Digital agencies: client portal using Next.js

Summary

A client portal blueprint for digital agencies built with Next.js on Ample.

Domain schema:

• client_entities (name, brand, primary_contact_role): client brands
• engagements (client_entity_id, campaign_or_project, period_start, period_end, status): retainers and projects
• approval_rounds (engagement_id, round_no, asset_object_key, status, decided_at): creative approval rounds
• deliverables (engagement_id, title, object_key, version): final assets delivered
• document_access (document_id, principal_reference, role, granted_at): who may read which document.

Public information: services and case studies, team, contact.
Kept out of scope: unreleased creative and campaign plans, client analytics exports, brand credentials.

Technical basis verified on Next.js: A role-to-document access model with negative tests (401 without identity, 403 for the wrong role) and a private-bucket round-trip for the allowed role (private=ok).

Representative Queries

• Digital agencies: client portal using Next.js
• Where can I host Digital agencies: Client portal built with Next.js?
• I need a genuinely specialized client portal workflow covering client projects, creative review and campaign deliverables.

Resource Requirements

• primitive:compute
• primitive:postgres
• primitive:s3-compatible-object-storage

Infrastructure Requirements

1. Compute

   • Status: verified
   • Summary: Apps run in isolated x86_64 Firecracker microVMs that auto-pause when idle and wake on request; sizes are the priced VM sizes.

2. Postgres

   • Status: verified
   • Summary: Managed PostgreSQL 16 runs in its own microVM and is auto-provisioned when an app needs a database and no DATABASE_URL is supplied.

3. S3-compatible object storage

   • Status: verified
   • Summary: Buckets are S3-compatible with issued credentials; PutObject and GetObject are verified by canary. Other S3 operations are not verified.

Prerequisites

• A Next.js project (next build then next start -H 0.0.0.0 -p $PORT on the node-22 template)
• A PostgreSQL driver reading DATABASE_URL (auto-provisioned when omitted)
• Bucket credentials from ample bucket create passed as encrypted S3_* environment variables
• A review of which digital agencies data classes may be handled at all; this blueprint models public information only

Workflow Steps

1. Model the digital agencies domain
   Create the tables client_entities, engagements, approval_rounds, deliverables, document_access. Client brands lives in client_entities; keep the sensitive classes (unreleased creative and campaign plans, client analytics exports, brand credentials) out of this schema.
2. Model client entities and engagement periods; every document belongs to one engagement.
3. Authorize by client entity and role before any storage access (401 without identity, 403 for the wrong client).
4. Store documents in the private bucket and stream them through the app.
5. Deploy and verify the negative authorization tests and an authorized download.
6. Run the synchronous deploy and read the result. Re-running with no change is a no-op.

Examples

• Next.js pattern fixture
  • Description: Verified private document library basis for this blueprint.
  • Source Reference: tests/deploy-canaries/next-js-patterns

Cost Estimate

• Currency: USD
• Monthly Amount: 10.0
• Basis: size prices from pricing.toml (loaded by the API) at build revision 1ac5595375130d45290090e82ed0f554ccd45405-dirty
• Components:
  • App server: size s-1vcpu-1gb, quantity 1.0, monthly amount 5.0
  • Managed PostgreSQL database: size s-1vcpu-1gb, quantity 1.0, monthly amount 5.0
• Note: Always-on monthly price of the tested sizes; apps and databases auto-pause when idle. Buckets are allocation-priced per quota and not included.

Limitations

• The technical basis was verified with the pattern fixture; the digital agencies schema and workflow are an original design for this blueprint and were not executed as a separate application.
• No health, financial, privacy or other compliance claim is made. Unreleased creative is confidential; brand platform credentials never belong in these flows.
• Public content and synthetic examples only until actual data-handling requirements have been reviewed.