Novademi

01 — Problem

The institute's courses, coaching and events ran on a Laravel monolith held together by demo screens. There were no real tables for orders, enrollments, certificates or coaching; student progress and coach follow-up were tracked by hand.

02 — System

We rebuilt it as a tested TypeScript modular monolith and two Next.js apps. The browser never touches the API: sessions live in httpOnly cookies and requests travel server-to-server through a BFF layer. Legacy users migrate on first login, with old password hashes verified and upgraded to stronger ones.

03 — Architecture

Site and admin apps reach the API through their own BFF layers; a shared package forwards the real client IP only with a shared secret. Payment and notification jobs are processed from database outboxes with SKIP LOCKED leases by a separate worker.

04 — Capabilities

1. 01

   Identity and security

   Four login audiences, 15-minute access tokens, rotating refresh tokens with reuse detection, mandatory TOTP for admins and an 11-role / ~40-permission catalogue.

2. 02

   LMS core

   Course → section → lesson structure, sequential unlocking, server-side completion, resume position, lesson notes; a drag-and-drop curriculum builder.

3. 03

   Classes and live lessons

   Class-specific live lessons, present/late/absent/excused attendance, Zoom Server-to-Server OAuth meeting creation and sync.

4. 04

   Exams and assignments

   Section, final and practice quizzes; single/multiple choice, true-false and open questions, server-side timers, autosave and a grading queue.

5. 05

   Coaching

   Capacity-aware coach–student matching, weekly availability, 14-day booking without double-booking, sessions drawn from package quota and daily study plans.

6. 06

   Practice exams and topic analysis

   Automatic net-score calculation for TYT/AYT/YDT/LGS practice exams; net trend, per-subject change and the topics that cost the most over the last 10 exams.

7. 07

   Commerce and access

   Orders with idempotency keys and an explicit state machine, PayTR iframe and signed webhook, discount codes, per-item partial refunds; payment turns into course access automatically.

8. 08

   Certificates and tickets

   PDF certificates generated without a library, public verification and revocation notices; 256-bit-token digital tickets with a validation page for events.

05 — Impact

• 01

  Coaching, courses, exams, certificates and events now live under one member account.

• 02

  Legacy users move to the new system without resetting their passwords.

• 03

  Coaches see each student's exam trend and weak topics without manual calculation.

4

separate login audiences

80+

database tables

11

roles · ~40 permissions

116

automated test files

0

direct browser-to-API calls

10

transactional email templates