Fundament: ISMS-Module entfernt; Craftvia-Rollen, Module, Navigation, i18n-Split
- ISMS-Routen, Actions, Server-/Lib-Code, Komponenten, Prisma-Modelle, Seeds, Importer, Skripte und ISMS-Tests entfernt (Fundament bleibt: Auth, Identity, MFA/WebAuthn, RBAC, Audit, Mail, Storage, Backup/DSGVO, Plattform-Admin) - Schema auf Fundament-Modelle reduziert; TenantSettings generisch (+phone/email) - TENANT_MODELS (db.ts, backup/topology.ts) und PII-Felder ausgedünnt - RBAC: Rollen tenant-admin/backoffice/team-lead/technician + Craftvia-Permissions - Modul-Katalog (customers, sites, teams, work_orders, imports, field, reports, emergency, documents, notifications, lotse) + Navigation aus src/lib/nav.ts - Modul-Routen mit requireModule-Layout und Platzhalterseite - Message-Katalog je Namespace (messages/<locale>/<namespace>.json), fs-Loader - check-module-guards: Modul-Key aus src/server/actions/<moduleKey>/ - Provisionierung, Admin-Konsole, Einstellungen, Files-Route, Mail entkoppelt - Seed minimal (demo/demo2, Nutzer je Rolle); Fundament-Tests auf Role/ NotificationPreference-Fixtures umgestellt Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5
@@ -1,82 +0,0 @@
|
||||
// Import der Umsetzungshinweise (Story B5-1) aus dem Fachcontent C6 in das globale
|
||||
// Modell ImplementationHint. Ein Block je Teilanforderung:
|
||||
//
|
||||
// ### <id> — [<STUFE>]
|
||||
// **Anforderung:** …
|
||||
// - **Organisatorisch:** …
|
||||
// - **Technisch:** …
|
||||
// - **Typische Nachweise:** …
|
||||
// - **Vorlage:** L00
|
||||
// - **Ressourcen:** …
|
||||
// - **AL-Filter:** AL2 + AL3
|
||||
//
|
||||
// Idempotent (Upsert über reqId). Kein tenantId (globaler Katalog).
|
||||
|
||||
import { readFileSync } from "node:fs";
|
||||
import { join } from "node:path";
|
||||
import type { PrismaClient } from "@prisma/client";
|
||||
|
||||
const C6_PATH = join(__dirname, "..", "docs", "wizard-uebergabe", "02_Fachcontent_C1-C9", "C6_Umsetzungshinweise.md");
|
||||
|
||||
const field = (block: string, label: string): string => {
|
||||
// Feldzeile "- **Label:** Wert" oder "**Label:** Wert" bis Zeilenende.
|
||||
const re = new RegExp(`\\*\\*${label}:\\*\\*\\s*(.+)`);
|
||||
const m = block.match(re);
|
||||
return m ? m[1].trim() : "";
|
||||
};
|
||||
|
||||
const isProcurement = (resources: string): boolean => {
|
||||
const r = resources.toLowerCase();
|
||||
if (/kein\s+toolbudget|kein\s+budget|ohne\s+budget|keine\s+beschaffung/.test(r)) return false;
|
||||
return /beschaffung|toolbudget|budget|lizenz|invest|anschaffung|€|eur\b/.test(r);
|
||||
};
|
||||
|
||||
export interface ParsedHint {
|
||||
reqId: string; control: string; stufe: string; requirement: string;
|
||||
organisational: string; technical: string; evidence: string;
|
||||
template: string | null; resources: string; alFilter: string; procurement: boolean;
|
||||
}
|
||||
|
||||
/** Parst den C6-Text zu Hinweis-Objekten (ohne DB-Zugriff — testbar). */
|
||||
export function parseC6Hints(text: string): ParsedHint[] {
|
||||
const hints: ParsedHint[] = [];
|
||||
// Blöcke ab "### <id> — [STUFE]"; nächster "### "/"## "/"# " beendet den Block.
|
||||
const re = /^###\s+(\S+)\s+—\s+\[([^\]]+)\]\s*\n([\s\S]*?)(?=^#{1,3}\s|$(?![\s\S]))/gm;
|
||||
let m: RegExpExecArray | null;
|
||||
while ((m = re.exec(text)) !== null) {
|
||||
const reqId = m[1].trim();
|
||||
if (!/^\d+\.\d+\.\d+-/.test(reqId)) continue; // nur Anforderungs-IDs
|
||||
const stufe = m[2].trim();
|
||||
const block = m[3];
|
||||
const resources = field(block, "Ressourcen");
|
||||
const template = field(block, "Vorlage") || null;
|
||||
hints.push({
|
||||
reqId,
|
||||
control: reqId.split("-")[0],
|
||||
stufe,
|
||||
requirement: field(block, "Anforderung"),
|
||||
organisational: field(block, "Organisatorisch"),
|
||||
technical: field(block, "Technisch"),
|
||||
evidence: field(block, "Typische Nachweise"),
|
||||
template,
|
||||
resources,
|
||||
alFilter: field(block, "AL-Filter"),
|
||||
procurement: isProcurement(resources),
|
||||
});
|
||||
}
|
||||
return hints;
|
||||
}
|
||||
|
||||
/** Liest C6 und schreibt die Hinweise (Upsert je reqId). Liefert die Anzahl. */
|
||||
export async function importImplementationHints(prisma: PrismaClient): Promise<number> {
|
||||
const text = readFileSync(C6_PATH, "utf-8");
|
||||
const hints = parseC6Hints(text);
|
||||
for (const h of hints) {
|
||||
await prisma.implementationHint.upsert({
|
||||
where: { reqId: h.reqId },
|
||||
update: { control: h.control, stufe: h.stufe, requirement: h.requirement, organisational: h.organisational, technical: h.technical, evidence: h.evidence, template: h.template, resources: h.resources, alFilter: h.alFilter, procurement: h.procurement },
|
||||
create: h,
|
||||
});
|
||||
}
|
||||
return hints.length;
|
||||
}
|
||||
@@ -1,222 +0,0 @@
|
||||
import type { PrismaClient } from "@prisma/client";
|
||||
|
||||
/**
|
||||
* Seed der verwalteten Register-Tabellen (§7b) und des Anwender-Handbuchs (§9.7).
|
||||
* Defaults aus den Auftraggeber-Vorgaben FB-80-04 (Risikomatrix) und
|
||||
* AA-80-20 (Klassifizierung/Handhabung). Idempotent pro Mandant.
|
||||
*/
|
||||
|
||||
const NOW = "2026-07-07T00:00:00.000Z";
|
||||
const daysFrom = (base: string, d: number) => new Date(new Date(base).getTime() + d * 86400000);
|
||||
|
||||
// Klassifizierungs-Handhabungsmatrix (AA-80-20) — Reihenfolge: Offen · Intern · Vertraulich · Streng vertraulich
|
||||
const CLASSES = [
|
||||
{ name: "Offen", description: "Öffentlich; keine Schutzanforderungen." },
|
||||
{ name: "Intern", description: "Nur für Mitarbeitende; geringer Schutzbedarf." },
|
||||
{ name: "Vertraulich", description: "Begrenzter Personenkreis; hoher Schutzbedarf." },
|
||||
{ name: "Streng vertraulich", description: "Namentlich Berechtigte; sehr hoher Schutzbedarf." },
|
||||
];
|
||||
|
||||
// [Offen, Intern, Vertraulich, Streng vertraulich]
|
||||
const ASPECTS: { name: string; category: string; rules: [string, string, string, string] }[] = [
|
||||
{ name: "Kennzeichnung (Papier/elektronisch)", category: "Kennzeichnung", rules: ["nicht nötig", "„Intern“ empfohlen", "„Vertraulich“ verpflichtend", "„Streng vertraulich“ + Bearbeiter"] },
|
||||
{ name: "Vervielfältigung", category: "Handhabung", rules: ["frei", "im Bedarfsfall", "nur mit Freigabe", "nur mit Freigabe, protokolliert"] },
|
||||
{ name: "Weitergabe intern", category: "Weitergabe", rules: ["frei", "an Mitarbeitende", "an Berechtigte, need-to-know", "namentlich Berechtigte, dokumentiert"] },
|
||||
{ name: "Postweg / Versand", category: "Weitergabe", rules: ["Standard", "Standard", "verschlossen, persönlich/Einschreiben", "Einschreiben eigenhändig, Empfangsbestätigung"] },
|
||||
{ name: "E-Mail", category: "Weitergabe", rules: ["ohne Auflagen", "intern ohne Auflagen", "extern verschlüsselt (BL-CRY-04)", "immer verschlüsselt, nur an Berechtigte"] },
|
||||
{ name: "Fax intern/extern", category: "Weitergabe", rules: ["zulässig", "zulässig", "nur mit Ankündigung/Abholung", "unzulässig"] },
|
||||
{ name: "Mobile Datenträger", category: "Speicherung", rules: ["zulässig", "nur freigegebene", "nur verschlüsselt (BL-CRY-03)", "nur verschlüsselt, freigegeben, protokolliert"] },
|
||||
{ name: "Internet / Blogs / Social Media", category: "Weitergabe", rules: ["zulässig", "kein interner Bezug", "unzulässig", "unzulässig"] },
|
||||
{ name: "Entsorgung Papier", category: "Entsorgung", rules: ["Altpapier", "Datentonne", "Aktenvernichter ≥ P-4", "Aktenvernichter ≥ P-5, protokolliert"] },
|
||||
{ name: "Löschung elektronisch / Hardware", category: "Entsorgung", rules: ["normal löschen", "normal löschen", "sicheres Löschen (BL-DEL-01)", "sicheres Löschen/Vernichten, Nachweis"] },
|
||||
{ name: "Speicherung (IT-Systeme)", category: "Speicherung", rules: ["beliebig", "interne Systeme", "zugriffsbeschränkte Ablagen", "verschlüsselt, streng zugriffsbeschränkt"] },
|
||||
{ name: "Homeoffice / mobiles Arbeiten", category: "Nutzung", rules: ["zulässig", "zulässig", "nur mit Sichtschutz, gesperrt bei Abwesenheit", "nur nach Freigabe, keine Papierform"] },
|
||||
{ name: "Öffentlicher Bereich / Dienstreise", category: "Nutzung", rules: ["zulässig", "diskret", "Sichtschutz, nicht unbeaufsichtigt", "unzulässig (kritische Länder)"] },
|
||||
{ name: "Verbale Weitergabe", category: "Weitergabe", rules: ["frei", "unter Kollegen", "nur in geschützter Umgebung", "nur namentlich Berechtigte, abhörsicher"] },
|
||||
];
|
||||
|
||||
// Risiko-Bewertungsmatrix (FB-80-04): Schadensausmaß(1–4) × EW(1–4) = 1–16
|
||||
const RISK_CLASSES = [
|
||||
{ name: "Niedrig", maxScore: 3, acceptance: "wird akzeptiert", tone: "ok" },
|
||||
{ name: "Mittel", maxScore: 6, acceptance: "Maßnahmen; Akzeptanz durch Risk Owner", tone: "warn" },
|
||||
{ name: "Hoch", maxScore: 9, acceptance: "Akzeptanz durch Risikomanagement-Gremium", tone: "orange" },
|
||||
{ name: "Kritisch", maxScore: 16, acceptance: "Akzeptanz durch Geschäftsführung", tone: "risk" },
|
||||
];
|
||||
const EW_LEVELS = [
|
||||
{ level: 1, label: "Unwahrscheinlich", definition: "Ereignis in absehbarer Zeit kaum zu erwarten (seltener als alle 5 Jahre)." },
|
||||
{ level: 2, label: "Gelegentlich", definition: "Ereignis denkbar, aber nicht häufig (ca. alle 1–5 Jahre)." },
|
||||
{ level: 3, label: "Wahrscheinlich", definition: "Ereignis tritt voraussichtlich ein (mehrmals pro Jahr)." },
|
||||
{ level: 4, label: "Sehr wahrscheinlich", definition: "Ereignis tritt regelmäßig/häufig ein (monatlich oder öfter)." },
|
||||
{ level: 5, label: "Nahezu sicher", definition: "Ereignis ist praktisch dauerhaft gegeben oder tritt ständig ein." },
|
||||
];
|
||||
const DAMAGE_DIMS: { name: string; levels: Record<string, string> }[] = [
|
||||
{ name: "Gesetzes-/Vertragsverstöße", levels: { "1": "unerheblich", "2": "geringfügige Verstöße", "3": "erhebliche Verstöße/Bußgelder", "4": "gravierende Rechtsfolgen/Straftatbestand", "5": "existenzbedrohende Rechtsfolgen (Lizenzentzug/Haftung)" } },
|
||||
{ name: "Datenschutz", levels: { "1": "kein Personenbezug", "2": "geringe Betroffenheit", "3": "sensible Daten betroffen", "4": "massenhaft sensible Daten / hohe Betroffenheit", "5": "besonders schützenswerte Daten in großem Umfang / existenzielle Betroffenheit" } },
|
||||
{ name: "Persönliche Unversehrtheit", levels: { "1": "keine", "2": "leichte Beeinträchtigung", "3": "Gesundheitsgefahr", "4": "Gefahr für Leib und Leben", "5": "Lebensgefahr für viele / Todesfolge" } },
|
||||
{ name: "Aufgabenerfüllung", levels: { "1": "keine Einschränkung", "2": "geringe Einschränkung", "3": "erhebliche Einschränkung", "4": "Kernaufgaben nicht erfüllbar", "5": "vollständiger, dauerhafter Ausfall der Organisation" } },
|
||||
{ name: "Innen-/Außenwirkung (Reputation)", levels: { "1": "keine", "2": "intern begrenzt", "3": "öffentlich wahrnehmbar", "4": "nachhaltiger Reputationsschaden", "5": "existenzbedrohender, dauerhafter Reputationsverlust" } },
|
||||
{ name: "Störungs-/Ausfallzeit", levels: { "1": "< 1 Std.", "2": "bis 1 Tag", "3": "bis 1 Woche", "4": "> 1 Woche", "5": "> 1 Monat / dauerhaft" } },
|
||||
{ name: "Finanzielle Auswirkungen", levels: { "1": "bis 10 T€", "2": "bis 50 T€", "3": "bis 200 T€", "4": "über 500 T€", "5": "existenzbedrohend (> 1 Mio €)" } },
|
||||
];
|
||||
|
||||
// Krypto-Register (VA-07) — Demo-Datensätze inkl. Ablaufüberwachung
|
||||
const CRYPTO = [
|
||||
{ dienst: "TLS Web-Portal (portal.gefim.example)", schluessel: "RSA 3072 · Let's Encrypt", algorithmus: "TLS 1.3 / AES-256", ablaufOffset: 45, verantwortlich: "IT-Leitung", speicherort: "Reverse Proxy", baselineRef: "BL-CRY-01" },
|
||||
{ dienst: "VPN-Gateway", schluessel: "ECDSA P-256 · interne CA", algorithmus: "IKEv2 / AES-256-GCM", ablaufOffset: 12, verantwortlich: "IT-Leitung", speicherort: "Firewall/HSM", baselineRef: "BL-CRY-02" },
|
||||
{ dienst: "Festplattenverschlüsselung Notebooks", schluessel: "BitLocker · TPM 2.0", algorithmus: "AES-256-XTS", ablaufOffset: null, verantwortlich: "IT-Betrieb", speicherort: "MDM-Recovery", baselineRef: "BL-CRY-03" },
|
||||
{ dienst: "S/MIME Zertifikate Geschäftsführung", schluessel: "RSA 2048 · öffentliche CA", algorithmus: "S/MIME", ablaufOffset: -8, verantwortlich: "IT-Leitung", speicherort: "Smartcard", baselineRef: "BL-CRY-04" },
|
||||
];
|
||||
|
||||
// Anwender-Handbuch (§9.7) — kuratierte Themen, Werte via {{VARIABLE}} synchron zur Baseline
|
||||
const HANDBOOK: { category: string; title: string; bodyMd: string; sourceRefs: string[] }[] = [
|
||||
{
|
||||
category: "Zugang & Passwörter", title: "Passwörter & Mehr-Faktor-Anmeldung",
|
||||
bodyMd: "**Das Wichtigste kurz:**\n\n- Nutze Passwörter mit **mindestens {{PW_MIN_LENGTH}} Zeichen** ({{PW_COMPLEXITY}}).\n- Aktiviere **Mehr-Faktor-Authentifizierung (MFA)** über {{TECH_MFA}} für {{MFA_SCOPE}}.\n- Gib Passwörter **nie** weiter und nutze für jeden Dienst ein eigenes.\n- Bei Verdacht auf Kompromittierung: Passwort sofort ändern und melden.",
|
||||
sourceRefs: ["R08#4.1.2"],
|
||||
},
|
||||
{
|
||||
category: "Zugang & Passwörter", title: "Zugriffsrechte – nur was du brauchst",
|
||||
bodyMd: "- Zugriff erhältst du **nach dem Minimalprinzip** (need-to-know) über {{TOOL_TICKET}}.\n- Nicht mehr benötigte Rechte werden entzogen; deine Rechte werden regelmäßig **überprüft (Rezertifizierung, {{RECERT_FREQ}})**.\n- Sperre deinen Bildschirm bei jedem Verlassen des Arbeitsplatzes.",
|
||||
sourceRefs: ["R08#4.2.1"],
|
||||
},
|
||||
{
|
||||
category: "Umgang mit Informationen", title: "Daten richtig klassifizieren & handhaben",
|
||||
bodyMd: "- Behandle Informationen gemäß ihrer **Schutzklasse** (Offen · Intern · Vertraulich · Streng vertraulich).\n- **Vertrauliche** Inhalte extern nur **verschlüsselt** versenden.\n- Dokumente nicht offen liegen lassen (Clean Desk); vertrauliche Ausdrucke sicher vernichten.",
|
||||
sourceRefs: ["R02"],
|
||||
},
|
||||
{
|
||||
category: "Sicheres Arbeiten", title: "Mobiles Arbeiten & Homeoffice",
|
||||
bodyMd: "- Nutze nur **freigegebene Geräte** (verwaltet über {{TECH_MDM}}).\n- Achte auf **Sichtschutz** in der Öffentlichkeit; keine vertraulichen Gespräche in Bahn/Café.\n- Verbinde dich extern nur über {{TECH_VPN}} mit MFA.",
|
||||
sourceRefs: ["R06"],
|
||||
},
|
||||
{
|
||||
category: "Sicheres Arbeiten", title: "E-Mail, Internet & Schadsoftware",
|
||||
bodyMd: "- Öffne **keine unerwarteten Anhänge/Links**; im Zweifel nachfragen.\n- Melde verdächtige E-Mails (Phishing) über den Meldeweg.\n- {{TECH_MALWARE}} schützt deine Geräte – deaktiviere den Schutz nie.",
|
||||
sourceRefs: ["R10", "R09"],
|
||||
},
|
||||
{
|
||||
category: "Vorfälle", title: "Sicherheitsvorfall? So meldest du ihn",
|
||||
bodyMd: "**Sofort melden** bei Verdacht auf Vorfall, Datenverlust oder verlorenem Gerät:\n\n- an die {{ROLE_ISB}} bzw. den definierten Meldeweg.\n- Lieber einmal zu viel melden – schnelle Meldung begrenzt den Schaden.\n- Nichts vertuschen, nichts eigenmächtig „reparieren“.",
|
||||
sourceRefs: ["R04"],
|
||||
},
|
||||
];
|
||||
|
||||
/** Generische verwaltete Register (WP3.0): Code, Titel, Pflichtspalten, Cross-Links. */
|
||||
const GENERIC_REGISTERS: {
|
||||
code: string; title: string; description: string; orderIdx: number;
|
||||
columns: { key: string; label: string }[]; supplierLink?: boolean; assetLink?: boolean;
|
||||
}[] = [
|
||||
{ code: "REG-PROJECTS", title: "Register Informationssicherheit in Projekten", orderIdx: 905,
|
||||
description: "Projekte mit IS-Klassifizierung, Risikobewertung, Maßnahmen und ISB-Einbindung (R01 / VA-19).",
|
||||
columns: [{ key: "projekt", label: "Projekt" }, { key: "klassifizierung", label: "IS-Klassifizierung" }, { key: "risiko", label: "Risikobewertung" }, { key: "massnahmen", label: "Maßnahmen/Status" }, { key: "isb", label: "ISB-Einbindung" }] },
|
||||
{ code: "REG-SENS-ROLES", title: "Register sensibler Tätigkeiten", orderIdx: 906,
|
||||
description: "Sensible Tätigkeitsbereiche/Rollen mit Eignungsnachweisen und Prüftiefe (R05 / VA-14).",
|
||||
columns: [{ key: "rolle", label: "Rolle/Bereich" }, { key: "nachweise", label: "Geforderte Eignungsnachweise" }, { key: "prueftiefe", label: "Prüftiefe" }, { key: "verantwortlich", label: "Verantwortlich" }, { key: "review", label: "Review" }] },
|
||||
{ code: "REG-AUDIT-PLAN", title: "Audit-Programm-Register", orderIdx: 907,
|
||||
description: "Auditprogramm mit Zeitplan, Umfang, geprüften Controls, Prüfern und Ergebnissen (R03 / VA-15).",
|
||||
columns: [{ key: "zeitplan", label: "Zeitplan" }, { key: "umfang", label: "Umfang" }, { key: "controls", label: "Geprüfte Controls" }, { key: "pruefer", label: "Prüfer" }, { key: "ergebnisse", label: "Ergebnisse" }] },
|
||||
// REG-NET bleibt ein leichtgewichtiges Register: der Netzplan ist ein extern gepflegtes
|
||||
// Dokument, daher nur Referenz/Speicherort statt Tabelleninhalt (Datei-Upload folgt separat).
