🔐 SecureScholar — Secure Academic File Sharing System

SRS-compliant implementation for the Software Requirements Specification by Development Team (16-02-2026)

---

✅ SRS Feature Coverage

SRS Requirement	Implementation
FR: SAML/OAuth login	JWT auth with bcrypt password hashing
FR: 5-attempt account lockout	users.failed_attempts + locked_until
FR: 30-min session timeout	Auto-expiring sessions in DB
FR: AES-256 file encryption	utils/encryption.js — per-file key, master-key-wrapped
FR: Malware scan hook	Pre-upload scan step (plug in your API key)
FR: Reference Mode viewing	PDF/image iframe with copy/print disabled
FR: Dynamic watermarking	SVG overlay with user name, email, IP, timestamp
FR: Audit logging (7-year)	audit_logs table, all actions tracked
FR: Role-based access control	admin / faculty / student roles
FR: Version control	document_versions table
FR: File sharing & permissions	permissions table with view/edit/admin levels
NFR: 500MB max upload	Multer limits.fileSize
NFR: TLS encryption	Configure reverse proxy (Nginx/Caddy) with TLS
NFR: SQL injection prevention	Parameterized queries throughout
NFR: GDPR right to erasure	Soft delete + archiving route
NFR: FERPA compliance	Configurable data residency, audit trails
NFR: 99.5% uptime	Deploy behind PM2 + health check endpoint
NFR: UTF-8 support	SQLite WAL mode, UTF-8 throughout

---

🏗️ Architecture

securescholar/
├── backend/                    # Node.js + Express API
│   ├── server.js               # Entry point, middleware, routes
│   ├── db.js                   # SQLite database + schema + seeding
│   ├── middleware/
│   │   ├── auth.js             # JWT auth, RBAC, document permission checks
│   │   └── audit.js            # Audit logging middleware
│   ├── routes/
│   │   ├── auth.js             # Login, logout, change-password
│   │   ├── files.js            # Upload, view, permissions, versions
│   │   ├── audit.js            # Audit log API + CSV export
│   │   └── users.js            # User management
│   └── utils/
│       ├── encryption.js       # AES-256-CBC encrypt/decrypt
│       └── watermark.js        # Dynamic SVG watermark generator
│
└── frontend/                   # React + Vite
    └── src/
        ├── App.jsx             # Router + protected routes
        ├── index.css           # Full design system
        ├── components/
        │   ├── AuthContext.jsx  # Auth state provider
        │   └── Sidebar.jsx      # Navigation sidebar
        ├── pages/
        │   ├── Login.jsx        # Institutional login page
        │   ├── Dashboard.jsx    # Stats + recent activity
        │   ├── FilesList.jsx    # Grid/table document browser
        │   ├── FileDetail.jsx   # Reference viewer + permissions
        │   ├── Upload.jsx       # Drag-drop file upload
        │   ├── AuditLogs.jsx    # Full audit trail browser
        │   ├── Users.jsx        # User management (admin)
        │   └── ChangePassword.jsx
        └── services/
            └── api.js           # Axios client + all API calls

---

🚀 Quick Start

Prerequisites

• Node.js v18 or higher
• npm v9 or higher

1. Clone the project

git clone <repo-url>
cd securescholar

2. Set up the Backend

cd backend

# Install dependencies
npm install

# Copy and configure environment
cp .env.example .env
# (Edit .env if needed — defaults work for local dev)

# Start the server
npm start
# Or for development with auto-reload:
npm run dev

The backend starts at http://localhost:5000

On first run, demo accounts are created automatically:

Role	Email	Password
Admin	admin@securescholar.edu	Admin@SecureScholar1
Faculty	faculty@securescholar.edu	Faculty@123
Student	student@securescholar.edu	Student@123

