Files
certvia/prisma/migrations/20260703113715_suppliers_as_assets/migration.sql
T
MartinandClaude Opus 4.8 dc884062b2 Lieferantenmodul neu: Asset-basiert + Anforderungs-Engine (Phase 1)
Referenz: docs/ISMS-Lieferantenmanagement-GEFIM.html

Architektur: Lieferanten (und IT-Services) sind jetzt Assets.
- AssetType += IT_SERVICE; SupplierProfile/ITServiceProfile als 1:1-
  Erweiterung eines Asset; alle Kind-Entitäten (Contract, Nda,
  SupplierEvidence, SupplierAssessment, ManagementDecision, Subcontractor,
  ServiceControlResponsibility, MaturityAssessment) hängen am Asset
  (keine parallele Datenhaltung). Migration + RLS; Demo neu geseedet.
- Lieferanten erscheinen im Asset-Inventar (Filter „Lieferant"/„IT-Service"),
  tragen C/I/A, nutzbar in Graph/BIA/Risiko.

Anforderungs-Engine (Herzstück, src/lib/supplier.ts):
- Schutzbedarf aus max C/I/A der verknüpften Assets → Stufe normal/hoch/
  sehr hoch; schaltet Anforderungen gestuft scharf (must/should/high/veryhigh)
- Flache Anforderungsliste (nach Themen gruppiert) mit Status-Ableitung aus
  den hinterlegten Objekten, Referenz + Herkunfts-Control (6.1.1–6.1.3)
- Gate-Logik: sehr hoch ohne Audit/Label → Kompensation (Management-
  entscheidung UND verknüpftes Risiko); „Risiko anlegen" erzeugt echten Risk
- Konformität (Konform/Teilweise/Lücken/Handlung nötig) + berechneter
  Reifegrad; ISB-Freigabe (Abweichung nur mit Begründung → Audit-Log)
- Cockpit-Detail mit Schutzbedarf-Banner + Live-Simulation der Stufe

Verifiziert: Register mit abgeleiteter Stufe/Reifegrad/Konformität,
Cockpit-Simulation (Tiers werden inaktiv), Gate bei sehr hoch ohne Audit,
„Risiko anlegen" erzeugt R-005 im Risikomodul.

Offen (Phase 2): Fragebogen-Builder, Self-Service-Portal, IT-Service-
Detail mit RACI-Matrix, Klick im Asset-Inventar öffnet Cockpit,
Scheduler-Automatisierung.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-03 11:57:17 +02:00

