Basis: Certvia dev@a48c5fb als Fundament für Craftvia

Unveränderter Stand von certvia/dev (a48c5fb) plus Craftvia-Spezifikation und Brandbook unter docs/craftvia/. ISMS-Module werden im Folgecommit entfernt. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-14 11:05:39 +02:00
commit c8e6f30a27
720 changed files with 140143 additions and 0 deletions
@@ -0,0 +1,67 @@
+-- CreateEnum
+CREATE TYPE "Framework" AS ENUM ('ISO_27001', 'TISAX');
+
+-- DropIndex
+DROP INDEX "policy_package_states_tenant_id_key";
+
+-- DropIndex
+DROP INDEX "policy_template_versions_version_key";
+
+-- AlterTable
+ALTER TABLE "policy_package_states" ADD COLUMN     "framework" "Framework" NOT NULL DEFAULT 'TISAX';
+
+-- AlterTable
+ALTER TABLE "policy_requirements" ADD COLUMN     "framework" "Framework" NOT NULL DEFAULT 'TISAX';
+
+-- AlterTable
+ALTER TABLE "policy_template_versions" ADD COLUMN     "framework" "Framework" NOT NULL DEFAULT 'TISAX';
+
+-- CreateTable
+CREATE TABLE "tenant_frameworks" (
+    "id" TEXT NOT NULL,
+    "tenant_id" TEXT NOT NULL,
+    "framework" "Framework" NOT NULL,
+    "is_primary" BOOLEAN NOT NULL DEFAULT false,
+    "config" JSONB,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "tenant_frameworks_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "tenant_frameworks_tenant_id_idx" ON "tenant_frameworks"("tenant_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "tenant_frameworks_tenant_id_framework_key" ON "tenant_frameworks"("tenant_id", "framework");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "policy_package_states_tenant_id_framework_key" ON "policy_package_states"("tenant_id", "framework");
+
+-- CreateIndex
+CREATE INDEX "policy_requirements_tenant_id_framework_idx" ON "policy_requirements"("tenant_id", "framework");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "policy_template_versions_framework_version_key" ON "policy_template_versions"("framework", "version");
+
+
+-- ─────────────────────────────────────────────────────────────────────────────
+-- AP1 — Framework-Dimension: Backfill + RLS (manuell an das Diff-DDL angehängt).
+-- ─────────────────────────────────────────────────────────────────────────────
+
+-- Backfill: Bestandsmandanten führen bisher TISAX → je Mandant eine TenantFramework-
+-- Zeile (isPrimary=true) anlegen. Idempotent über den (tenant_id, framework)-Unique.
+-- Die framework-Spalten in policy_requirements/policy_package_states/
+-- policy_template_versions sind bereits über DEFAULT 'TISAX' backfilled (s. o.).
+INSERT INTO "tenant_frameworks" ("id", "tenant_id", "framework", "is_primary", "created_at")
+SELECT gen_random_uuid()::text, t."id", 'TISAX', true, CURRENT_TIMESTAMP
+FROM "tenants" t
+ON CONFLICT ("tenant_id", "framework") DO NOTHING;
+
+-- Row Level Security auf der mandantengebundenen Framework-Tabelle (F-04-Muster:
+-- FORCE + WITH CHECK für den scharfen isms_app-Pfad, analog übrige Mandanten-Tabellen).
+ALTER TABLE "tenant_frameworks" ENABLE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS tenant_isolation ON "tenant_frameworks";
+CREATE POLICY tenant_isolation ON "tenant_frameworks"
+  USING ("tenant_id" = current_setting('app.tenant_id', true))
+  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
+ALTER TABLE "tenant_frameworks" FORCE ROW LEVEL SECURITY;