# WSPL EduTech LMS --- Complete Technical & Logical Flow Blueprint **Document Type:** Technical + Logical Architecture Blueprint\ **Purpose:** Production-grade architecture reference for the WSPL EduTech / LMS platform.\ **Reference:** Rocket LMS --- Learning Management System (CodeCanyon item 33120735).\ **Reference reviewed:** current CodeCanyon product information, including the documented role model, course/content system, organizational education, commerce, learning, assessment, certification, live learning, analytics, community, SaaS and plugin ecosystem. ------------------------------------------------------------------------ ## 1. Executive Summary A serious LMS is not simply: `Login → Course → Video → Certificate` It is an interconnected education and business platform: ``` text IDENTITY ↓ ROLES & PERMISSIONS ↓ USERS / ORGANIZATIONS ↓ COURSE CATALOG ↓ COMMERCE / ASSIGNMENT ↓ ENTITLEMENT ↓ ENROLLMENT ↓ LEARNING ↓ ASSESSMENT ↓ COMPLETION ↓ CERTIFICATION ↓ ANALYTICS ↓ COMMUNICATION ↓ ADMINISTRATION ``` WSPL should use Rocket LMS as a **reference for breadth**, not as a specification to clone. The architecture below separates the platform into stable domains so future modules can be added without rewriting the learning core. ------------------------------------------------------------------------ # 2. Product Vision WSPL EduTech should eventually support: ``` text WSPL EDUTECH | +----------------+----------------+ | | | B2C LMS B2B LMS SaaS LMS | | | Students Institutions Tenant LMS Instructors Companies Colleges Courses Departments Training Marketplace Cohorts Centers ``` The same core learning engine should power all three. ------------------------------------------------------------------------ # 3. Primary Actors ## Student / Learner - Discover courses - View course details - Purchase or enroll - Consume content - Complete quizzes - Submit assignments - Attend live sessions - Track progress - Earn certificates - Participate in discussions - Book instructors - Manage subscriptions - Review courses ## Instructor - Create profile - Submit instructor application - Create courses - Build curriculum - Upload content - Create assessments - Conduct live sessions - Grade assignments - Communicate with learners - Monitor analytics - Manage meetings - View earnings ## Organization Examples: college, school, training institute, corporate, NGO/CSR program, enterprise learning department. Responsibilities: - Manage learners - Manage instructors - Create departments - Create cohorts - Assign courses - Monitor completion - Track attendance - View reports - Manage institutional billing ## Admin / Staff Admin controls the platform. Staff should receive granular permissions rather than unrestricted administrator access. Example staff roles: ``` text Content Manager Finance Manager Support Agent Marketing Manager Operations Manager Organization Manager Assessment Manager ``` ------------------------------------------------------------------------ # 4. High-Level System Architecture ``` text PUBLIC WEBSITE | React / Inertia | +------------+------------+ | | LEARNER UI ADMIN UI | | INSTRUCTOR UI STAFF UI | | ORGANIZATION UI | | | +------------+------------+ | APPLICATION | API / ROUTES | DOMAIN SERVICES | +----------------------+----------------------+ | | | | | IDENTITY LEARNING COMMERCE CONTENT ORGANIZATION | | | | | +----------------------+----------------------+ | EVENTS | QUEUES | +---------------------+----------------------+ | | | NOTIFICATIONS ANALYTICS INTEGRATIONS | | | Email/SMS/Push Reports/Dashboards Payment/Video/Storage ``` ------------------------------------------------------------------------ # 5. Recommended Technical Stack Recommended to remain aligned with WSPL's existing development direction: ### Backend - Laravel - PHP 8.x - MySQL 8.4 LTS for production - Redis - Queue workers - Events / listeners - Notifications - Scheduler ### Frontend - React - Inertia.js - TypeScript - Tailwind CSS - Vite ### Infrastructure ``` text Nginx ↓ PHP-FPM ↓ Laravel ↓ MySQL + Redis + Queue Worker + Scheduler ``` For scale: ``` text Load Balancer ↓ Application Servers ↓ Database ↓ Redis ↓ Object Storage ↓ CDN ``` ------------------------------------------------------------------------ # 6. Domain Architecture ## Core Domains ``` text 01 Identity & Access 02 User Management 03 Organization Management 04 Course Catalog 05 Curriculum & Content 06 Enrollment 07 Learning Progress 08 Assessment 09 Assignment 10 Certification 11 Live Learning 12 Commerce 13 Subscription 14 Notification 15 Communication 16 Support 17 Community 18 Analytics 19 Administration 20 Audit & Security ``` ## Optional Expansion Domains ``` text 21 Marketplace 22 Affiliate 23 Rewards 24 SaaS 25 Tutor Finder 26 Events 27 Job Board 28 Store 29 AI 30 Mobile ``` ------------------------------------------------------------------------ # 7. Identity and Authentication Flow ``` text USER | +--> Email / Password +--> Google / Social Login +--> Phone / OTP | ↓ IDENTITY VERIFICATION ↓ USER ACCOUNT ↓ ROLE RESOLUTION | +--> Student +--> Instructor +--> Organization +--> Staff +--> Admin | ↓ PERMISSION RESOLUTION ↓ DASHBOARD ``` Authentication and authorization are separate: ``` text Authentication = Who are you? Authorization = What can you