Enforce browser location for geo fenced attendance

app/modules/employees/service.py

@@ -952,6 +952,27 @@ def _ip_matches_allowed(ip_value: str | None, allowed_csv: str | None) -> tuple[
     return False, "invalid_ip_rule" if invalid_rule_found else "outside_allowed_ip"
 
 
+def _attendance_geo_is_enforced(settings: BranchSettings | None) -> bool:
+    """Return True when branch GPS geofence is configured and must be captured by browser."""
+    if not settings or not bool(getattr(settings, "attendance_geo_enabled", False)):
+        return False
+    return _to_float(getattr(settings, "latitude", None)) is not None and _to_float(getattr(settings, "longitude", None)) is not None
+
+
+def _raise_if_required_geo_missing(settings: BranchSettings | None, evaluation: dict[str, Any]) -> None:
+    """Block self-attendance when geofencing is enabled but browser location is missing/invalid."""
+    if not _attendance_geo_is_enforced(settings):
+        return
+    if evaluation.get("geo_status") in {"location_missing", "invalid_location"}:
+        raise HTTPException(
+            status_code=400,
+            detail=(
+                "Location is required for attendance because branch geo-fencing is enabled. "
+                "Please allow browser location/GPS and try again."
+            ),
+        )
+
+
 def _evaluate_attendance_controls(
     db: Session,
     *,
@@ -1071,6 +1092,7 @@ def punch_in_attendance(
         longitude=longitude,
         client_ip=client_ip,
     )
+    _raise_if_required_geo_missing(branch_settings, evaluation)
     timing = _evaluate_attendance_timing(branch, branch_settings, local_dt)
     final_status = evaluation["status"] if evaluation["approval_status"] == "pending" else timing["status"]
     punch_remarks = _blank_to_none(remarks)
@@ -1166,6 +1188,7 @@ def punch_out_attendance(
         longitude=longitude,
         client_ip=client_ip,
     )
+    _raise_if_required_geo_missing(branch_settings, evaluation)
     row.punch_out_utc = now
     row.punch_out_local_at = local_dt
     row.branch_timezone = row.branch_timezone or branch_tz