img:first-child]:pt-0 data-[size=sm]:[--card-spacing:--spacing(3)] data-[size=sm]:has-data-[slot=card-footer]:pb-0 *:[img:first-child]:rounded-t-xl *:[img:last-child]:rounded-b-xl",
+ className
+ )}
+ {...props}
+ />
+ )
+}
+
+function CardHeader({ className, ...props }: React.ComponentProps<"div">) {
+ return (
+
+ )
+}
+
+function CardTitle({ className, ...props }: React.ComponentProps<"div">) {
+ return (
+
+ )
+}
+
+function CardDescription({ className, ...props }: React.ComponentProps<"div">) {
+ return (
+
+ )
+}
+
+function CardAction({ className, ...props }: React.ComponentProps<"div">) {
+ return (
+
+ )
+}
+
+function CardContent({ className, ...props }: React.ComponentProps<"div">) {
+ return (
+
+ )
+}
+
+function CardFooter({ className, ...props }: React.ComponentProps<"div">) {
+ return (
+
+ )
+}
+
+export {
+ Card,
+ CardHeader,
+ CardFooter,
+ CardTitle,
+ CardAction,
+ CardDescription,
+ CardContent,
+}
diff --git a/src/components/ui/input.tsx b/src/components/ui/input.tsx
new file mode 100644
index 0000000..7d21bab
--- /dev/null
+++ b/src/components/ui/input.tsx
@@ -0,0 +1,20 @@
+import * as React from "react"
+import { Input as InputPrimitive } from "@base-ui/react/input"
+
+import { cn } from "@/lib/utils"
+
+function Input({ className, type, ...props }: React.ComponentProps<"input">) {
+ return (
+
+ )
+}
+
+export { Input }
diff --git a/src/components/ui/label.tsx b/src/components/ui/label.tsx
new file mode 100644
index 0000000..74da65c
--- /dev/null
+++ b/src/components/ui/label.tsx
@@ -0,0 +1,20 @@
+"use client"
+
+import * as React from "react"
+
+import { cn } from "@/lib/utils"
+
+function Label({ className, ...props }: React.ComponentProps<"label">) {
+ return (
+
+ )
+}
+
+export { Label }
diff --git a/src/components/ui/select.tsx b/src/components/ui/select.tsx
new file mode 100644
index 0000000..e8021f5
--- /dev/null
+++ b/src/components/ui/select.tsx
@@ -0,0 +1,201 @@
+"use client"
+
+import * as React from "react"
+import { Select as SelectPrimitive } from "@base-ui/react/select"
+
+import { cn } from "@/lib/utils"
+import { ChevronDownIcon, CheckIcon, ChevronUpIcon } from "lucide-react"
+
+const Select = SelectPrimitive.Root
+
+function SelectGroup({ className, ...props }: SelectPrimitive.Group.Props) {
+ return (
+
+ )
+}
+
+function SelectValue({ className, ...props }: SelectPrimitive.Value.Props) {
+ return (
+
+ )
+}
+
+function SelectTrigger({
+ className,
+ size = "default",
+ children,
+ ...props
+}: SelectPrimitive.Trigger.Props & {
+ size?: "sm" | "default"
+}) {
+ return (
+
+ {children}
+
+ }
+ />
+
+ )
+}
+
+function SelectContent({
+ className,
+ children,
+ side = "bottom",
+ sideOffset = 4,
+ align = "center",
+ alignOffset = 0,
+ alignItemWithTrigger = true,
+ ...props
+}: SelectPrimitive.Popup.Props &
+ Pick<
+ SelectPrimitive.Positioner.Props,
+ "align" | "alignOffset" | "side" | "sideOffset" | "alignItemWithTrigger"
+ >) {
+ return (
+
+
+
+
+ {children}
+
+
+
+
+ )
+}
+
+function SelectLabel({
+ className,
+ ...props
+}: SelectPrimitive.GroupLabel.Props) {
+ return (
+
+ )
+}
+
+function SelectItem({
+ className,
+ children,
+ ...props
+}: SelectPrimitive.Item.Props) {
+ return (
+
+
+ {children}
+
+
+ }
+ >
+
+
+
+ )
+}
+
+function SelectSeparator({
+ className,
+ ...props
+}: SelectPrimitive.Separator.Props) {
+ return (
+
+ )
+}
+
+function SelectScrollUpButton({
+ className,
+ ...props
+}: React.ComponentProps
) {
+ return (
+
+
+
+ )
+}
+
+function SelectScrollDownButton({
+ className,
+ ...props
