diff --git a/app/api/users/route.ts b/app/api/users/route.ts
index 47a2e36..a8600a9 100644
--- a/app/api/users/route.ts
+++ b/app/api/users/route.ts
@@ -6,16 +6,22 @@
  * It includes handlers for fetching all users and creating new users.
  */
 
-'use server'
+"use server";
 
-import { NextResponse} from "next/server";
+import { NextResponse } from "next/server";
 import { z } from "zod";
-import { getUsers, createUser } from "@/services/user";
 
-// Define a Zod schema for validating new user creation requests
+import { auth } from "@/auth";
+import { createUser, getUserByEmail, getUsers } from "@/services/user";
+
+// Validation for new-user creation. ucsdId is optional because Google OAuth
+// can't give us a real PID — users can fill it in later from their profile.
 const userCreateSchema = z.object({
-    ucsdId: z.string().min(1),
-    email: z.string().email().regex(/@ucsd\.edu$/, "Must be a UCSD email"),
+    ucsdId: z.string().min(1).optional(),
+    email: z
+        .string()
+        .email()
+        .regex(/@ucsd\.edu$/, "Must be a UCSD email"),
     name: z.object({
         first: z.string().min(1),
         last: z.string().min(1),
@@ -27,32 +33,75 @@ const userCreateSchema = z.object({
  * Fetch all users
  * @return response with user data
  */
-export async function GET(){
+export async function GET() {
     try {
         const users = await getUsers();
         return NextResponse.json(users, { status: 200 });
-    }
-    catch (err){
+    } catch (err) {
         console.error(err);
-        return NextResponse.json({ message: "Internal server error" }, {status: 500});
+        return NextResponse.json(
+            { message: "Internal server error" },
+            { status: 500 },
+        );
     }
 }
 
 /**
- * Create a new user
- * @param request request object
- * @return response after creating new user
+ * Create a new user.
+ *
+ * Used by the onboarding flow after Google sign-in: takes the Google email
+ * from the authenticated session, the role the user selected from the enum
+ * (PI / LAB_MANAGER / RESEARCHER / VIEWER), and the name (pre-filled from
+ * Google but editable).
  */
 export async function POST(request: Request) {
     try {
+        const session = await auth();
+        if (!session?.user?.email) {
+            return NextResponse.json(
+                { message: "Not authenticated" },
+                { status: 401 },
+            );
+        }
+
         const parsed = userCreateSchema.safeParse(await request.json());
-        if (parsed.success === false){
-            return NextResponse.json({ message: "Invalid data "}, {status: 400});
+        if (parsed.success === false) {
+            return NextResponse.json(
+                { message: "Invalid data", issues: parsed.error.flatten() },
+                { status: 400 },
+            );
         }
-        const newUser = await createUser(parsed.data);
+
+        // Users can only create an account for themselves
+        if (
+            parsed.data.email.toLowerCase() !==
+            session.user.email.toLowerCase()
+        ) {
+            return NextResponse.json(
+                { message: "Email does not match signed-in user" },
+                { status: 403 },
+            );
+        }
+
+        // Prevent duplicate user docs if onboarding is submitted twice
+        const existing = await getUserByEmail(parsed.data.email);
+        if (existing) {
+            return NextResponse.json(
+                { message: "User already exists" },
+                { status: 409 },
+            );
+        }
+
+        const newUser = await createUser({
+            ...parsed.data,
+            lastLoginAt: new Date(),
+        });
         return NextResponse.json(newUser, { status: 201 });
     } catch (err) {
         console.error(err);
-        return NextResponse.json({ message: "Internal server error " }, {status: 500});
+        return NextResponse.json(
+            { message: "Internal server error" },
+            { status: 500 },
+        );
     }
-}
\ No newline at end of file
+}
diff --git a/app/layout.tsx b/app/layout.tsx
index f116187..c745ff8 100644
--- a/app/layout.tsx
+++ b/app/layout.tsx
@@ -1,6 +1,7 @@
 import type { Metadata } from "next";
 import localFont from "next/font/local";
 
+import Providers from "@/components/Providers";
 import "./globals.css";
 
 const geistSans = localFont({
@@ -27,7 +28,7 @@ export default function RootLayout({
     return (
         <html lang="en">
             <body className={`${geistSans.variable} ${geistMono.variable} antialiased`}>
-                {children}
+                <Providers>{children}</Providers>
             </body>
         </html>
     );
diff --git a/app/login/page.tsx b/app/login/page.tsx
