Basis: Certvia dev@a48c5fb als Fundament für Craftvia

Unveränderter Stand von certvia/dev (a48c5fb) plus Craftvia-Spezifikation und Brandbook unter docs/craftvia/. ISMS-Module werden im Folgecommit entfernt. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-14 11:05:39 +02:00
commit c8e6f30a27
720 changed files with 140143 additions and 0 deletions
@@ -0,0 +1,43 @@
+-- Modul „Vorfälle" IM-C: Verknüpfung Nachweise + Abschluss-Felder (§8/§9).
+--
+-- 1) incidents: Wirksamkeit der Maßnahmen + optionaler Post-Incident-Review
+--    (Kurzbericht, speist das Management-Review als Feld/Notiz).
+-- 2) incident_evidence: n:m-Verknüpfung Vorfall ↔ zentrales Evidence-Modell
+--    (Beweissicherung, ISO A.5.28).
+
+-- AlterTable
+ALTER TABLE "incidents" ADD COLUMN     "measures_effectiveness" TEXT,
+ADD COLUMN     "post_incident_review" TEXT;
+
+-- CreateTable
+CREATE TABLE "incident_evidence" (
+    "id" TEXT NOT NULL,
+    "tenant_id" TEXT NOT NULL,
+    "incident_id" TEXT NOT NULL,
+    "evidence_id" TEXT NOT NULL,
+    "note" TEXT,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "incident_evidence_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "incident_evidence_tenant_id_idx" ON "incident_evidence"("tenant_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "incident_evidence_incident_id_evidence_id_key" ON "incident_evidence"("incident_id", "evidence_id");
+
+-- AddForeignKey
+ALTER TABLE "incident_evidence" ADD CONSTRAINT "incident_evidence_incident_id_fkey" FOREIGN KEY ("incident_id") REFERENCES "incidents"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "incident_evidence" ADD CONSTRAINT "incident_evidence_evidence_id_fkey" FOREIGN KEY ("evidence_id") REFERENCES "evidence"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- Row Level Security (analog übrige Mandanten-Tabellen; FORCE + WITH CHECK für den
+-- scharfen isms_app-Pfad, F-04). Lokal (Owner-Rolle ohne FORCE) unverändert.
+ALTER TABLE "incident_evidence" ENABLE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS tenant_isolation ON "incident_evidence";
+CREATE POLICY tenant_isolation ON "incident_evidence"
+  USING ("tenant_id" = current_setting('app.tenant_id', true))
+  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
+ALTER TABLE "incident_evidence" FORCE ROW LEVEL SECURITY;