Iteration 1: Auth (lokale Accounts), RBAC, RLS-Policies, i18n

- Auth.js v5 mit Credentials-Provider: Argon2id-Verifikation, JWT-Session
  mit Mandanten-Kontext, Rollen und Permissions; Login-/Logout-Flow (deutsch)
- RBAC-Katalog (28 Permissions, 5 Rollen-Blueprints) mit serverseitigem
  requirePermission; Seed legt Demo-Mandant und 4 Demo-Nutzer an
- Route-Gate über Next-16-proxy.ts (UX-Ebene), autoritative Prüfung
  serverseitig via requireSession/requirePermission
- Prisma-Migrationen: init + Row-Level-Security-Policies (zweite
  Verteidigungslinie, Scharfschaltung in Härtungs-Iteration dokumentiert)
- i18n-Gerüst mit next-intl (de aktiv, en vorbereitet), Audit-Log-Helper
- Login/Logout end-to-end im Browser verifiziert; Build/Lint/Typecheck grün

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.claude/launch.json

@@ -0,0 +1,11 @@
+{
+  "version": "0.0.1",
+  "configurations": [
+    {
+      "name": "isms-dev",
+      "runtimeExecutable": "npm",
+      "runtimeArgs": ["run", "dev"],
+      "port": 3000
+    }
+  ]
+}

AGENTS.md

@@ -25,6 +25,12 @@ Multi-Tenant-SaaS für Informationssicherheits-Managementsysteme (ISO/IEC 27001:
 - Tests: Vitest (Unit), Playwright (E2E). `npm run lint` und `npm run build` müssen vor jedem Commit grün sein.
 - Sprache: UI und Fachbegriffe Deutsch; Code (Bezeichner, Kommentare) Englisch.
 
+## Offene Härtungspunkte (Iteration 8)
+
+- RLS scharfschalten: App-Verbindung auf DB-Rolle `isms_app` umstellen und `app.tenant_id` pro Transaktion setzen (Policies existieren bereits, siehe Migration `row_level_security`).
+- TOTP-2FA (Schema-Feld `mfa_secret` ist vorbereitet).
+- Rollenänderungen wirken erst beim nächsten Login (Permissions liegen im JWT).
+
 ## Entwicklung
 
 ```bash

docker-compose.yml

@@ -13,7 +13,9 @@ services:
         condition: service_started
     restart: unless-stopped
 
+  # Wird in Iteration 4 aktiviert (BullMQ-Scheduler, siehe docs/SPEC.md §4.5)
   worker:
+    profiles: ["worker"]
     build: .
     command: ["npm", "run", "worker"]
     env_file: .env

messages/de.json

@@ -0,0 +1,23 @@
+{
+  "common": {
+    "appName": "ISMS-Tool",
+    "logout": "Abmelden"
+  },
+  "login": {
+    "title": "Anmelden",
+    "subtitle": "Melde dich mit deinem Firmenkonto an.",
+    "email": "E-Mail-Adresse",
+    "password": "Passwort",
+    "tenant": "Organisation (optional)",
+    "tenantHint": "Nur nötig, wenn deine E-Mail in mehreren Organisationen existiert.",
+    "submit": "Anmelden",
+    "error": "Anmeldung fehlgeschlagen. Bitte prüfe E-Mail, Passwort und ggf. die Organisation."
+  },
+  "dashboard": {
+    "title": "Dashboard",
+    "welcome": "Willkommen, {name}",
+    "tenant": "Mandant",
+    "roles": "Rollen",
+    "placeholder": "Die Modul-Dashboards (Risiken, Aufgaben, SoA-Erfüllungsgrad) folgen in den nächsten Iterationen."
+  }
+}

messages/en.json

@@ -0,0 +1,23 @@
+{
+  "common": {
+    "appName": "ISMS Tool",
+    "logout": "Sign out"
+  },
+  "login": {
+    "title": "Sign in",
+    "subtitle": "Sign in with your company account.",
+    "email": "E-mail address",
+    "password": "Password",
+    "tenant": "Organization (optional)",
+    "tenantHint": "Only needed if your e-mail exists in several organizations.",
+    "submit": "Sign in",
+    "error": "Sign-in failed. Please check e-mail, password and organization."
+  },
+  "dashboard": {
+    "title": "Dashboard",
+    "welcome": "Welcome, {name}",
+    "tenant": "Tenant",
+    "roles": "Roles",
+    "placeholder": "Module dashboards (risks, tasks, SoA coverage) follow in upcoming iterations."