index 94bcef2..6aab20a 100644
--- a/app/login/page.tsx
+++ b/app/login/page.tsx
@@ -114,7 +114,7 @@ export default function SignInPage() {
         {/* SSO Sign In Button */}
         <button
           type="button"
-          onClick = {() => signIn("google", { callbackUrl: "/"})}
+          onClick = {() => signIn("google", { callbackUrl: "/onboarding"})}
           className="w-full bg-[#5d8cb9] hover:bg-[#4f7ca6] text-white font-medium py-2.5 rounded-md border border-[#3b5e7d] transition-colors shadow-sm"
         >
           Sign in with UCSD SSO
diff --git a/app/onboarding/page.tsx b/app/onboarding/page.tsx
new file mode 100644
index 0000000..0d32310
--- /dev/null
+++ b/app/onboarding/page.tsx
@@ -0,0 +1,234 @@
+"use client";
+
+import { useEffect, useMemo, useState } from "react";
+import { useRouter } from "next/navigation";
+import { signOut, useSession } from "next-auth/react";
+
+import type { Role } from "@/models/User";
+
+const ROLES: { value: Role; label: string }[] = [
+    { value: "PI", label: "Principal Investigator (PI)" },
+    { value: "LAB_MANAGER", label: "Lab Manager" },
+    { value: "RESEARCHER", label: "Researcher" },
+    { value: "VIEWER", label: "Viewer" },
+];
+
+/**
+ * Split a Google "name" string into first/last. Falls back to using the whole
+ * thing as `first` if there's only one word.
+ */
+function splitName(full: string): { first: string; last: string } {
+    const trimmed = full.trim();
+    if (!trimmed) return { first: "", last: "" };
+    const parts = trimmed.split(/\s+/);
+    if (parts.length === 1) return { first: parts[0], last: "" };
+    return {
+        first: parts[0],
+        last: parts.slice(1).join(" "),
+    };
+}
+
+export default function OnboardingPage() {
+    const router = useRouter();
+    const { data: session, status, update } = useSession();
+
+    const initialNames = useMemo(() => {
+        const source = session?.user?.googleName ?? session?.user?.name ?? "";
+        return splitName(source);
+    }, [session?.user?.googleName, session?.user?.name]);
+
+    const [firstName, setFirstName] = useState("");
+    const [lastName, setLastName] = useState("");
+    const [role, setRole] = useState<Role | "">("");
+    const [submitting, setSubmitting] = useState(false);
+    const [success, setSuccess] = useState(false);
+    const [error, setError] = useState<string | null>(null);
+
+    // Warm up the marketplace route so the post-submit navigation feels instant
+    useEffect(() => {
+        router.prefetch("/marketplace");
+    }, [router]);
+
+    // Seed the name fields once the session is available
+    useEffect(() => {
+        if (status === "authenticated") {
+            setFirstName((prev) => prev || initialNames.first);
+            setLastName((prev) => prev || initialNames.last);
+        }
+    }, [status, initialNames.first, initialNames.last]);
+
+    // Redirect already-onboarded users out of this page
+    useEffect(() => {
+        if (status === "unauthenticated") {
+            router.replace("/login");
+            return;
+        }
+        if (
+            status === "authenticated" &&
+            session?.user?.needsOnboarding === false
+        ) {
+            router.replace("/");
+        }
+    }, [status, session?.user?.needsOnboarding, router]);
+
+    if (status === "loading") {
+        return (
+            <main className="min-h-screen flex items-center justify-center bg-[#f8f9fa]">
+                <p className="text-gray-500">Loading…</p>
+            </main>
+        );
+    }
+
+    const handleSubmit = async (event: React.FormEvent<HTMLFormElement>) => {
+        event.preventDefault();
+        setError(null);
+
+        if (!session?.user?.email) {
+            setError("No session found. Please sign in again.");
+            return;
+        }
+        if (!role) {
+            setError("Please select your role.");
+            return;
+        }
+        if (!firstName.trim() || !lastName.trim()) {
+            setError("First and last name are required.");
+            return;
+        }
+
+        setSubmitting(true);
+        try {
+            const response = await fetch("/api/users", {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({
+                    email: session.user.email,
+                    name: {
+                        first: firstName.trim(),
+                        last: lastName.trim(),
+                    },
+                    role,
+                }),
+            });
+
+            if (!response.ok) {
+                const data = await response.json().catch(() => ({}));
+                throw new Error(data?.message ?? "Failed to create account.");
+            }
+
+            // Refresh the session so needsOnboarding flips to false.
