FileIO — System Documentation

1 System Overview

FileIO is a full-stack web platform built with ASP.NET Core MVC (.NET 10) that provides secure file sharing and a comprehensive suite of image, PDF, and AI-powered tools. Users earn or purchase credits to access premium features, with access controlled through a subscription plan system.

Technology Stack

🖥 Frontend

Razor Views (.cshtml) · Bootstrap 5 · Bootstrap Icons · Vanilla JS · Canvas API · face-api.js · exifr.js

⚙ Backend

ASP.NET Core MVC · C# · Entity Framework Core · ASP.NET Identity · Background Services · Email (SMTP)

🗄 Data

SQL Server · EF Core Migrations · DataSeeder (auto seeds plans, features, packages on startup)

🔌 External Services

Razorpay (payments, INR) · jsDelivr CDN · Bootstrap Icons CDN · Google Fonts

Key Design Principles

Principle	Implementation
Security	AES-256 encryption for stored files; TLS 1.2+ in transit; bcrypt password hashing; CSRF tokens on all forms; XSRF stripped from CDN requests
Privacy	Files auto-deleted after 24 hours; IP stored only as hash; no advertising trackers
Credit system	Every tool costs a defined credit amount; credits deducted server-side after validation; 401 if unauthenticated, 402 if insufficient credits
Guest access	File sharing works without an account (GuestId cookie); other tools require login
Plan gating	Nav items rendered per plan via ViewComponent; controller re-validates on every request

2 Subscription Plans

Free

₹0 / month

30 credits / month

Max file size: 10 MB
File sharing
QR Code Generator
Image to PDF
Crop, Resize, Rotate & Flip
Color Picker
File expiry: 1 hour

Pro

₹899 / month

1,000 credits / month

Max file size: 500 MB
Everything in Free
Image Upscale (AI)
Remove Background
OCR Text Extraction
Full PDF tools suite
Document conversions
Blur Faces, Metadata, Change DPI
Replace Background
File expiry: up to 7 days

Business

₹1,999 / month

5,000 credits / month

Max file size: 1 GB
Everything in Pro
AI Image Generator
Remove Image Watermark
QR Code Reader
URL Screenshot
Password-protected sharing
Add & Remove PDF Watermark
Edit PDF & PDF Editor Pro
AI PDF Summarizer
AI Writer
File expiry: up to 30 days

Yearly Billing Discount: 20% off — calculated as monthly price × 12 × 0.8. Credits are multiplied by 12 (full year allocation granted upfront).

Plan	Monthly Price	Yearly Price	Credits/mo	Max File Size	File Expiry Cap
Free	₹0	₹0	30	10 MB	1 hour
Pro	₹899	₹8,630	1,000	500 MB	7 days
Business	₹1,999	₹19,190	5,000	1 GB	30 days

3 Credit Packages (Add-On)

Users on paid plans can purchase additional credits at any time. Add-on credits stack on top of monthly plan credits and do not expire.

Package	Credits	Price (INR)	Per Credit
Small	500	₹199	~₹0.004
Medium	1,500	₹499	~₹0.003
Large	5,000	₹1499	~₹0.003

Credit Balance: Total = Plan Credits (remaining) + Add-On Credits. Credits are deducted only after successful tool execution. Failed or unauthenticated requests do not consume credits.