+}: React.ComponentProps) {
+ return (
+
+
+
+ )
+}
+
+export {
+ Select,
+ SelectContent,
+ SelectGroup,
+ SelectItem,
+ SelectLabel,
+ SelectScrollDownButton,
+ SelectScrollUpButton,
+ SelectSeparator,
+ SelectTrigger,
+ SelectValue,
+}
diff --git a/src/components/ui/separator.tsx b/src/components/ui/separator.tsx
new file mode 100644
index 0000000..6e1369e
--- /dev/null
+++ b/src/components/ui/separator.tsx
@@ -0,0 +1,25 @@
+"use client"
+
+import { Separator as SeparatorPrimitive } from "@base-ui/react/separator"
+
+import { cn } from "@/lib/utils"
+
+function Separator({
+ className,
+ orientation = "horizontal",
+ ...props
+}: SeparatorPrimitive.Props) {
+ return (
+
+ )
+}
+
+export { Separator }
diff --git a/src/components/ui/table.tsx b/src/components/ui/table.tsx
new file mode 100644
index 0000000..abeaced
--- /dev/null
+++ b/src/components/ui/table.tsx
@@ -0,0 +1,116 @@
+"use client"
+
+import * as React from "react"
+
+import { cn } from "@/lib/utils"
+
+function Table({ className, ...props }: React.ComponentProps<"table">) {
+ return (
+
+ )
+}
+
+function TableHeader({ className, ...props }: React.ComponentProps<"thead">) {
+ return (
+
+ )
+}
+
+function TableBody({ className, ...props }: React.ComponentProps<"tbody">) {
+ return (
+
+ )
+}
+
+function TableFooter({ className, ...props }: React.ComponentProps<"tfoot">) {
+ return (
+ tr]:last:border-b-0",
+ className
+ )}
+ {...props}
+ />
+ )
+}
+
+function TableRow({ className, ...props }: React.ComponentProps<"tr">) {
+ return (
+ |
+ )
+}
+
+function TableHead({ className, ...props }: React.ComponentProps<"th">) {
+ return (
+ |
+ )
+}
+
+function TableCell({ className, ...props }: React.ComponentProps<"td">) {
+ return (
+ |
+ )
+}
+
+function TableCaption({
+ className,
+ ...props
+}: React.ComponentProps<"caption">) {
+ return (
+
+ )
+}
+
+export {
+ Table,
+ TableHeader,
+ TableBody,
+ TableFooter,
+ TableHead,
+ TableRow,
+ TableCell,
+ TableCaption,
+}
diff --git a/src/components/ui/tabs.tsx b/src/components/ui/tabs.tsx
new file mode 100644
index 0000000..8ee8054
--- /dev/null
+++ b/src/components/ui/tabs.tsx
@@ -0,0 +1,82 @@
+"use client"
+
+import { Tabs as TabsPrimitive } from "@base-ui/react/tabs"
+import { cva, type VariantProps } from "class-variance-authority"
+
+import { cn } from "@/lib/utils"
+
+function Tabs({
+ className,
+ orientation = "horizontal",
+ ...props
+}: TabsPrimitive.Root.Props) {
+ return (
+
+ )
+}
+
+const tabsListVariants = cva(
+ "group/tabs-list inline-flex w-fit items-center justify-center rounded-lg p-[3px] text-muted-foreground group-data-horizontal/tabs:h-8 group-data-vertical/tabs:h-fit group-data-vertical/tabs:flex-col data-[variant=line]:rounded-none",
+ {
+ variants: {
+ variant: {
+ default: "bg-muted",
+ line: "gap-1 bg-transparent",
+ },
+ },
+ defaultVariants: {
+ variant: "default",
+ },
+ }
+)
+
+function TabsList({
+ className,
+ variant = "default",
+ ...props
+}: TabsPrimitive.List.Props & VariantProps) {
+ return (
+
+ )
+}
+
+function TabsTrigger({ className, ...props }: TabsPrimitive.Tab.Props) {
+ return (
+
+ )
+}
+
+function TabsContent({ className, ...props }: TabsPrimitive.Panel.Props) {
+ return (
+
+ )
+}
+
+export { Tabs, TabsList, TabsTrigger, TabsContent, tabsListVariants }
diff --git a/src/components/ui/textarea.tsx b/src/components/ui/textarea.tsx
new file mode 100644
index 0000000..04d27f7
--- /dev/null
+++ b/src/components/ui/textarea.tsx
@@ -0,0 +1,18 @@
+import * as React from "react"
+
+import { cn } from "@/lib/utils"
+