+            await update();
+
+            // Show the welcome interstitial briefly, then do a full-page
+            // navigation so middleware sees the updated cookie.
+            setSuccess(true);
+            setTimeout(() => {
+                window.location.assign("/marketplace");
+            }, 700);
+        } catch (err) {
+            setError(err instanceof Error ? err.message : "Unknown error");
+            setSubmitting(false);
+        }
+    };
+
+    if (success) {
+        return (
+            <main className="min-h-screen bg-[#f8f9fa] flex flex-col items-center justify-center font-sans px-4 py-10">
+                <div className="bg-white w-full max-w-[480px] rounded-xl shadow-[0_4px_24px_rgba(0,0,0,0.06)] p-10 border border-gray-100 flex flex-col items-center text-center">
+                    <div className="w-12 h-12 rounded-full border-2 border-[#ea7032]/30 border-t-[#ea7032] animate-spin mb-5" />
+                    <h1 className="text-[22px] font-semibold text-gray-900 mb-2">
+                        Welcome, {firstName.trim() || "there"}!
+                    </h1>
+                    <p className="text-[14px] text-gray-500">
+                        Taking you to the marketplace…
+                    </p>
+                </div>
+            </main>
+        );
+    }
+
+    return (
+        <main className="min-h-screen bg-[#f8f9fa] flex flex-col items-center justify-center font-sans px-4 py-10">
+            <div className="bg-white w-full max-w-[480px] rounded-xl shadow-[0_4px_24px_rgba(0,0,0,0.06)] p-8 border border-gray-100">
+                <h1 className="text-[24px] font-semibold text-center text-gray-900 mb-2">
+                    Finish setting up your account
+                </h1>
+                <p className="text-center text-[14px] text-gray-500 mb-6">
+                    {session?.user?.email
+                        ? `Signed in as ${session.user.email}`
+                        : "Tell us a little about yourself"}
+                </p>
+
+                <form onSubmit={handleSubmit} className="space-y-5">
+                    <div className="grid grid-cols-2 gap-3">
+                        <div className="space-y-1.5">
+                            <label className="block text-sm font-medium text-gray-700">
+                                First name
+                            </label>
+                            <input
+                                type="text"
+                                value={firstName}
+                                onChange={(e) => setFirstName(e.target.value)}
+                                required
+                                className="block w-full px-3 py-2.5 rounded-md bg-[#f3f4f6] text-gray-900 focus:bg-white focus:ring-2 focus:ring-[#ea7032]/50 outline-none transition-colors sm:text-sm"
+                            />
+                        </div>
+                        <div className="space-y-1.5">
+                            <label className="block text-sm font-medium text-gray-700">
+                                Last name
+                            </label>
+                            <input
+                                type="text"
+                                value={lastName}
+                                onChange={(e) => setLastName(e.target.value)}
+                                required
+                                className="block w-full px-3 py-2.5 rounded-md bg-[#f3f4f6] text-gray-900 focus:bg-white focus:ring-2 focus:ring-[#ea7032]/50 outline-none transition-colors sm:text-sm"
+                            />
+                        </div>
+                    </div>
+
+                    <div className="space-y-1.5">
+                        <label className="block text-sm font-medium text-gray-700">
+                            Your role in the lab
+                        </label>
+                        <select
+                            value={role}
+                            onChange={(e) => setRole(e.target.value as Role)}
+                            required
+                            className="block w-full px-3 py-2.5 rounded-md bg-[#f3f4f6] text-gray-900 focus:bg-white focus:ring-2 focus:ring-[#ea7032]/50 outline-none transition-colors sm:text-sm"
+                        >
+                            <option value="" disabled>
+                                Select a role
+                            </option>
+                            {ROLES.map((opt) => (
+                                <option key={opt.value} value={opt.value}>
+                                    {opt.label}
+                                </option>
+                            ))}
+                        </select>
+                    </div>
+
+                    {error ? (
+                        <p className="text-sm text-red-600">{error}</p>
+                    ) : null}
+
+                    <button
+                        type="submit"
+                        disabled={submitting}
+                        className="w-full bg-[#ea7032] hover:bg-[#d8642a] disabled:opacity-60 text-white font-medium py-2.5 rounded-md border border-[#c45a23] transition-colors shadow-sm"
+                    >
+                        {submitting ? "Creating account…" : "Create account"}
+                    </button>
+
+                    <button
+                        type="button"
+                        onClick={() => signOut({ callbackUrl: "/login" })}
+                        className="w-full bg-white text-gray-600 font-medium py-2 rounded-md border border-gray-200 hover:bg-gray-50 transition-colors text-sm"
+                    >
+                        Cancel and sign out
+                    </button>
+                </form>
+            </div>
+        </main>
+    );
+}
diff --git a/app/signup/page.tsx b/app/signup/page.tsx
index 8534e57..ae5716b 100644
--- a/app/signup/page.tsx
+++ b/app/signup/page.tsx
@@ -33,7 +33,7 @@ export default function SignUpPage() {
         {/* sign in */}
         <button
           type="button"
-          onClick={() => signIn("google", { callbackUrl: "/" })}
+          onClick={() => signIn("google", { callbackUrl: "/onboarding" })}
           className="w-full bg-[#5d8cb9] hover:bg-[#4f7ca6] text-white font-medium py-2.5 rounded-md border border-[#3b5e7d] transition-colors shadow-sm"
         >
           Sign up with UCSD SSO
diff --git a/auth.ts b/auth.ts
index d0d7d0b..c18b274 100644
--- a/auth.ts
+++ b/auth.ts
@@ -1,19 +1,76 @@
 import NextAuth from "next-auth";
 import GoogleProvider from "next-auth/providers/google";
+import { getUserByEmail, updateUser } from "@/services/user";
 
 // How will we log users in, and how do we remember them?
