Adds application design (awaiting approval)

aidlc-docs/features/cms-frontend/inception/user-stories/stories.md

@@ -16,7 +16,7 @@ As an Owner/Admin/User, I want to log in with my email address and password, so
 - [ ] A `/login` page is displayed for unauthenticated users
 - [ ] The form contains an email field, a password field, and a submit button
 - [ ] Email field validates format before submission (invalid format shows inline error)
-- [ ] Password field has a minimum length client-side hint (8 characters)
+- [ ] Password field enforces backend rules client-side: minimum 8 characters, at least 1 uppercase letter, 1 lowercase letter, 1 digit, and 1 non-alphanumeric character (e.g. `!@#$%`)
 - [ ] On valid credentials: access token is stored in memory, refresh token is set as httpOnly cookie, user is redirected to `/`
 - [ ] On invalid credentials: a generic error message is shown ("Invalid email or password") — no distinction between wrong email and wrong password
 - [ ] On network error: a user-friendly error message is shown ("Unable to connect. Please try again.")
@@ -205,7 +205,8 @@ As a person who received an invitation link, I want to complete my account setup
 **Acceptance Criteria**:
 - [ ] Navigating to `/invite/complete?token={token}` triggers `GET /users/validate-invitation?token={token}`
 - [ ] If the token is valid: a form is shown with a display name field and a password field (with confirmation)
-- [ ] Password must meet minimum requirements (8+ characters); a strength indicator is shown
+- [ ] Password must meet the backend requirements: minimum 8 characters, at least 1 uppercase letter, 1 lowercase letter, 1 digit, and 1 non-alphanumeric character — these rules are enforced client-side before submission and validated server-side
+- [ ] Inline validation messages indicate which specific rule is not yet met (e.g. "Must contain at least 1 uppercase letter")
 - [ ] Password confirmation must match; mismatch shows an inline error
 - [ ] On submit: `POST /users/complete-setup` is called with the token, display name, and password
 - [ ] On success: a confirmation message is shown ("Your account is ready. You can now log in.") with a link to `/login`
@@ -283,7 +284,7 @@ As an authenticated user, I want to see only the navigation items relevant to my
 - [ ] Dashboard: visible to all authenticated users
 - [ ] User Management: visible to Owner and Admin only
 - [ ] System Settings: visible to Owner only
-- [ ] CMS Management: visible to all authenticated users
+- [ ] CMS Management: visible to Owner only (feature is for managing other client CMS instances; out of scope for v1 but access is restricted from the start)
 - [ ] Profile: visible to all authenticated users
 - [ ] Logout: visible to all authenticated users
 - [ ] The sidebar is responsive: collapses to an icon-only view or a hamburger menu on small screens
@@ -309,15 +310,18 @@ As an authenticated user, I want to switch between dark and light themes, so tha
 ## Epic: CMS Management (Placeholder)
 
 ### US-20: View CMS management placeholder page
-**Persona**: Owner, Admin, User
+**Persona**: Owner
 
-As an authenticated user, I want to navigate to the CMS Management section, so that I know where CMS content features will be available in the future.
+As an Owner, I want to navigate to the CMS Management section, so that I know where multi-CMS management features will be available in the future.
 
 **Acceptance Criteria**:
-- [ ] The `/cms` route renders a CMS Management page for all authenticated users
+- [ ] The `/cms` route renders a CMS Management page for Owner only
+- [ ] Navigating to `/cms` as Admin or User redirects to an "Access Denied" page or back to `/`
+- [ ] The CMS Management item is NOT shown in the sidebar for Admin or User roles
 - [ ] The page displays a clear "Work in Progress" or "Coming Soon" message
-- [ ] A brief description explains that CMS content modules will appear here
+- [ ] A brief description explains that this section will allow managing multiple client CMS instances
 - [ ] The page uses the same layout as other pages (sidebar, header)
+- [ ] **Security**: The access restriction is enforced client-side as defence-in-depth; the backend also enforces authorisation
 
 ---