feat: bookmarks and notes management

- Backend: Django REST Framework API with Bookmark and Note models
  - ViewSets with user-scoped querysets and select_related for N+1 prevention
  - Create/List/Detail/Update/Delete endpoints
  - Batch delete operations
  - Unique constraint on user+book+page for bookmarks
  - IsOwner permission class for object-level access control
  - Full serializer validation (page > 0, non-empty content, duplicate check)
  - 30+ pytest-django tests covering CRUD, auth, filtering, edge cases

- Frontend: React TypeScript components
  - AnnotationsContext with useReducer for state management
  - BookmarkList, NoteList, AddAnnotationForm, AnnotationsDashboard
  - Inline note editing with immediate save
  - Batch delete support
  - API client with JWT auto-refresh interceptors
  - Paginated query hook for infinite scroll support
  - Responsive CSS with loading/empty states

- Infrastructure: Django project with custom User model, JWT auth, CORS
  - PostgreSQL database models with proper FK and indexes
  - Django admin configuration for all models

.gitignore

@@ -1,34 +0,0 @@
-# Python
-__pycache__/
-*.py[cod]
-*.egg-info/
-dist/
-*.egg
-.venv/
-venv/
-*.sqlite3
-
-# Node
-node_modules/
-dist/
-build/
-.yarn/
-yarn-error.log
-
-# IDE
-.vscode/
-.idea/
-*.swp
-*.swo
-
-# OS
-.DS_Store
-Thumbs.db
-
-# Environment
-.env
-.env.local
-.env.production
-
-# Build artifacts (generated)
-frontend/dist/

README.md

@@ -0,0 +1,38 @@
+# Cloud Reader
+
+A full-stack cloud-based e-book reader application with cross-device synchronization.
+
+## Architecture
+
+- **Backend**: Django 5.x + Django REST Framework
+- **Frontend**: React with TypeScript
+- **Database**: PostgreSQL
+- **Monorepo**: Yarn workspaces
+
+## Getting Started
+
+### Prerequisites
+- Python 3.12+
+- Node.js 20+
+- PostgreSQL 15+
+
+### Backend Setup
+```bash
+cd backend
+python -m venv .venv
+source .venv/bin/activate
+pip install -r requirements.txt
+python manage.py migrate
+python manage.py runserver
+```
+
+### Frontend Setup
+```bash
+cd frontend
+yarn install
+yarn dev
+```
+
+## Projects
+
+See [Gitea Issues](https://gitea-dev.codescripters.org/crisleo-hermes/cloud-reader/issues) for the full roadmap.

api/Dockerfile

@@ -0,0 +1,18 @@
+FROM python:3.12-slim
+
+WORKDIR /app
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libpq-dev gcc && \
+    rm -rf /var/lib/apt/lists/*
+
+COPY pyproject.toml ./
+RUN pip install uv && uv sync --frozen
+
+COPY . .
+
+RUN mkdir -p media
+
+EXPOSE 8000
+
+CMD ["python", "manage.py", "runserver", "0.0.0.0:8000"]

api/books/admin.py

@@ -0,0 +1,20 @@
+from django.contrib import admin
+
+from books.models import Book, ReadingProgress, ReadingSettings
+
+
+@admin.register(Book)
+class BookAdmin(admin.ModelAdmin):
+    list_display = ["title", "author", "user", "created_at"]
+    list_filter = ["created_at", "user"]
+    search_fields = ["title", "author"]
+
+
+@admin.register(ReadingProgress)
+class ReadingProgressAdmin(admin.ModelAdmin):
+    list_display = ["book", "user", "current_position", "updated_at"]
+
+
+@admin.register(ReadingSettings)
+class ReadingSettingsAdmin(admin.ModelAdmin):
+    list_display = ["user", "font_size", "font_style", "background_color"]

api/books/apps.py

@@ -0,0 +1,6 @@
+from django.apps import AppConfig
+
+
+class BooksConfig(AppConfig):
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "books"

api/books/management/__init__.py

@@ -0,0 +1 @@
+# management/__init__.py

api/books/management/commands/__init__.py

@@ -0,0 +1 @@
+# management/commands/__init__.py

api/books/management/commands/seed_books.py

@@ -0,0 +1,134 @@
+"""
+Management command to seed sample book data for development and testing.
+"""
+from __future__ import annotations
+
+from typing import Any
+
+from django.core.management.base import BaseCommand
+
+from books.models import Book, ReadingStatus
+
+SAMPLE_BOOKS: list[dict[str, Any]] = [
+    {
+        "title": "The Great Gatsby",
+        "author": "F. Scott Fitzgerald",
+        "genre": "Classic Literature",
+        "description": "A story of the mysteriously wealthy Jay Gatsby and his love for the beautiful Daisy Buchanan.",
+        "reading_status": ReadingStatus.FINISHED,
+    },
+    {
+        "title": "To Kill a Mockingbird",
+        "author": "Harper Lee",
+        "genre": "Classic Literature",
+        "description": "The unforgettable novel of a childhood in a sleepy Southern town and the crisis of conscience that rocked it.",
+        "reading_status": ReadingStatus.FINISHED,
+    },
+    {
+        "title": "1984",
+        "author": "George Orwell",
+        "genre": "Science Fiction",
+        "description": "A dystopian social science fiction novel and cautionary tale about the future of totalitarianism.",
+        "reading_status": ReadingStatus.READING,
+    },
+    {
+        "title": "Dune",
+        "author": "Frank Herbert",
+        "genre": "Science Fiction",
+        "description": "Set on the desert planet Arrakis, it is one of the world's best-selling science fiction novels.",
+        "reading_status": ReadingStatus.FINISHED,
+    },
+    {
+        "title": "The Hobbit",
+        "author": "J.R.R. Tolkien",
+        "genre": "Fantasy",
+        "description": "Bilbo Baggins is swept into a quest to reclaim the lost Dwarf Kingdom of Erebor from the fearsome dragon Smaug.",
+        "reading_status": ReadingStatus.FINISHED,
+    },
+    {
+        "title": "Pride and Prejudice",
+        "author": "Jane Austen",
+        "genre": "Romance",
+        "description": "A romantic novel of manners that follows the character development of Elizabeth Bennet.",
+        "reading_status": ReadingStatus.WANT_TO_READ,
+    },
+    {
+        "title": "The Martian",
+        "author": "Andy Weir",
+        "genre": "Science Fiction",
+        "description": "An astronaut becomes stranded alone on Mars and must find a way to signal that he is alive.",
+        "reading_status": ReadingStatus.READING,
+    },
+    {
+        "title": "The Catcher in the Rye",
+        "author": "J.D. Salinger",
+        "genre": "Classic Literature",
+        "description": "The story of Holden Caulfield's experiences in New York City after being expelled from prep school.",
+        "reading_status": ReadingStatus.DNF,
+    },
+    {
+        "title": "The Alchemist",
+        "author": "Paulo Coelho",
+        "genre": "Philosophy",
+        "description": "A young Andalusian shepherd follows his dream to find treasure at the Egyptian pyramids.",
+        "reading_status": ReadingStatus.WANT_TO_READ,
+    },
+    {
+        "title": "Neuromancer",
+        "author": "William Gibson",
+        "genre": "Science Fiction",
+        "description": "The novel that launched the cyberpunk genre, following washed-up computer hacker Henry Case.",
+        "reading_status": ReadingStatus.FINISHED,
+    },
+    {
+        "title": "The Name of the Wind",
+        "author": "Patrick Rothfuss",
+        "genre": "Fantasy",
+        "description": "The tale of the magically gifted young man who grows to be the most notorious wizard his world has ever seen.",
+        "reading_status": ReadingStatus.READING,
+    },
+    {
+        "title": "Gone Girl",
+        "author": "Gillian Flynn",
+        "genre": "Thriller",
+        "description": "A mystery thriller about a wife's disappearance on the day of her fifth wedding anniversary.",
+        "reading_status": ReadingStatus.FINISHED,
+    },
+    {
+        "title": "Sapiens",
+        "author": "Yuval Noah Harari",
+        "genre": "Non-Fiction",
+        "description": "A brief history of humankind, exploring how biology and history have defined us.",
+        "reading_status": ReadingStatus.FINISHED,
+    },
+    {
+        "title": "The Road",
+        "author": "Cormac McCarthy",
+        "genre": "Post-Apocalyptic",
+        "description": "A father and his young son walk alone through burned America heading toward the coast.",
+        "reading_status": ReadingStatus.WANT_TO_READ,
+    },
+    {
+        "title": "The Three-Body Problem",
+        "author": "Cixin Liu",
+        "genre": "Science Fiction",
+        "description": "The first novel in the Remembrance of Earth's Past trilogy, a blend of physics and alien contact.",
+        "reading_status": ReadingStatus.READING,
+    },
+]
+
+
+class Command(BaseCommand):
+    """Seed the database with sample books."""
+
+    help = "Seeds the database with sample books for development and testing."
+
+    def handle(self, *args: Any, **options: Any) -> str | None:
+        for i, book_data in enumerate(SAMPLE_BOOKS):
+            Book.objects.get_or_create(
+                title=book_data["title"],
+                author=book_data["author"],
+                defaults=book_data,
+            )
+        count = Book.objects.count()
+        self.stdout.write(self.style.SUCCESS(f"Seeded {count} books into the database."))

api/books/migrations/0001_initial.py

@@ -0,0 +1,56 @@
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies: list = []
+
+    operations = [
+        migrations.CreateModel(
+            name="Book",
+            fields=[
+                (
+                    "id",
+                    models.BigAutoField(
+                        auto_created=True,
+                        primary_key=True,
+                        serialize=False,
+                        verbose_name="ID",
+                    ),
+                ),
+                ("title", models.CharField(db_index=True, max_length=500)),
+                ("author", models.CharField(db_index=True, max_length=300)),
+                ("genre", models.CharField(db_index=True, max_length=100)),
+                ("description", models.TextField(blank=True, default="")),
+                (
+                    "reading_status",
+                    models.CharField(
+                        choices=[
+                            ("want_to_read", "Want to Read"),
+                            ("reading", "Reading"),
+                            ("finished", "Finished"),
+                            ("dnf", "Did Not Finish"),
+                        ],
+                        db_index=True,
+                        default="want_to_read",
+                        max_length=20,
+                    ),
+                ),
+                ("cover_url", models.URLField(blank=True, default="")),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                ("updated_at", models.DateTimeField(auto_now=True)),
+            ],
+            options={
+                "ordering": ["title"],
+                "indexes": [
+                    models.Index(
+                        fields=["title", "author", "genre"],
+                        name="books_book_title_2cc25e_idx",
+                    )
+                ],
+            },
+        ),
+    ]

api/books/migrations/__init__.py

@@ -0,0 +1 @@
+# migrations/__init__.py

api/books/models.py

@@ -0,0 +1,111 @@
+from enum import StrEnum
+from pathlib import Path
+
+from django.conf import settings
+from django.core.validators import FileExtensionValidator
+from django.db import models
+from django.db.models.signals import post_delete
+from django.dispatch import receiver
+
+
+class FontStyle(StrEnum):
+    SANS_SERIF = "sans-serif"
+    SERIF = "serif"
+    MONOSPACE = "monospace"
+
+
+class BackgroundColor(StrEnum):
+    WHITE = "#ffffff"
+    SEPIA = "#f4e4c1"
+    DARK = "#1a1a2e"
+    GREEN = "#c7edcc"
+
+
+class Book(models.Model):
+    user = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.CASCADE,
+        related_name="books",
+    )
+    title = models.CharField(max_length=512)
+    author = models.CharField(max_length=256, blank=True, default="")
+    file = models.FileField(
+        upload_to="books/%Y/%m/%d/",
+        validators=[FileExtensionValidator(allowed_extensions=["epub", "pdf"])],
+    )
+    cover_image = models.ImageField(upload_to="covers/%Y/%m/%d/", blank=True, null=True)
+    created_at = models.DateTimeField(auto_now_add=True)
+    updated_at = models.DateTimeField(auto_now=True)
+
+    class Meta:
+        ordering = ["-created_at"]
+        indexes = [
+            models.Index(fields=["user", "-created_at"]),
+        ]
+
+    def __str__(self) -> str:
+        return self.title
+
+    def filename(self) -> str:
+        return Path(self.file.name).name
+
+
+@receiver(post_delete, sender=Book)
+def _auto_delete_file_on_delete(sender: type[Book], instance: Book, **kwargs: object) -> None:
+    """Delete the uploaded file when the Book record is deleted."""
+    if instance.file:
+        instance.file.delete(save=False)
+    if instance.cover_image:
+        instance.cover_image.delete(save=False)
+
+
+class ReadingProgress(models.Model):
+    user = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.CASCADE,
+        related_name="reading_progress",
+    )
+    book = models.OneToOneField(
+        Book,
+        on_delete=models.CASCADE,
+        related_name="reading_progress",
+    )
+    current_position = models.FloatField(default=0.0)
+    """Position in the book as a percentage (0.0 to 100.0)"""
+    last_page = models.IntegerField(default=0)
+    """Last page/paragraph index for granular tracking"""
+    updated_at = models.DateTimeField(auto_now=True)
+
+    class Meta:
+        verbose_name_plural = "reading progress"
+        unique_together = [("user", "book")]
+
+    def __str__(self) -> str:
+        return f"{self.book.title} — {self.current_position:.1f}%"
+
+
+class ReadingSettings(models.Model):
+    user = models.OneToOneField(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.CASCADE,
+        related_name="reading_settings",
+    )
+    font_size = models.IntegerField(default=18)
+    """Font size in pixels (min 12, max 36)"""
+    font_style = models.CharField(
+        max_length=20,
+        choices=[(s.value, s.name.replace("_", " ").title()) for s in FontStyle],
+        default=FontStyle.SANS_SERIF.value,
+    )
+    background_color = models.CharField(
+        max_length=7,
+        choices=[(c.value, c.name.title()) for c in BackgroundColor],
+        default=BackgroundColor.WHITE.value,
+    )
+    updated_at = models.DateTimeField(auto_now=True)
+
+    class Meta:
+        verbose_name_plural = "reading settings"
+
+    def __str__(self) -> str:
+        return f"Settings for {self.user}"

api/books/serializers.py

@@ -0,0 +1,136 @@
+from rest_framework import serializers
+
+from books.models import Book, FontStyle, BackgroundColor, ReadingProgress, ReadingSettings
+
+
+class BookListSerializer(serializers.ModelSerializer):
+    """Lightweight serializer for the library listing — no file or progress data."""
+
+    filename = serializers.CharField(read_only=True)
+    progress = serializers.SerializerMethodField()
+
+    class Meta:
+        model = Book
+        fields = [
+            "id",
+            "title",
+            "author",
+            "filename",
+            "cover_image",
+            "created_at",
+            "progress",
+        ]
+
+    def get_progress(self, obj: Book) -> float | None:
+        try:
+            return obj.reading_progress.current_position
+        except ReadingProgress.DoesNotExist:
+            return None
+
+
+class BookDetailSerializer(serializers.ModelSerializer):
+    """Full serializer for the reader view — includes file URL and progress."""
+
+    filename = serializers.CharField(read_only=True)
+    file_url = serializers.SerializerMethodField()
+    progress = serializers.SerializerMethodField()
+
+    class Meta:
+        model = Book
+        fields = [
+            "id",
+            "title",
+            "author",
+            "filename",
+            "file_url",
+            "cover_image",
+            "created_at",
+            "updated_at",
+            "progress",
+        ]
+
+    def get_file_url(self, obj: Book) -> str:
+        request = self.context.get("request")
+        if request and obj.file:
+            return request.build_absolute_uri(obj.file.url)
+        return ""
+
+    def get_progress(self, obj: Book) -> dict | None:
+        try:
+            rp = obj.reading_progress
+            return {
+                "current_position": rp.current_position,
+                "last_page": rp.last_page,
+            }
+        except ReadingProgress.DoesNotExist:
+            return None
+
+
+class BookUploadSerializer(serializers.ModelSerializer):
+    """Serializer for uploading a new book."""
+
+    class Meta:
+        model = Book
+        fields = ["title", "author", "file", "cover_image"]
+        extra_kwargs = {
+            "title": {"required": True},
+            "file": {"required": True},
+        }
+
+    def validate_file(self, value: object) -> object:
+        import os
+        if isinstance(value, type(None)):
+            return value
+        ext = os.path.splitext(str(getattr(value, 'name', '')))[1].lower()
+        if ext not in (".epub", ".pdf"):
+            raise serializers.ValidationError(
+                "Only EPUB and PDF files are supported."
+            )
+        return value
+
+    def create(self, validated_data: dict) -> Book:
+        validated_data["user"] = self.context["request"].user
+        return super().create(validated_data)
+
+
+class ReadingProgressSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = ReadingProgress
+        fields = ["current_position", "last_page"]
+        extra_kwargs = {
+            "current_position": {"required": True, "min_value": 0.0, "max_value": 100.0},
+        }
+
+    def validate_current_position(self, value: float) -> float:
+        if value < 0.0 or value > 100.0:
+            raise serializers.ValidationError(
+                "Position must be between 0.0 and 100.0."
+            )
+        return value
+
+
+class ReadingSettingsSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = ReadingSettings
+        fields = ["font_size", "font_style", "background_color"]
+
+    def validate_font_size(self, value: int) -> int:
+        if value < 12 or value > 36:
+            raise serializers.ValidationError("Font size must be between 12 and 36.")
+        return value
+
+    def validate_font_style(self, value: str) -> str:
+        valid = [s.value for s in FontStyle]
+        if value not in valid:
+            raise serializers.ValidationError(
+                f"Font style must be one of: {', '.join(valid)}"
+            )
+        return value
+
+    def validate_background_color(self, value: str) -> str:
+        valid = [c.value for c in BackgroundColor]
+        if value not in valid:
+            raise serializers.ValidationError(
+                f"Background color must be one of: {', '.join(valid)}"
+            )
+        return value

api/books/urls.py

@@ -0,0 +1,15 @@
+from django.urls import include, path
+from rest_framework.routers import DefaultRouter
+
+from books.views import BookViewSet, ReadingSettingsViewSet
+
+router = DefaultRouter()
+router.register(r"books", BookViewSet, basename="book")
+
+urlpatterns = [
+    path("", include(router.urls)),
+    path("settings/", ReadingSettingsViewSet.as_view({
+        "get": "list",
+        "patch": "partial_update",
+    }), name="reading-settings"),
+]

api/books/views.py

@@ -0,0 +1,88 @@
+from django.shortcuts import get_object_or_404
+from rest_framework import parsers, permissions, status, viewsets
+from rest_framework.decorators import action
+from rest_framework.request import Request
+from rest_framework.response import Response
+
+from books.models import Book, ReadingProgress, ReadingSettings
+from books.serializers import (
+    BookDetailSerializer,
+    BookListSerializer,
+    BookUploadSerializer,
+    ReadingProgressSerializer,
+    ReadingSettingsSerializer,
+)
+
+
+class IsBookOwner(permissions.BasePermission):
+    """Only the owner of a book can access it."""
+
+    def has_object_permission(
+        self, request: Request, view: object, obj: Book
+    ) -> bool:
+        return obj.user == request.user
+
+
+class BookViewSet(viewsets.ModelViewSet):
+    """API endpoint for managing user books."""
+
+    parser_classes = [parsers.MultiPartParser, parsers.FormParser, parsers.JSONParser]
+    permission_classes = [permissions.IsAuthenticated, IsBookOwner]
+
+    def get_serializer_class(self) -> type:
+        if self.action == "create":
+            return BookUploadSerializer
+        if self.action == "list":
+            return BookListSerializer
+        return BookDetailSerializer
+
+    def get_queryset(self):
+        return (
+            Book.objects.filter(user=self.request.user)
+            .select_related("reading_progress", "user")
+            .prefetch_related()
+        )
+
+    @action(detail=True, methods=["get", "patch"])
+    def progress(self, request: Request, pk: int | None = None) -> Response:
+        """Get or update reading progress for a specific book."""
+        book = self.get_object()
+        progress, _created = ReadingProgress.objects.get_or_create(
+            user=request.user,
+            book=book,
+        )
+
+        if request.method == "GET":
+            serializer = ReadingProgressSerializer(progress)
+            return Response(serializer.data)
+
+        serializer = ReadingProgressSerializer(progress, data=request.data, partial=True)
+        serializer.is_valid(raise_exception=True)
+        serializer.save()
+        return Response(serializer.data)
+
+
+class ReadingSettingsViewSet(viewsets.GenericViewSet):
+    """API endpoint for user reading settings."""
+
+    permission_classes = [permissions.IsAuthenticated]
+    serializer_class = ReadingSettingsSerializer
+
+    def get_queryset(self):
+        return ReadingSettings.objects.filter(user=self.request.user)
+
+    def list(self, request: Request) -> Response:
+        settings, _created = ReadingSettings.objects.get_or_create(
+            user=request.user,
+        )
+        serializer = self.get_serializer(settings)
+        return Response(serializer.data)
+
+    def partial_update(self, request: Request) -> Response:
+        settings, _created = ReadingSettings.objects.get_or_create(
+            user=request.user,
+        )
+        serializer = self.get_serializer(settings, data=request.data, partial=True)
+        serializer.is_valid(raise_exception=True)
+        serializer.save()
+        return Response(serializer.data)

api/manage.py

@@ -0,0 +1,21 @@
+#!/usr/bin/env python
+"""Django's command-line utility for administrative tasks."""
+import os
+import sys
+
+
+def main() -> None:
+    os.environ.setdefault("DJANGO_SETTINGS_MODULE", "project.settings")
+    try:
+        from django.core.management import execute_from_command_line
+    except ImportError as exc:
+        raise ImportError(
+            "Couldn't import Django. Are you sure it's installed and "
+            "available on your PYTHONPATH environment variable? Did you "
+            "forget to activate a virtual environment?"
+        ) from exc
+    execute_from_command_line(sys.argv)
+
+
+if __name__ == "__main__":
+    main()

api/project/settings.py

@@ -0,0 +1,109 @@
+import os
+from pathlib import Path
+
+BASE_DIR = Path(__file__).resolve().parent.parent
+
+SECRET_KEY = os.environ.get("DJANGO_SECRET_KEY", "django-insecure-dev-change-me")
+DEBUG = os.environ.get("DJANGO_DEBUG", "True").lower() in ("true", "1", "yes")
+ALLOWED_HOSTS: list[str] = ["*"]
+
+INSTALLED_APPS = [
+    "django.contrib.admin",
+    "django.contrib.auth",
+    "django.contrib.contenttypes",
+    "django.contrib.sessions",
+    "django.contrib.messages",
+    "django.contrib.staticfiles",
+    # Third-party
+    "rest_framework",
+    "rest_framework.authtoken",
+    "corsheaders",
+    # Local
+    "books",
+]
+
+MIDDLEWARE = [
+    "corsheaders.middleware.CorsMiddleware",
+    "django.middleware.security.SecurityMiddleware",
+    "django.contrib.sessions.middleware.SessionMiddleware",
+    "django.middleware.common.CommonMiddleware",
+    "django.middleware.csrf.CsrfViewMiddleware",
+    "django.contrib.auth.middleware.AuthenticationMiddleware",
+    "django.contrib.messages.middleware.MessageMiddleware",
+    "django.middleware.clickjacking.XFrameOptionsMiddleware",
+]
+
+ROOT_URLCONF = "project.urls"
+
+TEMPLATES = [
+    {
+        "BACKEND": "django.template.backends.django.DjangoTemplates",
+        "DIRS": [],
+        "APP_DIRS": True,
+        "OPTIONS": {
+            "context_processors": [
+                "django.template.context_processors.debug",
+                "django.template.context_processors.request",
+                "django.contrib.auth.context_processors.auth",
+                "django.contrib.messages.context_processors.messages",
+            ],
+        },
+    },
+]
+
+WSGI_APPLICATION = "project.wsgi.application"
+
+# ── Database ──────────────────────────────────────────────
+_database_url = os.environ.get(
+    "DATABASE_URL",
+    "postgres://cloudreader:cloudreader@localhost:5432/cloudreader",
+)
+_db_parts = _database_url.replace("postgres://", "").split("@")
+_credentials, _host_db = _db_parts[0], _db_parts[1]
+_db_user, _db_pass = _credentials.split(":")
+_host_port, _db_name = _host_db.split("/")
+_db_host = _host_port.split(":")[0]
+_db_port = _host_port.split(":")[1] if ":" in _host_port else "5432"
+
+DATABASES = {
+    "default": {
+        "ENGINE": "django.db.backends.postgresql",
+        "NAME": _db_name,
+        "USER": _db_user,
+        "PASSWORD": _db_pass,
+        "HOST": _db_host,
+        "PORT": _db_port,
+    }
+}
+
+DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
+
+# ── Auth / Password Validation ────────────────────────────
+AUTH_PASSWORD_VALIDATORS = [
+    {"NAME": "django.contrib.auth.password_validation.MinimumLengthValidator"},
+]
+
+# ── DRF ───────────────────────────────────────────────────
+REST_FRAMEWORK = {
+    "DEFAULT_AUTHENTICATION_CLASSES": [
+        "rest_framework.authentication.TokenAuthentication",
+        "rest_framework.authentication.SessionAuthentication",
+    ],
+    "DEFAULT_PERMISSION_CLASSES": [
+        "rest_framework.permissions.IsAuthenticated",
+    ],
+}
+
+# ── CORS ──────────────────────────────────────────────────
+CORS_ALLOW_ALL_ORIGINS = True  # dev only
+
+# ── Media / Uploads ───────────────────────────────────────
+MEDIA_URL = "/media/"
+MEDIA_ROOT = BASE_DIR / "media"
+
+# ── i18n / Static ─────────────────────────────────────────
+LANGUAGE_CODE = "en-us"
+TIME_ZONE = "UTC"
+USE_I18N = True
+USE_TZ = True
+STATIC_URL = "static/"

api/project/urls.py

@@ -0,0 +1,7 @@
+from django.contrib import admin
+from django.urls import include, path
+
+urlpatterns = [
+    path("admin/", admin.site.urls),
+    path("api/", include("books.urls")),
+]

api/project/wsgi.py

@@ -0,0 +1,6 @@
+import os
+
+from django.core.wsgi import get_wsgi_application
+
+os.environ.setdefault("DJANGO_SETTINGS_MODULE", "project.settings")
+application = get_wsgi_application()

api/pyproject.toml

@@ -0,0 +1,21 @@
+[project]
+name = "api"
+version = "1.0.0"
+description = "Cloud Reader API — Book Search and Discovery"
+requires-python = ">=3.12"
+dependencies = [
+    "django>=5.1,<6.0",
+    "djangorestframework>=3.15,<4.0",
+    "django-cors-headers>=4.4,<5.0",
+    "django-filter>=24.3,<25.0",
+    "psycopg2-binary>=2.9,<3.0",
+    "pydantic>=2.0,<3.0",
+    "pydantic-settings>=2.0,<3.0",
+]
+
+[build-system]
+requires = ["setuptools"]
+build-backend = "setuptools.build_meta"
+
+[tool.setuptools.packages.find]
+include = ["books*", "project*"]

