Nicht-destruktiver Richtlinien-Re-Import (Phase-1-Härtung Paket 3)
Der Re-Import löschte bisher alle Policy-Zeilen und legte sie neu an — das setzte
per-Dokument-Status, TISAX-Override, Freigabe/Version und nutzergepflegte
Variablenwerte zurück. Jetzt Diff/Upsert über stabile Schlüssel, verlustfrei.
- Schema: PolicyDocument.archivedAt + PolicyRequirement.archivedAt (Lifecycle,
orthogonal zum Freigabe-status). Migration additiv/nullable.
- import-policies.ts komplett auf Reconcile umgebaut:
- Dokumente (code): neu→anlegen; vorhanden→nur Inhaltsfelder aktualisieren,
Status/Version/Owner/Freigabe/Override bleiben; fehlend→archivedAt setzen
(deaktivieren, nicht löschen); Wiederauftauchen→reaktivieren.
- Anforderungen (reqId): analog inkl. Deaktivierung entfernter Anforderungen.
- Variablen (key): Metadaten aktualisieren, aber value NIE überschreiben
(Kundenpflege); fehlende bleiben bestehen (als obsolet ausgewiesen).
- Baseline (blId) und Nachweise (nr): Upsert; fehlende bleiben erhalten.
- Deaktivierung greift nur im Paket-Namensraum (L00/R*/VA-*/BASELINE/NACHWEIS)
— verwaltete Register aus import-managed (CRYPTO/RISKMATRIX/CLASSIFICATION/
HANDBUCH) werden nicht angetastet.
- Änderungsreport (added/updated/archived/reactivated/unchanged/obsolete) wird
zurückgegeben und ins Audit-Log geschrieben (Entity policy_package). Option
{ dryRun: true } liefert die Vorschau ohne Schreibzugriff. Idempotent.
- Aktive Ansichten (Bibliothek/Coverage, Dokument-Detail) filtern archivedAt: null;
Historie bleibt per Direktlink erreichbar.
Akzeptanztest scripts/test-reimport.ts: Status/Override/Einreicher + Variablenwert
bleiben nach Re-Import erhalten, entfernte Anforderung wird deaktiviert (nicht
gelöscht), verwaltete Register unberührt, zweiter Lauf idempotent. Browser: /policies
rendert unverändert (30 Dokumente). tsc + lint + build + Guard-Check grün.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 4.8
@@ -156,7 +156,7 @@ Nach jeder Änderung: **`npx tsc --noEmit`** → **`npm run lint`** → **`npm r
|
||||
## 9. Bekannte Fallstricke
|
||||
|
||||
1. **Beschädigte Seed-Tokens:** Das VDA-ISA-Paket enthält in einigen VA-RACI-Tabellen (VA-05/08/09/10/12/13) abgeschnittene `{{VAR |`-Tokens. Bei jedem Paket-Update **erneut prüfen & reparieren** (sonst bricht Handlebars). Scan: unbalancierte `{{`/`}}` je Zeile.
|
||||
2. **Richtlinien-Re-Import ist destruktiv** (delete+recreate): setzt per-Dokument-Status/Override/Freigabe zurück. „Deaktivieren statt löschen" ist offene Anforderung.
|
||||
2. **Richtlinien-Re-Import ist nicht-destruktiv** (Phase-1-Härtung Paket 3, `prisma/import-policies.ts`): Diff/Upsert über stabile Schlüssel (`code`/`reqId`/`key`/`blId`/`nr`). Vorhandenes wird inhaltlich aktualisiert, aber **Status/Override/Freigabe** (PolicyDocument) und **nutzergepflegte Variablenwerte** bleiben erhalten; entfernte Paket-Einträge werden **deaktiviert** (`archivedAt`) statt gelöscht (aktive Ansichten filtern `archivedAt: null`). Verwaltete Register aus `import-managed.ts` (CRYPTO/RISKMATRIX/CLASSIFICATION/HANDBUCH) liegen außerhalb des Paket-Namensraums und werden nicht angetastet. Jeder Lauf liefert einen Änderungsreport (Audit-Log, Entity `policy_package`); `{ dryRun: true }` erzeugt die Vorschau ohne Schreibzugriff. Akzeptanztest: `npx tsx scripts/test-reimport.ts`.
|
||||
3. **RLS-Kontext:** RLS-Policies erwarten `current_setting('app.tenant_id')`. Die App nutzt primär den `dbForTenant`-Guard; wenn direkte DB-Zugriffe hinzukommen, `app.tenant_id` in der Transaktion setzen.
