Full-stack Data Room MVP
A secure and organized repository for storing and distributing due-diligence documents, inspired by platforms such as Google Drive, Dropbox, and Box.
This was a take-home project for Acme Corp, implemented as a complete full-stack application with a real backend, database, and file storage working end to end.
Technology Stack
The frontend is built with React 18, TypeScript, Vite, and Tailwind. The backend uses NestJS, Prisma, and PostgreSQL, with S3-compatible object storage for files.
MinIO is used for local development, while Backblaze B2 provides object storage in production. Authentication uses email OTP verification with HTTP-only JWT cookie sessions.
File and Folder Management
The application supports nested folders with unlimited depth, breadcrumbs for navigation, and standard folder operations including creation, renaming, moving, and deletion.
Moving folders includes cycle protection to prevent invalid folder structures.
Files support multi-file drag-and-drop uploads with per-file progress tracking, preview, rename, move, and deletion. Downloads use short-lived presigned URLs, so the API never has to stream file contents directly.
Sharing and Search
Data Rooms, folders, and individual files can be shared with read-only access.
The system supports both token-based public links and direct per-user sharing. Both types of access can be revoked.
Search is case-insensitive and works across folder and file names within a Data Room.
Authentication and Presence
Authentication supports email and password together with six-digit OTP verification for registration, login, password reset, and account deletion.
OTP codes are protected with rate limits and attempt limits to prevent abuse.
The application also provides presence information, showing which users are currently viewing a Data Room.
Engineering Highlights
The backend follows a layered architecture with routes, controllers, services, and repositories separated by responsibility.
API input is validated through class-validator DTOs, ensuring invalid requests return a proper 400 response instead of reaching deeper application layers.
The system automatically handles name conflicts by adding suffixes when uploading, renaming, or moving files and folders.
Access control avoids leaking the existence of protected resources by returning 404 responses where appropriate.
Read-only permissions are enforced throughout the sharing flow, while cascade deletion removes both database records and their associated objects from S3-compatible storage.
Testing
The backend includes a test suite with 101 tests covering the main application functionality and API behavior.
Deployment
The application uses a single-origin Nginx gateway that serves the React SPA and proxies API requests through /api.
The application is deployed on Render with managed PostgreSQL and Backblaze B2 object storage.