# Overview

## What TravelHub is

TravelHub is a **multi-tenant flight-booking platform** in the travel domain. It
serves travel agencies: each agency's staff use it to search flight inventory,
sell tickets to travellers, and manage the resulting bookings. It is built as a
reference implementation of a secure, multi-tenant full-stack application.

- **Frontend:** Angular single-page app (the agent console).
- **Backend:** Go HTTP API.
- **Database:** PostgreSQL.
- **Auth:** HTTP Basic, scoped per tenant.

## The multi-tenant model

A **tenant** is one travel agency. Many tenants share a single deployment and a
single database. The central product promise: **no tenant can see another
tenant's data** — not its flights, not its customers, not its revenue, not even
whether a given booking exists.

Storage uses a **shared database, shared schema, `tenant_id` discriminator**:
every tenant-owned row carries the id of the tenant that owns it. Reference data
that is genuinely global — airports and airlines — is shared and has no tenant.

Isolation is enforced in the **application layer**: the tenant is derived from
who you authenticated as, and every query is scoped to that tenant. (This is a
deliberate design choice; PostgreSQL row-level security is intentionally not
used — see [CLAUDE.md](../../CLAUDE.md).)

### What makes isolation visible

The two seeded demo agencies carry the **same routes at different fares** —
Skyline at list price, Globetrotter at a negotiated markup — and different
availability. Signing in as each and searching the same route shows different
results. That contrast is the product's isolation made tangible, not an
accident of the demo data.

## Who uses it

Agency staff in two roles — **admin** and **agent** (see
[Roles & access](04-roles-and-access.md)). There is no traveller-facing
self-service; a traveller is a passenger on a booking an agent makes.

## What it deliberately is not (yet)

A booking is a single one-way flight. Round trips, seat maps, ancillaries,
payment capture, ticketing, and tenant self-signup are out of scope for this
reference build.