|
||||
4. **Turbopack-HMR** kann veraltete Fehler/`MISSING_MESSAGE` zeigen, nachdem `messages/*.json` geändert wurde → Dev-Server neu starten. Produktions-Build ist maßgeblich.
|
||||
5. **Prisma-7-Migrationsflow** wie in §4 (kein `migrate dev`).
|
||||
|
||||
+203
-34
@@ -6,11 +6,34 @@ import type { PrismaClient } from "@prisma/client";
|
||||
* Importer für das VDA-ISA-2027-Vorlagenpaket (§6 der Spezifikation).
|
||||
* Liest die echten .md-Dateien, mapping.json, variables.schema.json,
|
||||
* Technische-Sicherheits-Baseline.md und Nachweisregister_zentral.md in die
|
||||
* Policy-Tabellen. Idempotent pro Mandant (löscht + legt neu an).
|
||||
* Policy-Tabellen.
|
||||
*
|
||||
* **Nicht-destruktiver Re-Import (Phase-1-Härtung Paket 3):** Abgleich über stabile
|
||||
* Schlüssel (Dokument-`code`, Anforderungs-`reqId`, Variablen-`key`, Baseline-`blId`,
|
||||
* Nachweis-`nr`) per Diff/Upsert statt Löschen+Neuanlegen.
|
||||
* - Neu im Paket ⇒ anlegen.
|
||||
* - Weiterhin vorhanden ⇒ Inhalt aktualisieren, aber per-Dokument-Status,
|
||||
* TISAX-Override, Freigabe-/Versionsstand und Verknüpfungen (Coverage/Nachweise)
|
||||
* sowie **nutzergepflegte Variablenwerte** erhalten.
|
||||
* - Nicht mehr im Paket ⇒ **deaktivieren** (`archivedAt` setzen), nicht löschen.
|
||||
* Jeder Lauf liefert einen Änderungsreport (added/updated/archived/reactivated) und
|
||||
* protokolliert ihn im Audit-Log. `dryRun` erzeugt den Report ohne Schreibzugriffe
|
||||
* (Vorschau). Idempotent: erneuter Lauf ohne Änderungen ⇒ nur „unchanged".
|
||||
*/
|
||||
|
||||
type DocType = "LEITLINIE" | "RICHTLINIE" | "VERFAHREN" | "REGISTER";
|
||||
|
||||
const arraysEqual = (a: string[], b: string[]) => a.length === b.length && a.every((v, i) => v === b[i]);
|
||||
|
||||
/**
|
||||
* Namensraum der Dokumente, die DIESER Importer verwaltet (Leitlinie, Richtlinien,
|
||||
* Verfahren, Baseline-/Nachweisregister). Verwaltete Register aus import-managed.ts
|
||||
* (CRYPTO, RISKMATRIX, CLASSIFICATION, HANDBUCH, …) gehören NICHT dazu und dürfen beim
|
||||
* Re-Import nicht deaktiviert werden.
|
||||
*/
|
||||
const isPackageDoc = (code: string) =>
|
||||
code === "L00" || code === "BASELINE" || code === "NACHWEIS" || /^R\d/.test(code) || /^VA-/.test(code);
|
||||
|
||||
function docCodeFromFile(file: string): string {
|
||||
return file.split("_")[0]; // "R08_….md" → "R08", "VA-03_….md" → "VA-03"
|
||||
}
|
||||
@@ -54,13 +77,36 @@ interface SchemaProp {
|
||||
example?: string;
|
||||
}
|
||||
|
||||
export async function importPolicies(prisma: PrismaClient, tenantId: string, seedDir: string) {
|
||||
// Sauberer Neuimport pro Mandant
|
||||
await prisma.policyRequirement.deleteMany({ where: { tenantId } });
|
||||
await prisma.policyDocument.deleteMany({ where: { tenantId } });
|
||||
await prisma.policyVariable.deleteMany({ where: { tenantId } });
|
||||
await prisma.policyBaselineParam.deleteMany({ where: { tenantId } });
|
||||
await prisma.policyEvidence.deleteMany({ where: { tenantId } });
|
||||
export interface ImportReport {
|
||||
documents: { added: number; updated: number; archived: number; reactivated: number; unchanged: number };
|
||||
requirements: { added: number; updated: number; archived: number; reactivated: number; unchanged: number };
|
||||
variables: { added: number; updated: number; unchanged: number; obsolete: number };
|
||||
baseline: { added: number; updated: number; unchanged: number; obsolete: number };
|
||||
