Amazon Portal
A System for Managing Client Communication and Store Progress Updates
I built a secure operations portal for an Amazon seller management agency, bringing client work, reports, files, product trackers, and conversations into one accountable workflow.
One agency, two very different workdays.
Agency staff move between many sellers, stores, reports, files, and conversations in a single day. They need detail, shortcuts, and enough context to pick up work without reconstructing the history from messages and spreadsheets.
Clients have a different job. They want to see progress, read a report, answer a question, or download a file without walking through the agency’s internal workspace. The portal had to serve both views from the same record while keeping every client and store boundary intact.
A shared record, shaped for each role.
The interface changes its density and emphasis according to who is signed in.
Admin operations desk. The staff dashboard brings client health, open work, invitations, and recent activity into one daily view.
Client store record. Clients see a quieter store record with progress, next steps, tasks, files, reports, and feedback.
Report editor and archive. Reports move from a private draft to a published client view, with attachments kept inside the same access rules.
The rules the product had to respect.
- 01
Staff permissions and tenant access are separate decisions. An administrator may be allowed to manage reports but only for assigned clients or individual stores. Those checks run inside Convex queries and mutations, not only in the interface.
- 02
Authentication uses WebAuthn passkeys. Challenges expire and can be consumed only once, while action and live-session tokens are stored as hashes and kept separate from the service secret.
- 03
Google Drive and Sheets are useful working surfaces, but they can be renamed, moved, duplicated, or temporarily unavailable. Convex remains authoritative, and every Google object must be discoverable, repairable, and safe to retry.
How I built the operating model.
I started at the trust boundary. Next.js handles the signed-in experience, but every meaningful read and write is checked again in Convex against the current role, capability, client, and store scope. That keeps stale screens and guessed identifiers from widening access.
The 28-table model follows the agency’s real workflow: identities, clients, stores, tasks, products, reports, feedback, files, messages, invitations, read state, audit history, and integration metadata. Dashboard totals are maintained across 32 deterministic shards, and growing lists are indexed, paginated, or explicitly bounded.
Slow Google work leaves the request path. Inngest jobs debounce bursts, retry transient failures, and serialize Drive changes for the same store while allowing unrelated stores to proceed. Stable private properties reconnect portal records to Drive and Sheets, even after a file or folder has been renamed.
Make identity and scope explicit
Passkey enrollment, one-time challenges, hashed sessions, origin checks, five staff capabilities, and client or store assignments define who can do what and where.
Follow the work, not a template
Clients, stores, tasks, products, feedback, reports, files, conversations, and read state are connected around the way the agency actually delivers its service.
Make integrations recoverable
Drive objects carry stable portal IDs, Sheets projections retain sync state and content digests, and queued jobs use unique keys, throttling, retries, and visible failure states.
Permissions are checked again before a mutation
The interface can hide an action, but the server still decides whether it is allowed.
export async function requireActionPermission(permission: AdminPermissionKey) {
const user = await requireActionRole('ADMIN');
if (!hasAdminPermission(user, permission)) {
throw new Error('Unauthorized');
}
return user;
}What the finished system contains.
“For this product, reliability means more than staying online. It means showing each person the right record, keeping an audit trail, and making outside services repairable when they drift.”Engineering field note