Master Every Major Competitive & Professional Exam

Copy & execute this SQL script in MySQL Workbench or PostgreSQL / pgAdmin to create the production student and security tables.

-- 1. Create Educational Institution Database
CREATE DATABASE IF NOT EXISTS a1m_institute_db;
USE a1m_institute_db;

-- 2. Students Master Table (Complete Fields)
CREATE TABLE IF NOT EXISTS students (
    student_id VARCHAR(50) PRIMARY KEY, -- e.g. STU-1298
    full_name VARCHAR(150) NOT NULL,
    email VARCHAR(150) UNIQUE NOT NULL,
    mobile_number VARCHAR(20) NOT NULL,
    parent_mobile VARCHAR(20) NOT NULL,
    date_of_birth DATE NOT NULL,
    gender ENUM('Male', 'Female', 'Other') NOT NULL,
    target_exam VARCHAR(100) NOT NULL, -- e.g. ICAI SPOM, JEE, NEET, UPSC
    academic_status VARCHAR(100) NOT NULL,
    target_year INT NOT NULL,
    state VARCHAR(100) NOT NULL,
    city VARCHAR(100) NOT NULL,
    password_hash VARCHAR(255) NOT NULL,
    status ENUM('Active', 'Suspended', 'Pending') DEFAULT 'Active',
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
);

-- 3. Active Sessions & DRM Device Lock Table (Single Device Enforcement)
CREATE TABLE IF NOT EXISTS student_sessions (
    session_id INT AUTO_INCREMENT PRIMARY KEY,
    student_id VARCHAR(50) NOT NULL,
    session_token VARCHAR(255) UNIQUE NOT NULL,
    ip_address VARCHAR(45) NOT NULL,
    user_agent TEXT NOT NULL,
    is_active TINYINT(1) DEFAULT 1,
    last_accessed TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    FOREIGN KEY (student_id) REFERENCES students(student_id) ON DELETE CASCADE
);

-- 4. Security Audit & Proctoring Violation Logs Table
CREATE TABLE IF NOT EXISTS security_audit_logs (
    log_id INT AUTO_INCREMENT PRIMARY KEY,
    student_id VARCHAR(50) NOT NULL,
    event_type ENUM('TAB_SWITCH', 'DEVTOOLS_ATTEMPT', 'PRINT_SCREEN', 'DUPLICATE_LOGIN', 'RIGHT_CLICK_BLOCK'),
    details TEXT,
    ip_address VARCHAR(45),
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    FOREIGN KEY (student_id) REFERENCES students(student_id) ON DELETE CASCADE
);

Node.js Mongoose Schema definition file (`models/Student.js`) for MongoDB:

const mongoose = require('mongoose');

const studentSchema = new mongoose.Schema({
  studentId: { type: String, required: true, unique: true }, // STU-1298
  fullName: { type: String, required: true },
  email: { type: String, required: true, unique: true, lowercase: true },
  mobileNumber: { type: String, required: true },
  parentMobile: { type: String, required: true },
  dob: { type: Date, required: true },
  gender: { type: String, enum: ['Male', 'Female', 'Other'], required: true },
  targetExam: { type: String, required: true },
  academicStatus: { type: String, required: true },
  targetYear: { type: Number, required: true },
  state: { type: String, required: true },
  city: { type: String, required: true },
  passwordHash: { type: String, required: true },
  
  // Single Device Session Locking
  activeSession: {
    token: String,
    ipAddress: String,
    deviceInfo: String,
    lastActive: Date
  },
  
  proctorViolationsCount: { type: Number, default: 0 }
}, { timestamps: true });

module.exports = mongoose.model('Student', studentSchema);

Express.js Node.js Registration & Login Controller (`controllers/authController.js`) with bcrypt password hashing & Single Device Session locking:

const bcrypt = require('bcryptjs');
const jwt = require('jsonwebtoken');
const Student = require('../models/Student');

// 1. Student Registration Controller
exports.registerStudent = async (req, res) => {
  try {
    const { fullName, email, mobileNumber, parentMobile, dob, gender, targetExam, academicStatus, targetYear, state, city, password } = req.body;

    // Check duplicate
    const existing = await Student.findOne({ email });
    if (existing) return res.status(400).json({ error: 'Email already registered' });

    // Hash Password securely
    const salt = await bcrypt.genSalt(10);
    const passwordHash = await bcrypt.hash(password, salt);

    const studentId = 'STU-' + Math.floor(1000 + Math.random() * 9000);

    const newStudent = new Student({
      studentId, fullName, email, mobileNumber, parentMobile, dob, gender,
      targetExam, academicStatus, targetYear, state, city, passwordHash
    });

    await newStudent.save();
    res.status(201).json({ message: 'Admission completed successfully', studentId });
  } catch (err) {
    res.status(500).json({ error: err.message });
  }
};

// 2. Student Login Controller (Single Device Token Lock)
exports.loginStudent = async (req, res) => {
  const { email, password } = req.body;
  const clientIp = req.headers['x-forwarded-for'] || req.socket.remoteAddress;

  const student = await Student.findOne({ email });
  if (!student) return res.status(404).json({ error: 'Student not found' });

  const isMatch = await bcrypt.compare(password, student.passwordHash);
  if (!isMatch) return res.status(401).json({ error: 'Invalid password' });

  // Generate JWT Token & Enforce Single Device Lock
  const token = jwt.sign({ studentId: student.studentId }, process.env.JWT_SECRET, { expiresIn: '7d' });
  
  student.activeSession = {
    token,
    ipAddress: clientIp,
    deviceInfo: req.headers['user-agent'],
    lastActive: new Date()
  };
  await student.save();

  res.json({ token, student });
};