evidence: { added: number; updated: number; unchanged: number; obsolete: number };
|
||||
}
|
||||
|
||||
export interface ImportOptions {
|
||||
/** true = nur Report berechnen, keine Schreibzugriffe (Vorschau). */
|
||||
dryRun?: boolean;
|
||||
/** Akteur für den Audit-Eintrag (z. B. Plattform-/Mandanten-Admin). */
|
||||
actorId?: string | null;
|
||||
}
|
||||
|
||||
export async function importPolicies(
|
||||
prisma: PrismaClient,
|
||||
tenantId: string,
|
||||
seedDir: string,
|
||||
options: ImportOptions = {}
|
||||
) {
|
||||
const dryRun = options.dryRun ?? false;
|
||||
const now = new Date();
|
||||
const report: ImportReport = {
|
||||
documents: { added: 0, updated: 0, archived: 0, reactivated: 0, unchanged: 0 },
|
||||
requirements: { added: 0, updated: 0, archived: 0, reactivated: 0, unchanged: 0 },
|
||||
variables: { added: 0, updated: 0, unchanged: 0, obsolete: 0 },
|
||||
baseline: { added: 0, updated: 0, unchanged: 0, obsolete: 0 },
|
||||
evidence: { added: 0, updated: 0, unchanged: 0, obsolete: 0 },
|
||||
};
|
||||
|
||||
// ── 1. mapping.json → FULFILLS-Rückwärtsmapping vorbereiten ──────────────
|
||||
const mapping = JSON.parse(readFileSync(join(seedDir, "mapping.json"), "utf-8")) as {
|
||||
@@ -106,72 +152,195 @@ export async function importPolicies(prisma: PrismaClient, tenantId: string, see
|
||||
docs.push({ code: "BASELINE", type: "REGISTER", title: titleOf(baselineRaw), policyCode: null, fulfills: [], raw: baselineRaw, orderIdx: 900 });
|
||||
docs.push({ code: "NACHWEIS", type: "REGISTER", title: titleOf(nachweisRaw), policyCode: null, fulfills: [], raw: nachweisRaw, orderIdx: 901 });
|
||||
|
||||
// ── Reconcile Dokumente (Upsert über code; Status/Override/Freigabe bleiben) ──
|
||||
const existingDocs = await prisma.policyDocument.findMany({ where: { tenantId } });
|
||||
const docByCode = new Map(existingDocs.map((d) => [d.code, d]));
|
||||
const desiredDocCodes = new Set(docs.map((d) => d.code));
|
||||
for (const d of docs) {
|
||||
const ex = docByCode.get(d.code);
|
||||
if (!ex) {
|
||||
report.documents.added++;
|
||||
if (!dryRun)
|
||||
await prisma.policyDocument.create({
|
||||
data: {
|
||||
tenantId, code: d.code, type: d.type, title: d.title, version: "1.0", status: "FREIGEGEBEN",
|
||||
policyCode: d.policyCode, fulfills: d.fulfills, rawMarkdown: d.raw, orderIdx: d.orderIdx,
|
||||
},
|
||||
});
|
||||
continue;
|
||||
}
|
||||
const contentChanged =
|
||||
ex.type !== d.type || ex.title !== d.title || (ex.policyCode ?? null) !== (d.policyCode ?? null) ||
|
||||
!arraysEqual(ex.fulfills, d.fulfills) || ex.rawMarkdown !== d.raw || ex.orderIdx !== d.orderIdx;
|
||||
// Nur Inhaltsfelder + Lifecycle; Status/Version/Owner/Freigabe/Override NICHT anfassen.
|
||||
const contentData = { type: d.type, title: d.title, policyCode: d.policyCode, fulfills: d.fulfills, rawMarkdown: d.raw, orderIdx: d.orderIdx };
|
||||
if (ex.archivedAt) {
|
||||
report.documents.reactivated++;
|
||||
if (!dryRun) await prisma.policyDocument.update({ where: { id: ex.id }, data: { ...contentData, archivedAt: null } });
|
||||
} else if (contentChanged) {
|
||||
report.documents.updated++;
|
||||
if (!dryRun) await prisma.policyDocument.update({ where: { id: ex.id }, data: contentData });
|
||||
} else {
|
||||
report.documents.unchanged++;
|
||||
}
|
||||
}
|
||||
for (const ex of existingDocs) {
|
||||
// Nur Paket-Dokumente deaktivieren — verwaltete Register (import-managed) unberührt lassen.
