## The short version

A client portal blueprint for b2b saas built with Django on Ample. Domain schema: customer_workspaces (name, plan, seat_count, created_at): customer tenants; workspace_members (workspace_id, email, role): members and roles per workspace; doc_versions (product_version, title, object_key, published_at): versioned product documentation; customer_assets (workspace_id, title, object_key, visibility): assets scoped to one customer; document_access (document_id, principal_reference, role, granted_at): who may read which document. Public information: product documentation by version, pricing and plan comparison, status and changelog. Kept out of scope until handling is reviewed: customer data inside workspaces, usage and billing records, support attachments. Customer workspace data is tenant-scoped; isolation is application-enforced and no security certification is claimed. Technical basis verified on Django: a role-to-document access model with negative tests (401 without identity, 403 for the wrong role) and a private-bucket round-trip for the allowed role (private=ok).

## What it needs

- [Compute](/content/discover/primitive/compute/index.html): verified (Apps run in isolated x86_64 Firecracker microVMs; sizes are the priced VM sizes.)
- [Postgres](/content/discover/primitive/postgres/index.html): verified (Managed PostgreSQL 16 runs in its own microVM and is auto-provisioned when an app needs a database and no DATABASE_URL is supplied.)
- [S3-compatible object storage](/content/discover/primitive/s3-compatible-object-storage/index.html): verified (Buckets are S3-compatible with issued credentials; PutObject and GetObject are verified by canary. Other S3 operations are not verified.)

## Before you start

- A Django project (pip install into .ample/python from requirements.txt, then waitress serving project.wsgi from run.py reading PORT on the python-3.12 template)
- A PostgreSQL driver reading DATABASE_URL (auto-provisioned when omitted)
- Bucket credentials from `ample bucket create` passed as encrypted S3_* environment variables
- A review of which b2b saas data classes may be handled at all; this blueprint models public information only

## How to do it

1. Create the tables customer_workspaces, workspace_members, doc_versions, customer_assets, document_access. Customer tenants lives in customer_workspaces; keep the sensitive classes (customer data inside workspaces, usage and billing records, support attachments) out of this schema.

2. Model client entities and engagement periods; every document belongs to one engagement.

3. Authorize by client entity and role before any storage access (401 without identity, 403 for the wrong client).

4. Store documents in the private bucket and stream them through the app.

5. Deploy and verify the negative authorization tests and an authorized download.

6. Run the synchronous deploy once and read the result. Re-running with no change is a no-op.
   
   ```
   ample deploy . --name <app-name> --public --start "python3 run.py" --env S3_ENDPOINT=... --env S3_REGION=... --env S3_BUCKET=... --env S3_ACCESS_KEY_ID=... --env S3_SECRET_ACCESS_KEY=...
   ```

7. Run the pattern self-test(s) from the example (/p/private-document-library) and your own acceptance checks for the b2b saas workflow.
   
   ```
   ample logs <deployment_id> --kind build
   ```

## Tested examples

- **Django pattern fixture** (`tests/deploy-canaries/django-patterns`): Verified private document library basis for this blueprint.

## How to know it worked

- app responds on its public URL (`/` on the live URL, expect ample canary django patterns)
- private-document-library self-test from the example (`/p/private-document-library` on the live URL, expect see the pattern fixture checks)

## Cost estimate

Estimated 10.00 USD per month (size prices from pricing.toml at build revision ca0b484a7a9957c573a88d3a32dc603c3c10135a).

- app server x1 `s-1vcpu-1gb`: 5.00 USD
- managed PostgreSQL database x1 `s-1vcpu-1gb`: 5.00 USD

Upper-bound monthly price of the tested sizes. Buckets are allocation-priced per quota and not included.

## Verification evidence

- canary_run on 2026-09-20T03:31:44Z at revision `03b6402b1b3e19178985f08ea4033804521d85d4 (CLI b75e104)`: Django pattern fixture deployed on Ample (pip install into .ample/python from requirements.txt, then waitress serving project.wsgi from run.py reading PORT on the python-3.12 template); the private document library checks passed: a role-to-document access model with negative tests (401 without identity, 403 for the wrong role) and a private-bucket round-trip for the allowed role (private=ok). The blueprint's B2B SaaS schema and workflow below build on that verified basis and were not separately executed. (expires 2027-03-19T03:31:44Z)

## Execution binding

MCP tool `ample_deploy` (registry `mcp:ample_deploy`), schema hash `876465fce906da0c` observed 2026-09-22T00:31:22.774679+00:00 at revision `e6446ceea69b`. Binding state at export: schema_changed. Required scopes: servers:write, databases:read, buckets:read.

## Typed next actions

- Browse the catalog index (`GET /v1/catalog` on the api origin; authentication not required, approval not required)
- Search published recipes by intent, stack and constraints (`POST /v1/catalog/search` on the api origin; authentication not required, approval not required)
- Prepare a side-effect-free deployment plan for an authorized project (`POST /v1/catalog/plan` on the api origin; authentication required, approval not required) 
- Read the existing agent authentication setup (`GET /mcp/setup` on the api origin; authentication not required, approval not required)
- Browse B2B SaaS (`GET /v1/catalog/nodes/industry%3Ab2b-saas` on the api origin; authentication not required, approval not required)
- Browse Client portal (`GET /v1/catalog/nodes/workload%3Aclient-portal` on the api origin; authentication not required, approval not required)
- Browse Django (`GET /v1/catalog/nodes/stack%3Aframework-django` on the api origin; authentication not required, approval not required)
- Browse Deploy web app (`GET /v1/catalog/nodes/intent%3Adeploy-web-app` on the api origin; authentication not required, approval not required)

## About this recipe

Recipe `page:blueprints:b2b-saas:client-portal:django`. Revision r1.

release **published** support **verified** execution **blocked (schema_changed: live tool schema differs from the recorded binding)**

Formats: [HTML](/content/blueprints/b2b-saas/client-portal/django/index.html) | [Markdown](/content/blueprints/b2b-saas/client-portal/django.md) | [JSON contract](https://api.ample.computer/v1/catalog/recipes/page%3Ablueprints%3Ab2b-saas%3Aclient-portal%3Adjango)