nilesh.pandClaude Opus 4.8
035711f08c
- CLAUDE.md + AGENTS.md: canonical guiding principles for AI agents and developers (tenant isolation, no RLS, stack, security, conventions, environment gotchas) - SECURITY.md: required security controls (isolation, secrets, auth, input handling, least privilege) with VAPT status - GOVERNANCE.md: how changes are validated before merge — deterministic gates + AI review, risk tiers, human accountability - CONTRIBUTING.md: code hygiene, definition of done, file hygiene - docs/wiki/: product reference (overview, domain model, features, roles & access, API reference, glossary) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2.1 KiB
Overview
What TravelHub is
TravelHub is a multi-tenant flight-booking platform in the travel domain. It serves travel agencies: each agency's staff use it to search flight inventory, sell tickets to travellers, and manage the resulting bookings. It is built as a reference implementation of a secure, multi-tenant full-stack application.
- Frontend: Angular single-page app (the agent console).
- Backend: Go HTTP API.
- Database: PostgreSQL.
- Auth: HTTP Basic, scoped per tenant.
The multi-tenant model
A tenant is one travel agency. Many tenants share a single deployment and a single database. The central product promise: no tenant can see another tenant's data — not its flights, not its customers, not its revenue, not even whether a given booking exists.
Storage uses a shared database, shared schema, tenant_id discriminator:
every tenant-owned row carries the id of the tenant that owns it. Reference data
that is genuinely global — airports and airlines — is shared and has no tenant.
Isolation is enforced in the application layer: the tenant is derived from who you authenticated as, and every query is scoped to that tenant. (This is a deliberate design choice; PostgreSQL row-level security is intentionally not used — see CLAUDE.md.)
What makes isolation visible
The two seeded demo agencies carry the same routes at different fares — Skyline at list price, Globetrotter at a negotiated markup — and different availability. Signing in as each and searching the same route shows different results. That contrast is the product's isolation made tangible, not an accident of the demo data.
Who uses it
Agency staff in two roles — admin and agent (see Roles & access). There is no traveller-facing self-service; a traveller is a passenger on a booking an agent makes.
What it deliberately is not (yet)
A booking is a single one-way flight. Round trips, seat maps, ancillaries, payment capture, ticketing, and tenant self-signup are out of scope for this reference build.