|
||||
if (desiredDocCodes.has(ex.code) || ex.archivedAt || !isPackageDoc(ex.code)) continue;
|
||||
report.documents.archived++;
|
||||
if (!dryRun) await prisma.policyDocument.update({ where: { id: ex.id }, data: { archivedAt: now } });
|
||||
}
|
||||
|
||||
// ── 3. Anforderungen (mapping.json) + vaCodes ────────────────────────────
|
||||
for (const a of mapping.anforderungen) {
|
||||
await prisma.policyRequirement.create({
|
||||
data: {
|
||||
tenantId, reqId: a.id, policyCode: a.policy, control: a.control, obligation: a.type,
|
||||
// ── 3. Reconcile Anforderungen (Upsert über reqId; entfernte werden deaktiviert) ──
|
||||
const desiredReqs = mapping.anforderungen.map((a) => ({
|
||||
reqId: a.id, policyCode: a.policy, control: a.control, obligation: a.type,
|
||||
condition: a.condition, requirement: a.requirement, implementation: implMap.get(a.id) ?? a.implementation ?? "",
|
||||
vaCodes: [...(reqToVas.get(a.id) ?? [])].sort(), nachweisLink: a.nachweis_link ?? null,
|
||||
},
|
||||
});
|
||||
}));
|
||||
const existingReqs = await prisma.policyRequirement.findMany({ where: { tenantId } });
|
||||
const reqById = new Map(existingReqs.map((r) => [r.reqId, r]));
|
||||
const desiredReqIds = new Set(desiredReqs.map((r) => r.reqId));
|
||||
for (const r of desiredReqs) {
|
||||
const ex = reqById.get(r.reqId);
|
||||
if (!ex) {
|
||||
report.requirements.added++;
|
||||
if (!dryRun) await prisma.policyRequirement.create({ data: { tenantId, ...r } });
|
||||
continue;
|
||||
}
|
||||
const changed =
|
||||
ex.policyCode !== r.policyCode || ex.control !== r.control || ex.obligation !== r.obligation ||
|
||||
(ex.condition ?? null) !== (r.condition ?? null) || ex.requirement !== r.requirement ||
|
||||
ex.implementation !== r.implementation || !arraysEqual(ex.vaCodes, r.vaCodes) ||
|
||||
(ex.nachweisLink ?? null) !== (r.nachweisLink ?? null);
|
||||
if (ex.archivedAt) {
|
||||
report.requirements.reactivated++;
|
||||
if (!dryRun) await prisma.policyRequirement.update({ where: { id: ex.id }, data: { ...r, archivedAt: null } });
|
||||
} else if (changed) {
|
||||
report.requirements.updated++;
|
||||
if (!dryRun) await prisma.policyRequirement.update({ where: { id: ex.id }, data: r });
|
||||
} else {
|
||||
report.requirements.unchanged++;
|
||||
}
|
||||
}
|
||||
for (const ex of existingReqs) {
|
||||
if (desiredReqIds.has(ex.reqId) || ex.archivedAt) continue;
|
||||
report.requirements.archived++;
|
||||
if (!dryRun) await prisma.policyRequirement.update({ where: { id: ex.id }, data: { archivedAt: now } });
|
||||
}
|
||||
|
||||
// ── 4. Variablen + Feature-Flags (variables.schema.json) ─────────────────
|
||||
// ── 4. Reconcile Variablen + Feature-Flags (Wert bleibt IMMER erhalten) ──
|
||||
const schema = JSON.parse(readFileSync(join(seedDir, "variables.schema.json"), "utf-8")) as {
|
||||
properties: Record<string, SchemaProp>; required?: string[];
|
||||
};
|
||||
const required = new Set(schema.required ?? []);
|
||||
let vi = 0;
|
||||
for (const [key, prop] of Object.entries(schema.properties)) {
|
||||
const desiredVars = Object.entries(schema.properties).map(([key, prop], i) => {
|
||||
const kind = prop.type === "boolean" ? "boolean" : "string";
|
||||
const value = prop.default !== undefined ? String(prop.default) : prop.example !== undefined ? String(prop.example) : kind === "boolean" ? "false" : "";
|
||||
await prisma.policyVariable.create({
|
||||
data: { tenantId, key, title: prop.title ?? key, kind, groupName: varGroup(key), value, required: required.has(key), orderIdx: vi++ },
|
||||
return { key, title: prop.title ?? key, kind, groupName: varGroup(key), value, required: required.has(key), orderIdx: i };
|
||||
});
|
||||
const existingVars = await prisma.policyVariable.findMany({ where: { tenantId } });
|
||||
const varByKey = new Map(existingVars.map((v) => [v.key, v]));
|
||||
const desiredVarKeys = new Set(desiredVars.map((v) => v.key));
|
||||
for (const v of desiredVars) {
|
||||
const ex = varByKey.get(v.key);
|
||||
if (!ex) {
|
||||
report.variables.added++;
|
||||
if (!dryRun) await prisma.policyVariable.create({ data: { tenantId, ...v } });
|
||||
continue;
|
||||
}
|
||||
// Nur Metadaten aktualisieren — den (ggf. vom Kunden gepflegten) value NIE überschreiben.