3. Set up the Frontend

# In a new terminal
cd frontend

# Install dependencies
npm install

# Start dev server
npm run dev

The frontend starts at http://localhost:3000

---

🔌 API Endpoints

Authentication

Method	Endpoint	Description
POST	/api/auth/login	Login with email + password
POST	/api/auth/logout	Invalidate session
GET	/api/auth/me	Get current user
PUT	/api/auth/change-password	Change password

Files

Method	Endpoint	Description
GET	/api/files	List accessible documents
POST	/api/files/upload	Upload + encrypt file (multipart)
GET	/api/files/:id	Get document metadata + permissions
GET	/api/files/:id/view	Reference mode — returns decrypted content
GET	/api/files/:id/watermark	Get watermark data for viewer
POST	/api/files/:id/permissions	Grant permission to user
DELETE	/api/files/:id/permissions/:userId	Revoke permission
GET	/api/files/:id/versions	Version history
DELETE	/api/files/:id	Soft-delete document

Audit

Method	Endpoint	Description
GET	/api/audit	List audit logs (admin/faculty)
GET	/api/audit/stats	Dashboard statistics
GET	/api/audit/export	Export logs as CSV

Users

Method	Endpoint	Description
GET	/api/users	List all users
POST	/api/users	Create user (admin)
DELETE	/api/users/:id/lock	Unlock account (admin)
GET	/api/users/search?q=	Search users

---

🔒 Security Implementation Details

File Encryption (AES-256-CBC)

1. A unique 256-bit key is generated per file
2. The file is encrypted using AES-256-CBC with a random IV
3. The file key is itself encrypted with the master key
4. Only the encrypted key and IV are stored in the database
5. Original file is deleted after encryption

Session Security

• JWT tokens expire after 30 minutes
• Sessions stored server-side (DB) for revocability
• Account locked after 5 failed attempts (15-minute lockout)
• Password changes invalidate all other sessions

Reference Mode

• Documents served as inline content (not downloadable)
• Content-Disposition: inline prevents save dialogs
• Copy/paste disabled via CSS user-select: none
• Dynamic watermark overlay with user identity + timestamp + IP
• Cache-Control: no-store prevents browser caching

Audit Trail

All these actions are logged with user, IP, timestamp, success/failure: LOGIN_SUCCESS, LOGIN_FAILED, FILE_UPLOAD, FILE_VIEW_REFERENCE_MODE, FILE_ACCESS, FILE_DELETED, PERMISSION_GRANTED, PERMISSION_REVOKED, PASSWORD_CHANGED, LOGOUT, USER_CREATED, ACCOUNT_UNLOCKED

---

🌐 Production Deployment

Using PM2

cd backend
npm install -g pm2
pm2 start server.js --name securescholar-api
pm2 save

Build Frontend

cd frontend
npm run build
# Serve dist/ folder via Nginx

Nginx Config (with TLS)

server {
    listen 443 ssl;
    server_name yourdomain.edu;
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;
    ssl_protocols TLSv1.3;

    # Serve React app
    location / {
        root /path/to/frontend/dist;
        try_files $uri $uri/ /index.html;
    }

    # Proxy API
    location /api {
        proxy_pass http://localhost:5000;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

---

📋 TBD Items from SRS Appendix C

TBD	Status	Action Needed
TBD-1: Cloud provider	SQLite (local) → swap for PostgreSQL + AWS S3	Configure DATABASE_URL and AWS SDK
TBD-2: Antivirus API	Hook in routes/files.js upload handler	Add ClamAV or VirusTotal API call
TBD-3: Retention period	Configurable, defaults 7 years	Set in .env
TBD-4: Max concurrent users	1000+ (add Redis for sessions at scale)	Replace SQLite sessions with Redis
TBD-5: Mobile app	API-first design ready	Build React Native app using same /api
TBD-6: Multi-language	UTF-8 throughout, i18n hooks needed	Add react-i18next

---

👨‍💻 Development Team

• Shayan Fatarpekar (24CSB0B69)
• Shreyas Prakash Lohia (24CSB0B70)
• Siddanth Sarath (24CSB0B71)

SecureScholar v1.0 — 16-02-2026