At work 2026-now
Admin console
Creator and, in practice, only developer
The daily web app where staff manage items, pricing, leads, pages, users and billing. Each person can do only what their role allows.
01 The problem
Staff needed one safe place for their daily work. Each person should do only what their role allows. The browser should never hold a full-power key.
02 What I built
- 01
Staff console
One web app, for staff only, for items, pricing, leads, pages, users and billing, with Stripe billing, live push messages and an installable app version.
- 02
Permission fix
Found that many server routes only checked a cookie and then used a full-power service key, and moved them to the real user's token plus a check for each action.
- 03
Backend for frontend
The browser talks only to the app's own server, which holds the keys and calls the services, so the browser never holds a service key.
- 04
Filter formula language
Staff type a filter formula, and a small parser turns it into a fast query that cannot grow out of control, then shows it back exactly as typed.
- 05
Shared admin UI kit
One shared front-end package for all admin web apps, so they look and work the same.
03 How it works
- 01Staff open the console in their browser.
- 02The browser talks only to the console's own server.
- 03That server checks the user's rights for each action.
- 04Then it calls the services with the user's own login token.
04 Result
- Closed a security gap where server routes used a full-power key.
- Each person can now do only what their role allows.
- Staff filter data with simple formulas that run as fast, safe queries.
- Admin apps share one design kit, so they look and work the same.
Stack
- Next.js
- React
- TypeScript
- Stripe
Get in touch.
Working on a platform, a backend or AI agents? Tell me about it.