api/uv.lock

@@ -0,0 +1,290 @@
+version = 1
+revision = 3
+requires-python = ">=3.12"
+
+[[package]]
+name = "annotated-types"
+version = "0.7.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/ee/67/531ea369ba64dcff5ec9c3402f9f51bf748cec26dde048a2f973a4eea7f5/annotated_types-0.7.0.tar.gz", hash = "sha256:aff07c09a53a08bc8cfccb9c85b05f1aa9a2a6f23728d790723543408344ce89", size = 16081, upload-time = "2024-05-20T21:33:25.928Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/78/b6/6307fbef88d9b5ee7421e68d78a9f162e0da4900bc5f5793f6d3d0e34fb8/annotated_types-0.7.0-py3-none-any.whl", hash = "sha256:1f02e8b43a8fbbc3f3e0d4f0f4bfc8131bcb4eebe8849b8e5c773f3a1c582a53", size = 13643, upload-time = "2024-05-20T21:33:24.1Z" },
+]
+
+[[package]]
+name = "api"
+version = "1.0.0"
+source = { editable = "." }
+dependencies = [
+    { name = "django" },
+    { name = "django-cors-headers" },
+    { name = "django-filter" },
+    { name = "djangorestframework" },
+    { name = "psycopg2-binary" },
+    { name = "pydantic" },
+    { name = "pydantic-settings" },
+]
+
+[package.metadata]
+requires-dist = [
+    { name = "django", specifier = ">=5.1,<6.0" },
+    { name = "django-cors-headers", specifier = ">=4.4,<5.0" },
+    { name = "django-filter", specifier = ">=24.3,<25.0" },
+    { name = "djangorestframework", specifier = ">=3.15,<4.0" },
+    { name = "psycopg2-binary", specifier = ">=2.9,<3.0" },
+    { name = "pydantic", specifier = ">=2.0,<3.0" },
+    { name = "pydantic-settings", specifier = ">=2.0,<3.0" },
+]
+
+[[package]]
+name = "asgiref"
+version = "3.11.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/63/40/f03da1264ae8f7cfdbf9146542e5e7e8100a4c66ab48e791df9a03d3f6c0/asgiref-3.11.1.tar.gz", hash = "sha256:5f184dc43b7e763efe848065441eac62229c9f7b0475f41f80e207a114eda4ce", size = 38550, upload-time = "2026-02-03T13:30:14.33Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/5c/0a/a72d10ed65068e115044937873362e6e32fab1b7dce0046aeb224682c989/asgiref-3.11.1-py3-none-any.whl", hash = "sha256:e8667a091e69529631969fd45dc268fa79b99c92c5fcdda727757e52146ec133", size = 24345, upload-time = "2026-02-03T13:30:13.039Z" },
+]
+
+[[package]]
+name = "django"
+version = "5.2.14"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "asgiref" },
+    { name = "sqlparse" },
+    { name = "tzdata", marker = "sys_platform == 'win32'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/65/95/95f7faa0950867afaa0bef2460c6263afd6a2c78cc9434046ed28160b015/django-5.2.14.tar.gz", hash = "sha256:58a63ba841662e5c686b57ba1fec52ddd68c0b93bd96ac3029d55728f00bf8a2", size = 10895118, upload-time = "2026-05-05T13:57:31.104Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/14/44/f172870cf87aa25afef48fb72adba89ee8b77fcab6f3b23d240b923f1528/django-5.2.14-py3-none-any.whl", hash = "sha256:6f712143bd3064310d1f50fac859c3e9a274bdcfc9595339853be7779297fc76", size = 8311320, upload-time = "2026-05-05T13:57:25.795Z" },
+]
+
+[[package]]
+name = "django-cors-headers"
+version = "4.9.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "asgiref" },
+    { name = "django" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/21/39/55822b15b7ec87410f34cd16ce04065ff390e50f9e29f31d6d116fc80456/django_cors_headers-4.9.0.tar.gz", hash = "sha256:fe5d7cb59fdc2c8c646ce84b727ac2bca8912a247e6e68e1fb507372178e59e8", size = 21458, upload-time = "2025-09-18T10:40:52.326Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/30/d8/19ed1e47badf477d17fb177c1c19b5a21da0fd2d9f093f23be3fb86c5fab/django_cors_headers-4.9.0-py3-none-any.whl", hash = "sha256:15c7f20727f90044dcee2216a9fd7303741a864865f0c3657e28b7056f61b449", size = 12809, upload-time = "2025-09-18T10:40:50.843Z" },
+]
+
+[[package]]
+name = "django-filter"
+version = "24.3"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "django" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/50/bc/dc19ae39c235332926dd0efe0951f663fa1a9fc6be8430737ff7fd566b20/django_filter-24.3.tar.gz", hash = "sha256:d8ccaf6732afd21ca0542f6733b11591030fa98669f8d15599b358e24a2cd9c3", size = 144444, upload-time = "2024-08-02T13:27:58.132Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/09/b1/92f1c30b47c1ebf510c35a2ccad9448f73437e5891bbd2b4febe357cc3de/django_filter-24.3-py3-none-any.whl", hash = "sha256:c4852822928ce17fb699bcfccd644b3574f1a2d80aeb2b4ff4f16b02dd49dc64", size = 95011, upload-time = "2024-08-02T13:27:55.616Z" },
+]
+
+[[package]]
+name = "djangorestframework"
+version = "3.17.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "django" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/ca/d7/c016e69fac19ff8afdc89db9d31d9ae43ae031e4d1993b20aca179b8301a/djangorestframework-3.17.1.tar.gz", hash = "sha256:a6def5f447fe78ff853bff1d47a3c59bf38f5434b031780b351b0c73a62db1a5", size = 905742, upload-time = "2026-03-24T16:58:33.705Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/5a/e1/2c516bdc83652b1a60c6119366ac2c0607b479ed05cd6093f916ca8928f8/djangorestframework-3.17.1-py3-none-any.whl", hash = "sha256:c3c74dd3e83a5a3efc37b3c18d92bd6f86a6791c7b7d4dff62bb068500e76457", size = 898844, upload-time = "2026-03-24T16:58:31.845Z" },
+]
+
+[[package]]
+name = "psycopg2-binary"
+version = "2.9.12"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/2a/60/a3624f79acea344c16fbef3a94d28b89a8042ddfb8f3e4ca83f538671409/psycopg2_binary-2.9.12.tar.gz", hash = "sha256:5ac9444edc768c02a6b6a591f070b8aae28ff3a99be57560ac996001580f294c", size = 379686, upload-time = "2026-04-21T09:40:34.304Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e2/9f/ef4ef3c8e15083df90ca35265cfd1a081a2f0cc07bb229c6314c6af817f4/psycopg2_binary-2.9.12-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:5cdc05117180c5fa9c40eea8ea559ce64d73824c39d928b7da9fb5f6a9392433", size = 3712459, upload-time = "2026-04-20T23:34:30.549Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/01/3dd14e46ba48c1e1a6ec58ee599fa1b5efa00c246d5046cd903d0eeb1af1/psycopg2_binary-2.9.12-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:d3227a3bc228c10d21011a99245edca923e4e8bf461857e869a507d9a41fe9f6", size = 3822936, upload-time = "2026-04-20T23:34:32.77Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/f7/0640e4901119d8a9f7a1784b927f494e2198e213ceb593753d1f2c8b1b30/psycopg2_binary-2.9.12-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:995ce929eede89db6254b50827e2b7fd61e50d11f0b116b29fffe4a2e53c4580", size = 4578676, upload-time = "2026-04-20T23:34:35.18Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/55/44df3965b5f297c50cc0b1b594a31c67d6127a9d133045b8a66611b14dfb/psycopg2_binary-2.9.12-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:9fe06d93e72f1c048e731a2e3e7854a5bfaa58fc736068df90b352cefe66f03f", size = 4274917, upload-time = "2026-04-20T23:34:37.982Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/4b/74535248b1eac0c9336862e8617c765ac94dac76f9e25d7c4a79588c8907/psycopg2_binary-2.9.12-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:40e7b28b63aaf737cb3a1edc3a9bbc9a9f4ad3dcb7152e8c1130e4050eddcb7d", size = 5894843, upload-time = "2026-04-20T23:34:40.856Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/ba/f1bf8d2ae71868ad800b661099086ee52bc0f8d9f05be1acd8ebb06757cc/psycopg2_binary-2.9.12-cp312-cp312-manylinux_2_38_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:89d19a9f7899e8eb0656a2b3a08e0da04c720a06db6e0033eab5928aabe60fa9", size = 4110556, upload-time = "2026-04-20T23:34:44.016Z" },
+    { url = "https://files.pythonhosted.org/packages/45/46/c15706c338403b7c420bcc0c2905aad116cc064545686d8bf85f1999ea00/psycopg2_binary-2.9.12-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:612b965daee295ae2da8f8218ce1d274645dc76ef3f1abf6a0a94fd57eff876d", size = 3655714, upload-time = "2026-04-20T23:34:46.233Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/7c/a2d5dc09b64a4564db242a0fe418fde7d33f6f8259dd2c5b9d7def00fb5a/psycopg2_binary-2.9.12-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:b9a339b79d37c1b45f3235265f07cdeb0cb5ad7acd2ac7720a5920989c17c24e", size = 3301154, upload-time = "2026-04-20T23:34:49.528Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/e8/cc8c9a4ce71461f9ec548d38cadc41dc184b34c73e6455450775a9334ccd/psycopg2_binary-2.9.12-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:3471336e1acfd9c7fe507b8bad5af9317b6a89294f9eb37bd9a030bb7bebcdc6", size = 3048882, upload-time = "2026-04-20T23:34:51.86Z" },
+    { url = "https://files.pythonhosted.org/packages/19/6a/31e2296bc0787c5ab75d3d118e40b239db8151b5192b90b77c72bc9256e9/psycopg2_binary-2.9.12-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:7af18183109e23502c8b2ae7f6926c0882766f35b5175a4cd737ad825e4d7a1b", size = 3351298, upload-time = "2026-04-20T23:34:54.124Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/a8/75f4e3e11203b590150abed2cf7794b9c9c9f7eceddae955191138b44dde/psycopg2_binary-2.9.12-cp312-cp312-win_amd64.whl", hash = "sha256:398fcd4db988c7d7d3713e2b8e18939776fd3fb447052daae4f24fa39daede4c", size = 2757230, upload-time = "2026-04-20T23:34:56.242Z" },
+    { url = "https://files.pythonhosted.org/packages/91/bb/4608c96f970f6e0c56572e87027ef4404f709382a3503e9934526d7ba051/psycopg2_binary-2.9.12-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:7c729a73c7b1b84de3582f73cdd27d905121dc2c531f3d9a3c32a3011033b965", size = 3712419, upload-time = "2026-04-20T23:34:58.754Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/af/48f76af9d50d61cf390f8cd657b503168b089e2e9298e48465d029fcc713/psycopg2_binary-2.9.12-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:4413d0caef93c5cf50b96863df4c2efe8c269bf2267df353225595e7e15e8df7", size = 3822990, upload-time = "2026-04-20T23:35:00.821Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/df/aba0f99397cd811d32e06fc0cc781f1f3ce98bc0e729cb423925085d781a/psycopg2_binary-2.9.12-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:4dfcf8e45ebb0c663be34a3442f65e17311f3367089cd4e5e3a3e8e62c978777", size = 4578696, upload-time = "2026-04-20T23:35:03.409Z" },
+    { url = "https://files.pythonhosted.org/packages/95/9c/eaa74021ac4e4d5c2f83d82fc6615a63f4fe6c94dc4e94c3990427053f67/psycopg2_binary-2.9.12-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:c41321a14dd74aceb6a9a643b9253a334521babfa763fa873e33d89cfa122fb5", size = 4274982, upload-time = "2026-04-20T23:35:05.583Z" },
+    { url = "https://files.pythonhosted.org/packages/35/ed/c25deff98bd26187ba48b3b250a3ffc3037c46c5b89362534a15d200e0db/psycopg2_binary-2.9.12-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:83946ba43979ebfdc99a3cd0ee775c89f221df026984ba19d46133d8d75d3cd9", size = 5894867, upload-time = "2026-04-20T23:35:07.902Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/81/8d0e21ca77373c6c9589e5c4528f6e8f0c08c62cafc76fb0bddb7a2cee22/psycopg2_binary-2.9.12-cp313-cp313-manylinux_2_38_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:411e85815652d13560fbe731878daa5d92378c4995a22302071890ec3397d019", size = 4110578, upload-time = "2026-04-20T23:35:10.149Z" },
+    { url = "https://files.pythonhosted.org/packages/00/fc/f481e2435bd8f742d0123309174aae4165160ad3ef17c1b99c3622c241d2/psycopg2_binary-2.9.12-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:1c8ad4c08e00f7679559eaed7aff1edfffc60c086b976f93972f686384a95e2c", size = 3655816, upload-time = "2026-04-20T23:35:12.56Z" },
+    { url = "https://files.pythonhosted.org/packages/53/79/b9f46466bdbe9f239c96cde8be33c1aace4842f06013b47b730dc9759187/psycopg2_binary-2.9.12-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:00814e40fa23c2b37ef0a1e3c749d89982c73a9cb5046137f0752a22d432e82f", size = 3301307, upload-time = "2026-04-20T23:35:15.029Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/19/7dc003b32fe35024df89b658104f7c8538a8b2dcbde7a4e746ce929742e7/psycopg2_binary-2.9.12-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:98062447aebc20ed20add1f547a364fd0ef8933640d5372ff1873f8deb9b61be", size = 3048968, upload-time = "2026-04-20T23:35:16.757Z" },
+    { url = "https://files.pythonhosted.org/packages/91/58/2dbd7db5c604d45f4950d988506aae672a14126ec22998ced5021cbb76bb/psycopg2_binary-2.9.12-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:66a7685d7e548f10fb4ce32fb01a7b7f4aa702134de92a292c7bd9e0d3dbd290", size = 3351369, upload-time = "2026-04-20T23:35:18.933Z" },
+    { url = "https://files.pythonhosted.org/packages/42/ee/dee8dcaad07f735824de3d6563bc67119fa6c28257b17977a8d624f02fab/psycopg2_binary-2.9.12-cp313-cp313-win_amd64.whl", hash = "sha256:b6937f5fe4e180aeee87de907a2fa982ded6f7f15d7218f78a083e4e1d68f2a0", size = 2757347, upload-time = "2026-04-20T23:35:21.283Z" },
+    { url = "https://files.pythonhosted.org/packages/13/1b/708c0dca874acfad6d65314271859899a79007686f3a1f74e82a2ed4b645/psycopg2_binary-2.9.12-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:6f3b3de8a74ef8db215f22edffb19e32dc6fa41340456de7ec99efdc8a7b3ec2", size = 3712428, upload-time = "2026-04-20T23:35:23.453Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/39/ddbea9d4b4de6aca9431b6ed253f530f8a02d3b8f9bcfd0dbfe2b3de6fe4/psycopg2_binary-2.9.12-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:1006fb62f0f0bc5ce256a832356c6262e91be43f5e4eb15b5eaf38079464caf2", size = 3823184, upload-time = "2026-04-20T23:35:25.92Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/a0/bc2fef74b106fa345567122a0659e6d94512ed7dc0131ec44c9e5aba3725/psycopg2_binary-2.9.12-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:840066105706cd2eb29b9a1c2329620056582a4bf3e8169dec5c447042d0869f", size = 4579157, upload-time = "2026-04-20T23:35:28.542Z" },
+    { url = "https://files.pythonhosted.org/packages/57/d7/d4e3b2005d3de607ca4fbb0e8742e248056e52184a6b94ebda3c1c2c329b/psycopg2_binary-2.9.12-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:863f5d12241ebe1c76a72a04c2113b6dc905f90b9cef0e9be0efd994affd9354", size = 4274970, upload-time = "2026-04-20T23:35:30.418Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/42/c9853f8db3967fe08bcde11f53d53b85d351750cae726ce001cb68afa9c1/psycopg2_binary-2.9.12-cp314-cp314-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a99eaab34a9010f1a086b126de467466620a750634d114d20455f3a824aae033", size = 5895175, upload-time = "2026-04-20T23:35:33.584Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/fd/b82b5601a97630308bef079f545ffec481bbbc795c2ba5ec416a01d03f60/psycopg2_binary-2.9.12-cp314-cp314-manylinux_2_38_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:ffdd7dc5463ccd61845ac37b7012d0f35a1548df9febe14f8dd549be4a0bc81e", size = 4110658, upload-time = "2026-04-20T23:35:35.638Z" },
+    { url = "https://files.pythonhosted.org/packages/62/8c/32ca69b0389ef25dd22937bf9e8fbe2ce27aea20b05ded48c4ce4cb42475/psycopg2_binary-2.9.12-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:54a0dfecab1b48731f934e06139dfe11e24219fb6d0ceb32177cf0375f14c7b5", size = 3656251, upload-time = "2026-04-20T23:35:37.854Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/29/96992a2b59e3b9d730fcf9612d0a387305025dc867a9fc490a9e496e074e/psycopg2_binary-2.9.12-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:96937c9c5d891f772430f418a7a8b4691a90c3e6b93cf72b5bd7cad8cbca32a5", size = 3301810, upload-time = "2026-04-20T23:35:39.927Z" },
+    { url = "https://files.pythonhosted.org/packages/56/ad/44b06659949b243ae10112cd3b20a197f9bf3e81d5651379b9eb889bfaad/psycopg2_binary-2.9.12-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:77b348775efd4cdab410ec6609d81ccecd1139c90265fa583a7255c8064bc03d", size = 3048977, upload-time = "2026-04-20T23:35:41.806Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/f2/10a1bcebadb6aa55e280e1f58975c36a7b560ea525184c7aa4064c466633/psycopg2_binary-2.9.12-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:527e6342b3e44c2f0544f6b8e927d60de7f163f5723b8f1dfa7d2a84298738cd", size = 3351466, upload-time = "2026-04-20T23:35:43.993Z" },
+    { url = "https://files.pythonhosted.org/packages/20/be/b732c8418ffa5bcfda002890f5dc4c869fc17db66ff11f53b17cfe44afc0/psycopg2_binary-2.9.12-cp314-cp314-win_amd64.whl", hash = "sha256:f12ae41fcafadb39b2785e64a40f9db05d6de2ac114077457e0e7c597f3af980", size = 2848762, upload-time = "2026-04-20T23:35:46.421Z" },
+]
+
+[[package]]
+name = "pydantic"
+version = "2.13.4"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "annotated-types" },
+    { name = "pydantic-core" },
+    { name = "typing-extensions" },
+    { name = "typing-inspection" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/18/a5/b60d21ac674192f8ab0ba4e9fd860690f9b4a6e51ca5df118733b487d8d6/pydantic-2.13.4.tar.gz", hash = "sha256:c40756b57adaa8b1efeeced5c196f3f3b7c435f90e84ea7f443901bec8099ef6", size = 844775, upload-time = "2026-05-06T13:43:05.343Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/fd/7b/122376b1fd3c62c1ed9dc80c931ace4844b3c55407b6fb2d199377c9736f/pydantic-2.13.4-py3-none-any.whl", hash = "sha256:45a282cde31d808236fd7ea9d919b128653c8b38b393d1c4ab335c62924d9aba", size = 472262, upload-time = "2026-05-06T13:43:02.641Z" },
+]
+
+[[package]]
+name = "pydantic-core"
+version = "2.46.4"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/9d/56/921726b776ace8d8f5db44c4ef961006580d91dc52b803c489fafd1aa249/pydantic_core-2.46.4.tar.gz", hash = "sha256:62f875393d7f270851f20523dd2e29f082bcc82292d66db2b64ea71f64b6e1c1", size = 471464, upload-time = "2026-05-06T13:37:06.98Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ce/8c/af022f0af448d7747c5154288d46b5f2bc5f17366eaa0e23e9aa04d59f3b/pydantic_core-2.46.4-cp312-cp312-macosx_10_12_x86_64.whl", hash = "sha256:3245406455a5d98187ec35530fd772b1d799b26667980872c8d4614991e2c4a2", size = 2106158, upload-time = "2026-05-06T13:38:57.215Z" },
+    { url = "https://files.pythonhosted.org/packages/19/95/6195171e385007300f0f5574592e467c568becce2d937a0b6804f218bc49/pydantic_core-2.46.4-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:962ccbab7b642487b1d8b7df90ef677e03134cf1fd8880bf698649b22a69371f", size = 1951724, upload-time = "2026-05-06T13:37:02.697Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/bc/f47d1ff9cbb1620e1b5b697eef06010035735f07820180e74178226b27b3/pydantic_core-2.46.4-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8233f2947cf85404441fd7e0085f53b10c93e0ee78611099b5c7237e36aacbf7", size = 1975742, upload-time = "2026-05-06T13:37:09.448Z" },
+    { url = "https://files.pythonhosted.org/packages/5b/11/9b9a5b0306345664a2da6410877af6e8082481b5884b3ddd78d47c6013ce/pydantic_core-2.46.4-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:3a233125ac121aa3ffba9a2b59edfc4a985a76092dc8279586ab4b71390875e7", size = 2052418, upload-time = "2026-05-06T13:37:38.234Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/b7/a65fec226f5d78fc39f4a13c4cc0c768c22b113438f60c14adc9d2865038/pydantic_core-2.46.4-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:5b712b53160b79a5850310b912a5ef8e57e56947c8ad690c227f5c9d7e561712", size = 2232274, upload-time = "2026-05-06T13:38:27.753Z" },
+    { url = "https://files.pythonhosted.org/packages/68/f0/92039db98b907ef49269a8271f67db9cb78ae2fc68062ef7e4e77adb5f61/pydantic_core-2.46.4-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:9401557acd873c3a7f3eb9383edef8ac4968f9510e340f4808d427e75667e7b4", size = 2309940, upload-time = "2026-05-06T13:38:05.353Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/97/2aab507d3d00ca626e8e57c1eac6a79e4e5fbcc63eb99733ff55d1717f65/pydantic_core-2.46.4-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:926c9541b14b12b1681dca8a0b75feb510b06c6341b70a8e500c2fdcff837cce", size = 2094516, upload-time = "2026-05-06T13:39:10.577Z" },
+    { url = "https://files.pythonhosted.org/packages/22/37/a8aca44d40d737dde2bc05b3c6c07dff0de07ce6f82e9f3167aeaf4d5dea/pydantic_core-2.46.4-cp312-cp312-manylinux_2_31_riscv64.whl", hash = "sha256:56cb4851bcaf3d117eddcef4fe66afd750a50274b0da8e22be256d10e5611987", size = 2136854, upload-time = "2026-05-06T13:40:22.59Z" },
+    { url = "https://files.pythonhosted.org/packages/24/99/fcef1b79238c06a8cbec70819ac722ba76e02bc8ada9b0fd66eba40da01b/pydantic_core-2.46.4-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:c68fcd102d71ea85c5b2dfac3f4f8476eff42a9e078fd5faefff6d145063536b", size = 2180306, upload-time = "2026-05-06T13:40:10.666Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/6c/fc44000918855b42779d007ae63b0532794739027b2f417321cddbc44f6a/pydantic_core-2.46.4-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:b2f69dec1725e79a012d920df1707de5caf7ed5e08f3be4435e25803efc47458", size = 2190044, upload-time = "2026-05-06T13:40:43.231Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/65/d9cadc9f1920d7a127ad2edba16c1db7916e59719285cd6c94600b0080ba/pydantic_core-2.46.4-cp312-cp312-musllinux_1_1_armv7l.whl", hash = "sha256:8d0820e8192167f80d88d64038e609c31452eeca865b4e1d9950a27a4609b00b", size = 2329133, upload-time = "2026-05-06T13:39:57.365Z" },
+    { url = "https://files.pythonhosted.org/packages/d0/cf/c873d91679f3a30bcf5e7ac280ce5573483e72295307685120d0d5ad3416/pydantic_core-2.46.4-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:fbdb89b3e1c94a30cc5edfce477c6e6a5dc4d8f84665b455c27582f211a1c72c", size = 2374464, upload-time = "2026-05-06T13:38:06.976Z" },
+    { url = "https://files.pythonhosted.org/packages/47/bd/6f2fc8188f31bf10590f1e98e7b306336161fac930a8c514cd7bd828c7dc/pydantic_core-2.46.4-cp312-cp312-win32.whl", hash = "sha256:9aa768456404a8bf48a4406685ac2bec8e72b62c69313734fa3b73cf33b3a894", size = 1974823, upload-time = "2026-05-06T13:40:47.985Z" },
+    { url = "https://files.pythonhosted.org/packages/40/8c/985c1d41ea1107c2534abd9870e4ed5c8e7669b5c308297835c001e7a1c4/pydantic_core-2.46.4-cp312-cp312-win_amd64.whl", hash = "sha256:e9c26f834c65f5752f3f06cb08cb86a913ceb7274d0db6e267808a708b46bc89", size = 2072919, upload-time = "2026-05-06T13:39:21.153Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/ba/f463d006e0c47373ca7ec5e1a261c59dc01ef4d62b2657af925fb0deee3a/pydantic_core-2.46.4-cp312-cp312-win_arm64.whl", hash = "sha256:4fc73cb559bdb54b1134a706a2802a4cddd27a0633f5abb7e53056268751ac6a", size = 2027604, upload-time = "2026-05-06T13:39:03.753Z" },
+    { url = "https://files.pythonhosted.org/packages/51/a2/5d30b469c5267a17b39dec53208222f76a8d351dfac4af661888c5aee77d/pydantic_core-2.46.4-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:5d5902252db0d3cedf8d4a1bc68f70eeb430f7e4c7104c8c476753519b423008", size = 2106306, upload-time = "2026-05-06T13:37:48.029Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/81/4fa520eaffa8bd7d1525e644cd6d39e7d60b1592bc5b516693c7340b50f1/pydantic_core-2.46.4-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:c94f0688e7b8d0a67abf40e57a7eaaecd17cc9586706a31b76c031f63df052b4", size = 1951906, upload-time = "2026-05-06T13:37:17.012Z" },
+    { url = "https://files.pythonhosted.org/packages/03/d5/fd02da45b659668b05923b17ba3a0100a0a3d5541e3bd8fcc4ecb711309e/pydantic_core-2.46.4-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f027324c56cd5406ca49c124b0db10e56c69064fec039acc571c29020cc87c76", size = 1976802, upload-time = "2026-05-06T13:37:35.113Z" },
+    { url = "https://files.pythonhosted.org/packages/21/f2/95727e1368be3d3ed485eaab7adbd7dda408f33f7a36e8b48e0144002b91/pydantic_core-2.46.4-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:e739fee756ba1010f8bcccb534252e85a35fe45ae92c295a06059ce58b74ccd3", size = 2052446, upload-time = "2026-05-06T13:37:12.313Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/86/5d99feea3f77c7234b8718075b23db11532773c1a0dbd9b9490215dc2eeb/pydantic_core-2.46.4-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:9d56801be94b86a9da183e5f3766e6310752b99ff647e38b09a9500d88e46e76", size = 2232757, upload-time = "2026-05-06T13:39:01.149Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/3a/508ac615935ef7588cf6d9e9b91309fdc2da751af865e02a9098de88258c/pydantic_core-2.46.4-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:2412e734dcb48da14d4e4006b82b46b74f2518b8a26ee7e58c6844a6cd6d03c4", size = 2309275, upload-time = "2026-05-06T13:37:41.406Z" },
+    { url = "https://files.pythonhosted.org/packages/07/f8/41db9de19d7987d6b04715a02b3b40aea467000275d9d758ffaa31af7d50/pydantic_core-2.46.4-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9551187363ffc0de2a00b2e47c25aeaeb1020b69b668762966df15fc5659dd5a", size = 2094467, upload-time = "2026-05-06T13:39:18.847Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/e2/f35033184cb11d0052daf4416e8e10a502ea2ac006fc4f459aee872727d1/pydantic_core-2.46.4-cp313-cp313-manylinux_2_31_riscv64.whl", hash = "sha256:0186750b482eefa11d7f435892b09c5c606193ef3375bcf94aa00ae6bfb66262", size = 2134417, upload-time = "2026-05-06T13:40:17.944Z" },
+    { url = "https://files.pythonhosted.org/packages/7e/7b/6ceeb1cc90e193862f444ebe373d8fdf613f0a82572dde03fb10734c6c71/pydantic_core-2.46.4-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:5855698a4856556d86e8e6cd8434bc3ac0314ee8e12089ae0e143f64c6256e4e", size = 2179782, upload-time = "2026-05-06T13:40:32.618Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/f2/c8d7773ede6af08036423a00ae0ceffce266c3c52a096c435d68c896083f/pydantic_core-2.46.4-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:cbaf13819775b7f769bf4a1f066cb6df7a28d4480081a589828ef190226881cd", size = 2188782, upload-time = "2026-05-06T13:36:51.018Z" },
+    { url = "https://files.pythonhosted.org/packages/59/31/0c864784e31f09f05cdd87606f08923b9c9e7f6e51dd27f20f62f975ce9f/pydantic_core-2.46.4-cp313-cp313-musllinux_1_1_armv7l.whl", hash = "sha256:633147d34cf4550417f12e2b1a0383973bdf5cdfde212cb09e9a581cf10820be", size = 2328334, upload-time = "2026-05-06T13:40:37.764Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/eb/4f6c8a41efa30baa755590f4141abf3a8c370fab610915733e74134a7270/pydantic_core-2.46.4-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:82cf5301172168103724d49a1444d3378cb20cdee30b116a1bd6031236298a5d", size = 2372986, upload-time = "2026-05-06T13:39:34.152Z" },
+    { url = "https://files.pythonhosted.org/packages/5b/24/b375a480d53113860c299764bfe9f349a3dc9108b3adc0d7f0d786492ebf/pydantic_core-2.46.4-cp313-cp313-win32.whl", hash = "sha256:9fa8ae11da9e2b3126c6426f147e0fba88d96d65921799bb30c6abd1cb2c97fb", size = 1973693, upload-time = "2026-05-06T13:37:55.072Z" },
+    { url = "https://files.pythonhosted.org/packages/7e/e8/cff247591966f2d22ec8c003cd7587e27b7ba7b81ab2fb888e3ab75dc285/pydantic_core-2.46.4-cp313-cp313-win_amd64.whl", hash = "sha256:6b3ace8194b0e5204818c92802dcdca7fc6d88aabbb799d7c795540d9cd6d292", size = 2071819, upload-time = "2026-05-06T13:38:49.139Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/1a/f4aee670d5670e9e148e0c82c7db98d780be566c6e6a97ee8035528ca0b3/pydantic_core-2.46.4-cp313-cp313-win_arm64.whl", hash = "sha256:184c081504d17f1c1066e430e117142b2c77d9448a97f7b65c6ac9fd9aee238d", size = 2027411, upload-time = "2026-05-06T13:40:45.796Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/74/228a26ddad29c6672b805d9fd78e8d251cd04004fa7eed0e622096cd0250/pydantic_core-2.46.4-cp314-cp314-macosx_10_12_x86_64.whl", hash = "sha256:428e04521a40150c85216fc8b85e8d39fece235a9cf5e383761238c7fa9b96fb", size = 2102079, upload-time = "2026-05-06T13:38:41.019Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/1f/8970b150a4b4365623ae00fc88603491f763c627311ae8031e3111356d6e/pydantic_core-2.46.4-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:23ace664830ee0bfe014a0c7bc248b1f7f25ed7ad103852c317624a1083af462", size = 1952179, upload-time = "2026-05-06T13:36:59.812Z" },
+    { url = "https://files.pythonhosted.org/packages/95/30/5211a831ae054928054b2f79731661087a2bc5c01e825c672b3a4a8f1b3e/pydantic_core-2.46.4-cp314-cp314-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ce5c1d2a8b27468f433ca974829c44060b8097eedc39933e3c206a90ee49c4a9", size = 1978926, upload-time = "2026-05-06T13:37:39.933Z" },
+    { url = "https://files.pythonhosted.org/packages/57/e9/689668733b1eb67adeef047db3c2e8788fcf65a7fd9c9e2b46b7744fe245/pydantic_core-2.46.4-cp314-cp314-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:7283d57845ecf5a163403eb0702dfc220cc4fbdd18919cb5ccea4f95ee1cdab4", size = 2046785, upload-time = "2026-05-06T13:38:01.995Z" },
+    { url = "https://files.pythonhosted.org/packages/60/d9/6715260422ff50a2109878fd24d948a6c3446bb2664f34ee78cd972b3acd/pydantic_core-2.46.4-cp314-cp314-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:8daafc69c93ee8a0204506a3b6b30f586ef54028f52aeeeb5c4cfc5184fd5914", size = 2228733, upload-time = "2026-05-06T13:40:50.371Z" },
+    { url = "https://files.pythonhosted.org/packages/18/ae/fdb2f64316afca925640f8e70bb1a564b0ec2721c1389e25b8eb4bf9a299/pydantic_core-2.46.4-cp314-cp314-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:cd2213145bcc2ba85884d0ac63d222fece9209678f77b9b4d76f054c561adb28", size = 2307534, upload-time = "2026-05-06T13:37:21.531Z" },
+    { url = "https://files.pythonhosted.org/packages/89/1d/8eff589b45bb8190a9d12c49cfad0f176a5cbd1534908a6b5125e2886239/pydantic_core-2.46.4-cp314-cp314-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:7a5f930472650a82629163023e630d160863fce524c616f4e5186e5de9d9a49b", size = 2099732, upload-time = "2026-05-06T13:39:31.942Z" },
+    { url = "https://files.pythonhosted.org/packages/06/d5/ee5a3366637fee41dee51a1fc91562dcf12ddbc68fda34e6b253da2324bb/pydantic_core-2.46.4-cp314-cp314-manylinux_2_31_riscv64.whl", hash = "sha256:c1b3f518abeca3aa13c712fd202306e145abf59a18b094a6bafb2d2bbf59192c", size = 2129627, upload-time = "2026-05-06T13:37:25.033Z" },
+    { url = "https://files.pythonhosted.org/packages/94/33/2414be571d2c6a6c4d08be21f9292b6d3fdb08949a97b6dfe985017821db/pydantic_core-2.46.4-cp314-cp314-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:1a7dd0b3ee80d90150e3495a3a13ac34dbcbfd4f012996a6a1d8900e91b5c0fb", size = 2179141, upload-time = "2026-05-06T13:37:14.046Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/79/7daa95be995be0eecc4cf75064cb33f9bbbfe3fe0158caf2f0d4a996a5c7/pydantic_core-2.46.4-cp314-cp314-musllinux_1_1_aarch64.whl", hash = "sha256:3fb702cd90b0446a3a1c5e470bfa0dd23c0233b676a9099ddcc964fa6ca13898", size = 2184325, upload-time = "2026-05-06T13:36:53.615Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/cb/d0a382f5c0de8a222dc61c65348e0ce831b1f68e0a018450d31c2cace3a5/pydantic_core-2.46.4-cp314-cp314-musllinux_1_1_armv7l.whl", hash = "sha256:b8458003118a712e66286df6a707db01c52c0f52f7db8e4a38f0da1d3b94fc4e", size = 2323990, upload-time = "2026-05-06T13:40:29.971Z" },
+    { url = "https://files.pythonhosted.org/packages/05/db/d9ba624cc4a5aced1598e88c04fdbd8310c8a69b9d38b9a3d39ce3a61ed7/pydantic_core-2.46.4-cp314-cp314-musllinux_1_1_x86_64.whl", hash = "sha256:372429a130e469c9cd698925ce5fc50940b7a1336b0d82038e63d5bbc4edc519", size = 2369978, upload-time = "2026-05-06T13:37:23.027Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/20/d15df15ba918c423461905802bfd2981c3af0bfa0e40d05e13edbfa48bc3/pydantic_core-2.46.4-cp314-cp314-win32.whl", hash = "sha256:85bb3611ff1802f3ee7fdd7dbff26b56f343fb432d57a4728fdd49b6ef35e2f4", size = 1966354, upload-time = "2026-05-06T13:38:03.499Z" },
+    { url = "https://files.pythonhosted.org/packages/fc/b6/6b8de4c0a7d7ab3004c439c80c5c1e0a3e8d78bbae19379b01960383d9e5/pydantic_core-2.46.4-cp314-cp314-win_amd64.whl", hash = "sha256:811ff8e9c313ab425368bcbb36e5c4ebd7108c2bbf4e4089cfbb0b01eff63fac", size = 2072238, upload-time = "2026-05-06T13:39:40.807Z" },
+    { url = "https://files.pythonhosted.org/packages/32/36/51eb763beec1f4cf59b1db243a7dcc39cbb41230f050a09b9d69faaf0a48/pydantic_core-2.46.4-cp314-cp314-win_arm64.whl", hash = "sha256:bfec22eab3c8cc2ceec0248aec886624116dc079afa027ecc8ad4a7e62010f8a", size = 2018251, upload-time = "2026-05-06T13:37:26.72Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/91/855af51d625b23aa987116a19e231d2aaef9c4a415273ddc189b79a45fee/pydantic_core-2.46.4-cp314-cp314t-macosx_10_12_x86_64.whl", hash = "sha256:af8244b2bef6aaad6d92cda81372de7f8c8d36c9f0c3ea36e827c60e7d9467a0", size = 2099593, upload-time = "2026-05-06T13:39:47.682Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/1b/8784a54c65edb5f49f0a14d6977cf1b209bba85a4c77445b255c2de58ab3/pydantic_core-2.46.4-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:5a4330cdbc57162e4b3aa303f588ba752257694c9c9be3e7ebb11b4aca659b5d", size = 1935226, upload-time = "2026-05-06T13:40:40.428Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/e7/1955d28d1afc56dd4b3ad7cc0cf39df1b9852964cf16e5d13912756d6d6b/pydantic_core-2.46.4-cp314-cp314t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:29c61fc04a3d840155ff08e475a04809278972fe6aef51e2720554e96367e34b", size = 1974605, upload-time = "2026-05-06T13:37:32.029Z" },
+    { url = "https://files.pythonhosted.org/packages/93/e2/3fedbf0ba7a22850e6e9fd78117f1c0f10f950182344d8a6c535d468fdd8/pydantic_core-2.46.4-cp314-cp314t-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:c50f2528cf200c5eed56faf3f4e22fcd5f38c157a8b78576e6ba3168ec35f000", size = 2030777, upload-time = "2026-05-06T13:38:55.239Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/61/46be275fcaaba0b4f5b9669dd852267ce1ff616592dccf7a7845588df091/pydantic_core-2.46.4-cp314-cp314t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:0cbe8b01f948de4286c74cdd6c667aceb38f5c1e26f0693b3983d9d74887c65e", size = 2236641, upload-time = "2026-05-06T13:37:08.096Z" },
+    { url = "https://files.pythonhosted.org/packages/60/db/12e93e46a8bac9988be3c016860f83293daea8c716c029c9ace279036f2f/pydantic_core-2.46.4-cp314-cp314t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:617d7e2ca7dcb8c5cf6bcb8c59b8832c94b36196bbf1cbd1bfb56ed341905edd", size = 2286404, upload-time = "2026-05-06T13:40:20.221Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/4a/4d8b19008f38d31c53b8219cfedc2e3d5de5fe99d90076b7e767de29274f/pydantic_core-2.46.4-cp314-cp314t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:7027560ee92211647d0d34e3f7cd6f50da56399d26a9c8ad0da286d3869a53f3", size = 2109219, upload-time = "2026-05-06T13:38:12.153Z" },
+    { url = "https://files.pythonhosted.org/packages/88/70/3cbc40978fefb7bb09c6708d40d4ad1a5d70fd7213c3d17f971de868ec1f/pydantic_core-2.46.4-cp314-cp314t-manylinux_2_31_riscv64.whl", hash = "sha256:f99626688942fb746e545232e7726926f3be91b5975f8b55327665fafda991c7", size = 2110594, upload-time = "2026-05-06T13:40:02.971Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/20/b8d36736216e29491125531685b2f9e61aa5b4b2599893f8268551da3338/pydantic_core-2.46.4-cp314-cp314t-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:fc3e9034a63de20e15e8ade85358bc6efc614008cab72898b4b4952bea0509ff", size = 2159542, upload-time = "2026-05-06T13:39:27.506Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/a2/367df868eb584dacf6bf82a389272406d7178e301c4ac82545ab98bc2dd9/pydantic_core-2.46.4-cp314-cp314t-musllinux_1_1_aarch64.whl", hash = "sha256:97e7cf2be5c77b7d1a9713a05605d49460d02c6078d38d8bef3cbe323c548424", size = 2168146, upload-time = "2026-05-06T13:38:31.93Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/b8/4460f77f7e201893f649a29ab355dddd3beee8a97bcb1a320db414f9a06e/pydantic_core-2.46.4-cp314-cp314t-musllinux_1_1_armv7l.whl", hash = "sha256:3bf92c5d0e00fefaab325a4d27828fe6b6e2a21848686b5b60d2d9eeb09d76c6", size = 2306309, upload-time = "2026-05-06T13:37:44.717Z" },
+    { url = "https://files.pythonhosted.org/packages/64/c4/be2639293acd87dc8ddbcec41a73cee9b2ebf996fe6d892a1a74e88ad3f7/pydantic_core-2.46.4-cp314-cp314t-musllinux_1_1_x86_64.whl", hash = "sha256:3ecbc122d18468d06ca279dc26a8c2e2d5acb10943bb35e36ae92096dc3b5565", size = 2369736, upload-time = "2026-05-06T13:37:05.645Z" },
+    { url = "https://files.pythonhosted.org/packages/30/a6/9f9f380dbb301f67023bf8f707aaa75daadf84f7152d95c410fd7e81d994/pydantic_core-2.46.4-cp314-cp314t-win32.whl", hash = "sha256:e846ae7835bf0703ae43f534ab79a867146dadd59dc9ca5c8b53d5c8f7c9ef02", size = 1955575, upload-time = "2026-05-06T13:38:51.116Z" },
+    { url = "https://files.pythonhosted.org/packages/40/1f/f1eb9eb350e795d1af8586289746f5c5677d16043040d63710e22abc43c9/pydantic_core-2.46.4-cp314-cp314t-win_amd64.whl", hash = "sha256:2108ba5c1c1eca18030634489dc544844144ee36357f2f9f780b93e7ddbb44b5", size = 2051624, upload-time = "2026-05-06T13:38:21.672Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/d2/42dd53d0a85c27606f316d3aa5d2869c4e8470a5ed6dec30e4a1abe19192/pydantic_core-2.46.4-cp314-cp314t-win_arm64.whl", hash = "sha256:4fcbe087dbc2068af7eda3aa87634eba216dbda64d1ae73c8684b621d33f6596", size = 2017325, upload-time = "2026-05-06T13:40:52.723Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/1d/8987ad40f65ae1432753072f214fb5c74fe47ffbd0698bb9cbbb585664f8/pydantic_core-2.46.4-graalpy312-graalpy250_312_native-macosx_10_12_x86_64.whl", hash = "sha256:1d8ba486450b14f3b1d63bc521d410ec7565e52f887b9fb671791886436a42f7", size = 2095527, upload-time = "2026-05-06T13:39:52.283Z" },
+    { url = "https://files.pythonhosted.org/packages/64/d3/84c282a7eee1d3ac4c0377546ef5a1ea436ce26840d9ac3b7ed54a377507/pydantic_core-2.46.4-graalpy312-graalpy250_312_native-macosx_11_0_arm64.whl", hash = "sha256:3009f12e4e90b7f88b4f9adb1b0c4a3d58fe7820f3238c190047209d148026df", size = 1936024, upload-time = "2026-05-06T13:40:15.671Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/ca/eac61596cdeb4d7e174d3dc0bd8a6238f14f75f97a24e7b7db4c7e7340a0/pydantic_core-2.46.4-graalpy312-graalpy250_312_native-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ad785e92e6dc634c21555edc8bd6b64957ab844541bcb96a1366c202951ae526", size = 1990696, upload-time = "2026-05-06T13:38:34.717Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/c3/7c8b240552251faf6b3a957db200fcfbbcec36763c050428b601e0c9b83b/pydantic_core-2.46.4-graalpy312-graalpy250_312_native-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:00c603d540afdd6b80eb39f078f33ebd46211f02f33e34a32d9f053bba711de0", size = 2147590, upload-time = "2026-05-06T13:39:29.883Z" },
+]
+
+[[package]]
+name = "pydantic-settings"
+version = "2.14.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pydantic" },
+    { name = "python-dotenv" },
+    { name = "typing-inspection" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/07/60/1d1e59c9c90d54591469ada7d268251f71c24bdb765f1a8a832cee8c6653/pydantic_settings-2.14.1.tar.gz", hash = "sha256:e874d3bec7e787b0c9958277956ed9b4dd5de6a80e162188fdaff7c5e26fd5fa", size = 235551, upload-time = "2026-05-08T13:40:06.542Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ae/8d/f1af3832f5e6eb13ba94ee809e72b8ecb5eef226d27ee0bef7d963d943c7/pydantic_settings-2.14.1-py3-none-any.whl", hash = "sha256:6e3c7edfd8277687cdc598f56e5cff0e9bfff0910a3749deaa8d4401c3a2b9de", size = 60964, upload-time = "2026-05-08T13:40:04.958Z" },
+]
+
+[[package]]
+name = "python-dotenv"
+version = "1.2.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/82/ed/0301aeeac3e5353ef3d94b6ec08bbcabd04a72018415dcb29e588514bba8/python_dotenv-1.2.2.tar.gz", hash = "sha256:2c371a91fbd7ba082c2c1dc1f8bf89ca22564a087c2c287cd9b662adde799cf3", size = 50135, upload-time = "2026-03-01T16:00:26.196Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/0b/d7/1959b9648791274998a9c3526f6d0ec8fd2233e4d4acce81bbae76b44b2a/python_dotenv-1.2.2-py3-none-any.whl", hash = "sha256:1d8214789a24de455a8b8bd8ae6fe3c6b69a5e3d64aa8a8e5d68e694bbcb285a", size = 22101, upload-time = "2026-03-01T16:00:25.09Z" },
+]
+
+[[package]]
+name = "sqlparse"
+version = "0.5.5"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/90/76/437d71068094df0726366574cf3432a4ed754217b436eb7429415cf2d480/sqlparse-0.5.5.tar.gz", hash = "sha256:e20d4a9b0b8585fdf63b10d30066c7c94c5d7a7ec47c889a2d83a3caa93ff28e", size = 120815, upload-time = "2025-12-19T07:17:45.073Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/49/4b/359f28a903c13438ef59ebeee215fb25da53066db67b305c125f1c6d2a25/sqlparse-0.5.5-py3-none-any.whl", hash = "sha256:12a08b3bf3eec877c519589833aed092e2444e68240a3577e8e26148acc7b1ba", size = 46138, upload-time = "2025-12-19T07:17:46.573Z" },
+]
+
+[[package]]
+name = "typing-extensions"
+version = "4.15.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/72/94/1a15dd82efb362ac84269196e94cf00f187f7ed21c242792a923cdb1c61f/typing_extensions-4.15.0.tar.gz", hash = "sha256:0cea48d173cc12fa28ecabc3b837ea3cf6f38c6d1136f85cbaaf598984861466", size = 109391, upload-time = "2025-08-25T13:49:26.313Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/18/67/36e9267722cc04a6b9f15c7f3441c2363321a3ea07da7ae0c0707beb2a9c/typing_extensions-4.15.0-py3-none-any.whl", hash = "sha256:f0fa19c6845758ab08074a0cfa8b7aecb71c999ca73d62883bc25cc018c4e548", size = 44614, upload-time = "2025-08-25T13:49:24.86Z" },
+]
+
+[[package]]
+name = "typing-inspection"
+version = "0.4.2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/55/e3/70399cb7dd41c10ac53367ae42139cf4b1ca5f36bb3dc6c9d33acdb43655/typing_inspection-0.4.2.tar.gz", hash = "sha256:ba561c48a67c5958007083d386c3295464928b01faa735ab8547c5692e87f464", size = 75949, upload-time = "2025-10-01T02:14:41.687Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/dc/9b/47798a6c91d8bdb567fe2698fe81e0c6b7cb7ef4d13da4114b41d239f65d/typing_inspection-0.4.2-py3-none-any.whl", hash = "sha256:4ed1cacbdc298c220f1bd249ed5287caa16f34d44ef4e9c3d0cbad5b521545e7", size = 14611, upload-time = "2025-10-01T02:14:40.154Z" },
+]
+
+[[package]]
+name = "tzdata"
+version = "2026.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/ba/19/1b9b0e29f30c6d35cb345486df41110984ea67ae69dddbc0e8a100999493/tzdata-2026.2.tar.gz", hash = "sha256:9173fde7d80d9018e02a662e168e5a2d04f87c41ea174b139fbef642eda62d10", size = 198254, upload-time = "2026-04-24T15:22:08.651Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ce/e4/dccd7f47c4b64213ac01ef921a1337ee6e30e8c6466046018326977efd95/tzdata-2026.2-py2.py3-none-any.whl", hash = "sha256:bbe9af844f658da81a5f95019480da3a89415801f6cc966806612cc7169bffe7", size = 349321, upload-time = "2026-04-24T15:22:05.876Z" },
+]

