WEB QUIZ ENGINE — PYTHON + FLASK OOP APPLICATION

Small-scale and collegiate web-based assessment systems are frequently built as monolithic scripts in which HTTP routing, authorization checks, and grading logic are tightly interleaved, and in which access control relies on a single hardcoded boolean flag such as is_admin. This design is difficult to test, difficult to extend with new roles or permissions, and prone to two concrete failure modes: privilege leaks (a user reaching an endpoint they should not) and orphaned data (a quiz left half-created after a database error). The Web Quiz Engine addresses both problems directly. It re-engineers the assessment workflow around a strict five-layer architecture — presentation, routing and guards, business services, repositories, and persistence — so that authorization, grading, and data-access concerns are never mixed in the same function. Access control is implemented as a normalized five-table Role-Based Access Control (RBAC) schema (users, roles, permissions, and two bridge tables) enforced through a custom @require_permission decorator, replacing static role columns with dynamic, database-driven permission checks. Multi-table quiz creation (quiz ® questions ® options) is wrapped in an explicit MySQL/InnoDB transaction with manual rollback, guaranteeing that a failure at any step leaves zero orphaned rows. Assessment timing is verified on the server using session timestamps rather than trusting the client’s JavaScript countdown alone, closing a common tampering vector. The system is implemented in Python (Flask) with a MySQL backend and a lightweight vanilla-JavaScript front end, and its domain logic is expressed as typed Python dataclasses (User, Quiz, Question, Submission) to keep business rules independent of any web framework or SQL driver. The expected output is a working three-role (Admin, Teacher, Student) quiz platform, a written design and evaluation report, and an automated test suite; at the time of writing, 36 unit, integration, and end-to-end tests pass in just over one second, covering domain scoring rules, RBAC enforcement across all permission tokens, and full user-facing flows such as timed quiz-taking, teacher grading overrides, and CSV export of class results.

27 Sep 2026 0 70