do? ``` ------------------------------------------------------------------------ # 8. RBAC Architecture ``` text User ↓ Roles ↓ Permissions ``` Example: ``` text Instructor | +--> course.create +--> course.update +--> course.submit +--> student.view +--> assignment.grade +--> analytics.view ``` Authorization should also verify resource ownership and tenant scope. ``` text Request ↓ Authenticated? ↓ Role? ↓ Permission? ↓ Resource / Tenant Scope? ↓ ALLOW / DENY ``` Never rely only on hiding frontend routes. ------------------------------------------------------------------------ # 9. Organization / Multi-Tenant Model If WSPL intends to sell LMS instances to institutions, tenancy should be considered early. ``` text WSPL PLATFORM | +--> Tenant A | +--> Admin | +--> Departments | +--> Instructors | +--> Learners | +--> Courses | +--> Tenant B | +--> Admin | +--> Departments | +--> Learners | +--> Tenant C ``` Recommended initial strategy: - shared database - strict `organization_id` scoping - centralized authorization policies - tenant-aware services - architecture compatible with future database isolation ------------------------------------------------------------------------ # 10. Organization Hierarchy ``` text Organization | +--> Departments | +--> Staff | +--> Learners | +--> Instructors +--> Cohorts +--> Learning Paths +--> Courses +--> Assessments +--> Reports ``` Example: ``` text ABC College | +--> Computer Science | +--> 2026 Batch | +--> 2027 Batch | +--> Mechanical | +--> Electronics ``` ------------------------------------------------------------------------ # 11. Course Domain Treat Course as a business aggregate: ``` text Course | +--> Basic Information +--> Category +--> Instructor(s) +--> Pricing +--> Curriculum +--> Requirements +--> Learning Outcomes +--> Media +--> Assessments +--> Certificate Rules +--> Access Rules +--> Capacity +--> Reviews +--> Analytics ``` Course lifecycle: ``` text DRAFT ↓ IN_REVIEW ↓ APPROVED ↓ PUBLISHED ↓ ACTIVE ↓ ARCHIVED ``` Rejection: ``` text IN_REVIEW → REJECTED → DRAFT ``` ------------------------------------------------------------------------ # 12. Course Creation Flow ``` text Instructor ↓ Create Course ↓ Basic Information ↓ Pricing ↓ Thumbnail / Media ↓ Curriculum ↓ Content ↓ Requirements ↓ Outcomes ↓ Assessment ↓ Certificate ↓ Preview ↓ Validation ↓ Submit for Review ↓ Admin Approval ↓ Publish ``` Pre-publish validation should check: ``` text Title Description Category Instructor At least one section Required content Pricing Media Assessment configuration Certificate configuration ``` ------------------------------------------------------------------------ # 13. Curriculum and Content Architecture Recommended hierarchy: ``` text Course | +--> Section / Chapter | +--> Lesson +--> Video +--> Text +--> PDF +--> Quiz +--> Assignment +--> SCORM +--> Live Session ``` Use an extensible content model: ``` text course_contents id course_id section_id content_type title description position status visibility duration completion_rule created_at updated_at ``` Do not hard-code every content type into the course record. ------------------------------------------------------------------------ # 14. Content Types ## Video ``` text Video | +--> Upload +--> External URL +--> YouTube +--> Vimeo +--> S3 +--> Secure Streaming ``` ## Text ``` text Text Lesson | +--> Rich Text +--> Images +--> Attachments ``` ## PDF ``` text PDF | +--> File +--> Viewer +--> Access Policy ``` ## Quiz ``` text Quiz | +--> Questions +--> Rules +--> Attempts ``` ## Assignment ``` text Assignment | +--> Instructions +--> Deadline +--> Submission +--> Grading ``` ## Live Session ``` text Live Session | +--> Provider +--> Date +--> Time +--> Capacity +--> Attendance +--> Recording ``` ------------------------------------------------------------------------ # 15. Enrollment Architecture Enrollment must be its own domain. Possible sources: ``` text FREE ENROLLMENT PAID PURCHASE SUBSCRIPTION MANUAL ENROLLMENT ORGANIZATION ASSIGNMENT BUNDLE GIFT PROMOTION ``` Flow: ``` text Enrollment Request ↓ Eligibility Check ↓ Access Rule Check ↓ Capacity Check ↓ Payment Required? | +--> YES → Checkout → Payment | +--> NO | ↓ Enrollment Created ↓ Entitlement Created ↓ Access Granted ``` ------------------------------------------------------------------------ # 16. Critical Payment-to-Access Architecture Never make payment success directly equal course access. Use: ``` text Payment ↓ Payment Verification ↓ Order Confirmation ↓ Entitlement ↓ Enrollment ↓ Access ``` Recommended relationship: ``` text User ↓ Order ↓ Order Item ↓ Product / Course ↓ Payment ↓ Entitlement ↓ Enrollment ``` This supports bundles, subscriptions, gifts, refunds, partial payments, organization purchases and future product types. ------------------------------------------------------------------------ # 17. Commerce Flow ``` text COURSE ↓ COURSE DETAILS ↓ ADD TO CART ↓ CART ↓ COUPON ↓ TAX ↓ CHECKOUT ↓ ORDER CREATED ↓ PAYMENT INITIATED ↓ GATEWAY | +--> SUCCESS | ↓ | VERIFY | ↓ | CAPTURE / CONFIRM | ↓ | ORDER CONFIRMED | ↓ | ENTITLEMENT | ↓ | ENROLLMENT | +--> FAILED | +--> PENDING ``` Payment states: ``` text CREATED ↓ INITIATED ↓ PENDING | +--> SUCCESS → VERIFIED → CAPTURED +--> FAILED +--> CANCELLED ``` Webhook handling must be idempotent. ------------------------------------------------------------------------ # 18. Entitlement Engine Entitlement answers: > What resource is this user currently authorized to access? ``` text User + Product / Course + Purchase / Subscription / Assignment ↓ ENTITLEMENT ``` Suggested fields: ``` text id user_id resource_type resource_id source_type source_id starts_at expires_at status ``` Example: ``` text Student Course: Laravel Masterclass Source: Order #10023 Starts: 2026-09-01 Expires: 2027-09-01 Status: ACTIVE ``` ------------------------------------------------------------------------ # 19. Learning Engine ``` text Enrollment ↓ Learning Access ↓ Course Player ↓ Section ↓ Content ↓ Progress ↓ Completion Rule ↓ Next Content ``` Learning progress must be separate from course structure. Suggested table: ``` text content_progress id user_id course_id content_id status started_at completed_at progress_percent last_position time_spent attempt_count ``` ------------------------------------------------------------------------ # 20. Learning Access Policy Every protected content request should pass through an access policy. ``` text Learner Requests Content ↓ Authenticated? ↓ Enrollment Active? ↓ Course Published? ↓ Content Published? ↓ Access Period Valid? ↓ Drip Rule Satisfied? ↓ Previous Content Completed? ↓ ALLOW / DENY ``` This is the security boundary of the learning player. ------------------------------------------------------------------------ # 21. Drip Content Supported models: ``` text Immediate After X Days After Previous Lesson Specific Date Sequential Unlock ``` Example: ``` text Enrollment Day 0 → Module 1 Day 3 → Module 2 Module 1 complete → Module 3 ``` The UI should tell the learner why a locked lesson is unavailable. ------------------------------------------------------------------------ # 22. Secure Video Flow Protected videos should not be exposed through permanent public URLs. ``` text Learner ↓ Authorized Request ↓ AccessControlService ↓ Short-Lived Token / Signed URL ↓ Video Provider / Object Storage ↓ Player ``` Possible protections: - signed URLs - expiry - watermarking - session/device limits - download restrictions - access logging - provider-level restrictions ------------------------------------------------------------------------ # 23. Assessment Engine Assessment is a separate domain: ``` text Assessment | +--> Question Bank +--> Questions +--> Options +--> Rules +--> Attempts +--> Answers +--> Evaluation +--> Result ``` Quiz flow: ``` text Start Quiz ↓ Create Attempt ↓ Load Questions ↓ Save Answers ↓ Submit ↓ Evaluation Engine ↓ Calculate Score ↓ Apply Pass Rule ↓ Result ↓ Update Learning Progress ``` Example: ``` text Questions = 20 Correct = 16 Score = 80% Pass Mark = 70% Result = PASSED ``` ------------------------------------------------------------------------ # 24. Question Bank Support: - random questions - sequential questions - categories - difficulty - multiple question types - negative marking - time limits - attempt limits Example: ``` text Question Bank | +--> JavaScript | +--> Easy | +--> Medium | +--> Hard | +--> React +--> Easy +--> Medium ``` Quiz rule: ``` text 10 random questions Category = React Difficulty = Medium ``` ------------------------------------------------------------------------ # 25. Assignment Engine ``` text Instructor ↓ Create Assignment ↓ Set Deadline ↓ Publish ↓ Student Receives ↓ Student Submits ↓ Submission Stored ↓ Instructor Reviews ↓ Grade ↓ Pass / Fail ↓ Progress Updated ``` Assignment states: ``` text DRAFT PUBLISHED OPEN SUBMITTED UNDER_REVIEW GRADED LATE RESUBMISSION_REQUIRED ``` ------------------------------------------------------------------------ # 26. Certification Engine Certificate issuance should be rule-based: ``` text Course Completed + Quiz Passed + Assignment Passed + Attendance Requirement + Other Conditions ↓ ELIGIBLE ↓ Generate Certificate ↓ Unique Certificate ID ↓ QR / Verification ↓ ISSUED ``` Verification: ``` text Public User ↓ /verify/{certificate_number} ↓ Certificate Lookup ↓ Valid? ├--> YES → Certificate details └--> NO → Invalid / Revoked ``` ------------------------------------------------------------------------ # 27. Live Learning ``` text Instructor ↓ Create Live Session ↓ Select Course ↓ Set Date / Time ↓ Select Provider ↓ Set Capacity ↓ Publish ↓ Notify Learners ↓ Reminder ↓ Join ↓ Attendance ↓ Session Complete ↓ Recording / Materials ``` Use a provider adapter: ``` text LiveProviderInterface | +--> ZoomProvider +--> JitsiProvider +--> InAppProvider ``` ------------------------------------------------------------------------ # 28. Meeting Booking Separate 1-to-1/group bookings from scheduled course sessions. ``` text Instructor ↓ Define Availability ↓ Meeting Type ↓ Duration ↓ Price ↓ Available Slots ↓ Student Selects ↓ Checkout ↓ Booking ↓ Calendar Event ↓ Reminder ↓ Meeting ↓ Completion ``` ------------------------------------------------------------------------ # 29. Learning Path Learning paths sit above individual courses: ``` text Learning Path | +--> Course 1 +--> Course 2 +--> Course 3 +--> Assessment +--> Certificate ``` Sequential rule: ``` text Course 1 completed ↓ Course 2 unlocks ↓ Course 2 completed ↓ Course 3 unlocks ``` ------------------------------------------------------------------------ # 30. Student Dashboard ``` text Dashboard | +--> Continue