Build a secure price analytics portal (Cloudflare, logins, admin uploads) from a working prototype

We have a working prototype of a retail price analytics portal for an industry client in the agricultural sector. It’s a single-page dashboard hosted on Cloudflare that analyses about 500,000 supermarket and e-commerce price listings across 15 product categories and 32 international markets. It has 9 tabs, charts, an in-page PDF viewer and light and dark modes. The prototype works, but all its data is bundled into the page and there are no user accounts. We need an experienced developer to turn it into a secure, production-ready portal: proper logins, a database, an admin upload system, and access rules so users can view data but only admins can export it. This job covers the initial build, but we’re looking for a long-term partner rather than a one-off contractor. After launch, we expect regular work on new features, enhancements and maintenance for this portal, and possibly similar portals for other clients. What exists today - Front end: vanilla JavaScript and Chart.js, deployed as static files on Cloudflare Workers. - Data pipeline: Python scripts that read fortnightly Excel workbooks (about 33 files per upload, 2 uploads a month), clean the data (11 documented rules) and build monthly aggregates. - Reports: a library of about 150+ industry report PDFs, organised by category and month. - Documentation: a full build scope covering data rules, calculations, screens and acceptance tests with expected figures. What we need built - User accounts and roles. - Members register and our client approves them. - Email verification and password reset. Three roles: - User: view only. - Admin: client staff, who can export data, generate snapshots, upload data and manage users. - Owner: us. - Multi-factor login for admins. A database and API. - Move the data out of the page into a database, with an API that serves only the aggregated figures each screen needs. - The individual listings view must be paginated and rate-limited, so the full dataset can’t be scraped through the browser. An admin upload system. - Admins upload each fortnight’s workbooks. - The system validates them and shows a report: rows read, rows rejected, unknown retailers or origins, price mismatches. - Admins then publish. Port our Python cleaning and aggregation logic, or run it as a server-side job. A reports library. - Admins upload report PDFs; the system reads the category and date from the PDF and keeps one report per month. - Files are stored privately and served only to logged-in users. Exports and snapshots for admins only. - CSV export of any table, and one-page A4 PDF summaries generated on the server. - Every export is logged. An admin console covering: - user approvals - upload history - data health checks - spelling alias tables for retailers and origins - usage statistics (logins, pages viewed, exports) Keep the existing front end. Wire it to the API rather than rebuilding it, unless you can make a strong case otherwise. Preferred approach - Build on Cloudflare, since the front end is already there: Workers for the API - D1 or Postgres (via Hyperdrive) for the database - R2 for files - Queues or a scheduled job for processing uploads We’re open to Supabase (Postgres, Auth, Storage) with the front end staying on Cloudflare if you can justify it. Security and quality requirements - Use an established auth library or provider; no home-made password handling. - All authorisation is checked on the server, never only in the browser. - Secrets live in environment variables or a secrets store, never in the code. - Protect against the OWASP Top 10. Add rate limiting on login and API routes. - Lock down CORS and security headers, and stop search engines indexing the portal. - Keep an audit log of logins, uploads, publishes, exports and user changes. - Daily database backups kept for 30 days, with one restore tested before launch. - Uptime and error monitoring, with alerts to us. - Automated tests for the cleaning rules and calculations. Deliverables and handover - All code in our GitHub repository from day one; we own everything. - All infrastructure in our Cloudflare account (and Supabase account, if used). - A deploy guide, an admin guide for the fortnightly upload, and an architecture summary. - A seed load of all historical data (2023 to 2026) that reconciles with our reference dataset. - 30 days of post-launch support. Milestones - Architecture, database and auth set up, with roles working. Data pipeline and seed load, with the acceptance figures matched. - API wired to the existing dashboard, exports and snapshots live for admins. - Admin console, reports library, security hardening and launch. You’ll be a good fit if you have - Shipped production apps on Cloudflare Workers (or Supabase) with authentication and role-based access. - Strong TypeScript or JavaScript, solid SQL, and enough Python to read our pipeline scripts. - Experience with file upload pipelines and data validation. - Clear written communication. We’re on Australian Eastern time, so some overlap helps. To apply, please answer - Which stack would you use (Cloudflare D1, Postgres or Supabase) and why? - Link to a any production app you built with logins and role-based access, and describe your part in it. The prototype, source code and full scope document will be shared with the selected developer after an NDA and contract are signed.