|
||||
{ code: "REG-NET", title: "Netz-/Netzdienste-Register", orderIdx: 911,
|
||||
description: "Verweis auf den (extern gepflegten) Netzplan sowie Netzdienste/Zonen und Review-Turnus (R09 5.1.2 / R10 5.2.7 / VA-07).",
|
||||
columns: [{ key: "netzplan", label: "Netzplan (Speicherort/Referenz)" }, { key: "netzdienst", label: "Netzdienst" }, { key: "zone", label: "Zone" }, { key: "review", label: "Review" }] },
|
||||
];
|
||||
|
||||
// GAP-Konsolidierung: Diese Register wurden in die Fachmodule überführt und werden
|
||||
// daher stillgelegt (Dokument + ManagedRegister + Zeilen entfernt). Die zugehörigen
|
||||
// {{LINK:…}} zeigen jetzt auf die Module (siehe resolveLink):
|
||||
// REG-EXT-SERVICES → Lieferanten/IT-Services · REG-SW-WHITELIST → Lieferanten/Software
|
||||
// REG-CRIT-SERVICES → Assets (kritische Dienste) · REG-PROJECTS → Assets (Projekte)
|
||||
const RETIRED_REGISTERS = ["REG-EXT-SERVICES", "REG-SW-WHITELIST", "REG-CRIT-SERVICES", "REG-PROJECTS"];
|
||||
|
||||
export async function importManaged(prisma: PrismaClient, tenantId: string) {
|
||||
// Idempotent: alte Datensätze pro Mandant entfernen
|
||||
await prisma.handlingRule.deleteMany({ where: { tenantId } });
|
||||
await prisma.handlingAspect.deleteMany({ where: { tenantId } });
|
||||
await prisma.classificationClass.deleteMany({ where: { tenantId } });
|
||||
await prisma.cryptoEntry.deleteMany({ where: { tenantId } });
|
||||
await prisma.riskMatrixClass.deleteMany({ where: { tenantId } });
|
||||
await prisma.riskEwLevel.deleteMany({ where: { tenantId } });
|
||||
await prisma.riskDamageDimension.deleteMany({ where: { tenantId } });
|
||||
await prisma.handbookTopic.deleteMany({ where: { tenantId } });
|
||||
|
||||
// Register-/Handbuch-Dokumente in der Bibliothek (interaktiv gerendert)
|
||||
const registerDocs = [
|
||||
{ code: "CRYPTO", type: "REGISTER" as const, title: "Verschlüsselungsmechanismen-Register", orderIdx: 902, intro: "Verwaltetes Register der eingesetzten Verschlüsselung (VA-07). Ablaufüberwachung aktiv." },
|
||||
{ code: "RISKMATRIX", type: "REGISTER" as const, title: "Risiko-Bewertungsmatrix", orderIdx: 903, intro: "Zentrale Bewertungsmatrix Schadensausmaß × Eintrittswahrscheinlichkeit (R03 / VA-09), Defaults nach FB-80-04." },
|
||||
{ code: "CLASSIFICATION", type: "REGISTER" as const, title: "Klassifizierung & Handhabungsmatrix", orderIdx: 904, intro: "Schutzklassen und Handhabungsregeln (R02 / VA-08), Defaults nach AA-80-20." },
|
||||
{ code: "HANDBUCH", type: "HANDBUCH" as const, title: "Anwender-Handbuch Informationssicherheit", orderIdx: 950, intro: "Kompakte Zusammenfassung der wichtigsten Regeln für Mitarbeitende – mit Deep-Links in die Quelldokumente." },
|
||||
];
|
||||
for (const d of registerDocs) {
|
||||
await prisma.policyDocument.upsert({
|
||||
where: { tenantId_code: { tenantId, code: d.code } },
|
||||
update: { title: d.title, type: d.type, orderIdx: d.orderIdx, rawMarkdown: `# ${d.title}\n\n${d.intro}` },
|
||||
create: { tenantId, code: d.code, type: d.type, title: d.title, version: "1.0", status: "FREIGEGEBEN", orderIdx: d.orderIdx, rawMarkdown: `# ${d.title}\n\n${d.intro}` },
|
||||
});
|
||||
}
|
||||
|
||||
// Generische verwaltete Register (GAP-Report WP3.0 / §5.2): Dokument (Bibliothek/Link)
|
||||
// + editierbare ManagedRegister-Definition mit Pflichtspalten + Cross-Links. Zeilen
|
||||
// (RegisterRow) bleiben bei Re-Import erhalten (nicht-destruktiv).
|
||||
for (const g of GENERIC_REGISTERS) {
|
||||
const intro = `${g.description} Pflichtspalten: ${g.columns.map((c) => c.label).join(", ")}.`;
|
||||
await prisma.policyDocument.upsert({
|
||||
where: { tenantId_code: { tenantId, code: g.code } },
|
||||
update: { title: g.title, type: "REGISTER", orderIdx: g.orderIdx, rawMarkdown: `# ${g.title}\n\n${intro}` },
|
||||
create: { tenantId, code: g.code, type: "REGISTER", title: g.title, version: "1.0", status: "FREIGEGEBEN", orderIdx: g.orderIdx, rawMarkdown: `# ${g.title}\n\n${intro}` },
|
||||
});
|
||||
await prisma.managedRegister.upsert({
|
||||
where: { tenantId_code: { tenantId, code: g.code } },
|
||||
update: { title: g.title, description: g.description, columns: g.columns, supplierLink: g.supplierLink ?? false, assetLink: g.assetLink ?? false },
|
||||
create: { tenantId, code: g.code, title: g.title, description: g.description, columns: g.columns, supplierLink: g.supplierLink ?? false, assetLink: g.assetLink ?? false },
|
||||
});
|
||||
}
|
||||
|
||||
// Stillgelegte Register entfernen (in Fachmodule überführt). RegisterRow hängt per
|
||||
// Cascade an ManagedRegister; das Bibliotheks-Dokument wird ebenfalls entfernt.
|
||||
await prisma.managedRegister.deleteMany({ where: { tenantId, code: { in: RETIRED_REGISTERS } } });
|
||||
await prisma.policyDocument.deleteMany({ where: { tenantId, code: { in: RETIRED_REGISTERS } } });
|
||||
|
||||
// Krypto-Register
|
||||
for (let i = 0; i < CRYPTO.length; i++) {
|
||||
const c = CRYPTO[i];
|
||||
await prisma.cryptoEntry.create({
|
||||
data: {
|
||||
tenantId, dienst: c.dienst, schluessel: c.schluessel, algorithmus: c.algorithmus,
|
||||
ablaufdatum: c.ablaufOffset === null ? null : daysFrom(NOW, c.ablaufOffset),
|
||||
verantwortlich: c.verantwortlich, speicherort: c.speicherort, baselineRef: c.baselineRef, orderIdx: i,
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
// Klassifizierung + Handhabungsmatrix
|
||||
const classIds: string[] = [];
|
||||
for (let i = 0; i < CLASSES.length; i++) {
|
||||
const cl = await prisma.classificationClass.create({ data: { tenantId, name: CLASSES[i].name, description: CLASSES[i].description, orderIdx: i } });
|
||||
classIds.push(cl.id);
|
||||
}
|
||||
for (let a = 0; a < ASPECTS.length; a++) {
|
||||
const asp = await prisma.handlingAspect.create({ data: { tenantId, name: ASPECTS[a].name, category: ASPECTS[a].category, orderIdx: a } });
|
||||
for (let c = 0; c < classIds.length; c++) {
|
||||
await prisma.handlingRule.create({ data: { tenantId, classId: classIds[c], aspectId: asp.id, text: ASPECTS[a].rules[c] } });
|
||||
}
|
||||
}
|
||||
|
||||
// Risiko-Bewertungsmatrix
|
||||
for (let i = 0; i < RISK_CLASSES.length; i++) {
|
||||
const r = RISK_CLASSES[i];
|
||||
await prisma.riskMatrixClass.create({ data: { tenantId, name: r.name, maxScore: r.maxScore, acceptance: r.acceptance, tone: r.tone, orderIdx: i } });
|
||||
}
|
||||
for (const ew of EW_LEVELS) await prisma.riskEwLevel.create({ data: { tenantId, level: ew.level, label: ew.label, definition: ew.definition } });
|
||||
for (let i = 0; i < DAMAGE_DIMS.length; i++) {
|
||||
await prisma.riskDamageDimension.create({ data: { tenantId, name: DAMAGE_DIMS[i].name, levels: DAMAGE_DIMS[i].levels, orderIdx: i } });
|
||||
}
|
||||
|
||||
// Anwender-Handbuch
|
||||
for (let i = 0; i < HANDBOOK.length; i++) {
|
||||
const h = HANDBOOK[i];
|
||||
await prisma.handbookTopic.create({ data: { tenantId, category: h.category, title: h.title, bodyMd: h.bodyMd, sourceRefs: h.sourceRefs, orderIdx: i } });
|
||||
}
|
||||
|
||||
return { crypto: CRYPTO.length, classes: CLASSES.length, aspects: ASPECTS.length, damage: DAMAGE_DIMS.length, handbook: HANDBOOK.length };
|
||||
}
|
||||
@@ -1,521 +0,0 @@
|
||||
import { readFileSync, readdirSync } from "node:fs";
|
||||
import { join } from "node:path";
|
||||
import type { PrismaClient, Framework } from "@prisma/client";
|
||||
|
||||
/**
|
||||
* Mapping-Datei je Framework (AP1). Beide Frameworks teilen sich denselben
|
||||
* Dokumentensatz (richtlinien/, verfahren/, Baseline, Nachweisregister); nur die
|
||||
* Anforderungs-Zuordnung unterscheidet sich → nur der Mapping-Dateiname wechselt
|
||||
* (Variante A). Default TISAX, damit Bestandsaufrufer unverändert bleiben.
|
||||
*/
|
||||
export function mappingFileFor(framework: Framework = "TISAX"): string {
|
||||
return framework === "ISO_27001" ? "mapping-iso.json" : "mapping.json";
|
||||
}
|
||||
|
||||
/** Kanonische Version des Vorlagenpakets (mapping meta.version) — Story B6. */
|
||||
export function readPackageVersion(seedDir: string, mappingFile = "mapping.json"): string {
|
||||
const mapping = JSON.parse(readFileSync(join(seedDir, mappingFile), "utf-8")) as { meta?: { version?: string } };
|
||||
return mapping.meta?.version ?? "unknown";
|
||||
}
|
||||
|
||||
/** Übernommene Paket-Version je Mandant/Framework stempeln (Story B6) — nach jedem Apply. */
|
||||
export async function stampPackageState(
|
||||
prisma: PrismaClient,
|
||||
tenantId: string,
|
||||
seedDir: string,
|
||||
framework: Framework = "TISAX",
|
||||
): Promise<void> {
|
||||
await stampPackageVersion(prisma, tenantId, readPackageVersion(seedDir, mappingFileFor(framework)), framework);
|
||||
}
|
||||
|
||||
/** Wie stampPackageState, aber mit direkt übergebener Version (DB-Vorlagen-Quelle). */
|
||||
export async function stampPackageVersion(
|
||||
prisma: PrismaClient,
|
||||
tenantId: string,
|
||||
version: string,
|
||||
framework: Framework = "TISAX",
|
||||
): Promise<void> {
|
||||
await prisma.policyPackageState.upsert({
|
||||
where: { tenantId_framework: { tenantId, framework } },
|
||||
update: { importedVersion: version, importedAt: new Date() },
|
||||
create: { tenantId, framework, importedVersion: version, importedAt: new Date() },
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Importer für das VDA-ISA-2027-Vorlagenpaket (§6 der Spezifikation).
|
||||
*
|
||||
* Das Modul ist in zwei Schritte getrennt:
|
||||
* 1. `parsePackageFiles(seedDir)` — liest die echten .md-Dateien, mapping.json,
|
||||
* variables.schema.json, Technische-Sicherheits-Baseline.md und
|
||||
* Nachweisregister_zentral.md in ein neutrales `ParsedPackage`.
|
||||
* 2. `reconcilePackage(prisma, tenantId, pkg)` — schreibt ein `ParsedPackage`
|
||||
* **nicht-destruktiv** in die Mandanten-Tabellen (Diff/Upsert).
|
||||
* Dieselbe `ParsedPackage`-Struktur kommt auch aus der globalen DB-Vorlagenablage
|
||||
* (template-store.ts), sodass der Reconcile-Import identisch für Datei- UND
|
||||
* DB-Quelle funktioniert.
|
||||
*
|
||||
* **Nicht-destruktiver Re-Import (Phase-1-Härtung Paket 3):** Abgleich über stabile
|
||||
* Schlüssel (Dokument-`code`, Anforderungs-`reqId`, Variablen-`key`, Baseline-`blId`,
|
||||
* Nachweis-`nr`) per Diff/Upsert statt Löschen+Neuanlegen.
|
||||
* - Neu im Paket ⇒ anlegen.
|
||||
* - Weiterhin vorhanden ⇒ Inhalt aktualisieren, aber per-Dokument-Status,
|
||||
* TISAX-Override, Freigabe-/Versionsstand und Verknüpfungen (Coverage/Nachweise)
|
||||
* sowie **nutzergepflegte Variablenwerte** erhalten.
|
||||
* - Nicht mehr im Paket ⇒ **deaktivieren** (`archivedAt` setzen), nicht löschen.
|
||||
* Jeder Lauf liefert einen Änderungsreport (added/updated/archived/reactivated) und
|
||||
* protokolliert ihn im Audit-Log. `dryRun` erzeugt den Report ohne Schreibzugriffe
|
||||
* (Vorschau). Idempotent: erneuter Lauf ohne Änderungen ⇒ nur „unchanged".