4 Feature Catalogue (59 Features)

#	Feature Key	Display Name	Category	Credit Cost	Free	Pro	Business
AI TOOLS
1	AIImageGenerate	AI Image Generator	AI Tools	5 / 7	✗	✗	✓
2	AIPdfSummarizer	AI PDF Summarizer	AI Tools	dynamic	✗	✗	✓
3	AIWriter	AI Writer	AI Tools	3	✗	✗	✓
CORE
4	FileShare	File Share	Core	0	✓	✓	✓
5	PasswordProtectionSharing	Password Protection	Core	0	✗	✗	✓
6	QRReader	QR Code Reader	Core	2	✗	✗	✓
7	QRGenerator	QR Generator	Core	2	✓	✓	✓
8	UrlToScreenshot	URL Screenshot	Core	2	✗	✗	✓
DOCUMENT
9	CsvToJson	CSV to JSON	Document	1	✗	✓	✓
10	JsonToCsv	JSON to CSV	Document	1	✗	✓	✓
11	JsonToXml	JSON to XML	Document	1	✗	✓	✓
12	JsonToYaml	JSON to YAML	Document	1	✗	✓	✓
13	MarkdownToHtml	Markdown to HTML	Document	1	✗	✓	✓
14	XmlToJson	XML to JSON	Document	1	✗	✓	✓
15	YamlToJson	YAML to JSON	Document	1	✗	✓	✓
IMAGE TOOLS
16	BlurFaces	Blur Faces	Image Tools	1	✗	✓	✓
17	ChangeDPI	Change DPI	Image Tools	1	✗	✓	✓
18	ColorPicker	Color Picker	Image Tools	1	✓	✓	✓
19	CropImage	Crop Image	Image Tools	1	✓	✓	✓
20	ExtractText	Extract Text (OCR)	Image Tools	3	✗	✓	✓
21	ImageCompress	Image Compress	Image Tools	2	✗	✓	✓
22	ImageConverter	Image Converter	Image Tools	dynamic	✗	✓	✓
23	ImageMetadata	Image Metadata	Image Tools	1	✗	✓	✓
24	ImageUpscale	Image Upscale	Image Tools	dynamic	✗	✓	✓
25	RemoveBackground	Remove Background	Image Tools	3	✗	✓	✓
26	RemoveImageWatermark	Remove Image Watermark	Image Tools	5	✗	✗	✓
27	ReplaceBackground	Replace Background	Image Tools	4	✗	✓	✓
28	ResizeImage	Resize Image	Image Tools	1	✓	✓	✓
29	RotateFlip	Rotate & Flip	Image Tools	1	✓	✓	✓
30	TextWatermark	Text Watermark	Image Tools	4	✗	✓	✓
31	PassportPhoto	Passport Photo	Image Tools	3	✗	✓	✓
32	MemeGenerator	Meme Generator	Image Tools	dynamic	✗	✓	✓
PDF & ADVANCED
33	AddPDFWatermark	Add PDF Watermark	PDF & Advanced	4	✗	✗	✓
34	CompressPDF	Compress PDF	PDF & Advanced	dynamic	✗	✓	✓
35	EditPDF	Edit PDF	PDF & Advanced	dynamic	✗	✗	✓
36	ExcelToPDF	Excel to PDF	PDF & Advanced	dynamic	✗	✓	✓
37	ExtractPDFText	Extract PDF Text	PDF & Advanced	dynamic	✗	✓	✓
38	HTMLToPDF	HTML to PDF	PDF & Advanced	3	✗	✓	✓
39	MarkdownToPDF	Markdown to PDF	PDF & Advanced	2	✗	✓	✓
40	ImageToPDF	Image to PDF	PDF & Advanced	dynamic	✓	✓	✓
41	MergePdf	Merge PDF	PDF & Advanced	dynamic	✗	✓	✓
42	PDFToExcel	PDF to Excel	PDF & Advanced	dynamic	✗	✗	✓
43	PDFToImage	PDF to Image	PDF & Advanced	dynamic	✗	✓	✓
44	PDFToJPG	PDF to JPG	PDF & Advanced	dynamic	✗	✓	✓
45	RemoveWatermark	Remove PDF Watermark	PDF & Advanced	5	✗	✗	✓
46	RotatePDF	Rotate PDF	PDF & Advanced	1	✗	✓	✓
47	SignPDF	Sign PDF	PDF & Advanced	2	✗	✓	✓
48	SplitPDF	Split PDF	PDF & Advanced	dynamic	✗	✓	✓
49	TextToPDF	Text to PDF	PDF & Advanced	1	✗	✓	✓
50	WordToPDF	Word to PDF	PDF & Advanced	dynamic	✗	✓	✓
51	LockPDF	Lock PDF	PDF & Advanced	2	✗	✓	✓
52	UnlockPDF	Unlock PDF	PDF & Advanced	2	✗	✓	✓
53	DeletePDFPages	Delete PDF Pages	PDF & Advanced	2	✗	✗	✓
54	ReorderPDFPages	Reorder PDF Pages	PDF & Advanced	2	✗	✗	✓
55	ExtractPDFPages	Extract PDF Pages	PDF & Advanced	2	✗	✗	✓
56	AddPageNumbers	Add Page Numbers	PDF & Advanced	2	✗	✗	✓
57	PDFEditorPro	PDF Editor (text, shapes, forms, links, signatures)	PDF & Advanced	dynamic	✗	✗	✓
58	ComparePDF	Compare PDF	PDF & Advanced	dynamic	✗	✗	✓
59	PDFToMarkdown	PDF to Markdown	PDF & Advanced	dynamic	✗	✓	✓

Dynamic credit cost means the cost is calculated per-use in the controller (e.g. based on number of pages for PDF tools, or file size for upscale). 0 cost means the feature is free to use but may require an account.

5 How Each Feature Works

5.1 — File Share

The core feature. Users upload one or more files which are encrypted with AES-256 and stored on the server. A unique ShareId (passcode) is generated and shared with recipients.

