PDF selling

byUtkarsh Raj

Act as a senior MERN Stack architect and full-stack developer. Help me build a production-ready Digital Document Marketplace where owners can upload and sell digital documents, and users can securely purchase and view them online. Project Overview Build a responsive web application using: - MongoDB - Express.js - React.js - Node.js - Tailwind CSS The application should be scalable, secure, modular, and deployment-ready. User Roles There are only two roles: - USER - OWNER Use the same Signup and Login pages for both roles. Every new account is created as a USER by default. I will manually change a user's role to OWNER directly in the database. There should be no public owner registration. After login: - OWNER → Owner Dashboard - USER → User Dashboard / Marketplace Implement proper authentication and role-based authorization. Authentication Implement: - JWT Authentication - HTTP-only Cookies - bcrypt Password Hashing - Protected Routes - Authentication & Authorization Middleware - Persistent Login - Logout - Secure Validation and Error Handling Owner Dashboard Owners can: - Upload documents - Edit documents - Delete documents - Publish/Unpublish documents - Set title, description, category, tags, thumbnail - Set document price (INR) - Mark document as Free or Paid - View uploaded documents - View purchases and revenue - View customers who purchased their documents Each owner should only manage their own uploaded documents. Supported File Types Owners can upload documents such as: - PDF - DOC/DOCX - XLS/XLSX - PPT/PPTX - Markdown (.md) - TXT - Other safe document formats Validate file type, extension, MIME type, size, and reject unsafe files. Secure Online Viewer Purchased documents should only be viewable inside the web application. Users must not receive the original file. Use a secure document viewer: - PDF → PDF.js or equivalent - Other formats → convert to browser-viewable format when required Store original files privately. Only: - Owner - Purchased User can access the complete document. Non-purchasers should only see: - Thumbnail - Title - Description - Price - Limited preview (optional) Download Protection The platform should be designed for online viewing only. Do not expose the original file URL or provide a download button. Implement reasonable protection including: - Authenticated document streaming - Temporary signed URLs - Dynamic watermark - Access validation - Access logs - Session validation Understand that browsers cannot completely prevent screenshots or screen recording. Marketplace Users can: - Browse documents - Search - Filter - Sort - View details - Purchase documents - Access free documents - View My Library - View purchased documents online - View purchase history A paid document must remain locked until payment is successfully verified. Payment Primary currency: INR. Use Razorpay (preferred) for: - UPI - Cards - Net Banking - Wallets Keep payment architecture flexible so Stripe can be added later. Payment Flow: 1. User clicks Buy. 2. Backend creates payment order. 3. User completes payment. 4. Backend verifies payment. 5. Store purchase record. 6. Grant access. 7. Add document to My Library. Never trust frontend payment success. Handle: - Success - Failure - Cancellation - Duplicate payments - Duplicate webhooks - Refunds - Invalid signatures Security Implement: - Helmet - CORS - Rate Limiting - Secure Cookies - Environment Variables - Centralized Error Handling - Strong Validation - File Upload Validation - Private File Storage - Payment Verification - Role-Based Authorization - Audit Logs Prevent unauthorized document access and direct file exposure. Deployment Prepare for production deployment using: - React on Vercel/Netlify/Render - Node.js Backend on Render/Railway/AWS - MongoDB Atlas - Private Cloud Storage (AWS S3 or Cloudflare R2 preferred) - Razorpay Payment Gateway Configure: - HTTPS - Environment Variables - Production CORS - Secure Cookies - Logging - Monitoring - Backup Strategy Development Rules Do not generate the complete project at once. Build the project phase-by-phase. For every phase: - Explain what is being built. - Explain why it is needed. - Explain technical terms simply. - Mention alternatives where appropriate. - Write production-quality, modular code. - Follow best practices. - Include validation, authorization, security, and proper error handling. Do not change the business workflow unless necessary, and always explain why before making changes. Start by understanding the requirements, then design the architecture, define APIs, and finally implement the project step by step until deployment.