# Onboarding MVP Epics and User Stories

## Epic 1: Public Landing Experience

Objective: Present CandleCraft Academy clearly and drive visitors to enquire.

Business value: Gives the startup a credible public entry point and improves conversion to enquiry.

Scope notes: Keep content concise and focused on trust, offerings, and contact CTA.

Dependencies: Brand copy, service summary, contact CTA route.

### Story 1.1

Statement: As a visitor, I want to understand what CandleCraft Academy offers so I can decide whether to enquire.

Priority: High

Acceptance criteria:

- Landing page states the business name and core offerings.
- Landing page describes pottery and knitting tuition in plain language.
- Landing page includes at least one primary CTA to contact or enquire.

### Story 1.2

Statement: As a prospective parent, I want to see trust-building information so I feel comfortable reaching out.

Priority: High

Acceptance criteria:

- Landing page includes a short business introduction.
- Landing page highlights key benefits or reasons to choose the academy.
- Contact CTA is visible without deep navigation.

### Story 1.3

Statement: As a mobile visitor, I want the landing page to remain readable and usable on a small screen.

Priority: Medium

Acceptance criteria:

- Core content stacks cleanly on mobile widths.
- Primary CTA remains visible and usable.
- Text remains legible without horizontal scrolling.

## Epic 2: Enquiry Capture

Objective: Let visitors submit an enquiry with the information the owner needs to follow up.

Business value: Converts interest into actionable leads.

Scope notes: The form should stay short, clear, validated, and follow-up focused.

Dependencies: Landing page CTA, enquiry persistence layer, validation rules.

### Story 2.1

Statement: As a visitor, I want to submit my name, email, and message so I can contact the academy.

Priority: High

Acceptance criteria:

- Contact form collects name, email, and message.
- Required fields show validation errors when empty or invalid.
- Successful submission persists the enquiry and shows a confirmation state.

### Story 2.2

Statement: As a prospective student, I want to specify whether I am interested in pottery, knitting, or both so my enquiry can be routed appropriately.

Priority: High

Acceptance criteria:

- Form includes an interest area field.
- Options include pottery, knitting, both, and not sure.
- Selected value is stored with the enquiry.

### Story 2.3

Statement: As a visitor, I want to optionally include my phone number so the academy has another way to contact me.

Priority: Medium

Acceptance criteria:

- Phone field is optional.
- Invalid phone input is rejected or normalized according to chosen validation.
- Blank phone does not block submission.

### Story 2.4

Statement: As the business owner, I want submissions to record consent to contact so follow-up is clearer and safer.

Priority: Medium

Acceptance criteria:

- Form includes a consent checkbox or equivalent acknowledgement.
- Consent is required before form submission.
- Consent status is stored with the enquiry.

## Epic 3: CAPTCHA / Spam Prevention

Objective: Reduce spam and bot submissions on the enquiry form.

Business value: Protects admin time and improves lead quality.

Scope notes: Keep provider flexible; design for integration rather than over-modeling storage.

Dependencies: Contact form, external CAPTCHA provider selection.

### Story 3.1

Statement: As the business owner, I want spam prevention on the public form so the inbox remains useful.

Priority: High

Acceptance criteria:

- Contact submission requires successful CAPTCHA verification.
- Failed CAPTCHA blocks message creation.
- User sees a clear error when CAPTCHA validation fails.

### Story 3.2

Statement: As a legitimate visitor, I want CAPTCHA errors to be understandable so I can retry successfully.

Priority: Medium

Acceptance criteria:

- CAPTCHA-related failure is displayed near the submission flow.
- Visitor can retry without losing already-entered valid data where technically feasible.

## Epic 4: Admin Authentication

Objective: Restrict admin functionality to authenticated admin users.

Business value: Protects enquiry data and message workflows.

Scope notes: Keep the role model simple for MVP.

Dependencies: Authentication library or framework support.

### Story 4.1

Statement: As an admin, I want to log in securely so I can access incoming enquiries.

