Case 03Adaptive learning · EdTech
Arithmetic confidence for children, visible to parents.منتانورا
- Year
- 2026
- Status
- Live
- Discipline
- Adaptive learning · EdTech
- 6
- bounded contexts
- 4
- languages
- 4
- difficulty levels
01 — The problem
Drill apps either bore children or hide what they learn. Parents and teachers need to see mastery, and children need practice that adapts — all under privacy rules that apply to minors.
An adaptive mathematics platform for children: fresh problems every session across four difficulty levels, recommendations from each child’s mastery, pedagogical characters, and a console for parents and teachers — in Arabic, English, French and Turkish.
02 — What I built
- 01
A Domain-Driven Django backend with isolated bounded contexts: accounts, families, characters, training, gamification and progress.
- 02
Problem generation and next-exercise recommendation driven by measured mastery.
- 03
A Flutter learner app and a Flutter web console for parents, teachers and administrators.
- 04
Guardian-issued child session tokens, consent records, photo upload with metadata stripping and account deletion.
- 05
A production deployment on Docker with Postgres, Redis, Celery workers and Caddy at the edge.
03 — Architecture
How the pieces fit.
- L1Clients
- Flutter learner app
- Flutter web console
- 4 languages incl. RTL
- L2API
- Django 5.2 LTS + DRF 3.18
- Rotating JWT + blacklist
- OpenAPI schema
- L3Application
- Use cases & query services
- Domain events
- Composition root wiring
- L4Domain
- Pure-Python entities
- Zero framework imports
- Enforced by import-linter
Requests flow top to bottom · each layer depends only on the one beneath
04 — Decisions that matter
Decisions
Boundaries a linter can prove
import-linter enforces api → application → domain and forbids cross-context database imports, so the architecture cannot quietly erode.
Ports and in-memory fakes
Services that protect business invariants depend only on repository and unit-of-work protocols, and are tested with the database switched off.
Children are not users
Children never hold credentials — guardians issue scoped session tokens, and consent is recorded as proof.
05 — Security & trust
- Two-factor authentication mandatory for administrators.
- Rotating refresh tokens with blacklist; 6-digit one-time codes for resets.
- HSTS preload, nosniff, frame and referrer policies at the edge.
- EXIF and metadata stripped from every uploaded photo.
06 — Stack
- Python 3.12
- Django 5.2
- DRF
- PostgreSQL 17
- Redis
- Celery
- Flutter
- Dart
- Docker
- Caddy
07 — In the product
Next case · 04
MDSS
A trading engine whose best feature is saying no.