pargar/docs/product.md

Product

Roles

Role	Access
student	Learning path, mentor chat, events, league, challenges, profile, certificate
mentor	Same + curriculum/events/challenges content (staff) + student learning views
admin	All staff + users, site settings, invites, whitelist/blacklist, chat archive, physical orders

Student journey

1. Login /login — self-hosted image CAPTCHA + adaptive rate limits; “remember me” lengthens refresh lifetime.
2. Public password recovery — disabled for students. Password changes only from the admin panel (requires the account security answer).
3. Registration
   • Public /register when registration_enabled is on; phone must be on the one-time whitelist.
   • Invite /register/invite/[token] with capacity limits; works even if public registration is off.
4. Skill tree /cap — “next step”; progress and unlock requests.
5. Player /player/[lessonId] — verified watch.
6. Quiz /quiz/[lessonId] — wrong answers spend hearts; zero → /lockout.
7. Hub /unwrap — events, chat, league, support.
8. Weekly league /leaderboard — resets on Monday (ISO week); next reset shown in Jalali. Separate from monthly challenges.
9. Monthly challenge — XP goal in a time window; progress from quiz XP; cards on league/unwrap/profile.
10. Profile /profile — identity, stats, active challenge, certificate slot, avatar edit.
11. Certificate /c/{publicId} — unlisted link; physical copy only if admin enabled it and payment is offline.

Registration and phone

• Whitelist and blacklist are mutually exclusive; import resolves conflicts.
• A phone already tied to an account cannot re-enter either list as a fresh entry.
• One account per phone. Optional one-account-per-IP (REGISTRATION_ENFORCE_IP, default off — unsuitable behind NAT).
• Blacklist blocks all registration paths (public + invite) and keeps a failed-attempt history tab.

Certificates

• publicId is a random 32-char hex (non-sequential).
• Anti-crawl: X-Robots-Tag, meta robots, robots.txt for /c/ and /api/certificates/.
• Fixed slot on /profile (not inside the avatar dialog).
• Physical: price/window from site settings; chart default off; no online payment gateway.

Admin panel (summary)

• Users, role, lock/unlock, password reset (requires target security answer)
• Chapters / lessons / questions / videos
• Events (Jalali date picker; real isActive)
• Monthly challenges (XP goal + window)
• Membership invites, whitelist/blacklist
• Site settings: public registration, donations, physical cert, landing sponsors
• Chat archives (ZIP export/restore + single-use external links)
• Physical certificate orders

Support / donations

The community page is chat mode: no public payment card; coordination happens in private messages with the team.