+  }
+}

next.config.ts

@@ -1,8 +1,11 @@
 import type { NextConfig } from "next";
+import createNextIntlPlugin from "next-intl/plugin";
 
 const nextConfig: NextConfig = {
   // Standalone-Output für den Docker-Multi-Stage-Build (siehe Dockerfile)
   output: "standalone",
 };
 
-export default nextConfig;
+const withNextIntl = createNextIntlPlugin();
+
+export default withNextIntl(nextConfig);

package.json

@@ -9,10 +9,13 @@
     "lint": "eslint"
   },
   "dependencies": {
+    "@node-rs/argon2": "^2.0.2",
     "@prisma/adapter-pg": "^7.8.0",
     "@prisma/client": "^7.8.0",
     "dotenv": "^17.4.2",
     "next": "16.2.10",
+    "next-auth": "^5.0.0-beta.31",
+    "next-intl": "^4.13.1",
     "react": "19.2.4",
     "react-dom": "19.2.4",
     "zod": "^4.4.3"

prisma/migrations/20260702095800_init/migration.sql

@@ -0,0 +1,131 @@
+-- CreateExtension
+CREATE EXTENSION IF NOT EXISTS "vector";
+
+-- CreateEnum
+CREATE TYPE "TenantStatus" AS ENUM ('ACTIVE', 'SUSPENDED');
+
+-- CreateEnum
+CREATE TYPE "UserStatus" AS ENUM ('ACTIVE', 'INVITED', 'LOCKED', 'DEACTIVATED');
+
+-- CreateTable
+CREATE TABLE "tenants" (
+    "id" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "slug" TEXT NOT NULL,
+    "status" "TenantStatus" NOT NULL DEFAULT 'ACTIVE',
+    "config" JSONB NOT NULL DEFAULT '{}',
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "tenants_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "users" (
+    "id" TEXT NOT NULL,
+    "tenant_id" TEXT NOT NULL,
+    "email" TEXT NOT NULL,
+    "password_hash" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "status" "UserStatus" NOT NULL DEFAULT 'ACTIVE',
+    "mfa_secret" TEXT,
+    "is_platform_admin" BOOLEAN NOT NULL DEFAULT false,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "users_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "roles" (
+    "id" TEXT NOT NULL,
+    "tenant_id" TEXT NOT NULL,
+    "key" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+
+    CONSTRAINT "roles_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "permissions" (
+    "id" TEXT NOT NULL,
+    "key" TEXT NOT NULL,
+
+    CONSTRAINT "permissions_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "user_roles" (
+    "user_id" TEXT NOT NULL,
+    "role_id" TEXT NOT NULL,
+
+    CONSTRAINT "user_roles_pkey" PRIMARY KEY ("user_id","role_id")
+);
+
+-- CreateTable
+CREATE TABLE "role_permissions" (
+    "role_id" TEXT NOT NULL,
+    "permission_id" TEXT NOT NULL,
+
+    CONSTRAINT "role_permissions_pkey" PRIMARY KEY ("role_id","permission_id")
+);
+
+-- CreateTable
+CREATE TABLE "audit_logs" (
+    "id" TEXT NOT NULL,
+    "tenant_id" TEXT NOT NULL,
+    "actor_id" TEXT,
+    "action" TEXT NOT NULL,
+    "entity" TEXT NOT NULL,
+    "entity_id" TEXT,
+    "before" JSONB,
+    "after" JSONB,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "audit_logs_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "tenants_slug_key" ON "tenants"("slug");
+
+-- CreateIndex
+CREATE INDEX "users_tenant_id_idx" ON "users"("tenant_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "users_tenant_id_email_key" ON "users"("tenant_id", "email");
+
+-- CreateIndex
+CREATE INDEX "roles_tenant_id_idx" ON "roles"("tenant_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "roles_tenant_id_key_key" ON "roles"("tenant_id", "key");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "permissions_key_key" ON "permissions"("key");
+
+-- CreateIndex
+CREATE INDEX "audit_logs_tenant_id_entity_entity_id_idx" ON "audit_logs"("tenant_id", "entity", "entity_id");
+
+-- CreateIndex
+CREATE INDEX "audit_logs_tenant_id_created_at_idx" ON "audit_logs"("tenant_id", "created_at");
+
+-- AddForeignKey
+ALTER TABLE "users" ADD CONSTRAINT "users_tenant_id_fkey" FOREIGN KEY ("tenant_id") REFERENCES "tenants"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "roles" ADD CONSTRAINT "roles_tenant_id_fkey" FOREIGN KEY ("tenant_id") REFERENCES "tenants"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "user_roles" ADD CONSTRAINT "user_roles_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "user_roles" ADD CONSTRAINT "user_roles_role_id_fkey" FOREIGN KEY ("role_id") REFERENCES "roles"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "role_permissions" ADD CONSTRAINT "role_permissions_role_id_fkey" FOREIGN KEY ("role_id") REFERENCES "roles"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "role_permissions" ADD CONSTRAINT "role_permissions_permission_id_fkey" FOREIGN KEY ("permission_id") REFERENCES "permissions"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "audit_logs" ADD CONSTRAINT "audit_logs_tenant_id_fkey" FOREIGN KEY ("tenant_id") REFERENCES "tenants"("id") ON DELETE RESTRICT ON UPDATE CASCADE;

prisma/migrations/20260702095816_row_level_security/migration.sql

@@ -0,0 +1,36 @@
+-- Row Level Security als zweite Verteidigungslinie (docs/SPEC.md §2).