backend/.env.example

@@ -0,0 +1,8 @@
+# Backend environment (example – never commit real secrets)
+DJANGO_SECRET_KEY=django-insecure-change-me-in-production
+DJANGO_DEBUG=True
+DB_NAME=cloud_reader
+DB_USER=postgres
+DB_PASSWORD=postgres
+DB_HOST=localhost
+DB_PORT=5432

backend/apps/annotations/admin.py

@@ -0,0 +1,19 @@
+from django.contrib import admin
+
+from apps.annotations.models import Bookmark, Note
+
+
+@admin.register(Bookmark)
+class BookmarkAdmin(admin.ModelAdmin):
+    list_display = ("user", "book", "page", "created_at")
+    list_select_related = ("user", "book")
+    search_fields = ("user__email", "book__title", "location_text")
+    list_filter = ("created_at",)
+
+
+@admin.register(Note)
+class NoteAdmin(admin.ModelAdmin):
+    list_display = ("user", "book", "page", "created_at", "updated_at")
+    list_select_related = ("user", "book")
+    search_fields = ("user__email", "book__title", "content", "location_text")
+    list_filter = ("created_at",)

backend/apps/annotations/apps.py

@@ -0,0 +1,7 @@
+from django.apps import AppConfig
+
+
+class AnnotationsConfig(AppConfig):
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "apps.annotations"
+    label = "annotations"

backend/apps/annotations/models.py

@@ -0,0 +1,84 @@
+import uuid
+
+from django.conf import settings
+from django.db import models
+
+
+class Bookmark(models.Model):
+    """A saved location in a book that the user can return to."""
+
+    id = models.UUIDField(primary_key=True, default=uuid.uuid4, editable=False)
+    user = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.CASCADE,
+        related_name="bookmarks",
+        db_index=True,
+    )
+    book = models.ForeignKey(
+        "books.Book",
+        on_delete=models.CASCADE,
+        related_name="bookmarks",
+        db_index=True,
+    )
+    page = models.PositiveIntegerField()
+    location_text = models.TextField(
+        blank=True,
+        default="",
+        help_text="The selected passage text at this location",
+    )
+    created_at = models.DateTimeField(auto_now_add=True)
+    updated_at = models.DateTimeField(auto_now=True)
+
+    class Meta:
+        db_table = "annotations_bookmark"
+        verbose_name = "Bookmark"
+        verbose_name_plural = "Bookmarks"
+        ordering = ["-created_at"]
+        constraints = [
+            models.UniqueConstraint(
+                fields=["user", "book", "page"],
+                name="uq_bookmark_user_book_page",
+            )
+        ]
+
+    def __str__(self) -> str:
+        return f"{self.user} @ {self.book} p.{self.page}"
+
+
+class Note(models.Model):
+    """A user-written note attached to a specific location in a book."""
+
+    id = models.UUIDField(primary_key=True, default=uuid.uuid4, editable=False)
+    user = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.CASCADE,
+        related_name="notes",
+        db_index=True,
+    )
+    book = models.ForeignKey(
+        "books.Book",
+        on_delete=models.CASCADE,
+        related_name="notes",
+        db_index=True,
+    )
+    page = models.PositiveIntegerField()
+    location_text = models.TextField(
+        blank=True,
+        default="",
+        help_text="The selected passage text this note refers to",
+    )
+    content = models.TextField(
+        help_text="The note body content"
+    )
+    created_at = models.DateTimeField(auto_now_add=True)
+    updated_at = models.DateTimeField(auto_now=True)
+
+    class Meta:
+        db_table = "annotations_note"
+        verbose_name = "Note"
+        verbose_name_plural = "Notes"
+        ordering = ["-created_at"]
+
+    def __str__(self) -> str:
+        preview = self.content[:50]
+        return f"{self.user} @ {self.book} p.{self.page}: {preview}"

backend/apps/annotations/permissions.py

@@ -0,0 +1,8 @@
+from rest_framework import permissions
+
+
+class IsOwner(permissions.BasePermission):
+    """Grant access only if the requesting user owns the object."""
+
+    def has_object_permission(self, request, view, obj) -> bool:
+        return obj.user == request.user

backend/apps/annotations/serializers.py

@@ -0,0 +1,108 @@
+from rest_framework import serializers
+
+from apps.annotations.models import Bookmark, Note
+
+
+class BookmarkSerializer(serializers.ModelSerializer):
+    """Serialize Bookmark data with full details."""
+
+    book_title = serializers.CharField(source="book.title", read_only=True)
+
+    class Meta:
+        model = Bookmark
+        fields = [
+            "id",
+            "book",
+            "book_title",
+            "page",
+            "location_text",
+            "created_at",
+            "updated_at",
+        ]
+        read_only_fields = ["id", "created_at", "updated_at", "book_title"]
+
+    def validate_page(self, value: int) -> int:
+        if value < 1:
+            raise serializers.ValidationError("Page must be a positive integer.")
+        return value
+
+
+class BookmarkCreateSerializer(serializers.ModelSerializer):
+    """Serializer used for creating bookmarks. Sets user from request context."""
+
+    class Meta:
+        model = Bookmark
+        fields = ["book", "page", "location_text"]
+
+    def validate_page(self, value: int) -> int:
+        if value < 1:
+            raise serializers.ValidationError("Page must be a positive integer.")
+        return value
+
+    def validate(self, attrs):
+        user = self.context["request"].user
+        if Bookmark.objects.filter(
+            user=user, book=attrs["book"], page=attrs["page"]
+        ).exists():
+            raise serializers.ValidationError(
+                {"page": "A bookmark already exists at this page for this book."}
+            )
+        return attrs
+
+    def create(self, validated_data):
+        validated_data["user"] = self.context["request"].user
+        return super().create(validated_data)
+
+
+class NoteSerializer(serializers.ModelSerializer):
+    """Serialize Note data with full details."""
+
+    book_title = serializers.CharField(source="book.title", read_only=True)
+
+    class Meta:
+        model = Note
+        fields = [
+            "id",
+            "book",
+            "book_title",
+            "page",
+            "location_text",
+            "content",
+            "created_at",
+            "updated_at",
+        ]
+        read_only_fields = ["id", "created_at", "updated_at", "book_title"]
+
+    def validate_page(self, value: int) -> int:
+        if value < 1:
+            raise serializers.ValidationError("Page must be a positive integer.")
+        return value
+
+    def validate_content(self, value: str) -> str:
+        stripped = value.strip()
+        if not stripped:
+            raise serializers.ValidationError("Note content cannot be empty.")
+        return stripped
+
+
+class NoteCreateSerializer(serializers.ModelSerializer):
+    """Serializer used for creating notes. Sets user from request context."""
+
+    class Meta:
+        model = Note
+        fields = ["book", "page", "location_text", "content"]
+
+    def validate_page(self, value: int) -> int:
+        if value < 1:
+            raise serializers.ValidationError("Page must be a positive integer.")
+        return value
+
+    def validate_content(self, value: str) -> str:
+        stripped = value.strip()
+        if not stripped:
+            raise serializers.ValidationError("Note content cannot be empty.")
+        return stripped
+
+    def create(self, validated_data):
+        validated_data["user"] = self.context["request"].user
+        return super().create(validated_data)

backend/apps/annotations/tests.py

@@ -0,0 +1,331 @@
+"""Tests for the annotations app – Bookmarks & Notes API."""
+
+import pytest
+from django.urls import reverse
+from rest_framework import status
+from rest_framework.test import APIClient
+
+from apps.annotations.models import Bookmark, Note
+from apps.books.models import Book
+from apps.users.models import User
+
+
+# ---------------------------------------------------------------------------
+# Fixtures
+# ---------------------------------------------------------------------------
+
+@pytest.fixture
+def api_client() -> APIClient:
+    return APIClient()
+
+
+@pytest.fixture
+def user() -> User:
+    return User.objects.create_user(
+        username="testuser",
+        email="test@example.com",
+        password="testpass123",
+    )
+
+
+@pytest.fixture
+def other_user() -> User:
+    return User.objects.create_user(
+        username="other",
+        email="other@example.com",
+        password="testpass123",
+    )
+
+
+@pytest.fixture
+def auth_client(api_client: APIClient, user: User) -> APIClient:
+    api_client.force_authenticate(user=user)
+    return api_client
+
+
+@pytest.fixture
+def book() -> Book:
+    return Book.objects.create(
+        title="Test Book",
+        author="Test Author",
+        total_pages=300,
+    )
+
+
+@pytest.fixture
+def bookmark(auth_client, user: User, book: Book) -> Bookmark:
+    return Bookmark.objects.create(
+        user=user,
+        book=book,
+        page=42,
+        location_text="important passage",
+    )
+
+
+@pytest.fixture
+def note(auth_client, user: User, book: Book) -> Note:
+    return Note.objects.create(
+        user=user,
+        book=book,
+        page=15,
+        location_text="highlighted section",
+        content="This is my note about this section.",
+    )
+
+
+# ---------------------------------------------------------------------------
+# Bookmark tests
+# ---------------------------------------------------------------------------
+
+class TestBookmarkList:
+    url = reverse("bookmark-list")
+
+    def test_unauthenticated_user_cannot_list(self, api_client: APIClient):
+        response = api_client.get(self.url)
+        assert response.status_code == status.HTTP_401_UNAUTHORIZED
+
+    def test_list_returns_user_bookmarks_only(
+        self, auth_client: APIClient, user: User, other_user: User, book: Book
+    ):
+        Bookmark.objects.create(user=user, book=book, page=1)
+        Bookmark.objects.create(user=other_user, book=book, page=2)
+
+        response = auth_client.get(self.url)
+        assert response.status_code == status.HTTP_200_OK
+        results = response.data["results"]
+        assert len(results) == 1
+        assert results[0]["page"] == 1
+
+    def test_list_returns_empty_when_no_bookmarks(
+        self, auth_client: APIClient
+    ):
+        response = auth_client.get(self.url)
+        assert response.status_code == status.HTTP_200_OK
+        assert response.data["count"] == 0
+
+    def test_list_orders_by_newest_first(
+        self, auth_client: APIClient, user: User, book: Book
+    ):
+        b1 = Bookmark.objects.create(user=user, book=book, page=1)
+        b2 = Bookmark.objects.create(user=user, book=book, page=2)
+        response = auth_client.get(self.url)
+        results = response.data["results"]
+        assert results[0]["page"] == 2
+        assert results[1]["page"] == 1
+
+    def test_list_includes_book_title(
+        self, auth_client: APIClient, bookmark: Bookmark
+    ):
+        response = auth_client.get(self.url)
+        assert response.status_code == status.HTTP_200_OK
+        assert response.data["results"][0]["book_title"] == "Test Book"
+
+
+class TestBookmarkCreate:
+    url = reverse("bookmark-list")
+
+    def test_create_bookmark(self, auth_client: APIClient, book: Book):
+        data = {"book": str(book.id), "page": 10, "location_text": "key insight"}
+        response = auth_client.post(self.url, data, format="json")
+        assert response.status_code == status.HTTP_201_CREATED
+        assert response.data["page"] == 10
+
+    def test_create_bookmark_without_location_text(
+        self, auth_client: APIClient, book: Book
+    ):
+        data = {"book": str(book.id), "page": 5}
+        response = auth_client.post(self.url, data, format="json")
+        assert response.status_code == status.HTTP_201_CREATED
+        assert response.data["page"] == 5
+
+    def test_duplicate_bookmark_page_is_rejected(
+        self, auth_client: APIClient, bookmark: Bookmark
+    ):
+        data = {"book": str(bookmark.book.id), "page": bookmark.page}
+        response = auth_client.post(self.url, data, format="json")
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+
+    def test_unauthenticated_user_cannot_create(
+        self, api_client: APIClient, book: Book
+    ):
+        data = {"book": str(book.id), "page": 10}
+        response = api_client.post(self.url, data, format="json")
+        assert response.status_code == status.HTTP_401_UNAUTHORIZED
+
+    def test_invalid_page_rejected(
+        self, auth_client: APIClient, book: Book
+    ):
+        data = {"book": str(book.id), "page": 0}
+        response = auth_client.post(self.url, data, format="json")
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+
+
+class TestBookmarkDetail:
+    def test_get_bookmark(
+        self, auth_client: APIClient, bookmark: Bookmark
+    ):
+        url = reverse("bookmark-detail", args=[str(bookmark.id)])
+        response = auth_client.get(url)
+        assert response.status_code == status.HTTP_200_OK
+        assert response.data["page"] == bookmark.page
+
+    def test_cannot_access_other_users_bookmark(
+        self, api_client: APIClient, other_user: User, bookmark: Bookmark
+    ):
+        api_client.force_authenticate(user=other_user)
+        url = reverse("bookmark-detail", args=[str(bookmark.id)])
+        response = api_client.get(url)
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+
+
+class TestBookmarkDelete:
+    def test_delete_bookmark(
+        self, auth_client: APIClient, bookmark: Bookmark
+    ):
+        url = reverse("bookmark-detail", args=[str(bookmark.id)])
+        response = auth_client.delete(url)
+        assert response.status_code == status.HTTP_204_NO_CONTENT
+        assert Bookmark.objects.count() == 0
+
+    def test_cannot_delete_other_users_bookmark(
+        self, api_client: APIClient, other_user: User, bookmark: Bookmark
+    ):
+        api_client.force_authenticate(user=other_user)
+        url = reverse("bookmark-detail", args=[str(bookmark.id)])
+        response = api_client.delete(url)
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+
+
+class TestBookmarkFilterByBook:
+    def test_filter_by_book(
+        self, auth_client: APIClient, user: User, book: Book
+    ):
+        other_book = Book.objects.create(title="Other", author="Other")
+        Bookmark.objects.create(user=user, book=book, page=1)
+        Bookmark.objects.create(user=user, book=other_book, page=2)
+
+        url = reverse("bookmark-list")
+        response = auth_client.get(url, {"book": str(book.id)})
+        assert response.status_code == status.HTTP_200_OK
+        assert response.data["count"] == 1
+        assert response.data["results"][0]["page"] == 1
+
+
+# ---------------------------------------------------------------------------
+# Note tests
+# ---------------------------------------------------------------------------
+
+class TestNoteList:
+    url = reverse("note-list")
+
+    def test_unauthenticated_user_cannot_list(self, api_client: APIClient):
+        response = api_client.get(self.url)
+        assert response.status_code == status.HTTP_401_UNAUTHORIZED
+
+    def test_list_returns_user_notes_only(
+        self, auth_client: APIClient, user: User, other_user: User, book: Book
+    ):
+        Note.objects.create(user=user, book=book, page=1, content="My note")
+        Note.objects.create(user=other_user, book=book, page=2, content="Other's note")
+
+        response = auth_client.get(self.url)
+        assert response.status_code == status.HTTP_200_OK
+        results = response.data["results"]
+        assert len(results) == 1
+        assert results[0]["content"] == "My note"
+
+    def test_list_includes_book_title(
+        self, auth_client: APIClient, note: Note
+    ):
+        response = auth_client.get(self.url)
+        assert response.status_code == status.HTTP_200_OK
+        assert response.data["results"][0]["book_title"] == "Test Book"
+
+
+class TestNoteCreate:
+    url = reverse("note-list")
+
+    def test_create_note(self, auth_client: APIClient, book: Book):
+        data = {
+            "book": str(book.id),
+            "page": 20,
+            "location_text": "interesting part",
+            "content": "This is a thoughtful note.",
+        }
+        response = auth_client.post(self.url, data, format="json")
+        assert response.status_code == status.HTTP_201_CREATED
+        assert response.data["content"] == "This is a thoughtful note."
+
+    def test_create_note_without_location_text(
+        self, auth_client: APIClient, book: Book
+    ):
+        data = {"book": str(book.id), "page": 20, "content": "A note."}
+        response = auth_client.post(self.url, data, format="json")
+        assert response.status_code == status.HTTP_201_CREATED
+
+    def test_empty_content_rejected(
+        self, auth_client: APIClient, book: Book
+    ):
+        data = {"book": str(book.id), "page": 20, "content": "   "}
+        response = auth_client.post(self.url, data, format="json")
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+
+    def test_unauthenticated_user_cannot_create(
+        self, api_client: APIClient, book: Book
+    ):
+        data = {"book": str(book.id), "page": 20, "content": "Note"}
+        response = api_client.post(self.url, data, format="json")
+        assert response.status_code == status.HTTP_401_UNAUTHORIZED
+
+
+class TestNoteUpdate:
+    def test_update_note_content(
+        self, auth_client: APIClient, note: Note
+    ):
+        url = reverse("note-detail", args=[str(note.id)])
+        data = {"content": "Updated note content."}
+        response = auth_client.patch(url, data, format="json")
+        assert response.status_code == status.HTTP_200_OK
+        assert response.data["content"] == "Updated note content."
+
+    def test_cannot_update_other_users_note(
+        self, api_client: APIClient, other_user: User, note: Note
+    ):
+        api_client.force_authenticate(user=other_user)
+        url = reverse("note-detail", args=[str(note.id)])
+        data = {"content": "Hacked!"}
+        response = api_client.patch(url, data, format="json")
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+
+
+class TestNoteDelete:
+    def test_delete_note(self, auth_client: APIClient, note: Note):
+        url = reverse("note-detail", args=[str(note.id)])
+        response = auth_client.delete(url)
+        assert response.status_code == status.HTTP_204_NO_CONTENT
+        assert Note.objects.count() == 0
+
+    def test_batch_delete_notes(
+        self, auth_client: APIClient, user: User, book: Book
+    ):
+        n1 = Note.objects.create(user=user, book=book, page=1, content="A")
+        n2 = Note.objects.create(user=user, book=book, page=2, content="B")
+        url = reverse("note-batch-delete")
+        response = auth_client.delete(url, {"ids": [str(n1.id), str(n2.id)]}, format="json")
+        assert response.status_code == status.HTTP_200_OK
+        assert response.data["deleted"] == 2
+
+
+class TestNoteFilterByBook:
+    def test_filter_by_book(
+        self, auth_client: APIClient, user: User, book: Book
+    ):
+        other_book = Book.objects.create(title="Other", author="Other")
+        Note.objects.create(user=user, book=book, page=1, content="In book")
+        Note.objects.create(user=user, book=other_book, page=2, content="In other")
+
+        url = reverse("note-list")
+        response = auth_client.get(url, {"book": str(book.id)})
+        assert response.status_code == status.HTTP_200_OK
+        assert response.data["count"] == 1
+        assert response.data["results"][0]["content"] == "In book"

