Initial commit: TravelHub multi-tenant flight booking platform

Angular + Go + PostgreSQL sample with strict per-tenant isolation. - Backend: Go API (basic auth, tenant-scoped repository layer, pgx pool) - Frontend: Angular 22 SPA (search, checkout, bookings, dashboard) - Database: schema, seed data and demo bookings migrations - Tests: 311 across Go (integration), Angular (unit) and Playwright (e2e), plus a generated evidence report with PDF export - Security: whitebox VAPT report under security/ Secrets (.env, tokens, DB credentials) are git-ignored. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-09-13 11:38:01 +05:30
commit 4d3eb18a6c
129 changed files with 25424 additions and 0 deletions
@@ -0,0 +1,76 @@
+import { defineConfig, devices } from '@playwright/test';
+
+const WEB = process.env.E2E_BASE_URL ?? 'http://localhost:4200';
+const API = process.env.E2E_API_URL ?? 'http://localhost:8080';
+
+export default defineConfig({
+  testDir: './tests',
+  outputDir: './test-results',
+
+  // These tests share one database, and several of them assert on seat counts
+  // and booking totals. Running a single worker keeps those assertions
+  // meaningful; the suite is small enough that the wall-clock cost is minor.
+  workers: 1,
+  fullyParallel: false,
+
+  // A stray test.only should fail the build rather than silently skip the suite.
+  forbidOnly: !!process.env.CI,
+  retries: process.env.CI ? 2 : 0,
+
+  timeout: 60_000,
+  expect: { timeout: 10_000 },
+
+  // The evidence reporter turns the screenshots and data captured by passing
+  // tests into a readable run report; the html one stays for debugging failures.
+  reporter: process.env.CI
+    ? [['github'], ['html', { open: 'never' }], ['./reporters/evidence.ts'], ['list']]
+    : [['html', { open: 'never' }], ['./reporters/evidence.ts'], ['list']],
+
+  use: {
+    baseURL: WEB,
+    trace: 'retain-on-failure',
+    // 'on' rather than 'only-on-failure': the evidence report is a record of
+    // what passed, so every test contributes at least a final screenshot.
+    screenshot: 'on',
+    video: 'retain-on-failure',
+    actionTimeout: 15_000,
+  },
+
+  projects: [
+    {
+      name: 'chromium',
+      use: { ...devices['Desktop Chrome'], viewport: { width: 1440, height: 900 } },
+    },
+    // A narrow viewport, because the console is built to work on a phone too.
+    // Only the read-mostly specs run here: the booking flows write to a shared
+    // database, and running them twice would churn the demo data for no gain.
+    {
+      name: 'mobile-chrome',
+      use: { ...devices['Pixel 7'] },
+      testMatch: /(auth|responsive)\.spec\.ts/,
+    },
+  ],
+
+  // Starts the Go API and the Angular dev server if they are not already up, so
+  // `npm test` is the only command a developer or CI job needs.
+  webServer: [
+    {
+      command: 'go run ./cmd/api',
+      cwd: '../backend',
+      url: `${API}/api/health`,
+      reuseExistingServer: !process.env.CI,
+      timeout: 180_000,
+      stdout: 'ignore',
+      stderr: 'pipe',
+    },
+    {
+      command: 'npm start',
+      cwd: '../frontend',
+      url: WEB,
+      reuseExistingServer: !process.env.CI,
+      timeout: 240_000,
+      stdout: 'ignore',
+      stderr: 'pipe',
+    },
+  ],
+});