Select Files→ Chunked Upload→ AES-256 Encrypt→ Generate ShareId→ Share Link/QR→ Recipient Downloads→ Auto-Delete

Detail	Value
Max file size	10 MB (Free) · 500 MB (Pro) · 1 GB (Business)
Expiry	1 h (Free/Guest); 24 h default for Pro/Business — extendable up to 7 / 30 days by plan
Password protection	Business plan only — bcrypt-hashed password required to download
Guest access	No login required; tracked via GuestId cookie
Encryption	AES-256, unique key per upload stored encrypted in DB
Multi-file	Multiple files zipped on download
Credit cost	0 (free)

5.2 — Image Tools (Client-Side Processing)

All basic image tools run entirely in the browser using the Canvas API — no image data is sent to the server. A POST request is made only to deduct 1 credit after the operation completes.

Tool	How It Works	Max Size	Credits	Plan
Crop Image	Touch-friendly canvas overlay with corner handles, rule-of-thirds grid, live dimensions.	7 MB	1	Free+
Resize Image	User enters target width/height (with optional aspect-ratio lock). Canvas redraws and exports resized image.	7 MB	1	Free+
Rotate & Flip	4 buttons: Rotate CW, Rotate CCW, Flip Horizontal, Flip Vertical. Canvas transforms applied cumulatively.	7 MB	1	Free+
Color Picker	Click anywhere on the uploaded image to sample the pixel color. Displays HEX, RGB, HSL values with one-click copy.	7 MB	1	Free+
Blur Faces	face-api.js (TinyFaceDetector) detects all faces; each region is pixelated using Canvas block averaging.	7 MB	1	Pro+
Image Metadata	exifr.js reads EXIF data client-side. Displays: File Info, Camera settings, Exposure, GPS, Colour profile.	7 MB	1	Pro+
Image Upscale	Server-side AI upscaling (4× enhancement via ONNX Real-ESRGAN model). Credits based on longest side: ≤500 px = 2, ≤1000 px = 3, ≤1200 px = 4.	7 MB	2 – 4	Pro+
Remove Background	Server-side AI background removal.	7 MB	3	Pro+
Replace Background	Remove background then composite a new background image.	7 MB	4	Pro+
Image Compress	Server-side compression with quality control.	—	2	Pro+
Image Converter	Convert between JPG, PNG, WebP, BMP, SVG, HEIC, AVIF, TIFF, ICO formats.	—	dynamic	Pro+
Text Watermark	Add custom text overlay with font, size, position, opacity controls.	—	4	Pro+
Remove Image Watermark	AI-powered watermark removal from images.	—	5	Business
Extract Text (OCR)	Optical Character Recognition — extract text content from images using Tesseract.	7 MB	3	Pro+
Change DPI	Rewrites the DPI/PPI metadata of an image. Pixels unchanged — metadata only.	7 MB	1	Pro+
Passport Photo	Country-preset passport photos with white or solid-color background. Print-ready 4×6" sheet with multiple copies.	7 MB	3	Pro+
Meme Generator	Upload any image and add top/bottom caption text. Supports Classic (single image with text) and Panel (2–4 image comic strip) modes. Font size, colour, and stroke customisable. Credits: Classic = 1, Panel 2–3 = 2, Panel 4 = 3.	7 MB	1 – 3	Free+

5.3 — PDF Tools (Server-Side Processing)

All PDF operations are processed server-side. Files are uploaded, processed in memory, and the result is returned for download.

