We're building a digital book reading platform that lets users register, subscribe, and read protected eBooks (digitized from source PDFs) in-browser, with full anti-piracy protections. This bounty covers the web reader application, the core backend/API layer that will also serve the mobile apps, and the two internal back-office dashboards (Admin and CRM).

A companion bounty (Bounty #2) covers the native Android and iOS mobile apps, built by a separate developer/team against the same backend API you deliver here. Your API contracts must be documented and stable enough for that team to integrate against.

2. Scope of Work

A. Backend / API (shared foundation)

• RESTful (or GraphQL) API serving Web, Android, and iOS clients
• Authentication & session services (mobile OTP-based, token sessions, single-active-session enforcement)
• Book catalog, metadata, and search/filter services
• PDF ingestion & digitization pipeline (queue-based processing: Queued → Processing → Ready for Review → Published/Failed)
• OCR integration for scanned PDFs
• Protected content delivery (chunked/streamed, non-downloadable, entitlement-checked)
• Dynamic watermarking / user barcode generation and embedding logic
• Bookmarking & reading-progress sync services (cross-device)
• Subscription & payment processing integration
• Notification services (push/email, transactional + bulk)
• Violation/audit logging
• Admin & CRM role-based access control (RBAC) layer

B. Web Reader Application (Frontend)

• Registration/login flow (mobile number + OTP, forgot-password via OTP)
• Post-signup profile form (name, email, university, college, course, exam, optional address)
• Profile view/edit (mobile number locked)
• Catalog browsing (category, author, new arrivals, popularity, search, filters: subject/course/university/exam)
• Book detail page (description, author, cover, sample pages, subscription eligibility)
• In-browser reader: TOC/page-slider/chapter navigation, font/theme/line-spacing customization, highlight text, in-book search
• Content protection: disabled right-click/copy/print/text-selection, visible watermark/barcode overlay on every page
• Bookmarking: add/remove/view (grouped by book), "My Library"/favourites shelf
• Notification center (in-app history)
• Subscription/plan selection and payment flow (UI)

C. Admin Dashboard

• Secure admin login (RBAC: Super Admin vs Admin)
• Book management: upload source PDF + metadata, add/edit/draft/publish/unpublish/delete, versioning without breaking existing bookmarks/progress
• Digitization job monitoring + re-trigger failed conversions
• Category/tag/filter management
• Subscription plan configuration (duration, pricing, promo/package offers)
• User management: search (including by generated barcode), view account/subscription status, suspend, issue refund
• Role & access management (Super Admin creates Admin/CRM accounts, assigns permissions)
• Content moderation/audit log (all admin actions timestamped with identity)
• Dashboard overview (total books, active subscribers, new signups, active packages, revenue summary)

D. CRM Dashboard

• Secure CRM/support login (read-focused RBAC)
• User activity tracking (signups, logins, books opened, reading time, bookmarks, subscription events)
• User Profile 360 view (activity timeline, subscription history, support notes)
• Engagement reports (DAU/MAU, most-read books, average reading time)
• Subscription & revenue reports (active/expired, revenue by plan)
• Churn/at-risk flagging
• Report export (CSV/Excel)
• Internal support notes on user profiles

3. Functional Requirements In Scope

SectionFR IDsNotesAuth & Account MgmtFR-AUTH-01 to 09Web UI + backend shared with mobileCatalog & DigitizationFR-CAT-01 to 08Ingestion pipeline is backend-only; browsing/detail page are web frontendReading ExperienceFR-READ-01 to 06Web reader implementation; sync backend is sharedContent ProtectionFR-PROT-02, 03, 04, 05, 08FR-PROT-01/06 (mobile OS-level) belong to Bounty #2BookmarkingFR-BM-01 to 05Web UI + shared sync backendAdmin DashboardFR-ADM-01 to 09Full scopeCRM DashboardFR-CRM-01 to 08Full scopeNotificationsFR-NOTIF-01 to 04Backend delivery + web in-app center

Section 6 (Subscription & Payment) had no FRs listed in the source document — scope the payment flow to standard subscription purchase, renewal, and expiry handling, and confirm the payment gateway with the project owner before implementation.

4. Out of Scope (per FRD Section 10 — flag if touched)

• Customer-facing support/helpdesk (live chat, ticketing, FAQ center)
• Accessibility (TTS, screen-reader, WCAG, keyboard navigation)
• Bulk/batch PDF upload (single-book upload only)
• 2FA beyond OTP (authenticator apps, hardware keys)

5. Suggested Tech Stack (flexible — propose alternatives in your bid)

• Backend: Node.js (NestJS/Express) or similar, PostgreSQL/MySQL, Redis (session/queue), message queue (SQS/RabbitMQ) for digitization pipeline, S3-compatible storage for protected content chunks
• OCR: Tesseract or a managed OCR API
• Frontend: React or Next.js, with a component library suited to a DRM-style protected reader
• Auth: JWT/token-based sessions, OTP via SMS gateway
• Infra: Dockerized services, CI/CD pipeline

6. Deliverables

1. Deployed/deployable Web application (reader-facing)
2. Deployed/deployable Admin Dashboard
3. Deployed/deployable CRM Dashboard
4. Backend API with documented endpoints (OpenAPI/Swagger or equivalent) for the mobile team to consume
5. Digitization pipeline (PDF → protected reflowable format) with admin QA preview
6. Source code repository with setup/README instructions
7. Basic test coverage on auth, entitlement checks, and content-protection logic

7. Acceptance Criteria

• All Must-Have (M) priority FRs listed in Section 3 are fully functional
• Should-Have (S) items implemented or explicitly deferred with sign-off
• No book file is downloadable/exportable in any form (verified via manual pen-test pass)
• Reading progress and bookmarks sync correctly between a web session and a test mobile client
• Admin can fully manage the book lifecycle end-to-end (upload → digitize → QA → publish)
• API is stable and documented for external (mobile) consumption

8. How to Apply

Submit a proposal including: relevant experience with DRM/protected content delivery, proposed tech stack, architecture diagram, milestone breakdown, and estimated timeline.