YouLearn
Learning Management System REST API with JWT Auth & Progress Tracking
🎯 Project Overview & Objective
A modular REST API for learning management systems built with Node.js, Express, MongoDB, and Mongoose. Implements course curricula, JWT authentication, role authorization, student enrollments, and lesson progression tracking with Docker Compose containerization.
⚡ The Engineering Challenge
Building scalable educational platforms requires organizing complex hierarchical curricula — from courses and instructional modules down to multi-format learning resources. In addition to content delivery, platforms must securely authenticate users, enforce role-based access between instructors and students, manage course enrollments, and calculate lesson progression without introducing tight coupling between backend services and client interfaces.
🏗️ Architecture & System Design
Backend & Service Layer
Node.js and Express.js REST API structured around the MVC controller pattern, providing standardized JSON responses, dedicated route modules, and clear separation of concerns.
Database & Persistence
MongoDB document database utilizing Mongoose ODM to model hierarchical relationships between Users, Courses, Modules, Resources, Enrollments, and ResourceProgress records.
API & Communication
Modular RESTful routing: /api/auth (/register, /login, /me), /api/courses (catalog, /:courseId/enroll, /:courseId/resume), /api/modules (curriculum hierarchies), /api/resources (/:resourceId/complete), and /api/progress (course progression calculation).
Auth, Permissions & Security
JWT-based bearer token authentication (authMiddleware), bcrypt password hashing on user registration, role authorization guards (authorize('learner', 'instructor')), and centralized error handling middleware.
Infrastructure & Packaging
Docker Compose orchestration packaging the Node.js API service and a MongoDB container with persistent named volumes for consistent local development and testing environments.
System Architecture Data Flow
+-----------------------------------------------------------------------------+
| CLIENT / API CONSUMER |
| Web Applications, Mobile Frontends, or Postman API Clients |
+--------------------------------------|--------------------------------------+
| HTTP + Bearer JWT Token
v
+-----------------------------------------------------------------------------+
| EXPRESS ROUTING & AUTH MIDDLEWARE |
| - authMiddleware (JWT Verification & User Context Extraction) |
| - authorize Middleware (Role Verification: Learner vs. Instructor) |
| - Global Error & Exception Normalizer (CastError, Duplicate Key 11000) |
+--------------------------------------|--------------------------------------+
| Validated Controller Routing
v
+-----------------------------------------------------------------------------+
| CONTROLLER MODULES |
| - authController : register, login, me (bcrypt + jwt) |
| - courseController : CRUD, category filters, keyword search |
| - moduleController : module order and resource hierarchies |
| - enrollmentController : enroll, cancelEnroll, student rosters |
| - progressController : completeResource, calculateCourseProgress |
+--------------------------------------|--------------------------------------+
| Mongoose ODM Operations
v
+-----------------------------------------------------------------------------+
| MONGODB DOCUMENT DATABASE |
| - Users Collection : Credentials, Hashed Passwords, Roles |
| - Courses & Modules : Hierarchical Curriculum and Instructor Refs |
| - Enrollments & Progress : Learner Course Associations and Lesson Flags |
+-----------------------------------------------------------------------------+🚀 Implemented Capabilities
JWT Authentication & Role Authorization
Secure user registration with bcrypt password hashing, login issuing JSON Web Tokens, and middleware guards restricting endpoints by user roles (learner/instructor).
Hierarchical Curriculum Data Model
Structured schema modeling Courses, instructional Modules, and multi-format Resources (video links, documents) with relational Mongoose references.
Enrollment & Progress Tracking Engine
Dedicated endpoints allowing learners to enroll in courses, mark individual module resources as completed, and query current progress percentages.
Docker Compose Development Workflow
Containerized Node.js runtime and MongoDB service with persistent database volumes, providing reproducible local development environments.
🛠️ Engineering Challenges & Solutions
Course Progress Aggregation
Accurately determining student progress percentage across courses with varying numbers of modules and variable resource counts per module.
Implemented progress calculation logic in progressController querying total resources within a course against completed ResourceProgress records for the authenticated learner.
Role-Based Route Protection
Ensuring learner endpoints (such as course enrollment and progress tracking) and instructor management routes remain strictly segregated.
Created reusable authMiddleware and authorize(roles) higher-order middlewares to verify JWT tokens and evaluate user roles prior to reaching controller handlers.
⚖️ Technical Decisions & Architectural Trade-offs
Stateless JWT Authentication with Role Middleware vs Session Cookies
Used stateless JSON Web Tokens passed via Authorization Bearer headers with dedicated authMiddleware and authorize guards to decouple API authentication for potential multi-client (web and mobile) consumers.
Requires token revocation strategies (such as short lifespans or token blacklists) if immediate session termination is needed.
Separate ResourceProgress & Enrollment Collections vs Giant User Subdocuments
Isolated course enrollments and completed resource tracking into distinct collections with compound indices rather than embedding deep array trees into the User document, avoiding document growth bottlenecks.
Requires aggregation or multi-query resolution when computing an all-courses progress summary.
Centralized Error Normalization Middleware vs Per-Route Try/Catch Blobs
Built a global Express error-handling middleware that intercepts Mongoose validation errors, CastErrors, and duplicate keys into standardized JSON envelopes.
Custom errors must be structured consistently with proper HTTP status codes.
🧪 Testing Strategy & Verification
Quality Strategy: Manual integration testing and route verification using Postman API collections, environment token variables, and Docker Compose container isolation.
Verified Test Scenarios
- Authentication flow verification: user registration with bcrypt password hashing, login token generation, and /api/auth/me token authorization.
- Role authorization verification: validating that student-only or instructor-only routes reject unauthorized roles with appropriate 403 Forbidden responses.
- Enrollment lifecycle: students successfully enrolling in courses, preventing duplicate enrollments, and updating course enrollment rosters.
- Lesson progress calculation: recording individual resource completion and retrieving aggregate course completion percentages.
- Docker Compose multi-container boot and MongoDB named volume persistence across container restarts.
📈 Results & Technical Learnings
Verified Implemented Outcomes
- Engineered and wired a complete LMS backend covering curriculum catalog, module hierarchies, and educational resources.
- Implemented user authentication endpoints (/api/auth/register, /api/auth/login, /api/auth/me) with bcrypt password hashing and JWT issuance.
- Implemented learner enrollment logic (/api/courses/:courseId/enroll), resource progression tracking (/api/resources/:resourceId/complete), resume course pointer (/api/courses/:courseId/resume), and progress aggregation.
- Verified core endpoints via manual Postman collections and Docker Compose container isolation.
Planned Next Milestones
- Automated unit and integration test suites using Jest and Supertest for CI/CD regression protection.
- Dedicated frontend SPA client (React/Next.js) consuming the LMS REST API.
- Payment gateway integration (Stripe) for commercial course monetization.
Architectural Takeaways
- Separating enrollment and progress records into dedicated collections prevents document size growth while maintaining clear auditability.
- Reusable middleware chains for authentication and role authorization simplify security enforcement across complex route hierarchies.
🧰 Complete Technology Stack
Need a Similar System or Application?
I collaborate with businesses and agencies to engineer scalable web backends, interactive client applications, and custom automation workflows.