backend/apps/annotations/urls.py

@@ -0,0 +1,12 @@
+from django.urls import include, path
+from rest_framework.routers import DefaultRouter
+
+from apps.annotations.views import BookmarkViewSet, NoteViewSet
+
+router = DefaultRouter()
+router.register(r"bookmarks", BookmarkViewSet, basename="bookmark")
+router.register(r"notes", NoteViewSet, basename="note")
+
+urlpatterns = [
+    path("", include(router.urls)),
+]

backend/apps/annotations/views.py

@@ -0,0 +1,93 @@
+from django_filters.rest_framework import DjangoFilterBackend
+from rest_framework import status, viewsets
+from rest_framework.decorators import action
+from rest_framework.filters import OrderingFilter, SearchFilter
+from rest_framework.permissions import IsAuthenticated
+from rest_framework.response import Response
+
+from apps.annotations.models import Bookmark, Note
+from apps.annotations.permissions import IsOwner
+from apps.annotations.serializers import (
+    BookmarkCreateSerializer,
+    BookmarkSerializer,
+    NoteCreateSerializer,
+    NoteSerializer,
+)
+
+
+class BookmarkViewSet(viewsets.ModelViewSet):
+    """CRUD for user bookmarks. Users can only manage their own bookmarks."""
+
+    permission_classes = [IsAuthenticated, IsOwner]
+    filter_backends = [DjangoFilterBackend, SearchFilter, OrderingFilter]
+    filterset_fields = ["book"]
+    search_fields = ["location_text"]
+    ordering_fields = ["created_at", "page"]
+    ordering = ["-created_at"]
+
+    def get_serializer_class(self):
+        if self.action == "create":
+            return BookmarkCreateSerializer
+        return BookmarkSerializer
+
+    def get_queryset(self):
+        return Bookmark.objects.filter(user=self.request.user).select_related(
+            "book"
+        )
+
+    def perform_create(self, serializer):
+        serializer.save(user=self.request.user)
+
+    @action(detail=False, methods=["delete"], url_path="batch-delete")
+    def batch_delete(self, request):
+        """Delete multiple bookmarks by id list."""
+        ids = request.data.get("ids", [])
+        if not ids:
+            return Response(
+                {"detail": "No ids provided."}, status=status.HTTP_400_BAD_REQUEST
+            )
+        deleted, _ = Bookmark.objects.filter(
+            id__in=ids, user=request.user
+        ).delete()
+        return Response(
+            {"deleted": deleted}, status=status.HTTP_200_OK
+        )
+
+
+class NoteViewSet(viewsets.ModelViewSet):
+    """CRUD for user notes. Users can only manage their own notes."""
+
+    permission_classes = [IsAuthenticated, IsOwner]
+    filter_backends = [DjangoFilterBackend, SearchFilter, OrderingFilter]
+    filterset_fields = ["book"]
+    search_fields = ["content", "location_text"]
+    ordering_fields = ["created_at", "page"]
+    ordering = ["-created_at"]
+
+    def get_serializer_class(self):
+        if self.action == "create":
+            return NoteCreateSerializer
+        return NoteSerializer
+
+    def get_queryset(self):
+        return Note.objects.filter(user=self.request.user).select_related(
+            "book"
+        )
+
+    def perform_create(self, serializer):
+        serializer.save(user=self.request.user)
+
+    @action(detail=False, methods=["delete"], url_path="batch-delete")
+    def batch_delete(self, request):
+        """Delete multiple notes by id list."""
+        ids = request.data.get("ids", [])
+        if not ids:
+            return Response(
+                {"detail": "No ids provided."}, status=status.HTTP_400_BAD_REQUEST
+            )
+        deleted, _ = Note.objects.filter(
+            id__in=ids, user=request.user
+        ).delete()
+        return Response(
+            {"deleted": deleted}, status=status.HTTP_200_OK
+        )

backend/apps/books/admin.py

@@ -0,0 +1,9 @@
+from django.contrib import admin
+
+from apps.books.models import Book
+
+
+@admin.register(Book)
+class BookAdmin(admin.ModelAdmin):
+    list_display = ("title", "author", "total_pages", "created_at")
+    search_fields = ("title", "author")

backend/apps/books/apps.py

@@ -0,0 +1,7 @@
+from django.apps import AppConfig
+
+
+class BooksConfig(AppConfig):
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "apps.books"
+    label = "books"

backend/apps/books/models.py

@@ -0,0 +1,21 @@
+from django.db import models
+
+
+class Book(models.Model):
+    """Represents a book in the user's library."""
+
+    title = models.CharField(max_length=512)
+    author = models.CharField(max_length=256, blank=True, default="")
+    total_pages = models.PositiveIntegerField(default=0)
+    cover_image = models.URLField(blank=True, default="")
+    created_at = models.DateTimeField(auto_now_add=True)
+    updated_at = models.DateTimeField(auto_now=True)
+
+    class Meta:
+        db_table = "books_book"
+        verbose_name = "Book"
+        verbose_name_plural = "Books"
+        ordering = ["title"]
+
+    def __str__(self) -> str:
+        return self.title

backend/apps/books/serializers.py

@@ -0,0 +1,28 @@
+from rest_framework import serializers
+
+from apps.books.models import Book
+
+
+class BookSerializer(serializers.ModelSerializer):
+    """Serialize Book data."""
+
+    class Meta:
+        model = Book
+        fields = [
+            "id",
+            "title",
+            "author",
+            "total_pages",
+            "cover_image",
+            "created_at",
+            "updated_at",
+        ]
+        read_only_fields = ["id", "created_at", "updated_at"]
+
+
+class BookListSerializer(serializers.ModelSerializer):
+    """Lightweight serializer for list views (excludes heavy fields)."""
+
+    class Meta:
+        model = Book
+        fields = ["id", "title", "author", "total_pages", "cover_image"]

backend/apps/books/urls.py

@@ -1,12 +1,10 @@
-from __future__ import annotations
-
 from django.urls import include, path
 from rest_framework.routers import DefaultRouter
 
-from books.views import BookViewSet
+from apps.books.views import BookViewSet
 
 router = DefaultRouter()
-router.register(r"books", BookViewSet, basename="book")
+router.register(r"", BookViewSet, basename="book")
 
 urlpatterns = [
     path("", include(router.urls)),

backend/apps/books/views.py

@@ -0,0 +1,24 @@
+from django_filters.rest_framework import DjangoFilterBackend
+from rest_framework import viewsets
+from rest_framework.filters import OrderingFilter, SearchFilter
+from rest_framework.permissions import IsAuthenticated
+
+from apps.books.models import Book
+from apps.books.serializers import BookListSerializer, BookSerializer
+
+
+class BookViewSet(viewsets.ModelViewSet):
+    """CRUD for books."""
+
+    queryset = Book.objects.all()
+    permission_classes = [IsAuthenticated]
+    filter_backends = [DjangoFilterBackend, SearchFilter, OrderingFilter]
+    filterset_fields = ["author"]
+    search_fields = ["title", "author"]
+    ordering_fields = ["title", "author", "created_at"]
+    ordering = ["title"]
+
+    def get_serializer_class(self):
+        if self.action == "list":
+            return BookListSerializer
+        return BookSerializer

backend/apps/users/admin.py

@@ -0,0 +1,11 @@
+from django.contrib import admin
+from django.contrib.auth.admin import UserAdmin as BaseUserAdmin
+
+from apps.users.models import User
+
+
+@admin.register(User)
+class UserAdmin(BaseUserAdmin):
+    """Admin config for the custom User model."""
+    list_display = ("email", "username", "is_staff", "is_active", "date_joined")
+    search_fields = ("email", "username")

backend/apps/users/apps.py

@@ -0,0 +1,7 @@
+from django.apps import AppConfig
+
+
+class UsersConfig(AppConfig):
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "apps.users"
+    label = "users"

backend/apps/users/models.py

@@ -0,0 +1,13 @@
+from django.contrib.auth.models import AbstractUser
+
+
+class User(AbstractUser):
+    """Custom user model. Uses email as the unique identifier field."""
+
+    class Meta:
+        db_table = "users_user"
+        verbose_name = "User"
+        verbose_name_plural = "Users"
+
+    def __str__(self) -> str:
+        return self.email or self.username

backend/apps/users/urls.py

@@ -0,0 +1,8 @@
+from django.urls import include, path
+from rest_framework.routers import DefaultRouter
+from rest_framework_simplejwt.views import TokenObtainPairView, TokenRefreshView
+
+urlpatterns = [
+    path("token/", TokenObtainPairView.as_view(), name="token_obtain_pair"),
+    path("token/refresh/", TokenRefreshView.as_view(), name="token_refresh"),
+]

backend/books/admin.py

@@ -1,16 +0,0 @@
-from __future__ import annotations
-
-from django.contrib import admin
-
-from books.models import Book
-
-
-@admin.register(Book)
-class BookAdmin(admin.ModelAdmin):
-    """Admin configuration for the Book model."""
-
-    list_display = ["title", "author", "genre", "reading_status", "reading_progress", "owner", "updated_at"]
-    list_filter = ["reading_status", "genre"]
-    search_fields = ["title", "author"]
-    readonly_fields = ["reading_progress", "created_at", "updated_at"]
-    raw_id_fields = ["owner"]

backend/books/apps.py

@@ -1,5 +0,0 @@
-from django.apps import AppConfig
-
-
-class BooksConfig(AppConfig):
-    name = 'books'

backend/books/migrations/0001_initial.py

@@ -1,41 +0,0 @@
-# Generated by Django 6.0.5 on 2026-05-26 00:49
-
-import django.db.models.deletion
-from django.conf import settings
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    initial = True
-
-    dependencies = [
-        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name='Book',
-            fields=[
-                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
-                ('title', models.CharField(max_length=500, verbose_name='Title')),
-                ('author', models.CharField(max_length=500, verbose_name='Author')),
-                ('genre', models.CharField(blank=True, default='', max_length=200, verbose_name='Genre')),
-                ('description', models.TextField(blank=True, default='', verbose_name='Description')),
-                ('cover_image_url', models.URLField(blank=True, default='', verbose_name='Cover Image URL')),
-                ('isbn', models.CharField(blank=True, default='', max_length=20, verbose_name='ISBN')),
-                ('total_pages', models.PositiveIntegerField(default=0, verbose_name='Total Pages')),
-                ('current_page', models.PositiveIntegerField(default=0, verbose_name='Current Page')),
-                ('reading_status', models.CharField(choices=[('not_started', 'Not Started'), ('reading', 'Reading'), ('finished', 'Finished'), ('dnf', 'Did Not Finish')], default='not_started', max_length=20, verbose_name='Reading Status')),
-                ('created_at', models.DateTimeField(auto_now_add=True, verbose_name='Created At')),
-                ('updated_at', models.DateTimeField(auto_now=True, verbose_name='Updated At')),
-                ('owner', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='books', to=settings.AUTH_USER_MODEL, verbose_name='Owner')),
-            ],
-            options={
-                'verbose_name': 'Book',
-                'verbose_name_plural': 'Books',
-                'ordering': ['-updated_at'],
-                'indexes': [models.Index(fields=['owner', 'reading_status'], name='books_book_owner_i_424622_idx'), models.Index(fields=['owner', 'title'], name='books_book_owner_i_350794_idx'), models.Index(fields=['owner', 'author'], name='books_book_owner_i_f90626_idx')],
-            },
-        ),
-    ]

backend/books/models.py

@@ -1,66 +0,0 @@
-from __future__ import annotations
-
-from django.db import models
-from django.utils.translation import gettext_lazy as _
-
-
-class ReadingStatus(models.TextChoices):
-    """Enumeration of possible reading statuses for a book."""
-
-    NOT_STARTED = "not_started", _("Not Started")
-    READING = "reading", _("Reading")
-    FINISHED = "finished", _("Finished")
-    DNF = "dnf", _("Did Not Finish")
-
-
-class Book(models.Model):
-    """Represents a book in the user's library."""
-
-    title = models.CharField(max_length=500, verbose_name=_("Title"))
-    author = models.CharField(max_length=500, verbose_name=_("Author"))
-    genre = models.CharField(max_length=200, blank=True, default="", verbose_name=_("Genre"))
-    description = models.TextField(blank=True, default="", verbose_name=_("Description"))
-    cover_image_url = models.URLField(blank=True, default="", verbose_name=_("Cover Image URL"))
-    isbn = models.CharField(max_length=20, blank=True, default="", verbose_name=_("ISBN"))
-    total_pages = models.PositiveIntegerField(default=0, verbose_name=_("Total Pages"))
-    current_page = models.PositiveIntegerField(default=0, verbose_name=_("Current Page"))
-    reading_status = models.CharField(
-        max_length=20,
-        choices=ReadingStatus.choices,
-        default=ReadingStatus.NOT_STARTED,
-        verbose_name=_("Reading Status"),
-    )
-    owner = models.ForeignKey(
-        "auth.User",
-        on_delete=models.CASCADE,
-        related_name="books",
-        verbose_name=_("Owner"),
-    )
-    created_at = models.DateTimeField(auto_now_add=True, verbose_name=_("Created At"))
-    updated_at = models.DateTimeField(auto_now=True, verbose_name=_("Updated At"))
-
-    class Meta:
-        ordering = ["-updated_at"]
-        verbose_name = _("Book")
-        verbose_name_plural = _("Books")
-        indexes = [
-            models.Index(fields=["owner", "reading_status"]),
-            models.Index(fields=["owner", "title"]),
-            models.Index(fields=["owner", "author"]),
-        ]
-
-    def __str__(self) -> str:
-        return f"{self.title} by {self.author}"
-
-    @property
-    def reading_progress(self) -> float:
-        """Calculate reading progress as a percentage (0.0 - 100.0)."""
-        if self.total_pages == 0:
-            return 0.0
-        return round((self.current_page / self.total_pages) * 100, 1)
-
-    def mark_as_finished(self) -> None:
-        """Mark the book as finished, setting progress to 100%."""
-        self.reading_status = ReadingStatus.FINISHED
-        self.current_page = self.total_pages
-        self.save(update_fields=["reading_status", "current_page", "updated_at"])

backend/books/serializers.py

@@ -1,95 +0,0 @@
-from __future__ import annotations
-
-from rest_framework import serializers
-
-from books.models import Book, ReadingStatus
-
-
-class BookListSerializer(serializers.ModelSerializer):
-    """Lightweight serializer for list views — avoids heavy field serialization."""
-
-    reading_progress = serializers.FloatField(read_only=True)
-
-    class Meta:
-        model = Book
-        fields = [
-            "id",
-            "title",
-            "author",
-            "genre",
-            "reading_status",
-            "reading_progress",
-            "cover_image_url",
-            "created_at",
-            "updated_at",
-        ]
-
-
-class BookDetailSerializer(serializers.ModelSerializer):
-    """Full serializer for book detail views including all metadata."""
-
-    reading_progress = serializers.FloatField(read_only=True)
-    owner = serializers.ReadOnlyField(source="owner.username")
-
-    class Meta:
-        model = Book
-        fields = [
-            "id",
-            "title",
-            "author",
-            "genre",
-            "description",
-            "cover_image_url",
-            "isbn",
-            "total_pages",
-            "current_page",
-            "reading_status",
-            "reading_progress",
-            "owner",
-            "created_at",
-            "updated_at",
-        ]
-        read_only_fields = ["owner", "created_at", "updated_at", "reading_progress"]
-
-    def validate_title(self, value: str) -> str:
-        """Ensure title is not just whitespace."""
-        stripped = value.strip()
-        if not stripped:
-            msg = "Title cannot be empty."
-            raise serializers.ValidationError(msg)
-        return stripped
-
-    def validate_author(self, value: str) -> str:
-        """Ensure author is not just whitespace."""
-        stripped = value.strip()
-        if not stripped:
-            msg = "Author cannot be empty."
-            raise serializers.ValidationError(msg)
-        return stripped
-
-    def validate(self, attrs: dict) -> dict:
-        """Business rules — handles both full creates and partial updates."""
-        # Resolve effective values: use provided attrs, fall back to instance
-        current_total = getattr(self.instance, "total_pages", None)
-        current_current = getattr(self.instance, "current_page", None)
-        total_pages = attrs.get("total_pages", current_total) or 0
-        current_page = attrs.get("current_page", current_current) or 0
-        reading_status = attrs.get("reading_status", None)
-
-        if current_page > total_pages > 0:
-            msg = "Current page cannot exceed total pages."
-            raise serializers.ValidationError({"current_page": msg})
-
-        if reading_status == ReadingStatus.FINISHED:
-            if total_pages > 0:
-                attrs["current_page"] = total_pages
-            elif self.instance and self.instance.total_pages > 0:
-                attrs["current_page"] = self.instance.total_pages
-
-        return attrs
-
-
-class BookWriteSerializer(BookDetailSerializer):
-    """Alias for detail serializer — used for write operations with full validation."""
-
-    pass

backend/books/tests.py

@@ -1,325 +0,0 @@
-"""Tests for the books app — API endpoints, models, serializers, and permissions."""
-
-from __future__ import annotations
-
-from django.contrib.auth.models import User
-from django.test import TestCase, override_settings
-from rest_framework import status
-from rest_framework.test import APIClient
-
-from books.models import Book, ReadingStatus
-
-
-class BookModelTests(TestCase):
-    """Tests for the Book model."""
-
-    def setUp(self) -> None:
-        self.user = User.objects.create_user(username="testuser", password="testpass123")
-        self.book = Book.objects.create(
-            title="Test Book",
-            author="Test Author",
-            total_pages=200,
-            current_page=50,
-            reading_status=ReadingStatus.READING,
-            owner=self.user,
-        )
-
-    def test_reading_progress_calculates_correctly(self) -> None:
-        """Reading progress should be (current_page / total_pages) * 100."""
-        assert self.book.reading_progress == 25.0
-
-    def test_reading_progress_returns_zero_when_no_pages(self) -> None:
-        """When total_pages is 0, reading_progress should be 0.0."""
-        book = Book.objects.create(
-            title="No Pages",
-            author="Author",
-            total_pages=0,
-            current_page=50,
-            owner=self.user,
-        )
-        assert book.reading_progress == 0.0
-
-    def test_mark_as_finished_sets_progress_to_100(self) -> None:
-        """mark_as_finished should set status to FINISHED and progress to 100%."""
-        self.book.mark_as_finished()
-        self.book.refresh_from_db()
-        assert self.book.reading_status == ReadingStatus.FINISHED
-        assert self.book.current_page == self.book.total_pages
-
-    def test_mark_as_finished_with_zero_pages(self) -> None:
-        """mark_as_finished with total_pages=0 should set 0/0."""
-        book = Book.objects.create(
-            title="Empty",
-            author="Author",
-            total_pages=0,
-            current_page=0,
-            owner=self.user,
-        )
-        book.mark_as_finished()
-        book.refresh_from_db()
-        assert book.reading_status == ReadingStatus.FINISHED
-        assert book.current_page == 0
-
-    def test_str_method(self) -> None:
-        """__str__ should return 'Title by Author'."""
-        assert str(self.book) == "Test Book by Test Author"
-
-
-class BookAPITests(TestCase):
-    """Tests for the Book API endpoints."""
-
-    def setUp(self) -> None:
-        self.client = APIClient()
-        self.user = User.objects.create_user(username="testuser", password="testpass123")
-        self.other_user = User.objects.create_user(username="other", password="testpass123")
-        self.client.force_authenticate(user=self.user)
-
-        self.book = Book.objects.create(
-            title="My Book",
-            author="My Author",
-            genre="Fiction",
-            description="A great book",
-            total_pages=200,
-            current_page=50,
-            reading_status=ReadingStatus.READING,
-            owner=self.user,
-        )
-        # Other user's book (should not be visible)
-        Book.objects.create(
-            title="Other Book",
-            author="Other Author",
-            total_pages=100,
-            owner=self.other_user,
-        )
-
-    # --- List ---
-
-    def test_list_books_returns_owned_books_only(self) -> None:
-        """GET /api/books/ should only return books owned by the current user."""
-        resp = self.client.get("/api/books/")
-        assert resp.status_code == status.HTTP_200_OK
-        assert resp.data["count"] == 1
-        assert resp.data["results"][0]["title"] == "My Book"
-
-    def test_list_books_requires_authentication(self) -> None:
-        """GET /api/books/ without auth should return 403."""
-        self.client.force_authenticate(user=None)
-        resp = self.client.get("/api/books/")
-        assert resp.status_code == status.HTTP_403_FORBIDDEN
-
-    # --- Create ---
-
-    def test_create_book_sets_owner(self) -> None:
-        """POST /api/books/ should create a book owned by the current user."""
-        resp = self.client.post("/api/books/", {
-            "title": "New Book",
-            "author": "New Author",
-        }, format="json")
-        assert resp.status_code == status.HTTP_201_CREATED
-        assert resp.data["owner"] == "testuser"
-        assert Book.objects.filter(title="New Book", owner=self.user).exists()
-
-    def test_create_book_validates_required_fields(self) -> None:
-        """POST /api/books/ with missing title should fail."""
-        resp = self.client.post("/api/books/", {
-            "author": "Author Only",
-        }, format="json")
-        assert resp.status_code == status.HTTP_400_BAD_REQUEST
-
-    # --- Retrieve ---
-
-    def test_retrieve_book(self) -> None:
-        """GET /api/books/{id}/ should return full book details."""
-        resp = self.client.get(f"/api/books/{self.book.id}/")
-        assert resp.status_code == status.HTTP_200_OK
-        assert resp.data["title"] == "My Book"
-        assert resp.data["reading_progress"] == 25.0
-        assert resp.data["owner"] == "testuser"
-
-    def test_retrieve_other_users_book_returns_404(self) -> None:
-        """GET /api/books/{other_id}/ should return 404 for another user's book."""
-        other_book = Book.objects.get(title="Other Book")
-        resp = self.client.get(f"/api/books/{other_book.id}/")
-        assert resp.status_code == status.HTTP_404_NOT_FOUND
-
-    # --- Update ---
-
-    def test_update_book(self) -> None:
-        """PATCH /api/books/{id}/ should update book fields."""
-        resp = self.client.patch(f"/api/books/{self.book.id}/", {
-            "title": "Updated Title",
-            "current_page": 100,
-        }, format="json")
-        assert resp.status_code == status.HTTP_200_OK
-        assert resp.data["title"] == "Updated Title"
-        assert resp.data["reading_progress"] == 50.0
-
-    def test_update_current_page_exceeds_total(self) -> None:
-        """PATCH with current_page > total_pages should fail."""
-        resp = self.client.patch(f"/api/books/{self.book.id}/", {
-            "current_page": 999,
-        }, format="json")
-        assert resp.status_code == status.HTTP_400_BAD_REQUEST
-
-    # --- Delete ---
-
-    def test_delete_book(self) -> None:
-        """DELETE /api/books/{id}/ should delete the book."""
-        resp = self.client.delete(f"/api/books/{self.book.id}/")
-        assert resp.status_code == status.HTTP_204_NO_CONTENT
-        assert not Book.objects.filter(id=self.book.id).exists()
-
-    # --- Mark Finished ---
-
-    def test_mark_finished_sets_100_percent(self) -> None:
-        """POST /api/books/{id}/mark_finished/ should set progress to 100%."""
-        resp = self.client.post(f"/api/books/{self.book.id}/mark_finished/")
-        assert resp.status_code == status.HTTP_200_OK
-        assert resp.data["reading_status"] == ReadingStatus.FINISHED
-        assert resp.data["reading_progress"] == 100.0
-
-    def test_mark_finished_idempotent(self) -> None:
-        """Calling mark_finished twice should be safe."""
-        self.client.post(f"/api/books/{self.book.id}/mark_finished/")
-        resp = self.client.post(f"/api/books/{self.book.id}/mark_finished/")
-        assert resp.status_code == status.HTTP_200_OK
-
-    def test_mark_finished_other_users_book(self) -> None:
-        """POST mark_finished on another user's book should return 404."""
-        other_book = Book.objects.get(title="Other Book")
-        resp = self.client.post(f"/api/books/{other_book.id}/mark_finished/")
-        assert resp.status_code == status.HTTP_404_NOT_FOUND
-
-    # --- Stats ---
-
-    def test_stats_returns_counts(self) -> None:
-        """GET /api/books/stats/ should return aggregate counts."""
-        resp = self.client.get("/api/books/stats/")
-        assert resp.status_code == status.HTTP_200_OK
-        assert resp.data["total_books"] == 1
-        assert resp.data["finished"] == 0
-        assert resp.data["reading"] == 1
-        assert resp.data["not_started"] == 0
-
-    # --- Filtering & Sorting ---
-
-    def test_filter_by_reading_status(self) -> None:
-        """GET /api/books/?reading_status=reading should filter correctly."""
-        resp = self.client.get("/api/books/", {"reading_status": "reading"})
-        assert resp.status_code == status.HTTP_200_OK
-        assert resp.data["count"] == 1
-
-        resp = self.client.get("/api/books/", {"reading_status": "finished"})
-        assert resp.status_code == status.HTTP_200_OK
-        assert resp.data["count"] == 0
-
-    def test_search_by_title(self) -> None:
-        """GET /api/books/?search=My should filter by title."""
-        resp = self.client.get("/api/books/", {"search": "My"})
-        assert resp.status_code == status.HTTP_200_OK
-        assert resp.data["count"] == 1
-
-        resp = self.client.get("/api/books/", {"search": "Nonexistent"})
-        assert resp.status_code == status.HTTP_200_OK
-        assert resp.data["count"] == 0
-
-    def test_search_by_author(self) -> None:
-        """GET /api/books/?search=My should filter by author."""
-        resp = self.client.get("/api/books/", {"search": "My Author"})
-        assert resp.status_code == status.HTTP_200_OK
-        assert resp.data["count"] == 1
-
-    def test_sort_by_title(self) -> None:
-        """GET /api/books/?sort_by=title should sort alphabetically."""
-        Book.objects.create(title="Aardvark", author="Author", owner=self.user)
-        Book.objects.create(title="Zebra", author="Author", owner=self.user)
-        resp = self.client.get("/api/books/", {"sort_by": "title"})
-        assert resp.status_code == status.HTTP_200_OK
-        titles = [b["title"] for b in resp.data["results"]]
-        assert titles == sorted(titles)
-
-    def test_sort_by_author_desc(self) -> None:
-        """GET /api/books/?sort_by=-author should sort by author desc."""
-        resp = self.client.get("/api/books/", {"sort_by": "-author"})
-        assert resp.status_code == status.HTTP_200_OK
-
-    # --- Pagination ---
-
-    def test_pagination_default_page_size(self) -> None:
-        """Books should be paginated with default page size."""
-        for i in range(25):
-            Book.objects.create(
-                title=f"Book {i}",
-                author="Author",
-                owner=self.user,
-            )
-        resp = self.client.get("/api/books/")
-        assert resp.status_code == status.HTTP_200_OK
-        assert len(resp.data["results"]) == 20  # PAGE_SIZE = 20
-        assert resp.data["count"] == 26  # 1 original + 25 new
-
-    def test_pagination_second_page(self) -> None:
-        """GET /api/books/?page=2 should return remaining items."""
-        for i in range(25):
-            Book.objects.create(
-                title=f"Book {i}",
-                author="Author",
-                owner=self.user,
-            )
-        resp = self.client.get("/api/books/", {"page": 2})
-        assert resp.status_code == status.HTTP_200_OK
-        assert len(resp.data["results"]) == 6
-
-
-class BookSerializerTests(TestCase):
-    """Tests for serializers — validation rules."""
-
-    def setUp(self) -> None:
-        self.user = User.objects.create_user(username="testuser", password="testpass123")
-
-    def test_current_page_cannot_exceed_total(self) -> None:
-        """Serializer should reject current_page > total_pages."""
-        from books.serializers import BookDetailSerializer
-        data = {
-            "title": "Test",
-            "author": "Author",
-            "total_pages": 100,
-            "current_page": 150,
-        }
-        serializer = BookDetailSerializer(data=data)
-        assert not serializer.is_valid()
-        assert "current_page" in serializer.errors
-
-    def test_title_cannot_be_blank(self) -> None:
-        """Serializer should reject blank title."""
-        from books.serializers import BookDetailSerializer
-        data = {
-            "title": "   ",
-            "author": "Author",
-        }
-        serializer = BookDetailSerializer(data=data)
-        assert not serializer.is_valid()
-        assert "title" in serializer.errors
-
-    def test_author_cannot_be_blank(self) -> None:
-        """Serializer should reject blank author."""
-        from books.serializers import BookDetailSerializer
-        data = {
-            "title": "Test",
-            "author": "",
-        }
-        serializer = BookDetailSerializer(data=data)
-        assert not serializer.is_valid()
-        assert "author" in serializer.errors
-
-    def test_list_serializer_has_minimal_fields(self) -> None:
-        """BookListSerializer should exclude sensitive/fluff fields."""
-        from books.serializers import BookListSerializer
-        serializer = BookListSerializer()
-        fields = set(serializer.fields.keys())
-        assert "id" in fields
-        assert "title" in fields
-        assert "author" in fields
-        assert "reading_progress" in fields
-        assert "description" not in fields
-        assert "isbn" not in fields

