PapaFix is an on-demand home-repair marketplace for the Philippines: customers book electricians, plumbers, and aircon technicians from one mobile app, while technicians accept and complete those jobs from another. Both apps write to a single Supabase Postgres database, but the business had no way to actually oversee the operation — which jobs were stalling, which payments hadn't cleared, where technicians were in the field, or whether a record had been quietly altered. I built the admin panel that sits over all of it: the control room for the entire platform.
What I built
I designed and developed a dark-mode admin panel in React and Supabase that reads, oversees, and corrects everything the two mobile apps generate. The customer app, the technician app, and this panel all share one Postgres database — the apps own the operational writes, and the panel is the layer that gives the business visibility and control over them. It is locked to admin accounts only, enforced not just in the UI but by Postgres row-level security, so it holds full oversight without ever shipping a service key to the browser.
Day-to-day operations
The management tabs cover the operational core. I built full create-read-update-delete for user profiles — searchable and role-filtered across customers, technicians, and admins — with account creation and email changes routed through a secure server-side Edge Function so the service key never touches the browser. Bookings get the same treatment with status, category, payment, and date filters plus a full detail view down to the inspection checklist and on-site QR token. Alongside these sit saved customer locations with inline map previews, a technician availability scheduler with per-slot toggles, and a support-ticket queue with status and priority. Rounding it out are a settings panel for appearance and data preferences and a profile page for managing my own admin account.
Seeing the field in real time
Because technicians work in the field, the panel tracks them in real time. The Live Map renders every technician on an interactive Leaflet map — green when online, grey when offline — alongside the blue pins of active customer job sites, and it auto-refreshes on its own. A companion Tech Locations view lists each technician's last-known coordinates and how long ago they reported in, for when I need the data as a table rather than a map.
Analytics and insight
The Overview dashboard is the at-a-glance health check: headline KPIs against the previous period, a bookings-and-revenue trend, demand patterns by hour and weekday, a top-technicians leaderboard, and a needs-attention queue that surfaces stale jobs, unpaid completed work, and low ratings. The Analytics tab goes deeper, with drill-downs by category, status, and payment, and a technician ranking where clicking one bar cross-filters every chart on the page. Both started out pulling thousands of raw booking rows into the browser to crunch client-side, which doesn't scale — so I moved all of that aggregation into PostgreSQL functions that return pre-summarised JSON, backed by targeted indexes and server-side pagination so the panel stays responsive into the hundreds of thousands of rows.
Oversight and integrity
Oversight only means something if the records can be trusted. The audit trail records every booking and payment event the moment a row changes — created, status moved, technician reassigned, payment captured, fee adjusted — written by Postgres triggers through a SECURITY DEFINER function under row-level security with no update or delete policy, so even an admin can't forge or erase one. I deliberately scoped it to the facts that change a record rather than taps, locations, or message contents: a complete paper trail without surveilling users. A separate activity log captures what admins themselves do inside the panel, keeping the two concerns cleanly apart.
Conclusion
PapaFix is the project where I owned an entire operational surface end to end — from the React interface down to the Postgres triggers, RPCs, row-level security policies, and the Edge Function that keeps privileged work off the client. The throughline was building for scale and trust: aggregate on the server so it holds up as the data grows, and push integrity into the database where it can't be bypassed. It is the clearest example of how I think about full-stack work — that the hard guarantees belong close to the data, and the browser is just an untrusted client looking in.