# Architecture & expansion map

## Core
`app/Core` contains routing, database, authentication, sessions, CSRF, views and base controllers.

## Business modules
Each major feature should become a controller/model/view/service group. Recommended future modules:
- `CRM`: leads, opportunities, accounts, contacts, activities
- `Projects`: projects, tasks, milestones, resources, timesheets
- `ServiceDesk`: tickets, SLA, incidents, changes, knowledge base
- `Assets`: devices, software, licenses, assignments, maintenance
- `Procurement`: requests, quotations, purchase orders, suppliers, goods received
- `Finance`: invoices, expenses, budgets, approvals, payments
- `HC`: employee lifecycle, leave, attendance, performance, learning
- `Legal`: contracts, obligations, matters, renewals
- `Risk`: risk register, controls, audits, actions
- `Compliance`: policies, evidence, privacy requests, processing records
- `Notifications`: in-app + queued email
- `Reporting`: KPI widgets, scheduled reports, exports

## Configurable organization
The department -> unit -> feature structure is stored in database tables rather than hard-coded menus. Future admin screens can add/remove/disable these records and map permissions/features to roles.

## Time tracking
`login_sessions` stores every authenticated session. `user_activity` accumulates active seconds based on requests/heartbeats. For more precise browser activity, add a dedicated `/api/heartbeat` endpoint with visibility/focus events and a 30-60 second interval.