// ==========================================
// INTERFACES - RISK & CONTROLS
// ==========================================

import type { LocalizedText } from './common'
import type {
  RiskLevel,
  EntityType,
  EvidenceType,
  ControlDomain,
  ControlStatus,
  ReviewFrequency,
} from './enums'

export interface RiskFactor {
  id: string
  name: LocalizedText
  category: string
  weight: number
  value: number // 1-5
  rationale?: string
}

export interface RiskScore {
  likelihood: 1 | 2 | 3 | 4 | 5
  impact: 1 | 2 | 3 | 4 | 5
  score: number // likelihood * impact (1-25)
  level: RiskLevel
  rationale: string
}

export interface RiskAssessment {
  id: string
  tenantId: string
  entityType: EntityType
  entityId: string

  // Bewertung
  inherentRisk: RiskScore
  residualRisk: RiskScore

  // Faktoren
  riskFactors: RiskFactor[]
  mitigatingControls: string[] // Control-IDs

  // Workflow
  assessedBy: string
  assessedAt: Date
  approvedBy?: string
  approvedAt?: Date

  nextAssessmentDate: Date
}

export interface Control {
  id: string // z.B. VND-TRF-01
  domain: ControlDomain

  title: LocalizedText
  description: LocalizedText
  passCriteria: LocalizedText

  // Mapping
  requirements: string[] // Art. 28 Abs. 3 lit. a, ISO 27001 A.15.1.2

  // Standard
  isRequired: boolean
  defaultFrequency: ReviewFrequency
}

export interface ControlInstance {
  id: string
  tenantId: string
  controlId: string
  entityType: EntityType
  entityId: string

  // Status
  status: ControlStatus

  // Evidenz
  evidenceIds: string[]

  // Workflow
  lastAssessedAt: Date
  lastAssessedBy: string
  nextAssessmentDate: Date

  notes?: string
}

export interface Evidence {
  id: string
  tenantId: string
  controlInstanceId: string

  type: EvidenceType
  title: string
  description?: string

  // Fuer Dokumente
  storagePath?: string
  fileName?: string

  // Fuer Links
  url?: string

  // Fuer Attestation
  attestedBy?: string
  attestedAt?: Date

  validFrom: Date
  validUntil?: Date

  createdAt: Date
}
