SecureView

Secure, view-only PDF sharing with AES-256-GCM encryption, password protection, email-based access control, and watermarked viewing.

Architecture

Frontend (Next.js)          →        Backend (Express + TypeScript)
   Vercel                                   Render
                                              │
                                   ┌──────────┼──────────┐
                                   ▼                     ▼
                              Neon Postgres        Upstash Redis
                             (PDFs + data)        (sessions + rate limits)

PDFs are encrypted with AES-256-GCM and stored directly in PostgreSQL (bytea). No S3 or external object storage required.

Tech Stack

Backend — Node.js 20, Express, TypeScript, Prisma, Redis (ioredis), bcrypt, JWT, MuPDF (WASM), Sharp

Frontend — Next.js, React, TypeScript, Tailwind CSS, Zustand, Zod

Infrastructure — Neon Postgres, Upstash Redis, Render (API), Vercel (Web)

Security Features

• AES-256-GCM encryption — PDFs encrypted at rest with per-document keys and authenticated encryption
• Password-protected access — Every document secured with bcrypt-hashed passwords (min 8 chars)
• Email whitelist — Only authorized emails can access documents
• View-only rendering — Pages rendered as watermarked images on canvas (no PDF downloads)
• Watermarked viewing — Viewer email + timestamp burned into every page render
• httpOnly cookie auth — No tokens in localStorage; CSRF-resistant with sameSite: strict
• Rate limiting — Redis-backed with in-memory fallback (fails closed, not open)
• Session management — Time-limited JWT sessions with Redis backing + admin revocation
• Audit logging — Every access attempt and page view tracked
• Security headers — CSP, HSTS, X-Frame-Options, Permissions-Policy

Getting Started

Prerequisites

• Node.js 20+
• PostgreSQL (or Neon account)
• Redis (or Upstash account)

Local Development

# Clone
git clone https://github.com/artypratham/SecureView.git
cd SecureView

# Install all dependencies (monorepo workspaces)
npm install

# Configure environment
cp apps/api/.env.example apps/api/.env
cp apps/web/.env.example apps/web/.env
# Edit both .env files with your credentials

# Generate a secure encryption key
node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
# Copy the output into ENCRYPTION_MASTER_KEY in apps/api/.env

# Setup database
cd apps/api
npx prisma db push
cd ../..

# Run development servers
npm run dev:api   # Backend on :3001
npm run dev:web   # Frontend on :3000

Environment Variables

Backend (apps/api/.env)

Variable	Description	Example
DATABASE_URL	PostgreSQL connection string	postgresql://user:pass@host/db?sslmode=require
REDIS_URL	Redis connection string	rediss://default:xxx@host:6379
JWT_SECRET	Secret for signing JWTs (min 32 chars)	Random string
JWT_EXPIRY	Viewer session token expiry	15m
AUTH_TOKEN_EXPIRY	Admin auth token expiry	7d
ENCRYPTION_MASTER_KEY	AES-256 master key (64 hex chars)	node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
PORT	Server port	3001
NODE_ENV	Environment	production
CORS_ORIGINS	Allowed origins (comma-separated)	https://your-app.vercel.app

Frontend (apps/web/.env)

Variable	Description	Example
NEXT_PUBLIC_API_URL	Public API URL (used by browser)	https://secureview-api.onrender.com
API_INTERNAL_URL	Internal API URL (used by SSR/proxy)	Same as above for Vercel

API Endpoints

Auth

Method	Path	Description
POST	/api/auth/register	Register new user
POST	/api/auth/login	Login (sets httpOnly cookie)
GET	/api/auth/me	Get current user profile
POST	/api/auth/logout	Logout (clears cookie)

Documents

Method	Path	Description
POST	/api/documents	Upload PDF (multipart, max 50MB)
GET	/api/documents	List user's documents (paginated, max 100/page)
GET	/api/documents/:id	Get document details
PUT	/api/documents/:id	Update document settings
DELETE	/api/documents/:id	Delete document
POST	/api/documents/:id/emails	Add allowed emails
DELETE	/api/documents/:id/emails	Remove allowed email
GET	/api/documents/:id/audit-log	Get audit log (paginated)

