931 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Benjamin Admin	a970c28168	feat: DSI document discovery + completeness check in agent scan workflow ... Agent scan now automatically: 1. Discovers all legal documents via consent-tester /dsi-discovery endpoint 2. Classifies each as DSE/AGB/Widerruf/Cookie/Impressum 3. Checks completeness against type-specific checklists: - DSE: 9 Art. 13 DSGVO mandatory fields (controller, DPO, purposes, legal basis, recipients, third-country, retention, rights, complaint) - AGB: §305ff BGB (scope, contract formation, liability, jurisdiction) - Widerruf: §355 BGB (right info, 14-day deadline, form, consequences) 4. Adds findings per document to scan results 5. Shows discovered documents with completeness % in email summary 6. Returns discovered_documents list in API response New files: - dsi_document_checker.py (229 LOC) — checklists + classifier - agent_scan_helpers.py (109 LOC) — extracted summary builder + corrections Refactor: agent_scan_routes.py 537→448 LOC (under 500 budget) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 22:10:15 +02:00
Benjamin Admin	48146cddaf	feat: DSI document discovery + completeness check in agent scan workflow ... Agent scan now automatically: 1. Discovers all legal documents via consent-tester /dsi-discovery endpoint 2. Classifies each as DSE/AGB/Widerruf/Cookie/Impressum 3. Checks completeness against type-specific checklists: - DSE: 9 Art. 13 DSGVO mandatory fields (controller, DPO, purposes, legal basis, recipients, third-country, retention, rights, complaint) - AGB: §305ff BGB (scope, contract formation, liability, jurisdiction) - Widerruf: §355 BGB (right info, 14-day deadline, form, consequences) 4. Adds findings per document to scan results 5. Shows discovered documents with completeness % in email summary 6. Returns discovered_documents list in API response New files: - dsi_document_checker.py (229 LOC) — checklists + classifier - agent_scan_helpers.py (109 LOC) — extracted summary builder + corrections Refactor: agent_scan_routes.py 537→448 LOC (under 500 budget) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 22:10:13 +02:00
Benjamin Admin	53f6f30cf0	feat: DSI document discovery + completeness check in agent scan workflow ... Agent scan now automatically: 1. Discovers all legal documents via consent-tester /dsi-discovery endpoint 2. Classifies each as DSE/AGB/Widerruf/Cookie/Impressum 3. Checks completeness against type-specific checklists: - DSE: 9 Art. 13 DSGVO mandatory fields (controller, DPO, purposes, legal basis, recipients, third-country, retention, rights, complaint) - AGB: §305ff BGB (scope, contract formation, liability, jurisdiction) - Widerruf: §355 BGB (right info, 14-day deadline, form, consequences) 4. Adds findings per document to scan results 5. Shows discovered documents with completeness % in email summary 6. Returns discovered_documents list in API response New files: - dsi_document_checker.py (229 LOC) — checklists + classifier - agent_scan_helpers.py (109 LOC) — extracted summary builder + corrections Refactor: agent_scan_routes.py 537→448 LOC (under 500 budget) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 22:09:45 +02:00
Benjamin Admin	298c95731a	feat: Generic legal document discovery (DSI, AGB, Widerruf, Cookie-Richtlinie) ... New service: dsi_discovery.py — finds ALL legal documents on any website: - Technology-agnostic: HTML, SPA, WordPress, Typo3, custom CMS - Structure-agnostic: accordions, sidebars, footers, inline links, tabs - Format-agnostic: HTML pages, anchor sections, PDFs, cross-domain links - Language-agnostic: 26 EU/EEA languages with document-type keywords Document types discovered: - Datenschutzinformationen / Privacy Policies (Art. 13/14 DSGVO) - AGB / Terms of Service / Nutzungsbedingungen - Widerrufsbelehrung / Right of Withdrawal (§355 BGB) - Cookie-Richtlinie / Cookie Policy - All cross-domain variants (e.g. help.instagram.com from instagram.com) API: POST /dsi-discovery { url, max_documents } Returns: list of documents with title, url, language, type, word_count, text_preview Features: - Expands all accordions, details, tabs, dropdowns before scanning - Follows cross-domain links (same registrable domain) - Re-expands after navigation back to source page - Handles anchor links (#sections) separately from full pages Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 21:57:37 +02:00
