The problem
Most course platforms still model a lesson as one plain-text field rendered as a truncated string, let any edit to a live course change what students see mid-typo, and treat "file upload" as a URL text box with nowhere for a student to keep a private note.
The product
This LMS is a modular-monolith built around three commitments: a real WYSIWYG block editor for authoring, a hard separation between a course's draft and its published state, and tenant isolation enforced at the storage layer, not just in the UI.
Available today
Built and tested, verified directly against the source — not just the product's own documentation:
- A genuine BlockNote editor integration — native drag-drop blocks, a "/" slash menu, one-second-debounce autosave, and custom upload/resolve handlers wired to the app's own media API.
- Real draft/publish separation — a lesson holds both a draft and a live content body, promoted only on explicit instructor action, with a dedicated automated test proving an enrolled student's view doesn't change mid-edit.
- Tenant-isolated media storage — uploads use a server-minted, opaque storage key that can never be derived from user input, and an extension allowlist (roughly 20 types) rather than a denylist, an explicitly OWASP-informed design choice in the code itself.
- Real drag-drop reordering and course cloning — a genuine deep copy of a course, its sections, and its lessons, resetting the clone to draft status under a new instructor.
- A new, real engagement module for private per-lesson student notes (with optional video/audio timestamp anchoring) and bookmarks.
- Hardened multi-tenant security — middleware that refuses to let a client-supplied tenant header override a JWT's tenant claim unless the caller is a platform admin, with its own dedicated regression test covering exactly that attack path.
Upcoming features
Honestly scoped as not yet built, per the project's own go-live tracking:
- Cloud object storage for media — the storage layer is tenant-isolated today but backed by local disk, not a cloud provider, behind an interface designed to make that swap straightforward.
- PDF certificate generation (HTML certificates work today), payments, and SCORM/LTI interoperability.
- SSO and a password-reset flow.
- Moving session tokens from browser storage to httpOnly cookies.
- Enforcing the course-approval workflow that's currently modeled in the data but not yet gated in the UI.
Who it's for
- Training providers and corporate L&D teams needing safe live-course editing.
- Cohort-based course creators wanting a real editor, not a plain-text box.
- Education platforms evaluating a multi-tenant LMS core to build on.
Platform and stage
.NET 8 modular-monolith API + Next.js 15 web app; Postgres and Redis in production, or a fully in-memory mode for zero-infra local evaluation. Stage: Tech Ready — built, tested, and demoed locally; cloud deployment is scoped and ready to switch on, not yet public.