Flexible Testing System for LMS: Development & Integration

Developing a Test and Quiz System for LMS

We integrate a flexible testing system into your LMS that handles any scenario: from simple surveys to certification exams with cheating protection. Together we identify the needed question types, time settings, and automatic grading rules. The result is a ready module with API, client-side timer, and admin panel. For example, in one project for a corporate university we replaced an outdated in-house system. The number of technical failures dropped by 80%, and the average test completion time fell from 30 to 18 minutes. Students got instant feedback, teachers got detailed statistics per question. The system is designed to easily adapt to curriculum changes without rewriting code.

What Problems Do We Solve?

Problem 1: Monotonous question types. Only single choice? Students quickly adapt. We add 7+ types: from ordering to fill-in-the-blank. This boosts engagement and assessment accuracy. More about test question types.

Problem 2: Cheating and manipulation. Without protection, results lose meaning. We include: shuffling, timer, attempt limits, no backtracking, anti-cheat detection. On one project, honest completions increased by 40%.

Problem 3: Manual grading. We automate what can be automated. Short answers are checked by keywords, multiple choice gets partial credit. The teacher only moderates exceptional cases. Automatic short_answer checking is 5 times faster than manual moderation, with up to 95% accuracy when keywords are well-chosen.

Problem 4: Integration with existing LMS. Often the test module works in isolation, data not synced. We embed the system via REST API, synchronizing users, courses, and progress. This eliminates manual result transfer and prevents errors.

How We Do It

We use TypeScript on the React + Node.js stack. Database: PostgreSQL (for complex relationships) or Redis (for timers). We employ Redis caching for timers and results to speed up computations. An example of a typical system (simplified):

type QuestionType =
  | 'single_choice'      // one correct answer
  | 'multiple_choice'    // several correct
  | 'true_false'
  | 'short_answer'       // text, checked by keywords or manually
  | 'ordering'           // arrange in correct order
  | 'matching'           // match pairs
  | 'fill_blank';        // fill in the blank

interface Question {
  id: string;
  type: QuestionType;
  text: string;
  points: number;
  explanation?: string;   // shown after answer
  answers: Answer[];
  // For fill_blank
  blanks?: string[];
  // For matching
  pairs?: Array<{ left: string; right: string }>;
}

interface QuizSettings {
  timeLimit?: number;       // seconds, null = unlimited
  maxAttempts: number;      // 0 = unlimited
  passingScore: number;     // percentage
  shuffleQuestions: boolean;
  shuffleAnswers: boolean;
  showCorrectAnswers: 'never' | 'after_attempt' | 'after_passing';
  allowReview: boolean;     // can go back to previous questions
}

Storage of questions and answers in the database is designed with normalization in mind: table questions contains fields type, text, points; table answers — id, text, isCorrect, questionId; for ordering and matching — auxiliary tables with order and pairs.

How We Implement Cheating Protection

Starting an attempt is done server-side: we shuffle questions and answers, check the attempt limit. Only IDs and text are sent to the client, never correct answers. When submitting, the timer is validated on the server. Server-side validation prevents client-side time manipulation.

app.post('/api/quizzes/:quizId/attempts', authenticate, async (req, res) => {
  const quiz = await db.quizzes.findById(req.params.quizId);
  const enrollment = await db.enrollments.findByUserAndCourse(req.user.id, quiz.courseId);

  // Check attempt limit
  const previousAttempts = await db.quizAttempts.countByUserAndQuiz(
    req.user.id, quiz.id
  );

  if (quiz.settings.maxAttempts > 0 && previousAttempts >= quiz.settings.maxAttempts) {
    return res.status(429).json({ error: 'Max attempts reached' });
  }

  // Shuffle questions
  let questions = quiz.questions;
  if (quiz.settings.shuffleQuestions) {
    questions = shuffleArray([...questions]);
  }

  if (quiz.settings.shuffleAnswers) {
    questions = questions.map(q => ({
      ...q,
      answers: q.type !== 'ordering' ? shuffleArray([...q.answers]) : q.answers,
    }));
  }

  const attempt = await db.quizAttempts.create({
    quizId: quiz.id,
    userId: req.user.id,
    enrollmentId: enrollment.id,
    questions: questions.map(q => ({
      id: q.id,
      // Do NOT send isCorrect to the client
      answers: q.answers.map(a => ({ id: a.id, text: a.text })),
    })),
    startedAt: new Date(),
    expiresAt: quiz.settings.timeLimit
      ? new Date(Date.now() + quiz.settings.timeLimit * 1000)
      : null,
  });

  res.json({
    attemptId: attempt.id,
    questions: attempt.questions,
    expiresAt: attempt.expiresAt,
  });
});