Learning +--> Active Courses +--> Completed Courses +--> Progress +--> Upcoming Live Sessions +--> Assignments +--> Quiz Results +--> Certificates +--> Wishlist +--> Orders +--> Subscriptions +--> Notifications +--> Messages +--> Support +--> Profile ``` Primary learner journey: ``` text DISCOVER → EVALUATE → ENROLL → LEARN → PRACTICE → ASSESS → COMPLETE → CERTIFY → CONTINUE ``` ------------------------------------------------------------------------ # 31. Instructor Dashboard ``` text Dashboard | +--> Course Overview +--> Draft Courses +--> Published Courses +--> Students +--> Assignments +--> Quizzes +--> Live Classes +--> Meetings +--> Messages +--> Reviews +--> Earnings +--> Analytics +--> Payouts +--> Profile ``` Instructor lifecycle: ``` text Apply ↓ Approval ↓ Instructor Account ↓ Create Course ↓ Submit ↓ Review ↓ Publish ↓ Teach ↓ Grade ↓ Analyze ↓ Earn / Payout ``` ------------------------------------------------------------------------ # 32. Organization Dashboard ``` text Overview | +--> Learners +--> Instructors +--> Departments +--> Cohorts +--> Courses +--> Learning Paths +--> Enrollment +--> Attendance +--> Assessments +--> Certificates +--> Reports +--> Billing +--> Settings ``` Key metrics: ``` text Total Learners Active Learners Course Completion Rate Average Score Attendance Certificate Rate Learning Hours Department Performance Cohort Performance ``` ------------------------------------------------------------------------ # 33. Admin Control Plane ``` text ADMIN | +--> Dashboard +--> Users +--> Staff +--> Roles +--> Permissions +--> Organizations +--> Instructors +--> Courses +--> Categories +--> Content +--> Approvals +--> Orders +--> Payments +--> Refunds +--> Payouts +--> Coupons +--> Subscriptions +--> Reports +--> Analytics +--> Notifications +--> Support +--> Integrations +--> Settings +--> Security +--> Audit Logs ``` ------------------------------------------------------------------------ # 34. Notification Architecture Do not send notifications directly from controllers. Use: ``` text BUSINESS EVENT ↓ NOTIFICATION SERVICE ↓ TEMPLATE ↓ CHANNEL ``` Channels: ``` text In-App Email SMS Push WhatsApp (future) ``` Events: ``` text UserRegistered InstructorApproved CoursePublished EnrollmentCreated PaymentSucceeded PaymentFailed AssignmentSubmitted AssignmentGraded QuizCompleted CourseCompleted CertificateIssued LiveSessionScheduled LiveSessionReminderDue SubscriptionExpiring SubscriptionExpired ``` ------------------------------------------------------------------------ # 35. Event-Driven Backbone Example: ``` text PaymentSucceeded ↓ OrderConfirmed ↓ EntitlementGranted ↓ EnrollmentCreated ↓ EnrollmentNotification ↓ AnalyticsEvent ``` Course completion: ``` text CourseCompleted ↓ CheckCertificateEligibility ↓ CertificateIssued ↓ NotifyLearner ↓ UpdateAnalytics ``` Live class: ``` text LiveSessionScheduled ↓ Notification ↓ ReminderJob ↓ SessionStarted ↓ Attendance ↓ SessionCompleted ``` ------------------------------------------------------------------------ # 36. Queue Architecture Long-running tasks should not block HTTP requests. ``` text HTTP REQUEST ↓ TRANSACTION ↓ EVENT ↓ QUEUE | +--> Email +--> SMS +--> Certificate PDF +--> Video Processing +--> Analytics +--> Reports +--> Imports +--> Reminder Jobs ``` Suggested Redis queues: ``` text default notifications media analytics reports ``` ------------------------------------------------------------------------ # 37. Analytics Architecture Use event-driven analytics rather than calculating every dashboard metric from transactional tables. ``` text Learning Event ↓ Event Store / Queue ↓ Analytics Processor ↓ Aggregates ↓ Dashboard ``` Events: ``` text CourseViewed LessonStarted LessonCompleted VideoProgressed QuizStarted QuizCompleted AssignmentSubmitted CourseCompleted CertificateIssued LiveSessionJoined ``` Analytics levels: ``` text Learner Instructor Course Organization Platform ``` ------------------------------------------------------------------------ # 38. Communication Architecture ``` text COMMUNICATION | +--> Notifications +--> Chat +--> Course Discussion +--> Community Forum +--> Support Tickets +--> Announcements +--> Noticeboard ``` Course discussion: ``` text Course ↓ Question ↓ Reply ↓ Resolved ``` ------------------------------------------------------------------------ # 39. Support Ticket System Recommended lifecycle: ``` text OPEN ↓ ASSIGNED ↓ IN_PROGRESS ↓ WAITING_FOR_CUSTOMER ↓ RESOLVED ↓ CLOSED ``` Entities: ``` text Ticket TicketMessage Attachment Assignee Category Priority Status SLA ``` ------------------------------------------------------------------------ # 40. Subscription Architecture ``` text Subscription Plan | +--> Price +--> Duration +--> Included Courses +--> Feature Limits +--> Access Rules ``` Lifecycle: ``` text CREATED ↓ PENDING ↓ ACTIVE ↓ RENEWING ↓ EXPIRING ↓ EXPIRED ``` With payment failure: ``` text ACTIVE ↓ PAYMENT_FAILED ↓ GRACE_PERIOD ↓ EXPIRED ``` ------------------------------------------------------------------------ # 41. Bundle Architecture ``` text Bundle | +--> Course A +--> Course B +--> Course C ``` Purchase: ``` text Bundle Purchase ↓ Order ↓ Entitlement ↓ Course Entitlements ↓ Enrollments ``` ------------------------------------------------------------------------ # 42. Coupon / Promotion