System Architecture (High-Level)

%%{init: { 'theme': 'base', 'themeVariables': { 'fontSize': '15px', 'lineColor': '#3B82F6' } }}%%
flowchart TB
  subgraph Clients["Browsers / Devices"]
    C1[Client - Anonymous]:::client
    C2[Counselor / Admin]:::staff
  end

  subgraph FE["Frontend Layer"]
    FA[ORISO-Frontend - Client portal]:::fe
    FB[ORISO-Admin - Staff console]:::fe
    FC[ORISO-Element - Chat UI]:::fe
  end

  subgraph Edge["Edge"]
    NG[Nginx Ingress - TLS]:::edge
  end

  subgraph Auth["Identity"]
    KC[Keycloak OIDC/OAuth2]:::auth
  end

  subgraph BE["Backend Microservices"]
    TS[TenantService :8081]:::svc
    US[UserService :8082]:::svc
    CTS[ConsultingTypeService :8083]:::svc
    AS[AgencyService :8084]:::svc
  end

  subgraph Comms["Communication"]
    MX[Matrix Synapse]:::matrix
    LK[LiveKit WebRTC]:::matrix
  end

  subgraph Data["Data Stores"]
    MA[(MariaDB)]:::db
    MO[(MongoDB)]:::db
    PG[(PostgreSQL - Synapse)]:::db
    RD[(Redis)]:::db
    RQ[(RabbitMQ)]:::db
  end

  Clients --> NG
  NG --> FA & FB & FC
  FA --> KC
  FB --> KC
  FA --> US
  FB --> AS
  FB --> TS
  FB --> CTS
  US --> KC
  AS --> KC
  TS --> KC
  CTS --> KC
  US <--> MX
  FC --> MX
  US --> LK
  US --> MA
  TS --> MA
  AS --> MA
  CTS --> MA
  CTS --> MO
  US & AS & TS & CTS --> RD
  US & TS --> RQ
  MX --> PG

  classDef client fill:#fde7f3,stroke:#c2185b
  classDef staff fill:#e3f2fd,stroke:#1565c0
  classDef fe fill:#fff3e0,stroke:#ef6c00
  classDef edge fill:#eeeeee,stroke:#616161
  classDef auth fill:#ffebee,stroke:#c62828
  classDef svc fill:#f3e5f5,stroke:#6a1b9a
  classDef matrix fill:#fff8e1,stroke:#f9a825
  classDef db fill:#e8f5e8,stroke:#2e7d32

anonymous, user, consultant, technical, group-chat-consultant,
user-admin, single-tenant-admin, tenant-admin,
agency-admin, restricted-agency-admin,
restricted-consultant-admin, supervisor-consultant,
topic-admin, notifications-technical

sequenceDiagram
  autonumber
  participant Cl as Client (browser)
  participant FE as ORISO-Frontend
  participant US as UserService
  participant KC as Keycloak
  participant AS as AgencyService
  participant MX as Matrix Synapse
  participant Co as Counselor (browser)

  Cl->>FE: Open live-chat link (?topic=debt)
  FE->>US: Issue anonymous user
  US->>KC: Create user with role anonymous
  KC-->>US: Token + pseudonym (random animal name)
  US-->>FE: Cookie session, ticket queued
  FE-->>Cl: Show Waiting Room (queue position, GDPR popup #1 = platform default)

  Note over US,AS: While client waits, ticket is visible to all counselors of matching agency/topic

  Co->>FE: Open Live Chat tab on Admin
  FE->>US: GET /live-chat/tickets
  US-->>FE: 3 tickets (oldest first)
  Co->>FE: Pick the oldest client
  FE->>US: POST /live-chat/accept (ticketId)
  US->>MX: Create encrypted room, invite both
  US->>FE: Push consent prompt to client (GDPR of counseling center)
  Cl->>FE: Click "Bestätigen" (Confirm)
  FE->>US: POST /live-chat/consent
  US-->>Co: Ticket promoted to active session
  Cl<<->>MX: Encrypted chat (E2EE via Element/ORISO-Element)
  Co<<->>MX: Encrypted chat
  Cl->>FE: Close chat / leave
  FE->>US: DELETE /live-chat/session
  US->>KC: Wipe anonymous user
  US->>MX: Tombstone room, schedule purge