Why Configuring the Timer Matters

The timer is not just about time limits. The client-side React component QuizTimer shows a countdown, warns one minute before the end, and auto-submits the test. On the server, we verify that the attempt didn't exceed the limit — this guarantees fairness. We use useState and useEffect from React documentation.

function QuizTimer({ expiresAt, onExpired }) {
  const [remaining, setRemaining] = useState(0);

  useEffect(() => {
    const update = () => {
      const diff = Math.max(0, new Date(expiresAt).getTime() - Date.now());
      setRemaining(Math.floor(diff / 1000));
      if (diff <= 0) onExpired();
    };

    update();
    const timer = setInterval(update, 1000);
    return () => clearInterval(timer);
  }, [expiresAt]);

  const minutes = Math.floor(remaining / 60);
  const seconds = remaining % 60;
  const isUrgent = remaining < 60;

  return (
    <div className={`font-mono text-lg font-bold ${isUrgent ? 'text-red-600 animate-pulse' : 'text-gray-700'}`}>
      {String(minutes).padStart(2, '0')}:{String(seconds).padStart(2, '0')}
    </div>
  );
}

In addition to the client-side timer, on each submit request the server checks that time has not expired. If an attempt is submitted after the deadline, we return a 408 error. This prevents cheating by manipulating the client time.

How Answers Are Graded

After submission, the server calculates scores, accounting for partial credit on multiple choice and keywords for short answers. Comparison of automatic vs. manual grading:

app.post('/api/attempts/:attemptId/submit', authenticate, async (req, res) => {
  const attempt = await db.quizAttempts.findById(req.params.attemptId);

  if (attempt.userId !== req.user.id) return res.status(403).end();
  if (attempt.submittedAt) return res.status(409).json({ error: 'Already submitted' });

  // Check timer
  if (attempt.expiresAt && new Date() > attempt.expiresAt) {
    return res.status(408).json({ error: 'Time expired' });
  }

  const { answers } = req.body;  // { questionId: answerId | answerId[] | string }

  const quiz = await db.quizzes.findById(attempt.quizId);
  let totalPoints = 0;
  let earnedPoints = 0;

  const results = quiz.questions.map(question => {
    totalPoints += question.points;
    const userAnswer = answers[question.id];
    let isCorrect = false;
    let pointsEarned = 0;

    switch (question.type) {
      case 'single_choice':
      case 'true_false':
        const correctAnswer = question.answers.find(a => a.isCorrect);
        isCorrect = userAnswer === correctAnswer?.id;
        pointsEarned = isCorrect ? question.points : 0;
        break;

      case 'multiple_choice':
        const correctIds = new Set(question.answers.filter(a => a.isCorrect).map(a => a.id));
        const userIds = new Set(Array.isArray(userAnswer) ? userAnswer : []);
        isCorrect = correctIds.size === userIds.size &&
          [...correctIds].every(id => userIds.has(id));
        // Partial scoring for multiple choice
        const correctSelected = [...userIds].filter(id => correctIds.has(id)).length;
        const wrongSelected = [...userIds].filter(id => !correctIds.has(id)).length;
        pointsEarned = Math.max(0,
          (correctSelected / correctIds.size - wrongSelected / correctIds.size) * question.points
        );
        break;

      case 'ordering':
        const correctOrder = question.answers.map(a => a.id);
        isCorrect = JSON.stringify(userAnswer) === JSON.stringify(correctOrder);
        pointsEarned = isCorrect ? question.points : 0;
        break;

      case 'short_answer':
        // Auto-check by keywords, manual check separate
        const keywords = question.answers[0]?.keywords ?? [];
        const matchCount = keywords.filter(kw =>
          (userAnswer as string).toLowerCase().includes(kw.toLowerCase())
        ).length;
        isCorrect = matchCount >= (question.answers[0]?.minKeywords ?? 1);
        pointsEarned = isCorrect ? question.points : 0;
        break;
    }

    earnedPoints += pointsEarned;
    return { questionId: question.id, isCorrect, pointsEarned, correctAnswer: question.answers.filter(a => a.isCorrect) };
  });

