nilesh.pandClaude Opus 4.8
035711f08c
- CLAUDE.md + AGENTS.md: canonical guiding principles for AI agents and developers (tenant isolation, no RLS, stack, security, conventions, environment gotchas) - SECURITY.md: required security controls (isolation, secrets, auth, input handling, least privilege) with VAPT status - GOVERNANCE.md: how changes are validated before merge — deterministic gates + AI review, risk tiers, human accountability - CONTRIBUTING.md: code hygiene, definition of done, file hygiene - docs/wiki/: product reference (overview, domain model, features, roles & access, API reference, glossary) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
50 lines
2.1 KiB
Markdown
50 lines
2.1 KiB
Markdown
# Overview
|
|
|
|
## What TravelHub is
|
|
|
|
TravelHub is a **multi-tenant flight-booking platform** in the travel domain. It
|
|
serves travel agencies: each agency's staff use it to search flight inventory,
|
|
sell tickets to travellers, and manage the resulting bookings. It is built as a
|
|
reference implementation of a secure, multi-tenant full-stack application.
|
|
|
|
- **Frontend:** Angular single-page app (the agent console).
|
|
- **Backend:** Go HTTP API.
|
|
- **Database:** PostgreSQL.
|
|
- **Auth:** HTTP Basic, scoped per tenant.
|
|
|
|
## The multi-tenant model
|
|
|
|
A **tenant** is one travel agency. Many tenants share a single deployment and a
|
|
single database. The central product promise: **no tenant can see another
|
|
tenant's data** — not its flights, not its customers, not its revenue, not even
|
|
whether a given booking exists.
|
|
|
|
Storage uses a **shared database, shared schema, `tenant_id` discriminator**:
|
|
every tenant-owned row carries the id of the tenant that owns it. Reference data
|
|
that is genuinely global — airports and airlines — is shared and has no tenant.
|
|
|
|
Isolation is enforced in the **application layer**: the tenant is derived from
|
|
who you authenticated as, and every query is scoped to that tenant. (This is a
|
|
deliberate design choice; PostgreSQL row-level security is intentionally not
|
|
used — see [CLAUDE.md](../../CLAUDE.md).)
|
|
|
|
### What makes isolation visible
|
|
|
|
The two seeded demo agencies carry the **same routes at different fares** —
|
|
Skyline at list price, Globetrotter at a negotiated markup — and different
|
|
availability. Signing in as each and searching the same route shows different
|
|
results. That contrast is the product's isolation made tangible, not an
|
|
accident of the demo data.
|
|
|
|
## Who uses it
|
|
|
|
Agency staff in two roles — **admin** and **agent** (see
|
|
[Roles & access](04-roles-and-access.md)). There is no traveller-facing
|
|
self-service; a traveller is a passenger on a booking an agent makes.
|
|
|
|
## What it deliberately is not (yet)
|
|
|
|
A booking is a single one-way flight. Round trips, seat maps, ancillaries,
|
|
payment capture, ticketing, and tenant self-signup are out of scope for this
|
|
reference build.
|