nilesh.pandClaude Opus 4.8
035711f08c
- CLAUDE.md + AGENTS.md: canonical guiding principles for AI agents and developers (tenant isolation, no RLS, stack, security, conventions, environment gotchas) - SECURITY.md: required security controls (isolation, secrets, auth, input handling, least privilege) with VAPT status - GOVERNANCE.md: how changes are validated before merge — deterministic gates + AI review, risk tiers, human accountability - CONTRIBUTING.md: code hygiene, definition of done, file hygiene - docs/wiki/: product reference (overview, domain model, features, roles & access, API reference, glossary) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2.0 KiB
2.0 KiB
Glossary
| Term | Meaning |
|---|---|
| Tenant | One travel agency using the platform. The owner of all tenant-scoped data. Identified by a slug (e.g. skyline). |
| Agency | The user-facing word for a tenant. |
| Agent | Agency staff member who searches, books and manages reservations. |
| Admin | Agency staff member with (intended) administration rights on top of agent capabilities. |
| Tenant isolation | The guarantee that one tenant cannot see or affect another's data. Enforced in the application layer. |
| PNR / Booking reference | The 6-character code identifying a booking (e.g. QX7A2M). Unique within a tenant. |
| Flight (inventory) | A sellable route on a date at a fare with a seat count, owned by one tenant. The same physical route is a separate row per tenant. |
| Cabin class | economy, premium_economy, business, or first. |
| Seats available / total | Remaining and original seats on a flight. Bookings decrement available; cancellations restore it. |
| Oversell | Selling more seats than exist. Prevented by a row-locked transaction at booking time. |
| IATA code | Standard airport (3-letter, e.g. JFK) or airline (2-letter, e.g. AA) code. |
| Reference data | Global, non-tenant data: airports and airlines, shared by all tenants. |
| X-Tenant | The HTTP header naming which agency a request is for (or taken from the subdomain). |
| Basic auth | The authentication scheme: Authorization: Basic base64(email:password), verified within the named tenant. |
| Suspended tenant | An agency whose users cannot sign in and which is hidden from the agency picker. |
| Evidence report | The e2e test report showing screenshots and the API request/response for each scenario (e2e/evidence-report/). |
| Scenario card | A structured definition of one test scenario in qa/scenarios/; the source a Playwright test is generated from. |
| Binding (test layer) | A test of the seam between layers — that the UI sends what the API expects and renders what it returns. |