-- CreateTable
CREATE TABLE "control_implementations" (
    "id" TEXT NOT NULL,
    "tenant_id" TEXT NOT NULL,
    "req_id" TEXT NOT NULL,
    "control" TEXT NOT NULL,
    "status" TEXT NOT NULL DEFAULT 'offen',
    "note" TEXT,
    "updated_by_id" TEXT,
    "updated_at" TIMESTAMP(3) NOT NULL,

    CONSTRAINT "control_implementations_pkey" PRIMARY KEY ("id")
);

-- CreateIndex
CREATE INDEX "control_implementations_tenant_id_idx" ON "control_implementations"("tenant_id");

-- CreateIndex
CREATE INDEX "control_implementations_tenant_id_control_idx" ON "control_implementations"("tenant_id", "control");

-- CreateIndex
CREATE UNIQUE INDEX "control_implementations_tenant_id_req_id_key" ON "control_implementations"("tenant_id", "req_id");


-- Row Level Security (zweite Verteidigungslinie, analog übrige Mandanten-Tabellen)
DO $$
DECLARE t text;
BEGIN
  FOREACH t IN ARRAY ARRAY['control_implementations'] LOOP
    EXECUTE format('ALTER TABLE %I ENABLE ROW LEVEL SECURITY', t);
    EXECUTE format(
      'CREATE POLICY tenant_isolation ON %I USING (tenant_id = current_setting(''app.tenant_id'', true))',
      t
    );
  END LOOP;
END $$;