nilesh.pandClaude Opus 4.8
035711f08c
- CLAUDE.md + AGENTS.md: canonical guiding principles for AI agents and developers (tenant isolation, no RLS, stack, security, conventions, environment gotchas) - SECURITY.md: required security controls (isolation, secrets, auth, input handling, least privilege) with VAPT status - GOVERNANCE.md: how changes are validated before merge — deterministic gates + AI review, risk tiers, human accountability - CONTRIBUTING.md: code hygiene, definition of done, file hygiene - docs/wiki/: product reference (overview, domain model, features, roles & access, API reference, glossary) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2.5 KiB
2.5 KiB
Features
The agent console, screen by screen. Each maps to a feature area used in the test suite and the evidence report.
Sign in
- The agency picker lists active tenants (the only unauthenticated read).
- The agent chooses an agency, then enters credentials. The same email/password is only valid against the agency it was issued for — valid credentials aimed at the wrong agency are rejected.
- Demo-account shortcuts fill the form for quick access (see Roles & access).
- Sessions survive a reload (credentials held client-side) but not a sign-out; stale credentials are discarded and the user returned to sign-in.
Search flights
- Filter the agency's inventory by origin/destination (IATA), date, cabin, and number of travellers.
- Dropdowns offer only the airports the agency actually flies.
- Sort by lowest fare, shortest trip, or earliest departure.
- Results are paged; each card shows carrier, times (with a +1 for overnight arrivals), duration, fare, cabin, and seats remaining (scarce inventory is flagged). Only future, non-cancelled flights with enough seats appear.
Checkout & booking
- Selecting a flight opens checkout with the fare carried over.
- Enter one or more travellers (up to 9) and contact details; the total reprices live as travellers change.
- Confirming creates the booking and shows a confirmation with the PNR.
- Guardrails: the party can't exceed remaining seats; a seat sold while the form was open surfaces as a clear "just sold" message (409), not an oversell.
Bookings
- List every reservation the agency has sold, filterable by status (confirmed/cancelled), newest first.
- Open a booking to see its full itinerary, travellers, totals and contact.
- Cancel a booking (two-step confirm); the seats return to inventory. A cancelled booking still appears in the list, marked cancelled.
Dashboard
- The agency's trading position: total revenue, confirmed/cancelled bookings, seats sold, future flights in stock.
- Best-selling routes and the most recent bookings.
- All figures are strictly per-agency; a sale moves them and a cancellation moves them back.
Cross-cutting
- Multi-tenant throughout: every screen shows only the signed-in agency's data; the sidebar always names the current agency.
- Responsive: works at desk and phone width; no horizontal scrolling.
- Observable correctness: the e2e suite captures screenshots and the API request/response behind each of these flows into the evidence report.