Benjamin Admin	4e63a6050d	feat: Generic legal document discovery (DSI, AGB, Widerruf, Cookie-Richtlinie) ... New service: dsi_discovery.py — finds ALL legal documents on any website: - Technology-agnostic: HTML, SPA, WordPress, Typo3, custom CMS - Structure-agnostic: accordions, sidebars, footers, inline links, tabs - Format-agnostic: HTML pages, anchor sections, PDFs, cross-domain links - Language-agnostic: 26 EU/EEA languages with document-type keywords Document types discovered: - Datenschutzinformationen / Privacy Policies (Art. 13/14 DSGVO) - AGB / Terms of Service / Nutzungsbedingungen - Widerrufsbelehrung / Right of Withdrawal (§355 BGB) - Cookie-Richtlinie / Cookie Policy - All cross-domain variants (e.g. help.instagram.com from instagram.com) API: POST /dsi-discovery { url, max_documents } Returns: list of documents with title, url, language, type, word_count, text_preview Features: - Expands all accordions, details, tabs, dropdowns before scanning - Follows cross-domain links (same registrable domain) - Re-expands after navigation back to source page - Handles anchor links (#sections) separately from full pages Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 21:56:55 +02:00
Benjamin Admin	a6618af5ed	feat: Generic legal document discovery (DSI, AGB, Widerruf, Cookie-Richtlinie) ... New service: dsi_discovery.py — finds ALL legal documents on any website: - Technology-agnostic: HTML, SPA, WordPress, Typo3, custom CMS - Structure-agnostic: accordions, sidebars, footers, inline links, tabs - Format-agnostic: HTML pages, anchor sections, PDFs, cross-domain links - Language-agnostic: 26 EU/EEA languages with document-type keywords Document types discovered: - Datenschutzinformationen / Privacy Policies (Art. 13/14 DSGVO) - AGB / Terms of Service / Nutzungsbedingungen - Widerrufsbelehrung / Right of Withdrawal (§355 BGB) - Cookie-Richtlinie / Cookie Policy - All cross-domain variants (e.g. help.instagram.com from instagram.com) API: POST /dsi-discovery { url, max_documents } Returns: list of documents with title, url, language, type, word_count, text_preview Features: - Expands all accordions, details, tabs, dropdowns before scanning - Follows cross-domain links (same registrable domain) - Re-expands after navigation back to source page - Handles anchor links (#sections) separately from full pages Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 21:56:29 +02:00
Benjamin Admin	2b4ff9f422	feat: DSFA — VVT-Verknüpfung + Residual Risk + Bundesland-Blacklists ... 1. VVT-Verknüpfung: Dropdown "Verknüpfte VVT-Aktivität" in Step 1, lädt Aktivitäten via API, auto-fills Verarbeitungstätigkeit bei Auswahl 2. Residual Risk: Neuer Step 5 im Wizard — Bewertung des Restrisikos nach Maßnahmen. Bei hoch/kritisch → Art. 36 Vorabkonsultation Warnung 3. Bundesland-Blacklists (Art. 35 Abs. 4): 16 Landesbehörden mit DSK-Muss-Liste (10 gemeinsame Kriterien) + länderspezifische Ergänzungen (Bayern: Whistleblower/Drohnen, NRW: Social-Media- Monitoring, Berlin: Mieterbonitätsprüfung). Automatische Prüfung gegen Scope-Antworten. Blacklist-Matches im DSFA-Banner angezeigt. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 21:48:59 +02:00
