-- CreateTable
CREATE TABLE "soa_entries" (
    "id" TEXT NOT NULL,
    "tenant_id" TEXT NOT NULL,
    "framework" "Framework" NOT NULL,
    "control" TEXT NOT NULL,
    "title" TEXT,
    "applicable" BOOLEAN NOT NULL DEFAULT true,
    "justification" TEXT NOT NULL DEFAULT '',
    "source" TEXT,
    "implementation_status" TEXT NOT NULL DEFAULT 'geplant',
    "owner_id" TEXT,
    "policy_code" TEXT,
    "evidence_id" TEXT,
    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
    "updated_at" TIMESTAMP(3) NOT NULL,

    CONSTRAINT "soa_entries_pkey" PRIMARY KEY ("id")
);

-- CreateIndex
CREATE INDEX "soa_entries_tenant_id_idx" ON "soa_entries"("tenant_id");

-- CreateIndex
CREATE INDEX "soa_entries_tenant_id_framework_idx" ON "soa_entries"("tenant_id", "framework");

-- CreateIndex
CREATE UNIQUE INDEX "soa_entries_tenant_id_framework_control_key" ON "soa_entries"("tenant_id", "framework", "control");


-- AP3 — Row Level Security auf der SoA-Tabelle (F-04: FORCE + WITH CHECK).
ALTER TABLE "soa_entries" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "soa_entries";
CREATE POLICY tenant_isolation ON "soa_entries"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "soa_entries" FORCE ROW LEVEL SECURITY;