Full-Stack Web Developer to Fix, Improve an Existing Pilot Website (Supabase, JavaScript and Vercel)

Job title: Experienced Full-Stack Developer Needed to Fix and Improve Existing PartRoute Pilot Website Project overview I need an experienced full-stack web developer to audit, fix, secure, and improve an existing mobile-friendly pilot website called PartRoute. PartRoute connects customers looking for car, generator, inverter, and solar parts with matched dealers in Lagos, Nigeria. The website is already built and deployed using GitHub, Vercel, JavaScript, Supabase and PostgreSQL. This is not a request to rebuild the website from scratch. The developer must first review the existing code and database, identify problems, and preserve the approved design and working features. Current website features • Mobile-friendly customer enquiry form • Different form fields based on the selected parts category • Automatic matching of enquiries to dealers • Separate dealer and administrator login pages • Dealer and administrator dashboards • Supabase authentication and PostgreSQL database • Customer photo uploads • Dealer response forms • WhatsApp contact buttons and click tracking • Enquiry reference numbers • Administrative statistics and CSV export Required corrections and improvements 1. Complete technical and security review Review the existing GitHub code, Vercel deployment, Supabase database, authentication, storage, functions, and security settings. Check Supabase Row Level Security policies and database permissions. Dealers must not be able to access another dealer’s enquiries, responses, private information, or unmatched customer information. Customer photos and contact information must be protected from unauthorized access. 2. Administrator login correction Fix an intermittent administrator login error that says: “Cannot read properties of null (reading ‘id’).” The administrator login currently works in an incognito browser but may fail in a regular browser. Investigate session handling, cached authentication data, profile loading, and browser compatibility. Display a clear error message instead of allowing the page to crash. 3. Dealer activation controls The administrator must be able to change a dealer’s status to: • Active • Inactive • Suspended Only active dealers should receive or be counted in new enquiry matches. Inactive, suspended, and test dealers must not be included. Changing a dealer to inactive or suspended must stop future matching without deleting the dealer’s previous enquiry records. 4. Correct dealer matching Only active dealers whose approved categories match the customer’s selected category should receive the enquiry. The administrator dashboard must display: • The correct number of matched dealers • The names of the matched dealers • Each dealer’s category • The dealer’s current account status The developer must test the matching process for car, generator, inverter, and solar enquiries. 5. Dealer-management controls The administrator must be able to: • Add a new dealer • Edit dealer information • Edit the dealer’s parts categories • Activate, deactivate, or suspend a dealer • Review the dealer’s enquiry history • View dealer response and completion rates • Send a secure password-reset link • Disable dealer access when necessary Dealers should be able to change their own passwords securely. The administrator must never see, request, or use a dealer’s private password. Administrator access must be provided through secure role-based controls. 6. Customer-contact protection A matched dealer must not immediately see the customer’s phone number or WhatsApp contact button. The dealer must first review the enquiry and choose one of these clear dropdown options: • Part Available • Part Not Available • Need More Information If the dealer selects Part Available, the system may reveal the customer’s phone number and WhatsApp contact button to that dealer. The system must record: • Dealer’s name • Enquiry reference • Availability response • Date and time of the response • Date and time the customer’s contact information was revealed • Whether the WhatsApp contact button was clicked A dealer who selects Part Not Available should not receive access to the customer’s phone number. 7. Mandatory dealer follow-up After receiving access to the customer’s contact information, the dealer must complete a simple follow-up form using clear dropdown options. The form should include: • Did you contact the customer? • Did the customer respond? • Was the requested part available? • Was the part sold? • If not sold, what was the reason? • What is the final enquiry status? Suggested final-status options: • New enquiry • Part available • Customer contacted • Waiting for customer • Sale completed • No sale • Closed The administrator must be able to see all responses and identify dealers who repeatedly access customer information without completing follow-up reports. 8. Immediate dealer notifications When a customer submits an enquiry, every active matched dealer should receive an immediate notification containing: • PartRoute enquiry reference • Parts category • Part name • Vehicle make, model and year when applicable • Customer’s Lagos area • A secure link to open the enquiry in the dealer dashboard The notification must not reveal the customer’s phone number. The dealer must log in and confirm availability before accessing the customer’s contact information. Please provide separate prices for these two options: Option A: Add a WhatsApp button to the administrator dashboard that creates a prepared message for the administrator to send manually to each matched dealer. Option B: Integrate the WhatsApp Business Platform so the notification is sent automatically to every matched dealer immediately after the enquiry is submitted, without the administrator clicking anything. For Option B, explain all Meta/WhatsApp account requirements, approved message-template requirements, setup costs, and ongoing messaging charges. The system should record: • Which dealer was notified • Notification date and time • Whether the notification was created or sent • Delivery status, when available • Any notification failure Please include email notification as a backup if an automatic WhatsApp notification fails. 