BuiltByBas Backend
The operational engine behind the agency — CRM, proposals, invoicing, and analytics
What We Built
The complete business operating system that runs BuiltByBas. A custom-built admin dashboard with client pipeline management, algorithmic intake scoring, proposal generation engine, invoice system with line items and tax calculations, financial analytics with revenue tracking, and role-based access control. Every client touchpoint from first inquiry to final payment flows through one unified system. No Salesforce, no QuickBooks, no stitching together third-party tools.
Visit Live SiteThe Challenge
Running a software development agency requires managing the entire client lifecycle — from the moment someone fills out an intake form to the final invoice payment. Off-the-shelf tools fragment this workflow: one tool for CRM, another for proposals, another for invoicing, another for analytics. Each has its own login, its own data format, and its own monthly fee. The data never connects. A lead in the CRM has no link to the proposal you sent or the invoice you generated. BuiltByBas needed one system that owns the entire journey.
Our Approach
We built the backend as a single Next.js application with the public site — same codebase, same deploy, zero integration overhead. The intake scoring engine evaluates every lead algorithmically so projects can be prioritized by fit, not gut feeling. The proposal generator builds structured deliverables from intake data without AI API calls — instant and free. The invoice system closes the loop from lead to revenue with line-item detail, tax calculations, and status tracking. Financial analytics aggregate everything into revenue dashboards and monthly trends. RBAC ensures the owner sees everything, team members see their assignments, and clients see only their own project status. Every API route is Zod-validated, every database query uses parameterized inputs, and every protected route checks authentication before rendering.
Project Scope
- Admin dashboard with live metrics: total clients, active projects, revenue, pending invoices
- Kanban pipeline: Inquiry → Consultation → Proposal → Active → Follow-Up with drag-and-drop
- 10-step intake form with algorithmic analysis engine that scores every lead automatically
- Fit scoring across multiple dimensions: budget alignment, project complexity, timeline feasibility
- Proposal generation engine that builds structured proposals from intake data — instant, deterministic
- Revision workflow for proposals with version tracking and client-facing delivery
- Invoice system with line items, tax calculation, status management (draft, sent, paid, overdue)
- Financial analytics dashboard with revenue tracking, monthly trends, and projection data
- Role-based access control: owner, team, and client roles with route-level enforcement
- Custom authentication with httpOnly cookies, bcrypt hashing, rate limiting (5 attempts / 15 min / IP)
- Notification system with real-time badges for new intakes, pending proposals, and overdue invoices
- Client portal for project status visibility and document access
Project Health
Security
10/10 checks
Accessibility
10/10 checks
Performance
10/10 checks
Stability
10/10 checks
Based on 40-point verifiable checklist
Capabilities Demonstrated
Why We Chose This Stack
Next.js
Server components for the admin dashboard mean sensitive business data never ships to the client. API routes colocated with the UI they serve — no separate backend deploy
TypeScript
Strict mode with zero 'any' types. Invoice calculations, scoring algorithms, and auth flows demand compile-time guarantees — a wrong type in a payment amount is real money
PostgreSQL
Relational data: clients have intakes, intakes generate proposals, proposals become invoices. Foreign keys enforce referential integrity. JSONB columns store flexible intake responses without schema sprawl
Zod
Runtime validation on every API endpoint. Every PATCH, POST, and PUT request is validated against a schema before touching the database. Field whitelisting prevents mass assignment attacks
Custom Auth
httpOnly cookies with bcrypt hashing. RBAC enforced at the middleware level — no auth check, no page render. Rate limiting prevents brute force. No third-party auth dependency to break or change pricing
Server Components
Dashboard pages fetch data server-side — no loading spinners, no client-side waterfall requests. The browser receives rendered HTML with real data, making the admin feel instant
Ready to Get Results Like These?
Every project starts with a conversation. Tell us about your business and we'll craft a solution that delivers.