Architecture Promotions must be server-authoritative. ``` text Cart ↓ Promotion Engine ↓ Eligibility ↓ Discount Calculation ↓ Final Total ``` Never trust frontend-submitted: ``` text discount_amount subtotal final_total ``` The backend must calculate them. ------------------------------------------------------------------------ # 43. Affiliate Architecture ``` text Affiliate ↓ Unique Link ↓ Visitor ↓ Course Page ↓ Purchase ↓ Attribution ↓ Commission ↓ Affiliate Balance ↓ Payout ``` Suggested entities: ``` text affiliate_accounts affiliate_links affiliate_clicks affiliate_conversions affiliate_commissions affiliate_payouts ``` ------------------------------------------------------------------------ # 44. Rewards / Gamification ``` text Action ↓ Reward Rule ↓ Points ↓ Wallet ↓ Redeem ``` Example: ``` text Course Completed → 100 points Quiz Passed → 25 points Review Submitted → 10 points Referral → 50 points ``` Badges: ``` text Condition ↓ Badge Evaluation ↓ Badge Award ↓ Profile ``` ------------------------------------------------------------------------ # 45. Marketplace Architecture If multiple sellers are supported: ``` text Platform | +--> Instructor Seller +--> Organization Seller +--> Product Seller ``` Separate: ``` text Seller Product Order OrderItem Commission Payout ``` Do not put seller payout logic directly inside Course logic. ------------------------------------------------------------------------ # 46. SaaS Architecture ``` text WSPL | +--> Plan A | +--> Course Limit | +--> Learner Limit | +--> Storage | +--> Plan B | +--> More Learners | +--> More Courses | +--> Enterprise +--> Custom Limits ``` Tenant provisioning: ``` text Subscription ↓ Tenant Created ↓ Domain / Subdomain ↓ Branding ↓ Admin User ↓ Default Settings ↓ Tenant Active ``` ------------------------------------------------------------------------ # 47. Tutor Finder Matching inputs: ``` text Subject Level Availability Location Meeting Type Price Language Experience Rating ``` Flow: ``` text Student Wizard ↓ Preferences ↓ Matching Engine ↓ Rank Tutors ↓ Results ↓ Book Meeting ``` ------------------------------------------------------------------------ # 48. AI Layer AI should be a separate service boundary. Potential modules: ``` text AI Course Description AI Lesson Outline AI Quiz Generation AI Question Suggestions AI Learning Assistant AI Recommendation AI Student Risk Detection AI Summarization AI Tutor ``` Architecture: ``` text LMS ↓ AI Service ↓ Provider Adapter | +--> Provider A +--> Provider B ``` ------------------------------------------------------------------------ # 49. File / Media Architecture ``` text Upload ↓ Validation ↓ Media Service ↓ Object Storage ↓ Metadata ↓ Access Policy ``` Suggested metadata: ``` text media_assets id owner_type owner_id storage_disk storage_key mime_type size checksum visibility created_at ``` ------------------------------------------------------------------------ # 50. Audit Architecture Sensitive actions should be auditable: ``` text Course Published Course Price Changed User Role Changed Payment Refunded Certificate Revoked Instructor Approved Organization Created Permission Changed ``` Audit record: ``` text actor_id action resource_type resource_id old_values new_values ip_address user_agent created_at ``` ------------------------------------------------------------------------ # 51. Security Architecture Minimum controls: ``` text Authentication Authorization RBAC Tenant Isolation CSRF Protection XSS Protection SQL Injection Protection Rate Limiting Secure Sessions Password Hashing OTP Protection Webhook Signature Verification Payment Signature Verification Signed Media URLs File Validation Audit Logs Device / Session Management Backups Monitoring ``` Security must be enforced server-side. ------------------------------------------------------------------------ # 52. Device and Session Management ``` text User ↓ Sessions ↓ Devices ↓ Active Session List ``` Features: ``` text View devices Logout device Logout all devices Detect duplicate sessions Configure device limit ``` ------------------------------------------------------------------------ # 53. Database Domain Map Core: ``` text users roles permissions user_roles role_permissions organizations organization_users departments cohorts courses course_categories course_instructors course_sections course_contents enrollments entitlements content_progress assessments questions question_options question_banks quiz_attempts quiz_answers assignments assignment_submissions certificates certificate_templates live_sessions meeting_slots meeting_bookings attendance carts cart_items orders order_items payments refunds coupons subscriptions notifications notification_preferences messages support_tickets support_ticket_messages forums forum_topics forum_posts reviews ratings analytics_events analytics_daily media_assets audit_logs ``` Expansion: ``` text bundles bundle_courses affiliate_accounts affiliate_links affiliate_clicks affiliate_commissions affiliate_payouts reward_accounts reward_transactions badges user_badges saas_plans tenant_subscriptions events event_bookings job_posts job_applications ``` ------------------------------------------------------------------------ # 54. API Organization Suggested: ``` text /api/v1/auth/* /api/v1/users/* /api/v1/courses/* /api/v1/catalog/* /api/v1/enrollments/* /api/v1/learning/* /api/v1/assessments/* /api/v1/assignments/* /api/v1/certificates/* /api/v1/live/* /api/v1/meetings/* /api/v1/cart/* /api/v1/checkout/* /api/v1/orders/* /api/v1/payments/* /api/v1/subscriptions/* /api/v1/organizations/* /api/v1/notifications/* /api/v1/messages/* /api/v1/support/* /api/v1/analytics/* ``` Admin: ``` text /admin/users/* /admin/courses/* /admin/organizations/* /admin/orders/* /admin/payments/* /admin/reports/* /admin/settings/* ``` ------------------------------------------------------------------------ # 55. Service Layer Recommended services: ``` text AuthenticationService AuthorizationService UserService OrganizationService DepartmentService CohortService CourseService CoursePublishingService CurriculumService ContentService EnrollmentService EntitlementService AccessControlService LearningProgressService AssessmentService QuizEvaluationService AssignmentService CertificateService LiveSessionService MeetingBookingService AttendanceService CartService CheckoutService OrderService PaymentService RefundService CouponService SubscriptionService BundleService NotificationService MessagingService SupportService CommunityService AnalyticsService ReportingService MediaService VideoAccessService AffiliateService RewardService AuditLogService ``` ------------------------------------------------------------------------ # 56. Transaction Boundaries Critical operations should be transactional. Example: ``` text Order Confirmation | +--> update order +--> update payment +--> create entitlement +--> create enrollment +--> emit event ``` Side effects such as emails should be dispatched after successful commit. ------------------------------------------------------------------------ # 57. Idempotency Critical operations must be safe to repeat: ``` text Payment webhook Enrollment creation Certificate issuance Notification dispatch Refund processing ``` Pattern: ``` text Request ↓ Idempotency Key ↓ Already Processed? | +--> YES → Return previous result | +--> NO → Process ``` ------------------------------------------------------------------------ # 58. State Machines Important state machines: ``` text Course Enrollment Payment Order Subscription Assignment Quiz Attempt Certificate Support Ticket Live Session Booking Payout ``` Example enrollment: ``` text PENDING ↓ ACTIVE ↓ COMPLETED ``` Extended: ``` text PENDING ↓ ACTIVE ↓ SUSPENDED ↓ ACTIVE ↓ EXPIRED ``` ------------------------------------------------------------------------ # 59. Frontend Information Architecture ## Public ``` text / /courses /courses/{slug} /categories/{slug} /instructors /instructors/{slug} /organizations /pricing /events /blog /about /contact ``` ## Learner ``` text /dashboard /my-learning /course/{course}/learn /assignments /quizzes /certificates /orders /subscriptions /messages /notifications /support /profile ``` ## Instructor ``` text /instructor/dashboard /instructor/courses /instructor/courses/create /instructor/courses/{id}/edit /instructor/students /instructor/assignments /instructor/live /instructor/meetings /instructor/analytics /instructor/earnings ``` ## Organization ``` text /organization/dashboard /organization/learners /organization/instructors /organization/departments /organization/cohorts /organization/courses /organization/learning-paths /organization/reports /organization/billing ``` ## Admin ``` text /admin /admin/users /admin/instructors /admin/organizations /admin/courses /admin/approvals /admin/orders /admin/payments /admin/reports /admin/settings /admin/security /admin/audit ``` ------------------------------------------------------------------------ # 60. UX Principles ## Learner Prioritize: ``` text Continue Learning Upcoming Session Current Progress Next Action ``` ## Instructor Prioritize: ``` text What needs my action? Which students need attention? Which assignments need grading? How are my courses performing? ``` ## Organization Prioritize: ``` text Who is learning? Who is falling behind? Which department performs best? What has been completed? ``` ## Admin Prioritize: ``` text What requires intervention? Revenue Users Approvals System Health Security ``` Every dashboard widget should answer: ``` text WHAT? WHY? ACTION? ``` ------------------------------------------------------------------------ # 61. Search and Recommendation Search progression: ``` text Phase 1 → Database search Phase 2 → Full-text search Phase 3 → Dedicated search engine ``` Possible engines: ``` text Meilisearch OpenSearch Elasticsearch ``` Recommendation should start rule-based: ``` text Category Match + Level Match + Interest Match + Previous Learning + Popularity + Rating ``` Later: ``` text Events ↓ Feature Store ↓ ML Model ↓ Ranking ``` ------------------------------------------------------------------------ # 62. Reporting Architecture Report groups: ``` text Learner Reports Instructor Reports Organization Reports Financial Reports Course Reports Platform Reports ``` Exports: ``` text CSV Excel PDF ``` Large reports should be asynchronous: ``` text Report Request ↓ Queue ↓ Generate ↓ Store ↓ Notify ↓ Download ``` ------------------------------------------------------------------------ # 63. Localization and Accessibility Support from the beginning: ``` text Languages