|
||||
*/
|
||||
|
||||
type DocType = "LEITLINIE" | "RICHTLINIE" | "VERFAHREN" | "REGISTER";
|
||||
|
||||
const arraysEqual = (a: string[], b: string[]) => a.length === b.length && a.every((v, i) => v === b[i]);
|
||||
|
||||
// ── Neutrale Paket-Struktur (Quelle: Dateien ODER globale DB-Vorlagenablage) ──────
|
||||
export interface ParsedDoc {
|
||||
code: string;
|
||||
type: DocType;
|
||||
title: string;
|
||||
policyCode: string | null;
|
||||
fulfills: string[];
|
||||
rawMarkdown: string;
|
||||
orderIdx: number;
|
||||
}
|
||||
export interface ParsedRequirement {
|
||||
reqId: string;
|
||||
policyCode: string;
|
||||
control: string;
|
||||
obligation: string;
|
||||
condition: string | null;
|
||||
requirement: string;
|
||||
implementation: string;
|
||||
vaCodes: string[];
|
||||
nachweisLink: string | null;
|
||||
}
|
||||
export interface ParsedVariable {
|
||||
key: string;
|
||||
title: string;
|
||||
kind: string;
|
||||
groupName: string | null;
|
||||
value: string;
|
||||
required: boolean;
|
||||
orderIdx: number;
|
||||
}
|
||||
export interface ParsedBaselineParam {
|
||||
blId: string;
|
||||
section: string;
|
||||
name: string;
|
||||
vorgabe: string;
|
||||
orderIdx: number;
|
||||
}
|
||||
export interface ParsedEvidence {
|
||||
nr: number;
|
||||
policyCode: string;
|
||||
nachweis: string;
|
||||
quelle: string;
|
||||
verantwortlich: string;
|
||||
turnus: string;
|
||||
}
|
||||
export interface ParsedPackage {
|
||||
version: string;
|
||||
documents: ParsedDoc[];
|
||||
requirements: ParsedRequirement[];
|
||||
variables: ParsedVariable[];
|
||||
baseline: ParsedBaselineParam[];
|
||||
evidence: ParsedEvidence[];
|
||||
}
|
||||
|
||||
/**
|
||||
* Namensraum der Dokumente, die DIESER Importer verwaltet (Leitlinie, Richtlinien,
|
||||
* Verfahren, Baseline-/Nachweisregister). Verwaltete Register aus import-managed.ts
|
||||
* (CRYPTO, RISKMATRIX, CLASSIFICATION, HANDBUCH, …) gehören NICHT dazu und dürfen beim
|
||||
* Re-Import nicht deaktiviert werden.
|
||||
*/
|
||||
const isPackageDoc = (code: string) =>
|
||||
code === "L00" || code === "BASELINE" || code === "NACHWEIS" || /^R\d/.test(code) || /^VA-/.test(code);
|
||||
|
||||
function docCodeFromFile(file: string): string {
|
||||
return file.split("_")[0]; // "R08_….md" → "R08", "VA-03_….md" → "VA-03"
|
||||
}
|
||||
function titleOf(md: string): string {
|
||||
const m = md.match(/^#\s+(.+?)\s*$/m);
|
||||
return m ? m[1].trim() : "(ohne Titel)";
|
||||
}
|
||||
/** Umsetzungstext je Anforderung aus den `<!-- IMPL id -->`-Ankern extrahieren. */
|
||||
function extractImpls(raw: string, into: Map<string, string>) {
|
||||
const lines = raw.split("\n");
|
||||
for (let i = 0; i < lines.length; i++) {
|
||||
const m = lines[i].match(/^<!--\s*IMPL\s+(\S+)\s*-->/);
|
||||
if (!m) continue;
|
||||
const buf: string[] = [];
|
||||
for (let j = i + 1; j < lines.length; j++) {
|
||||
const l = lines[j];
|
||||
const tr = l.trim();
|
||||
if (tr === "" || tr.startsWith("<!--") || tr.startsWith("{{#") || tr.startsWith("{{/") || /^#{1,6}\s/.test(tr) || tr.startsWith("**") || tr.startsWith("- ") || tr.startsWith("|")) break;
|
||||
buf.push(l);
|
||||
}
|
||||
if (buf.length) into.set(m[1], buf.join(" ").trim());
|
||||
}
|
||||
}
|
||||
|
||||
function varGroup(key: string): string {
|
||||
if (key.startsWith("FLAG_")) return "Feature-Flags";
|
||||
if (key.startsWith("ORG_") || key.startsWith("ISMS_")) return "Organisation";
|
||||
if (key.startsWith("ROLE_")) return "Rollen";
|
||||
if (key.startsWith("DOC_")) return "Metadaten";
|
||||
if (key.startsWith("TECH_") || key.startsWith("TOOL_")) return "Technik/Werkzeuge";
|
||||
if (/^(PW_|MFA_|SESSION_|ACCOUNT_|RECERT_)/.test(key)) return "IAM-Baseline";
|
||||
if (key.startsWith("TLS_") || key.startsWith("CRYPTO_")) return "Krypto-Baseline";
|
||||
if (/^(PATCH_|VULN_|MALWARE_|LOG_|BACKUP_|PENTEST_)/.test(key)) return "Betriebs-Baseline";
|
||||
return "Sonstige";
|
||||
}
|
||||
|
||||
interface SchemaProp {
|
||||
type?: string;
|
||||
title?: string;
|
||||
default?: string | boolean;
|
||||
example?: string;
|
||||
}
|
||||
|
||||
export interface ImportReport {
|
||||
documents: { added: number; updated: number; archived: number; reactivated: number; unchanged: number };
|
||||
requirements: { added: number; updated: number; archived: number; reactivated: number; unchanged: number };
|
||||
variables: { added: number; updated: number; unchanged: number; obsolete: number };
|
||||
baseline: { added: number; updated: number; unchanged: number; obsolete: number };
|
||||
evidence: { added: number; updated: number; unchanged: number; obsolete: number };
|
||||
}
|
||||
|
||||
export interface ImportOptions {
|
||||
/** true = nur Report berechnen, keine Schreibzugriffe (Vorschau). */
|
||||
dryRun?: boolean;
|
||||
/** Akteur für den Audit-Eintrag (z. B. Plattform-/Mandanten-Admin). */
|
||||
actorId?: string | null;
|
||||
/**
|
||||
* Namensraum der abzugleichenden Anforderungen (AP1). Der Archivierungslauf und die
|
||||
* Anlage laufen NUR innerhalb dieses Frameworks — ein ISO-Import archiviert damit
|
||||
* keine TISAX-Anforderungen (und umgekehrt, Falle 1.1). Default TISAX.
|
||||
*/
|
||||
framework?: Framework;
|
||||
/**
|
||||
* Geteilte Inhalte (Dokumente, Variablen, Baseline, Nachweisregister) mit abgleichen.
|
||||
* Diese sind für beide Frameworks identisch und dürfen je Mandant **einmal**
|
||||
* abgeglichen werden (Falle 1.1). Beim Import mehrerer Frameworks nur für das erste
|
||||
* `true` setzen. Default true (Einzel-Framework-Fall unverändert).
|
||||
*/
|
||||
reconcileShared?: boolean;
|
||||
}
|
||||
|
||||
/**
|
||||
* Liest das Datei-Vorlagenpaket in eine neutrale `ParsedPackage`-Struktur (kein DB-Zugriff).
|
||||
* Quelle für die einmalige Synchronisierung in die globale DB-Vorlagenablage und für den
|
||||
* Datei-Fallback des Mandanten-Imports.
|
||||
*/
|
||||
export function parsePackageFiles(seedDir: string, mappingFile = "mapping.json"): ParsedPackage {
|
||||
// ── 1. mapping-Datei → Anforderungen + FULFILLS-Rückwärtsmapping vorbereiten ──
|
||||
const mapping = JSON.parse(readFileSync(join(seedDir, mappingFile), "utf-8")) as {
|
||||
meta?: { version?: string };
|
||||
anforderungen: Array<{
|
||||
id: string; policy: string; control: string; type: string;
|
||||
condition: string | null; requirement: string; implementation?: string; nachweis_link?: string;
|
||||
/** Optional: „IMPL <key>" — Umsetzungsblock, aus dem der Text stammt (Control- statt Anforderungsebene). */
|
||||
impl_anchor?: string;
|
||||
}>;
|
||||
};
|
||||
const version = mapping.meta?.version ?? "unknown";
|
||||
|
||||
// ── 2. Dokumente einlesen (Richtlinien + Verfahren) ──────────────────────
|
||||
const reqToVas = new Map<string, Set<string>>();
|
||||
const implMap = new Map<string, string>(); // Umsetzungstext je Anforderung aus den IMPL-Ankern
|
||||
const documents: ParsedDoc[] = [];
|
||||
|
||||
const richtDir = join(seedDir, "richtlinien");
|
||||
for (const file of readdirSync(richtDir).filter((f) => f.endsWith(".md")).sort()) {
|
||||
const raw = readFileSync(join(richtDir, file), "utf-8");
|
||||
const code = docCodeFromFile(file);
|
||||
const type: DocType = code === "L00" ? "LEITLINIE" : "RICHTLINIE";
|
||||
const orderIdx = code === "L00" ? 0 : parseInt(code.replace(/\D/g, ""), 10);
|
||||
extractImpls(raw, implMap);
|
||||
documents.push({ code, type, title: titleOf(raw), policyCode: null, fulfills: [], rawMarkdown: raw, orderIdx });
|
||||
}
|
||||
|
||||
const verfDir = join(seedDir, "verfahren");
|
||||
for (const file of readdirSync(verfDir).filter((f) => f.endsWith(".md")).sort()) {
|
||||
const raw = readFileSync(join(verfDir, file), "utf-8");
|
||||
const code = docCodeFromFile(file);
|
||||
const fh = raw.match(/<!--\s*FULFILLS\s+([^|]+?)\s*\|\s*POLICY\s+(\S+)\s*-->/);
|
||||
const fulfills = fh ? fh[1].split(",").map((s) => s.trim()).filter(Boolean) : [];
|
||||
const policyCode = fh ? fh[2].trim() : null;
|
||||
for (const req of fulfills) {
|
||||
if (!reqToVas.has(req)) reqToVas.set(req, new Set());
|
||||
reqToVas.get(req)!.add(code);
|
||||
}
|
||||
const orderIdx = 100 + parseInt(code.replace(/\D/g, ""), 10);
|
||||
documents.push({ code, type: "VERFAHREN", title: titleOf(raw), policyCode, fulfills, rawMarkdown: raw, orderIdx });
|
||||
}
|
||||
|
||||
// Register-Dokumente (Baseline + Nachweisregister) mitführen
|
||||
const baselineRaw = readFileSync(join(seedDir, "Technische-Sicherheits-Baseline.md"), "utf-8");
|
||||
const nachweisRaw = readFileSync(join(seedDir, "Nachweisregister_zentral.md"), "utf-8");
|
||||
documents.push({ code: "BASELINE", type: "REGISTER", title: titleOf(baselineRaw), policyCode: null, fulfills: [], rawMarkdown: baselineRaw, orderIdx: 900 });
|
||||
documents.push({ code: "NACHWEIS", type: "REGISTER", title: titleOf(nachweisRaw), policyCode: null, fulfills: [], rawMarkdown: nachweisRaw, orderIdx: 901 });
|
||||
|
||||
// ── 3. Anforderungen ─────────────────────────────────────────────────────
|
||||
// Umsetzungstext: bevorzugt über `impl_anchor` (Control-Ebene, z. B. „IMPL 4.1.2") auflösen —
|
||||
// die Anforderungs-IDs (4.1.2-M1) haben keinen eigenen IMPL-Block. Fällt zurück auf die
|
||||
// Anforderungs-ID und zuletzt auf ein im Mapping mitgeliefertes `implementation`-Feld.
|
||||
const implOf = (a: { id: string; impl_anchor?: string; implementation?: string }) =>
|
||||
implMap.get((a.impl_anchor ?? "").replace(/^IMPL\s+/, "")) ?? implMap.get(a.id) ?? a.implementation ?? "";
|
||||
|
||||
const requirements: ParsedRequirement[] = mapping.anforderungen.map((a) => ({
|
||||
reqId: a.id, policyCode: a.policy, control: a.control, obligation: a.type,
|
||||
condition: a.condition, requirement: a.requirement, implementation: implOf(a),
|
||||
vaCodes: [...(reqToVas.get(a.id) ?? [])].sort(), nachweisLink: a.nachweis_link ?? null,
|
||||
}));
|
||||
|
||||
// ── 4. Variablen + Feature-Flags ─────────────────────────────────────────
|
||||
const schema = JSON.parse(readFileSync(join(seedDir, "variables.schema.json"), "utf-8")) as {
|
||||
properties: Record<string, SchemaProp>; required?: string[];
|
||||
};
|
||||
const required = new Set(schema.required ?? []);
|
||||
const variables: ParsedVariable[] = Object.entries(schema.properties).map(([key, prop], i) => {
|
||||
const kind = prop.type === "boolean" ? "boolean" : "string";
|
||||
const value = prop.default !== undefined ? String(prop.default) : prop.example !== undefined ? String(prop.example) : kind === "boolean" ? "false" : "";
|
||||
return { key, title: prop.title ?? key, kind, groupName: varGroup(key), value, required: required.has(key), orderIdx: i };
|
||||
});
|
||||
|
||||
// ── 5. Baseline-Parameter ────────────────────────────────────────────────
|
||||
const baseline: ParsedBaselineParam[] = [];
|
||||
{
|
||||
let section = "";
|
||||
let bi = 0;
|
||||
for (const line of baselineRaw.split("\n")) {
|
||||
const h = line.match(/^##\s+(.+?)\s*$/);
|
||||
if (h) { section = h[1].trim(); continue; }
|
||||
const row = line.match(/^\|\s*(BL-[A-Z]+-\d+)\s*\|\s*(.+?)\s*\|\s*(.+?)\s*\|\s*$/);
|
||||
if (row) baseline.push({ blId: row[1], section, name: row[2].trim(), vorgabe: row[3].trim(), orderIdx: bi++ });
|
||||
}
|
||||
}
|
||||
|
||||
// ── 6. Nachweisregister ──────────────────────────────────────────────────
|
||||
const evidence: ParsedEvidence[] = [];
|
||||
for (const line of nachweisRaw.split("\n")) {
|
||||
const row = line.match(/^\|\s*(\d+)\s*\|\s*(.+?)\s*\|\s*(.+?)\s*\|\s*(.+?)\s*\|\s*(.+?)\s*\|\s*(.+?)\s*\|\s*$/);
|
||||
if (!row) continue;
|
||||
const policyMatch = row[2].match(/\{\{LINK:([^}]+)\}\}/);
|
||||
evidence.push({
|
||||
nr: parseInt(row[1], 10), policyCode: policyMatch ? policyMatch[1] : row[2].trim(),
|
||||
nachweis: row[3].trim(), quelle: row[4].trim(), verantwortlich: row[5].trim(), turnus: row[6].trim(),
|
||||
});
|
||||
}
|
||||
|
||||
return { version, documents, requirements, variables, baseline, evidence };
|
||||
}
|
||||
|
||||
/**
|
||||
* Schreibt ein `ParsedPackage` nicht-destruktiv in die Mandanten-Tabellen (Diff/Upsert).
|
||||
* Quelle-neutral: das Paket stammt aus den Dateien (`parsePackageFiles`) oder der globalen
|
||||
* DB-Vorlagenablage (`loadPublishedPackage`).
|
||||
*/
|
||||
export async function reconcilePackage(
|
||||
prisma: PrismaClient,
|
||||
tenantId: string,
|
||||
pkg: ParsedPackage,
|
||||
options: ImportOptions = {}
|
||||
) {
|
||||
const dryRun = options.dryRun ?? false;
|
||||
const framework: Framework = options.framework ?? "TISAX";
|
||||
// Geteilte Inhalte (Dokumente/Variablen/Baseline/Nachweise) sind frameworkübergreifend
|
||||
// identisch → nur einmal je Mandant abgleichen (Falle 1.1). Anforderungen dagegen
|
||||
// IMMER, aber framework-scoped.
|
||||
const reconcileShared = options.reconcileShared ?? true;
|
||||
const now = new Date();
|
||||
const report: ImportReport = {
|
||||
documents: { added: 0, updated: 0, archived: 0, reactivated: 0, unchanged: 0 },
|
||||
requirements: { added: 0, updated: 0, archived: 0, reactivated: 0, unchanged: 0 },
|
||||
variables: { added: 0, updated: 0, unchanged: 0, obsolete: 0 },
|
||||
baseline: { added: 0, updated: 0, unchanged: 0, obsolete: 0 },
|
||||
evidence: { added: 0, updated: 0, unchanged: 0, obsolete: 0 },
|
||||
};
|
||||
|
||||
// ── Reconcile Dokumente (Upsert über code; Status/Override/Freigabe bleiben) ──
|
||||
// Geteilt → nur beim ersten Framework je Mandant (Falle 1.1).
|
||||
if (reconcileShared) {
|
||||
const existingDocs = await prisma.policyDocument.findMany({ where: { tenantId } });
|
||||
const docByCode = new Map(existingDocs.map((d) => [d.code, d]));
|
||||
const desiredDocCodes = new Set(pkg.documents.map((d) => d.code));
|
||||
for (const d of pkg.documents) {
|
||||
const ex = docByCode.get(d.code);
|
||||
if (!ex) {
|
||||
report.documents.added++;
|
||||
if (!dryRun)
|
||||
await prisma.policyDocument.create({
|
||||
data: {
|
||||
tenantId, code: d.code, type: d.type, title: d.title, version: "1.0", status: "FREIGEGEBEN",
|
||||
policyCode: d.policyCode, fulfills: d.fulfills, rawMarkdown: d.rawMarkdown, orderIdx: d.orderIdx,
|
||||
},
|
||||
});
|
||||
continue;
|
||||
}
|
||||
const contentChanged =
|
||||
ex.type !== d.type || ex.title !== d.title || (ex.policyCode ?? null) !== (d.policyCode ?? null) ||
|
||||
!arraysEqual(ex.fulfills, d.fulfills) || ex.rawMarkdown !== d.rawMarkdown || ex.orderIdx !== d.orderIdx;
|
||||
// Nur Inhaltsfelder + Lifecycle; Status/Version/Owner/Freigabe/Override NICHT anfassen.