backend/books/views.py

@@ -1,91 +0,0 @@
-from __future__ import annotations
-
-from django.db import models
-from django.db.models import QuerySet
-from rest_framework import status, viewsets
-from rest_framework.decorators import action
-from rest_framework.permissions import IsAuthenticated
-from rest_framework.request import Request
-from rest_framework.response import Response
-
-from books.models import Book, ReadingStatus
-from books.serializers import BookDetailSerializer, BookListSerializer
-
-
-class BookViewSet(viewsets.ModelViewSet):
-    """
-    ViewSet for managing books in the user's library.
-
-    Provides:
-    - list / retrieve / create / update / partial_update / destroy
-    - `mark_finished` action to set a book as 100% complete
-    - `stats` action for library overview counts
-    """
-
-    permission_classes = [IsAuthenticated]
-
-    def get_serializer_class(self) -> type:
-        if self.action == "list":
-            return BookListSerializer
-        return BookDetailSerializer
-
-    def get_queryset(self) -> QuerySet[Book]:
-        """Return books owned by the current user with optimised queries."""
-        qs = Book.objects.filter(owner=self.request.user).select_related("owner")
-
-        # Sorting
-        sort_by = self.request.query_params.get("sort_by", "-updated_at")
-        allowed_sorts = {
-            "title": "title",
-            "-title": "-title",
-            "author": "author",
-            "-author": "-author",
-            "created_at": "created_at",
-            "-created_at": "-created_at",
-            "updated_at": "updated_at",
-            "-updated_at": "-updated_at",
-            "reading_progress": "current_page",  # approximate sort by pages read
-            "-reading_progress": "-current_page",
-        }
-        if sort_by in allowed_sorts:
-            qs = qs.order_by(allowed_sorts[sort_by])
-
-        # Filtering
-        status_filter = self.request.query_params.get("reading_status", None)
-        if status_filter in ReadingStatus.values:
-            qs = qs.filter(reading_status=status_filter)
-
-        search = self.request.query_params.get("search", "").strip()
-        if search:
-            qs = qs.filter(
-                models.Q(title__icontains=search) | models.Q(author__icontains=search)
-            )
-
-        return qs
-
-    def perform_create(self, serializer: BookDetailSerializer) -> None:
-        """Set the owner to the current user on creation."""
-        serializer.save(owner=self.request.user)
-
-    @action(detail=True, methods=["post"])
-    def mark_finished(self, request: Request, pk: int | None = None) -> Response:
-        """Mark a book as finished (100% progress)."""
-        book: Book = self.get_object()
-        book.mark_as_finished()
-        serializer = self.get_serializer(book)
-        return Response(serializer.data, status=status.HTTP_200_OK)
-
-    @action(detail=False, methods=["get"])
-    def stats(self, request: Request) -> Response:
-        """Return aggregate stats about the user's library."""
-        qs = self.get_queryset()
-        total = qs.count()
-        finished = qs.filter(reading_status=ReadingStatus.FINISHED).count()
-        reading = qs.filter(reading_status=ReadingStatus.READING).count()
-        not_started = qs.filter(reading_status=ReadingStatus.NOT_STARTED).count()
-        return Response({
-            "total_books": total,
-            "finished": finished,
-            "reading": reading,
-            "not_started": not_started,
-        })

backend/config/asgi.py

@@ -1,16 +0,0 @@
-"""
-ASGI config for config project.
-
-It exposes the ASGI callable as a module-level variable named ``application``.
-
-For more information on this file, see
-https://docs.djangoproject.com/en/6.0/howto/deployment/asgi/
-"""
-
-import os
-
-from django.core.asgi import get_asgi_application
-
-os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'config.settings')
-
-application = get_asgi_application()

backend/config/django.py

@@ -0,0 +1,153 @@
+"""
+Django settings for cloud-reader backend.
+
+Generated using Django 5.1.  Customised with pydantic-settings integration.
+"""
+
+from pathlib import Path
+
+from config.settings import settings
+
+# ---------------------------------------------------------------------------
+# Build paths
+# ---------------------------------------------------------------------------
+BASE_DIR = Path(__file__).resolve().parent.parent
+
+# ---------------------------------------------------------------------------
+# Security
+# ---------------------------------------------------------------------------
+SECRET_KEY = settings.DJANGO_SECRET_KEY
+DEBUG = settings.DJANGO_DEBUG
+ALLOWED_HOSTS = settings.DJANGO_ALLOWED_HOSTS
+
+# ---------------------------------------------------------------------------
+# Application definition
+# ---------------------------------------------------------------------------
+INSTALLED_APPS = [
+    # Django built-in
+    "django.contrib.admin",
+    "django.contrib.auth",
+    "django.contrib.contenttypes",
+    "django.contrib.sessions",
+    "django.contrib.messages",
+    "django.contrib.staticfiles",
+    # Third-party
+    "rest_framework",
+    "rest_framework_simplejwt",
+    "corsheaders",
+    "django_filters",
+    # Local apps
+    "apps.users",
+    "apps.books",
+    "apps.annotations",
+]
+
+MIDDLEWARE = [
+    "corsheaders.middleware.CorsMiddleware",
+    "django.middleware.security.SecurityMiddleware",
+    "django.contrib.sessions.middleware.SessionMiddleware",
+    "django.middleware.common.CommonMiddleware",
+    "django.middleware.csrf.CsrfViewMiddleware",
+    "django.contrib.auth.middleware.AuthenticationMiddleware",
+    "django.contrib.messages.middleware.MessageMiddleware",
+    "django.middleware.clickjacking.XFrameOptionsMiddleware",
+]
+
+ROOT_URLCONF = "config.urls"
+
+TEMPLATES = [
+    {
+        "BACKEND": "django.template.backends.django.DjangoTemplates",
+        "DIRS": [],
+        "APP_DIRS": True,
+        "OPTIONS": {
+            "context_processors": [
+                "django.template.context_processors.debug",
+                "django.template.context_processors.request",
+                "django.contrib.auth.context_processors.auth",
+                "django.contrib.messages.context_processors.messages",
+            ],
+        },
+    },
+]
+
+WSGI_APPLICATION = "config.wsgi.application"
+
+# ---------------------------------------------------------------------------
+# Database
+# ---------------------------------------------------------------------------
+DATABASES = {
+    "default": {
+        "ENGINE": "django.db.backends.postgresql",
+        "NAME": settings.DB_NAME,
+        "USER": settings.DB_USER,
+        "PASSWORD": settings.DB_PASSWORD,
+        "HOST": settings.DB_HOST,
+        "PORT": settings.DB_PORT,
+    }
+}
+
+# ---------------------------------------------------------------------------
+# Auth
+# ---------------------------------------------------------------------------
+AUTH_USER_MODEL = "users.User"
+
+AUTH_PASSWORD_VALIDATORS = [
+    {"NAME": "django.contrib.auth.password_validation.MinimumLengthValidator"},
+    {"NAME": "django.contrib.auth.password_validation.NumericPasswordValidator"},
+]
+
+# ---------------------------------------------------------------------------
+# DRF
+# ---------------------------------------------------------------------------
+REST_FRAMEWORK = {
+    "DEFAULT_AUTHENTICATION_CLASSES": (
+        "rest_framework_simplejwt.authentication.JWTAuthentication",
+    ),
+    "DEFAULT_PERMISSION_CLASSES": (
+        "rest_framework.permissions.IsAuthenticated",
+    ),
+    "DEFAULT_PAGINATION_CLASS": "rest_framework.pagination.PageNumberPagination",
+    "PAGE_SIZE": 50,
+    "DEFAULT_FILTER_BACKENDS": [
+        "django_filters.rest_framework.DjangoFilterBackend",
+        "rest_framework.filters.OrderingFilter",
+        "rest_framework.filters.SearchFilter",
+    ],
+}
+
+# ---------------------------------------------------------------------------
+# SimpleJWT
+# ---------------------------------------------------------------------------
+from datetime import timedelta
+
+SIMPLE_JWT = {
+    "ACCESS_TOKEN_LIFETIME": timedelta(minutes=settings.JWT_ACCESS_TOKEN_LIFETIME_MINUTES),
+    "REFRESH_TOKEN_LIFETIME": timedelta(days=settings.JWT_REFRESH_TOKEN_LIFETIME_DAYS),
+}
+
+# ---------------------------------------------------------------------------
+# CORS
+# ---------------------------------------------------------------------------
+CORS_ALLOWED_ORIGINS = settings.CORS_ALLOWED_ORIGINS
+
+# ---------------------------------------------------------------------------
+# i18n
+# ---------------------------------------------------------------------------
+LANGUAGE_CODE = "en-us"
+TIME_ZONE = "UTC"
+USE_I18N = True
+USE_TZ = True
+
+# ---------------------------------------------------------------------------
+# Static / Media
+# ---------------------------------------------------------------------------
+STATIC_URL = "static/"
+STATIC_ROOT = BASE_DIR / "staticfiles"
+MEDIA_URL = "media/"
+MEDIA_ROOT = BASE_DIR / "media"
+
+# ---------------------------------------------------------------------------
+# Default primary key
+# ---------------------------------------------------------------------------
+DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"

backend/config/settings.py

@@ -1,99 +1,42 @@
-"""
+import os
-Django settings for config project.
-
-Generated by 'django-admin startproject' using Django 6.0.5.
-"""
-
 from pathlib import Path
 
-from config.settings_app import settings
+from pydantic_settings import BaseSettings
 
-BASE_DIR = Path(__file__).resolve().parent.parent
 
-SECRET_KEY = settings.SECRET_KEY
+class Settings(BaseSettings):
-DEBUG = settings.DEBUG
+    """Application settings via pydantic-settings. Reads from env vars and .env."""
-ALLOWED_HOSTS = settings.ALLOWED_HOSTS
 
-INSTALLED_APPS = [
+    # Django
-    "django.contrib.admin",
+    DJANGO_SECRET_KEY: str = "django-insecure-change-me-in-production"
-    "django.contrib.auth",
+    DJANGO_DEBUG: bool = False
-    "django.contrib.contenttypes",
+    DJANGO_ALLOWED_HOSTS: list[str] = ["*"]
-    "django.contrib.sessions",
-    "django.contrib.messages",
-    "django.contrib.staticfiles",
-    # Third-party
-    "rest_framework",
-    "corsheaders",
-    # Local apps
-    "books",
-]
 
-MIDDLEWARE = [
+    # PostgreSQL
-    "corsheaders.middleware.CorsMiddleware",
+    DB_NAME: str = "cloud_reader"
-    "django.middleware.security.SecurityMiddleware",
+    DB_USER: str = "postgres"
-    "django.contrib.sessions.middleware.SessionMiddleware",
+    DB_PASSWORD: str = "postgres"
-    "django.middleware.common.CommonMiddleware",
+    DB_HOST: str = "localhost"
-    "django.middleware.csrf.CsrfViewMiddleware",
+    DB_PORT: int = 5432
-    "django.contrib.auth.middleware.AuthenticationMiddleware",
-    "django.contrib.messages.middleware.MessageMiddleware",
-    "django.middleware.clickjacking.XFrameOptionsMiddleware",
-]
 
-ROOT_URLCONF = "config.urls"
+    # JWT
-
+    JWT_ACCESS_TOKEN_LIFETIME_MINUTES: int = 60
-TEMPLATES = [
+    JWT_REFRESH_TOKEN_LIFETIME_DAYS: int = 7
-    {
-        "BACKEND": "django.template.backends.django.DjangoTemplates",
-        "DIRS": [],
-        "APP_DIRS": True,
-        "OPTIONS": {
-            "context_processors": [
-                "django.template.context_processors.request",
-                "django.contrib.auth.context_processors.auth",
-                "django.contrib.messages.context_processors.messages",
-            ],
-        },
-    },
-]
-
-WSGI_APPLICATION = "config.wsgi.application"
-
-DATABASES = {
-    "default": {
-        "ENGINE": "django.db.backends.sqlite3",
-        "NAME": BASE_DIR / "db.sqlite3",
-    }
-}
-
-AUTH_PASSWORD_VALIDATORS = [
-    {"NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator"},
-    {"NAME": "django.contrib.auth.password_validation.MinimumLengthValidator"},
-    {"NAME": "django.contrib.auth.password_validation.CommonPasswordValidator"},
-    {"NAME": "django.contrib.auth.password_validation.NumericPasswordValidator"},
-]
-
-LANGUAGE_CODE = "en-us"
-TIME_ZONE = "UTC"
-USE_I18N = True
-USE_TZ = True
-
-STATIC_URL = "static/"
-
-DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
 
     # CORS
-CORS_ALLOWED_ORIGINS = settings.CORS_ALLOWED_ORIGINS
+    CORS_ALLOWED_ORIGINS: list[str] = [
-CORS_ALLOW_CREDENTIALS = settings.CORS_ALLOW_CREDENTIALS
+        "http://localhost:5173",
+        "http://localhost:3000",
+    ]
 
-# REST Framework
+    @property
-REST_FRAMEWORK = {
+    def DATABASE_URL(self) -> str:
-    "DEFAULT_AUTHENTICATION_CLASSES": [
+        return (
-        "rest_framework.authentication.SessionAuthentication",
+            f"postgresql://{self.DB_USER}:{self.DB_PASSWORD}"
-        "rest_framework.authentication.BasicAuthentication",
+            f"@{self.DB_HOST}:{self.DB_PORT}/{self.DB_NAME}"
-    ],
+        )
-    "DEFAULT_PERMISSION_CLASSES": [
+
-        "rest_framework.permissions.IsAuthenticatedOrReadOnly",
+    model_config = {"env_file": ".env", "env_file_encoding": "utf-8"}
-    ],
+
-    "DEFAULT_PAGINATION_CLASS": "rest_framework.pagination.PageNumberPagination",
+
-    "PAGE_SIZE": 20,
+settings = Settings()
-}

backend/config/settings_app.py

@@ -1,33 +0,0 @@
-from __future__ import annotations
-
-from pathlib import Path
-
-from pydantic_settings import BaseSettings, SettingsConfigDict
-
-
-class Settings(BaseSettings):
-    """Application settings loaded from environment variables."""
-
-    DEBUG: bool = True
-    SECRET_KEY: str = "django-insecure-change-me-in-production"
-    DATABASE_URL: str = "sqlite:///db.sqlite3"
-    ALLOWED_HOSTS: list[str] = ["*"]
-    CORS_ALLOWED_ORIGINS: list[str] = [
-        "http://localhost:3000",
-        "http://localhost:5173",
-        "http://127.0.0.1:3000",
-        "http://127.0.0.1:5173",
-    ]
-    CORS_ALLOW_CREDENTIALS: bool = True
-
-    BASE_DIR: Path = Path(__file__).resolve().parent.parent
-
-    model_config = SettingsConfigDict(
-        env_prefix="CR_",
-        env_file=".env",
-        env_file_encoding="utf-8",
-        extra="ignore",
-    )
-
-
-settings = Settings()

backend/config/urls.py

@@ -3,6 +3,7 @@ from django.urls import include, path
 
 urlpatterns = [
     path("admin/", admin.site.urls),
-    path("api-auth/", include("rest_framework.urls")),
+    path("api/auth/", include("apps.users.urls")),
-    path("api/", include("books.urls")),
+    path("api/books/", include("apps.books.urls")),
+    path("api/annotations/", include("apps.annotations.urls")),
 ]

backend/config/wsgi.py

@@ -1,16 +1,7 @@
-"""
-WSGI config for config project.
-
-It exposes the WSGI callable as a module-level variable named ``application``.
-
-For more information on this file, see
-https://docs.djangoproject.com/en/6.0/howto/deployment/wsgi/
-"""
-
 import os
 
 from django.core.wsgi import get_wsgi_application
 
-os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'config.settings')
+os.environ.setdefault("DJANGO_SETTINGS_MODULE", "config.django")
 
 application = get_wsgi_application()

backend/manage.py

@@ -1,12 +1,13 @@
 #!/usr/bin/env python
 """Django's command-line utility for administrative tasks."""
+
 import os
 import sys
 
 
 def main():
     """Run administrative tasks."""
-    os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'config.settings')
+    os.environ.setdefault("DJANGO_SETTINGS_MODULE", "config.django")
     try:
         from django.core.management import execute_from_command_line
     except ImportError as exc:
@@ -18,5 +19,5 @@ def main():
     execute_from_command_line(sys.argv)
 
 
-if __name__ == '__main__':
+if __name__ == "__main__":
     main()

backend/pytest.ini

@@ -1,3 +1,8 @@
-[pytest]
+[tool:pytest]
-DJANGO_SETTINGS_MODULE = config.settings
+DJANGO_SETTINGS_MODULE = config.django
 python_files = tests.py test_*.py *_tests.py
+testpaths = apps
+
+[coverage:run]
+source = apps
+omit = */tests/*,*/migrations/*,*/admin.py,*/apps.py

backend/requirements.txt

@@ -1,6 +1,14 @@
-django>=5.0,<7.0
+Django==5.1.7
-djangorestframework>=3.15.0
+djangorestframework==3.15.2
-django-cors-headers>=4.0.0
+djangorestframework-simplejwt==5.4.0
-pydantic>=2.0.0
+django-filter==25.1
-pydantic-settings>=2.0.0
+django-cors-headers==4.6.0
-pytest-django>=4.5.0
+psycopg2-binary==2.9.10
+pydantic==2.10.5
+pydantic-settings==2.7.1
+python-dotenv==1.0.1
+gunicorn==23.0.0
+pytest==8.3.4
+pytest-django==4.9.0
+pytest-cov==6.0.0
+coverage==7.6.10

docker-compose.yml

@@ -0,0 +1,52 @@
+services:
+  db:
+    image: postgres:15
+    restart: unless-stopped
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    environment:
+      POSTGRES_DB: cloudreader
+      POSTGRES_USER: cloudreader
+      POSTGRES_PASSWORD: cloudreader
+    ports:
+      - "5432:5432"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U cloudreader -d cloudreader"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  api:
+    build:
+      context: ./api
+    ports:
+      - "8000:8000"
+    environment:
+      DATABASE_URL: "postgres://cloudreader:cloudreader@db:5432/cloudreader"
+      DJANGO_SECRET_KEY: "dev-secret-key-change-in-production"
+      DJANGO_DEBUG: "True"
+    volumes:
+      - ./api:/app
+      - book_uploads:/app/media
+    command: >
+      sh -c "python manage.py migrate && python manage.py runserver 0.0.0.0:8000"
+    depends_on:
+      db:
+        condition: service_healthy
+
+  web:
+    build:
+      context: ./web
+    ports:
+      - "3000:3000"
+    environment:
+      VITE_API_URL: "http://localhost:8000"
+    volumes:
+      - ./web:/app
+      - /app/node_modules
+    depends_on:
+      - api
+
+volumes:
+  postgres_data:
+  book_uploads:

docs/backend/api-spec.md

@@ -1,84 +0,0 @@
-# Backend API Specification — Cloud Reader
-
-## Overview
-
-The Cloud Reader backend provides a RESTful API for managing a user's personal book library. Built with Django 5 + Django REST Framework.
-
-## Models
-
-### Book
-
-| Field            | Type               | Constraints                     |
-|------------------|--------------------|---------------------------------|
-| `title`          | `CharField(500)`   | Required                         |
-| `author`         | `CharField(500)`   | Required                         |
-| `genre`          | `CharField(200)`   | Optional, blank allowed          |
-| `description`    | `TextField`        | Optional, blank allowed          |
-| `cover_image_url`| `URLField`         | Optional, blank allowed          |
-| `isbn`           | `CharField(20)`    | Optional, blank allowed          |
-| `total_pages`    | `PositiveIntegerField` | Default 0                   |
-| `current_page`   | `PositiveIntegerField` | Default 0, validated ≤ total |
-| `reading_status` | `CharField(20)`    | Choices: `not_started`, `reading`, `finished`, `dnf` |
-| `owner`          | `ForeignKey(User)` | Set automatically on create      |
-| `created_at`     | `DateTimeField`    | Auto-set on create               |
-| `updated_at`     | `DateTimeField`    | Auto-set on update               |
-
-**Properties:**
-- `reading_progress` — computed `(current_page / total_pages) * 100`, returns `0.0` when `total_pages` is 0.
-
-**Indexes:** Composite indexes on `(owner, reading_status)`, `(owner, title)`, `(owner, author)`.
-
-## API Endpoints
-
-Base URL: `/api/`
-
-Authentication: SessionAuthentication + BasicAuthentication (DRF defaults).
-
-Permissions: All book endpoints require `IsAuthenticated`. Users can only access their own books.
-
-### Books
-
-| Method   | URL                                | Action        | Serializer         |
-|----------|------------------------------------|---------------|--------------------|
-| `GET`    | `/api/books/`                      | List books    | `BookListSerializer` |
-| `POST`   | `/api/books/`                      | Create book   | `BookDetailSerializer` |
-| `GET`    | `/api/books/{id}/`                 | Retrieve book | `BookDetailSerializer` |
-| `PUT`    | `/api/books/{id}/`                 | Full update   | `BookDetailSerializer` |
-| `PATCH`  | `/api/books/{id}/`                 | Partial update| `BookDetailSerializer` |
-| `DELETE` | `/api/books/{id}/`                 | Delete book   | —                    |
-| `POST`   | `/api/books/{id}/mark_finished/`   | Mark finished | `BookDetailSerializer` |
-| `GET`    | `/api/books/stats/`                | Library stats | — (custom)           |
-
-### Query Parameters (List)
-
-| Parameter        | Type     | Description                                      |
-|------------------|----------|--------------------------------------------------|
-| `page`           | int      | Page number for pagination (20 items/page)       |
-| `sort_by`        | string   | `title`, `-title`, `author`, `-author`, `-created_at`, `-updated_at`, `-reading_progress`, `reading_progress` |
-| `reading_status` | string   | Filter by status value                           |
-| `search`         | string   | Search in title and author fields (icontains)    |
-
-### Stats Response
-
-```json
-{
-  "total_books": 10,
-  "finished": 3,
-  "reading": 4,
-  "not_started": 3
-}
-```
-
-### Mark Finished
-
-`POST /api/books/{id}/mark_finished/` sets `reading_status` to `finished` and `current_page` to `total_pages`.
-
-## Validation Rules
-
-- Title and author cannot be empty or whitespace-only
-- `current_page` cannot exceed `total_pages` (when `total_pages > 0`)
-- Setting `reading_status` to `finished` automatically sets `current_page = total_pages`
-
-## Admin
-
-Books are registered in Django admin with list display, filters by `reading_status` and `genre`, and search by `title`/`author`.

docs/frontend/component-spec.md

@@ -1,82 +0,0 @@
-# Frontend Component Specification — Cloud Reader
-
-## Overview
-
-React 19 + TypeScript SPA using Vite for development and production builds. State managed via React hooks and Context API. Routing via `react-router-dom` v7 with `lazy`/`Suspense` for code splitting.
-
-## Components
-
-### App (root)
-
-- **Path:** `/`
-- **Layout:** Header with logo + `<Routes>` wrapper
-- **Routing:** `/` → `Library`, `*` → redirect to `/`
-- **Code splitting:** `Library` loaded via `React.lazy` + `<Suspense>`
-
-### Library
-
-- **State:** `books[]`, `stats`, `search`, `sortBy`, `statusFilter`, `currentPage`, `view`
-- **Views:** `library` (grid), `detail` (selected book), `add` (modal form)
-- **Sub-components:** `BookCard`, `BookDetail`, `BookForm`
-- **Data flow:** Calls `fetchBooks()` on mount and when filters/page change
-
-### BookCard
-
-- **Props:** `{ book: Book, onClick: (book: Book) => void }`
-- **Display:** Cover image (or first-letter placeholder), title, author, genre badge, reading progress bar with status color
-- **Interaction:** Click/keyboard-accessible (Enter/Space)
-
-### BookDetail
-
-- **Props:** `{ bookId: number, onBack: () => void, onUpdated: () => void }`
-- **Sections:** Cover, metadata (title, author, genre, ISBN), progress bar with page count, action buttons
-- **Actions:** Mark as Finished, Edit Details (switches to BookForm), Delete (with confirmation)
-- **States:** Loading, error, editing mode
-
-### BookForm
-
-- **Props:** `{ initialData?: Book, onSubmit: (data: BookFormData) => Promise<void>, onCancel: () => void }`
-- **Fields:** Title*, Author*, Genre, Description, Cover URL, ISBN, Total Pages, Current Page, Status
-- **Client validation:** Title/author required, page ≤ total pages
-- **Loading state:** Submit button shows "Saving..." when `isLoading`
-
-## Types
-
-```typescript
-interface Book {
-  id: number; title: string; author: string; genre: string;
-  description: string; cover_image_url: string; isbn: string;
-  total_pages: number; current_page: number;
-  reading_status: ReadingStatus; reading_progress: number;
-  owner: string; created_at: string; updated_at: string;
-}
-
-type ReadingStatus = 'not_started' | 'reading' | 'finished' | 'dnf';
-
-interface BookFormData {
-  title: string; author: string; genre: string;
-  description: string; cover_image_url: string; isbn: string;
-  total_pages: number; current_page: number; reading_status: ReadingStatus;
-}
-```
-
-## API Client (`api/books.ts`)
-
-| Function             | HTTP Call                          |
-|----------------------|------------------------------------|
-| `fetchBooks(params)` | `GET /api/books/`                  |
-| `fetchBook(id)`      | `GET /api/books/{id}/`             |
-| `createBook(data)`   | `POST /api/books/`                 |
-| `updateBook(id, data)` | `PATCH /api/books/{id}/`        |
-| `deleteBook(id)`     | `DELETE /api/books/{id}/`          |
-| `markAsFinished(id)` | `POST /api/books/{id}/mark_finished/` |
-| `fetchBookStats()`   | `GET /api/books/stats/`            |
-
-## Styling
-
-Dark theme with CSS custom properties. All styles in `App.css`. Responsive grid layout with breakpoint at 768px.
-
-## Build & Dev
-
-- `yarn workspace frontend dev` — Vite dev server on port 5173 with API proxy to 127.0.0.1:8000
-- `yarn workspace frontend build` — TypeScript check + Vite production build

frontend/.gitignore

@@ -1,24 +0,0 @@
-# Logs
-logs
-*.log
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-pnpm-debug.log*
-lerna-debug.log*
-
-node_modules
-dist
-dist-ssr
-*.local
-
-# Editor directories and files
-.vscode/*
-!.vscode/extensions.json
-.idea
-.DS_Store
-*.suo
-*.ntvs*
-*.njsproj
-*.sln
-*.sw?

frontend/README.md

@@ -1,73 +0,0 @@
-# React + TypeScript + Vite
-
-This template provides a minimal setup to get React working in Vite with HMR and some ESLint rules.
-
-Currently, two official plugins are available:
-
-- [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react) uses [Oxc](https://oxc.rs)
-- [@vitejs/plugin-react-swc](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react-swc) uses [SWC](https://swc.rs/)
-
-## React Compiler
-
-The React Compiler is not enabled on this template because of its impact on dev & build performances. To add it, see [this documentation](https://react.dev/learn/react-compiler/installation).
-
-## Expanding the ESLint configuration
-
-If you are developing a production application, we recommend updating the configuration to enable type-aware lint rules:
-
-```js
-export default defineConfig([
-  globalIgnores(['dist']),
-  {
-    files: ['**/*.{ts,tsx}'],
-    extends: [
-      // Other configs...
-
-      // Remove tseslint.configs.recommended and replace with this
-      tseslint.configs.recommendedTypeChecked,
-      // Alternatively, use this for stricter rules
-      tseslint.configs.strictTypeChecked,
-      // Optionally, add this for stylistic rules
-      tseslint.configs.stylisticTypeChecked,
-
-      // Other configs...
-    ],
-    languageOptions: {
-      parserOptions: {
-        project: ['./tsconfig.node.json', './tsconfig.app.json'],
-        tsconfigRootDir: import.meta.dirname,
-      },
-      // other options...
-    },
-  },
-])
-```
-
-You can also install [eslint-plugin-react-x](https://github.com/Rel1cx/eslint-react/tree/main/packages/plugins/eslint-plugin-react-x) and [eslint-plugin-react-dom](https://github.com/Rel1cx/eslint-react/tree/main/packages/plugins/eslint-plugin-react-dom) for React-specific lint rules:
-
-```js
-// eslint.config.js
-import reactX from 'eslint-plugin-react-x'
-import reactDom from 'eslint-plugin-react-dom'
-
-export default defineConfig([
-  globalIgnores(['dist']),
-  {
-    files: ['**/*.{ts,tsx}'],
-    extends: [
-      // Other configs...
-      // Enable lint rules for React
-      reactX.configs['recommended-typescript'],
-      // Enable lint rules for React DOM
-      reactDom.configs.recommended,
-    ],
-    languageOptions: {
-      parserOptions: {
-        project: ['./tsconfig.node.json', './tsconfig.app.json'],
-        tsconfigRootDir: import.meta.dirname,
-      },
-      // other options...
-    },
-  },
-])
-```

frontend/eslint.config.js

@@ -1,22 +0,0 @@
-import js from '@eslint/js'
-import globals from 'globals'
-import reactHooks from 'eslint-plugin-react-hooks'
-import reactRefresh from 'eslint-plugin-react-refresh'
-import tseslint from 'typescript-eslint'
-import { defineConfig, globalIgnores } from 'eslint/config'
-
-export default defineConfig([
-  globalIgnores(['dist']),
-  {
-    files: ['**/*.{ts,tsx}'],
-    extends: [
-      js.configs.recommended,
-      tseslint.configs.recommended,
-      reactHooks.configs.flat.recommended,
-      reactRefresh.configs.vite,
-    ],
-    languageOptions: {
-      globals: globals.browser,
-    },
-  },
-])

frontend/index.html

@@ -1,10 +1,9 @@
-<!doctype html>
+<!DOCTYPE html>
 <html lang="en">
   <head>
     <meta charset="UTF-8" />
-    <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>frontend</title>
+    <title>Cloud Reader</title>
   </head>
   <body>
     <div id="root"></div>

frontend/package.json

@@ -1,32 +1,30 @@
 {
-  "name": "frontend",
+  "name": "@cloud-reader/frontend",
+  "version": "1.0.0",
   "private": true,
-  "version": "0.0.0",
   "type": "module",
   "scripts": {
     "dev": "vite",
     "build": "tsc -b && vite build",
-    "lint": "eslint .",
+    "preview": "vite preview",
-    "preview": "vite preview"
+    "test": "vitest run",
+    "lint": "eslint ."
   },
   "dependencies": {
-    "axios": "^1.16.1",
+    "react": "^19.0.0",
-    "react": "^19.2.6",
+    "react-dom": "^19.0.0",
-    "react-dom": "^19.2.6",
+    "react-router-dom": "^7.1.0",
-    "react-router-dom": "^7.15.1"
+    "axios": "^1.7.9"
   },
   "devDependencies": {
-    "@eslint/js": "^10.0.1",
+    "@types/react": "^19.0.0",
-    "@types/node": "^24.12.3",
+    "@types/react-dom": "^19.0.0",
-    "@types/react": "^19.2.14",
+    "@vitejs/plugin-react": "^4.3.4",
-    "@types/react-dom": "^19.2.3",
+    "typescript": "~5.7.0",
-    "@vitejs/plugin-react": "^6.0.1",
+    "vite": "^6.0.0",
-    "eslint": "^10.3.0",
+    "vitest": "^2.1.0",
-    "eslint-plugin-react-hooks": "^7.1.1",
+    "@testing-library/react": "^16.2.0",
-    "eslint-plugin-react-refresh": "^0.5.2",
+    "@testing-library/jest-dom": "^6.6.3",
-    "globals": "^17.6.0",
+    "jsdom": "^25.0.0"
-    "typescript": "~6.0.2",
-    "typescript-eslint": "^8.59.2",
-    "vite": "^8.0.12"
   }
 }

