SYS · System Requirements
System Requirements
Complete functional requirements (FR) covering all 10 modules, and non-functional requirements (NFR) covering performance, security, reliability, scalability, and compliance.
⚙️ Part A — Functional Requirements
FR-AUTH · Authentication & Access Control
| ID | Requirement | Priority |
|---|---|---|
| FR-AUTH-01 | Email + password login using local PostgreSQL users table; passwords stored as bcrypt hashes (12 rounds); returns access token (JWT, 15 min TTL) + refresh token (JWT, 7 days) | Must |
| FR-AUTH-02 | Access token refreshed via POST /auth/refresh using the refresh token; old refresh token revoked on each use (token rotation) | Must |
| FR-AUTH-03 | Three roles: Admin (full access), User (read + limited write), Viewer (read-only); role stored in users table and embedded in JWT payload | Must |
| FR-AUTH-04 | Admin creates new users directly in admin panel (no email invitation flow); sets initial password; user changes on first login | Must |
| FR-AUTH-05 | Password reset: admin resets any user's password via admin panel; self-service reset via email link (SMTP required) | Must |
| FR-AUTH-06 | All API routes require valid Bearer JWT; Express middleware extracts userId + role; application-layer access control enforced per route (owner check: record.owner_id = req.userId) | Must |
| FR-AUTH-07 | Logout revokes current refresh token in DB; all subsequent refresh attempts with that token return 401 | Must |
FR-PROP · Property Management
| ID | Requirement | Priority |
|---|---|---|
| FR-PROP-01 | Create, read, update, delete (CRUD) properties with: name, type (residential/commercial/land/plot), address, GPS coordinates, purchase price, purchase date, notes | Must |
| FR-PROP-02 | Address geocoded automatically to lat/lng via OpenStreetMap Nominatim on save | Should |
| FR-PROP-03 | All properties displayed on interactive Leaflet map with colour-coded markers by type | Must |
| FR-PROP-04 | Property taxes: track property tax and water tax — amount, due date, payment date, paid/unpaid status, receipt upload; alert 30 days before due | Must |
| FR-PROP-05 | Property expenses: log electricity, internet, maintenance, and other expenses with category, date, amount, receipt upload; monthly and annual summaries generated | Must |
| FR-PROP-06 | Multiple contacts per property: name, phone (clickable), role (Caretaker / Agent / Tenant / Neighbour / Other) | Must |
| FR-PROP-07 | Documents linkable to a property (sale deed, encumbrance, tax receipts, electricity bills) | Must |
| FR-PROP-08 | Property detail page shows: summary, contacts, linked documents, expenses, tax records, rental records (if rental property) | Must |
| FR-PROP-09 | Map popup on marker click shows property name, type, upcoming due dates, and quick-dial contact | Should |
FR-VEH · Vehicle Management
| ID | Requirement | Priority |
|---|---|---|
| FR-VEH-01 | CRUD vehicles: type (2W/4W), make, model, year, registration no., chassis no., engine no., colour, fuel type, purchase price, purchase date, photo upload | Must |
| FR-VEH-02 | Insurance tracking per vehicle: insurer, policy no., type (comprehensive/TP), premium, IDV, start date, expiry date, document upload; alerts at 60, 30, 7 days before expiry | Must |
| FR-VEH-03 | Service history: date, odometer, work done, parts replaced, cost, service centre; next service date/km trigger configurable; alert 7 days before | Must |
| FR-VEH-04 | RC (Registration Certificate) renewal date tracked; alert at 30 days | Must |
| FR-VEH-05 | PUC (Pollution Under Control) certificate expiry tracked; alert at 15 days | Must |
| FR-VEH-06 | Road tax renewal tracking; alert at 45 days | Should |
| FR-VEH-07 | Fuel cost log per vehicle with date, litres, cost, and odometer | Could |
| FR-VEH-08 | Vehicle list shows status badges: Insurance OK/Expiring/Expired, Service Due, RC Renewal Due | Must |
FR-INS · Insurance Management
| ID | Requirement | Priority |
|---|---|---|
| FR-INS-01 | CRUD insurance policies: type (Health/Life/Term/Personal Accident/Home), insurer, plan name, policy no., sum insured/assured, premium, frequency (annual/monthly), start date, renewal/maturity date, nominee | Must |