Currencies Date Formats Time Zones Number Formats RTL ``` Content localization: ``` text Course | +--> English +--> Tamil +--> Hindi +--> Arabic ``` Accessibility: - keyboard navigation - semantic HTML - visible focus - accessible forms - captions - transcripts - sufficient contrast - screen-reader support - reduced-motion consideration ------------------------------------------------------------------------ # 64. SEO Public course pages should support: ``` text Title Description Canonical URL Open Graph Social metadata Structured Data ``` Course structured data should only contain truthful, supported values. ------------------------------------------------------------------------ # 65. Performance Frontend: ``` text Code Splitting Lazy Loading Image Optimization Caching Pagination Virtualized Lists ``` Backend: ``` text Database Indexing Query Optimization Caching Queues CDN Object Storage ``` Avoid: ``` text N+1 queries Huge API payloads Unbounded lists Synchronous PDF generation Synchronous video processing ``` ------------------------------------------------------------------------ # 66. Observability Production monitoring should cover: ``` text Application Logs Error Tracking Queue Monitoring Database Monitoring API Latency Payment Monitoring Webhook Monitoring Storage Monitoring Security Events ``` Alert examples: ``` text Payment failures spike Queue backlog Database connection failure Storage failure Webhook failure Authentication anomaly High API latency ``` ------------------------------------------------------------------------ # 67. Backup and Disaster Recovery Minimum: ``` text Database Backup Object Storage Versioning Configuration Backup Secret Management Strategy Audit Retention ``` Define: ``` text RPO = Recovery Point Objective RTO = Recovery Time Objective ``` ------------------------------------------------------------------------ # 68. Testing Strategy ## Unit Tests Test: ``` text Enrollment rules Access rules Discount calculations Quiz evaluation Certificate eligibility Subscription rules Commission calculations ``` ## Feature Tests ``` text Registration Course creation Purchase Payment Enrollment Learning Quiz Assignment Certificate Organization assignment ``` ## Integration Tests ``` text Payment Gateway Video Provider Email SMS Storage Calendar ``` ## End-to-End ``` text Register ↓ Browse ↓ Purchase ↓ Payment ↓ Enroll ↓ Learn ↓ Quiz ↓ Complete ↓ Certificate ``` ------------------------------------------------------------------------ # 69. Security Testing Required: ``` text Authorization tests Tenant isolation tests Webhook replay tests Payment tampering tests IDOR tests Rate-limit tests File upload tests Session tests Privilege escalation tests ``` Example: ``` text Student A ↓ Requests Course B content ↓ Authorization ↓ DENY ``` ------------------------------------------------------------------------ # 70. Development Phases ## Phase 0 --- Architecture ``` text BRD Domain Map ERD Permission Matrix State Machines API Contract Security Model ``` ## Phase 1 --- Foundation ``` text Authentication Users Roles Permissions Admin Organizations ``` ## Phase 2 --- Course Core ``` text Categories Courses Sections Content Course Publishing Instructor ``` ## Phase 3 --- Learning ``` text Enrollment Entitlements Learning Player Progress Drip Access Rules ``` ## Phase 4 --- Assessment ``` text Quiz Question Bank Assignments Grades Results ``` ## Phase 5 --- Certification ``` text Certificate Templates Eligibility Generation Verification Revocation ``` ## Phase 6 --- Commerce ``` text Cart Checkout Orders Payments Coupons Refunds Subscriptions ``` ## Phase 7 --- Live Learning ``` text Live Sessions Meetings Attendance Calendar Recordings ``` ## Phase 8 --- Organization LMS ``` text Departments Cohorts Learning Paths Bulk Enrollment Reports ``` ## Phase 9 --- Communication ``` text Notifications Chat Support Forums Announcements ``` ## Phase 10 --- Analytics ``` text Learner Analytics Course Analytics Instructor Analytics Organization Analytics Admin Reports ``` ## Phase 11 --- Expansion ``` text Marketplace Affiliate Rewards SaaS Tutor Finder Events AI Job Board Mobile ``` ------------------------------------------------------------------------ # 71. MVP Recommendation Do not build every feature in the first release. ## MVP ``` text Authentication Roles Users Instructor Admin Courses Curriculum Video Enrollment Learning Progress Quiz Certificate Basic Payments Notifications Basic Analytics ``` ## Version 1.1 ``` text Assignments Organizations Cohorts Live Classes Meetings Support Course Forum ``` ## Version 1.2 ``` text Subscriptions Bundles Coupons Advanced Analytics Attendance Drip Question Bank ``` ## Version 2 ``` text Marketplace Affiliate Rewards SaaS Tutor Finder AI Events Job Board Mobile ``` ------------------------------------------------------------------------ # 72. Complete Learner Journey ``` text DISCOVER ↓ Browse Courses ↓ Course Details ↓ +---------+---------+ | | FREE PAID | | ↓ ↓ ENROLL CART ↓ CHECKOUT ↓ PAYMENT ↓ VERIFICATION ↓ ORDER CONFIRMED ↓ ENTITLEMENT ↓ ENROLLMENT +-------------------+ | ↓ COURSE ACCESS ↓ LEARNING PLAYER ↓ CONTENT PROGRESS ↓ QUIZ ↓ ASSIGNMENT ↓ LIVE SESSION ↓ COURSE COMPLETION ↓ ELIGIBILITY CHECK ↓ CERTIFICATE ↓ ANALYTICS ↓ RECOMMENDATION ↓ NEXT LEARNING ``` ------------------------------------------------------------------------ # 73. Complete Instructor Journey ``` text REGISTER ↓ INSTRUCTOR APPLICATION ↓ ADMIN REVIEW ↓ APPROVED ↓ INSTRUCTOR PROFILE ↓ CREATE COURSE ↓ BUILD CURRICULUM ↓ ADD CONTENT ↓ ADD ASSESSMENTS ↓ CONFIGURE CERTIFICATE ↓ SUBMIT ↓ ADMIN REVIEW ↓ PUBLISHED ↓ STUDENTS ENROLL ↓ TEACH ↓ GRADE ↓ COMMUNICATE ↓ ANALYZE ↓ EARN / PAYOUT ``` ------------------------------------------------------------------------ # 74. Complete Organization Journey ``` text ORGANIZATION APPLICATION ↓ ADMIN APPROVAL ↓ ORGANIZATION CREATED ↓ BRANDING / SETTINGS ↓ DEPARTMENTS ↓ COHORTS ↓ LEARNERS ↓ INSTRUCTORS ↓ COURSES ↓ LEARNING PATHS ↓ ASSIGNMENT ↓ ENROLLMENT ↓ LEARNING ↓ ASSESSMENT ↓ CERTIFICATION ↓ REPORTING ``` ------------------------------------------------------------------------ # 75. Complete Admin Journey ``` text LOGIN ↓ PLATFORM DASHBOARD ↓ USER MANAGEMENT ↓ INSTRUCTOR MANAGEMENT ↓ ORGANIZATION MANAGEMENT ↓ COURSE MANAGEMENT ↓ CONTENT APPROVAL ↓ ORDER MANAGEMENT ↓ PAYMENT MANAGEMENT ↓ REFUNDS ↓ PAYOUTS ↓ REPORTS ↓ ANALYTICS ↓ SETTINGS ↓ SECURITY ↓ AUDIT ``` ------------------------------------------------------------------------ # 76. Final Reference Architecture ``` text WSPL EDUTECH | +---------------+---------------+ | | | LEARNER INSTRUCTOR ORGANIZATION | | | +---------------+---------------+ | IDENTITY & ACCESS | APPLICATION LAYER | +-------------+-----------+-----------+-------------+ | | | | | CATALOG LEARNING ASSESSMENT COMMERCE ORGANIZATION | | | | | +-------------+-----------+-----------+-------------+ | CERTIFICATION | COMMUNICATION | ANALYTICS | ADMIN / OPS | EVENTS / QUEUES | +------------------------+------------------------+ | | | NOTIFICATIONS INTEGRATIONS STORAGE | | | Email/SMS/Push Payment/Video/Calendar S3/CDN ``` ------------------------------------------------------------------------ # 77. Golden Business Flow The entire platform can be reduced to: ``` text USER ↓ IDENTITY ↓ ROLE ↓ PERMISSION ↓ CATALOG ↓ COURSE ↓ PURCHASE / ASSIGNMENT ↓ PAYMENT / AUTHORIZATION ↓ ENTITLEMENT ↓ ENROLLMENT ↓ LEARNING ↓ PROGRESS ↓ ASSESSMENT ↓ COMPLETION ↓ CERTIFICATION ↓ ANALYTICS ↓ RECOMMENDATION ↓ NEXT LEARNING ``` Institutional: ``` text ORGANIZATION ↓ DEPARTMENT ↓ COHORT ↓ LEARNING PATH ↓ COURSES ↓ ENROLLMENT ↓ LEARNING ↓ ASSESSMENT ↓ CERTIFICATION ↓ ORGANIZATION ANALYTICS ``` Commercial: ``` text CATALOG ↓ CART ↓ CHECKOUT ↓ ORDER ↓ PAYMENT ↓ ENTITLEMENT ↓ ENROLLMENT ↓ LEARNING ``` SaaS: ``` text PLAN ↓ SUBSCRIPTION ↓ TENANT ↓ TENANT ADMIN ↓ TENANT CONFIGURATION ↓ USERS ↓ COURSES ↓ LEARNING ↓ REPORTING ``` ------------------------------------------------------------------------ # 78. Pre-Development Gate Do not begin the full screen-by-screen UI build until these are approved: ``` text [ ] Product Scope [ ] BRD [ ] User Roles [ ] Permission Matrix [ ] Domain Architecture [ ] ERD [ ] Enrollment Flow [ ] Payment Flow [ ] Entitlement Model [ ] Learning Progress Model [ ] Assessment Model [ ] Certificate Model [ ] Organization Model [ ] Notification Model [ ] Analytics Model [ ] State Machines [ ] API Contracts [ ] Security Model [ ] Tenant Strategy [ ] Storage Strategy [ ] Queue Strategy [ ] Backup Strategy [ ] Testing Strategy ``` ------------------------------------------------------------------------ # 79. Recommended Next Documents After this architecture baseline, produce these in order: ``` text 01_WSPL_LMS_BRD.md ↓ 02_WSPL_LMS_DOMAIN_ARCHITECTURE.md ↓ 03_WSPL_LMS_ROLE_PERMISSION_MATRIX.md ↓ 04_WSPL_LMS_DATABASE_ERD.md ↓ 05_WSPL_LMS_STATE_MACHINES.md ↓ 06_WSPL_LMS_EVENT_MAP.md ↓ 07_WSPL_LMS_API_SPECIFICATION.md ↓ 08_WSPL_LMS_SECURITY_ARCHITECTURE.md ↓ 09_WSPL_LMS_TEST_STRATEGY.md ↓ 10_WSPL_LMS_UI_UX_INFORMATION_ARCHITECTURE.md ↓ 11_WSPL_LMS_IMPLEMENTATION_PHASES.md ``` Only after these are sufficiently stable should the team proceed to the complete screen-by-screen UI build. ------------------------------------------------------------------------ # 80. Source / Reference Note This document uses Rocket LMS as a **product and architecture reference**, not as a source-code cloning specification. The current CodeCanyon listing documents Rocket LMS as a Laravel-based LMS with multiple roles, course/content management, organizational education, payments, subscriptions, analytics, live classes, certificates, quizzes, assignments, forums, marketplace capabilities, SaaS packages, affiliate/referral systems, secure storage and many optional plugins. Official reference page: https://codecanyon.net/item/rocket-lms-learning-management-academy-script/33120735 Support/product page: https://codecanyon.net/item/rocket-lms-learning-management-academy-script/33120735/support The listing also indicates that many advanced capabilities are delivered through a Universal Plugin Bundle. Therefore WSPL should separate **Core LMS**, **Business Modules**, and **Optional Extensions** instead of treating the entire feature set as MVP scope. ------------------------------------------------------------------------ ## Architecture Principle > **Build the learning engine first. Build the business ecosystem around > it.** The LMS should remain maintainable when future modules such as marketplace, SaaS, AI, affiliate, rewards, events, job board and mobile applications are added. **END OF DOCUMENT**