Negócios

Context

Negócios (negocios.com.br) is a marketplace that connects people who need a service to companies and independent professionals across Brazil. It is two repositories: a Node.js API with Express and a React site, which is also packaged as an Android app. The site runs on Vercel and the API on Railway.

The challenge

A marketplace only works when demand and supply show up together. The product had to help a customer reach the right professional from a free-form sentence, with service, city, urgency and price; bring real companies onto the platform while it still had few sign-ups; and get the site found on Google by category and city, even though it is a single-page React app that search engines read poorly.

What was built

• AI search: understands the typed sentence, cross-references marketplace companies, Google Places and web search, re-ranks by relevance and summarizes the results in natural language. Without the AI key it falls back to a deterministic mode and keeps working.
• When a search returns few companies or none, it offers a pre-filled quote request, turning an unanswered search into demand for the registered professionals.
• Full quote flow: the customer asks for up to 3 free quotes, the company replies, the customer accepts or declines and, after the service, leaves a review. Both sides talk through an internal chat.
• Role-based access control (Customer, Company and Admin) with 23 granular permissions, enforced by middleware on every API route.
• Admin panel with AI-assisted company import: it finds real companies on Google Places, writes the description, services and FAQ, and publishes only what was reviewed and approved. The same panel moderates requests and reviews and manages categories and cities.
• A community inside the platform: posts, stories, highlights, following companies, comments, notifications, reports and user blocking, plus a blog with AI-generated drafts.
• Assisted sign-up: the postal code fills in city and state, the company tax ID fills in the company data, and the city field autocompletes from the IBGE list of municipalities.
• Technical SEO: the sitemap is generated at build time from API data (categories, category and city, profiles and blog), and a prerender step opens each route in headless Chromium and saves the rendered HTML. Bots that do not run JavaScript therefore see real text.
• Hardened API: input validation with Zod, Helmet, CORS by origin allowlist, layered rate limiting (global, writes and social actions) and structured logs with Pino. The role impersonation used in local tests is ignored in production.
• Automated tests with Vitest for RBAC, search and taxonomy, CORS and slug generation, and a database schema versioned across more than 20 SQL migrations.

Highlight: AI search · RBAC with 23 permissions · SEO by category and city with prerendering

Technologies and the role of each

React

TypeScript site with Vite and React Router, organized by area: auth, marketplace, customer, company, admin, social, blog and chat.

TanStack Query

Fetching, caching and syncing the data that comes from the API.

Node.js

Express 5 API split by area (access, public marketplace, quote flow, admin, automation and social).

Supabase

Postgres and authentication, with the schema versioned in SQL migrations.

OpenAI and Google Places

Search intent, re-ranking, summaries and content; and the source of real companies for import.

Capacitor

Packages the same site as an Android app.