+-- Primäre Isolation ist der Tenant-Guard in src/server/db.ts.
+--
+-- Aktivierungsstand: Policies sind definiert; die App verbindet sich aktuell
+-- noch als Tabellen-Owner (Policies greifen für Owner ohne FORCE nicht).
+-- Härtungs-Iteration (SPEC §11 Punkt 8): App-Verbindung auf die Rolle
+-- "isms_app" umstellen und app.tenant_id pro Transaktion setzen — dann sind
+-- die Policies scharf. FORCE wird bewusst nicht gesetzt, damit Migrationen,
+-- Seeds und der mandantenübergreifende Login-Lookup als Owner funktionieren.
+
+-- Eingeschränkte Anwendungsrolle (für die Härtungs-Iteration)
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'isms_app') THEN
+    CREATE ROLE isms_app NOLOGIN NOBYPASSRLS;
+  END IF;
+END
+$$;
+
+GRANT USAGE ON SCHEMA public TO isms_app;
+GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO isms_app;
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
+  GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO isms_app;
+
+-- RLS auf allen mandanten-gebundenen Tabellen
+ALTER TABLE "users" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "roles" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "audit_logs" ENABLE ROW LEVEL SECURITY;
+
+-- Isolation: Zugriff nur auf Zeilen des in app.tenant_id gesetzten Mandanten
+CREATE POLICY tenant_isolation ON "users"
+  USING ("tenant_id" = current_setting('app.tenant_id', true));
+CREATE POLICY tenant_isolation ON "roles"
+  USING ("tenant_id" = current_setting('app.tenant_id', true));
+CREATE POLICY tenant_isolation ON "audit_logs"
+  USING ("tenant_id" = current_setting('app.tenant_id', true));

prisma/migrations/migration_lock.toml

@@ -0,0 +1,3 @@
+# Please do not edit this file manually
+# It should be added in your version-control system (e.g., Git)
+provider = "postgresql"

prisma/seed.ts

@@ -0,0 +1,92 @@
+import "dotenv/config";
+import { PrismaClient } from "@prisma/client";
+import { PrismaPg } from "@prisma/adapter-pg";
+import { hash } from "@node-rs/argon2";
+import { PERMISSIONS, ROLE_DEFS } from "../src/server/rbac";
+
+/**
+ * Seed: global permission catalog + demo tenant with roles and users.
+ * Idempotent (upserts) — safe to run repeatedly.
+ */
+
+const prisma = new PrismaClient({
+  adapter: new PrismaPg({ connectionString: process.env.DATABASE_URL }),
+});
+
+const DEMO_PASSWORD = "Demo1234!";
+
+async function main() {
+  // 1. Global permission catalog
+  for (const key of PERMISSIONS) {
+    await prisma.permission.upsert({ where: { key }, update: {}, create: { key } });
+  }
+  console.log(`✔ ${PERMISSIONS.length} Permissions`);
+
+  // 2. Demo tenant
+  const tenant = await prisma.tenant.upsert({
+    where: { slug: "demo" },
+    update: {},
+    create: { name: "Demo GmbH", slug: "demo" },
+  });
+
+  // 3. Roles from blueprints, with permission bundles
+  for (const [key, def] of Object.entries(ROLE_DEFS)) {
+    const role = await prisma.role.upsert({
+      where: { tenantId_key: { tenantId: tenant.id, key } },
+      update: { name: def.name },
+      create: { tenantId: tenant.id, key, name: def.name },
+    });
+    const perms = await prisma.permission.findMany({
+      where: { key: { in: [...def.permissions] } },
+    });
+    for (const p of perms) {
+      await prisma.rolePermission.upsert({
+        where: { roleId_permissionId: { roleId: role.id, permissionId: p.id } },
+        update: {},
+        create: { roleId: role.id, permissionId: p.id },
+      });
+    }
+  }
+  console.log(`✔ Mandant "demo" mit ${Object.keys(ROLE_DEFS).length} Rollen`);
+
+  // 4. Demo users
+  const passwordHash = await hash(DEMO_PASSWORD);
+  const demoUsers: { email: string; name: string; roles: string[] }[] = [
+    { email: "admin@demo.example", name: "Anna Admin", roles: ["tenant-admin", "isb"] },
+    { email: "auditor@demo.example", name: "Axel Auditor", roles: ["auditor"] },
+    { email: "owner@demo.example", name: "Oskar Owner", roles: ["owner"] },
+    { email: "user@demo.example", name: "Ulla User", roles: ["user"] },
+  ];
+
+  for (const u of demoUsers) {
+    const user = await prisma.user.upsert({
+      where: { tenantId_email: { tenantId: tenant.id, email: u.email } },
+      update: {},
+      create: {
+        tenantId: tenant.id,
+        email: u.email,
+        name: u.name,
+        passwordHash,
+      },
+    });
+    const roles = await prisma.role.findMany({
+      where: { tenantId: tenant.id, key: { in: u.roles } },
+    });
