EdTech / K-12 Language Learning · Multi-Province Franchise

K12 Language Learning Platform — A Multi-Level Franchise English Learning Platform

Upgrading a K-12 English learning platform to a multi-province franchise model: teacher-supervised AI pronunciation scoring, multi-level Province–Partner–School access control, and unified SSO.

AI Read Aloud Multi-level RBAC SSO Gamification Analytics
Industry
K-12 Language Learning (Franchise)
Type
Platform (Phase 3 Upgrade)
Model
Province – Partner – School
Tech
Spring Boot 3, Nuxt/Vue 3

System Scale & Design Thresholds

Designed for a multi-level franchise model, with performance thresholds set from the architecture stage onward.

3
Permission tiers: Province – Partner – School
5
Standardized RBAC role groups
3
AI scoring criteria: pronunciation, intonation, fluency
24h
AI result turnaround threshold
<3s
Dashboard page-load threshold
<5s
Recording processing threshold after submission

The Challenge

Upgrading a live platform to a multi-province franchise model, with zero tolerance for downtime or historical data loss.

Zero-downtime data restructuring

Converting the content model from fixed "Weeks" to flexible "Lessons" across tens of thousands of students' historical data.

Multi-level access without data leaks

Strict data boundaries between Province – Partner – School as the system expands to more provinces.

AI pronunciation scoring for children

Children's voices are high-pitched with uneven pacing — AI can't be 100% accurate, so it needs teacher oversight.

SSO & account conflict handling

Unifying login while still safely handling accounts that already existed under the old method.

Leaderboards & reporting without slowing the system

Computing rankings and reports over millions of records without affecting students' everyday learning experience.

Feature Map

Read Aloud AI

  • Listen → Record → Submit → Reading comprehension
  • 3 scoring criteria: pronunciation, intonation, fluency
  • Sample feedback bank
  • Teacher review (human-in-the-loop)
AI PIPELINE

Multi-Level Access

  • 5 standardized role groups
  • Entity binding to Province/Partner/School
  • Blocked right at the Controller layer
PROVINCE–PARTNER–SCHOOL

SSO

  • Unified login
  • Account conflict handling
  • Manual merge tool for admins
  • Login audit log
OIDC

Teaching Content

  • Converting the Week structure to Lessons
  • Course & material library management
WEEK → LESSON

Gamification & Reporting

  • Star accumulation, leaderboards
  • Role-based dashboards
  • Periodic pre-computed reports
PRE-COMPUTED

A Student's Speaking-Practice Journey

1
Listen
The student listens to a sample passage to practice reading
2
Record
Records their own reading, with playback before submitting
3
Submit
The recording is uploaded and queued for processing
4
AI scoring
AI analyzes pronunciation, intonation, and fluency
5
Teacher review
A teacher listens back and confirms or adjusts the score/feedback
6
Get results
The student sees the final score and natural-language feedback

Data Restructuring & Safe Multi-Level Access

A Shadow Tables strategy converts the content structure without downtime, paired with a security interceptor that blocks data leaks right at the request layer.

  • Shadow tables + supervised auto-mapping for historical data
  • Indexing by Province/Partner/School ID
  • Time-based range partitioning by academic year
  • Unauthorized access blocked at the Controller layer, before it touches the database
Technical Notes
Spring Boot 3 + Flyway for versioned migrations, Spring Batch handles chunked backfills on PostgreSQL to avoid table locks on multi-million-row tables.

AI Read Aloud & Unified SSO

An asynchronous scoring pipeline pairs enterprise-grade AI with teacher review, alongside an OIDC SSO flow that safely handles account conflicts.

  • Recordings uploaded via presigned URL, processed in the background via a message queue
  • A dedicated AI Speech worker, isolated from the main API
  • An LLM turns raw scores into natural-language feedback
  • Teacher review before scores are published (human-in-the-loop)
  • OIDC SSO with a manual account-merge tool for admins
Technical Notes
Spring Security OAuth2 Resource Server validates JWTs against JWKS; a dedicated worker uses WebClient to call the AI Speech + LLM services, isolated from the main request flow so a slow/failing AI service can't take down the core API.

Technical Architecture

Frontend App
Vue 3 + Vite (SPA)
Landing/SSO
Nuxt 3 (SSR)
Backend API
Spring Boot 3
Auth
OIDC / Spring Security
Data
PostgreSQL + Redis

Backend

Spring Boot 3 (Java 21 LTS)Spring Security OAuth2Spring Data JPASpring BatchFlyway

Frontend

Vue 3 + ViteNuxt 3 (SSR)Pinia

Data & Cache

PostgreSQL (range partitioning)Redis (cache-aside)

Infra & Integrations

Message Queue (SQS-compatible)Object Storage (S3-compatible)AI Speech ServiceGitHub Actions CI/CD
"Upgrading a live education platform serving tens of thousands of real users demands a completely different mindset than building new: every data-model change has to be designed so nobody notices the wheels were changed while the car was still moving."
— The XO Engineering Team

Related Projects