240 lines
8.3 KiB
SQL

-- CreateEnum
CREATE TYPE "SupplierLifecycle" AS ENUM ('ACTIVE', 'ONBOARDING', 'UNDER_REVIEW', 'OFFBOARDED');
-- CreateEnum
CREATE TYPE "RaciResponsibility" AS ENUM ('PROVIDER', 'US', 'SHARED');
-- AlterEnum
ALTER TYPE "AssetType" ADD VALUE 'IT_SERVICE';
-- DropForeignKey
ALTER TABLE "contracts" DROP CONSTRAINT "contracts_supplier_id_fkey";
-- DropForeignKey
ALTER TABLE "management_decisions" DROP CONSTRAINT "management_decisions_supplier_id_fkey";
-- DropForeignKey
ALTER TABLE "ndas" DROP CONSTRAINT "ndas_supplier_id_fkey";
-- DropForeignKey
ALTER TABLE "service_responsibilities" DROP CONSTRAINT "service_responsibilities_supplier_id_fkey";
-- DropForeignKey
ALTER TABLE "subcontractors" DROP CONSTRAINT "subcontractors_supplier_id_fkey";
-- DropForeignKey
ALTER TABLE "supplier_assessments" DROP CONSTRAINT "supplier_assessments_supplier_id_fkey";
-- DropForeignKey
ALTER TABLE "supplier_assets" DROP CONSTRAINT "supplier_assets_asset_id_fkey";
-- DropForeignKey
ALTER TABLE "supplier_assets" DROP CONSTRAINT "supplier_assets_supplier_id_fkey";
-- DropForeignKey
ALTER TABLE "supplier_control_maturity" DROP CONSTRAINT "supplier_control_maturity_control_id_fkey";
-- DropForeignKey
ALTER TABLE "supplier_control_maturity" DROP CONSTRAINT "supplier_control_maturity_supplier_id_fkey";
-- DropForeignKey
ALTER TABLE "supplier_evidence" DROP CONSTRAINT "supplier_evidence_supplier_id_fkey";
-- AlterTable
ALTER TABLE "contracts" DROP COLUMN "customer_transparency",
DROP COLUMN "supplier_id",
ADD COLUMN "asset_id" TEXT NOT NULL,
ADD COLUMN "customer_requirements_passed" BOOLEAN NOT NULL DEFAULT false;
-- AlterTable
ALTER TABLE "management_decisions" DROP COLUMN "supplier_id",
ADD COLUMN "asset_id" TEXT NOT NULL;
-- AlterTable
ALTER TABLE "ndas" DROP COLUMN "supplier_id",
ADD COLUMN "asset_id" TEXT NOT NULL,
ADD COLUMN "beyond_term" BOOLEAN NOT NULL DEFAULT false;
-- AlterTable
ALTER TABLE "subcontractors" DROP COLUMN "supplier_id",
ADD COLUMN "asset_id" TEXT NOT NULL;
-- AlterTable
ALTER TABLE "supplier_assessments" DROP COLUMN "status",
DROP COLUMN "supplier_id",
ADD COLUMN "asset_id" TEXT NOT NULL,
ADD COLUMN "self_score" INTEGER,
ADD COLUMN "verified_score" INTEGER;
-- AlterTable
ALTER TABLE "supplier_evidence" DROP COLUMN "supplier_id",
ADD COLUMN "asset_id" TEXT NOT NULL;
-- DropTable
DROP TABLE "service_responsibilities";
-- DropTable
DROP TABLE "supplier_assets";
-- DropTable
DROP TABLE "supplier_control_maturity";
-- DropTable
DROP TABLE "supplier_controls";
-- DropTable
DROP TABLE "suppliers";
-- DropEnum
DROP TYPE "AssessmentStatus";
-- DropEnum
DROP TYPE "ResponsibleParty";
-- DropEnum
DROP TYPE "SupplierStatus";
-- CreateTable
CREATE TABLE "supplier_profiles" (
"id" TEXT NOT NULL,
"tenant_id" TEXT NOT NULL,
"asset_id" TEXT NOT NULL,
"ref_no" INTEGER NOT NULL,
"sector" TEXT,
"service_desc" TEXT,
"criticality" INTEGER NOT NULL DEFAULT 1,
"data_categories" TEXT[] DEFAULT ARRAY[]::TEXT[],
"nis2_relevant" BOOLEAN NOT NULL DEFAULT false,
"lifecycle" "SupplierLifecycle" NOT NULL DEFAULT 'ACTIVE',
"contact" TEXT,
"tisax_label" TEXT,
"tisax_valid_to" TIMESTAMP(3),
"next_review" TIMESTAMP(3),
"notes" TEXT,
"created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
"updated_at" TIMESTAMP(3) NOT NULL,
"created_by" TEXT,
CONSTRAINT "supplier_profiles_pkey" PRIMARY KEY ("id")
);
-- CreateTable
CREATE TABLE "it_service_profiles" (
"id" TEXT NOT NULL,
"tenant_id" TEXT NOT NULL,
"asset_id" TEXT NOT NULL,
"ref_no" INTEGER NOT NULL,
"provider_asset_id" TEXT,
"criticality" INTEGER NOT NULL DEFAULT 1,
"internal" BOOLEAN NOT NULL DEFAULT false,
"notes" TEXT,
"created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
"updated_at" TIMESTAMP(3) NOT NULL,
"created_by" TEXT,
CONSTRAINT "it_service_profiles_pkey" PRIMARY KEY ("id")
);
-- CreateTable
CREATE TABLE "service_control_responsibilities" (
"id" TEXT NOT NULL,
"tenant_id" TEXT NOT NULL,
"asset_id" TEXT NOT NULL,
"control_ref" TEXT NOT NULL,
"title" TEXT,
"applicable" BOOLEAN NOT NULL DEFAULT true,
"responsibility" "RaciResponsibility" NOT NULL DEFAULT 'SHARED',
"evidence_ref" TEXT,