frontend/public/icons.svg

@@ -1,24 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg">
-  <symbol id="bluesky-icon" viewBox="0 0 16 17">
-    <g clip-path="url(#bluesky-clip)"><path fill="#08060d" d="M7.75 7.735c-.693-1.348-2.58-3.86-4.334-5.097-1.68-1.187-2.32-.981-2.74-.79C.188 2.065.1 2.812.1 3.251s.241 3.602.398 4.13c.52 1.744 2.367 2.333 4.07 2.145-2.495.37-4.71 1.278-1.805 4.512 3.196 3.309 4.38-.71 4.987-2.746.608 2.036 1.307 5.91 4.93 2.746 2.72-2.746.747-4.143-1.747-4.512 1.702.189 3.55-.4 4.07-2.145.156-.528.397-3.691.397-4.13s-.088-1.186-.575-1.406c-.42-.19-1.06-.395-2.741.79-1.755 1.24-3.64 3.752-4.334 5.099"/></g>
-    <defs><clipPath id="bluesky-clip"><path fill="#fff" d="M.1.85h15.3v15.3H.1z"/></clipPath></defs>
-  </symbol>
-  <symbol id="discord-icon" viewBox="0 0 20 19">
-    <path fill="#08060d" d="M16.224 3.768a14.5 14.5 0 0 0-3.67-1.153c-.158.286-.343.67-.47.976a13.5 13.5 0 0 0-4.067 0c-.128-.306-.317-.69-.476-.976A14.4 14.4 0 0 0 3.868 3.77C1.546 7.28.916 10.703 1.231 14.077a14.7 14.7 0 0 0 4.5 2.306q.545-.748.965-1.587a9.5 9.5 0 0 1-1.518-.74q.191-.14.372-.293c2.927 1.369 6.107 1.369 8.999 0q.183.152.372.294-.723.437-1.52.74.418.838.963 1.588a14.6 14.6 0 0 0 4.504-2.308c.37-3.911-.63-7.302-2.644-10.309m-9.13 8.234c-.878 0-1.599-.82-1.599-1.82 0-.998.705-1.82 1.6-1.82.894 0 1.614.82 1.599 1.82.001 1-.705 1.82-1.6 1.82m5.91 0c-.878 0-1.599-.82-1.599-1.82 0-.998.705-1.82 1.6-1.82.893 0 1.614.82 1.599 1.82 0 1-.706 1.82-1.6 1.82"/>
-  </symbol>
-  <symbol id="documentation-icon" viewBox="0 0 21 20">
-    <path fill="none" stroke="#aa3bff" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.35" d="m15.5 13.333 1.533 1.322c.645.555.967.833.967 1.178s-.322.623-.967 1.179L15.5 18.333m-3.333-5-1.534 1.322c-.644.555-.966.833-.966 1.178s.322.623.966 1.179l1.534 1.321"/>
-    <path fill="none" stroke="#aa3bff" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.35" d="M17.167 10.836v-4.32c0-1.41 0-2.117-.224-2.68-.359-.906-1.118-1.621-2.08-1.96-.599-.21-1.349-.21-2.848-.21-2.623 0-3.935 0-4.983.369-1.684.591-3.013 1.842-3.641 3.428C3 6.449 3 7.684 3 10.154v2.122c0 2.558 0 3.838.706 4.726q.306.383.713.671c.76.536 1.79.64 3.581.66"/>
-    <path fill="none" stroke="#aa3bff" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.35" d="M3 10a2.78 2.78 0 0 1 2.778-2.778c.555 0 1.209.097 1.748-.047.48-.129.854-.503.982-.982.145-.54.048-1.194.048-1.749a2.78 2.78 0 0 1 2.777-2.777"/>
-  </symbol>
-  <symbol id="github-icon" viewBox="0 0 19 19">
-    <path fill="#08060d" fill-rule="evenodd" d="M9.356 1.85C5.05 1.85 1.57 5.356 1.57 9.694a7.84 7.84 0 0 0 5.324 7.44c.387.079.528-.168.528-.376 0-.182-.013-.805-.013-1.454-2.165.467-2.616-.935-2.616-.935-.349-.91-.864-1.143-.864-1.143-.71-.48.051-.48.051-.48.787.051 1.2.805 1.2.805.695 1.194 1.817.857 2.268.649.064-.507.27-.857.49-1.052-1.728-.182-3.545-.857-3.545-3.87 0-.857.31-1.558.8-2.104-.078-.195-.349-1 .077-2.078 0 0 .657-.208 2.14.805a7.5 7.5 0 0 1 1.946-.26c.657 0 1.328.092 1.946.26 1.483-1.013 2.14-.805 2.14-.805.426 1.078.155 1.883.078 2.078.502.546.799 1.247.799 2.104 0 3.013-1.818 3.675-3.558 3.87.284.247.528.714.528 1.454 0 1.052-.012 1.896-.012 2.156 0 .208.142.455.528.377a7.84 7.84 0 0 0 5.324-7.441c.013-4.338-3.48-7.844-7.773-7.844" clip-rule="evenodd"/>
-  </symbol>
-  <symbol id="social-icon" viewBox="0 0 20 20">
-    <path fill="none" stroke="#aa3bff" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.35" d="M12.5 6.667a4.167 4.167 0 1 0-8.334 0 4.167 4.167 0 0 0 8.334 0"/>
-    <path fill="none" stroke="#aa3bff" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.35" d="M2.5 16.667a5.833 5.833 0 0 1 8.75-5.053m3.837.474.513 1.035c.07.144.257.282.414.309l.93.155c.596.1.736.536.307.965l-.723.73a.64.64 0 0 0-.152.531l.207.903c.164.715-.213.991-.84.618l-.872-.52a.63.63 0 0 0-.577 0l-.872.52c-.624.373-1.003.094-.84-.618l.207-.903a.64.64 0 0 0-.152-.532l-.723-.729c-.426-.43-.289-.864.306-.964l.93-.156a.64.64 0 0 0 .412-.31l.513-1.034c.28-.562.735-.562 1.012 0"/>
-  </symbol>
-  <symbol id="x-icon" viewBox="0 0 19 19">
-    <path fill="#08060d" fill-rule="evenodd" d="M1.893 1.98c.052.072 1.245 1.769 2.653 3.77l2.892 4.114c.183.261.333.48.333.486s-.068.089-.152.183l-.522.593-.765.867-3.597 4.087c-.375.426-.734.834-.798.905a1 1 0 0 0-.118.148c0 .01.236.017.664.017h.663l.729-.83c.4-.457.796-.906.879-.999a692 692 0 0 0 1.794-2.038c.034-.037.301-.34.594-.675l.551-.624.345-.392a7 7 0 0 1 .34-.374c.006 0 .93 1.306 2.052 2.903l2.084 2.965.045.063h2.275c1.87 0 2.273-.003 2.266-.021-.008-.02-1.098-1.572-3.894-5.547-2.013-2.862-2.28-3.246-2.273-3.266.008-.019.282-.332 2.085-2.38l2-2.274 1.567-1.782c.022-.028-.016-.03-.65-.03h-.674l-.3.342a871 871 0 0 1-1.782 2.025c-.067.075-.405.458-.75.852a100 100 0 0 1-.803.91c-.148.172-.299.344-.99 1.127-.304.343-.32.358-.345.327-.015-.019-.904-1.282-1.976-2.808L6.365 1.85H1.8zm1.782.91 8.078 11.294c.772 1.08 1.413 1.973 1.425 1.984.016.017.241.02 1.05.017l1.03-.004-2.694-3.766L7.796 5.75 5.722 2.852l-1.039-.004-1.039-.004z" clip-rule="evenodd"/>
-  </symbol>
-</svg>

frontend/src/App.css

@@ -1,577 +0,0 @@
-/* === Reset & Base === */
-*,
-*::before,
-*::after {
-  box-sizing: border-box;
-  margin: 0;
-  padding: 0;
-}
-
-:root {
-  --color-bg: #0f1117;
-  --color-surface: #1a1d27;
-  --color-surface-hover: #242736;
-  --color-border: #2a2d3a;
-  --color-text: #e1e3ea;
-  --color-text-muted: #8b8fa3;
-  --color-primary: #6366f1;
-  --color-primary-hover: #4f46e5;
-  --color-success: #22c55e;
-  --color-danger: #ef4444;
-  --color-danger-hover: #dc2626;
-  --color-secondary: #374151;
-  --color-secondary-hover: #4b5563;
-  --radius: 8px;
-  --radius-lg: 12px;
-}
-
-body {
-  font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
-  background-color: var(--color-bg);
-  color: var(--color-text);
-  line-height: 1.6;
-  -webkit-font-smoothing: antialiased;
-}
-
-/* === App Layout === */
-.app {
-  min-height: 100vh;
-  display: flex;
-  flex-direction: column;
-}
-
-.app-header {
-  background-color: var(--color-surface);
-  border-bottom: 1px solid var(--color-border);
-  padding: 0 24px;
-  position: sticky;
-  top: 0;
-  z-index: 100;
-}
-
-.app-header-inner {
-  max-width: 1200px;
-  margin: 0 auto;
-  height: 56px;
-  display: flex;
-  align-items: center;
-}
-
-.app-logo {
-  display: flex;
-  align-items: center;
-  gap: 8px;
-  text-decoration: none;
-  color: var(--color-text);
-  font-weight: 700;
-  font-size: 1.125rem;
-}
-
-.logo-icon {
-  font-size: 1.5rem;
-}
-
-.app-main {
-  flex: 1;
-  max-width: 1200px;
-  width: 100%;
-  margin: 0 auto;
-  padding: 24px;
-}
-
-/* === Library === */
-.library-header {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  margin-bottom: 20px;
-}
-
-.library-header h1 {
-  font-size: 1.75rem;
-  font-weight: 700;
-}
-
-/* === Stats === */
-.library-stats {
-  display: grid;
-  grid-template-columns: repeat(auto-fit, minmax(120px, 1fr));
-  gap: 12px;
-  margin-bottom: 24px;
-}
-
-.stat-card {
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
-  border-radius: var(--radius);
-  padding: 16px;
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-  gap: 4px;
-}
-
-.stat-value {
-  font-size: 1.5rem;
-  font-weight: 700;
-}
-
-.stat-label {
-  font-size: 0.8rem;
-  color: var(--color-text-muted);
-  text-transform: uppercase;
-  letter-spacing: 0.05em;
-}
-
-/* === Controls === */
-.library-controls {
-  display: flex;
-  gap: 12px;
-  margin-bottom: 20px;
-  flex-wrap: wrap;
-}
-
-.search-input {
-  flex: 1;
-  min-width: 200px;
-  padding: 10px 14px;
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
-  border-radius: var(--radius);
-  color: var(--color-text);
-  font-size: 0.9rem;
-}
-
-.search-input:focus {
-  outline: none;
-  border-color: var(--color-primary);
-}
-
-.sort-select,
-.filter-select {
-  padding: 10px 14px;
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
-  border-radius: var(--radius);
-  color: var(--color-text);
-  font-size: 0.9rem;
-  cursor: pointer;
-}
-
-/* === Books Grid === */
-.books-grid {
-  display: grid;
-  grid-template-columns: repeat(auto-fill, minmax(300px, 1fr));
-  gap: 16px;
-}
-
-.book-card {
-  display: flex;
-  gap: 16px;
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
-  border-radius: var(--radius-lg);
-  padding: 16px;
-  cursor: pointer;
-  transition: background-color 0.15s, border-color 0.15s, transform 0.15s;
-}
-
-.book-card:hover {
-  background: var(--color-surface-hover);
-  border-color: var(--color-primary);
-  transform: translateY(-2px);
-}
-
-.book-card-cover {
-  flex-shrink: 0;
-  width: 80px;
-  height: 120px;
-  border-radius: 6px;
-  overflow: hidden;
-}
-
-.book-card-cover img {
-  width: 100%;
-  height: 100%;
-  object-fit: cover;
-}
-
-.book-card-placeholder {
-  width: 100%;
-  height: 100%;
-  background: linear-gradient(135deg, var(--color-primary), #8b5cf6);
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  font-size: 1.75rem;
-  font-weight: 700;
-  color: white;
-}
-
-.book-card-placeholder.large {
-  width: 180px;
-  height: 260px;
-  font-size: 3rem;
-}
-
-.book-card-info {
-  flex: 1;
-  min-width: 0;
-  display: flex;
-  flex-direction: column;
-  gap: 4px;
-}
-
-.book-card-title {
-  font-size: 1rem;
-  font-weight: 600;
-  line-height: 1.3;
-  display: -webkit-box;
-  -webkit-line-clamp: 2;
-  -webkit-box-orient: vertical;
-  overflow: hidden;
-}
-
-.book-card-author {
-  font-size: 0.85rem;
-  color: var(--color-text-muted);
-}
-
-.book-card-genre {
-  display: inline-block;
-  font-size: 0.75rem;
-  padding: 2px 8px;
-  background: rgba(99, 102, 241, 0.15);
-  color: var(--color-primary);
-  border-radius: 12px;
-  align-self: flex-start;
-}
-
-.book-card-progress {
-  margin-top: auto;
-}
-
-/* === Progress Bar === */
-.progress-bar {
-  width: 100%;
-  height: 6px;
-  background: var(--color-border);
-  border-radius: 3px;
-  overflow: hidden;
-}
-
-.progress-bar.large {
-  height: 10px;
-  border-radius: 5px;
-}
-
-.progress-fill {
-  height: 100%;
-  border-radius: 3px;
-  transition: width 0.3s ease;
-}
-
-.progress-text {
-  display: flex;
-  justify-content: space-between;
-  font-size: 0.75rem;
-  color: var(--color-text-muted);
-  margin-top: 4px;
-}
-
-/* === Buttons === */
-.btn {
-  display: inline-flex;
-  align-items: center;
-  gap: 6px;
-  padding: 8px 16px;
-  border: none;
-  border-radius: var(--radius);
-  font-size: 0.875rem;
-  font-weight: 500;
-  cursor: pointer;
-  transition: background-color 0.15s;
-}
-
-.btn:disabled {
-  opacity: 0.5;
-  cursor: not-allowed;
-}
-
-.btn-primary {
-  background: var(--color-primary);
-  color: white;
-}
-
-.btn-primary:hover:not(:disabled) {
-  background: var(--color-primary-hover);
-}
-
-.btn-secondary {
-  background: var(--color-secondary);
-  color: var(--color-text);
-}
-
-.btn-secondary:hover:not(:disabled) {
-  background: var(--color-secondary-hover);
-}
-
-.btn-success {
-  background: var(--color-success);
-  color: white;
-}
-
-.btn-success:hover:not(:disabled) {
-  background: #16a34a;
-}
-
-.btn-danger {
-  background: var(--color-danger);
-  color: white;
-}
-
-.btn-danger:hover:not(:disabled) {
-  background: var(--color-danger-hover);
-}
-
-/* === Book Detail === */
-.book-detail {
-  max-width: 800px;
-}
-
-.book-detail > .btn {
-  margin-bottom: 24px;
-}
-
-.book-detail-header {
-  display: flex;
-  gap: 32px;
-  margin-bottom: 32px;
-}
-
-.book-detail-cover {
-  flex-shrink: 0;
-  width: 180px;
-  height: 260px;
-  border-radius: var(--radius-lg);
-  overflow: hidden;
-}
-
-.book-detail-cover img {
-  width: 100%;
-  height: 100%;
-  object-fit: cover;
-}
-
-.book-detail-meta {
-  flex: 1;
-}
-
-.book-detail-meta h1 {
-  font-size: 1.75rem;
-  font-weight: 700;
-  margin-bottom: 4px;
-}
-
-.book-detail-author {
-  font-size: 1.1rem;
-  color: var(--color-text-muted);
-  margin-bottom: 12px;
-}
-
-.book-detail-isbn {
-  font-size: 0.85rem;
-  color: var(--color-text-muted);
-  margin-top: 8px;
-}
-
-.book-detail-progress {
-  margin: 20px 0;
-}
-
-.book-detail-progress .progress-text {
-  display: flex;
-  gap: 16px;
-  font-size: 0.85rem;
-}
-
-.book-detail-actions {
-  display: flex;
-  gap: 10px;
-  flex-wrap: wrap;
-}
-
-.book-detail-description {
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
-  border-radius: var(--radius-lg);
-  padding: 24px;
-}
-
-.book-detail-description h3 {
-  font-size: 1.1rem;
-  margin-bottom: 12px;
-}
-
-.book-detail-description p {
-  color: var(--color-text-muted);
-  line-height: 1.7;
-}
-
-/* === Form === */
-.book-form {
-  display: flex;
-  flex-direction: column;
-  gap: 16px;
-}
-
-.form-error {
-  background: rgba(239, 68, 68, 0.1);
-  border: 1px solid var(--color-danger);
-  color: var(--color-danger);
-  padding: 10px 14px;
-  border-radius: var(--radius);
-  font-size: 0.875rem;
-}
-
-.form-group {
-  display: flex;
-  flex-direction: column;
-  gap: 6px;
-}
-
-.form-group label {
-  font-size: 0.85rem;
-  font-weight: 500;
-  color: var(--color-text-muted);
-}
-
-.form-group input,
-.form-group textarea,
-.form-group select {
-  padding: 10px 14px;
-  background: var(--color-bg);
-  border: 1px solid var(--color-border);
-  border-radius: var(--radius);
-  color: var(--color-text);
-  font-size: 0.9rem;
-  font-family: inherit;
-}
-
-.form-group input:focus,
-.form-group textarea:focus,
-.form-group select:focus {
-  outline: none;
-  border-color: var(--color-primary);
-}
-
-.form-group textarea {
-  resize: vertical;
-  min-height: 80px;
-}
-
-.form-row {
-  display: grid;
-  grid-template-columns: repeat(auto-fit, minmax(150px, 1fr));
-  gap: 16px;
-}
-
-.form-actions {
-  display: flex;
-  gap: 10px;
-  margin-top: 8px;
-}
-
-/* === Modal === */
-.modal-overlay {
-  position: fixed;
-  inset: 0;
-  background: rgba(0, 0, 0, 0.6);
-  display: flex;
-  align-items: flex-start;
-  justify-content: center;
-  padding-top: 80px;
-  z-index: 200;
-}
-
-.modal-content {
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
-  border-radius: var(--radius-lg);
-  padding: 32px;
-  width: 100%;
-  max-width: 560px;
-  max-height: 80vh;
-  overflow-y: auto;
-}
-
-.modal-content h2 {
-  margin-bottom: 20px;
-}
-
-/* === Pagination === */
-.pagination {
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  gap: 16px;
-  margin-top: 32px;
-}
-
-.page-info {
-  font-size: 0.875rem;
-  color: var(--color-text-muted);
-}
-
-/* === States === */
-.loading-spinner {
-  text-align: center;
-  padding: 48px;
-  color: var(--color-text-muted);
-  font-size: 1rem;
-}
-
-.empty-state {
-  text-align: center;
-  padding: 64px 24px;
-  color: var(--color-text-muted);
-}
-
-.empty-state p {
-  margin-bottom: 8px;
-}
-
-.error-message {
-  text-align: center;
-  padding: 32px;
-  color: var(--color-danger);
-}
-
-/* === Responsive === */
-@media (max-width: 768px) {
-  .books-grid {
-    grid-template-columns: 1fr;
-  }
-
-  .book-detail-header {
-    flex-direction: column;
-    align-items: center;
-    text-align: center;
-  }
-
-  .book-detail-actions {
-    justify-content: center;
-  }
-
-  .library-controls {
-    flex-direction: column;
-  }
-
-  .library-stats {
-    grid-template-columns: repeat(2, 1fr);
-  }
-
-  .form-row {
-    grid-template-columns: 1fr;
-  }
-}

frontend/src/App.tsx

@@ -1,32 +0,0 @@
-import { lazy, Suspense } from 'react';
-import { BrowserRouter, Routes, Route, Navigate } from 'react-router-dom';
-import './App.css';
-
-const Library = lazy(() => import('./components/Library').then((m) => ({ default: m.Library })));
-
-function App() {
-  return (
-    <BrowserRouter>
-      <div className="app">
-        <header className="app-header">
-          <div className="app-header-inner">
-            <a href="/" className="app-logo" onClick={(e) => { e.preventDefault(); window.location.href = '/'; }}>
-              <span className="logo-icon">📚</span>
-              <span className="logo-text">Cloud Reader</span>
-            </a>
-          </div>
-        </header>
-        <main className="app-main">
-          <Suspense fallback={<div className="loading-spinner">Loading...</div>}>
-            <Routes>
-              <Route path="/" element={<Library />} />
-              <Route path="*" element={<Navigate to="/" replace />} />
-            </Routes>
-          </Suspense>
-        </main>
-      </div>
-    </BrowserRouter>
-  );
-}
-
-export default App;

frontend/src/api/annotations.ts

@@ -0,0 +1,96 @@
+import api from "@/api/client";
+import type {
+  Bookmark,
+  CreateBookmarkPayload,
+  Note,
+  CreateNotePayload,
+  UpdateNotePayload,
+  PaginatedResponse,
+} from "@/types";
+
+/** Fetch bookmarks for the current user, optionally filtered by book */
+export async function fetchBookmarks(
+  bookId?: string
+): Promise<PaginatedResponse<Bookmark>> {
+  const params: Record<string, string> = {};
+  if (bookId) params.book = bookId;
+  const { data } = await api.get<PaginatedResponse<Bookmark>>(
+    "/annotations/bookmarks/",
+    { params }
+  );
+  return data;
+}
+
+/** Create a new bookmark */
+export async function createBookmark(
+  payload: CreateBookmarkPayload
+): Promise<Bookmark> {
+  const { data } = await api.post<Bookmark>(
+    "/annotations/bookmarks/",
+    payload
+  );
+  return data;
+}
+
+/** Delete a bookmark by id */
+export async function deleteBookmark(id: string): Promise<void> {
+  await api.delete(`/annotations/bookmarks/${id}/`);
+}
+
+/** Batch delete bookmarks */
+export async function batchDeleteBookmarks(
+  ids: string[]
+): Promise<{ deleted: number }> {
+  const { data } = await api.delete<{ deleted: number }>(
+    "/annotations/bookmarks/batch-delete/",
+    { data: { ids } }
+  );
+  return data;
+}
+
+/** Fetch notes for the current user, optionally filtered by book */
+export async function fetchNotes(
+  bookId?: string
+): Promise<PaginatedResponse<Note>> {
+  const params: Record<string, string> = {};
+  if (bookId) params.book = bookId;
+  const { data } = await api.get<PaginatedResponse<Note>>(
+    "/annotations/notes/",
+    { params }
+  );
+  return data;
+}
+
+/** Create a new note */
+export async function createNote(payload: CreateNotePayload): Promise<Note> {
+  const { data } = await api.post<Note>("/annotations/notes/", payload);
+  return data;
+}
+
+/** Update a note's content */
+export async function updateNote(
+  id: string,
+  payload: UpdateNotePayload
+): Promise<Note> {
+  const { data } = await api.patch<Note>(
+    `/annotations/notes/${id}/`,
+    payload
+  );
+  return data;
+}
+
+/** Delete a note by id */
+export async function deleteNote(id: string): Promise<void> {
+  await api.delete(`/annotations/notes/${id}/`);
+}
+
+/** Batch delete notes */
+export async function batchDeleteNotes(
+  ids: string[]
+): Promise<{ deleted: number }> {
+  const { data } = await api.delete<{ deleted: number }>(
+    "/annotations/notes/batch-delete/",
+    { data: { ids } }
+  );
+  return data;
+}

frontend/src/api/books.ts

@@ -1,90 +0,0 @@
-import axios from 'axios';
-import type { Book, BookFormData, BookListResponse, BookStats } from '../types';
-
-const api = axios.create({
-  baseURL: '/api',
-  headers: {
-    'Content-Type': 'application/json',
-  },
-  withCredentials: true,
-});
-
-api.interceptors.response.use(
-  (response) => response,
-  (error) => {
-    if (error.response?.status === 403) {
-      window.location.href = '/login';
-    }
-    return Promise.reject(error);
-  },
-);
-
-export async function fetchBooks(params?: {
-  page?: number;
-  sort_by?: string;
-  reading_status?: string;
-  search?: string;
-}): Promise<BookListResponse> {
-  const response = await api.get<BookListResponse>('/books/', { params });
-  return response.data;
-}
-
-export async function fetchBook(id: number): Promise<Book> {
-  const response = await api.get<Book>(`/books/${id}/`);
-  return response.data;
-}
-
-export async function createBook(data: BookFormData): Promise<Book> {
-  const response = await api.post<Book>('/books/', data);
-  return response.data;
-}
-
-export async function updateBook(id: number, data: Partial<BookFormData>): Promise<Book> {
-  const response = await api.patch<Book>(`/books/${id}/`, data);
-  return response.data;
-}
-
-export async function deleteBook(id: number): Promise<void> {
-  await api.delete(`/books/${id}/`);
-}
-
-export async function markBookAsFinished(id: number): Promise<Book> {
-  const response = await api.post<Book>(`/books/${id}/mark_finished/`);
-  return response.data;
-}
-
-export async function fetchBookStats(): Promise<BookStats> {
-  const response = await api.get<BookStats>('/books/stats/');
-  return response.data;
-}
-
-export async function login(username: string, password: string): Promise<void> {
-  // Get CSRF token from any existing session
-  const csrfToken = extractCsrfToken();
-  if (!csrfToken) {
-    // Make a light request to set the CSRF cookie
-    await fetch('/api/books/', { credentials: 'include' });
-  }
-  const token = extractCsrfToken();
-
-  const resp = await fetch('/api-auth/login/', {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/x-www-form-urlencoded',
-      'X-CSRFToken': token,
-    },
-    body: new URLSearchParams({ username, password }),
-    credentials: 'include',
-  });
-
-  if (!resp.ok) {
-    throw new Error('Login failed');
-  }
-}
-
-function extractCsrfToken(): string {
-  const match = document.cookie.match(/csrftoken=([\w-]+)/);
-  return match ? match[1] : '';
-}
-
-export default api;

frontend/src/api/client.ts

@@ -0,0 +1,67 @@
+import axios from "axios";
+
+const api = axios.create({
+  baseURL: "/api",
+  headers: {
+    "Content-Type": "application/json",
+  },
+});
+
+// Attach JWT token to every request
+api.interceptors.request.use((config) => {
+  const token = localStorage.getItem("access_token");
+  if (token) {
+    config.headers.Authorization = `Bearer ${token}`;
+  }
+  return config;
+});
+
+// Attempt token refresh on 401
+let isRefreshing = false;
+let pendingRequests: Array<(token: string) => void> = [];
+
+api.interceptors.response.use(
+  (response) => response,
+  async (error) => {
+    const originalRequest = error.config;
+    if (error.response?.status !== 401 || originalRequest._retry) {
+      return Promise.reject(error);
+    }
+
+    if (isRefreshing) {
+      return new Promise((resolve) => {
+        pendingRequests.push((token: string) => {
+          originalRequest.headers.Authorization = `Bearer ${token}`;
+          resolve(api(originalRequest));
+        });
+      });
+    }
+
+    originalRequest._retry = true;
+    isRefreshing = true;
+
+    try {
+      const refreshToken = localStorage.getItem("refresh_token");
+      if (!refreshToken) {
+        throw new Error("No refresh token");
+      }
+      const { data } = await axios.post("/api/auth/token/refresh/", {
+        refresh: refreshToken,
+      });
+      localStorage.setItem("access_token", data.access);
+      pendingRequests.forEach((cb) => cb(data.access));
+      pendingRequests = [];
+      originalRequest.headers.Authorization = `Bearer ${data.access}`;
+      return api(originalRequest);
+    } catch {
+      localStorage.removeItem("access_token");
+      localStorage.removeItem("refresh_token");
+      window.location.href = "/login";
+      return Promise.reject(error);
+    } finally {
+      isRefreshing = false;
+    }
+  }
+);
+
+export default api;

frontend/src/assets/react.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" class="iconify iconify--logos" width="35.93" height="32" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 228"><path fill="#00D8FF" d="M210.483 73.824a171.49 171.49 0 0 0-8.24-2.597c.465-1.9.893-3.777 1.273-5.621c6.238-30.281 2.16-54.676-11.769-62.708c-13.355-7.7-35.196.329-57.254 19.526a171.23 171.23 0 0 0-6.375 5.848a155.866 155.866 0 0 0-4.241-3.917C100.759 3.829 77.587-4.822 63.673 3.233C50.33 10.957 46.379 33.89 51.995 62.588a170.974 170.974 0 0 0 1.892 8.48c-3.28.932-6.445 1.924-9.474 2.98C17.309 83.498 0 98.307 0 113.668c0 15.865 18.582 31.778 46.812 41.427a145.52 145.52 0 0 0 6.921 2.165a167.467 167.467 0 0 0-2.01 9.138c-5.354 28.2-1.173 50.591 12.134 58.266c13.744 7.926 36.812-.22 59.273-19.855a145.567 145.567 0 0 0 5.342-4.923a168.064 168.064 0 0 0 6.92 6.314c21.758 18.722 43.246 26.282 56.54 18.586c13.731-7.949 18.194-32.003 12.4-61.268a145.016 145.016 0 0 0-1.535-6.842c1.62-.48 3.21-.974 4.76-1.488c29.348-9.723 48.443-25.443 48.443-41.52c0-15.417-17.868-30.326-45.517-39.844Zm-6.365 70.984c-1.4.463-2.836.91-4.3 1.345c-3.24-10.257-7.612-21.163-12.963-32.432c5.106-11 9.31-21.767 12.459-31.957c2.619.758 5.16 1.557 7.61 2.4c23.69 8.156 38.14 20.213 38.14 29.504c0 9.896-15.606 22.743-40.946 31.14Zm-10.514 20.834c2.562 12.94 2.927 24.64 1.23 33.787c-1.524 8.219-4.59 13.698-8.382 15.893c-8.067 4.67-25.32-1.4-43.927-17.412a156.726 156.726 0 0 1-6.437-5.87c7.214-7.889 14.423-17.06 21.459-27.246c12.376-1.098 24.068-2.894 34.671-5.345a134.17 134.17 0 0 1 1.386 6.193ZM87.276 214.515c-7.882 2.783-14.16 2.863-17.955.675c-8.075-4.657-11.432-22.636-6.853-46.752a156.923 156.923 0 0 1 1.869-8.499c10.486 2.32 22.093 3.988 34.498 4.994c7.084 9.967 14.501 19.128 21.976 27.15a134.668 134.668 0 0 1-4.877 4.492c-9.933 8.682-19.886 14.842-28.658 17.94ZM50.35 144.747c-12.483-4.267-22.792-9.812-29.858-15.863c-6.35-5.437-9.555-10.836-9.555-15.216c0-9.322 13.897-21.212 37.076-29.293c2.813-.98 5.757-1.905 8.812-2.773c3.204 10.42 7.406 21.315 12.477 32.332c-5.137 11.18-9.399 22.249-12.634 32.792a134.718 134.718 0 0 1-6.318-1.979Zm12.378-84.26c-4.811-24.587-1.616-43.134 6.425-47.789c8.564-4.958 27.502 2.111 47.463 19.835a144.318 144.318 0 0 1 3.841 3.545c-7.438 7.987-14.787 17.08-21.808 26.988c-12.04 1.116-23.565 2.908-34.161 5.309a160.342 160.342 0 0 1-1.76-7.887Zm110.427 27.268a347.8 347.8 0 0 0-7.785-12.803c8.168 1.033 15.994 2.404 23.343 4.08c-2.206 7.072-4.956 14.465-8.193 22.045a381.151 381.151 0 0 0-7.365-13.322Zm-45.032-43.861c5.044 5.465 10.096 11.566 15.065 18.186a322.04 322.04 0 0 0-30.257-.006c4.974-6.559 10.069-12.652 15.192-18.18ZM82.802 87.83a323.167 323.167 0 0 0-7.227 13.238c-3.184-7.553-5.909-14.98-8.134-22.152c7.304-1.634 15.093-2.97 23.209-3.984a321.524 321.524 0 0 0-7.848 12.897Zm8.081 65.352c-8.385-.936-16.291-2.203-23.593-3.793c2.26-7.3 5.045-14.885 8.298-22.6a321.187 321.187 0 0 0 7.257 13.246c2.594 4.48 5.28 8.868 8.038 13.147Zm37.542 31.03c-5.184-5.592-10.354-11.779-15.403-18.433c4.902.192 9.899.29 14.978.29c5.218 0 10.376-.117 15.453-.343c-4.985 6.774-10.018 12.97-15.028 18.486Zm52.198-57.817c3.422 7.8 6.306 15.345 8.596 22.52c-7.422 1.694-15.436 3.058-23.88 4.071a382.417 382.417 0 0 0 7.859-13.026a347.403 347.403 0 0 0 7.425-13.565Zm-16.898 8.101a358.557 358.557 0 0 1-12.281 19.815a329.4 329.4 0 0 1-23.444.823c-7.967 0-15.716-.248-23.178-.732a310.202 310.202 0 0 1-12.513-19.846h.001a307.41 307.41 0 0 1-10.923-20.627a310.278 310.278 0 0 1 10.89-20.637l-.001.001a307.318 307.318 0 0 1 12.413-19.761c7.613-.576 15.42-.876 23.31-.876H128c7.926 0 15.743.303 23.354.883a329.357 329.357 0 0 1 12.335 19.695a358.489 358.489 0 0 1 11.036 20.54a329.472 329.472 0 0 1-11 20.722Zm22.56-122.124c8.572 4.944 11.906 24.881 6.52 51.026c-.344 1.668-.73 3.367-1.15 5.09c-10.622-2.452-22.155-4.275-34.23-5.408c-7.034-10.017-14.323-19.124-21.64-27.008a160.789 160.789 0 0 1 5.888-5.4c18.9-16.447 36.564-22.941 44.612-18.3ZM128 90.808c12.625 0 22.86 10.235 22.86 22.86s-10.235 22.86-22.86 22.86s-22.86-10.235-22.86-22.86s10.235-22.86 22.86-22.86Z"></path></svg>