Benjamin Admin	84b21cad08	feat: DSFA pre-fill from Company Profile + Scope answers ... - New prefill-from-scope.ts utility: - headquartersState → federal_state (Bundesland for authority lookup) - data_art9 → special data categories (Gesundheit, Biometrie, etc.) - data_minors → adds "Minderjährige" to data subjects + raises risk - proc_adm_scoring → Art. 22 affected rights + measures - proc_ai_usage → involves_ai flag + AI measures - proc_video_surveillance → video data categories - industry/businessModel → processing purpose + legal basis - isDSFARequired() check: shows red banner when Art. 35 triggers detected - GeneratorWizard accepts prefill prop, initializes all fields - Passes federal_state, involves_ai, legal_basis to backend POST Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 19:36:13 +02:00
Benjamin Admin	95baf60da3	refactor: Paket 2 Analyse umstrukturiert + AI Act/Evidence verschoben ... Paket 2 Analyse (vorher 7 Steps → jetzt 5): 1. Requirements — Pruefaspekte aus Regulierungen 2. Controls — Technische & organisatorische Massnahmen 3. Risk Matrix — Risikobewertung (vorher #4, jetzt #3) 4. Audit Checklist — Pruefbare Checkliste (vorher #6) 5. Audit Report — Zusammenfassender Report (vorher #7) Verschoben: - AI Act → Paket 1 Vorbereitung (optional, nur bei KI-Einsatz) - Evidence → Paket 5 Betrieb (Nachweise laufend sammeln, nicht einmalig) SDK Flow (steps-*.ts) synchronisiert mit neuer Reihenfolge. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 16:40:10 +02:00
Benjamin Admin	9fe7759973	refactor: ISO 27001 aus Regulierungen entfernen → ISMS Readiness ... ISO 27001 ist kein Gesetz — freiwilliger Standard, kein Normtext ingested. - Modules: ISO 27001 Fallback-Modul entfernt, Filter entfernt - ISMS: Umbenannt zu "ISMS — ISO 27001 Readiness" - ISMS: Hinweis "Basierend auf eigenen Pruefaspekten, kein Normtext" - Sidebar: "ISMS (ISO 27001)" → "ISMS Readiness" - Verbleibende Regulierungen: DSGVO, AI Act, NIS2 (gesetzlich) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 14:38:22 +02:00
Benjamin Admin	f737bfc4db	refactor: Integrate Modules into Scope-Decision (Option C) ... - RegulationsPanel: added enable/disable toggles per regulation - ScopeDecisionTab: passes enabledModules + onToggleModule - Scope page: auto-enables all applicable regulations when loaded - Modules step: isOptional=true, moved to Zusatzmodule - Requirements: now depends on compliance-scope, not modules - Source-policy: now depends on use-case-assessment, not modules Flow: Profile → Scope → Scope-Decision shows applicable regulations with toggles → Requirements derived from enabled regulations Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 14:29:53 +02:00
Benjamin Admin	7ab1476d8f	refactor: Move Screening to Zusatzmodule (optional) ... - Screening step: isOptional=true - Compliance Modules no longer depends on Screening - Description updated to "SBOM + Vulnerability Scan (OSV.dev)" Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 13:55:09 +02:00
Benjamin Admin	225456ec14	refactor: Source Policy — strip PII/Audit/Blocked, move to Zusatzmodule ... - Removed: PII-Regeln tab (→ Core Service, other repo) - Removed: Audit tab (→ redundant with Document Workflow + RBAC) - Removed: Blockierte Inhalte tab (→ belongs to PII) - Kept: Quellen-Whitelist + Berechtigungen (Operations Matrix) - Renamed: "Source Policy" → "Quellen-Verwaltung" - Moved: From Paket 1 (Pflicht) to Zusatzmodule (optional) - sdk-steps.ts: isOptional=true, requirements no longer depends on it - Sidebar: Added under Zusatzmodule section - Page reduced from 365 → 130 lines Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 11:36:20 +02:00
