# Phase 8: Learning Management System

## Completed work

- Offering-bound virtual classrooms with draft and published states.
- Lecturer access derived from course allocations and student access derived from
  approved course-registration items.
- Ordered weekly/topic modules with release, expiry, and publication controls.
- Private lecture materials supporting PDF, office files, audio, video, archives,
  and images with version history, hashes, release windows, and download tracking.
- Required-reading acknowledgements and calculated classroom progress.
- Classroom announcements and enrolled-user discussion threads/replies.
- Assignments with instructions, rubrics, availability, deadlines, late-submission
  policy, marks, file limits, and allowed extensions.
- Text/file submissions with append-only resubmission versions, receipts, grading,
  feedback, and authorized file downloads.
- Live-class scheduling for Zoom, Google Meet, Teams, Jitsi, YouTube Live, and custom
  providers, including encrypted passwords/codes, recordings, and notes.
- Student attendance-code check-in and persistent attendance records.
- Twenty seeded classrooms and course guides, five assignments, three live sessions,
  announcements, and approved demo-student enrollments.

## Database changes

Migration `2026_07_30_150000_create_lms_tables.php` adds:

- `virtual_classrooms`
- `lesson_modules`
- `lecture_materials`
- `material_accesses`
- `classroom_announcements`
- `discussion_threads`
- `discussion_posts`
- `assignments`
- `assignment_submissions`
- `assignment_submission_versions`
- `live_classes`
- `lms_attendance_records`
- `classroom_progress`

Uniqueness constraints protect one classroom per offering, stable module ordering,
material/submission versions, one current submission per assignment/student,
attendance, access counters, and progress records.

## Security controls

- Classroom policies require the same tenant plus either lecturer allocation,
  administrative LMS authority, or an approved student enrollment.
- Every subordinate write is authorized against its parent classroom.
- Materials and assignment files use private storage, allowlisted MIME/extensions,
  size limits, randomized paths, SHA-256 hashes, and controlled downloads.
- Material replacements and student resubmissions append versions rather than
  overwriting evidence.
- Assignment availability and late-submission rules are enforced server-side.
- Scores cannot exceed assignment maximum marks.
- Meeting passwords and attendance codes are encrypted at rest and hidden from model
  serialization.

## Manual testing

1. Sign in as `admin@ecstu.test`, open **LMS**, and create/publish a classroom.
2. Add a module, upload or replace a material, publish an announcement, create an
   assignment, and schedule a live class.
3. Sign in as `student1@ecstu.test`, open an enrolled classroom, download and
   acknowledge the guide, post a discussion, submit two assignment versions, and
   check into a live class.
4. Sign in as the allocated lecturer and grade the latest submission while confirming
   earlier versions remain visible.

## Honest limitations

- Video/audio files are stored and served privately; adaptive streaming and
  transcoding are not included.
- Provider APIs, automatic meeting creation, attendance synchronization, email/SMS/
  WhatsApp reminders, and recording ingestion require external credentials and remain
  future integrations. Current live classes use validated provider links.
- Malware scanning and private S3 signed object URLs remain deployment hardening.
- Similarity/plagiarism detection is not fabricated; a future provider integration
  can be added behind a reviewed contract.
- LMS quizzes and examinations belong to Phase 9 CBT.

## Phase boundary

Phase 9 will build the secure CBT question bank, examination configuration, timed
attempts, autosave/recovery, submission, marking, moderation, and incident logging.
It has not been started.