|
||||
const metaChanged =
|
||||
ex.title !== v.title || ex.kind !== v.kind || (ex.groupName ?? null) !== (v.groupName ?? null) ||
|
||||
ex.required !== v.required || ex.orderIdx !== v.orderIdx;
|
||||
if (metaChanged) {
|
||||
report.variables.updated++;
|
||||
if (!dryRun) await prisma.policyVariable.update({ where: { id: ex.id }, data: { title: v.title, kind: v.kind, groupName: v.groupName, required: v.required, orderIdx: v.orderIdx } });
|
||||
} else {
|
||||
report.variables.unchanged++;
|
||||
}
|
||||
}
|
||||
// Nicht mehr im Schema enthaltene Variablen bleiben bestehen (können in eigenem
|
||||
// Rohtext referenziert sein) — nur als „obsolet" im Report ausgewiesen.
|
||||
report.variables.obsolete = existingVars.filter((v) => !desiredVarKeys.has(v.key)).length;
|
||||
|
||||
// ── 5. Baseline-Parameter (Technische-Sicherheits-Baseline.md) ───────────
|
||||
// ── 5. Reconcile Baseline-Parameter (Upsert über blId) ───────────────────
|
||||
const desiredBaseline: Array<{ blId: string; section: string; name: string; vorgabe: string; orderIdx: number }> = [];
|
||||
{
|
||||
let section = "";
|
||||
let bi = 0;
|
||||
for (const line of baselineRaw.split("\n")) {
|
||||
const h = line.match(/^##\s+(.+?)\s*$/);
|
||||
if (h) { section = h[1].trim(); continue; }
|
||||
const row = line.match(/^\|\s*(BL-[A-Z]+-\d+)\s*\|\s*(.+?)\s*\|\s*(.+?)\s*\|\s*$/);
|
||||
if (row) {
|
||||
await prisma.policyBaselineParam.create({
|
||||
data: { tenantId, blId: row[1], section, name: row[2].trim(), vorgabe: row[3].trim(), orderIdx: bi++ },
|
||||
});
|
||||
if (row) desiredBaseline.push({ blId: row[1], section, name: row[2].trim(), vorgabe: row[3].trim(), orderIdx: bi++ });
|
||||
}
|
||||
}
|
||||
const existingBaseline = await prisma.policyBaselineParam.findMany({ where: { tenantId } });
|
||||
const blById = new Map(existingBaseline.map((b) => [b.blId, b]));
|
||||
const desiredBlIds = new Set(desiredBaseline.map((b) => b.blId));
|
||||
for (const b of desiredBaseline) {
|
||||
const ex = blById.get(b.blId);
|
||||
if (!ex) {
|
||||
report.baseline.added++;
|
||||
if (!dryRun) await prisma.policyBaselineParam.create({ data: { tenantId, ...b } });
|
||||
continue;
|
||||
}
|
||||
const changed = ex.section !== b.section || ex.name !== b.name || ex.vorgabe !== b.vorgabe || ex.orderIdx !== b.orderIdx;
|
||||
if (changed) {
|
||||
report.baseline.updated++;
|
||||
if (!dryRun) await prisma.policyBaselineParam.update({ where: { id: ex.id }, data: { section: b.section, name: b.name, vorgabe: b.vorgabe, orderIdx: b.orderIdx } });
|
||||
} else {
|
||||
report.baseline.unchanged++;
|
||||
}
|
||||
}
|
||||
report.baseline.obsolete = existingBaseline.filter((b) => !desiredBlIds.has(b.blId)).length;
|
||||
|
||||
// ── 6. Nachweisregister (Nachweisregister_zentral.md) ────────────────────
|
||||
// ── 6. Reconcile Nachweisregister (Upsert über nr) ───────────────────────
|
||||
const desiredEvidence: Array<{ nr: number; policyCode: string; nachweis: string; quelle: string; verantwortlich: string; turnus: string }> = [];
|
||||
for (const line of nachweisRaw.split("\n")) {
|
||||
const row = line.match(/^\|\s*(\d+)\s*\|\s*(.+?)\s*\|\s*(.+?)\s*\|\s*(.+?)\s*\|\s*(.+?)\s*\|\s*(.+?)\s*\|\s*$/);
|
||||
if (!row) continue;
|
||||
const policyMatch = row[2].match(/\{\{LINK:([^}]+)\}\}/);
|
||||
await prisma.policyEvidence.create({
|
||||
data: {
|