Benjamin Admin	9395a0084a	feat: Legally vetted cookie banner translations for 22 EU/EEA languages ... 22 languages: BG, CS, DA, DE, EL, EN, ES, ET, FI, FR, HR, HU, IT, LT, LV, NL, PL, PT, RO, SK, SL, SV Each language includes 20 fields: - Banner title, description, accept/reject/save buttons - Privacy notice: "zur Kenntnis genommen" pattern (NOT "zugestimmt") - Terms: "gelesen und stimme zu" pattern (contract = agreement correct) - EWR-only toggle label + info text - 4 category names + descriptions - Vendor/blocked labels, imprint + privacy policy links Legal precision: - DSE = Informationspflicht Art. 13 DSGVO → "acknowledged/zur Kenntnis" - Nutzungsbedingungen = Vertrag → "agree/zustimmen" is correct - No passive consent formulations - No coupling patterns Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 10:58:21 +02:00
Benjamin Admin	74dddbfa0f	feat: Legally vetted cookie banner translations for 22 EU/EEA languages ... 22 languages: BG, CS, DA, DE, EL, EN, ES, ET, FI, FR, HR, HU, IT, LT, LV, NL, PL, PT, RO, SK, SL, SV Each language includes 20 fields: - Banner title, description, accept/reject/save buttons - Privacy notice: "zur Kenntnis genommen" pattern (NOT "zugestimmt") - Terms: "gelesen und stimme zu" pattern (contract = agreement correct) - EWR-only toggle label + info text - 4 category names + descriptions - Vendor/blocked labels, imprint + privacy policy links Legal precision: - DSE = Informationspflicht Art. 13 DSGVO → "acknowledged/zur Kenntnis" - Nutzungsbedingungen = Vertrag → "agree/zustimmen" is correct - No passive consent formulations - No coupling patterns Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 10:56:36 +02:00
Benjamin Admin	c719b1ca5f	feat: Legally vetted cookie banner translations for 22 EU/EEA languages ... 22 languages: BG, CS, DA, DE, EL, EN, ES, ET, FI, FR, HR, HU, IT, LT, LV, NL, PL, PT, RO, SK, SL, SV Each language includes 20 fields: - Banner title, description, accept/reject/save buttons - Privacy notice: "zur Kenntnis genommen" pattern (NOT "zugestimmt") - Terms: "gelesen und stimme zu" pattern (contract = agreement correct) - EWR-only toggle label + info text - 4 category names + descriptions - Vendor/blocked labels, imprint + privacy policy links Legal precision: - DSE = Informationspflicht Art. 13 DSGVO → "acknowledged/zur Kenntnis" - Nutzungsbedingungen = Vertrag → "agree/zustimmen" is correct - No passive consent formulations - No coupling patterns Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 10:56:23 +02:00
Benjamin Admin	129849aa21	feat: 9 new banner checks (12-20), total 20 compliance checks ... Check 12: Click count — reject requires more clicks than accept (CNIL 150M EUR) Check 13: Color contrast — reject button invisible (same bg as banner) Check 14: Google Consent Mode — analytics_storage 'granted' as default Check 15: Pre-consent cookies — tracking cookies set before any interaction Check 16: Registration coupling — login button = consent (Art. 7(4) DSGVO) Check 17: Language mismatch — banner vs page language (all 26 EU languages) Check 18: Consent cookie expiry — >13 months violates CNIL guidelines Check 19: Nudging — reject button below fold / requires scrolling Check 20: Emotional language (Stirring) — "volle Funktionalitaet" etc. Language detection covers: BG, CS, DA, DE, EL, EN, ES, ET, FI, FR, GA, HR, HU, IS, IT, LT, LV, MT, NL, NO, PL, PT, RO, SK, SL, SV New file: banner_advanced_checks.py (396 LOC) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 08:39:01 +02:00
Benjamin Admin	b997b4a475	feat: 9 new banner checks (12-20), total 20 compliance checks ... Check 12: Click count — reject requires more clicks than accept (CNIL 150M EUR) Check 13: Color contrast — reject button invisible (same bg as banner) Check 14: Google Consent Mode — analytics_storage 'granted' as default Check 15: Pre-consent cookies — tracking cookies set before any interaction Check 16: Registration coupling — login button = consent (Art. 7(4) DSGVO) Check 17: Language mismatch — banner vs page language (all 26 EU languages) Check 18: Consent cookie expiry — >13 months violates CNIL guidelines Check 19: Nudging — reject button below fold / requires scrolling Check 20: Emotional language (Stirring) — "volle Funktionalitaet" etc. Language detection covers: BG, CS, DA, DE, EL, EN, ES, ET, FI, FR, GA, HR, HU, IS, IT, LT, LV, MT, NL, NO, PL, PT, RO, SK, SL, SV New file: banner_advanced_checks.py (396 LOC) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 08:39:00 +02:00
