Case studyInternal platform
Dealer Portal
A Flask admin platform that replaced fragile, hand-run scripts with a safe, auditable way to distribute marketing assets across a 36-dealer retail network. Every change previewed before it runs and logged after it does.
Client not named publicly. Everything below is accurate; only the attribution is withheld. Happy to walk through the work in detail, and introduce you to the client, on request.
- Python
- Flask
- Nextcloud API
- Apache / gunicorn
- Linux
- dealers served
- 36dealers served
- access roles enforced
- 3access roles enforced
- incident found and recovered
- 1 dayincident found and recovered
A national audio distributor supplies marketing assets to its retail dealer network. When the work started, that distribution ran on hand-written scripts managing folders and symlinks, with the source files living in one employee's personal cloud account. There was no preview, no undo, and no record of what had been sent to whom. Hart & Heim replaced it.
What was actually broken
- Campaign assets were pushed by hand-run scripts managing folders and symlinks — no preview, no undo, no log
- Source files lived in a single employee's personal account, making one person a hard dependency for the entire pipeline
- Dealer data was duplicated between a spreadsheet and the scripts, so the two drifted apart over time
Plan, review, execute
The core pattern is that nothing happens without a preview. Choosing dealers produces a plan — the exact directory and symlink operations, plus warnings — and only an explicit confirmation turns that plan into changes on disk.
- Dry-run preview on every campaign, showing operations before execution rather than after
- Typed confirmation on destructive paths, not a single click
- Append-only audit log capturing user, IP and timestamp for every deploy, upload and admin action
- A never-hard-delete policy: archiving preserves dealer-uploaded content instead of removing it
An incident, and what changed because of it
The safety design was tested by a real failure. On one deploy, an explicit five-dealer selection was silently reset to the default target when the page re-rendered after the dry-run, and a campaign shipped to the wrong destination.
- Root cause: the form's "user has touched this field" state was not carried through the dry-run re-render, so the reloaded page was treated as fresh and reapplied its default
- Caught and recovered the same day, then fixed at the root — an explicit selection now survives any number of repaints
- The same review discipline was extended to the archive path, with a regression suite covering that flow specifically
- The broader change was in method: verification moved from clicking through the UI and eyeballing it to deterministic, script-driven checks of actual system state
Proven at scale
- A 32-dealer campaign shipped clean through the fixed flow — bespoke banners for 13 dealers, 18 more discovered and onboarded mid-flight, and a generic set that auto-propagated to the rest with no redeploy
- A historical 35-dealer campaign was archived with zero data loss, and an orphaned multi-gigabyte folder was found and archived rather than deleted
- The host underneath the portal was upgraded through the same discipline: full backup, maintenance mode and a verified rollback plan before anything was touched
Security posture
- Authenticated over HTTPS with role-based access — viewer, editor, admin — and idle session timeout
- CSRF tokens on every mutating form; path-traversal guards on all filesystem operations
- Upload targets rejected when the destination is a symlink rather than a real directory
- Deployed behind Apache and gunicorn with a scripted TLS and service setup