Tool	How It Works	Credits	Plan
Image to PDF	Converts one or more uploaded images into a single PDF document.	dynamic	Free+
Merge PDF	Combines multiple PDF files into one, maintaining page order. Max 20 MB per file; up to 20 PDFs per merge.	dynamic	Pro+
Split PDF	Splits a PDF by page range, or (when no range is given) splits every page into its own PDF. Credits scale with the input PDF's page count; explicit range is discounted one tier vs. no range. Max 20 MB.	dynamic	Pro+
Compress PDF	Reduces PDF file size by optimising embedded images and resources.	dynamic	Pro+
PDF to Image	Renders each PDF page as a high-resolution image (JPG/PNG).	dynamic	Pro+
Extract PDF Text	Extracts all text content from a PDF into a plain-text file.	dynamic	Pro+
Add PDF Watermark	Stamps a text or image watermark on every page of a PDF.	4	Business
Remove PDF Watermark	Attempts to remove watermark layers from a PDF document.	5	Business
Word to PDF	Converts .doc/.docx to PDF via LibreOffice headless. Preserves fonts, tables, layout. Max 20 MB.	dynamic	Pro+
Excel to PDF	Converts .xls/.xlsx to PDF via LibreOffice headless. Preserves formatting. Max 20 MB.	dynamic	Pro+
Rotate PDF	Rotates pages by 90°, 180°, or 270°. Supports All / Odd / Even page selection. Max 20 MB.	1	Pro+
PDF to JPG	Renders each PDF page as JPEG (quality 10–100%). Returns all pages in a ZIP archive. Max 20 MB.	dynamic	Pro+
Text to PDF	Converts plain text into a formatted PDF. Supports font size and alignment options.	1	Pro+
HTML to PDF	Converts raw HTML to PDF using Playwright Chromium headless. Renders full CSS styling.	3	Pro+
Markdown to PDF	Paste or upload Markdown; rendered through Markdig into a GitHub-styled A4 PDF via Playwright headless.	2	Pro+
Edit PDF	Add text annotations to PDF pages. Canvas-based editor with font, color, drag-to-reposition. Applied via PdfSharpCore.	dynamic	Business
Sign PDF	Draw signature on canvas or upload image, place on any page. Composited via SkiaSharp, reassembled via QuestPDF.	2	Pro+
PDF to Excel	Extracts text and tabular data from PDF to .xlsx. Uses PdfPig + ClosedXML. Column detection via whitespace analysis. Max 20 MB.	dynamic	Business
Lock PDF	Adds AES-128 password protection via PdfSharpCore. Restricts copying, editing, annotations while allowing reading.	2	Pro+
Unlock PDF	Removes password protection. User must supply correct password. Credits refunded on wrong password.	2	Pro+
Delete PDF Pages	Client renders thumbnails via pdf.js; user clicks pages to mark for deletion. Server rebuilds via PdfSharpCore.	2	Business
Reorder PDF Pages	Client renders thumbnails via pdf.js; SortableJS enables drag-drop reordering. Server rebuilds in submitted order.	2	Business
Extract PDF Pages	User selects pages to keep; server builds a single combined PDF. Differs from Split (which returns a ZIP).	2	Business
Add Page Numbers	Adds page numbers with position (6 choices), format, font size, margin, skip-first-page toggle. Uses PdfSharpCore.	2	Business
PDF Editor	Full visual editor: text, images, signatures, shapes, freehand, highlights, whiteout, links, form fields. Canvas via Fabric.js; server-side via PdfSharpCore + iTextSharp; autosave drafts; saved signature slots (3); find & replace; page thumbnail rail. Max 20 MB.	dynamic	Business
Compare PDF	Upload two text-based PDFs; server extracts text via PdfPig, runs an LCS (Longest Common Subsequence) diff, and returns a side-by-side colour-coded diff table (green = added, red = removed, grey = unchanged). Toggle to show/hide unchanged lines. Max 20 MB each.	dynamic (3–8)	Business
PDF to Markdown	Extracts text from a PDF using PdfPig with font-size analysis to detect headings (H1/H2/H3), bold labels, and bullet/numbered lists. Monospace fonts are wrapped in fenced code blocks. Outputs a clean .md file for download with an inline preview. Max 20 MB.	dynamic (2–7)	Pro+

5.3b — Document Conversion Tools

Tool	How It Works	Credits	Plan
JSON to CSV	Parses a JSON array and converts to CSV. Handles nested flat objects.	1	Pro+
CSV to JSON	Parses a CSV file (with header row) and converts to a JSON array of objects.	1	Pro+
XML to JSON	Parses an XML document and converts to a JSON object representation.	1	Pro+
JSON to XML	Converts a JSON object or array to a well-formed XML document.	1	Pro+
YAML to JSON	Parses a YAML file and converts to a JSON object.	1	Pro+
JSON to YAML	Converts a JSON object to YAML format.	1	Pro+
Markdown to HTML	Renders a Markdown document as a styled HTML page. Supports headings, lists, tables, code blocks.	1	Pro+

5.4 — Core & AI Tools

Tool	How It Works	Credits	Plan
AI Image Generator	Generates images from a text prompt using Pollinations.ai (FLUX model) — free, no API key required. Square (1024×1024), Landscape, or Portrait size options.	5 / 7	Business
AI PDF Summarizer	Upload any text-based PDF (max 20 MB). PdfPig extracts text locally; Groq API (openai/gpt-oss-20b) generates a structured summary with Overview, Key Points, and Conclusions. Dynamic credit cost by page count.	3–12	Business
AI Writer	12 writing tools powered by Groq API: Essay, Paragraph, Complete Text, Story, Article, Grammar Fix, Summarize, Rewrite, Bullet Points, Email, Blog Post, Sentence Improver. Up to 5,000 characters input; optional tone and language settings.	3	Business
QR Generator	Generates a QR code from any text or URL. Client-side rendering with download as PNG/SVG.	2	Free+
QR Reader	Upload an image containing a QR code; server decodes and returns the embedded text or URL.	2	Business
URL Screenshot	Captures a full-page screenshot of any URL using Playwright Chromium. Returns a PNG or JPG image.	2	Business