  const scorePercent = Math.round((earnedPoints / totalPoints) * 100);
  const passed = scorePercent >= quiz.settings.passingScore;

  await db.quizAttempts.update(attempt.id, {
    answers,
    results,
    score: scorePercent,
    passed,
    submittedAt: new Date(),
    timeSpent: Math.round((Date.now() - new Date(attempt.startedAt).getTime()) / 1000),
  });

  if (passed) {
    await db.lessonProgress.markCompleted(req.user.id, quiz.lessonId);
  }

  const showAnswers = quiz.settings.showCorrectAnswers === 'after_attempt' ||
    (quiz.settings.showCorrectAnswers === 'after_passing' && passed);

  res.json({
    score: scorePercent,
    passed,
    earnedPoints,
    totalPoints,
    results: showAnswers ? results : results.map(r => ({ questionId: r.questionId, isCorrect: r.isCorrect })),
  });
});

Work Process

1. Analysis — study your LMS, list of question types, protection requirements.
2. Design — database schema, API, question rendering, timer logic.
3. Implementation — write code, test on real data.
4. Testing — load testing, protection checks, usability.
5. Deployment and support — deploy, hand over documentation, train administrators.

Timeline and What's Included

Included: API, client-side timer component, admin panel for test management, database migrations, documentation, training, post-launch support.

Get a consultation for your project — we'll advise which question types suit you. Order development of a test system: from a simple survey to a certification exam. Our team has 5+ years of experience and over 50 test system implementations in various LMSs. We guarantee stability and data security.

Backend Development Services: Laravel, Node.js, Go, Django, PostgreSQL

On a production server at 3:14 AM, the Laravel Jobs queue stopped processing. 40,000 unprocessed jobs in Redis. Cause: worker crashed due to a memory leak in one of the Jobs (leak via a static variable in an Eloquent observer), supervisor didn't restart it because of misconfigured stopwaitsecs. This is not a hypothetical scenario — it's Tuesday. We analyzed such an incident on a project with 500 RPS load: diagnosis took 4 hours, fix — 20 minutes. So you don't lose money on downtime, we offer backend development services with a focus on production-grade reliability. We'll assess your project in 2 days.

Backend is what works when no one is watching. Or doesn't work. We guarantee you'll have the first option.

How do we ensure production-grade reliability from day one?

What we do correctly from day one

Service Layer over Fat Controllers. Controller receives HTTP request, validates it via Form Request, passes data to Service, returns response. Business logic in Service, not Controller. This sounds trivial, but most legacy projects have controllers with 500 lines and SQL queries inside.

Repository Pattern we use cautiously. If you just wrap Model::where(...) in a repository method — that's boilerplate without benefit. Repository is justified when: you need to abstract from the data source (DB + cache + external API) or when query logic is complex enough to isolate.

Jobs, Events, Listeners. Everything that can be async — make async. Sending email, PDF generation, external API sync, aggregate recalculation — into Queue. Laravel Horizon for queue monitoring in Redis: see throughput, failed jobs, processing time per queue.

How Octane handles high load

Laravel Octane with RoadRunner or Swoole keeps the app in memory between requests — removes bootstrap overhead (config loading, class autoloading) on each HTTP request. Gain: 3–8x on synthetic benchmarks, 2–4x on real applications. Important: no state between requests in static variables — that leads to exactly the incidents from the beginning. We use this in projects with >1000 RPS.

What to do about N+1 queries

N+1 is the most common cause of slow pages in Laravel apps. Standard story: page worked fine on dev with 10 records, on production with 10,000 — 8-second load.

Laravel Debugbar in dev environment shows the number of queries per page. More than 20 queries per page — signal for audit.

Model::preventLazyLoading(! app()->isProduction());

Telescope for profiling in staging: logs all queries, jobs, mail, notifications with time detail. Numbers: after implementing eager loading, page load time drops from 8s to 0.3s — 27 times faster.

PostgreSQL: indexes that are actually needed

PostgreSQL 14+ is the primary DB on all projects. We use PgBouncer + PostgreSQL combination. 10+ years experience, more than 50 backend projects, 5 years on the market.

How PostgreSQL helps avoid slow queries

Composite indexes for frequent WHERE + ORDER BY. If you have WHERE user_id = ? AND status = ? ORDER BY created_at DESC — you need (user_id, status, created_at DESC). A separate index on (user_id) doesn't help much with sorting.