 
 export const { handlers, auth, signIn, signOut } = NextAuth({
     providers: [
         GoogleProvider({
-            clientId:
-            process.env.GOOGLE_CLIENT_ID!,
-            clientSecret:
-            process.env.GOOGLE_CLIENT_SECRET!,
+            clientId: process.env.GOOGLE_CLIENT_ID!,
+            clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
         }),
     ],
     session: {
         strategy: "jwt",
     },
     secret: process.env.NEXTAUTH_SECRET,
-});
\ No newline at end of file
+    callbacks: {
+        // Only allow @ucsd.edu emails to sign in
+        async signIn({ user }) {
+            if (!user.email?.endsWith("@ucsd.edu")) {
+                return false;
+            }
+            return true;
+        },
+
+        // Runs on every JWT read. Refresh from the DB on first sign-in, when
+        // the client calls `update()` after submitting onboarding, OR whenever
+        // the token still says the user needs onboarding (so the very next
+        // request after account creation flips the flag even if `update()`
+        // didn't propagate the cookie in time).
+        async jwt({ token, user, trigger }) {
+            const isFirstSignIn = !!user?.email;
+            const isClientUpdate = trigger === "update";
+            const pendingOnboarding = token.needsOnboarding === true;
+            if (!isFirstSignIn && !isClientUpdate && !pendingOnboarding) {
+                return token;
+            }
+
+            const email = user?.email ?? token.email;
+            if (!email) {
+                return token;
+            }
+
+            const dbUser = await getUserByEmail(email);
+            if (dbUser) {
+                token.userId = String(dbUser._id);
+                token.role = dbUser.role;
+                token.needsOnboarding = false;
+                if (isFirstSignIn) {
+                    await updateUser(String(dbUser._id), {
+                        lastLoginAt: new Date(),
+                    });
+                }
+            } else {
+                token.needsOnboarding = true;
+                if (isFirstSignIn && user) {
+                    token.googleName = user.name ?? "";
+                    token.picture = user.image ?? "";
+                }
+            }
+            return token;
+        },
+
+        // Expose the token data to the client via useSession()
+        async session({ session, token }) {
+            if (session.user) {
+                session.user.userId = token.userId;
+                session.user.role = token.role;
+                session.user.needsOnboarding = token.needsOnboarding;
+                session.user.googleName = token.googleName;
+            }
+            return session;
+        },
+    },
+});
diff --git a/components/Providers.tsx b/components/Providers.tsx
new file mode 100644
index 0000000..1763538
--- /dev/null
+++ b/components/Providers.tsx
@@ -0,0 +1,12 @@
+"use client";
+
+import { SessionProvider } from "next-auth/react";
+import type { ReactNode } from "react";
+
+/**
+ * Client-side context providers (e.g. NextAuth's SessionProvider).
+ * Required for `useSession()` to work in client components.
+ */
+export default function Providers({ children }: { children: ReactNode }) {
+    return <SessionProvider>{children}</SessionProvider>;
+}
diff --git a/middleware.ts b/middleware.ts
new file mode 100644
index 0000000..4d087cf
--- /dev/null
+++ b/middleware.ts
@@ -0,0 +1,50 @@
+import { NextResponse } from "next/server";
+import type { NextRequest } from "next/server";
+import { getToken } from "next-auth/jwt";
+
+/**
+ * Route guard:
+ * - Signed-in users with `needsOnboarding === true` must go to /onboarding
+ *   before they can use the rest of the app.
