Basis: Certvia dev@a48c5fb als Fundament für Craftvia

Unveränderter Stand von certvia/dev (a48c5fb) plus Craftvia-Spezifikation
und Brandbook unter docs/craftvia/. ISMS-Module werden im Folgecommit entfernt.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/server/audit.ts

@@ -0,0 +1,56 @@
+import { prisma } from "./db";
+
+/**
+ * Audit trail (SPEC §5 AuditLog, §10): every writing action creates an entry.
+ * Uses the raw client on purpose — audit writes must never be silently
+ * filtered, and tenantId is passed explicitly by the caller.
+ */
+export async function writeAuditLog(entry: {
+  tenantId: string;
+  actorId?: string;
+  action: "create" | "update" | "delete" | "login" | "logout" | "export" | "import" | "denied";
+  scope?: "tenant" | "platform";
+  entity: string;
+  entityId?: string;
+  before?: unknown;
+  after?: unknown;
+}) {
+  await prisma.auditLog.create({
+    data: {
+      tenantId: entry.tenantId,
+      scope: entry.scope ?? "tenant",
+      actorId: entry.actorId,
+      action: entry.action,
+      entity: entry.entity,
+      entityId: entry.entityId,
+      before: entry.before as object | undefined,
+      after: entry.after as object | undefined,
+    },
+  });
+}
+
+/**
+ * Audit-Eintrag der Plattform-Ebene (kein Mandantenbezug, scope="platform").
+ * Für Superadmin-Anmeldungen und -Aktionen (Phase-1-Härtung Paket 2).
+ */
+export async function writePlatformAudit(entry: {
+  actorId?: string;
+  action: "create" | "update" | "delete" | "login" | "logout" | "export" | "import" | "denied";
+  entity: string;
+  entityId?: string;
+  before?: unknown;
+  after?: unknown;
+}) {
+  await prisma.auditLog.create({
+    data: {
+      tenantId: null,
+      scope: "platform",
+      actorId: entry.actorId,
+      action: entry.action,
+      entity: entry.entity,
+      entityId: entry.entityId,
+      before: entry.before as object | undefined,
+      after: entry.after as object | undefined,
+    },
+  });
+}