| FR-INS-02 | Covered members linkable to each health policy (family floater: all, or individual per person) | Must |
| FR-INS-03 | Senior citizen policies (Father, Mother) displayed with pre-existing condition notes and cashless hospital list upload | Must |
| FR-INS-04 | Premium payment tracking: paid/due status, auto-alert at 30 and 7 days before renewal | Must |
| FR-INS-05 | Claim history: claim date, amount, description, status (approved/pending/rejected), settlement amount | Should |
| FR-INS-06 | Policy documents (PDF, scanned copies) uploadable and downloadable | Must |
| FR-INS-07 | Insurance summary: total annual premium across all policies, coverage totals by type | Should |
FR-DOC · Document Management
| ID | Requirement | Priority |
|---|---|---|
| FR-DOC-01 | Upload PDF, PNG, JPG, JPEG, TIFF documents up to 20MB; stored in configured storage (local/S3) | Must |
| FR-DOC-02 | Google Document AI processes upload and pre-fills: document name, number, issue date, expiry date, issuing authority | Must |
| FR-DOC-03 | User edits and confirms AI-extracted fields before final save | Must |
| FR-DOC-04 | Documents classified as Expiry (with alert) or Non-Expiry (no alert) | Must |
| FR-DOC-05 | Documents linked to a person (family member) and optionally to a property or vehicle | Must |
| FR-DOC-06 | Document status auto-computed: Valid / Expiring Soon (<90 days) / Expired | Must |
| FR-DOC-07 | Full-text search across document name, number, person, type, and notes | Must |
| FR-DOC-08 | Signed URL generated for secure document download (expires in 1 hour) | Must |
| FR-DOC-09 | Document version history: re-upload replaces file but retains previous version accessible | Should |
| FR-DOC-10 | Low-confidence AI extractions flagged as "Review Needed" and shown in review queue | Must |
FR-PHO · Passport Photographs
| ID | Requirement | Priority |
|---|---|---|
| FR-PHO-01 | Upload passport-size photographs per family member; stored with YYYY-MM-DD taken date in filename and metadata | Must |
| FR-PHO-02 | Timeline view per member: photos ordered by date, newest first | Must |
| FR-PHO-03 | Latest photo downloadable as high-quality original (no compression) | Must |
| FR-PHO-04 | Member gallery view: all members shown with their most recent photo | Should |
FR-FIN · Family Finances
| ID | Requirement | Priority |
|---|---|---|
| FR-FIN-01 | Log family expenses: date, category (Groceries / Health / Education / Dining / Utilities / Entertainment / Travel / Other), amount, description, optional receipt photo | Must |
| FR-FIN-02 | Monthly budget limits per category; visual alert when 80% budget consumed | Should |
| FR-FIN-03 | Monthly expense summary with category breakdown pie chart | Must |
| FR-FIN-04 | Income entry: date, source (Salary / Rental / Freelance / Dividend / Interest / Other), amount, description | Must |
| FR-FIN-05 | Monthly income vs expense comparison displayed as bar chart | Must |
| FR-FIN-06 | EMI/Loan tracking: lender, loan type, principal, EMI amount, due date, outstanding balance, end date; monthly EMI payment log | Must |
| FR-FIN-07 | Recurring expense setup: monthly bills auto-listed as expected entries (to be confirmed paid) | Should |
FR-RENT · Rental Management
| ID | Requirement | Priority |
|---|---|---|
| FR-RENT-01 | Link tenants to rental properties: tenant name, phone, email, move-in date, rent agreement upload | Must |
| FR-RENT-02 | Monthly rent collection: expected amount, received amount, payment date, payment mode (cash/bank/UPI), arrear auto-calculated | Must |
| FR-RENT-03 | Rental agreement expiry tracking; alert 60 days before agreement end for renewal | Must |
| FR-RENT-04 | Arrear report: total outstanding rent per property, total across all properties | Must |
| FR-RENT-05 | Rental property expenses (maintenance, repairs, painting, etc.) tracked separately from non-rental properties | Must |
| FR-RENT-06 | Annual rental income report per property (for tax reference — informational only) | Should |