+    for (const r of roles) {
+      await prisma.userRole.upsert({
+        where: { userId_roleId: { userId: user.id, roleId: r.id } },
+        update: {},
+        create: { userId: user.id, roleId: r.id },
+      });
+    }
+  }
+  console.log(`✔ ${demoUsers.length} Demo-Nutzer (Passwort: ${DEMO_PASSWORD})`);
+}
+
+main()
+  .then(() => prisma.$disconnect())
+  .catch(async (e) => {
+    console.error(e);
+    await prisma.$disconnect();
+    process.exit(1);
+  });

src/app/api/auth/[...nextauth]/route.ts

@@ -0,0 +1,3 @@
+import { handlers } from "@/server/auth";
+
+export const { GET, POST } = handlers;

src/app/dashboard/page.tsx

@@ -0,0 +1,43 @@
+import { getTranslations } from "next-intl/server";
+import { redirect } from "next/navigation";
+import { auth, signOut } from "@/server/auth";
+
+export default async function DashboardPage() {
+  const session = await auth();
+  if (!session?.user) redirect("/login");
+
+  const t = await getTranslations("dashboard");
+  const tc = await getTranslations("common");
+
+  async function logout() {
+    "use server";
+    await signOut({ redirectTo: "/login" });
+  }
+
+  return (
+    <main className="mx-auto w-full max-w-5xl flex-1 p-6">
+      <header className="flex items-center justify-between border-b border-slate-200 pb-4">
+        <h1 className="text-xl font-semibold">{t("title")}</h1>
+        <form action={logout}>
+          <button
+            type="submit"
+            className="rounded-md border border-slate-300 px-3 py-1.5 text-sm hover:bg-slate-100"
+          >
+            {tc("logout")}
+          </button>
+        </form>
+      </header>
+
+      <section className="mt-6 rounded-xl border border-slate-200 bg-white p-6 shadow-sm">
+        <p className="text-lg">{t("welcome", { name: session.user.name ?? "" })}</p>
+        <dl className="mt-4 grid grid-cols-2 gap-2 text-sm">
+          <dt className="text-slate-500">{t("tenant")}</dt>
+          <dd>{session.user.tenantSlug}</dd>
+          <dt className="text-slate-500">{t("roles")}</dt>
+          <dd>{session.user.roles.join(", ")}</dd>
+        </dl>
+        <p className="mt-6 text-sm text-slate-400">{t("placeholder")}</p>
+      </section>
+    </main>
+  );
+}

src/app/globals.css

@@ -1,8 +1,10 @@
 @import "tailwindcss";
 
+/* Helles Basis-Theme; Dark-Mode folgt kontrolliert mit dem shadcn/ui-Theming
+   (kein automatisches prefers-color-scheme, damit Komponenten konsistent bleiben). */
 :root {
-  --background: #ffffff;
+  --background: #f8fafc;
-  --foreground: #171717;
+  --foreground: #0f172a;
 }
 
 @theme inline {
@@ -12,15 +14,8 @@
   --font-mono: var(--font-geist-mono);
 }
 
-@media (prefers-color-scheme: dark) {
-  :root {
-    --background: #0a0a0a;
-    --foreground: #ededed;
-  }
-}
-
 body {
   background: var(--background);
   color: var(--foreground);
-  font-family: Arial, Helvetica, sans-serif;
+  font-family: var(--font-sans), Arial, Helvetica, sans-serif;
 }

src/app/layout.tsx

@@ -1,5 +1,7 @@
 import type { Metadata } from "next";
 import { Geist, Geist_Mono } from "next/font/google";
+import { NextIntlClientProvider } from "next-intl";
+import { getLocale } from "next-intl/server";
 import "./globals.css";
 
 const geistSans = Geist({
@@ -13,21 +15,26 @@ const geistMono = Geist_Mono({
 });
 
 export const metadata: Metadata = {
-  title: "Create Next App",
+  title: "ISMS-Tool",
-  description: "Generated by create next app",
+  description:
+    "Informationssicherheits-Managementsystem für ISO/IEC 27001:2022 und TISAX/VDA-ISA",
 };
 
-export default function RootLayout({
+export default async function RootLayout({
   children,
 }: Readonly<{
   children: React.ReactNode;
 }>) {
+  const locale = await getLocale();
+
   return (
     <html
-      lang="en"
+      lang={locale}
       className={`${geistSans.variable} ${geistMono.variable} h-full antialiased`}
     >
-      <body className="min-h-full flex flex-col">{children}</body>
+      <body className="min-h-full flex flex-col bg-slate-50 text-slate-900">
+        <NextIntlClientProvider>{children}</NextIntlClientProvider>
+      </body>
     </html>
   );
 }

src/app/login/page.tsx

@@ -0,0 +1,104 @@
+import { getTranslations } from "next-intl/server";
+import { redirect } from "next/navigation";
+import { AuthError } from "next-auth";
+import { auth, signIn } from "@/server/auth";
+
+export default async function LoginPage({
+  searchParams,
+}: {
