Python Backend Engineer - Multi-Tenant Partner Access (5-Day Sprint)

Backend Engineer - Partner Multi-Tenancy & Access Controls (5-Day Sprint) We need an experienced backend engineer to begin immediately and deliver a focused, production-ready backend sprint in 5 calendar days. This is a fixed-price project with a total budget of $350. Project objective Build the backend foundation for approved channel partners to onboard and manage their own companies, workspaces, users, branding, workflows, and usage while enforcing strict database-level tenant isolation. The existing Stripe checkout and subscription flow for direct customers must remain unchanged; authenticated partner-managed users must bypass Stripe. Core requirements - Add partner_id, billing_source, partner status, parent/child workspace mapping, suspension, billing-contact, token-usage, and archive fields with safe migrations and backward compatibility. - Derive partner scope from the authenticated backend session. Every Partner Super Admin query must be restricted to the assigned partner_id, with negative tests proving cross-tenant access is impossible. - Implement Partner Super Admin assignment, partner inheritance, activation/suspension, domain deactivation, session/token revocation, and Stripe-bypass decision logic. - Build a partner activity-log API with pagination and date/event filters. - Build two-step CSV user onboarding: pre-validation with exact row-level errors, followed by transactional batch provisioning, role assignment, partner inheritance, invitation emails, and rollback on critical failure. - Enforce server-side RBAC for Super Admin, Company Admin, Author, and Read-Only Member. - Add billing-contact controls and parent-hub branding inheritance. - Implement approved workflow-template cloning and output-connector verification. - Track monthly workspace token usage, premium-model use, and baseline exceedance. - Add 60-day suspension retention and archiving for threads/chat logs older than one year. Required deliverables - Production-ready backend code and database migrations - API endpoints plus authorization middleware/guards - Unit/integration tests for tenant isolation, authentication, RBAC, Stripe preservation, and partner bypass - API request/response examples and setup/deployment notes - Clear daily commits, concise daily updates, and a final GitHub pull request - Short list of known limitations and a final walkthrough Required experience Strong production experience with Python 3 and FastAPI, Django/DRF, or Flask; REST APIs; PostgreSQL/MySQL; SQLAlchemy/Django ORM/Alembic; multi-tenant SaaS architecture; JWT/session management; RBAC; Stripe integrations; transactional CSV processing; pytest; Git/GitHub; Docker; and Linux. Background workers, Redis, audit logging, CI/CD, and cloud deployment experience are strongly preferred. 5-day delivery plan Day 1: architecture review, schema/migrations, tenant-scoping guard. Day 2: partner assignment/inheritance, Stripe bypass, suspension controls. Day 3: company/workspace mapping, domain deactivation, session revocation, audit events. Day 4: activity-log API, CSV validation/execution, RBAC, branding/billing contacts. Day 5: workflow cloning, connector checks, usage/retention logic, tests, documentation, PR, and walkthrough. Security and preservation of the existing direct-customer Stripe flow are non-negotiable. If a lower-priority feature cannot be completed securely in the sprint, identify it immediately and document the exact remaining work. How to apply Begin your proposal with “Partner Backend Sprint” and include: 1. Relevant backend and multi-tenant/RBAC examples. 2. How you prevent cross-partner data exposure. 3. Your Python framework, database, auth, testing, Stripe, Docker, and GitHub experience. 4. Confirmation that you can start immediately, complete the 5-day sprint, and accept the $350 fixed fee.