-- Modul „Vorfälle" IM-C: Verknüpfung Nachweise + Abschluss-Felder (§8/§9).
--
-- 1) incidents: Wirksamkeit der Maßnahmen + optionaler Post-Incident-Review
--    (Kurzbericht, speist das Management-Review als Feld/Notiz).
-- 2) incident_evidence: n:m-Verknüpfung Vorfall ↔ zentrales Evidence-Modell
--    (Beweissicherung, ISO A.5.28).

-- AlterTable
ALTER TABLE "incidents" ADD COLUMN     "measures_effectiveness" TEXT,
ADD COLUMN     "post_incident_review" TEXT;

-- CreateTable
CREATE TABLE "incident_evidence" (
    "id" TEXT NOT NULL,
    "tenant_id" TEXT NOT NULL,
    "incident_id" TEXT NOT NULL,
    "evidence_id" TEXT NOT NULL,
    "note" TEXT,
    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,

    CONSTRAINT "incident_evidence_pkey" PRIMARY KEY ("id")
);

-- CreateIndex
CREATE INDEX "incident_evidence_tenant_id_idx" ON "incident_evidence"("tenant_id");

-- CreateIndex
CREATE UNIQUE INDEX "incident_evidence_incident_id_evidence_id_key" ON "incident_evidence"("incident_id", "evidence_id");

-- AddForeignKey
ALTER TABLE "incident_evidence" ADD CONSTRAINT "incident_evidence_incident_id_fkey" FOREIGN KEY ("incident_id") REFERENCES "incidents"("id") ON DELETE CASCADE ON UPDATE CASCADE;

-- AddForeignKey
ALTER TABLE "incident_evidence" ADD CONSTRAINT "incident_evidence_evidence_id_fkey" FOREIGN KEY ("evidence_id") REFERENCES "evidence"("id") ON DELETE CASCADE ON UPDATE CASCADE;

-- Row Level Security (analog übrige Mandanten-Tabellen; FORCE + WITH CHECK für den
-- scharfen isms_app-Pfad, F-04). Lokal (Owner-Rolle ohne FORCE) unverändert.
ALTER TABLE "incident_evidence" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "incident_evidence";
CREATE POLICY tenant_isolation ON "incident_evidence"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "incident_evidence" FORCE ROW LEVEL SECURITY;