+function Textarea({ className, ...props }: React.ComponentProps<"textarea">) {
+ return (
+
+ )
+}
+
+export { Textarea }
diff --git a/src/lib/levels.ts b/src/lib/levels.ts
new file mode 100644
index 0000000..0f2c2f4
--- /dev/null
+++ b/src/lib/levels.ts
@@ -0,0 +1,13 @@
+/** Farbklassen für Stufen 1–4 (Schutzbedarf, Schadenshöhe, Kritikalität). */
+export function levelColor(level: number): string {
+ switch (level) {
+ case 2:
+ return "bg-yellow-100 text-yellow-800 border-yellow-200";
+ case 3:
+ return "bg-orange-100 text-orange-800 border-orange-200";
+ case 4:
+ return "bg-red-100 text-red-800 border-red-200";
+ default:
+ return "bg-emerald-100 text-emerald-800 border-emerald-200";
+ }
+}
diff --git a/src/lib/utils.ts b/src/lib/utils.ts
new file mode 100644
index 0000000..bd0c391
--- /dev/null
+++ b/src/lib/utils.ts
@@ -0,0 +1,6 @@
+import { clsx, type ClassValue } from "clsx"
+import { twMerge } from "tailwind-merge"
+
+export function cn(...inputs: ClassValue[]) {
+ return twMerge(clsx(inputs))
+}
diff --git a/src/server/actions/assets.ts b/src/server/actions/assets.ts
new file mode 100644
index 0000000..073185a
--- /dev/null
+++ b/src/server/actions/assets.ts
@@ -0,0 +1,174 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { redirect } from "next/navigation";
+import { z } from "zod";
+import { requireSession } from "@/server/auth";
+import { dbForTenant } from "@/server/db";
+import { requirePermission } from "@/server/rbac";
+import { writeAuditLog } from "@/server/audit";
+
+const level = z.coerce.number().int().min(1).max(4);
+
+const assetSchema = z.object({
+ name: z.string().trim().min(1).max(200),
+ description: z.string().trim().max(5000).optional(),
+ type: z.enum(["INFORMATION", "SYSTEM", "APPLICATION", "LOCATION", "SUPPLIER", "PERSON", "DATA"]),
+ status: z.enum(["ACTIVE", "PLANNED", "RETIRED"]),
+ ownerId: z.string().optional(),
+ location: z.string().trim().max(200).optional(),
+ tags: z.string().optional(),
+ confidentiality: level,
+ integrity: level,
+ availability: level,
+});
+
+function parseAssetForm(formData: FormData) {
+ const parsed = assetSchema.parse({
+ name: formData.get("name"),
+ description: formData.get("description") || undefined,
+ type: formData.get("type"),
+ status: formData.get("status"),
+ ownerId: formData.get("ownerId") || undefined,
+ location: formData.get("location") || undefined,
+ tags: formData.get("tags") || undefined,
+ confidentiality: formData.get("confidentiality"),
+ integrity: formData.get("integrity"),
+ availability: formData.get("availability"),
+ });
+ return {
+ ...parsed,
+ ownerId: parsed.ownerId || null,
+ description: parsed.description || null,
+ location: parsed.location || null,
+ tags: parsed.tags
+ ? parsed.tags.split(",").map((t) => t.trim()).filter(Boolean)
+ : [],
+ };
+}
+
+export async function createAsset(formData: FormData) {
+ const session = await requireSession();
+ requirePermission(session, "asset:write");
+ const db = dbForTenant(session.user.tenantId);
+
+ const data = parseAssetForm(formData);
+ // tenantId doppelt gemoppelt: explizit für die Typen, der Guard injiziert ohnehin
+ const asset = await db.asset.create({
+ data: { ...data, tenantId: session.user.tenantId, createdBy: session.user.id },
+ });
+
+ await writeAuditLog({
+ tenantId: session.user.tenantId,
+ actorId: session.user.id,
+ action: "create",
+ entity: "asset",
+ entityId: asset.id,
+ after: data,
+ });
+ revalidatePath("/assets");
+ redirect(`/assets/${asset.id}`);
+}
+
