Venue pins for checked-in friends + opt-in live location + opt-in auto check-in

[snackman]

Summary

• Venue pins: friends with an active check-in (not checked out; event live, or checked in within the last 3h) show at the event's lat/lng with a label like "Alex @ Founders Brunch". Several friends at one venue stack into one avatar group with a +N badge, and co-located events stack upward. Venue pins win over raw GPS for the same friend. Friend check-ins refresh every 2 min while the tab is visible, and again when the tab becomes visible.
• Live location is now opt-in: new toggle in the user menu, "Share my live location with friends" (default OFF). When it's off we never call geolocation for sharing and never upsert user_locations. Turning it off deletes your row (client delete, plus a DB trigger). When it's on, your location updates on enable and then every 5 min while the tab is visible.
• Auto check-in (opt-in): toggle "Auto check-in at events in my plan" (default OFF). It reuses the existing watchPosition (enableHighAccuracy: false; fixes are throttled to one every 10s and fixes with worse than 200m accuracy are ignored). After 90s within 150m of a live event in your plan, it inserts the check-in and shows the toast "You're at {event} — checked in" with Undo. Undo deletes the row, and falls back to a checkout if the delete isn't allowed. It skips events you already checked in to, and events you undid this session. The UI copy says it only works while plan.wtf is open.
• EventApp changes kept small: new useLocationSharing, useAutoCheckIn, pure lib/venue-pins.ts + lib/auto-checkin.ts (tested), VenueFriendMarker, AutoCheckInToast, LocationSettings. Removed the unused, deprecated useFriendLocations (it also did the non-consented upsert).
• No privacy page exists in the repo, so the explanation lives in the settings toggle copy.

⚠️ Migration: supabase/migrations/20261001130000_location_privacy_venue_pins.sql (NOT applied)

• Adds profiles.share_live_location and profiles.auto_check_in (boolean, default false).
• One-time cleanup: deletes ALL existing user_locations rows. Every row belongs to a user who hasn't opted in, because the new column defaults to false. These rows were collected on app open without consent.
• user_locations RLS: insert/update are only allowed while you've opted in, and you can now delete your own row. A trigger clears the row when sharing is turned off.
• Replaces get_friends_locations(): returns only friends who have opted in and whose location was updated in the last 2h. Restricted to authenticated.
• New get_friends_active_check_ins(): friends only, not checked out, last 12h. The client falls back to a direct check_ins query if the RPC is missing.
• Adds a delete-own policy on check_ins (needed for Undo) and an index on check_ins(created_at).
• The client is safe to deploy before the migration: profile is fetched with *, so a missing column reads as off. Toggles fail and revert until the migration is applied.

QA checklist (needs 2 signed-in accounts that are friends, A and B)

• Apply migration in staging; confirm user_locations is empty and the profile columns exist
• A (sharing off): open app → no user_locations row for A; B sees no GPS pin for A
• A turns sharing ON → row appears; B sees A's GPS pin (within 5 min / reload)
• A turns sharing OFF → A's row is deleted; B no longer sees A after refresh
• A checks in to a live event (manual) → within ~2 min B sees "A @ Event" pin at the venue (zoom ≥13 for label), not A's GPS pin
• A checks out → venue pin disappears on B's next refresh
• Two friends checked in to the same event → one stacked pin, "X +1 @ Event"
• A enables auto check-in, adds a live event to plan, stays within 150m for ~90s with app open → toast + check-in created
• Undo → check-in row deleted; staying there does not re-trigger this session
• Walking past (<90s in range) → no check-in
• Auto check-in off → nothing happens; manual Check In FAB still works
• Signed-out /kbw2026 renders normally

Verification

npm run lint (0 errors), npx tsc --noEmit, npm test (327 passed, incl. new dwell + venue-pin tests), npx next build passed; /kbw2026 returns 200 in next dev.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
sheeets	Ready	Preview	Oct 1, 2026 12:05pm UTC