# Project Atom — Complete Technical & Architecture Specification

## Architecture & Data Flow

### Authentication & Authorization
- **Student Auth**: Email/Password and Google OAuth 2.0 via Firebase Authentication.
- **Role System**: `student` and `admin` roles stored in Cloud Firestore `users` collection.
- **Approval Gate**: Student accounts require `status === 'approved'` set by department staff. Pending students see a professional status holding screen.

### Real-Time Firestore Data Collections
- `users`: `{ uid, full_name, student_id, email, programme, year_of_study, status, role, created_at }`
- `announcements`: `{ id, title, body, image_url, is_pinned, created_at, created_by }`
- `documents`: `{ id, title, type, file_url, file_size_bytes, description, download_count, uploaded_at }`
- `lab_sessions`: `{ id, name, instructor, location, max_capacity, enrolled_count, day_of_week, time_slot }`
- `lab_enrollments`: `{ id, student_uid, student_id, session_id, enrolled_at }`
- `timetable`: `{ id, course_code, course_title, venue, day_of_week, start_time, end_time, instructor }`
- `souvenirs`: `{ id, name, description, price_ghs, stock_quantity, is_available, image_url }`
- `orders`: `{ id, student_uid, student_id, student_name, student_email, items, total_amount_ghs, status, paystack_reference, created_at }`
- `complaints`: `{ id, student_uid, student_id, student_name, category, subject, description, status, has_unread_admin_reply, created_at }`
- `notifications`: `{ id, user_id, type, message, read, link, created_at }`

### Security Protocols & AI Integrity
- Security rules enforce auth constraints on Firestore.
- Large files (>500MB) are served via Hugging Face Hub with user prompts.
- Office Security Tokens renew every 60 seconds using time-based OTP hashing for administrative registrations.