DASHBOARD
What the panel does
Requests management
Service, hiring, partnership — every request arrives classified and ready to follow up and answer from one place.
Complaints & reports
A dedicated inbox that collects every complaint and report, so no client's voice gets lost.
Full content control
Site sections, blogs, news — the company edits everything itself, no developer needed.
Users & security
Panel users managed with scoped permissions, and very high data protection.
By the numbers
The four hardest problems
Worked on my machine, broke in production
Two-factor login via an emailed code worked locally and broke once deployed — and four fixes in a row didn't hold. The cause sat deeper than the code itself: the middleware runs on the Edge and was decoding the session by hand, and the database layer (Prisma) can't run there at all. So I rebuilt authentication: an authenticator app (TOTP) instead of email codes, a pre-auth token linking the two steps, and a lightweight Edge-only auth config with no database.
The rebuild touched 27 files — instead of patching on a fifth fix.
Every request passes here — so no database here
Middleware runs on every request, so any query in it slows the whole site. Maintenance mode is detected from a cookie with zero queries, authentication is fully isolated from the public pages, and the forced-logout check has a 4-second timeout so a slow database can't stall every request.
The public pages carry nothing from the login system.
Security that's built, not claimed
Rate limiting, sanitising HTML from the content editor before rendering, validating uploads by their actual contents (magic bytes) rather than their extension, and CSP headers — plus active sessions that can be revoked from settings.
A file's extension is whatever the user typed; its contents don't lie.
Content the company edits without calling me
Draft → preview → publish, image and video management, a rich-text editor for blog and news with slugs, and an importer that moves content previously hard-coded in the site into the dashboard instead of retyping it. Later the Terms and Privacy pages became editable from the dashboard too.
Headings are built to stay tidy however long the copy the team writes.
The tools
Core
- Next.js · App Router
- React
- Tailwind CSS v4
- next-intl — bilingual dashboard
Data & auth
- Prisma + Neon Postgres
- NextAuth
- TOTP — otplib + qrcode
- bcryptjs
Ops
- Vercel Blob — media
- Nodemailer — email
- SSE — live notifications
- Vercel — deploy
What actually shipped
- Complaints & reports inbox with internal notes
- Requests: service / hiring / partnership
- Job listings management
- Saved reply templates
- Live in-dashboard notifications
- Activity log
- Users, roles and online presence
- Revocable active sessions
- Two-factor login with an authenticator app
- One-click maintenance mode
- Blog and news editor
- Image and video management
The lesson that stayed
The part that took the most time wasn't an interface — it was two-factor login: four fixes for the same failure before it became clear the problem was somewhere else entirely. A dashboard that runs a whole company is measured by one thing: staying shut to anyone without a key, and open to the team without friction.
A bug that returns after every fix means the diagnosis is wrong.
Inside the panel
Need a dashboard to run your business?
I'll build a panel tailored to your company — bilingual, secure, and easy for your team.
Tell me about your project