+export async function updateAsset(assetId: string, formData: FormData) {
+ const session = await requireSession();
+ requirePermission(session, "asset:write");
+ const db = dbForTenant(session.user.tenantId);
+
+ const before = await db.asset.findUnique({ where: { id: assetId } });
+ if (!before) throw new Error("Asset nicht gefunden");
+
+ const data = parseAssetForm(formData);
+ await db.asset.update({ where: { id: assetId }, data });
+
+ await writeAuditLog({
+ tenantId: session.user.tenantId,
+ actorId: session.user.id,
+ action: "update",
+ entity: "asset",
+ entityId: assetId,
+ before,
+ after: data,
+ });
+ revalidatePath("/assets");
+ revalidatePath(`/assets/${assetId}`);
+ redirect(`/assets/${assetId}`);
+}
+
+export async function deleteAsset(assetId: string) {
+ const session = await requireSession();
+ requirePermission(session, "asset:write");
+ const db = dbForTenant(session.user.tenantId);
+
+ const before = await db.asset.findUnique({ where: { id: assetId } });
+ if (!before) throw new Error("Asset nicht gefunden");
+
+ await db.asset.delete({ where: { id: assetId } });
+
+ await writeAuditLog({
+ tenantId: session.user.tenantId,
+ actorId: session.user.id,
+ action: "delete",
+ entity: "asset",
+ entityId: assetId,
+ before,
+ });
+ revalidatePath("/assets");
+ redirect("/assets");
+}
+
+export async function addAssetRelation(assetId: string, formData: FormData) {
+ const session = await requireSession();
+ requirePermission(session, "asset:write");
+ const db = dbForTenant(session.user.tenantId);
+
+ const relatedAssetId = z.string().min(1).parse(formData.get("relatedAssetId"));
+ if (relatedAssetId === assetId) return;
+
+ // Beide Assets müssen zum Mandanten gehören (Guard filtert, count prüft)
+ const count = await db.asset.count({ where: { id: { in: [assetId, relatedAssetId] } } });
+ if (count !== 2) throw new Error("Asset nicht gefunden");
+
+ await db.assetRelation.upsert({
+ where: {
+ assetId_relatedAssetId_type: { assetId, relatedAssetId, type: "depends_on" },
+ },
+ update: {},
+ create: {
+ assetId,
+ relatedAssetId,
+ type: "depends_on",
+ tenantId: session.user.tenantId,
+ },
+ });
+
+ await writeAuditLog({
+ tenantId: session.user.tenantId,
+ actorId: session.user.id,
+ action: "create",
+ entity: "asset_relation",
+ entityId: assetId,
+ after: { assetId, relatedAssetId, type: "depends_on" },
+ });
+ revalidatePath(`/assets/${assetId}`);
+}
+
+export async function removeAssetRelation(assetId: string, relationId: string) {
+ const session = await requireSession();
+ requirePermission(session, "asset:write");
+ const db = dbForTenant(session.user.tenantId);
+
+ const before = await db.assetRelation.findUnique({ where: { id: relationId } });
+ if (!before) return;
+ await db.assetRelation.delete({ where: { id: relationId } });
+
+ await writeAuditLog({
+ tenantId: session.user.tenantId,
+ actorId: session.user.id,
+ action: "delete",
+ entity: "asset_relation",
+ entityId: relationId,
+ before,
+ });
+ revalidatePath(`/assets/${assetId}`);
+}
diff --git a/src/server/actions/processes.ts b/src/server/actions/processes.ts
new file mode 100644
index 0000000..5f1512a
--- /dev/null
+++ b/src/server/actions/processes.ts
@@ -0,0 +1,192 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { redirect } from "next/navigation";
+import { z } from "zod";
+import { requireSession } from "@/server/auth";
+import { dbForTenant } from "@/server/db";
+import { requirePermission } from "@/server/rbac";
+import { writeAuditLog } from "@/server/audit";
+
+const processSchema = z.object({
