Publish & Compliance Microservice (PDF + TSA + S3)

Overview

--NOTE :The Document Template Pack (Cover.pdf, HeaderFooter.json, fonts, and styles) will be provided by us; the microservice must only consume it and apply it dynamically when generating documents.--

We are looking for an experienced backend developer to build a stateless microservice for document publication and compliance stamping.
The service must generate official PDFs with cover + header/footer, compute SHA-256, embed an RFC 3161 TimeStamp Token (PAdES DocTimeStamp), and upload results to AWS S3 (SSE-KMS + Object Lock).

The service will be invoked only server-to-server (no user-facing UI).
All inputs/outputs are JSON + PDFs.

Scope of Work
• Implement REST API (OpenAPI 3) with the following features:
1. Start publication job:
• Merge body PDF/DOCX with Cover (provided template).
• Apply header/footer stamping (code, version, classification, page X of Y, etc.).
• Compute SHA-256.
• Call TSA (RFC 3161) and embed PAdES DocTimeStamp.
• Upload final PDF to S3 (SSE-KMS, Object Lock if enabled).
• Return job status + outputs (s3Key, sha256, tsa, qrUrl).
2. Issue checklist PDF:
• Generate lightweight official PDF from structured JSON answers.
• Stamp header/footer, hash, optional TSA, upload to S3.
3. Audit Pack generation:
• Concatenate final doc + checklists into a single PDF.
4. Verification JSON endpoint:
• Return published doc metadata (code, version, sha256, tsa, s3Key).
• No database: fully stateless service, Materio backend persists references.
• Server-to-server security: Auth via API key or JWT or mTLS (configurable).
• Idempotency: requests must be idempotent with Idempotency-Key.
• Logging/metrics: structured logs + timing metrics for TSA/S3 stages.
• Error handling: full HTTP model (400, 401, 422, 5xx, etc.).

Deliverables
• Source code + Dockerfile (ready for Kubernetes/EKS).
• OpenAPI 3 spec (YAML/JSON).
• Postman collection (happy path + error cases).
• Unit + integration tests (TSA mock, S3 mock).
• Sample outputs (PDF with cover/header/footer, TSA, checklist, audit pack).
• README with env config (.env.example, setup, run, TLS, TSA).

Technical Guidelines
• Language: Java (preferred, for PAdES maturity) or Node.js with Java sidecar for TSA.
• PDF libs: Apache PDFBox, EU DSS (for PAdES + RFC3161).
• QR: ZXing or equivalent.
• DOCX→PDF/A conversion: LibreOffice headless (if body is DOCX).
• Container: Docker (slim/distroless).
• Cloud: AWS SDK (S3, SSE-KMS, versioning, Object Lock).

Non-Functional Requirements
• Performance: p95 ≤ 7s per job (typical 2–5 MB PDFs).
• Concurrency: ≥ 50 jobs in parallel.
• Availability target: 99.9% (infra provided).
• Security: TLS 1.2+, no secrets in logs, safe error handling.
• Languages supported: EN / ES (for stamped labels).

Timeline
• Estimated delivery: 2 weeks
• Week 1: Skeleton + S3 + stamping basics, TSA integration + final PDF + checklist.
• Week 2: Audit pack + verification + tests/docs.

Skills Required
• Strong backend development (Java/Node.js).
• Experience with PDF manipulation (stamping, merging, PAdES).
• Familiarity with RFC 3161 TSA and digital signatures.
• AWS S3 SDK (SSE-KMS, Object Lock).
• Docker, OpenAPI 3, REST design.