+  searchParams: Promise<{ error?: string; callbackUrl?: string }>;
+}) {
+  const t = await getTranslations("login");
+  const tc = await getTranslations("common");
+  const { error, callbackUrl } = await searchParams;
+
+  // Already signed in → straight to the app
+  const session = await auth();
+  if (session?.user) redirect("/dashboard");
+
+  async function login(formData: FormData) {
+    "use server";
+    const target = (formData.get("callbackUrl") as string) || "/dashboard";
+    try {
+      await signIn("credentials", {
+        email: formData.get("email"),
+        password: formData.get("password"),
+        tenant: formData.get("tenant"),
+        redirectTo: target,
+      });
+    } catch (err) {
+      if (err instanceof AuthError) {
+        redirect(`/login?error=1${target !== "/dashboard" ? `&callbackUrl=${encodeURIComponent(target)}` : ""}`);
+      }
+      throw err; // NEXT_REDIRECT from a successful signIn must propagate
+    }
+  }
+
+  return (
+    <main className="flex flex-1 items-center justify-center p-6">
+      <div className="w-full max-w-sm rounded-xl border border-slate-200 bg-white p-8 shadow-sm">
+        <h1 className="text-xl font-semibold">{tc("appName")}</h1>
+        <h2 className="mt-1 text-sm text-slate-500">{t("subtitle")}</h2>
+
+        {error && (
+          <p
+            role="alert"
+            className="mt-4 rounded-md bg-red-50 px-3 py-2 text-sm text-red-700"
+          >
+            {t("error")}
+          </p>
+        )}
+
+        <form action={login} className="mt-6 space-y-4">
+          <input type="hidden" name="callbackUrl" value={callbackUrl ?? ""} />
+          <div>
+            <label htmlFor="email" className="block text-sm font-medium">
+              {t("email")}
+            </label>
+            <input
+              id="email"
+              name="email"
+              type="email"
+              required
+              autoComplete="email"
+              className="mt-1 w-full rounded-md border border-slate-300 px-3 py-2 text-sm focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500"
+            />
+          </div>
+          <div>
+            <label htmlFor="password" className="block text-sm font-medium">
+              {t("password")}
+            </label>
+            <input
+              id="password"
+              name="password"
+              type="password"
+              required
+              autoComplete="current-password"
+              className="mt-1 w-full rounded-md border border-slate-300 px-3 py-2 text-sm focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500"
+            />
+          </div>
+          <div>
+            <label htmlFor="tenant" className="block text-sm font-medium">
+              {t("tenant")}
+            </label>
+            <input
+              id="tenant"
+              name="tenant"
+              type="text"
+              autoComplete="organization"
+              title={t("tenantHint")}
+              className="mt-1 w-full rounded-md border border-slate-300 px-3 py-2 text-sm focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500"
+            />
+            <p className="mt-1 text-xs text-slate-400">{t("tenantHint")}</p>
+          </div>
+          <button
+            type="submit"
+            className="w-full rounded-md bg-blue-600 px-3 py-2 text-sm font-medium text-white hover:bg-blue-700 focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2"
+          >
+            {t("submit")}
+          </button>
+        </form>
+      </div>
+    </main>
+  );
+}

src/app/page.tsx

@@ -1,65 +1,5 @@
-import Image from "next/image";
+import { redirect } from "next/navigation";
 
 export default function Home() {
-  return (
+  redirect("/dashboard");
-    <div className="flex flex-col flex-1 items-center justify-center bg-zinc-50 font-sans dark:bg-black">
-      <main className="flex flex-1 w-full max-w-3xl flex-col items-center justify-between py-32 px-16 bg-white dark:bg-black sm:items-start">
-        <Image
-          className="dark:invert"
-          src="/next.svg"
-          alt="Next.js logo"
-          width={100}
-          height={20}
-          priority
-        />
-        <div className="flex flex-col items-center gap-6 text-center sm:items-start sm:text-left">
-          <h1 className="max-w-xs text-3xl font-semibold leading-10 tracking-tight text-black dark:text-zinc-50">
-            To get started, edit the page.tsx file.