Partial indexes. If 95% of queries go with WHERE status = 'active':

CREATE INDEX idx_orders_active ON orders (created_at DESC)
WHERE status = 'active';

The index is small, fast, covers the main load.

GIN indexes for JSONB and arrays. @> operator without GIN index — seq scan. With index — fast even on millions of rows.

GIN for full-text search. to_tsvector + GIN instead of LIKE '%query%'. LIKE without index is always seq scan. With pg_trgm extension and gin_trgm_ops — supports LIKE with index, useful for CRM search by partial match.

Connection pooling: why it's more important than it seems

Rails, Laravel, Django open a new connection to PostgreSQL for each PHP/Python process. With 100 workers — 100 connections. PostgreSQL starts degrading from 200–300 active connections — overhead on connection management becomes significant.

PgBouncer — connection pooler in front of PostgreSQL. Transaction pooling mode: connection to PostgreSQL is occupied only during a transaction, returned to pool between requests. 1000 application workers → 20–50 actual connections to PostgreSQL. This reduces latency by 40% and hosting costs by 30%.

Node.js with Fastify: when it's better than Laravel

Node.js is justified for:

• Realtime: WebSocket servers, Server-Sent Events, chat, live updates
• Streaming: large files, video, streaming data
• High I/O concurrency: many parallel requests to external APIs without heavy business logic
• Serverless: Lambda/Cloud Functions — Node.js starts faster than PHP

Fastify over Express: 2–3 times faster on benchmarks, built-in JSON Schema validation, better TypeScript support, plugin architecture.

Typical realtime architecture: Laravel — core business logic and REST API. Node.js + Socket.io or ws — WebSocket server. Laravel publishes events to Redis Pub/Sub, Node.js subscribes and broadcasts to clients. This separation allows scaling the WebSocket server independently of the main app.

Go: microservices and high load

Go we use for:

• High-load microservices (>10,000 RPS)
• Background workers with strict latency requirements
• DevOps tools and CLI
• gRPC services in microservice architecture

Goroutines — thousands of times cheaper than OS threads. 10,000 concurrent connections on Go is normal on one server.

But Go is not a silver bullet. Development is slower than Laravel: more boilerplate, no ORM at Eloquent level, error handling with if err != nil everywhere. Justified only when performance is a real requirement, not an assumption.

Django and Python backend

Django with DRF (Django REST Framework) — for tasks where Python is needed: ML pipelines, data processing, integrations with AI tools.

Celery for background tasks — similar to Laravel Queue but more complex to configure. Celery Beat for cron tasks.

Django ORM vs raw SQL: ORM is convenient for CRUD. For analytical queries with multiple JOINs, window functions, and CTEs — connection.execute() with raw SQL is more readable and predictable.

Redis: not just cache

Redis in our projects plays multiple roles:

Redis Cluster for horizontal scaling. Sentinel for automatic failover on standalone setups.

Deployment and infrastructure

Docker + docker-compose — standard for local development and production. Each service in a container: PHP-FPM/Octane, Nginx, PostgreSQL, Redis, Queue Worker, Scheduler.

CI/CD via GitHub Actions:

1. Run tests (PHPUnit / Pest, Vitest, Playwright)
2. Build Docker image
3. Push to Container Registry
4. Deploy: docker pull → docker-compose up -d on server, or Kubernetes rolling update

Zero-downtime deploy for Laravel: php artisan down --secret=TOKEN is not needed with proper configuration. Strategy: new container starts next to the old one, Nginx switches traffic after health check, old container stops.

Monitoring: Sentry for exception tracking with alerting in Slack/Telegram. Grafana + Prometheus (or Grafana Cloud) for metrics: CPU, memory, request rate, queue depth, database connection count. Alerts on: error rate > 1%, p99 latency > 2s, queue depth > 1000 jobs.

What's included in turnkey work

• Architecture design (API documentation, DB schema, service diagram)
• Implementation according to agreed specification with code review
• CI/CD, monitoring, alerting setup
• Load testing (k6, wrk) with report
• Handover of source code, access, deployment instructions
• Training of customer's team (2-3 sessions)
• Warranty support for 1 month after delivery

Timeline benchmarks

Pricing is calculated individually after analyzing load, integrations, and business logic. Contact us for a free audit of your current backend — get an optimization plan in 2 days. Request a consultation.