Programming Exam Platform

A secure-by-design WPF desktop foundation for academic programming examinations. The current release implements the complete Phase 1 architecture plus a functional authentication and role-aware data-browsing vertical slice: SQLite persistence, development seeding, login/registration/lockout, dashboards, courses, examinations, users, notifications, profiles, audit logs, grading primitives, authoritative timer logic, and a fail-closed code-execution boundary.

Technology

• C# / .NET 8 / WPF
• MVVM with CommunityToolkit.Mvvm
• Entity Framework Core 8 with SQLite and SQL Server providers
• BCrypt password hashing (work factor 12)
• Microsoft.Extensions.Hosting, configuration, logging, and dependency injection
• xUnit and FluentAssertions

Architecture

UI (WPF/MVVM)
  -> Application (use-case contracts, DTOs, policies)
     -> Domain (entities and enums)
  -> Infrastructure (EF Core, authentication, audit, code-runner adapter)

The domain has no infrastructure dependency. The application layer defines ports; infrastructure implements them; the WPF composition root selects adapters. Business logic is not stored in WPF code-behind. See architecture.md.

Implemented features

• Role-aware student, instructor, and administrator navigation
• Public student registration with unique institutional identity fields
• BCrypt credentials, generic login failures, failed-attempt tracking, and 15-minute lockout
• Seeded SQLite database with 1 administrator, 2 instructors, 20 students, 5 courses, 3 sections, 5 exams, 50 objective questions, 15 programming problems, and 60 test cases
• Real dashboard aggregates and data grids backed by EF Core
• Assigned-student objective exam flow with authoritative timestamps, resume support, transaction-safe answer persistence, question navigation/flagging, auto-submit, automatic grading, and immediate/manual result release behavior
• Unique indexes, relationships, timestamps, soft-delete fields, and an initial migration
• Output comparison modes, programming score calculation, letter grades, and authoritative exam clock
• Structured audit and integrity-event data models
• Extensible language configuration and code-execution interface
• Development local runner that is disabled by default and explicitly not represented as a sandbox
• Dark, responsive WPF shell designed for 1280×720 and larger screens

Run

Prerequisites: Windows 10/11 and the .NET 8 SDK (a newer SDK can also build the net8.0 target).

dotnet tool restore
dotnet restore ProgrammingExamPlatform.sln
dotnet build ProgrammingExamPlatform.sln
dotnet run --project src/ProgrammingExamPlatform.UI

The app creates ProgrammingExamPlatform.dev.db under %LOCALAPPDATA%\ProgrammingExamPlatform and applies EF migrations on startup.

Development demo accounts

Role	Username	Password
Administrator	admin	Admin!23456
Instructor	instructor	Teacher!234
Student	student01	Student!234

These credentials are deliberately obvious and development-only. The administrator is marked for a password change. Delete the database to recreate demo data.

Database provider

SQLite is configured in src/ProgrammingExamPlatform.UI/appsettings.json. To use SQL Server, change Database:Provider to SqlServer and replace the default connection string. Provider-specific production validation remains required.

Create an additional migration with:

dotnet tool run dotnet-ef migrations add MigrationName --project src/ProgrammingExamPlatform.Infrastructure

Code execution architecture

Student source is untrusted. ICodeExecutionService is the only application-facing boundary. The bundled local adapter supports opt-in Python/JavaScript workstation testing, is disabled by default, and is not a security sandbox. A production deployment must replace it with a separate execution service/container that enforces CPU, memory, process, filesystem, disk, and network restrictions. Never enable the local runner on an exam host that handles real student submissions.

Tests

dotnet test ProgrammingExamPlatform.sln

Tests cover password policy, login/audit behavior, registration and hashing, student identifiers, output comparison, programming scores, grading scales, authoritative timer behavior, and EF model constraints.

Security notes

• Authorization belongs in application/infrastructure services; hiding a WPF control is not authorization.
• Passwords and exam secrets are hashed and never written to audit logs.
• Error details are logged separately from friendly user messages.
• Hidden test cases must never be returned through student-facing DTOs.
• Fullscreen/focus controls are deterrents and audit signals, not guarantees on unmanaged computers.
• See security.md before adding exam delivery or production code execution.

Current scope and roadmap

This repository is a production-minded foundation, not a claim that every item in the long-term specification is complete. The next vertical slices are instructor exam authoring, programming-editor submissions, manual grading, richer result history, remote sandbox integration, analytics/report export, similarity indicators, backup/restore, and end-to-end UI tests. Interfaces and data models for these areas are already separated to support incremental delivery without restructuring the solution.