+ * - Signed-in users who've finished onboarding shouldn't see /onboarding.
+ *
+ * Public routes (login, signup, NextAuth endpoints, static assets) are skipped
+ * via the matcher below.
+ */
+export async function middleware(req: NextRequest) {
+    const token = await getToken({
+        req,
+        secret: process.env.NEXTAUTH_SECRET,
+    });
+
+    const { pathname } = req.nextUrl;
+
+    // Not signed in → let the page handle it (most pages will redirect to /login on their own)
+    if (!token) {
+        return NextResponse.next();
+    }
+
+    const needsOnboarding = token.needsOnboarding === true;
+
+    if (needsOnboarding && pathname !== "/onboarding") {
+        const url = req.nextUrl.clone();
+        url.pathname = "/onboarding";
+        return NextResponse.redirect(url);
+    }
+
+    if (!needsOnboarding && pathname === "/onboarding") {
+        const url = req.nextUrl.clone();
+        url.pathname = "/";
+        return NextResponse.redirect(url);
+    }
+
+    return NextResponse.next();
+}
+
+export const config = {
+    // Run on everything except API routes, NextAuth endpoints, login/signup,
+    // Next.js internals, and static files.
+    matcher: [
+        "/((?!api|_next/static|_next/image|favicon.ico|login|signup|.*\\..*).*)",
+    ],
+};
diff --git a/models/User.ts b/models/User.ts
index a312097..5f511f0 100644
--- a/models/User.ts
+++ b/models/User.ts
@@ -1,105 +1,105 @@
-import mongoose, { Schema, Document, Types } from "mongoose";
-
-export type Role = "PI" | "LAB_MANAGER" | "RESEARCHER" | "VIEWER";
-export type Status = "ACTIVE" | "INACTIVE" | "SUSPENDED";
-
-// describes what one lab membership looks like
-export interface ILabMembership {
-    labId: Types.ObjectId;
-    role: Role;
-}
-
-// shape of a user document in mongodb
-export interface IUser extends Document {
-    ucsdId: string; // ucsd pid
-    email: string; // ucsd email
-    name: {
-        first: string;
-        last: string;
-    };
-    role: Role;
-    labs: ILabMembership[];
-    notificationPreferences: {
-        email: boolean;
-        sms: boolean;
-        inApp: boolean;
-    };
-    safety: {
-        trainingCompleted: string[];
-        clearanceLevel: string;
-        lastReviewedAt: Date;
-    };
-    profile: {
-        title: string;
-        department: string;
-        phone: string;
-    }
-    status: Status;
-    createdAt: Date;
-    lastLoginAt: Date;
-}
-
-// mongoose schema to valid the data
-const userSchema = new Schema<IUser>({
-
-    ucsdId: { type: String, required: true, unique: true }, // ucsd pid
-    email: { type: String, required: true, unique: true, trim: true, lowercase: true,
-        match:[/^\S+@ucsd\.edu$/, "Must be a valid UCSD email (@ucsd.edu)"],
-    }, // ucsd email
-
-    name: {
-        first: { type: String, required: true },
-        last: { type: String, required: true },
-    },
-    role: { // global role - enum restricts to only these 4 valid roles
-        type: String,
-        enum: ["PI", "LAB_MANAGER", "RESEARCHER", "VIEWER"],
-        required: true,
-    },
-    
-    // each entry represents membership in one lab
-
-    labs: [
-        {
-            labId: { type: Schema.Types.ObjectId, ref: "Lab", required: true },
-            role: {
-                type: String,
-                enum: ["PI", "LAB_MANAGER", "RESEARCHER", "VIEWER"],
-                required: true,
-            },
-        },
-    ],
-    notificationPreferences: { // default notification preferences
-        email: { type: Boolean, default: true },
-        inApp: { type: Boolean, default: true },
-        sms: { type: Boolean, default: false },
-    },
-
-    // checks for if you completed training and if you are cleared
-    safety: {
-        trainingCompleted: [{ type: String }],
-        clearanceLevel: { type: String },
-        lastReviewedAt: { type: Date },
-    },
-
-    profile: {
-        title: { type: String },
-        department: { type: String },
-        phone: { type: String },
-    },
-    status: {
-        type: String,
-        enum: ["ACTIVE", "INACTIVE", "SUSPENDED"],
-        default: "ACTIVE",
-    },
-    lastLoginAt: { type: Date },