Benjamin Admin	9df2a001bb	feat: 9 new banner checks (12-20), total 20 compliance checks ... Check 12: Click count — reject requires more clicks than accept (CNIL 150M EUR) Check 13: Color contrast — reject button invisible (same bg as banner) Check 14: Google Consent Mode — analytics_storage 'granted' as default Check 15: Pre-consent cookies — tracking cookies set before any interaction Check 16: Registration coupling — login button = consent (Art. 7(4) DSGVO) Check 17: Language mismatch — banner vs page language (all 26 EU languages) Check 18: Consent cookie expiry — >13 months violates CNIL guidelines Check 19: Nudging — reject button below fold / requires scrolling Check 20: Emotional language (Stirring) — "volle Funktionalitaet" etc. Language detection covers: BG, CS, DA, DE, EL, EN, ES, ET, FI, FR, GA, HR, HU, IS, IT, LT, LV, MT, NL, NO, PL, PT, RO, SK, SL, SV New file: banner_advanced_checks.py (396 LOC) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 08:38:46 +02:00
Benjamin Admin	7fc43a3f1f	feat: 3 new banner legal checks (11 total) + extract banner_text_checker ... New checks (from EUIPO reference case): - Check 9: Third-party DSE link — detects when consent dialog links to external domain's privacy policy instead of own DSE (Art. 13 DSGVO) - Check 10: Dark-pattern language — detects "muessen/erforderlich" for non-essential cookies suggesting false technical necessity (EDPB Rn. 70) - Check 11: Non-modal dismiss = consent — detects when clicking outside dialog closes it (possibly treating as consent, Planet49 violation) Refactor: extracted _check_banner_text (375 LOC) from consent_scanner.py into services/banner_text_checker.py to keep both files under 500 LOC. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 08:05:49 +02:00
Benjamin Admin	5d138f265b	feat: 3 new banner legal checks (11 total) + extract banner_text_checker ... New checks (from EUIPO reference case): - Check 9: Third-party DSE link — detects when consent dialog links to external domain's privacy policy instead of own DSE (Art. 13 DSGVO) - Check 10: Dark-pattern language — detects "muessen/erforderlich" for non-essential cookies suggesting false technical necessity (EDPB Rn. 70) - Check 11: Non-modal dismiss = consent — detects when clicking outside dialog closes it (possibly treating as consent, Planet49 violation) Refactor: extracted _check_banner_text (375 LOC) from consent_scanner.py into services/banner_text_checker.py to keep both files under 500 LOC. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 08:02:46 +02:00
Benjamin Admin	c47450fe58	feat: 3 new banner legal checks (11 total) + extract banner_text_checker ... New checks (from EUIPO reference case): - Check 9: Third-party DSE link — detects when consent dialog links to external domain's privacy policy instead of own DSE (Art. 13 DSGVO) - Check 10: Dark-pattern language — detects "muessen/erforderlich" for non-essential cookies suggesting false technical necessity (EDPB Rn. 70) - Check 11: Non-modal dismiss = consent — detects when clicking outside dialog closes it (possibly treating as consent, Planet49 violation) Refactor: extracted _check_banner_text (375 LOC) from consent_scanner.py into services/banner_text_checker.py to keep both files under 500 LOC. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 08:01:54 +02:00