+ name: z.string().trim().min(1).max(200),
+ description: z.string().trim().max(5000).optional(),
+ ownerId: z.string().optional(),
+});
+
+function parseProcessForm(formData: FormData) {
+ const parsed = processSchema.parse({
+ name: formData.get("name"),
+ description: formData.get("description") || undefined,
+ ownerId: formData.get("ownerId") || undefined,
+ });
+ return {
+ ...parsed,
+ description: parsed.description || null,
+ ownerId: parsed.ownerId || null,
+ };
+}
+
+export async function createProcess(formData: FormData) {
+ const session = await requireSession();
+ requirePermission(session, "bia:write");
+ const db = dbForTenant(session.user.tenantId);
+
+ const data = parseProcessForm(formData);
+ // tenantId explizit für die Typen, der Guard injiziert ohnehin
+ const process = await db.process.create({
+ data: { ...data, tenantId: session.user.tenantId, createdBy: session.user.id },
+ });
+
+ await writeAuditLog({
+ tenantId: session.user.tenantId,
+ actorId: session.user.id,
+ action: "create",
+ entity: "process",
+ entityId: process.id,
+ after: data,
+ });
+ revalidatePath("/processes");
+ redirect(`/processes/${process.id}`);
+}
+
+export async function updateProcess(processId: string, formData: FormData) {
+ const session = await requireSession();
+ requirePermission(session, "bia:write");
+ const db = dbForTenant(session.user.tenantId);
+
+ const before = await db.process.findUnique({ where: { id: processId } });
+ if (!before) throw new Error("Prozess nicht gefunden");
+
+ const data = parseProcessForm(formData);
+ await db.process.update({ where: { id: processId }, data });
+
+ await writeAuditLog({
+ tenantId: session.user.tenantId,
+ actorId: session.user.id,
+ action: "update",
+ entity: "process",
+ entityId: processId,
+ before,
+ after: data,
+ });
+ revalidatePath("/processes");
+ revalidatePath(`/processes/${processId}`);
+ redirect(`/processes/${processId}`);
+}
+
+export async function deleteProcess(processId: string) {
+ const session = await requireSession();
+ requirePermission(session, "bia:write");
+ const db = dbForTenant(session.user.tenantId);
+
+ const before = await db.process.findUnique({ where: { id: processId } });
+ if (!before) throw new Error("Prozess nicht gefunden");
+
+ await db.process.delete({ where: { id: processId } });
+
+ await writeAuditLog({
+ tenantId: session.user.tenantId,
+ actorId: session.user.id,
+ action: "delete",
+ entity: "process",
+ entityId: processId,
+ before,
+ });
+ revalidatePath("/processes");
+ redirect("/processes");
+}
+
+export async function assignAsset(processId: string, formData: FormData) {
+ const session = await requireSession();
+ requirePermission(session, "bia:write");
+ const db = dbForTenant(session.user.tenantId);
+
+ const assetId = z.string().min(1).parse(formData.get("assetId"));
+ const role = z.enum(["PRIMARY", "SECONDARY"]).parse(formData.get("role"));
+
+ const assetCount = await db.asset.count({ where: { id: assetId } });
+ const processCount = await db.process.count({ where: { id: processId } });
+ if (assetCount !== 1 || processCount !== 1) throw new Error("Nicht gefunden");
+
+ await db.processAsset.upsert({
+ where: { processId_assetId: { processId, assetId } },
+ update: { role },
+ create: { processId, assetId, role, tenantId: session.user.tenantId },
+ });
+
+ await writeAuditLog({
+ tenantId: session.user.tenantId,
+ actorId: session.user.id,
+ action: "update",
+ entity: "process_asset",
+ entityId: processId,
+ after: { processId, assetId, role },