6 Credit System

User registered→ Assigned Free plan (30 credits)→ Uses tool→ Server validates credits→ Credits deducted→ Tool executes

Event	Effect on Credits
New registration	Free plan assigned → 30 credits added
Plan subscription	Plan credits added for the billing period
Plan renewal (monthly)	Credits reset to plan allocation
Yearly subscription	Plan credits × 12 added upfront
Credit package purchase	Add-on credits stacked on top of plan credits
Tool usage	CreditCost deducted; transaction logged in CreditTransaction table
Plan downgrade	Unused credits do not carry over
0 credits	Server returns HTTP 402; UI redirects to pricing page after 5 seconds

Credit balance formula: Total Credits = RemainingCredits (plan) + AddOnCredits
Both stored in UserSubscription table per user. Every tool use records an entry in CreditTransaction with action name and timestamp.

6.1 Credit Cost Breakdown

All credit costs are defined as constants or static methods in Service/CreditCalculator.cs — the single source of truth. Controllers never hardcode credit amounts.

Fixed-Cost Features

Feature	Credits Deducted
Crop Image	1 credit
Resize Image	1 credit
Rotate & Flip	1 credit
Blur Faces	1 credit
Image Metadata	1 credit
Color Picker	1 credit
Rotate PDF	1 credit
Text to PDF	1 credit
JSON to CSV / CSV to JSON / XML to JSON / JSON to XML / YAML to JSON / JSON to YAML / Markdown to HTML	1 credit each
QR Code Generator	2 credits
QR Reader	2 credits
Image Compress	2 credits
URL Screenshot	2 credits
Markdown to PDF	2 credits
Sign PDF / Lock PDF / Unlock PDF	2 credits each
Delete / Reorder / Extract PDF Pages / Add Page Numbers	2 credits each
Image OCR / Extract Text	3 credits
Remove Background	3 credits
HTML to PDF	3 credits
Passport Photo	3 credits
Text Watermark (image)	4 credits
Add PDF Watermark	4 credits
Replace Background	4 credits
Remove Image Watermark	5 credits
Remove PDF Watermark	5 credits
Change DPI	1 credit

Dynamic-Cost Features

Feature	Condition	Credits
AI Image Generator	Square (1024×1024)	5
	Landscape (1366×768)	7
	Portrait (768×1366)	7
Image Upscale	Longest side ≤ 500 px	2
	Longest side ≤ 1000 px	3
	Longest side ≤ 1200 px	4
Image Converter	SVG / HEIC / AVIF / TIFF / ICO conversions	2
Image Converter	All other conversions	1
Image to PDF	1 – 5 images	0
Image to PDF	6+ images	1 per additional 5 (ceiling)
PDF Merge	N PDFs merged	N credits
PDF Split (with explicit range)	1 – 10 pages	1
	11 – 50 pages	1
	51 – 100 pages	2
	Over 100 pages	3
PDF Split (no range → split every page)	1 – 10 pages	1
	11 – 50 pages	2
	51 – 100 pages	4
	Over 100 pages	6
PDF Compress / PDF to Image / PDF to JPG / OCR PDF	1 – 10 pages	1 – 2
	6 – 20 pages	4
	11 – 50 pages	2 – 4
	Over 20 / 50 / 100 pages	4 – 6
Word to PDF / Excel to PDF	Up to 1 MB	2
	1 MB – 5 MB	3
	Over 5 MB	5
PDF to Excel	Up to 1 MB	3
	1 MB – 5 MB	4
	Over 5 MB	6
AI PDF Summarizer	1 – 5 pages	3
	6 – 20 pages	5
	21 – 50 pages	8
	51+ pages	12
AI Writer	All 12 tools (flat rate)	3
Edit PDF	1 – 5 pages	2
	6 – 20 pages	3
	21+ pages	5
PDF Editor Pro	Base: 1 – 5 pages	3
	Base: 6 – 20 pages	5
	Base: 21+ pages	8
	+1 per 10 elements; +2 if AcroForm; max 20	variable
Meme Generator	Classic meme (single image)	1
	Panel (2 – 3 images)	2
	Panel (4+ images)	3
Compare PDF	Total pages ≤ 10	3
	Total pages ≤ 40	5
	Total pages > 40	8
PDF to Markdown	1 – 5 pages	2
	6 – 20 pages	3
	21 – 50 pages	5
	51+ pages	7

Source of truth: All values above map directly to constants and methods in Service/CreditCalculator.cs. To change any cost, update only that file — controllers read from it automatically.

7 Authentication & User Accounts

Authentication is built on ASP.NET Core Identity with SQL Server storage.

