Spark - ProVQ Apprenticeship Portal

WordPress Admin

• Dashboard with apprentice, company, and trainer counts.
• Recent apprentice and activity summaries.
• Media breakdown chart.
• Apprentice creation, editing, deletion, activation, and deactivation.
• Apprentice activity history and password-reset request management.
• Company management, including status, contact information, address, and ordering.
• Resource management with title, description, files, thumbnails, company assignments, categories, tags, and publishing status.
• Chunked video uploads with progress feedback.
• Portal, login branding, company theme, SMTP, notification, and demo-data settings.

Apprentice Portal

• Branded login page.
• Dashboard, Resources, Company Info, and Profile sections (some sections can be configured).
• Resource search, category/tag filtering, sorting, and pagination.
• In-portal PDF, image, DOCX, and video viewing.
• YouTube and Vimeo embeds.
• Company-specific logo and colour theme.
• Password-reset requests reviewed by an administrator.

Access and Activity

• Resources assigned to one or more companies.
• Company membership checked when protected files and video streams are requested.
• Inactive apprentices are prevented from logging in and accessing resources.
• Login rate limiting.
• Resource-open progress tracking.
• Audit log for supported account and resource events.

Video

• Chunked browser uploads.
• Background FFmpeg processing.
• MP4 fast-start output.
• HLS playlist and segment generation.
• Processing progress in the admin interface.
• Cleanup of abandoned video jobs.

• Platform: WordPress
• Backend: PHP, WordPress Plugin API
• Data: MySQL, WordPress custom post types, user meta, options
• Frontend: HTML, CSS, JavaScript, jQuery
• Asynchronous requests: WordPress AJAX (admin-ajax.php)
• Video processing: FFmpeg, FFprobe, MP4, HLS
• Video playback: hls.js
• DOCX preview: docx-preview, JSZip
• Admin lists: WordPress WP_List_Table

No third-party PHP packages are required. Composer autoloading is optional; the plugin includes a built-in autoloader.

• WordPress 6.0 or later.
• PHP 7.4 or later; tested on PHP 8.4.
• A working WordPress database.
• A server configuration capable of running the plugin's required WordPress and PHP operations.

Additional requirements for uploaded-video processing

• ffmpeg and ffprobe installed and available on the system PATH, or configured using the plugin constants.
• PHP exec() enabled.
• A working WP-Cron setup, or a real system cron invoking wp-cron.php.
• PHP upload limits sufficient for the configured upload chunk size.
• Web-server rules that prevent direct access to the video-stream storage directory. The implementation includes an Apache .htaccess rule; Nginx requires a corresponding server configuration.

Without FFmpeg/FFprobe and exec(), uploaded-video processing is unavailable. YouTube and Vimeo embeds can still be used.

Apprentice onboarding

• An administrator creates an apprentice and assigns a company.
• The plugin creates a WordPress user with the provq_apprentice role and saves the related metadata.
• A password-reveal token is issued.
• The apprentice receives a welcome email containing the reveal link, not a plaintext password.
• The apprentice opens the link and confirms their username.
• The password is revealed, subject to the token's use limit and expiry.
• The apprentice signs in through the branded login page.

The reveal token is 64 hexadecimal characters, can be used at most three times, and expires after 30 days.

Login

• The custom login form submits to the login page.
• The login handler checks rate limits.
• Inactive accounts and trainer accounts are rejected by authentication filters.
• Successful apprentice login updates the last-login timestamp and fires the login audit action.
• The apprentice is redirected to the portal.
• Apprentices who try to access wp-admin are redirected to the frontend portal.

Documented rate limits:

• Five attempts per username-and-IP bucket.
• Fifteen attempts per IP bucket.
• Fifteen-minute lockout.

These values are filterable.

Resource access

When an apprentice requests a document, image, video playlist, or video segment, the relevant handler checks authorization.

Access is allowed to an administrator or an active user whose company is assigned to the resource. Unauthorized requests receive a 403 response or are redirected to login, depending on the handler.

Resource-open events update the apprentice's progress data.

Password reset

Apprentices submit a password-reset request through the login page or profile. An administrator reviews the request and can accept it. On acceptance, a new password is issued through a fresh password-reveal link.

• Nonce verification for admin forms and AJAX requests.
• Capability checks for administrative screens.
• Company-scoped authorization for protected files, playlists, and segments.
• Login rate limiting.
• Inactive-account checks during authentication, portal rendering, and file delivery.
• Random password-reveal tokens, with HMAC-SHA256 token hashes.
• Input sanitization and output escaping.
• Prepared SQL statements for raw database queries.
• Shell argument escaping for FFmpeg commands.