||||
tenantId, nr: parseInt(row[1], 10), policyCode: policyMatch ? policyMatch[1] : row[2].trim(),
|
||||
desiredEvidence.push({
|
||||
nr: parseInt(row[1], 10), policyCode: policyMatch ? policyMatch[1] : row[2].trim(),
|
||||
nachweis: row[3].trim(), quelle: row[4].trim(), verantwortlich: row[5].trim(), turnus: row[6].trim(),
|
||||
});
|
||||
}
|
||||
const existingEvidence = await prisma.policyEvidence.findMany({ where: { tenantId } });
|
||||
const evByNr = new Map(existingEvidence.map((e) => [e.nr, e]));
|
||||
const desiredNrs = new Set(desiredEvidence.map((e) => e.nr));
|
||||
for (const e of desiredEvidence) {
|
||||
const ex = evByNr.get(e.nr);
|
||||
if (!ex) {
|
||||
report.evidence.added++;
|
||||
if (!dryRun) await prisma.policyEvidence.create({ data: { tenantId, ...e } });
|
||||
continue;
|
||||
}
|
||||
const changed = ex.policyCode !== e.policyCode || ex.nachweis !== e.nachweis || ex.quelle !== e.quelle || ex.verantwortlich !== e.verantwortlich || ex.turnus !== e.turnus;
|
||||
if (changed) {
|
||||
report.evidence.updated++;
|
||||
if (!dryRun) await prisma.policyEvidence.update({ where: { id: ex.id }, data: { policyCode: e.policyCode, nachweis: e.nachweis, quelle: e.quelle, verantwortlich: e.verantwortlich, turnus: e.turnus } });
|
||||
} else {
|
||||
report.evidence.unchanged++;
|
||||
}
|
||||
}
|
||||
report.evidence.obsolete = existingEvidence.filter((e) => !desiredNrs.has(e.nr)).length;
|
||||
|
||||
// Änderungsprotokoll ins Audit-Log (nur bei echtem Lauf).
|
||||
if (!dryRun) {
|
||||
await prisma.auditLog.create({
|
||||
data: {
|
||||
tenantId, scope: "tenant", actorId: options.actorId ?? null,
|
||||
action: "import", entity: "policy_package", after: report as unknown as object,
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
const counts = {
|
||||
return {
|
||||
documents: docs.length,
|
||||
requirements: mapping.anforderungen.length,
|
||||
variables: Object.keys(schema.properties).length,
|
||||
baseline: bi,
|
||||
requirements: desiredReqs.length,
|
||||
variables: desiredVars.length,
|
||||
baseline: desiredBaseline.length,
|
||||
report,
|
||||
};
|
||||
return counts;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,6 @@
|
||||
-- AlterTable
|
||||
ALTER TABLE "policy_documents" ADD COLUMN "archived_at" TIMESTAMP(3);
|
||||
|
||||
-- AlterTable
|
||||
ALTER TABLE "policy_requirements" ADD COLUMN "archived_at" TIMESTAMP(3);
|
||||
|
||||
@@ -770,6 +770,9 @@ model PolicyDocument {
|
||||
approvedAt DateTime? @map("approved_at")
|
||||
// Schutzbedarf-/TISAX-Level-Override je Richtlinie: null = global, "AL2" | "AL3"
|
||||
protectionOverride String? @map("protection_override")
|
||||
// Lifecycle (nicht-destruktiver Re-Import): gesetzt, wenn das Dokument nicht mehr
|
||||
// im Vorlagenpaket enthalten ist. null = aktiv. Orthogonal zum Freigabe-`status`.
|
||||
archivedAt DateTime? @map("archived_at")
|
||||
createdAt DateTime @default(now()) @map("created_at")
|
||||
updatedAt DateTime @updatedAt @map("updated_at")
|
||||
|
||||
@@ -790,6 +793,9 @@ model PolicyRequirement {
|
||||
implementation String
|
||||
vaCodes String[] @default([]) @map("va_codes") // operationalisierende Verfahren
|
||||
nachweisLink String? @map("nachweis_link")
|
||||
// Lifecycle (nicht-destruktiver Re-Import): gesetzt, wenn die Anforderung nicht mehr
|
||||
// im Vorlagenpaket enthalten ist. null = aktiv.