Viewer

Method	Path	Description
POST	/api/view/:slug/verify	Verify access (email + password)
GET	/api/view/:slug/pages/:num	Get watermarked page image (PNG)
GET	/api/view/:slug/info	Get document info (name, page count)

Admin

Method	Path	Description
GET	/api/admin/dashboard	Dashboard stats
POST	/api/admin/documents/:id/revoke	Revoke all active sessions

Health

Method	Path	Description
GET	/api/health	Health check (DB + Redis status)

Testing

npm run test:api   # Backend tests
npm run test:web   # Frontend tests

---

Production Deployment

Step 1: Database (Neon Postgres)

1. Go to neon.tech and create a project
2. Create a database named secureview
3. Copy the connection string — you'll need it as DATABASE_URL

Step 2: Redis (Upstash)

1. Go to upstash.com and create a Redis database
2. Select a region close to your Render deployment (e.g., us-west-1 for Oregon)
3. Copy the rediss:// connection string — you'll need it as REDIS_URL

Step 3: Backend on Render

Option A: Blueprint (Recommended)

1. Push your code to GitHub
2. Go to render.com → New → Blueprint
3. Connect your GitHub repo
4. Render auto-detects apps/api/render.yaml
5. Fill in the environment variables marked sync: false:
   • DATABASE_URL — from Neon
   • REDIS_URL — from Upstash
   • ENCRYPTION_MASTER_KEY — generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
   • CORS_ORIGINS — your Vercel frontend URL (e.g., https://secureview.vercel.app)
6. Click Apply

Option B: Manual Setup

1. Go to render.com → New → Web Service
2. Connect your GitHub repo
3. Configure:
   • Name: secureview-api
   • Region: Oregon (or closest to your DB)
   • Runtime: Docker
   • Root Directory: apps/api
   • Dockerfile Path: ./Dockerfile
   • Plan: Starter ($7/mo) or higher
4. Add environment variables:

   NODE_ENV=production
   PORT=3001
   DATABASE_URL=<your-neon-connection-string>
   REDIS_URL=<your-upstash-redis-url>
   JWT_SECRET=<generate-random-32-char-string>
   JWT_EXPIRY=15m
   AUTH_TOKEN_EXPIRY=7d
   ENCRYPTION_MASTER_KEY=<generate-64-hex-chars>
   CORS_ORIGINS=https://your-app.vercel.app
   

5. Set Health Check Path to /api/health
6. Click Create Web Service

The Dockerfile automatically runs prisma migrate deploy on startup, so your database schema will be applied on first deploy.

Step 4: Frontend on Vercel

1. Go to vercel.com → Add New Project
2. Import your GitHub repo
3. Vercel auto-detects vercel.json — no framework/build settings changes needed
4. Add environment variables:

   NEXT_PUBLIC_API_URL=https://secureview-api.onrender.com
   API_INTERNAL_URL=https://secureview-api.onrender.com
   

   Replace secureview-api.onrender.com with your actual Render service URL.
5. Click Deploy

Step 5: Post-Deployment Checklist

• Visit https://your-api.onrender.com/api/health — should return {"status":"healthy"}
• Visit your Vercel frontend — should load the login page
• Register a new account, upload a PDF, verify viewing works
• Update CORS_ORIGINS on Render if your Vercel URL differs from what you initially set
• Ensure Render service is on Starter plan or higher (free tier sleeps after inactivity)

Custom Domain (Optional)

Render: Settings → Custom Domains → Add your API domain → Update DNS

Vercel: Settings → Domains → Add your frontend domain → Update DNS

After adding custom domains, update:

• CORS_ORIGINS on Render to include the new frontend domain
• NEXT_PUBLIC_API_URL and API_INTERNAL_URL on Vercel to the new API domain

License

MIT