# Tour Sandbox — free 7-day trial (Brief 20 Phase 1)

_Settings & Administration_

Anonymous visitors at try.crmown.io enter their email, receive a magic link, and land in a 7-day fully-seeded Tour Sandbox without ever setting a password. Phase 1a (shipped 2026-05-21) is the BACKEND foundation: magic-link signup, dormant User row, Northstar-seeded Tour Sandbox org, disposable-email blocklist, rate limits. Phase 1b ships the frontend /try landing pages + the 5-stop guided walkthrough; Phase 1c adds the day-7 expiry worker + 30/60/90-day remarketing cadence; Phase 2 adds the $14 Trial upgrade.

## Steps
1. Visitor lands at try.crmown.io (subdomain wired by John out-of-band — code agnostic to which host serves the page).
2. Enters their email → frontend POSTs /api/tour/start.
3. Backend validates: email shape, disposable-email blocklist (250+ known providers), rate limit (3/IP/24h + 1/email/24h).
4. Magic-link token (10-min TTL) saved on a placeholder dormant User row + placeholder Tour Sandbox Org (status: pending_verification).
5. Email arrives: "Your CRMown Tour Sandbox is ready" with a Start the Tour link.
6. Click → GET /api/tour/verify?token=xxx. Backend activates the Org (sandboxConfig.status = active, expiresAt set +7 days), seeds Northstar synchronously (~30s), issues session JWT.
7. Frontend stores the JWT cookie + redirects to /dashboard?tour=true.

## Tips
- Tour Sandbox orgs use the same isSandbox=true + plan="learner" + sandboxConfig.tier="tour" pattern Brief 20a established for Learner Mode. They share the enrichment-mock layer (no Hunter/Apollo spend) and the outbound-email interception (nothing leaves the sandbox).
- Dormant users have a SENTINEL password hash (bcrypt of crypto.randomBytes(32)) — password login physically cannot authenticate them. Only the magic-link verify flow works until they upgrade to Trial + set a real password.
- Re-entering the same email within the 24h rate-limit window returns the generic "check your inbox" envelope without sending another email. Avoids both spam and the account-existence leak.
- Non-dormant users entering the Tour flow (e.g. an existing paying customer trying to "test" the Tour) get the SAME generic envelope — we never confirm or deny account existence to anonymous callers.
- Tour data lives on the org just like real CRMown data — same tables, same routes, same UI. The only difference is the org row flags (isSandbox=true + plan=learner) that route every outbound side-effect through the interception layer.
- Phase 1a only ships the backend. The /try landing page, walkthrough UI, and the read-mostly restriction enforcement land in Phase 1b. Until then, a Tour user has full edit capability inside their sandbox — fine for testing flows, not yet the brief's read-mostly target state.
- Trial upgrade button currently returns 501 not_yet_available. Phase 2 ships the $14 Stripe SKU + 5 industry seeds + Trial→Paid conversion. Users on Phase 1a Tour see "Trial coming soon — your 7-day Tour continues" if they try to upgrade.

## Example
A marketing-agency owner sees a "Try CRMown free for 7 days, no card needed" CTA on the homepage, enters her work email at try.crmown.io. Magic-link email arrives in 8 seconds. She clicks, lands in her own Tour Sandbox 30 seconds later — fully populated with Northstar Marketing's 47 contacts, $42K Hopper deal in Negotiation, a 3-stage Pipeline, and a "Welcome lead nurture" Workflow she can poke. She runs the AI Bar query "What deals are most likely to close this quarter?" and gets a real answer. She drags the Hopper deal from Negotiation → Closed Won; the pipeline AI re-projects revenue. None of this touches a real CRMown customer or burns a single Hunter API call. Six days later she clicks "Upgrade to a 14-day Trial with my own data" → Phase 2 Stripe checkout flow.

## Troubleshooting
- **"A Tour link was already sent to this address today" message on /try** — Per-email rate limit (1/24h). Either a previous Tour link was already sent and the visitor missed it, or someone else used this email for a Tour in the last 24 hours. Fix: Check the inbox (and spam folder). The link is valid for 10 minutes from issue, so a 24-hour-old link won't work even if found — they'll need to wait until the next day to request a new one.
- **"Disposable email addresses aren't supported" message** — The email's domain matches the blocklist (250+ known disposable providers: mailinator, 10minutemail, guerrillamail, etc.). Fix: Use a work or personal email. Real privacy providers (protonmail, fastmail, hey.com, etc.) are NOT blocked — only the throwaway / temp-mail services.
- **Magic link has expired error** — The link is valid for 10 minutes from issue. Clicking a stale link (e.g. from a 2-hour-old email) returns this error. Fix: Go back to try.crmown.io and request a new Tour — the per-email rate limit allows 1 attempt per 24 hours, but if the previous attempt expired without being used, this will go through immediately.
- **Tour Sandbox dashboard is empty / no Northstar data visible** — The Northstar seed runs synchronously during verify but is wrapped in try/catch — if seeding failed (DB issue, permissions, etc.) the verify flow still completes and the user lands on an empty dashboard. Fix: Check platform logs for "[tour] Northstar seed failed" errors. A re-seed cron will reprovision empty Tour orgs in Phase 1c; for now, support can re-run the seed manually via the seed-northstar CLI script with the Tour org's ID.

## Error messages
- `invalid_email` — Email shape didn't match the basic regex (e.g. no @ or missing TLD).
- `disposable_email` — Domain matched the disposable-email blocklist. Use a real work or personal email.
- `rate_limited` — Either 3 Tour starts already came from this IP in the last 24 hours, OR this email already requested a Tour in the last 24 hours.
- `invalid_token` — Magic-link token in the URL doesn't exist or was already consumed.
- `expired_token` — Magic-link is older than 10 minutes. Start a fresh Tour to get a new one.
- `trial_phase_2` — You clicked "Upgrade to Trial" — that feature lands in Phase 2. For now your Tour continues for the full 7 days.

## Plans
Tour Sandbox is anonymous-accessible (no plan, no signup) but bounded by 7-day expiry + the rate limits. It is NOT subject to the Max/Own gate that standard Enterprise Sandboxes have, nor the all-paid-plan gate Learner Mode sandboxes have.