|
||||
archivedAt DateTime? @map("archived_at")
|
||||
createdAt DateTime @default(now()) @map("created_at")
|
||||
|
||||
@@unique([tenantId, reqId])
|
||||
|
||||
@@ -0,0 +1,88 @@
|
||||
import "dotenv/config";
|
||||
import { join } from "node:path";
|
||||
import { prisma } from "../src/server/db";
|
||||
import { importPolicies } from "../prisma/import-policies";
|
||||
|
||||
const SEED_DIR = join(process.cwd(), "seed", "isms-vorlagenpaket-v2");
|
||||
const ok = (c: boolean, m: string) => console.log(`${c ? "✓" : "✗ FEHLER"} ${m}`);
|
||||
|
||||
async function main() {
|
||||
const tenant = await prisma.tenant.findFirst({ where: { slug: "demo" } });
|
||||
if (!tenant) throw new Error("Demo-Mandant fehlt");
|
||||
const t = tenant.id;
|
||||
|
||||
// Ausgangszustand eines echten Dokuments + einer Variable sichern
|
||||
const doc0 = await prisma.policyDocument.findFirst({ where: { tenantId: t, code: "R08" } });
|
||||
const varName = "ORG_NAME";
|
||||
const var0 = await prisma.policyVariable.findFirst({ where: { tenantId: t, key: varName } });
|
||||
if (!doc0 || !var0) throw new Error("Erwartetes Dokument R08 / Variable ORG_NAME fehlt");
|
||||
|
||||
// 1) Kuratierten Zustand simulieren: Freigabe-Status, TISAX-Override, Einreicher,
|
||||
// geänderter Titel (Inhalts-Diff) + nutzergepflegter Variablenwert.
|
||||
await prisma.policyDocument.update({
|
||||
where: { id: doc0.id },
|
||||
data: { status: "ENTWURF", protectionOverride: "AL3", submittedBy: "tester", title: "MANUELL GEÄNDERTER TITEL" },
|
||||
});
|
||||
await prisma.policyVariable.update({ where: { id: var0.id }, data: { value: "Mustermann Spezial GmbH" } });
|
||||
|
||||
// 2) Entfernte Anforderung simulieren (nicht im Paket): muss deaktiviert, nicht gelöscht werden.
|
||||
const fakeReqId = "ZZ-REMOVED-TEST-1";
|
||||
await prisma.policyRequirement.deleteMany({ where: { tenantId: t, reqId: fakeReqId } });
|
||||
await prisma.policyRequirement.create({
|
||||
data: { tenantId: t, reqId: fakeReqId, policyCode: "R08", control: "0.0.0", obligation: "MUSS", requirement: "Test", implementation: "" },
|
||||
});
|
||||
|
||||
// 3) Dry-Run: Vorschau ohne Schreibzugriff
|
||||
const preview = await importPolicies(prisma, t, SEED_DIR, { dryRun: true });
|
||||
console.log("\n— Dry-Run-Report —");
|
||||
console.log(JSON.stringify(preview.report, null, 0));
|
||||
ok(preview.report.documents.updated >= 1, "Dry-Run erkennt Titeländerung an R08 (updated ≥ 1)");
|
||||
ok(preview.report.documents.archived === 0, "Dry-Run deaktiviert KEINE verwalteten Register (CRYPTO/HANDBUCH/…)");
|
||||
ok(preview.report.requirements.archived === 1, "Dry-Run erkennt 1 zu deaktivierende Anforderung");
|
||||
const stillDraftAfterDry = await prisma.policyDocument.findUnique({ where: { id: doc0.id } });
|
||||
ok(stillDraftAfterDry?.title === "MANUELL GEÄNDERTER TITEL", "Dry-Run schreibt NICHT (Titel unverändert)");
|
||||
|
||||
// 4) Echter Re-Import
|
||||
const run1 = await importPolicies(prisma, t, SEED_DIR, { dryRun: false, actorId: null });
|
||||
console.log("\n— Re-Import-Report —");
|
||||
console.log(JSON.stringify(run1.report, null, 0));
|
||||
|
||||
const docA = await prisma.policyDocument.findUnique({ where: { id: doc0.id } });
|
||||
ok(docA?.status === "ENTWURF", "Freigabe-Status bleibt erhalten (ENTWURF)");
|
||||
ok(docA?.protectionOverride === "AL3", "TISAX-Override bleibt erhalten (AL3)");
|
||||
ok(docA?.submittedBy === "tester", "Einreicher (Freigabe-Workflow) bleibt erhalten");
|
||||
ok(docA?.title === doc0.title, "Titel wurde aus dem Paket aktualisiert (Inhalt)");
|
||||
ok(docA?.archivedAt === null, "Dokument bleibt aktiv");