|
||||
const contentData = { type: d.type, title: d.title, policyCode: d.policyCode, fulfills: d.fulfills, rawMarkdown: d.rawMarkdown, orderIdx: d.orderIdx };
|
||||
if (ex.archivedAt) {
|
||||
report.documents.reactivated++;
|
||||
if (!dryRun) await prisma.policyDocument.update({ where: { id: ex.id }, data: { ...contentData, archivedAt: null } });
|
||||
} else if (contentChanged) {
|
||||
report.documents.updated++;
|
||||
if (!dryRun) await prisma.policyDocument.update({ where: { id: ex.id }, data: contentData });
|
||||
} else {
|
||||
report.documents.unchanged++;
|
||||
}
|
||||
}
|
||||
for (const ex of existingDocs) {
|
||||
// Nur Paket-Dokumente deaktivieren — verwaltete Register (import-managed) unberührt lassen.
|
||||
if (desiredDocCodes.has(ex.code) || ex.archivedAt || !isPackageDoc(ex.code)) continue;
|
||||
report.documents.archived++;
|
||||
if (!dryRun) await prisma.policyDocument.update({ where: { id: ex.id }, data: { archivedAt: now } });
|
||||
}
|
||||
} // Ende reconcileShared (Dokumente)
|
||||
|
||||
// ── Reconcile Anforderungen (Upsert über reqId; entfernte deaktiviert) — FRAMEWORK-SCOPED ──
|
||||
// Nur Anforderungen DIESES Frameworks lesen/anlegen/archivieren, damit ein ISO-Import
|
||||
// die TISAX-Anforderungen (und umgekehrt) nicht stilllegt (Falle 1.1).
|
||||
const existingReqs = await prisma.policyRequirement.findMany({ where: { tenantId, framework } });
|
||||
const reqById = new Map(existingReqs.map((r) => [r.reqId, r]));
|
||||
const desiredReqIds = new Set(pkg.requirements.map((r) => r.reqId));
|
||||
for (const r of pkg.requirements) {
|
||||
const ex = reqById.get(r.reqId);
|
||||
if (!ex) {
|
||||
report.requirements.added++;
|
||||
if (!dryRun) await prisma.policyRequirement.create({ data: { tenantId, framework, ...r } });
|
||||
continue;
|
||||
}
|
||||
const changed =
|
||||
ex.policyCode !== r.policyCode || ex.control !== r.control || ex.obligation !== r.obligation ||
|
||||
(ex.condition ?? null) !== (r.condition ?? null) || ex.requirement !== r.requirement ||
|
||||
ex.implementation !== r.implementation || !arraysEqual(ex.vaCodes, r.vaCodes) ||
|
||||
(ex.nachweisLink ?? null) !== (r.nachweisLink ?? null);
|
||||
if (ex.archivedAt) {
|
||||
report.requirements.reactivated++;
|
||||
if (!dryRun) await prisma.policyRequirement.update({ where: { id: ex.id }, data: { ...r, archivedAt: null } });
|
||||
} else if (changed) {
|
||||
report.requirements.updated++;
|
||||
if (!dryRun) await prisma.policyRequirement.update({ where: { id: ex.id }, data: r });
|
||||
} else {
|
||||
report.requirements.unchanged++;
|
||||
}
|
||||
}
|
||||
for (const ex of existingReqs) {
|
||||
if (desiredReqIds.has(ex.reqId) || ex.archivedAt) continue;
|
||||
report.requirements.archived++;
|
||||
if (!dryRun) await prisma.policyRequirement.update({ where: { id: ex.id }, data: { archivedAt: now } });
|
||||
}
|
||||
|
||||
// Geteilte Inhalte (Variablen/Baseline/Nachweise) wieder nur beim ersten Framework.
|
||||
if (reconcileShared) {
|
||||
// ── Reconcile Variablen + Feature-Flags (Wert bleibt IMMER erhalten) ──
|
||||
const existingVars = await prisma.policyVariable.findMany({ where: { tenantId } });
|
||||
const varByKey = new Map(existingVars.map((v) => [v.key, v]));
|
||||
const desiredVarKeys = new Set(pkg.variables.map((v) => v.key));
|
||||
for (const v of pkg.variables) {
|
||||
const ex = varByKey.get(v.key);
|
||||
if (!ex) {
|
||||
report.variables.added++;
|
||||
if (!dryRun) await prisma.policyVariable.create({ data: { tenantId, ...v } });
|
||||
continue;
|
||||
}
|
||||
// Nur Metadaten aktualisieren — den (ggf. vom Kunden gepflegten) value NIE überschreiben.
|
||||
const metaChanged =
|
||||
ex.title !== v.title || ex.kind !== v.kind || (ex.groupName ?? null) !== (v.groupName ?? null) ||
|
||||
ex.required !== v.required || ex.orderIdx !== v.orderIdx;
|
||||
if (metaChanged) {
|
||||
report.variables.updated++;
|
||||
if (!dryRun) await prisma.policyVariable.update({ where: { id: ex.id }, data: { title: v.title, kind: v.kind, groupName: v.groupName, required: v.required, orderIdx: v.orderIdx } });
|
||||
} else {
|
||||
report.variables.unchanged++;
|
||||
}
|
||||
}
|
||||
// Nicht mehr im Schema enthaltene Variablen bleiben bestehen (können in eigenem
|
||||
// Rohtext referenziert sein) — nur als „obsolet" im Report ausgewiesen.
|
||||
report.variables.obsolete = existingVars.filter((v) => !desiredVarKeys.has(v.key)).length;
|
||||
|
||||
// ── Reconcile Baseline-Parameter (Upsert über blId) ───────────────────
|
||||
const existingBaseline = await prisma.policyBaselineParam.findMany({ where: { tenantId } });
|
||||
const blById = new Map(existingBaseline.map((b) => [b.blId, b]));
|
||||
const desiredBlIds = new Set(pkg.baseline.map((b) => b.blId));
|
||||
for (const b of pkg.baseline) {
|
||||
const ex = blById.get(b.blId);
|
||||
if (!ex) {
|
||||
report.baseline.added++;
|
||||
if (!dryRun) await prisma.policyBaselineParam.create({ data: { tenantId, ...b } });
|
||||
continue;
|
||||
}
|
||||
const changed = ex.section !== b.section || ex.name !== b.name || ex.vorgabe !== b.vorgabe || ex.orderIdx !== b.orderIdx;
|
||||
if (changed) {
|
||||
report.baseline.updated++;
|
||||
if (!dryRun) await prisma.policyBaselineParam.update({ where: { id: ex.id }, data: { section: b.section, name: b.name, vorgabe: b.vorgabe, orderIdx: b.orderIdx } });
|
||||
} else {
|
||||
report.baseline.unchanged++;
|
||||
}
|
||||
}
|
||||
report.baseline.obsolete = existingBaseline.filter((b) => !desiredBlIds.has(b.blId)).length;
|
||||
|
||||
// ── Reconcile Nachweisregister (Upsert über nr) ───────────────────────
|
||||
const existingEvidence = await prisma.policyEvidence.findMany({ where: { tenantId } });
|
||||
const evByNr = new Map(existingEvidence.map((e) => [e.nr, e]));
|
||||
const desiredNrs = new Set(pkg.evidence.map((e) => e.nr));
|
||||
for (const e of pkg.evidence) {
|
||||
const ex = evByNr.get(e.nr);
|
||||
if (!ex) {
|
||||
report.evidence.added++;
|
||||
if (!dryRun) await prisma.policyEvidence.create({ data: { tenantId, ...e } });
|
||||
continue;
|
||||
}
|
||||
const changed = ex.policyCode !== e.policyCode || ex.nachweis !== e.nachweis || ex.quelle !== e.quelle || ex.verantwortlich !== e.verantwortlich || ex.turnus !== e.turnus;
|
||||
if (changed) {
|
||||
report.evidence.updated++;
|
||||
if (!dryRun) await prisma.policyEvidence.update({ where: { id: ex.id }, data: { policyCode: e.policyCode, nachweis: e.nachweis, quelle: e.quelle, verantwortlich: e.verantwortlich, turnus: e.turnus } });
|
||||
} else {
|
||||
report.evidence.unchanged++;
|
||||
}
|
||||
}
|
||||
report.evidence.obsolete = existingEvidence.filter((e) => !desiredNrs.has(e.nr)).length;
|
||||
} // Ende reconcileShared (Variablen/Baseline/Nachweise)
|
||||
|
||||
// Änderungsprotokoll ins Audit-Log (nur bei echtem Lauf).
|
||||
if (!dryRun) {
|
||||
await prisma.auditLog.create({
|
||||
data: {
|
||||
tenantId, scope: "tenant", actorId: options.actorId ?? null,
|
||||
action: "import", entity: "policy_package",
|
||||
after: { framework, ...report } as unknown as object,
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
return {
|
||||
documents: pkg.documents.length,
|
||||
requirements: pkg.requirements.length,
|
||||
variables: pkg.variables.length,
|
||||
baseline: pkg.baseline.length,
|
||||
report,
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Rückwärtskompatibler Datei-Import: parst das Datei-Paket und reconciled es in den
|
||||
* Mandanten. Wird als Fallback genutzt, solange keine veröffentlichte DB-Vorlage vorliegt.
|
||||
*/
|
||||
export async function importPolicies(
|
||||
prisma: PrismaClient,
|
||||
tenantId: string,
|
||||
seedDir: string,
|
||||
options: ImportOptions = {}
|
||||
) {
|
||||
// Datei-Quelle für das Framework des Imports (Default TISAX = mapping.json).
|
||||
const pkg = parsePackageFiles(seedDir, mappingFileFor(options.framework));
|
||||
return reconcilePackage(prisma, tenantId, pkg, options);
|
||||
}
|
||||
@@ -1,256 +0,0 @@
|
||||
// Import des Standard-Prozess-Katalogs (M2 Strukturanalyse, Ebene 2) in das globale
|
||||
// Modell ProcessCatalogEntry. GLOBALER Content (kein tenantId), analog RiskCatalogEntry.
|
||||
// Idempotent (Upsert je `code`). Kuratierte Kern-/Management-/Unterstützungsprozesse
|
||||
// mit Vorschlägen für Träger-Asset-Typen, Standard-Risiken (→ RiskCatalogEntry.code)
|
||||
// und Info-Labels — angeboten im prozessgeführten Wizard-Schritt.
|
||||
|
||||
import type { AssetType, InfoLabel, PrismaClient, ProcessCategory } from "@prisma/client";
|
||||
|
||||
interface CatalogSeed {
|
||||
code: string;
|
||||
name: string;
|
||||
category: ProcessCategory;
|
||||
/** Katalog-Prozess-Tiefe: Code des übergeordneten Katalog-Prozesses (Teilprozess). */
|
||||
parentCode?: string;
|
||||
suggestedAssetTypes: AssetType[];
|
||||
suggestedRiskCodes: string[];
|
||||
suggestedInfoLabels: InfoLabel[];
|
||||
}
|
||||
|
||||
// „Neben"-Prozesse → SUPPORT (Vorgabe). Codes: P-<KAT><nr>, KAT = CORE|MGMT|SUP.
|
||||
const CATALOG: CatalogSeed[] = [
|
||||
// ── Kernprozesse ──────────────────────────────────────────────────────────
|
||||
{
|
||||
code: "P-CORE-01",
|
||||
name: "Auftragsabwicklung",
|
||||
category: "CORE",
|
||||
suggestedAssetTypes: ["INFORMATION", "DATA", "APPLICATION", "SYSTEM", "PERSON"],
|
||||
suggestedRiskCodes: ["R-OPS-01", "R-ORG-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-CORE-02",
|
||||
name: "Produktentwicklung / Engineering",
|
||||
category: "CORE",
|
||||
suggestedAssetTypes: ["INFORMATION", "DATA", "APPLICATION", "PERSON", "SUPPLIER"],
|
||||
suggestedRiskCodes: ["R-DEV-01", "R-PROTO-01"],
|
||||
suggestedInfoLabels: ["INFO_VERY_HIGH", "PROTOTYPE"],
|
||||
},
|
||||
{
|
||||
code: "P-CORE-03",
|
||||
name: "Produktion / Leistungserbringung",
|
||||
category: "CORE",
|
||||
suggestedAssetTypes: ["SYSTEM", "APPLICATION", "LOCATION", "PERSON"],
|
||||
suggestedRiskCodes: ["R-OPS-01", "R-PHY-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-CORE-04",
|
||||
name: "Vertrieb & Kundenbetreuung",
|
||||
category: "CORE",
|
||||
suggestedAssetTypes: ["INFORMATION", "DATA", "APPLICATION", "PERSON"],
|
||||
suggestedRiskCodes: ["R-DSGVO-01", "R-HR-01"],
|
||||
suggestedInfoLabels: ["PERSONAL_DATA"],
|
||||
},
|
||||
// ── Managementprozesse ──────────────────────────────────────────────────────
|
||||
{
|
||||
code: "P-MGMT-01",
|
||||
name: "Unternehmensführung & Strategie",
|
||||
category: "MANAGEMENT",
|
||||
suggestedAssetTypes: ["INFORMATION", "PERSON"],
|
||||
suggestedRiskCodes: ["R-ORG-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-MGMT-02",
|
||||
name: "Informationssicherheits-Management (ISMS)",
|
||||
category: "MANAGEMENT",
|
||||
suggestedAssetTypes: ["INFORMATION", "APPLICATION", "PERSON"],
|
||||
suggestedRiskCodes: ["R-ORG-01", "R-OPS-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-MGMT-03",
|
||||
name: "Risiko- & Compliance-Management",
|
||||
category: "MANAGEMENT",
|
||||
suggestedAssetTypes: ["INFORMATION", "PERSON"],
|
||||
suggestedRiskCodes: ["R-ORG-01", "R-DSGVO-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH", "PERSONAL_DATA"],
|
||||
},
|
||||
// ── Unterstützende Prozesse (inkl. „Neben"-Prozesse → SUPPORT) ────────────────
|
||||
{
|
||||
code: "P-SUP-01",
|
||||
name: "IT-Betrieb & Infrastruktur",
|
||||
category: "SUPPORT",
|
||||
suggestedAssetTypes: ["SYSTEM", "APPLICATION", "IT_SERVICE", "SOFTWARE", "SUPPLIER", "LOCATION"],
|
||||
suggestedRiskCodes: ["R-OPS-01", "R-NET-01", "R-IAM-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
// Teilprozesse von P-SUP-01 „IT-Betrieb & Infrastruktur" (parentCode).
|
||||
{
|
||||
code: "P-SUP-01-01",
|
||||
name: "Datensicherung & Wiederherstellung",
|
||||
category: "SUPPORT",
|
||||
parentCode: "P-SUP-01",
|
||||
suggestedAssetTypes: ["SYSTEM", "IT_SERVICE", "DATA", "SOFTWARE"],
|
||||
suggestedRiskCodes: ["R-OPS-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-01-02",
|
||||
name: "Server-/Virtualisierungsbetrieb",
|
||||
category: "SUPPORT",
|
||||
parentCode: "P-SUP-01",
|
||||
suggestedAssetTypes: ["SYSTEM", "APPLICATION", "IT_SERVICE"],
|
||||
suggestedRiskCodes: ["R-OPS-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-01-03",
|
||||
name: "Netzwerk-/Firewallbetrieb",
|
||||
category: "SUPPORT",
|
||||
parentCode: "P-SUP-01",
|
||||
suggestedAssetTypes: ["SYSTEM", "IT_SERVICE"],
|
||||
suggestedRiskCodes: ["R-NET-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-01-04",
|
||||
name: "Patch-/Schwachstellenmanagement",
|
||||
category: "SUPPORT",
|
||||
parentCode: "P-SUP-01",
|
||||
suggestedAssetTypes: ["SYSTEM", "APPLICATION", "SOFTWARE"],
|
||||
suggestedRiskCodes: ["R-OPS-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-01-05",
|
||||
name: "Monitoring & Alerting",
|
||||
category: "SUPPORT",
|
||||
parentCode: "P-SUP-01",
|
||||
suggestedAssetTypes: ["SYSTEM", "IT_SERVICE", "APPLICATION"],
|
||||
suggestedRiskCodes: ["R-OPS-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-01-06",
|
||||
name: "Identity-/Access-Betrieb (IAM)",
|
||||
category: "SUPPORT",
|
||||
parentCode: "P-SUP-01",
|
||||
suggestedAssetTypes: ["APPLICATION", "IT_SERVICE", "PERSON"],
|
||||
suggestedRiskCodes: ["R-IAM-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-01-07",
|
||||
name: "Endpoint-Management",
|
||||
category: "SUPPORT",
|
||||
parentCode: "P-SUP-01",
|
||||
suggestedAssetTypes: ["SYSTEM", "SOFTWARE", "IT_SERVICE"],
|
||||
suggestedRiskCodes: ["R-OPS-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-01-08",
|
||||
name: "RZ-/Cloud-Betrieb",
|
||||
category: "SUPPORT",
|
||||
parentCode: "P-SUP-01",
|
||||
suggestedAssetTypes: ["LOCATION", "IT_SERVICE", "SUPPLIER", "SYSTEM"],
|
||||
suggestedRiskCodes: ["R-OPS-01", "R-PHY-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-02",
|
||||
name: "Personalwesen (HR)",
|
||||
category: "SUPPORT",
|
||||
suggestedAssetTypes: ["INFORMATION", "DATA", "PERSON", "APPLICATION"],
|
||||
suggestedRiskCodes: ["R-HR-01", "R-DSGVO-01"],
|
||||
suggestedInfoLabels: ["PERSONAL_DATA", "INFO_HIGH"],
|
||||
},
|
||||
// Teilprozesse von P-SUP-02 „Personalwesen (HR)" (parentCode).