9. Administrator tracking dashboard For every enquiry, the administrator should be able to see: • Enquiry reference number • Customer’s requested part • Names of matched dealers • Whether each dealer was notified • Dealer’s availability response • Dealer response time • Whether customer contact information was revealed • Whether the WhatsApp button was clicked • Whether the dealer contacted the customer • Whether the customer responded • Whether a sale was completed • Final enquiry status The administrator dashboard should use understandable words and dropdown statuses rather than unexplained numbers. 10. Customer follow-up and outcome reporting Create a secure way for the administrator to follow up with the customer or send the customer a secure outcome form. The customer should be able to report: • Whether any dealer contacted them • Which dealer contacted them • Whether the requested part was available • Whether they purchased the part • Which dealer completed the sale • Why no purchase was made, if applicable The customer’s report should be connected to the correct enquiry reference and visible on the administrator dashboard. 11. WhatsApp-click tracking Confirm what is currently counted as a WhatsApp click. The system should distinguish between: • Administrator clicking a dealer-notification button • Dealer clicking to contact a customer • Customer clicking to contact a dealer Each click should be connected to the correct enquiry and dealer and recorded with the date and time. A click must not automatically be counted as a completed contact or sale. 12. Mobile usability improvements Review and improve the customer, dealer, and administrator pages on mobile devices. Correct: • Buttons or fields that are too small • Content extending beyond the screen • Confusing forms or status labels • Difficult navigation • Missing loading messages • Unclear success and error messages • Browser compatibility problems Preserve the approved PartRoute branding and overall design unless a specific change is agreed upon. 13. Customer enquiry form Confirm that the form displays the correct fields for each category: Car parts: • Vehicle make • Model • Year • Part name Generator parts: • Brand • KVA • Part name Inverter and solar parts: • Brand • Capacity • Part name All enquiries should also include the customer’s Lagos area and an optional photo. Validate required fields and display clear messages when information is missing. 14. Photo security Review customer photo uploads and ensure that: • File types and file sizes are limited • Files are stored securely • Public links are not permanently exposed • Only authorized matched dealers and the administrator can access the photo • Inactive, suspended, or unmatched dealers cannot access it 15. Enquiry history and records Do not delete enquiry history when a dealer becomes inactive. Maintain an audit history showing important actions, including: • Dealer activation or deactivation • Enquiry matching • Availability confirmation • Customer-contact access • WhatsApp clicks • Status changes • Customer and dealer outcome reports 16. Google Ads conversion tracking Review the customer enquiry success page and prepare it for accurate Google Ads conversion tracking. A conversion should be recorded only after a customer successfully submits a genuine enquiry, not merely when someone visits the website or clicks a button. Please state whether Google Tag Manager or a direct Google Ads tag is recommended for the current website. Do not install tracking until the proposed setup and privacy implications are explained and approved. 17. Testing requirements Test the complete process on mobile and desktop: 1. Customer submits an enquiry. 2. Only eligible active dealers are matched. 3. Matched dealers are notified. 4. The dealer logs in and reviews the enquiry. 5. The dealer confirms availability. 6. Customer contact information is revealed only when permitted. 7. Dealer contact and WhatsApp actions are tracked. 8. Dealer completes the follow-up form. 9. Customer completes the outcome form. 10. Administrator sees the correct records and statistics. Please test regular and incognito browser sessions and confirm that the website works correctly in common mobile browsers. 18. Backup, testing and deployment Before making changes: • Create or confirm a complete backup • Use a separate test or staging environment • Do not experiment directly on the live pilot website • Do not delete or overwrite existing customer or dealer data • Do not expose Supabase service keys or other secrets in public code All changes must be tested and approved before being deployed to the live website. 19. Documentation and handover Provide clear, simple documentation explaining: • What problems were found • What was changed • How dealer activation works • How matching works • How notifications work • How to add and manage dealers • How to review enquiry outcomes • How backups work • Any ongoing costs or third-party services • How to restore the previous version if necessary Required experience The developer must have proven experience with: • Supabase • PostgreSQL • Row Level Security • Authentication and role-based access • JavaScript and responsive web development • GitHub • Vercel • Secure file storage • Existing-project debugging • Customer, dealer, or administrator dashboards Experience with the WhatsApp Business Platform and Google Ads conversion tracking is preferred. Please provide: • Examples of Supabase projects you have completed • A short explanation of how you will audit an existing project • Your estimated hours and total expected cost • A fixed-price quote if possible • Separate pricing for manual and automatic WhatsApp notifications • Your expected completion time • Any ongoing third-party costs • Confirmation that you can work through milestones • Confirmation that you will not rebuild or replace the current website without written approval Recommended milestones Milestone 1: Code, database and security audit with a written findings report Milestone 2: Critical login, dealer-management and matching corrections Milestone 3: Availability confirmation, protected customer contact, dealer follow-up and administrator tracking Milestone 4: Dealer notifications, customer outcome reporting and Google Ads tracking preparation Milestone 5: Mobile and desktop testing, live deployment, documentation and handover Please identify any feature that should be postponed because of cost, technical risk, or pilot-stage limitations before the contract begins.