-          </h1>
-          <p className="max-w-md text-lg leading-8 text-zinc-600 dark:text-zinc-400">
-            Looking for a starting point or more instructions? Head over to{" "}
-            <a
-              href="https://vercel.com/templates?framework=next.js&utm_source=create-next-app&utm_medium=appdir-template-tw&utm_campaign=create-next-app"
-              className="font-medium text-zinc-950 dark:text-zinc-50"
-            >
-              Templates
-            </a>{" "}
-            or the{" "}
-            <a
-              href="https://nextjs.org/learn?utm_source=create-next-app&utm_medium=appdir-template-tw&utm_campaign=create-next-app"
-              className="font-medium text-zinc-950 dark:text-zinc-50"
-            >
-              Learning
-            </a>{" "}
-            center.
-          </p>
-        </div>
-        <div className="flex flex-col gap-4 text-base font-medium sm:flex-row">
-          <a
-            className="flex h-12 w-full items-center justify-center gap-2 rounded-full bg-foreground px-5 text-background transition-colors hover:bg-[#383838] dark:hover:bg-[#ccc] md:w-[158px]"
-            href="https://vercel.com/new?utm_source=create-next-app&utm_medium=appdir-template-tw&utm_campaign=create-next-app"
-            target="_blank"
-            rel="noopener noreferrer"
-          >
-            <Image
-              className="dark:invert"
-              src="/vercel.svg"
-              alt="Vercel logomark"
-              width={16}
-              height={16}
-            />
-            Deploy Now
-          </a>
-          <a
-            className="flex h-12 w-full items-center justify-center rounded-full border border-solid border-black/[.08] px-5 transition-colors hover:border-transparent hover:bg-black/[.04] dark:border-white/[.145] dark:hover:bg-[#1a1a1a] md:w-[158px]"
-            href="https://nextjs.org/docs?utm_source=create-next-app&utm_medium=appdir-template-tw&utm_campaign=create-next-app"
-            target="_blank"
-            rel="noopener noreferrer"
-          >
-            Documentation
-          </a>
-        </div>
-      </main>
-    </div>
-  );
 }

src/i18n/request.ts

@@ -0,0 +1,13 @@
+import { getRequestConfig } from "next-intl/server";
+
+/**
+ * i18n scaffold (SPEC §7): all UI strings come from the message catalog.
+ * MVP is fixed to "de"; per-user locale (en) is prepared — switch here later.
+ */
+export default getRequestConfig(async () => {
+  const locale = "de";
+  return {
+    locale,
+    messages: (await import(`../../messages/${locale}.json`)).default,
+  };
+});

src/proxy.ts

@@ -0,0 +1,34 @@
+import { NextResponse, type NextRequest } from "next/server";
+
+/**
+ * Route gate (Next.js 16 proxy, formerly middleware): redirects anonymous
+ * visitors to /login. This is a UX-level gate only — authoritative checks
+ * happen server-side via requireSession()/requirePermission().
+ */
+
+const PUBLIC_PATHS = ["/login", "/api/auth"];
+
+export function proxy(request: NextRequest) {
+  const { pathname } = request.nextUrl;
+
+  if (PUBLIC_PATHS.some((p) => pathname === p || pathname.startsWith(p + "/"))) {
+    return NextResponse.next();
+  }
+
+  const hasSessionCookie =
+    request.cookies.has("authjs.session-token") ||
+    request.cookies.has("__Secure-authjs.session-token");
+
+  if (!hasSessionCookie) {
+    const loginUrl = new URL("/login", request.url);
+    if (pathname !== "/") loginUrl.searchParams.set("callbackUrl", pathname);
+    return NextResponse.redirect(loginUrl);
+  }
+
+  return NextResponse.next();
+}
+
+export const config = {
+  // Everything except static assets
+  matcher: ["/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|ico)).*)"],
+};

src/server/audit.ts

@@ -0,0 +1,28 @@
+import { prisma } from "./db";
+
+/**
+ * Audit trail (SPEC §5 AuditLog, §10): every writing action creates an entry.