|
||||
|
||||
const varA = await prisma.policyVariable.findUnique({ where: { id: var0.id } });
|
||||
ok(varA?.value === "Mustermann Spezial GmbH", "Nutzergepflegter Variablenwert bleibt erhalten");
|
||||
|
||||
const fakeA = await prisma.policyRequirement.findFirst({ where: { tenantId: t, reqId: fakeReqId } });
|
||||
ok(!!fakeA && fakeA.archivedAt !== null, "Entfernte Anforderung ist deaktiviert (archivedAt gesetzt), NICHT gelöscht");
|
||||
|
||||
const auditA = await prisma.auditLog.findFirst({ where: { tenantId: t, entity: "policy_package" }, orderBy: { createdAt: "desc" } });
|
||||
ok(!!auditA, "Änderungsreport im Audit-Log protokolliert");
|
||||
|
||||
// 5) Idempotenz: zweiter Lauf ohne externe Änderung → keine Diffs
|
||||
const run2 = await importPolicies(prisma, t, SEED_DIR, { dryRun: false });
|
||||
const r = run2.report;
|
||||
const noChanges =
|
||||
r.documents.added + r.documents.updated + r.documents.archived + r.documents.reactivated === 0 &&
|
||||
r.requirements.added + r.requirements.updated + r.requirements.archived + r.requirements.reactivated === 0 &&
|
||||
r.variables.added + r.variables.updated === 0 && r.baseline.added + r.baseline.updated === 0 &&
|
||||
r.evidence.added + r.evidence.updated === 0;
|
||||
console.log("\n— Idempotenz-Report —");
|
||||
console.log(JSON.stringify(r, null, 0));
|
||||
ok(noChanges, "Zweiter Lauf ist idempotent (keine added/updated/archived/reactivated)");
|
||||
|
||||
// Aufräumen: Testartefakt entfernen, kuratierten Zustand zurücksetzen
|
||||
await prisma.policyRequirement.deleteMany({ where: { tenantId: t, reqId: fakeReqId } });
|
||||
await prisma.policyDocument.update({
|
||||
where: { id: doc0.id },
|
||||
data: { status: doc0.status, protectionOverride: doc0.protectionOverride, submittedBy: doc0.submittedBy, title: doc0.title, archivedAt: null },
|
||||
});
|
||||
await prisma.policyVariable.update({ where: { id: var0.id }, data: { value: var0.value } });
|
||||
console.log("\n✓ aufgeräumt (Testartefakte entfernt, R08/ORG_NAME zurückgesetzt)");
|
||||
}
|
||||
|
||||
main().then(() => process.exit(0)).catch((e) => { console.error(e); process.exit(1); });
|
||||
@@ -58,7 +58,7 @@ export default async function PolicyDetailPage({
|
||||
} else {
|
||||
const [variables, reqs] = await Promise.all([
|
||||
db.policyVariable.findMany({ orderBy: { orderIdx: "asc" } }),
|
||||
db.policyRequirement.findMany({ where: { policyCode: doc.code } }),
|
||||
db.policyRequirement.findMany({ where: { policyCode: doc.code, archivedAt: null } }),
|
||||
]);
|
||||
const controls = [...new Set(reqs.map((r) => r.control))].sort();
|
||||
const relatedVas = [...new Set(reqs.flatMap((r) => r.vaCodes))].sort();
|
||||
|
||||
@@ -125,8 +125,10 @@ export default async function PoliciesPage({
|
||||
const params = await searchParams;
|
||||
|
||||
const [docs, requirements, variables] = await Promise.all([
|
||||
db.policyDocument.findMany({ orderBy: { orderIdx: "asc" } }),
|
||||
db.policyRequirement.findMany({ orderBy: [{ control: "asc" }, { reqId: "asc" }] }),
|
||||
// Aktive Bibliothek/Coverage: deaktivierte (nicht mehr im Paket enthaltene)
|
||||
// Dokumente/Anforderungen ausblenden — Historie bleibt per Direktlink erreichbar.
|
||||
db.policyDocument.findMany({ where: { archivedAt: null }, orderBy: { orderIdx: "asc" } }),
|
||||
db.policyRequirement.findMany({ where: { archivedAt: null }, orderBy: [{ control: "asc" }, { reqId: "asc" }] }),
|
||||
db.policyVariable.findMany(),
|
||||
]);
|
||||
const titleOf = (code: string) => docs.find((d) => d.code === code)?.title ?? code;
|
||||
|
||||
Reference in New Issue
Block a user