|
||||
{
|
||||
code: "P-SUP-02-01",
|
||||
name: "Recruiting & Onboarding",
|
||||
category: "SUPPORT",
|
||||
parentCode: "P-SUP-02",
|
||||
suggestedAssetTypes: ["INFORMATION", "DATA", "PERSON", "APPLICATION"],
|
||||
suggestedRiskCodes: ["R-HR-01", "R-DSGVO-01"],
|
||||
suggestedInfoLabels: ["PERSONAL_DATA"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-02-02",
|
||||
name: "Offboarding",
|
||||
category: "SUPPORT",
|
||||
parentCode: "P-SUP-02",
|
||||
suggestedAssetTypes: ["INFORMATION", "PERSON", "APPLICATION"],
|
||||
suggestedRiskCodes: ["R-HR-01", "R-IAM-01"],
|
||||
suggestedInfoLabels: ["PERSONAL_DATA"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-02-03",
|
||||
name: "Awareness & Schulung",
|
||||
category: "SUPPORT",
|
||||
parentCode: "P-SUP-02",
|
||||
suggestedAssetTypes: ["INFORMATION", "PERSON"],
|
||||
suggestedRiskCodes: ["R-HR-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-03",
|
||||
name: "Einkauf & Lieferantensteuerung",
|
||||
category: "SUPPORT",
|
||||
suggestedAssetTypes: ["INFORMATION", "SUPPLIER", "IT_SERVICE"],
|
||||
suggestedRiskCodes: ["R-SUP-01", "R-ORG-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-04",
|
||||
name: "Finanzen & Buchhaltung",
|
||||
category: "SUPPORT",
|
||||
suggestedAssetTypes: ["INFORMATION", "DATA", "APPLICATION", "PERSON"],
|
||||
suggestedRiskCodes: ["R-DSGVO-01", "R-ORG-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH", "PERSONAL_DATA"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-05",
|
||||
name: "Facility Management & physische Sicherheit",
|
||||
category: "SUPPORT",
|
||||
suggestedAssetTypes: ["LOCATION", "SYSTEM", "PERSON"],
|
||||
suggestedRiskCodes: ["R-PHY-01"],
|
||||
suggestedInfoLabels: ["NONE"],
|
||||
},
|
||||
// Teilprozesse von P-SUP-05 „Facility Management & physische Sicherheit" (parentCode).
|
||||
{
|
||||
code: "P-SUP-05-01",
|
||||
name: "Zutritts-/Zonenkontrolle",
|
||||
category: "SUPPORT",
|
||||
parentCode: "P-SUP-05",
|
||||
suggestedAssetTypes: ["LOCATION", "SYSTEM", "PERSON"],
|
||||
suggestedRiskCodes: ["R-PHY-01"],
|
||||
suggestedInfoLabels: ["NONE"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-05-02",
|
||||
name: "Gebäude-/Versorgungstechnik",
|
||||
category: "SUPPORT",
|
||||
parentCode: "P-SUP-05",
|
||||
suggestedAssetTypes: ["LOCATION", "SYSTEM"],
|
||||
suggestedRiskCodes: ["R-PHY-01"],
|
||||
suggestedInfoLabels: ["NONE"],
|
||||
},
|
||||
];
|
||||
|
||||
/** Schreibt den Katalog (Upsert je code). Liefert die Anzahl. */
|
||||
export async function importProcessCatalog(prisma: PrismaClient): Promise<number> {
|
||||
let orderIdx = 0;
|
||||
for (const c of CATALOG) {
|
||||
// parentCode explizit setzen (null bei Hauptprozessen) → idempotente Updates.
|
||||
const payload = { ...c, parentCode: c.parentCode ?? null, orderIdx: orderIdx++ };
|
||||
await prisma.processCatalogEntry.upsert({
|
||||
where: { code: c.code },
|
||||
update: payload,
|
||||
create: payload,
|
||||
});
|
||||
}
|
||||
return CATALOG.length;
|
||||
}
|
||||
@@ -1,63 +0,0 @@
|
||||
// Import des Standard-Risikokatalogs (Story A6-1) aus dem Fachcontent C4 in das
|
||||
// globale Modell RiskCatalogEntry. Tabellenzeile:
|
||||
//
|
||||
// | R-ORG-01 | Titel | Beschreibung | 1.1.1, 1.2.1 | Richtlinien, Organisation | Standardmaßnahme | E3/S4 — Begründung |
|
||||
//
|
||||
// Idempotent (Upsert über code). Kein tenantId (globaler Katalog).
|
||||
|
||||
import { readFileSync } from "node:fs";
|
||||
import { join } from "node:path";
|
||||
import type { PrismaClient } from "@prisma/client";
|
||||
|
||||
const C4_PATH = join(__dirname, "..", "docs", "wizard-uebergabe", "02_Fachcontent_C1-C9", "C4_Risikokatalog.md");
|
||||
|
||||
export interface ParsedRisk {
|
||||
code: string; category: string; title: string; description: string;
|
||||
controls: string[]; assetTypes: string[]; standardMeasure: string;
|
||||
defaultLikelihood: number; defaultImpact: number; rationale: string; orderIdx: number;
|
||||
}
|
||||
|
||||
const splitList = (s: string): string[] => s.split(",").map((x) => x.trim()).filter(Boolean);
|
||||
|
||||
/** Parst die C4-Tabellen zu Katalog-Objekten (ohne DB-Zugriff — testbar). */
|
||||
export function parseRiskCatalog(text: string): ParsedRisk[] {
|
||||
const out: ParsedRisk[] = [];
|
||||
let i = 0;
|
||||
for (const line of text.split("\n")) {
|
||||
const m = line.match(/^\|\s*(R-[A-Z]+-\d+)\s*\|(.*)\|\s*$/);
|
||||
if (!m) continue;
|
||||
const cols = m[2].split("|").map((c) => c.trim());
|
||||
if (cols.length < 6) continue; // title|desc|controls|assetTypes|measure|ES-rationale
|
||||
const code = m[1];
|
||||
const es = cols[5].match(/E\s*(\d)\s*\/\s*S\s*(\d)/i);
|
||||
const [, esL, esI] = es ?? [];
|
||||
out.push({
|
||||
code,
|
||||
category: code.split("-")[1],
|
||||
title: cols[0],
|
||||
description: cols[1],
|
||||
controls: splitList(cols[2]),
|
||||
assetTypes: splitList(cols[3]),
|
||||
standardMeasure: cols[4],
|
||||
defaultLikelihood: esL ? Number(esL) : 3,
|
||||
defaultImpact: esI ? Number(esI) : 3,
|
||||
rationale: cols[5].replace(/^E\s*\d\s*\/\s*S\s*\d\s*[—-]\s*/i, "").trim(),
|
||||
orderIdx: i++,
|
||||
});
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
/** Liest C4 und schreibt den Katalog (Upsert je code). Liefert die Anzahl. */
|
||||
export async function importRiskCatalog(prisma: PrismaClient): Promise<number> {
|
||||
const text = readFileSync(C4_PATH, "utf-8");
|
||||
const risks = parseRiskCatalog(text);
|
||||
for (const r of risks) {
|
||||
await prisma.riskCatalogEntry.upsert({
|
||||
where: { code: r.code },
|
||||
update: { category: r.category, title: r.title, description: r.description, controls: r.controls, assetTypes: r.assetTypes, standardMeasure: r.standardMeasure, defaultLikelihood: r.defaultLikelihood, defaultImpact: r.defaultImpact, rationale: r.rationale, orderIdx: r.orderIdx },
|
||||
create: r,
|
||||
});
|
||||
}
|
||||
return risks.length;
|
||||
}
|
||||
+104
-2202
File diff suppressed because it is too large
Load Diff
@@ -1,60 +0,0 @@
|
||||
import "dotenv/config";
|
||||
import { PrismaClient } from "@prisma/client";
|
||||
import { PrismaPg } from "@prisma/adapter-pg";
|
||||
import { pathToFileURL } from "node:url";
|
||||
import { CONTROL_DOMAIN_DEFAULTS } from "../src/lib/control-domain";
|
||||
import { importProcessCatalog } from "./import-process-catalog";
|
||||
|
||||
/**
|
||||
* Prod-tauglicher Content-Seed: die GLOBALEN, mandantenunabhängigen Inhalte der
|
||||
* TISAX-Neustruktur — Control→Domain/RACI-Defaults (M3) und Prozess-Katalog (M2).
|
||||
* Enthält KEINE Demo-/Mandantendaten und ist idempotent (upsert bzw.
|
||||
* global-neu-setzen), also gefahrlos in jeder Umgebung mehrfach ausführbar.
|
||||
*
|
||||
* Wird vom Demo-Seed (`seed.ts`) wiederverwendet und ist eigenständig ausführbar:
|
||||
* npm run seed:content
|
||||
*/
|
||||
export async function seedGlobalContent(
|
||||
prisma: PrismaClient
|
||||
): Promise<{ controlDomains: number; processCatalog: number }> {
|
||||
// Control→Domain/RACI-Defaults (global, tenantId = null). Idempotent: die globalen
|
||||
// Zeilen werden neu gesetzt; mandantenspezifische Overrides (tenantId != null) bleiben.
|
||||
await prisma.controlDomainMap.deleteMany({ where: { tenantId: null } });
|
||||
await prisma.controlDomainMap.createMany({
|
||||
data: CONTROL_DOMAIN_DEFAULTS.map((r) => ({
|
||||
tenantId: null,
|
||||
control: r.control,
|
||||
domain: r.domain,
|
||||
raci: r.raci,
|
||||
functionKey: r.functionKey ?? null,
|
||||
})),
|
||||
});
|
||||
|
||||
// Prozess-Katalog (global, upsert je code — idempotent).
|
||||
const processCatalog = await importProcessCatalog(prisma);
|
||||
|
||||
return { controlDomains: CONTROL_DOMAIN_DEFAULTS.length, processCatalog };
|
||||
}
|
||||
|
||||
async function main() {
|
||||
const prisma = new PrismaClient({
|
||||
adapter: new PrismaPg({ connectionString: process.env.DATABASE_URL }),
|
||||
});
|
||||
try {
|
||||
console.log("→ Globaler Content-Seed (Control→Domain-Defaults + Prozess-Katalog)…");
|
||||
const { controlDomains, processCatalog } = await seedGlobalContent(prisma);
|
||||
console.log(`✔ ${controlDomains} Control→Domain-Defaults`);
|
||||
console.log(`✔ ${processCatalog} Prozess-Katalog-Einträge`);
|
||||
console.log("✓ Globaler Content-Seed abgeschlossen.");
|
||||
} finally {
|
||||
await prisma.$disconnect();
|
||||
}
|
||||
}
|
||||
|
||||
// Nur als eigenständiger Runner ausführen, nicht beim Import aus seed.ts.
|
||||
if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
|
||||
main().catch((e) => {
|
||||
console.error(e);
|
||||
process.exit(1);
|
||||
});
|
||||
}
|
||||
+74
-709
@@ -2,732 +2,97 @@ import "dotenv/config";
|
||||
import { PrismaClient } from "@prisma/client";
|
||||
import { PrismaPg } from "@prisma/adapter-pg";
|
||||
import { hashPassword } from "../src/server/password";
|
||||
import { join } from "node:path";
|
||||
import { PERMISSIONS, ROLE_DEFS } from "../src/server/rbac";
|
||||
import { importPolicies, stampPackageState } from "./import-policies";
|
||||
import { importImplementationHints } from "./import-hints";
|
||||
import { importRiskCatalog } from "./import-risks";
|
||||
import { seedGlobalContent } from "./seed-content";
|
||||
import { importManaged } from "./import-managed";
|
||||
import { MODULE_KEYS } from "../src/lib/modules";
|
||||
import { normalizeAssetName } from "../src/lib/normalize-asset";
|
||||
import { PERMISSIONS, type RoleKey } from "../src/server/rbac";
|
||||
import { provisionTenant } from "../src/server/provision";
|
||||
|
||||
/**
|
||||
* Seed: global permission catalog + demo tenant with roles and users.
|
||||
* Idempotent (upserts) — safe to run repeatedly.
|
||||
* Craftvia-Demo-Seed (Fundament): Plattform-Admin + Mandant `demo` mit je einem Nutzer
|
||||
* pro Standardrolle + zweiter Mandant `demo2` (Isolations-/Tenant-Switch-Tests) +
|
||||
* Multi-Membership-Fixture. KEINE Fachdaten (Kunden/Aufträge liefern die Module).
|
||||
*
|
||||
* Idempotent (upserts) — beliebig oft ausführbar. Passwort: SEED_PASSWORD oder Default.
|
||||
*/
|
||||
|
||||
const prisma = new PrismaClient({
|
||||
adapter: new PrismaPg({ connectionString: process.env.DATABASE_URL }),
|
||||
});
|
||||
|
||||
const DEMO_PASSWORD = "Demo1234!";
|
||||
const DEMO_PASSWORD = process.env.SEED_PASSWORD || "Demo1234!";
|
||||
|
||||
const THREATS = [
|
||||
"Schadsoftware / Ransomware",
|
||||
"Phishing / Social Engineering",
|
||||
"Innentäter / Missbrauch von Berechtigungen",
|
||||
"Diebstahl oder Verlust von Geräten",
|
||||
"Ausfall von IT-Systemen oder Diensten",
|
||||
"Ausfall eines Dienstleisters / Lieferanten",
|
||||
"Stromausfall / Infrastrukturausfall",
|
||||
"Feuer / Wasser / Elementarschäden",
|
||||
"Unbefugter physischer Zutritt",
|
||||
"Denial-of-Service-Angriff",
|
||||
"Datenabfluss / Industriespionage",
|
||||
"Fehlbedienung durch Mitarbeitende",
|
||||
"Softwarefehler / fehlerhafte Updates",
|
||||
"Kompromittierte Zugangsdaten",
|
||||
"Rechtliche / regulatorische Verstöße",
|
||||
];
|
||||
|
||||
const VULNERABILITIES = [
|
||||
"Fehlende oder veraltete Backups",
|
||||
"Fehlende Netzwerksegmentierung",
|
||||
"Unzureichendes Patch-Management",
|
||||
"Schwache oder wiederverwendete Passwörter",
|
||||
"Fehlende Multi-Faktor-Authentifizierung",
|
||||
"Übermäßige Berechtigungen / fehlendes Least-Privilege",
|
||||
"Fehlende Awareness / Schulungen",
|
||||
"Unverschlüsselte Datenträger oder Übertragungen",
|
||||
"Kein Notfallkonzept / ungetesteter Wiederanlauf",
|
||||
"Single Point of Failure (Technik oder Person)",
|
||||
"Unzureichende Protokollierung / Überwachung",
|
||||
"Veraltete oder nicht mehr unterstützte Software",
|
||||
"Fehlende Vertrags-/AV-Regelungen mit Dienstleistern",
|
||||
"Offene, ungenutzte Dienste und Ports",
|
||||
"Unklare Verantwortlichkeiten",
|
||||
];
|
||||
async function ensureMember(tenantId: string, u: { email: string; name: string; roles: RoleKey[] }, passwordHash: string) {
|
||||
// Globale Identity (Anmeldung) + Mitgliedschaft (User) im Mandanten.
|
||||
const identity = await prisma.identity.upsert({
|
||||
where: { email: u.email },
|
||||
update: {},
|
||||
create: { email: u.email, passwordHash },
|
||||
});
|
||||
const user = await prisma.user.upsert({
|
||||
where: { tenantId_email: { tenantId, email: u.email } },
|
||||
update: { identityId: identity.id, name: u.name },
|
||||
create: { tenantId, identityId: identity.id, email: u.email, name: u.name },
|
||||
});
|
||||
const roles = await prisma.role.findMany({ where: { tenantId, key: { in: u.roles } } });
|
||||
for (const r of roles) {
|
||||
await prisma.userRole.upsert({
|
||||
where: { userId_roleId: { userId: user.id, roleId: r.id } },
|
||||
update: {},
|
||||
create: { userId: user.id, roleId: r.id },
|
||||
});
|
||||
}
|
||||
return user;
|
||||
}
|
||||
|
||||
async function main() {
|
||||
// 0. Globale Kataloge Bedrohungen/Schwachstellen (Vorschläge, Freitext bleibt möglich)
|
||||
for (const name of THREATS) {
|
||||
await prisma.threat.upsert({ where: { name }, update: {}, create: { name } });
|
||||
}
|
||||
for (const name of VULNERABILITIES) {
|
||||
await prisma.vulnerability.upsert({ where: { name }, update: {}, create: { name } });
|
||||
}
|
||||
console.log(`✔ Kataloge: ${THREATS.length} Bedrohungen, ${VULNERABILITIES.length} Schwachstellen`);
|
||||
|
||||
// 1. Global permission catalog
|
||||
for (const key of PERMISSIONS) {
|
||||
await prisma.permission.upsert({ where: { key }, update: {}, create: { key } });
|
||||
}
|
||||
console.log(`✔ ${PERMISSIONS.length} Permissions`);
|
||||
|
||||
// 1b. Globaler Content (M2/M3): Control→Domain/RACI-Defaults + Prozess-Katalog.
|
||||
// Ausgelagert in den prod-tauglichen, idempotenten Content-Seed (seed-content.ts),
|
||||
// damit DevOps ihn auch ohne Demo-Seed in jeder Umgebung fahren kann (npm run seed:content).
