A full-stack cloud storage application that allows users to securely upload, organize, access, and manage files through a hierarchical folder structure. The platform supports Email/Password authentication with OTP verification, Google OAuth login, Redis-backed session management, role-based access control, and direct-to-S3 uploads using presigned URLs.

The system is designed around security, scalability, and data integrity, combining MongoDB for persistent metadata storage, Redis for session management, AWS S3 for object storage, and React for the frontend.

• Email/Password authentication

• OTP-based email verification during registration

• Google OAuth login

• Redis-backed session management

• Signed HTTP-only cookies

• Role-Based Access Control (RBAC)

  • Admin
  • Manager
  • User

• Session expiration and invalidation

• Upload files directly to AWS S3
• Download files securely using presigned URLs
• Browser preview support
• Rename files
• Delete files
• Upload integrity verification
• Upload state tracking

• Create folders
• Rename folders
• Delete folders recursively
• Hierarchical directory tree
• Automatic storage size propagation

• View all users
• Monitor active users
• Soft delete user accounts
• Force logout capabilities
• Role-based administration

• Per-user storage quotas
• Storage usage tracking
• Directory-level size aggregation
• Automatic quota enforcement

• bcrypt password hashing
• Google ID token verification
• Signed session cookies
• Private S3 bucket architecture
• Time-limited presigned URLs
• Resource ownership validation
• Multi-layer input validation

• React
• Vite
• Axios
• Context API

• Node.js
• Express.js

• MongoDB
• Mongoose

• Redis

• AWS S3

• Google OAuth
• OTP Verification
• Redis Session Authentication

• Resend

┌─────────────────────┐
│     React Client    │
└──────────┬──────────┘
           │
           ▼
┌─────────────────────┐
│    Express Server   │
└───┬────────┬─────┬──┘
    │        │     │
    ▼        ▼     ▼

┌────────┐ ┌──────────┐ ┌────────┐
│ Redis  │ │ MongoDB  │ │ AWS S3 │
└────────┘ └──────────┘ └────────┘

 Sessions    Metadata      Files

The application uses session-based authentication instead of JWTs.

User Login
    │
    ▼
Generate Session ID
    │
    ▼
Store Session in Redis
    │
    ▼
Set Signed Cookie (sid)
    │
    ▼
Future Requests
    │
    ▼
Redis Session Lookup
    │
    ▼
Authenticated User

Redis acts as a distributed session store:

• Fast session lookup
• Automatic expiration
• Easy logout
• Session revocation
• Horizontal scalability

User Registration
       │
       ▼
Enter Email
       │
       ▼
Generate OTP
       │
       ▼
Send Email via Resend
       │
       ▼
Store OTP in MongoDB
       │
       ▼
Verify OTP
       │
       ▼
MongoDB Transaction
       │
 ┌─────┴─────┐
 ▼           ▼
Create User  Create Root Directory
       │
       ▼
Registration Complete

MongoDB TTL indexes automatically remove OTP records after 10 minutes.

User
 │
 ▼
Google Sign-In
 │
 ▼
Google ID Token
 │
 ▼
Backend Verification
 │
 ▼
Create/Login User
 │
 ▼
Create Redis Session
 │
 ▼
Authenticated

The backend verifies Google-issued ID tokens before authenticating users.

The application uses a direct-to-S3 upload pipeline.

Client
   │
   ▼
Request Upload URL
   │
   ▼
Backend
   │
Generate Presigned URL
   │
   ▼
Client ─────────────► AWS S3
         Upload File

• Files never pass through Express
• Lower server bandwidth usage
• Better scalability
• Faster uploads
• Reduced server load

Initiate Upload
      │
      ▼
Create MongoDB Record
      │
      ▼
isUploading = true
      │
      ▼
Upload File to S3
      │
      ▼
Verify File Metadata
      │
      ▼
Size Match?
      │
   Yes ▼
      │
isUploading = false
      │
      ▼
Update Directory Sizes

If verification fails, the upload record is removed.

Files are never publicly exposed.

User Request
      │
      ▼
Verify Ownership
      │
      ▼
Generate Signed URL
      │
      ▼
Redirect User
      │
      ▼
Temporary S3 Access

Presigned URLs expire automatically after 5 minutes.

Directories are organized as a tree.

Root
│
├── Documents
│   ├── Notes
│   └── Books
│
├── Images
│   ├── Travel
│   └── Personal
│
└── Videos

Each directory stores:

• Name
• Parent Directory
• Owner
• Aggregated Size

When a file is uploaded:

Root
│
└── Folder A
     │
     └── Folder B
           │
           └── File

The size is propagated upward:

File Size
    │
    ▼
Folder B
    │
    ▼
Folder A
    │
    ▼
Root

This enables efficient storage usage calculation.

Deleting a folder automatically:

Directory
│
├── Sub Directory
│   ├── File
│   └── File
│
└── File

removes:

• All descendant directories
• All file metadata
• All S3 objects

using bulk deletion operations.

User
├── name
├── email
├── password
├── role
├── rootDirId
├── maxStorageInBytes
├── deleted
└── picture

Directory
├── name
├── size
├── userId
└── parentDirId

File
├── name
├── extension
├── size
├── userId
├── parentDirId
└── isUploading

The application uses multiple validation layers.

Frontend Validation
        │
        ▼
Zod Validation
        │
        ▼
Route Validation
        │
        ▼
Controller Logic
        │
        ▼
Mongoose Strict Mode
        │
        ▼
MongoDB JSON Schema Validation

• Zod request validation
• MongoDB JSON Schema validators
• Mongoose strict mode
• Route parameter validation

Passwords are hashed using:

bcrypt (12 salt rounds)

before being stored.

Signed Cookies
+
HTTP Only Cookies
+
Redis Session Store

protect authentication state.

Every file and directory operation validates ownership:

User A
  ❌
Cannot Access
  ❌
User B Resources

Files remain private in S3.

Access is granted only through temporary presigned URLs.

Each user receives:

1 GB Default Storage

Uploads are validated before storage allocation.

Current Usage
      +
Incoming File Size
      >
Maximum Quota
      ?

If exceeded:

Upload Rejected

client/
├── src/
│   ├── api/
│   ├── components/
│   ├── context/
│   ├── pages/
│   └── App.jsx
│

server/
├── config/
├── controllers/
├── middlewares/
├── models/
├── routes/
├── services/
├── validators/
└── app.js

git clone <repository-url>
cd <project-name>

cd server
npm install

cd client
npm install

Create .env files using the provided .env.example files.

cd server
npm run dev

cd client
npm run dev

• Multipart uploads for very large files
• File sharing links
• Folder sharing
• Search functionality
• Storage analytics dashboard
• Activity logs
• Versioned files
• Real-time upload progress tracking

• Direct-to-S3 uploads using presigned URLs
• Redis-backed distributed session management
• MongoDB transactions during user onboarding
• Automatic OTP expiration using TTL indexes
• Hierarchical directory tree with recursive deletion
• Storage quota enforcement
• Upload integrity verification
• MongoDB JSON Schema validation
• Multi-layer validation architecture
• Role-Based Access Control (RBAC)
• Secure private object storage using temporary signed URLs