theme-education-lms

name	theme-education_lms
description	Education / LMS application palette: variants, pages, entities, and flows for building a varied learning app. Use when theme_preset is education_lms.

Education LMS theme

Domain

Apps where students submit work and instructors grade it. The org hierarchy (student → instructor → admin), ownership of grades/submissions, and deadline rules are exactly where access and logic exploits live.

Application variants — pick ONE per lab

Honor any hint in theme_free_text / custom_prompt; otherwise pick one.

• K-12 gradebook — classes, assignments, grades, report cards, guardians.
• University LMS — courses, modules, submissions, grading, transcripts.
• Online-course marketplace — paid courses, lessons, enrollment, certificates.
• Coding-bootcamp portal — cohorts, projects, auto-graded exercises, reviews.
• Certification / quiz — question banks, timed attempts, scoring, badges.

Roles — choose the set that fits the variant

• user (student) — enroll, view materials, submit work, see own grades.
• instructor — author content, view roster, grade submissions, post feedback.
• admin (registrar) — all courses, enrollment, role assignment, transcripts.

Most exploits run as student.

Candidate pages — select a coherent subset

Size the subset to endpoint_count. Candidates: dashboard, course catalog, course/class home, module/lesson viewer, assignment detail, submit work, my grades, grade detail, feedback thread, roster (instructor), grading queue (instructor), gradebook (instructor), quiz/attempt, certificate, transcript, profile/settings, notifications, admin courses, admin enrollment.

Candidate entities (seed tables) — select what the variant needs

• users — id, email, password_hash, role
• courses — id, title, term, instructor_id, status
• enrollments — id, course_id, user_id, role_in_course, status
• assignments — id, course_id, title, due_at, max_points, allow_late
• submissions — id, assignment_id, user_id, content, file_path?, submitted_at
• grades — id, submission_id, score, max, graded_by, feedback, released_at
• modules / lessons — id, course_id, title, order, body, visible

Quiz / certification (variant):

• quizzes — id, course_id, time_limit_s, max_attempts, pass_score
• questions — id, quiz_id, prompt, kind, answer_key
• attempts — id, quiz_id, user_id, started_at, submitted_at, score
• certificates — id, user_id, course_id, code, issued_at

Marketplace (variant):

• orders — id, user_id, course_id, amount_cents, status

Seed several students under ≥2 courses/instructors so cross-student access is testable.

Candidate user flows — select the ones matching chosen pages/features

1. Browse catalog → enroll in a course → open its modules.
2. Open an assignment → submit work (text or file) before the deadline.
3. View my grades → open a graded submission → read instructor feedback.
4. (instructor) Open the grading queue → grade a submission → release the grade.
5. (instructor) Author an assignment with a due date → it appears for the roster.
6. (quiz) Start a timed attempt → answer → submit → see the score.
7. (marketplace) Pay for a course → unlock lessons → earn a certificate.
8. (admin) Enrol/drop a student → reassign an instructor.

Candidate endpoints — a feature may span several

Endpoints are a shared surface, not owned 1:1 by a feature (a single feature often spans several, and an endpoint can back multiple features). Pick a coherent subset alongside the pages above. Grouped by area:

• courses — GET /api/courses, GET /api/courses/{id}, POST /api/courses/{id}/enroll, GET /api/courses/{id}/roster
• assignments — GET /api/assignments/{id}, POST /api/assignments, GET /api/courses/{id}/assignments
• submissions — POST /api/assignments/{id}/submissions, GET /api/submissions/{id}, GET /api/submissions/{id}/download?file=
• grades — GET /api/grades/{id}, POST /api/submissions/{id}/grade, GET /api/courses/{id}/gradebook
• quizzes (quiz) — GET /api/quizzes/{id}, POST /api/quizzes/{id}/attempts, POST /api/attempts/{id}/submit
• certificates / orders (marketplace) — GET /api/certificates/{id}, POST /api/courses/{id}/purchase
• admin — GET /api/admin/courses, POST /api/admin/enrollments, POST /api/admin/users/{id}/role

Where vulnerabilities fit naturally

• idor → GET /api/submissions/{id}, /api/grades/{id} — read a classmate's submission or grade.
• privilege_escalation → student gaining instructor role; grading own submission; editing a released grade.
• business_logic → submit after the deadline (or tamper submitted_at), exceed quiz max_attempts, change max_points, self-grade, regrade abuse.
• path_traversal → submission/attachment download file= parameter.
• xss → submission content or instructor feedback rendered to others.
• auth_bypass → reach a grading or admin-enrollment action without a valid session.

Diversity guidance

Pick ONE variant and a coherent subset — a quiz/certification app and a gradebook diverge sharply. Size to endpoint_count; let theme_free_text / custom_prompt bias the variant and naming. Vary subjects, term structure, and grading scales so two LMS labs feel like different institutions.