| FR-RENT-07 | Security deposit tracking: amount received, held, refunded per tenant | Should |
FR-INV · Investment Tracking
| ID | Requirement | Priority |
|---|---|---|
| FR-INV-01 | Track investment accounts: type (Stocks / Mutual Funds / Fixed Deposit / PPF / NPS / Bonds / Gold / Other), institution, account/folio no., investment amount, current value, maturity date | Should |
| FR-INV-02 | Fixed deposit maturity alert at 30 days | Should |
| FR-INV-03 | Net worth calculator: sum of property values + vehicle values + investment values − outstanding loans | Should |
| FR-INV-04 | Bank account summary: bank, account no. (masked), type (savings/current), balance (manually updated), IFSC | Should |
| FR-INV-05 | Investment returns tracking: manually enter current value periodically; system plots value over time | Could |
FR-ALT · Alerts & Notifications
| ID | Requirement | Priority |
|---|---|---|
| FR-ALT-01 | Daily cron job (configurable time, default 08:00 IST) evaluates all upcoming due dates across all modules | Must |
| FR-ALT-02 | Email alerts sent via Gmail SMTP for: document expiry, insurance renewal, vehicle insurance expiry, vehicle service due, property tax due, RC/PUC renewal, rental agreement expiry, FD maturity, EMI due | Must |
| FR-ALT-03 | Alert deduplication: same alert not sent twice for the same event (checked via alert_logs table) | Must |
| FR-ALT-04 | Alert history log viewable in admin panel: date sent, recipient, type, status (sent/failed) | Must |
| FR-ALT-05 | Admin can trigger immediate test alert from settings panel | Should |
| FR-ALT-06 | Android push notification (FCM) sent in addition to email when app is installed | Should |
| FR-ALT-07 | Global alert thresholds configurable (default: 90, 30, 7 days); per-item overrides supported | Must |
FR-DASH · Dashboard
| ID | Requirement | Priority |
|---|---|---|
| FR-DASH-01 | Summary cards: Total Properties, Vehicles, Documents, Active Insurance Policies, Monthly Income, Monthly Expenses | Must |
| FR-DASH-02 | Upcoming due alerts panel: sorted list of all due items within next 90 days, colour coded by urgency | Must |
| FR-DASH-03 | Income vs Expense chart for current month and trailing 6 months | Must |
| FR-DASH-04 | Overdue items highlighted in red: expired documents, overdue rent, missed insurance renewal | Must |
| FR-DASH-05 | Net worth summary card (assets − liabilities) updated when any value changes | Should |
| FR-DASH-06 | Recent activity feed: last 10 additions or changes across all modules | Should |
🔬 Part B — Non-Functional Requirements
NFR-PERF · Performance
NFR-PERF-01Dashboard Load Time
The main dashboard must load and render all summary cards and the due-alerts panel within 2 seconds on a 4G mobile connection (50 Mbps).
Target: P95 < 2000ms on 4G · P50 < 800ms on WiFi
NFR-PERF-02Document Search Response
Search results must appear within 500ms of the last keystroke (after 300ms debounce) for up to 10,000 documents.
Target: P95 search API response < 300ms
NFR-PERF-03Document Upload Processing
Document AI processing should complete within 10 seconds for a standard single-page document. Multi-page documents (up to 10 pages) within 30 seconds.
Target: P90 AI extraction complete within 10s for single-page docs
NFR-PERF-04API Response Time
All API endpoints (except file upload and AI processing) must respond within 500ms at normal load (1–5 concurrent users).
Target: P95 API response < 500ms · P99 < 1500ms
NFR-SEC · Security
NFR-SEC-01Authentication
All API routes (except
POST /auth/login and POST /auth/refresh) require a valid Bearer JWT. Invalid or expired tokens return HTTP 401 immediately. JWT signed with HS256 using a secret stored encrypted in system_settings.Zero unauthenticated data access endpoints · JWT TTL: 15 minutes
NFR-SEC-02Encryption at Rest
Sensitive fields (Aadhaar numbers, PAN, bank account numbers, API keys in system_settings) stored AES-256-GCM encrypted. PostgreSQL data directory encrypted via OS-level encryption. SSL/TLS 1.3 for all data in transit. Uploaded files stored on local encrypted filesystem.