|
||||
const globalContent = await seedGlobalContent(prisma);
|
||||
console.log(`✔ ${globalContent.controlDomains} Control→Domain-Defaults (M3)`);
|
||||
|
||||
// 2. Demo tenant
|
||||
const tenant = await prisma.tenant.upsert({
|
||||
where: { slug: "demo" },
|
||||
update: {},
|
||||
create: { name: "Demo GmbH", slug: "demo" },
|
||||
});
|
||||
|
||||
// 3. Roles from blueprints, with permission bundles
|
||||
for (const [key, def] of Object.entries(ROLE_DEFS)) {
|
||||
const role = await prisma.role.upsert({
|
||||
where: { tenantId_key: { tenantId: tenant.id, key } },
|
||||
update: { name: def.name },
|
||||
create: { tenantId: tenant.id, key, name: def.name },
|
||||
});
|
||||
const perms = await prisma.permission.findMany({
|
||||
where: { key: { in: [...def.permissions] } },
|
||||
});
|
||||
for (const p of perms) {
|
||||
await prisma.rolePermission.upsert({
|
||||
where: { roleId_permissionId: { roleId: role.id, permissionId: p.id } },
|
||||
update: {},
|
||||
create: { roleId: role.id, permissionId: p.id },
|
||||
});
|
||||
}
|
||||
}
|
||||
console.log(`✔ Mandant "demo" mit ${Object.keys(ROLE_DEFS).length} Rollen`);
|
||||
|
||||
// 4. Demo users
|
||||
const passwordHash = await hashPassword(DEMO_PASSWORD);
|
||||
const demoUsers: { email: string; name: string; roles: string[] }[] = [
|
||||
{ email: "admin@demo.example", name: "Anna Admin", roles: ["tenant-admin", "isb"] },
|
||||
// Zweiter ISB als Freigeber — ermöglicht den Vier-Augen-Freigabe-Workflow (≠ Einreicher).
|
||||
{ email: "bea.approver@demo.example", name: "Bea Approver", roles: ["isb"] },
|
||||
{ email: "auditor@demo.example", name: "Axel Auditor", roles: ["auditor"] },
|
||||
{ email: "owner@demo.example", name: "Oskar Owner", roles: ["owner"] },
|
||||
{ email: "user@demo.example", name: "Ulla User", roles: ["user"] },
|
||||
];
|
||||
|
||||
for (const u of demoUsers) {
|
||||
// Option C: globale Identity (Anmeldung) + Mitgliedschaft (User) im Mandanten.
|
||||
// Diese 5 Standard-Logins bleiben bewusst SINGLE-Membership, damit der
|
||||
// (bis WS1) einstufige Login-Lookup (auth.ts: findMany by email) eindeutig
|
||||
// bleibt und dev lauffähig ist. Der Multi-Membership-Fall wird über einen
|
||||
// separaten Fixture-Nutzer (multi@demo.example) abgebildet (siehe unten).
|
||||
const idn = await prisma.identity.upsert({
|
||||
where: { email: u.email },
|
||||
update: {},
|
||||
create: { email: u.email, passwordHash },
|
||||
});
|
||||
const user = await prisma.user.upsert({
|
||||
where: { tenantId_email: { tenantId: tenant.id, email: u.email } },
|
||||
update: { identityId: idn.id },
|
||||
create: {
|
||||
tenantId: tenant.id,
|
||||
identityId: idn.id,
|
||||
email: u.email,
|
||||
name: u.name,
|
||||
},
|
||||
});
|
||||
const roles = await prisma.role.findMany({
|
||||
where: { tenantId: tenant.id, key: { in: u.roles } },
|
||||
});
|
||||
for (const r of roles) {
|
||||
await prisma.userRole.upsert({
|
||||
where: { userId_roleId: { userId: user.id, roleId: r.id } },
|
||||
update: {},
|
||||
create: { userId: user.id, roleId: r.id },
|
||||
});
|
||||
}
|
||||
}
|
||||
console.log(`✔ ${demoUsers.length} Demo-Nutzer (Passwort: ${DEMO_PASSWORD})`);
|
||||
|
||||
// 4b. Zweiter Mandant + Multi-Membership-Fixture (Option C, WS0/WS2/WS7).
|
||||
// Eine Identity (multi@demo.example) ist Mitglied in ZWEI Mandanten mit je
|
||||
// unterschiedlichen Rollen — Grundlage für Tenant-Switch- und Isolationstests.
|
||||
// `demo2` wird schlank provisioniert (Rollen/Module/Einstellungen, ohne
|
||||
// Richtlinienpaket). Berührt die 5 Standard-Logins nicht.
|
||||
const tenant2 = await provisionTenant(prisma, {
|
||||
name: "Demo Zwei GmbH",
|
||||
slug: "demo2",
|
||||
short: "Demo2",
|
||||
sector: "Automotive",
|
||||
admin: { email: "admin2@demo.example", name: "Zoe Zweitadmin", password: DEMO_PASSWORD },
|
||||
// 1. Mandant „demo" (provisioniert Permissions, Rollen, Einstellungen, Module, Admin)
|
||||
const demo = await provisionTenant(prisma, {
|
||||
name: "Musterbau Haustechnik GmbH",
|
||||
slug: "demo",
|
||||
short: "Musterbau",
|
||||
sector: "Sanitär, Heizung, Klima",
|
||||
admin: { email: "admin@demo.example", name: "Anna Admin", password: DEMO_PASSWORD },
|
||||
});
|
||||
const multiIdentity = await prisma.identity.upsert({
|
||||
where: { email: "multi@demo.example" },
|
||||
update: {},
|
||||
create: { email: "multi@demo.example", passwordHash },
|
||||
});
|
||||
// Mitgliedschaft je Mandant mit je eigener Rolle (Rechte je aktivem Mandant verschieden).
|
||||
const multiMemberships: { tenantId: string; roleKey: string }[] = [
|
||||
{ tenantId: tenant.id, roleKey: "user" }, // in "demo": nur Standardnutzer
|
||||
{ tenantId: tenant2.id, roleKey: "tenant-admin" }, // in "demo2": Mandanten-Admin
|
||||
];
|
||||
for (const m of multiMemberships) {
|
||||
const membership = await prisma.user.upsert({
|
||||
where: { tenantId_email: { tenantId: m.tenantId, email: "multi@demo.example" } },
|
||||
update: { identityId: multiIdentity.id },
|
||||
create: {
|
||||
tenantId: m.tenantId,
|
||||
identityId: multiIdentity.id,
|
||||
email: "multi@demo.example",
|
||||
name: "Mika Multi",
|
||||
},
|
||||
});
|
||||
const role = await prisma.role.findFirst({ where: { tenantId: m.tenantId, key: m.roleKey } });
|
||||
if (role) {
|
||||
await prisma.userRole.upsert({
|
||||
where: { userId_roleId: { userId: membership.id, roleId: role.id } },
|
||||
update: {},
|
||||
create: { userId: membership.id, roleId: role.id },
|
||||
});
|
||||
}
|
||||
}
|
||||
console.log(`✔ Multi-Membership-Fixture multi@demo.example (Mandanten: demo, demo2)`);
|
||||
|
||||
// 5. Beispiel-Assets, -Prozesse und BIA (nur wenn noch keine Assets existieren)
|
||||
const assetCount = await prisma.asset.count({ where: { tenantId: tenant.id } });
|
||||
if (assetCount === 0) {
|
||||
const isb = await prisma.user.findUniqueOrThrow({
|
||||
where: { tenantId_email: { tenantId: tenant.id, email: "admin@demo.example" } },
|
||||
});
|
||||
const owner = await prisma.user.findUniqueOrThrow({
|
||||
where: { tenantId_email: { tenantId: tenant.id, email: "owner@demo.example" } },
|
||||
});
|
||||
|
||||
const mk = (data: {
|
||||
name: string;
|
||||
type: "INFORMATION" | "SYSTEM" | "APPLICATION" | "LOCATION" | "SUPPLIER" | "PERSON" | "DATA";
|
||||
c: number;
|
||||
i: number;
|
||||
a: number;
|
||||
ownerId?: string;
|
||||
location?: string;
|
||||
tags?: string[];
|
||||
description?: string;
|
||||
}) =>
|
||||
prisma.asset.create({
|
||||
data: {
|
||||
tenantId: tenant.id,
|
||||
name: data.name,
|
||||
type: data.type,
|
||||
// M2: Dedup-Schlüssel setzen (nur INFORMATION/DATA sind primäre Werte;
|
||||
// für die übrigen Typen dient er nur der Exakt-Duplikat-Vermeidung).
|
||||
normalizedName: normalizeAssetName(data.name),
|
||||
confidentiality: data.c,
|
||||
integrity: data.i,
|
||||
availability: data.a,
|
||||
ownerId: data.ownerId,
|
||||
location: data.location,
|
||||
tags: data.tags ?? [],
|
||||
description: data.description,
|
||||
},
|
||||
});
|
||||
|
||||
const erp = await mk({ name: "ERP-System", type: "SYSTEM", c: 3, i: 4, a: 3, ownerId: owner.id, location: "RZ Frankfurt", tags: ["kritisch", "kern"] });
|
||||
const crm = await mk({ name: "Kundendatenbank", type: "DATA", c: 4, i: 3, a: 2, ownerId: isb.id, tags: ["dsgvo"] });
|
||||
const auftraege = await mk({ name: "Auftragsdaten", type: "INFORMATION", c: 3, i: 4, a: 3, ownerId: owner.id });
|
||||
const hoster = await mk({ name: "Cloud-Hoster (IaaS)", type: "SUPPLIER", c: 2, i: 3, a: 4, description: "Betreibt das Rechenzentrum für ERP und CRM." });
|
||||
const buero = await mk({ name: "Bürostandort München", type: "LOCATION", c: 2, i: 2, a: 2 });
|
||||
const itTeam = await mk({ name: "IT-Administration", type: "PERSON", c: 3, i: 3, a: 3 });
|
||||
|
||||
await prisma.assetRelation.createMany({
|
||||
data: [
|
||||
{ tenantId: tenant.id, assetId: erp.id, relatedAssetId: hoster.id, type: "depends_on" },
|
||||
{ tenantId: tenant.id, assetId: crm.id, relatedAssetId: hoster.id, type: "depends_on" },
|
||||
{ tenantId: tenant.id, assetId: erp.id, relatedAssetId: itTeam.id, type: "depends_on" },
|
||||
],
|
||||
});
|
||||
|
||||
const auftrag = await prisma.process.create({
|
||||
data: {
|
||||
tenantId: tenant.id,
|
||||
name: "Auftragsabwicklung",
|
||||
description: "Vom Kundenauftrag bis zur Auslieferung.",
|
||||
category: "CORE",
|
||||
ownerId: owner.id,
|
||||
},
|
||||
});
|
||||
await prisma.processAsset.createMany({
|
||||
data: [
|
||||
{ tenantId: tenant.id, processId: auftrag.id, assetId: auftraege.id, role: "PRIMARY" },
|
||||
{ tenantId: tenant.id, processId: auftrag.id, assetId: erp.id, role: "SECONDARY" },
|
||||
{ tenantId: tenant.id, processId: auftrag.id, assetId: crm.id, role: "SECONDARY" },
|
||||
{ tenantId: tenant.id, processId: auftrag.id, assetId: itTeam.id, role: "SECONDARY" },
|
||||
],
|
||||
});
|
||||
await prisma.biaEntry.create({
|
||||
data: {
|
||||
tenantId: tenant.id,
|
||||
processId: auftrag.id,
|
||||
rtoHours: 8,
|
||||
rpoHours: 4,
|
||||
mtdHours: 24,
|
||||
impactC: 2,
|
||||
impactI: 4,
|
||||
impactA: 3,
|
||||
criticality: 4,
|
||||
notes: "Ausfall > 1 Tag führt zu Lieferverzug und Vertragsstrafen.",
|
||||
},
|
||||
});
|
||||
|
||||
const vertrieb = await prisma.process.create({
|
||||
data: {
|
||||
tenantId: tenant.id,
|
||||
name: "Kundenbetreuung",
|
||||
description: "Anfragen, Angebote, Support.",
|
||||
category: "SUPPORT",
|
||||
ownerId: isb.id,
|
||||
},
|
||||
});
|
||||
await prisma.processAsset.createMany({
|
||||
data: [
|
||||
{ tenantId: tenant.id, processId: vertrieb.id, assetId: crm.id, role: "PRIMARY" },
|
||||
{ tenantId: tenant.id, processId: vertrieb.id, assetId: buero.id, role: "SECONDARY" },
|
||||
],
|
||||
});
|
||||
await prisma.biaEntry.create({
|
||||
data: {
|
||||
tenantId: tenant.id,
|
||||
processId: vertrieb.id,
|
||||
rtoHours: 24,
|
||||
rpoHours: 24,
|
||||
mtdHours: 72,
|
||||
impactC: 3,
|
||||
impactI: 2,
|
||||
impactA: 2,
|
||||
criticality: 3,
|
||||
notes: "Kundenkommunikation kann kurzfristig über Ausweichkanäle laufen.",
|
||||
},
|
||||
});
|
||||
|
||||
console.log("✔ Beispiel-Assets, -Prozesse und BIA angelegt");
|
||||
}
|
||||
|
||||
// 6. Beispiel-Risiken (nur wenn noch keine existieren)
|
||||
const riskCount = await prisma.risk.count({ where: { tenantId: tenant.id } });
|
||||
if (riskCount === 0) {
|
||||
const isb = await prisma.user.findUniqueOrThrow({
|
||||
where: { tenantId_email: { tenantId: tenant.id, email: "admin@demo.example" } },
|
||||
});
|
||||
const byName = async (name: string) =>
|
||||
prisma.asset.findFirstOrThrow({ where: { tenantId: tenant.id, name } });
|
||||
const erp = await byName("ERP-System");
|
||||
const crm = await byName("Kundendatenbank");
|
||||
const hoster = await byName("Cloud-Hoster (IaaS)");
|
||||
const auftrag = await prisma.process.findFirstOrThrow({
|
||||
where: { tenantId: tenant.id, name: "Auftragsabwicklung" },
|
||||
});
|
||||
|
||||
const risks: {
|
||||
title: string;
|
||||
threat: string;
|
||||
vulnerability: string;
|
||||
likelihood: number;
|
||||
impact: number;
|
||||
residual?: [number, number];
|
||||
treatment: "AVOID" | "MITIGATE" | "TRANSFER" | "ACCEPT";
|
||||
status: "OPEN" | "IN_TREATMENT" | "ACCEPTED" | "CLOSED";
|
||||
assets: string[];
|
||||
processId?: string;
|
||||
description?: string;
|
||||
}[] = [
|
||||
{
|
||||
title: "Ransomware auf ERP",
|
||||
threat: "Schadsoftware / Verschlüsselungstrojaner",
|
||||
vulnerability: "Fehlende Offline-Backups, Makro-Ausführung erlaubt",
|
||||
likelihood: 4,
|
||||
impact: 5,
|
||||
residual: [2, 4],
|
||||
treatment: "MITIGATE",
|
||||
status: "IN_TREATMENT",
|
||||
assets: [erp.id, crm.id],
|
||||
processId: auftrag.id,
|
||||
description: "Verschlüsselung der ERP-Datenbank würde die Auftragsabwicklung stoppen.",
|
||||
},
|
||||
{
|
||||
title: "Ausfall Cloud-Hoster",
|
||||
threat: "Ausfall des Rechenzentrums / Insolvenz Dienstleister",
|
||||
vulnerability: "Kein Ausweich-Standort, Single Provider",
|
||||
likelihood: 4,
|
||||
impact: 4,
|
||||
treatment: "TRANSFER",
|
||||
status: "OPEN",
|
||||
assets: [hoster.id, erp.id],
|
||||
processId: auftrag.id,
|
||||
},
|
||||
{
|
||||
title: "Phishing / Social Engineering",
|
||||
threat: "Gezielte Phishing-Kampagnen",
|
||||
vulnerability: "Fehlende Awareness-Schulungen",
|
||||
likelihood: 3,
|
||||
impact: 3,
|
||||
residual: [2, 3],
|
||||
treatment: "MITIGATE",
|
||||
status: "IN_TREATMENT",
|
||||
assets: [crm.id],
|
||||
},
|
||||
{
|
||||
title: "Verlust mobiler Geräte",
|
||||
threat: "Diebstahl/Verlust von Notebooks",
|
||||
vulnerability: "Unvollständige Festplattenverschlüsselung",
|
||||
likelihood: 2,
|
||||
impact: 3,
|
||||
treatment: "ACCEPT",
|
||||
status: "ACCEPTED",
|
||||
assets: [],
|
||||
},
|
||||
];
|
||||
|
||||
let refNo = 1;
|
||||
for (const r of risks) {
|
||||
const risk = await prisma.risk.create({
|
||||
data: {
|
||||
tenantId: tenant.id,
|
||||
refNo: refNo++,
|
||||
title: r.title,
|
||||
description: r.description,
|
||||
threat: r.threat,
|
||||
vulnerability: r.vulnerability,
|
||||
likelihood: r.likelihood,
|
||||
impact: r.impact,
|
||||
score: r.likelihood * r.impact,
|
||||
residualLikelihood: r.residual?.[0],
|
||||
residualImpact: r.residual?.[1],
|
||||
residualScore: r.residual ? r.residual[0] * r.residual[1] : undefined,
|
||||
treatment: r.treatment,
|
||||
status: r.status,
|
||||
ownerId: isb.id,
|
||||
processId: r.processId,
|
||||
},
|
||||
});
|
||||
for (const assetId of r.assets) {
|
||||
await prisma.riskAsset.create({
|
||||
data: { tenantId: tenant.id, riskId: risk.id, assetId },
|
||||
});
|
||||
}
|
||||
}
|
||||
console.log(`✔ ${risks.length} Beispiel-Risiken angelegt`);
|
||||
}
|
||||
|
||||
// 7. Beispiel-Maßnahmen (nur wenn noch keine existieren) — bestimmen das Rest-Risiko
|
||||
const measureCount = await prisma.measure.count({ where: { tenantId: tenant.id } });
|
||||
if (measureCount === 0) {
|
||||
const owner = await prisma.user.findUniqueOrThrow({
|
||||
where: { tenantId_email: { tenantId: tenant.id, email: "owner@demo.example" } },
|
||||
});
|
||||
const riskByTitle = (title: string) =>
|
||||