"created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
CONSTRAINT "service_control_responsibilities_pkey" PRIMARY KEY ("id")
);
-- CreateTable
CREATE TABLE "maturity_assessments" (
"id" TEXT NOT NULL,
"tenant_id" TEXT NOT NULL,
"asset_id" TEXT NOT NULL,
"self_value" DOUBLE PRECISION,
"verified_value" DOUBLE PRECISION,
"computed_value" DOUBLE PRECISION,
"isb_value" DOUBLE PRECISION,
"isb_justification" TEXT,
"approved_by" TEXT,
"approved_at" TIMESTAMP(3),
"updated_at" TIMESTAMP(3) NOT NULL,
CONSTRAINT "maturity_assessments_pkey" PRIMARY KEY ("id")
);
-- CreateIndex
CREATE UNIQUE INDEX "supplier_profiles_asset_id_key" ON "supplier_profiles"("asset_id");
-- CreateIndex
CREATE INDEX "supplier_profiles_tenant_id_idx" ON "supplier_profiles"("tenant_id");
-- CreateIndex
CREATE UNIQUE INDEX "supplier_profiles_tenant_id_ref_no_key" ON "supplier_profiles"("tenant_id", "ref_no");
-- CreateIndex
CREATE UNIQUE INDEX "it_service_profiles_asset_id_key" ON "it_service_profiles"("asset_id");
-- CreateIndex
CREATE INDEX "it_service_profiles_tenant_id_idx" ON "it_service_profiles"("tenant_id");
-- CreateIndex
CREATE UNIQUE INDEX "it_service_profiles_tenant_id_ref_no_key" ON "it_service_profiles"("tenant_id", "ref_no");
-- CreateIndex
CREATE INDEX "service_control_responsibilities_tenant_id_idx" ON "service_control_responsibilities"("tenant_id");
-- CreateIndex
CREATE UNIQUE INDEX "maturity_assessments_asset_id_key" ON "maturity_assessments"("asset_id");
-- CreateIndex
CREATE INDEX "maturity_assessments_tenant_id_idx" ON "maturity_assessments"("tenant_id");
-- AddForeignKey
ALTER TABLE "supplier_profiles" ADD CONSTRAINT "supplier_profiles_asset_id_fkey" FOREIGN KEY ("asset_id") REFERENCES "assets"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-- AddForeignKey
ALTER TABLE "it_service_profiles" ADD CONSTRAINT "it_service_profiles_asset_id_fkey" FOREIGN KEY ("asset_id") REFERENCES "assets"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-- AddForeignKey
ALTER TABLE "it_service_profiles" ADD CONSTRAINT "it_service_profiles_provider_asset_id_fkey" FOREIGN KEY ("provider_asset_id") REFERENCES "assets"("id") ON DELETE SET NULL ON UPDATE CASCADE;
-- AddForeignKey
ALTER TABLE "supplier_assessments" ADD CONSTRAINT "supplier_assessments_asset_id_fkey" FOREIGN KEY ("asset_id") REFERENCES "assets"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-- AddForeignKey
ALTER TABLE "supplier_evidence" ADD CONSTRAINT "supplier_evidence_asset_id_fkey" FOREIGN KEY ("asset_id") REFERENCES "assets"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-- AddForeignKey
ALTER TABLE "management_decisions" ADD CONSTRAINT "management_decisions_asset_id_fkey" FOREIGN KEY ("asset_id") REFERENCES "assets"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-- AddForeignKey
ALTER TABLE "contracts" ADD CONSTRAINT "contracts_asset_id_fkey" FOREIGN KEY ("asset_id") REFERENCES "assets"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-- AddForeignKey
ALTER TABLE "ndas" ADD CONSTRAINT "ndas_asset_id_fkey" FOREIGN KEY ("asset_id") REFERENCES "assets"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-- AddForeignKey
ALTER TABLE "subcontractors" ADD CONSTRAINT "subcontractors_asset_id_fkey" FOREIGN KEY ("asset_id") REFERENCES "assets"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-- AddForeignKey
ALTER TABLE "service_control_responsibilities" ADD CONSTRAINT "service_control_responsibilities_asset_id_fkey" FOREIGN KEY ("asset_id") REFERENCES "assets"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-- AddForeignKey
ALTER TABLE "maturity_assessments" ADD CONSTRAINT "maturity_assessments_asset_id_fkey" FOREIGN KEY ("asset_id") REFERENCES "assets"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-- RLS für neue/umgestellte Lieferanten-Tabellen
DO $$
DECLARE t text;
BEGIN
FOREACH t IN ARRAY ARRAY['supplier_profiles','it_service_profiles','maturity_assessments','service_control_responsibilities'] LOOP
EXECUTE format('ALTER TABLE %I ENABLE ROW LEVEL SECURITY', t);
EXECUTE format('CREATE POLICY tenant_isolation ON %I USING (tenant_id = current_setting(''app.tenant_id'', true))', t);
END LOOP;
END $$;