Benjamin Admin	bb1f5d6c94	feat: Document Workflow wiring + Email system consolidation ... Document Workflow: - "Als Version speichern" button in Document Generator preview - Creates document + version via /legal-documents/documents API - Saved documents appear in /sdk/workflow module - Status indicator (saving/saved/error) in toolbar Email Consolidation: - consent-management Emails tab now redirects to /sdk/email-templates - Single source of truth for all email templates - Old tab replaced with redirect card explaining the change Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 07:57:33 +02:00
Benjamin Admin	0837680e03	docs: Add EUIPO Unblu Chat findings (3 new, total 10 findings) ... Finding 8: Unblu chat consent links to third-party DSE (unblu.com) instead of EUIPO's own privacy policy (Art. 13 DSGVO) Finding 9: Cookie consent delegated to third-party terms without own legal basis (§25 TDDDG) Finding 10: Click-outside-dialog = accept — accidental click counts as consent (Planet49, Art. 7(1) DSGVO) New planned agent checks: - Drittanbieter-DSE-Check: detect consent linking to external DSE - Modal-Dismiss-Check: Playwright test if backdrop click = consent - Dark-Pattern-Sprache: detect "muessen/erforderlich" for non-essential cookies Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 07:48:35 +02:00
Benjamin Admin	0b7e14f202	feat: Add IAM system knowledge + CMP FAQ to Compliance Advisor soul ... New FAQ sections the advisor can answer: - "Was ist WSO2 Identity Server?" — explains systemic GDPR template problem - "Welche IAM-Systeme haben aehnliche Probleme?" — WSO2, Keycloak, Azure AD B2C, Auth0, Cognito, ForgeRock comparison table - "Was ist das Koppelungsverbot?" — Art. 7(4) DSGVO with practical examples - CMP product knowledge — all 9 modules, EWR-Only feature explanation Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 07:40:32 +02:00
Benjamin Admin	2fb417c784	feat: Add IAM system knowledge + CMP FAQ to Compliance Advisor soul ... New FAQ sections the advisor can answer: - "Was ist WSO2 Identity Server?" — explains systemic GDPR template problem - "Welche IAM-Systeme haben aehnliche Probleme?" — WSO2, Keycloak, Azure AD B2C, Auth0, Cognito, ForgeRock comparison table - "Was ist das Koppelungsverbot?" — Art. 7(4) DSGVO with practical examples - CMP product knowledge — all 9 modules, EWR-Only feature explanation Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 07:37:17 +02:00
Benjamin Admin	f74b786c6f	feat: Add IAM system knowledge + CMP FAQ to Compliance Advisor soul ... New FAQ sections the advisor can answer: - "Was ist WSO2 Identity Server?" — explains systemic GDPR template problem - "Welche IAM-Systeme haben aehnliche Probleme?" — WSO2, Keycloak, Azure AD B2C, Auth0, Cognito, ForgeRock comparison table - "Was ist das Koppelungsverbot?" — Art. 7(4) DSGVO with practical examples - CMP product knowledge — all 9 modules, EWR-Only feature explanation Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 07:36:27 +02:00
Benjamin Admin	7ebd25c59c	docs: Add EUIPO registration as compliance agent reference test case ... Real-world case from EU authority (EUIPO) with 7 findings: - Grammatically broken consent text (bad DE translation) - Coupling prohibition violation (login = consent, Art. 7(4) DSGVO) - No reject button, no granularity, no active opt-in - Broken link layout (DSE/ToS links appear after submit button) - Includes correction suggestion and planned agent check implementations - Pattern: WSO2 Identity Server default templates (systemic issue) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 07:28:32 +02:00
Benjamin Admin	e0f59cdf82	feat: IAB TCF 2.2 + sidebar naming consistency (Option C) ... TCF/IAB 2.2: - TCFEncoderService: base64url TC String generation per IAB spec - 12 IAB purposes mapped to banner categories - tcf_routes: 5 endpoints (purposes, features, mapping, encode) - Auto-generate TC String on consent when tcf_enabled=true - TCFSettings.tsx: enable/disable, purpose grid, test encoder - New "TCF/IAB" tab in cookie-banner (7 tabs total) Sidebar naming (Option C): - SDK step "Einwilligungen" renamed to "Consent-Records" to match CMP sidebar label — consistent across both navigations Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 07:10:53 +02:00
