ProjectSend is a self-hosted secure file sharing platform built as a modular Laravel application with an Inertia.js + React frontend. The codebase is organized into domain modules — Files, Clients, Groups, Identity, Comments, Notifications, Audit, Platform, and Api — each containing controllers, services, policies, models, and event hooks. Staff members upload and share files with clients or groups, manage roles and permissions, enforce download limits, expire or version files, and monitor activity through a detailed audit log. Clients access their own portal with four switchable themes (default, compact, drive, gallery), and public share links support additional presentation themes with pagination, previews, and controlled downloads. The application is a monolith with strong modular boundaries rather than microservices. Authentication supports local accounts, LDAP, social login/SSO via OIDC, two-factor authentication, CAPTCHA, and password policies. A REST API protected by Sanctum tokens offers scoped abilities, RFC 7807 problem details, polling-based pagination, and an OpenAPI contract that is drift-tested against the live route surface. Background jobs handle zip downloads, email digests, thumbnails, file cleanup, and scheduled maintenance. The system persists settings, activity logs, notification preferences, and upload metadata in a relational database, while file payloads can be stored on local disks, S3-compatible storage, or Google Cloud Storage. The code is notably security-conscious: secrets are encrypted at rest, old input flashing excludes credentials, CSRF cookie naming is customized to avoid collisions, download paths are never exposed in API responses, and regression tests cover disclosure boundaries, permission scoping, token revocation, and account erasure. The test suite is extensive, using Pest feature tests to exercise permissions, file lifecycle edge cases, version chains, comment visibility, API contracts, and authentication flows. The architecture favors event-based extension points and registry patterns, making modules independently testable and partially reusable, though the project remains an application rather than a framework or library. Overall this is a well-crafted, actively maintained application with clean engineering practices, clear separation of concerns, and unusually thorough security regression coverage. Its main complexity is the large surface area of interchangeable themes, editions, authentication backends, and storage drivers, which creates some ongoing drift risk, but current CI, recent commits, and dependency management show the project is keeping pace with its ecosystem.
Papermark is an open-source document and data room sharing platform (DocSend alternative) built with Next.js, Prisma, and a modern SaaS stack. It provides secure document sharing with granular access controls (password, email verification, domain allow/deny lists, watermarking, screenshot protection), real-time analytics (page views, video playback, click tracking via Tinybird), and enterprise-grade features like virtual data rooms with folder hierarchies, group permissions, AI-powered document indexing and chat, signing agreements (Documenso integration), workflow automation, and Slack integration. The platform is monetized via Stripe subscriptions with tiered plans and includes a comprehensive billing/cancellation flow. The architecture is a full-stack Next.js application with a mix of Pages Router and App Router, using Prisma for PostgreSQL ORM, Redis for caching/rate limiting/job stores, Trigger.dev for background tasks, Tinybird for analytics pipes, and Vercel Blob/AWS S3 for file storage. Authentication supports NextAuth.js with passkeys, SAML SSO (via BoxyHQ Jackson), and OTP verification. The codebase is organized with a clear separation of enterprise features under an `ee/` directory, reusable UI components (shadcn/ui-based), and extensive SWR hooks for client-side data fetching. The repository demonstrates solid engineering practices with well-structured API routes, RBAC enforcement, and a rich set of utilities. However, it shows signs of technical drift: simultaneous use of Pages Router and App Router creates inconsistency, some API endpoints are large and monolithic, and there is duplication in folder management and export-visits logic. The rapid schema evolution (many Prisma migrations) indicates active development but also potential instability. Overall, it is a production-quality application with strong reusability in its UI components, i18n pattern, and utility libraries.