Feature	Detail
Registration	Email + password; email confirmation required. Required profile fields: Full Name, Address, State, Country (locked after first save), Postal Code.
Login	Cookie-based; optional "Remember me" (30-day persistent cookie)
Password storage	bcrypt hash — plaintext never stored
Password reset	Email link with time-limited token
Roles	User, Admin — Admin can access Admin Panel
Guest uploads	File sharing works without account via GuestId cookie
Profile page	Shows plan, credits used/remaining, subscription end date, billing cycle, days remaining; subscription alerts
Two-Factor Authentication (2FA)	TOTP-based 2FA available on Profile page. User scans QR code with authenticator app. Also supports email-based 2FA. Recovery via email code if TOTP device is lost.
Account deletion	Soft delete — data not immediately destroyed. Immediately: Uploads marked `DeletedAt=now`; `DeletedAccounts` row created with `PurgeAt = +30 days`; Identity locked out; confirmation email sent. After 30 days (background job): Hard-deletes all user data (files, credits, subscriptions, Identity record). Marks `Purged=true`.
Account reactivation	Available within 30-day soft-delete window. User enters email → receives reactivation link with 24-hour token → link unlocks Identity, restores uploads, removes `DeletedAccounts` record.

8 Billing & Payments

Payments are processed via Razorpay (INR currency). No card data touches our servers.

User selects plan→ Checkout page→ Razorpay order created→ User pays→ Signature verified→ Subscription activated→ Confirmation email sent

Scenario	Behaviour
New subscription	Creates UserSubscription record; credits added; email sent
Renewal	Existing subscription extended; credits refreshed
Upgrade mid-cycle	New plan applied immediately; credits updated to new plan allocation
Cancellation	Sets CancelAtPeriodEnd = true; access continues until period end; cancellation email sent
Credit purchase	Separate Razorpay order; credits added to AddOnCredits; receipt email sent
Refunds	All purchases are final (per Terms of Service), except where required by law
Transaction record	Stored in Checkout / CreditPurchase tables with TransactionId from Razorpay

8.1 Multi-Currency Display & Payment

Prices across the platform can be displayed and charged in INR (₹), USD ($), or SAR (﷼). Currency selection affects both the displayed price and the actual Razorpay order amount.

Aspect	Detail
Selection	Currency dropdown in navbar. Choice saved to `localStorage` under key `fs-currency`. Sent as `currency` field in the `CreateOrder` JSON body.
Exchange rates	Fixed rates loaded at startup from `appsettings.json → CurrencyRates` into the singleton `CurrencyRateService`. Also injected into the page as `window.CURRENCY_RATES`.
Server-side conversion	`BillingController.ConvertPrice()` multiplies the base INR price by the selected rate and converts to the smallest currency unit before creating the Razorpay order.
Payment	Razorpay order is created with the converted amount and the selected currency code. International payment support must be enabled in the Razorpay dashboard for non-INR currencies.
Allowed currencies	Validated server-side against `_allowedCurrencies` HashSet. Unknown values fall back to INR.
Order session	Currency stored in server-side session alongside planId and cycle so verify endpoints cannot be spoofed.
Checkout record	`Checkout.Currency` field records which currency was charged for audit and admin revenue display.
Admin pages	Revenue pages use `data-inr` attributes; `refreshInrSpans()` converts them on load and on currency change.

Supported Currencies

Currency	Symbol	Rate source
Indian Rupee (INR)	₹	Base — rate 1.0 (no conversion)
US Dollar (USD)	$	`appsettings.json → CurrencyRates:USD`
Saudi Riyal (SAR)	﷼	`appsettings.json → CurrencyRates:SAR`

Adding a New Currency

Add the rate to appsettings.json → CurrencyRates and map it in CurrencyRateService.
Add the currency code to _allowedCurrencies in BillingController.
Handle the new rate in BillingController.ConvertPrice() switch expression.
Add the currency option to the navbar dropdown and update window.CURRENCY_RATES in both layouts.
Enable the currency in your Razorpay dashboard (Settings → International Payments).

To update exchange rates: Change the values in appsettings.json → CurrencyRates and restart the app. No code changes required.

8.2 Subscription Grace Period

When a paid subscription expires, users are not immediately downgraded. A 5-day grace period is granted, during which the account retains full plan access.

State	Condition	Effect
Active	`now ≤ EndDate`	Full plan access; DaysRemaining ≥ 0
Grace period	`EndDate < now ≤ EndDate + 5 days`	Full access retained; Profile shows "X days left in grace period" warning
Expired	`now > EndDate + 5 days`	Background service downgrades user to Free plan and sends expiry email

Grace period constant: SubscriptionGraceRules.GracePeriodDays = 5. Change only this value to adjust the grace window.