+ });
+ revalidatePath(`/processes/${processId}`);
+}
+
+export async function unassignAsset(processId: string, processAssetId: string) {
+ const session = await requireSession();
+ requirePermission(session, "bia:write");
+ const db = dbForTenant(session.user.tenantId);
+
+ const before = await db.processAsset.findUnique({ where: { id: processAssetId } });
+ if (!before) return;
+ await db.processAsset.delete({ where: { id: processAssetId } });
+
+ await writeAuditLog({
+ tenantId: session.user.tenantId,
+ actorId: session.user.id,
+ action: "delete",
+ entity: "process_asset",
+ entityId: processAssetId,
+ before,
+ });
+ revalidatePath(`/processes/${processId}`);
+}
+
+const hours = z
+ .union([z.literal(""), z.coerce.number().int().min(0).max(100000)])
+ .transform((v) => (v === "" ? null : v));
+
+export async function saveBia(processId: string, formData: FormData) {
+ const session = await requireSession();
+ requirePermission(session, "bia:write");
+ const db = dbForTenant(session.user.tenantId);
+
+ const processCount = await db.process.count({ where: { id: processId } });
+ if (processCount !== 1) throw new Error("Prozess nicht gefunden");
+
+ const level = z.coerce.number().int().min(1).max(4);
+ const data = {
+ rtoHours: hours.parse(formData.get("rtoHours") ?? ""),
+ rpoHours: hours.parse(formData.get("rpoHours") ?? ""),
+ mtdHours: hours.parse(formData.get("mtdHours") ?? ""),
+ impactC: level.parse(formData.get("impactC")),
+ impactI: level.parse(formData.get("impactI")),
+ impactA: level.parse(formData.get("impactA")),
+ notes: (formData.get("notes") as string)?.trim() || null,
+ };
+ // Kritikalität nach Max-Prinzip aus den Schadenshöhen (SPEC §4.1.2)
+ const criticality = Math.max(data.impactC, data.impactI, data.impactA);
+
+ const before = await db.biaEntry.findUnique({ where: { processId } });
+ await db.biaEntry.upsert({
+ where: { processId },
+ update: { ...data, criticality },
+ create: { ...data, criticality, processId, tenantId: session.user.tenantId },
+ });
+
+ await writeAuditLog({
+ tenantId: session.user.tenantId,
+ actorId: session.user.id,
+ action: before ? "update" : "create",
+ entity: "bia_entry",
+ entityId: processId,
+ before: before ?? undefined,
+ after: { ...data, criticality },
+ });
+ revalidatePath("/processes");
+ revalidatePath(`/processes/${processId}`);
+}
diff --git a/src/server/db.ts b/src/server/db.ts
index 0574db3..590059c 100644
--- a/src/server/db.ts
+++ b/src/server/db.ts
@@ -24,7 +24,16 @@ export const prisma =
if (process.env.NODE_ENV !== "production") globalForPrisma.prisma = prisma;
/** Models that carry a tenantId column and must never be queried without one. */
-const TENANT_MODELS = new Set(["User", "Role", "AuditLog"]);
+const TENANT_MODELS = new Set([
+ "User",
+ "Role",
+ "AuditLog",
+ "Asset",
+ "AssetRelation",
+ "Process",
+ "ProcessAsset",
+ "BiaEntry",
+]);
/**
* Returns a Prisma client that transparently enforces the tenant scope:
@@ -44,8 +53,10 @@ export function dbForTenant(tenantId: string) {
if (
operation === "findMany" ||
operation === "findFirst" ||
+ operation === "findFirstOrThrow" ||
operation === "count" ||
operation === "aggregate" ||
+ operation === "groupBy" ||
operation === "updateMany" ||
operation === "deleteMany"
) {
@@ -87,6 +98,9 @@ export function dbForTenant(tenantId: string) {
`Tenant isolation violation: ${model} belongs to another tenant`
);
}
+ if (operation === "upsert") {
+ a.create = { ...(a.create as object), tenantId };
+ }
}
return query(args);