prisma.risk.findFirst({ where: { tenantId: tenant.id, title } });
|
||||
|
||||
const measures: {
|
||||
title: string;
|
||||
status: "OPEN" | "IN_PROGRESS" | "DONE";
|
||||
priority: "LOW" | "MEDIUM" | "HIGH";
|
||||
dueInDays?: number;
|
||||
riskTitle?: string;
|
||||
reduction?: [number, number]; // [Wahrscheinlichkeit, Schaden]
|
||||
}[] = [
|
||||
{
|
||||
title: "Offline-Backups einführen (3-2-1-Regel)",
|
||||
status: "IN_PROGRESS",
|
||||
priority: "HIGH",
|
||||
dueInDays: 14,
|
||||
riskTitle: "Ransomware auf ERP",
|
||||
reduction: [1, 1],
|
||||
},
|
||||
{
|
||||
title: "Makro-Ausführung per GPO einschränken",
|
||||
status: "OPEN",
|
||||
priority: "HIGH",
|
||||
dueInDays: 30,
|
||||
riskTitle: "Ransomware auf ERP",
|
||||
reduction: [1, 0],
|
||||
},
|
||||
{
|
||||
title: "Awareness-Schulung Phishing (alle Mitarbeitenden)",
|
||||
status: "IN_PROGRESS",
|
||||
priority: "MEDIUM",
|
||||
dueInDays: 45,
|
||||
riskTitle: "Phishing / Social Engineering",
|
||||
reduction: [1, 0],
|
||||
},
|
||||
{
|
||||
title: "Notfallhandbuch aktualisieren",
|
||||
status: "DONE",
|
||||
priority: "MEDIUM",
|
||||
},
|
||||
];
|
||||
|
||||
let mRef = 1;
|
||||
for (const m of measures) {
|
||||
const measure = await prisma.measure.create({
|
||||
data: {
|
||||
tenantId: tenant.id,
|
||||
refNo: mRef++,
|
||||
title: m.title,
|
||||
status: m.status,
|
||||
priority: m.priority,
|
||||
ownerId: owner.id,
|
||||
dueDate: m.dueInDays
|
||||
? new Date(Date.now() + m.dueInDays * 24 * 3600 * 1000)
|
||||
: undefined,
|
||||
},
|
||||
});
|
||||
if (m.riskTitle && m.reduction) {
|
||||
const risk = await riskByTitle(m.riskTitle);
|
||||
if (risk) {
|
||||
await prisma.riskMeasure.create({
|
||||
data: {
|
||||
tenantId: tenant.id,
|
||||
riskId: risk.id,
|
||||
measureId: measure.id,
|
||||
reductionLikelihood: m.reduction[0],
|
||||
reductionImpact: m.reduction[1],
|
||||
},
|
||||
});
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Rest-Risiken aus den Maßnahmen ableiten (manuelle Alt-Werte ersetzen)
|
||||
const allRisks = await prisma.risk.findMany({
|
||||
where: { tenantId: tenant.id },
|
||||
include: { riskMeasures: true },
|
||||
});
|
||||
for (const r of allRisks) {
|
||||
if (r.riskMeasures.length === 0) {
|
||||
await prisma.risk.update({
|
||||
where: { id: r.id },
|
||||
data: { residualLikelihood: null, residualImpact: null, residualScore: null },
|
||||
});
|
||||
} else {
|
||||
const redL = r.riskMeasures.reduce((s, x) => s + x.reductionLikelihood, 0);
|
||||
const redI = r.riskMeasures.reduce((s, x) => s + x.reductionImpact, 0);
|
||||
const rl = Math.max(1, r.likelihood - redL);
|
||||
const ri = Math.max(1, r.impact - redI);
|
||||
await prisma.risk.update({
|
||||
where: { id: r.id },
|
||||
data: { residualLikelihood: rl, residualImpact: ri, residualScore: rl * ri },
|
||||
});
|
||||
}
|
||||
}
|
||||
console.log(`✔ ${measures.length} Beispiel-Maßnahmen angelegt, Rest-Risiken berechnet`);
|
||||
}
|
||||
|
||||
// 8. Demo-Lieferanten als Assets (type SUPPLIER) mit Profil, Nachweisen, Verträgen
|
||||
const supCount = await prisma.supplierProfile.count({ where: { tenantId: tenant.id } });
|
||||
if (supCount === 0) {
|
||||
const hoster = await prisma.asset.findFirst({ where: { tenantId: tenant.id, name: "Cloud-Hoster (IaaS)" } });
|
||||
|
||||
const a1 = await prisma.asset.create({
|
||||
data: { tenantId: tenant.id, name: "Cloud-Hoster GmbH", type: "SUPPLIER", confidentiality: 3, integrity: 3, availability: 4 },
|
||||
});
|
||||
await prisma.supplierProfile.create({
|
||||
data: { tenantId: tenant.id, assetId: a1.id, refNo: 1, sector: "IT-Dienstleistung / IaaS", serviceDesc: "Rechenzentrum, Virtualisierung, Backup", criticality: 4, dataCategories: ["Kundendaten", "Auftragsdaten"], nis2Relevant: true, lifecycle: "ACTIVE", contact: "security@cloud-hoster.example", nextReview: new Date(Date.now() + 90 * 24 * 3600 * 1000) },
|
||||
});
|
||||
if (hoster) await prisma.assetRelation.create({ data: { tenantId: tenant.id, assetId: a1.id, relatedAssetId: hoster.id, type: "provides" } }).catch(() => {});
|
||||
await prisma.supplierEvidence.create({ data: { tenantId: tenant.id, assetId: a1.id, kind: "TISAX_LABEL", name: "TISAX AL3 (info high)", protectsCia: "C,I,A", validTo: new Date(Date.now() + 200 * 24 * 3600 * 1000), adequacyChecked: true } });
|
||||
await prisma.contract.create({ data: { tenantId: tenant.id, assetId: a1.id, type: "av_dpa", avDpa: true, securityClauses: true, flowdown: true, customerRequirementsPassed: true, validTo: new Date(Date.now() + 400 * 24 * 3600 * 1000), reference: "AV-2025-014" } });
|
||||
await prisma.nda.create({ data: { tenantId: tenant.id, assetId: a1.id, subject: "Betrieb der ERP-/CRM-Infrastruktur", parties: "Demo GmbH / Cloud-Hoster GmbH", validTo: new Date(Date.now() + 60 * 24 * 3600 * 1000), extensionStatus: "offen" } });
|
||||
await prisma.supplierAssessment.create({ data: { tenantId: tenant.id, assetId: a1.id, type: "SELF_ASSESSMENT", score: 82, date: new Date(Date.now() - 120 * 24 * 3600 * 1000), nextReview: new Date(Date.now() + 245 * 24 * 3600 * 1000), result: "angemessen" } });
|
||||
|
||||
const a2 = await prisma.asset.create({
|
||||
data: { tenantId: tenant.id, name: "WebAgentur X", type: "SUPPLIER", confidentiality: 2, integrity: 2, availability: 2 },
|
||||
});
|
||||
await prisma.supplierProfile.create({
|
||||
data: { tenantId: tenant.id, assetId: a2.id, refNo: 2, sector: "Webentwicklung", serviceDesc: "Website-Betrieb", criticality: 2, dataCategories: ["Marketingdaten"], nis2Relevant: false, lifecycle: "UNDER_REVIEW" },
|
||||
});
|
||||
|
||||
console.log("✔ 2 Demo-Lieferanten als Assets angelegt");
|
||||
}
|
||||
|
||||
// 9. Demo-IT-Service (type IT_SERVICE) mit RACI-Matrix über den ISA-Katalog
|
||||
const svcCount = await prisma.iTServiceProfile.count({ where: { tenantId: tenant.id } });
|
||||
if (svcCount === 0) {
|
||||
const provider = await prisma.asset.findFirst({ where: { tenantId: tenant.id, name: "Cloud-Hoster GmbH", type: "SUPPLIER" } });
|
||||
const svc = await prisma.asset.create({
|
||||
data: { tenantId: tenant.id, name: "Managed ERP-Hosting", type: "IT_SERVICE", confidentiality: 3, integrity: 3, availability: 4 },
|
||||
});
|
||||
await prisma.iTServiceProfile.create({
|
||||
data: { tenantId: tenant.id, assetId: svc.id, refNo: 1, criticality: 4, internal: false, providerAssetId: provider?.id ?? null, notes: "Betrieb & Wartung der ERP-Plattform beim Cloud-Hoster (Shared Responsibility)." },
|
||||
});
|
||||
const raci: { controlRef: string; title: string; responsibility: "PROVIDER" | "US" | "SHARED"; evidenceRef?: string }[] = [
|
||||
{ controlRef: "4.1.2", title: "Authentisierung / MFA", responsibility: "SHARED", evidenceRef: "IAM-Konzept v2" },
|
||||
{ controlRef: "5.2.4", title: "Schwachstellen-/Patch-Management", responsibility: "PROVIDER", evidenceRef: "Patch-SLA" },
|
||||
{ controlRef: "5.2.5", title: "Datensicherung / Backup", responsibility: "PROVIDER", evidenceRef: "Backup-Report Q2" },
|
||||
{ controlRef: "4.1.3", title: "Zugriffsrechte-Verwaltung", responsibility: "US" },
|
||||
{ controlRef: "1.6.1", title: "Informationssicherheits-Vorfälle", responsibility: "SHARED", evidenceRef: "IR-Runbook" },
|
||||
];
|
||||
for (const r of raci) {
|
||||
await prisma.serviceControlResponsibility.create({
|
||||
data: { tenantId: tenant.id, assetId: svc.id, controlRef: r.controlRef, title: r.title, applicable: true, responsibility: r.responsibility, evidenceRef: r.evidenceRef ?? null },
|
||||
});
|
||||
}
|
||||
console.log("✔ 1 Demo-IT-Service mit RACI-Matrix angelegt");
|
||||
}
|
||||
|
||||
// 9b. Demo-Vorfälle (Modul „Vorfälle", IM-A) — 1–2 Beispiele im Demo-Mandanten
|
||||
const incidentCount = await prisma.incident.count({ where: { tenantId: tenant.id } });
|
||||
if (incidentCount === 0) {
|
||||
const isb = await prisma.user.findUnique({
|
||||
where: { tenantId_email: { tenantId: tenant.id, email: "admin@demo.example" } },
|
||||
});
|
||||
const owner = await prisma.user.findUnique({
|
||||
where: { tenantId_email: { tenantId: tenant.id, email: "owner@demo.example" } },
|
||||
});
|
||||
const crm = await prisma.asset.findFirst({ where: { tenantId: tenant.id, name: "Kundendatenbank" } });
|
||||
const erp = await prisma.asset.findFirst({ where: { tenantId: tenant.id, name: "ERP-System" } });
|
||||
const vertrieb = await prisma.process.findFirst({ where: { tenantId: tenant.id, name: "Kundenbetreuung" } });
|
||||
const year = new Date().getFullYear();
|
||||
|
||||
// Vorfall 1: Phishing (mittlerer Schweregrad), in Bearbeitung, mit betroffenem Asset/Prozess.
|
||||
const inc1 = await prisma.incident.create({
|
||||
data: {
|
||||
tenantId: tenant.id,
|
||||
refNo: `INC-${year}-0001`,
|
||||
title: "Phishing-Welle gegen Vertriebsmitarbeitende",
|
||||
description: "Mehrere Mitarbeitende meldeten gefälschte E-Mails mit Login-Aufforderung. Ein Konto könnte kompromittiert sein.",
|
||||
source: "manual",
|
||||
reporterName: "Helpdesk",
|
||||
reporterContact: "helpdesk@demo.example",
|
||||
detectedAt: new Date(Date.now() - 2 * 24 * 3600 * 1000),
|
||||
occurredAt: new Date(Date.now() - 3 * 24 * 3600 * 1000),
|
||||
reportedAt: new Date(Date.now() - 2 * 24 * 3600 * 1000),
|
||||
category: "phishing",
|
||||
impactC: 3,
|
||||
impactI: 1,
|
||||
impactA: 0,
|
||||
urgency: 3,
|
||||
severity: "hoch",
|
||||
priority: "hoch",
|
||||
personalData: true,
|
||||
dsgvoRelevant: true,
|
||||
nis2Relevant: false,
|
||||
status: "in_bearbeitung",
|
||||
ownerId: isb?.id ?? null,
|
||||
assigneeId: owner?.id ?? null,
|
||||
createdBy: isb?.id ?? null,
|
||||
},
|
||||
});
|
||||
if (crm) await prisma.incidentAsset.create({ data: { tenantId: tenant.id, incidentId: inc1.id, assetId: crm.id } });
|
||||
if (vertrieb) await prisma.incidentProcess.create({ data: { tenantId: tenant.id, incidentId: inc1.id, processId: vertrieb.id } });
|
||||
await prisma.incidentComment.create({
|
||||
data: { tenantId: tenant.id, incidentId: inc1.id, authorId: isb?.id ?? null, body: "Betroffene Konten gesperrt, Passwort-Reset veranlasst.", internal: false },
|
||||
});
|
||||
|
||||
// Vorfall 2: Kurzer ERP-Ausfall, bereits abgeschlossen (mit Ursache/Lösung/Lessons Learned).
|
||||
const inc2 = await prisma.incident.create({
|
||||
data: {
|
||||
tenantId: tenant.id,
|
||||
refNo: `INC-${year}-0002`,
|
||||
title: "Kurzzeitiger Ausfall des ERP-Systems",
|
||||
description: "Das ERP-System war rund 40 Minuten nicht erreichbar (Speicherengpass auf dem Applikationsserver).",
|
||||
source: "manual",
|
||||
reporterName: "IT-Betrieb",
|
||||
category: "outage",
|
||||
impactC: 0,
|
||||
impactI: 0,
|
||||
impactA: 3,
|
||||
urgency: 2,
|
||||
severity: "mittel",
|
||||
priority: "mittel",
|
||||
status: "abgeschlossen",
|
||||
rootCause: "Fehlende Überwachung des Speicherverbrauchs führte zu einem OOM-Neustart.",
|
||||
resolution: "Dienst neu gestartet, Speicherlimits angehoben.",
|
||||
closingNote: "Betrieb nach 40 Minuten wiederhergestellt, kein Datenverlust.",
|
||||
lessonsLearned: "Monitoring der Ressourcen-Auslastung mit Schwellwert-Alarm einrichten.",
|
||||
ownerId: isb?.id ?? null,
|
||||
createdBy: isb?.id ?? null,
|
||||
},
|
||||
});
|
||||
if (erp) await prisma.incidentAsset.create({ data: { tenantId: tenant.id, incidentId: inc2.id, assetId: erp.id } });
|
||||
|
||||
console.log("✔ 2 Demo-Vorfälle angelegt");
|
||||
}
|
||||
|
||||
// 10. Richtlinien & Verfahren aus dem VDA-ISA-2027-Vorlagenpaket importieren
|
||||
// AP1: Framework-Zuordnung des Demo-Mandanten (er wird direkt per upsert angelegt,
|
||||
// nicht über provisionTenant) — TISAX als Primär-Framework.
|
||||
await prisma.tenantFramework.upsert({
|
||||
where: { tenantId_framework: { tenantId: tenant.id, framework: "TISAX" } },
|
||||
update: {},
|
||||
create: { tenantId: tenant.id, framework: "TISAX", isPrimary: true },
|
||||
});
|
||||
const seedDir = join(__dirname, "..", "seed", "isms-vorlagenpaket-v2");
|
||||
const pc = await importPolicies(prisma, tenant.id, seedDir);
|
||||
await stampPackageState(prisma, tenant.id, seedDir); // Story B6: Paket-Version stempeln
|
||||
// Umsetzungshinweise (C6, Story B5) — globaler Katalog, einmalig/idempotent.
|
||||
const hintCount = await importImplementationHints(prisma);
|
||||
// Standard-Risikokatalog (C4, Story A6) — globaler Katalog, einmalig/idempotent.
|
||||
const riskCatCount = await importRiskCatalog(prisma);
|
||||
// Standard-Prozess-Katalog (M2) wird bereits oben über seedGlobalContent geseedet.
|
||||
const processCatCount = globalContent.processCatalog;
|
||||
// Demo-Werte für Variablen ohne Schema-Default (damit die Doku vollständig wirkt)
|
||||
const demoVars: Record<string, string> = {
|
||||
ORG_NAME: "GEFIM Demo GmbH",
|
||||
ORG_SHORT: "GEFIM",
|
||||
ISMS_SCOPE: "IT-Betrieb & Softwareentwicklung",
|
||||
ISMS_SCOPE_DESCRIPTION: "IT-Betrieb, Softwareentwicklung und zugehörige Unterstützungsprozesse am Standort Zentrale",
|
||||
DOC_DATE: "2026-07-07",
|
||||
};
|
||||
for (const [key, value] of Object.entries(demoVars)) {
|
||||
await prisma.policyVariable.updateMany({ where: { tenantId: tenant.id, key }, data: { value } });
|
||||
}
|
||||
console.log(`✔ Richtlinienpaket importiert: ${pc.documents} Dokumente, ${pc.requirements} Anforderungen, ${pc.variables} Variablen, ${pc.baseline} Baseline-Parameter`);
|
||||
console.log(`✔ Umsetzungshinweise (C6) importiert: ${hintCount} Hinweise`);
|
||||
console.log(`✔ Risikokatalog (C4) importiert: ${riskCatCount} Katalog-Risiken`);
|
||||
console.log(`✔ Prozess-Katalog (M2) importiert: ${processCatCount} Standard-Prozesse`);
|
||||
|
||||
const mc = await importManaged(prisma, tenant.id);
|
||||
console.log(`✔ Verwaltete Register: Krypto ${mc.crypto}, Klassifizierung ${mc.classes}×${mc.aspects}, Risikomatrix (${mc.damage} Schadensdim.), Handbuch ${mc.handbook} Themen`);
|
||||
|
||||
// 11. Admin-Konsole: Mandanten-Einstellungen, Module, Plattform-Admin (getrennter Store)
|
||||
// Demo-Plattform-Admin: gleiche Adresse wie der Mandanten-Admin, damit /login (Mandant)
|
||||
// und /platform/login (Betrieb) mit denselben Demo-Zugangsdaten funktionieren. MFA wird
|
||||
// beim ersten Plattform-Login eingerichtet.