Priority: High

Acceptance criteria:

- Admin login page accepts email or username and password.
- Valid credentials grant access to admin pages.
- Invalid credentials show a clear error without exposing sensitive details.

### Story 4.2

Statement: As an unauthenticated visitor, I should be blocked from admin pages so private messages remain protected.

Priority: High

Acceptance criteria:

- Protected admin routes redirect unauthenticated users to login or deny access.
- Public pages remain accessible without login.

### Story 4.3

Statement: As an admin, I want to log out so shared devices do not retain access.

Priority: Medium

Acceptance criteria:

- Admin can trigger logout from the admin UI.
- Logout clears authenticated access to protected pages.

## Epic 5: Admin Message Management

Objective: Let the owner/admin review, triage, and track incoming enquiries.

Business value: Turns captured enquiries into a manageable work queue.

Scope notes: Inbox and detail views are enough for MVP.

Dependencies: Enquiry persistence, admin authentication.

### Story 5.1

Statement: As an admin, I want to see a list of incoming enquiries so I can review new leads.

Priority: High

Acceptance criteria:

- Admin inbox lists submitted enquiries.
- List shows at least sender name, interest area, created time, and status.
- Most recent or newest-status items are easy to identify.

### Story 5.2

Statement: As an admin, I want to open a message detail view so I can read the full enquiry.

Priority: High

Acceptance criteria:

- Admin can open a specific message from the inbox.
- Detail view shows full contact information and message body.
- Detail view shows current status and timestamps.

### Story 5.3

Statement: As an admin, I want to update a message status so I can track progress.

Priority: High

Acceptance criteria:

- Admin can set status values such as `new`, `in_progress`, `resolved`, or `spam`.
- Updated status persists and is visible in the inbox and detail view.

### Story 5.4

Statement: As an admin, I want simple filtering by status so I can focus on unresolved messages.

Priority: Medium

Acceptance criteria:

- Admin inbox supports filtering by status.
- Filter can show unresolved items without manual scanning.

### Story 5.5

Statement: As an admin, I want an internal note field on a message so I can keep private follow-up context.

Priority: Medium

Acceptance criteria:

- Message detail includes an optional admin-only notes field.
- Notes are not visible on the public site.
- Notes persist after save.

## Epic 6: Validation and Security

Objective: Make the MVP robust enough for public use.

Business value: Reduces broken submissions and protects admin data.

Scope notes: Focus on essential validation and access control.

Dependencies: Form handling, auth, framework selection.

### Story 6.1

Statement: As a visitor, I want clear validation errors so I can correct the form quickly.

Priority: High

Acceptance criteria:

- Required fields show inline or nearby error feedback.
- Email format is validated.
- Submission is blocked until validation passes.

### Story 6.2

Statement: As the project team, we want common web risks handled so the MVP is safe enough to demo and deploy.

Priority: High

Acceptance criteria:

- Form submission includes CSRF protection.
- Admin authentication uses hashed passwords.
- Admin routes enforce authentication.
- Inputs are escaped or sanitized appropriately in rendered UI.

## Epic 7: Deployment and Acceptance Readiness

Objective: Make the MVP demonstrable and easy for the team to validate.

Business value: Reduces delivery risk in a short timeline.

Scope notes: Keep this practical and lightweight.

Dependencies: Implemented core flows.

### Story 7.1

Statement: As a team member, I want a clear local setup path so I can run the MVP consistently.

Priority: High

Acceptance criteria:

- Project documents setup prerequisites.
- Team can identify run commands and required environment variables.
- Team can identify how to access public and admin flows locally.

### Story 7.2

Statement: As a team member, I want a concise acceptance checklist so I can verify the MVP before submission.

Priority: High

Acceptance criteria:

- Checklist covers landing page, enquiry submission, CAPTCHA, login, inbox, and message status update.
- Checklist is short enough to use during demos and handover.

## Future Backlog Only

- Booking request workflows
- Calendar scheduling
- Parent accounts
- Student accounts
- Teacher/admin staff roles beyond simple admin
- Resource library and lesson content
- AI assistant or recommendation features