+ * Uses the raw client on purpose — audit writes must never be silently
+ * filtered, and tenantId is passed explicitly by the caller.
+ */
+export async function writeAuditLog(entry: {
+  tenantId: string;
+  actorId?: string;
+  action: "create" | "update" | "delete" | "login" | "logout" | "export" | "import";
+  entity: string;
+  entityId?: string;
+  before?: unknown;
+  after?: unknown;
+}) {
+  await prisma.auditLog.create({
+    data: {
+      tenantId: entry.tenantId,
+      actorId: entry.actorId,
+      action: entry.action,
+      entity: entry.entity,
+      entityId: entry.entityId,
+      before: entry.before as object | undefined,
+      after: entry.after as object | undefined,
+    },
+  });
+}

src/server/auth.ts

@@ -0,0 +1,119 @@
+import NextAuth from "next-auth";
+import Credentials from "next-auth/providers/credentials";
+import { verify } from "@node-rs/argon2";
+import { z } from "zod";
+import { prisma } from "./db";
+
+/**
+ * Auth.js (NextAuth v5) with local credentials (MVP, see docs/SPEC.md §0).
+ * JWT strategy: tenant context, roles and permissions are resolved at login
+ * and carried in the token — a role change becomes effective at next login.
+ * TOTP-2FA and OIDC/SAML are planned extensions (SPEC §13).
+ */
+
+const credentialsSchema = z.object({
+  email: z.string().email(),
+  password: z.string().min(1),
+  // Optional: disambiguates when the same e-mail exists in several tenants.
+  tenant: z.string().optional(),
+});
+
+export class LoginError extends Error {}
+
+export const { handlers, auth, signIn, signOut } = NextAuth({
+  session: { strategy: "jwt" },
+  pages: { signIn: "/login" },
+  providers: [
+    Credentials({
+      credentials: {
+        email: {},
+        password: {},
+        tenant: {},
+      },
+      authorize: async (raw) => {
+        const parsed = credentialsSchema.safeParse(raw);
+        if (!parsed.success) return null;
+        const { email, password, tenant } = parsed.data;
+
+        const users = await prisma.user.findMany({
+          where: {
+            email: email.toLowerCase(),
+            status: "ACTIVE",
+            tenant: {
+              status: "ACTIVE",
+              ...(tenant ? { slug: tenant.toLowerCase() } : {}),
+            },
+          },
+          include: {
+            tenant: true,
+            userRoles: {
+              include: {
+                role: {
+                  include: {
+                    rolePermissions: { include: { permission: true } },
+                  },
+                },
+              },
+            },
+          },
+        });
+
+        // Same e-mail in several tenants and no slug given → cannot decide.
+        if (users.length !== 1) return null;
+        const user = users[0];
+
+        const valid = await verify(user.passwordHash, password);
+        if (!valid) return null;
+
+        const roles = user.userRoles.map((ur) => ur.role.key);
+        const permissions = [
+          ...new Set(
+            user.userRoles.flatMap((ur) =>
+              ur.role.rolePermissions.map((rp) => rp.permission.key)
+            )
+          ),
+        ];
+
+        return {
+          id: user.id,
+          email: user.email,
+          name: user.name,
+          tenantId: user.tenantId,
+          tenantSlug: user.tenant.slug,
+          roles,
+          permissions,
+          isPlatformAdmin: user.isPlatformAdmin,
+        };
+      },
+    }),
+  ],
+  callbacks: {
+    jwt({ token, user }) {
+      if (user) {
+        token.userId = user.id!;
+        token.tenantId = user.tenantId;
+        token.tenantSlug = user.tenantSlug;
+        token.roles = user.roles;
+        token.permissions = user.permissions;
+        token.isPlatformAdmin = user.isPlatformAdmin;
+      }
+      return token;
+    },
+    session({ session, token }) {
+      session.user.id = token.userId;
+      session.user.tenantId = token.tenantId;
+      session.user.tenantSlug = token.tenantSlug;
+      session.user.roles = token.roles;
+      session.user.permissions = token.permissions;
+      session.user.isPlatformAdmin = token.isPlatformAdmin;
+      return session;
+    },
+  },
+});
+
+/** Session guard for server components / route handlers. */
+export async function requireSession() {
+  const session = await auth();
+  if (!session?.user) throw new Error("Nicht angemeldet");
+  return session;
+}

src/server/rbac.ts

@@ -0,0 +1,152 @@
+/**
+ * RBAC catalog: granular permissions bundled into per-tenant roles.
+ * See docs/SPEC.md §3. Permissions are global rows (no tenantId),
+ * roles are created per tenant from ROLE_DEFS at tenant provisioning.
