# Desktop-Only Examination Update — v4

## Scope
Only the **candidate examination experience** is desktop/laptop restricted.

- Super Admin portal: responsive, unchanged.
- Company portal: responsive, unchanged.
- Candidate dashboard/login/OTP: remains accessible on mobile/tablet.
- Starting, continuing, opening, or submitting an assessment: desktop/laptop only.

## Client-side enforcement
`frontend/src/device.js` requires:

1. A non-mobile/non-tablet browser identity.
2. A viewport width of at least **1024px**.
3. Android, iPhone, iPad/iPadOS, Windows Phone, Kindle/Silk, and other common mobile/tablet UAs are rejected.
4. Modern iPadOS desktop-style UA detection is included using platform + touch-point detection.

The candidate dashboard displays a Desktop/Laptop Required notice and disables assessment buttons on unsupported devices.

The `/exam/:assignmentId` route has its own independent guard. A direct URL therefore cannot bypass the dashboard check.

If the viewport becomes smaller than 1024px during an active assessment, the exam interface is replaced by a warning. The server-side section timer continues running.

## Backend enforcement
Candidate exam API calls include:

- `X-Assessment-Client: desktop-web-v1`
- `X-Assessment-Viewport-Width: <current viewport width>`

PHP validates those headers plus the browser User-Agent and `Sec-CH-UA-Mobile` when available.

The guard is enforced on:

- GET assignment session
- POST start assessment
- POST save answer
- POST submit section
- POST speaking/audio response

Unsupported requests return HTTP 403 with code `DESKTOP_REQUIRED`.

## Important security limitation
Web applications cannot prove physical hardware type. User-Agent and custom HTTP headers can be spoofed by a technically capable user. This implementation reliably blocks normal phone/tablet usage and accidental small-window access, but it is not hardware attestation.

For high-stakes exams requiring tamper-resistant desktop enforcement, add a managed secure browser, browser lockdown agent, or native desktop application.