AES-256-GCM for sensitive DB fields · TLS 1.3 · bcrypt-12 for passwords
NFR-SEC-03Application-Level Access Control
Every data-mutating API route checks that the record's
owner_id matches the authenticated user's ID from the JWT. Admin role bypasses owner check. Viewer role is blocked from all write operations. All queries use parameterised statements (via Drizzle ORM) — no raw SQL string interpolation.Owner check on 100% of data routes · Parameterised queries only
NFR-SEC-04File Access Control
Uploaded files stored outside the web root; never served as static files. Downloads streamed via API after JWT verification. Signed tokens (HMAC) for file download URLs with 1-hour TTL — file path never exposed to client.
Signed download token TTL: 3600 seconds · Files outside web root
NFR-SEC-05-DBDatabase Network Security
PostgreSQL listens on Unix socket only (no TCP/IP port). No external DB access; API server connects via local socket. pg_hba.conf restricts connections to local unix socket with md5 auth for the app user. Separate PostgreSQL roles:
docuwealth_app (DML only) and docuwealth_admin (DDL for migrations).PostgreSQL: Unix socket only · No external port exposure · Least-privilege roles
NFR-SEC-05Rate Limiting
API endpoints rate-limited: auth endpoints at 10 requests/minute/IP; data endpoints at 200 requests/minute/user. Exceeding returns HTTP 429.
Auth: 10 req/min/IP · API: 200 req/min/user
NFR-REL · Reliability & Availability
NFR-REL-01Uptime Target
System must maintain ≥99.5% monthly uptime (allows <3.6 hours downtime/month). Planned maintenance windows must be outside 07:00–23:00 IST.
Target: 99.5% monthly uptime (≈3.6h allowed downtime/month)
NFR-REL-02Alert Delivery Reliability
Daily cron job must execute successfully ≥99% of days. Failed alert deliveries are retried up to 3 times at 15-minute intervals. Delivery failure logged and visible in admin panel.
Alert delivery rate target: ≥99% · Retry: 3× at 15-min intervals
NFR-REL-03Data Backup
Daily automated PostgreSQL backup to encrypted cloud storage (Google Drive or Backblaze B2). Backups retained for 30 days. Monthly restore test to verify integrity. RTO < 4 hours, RPO < 24 hours.
RTO < 4h · RPO < 24h · Retention: 30 days
NFR-SCAL · Scalability
NFR-SCAL-01Data Volume
System must handle up to 10,000 documents, 50 properties, 20 vehicles, 100 insurance policies, and 5 years of expense history without performance degradation.
Tested at: 10K docs · 50 properties · 5 years expenses
NFR-SCAL-02Concurrent Users
System designed for up to 10 simultaneous users (family scale). No horizontal scaling required at this stage; vertical scaling on Oracle Cloud.
Design capacity: 10 concurrent users
NFR-MAINT · Maintainability
NFR-MAINT-01Code Quality
TypeScript strict mode enabled for all frontend and backend code. ESLint with standard ruleset enforced in CI. No build warnings allowed to merge.
TypeScript strict · ESLint enforced · Zero CI warnings
NFR-MAINT-02Database Migrations
All schema changes made via Drizzle Kit versioned migration files in /db/migrations. Run with
drizzle-kit migrate. No manual psql schema changes. Rollback scripts provided for each migration. Migration history tracked in drizzle_migrations table.100% schema changes via Drizzle migrations · No manual DDL
NFR-MAINT-03Deployment
GitHub Actions CI/CD pipeline: push to main triggers automated build, test, and deploy. Zero-downtime deployment using nginx reload + PM2 cluster mode.
Zero-downtime deploy · GitHub Actions CI
NFR-USAB · Usability
NFR-USAB-01Responsive Design
All web pages must be fully functional on: mobile (320px+), tablet (768px+), and desktop (1280px+). No horizontal scrolling on any breakpoint.
Breakpoints: 320px · 768px · 1280px
NFR-USAB-02Accessibility
WCAG 2.1 Level AA compliance: all interactive elements keyboard-navigable, colour contrast ratio ≥4.5:1, form labels present, error messages descriptive.
WCAG 2.1 AA · Contrast ≥4.5:1