+ */
+
+export const PERMISSIONS = [
+  // Administration
+  "tenant:manage",
+  "user:read",
+  "user:manage",
+  // Assets & BIA (one module)
+  "asset:read",
+  "asset:write",
+  "bia:read",
+  "bia:write",
+  // Risk
+  "risk:read",
+  "risk:write",
+  "risk:accept",
+  // Compliance
+  "soa:read",
+  "soa:write",
+  // Measures / tasks
+  "measure:read",
+  "measure:write",
+  // Policies
+  "policy:read",
+  "policy:write",
+  "policy:approve",
+  // Incidents
+  "incident:report",
+  "incident:manage",
+  // Audits
+  "audit:read",
+  "audit:conduct",
+  // Suppliers
+  "supplier:read",
+  "supplier:write",
+  // Evidence / documents
+  "evidence:read",
+  "evidence:write",
+  // Reporting / management review
+  "report:read",
+  "review:manage",
+  // Chat
+  "chat:use",
+] as const;
+
+export type Permission = (typeof PERMISSIONS)[number];
+
+/** Role blueprints instantiated for every tenant (key → name + permissions). */
+export const ROLE_DEFS: Record<
+  string,
+  { name: string; permissions: readonly Permission[] }
+> = {
+  "tenant-admin": {
+    name: "Mandanten-Admin",
+    permissions: ["tenant:manage", "user:read", "user:manage", "report:read", "chat:use"],
+  },
+  isb: {
+    name: "ISB / CISO",
+    permissions: [
+      "user:read",
+      "asset:read",
+      "asset:write",
+      "bia:read",
+      "bia:write",
+      "risk:read",
+      "risk:write",
+      "risk:accept",
+      "soa:read",
+      "soa:write",
+      "measure:read",
+      "measure:write",
+      "policy:read",
+      "policy:write",
+      "policy:approve",
+      "incident:report",
+      "incident:manage",
+      "audit:read",
+      "supplier:read",
+      "supplier:write",
+      "evidence:read",
+      "evidence:write",
+      "report:read",
+      "review:manage",
+      "chat:use",
+    ],
+  },
+  auditor: {
+    name: "Auditor",
+    permissions: [
+      "asset:read",
+      "bia:read",
+      "risk:read",
+      "soa:read",
+      "measure:read",
+      "policy:read",
+      "audit:read",
+      "audit:conduct",
+      "supplier:read",
+      "evidence:read",
+      "report:read",
+    ],
+  },
+  owner: {
+    name: "Asset-/Risk-Owner",
+    permissions: [
+      "asset:read",
+      "asset:write",
+      "bia:read",
+      "risk:read",
+      "risk:write",
+      "measure:read",
+      "measure:write",
+      "policy:read",
+      "incident:report",
+      "evidence:read",
+      "evidence:write",
+      "chat:use",
+    ],
+  },
+  user: {
+    name: "Mitarbeiter",
+    permissions: ["policy:read", "incident:report", "measure:read", "chat:use"],
+  },
+};
+
+export class ForbiddenError extends Error {
+  constructor(permission: Permission) {
+    super(`Fehlende Berechtigung: ${permission}`);
+    this.name = "ForbiddenError";
+  }
+}
+
+/** Server-side permission check — UI hiding is convenience, this is security. */
+export function requirePermission(
+  session: { user?: { permissions?: string[] } } | null,
+  permission: Permission
+): void {
+  if (!session?.user?.permissions?.includes(permission)) {
+    throw new ForbiddenError(permission);
+  }
+}
+
+export function hasPermission(
+  session: { user?: { permissions?: string[] } } | null,
+  permission: Permission
+): boolean {
+  return session?.user?.permissions?.includes(permission) ?? false;
+}

src/types/next-auth.d.ts

@@ -0,0 +1,35 @@
+import type { DefaultSession } from "next-auth";
+
+declare module "next-auth" {
+  interface Session {
+    user: {
+      id: string;
+      tenantId: string;
+      tenantSlug: string;
+      roles: string[];
+      permissions: string[];
+      isPlatformAdmin: boolean;
+    } & DefaultSession["user"];
+  }
+
+  interface User {
+    id?: string;
+    tenantId: string;
+    tenantSlug: string;
+    roles: string[];
+    permissions: string[];
+    isPlatformAdmin: boolean;
+  }
+}
+
+// next-auth/jwt re-exportiert nur aus @auth/core/jwt — Augmentation muss dorthin
+declare module "@auth/core/jwt" {
+  interface JWT {
+    userId: string;
+    tenantId: string;
+    tenantSlug: string;
+    roles: string[];
+    permissions: string[];
+    isPlatformAdmin: boolean;
+  }
+}