This piece of code is taken from my Employee-Attendance-System mobile application from the backend (Nodejs) which is open source on my GitHub.

code.js

static async signInRoute(req, res) {
        // empID should be extracted from the AUTH token provided by the client-side
        const { site_token } = req.params
        const isObjectID = /^[0-9a-fA-F]{24}$/
        const site = decode(site_token);
        // if not a valid object id
        if (!isObjectID.test(site._id)) return res.status(400).send()

        const site_id = site._id;
        //! for testing
        req.body = { empID: '5d99b512cd08403c9446cf92', ...req.body }
        const { time, empID } = req.body

        try {
            const response = await CRUD.getOne(Emp, '', { _id: empID }) // autopopulate on
            // if the employee was not found
            if (!response) return res.status(403).send(response)

            const currentSession = await this.getCurrentSession(site_id, empID);

            if (!!currentSession) {
                console.log('Already Signed In', currentSession)
                return res.status(200).send({ message: 'Already Signed In', employee: currentSession, siteDetails: site })
            } else {
                console.log('Should Sign in')
                const { status, message } = await this.signIn(site_id, req.body)
                console.log(response)
                return res.status(status).send({ message, employee: response, siteDetails: site })
            }
        }
        catch (e) {
            console.log('error: ', e)
        }
    }

Explanation:

The user has to sign in to the company by scanning a QR code, that QR code has a JWT string which when decoded contains the office id (a company might have multiple offices), after scanning it would send that string to a controller on the backend which first checks if it's a valid JWT string and then check if the user was already signed in by looking at the attendance database records if he/she is then it should do nothing. if the user is not signed in, it would create a new object in the Attendance schema to record that event.