Buyer roles
- Admin. Every page, settings, and unseal.
- Sourcing Manager. Events, suppliers, invitations, unseal, auctions, award recommendations, and audit export. No settings page.
- Approver. Requisition, event, and award approvals, plus read access to the event, calendar, documents, and reports.
- Evaluator. Score assigned bids. Cannot view other evaluators' scores, cannot unseal, and cannot open settings.
- Supplier. No SharePoint pages. Access is the signed portal link only.
A direct role assignment is what the app checks. SharePoint site owners can still open the lists behind the app, which is why sealed prices are encrypted rather than merely hidden in the interface.
SharePoint permissions
Put the app on a site whose members are the sourcing team. Visitors who should not see supplier documents should not have read permission on that site. The public tender board inside the app only shows events the signed-in buyer is allowed to open, and only when those events are marked public.
Sealed bids
Ciphertext in the bid list is not the price. Reading the list item, exporting the list with a SharePoint view, or granting yourself site-owner rights does not decrypt it. Decryption happens when an authorized buyer unseals, and only if the Function App still holds the seal key.
Treat the Function App configuration as a production secret. Rotate it only with a plan for bids that were encrypted with the previous key. Losing the key means those sealed envelopes cannot be opened.
Supplier links
A portal link is a bearer token. Anyone who has the link can act as that supplier until the token expires or you revoke it. Send the link to the supplier contact, and revoke it if it was forwarded to the wrong person.
Q&A text and uploaded event documents are not inside the sealed envelope. Do not put a price that must stay secret into a clarification or an attachment.