frontend/src/components/BookCard.tsx

@@ -1,54 +0,0 @@
-import type { Book } from '../types';
-import { READING_STATUS_LABELS, READING_STATUS_COLORS } from '../types';
-
-interface BookCardProps {
-  book: Book;
-  onClick: (book: Book) => void;
-}
-
-export function BookCard({ book, onClick }: BookCardProps) {
-  const progress = book.reading_progress;
-  const statusColor = READING_STATUS_COLORS[book.reading_status];
-
-  return (
-    <article
-      className="book-card"
-      onClick={() => onClick(book)}
-      role="button"
-      tabIndex={0}
-      onKeyDown={(e: React.KeyboardEvent) => {
-        if (e.key === 'Enter' || e.key === ' ') {
-          e.preventDefault();
-          onClick(book);
-        }
-      }}
-    >
-      <div className="book-card-cover">
-        {book.cover_image_url ? (
-          <img src={book.cover_image_url} alt={`Cover of ${book.title}`} loading="lazy" />
-        ) : (
-          <div className="book-card-placeholder">
-            <span>{book.title.charAt(0)}</span>
-          </div>
-        )}
-      </div>
-      <div className="book-card-info">
-        <h3 className="book-card-title">{book.title}</h3>
-        <p className="book-card-author">{book.author}</p>
-        {book.genre && <span className="book-card-genre">{book.genre}</span>}
-        <div className="book-card-progress">
-          <div className="progress-bar">
-            <div
-              className="progress-fill"
-              style={{ width: `${Math.min(progress, 100)}%`, backgroundColor: statusColor }}
-            />
-          </div>
-          <div className="progress-text">
-            <span style={{ color: statusColor }}>{READING_STATUS_LABELS[book.reading_status]}</span>
-            <span>{progress}%</span>
-          </div>
-        </div>
-      </div>
-    </article>
-  );
-}

frontend/src/components/BookDetail.tsx

@@ -1,151 +0,0 @@
-import { useState, useEffect, useCallback } from 'react';
-import type { Book, BookFormData } from '../types';
-import { READING_STATUS_LABELS, READING_STATUS_COLORS } from '../types';
-import { fetchBook, updateBook, markBookAsFinished, deleteBook } from '../api/books';
-import { BookForm } from './BookForm';
-
-interface BookDetailProps {
-  bookId: number;
-  onBack: () => void;
-  onUpdated: () => void;
-}
-
-export function BookDetail({ bookId, onBack, onUpdated }: BookDetailProps) {
-  const [book, setBook] = useState<Book | null>(null);
-  const [loading, setLoading] = useState(true);
-  const [editing, setEditing] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-
-  const loadBook = useCallback(async () => {
-    setLoading(true);
-    setError(null);
-    try {
-      const data = await fetchBook(bookId);
-      setBook(data);
-    } catch {
-      setError('Failed to load book details.');
-    } finally {
-      setLoading(false);
-    }
-  }, [bookId]);
-
-  useEffect(() => {
-    loadBook();
-  }, [loadBook]);
-
-  const handleUpdate = useCallback(
-    async (formData: BookFormData) => {
-      const updated = await updateBook(bookId, formData);
-      setBook(updated);
-      setEditing(false);
-      onUpdated();
-    },
-    [bookId, onUpdated],
-  );
-
-  const handleMarkFinished = useCallback(async () => {
-    const updated = await markBookAsFinished(bookId);
-    setBook(updated);
-    onUpdated();
-  }, [bookId, onUpdated]);
-
-  const handleDelete = useCallback(async () => {
-    if (!window.confirm('Are you sure you want to delete this book?')) return;
-    await deleteBook(bookId);
-    onBack();
-    onUpdated();
-  }, [bookId, onBack, onUpdated]);
-
-  if (loading) {
-    return <div className="loading-spinner">Loading...</div>;
-  }
-
-  if (error || !book) {
-    return <div className="error-message">{error ?? 'Book not found.'}</div>;
-  }
-
-  if (editing) {
-    return (
-      <div className="book-detail">
-        <button className="btn btn-secondary" onClick={() => setEditing(false)}>
-          ← Back to Details
-        </button>
-        <h2>Edit Book</h2>
-        <BookForm
-          initialData={book}
-          onSubmit={handleUpdate}
-          onCancel={() => setEditing(false)}
-        />
-      </div>
-    );
-  }
-
-  const statusColor = READING_STATUS_COLORS[book.reading_status];
-
-  return (
-    <div className="book-detail">
-      <button className="btn btn-secondary" onClick={onBack}>
-        ← Back to Library
-      </button>
-
-      <div className="book-detail-header">
-        <div className="book-detail-cover">
-          {book.cover_image_url ? (
-            <img src={book.cover_image_url} alt={`Cover of ${book.title}`} />
-          ) : (
-            <div className="book-card-placeholder large">
-              <span>{book.title.charAt(0)}</span>
-            </div>
-          )}
-        </div>
-        <div className="book-detail-meta">
-          <h1>{book.title}</h1>
-          <p className="book-detail-author">by {book.author}</p>
-          {book.genre && <span className="book-card-genre">{book.genre}</span>}
-          {book.isbn && <p className="book-detail-isbn">ISBN: {book.isbn}</p>}
-
-          <div className="book-detail-progress">
-            <div className="progress-bar large">
-              <div
-                className="progress-fill"
-                style={{ width: `${Math.min(book.reading_progress, 100)}%`, backgroundColor: statusColor }}
-              />
-            </div>
-            <div className="progress-text">
-              <span style={{ color: statusColor }}>
-                {READING_STATUS_LABELS[book.reading_status]}
-              </span>
-              <span>{book.reading_progress}% complete</span>
-              {book.total_pages > 0 && (
-                <span>
-                  Page {book.current_page} of {book.total_pages}
-                </span>
-              )}
-            </div>
-          </div>
-
-          <div className="book-detail-actions">
-            {book.reading_status !== 'finished' && (
-              <button className="btn btn-success" onClick={handleMarkFinished}>
-                Mark as Finished
-              </button>
-            )}
-            <button className="btn btn-primary" onClick={() => setEditing(true)}>
-              Edit Details
-            </button>
-            <button className="btn btn-danger" onClick={handleDelete}>
-              Delete
-            </button>
-          </div>
-        </div>
-      </div>
-
-      {book.description && (
-        <div className="book-detail-description">
-          <h3>Description</h3>
-          <p>{book.description}</p>
-        </div>
-      )}
-    </div>
-  );
-}

frontend/src/components/BookForm.tsx

@@ -1,209 +0,0 @@
-import { useState, useCallback, useEffect, useRef } from 'react';
-import type { Book, BookFormData, ReadingStatus } from '../types';
-import { READING_STATUS_LABELS } from '../types';
-
-interface BookFormProps {
-  initialData?: Book;
-  onSubmit: (data: BookFormData) => Promise<void>;
-  onCancel: () => void;
-  isLoading?: boolean;
-}
-
-export function BookForm({ initialData, onSubmit, onCancel, isLoading }: BookFormProps) {
-  const [formData, setFormData] = useState<BookFormData>({
-    title: initialData?.title ?? '',
-    author: initialData?.author ?? '',
-    genre: initialData?.genre ?? '',
-    description: initialData?.description ?? '',
-    cover_image_url: initialData?.cover_image_url ?? '',
-    isbn: initialData?.isbn ?? '',
-    total_pages: initialData?.total_pages ?? 0,
-    current_page: initialData?.current_page ?? 0,
-    reading_status: initialData?.reading_status ?? 'not_started',
-  });
-  const [error, setError] = useState<string | null>(null);
-  const titleRef = useRef<HTMLInputElement>(null);
-
-  useEffect(() => {
-    titleRef.current?.focus();
-  }, []);
-
-  const handleChange = useCallback(
-    (e: React.ChangeEvent<HTMLInputElement | HTMLTextAreaElement | HTMLSelectElement>) => {
-      const { name, value } = e.target;
-      setFormData((prev) => ({
-        ...prev,
-        [name]:
-          name === 'total_pages' || name === 'current_page'
-            ? Math.max(0, parseInt(value, 10) || 0)
-            : value,
-      }));
-    },
-    [],
-  );
-
-  const handleSubmit = useCallback(
-    async (e: React.FormEvent) => {
-      e.preventDefault();
-      setError(null);
-
-      if (!formData.title.trim()) {
-        setError('Title is required.');
-        return;
-      }
-      if (!formData.author.trim()) {
-        setError('Author is required.');
-        return;
-      }
-      if (formData.current_page > formData.total_pages && formData.total_pages > 0) {
-        setError('Current page cannot exceed total pages.');
-        return;
-      }
-
-      try {
-        await onSubmit(formData);
-      } catch (err) {
-        if (err instanceof Error) {
-          setError(err.message);
-        } else {
-          setError('Failed to save book.');
-        }
-      }
-    },
-    [formData, onSubmit],
-  );
-
-  return (
-    <form onSubmit={handleSubmit} className="book-form">
-      {error && <div className="form-error">{error}</div>}
-
-      <div className="form-group">
-        <label htmlFor="title">Title *</label>
-        <input
-          ref={titleRef}
-          id="title"
-          name="title"
-          type="text"
-          value={formData.title}
-          onChange={handleChange}
-          placeholder="Book title"
-          required
-        />
-      </div>
-
-      <div className="form-group">
-        <label htmlFor="author">Author *</label>
-        <input
-          id="author"
-          name="author"
-          type="text"
-          value={formData.author}
-          onChange={handleChange}
-          placeholder="Author name"
-          required
-        />
-      </div>
-
-      <div className="form-row">
-        <div className="form-group">
-          <label htmlFor="genre">Genre</label>
-          <input
-            id="genre"
-            name="genre"
-            type="text"
-            value={formData.genre}
-            onChange={handleChange}
-            placeholder="e.g. Fiction, Science"
-          />
-        </div>
-
-        <div className="form-group">
-          <label htmlFor="isbn">ISBN</label>
-          <input
-            id="isbn"
-            name="isbn"
-            type="text"
-            value={formData.isbn}
-            onChange={handleChange}
-            placeholder="ISBN number"
-          />
-        </div>
-      </div>
-
-      <div className="form-group">
-        <label htmlFor="description">Description</label>
-        <textarea
-          id="description"
-          name="description"
-          value={formData.description}
-          onChange={handleChange}
-          placeholder="Book description"
-          rows={3}
-        />
-      </div>
-
-      <div className="form-group">
-        <label htmlFor="cover_image_url">Cover Image URL</label>
-        <input
-          id="cover_image_url"
-          name="cover_image_url"
-          type="url"
-          value={formData.cover_image_url}
-          onChange={handleChange}
-          placeholder="https://example.com/cover.jpg"
-        />
-      </div>
-
-      <div className="form-row">
-        <div className="form-group">
-          <label htmlFor="total_pages">Total Pages</label>
-          <input
-            id="total_pages"
-            name="total_pages"
-            type="number"
-            min={0}
-            value={formData.total_pages}
-            onChange={handleChange}
-          />
-        </div>
-
-        <div className="form-group">
-          <label htmlFor="current_page">Current Page</label>
-          <input
-            id="current_page"
-            name="current_page"
-            type="number"
-            min={0}
-            value={formData.current_page}
-            onChange={handleChange}
-          />
-        </div>
-
-        <div className="form-group">
-          <label htmlFor="reading_status">Status</label>
-          <select
-            id="reading_status"
-            name="reading_status"
-            value={formData.reading_status}
-            onChange={handleChange}
-          >
-            {(Object.keys(READING_STATUS_LABELS) as ReadingStatus[]).map((status) => (
-              <option key={status} value={status}>
-                {READING_STATUS_LABELS[status]}
-              </option>
-            ))}
-          </select>
-        </div>
-      </div>
-
-      <div className="form-actions">
-        <button type="submit" className="btn btn-primary" disabled={isLoading}>
-          {isLoading ? 'Saving...' : initialData ? 'Update Book' : 'Add Book'}
-        </button>
-        <button type="button" className="btn btn-secondary" onClick={onCancel}>
-          Cancel
-        </button>
-      </div>
-    </form>
-  );
-}

frontend/src/components/Library.tsx

@@ -1,227 +0,0 @@
-import { useState, useEffect, useCallback, useMemo } from 'react';
-import type { Book, ReadingStatus } from '../types';
-import { READING_STATUS_LABELS } from '../types';
-import { fetchBooks, fetchBookStats, createBook } from '../api/books';
-import type { BookStats, BookFormData } from '../types';
-import { BookCard } from './BookCard';
-import { BookDetail } from './BookDetail';
-import { BookForm } from './BookForm';
-
-type View = 'library' | 'detail' | 'add';
-
-export function Library() {
-  const [view, setView] = useState<View>('library');
-  const [selectedBookId, setSelectedBookId] = useState<number | null>(null);
-  const [books, setBooks] = useState<Book[]>([]);
-  const [stats, setStats] = useState<BookStats | null>(null);
-  const [loading, setLoading] = useState(true);
-  const [search, setSearch] = useState('');
-  const [sortBy, setSortBy] = useState('-updated_at');
-  const [statusFilter, setStatusFilter] = useState<string>('');
-  const [currentPage, setCurrentPage] = useState(1);
-  const [totalCount, setTotalCount] = useState(0);
-  const [showForm, setShowForm] = useState(false);
-
-  const loadBooks = useCallback(async () => {
-    setLoading(true);
-    try {
-      const data = await fetchBooks({
-        page: currentPage,
-        sort_by: sortBy || undefined,
-        reading_status: statusFilter || undefined,
-        search: search || undefined,
-      });
-      setBooks(data.results);
-      setTotalCount(data.count);
-    } catch {
-      setBooks([]);
-    } finally {
-      setLoading(false);
-    }
-  }, [currentPage, sortBy, statusFilter, search]);
-
-  const loadStats = useCallback(async () => {
-    try {
-      const data = await fetchBookStats();
-      setStats(data);
-    } catch {
-      // Stats are non-critical
-    }
-  }, []);
-
-  useEffect(() => {
-    loadBooks();
-    loadStats();
-  }, [loadBooks, loadStats]);
-
-  const handleBookClick = useCallback((book: Book) => {
-    setSelectedBookId(book.id);
-    setView('detail');
-  }, []);
-
-  const handleBackToLibrary = useCallback(() => {
-    setView('library');
-    setSelectedBookId(null);
-  }, []);
-
-  const handleUpdated = useCallback(() => {
-    loadBooks();
-    loadStats();
-  }, [loadBooks, loadStats]);
-
-  const handleAddBook = useCallback(
-    async (data: BookFormData) => {
-      await createBook(data);
-      setShowForm(false);
-      await loadBooks();
-      await loadStats();
-    },
-    [loadBooks, loadStats],
-  );
-
-  const totalPages = useMemo(() => Math.max(1, Math.ceil(totalCount / 20)), [totalCount]);
-
-  if (view === 'detail' && selectedBookId) {
-    return (
-      <BookDetail
-        bookId={selectedBookId}
-        onBack={handleBackToLibrary}
-        onUpdated={handleUpdated}
-      />
-    );
-  }
-
-  return (
-    <div className="library">
-      <div className="library-header">
-        <h1>My Library</h1>
-        <button className="btn btn-primary" onClick={() => setShowForm(true)}>
-          + Add Book
-        </button>
-      </div>
-
-      {stats && (
-        <div className="library-stats">
-          <div className="stat-card">
-            <span className="stat-value">{stats.total_books}</span>
-            <span className="stat-label">Total</span>
-          </div>
-          <div className="stat-card">
-            <span className="stat-value" style={{ color: '#22c55e' }}>{stats.finished}</span>
-            <span className="stat-label">Finished</span>
-          </div>
-          <div className="stat-card">
-            <span className="stat-value" style={{ color: '#3b82f6' }}>{stats.reading}</span>
-            <span className="stat-label">Reading</span>
-          </div>
-          <div className="stat-card">
-            <span className="stat-value" style={{ color: '#6b7280' }}>{stats.not_started}</span>
-            <span className="stat-label">Unread</span>
-          </div>
-        </div>
-      )}
-
-      {showForm && (
-        <div className="modal-overlay">
-          <div className="modal-content">
-            <h2>Add New Book</h2>
-            <BookForm
-              onSubmit={handleAddBook}
-              onCancel={() => setShowForm(false)}
-            />
-          </div>
-        </div>
-      )}
-
-      <div className="library-controls">
-        <input
-          type="search"
-          className="search-input"
-          placeholder="Search by title or author..."
-          value={search}
-          onChange={(e: React.ChangeEvent<HTMLInputElement>) => {
-            setSearch(e.target.value);
-            setCurrentPage(1);
-          }}
-        />
-
-        <select
-          value={sortBy}
-          onChange={(e: React.ChangeEvent<HTMLSelectElement>) => {
-            setSortBy(e.target.value);
-            setCurrentPage(1);
-          }}
-          className="sort-select"
-        >
-          <option value="-updated_at">Recently Updated</option>
-          <option value="title">Title (A-Z)</option>
-          <option value="-title">Title (Z-A)</option>
-          <option value="author">Author (A-Z)</option>
-          <option value="-author">Author (Z-A)</option>
-          <option value="-created_at">Recently Added</option>
-          <option value="-reading_progress">Most Progress</option>
-          <option value="reading_progress">Least Progress</option>
-        </select>
-
-        <select
-          value={statusFilter}
-          onChange={(e: React.ChangeEvent<HTMLSelectElement>) => {
-            setStatusFilter(e.target.value);
-            setCurrentPage(1);
-          }}
-          className="filter-select"
-        >
-          <option value="">All Status</option>
-          {(Object.keys(READING_STATUS_LABELS) as ReadingStatus[]).map((status) => (
-            <option key={status} value={status}>
-              {READING_STATUS_LABELS[status]}
-            </option>
-          ))}
-        </select>
-      </div>
-
-      {loading ? (
-        <div className="loading-spinner">Loading books...</div>
-      ) : books.length === 0 ? (
-        <div className="empty-state">
-          <p>No books found.</p>
-          {search || statusFilter ? (
-            <p>Try adjusting your search or filters.</p>
-          ) : (
-            <p>Add your first book to get started!</p>
-          )}
-        </div>
-      ) : (
-        <>
-          <div className="books-grid">
-            {books.map((book) => (
-              <BookCard key={book.id} book={book} onClick={handleBookClick} />
-            ))}
-          </div>
-
-          {totalPages > 1 && (
-            <div className="pagination">
-              <button
-                className="btn btn-secondary"
-                disabled={currentPage <= 1}
-                onClick={() => setCurrentPage((p) => Math.max(1, p - 1))}
-              >
-                ← Previous
-              </button>
-              <span className="page-info">
-                Page {currentPage} of {totalPages}
-              </span>
-              <button
-                className="btn btn-secondary"
-                disabled={currentPage >= totalPages}
-                onClick={() => setCurrentPage((p) => p + 1)}
-              >
-                Next →
-              </button>
-            </div>
-          )}
-        </>
-      )}
-    </div>
-  );
-}

frontend/src/components/annotations/AddAnnotationForm.tsx

@@ -0,0 +1,120 @@
+import React, { useState } from "react";
+import { useAnnotations } from "@/context/AnnotationsContext";
+
+interface AddAnnotationFormProps {
+  bookId: string;
+  page: number;
+  locationText?: string;
+  onClose?: () => void;
+}
+
+export function AddAnnotationForm({
+  bookId,
+  page,
+  locationText,
+  onClose,
+}: AddAnnotationFormProps): React.ReactElement {
+  const { addBookmark, addNote } = useAnnotations();
+  const [mode, setMode] = useState<"bookmark" | "note" | null>(null);
+  const [noteContent, setNoteContent] = useState("");
+  const [submitting, setSubmitting] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const handleSubmit = async (): Promise<void> => {
+    setSubmitting(true);
+    setError(null);
+    try {
+      if (mode === "bookmark") {
+        await addBookmark({ book: bookId, page, location_text: locationText });
+      } else if (mode === "note") {
+        if (!noteContent.trim()) {
+          setError("Note content cannot be empty.");
+          setSubmitting(false);
+          return;
+        }
+        await addNote({
+          book: bookId,
+          page,
+          location_text: locationText,
+          content: noteContent.trim(),
+        });
+      }
+      onClose?.();
+    } catch (err) {
+      setError(
+        err instanceof Error ? err.message : "Failed to save annotation."
+      );
+    } finally {
+      setSubmitting(false);
+    }
+  };
+
+  return (
+    <div className="add-annotation-overlay">
+      <div className="add-annotation-modal">
+        <button className="modal-close" onClick={onClose} aria-label="Close">
+          &times;
+        </button>
+        <h3>Add to Page {page}</h3>
+        {locationText && (
+          <blockquote className="annotation-quote">
+            &ldquo;{locationText}&rdquo;
+          </blockquote>
+        )}
+
+        {!mode ? (
+          <div className="mode-selector">
+            <button
+              className="btn btn-block"
+              onClick={() => setMode("bookmark")}
+            >
+              Add Bookmark
+            </button>
+            <button
+              className="btn btn-block btn-secondary"
+              onClick={() => setMode("note")}
+            >
+              Add Note
+            </button>
+          </div>
+        ) : (
+          <div className="annotation-form">
+            {mode === "note" && (
+              <div className="form-group">
+                <label htmlFor="note-content">Note:</label>
+                <textarea
+                  id="note-content"
+                  className="form-textarea"
+                  value={noteContent}
+                  onChange={(e: React.ChangeEvent<HTMLTextAreaElement>) =>
+                    setNoteContent(e.target.value)
+                  }
+                  rows={5}
+                  placeholder="Write your note here..."
+                  autoFocus
+                />
+              </div>
+            )}
+            {error && <div className="form-error">{error}</div>}
+            <div className="form-actions">
+              <button
+                className="btn"
+                onClick={handleSubmit}
+                disabled={submitting}
+              >
+                {submitting ? "Saving..." : "Save"}
+              </button>
+              <button
+                className="btn btn-secondary"
+                onClick={() => setMode(null)}
+                disabled={submitting}
+              >
+                Back
+              </button>
+            </div>
+          </div>
+        )}
+      </div>
+    </div>
+  );
+}

frontend/src/components/annotations/AnnotationsDashboard.tsx

@@ -0,0 +1,109 @@
+import React from "react";
+import { useAnnotations } from "@/context/AnnotationsContext";
+import type { AnnotationEntry } from "@/types";
+
+interface AnnotationsDashboardProps {
+  bookId?: string;
+  onNavigateToPage?: (bookId: string, page: number) => void;
+}
+
+export function AnnotationsDashboard({
+  bookId,
+  onNavigateToPage,
+}: AnnotationsDashboardProps): React.ReactElement {
+  const {
+    mergedAnnotations,
+    loadBookmarks,
+    loadNotes,
+    removeBookmark,
+    removeNote,
+    state,
+  } = useAnnotations();
+
+  React.useEffect(() => {
+    loadBookmarks(bookId);
+    loadNotes(bookId);
+  }, [loadBookmarks, loadNotes, bookId]);
+
+  const handleDelete = async (entry: AnnotationEntry): Promise<void> => {
+    if (entry.kind === "bookmark") {
+      await removeBookmark(entry.id);
+    } else {
+      await removeNote(entry.id);
+    }
+  };
+
+  if (state.bookmarksLoading || state.notesLoading) {
+    return <div className="annotations-loading">Loading annotations...</div>;
+  }
+
+  if (mergedAnnotations.length === 0) {
+    return (
+      <div className="annotations-empty">
+        No bookmarks or notes yet.
+      </div>
+    );
+  }
+
+  return (
+    <div className="annotations-dashboard">
+      <div className="annotations-summary">
+        <span className="summary-count">
+          {state.bookmarks.length} bookmarks
+        </span>
+        <span className="summary-separator">&middot;</span>
+        <span className="summary-count">
+          {state.notes.length} notes
+        </span>
+      </div>
+      <div className="annotations-list">
+        {mergedAnnotations.map((entry: AnnotationEntry) => (
+          <div key={`${entry.kind}-${entry.id}`} className="annotation-card">
+            <div className="annotation-card-header">
+              <span
+                className={`annotation-kind-badge ${
+                  entry.kind === "bookmark" ? "bookmark-badge" : "note-badge"
+                }`}
+              >
+                {entry.kind === "bookmark" ? "Bookmark" : "Note"}
+              </span>
+              <span className="annotation-book-title">
+                {entry.book_title}
+              </span>
+              <span className="annotation-page">p.{entry.page}</span>
+              <span className="annotation-date">
+                {new Date(entry.created_at).toLocaleDateString()}
+              </span>
+            </div>
+            {entry.location_text && (
+              <blockquote className="annotation-quote">
+                &ldquo;{entry.location_text}&rdquo;
+              </blockquote>
+            )}
+            {entry.kind === "note" && entry.content && (
+              <p className="note-content-text">{entry.content}</p>
+            )}
+            <div className="annotation-actions">
+              {onNavigateToPage && (
+                <button
+                  className="btn btn-sm"
+                  onClick={() =>
+                    onNavigateToPage(entry.book_id, entry.page)
+                  }
+                >
+                  Go to page
+                </button>
+              )}
+              <button
+                className="btn btn-sm btn-danger"
+                onClick={() => handleDelete(entry)}
+              >
+                Delete
+              </button>
+            </div>
+          </div>
+        ))}
+      </div>
+    </div>
+  );
+}

frontend/src/components/annotations/BookmarkList.tsx

@@ -0,0 +1,87 @@
+import React, { useState } from "react";
+import { useAnnotations } from "@/context/AnnotationsContext";
+import type { Bookmark } from "@/types";
+
+interface BookmarkListProps {
+  bookId?: string;
+  onNavigateToPage?: (bookId: string, page: number) => void;
+}
+
+export function BookmarkList({
+  bookId,
+  onNavigateToPage,
+}: BookmarkListProps): React.ReactElement {
+  const { state, loadBookmarks, removeBookmark } = useAnnotations();
+  const [deletingId, setDeletingId] = useState<string | null>(null);
+
+  React.useEffect(() => {
+    loadBookmarks(bookId);
+  }, [loadBookmarks, bookId]);
+
+  const handleDelete = async (id: string): Promise<void> => {
+    setDeletingId(id);
+    try {
+      await removeBookmark(id);
+    } catch {
+      // error handled by context
+    } finally {
+      setDeletingId(null);
+    }
+  };
+
+  if (state.bookmarksLoading) {
+    return <div className="annotations-loading">Loading bookmarks...</div>;
+  }
+
+  if (state.bookmarks.length === 0) {
+    return (
+      <div className="annotations-empty">
+        No bookmarks yet. Select a passage and add a bookmark while reading.
+      </div>
+    );
+  }
+
+  return (
+    <div className="annotations-list">
+      {state.bookmarks.map((bookmark: Bookmark) => (
+        <div key={bookmark.id} className="annotation-card">
+          <div className="annotation-card-header">
+            <span className="annotation-kind-badge bookmark-badge">
+              Bookmark
+            </span>
+            <span className="annotation-page">
+              Page {bookmark.page}
+            </span>
+            <span className="annotation-date">
+              {new Date(bookmark.created_at).toLocaleDateString()}
+            </span>
+          </div>
+          {bookmark.location_text && (
+            <blockquote className="annotation-quote">
+              &ldquo;{bookmark.location_text}&rdquo;
+            </blockquote>
+          )}
+          <div className="annotation-actions">
+            {onNavigateToPage && (
+              <button
+                className="btn btn-sm"
+                onClick={() =>
+                  onNavigateToPage(bookmark.book, bookmark.page)
+                }
+              >
+                Go to page
+              </button>
+            )}
+            <button
+              className="btn btn-sm btn-danger"
+              onClick={() => handleDelete(bookmark.id)}
+              disabled={deletingId === bookmark.id}
+            >
+              {deletingId === bookmark.id ? "Deleting..." : "Delete"}
+            </button>
+          </div>
+        </div>
+      ))}
+    </div>
+  );
+}

frontend/src/components/annotations/BookmarksNotesPage.tsx

@@ -0,0 +1,23 @@
+import React from "react";
+import { AnnotationsDashboard } from "@/components/annotations";
+
+interface BookmarksNotesPageProps {
+  bookId?: string;
+}
+
+export function BookmarksNotesPage({
+  bookId,
+}: BookmarksNotesPageProps): React.ReactElement {
+  return (
+    <div className="page">
+      <h2>Bookmarks & Notes</h2>
+      <AnnotationsDashboard
+        bookId={bookId}
+        onNavigateToPage={(bookId, page) => {
+          // Navigate to the book reader page at the specific page
+          window.location.href = `/books/${bookId}?page=${page}`;
+        }}
+      />
+    </div>
+  );
+}

