4Hacks Learning.
4Hacks Learning is a multi-tenant learning and credentialing platform that manages courses, course progress, assessments, organization workspaces, verifiable certificates, and gamification. Its backend treats historical learning outcomes, organization boundaries, and account security as first-class system concerns.
- Role
- Lead Backend Architect · Engineer
- Domain
- EdTech · Multi-tenant SaaS · Credentialing · Learning systems
System at a glance
What the system does
Multi-tenant organization workspaces
Anti-cheat assessment workflows
Verifiable PDF credentials
Secure sessions and audit trails
Architecture flow
From intent to verified state.
- 01
Learner, organization, and administrative portals use a NestJS backend-for-frontend boundary.
- 02
Cookie-backed sessions pass through security headers, rate limits, role guards, and strict DTO validation.
- 03
Domain modules coordinate courses, progress, assessments, tenants, certificates, gamification, coupons, and audit records.
- 04
PostgreSQL persists durable learning state while Redis supports caching and BullMQ dispatches background jobs.
- 05
Certificate and mail workers process high-volume operations without blocking interactive learning flows.
01 / Tenant model
One platform, isolated organization workspaces
Organization boundaries
Courses, media, certificate templates, analytics, and participation data are partitioned by organization so B2B customers can operate their own learning environments without crossing tenant boundaries.
Granular access control
Guards distinguish platform administrators from organization owners, managers, instructors, and students. Invitation tokens have explicit acceptance, expiry, and revocation lifecycles.
Safe concurrent actions
Compound unique constraints and transaction-aware application logic protect records such as enrollment, attempts, and coupon redemption from duplicate requests and expected race conditions.
02 / Learning integrity
Assessments that preserve the evidence of an attempt
Adaptive exam construction
Question and option order are randomized per attempt. Pools can choose a configured number of questions while retaining mandatory items, reducing answer-key sharing without losing curriculum requirements.
Server-owned timing and grading
Attempt windows are calculated from server-side start times rather than browser claims. The system supports single choice, multiple choice, true/false, code, and file submissions alongside rubric-based instructor review.
Immutable snapshots
The questions, options, and relevant configuration are captured as JSONB at attempt time. Later edits to a course therefore cannot rewrite a completed assessment or the basis on which it was graded.
03 / Progress & credentials
From learning activity to independently verifiable proof
Progress computation
The learning engine tracks rich-text lessons, video watch time, assignments, and resume positions. Completion is triggered only after the required progress and assessment conditions have been satisfied.
Vector certificate generation
PDFKit renders high-resolution, branded A4 credentials from organization templates. Each certificate carries a unique verification code and QR code that can be checked through a public verification endpoint.
Background issuance
BullMQ workers process certificate batches and transactional email independently from the request cycle, enabling organizations to monitor progress while the learner experience remains responsive.
04 / Security & audit
A browser-safe BFF boundary with accountable changes
Cookie-based sessions
The backend-for-frontend pattern uses HttpOnly, Secure, SameSite session cookies, keeping authentication tokens out of browser JavaScript and reducing exposure to token theft through XSS.
Account protection
TOTP includes QR provisioning and backup recovery. Failed-login tracking, device and GeoIP-derived session signals, and temporary lockouts add friction to repeated brute-force attempts.
Auditability by default
A centralized interceptor records who changed what, the entity and target involved, supporting metadata, and before-and-after state differences for mutating operations.
05 / Engagement systems
Incentives with rules that can be operated safely
Concurrency-safe coupons
Discounts can be scoped globally, per organization, or per course. Atomic data operations enforce total redemption caps and per-user limits under concurrent checkout activity.
Streaks and badges
The system tracks daily and lifetime activity, learning minutes, and freeze protections. JSON-driven rules award milestones such as completed courses, consistent participation, or high assessment performance.
Weighted leaderboards
Configurable formulas combine inputs such as assessment scores, watch time, streaks, badges, and certificates; Redis caching keeps rankings responsive as the underlying learning state changes.