Profile Page Alerts

DaysRemaining	Alert shown	Style
= 0	"Your subscription will end today."	Danger
1 – 3	"Your subscription will end in N day(s)."	Danger
4 – 10	"Your subscription will end in N days."	Warning
< 0 (grace)	"Your subscription has expired. X day(s) left in grace period."	Danger

9 Navigation & UI System

The navbar dynamically renders features based on the logged-in user's plan using a ViewComponent (SubscriptionMenuViewComponent). Features not in the user's plan are simply not shown.

Nav Group	Type	Description
File Share, URL Screenshot, QR Generator, QR Reader	Core flat links	Direct nav links, always visible if plan includes them
Image Tools	Mega menu	4-column mega menu: Edit · Enhance · Analyze · Privacy, plus AI Image Generator promo card
PDF & Advanced	Mega menu	4-column mega menu: Convert · Organize · Optimize · Protect, plus Upgrade Plan promo card
Document	Compact panel dropdown	420 px panel with 2-column grid for JSON conversions and Markup. Pro+ only.
AI Tools	Standard dropdown	Simple dropdown for AI Image Generator and AI Writer

Mega menu positioning: Uses CSS :has() selector — .nav-dropdown:has(.mega-menu) { position: static; } — so the absolute-positioned menu stretches full-width relative to the sticky navbar.

UI Themes

The app supports light and dark mode toggled via a button in the navbar. Theme preference is saved in localStorage and applied via data-theme="dark" on the <html> element.

10 Core Data Models

Model	Key Fields	Purpose
SubscriptionPlan	Name, Price, Credits, MaxFileSizeBytes	Defines plan tiers and their limits
UserSubscription	UserId, PlanId, StartDate, EndDate, RemainingCredits, AddOnCredits, BillingCycle, CancelAtPeriodEnd	Tracks active subscription per user
Feature	Key, DisplayName, Category, CreditCost, ControllerName, ActionName, SortOrder	All 59 platform features with routing info
PlanFeature	PlanId, FeatureId	Many-to-many: which features belong to which plan
CreditPackage	Name, Credits, Price, Active	Add-on credit bundles available for purchase
CreditTransaction	UserId, CreditUsed, Action, CreatedAt	Audit log of every credit deduction
CreditPurchase	UserId, CreditsAdded, Amount, TransactionId	Record of every credit package purchased
Upload	ShareId, FileName, FileSize, ExpiresAt, IsPasswordProtected, EncryptedKey	Uploaded file metadata and encryption key
Download	ShareId, DownloadAt, ClientIpHash	Download audit per share link
Checkout	UserId, PlanId, Price, Credits, Duration, Status, TransactionId	Payment intent and result for plan purchases

11 Security Architecture

Layer	Measure
Transport	TLS 1.2+ enforced; HTTPS redirect middleware
File encryption	AES-256 at rest; unique key per upload; key stored encrypted in DB
Passwords	bcrypt hash with work factor 12 (ASP.NET Identity default)
CSRF	Anti-forgery tokens on all POST forms and AJAX requests; stripped from CDN calls
Rate limiting	Upload and download endpoints rate-limited by IP
Credit gating	Server-side validation on every tool endpoint; client-side JS does not control access
Plan gating	Controller checks `HasFeature()` on every tool request; plan from DB, not session
IP logging	Stored as hash only (not plaintext) in Download records
File auto-delete	Background service purges expired uploads every hour
Virus scanning	Every uploaded file is scanned by Windows Defender before being written to disk

11.1 Virus Scanning

Every file is scanned for malware before it is encrypted and stored. Scanning is handled by Windows Defender via MpCmdRun.exe — no third-party service required.

How It Works

File received→ Written to temp path→ MpCmdRun.exe scans→ Clean → encrypt & store

Threat detected→ Temp file deleted→ HTTP 400 returned→ Upload blocked

Aspect	Detail
Scanner	Windows Defender (`MpCmdRun.exe -Scan -ScanType 3 -File`)
Location	`%ProgramFiles%\Windows Defender\MpCmdRun.exe`
Exit codes	0 = clean · 2 = threat found · other = scan error
On scan error	Upload proceeds (non-fatal) — scan errors do not block users
If Defender missing	Scan is silently skipped — upload proceeds
Temp file	Written to `Path.GetTempPath()`, deleted immediately after scan regardless of result
Config key	`appsettings.json → VirusScan:Enabled` (true/false)
Service class	`Service/VirusScanService.cs`

Test Endpoint

Admins can verify scanning is active by visiting /Admin/TestVirusScan. It scans the standard EICAR test string.

Response Status	Meaning
`working`	Defender detected EICAR — scanning is fully active
`disabled_or_not_detected`	`VirusScan:Enabled` is false, or Defender path not found
`error`	Unexpected exception — message field contains details

To disable scanning: Set "Enabled": false under VirusScan in appsettings.json and restart. Useful for development environments without Windows Defender.