|
||||
await prisma.platformAdmin.upsert({
|
||||
where: { email: "admin@demo.example" },
|
||||
update: { name: "Anna Admin", status: "ACTIVE" },
|
||||
create: { email: "admin@demo.example", name: "Anna Admin", passwordHash: await hashPassword("Demo1234!"), status: "ACTIVE" },
|
||||
});
|
||||
await prisma.tenantSettings.upsert({
|
||||
where: { tenantId: tenant.id },
|
||||
update: {},
|
||||
create: {
|
||||
tenantId: tenant.id,
|
||||
orgName: "GEFIM Demo GmbH",
|
||||
orgShort: "GEFIM",
|
||||
sector: "IT-Dienstleistung",
|
||||
ismsScope: "IT-Betrieb & Softwareentwicklung",
|
||||
ismsScopeDescription: "IT-Betrieb, Softwareentwicklung und zugehörige Unterstützungsprozesse am Standort Zentrale",
|
||||
roleManagement: "Geschäftsführung",
|
||||
roleIsb: "Informationssicherheitsbeauftragte(r) (ISB)",
|
||||
roleItLead: "IT-Leitung",
|
||||
roleDpo: "Datenschutzbeauftragte(r) (DSB)",
|
||||
tisaxLevel: "AL2",
|
||||
await prisma.tenantSettings.update({
|
||||
where: { tenantId: demo.id },
|
||||
data: {
|
||||
address: "Hafenstraße 12, 20457 Hamburg",
|
||||
phone: "+49 40 123456-0",
|
||||
email: "info@musterbau.example",
|
||||
},
|
||||
});
|
||||
for (const key of MODULE_KEYS) {
|
||||
await prisma.tenantModule.upsert({
|
||||
where: { tenantId_moduleKey: { tenantId: tenant.id, moduleKey: key } },
|
||||
update: {},
|
||||
create: { tenantId: tenant.id, moduleKey: key, enabled: true },
|
||||
});
|
||||
}
|
||||
console.log(`✔ Admin-Konsole: Einstellungen, ${MODULE_KEYS.length} Module aktiv; Plattform-Admin admin@demo.example (getrennter Login /platform/login, MFA beim ersten Login)`);
|
||||
const demoUsers: { email: string; name: string; roles: RoleKey[] }[] = [
|
||||
{ email: "admin@demo.example", name: "Anna Admin", roles: ["tenant-admin"] },
|
||||
{ email: "backoffice@demo.example", name: "Bernd Backoffice", roles: ["backoffice"] },
|
||||
{ email: "teamleiter@demo.example", name: "Tina Teamleiter", roles: ["team-lead"] },
|
||||
{ email: "monteur@demo.example", name: "Max Monteur", roles: ["technician"] },
|
||||
];
|
||||
for (const u of demoUsers) await ensureMember(demo.id, u, passwordHash);
|
||||
console.log(`✔ Mandant "demo" (${PERMISSIONS.length} Permissions) mit ${demoUsers.length} Nutzern (Passwort: ${DEMO_PASSWORD})`);
|
||||
|
||||
// 2. Zweiter Mandant „demo2" — Grundlage für Isolations- und Tenant-Switch-Tests.
|
||||
const demo2 = await provisionTenant(prisma, {
|
||||
name: "Nordlicht Elektro GmbH",
|
||||
slug: "demo2",
|
||||
short: "Nordlicht",
|
||||
sector: "Elektro",
|
||||
admin: { email: "admin2@demo.example", name: "Zoe Zweitadmin", password: DEMO_PASSWORD },
|
||||
});
|
||||
console.log(`✔ Mandant "demo2" mit Admin admin2@demo.example`);
|
||||
|
||||
// 3. Multi-Membership-Fixture: eine Identity in ZWEI Mandanten mit je anderer Rolle.
|
||||
const multi = { email: "multi@demo.example", name: "Mika Multi" };
|
||||
await ensureMember(demo.id, { ...multi, roles: ["technician"] }, passwordHash);
|
||||
await ensureMember(demo2.id, { ...multi, roles: ["tenant-admin"] }, passwordHash);
|
||||
console.log(`✔ Multi-Membership-Fixture multi@demo.example (demo: Monteur, demo2: Mandantenadministrator)`);
|
||||
|
||||
// 4. Plattform-Admin (getrennter Store, Login unter /platform/login).
|
||||
await prisma.platformAdmin.upsert({
|
||||
where: { email: "platform@demo.example" },
|
||||
update: { name: "Paula Plattform", status: "ACTIVE" },
|
||||
create: { email: "platform@demo.example", name: "Paula Plattform", passwordHash, status: "ACTIVE" },
|
||||
});
|
||||
console.log(`✔ Plattform-Admin platform@demo.example (/platform/login)`);
|
||||
}
|
||||
|
||||
main()
|
||||
|
||||
@@ -1,205 +0,0 @@
|
||||
import type { PrismaClient, Framework } from "@prisma/client";
|
||||
import type { ParsedPackage, ParsedDoc } from "./import-policies";
|
||||
import { parsePackageFiles, readPackageVersion, mappingFileFor } from "./import-policies";
|
||||
|
||||
/**
|
||||
* Globale DB-Vorlagenablage (Plattform-Ebene). Master-Quelle für den Mandanten-Import:
|
||||
* eine `PolicyTemplateVersion` je Paketversion mit Inhalten je Sprache (`locale`).
|
||||
*
|
||||
* - `syncTemplatesFromParsed`: schreibt ein `ParsedPackage` (aus den Dateien geparst)
|
||||
* für eine Sprache in eine Version. Für eine bestehende Version werden die Inhalte
|
||||
* dieser Sprache vollständig ersetzt (idempotent). Sicher, weil die Vorlagen-Tabellen
|
||||
* keine Mandanten-/Nutzerdaten enthalten.
|
||||
* - `loadPublishedPackage`: liest die aktuell veröffentlichte Version in der gewünschten
|
||||
* Sprache als `ParsedPackage` — dieselbe Struktur wie der Datei-Parser, sodass der
|
||||
* non-destruktive Mandanten-Reconcile identisch damit arbeitet. Liefert null, wenn es
|
||||
* keine veröffentlichte Version bzw. keine Inhalte in der Sprache gibt (→ Datei-Fallback).
|
||||
*/
|
||||
|
||||
type DocType = ParsedDoc["type"];
|
||||
|
||||
/** Ein Datei-Paket (eine Sprache) in eine Vorlagen-Version schreiben; Inhalte der Sprache ersetzen. */
|
||||
export async function syncTemplatesFromParsed(
|
||||
prisma: PrismaClient,
|
||||
pkg: ParsedPackage,
|
||||
locale: string,
|
||||
framework: Framework = "TISAX",
|
||||
options: { publish?: boolean; publishedBy?: string | null } = {},
|
||||
): Promise<{ versionId: string; version: string }> {
|
||||
const publish = options.publish ?? true;
|
||||
// Eindeutigkeit je (Framework, Version): ISO 2.1 und TISAX 2.1 sind verschiedene Zeilen.
|
||||
const existing = await prisma.policyTemplateVersion.findUnique({
|
||||
where: { framework_version: { framework, version: pkg.version } },
|
||||
});
|
||||
const version =
|
||||
existing ??
|
||||
(await prisma.policyTemplateVersion.create({
|
||||
data: {
|
||||
framework,
|
||||
version: pkg.version,
|
||||
status: publish ? "PUBLISHED" : "DRAFT",
|
||||
publishedBy: publish ? (options.publishedBy ?? null) : null,
|
||||
publishedAt: publish ? new Date() : null,
|
||||
},
|
||||
}));
|
||||
if (existing && publish && existing.status !== "PUBLISHED") {
|
||||
await prisma.policyTemplateVersion.update({
|
||||
where: { id: existing.id },
|
||||
data: { status: "PUBLISHED", publishedAt: new Date(), publishedBy: options.publishedBy ?? null },
|
||||
});
|
||||
}
|
||||
|
||||
const versionId = version.id;
|
||||
// Inhalte dieser Sprache vollständig ersetzen (idempotenter Sync).
|
||||
await prisma.$transaction([
|
||||
prisma.policyTemplateDoc.deleteMany({ where: { versionId, locale } }),
|
||||
prisma.policyTemplateRequirement.deleteMany({ where: { versionId, locale } }),
|
||||
prisma.policyTemplateVariable.deleteMany({ where: { versionId, locale } }),
|
||||
prisma.policyTemplateBaselineParam.deleteMany({ where: { versionId, locale } }),
|
||||
prisma.policyTemplateEvidence.deleteMany({ where: { versionId, locale } }),
|
||||
prisma.policyTemplateDoc.createMany({
|
||||
data: pkg.documents.map((d) => ({
|
||||
versionId, locale, code: d.code, type: d.type, title: d.title,
|
||||
policyCode: d.policyCode, fulfills: d.fulfills, rawMarkdown: d.rawMarkdown, orderIdx: d.orderIdx,
|
||||
})),
|
||||
}),
|
||||
prisma.policyTemplateRequirement.createMany({
|
||||
data: pkg.requirements.map((r) => ({
|
||||
versionId, locale, reqId: r.reqId, policyCode: r.policyCode, control: r.control,
|
||||
obligation: r.obligation, condition: r.condition, requirement: r.requirement,
|
||||
implementation: r.implementation, vaCodes: r.vaCodes, nachweisLink: r.nachweisLink,
|
||||
})),
|
||||
}),
|
||||
prisma.policyTemplateVariable.createMany({
|
||||
data: pkg.variables.map((v) => ({
|
||||
versionId, locale, key: v.key, title: v.title, kind: v.kind,
|
||||
groupName: v.groupName, value: v.value, required: v.required, orderIdx: v.orderIdx,
|
||||
})),
|
||||
}),
|
||||
prisma.policyTemplateBaselineParam.createMany({
|
||||
data: pkg.baseline.map((b) => ({
|
||||
versionId, locale, blId: b.blId, section: b.section, name: b.name, vorgabe: b.vorgabe, orderIdx: b.orderIdx,
|
||||
})),
|
||||
}),
|
||||
prisma.policyTemplateEvidence.createMany({
|
||||
data: pkg.evidence.map((e) => ({
|
||||
versionId, locale, nr: e.nr, policyCode: e.policyCode, nachweis: e.nachweis,
|
||||
quelle: e.quelle, verantwortlich: e.verantwortlich, turnus: e.turnus,
|
||||
})),
|
||||
}),
|
||||
]);
|
||||
|
||||
return { versionId, version: version.version };
|
||||
}
|
||||
|
||||
/**
|
||||
* Aktuell veröffentlichte Vorlagen-Version in der gewünschten Sprache als `ParsedPackage`.
|
||||
* Liefert null, wenn keine veröffentlichte Version existiert oder die Sprache keine
|
||||
* Dokumente enthält (→ Aufrufer nutzt den Datei-Fallback).
|
||||
*/
|
||||
export async function loadPublishedPackage(
|
||||
prisma: PrismaClient,
|
||||
locale: string,
|
||||
framework: Framework = "TISAX",
|
||||
): Promise<ParsedPackage | null> {
|
||||
const version = await prisma.policyTemplateVersion.findFirst({
|
||||
where: { status: "PUBLISHED", framework },
|
||||
orderBy: [{ publishedAt: "desc" }, { createdAt: "desc" }],
|
||||
});
|
||||
if (!version) return null;
|
||||
|
||||
const [docs, reqs, vars, baseline, evidence] = await Promise.all([
|
||||
prisma.policyTemplateDoc.findMany({ where: { versionId: version.id, locale }, orderBy: { orderIdx: "asc" } }),
|
||||
prisma.policyTemplateRequirement.findMany({ where: { versionId: version.id, locale }, orderBy: { orderIdx: "asc" } }),
|
||||
prisma.policyTemplateVariable.findMany({ where: { versionId: version.id, locale }, orderBy: { orderIdx: "asc" } }),
|
||||
prisma.policyTemplateBaselineParam.findMany({ where: { versionId: version.id, locale }, orderBy: { orderIdx: "asc" } }),
|
||||
prisma.policyTemplateEvidence.findMany({ where: { versionId: version.id, locale }, orderBy: { nr: "asc" } }),
|
||||
]);
|
||||
if (docs.length === 0) return null; // Sprache (noch) nicht befüllt → Fallback
|
||||
|
||||
return {
|
||||
version: version.version,
|
||||
documents: docs.map((d) => ({
|
||||
code: d.code, type: d.type as DocType, title: d.title, policyCode: d.policyCode,
|
||||
fulfills: d.fulfills, rawMarkdown: d.rawMarkdown, orderIdx: d.orderIdx,
|
||||
})),
|
||||
requirements: reqs.map((r) => ({
|
||||
reqId: r.reqId, policyCode: r.policyCode, control: r.control, obligation: r.obligation,
|
||||
condition: r.condition, requirement: r.requirement, implementation: r.implementation,
|
||||
vaCodes: r.vaCodes, nachweisLink: r.nachweisLink,
|
||||
})),
|
||||
variables: vars.map((v) => ({
|
||||
key: v.key, title: v.title, kind: v.kind, groupName: v.groupName,
|
||||
value: v.value, required: v.required, orderIdx: v.orderIdx,
|
||||
})),
|
||||
baseline: baseline.map((b) => ({
|
||||
blId: b.blId, section: b.section, name: b.name, vorgabe: b.vorgabe, orderIdx: b.orderIdx,
|
||||
})),
|
||||
evidence: evidence.map((e) => ({
|
||||
nr: e.nr, policyCode: e.policyCode, nachweis: e.nachweis, quelle: e.quelle,
|
||||
verantwortlich: e.verantwortlich, turnus: e.turnus,
|
||||
})),
|
||||
};
|
||||
}
|
||||
|
||||
/** Sprachpräferenz eines Mandanten (Default "de"). Owner-Client (RLS-Bypass) — für Plattform- UND Mandanten-Aufrufer nutzbar. */
|
||||
export async function getTenantLocale(prisma: PrismaClient, tenantId: string): Promise<string> {
|
||||
const s = await prisma.tenantSettings.findUnique({ where: { tenantId }, select: { locale: true } });
|
||||
return s?.locale ?? "de";
|
||||
}
|
||||
|
||||
/**
|
||||
* Auflösen des Vorlagenpakets für einen Mandanten: veröffentlichte DB-Version in der
|
||||
* Sprache des Mandanten → DE-Fallback → Datei-Fallback. So funktioniert der Import
|
||||
* identisch, egal ob die DB-Ablage schon befüllt ist.
|
||||
*/
|
||||
export async function resolvePackageForTenant(
|
||||
prisma: PrismaClient,
|
||||
tenantId: string,
|
||||
seedDir: string,
|
||||
framework: Framework = "TISAX",
|
||||
): Promise<{ pkg: ParsedPackage; source: "db" | "file"; locale: string }> {
|
||||
const locale = await getTenantLocale(prisma, tenantId);
|
||||
const inLocale = await loadPublishedPackage(prisma, locale, framework);
|
||||
if (inLocale) return { pkg: inLocale, source: "db", locale };
|
||||
if (locale !== "de") {
|
||||
const de = await loadPublishedPackage(prisma, "de", framework);
|
||||
if (de) return { pkg: de, source: "db", locale: "de" };
|
||||
}
|
||||
// Datei-Fallback: das framework-passende Mapping (mapping.json / mapping-iso.json).
|
||||
return { pkg: parsePackageFiles(seedDir, mappingFileFor(framework)), source: "file", locale };
|
||||
}
|
||||
|
||||
/** Verfügbare Paketversion für den Update-Vergleich: veröffentlichte DB-Version, sonst Datei-Version. */
|
||||
export async function getAvailableVersion(
|
||||
prisma: PrismaClient,
|
||||
seedDir: string,
|
||||
framework: Framework = "TISAX",
|
||||
): Promise<string> {
|
||||
const v = await prisma.policyTemplateVersion.findFirst({
|
||||
where: { status: "PUBLISHED", framework },
|
||||
orderBy: [{ publishedAt: "desc" }, { createdAt: "desc" }],
|
||||
select: { version: true },
|
||||
});
|
||||
return v?.version ?? readPackageVersion(seedDir, mappingFileFor(framework));
|
||||
}
|
||||
|
||||
/**
|
||||
* Frameworks eines Mandanten (AP1), Primär-Framework zuerst. Fällt auf `["TISAX"]`
|
||||
* zurück, falls (noch) keine `TenantFramework`-Zeile existiert — so bleibt jeder
|
||||
* Bestands-/Alt-Mandant ohne Zeile als TISAX lauffähig (Fail-safe zu Invariante 3).
|
||||
* Owner-Client (RLS-Bypass) — für Plattform- UND Mandanten-Aufrufer nutzbar.
|
||||
*/
|
||||
export async function getTenantFrameworks(prisma: PrismaClient, tenantId: string): Promise<Framework[]> {
|
||||
const rows = await prisma.tenantFramework.findMany({
|
||||
where: { tenantId },
|
||||
orderBy: [{ isPrimary: "desc" }, { createdAt: "asc" }],
|
||||
select: { framework: true },
|
||||
});
|
||||
return rows.length ? rows.map((r) => r.framework) : ["TISAX"];
|
||||
}
|
||||
|
||||
/** Primär-Framework eines Mandanten (erstes aus {@link getTenantFrameworks}). */
|
||||
export async function getTenantPrimaryFramework(prisma: PrismaClient, tenantId: string): Promise<Framework> {
|
||||
return (await getTenantFrameworks(prisma, tenantId))[0];
|
||||
}
|
||||
Reference in New Issue
Block a user