What the portal is
The supplier portal is a separate web app. It is not a second SharePoint site, and the supplier does not need a SharePoint account. Buyers can run the whole internal process without the portal. Use the portal when an external supplier should read the event, ask a question, and submit a bid.
The portal talks to the Function App. The Function App uses an app-only credential to read and write the SharePoint lists. The signing key for the supplier link stays on that Function App.
Invite a supplier
- In Settings, set the portal base URL to the hosted portal, such as the Vercel address of your portal.
- Invite the supplier from the event. The app builds a link with a signed token.
- Copy the link into the invitation mail, or send mail with Microsoft Graph when Mail.Send is approved.
- The token stays valid through the event close, plus one day.
Supplier suggestions on the invite screen are ranked from suppliers already stored in this site. The ranker does not call an external data broker.
What the supplier can do
- Read the event, documents, and questions. Those files and the Q&A text are stored in plain text for the people who can open the event.
- Acknowledge an addendum when the buyer required it. Submission stays blocked until that acknowledgment is recorded.
- Submit a sealed bid. The portal encrypts the line responses, documents payload, and total with AES-256-GCM and stores the ciphertext. The total is omitted from the readable columns while the bid is sealed.
- Join a live auction when the event has one. Auction prices are visible during the auction.
- Open the supplier inbox when the buyer has sent more than a single notice. Messages can be addressed to the buyer, the supplier, or everyone on the event.
Revoke a link
Revoke a token by the token itself or by its reference. Revocation is stored in the site and refreshed about every 15 seconds, so a copied link stops working even after the Function App restarts.