12 Email Notifications

Trigger	Email Sent
Registration	Email confirmation link
Password reset	Reset link with time-limited token
Subscription activated	Plan confirmation with credits and expiry date
Subscription cancelled	Cancellation confirmation; access-until date
Subscription expiring soon	Expiry reminder (sent via background service)
Subscription expired / grace period	Grace period notice; downgrade warning
Credit purchase	Receipt with credits added and new balance
Account deletion	Deletion confirmation; explains 30-day recovery window before permanent purge
Account reactivation link	Reactivation link with 24-hour expiry token
2FA / verification code	One-time code for two-factor login or email verification flows

13 Background Services

Three hosted services run continuously in the background. All are registered in Program.cs via AddHostedService<>.

Service	File	Interval	What It Does
FileService	`Service/FileService.cs`	Every 5 minutes	1. Expire uploads: Finds `Uploads` where `ExpiresAt ≤ now` (and not already soft-deleted). Deletes the `.enc` file from disk, removes the `Upload` DB row. 2. Purge deleted accounts: Finds `DeletedAccounts` where `PurgeAt ≤ now` and `Purged = false`. Hard-deletes all user data (files, credits, subscriptions, Identity record). Sets `Purged = true`.
SubscriptionExpireService	`Service/SubscriptionExpireService.cs`	Every 1 minute	Finds active paid subscriptions where `EndDate + GracePeriodDays < now`. Downgrades each to the Free plan: resets `RemainingCredits` to Free plan credits, updates `SubscriptionId`, sets `AddOnCredits = 0`.
SubscriptionExpireEmail	`Service/SubscriptionExpireEmail.cs`	Every 24 hours	Sends expiry reminder emails. Targets subscriptions expiring in exactly 1, 3, or 7 days (configurable). Uses `EmailHtml.GetSubscriptionExpireEmailHtml()` for HTML template. Sends grace-period notice via `GetGracePeriodEmailHtml()` for subscriptions past EndDate but within the grace window.

Overlap protection: SubscriptionExpireService and SubscriptionExpireEmail run independently. Email is sent based on days-until-expiry check; downgrade only happens after the grace period expires. No flags are written to prevent double-processing — the time condition is the guard.

14 Admin Panel

Accessible only to users with the Admin role at /Admin/. Uses a separate layout (_AdminLayout.cshtml) with its own sidebar navigation and currency display.

Page	Route	What It Shows / Does
Dashboard	`/Admin/Dashboard`	Total users, active subscriptions, revenue (INR / converted), recent signups, plan distribution chart, today's credit usage.
Users	`/Admin/Users`	Paginated list of all users with plan, credits, subscription status, join date. Search by email. View individual user details. Manually adjust credits.
Revenue	`/Admin/Revenue`	Chronological list of all Checkout and CreditPurchase transactions. Filter by date range or plan. Export to CSV. Currency-convertible display.
Expiring Subscriptions	`/Admin/ExpiringSubscriptions`	Lists subscriptions expiring within a configurable number of days. Highlights urgency: red (≤2 days), amber (≤7 days).
Feature Seeder	`/Admin/SeedFeatures`	Re-runs `DataSeeder` to add any missing features or plan assignments without wiping existing data.
Test Virus Scan	`/Admin/TestVirusScan`	Scans the EICAR test string to verify Windows Defender is active. Returns `working`, `disabled_or_not_detected`, or `error`.
Credit Packages	`/Admin/CreditPackages`	Create, edit, activate, or deactivate add-on credit packages available on the Buy Credits page.

Role assignment: The first admin account is seeded at startup from appsettings.json → AdminUser. Additional admins must be assigned the Admin role directly in the database — there is no in-app role management UI.

15 Quick Register & Checkout Flow

On the Pricing page, unauthenticated users clicking a paid plan button open a modal (Quick Checkout modal) that registers the account and redirects to Checkout in a single step.

Click plan button→ Quick Checkout modal opens→ Fill details→ POST /Account/QuickRegister→ Account created & signed in→ Redirect to /Billing/Checkout

Detail	Value
Endpoint	`POST /Account/QuickRegister` — returns JSON `{ success, redirectUrl, error }`
Fields collected	Full Name, Email, Password, Confirm Password, Street Address, City, State, Country, Postal Code
Plan & cycle	Hidden fields in the modal form; forwarded to checkout URL as query params
Client validation	Inline JS validates all fields before submitting (required, email format, password strength: 8+ chars, uppercase, number, special char)
On server error	JSON error message mapped to the relevant field (email already taken, weak password, etc.)
Billing cycle	Reflects whatever toggle (Monthly / Yearly) was active when the modal opened