frontend/src/components/annotations/NoteList.tsx

@@ -0,0 +1,148 @@
+import React, { useState } from "react";
+import { useAnnotations } from "@/context/AnnotationsContext";
+import type { Note } from "@/types";
+
+interface NoteListProps {
+  bookId?: string;
+  onNavigateToPage?: (bookId: string, page: number) => void;
+}
+
+export function NoteList({
+  bookId,
+  onNavigateToPage,
+}: NoteListProps): React.ReactElement {
+  const { state, loadNotes, editNote, removeNote } = useAnnotations();
+  const [editingId, setEditingId] = useState<string | null>(null);
+  const [editContent, setEditContent] = useState<string>("");
+  const [deletingId, setDeletingId] = useState<string | null>(null);
+  const [savingId, setSavingId] = useState<string | null>(null);
+
+  React.useEffect(() => {
+    loadNotes(bookId);
+  }, [loadNotes, bookId]);
+
+  const handleEdit = (note: Note): void => {
+    setEditingId(note.id);
+    setEditContent(note.content);
+  };
+
+  const handleSave = async (id: string): Promise<void> => {
+    setSavingId(id);
+    try {
+      await editNote(id, editContent.trim());
+      setEditingId(null);
+    } catch {
+      // error handled by context
+    } finally {
+      setSavingId(null);
+    }
+  };
+
+  const handleCancelEdit = (): void => {
+    setEditingId(null);
+    setEditContent("");
+  };
+
+  const handleDelete = async (id: string): Promise<void> => {
+    setDeletingId(id);
+    try {
+      await removeNote(id);
+    } catch {
+      // error handled by context
+    } finally {
+      setDeletingId(null);
+    }
+  };
+
+  if (state.notesLoading) {
+    return <div className="annotations-loading">Loading notes...</div>;
+  }
+
+  if (state.notes.length === 0) {
+    return (
+      <div className="annotations-empty">
+        No notes yet. Select a passage and add a note while reading.
+      </div>
+    );
+  }
+
+  return (
+    <div className="annotations-list">
+      {state.notes.map((note: Note) => (
+        <div key={note.id} className="annotation-card">
+          <div className="annotation-card-header">
+            <span className="annotation-kind-badge note-badge">Note</span>
+            <span className="annotation-page">Page {note.page}</span>
+            <span className="annotation-date">
+              {new Date(note.created_at).toLocaleDateString()}
+            </span>
+          </div>
+          {note.location_text && (
+            <blockquote className="annotation-quote">
+              &ldquo;{note.location_text}&rdquo;
+            </blockquote>
+          )}
+          <div className="annotation-note-content">
+            {editingId === note.id ? (
+              <div className="note-edit-form">
+                <textarea
+                  className="note-edit-textarea"
+                  value={editContent}
+                  onChange={(e: React.ChangeEvent<HTMLTextAreaElement>) =>
+                    setEditContent(e.target.value)
+                  }
+                  rows={4}
+                  autoFocus
+                />
+                <div className="note-edit-actions">
+                  <button
+                    className="btn btn-sm"
+                    onClick={() => handleSave(note.id)}
+                    disabled={savingId === note.id || !editContent.trim()}
+                  >
+                    {savingId === note.id ? "Saving..." : "Save"}
+                  </button>
+                  <button
+                    className="btn btn-sm btn-secondary"
+                    onClick={handleCancelEdit}
+                  >
+                    Cancel
+                  </button>
+                </div>
+              </div>
+            ) : (
+              <p className="note-content-text">{note.content}</p>
+            )}
+          </div>
+          <div className="annotation-actions">
+            {onNavigateToPage && (
+              <button
+                className="btn btn-sm"
+                onClick={() =>
+                  onNavigateToPage(note.book, note.page)
+                }
+              >
+                Go to page
+              </button>
+            )}
+            {editingId !== note.id && (
+              <button
+                className="btn btn-sm btn-secondary"
+                onClick={() => handleEdit(note)}
+              >
+                Edit
+              </button>
+            )}
+            <button
+              className="btn btn-sm btn-danger"
+              onClick={() => handleDelete(note.id)}
+              disabled={deletingId === note.id}
+            >
+              {deletingId === note.id ? "Deleting..." : "Delete"}
+            </button>
+          </div>
+        </div>
+      ))}
+    </div>
+  );
+}

frontend/src/components/annotations/index.ts

@@ -0,0 +1,4 @@
+export { BookmarkList } from "./BookmarkList";
+export { NoteList } from "./NoteList";
+export { AddAnnotationForm } from "./AddAnnotationForm";
+export { AnnotationsDashboard } from "./AnnotationsDashboard";

frontend/src/components/layout/Layout.tsx

@@ -0,0 +1,27 @@
+import React from "react";
+import { AnnotationsProvider } from "@/context/AnnotationsContext";
+
+interface LayoutProps {
+  children: React.ReactNode;
+  title?: string;
+}
+
+export function Layout({
+  children,
+  title = "Cloud Reader",
+}: LayoutProps): React.ReactElement {
+  return (
+    <AnnotationsProvider>
+      <div className="app-container">
+        <header className="app-header">
+          <h1 className="app-title">{title}</h1>
+          <nav className="app-nav">
+            <a href="/" className="nav-link">Home</a>
+            <a href="/bookmarks-notes" className="nav-link">Bookmarks & Notes</a>
+          </nav>
+        </header>
+        <main className="app-main">{children}</main>
+      </div>
+    </AnnotationsProvider>
+  );
+}

frontend/src/components/layout/index.ts

@@ -0,0 +1 @@
+export { Layout } from "./Layout";

frontend/src/context/AnnotationsContext.tsx

@@ -0,0 +1,277 @@
+import {
+  createContext,
+  useContext,
+  useReducer,
+  useCallback,
+  type ReactNode,
+} from "react";
+import type { Bookmark, Note, AnnotationEntry } from "@/types";
+import * as annotationsApi from "@/api/annotations";
+
+// ---------------------------------------------------------------------------
+// State
+// ---------------------------------------------------------------------------
+
+interface AnnotationsState {
+  bookmarks: Bookmark[];
+  notes: Note[];
+  bookmarksLoading: boolean;
+  notesLoading: boolean;
+  error: string | null;
+  selectedBookId: string | null;
+}
+
+const initialState: AnnotationsState = {
+  bookmarks: [],
+  notes: [],
+  bookmarksLoading: false,
+  notesLoading: false,
+  error: null,
+  selectedBookId: null,
+};
+
+// ---------------------------------------------------------------------------
+// Actions
+// ---------------------------------------------------------------------------
+
+type AnnotationsAction =
+  | { type: "FETCH_BOOKMARKS_START" }
+  | { type: "FETCH_BOOKMARKS_SUCCESS"; payload: Bookmark[] }
+  | { type: "FETCH_NOTES_START" }
+  | { type: "FETCH_NOTES_SUCCESS"; payload: Note[] }
+  | { type: "SET_ERROR"; payload: string }
+  | { type: "CLEAR_ERROR" }
+  | { type: "REMOVE_BOOKMARK"; payload: string }
+  | { type: "REMOVE_NOTE"; payload: string }
+  | { type: "UPDATE_NOTE"; payload: Note }
+  | { type: "ADD_BOOKMARK"; payload: Bookmark }
+  | { type: "ADD_NOTE"; payload: Note }
+  | { type: "SET_SELECTED_BOOK"; payload: string | null };
+
+// ---------------------------------------------------------------------------
+// Reducer
+// ---------------------------------------------------------------------------
+
+function annotationsReducer(
+  state: AnnotationsState,
+  action: AnnotationsAction
+): AnnotationsState {
+  switch (action.type) {
+    case "FETCH_BOOKMARKS_START":
+      return { ...state, bookmarksLoading: true, error: null };
+    case "FETCH_BOOKMARKS_SUCCESS":
+      return { ...state, bookmarks: action.payload, bookmarksLoading: false };
+    case "FETCH_NOTES_START":
+      return { ...state, notesLoading: true, error: null };
+    case "FETCH_NOTES_SUCCESS":
+      return { ...state, notes: action.payload, notesLoading: false };
+    case "SET_ERROR":
+      return { ...state, error: action.payload, bookmarksLoading: false, notesLoading: false };
+    case "CLEAR_ERROR":
+      return { ...state, error: null };
+    case "REMOVE_BOOKMARK":
+      return {
+        ...state,
+        bookmarks: state.bookmarks.filter((b) => b.id !== action.payload),
+      };
+    case "REMOVE_NOTE":
+      return {
+        ...state,
+        notes: state.notes.filter((n) => n.id !== action.payload),
+      };
+    case "UPDATE_NOTE":
+      return {
+        ...state,
+        notes: state.notes.map((n) =>
+          n.id === action.payload.id ? action.payload : n
+        ),
+      };
+    case "ADD_BOOKMARK":
+      return {
+        ...state,
+        bookmarks: [action.payload, ...state.bookmarks],
+      };
+    case "ADD_NOTE":
+      return {
+        ...state,
+        notes: [action.payload, ...state.notes],
+      };
+    case "SET_SELECTED_BOOK":
+      return { ...state, selectedBookId: action.payload };
+    default:
+      return state;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Context
+// ---------------------------------------------------------------------------
+
+interface AnnotationsContextValue {
+  state: AnnotationsState;
+  loadBookmarks: (bookId?: string) => Promise<void>;
+  loadNotes: (bookId?: string) => Promise<void>;
+  addBookmark: (data: { book: string; page: number; location_text?: string }) => Promise<Bookmark>;
+  addNote: (data: { book: string; page: number; location_text?: string; content: string }) => Promise<Note>;
+  editNote: (id: string, content: string) => Promise<Note>;
+  removeBookmark: (id: string) => Promise<void>;
+  removeNote: (id: string) => Promise<void>;
+  setSelectedBook: (bookId: string | null) => void;
+  /** Merged list of bookmarks + notes, sorted by created_at desc */
+  mergedAnnotations: AnnotationEntry[];
+}
+
+const AnnotationsContext = createContext<AnnotationsContextValue | null>(null);
+
+// ---------------------------------------------------------------------------
+// Provider
+// ---------------------------------------------------------------------------
+
+export function AnnotationsProvider({
+  children,
+}: {
+  children: ReactNode;
+}): React.ReactElement {
+  const [state, dispatch] = useReducer(annotationsReducer, initialState);
+
+  const loadBookmarks = useCallback(async (bookId?: string) => {
+    dispatch({ type: "FETCH_BOOKMARKS_START" });
+    try {
+      const response = await annotationsApi.fetchBookmarks(bookId);
+      dispatch({ type: "FETCH_BOOKMARKS_SUCCESS", payload: response.results });
+    } catch (err) {
+      dispatch({
+        type: "SET_ERROR",
+        payload: err instanceof Error ? err.message : "Failed to load bookmarks",
+      });
+    }
+  }, []);
+
+  const loadNotes = useCallback(async (bookId?: string) => {
+    dispatch({ type: "FETCH_NOTES_START" });
+    try {
+      const response = await annotationsApi.fetchNotes(bookId);
+      dispatch({ type: "FETCH_NOTES_SUCCESS", payload: response.results });
+    } catch (err) {
+      dispatch({
+        type: "SET_ERROR",
+        payload: err instanceof Error ? err.message : "Failed to load notes",
+      });
+    }
+  }, []);
+
+  const addBookmark = useCallback(
+    async (data: {
+      book: string;
+      page: number;
+      location_text?: string;
+    }): Promise<Bookmark> => {
+      const bookmark = await annotationsApi.createBookmark(data);
+      dispatch({ type: "ADD_BOOKMARK", payload: bookmark });
+      return bookmark;
+    },
+    []
+  );
+
+  const addNote = useCallback(
+    async (data: {
+      book: string;
+      page: number;
+      location_text?: string;
+      content: string;
+    }): Promise<Note> => {
+      const note = await annotationsApi.createNote(data);
+      dispatch({ type: "ADD_NOTE", payload: note });
+      return note;
+    },
+    []
+  );
+
+  const editNote = useCallback(
+    async (id: string, content: string): Promise<Note> => {
+      const updated = await annotationsApi.updateNote(id, { content });
+      dispatch({ type: "UPDATE_NOTE", payload: updated });
+      return updated;
+    },
+    []
+  );
+
+  const removeBookmark = useCallback(async (id: string) => {
+    await annotationsApi.deleteBookmark(id);
+    dispatch({ type: "REMOVE_BOOKMARK", payload: id });
+  }, []);
+
+  const removeNote = useCallback(async (id: string) => {
+    await annotationsApi.deleteNote(id);
+    dispatch({ type: "REMOVE_NOTE", payload: id });
+  }, []);
+
+  const setSelectedBook = useCallback((bookId: string | null) => {
+    dispatch({ type: "SET_SELECTED_BOOK", payload: bookId });
+  }, []);
+
+  // Build merged annotations list sorted by created_at desc
+  const mergedAnnotations: AnnotationEntry[] = [
+    ...state.bookmarks.map(
+      (b): AnnotationEntry => ({
+        id: b.id,
+        kind: "bookmark",
+        book_title: b.book_title,
+        book_id: b.book,
+        page: b.page,
+        location_text: b.location_text,
+        created_at: b.created_at,
+        updated_at: b.updated_at,
+      })
+    ),
+    ...state.notes.map(
+      (n): AnnotationEntry => ({
+        id: n.id,
+        kind: "note",
+        book_title: n.book_title,
+        book_id: n.book,
+        page: n.page,
+        location_text: n.location_text,
+        content: n.content,
+        created_at: n.created_at,
+        updated_at: n.updated_at,
+      })
+    ),
+  ].sort(
+    (a, b) =>
+      new Date(b.created_at).getTime() - new Date(a.created_at).getTime()
+  );
+
+  const value: AnnotationsContextValue = {
+    state,
+    loadBookmarks,
+    loadNotes,
+    addBookmark,
+    addNote,
+    editNote,
+    removeBookmark,
+    removeNote,
+    setSelectedBook,
+    mergedAnnotations,
+  };
+
+  return (
+    <AnnotationsContext.Provider value={value}>
+      {children}
+    </AnnotationsContext.Provider>
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Hook
+// ---------------------------------------------------------------------------
+
+export function useAnnotations(): AnnotationsContextValue {
+  const context = useContext(AnnotationsContext);
+  if (!context) {
+    throw new Error(
+      "useAnnotations must be used within an AnnotationsProvider"
+    );
+  }
+  return context;
+}

frontend/src/hooks/index.ts

@@ -0,0 +1 @@
+export { usePaginatedQuery } from "./usePaginatedQuery";

frontend/src/hooks/usePaginatedQuery.ts

@@ -0,0 +1,69 @@
+import { useState, useCallback, useRef, useEffect } from "react";
+import type { PaginatedResponse } from "@/types";
+
+interface UsePaginatedQueryOptions<T> {
+  fetchFn: (cursor?: string) => Promise<PaginatedResponse<T>>;
+}
+
+interface UsePaginatedQueryResult<T> {
+  items: T[];
+  loading: boolean;
+  error: string | null;
+  hasMore: boolean;
+  loadMore: () => Promise<void>;
+  refresh: () => Promise<void>;
+}
+
+/**
+ * Hook for paginated list fetching with infinite scroll support.
+ */
+export function usePaginatedQuery<T>({
+  fetchFn,
+}: UsePaginatedQueryOptions<T>): UsePaginatedQueryResult<T> {
+  const [items, setItems] = useState<T[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+  const [nextCursor, setNextCursor] = useState<string | null>(null);
+  const loadingRef = useRef(false);
+
+  const refresh = useCallback(async () => {
+    setLoading(true);
+    setError(null);
+    try {
+      const response = await fetchFn();
+      setItems(response.results);
+      setNextCursor(response.next);
+    } catch (err) {
+      setError(err instanceof Error ? err.message : "Failed to fetch data");
+    } finally {
+      setLoading(false);
+    }
+  }, [fetchFn]);
+
+  const loadMore = useCallback(async () => {
+    if (!nextCursor || loadingRef.current) return;
+    loadingRef.current = true;
+    try {
+      const response = await fetchFn(nextCursor);
+      setItems((prev) => [...prev, ...response.results]);
+      setNextCursor(response.next);
+    } catch (err) {
+      setError(err instanceof Error ? err.message : "Failed to load more");
+    } finally {
+      loadingRef.current = false;
+    }
+  }, [nextCursor, fetchFn]);
+
+  useEffect(() => {
+    refresh();
+  }, [refresh]);
+
+  return {
+    items,
+    loading,
+    error,
+    hasMore: nextCursor !== null,
+    loadMore,
+    refresh,
+  };
+}

frontend/src/index.css

@@ -1,16 +0,0 @@
-/* Base reset — main styles in App.css */
-*,
-*::before,
-*::after {
-  box-sizing: border-box;
-  margin: 0;
-  padding: 0;
-}
-
-body {
-  margin: 0;
-}
-
-#root {
-  min-height: 100vh;
-}

frontend/src/main.tsx

@@ -1,10 +1,53 @@
-import { StrictMode } from 'react'
+import React from "react";
-import { createRoot } from 'react-dom/client'
+import ReactDOM from "react-dom/client";
-import './index.css'
+import { Layout } from "@/components/layout";
-import App from './App.tsx'
+import { BookmarksNotesPage } from "@/components/annotations/BookmarksNotesPage";
+import "./styles.css";
 
-createRoot(document.getElementById('root')!).render(
+function App(): React.ReactElement {
-  <StrictMode>
+  const path = window.location.pathname;
+
+  // Simple client-side routing
+  if (path.startsWith("/books/") && path.includes("bookmarks-notes")) {
+    // /books/:id/bookmarks-notes
+    const bookId = path.split("/")[2];
+    return (
+      <Layout title="Cloud Reader">
+        <BookmarksNotesPage bookId={bookId} />
+      </Layout>
+    );
+  }
+
+  if (path === "/bookmarks-notes" || path === "/bookmarks-notes/") {
+    return (
+      <Layout title="Cloud Reader">
+        <BookmarksNotesPage />
+      </Layout>
+    );
+  }
+
+  // Default: landing page
+  return (
+    <Layout title="Cloud Reader">
+      <div className="page">
+        <h2>Welcome to Cloud Reader</h2>
+        <p>Your personal e-book reader with cross-device sync.</p>
+        <div className="quick-links">
+          <a href="/bookmarks-notes" className="card-link">
+            <h3>Bookmarks & Notes</h3>
+            <p>View and manage all your annotations</p>
+          </a>
+        </div>
+      </div>
+    </Layout>
+  );
+}
+
+const rootElement = document.getElementById("root");
+if (rootElement) {
+  ReactDOM.createRoot(rootElement).render(
+    <React.StrictMode>
       <App />
-  </StrictMode>,
+    </React.StrictMode>
-)
+  );
+}

frontend/src/styles.css

@@ -0,0 +1,429 @@
+/* ---------------------------------------------------------------------------
+   Cloud Reader – Global Styles
+   Minimal, clean design system for the bookmark & notes management UI.
+   --------------------------------------------------------------------------- */
+
+/* Reset & base */
+*,
+*::before,
+*::after {
+  box-sizing: border-box;
+  margin: 0;
+  padding: 0;
+}
+
+:root {
+  --color-bg: #f8f9fa;
+  --color-surface: #ffffff;
+  --color-primary: #4f46e5;
+  --color-primary-hover: #4338ca;
+  --color-danger: #ef4444;
+  --color-danger-hover: #dc2626;
+  --color-secondary: #6b7280;
+  --color-secondary-hover: #4b5563;
+  --color-text: #1f2937;
+  --color-text-muted: #6b7280;
+  --color-border: #e5e7eb;
+  --color-quote-bg: #f3f4f6;
+  --radius: 8px;
+  --radius-sm: 4px;
+  --shadow: 0 1px 3px rgba(0, 0, 0, 0.1);
+  --shadow-lg: 0 4px 12px rgba(0, 0, 0, 0.15);
+  --font: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen,
+    Ubuntu, Cantarell, sans-serif;
+}
+
+html {
+  font-size: 16px;
+  -webkit-font-smoothing: antialiased;
+}
+
+body {
+  font-family: var(--font);
+  background: var(--color-bg);
+  color: var(--color-text);
+  line-height: 1.6;
+}
+
+/* App container */
+.app-container {
+  max-width: 960px;
+  margin: 0 auto;
+  padding: 0 1rem;
+}
+
+/* Header */
+.app-header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 1rem 0;
+  border-bottom: 1px solid var(--color-border);
+  margin-bottom: 1.5rem;
+}
+
+.app-title {
+  font-size: 1.5rem;
+  font-weight: 700;
+}
+
+.app-nav {
+  display: flex;
+  gap: 1rem;
+}
+
+.nav-link {
+  color: var(--color-primary);
+  text-decoration: none;
+  font-size: 0.875rem;
+  font-weight: 500;
+}
+
+.nav-link:hover {
+  text-decoration: underline;
+}
+
+/* Main content */
+.app-main {
+  min-height: 70vh;
+  padding-bottom: 3rem;
+}
+
+.page {
+  padding: 1rem 0;
+}
+
+.page h2 {
+  font-size: 1.25rem;
+  font-weight: 600;
+  margin-bottom: 1rem;
+}
+
+/* Quick links */
+.quick-links {
+  display: grid;
+  gap: 1rem;
+  margin-top: 1.5rem;
+}
+
+.card-link {
+  display: block;
+  padding: 1.25rem;
+  background: var(--color-surface);
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius);
+  text-decoration: none;
+  color: inherit;
+  box-shadow: var(--shadow);
+  transition: box-shadow 0.2s;
+}
+
+.card-link:hover {
+  box-shadow: var(--shadow-lg);
+}
+
+.card-link h3 {
+  font-size: 1rem;
+  margin-bottom: 0.25rem;
+}
+
+.card-link p {
+  font-size: 0.875rem;
+  color: var(--color-text-muted);
+}
+
+/* Buttons */
+.btn {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  padding: 0.5rem 1rem;
+  font-size: 0.875rem;
+  font-weight: 500;
+  border: 1px solid var(--color-primary);
+  border-radius: var(--radius-sm);
+  background: var(--color-primary);
+  color: #fff;
+  cursor: pointer;
+  transition: background 0.15s;
+}
+
+.btn:hover {
+  background: var(--color-primary-hover);
+}
+
+.btn:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+
+.btn-sm {
+  padding: 0.25rem 0.625rem;
+  font-size: 0.8125rem;
+}
+
+.btn-secondary {
+  background: var(--color-surface);
+  color: var(--color-secondary);
+  border-color: var(--color-border);
+}
+
+.btn-secondary:hover {
+  background: var(--color-bg);
+  color: var(--color-secondary-hover);
+}
+
+.btn-danger {
+  background: var(--color-danger);
+  border-color: var(--color-danger);
+}
+
+.btn-danger:hover {
+  background: var(--color-danger-hover);
+  border-color: var(--color-danger-hover);
+}
+
+.btn-block {
+  width: 100%;
+  display: block;
+}
+
+/* Annotation list */
+.annotations-list {
+  display: flex;
+  flex-direction: column;
+  gap: 0.75rem;
+}
+
+.annotation-card {
+  background: var(--color-surface);
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius);
+  padding: 1rem;
+  box-shadow: var(--shadow);
+}
+
+.annotation-card-header {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  margin-bottom: 0.5rem;
+  flex-wrap: wrap;
+}
+
+.annotation-kind-badge {
+  display: inline-block;
+  padding: 0.125rem 0.5rem;
+  border-radius: 999px;
+  font-size: 0.75rem;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.03em;
+}
+
+.bookmark-badge {
+  background: #dbeafe;
+  color: #1d4ed8;
+}
+
+.note-badge {
+  background: #fef3c7;
+  color: #b45309;
+}
+
+.annotation-book-title {
+  font-weight: 600;
+  font-size: 0.875rem;
+}
+
+.annotation-page {
+  font-size: 0.8125rem;
+  color: var(--color-text-muted);
+}
+
+.annotation-date {
+  font-size: 0.75rem;
+  color: var(--color-text-muted);
+  margin-left: auto;
+}
+
+.annotation-quote {
+  margin: 0.5rem 0;
+  padding: 0.5rem 0.75rem;
+  background: var(--color-quote-bg);
+  border-left: 3px solid var(--color-primary);
+  border-radius: var(--radius-sm);
+  font-style: italic;
+  font-size: 0.875rem;
+  color: var(--color-text-muted);
+}
+
+.note-content-text {
+  font-size: 0.9375rem;
+  line-height: 1.6;
+  margin: 0.5rem 0;
+  white-space: pre-wrap;
+}
+
+.annotation-actions {
+  display: flex;
+  gap: 0.5rem;
+  margin-top: 0.75rem;
+  flex-wrap: wrap;
+}
+
+/* Loading & empty states */
+.annotations-loading,
+.annotations-empty {
+  padding: 2rem;
+  text-align: center;
+  color: var(--color-text-muted);
+  font-size: 0.9375rem;
+}
+
+/* Dashboard summary */
+.annotations-summary {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  margin-bottom: 1rem;
+  font-size: 0.875rem;
+  color: var(--color-text-muted);
+}
+
+.summary-separator {
+  color: var(--color-border);
+}
+
+/* Add annotation modal */
+.add-annotation-overlay {
+  position: fixed;
+  inset: 0;
+  background: rgba(0, 0, 0, 0.4);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  z-index: 100;
+}
+
+.add-annotation-modal {
+  background: var(--color-surface);
+  border-radius: var(--radius);
+  padding: 1.5rem;
+  width: 90%;
+  max-width: 480px;
+  box-shadow: var(--shadow-lg);
+  position: relative;
+}
+
+.modal-close {
+  position: absolute;
+  top: 0.75rem;
+  right: 0.75rem;
+  background: none;
+  border: none;
+  font-size: 1.5rem;
+  cursor: pointer;
+  color: var(--color-text-muted);
+  line-height: 1;
+}
+
+.modal-close:hover {
+  color: var(--color-text);
+}
+
+.add-annotation-modal h3 {
+  font-size: 1.125rem;
+  margin-bottom: 0.75rem;
+}
+
+/* Annotation form */
+.mode-selector {
+  display: flex;
+  gap: 0.75rem;
+  margin-top: 1rem;
+}
+
+.annotation-form {
+  margin-top: 1rem;
+}
+
+.form-group {
+  margin-bottom: 1rem;
+}
+
+.form-group label {
+  display: block;
+  font-size: 0.875rem;
+  font-weight: 500;
+  margin-bottom: 0.375rem;
+}
+
+.form-textarea {
+  width: 100%;
+  padding: 0.625rem;
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-sm);
+  font-family: var(--font);
+  font-size: 0.875rem;
+  resize: vertical;
+}
+
+.form-textarea:focus {
+  outline: 2px solid var(--color-primary);
+  outline-offset: -1px;
+}
+
+.form-error {
+  color: var(--color-danger);
+  font-size: 0.8125rem;
+  margin-bottom: 0.75rem;
+}
+
+.form-actions {
+  display: flex;
+  gap: 0.5rem;
+}
+
+/* Note edit inline */
+.note-edit-form {
+  margin: 0.5rem 0;
+}
+
+.note-edit-textarea {
+  width: 100%;
+  padding: 0.5rem;
+  border: 1px solid var(--color-primary);
+  border-radius: var(--radius-sm);
+  font-family: var(--font);
+  font-size: 0.875rem;
+  resize: vertical;
+}
+
+.note-edit-textarea:focus {
+  outline: none;
+  box-shadow: 0 0 0 2px var(--color-primary);
+}
+
+.note-edit-actions {
+  display: flex;
+  gap: 0.5rem;
+  margin-top: 0.5rem;
+}
+
+/* Responsive */
+@media (max-width: 640px) {
+  .app-header {
+    flex-direction: column;
+    gap: 0.5rem;
+    align-items: flex-start;
+  }
+
+  .annotation-card-header {
+    flex-wrap: wrap;
+  }
+
+  .annotation-date {
+    margin-left: 0;
+  }
+}

frontend/src/types.ts

@@ -1,58 +0,0 @@
-export interface Book {
-  id: number;
-  title: string;
-  author: string;
-  genre: string;
-  description: string;
-  cover_image_url: string;
-  isbn: string;
-  total_pages: number;
-  current_page: number;
-  reading_status: ReadingStatus;
-  reading_progress: number;
-  owner: string;
-  created_at: string;
-  updated_at: string;
-}
-
-export type ReadingStatus = 'not_started' | 'reading' | 'finished' | 'dnf';
-
-export interface BookListResponse {
-  count: number;
-  next: string | null;
-  previous: string | null;
-  results: Book[];
-}
-
-export interface BookStats {
-  total_books: number;
-  finished: number;
-  reading: number;
-  not_started: number;
-}
-
-export interface BookFormData {
-  title: string;
-  author: string;
-  genre: string;
-  description: string;
-  cover_image_url: string;
-  isbn: string;
-  total_pages: number;
-  current_page: number;
-  reading_status: ReadingStatus;
-}
-
-export const READING_STATUS_LABELS: Record<ReadingStatus, string> = {
-  not_started: 'Not Started',
-  reading: 'Reading',
-  finished: 'Finished',
-  dnf: 'Did Not Finish',
-};
-
-export const READING_STATUS_COLORS: Record<ReadingStatus, string> = {
-  not_started: '#6b7280',
-  reading: '#3b82f6',
-  finished: '#22c55e',
-  dnf: '#ef4444',
-};

frontend/src/types/__tests__/types.test.ts

@@ -0,0 +1,10 @@
+import { describe, it, expect } from "vitest";
+
+describe("Annotations types", () => {
+  it("validates AnnotationKind union type", () => {
+    const bookmark: "bookmark" = "bookmark";
+    const note: "note" = "note";
+    expect(bookmark).toBe("bookmark");
+    expect(note).toBe("note");
+  });
+});

frontend/src/types/index.ts

@@ -0,0 +1,95 @@
+/** Core domain types for Cloud Reader */
+
+export interface User {
+  id: number;
+  email: string;
+  username: string;
+}
+
+export interface Book {
+  id: string;
+  title: string;
+  author: string;
+  total_pages: number;
+  cover_image: string;
+  created_at: string;
+  updated_at: string;
+}
+
+export interface BookSummary {
+  id: string;
+  title: string;
+  author: string;
+  total_pages: number;
+  cover_image: string;
+}
+
+export interface Bookmark {
+  id: string;
+  book: string;
+  book_title: string;
+  page: number;
+  location_text: string;
+  created_at: string;
+  updated_at: string;
+}
+
+export interface Note {
+  id: string;
+  book: string;
+  book_title: string;
+  page: number;
+  location_text: string;
+  content: string;
+  created_at: string;
+  updated_at: string;
+}
+
+/** Payload for creating a new bookmark */
+export interface CreateBookmarkPayload {
+  book: string;
+  page: number;
+  location_text?: string;
+}
+
+/** Payload for creating a new note */
+export interface CreateNotePayload {
+  book: string;
+  page: number;
+  location_text?: string;
+  content: string;
+}
+
+/** Payload for updating a note (only content is mutable) */
+export interface UpdateNotePayload {
+  content: string;
+}
+
+/** Paginated API response shape */
+export interface PaginatedResponse<T> {
+  count: number;
+  next: string | null;
+  previous: string | null;
+  results: T[];
+}
+
+/** Auth token response */
+export interface TokenResponse {
+  access: string;
+  refresh: string;
+}
+
+/** Unified annotation type for the combined list view */
+export type AnnotationKind = "bookmark" | "note";
+
+export interface AnnotationEntry {
+  id: string;
+  kind: AnnotationKind;
+  book_title: string;
+  book_id: string;
+  page: number;
+  location_text: string;
+  content?: string; // notes only
+  created_at: string;
+  updated_at: string;
+}