-
-},
-{
-    timestamps: true,
-});
-userSchema.index({"labs.labId": 1});
-
-
-//creates and exports the mongoose model
-export const User = mongoose.models.User || mongoose.model<IUser>("User", userSchema);
\ No newline at end of file
+import mongoose, { Schema, Document, Types } from "mongoose";
+
+export type Role = "PI" | "LAB_MANAGER" | "RESEARCHER" | "VIEWER";
+export type Status = "ACTIVE" | "INACTIVE" | "SUSPENDED";
+
+// describes what one lab membership looks like
+export interface ILabMembership {
+    labId: Types.ObjectId;
+    role: Role;
+}
+
+// shape of a user document in mongodb
+export interface IUser extends Document {
+    ucsdId?: string; // ucsd pid
+    email: string; // ucsd email
+    name: {
+        first: string;
+        last: string;
+    };
+    role: Role;
+    labs: ILabMembership[];
+    notificationPreferences: {
+        email: boolean;
+        sms: boolean;
+        inApp: boolean;
+    };
+    safety: {
+        trainingCompleted: string[];
+        clearanceLevel: string;
+        lastReviewedAt: Date;
+    };
+    profile: {
+        title: string;
+        department: string;
+        phone: string;
+    }
+    status: Status;
+    createdAt: Date;
+    lastLoginAt: Date;
+}
+
+// mongoose schema to valid the data
+const userSchema = new Schema<IUser>({
+
+    ucsdId: { type: String, required: false, unique: true, sparse: true }, // ucsd pid optional since we can't get it from googe
+    email: { type: String, required: true, unique: true, trim: true, lowercase: true,
+        match:[/^\S+@ucsd\.edu$/, "Must be a valid UCSD email (@ucsd.edu)"],
+    }, // ucsd email
+
+    name: {
+        first: { type: String, required: true },
+        last: { type: String, required: true },
+    },
+    role: { // global role - enum restricts to only these 4 valid roles
+        type: String,
+        enum: ["PI", "LAB_MANAGER", "RESEARCHER", "VIEWER"],
+        required: true,
+    },
+
+    // each entry represents membership in one lab
+
+    labs: [
+        {
+            labId: { type: Schema.Types.ObjectId, ref: "Lab", required: true },
+            role: {
+                type: String,
+                enum: ["PI", "LAB_MANAGER", "RESEARCHER", "VIEWER"],
+                required: true,
+            },
+        },
+    ],
+    notificationPreferences: { // default notification preferences
+        email: { type: Boolean, default: true },
+        inApp: { type: Boolean, default: true },
+        sms: { type: Boolean, default: false },
+    },
+
+    // checks for if you completed training and if you are cleared
+    safety: {
+        trainingCompleted: [{ type: String }],
+        clearanceLevel: { type: String },
+        lastReviewedAt: { type: Date },
+    },
+
+    profile: {
+        title: { type: String },
+        department: { type: String },
+        phone: { type: String },
+    },
+    status: {
+        type: String,
+        enum: ["ACTIVE", "INACTIVE", "SUSPENDED"],
+        default: "ACTIVE",
+    },
+    lastLoginAt: { type: Date },
+
+},
+{
+    timestamps: true,
+});
+userSchema.index({"labs.labId": 1});
+
+
+//creates and exports the mongoose model
+export const User = mongoose.models.User || mongoose.model<IUser>("User", userSchema);
diff --git a/types/next-auth.d.ts b/types/next-auth.d.ts
new file mode 100644
index 0000000..96fa8b2
--- /dev/null
+++ b/types/next-auth.d.ts
@@ -0,0 +1,28 @@
+import "next-auth";
+import "next-auth/jwt";
+import type { Role } from "@/models/User";
+
+// Extend the built-in Session type so session.user has our custom fields
+declare module "next-auth" {
+    interface Session {
+        user: {
+            name?: string | null;
+            email?: string | null;
+            image?: string | null;
+            userId?: string;
+            role?: Role;
+            needsOnboarding?: boolean;
+            googleName?: string;
+        };
+    }
+}
+
+// Extend the built-in JWT type so token.* has our custom fields
+declare module "next-auth/jwt" {
+    interface JWT {
+        userId?: string;
+        role?: Role;
+        needsOnboarding?: boolean;
+        googleName?: string;
+    }
+}