Benjamin Admin	d3c8811fdb	feat: IAB TCF 2.2 — TC String encoder + purpose mapping + UI ... - TCFEncoderService: generates base64url-encoded TC Strings per IAB spec with 12 purposes, vendor consent bitfield, CMP metadata - Category-to-purpose mapping (necessary→none, statistics→1,7,8,9,10, marketing→1,2,3,4,5,6,7,12, functional→1,11) - tcf_routes: 5 endpoints (purposes, features, mapping, encode, encode-categories) - banner_consent_service: auto-generates TC String when tcf_enabled=true - TCFSettings.tsx: enable/disable toggle, purpose grid with category mapping, TC String test generator, CMP registration info - New "TCF/IAB" tab in cookie-banner page (7 tabs total) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 07:01:37 +02:00
Benjamin Admin	c89a68e59e	feat: Whistleblower backend + Scanner banner-check (last 2 gaps) ... Whistleblower (HinSchG): - Migration 118: 3 tables (reports, messages, measures) with HinSchG deadlines (7d acknowledgment, 3mo feedback) - whistleblower_routes.py: 14 endpoints (CRUD, acknowledge, close, messages, measures, public submit, anonymous status check) - Frontend api-operations.ts rewired from Go SDK to compliance proxy - Access key format XXXX-XXXX-XXXX for anonymous reporters Scanner banner-check (TTDSG § 25): - CMP Dashboard: green "Kein Cookie-Banner erforderlich" when no trackers detected + no banner configured - Red warning "Cookie-Banner fehlt!" when trackers found but no banner - Mandatory note: Impressum (DDG § 5) + DSE (DSGVO Art. 13) still required [migration-approved] Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-04 00:22:18 +02:00
Benjamin Admin	eb4ea8bc42	feat: EmailDeliveryService + professional DSR email templates ... - EmailDeliveryService: load template → find published version → render {{variables}} → send via SMTP → audit log. Fallback to inline HTML when no published template exists. - Migration 117: Professional HTML/text content for all 5 DSR templates (receipt, completion, rejection, identity, extension) with branded styling and proper Art. references - DSRArt11Service now uses EmailDeliveryService with dsr_rejection template instead of hardcoded HTML [migration-approved] Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-03 23:38:32 +02:00
Benjamin Admin	060f351da7	feat: Art. 11 DSGVO — reject DSR when data subject not identifiable ... - New DSRArt11Service: handles rejection with proper legal basis, automated email notification to requester explaining Art. 11 - POST /dsr/{id}/reject-art11 endpoint - ActionButtons.tsx: "Nicht identifizierbar (Art. 11)" button shown when identity is not yet verified - Also fixes: DSR export type-cast rollback handling Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-03 23:30:18 +02:00
Benjamin Admin	c55d0ab12a	fix: DSR export type-cast bug + session rollback on partial failures ... - tenant_id kept as string (PostgreSQL handles UUID cast) - Einwilligungen query uses CAST(:tid AS VARCHAR) for compatibility - Each data source query wrapped with rollback on failure to prevent cascading "transaction aborted" errors Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-03 23:15:25 +02:00
Benjamin Admin	02468c94c0	feat: DSR User Data Export — Art. 15 PDF + Art. 20 JSON/CSV ... - DSRExportService: aggregates all CMP data about a user from Banner Consents, Einwilligungen, Audit Trail, DSR History - GET /dsr/{id}/export-user-data?format=json|csv|pdf endpoint - PDF: A4 reportlab with 4 sections (Consents, Einwilligungen, Audit-Trail, DSR-Anfragen) + cover page - CSV: BOM-encoded for Excel with flattened data rows - JSON: structured export with all data categories - ActionButtons.tsx: PDF/JSON/CSV export buttons now functional Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-03 22:42:03 +02:00
Benjamin Admin	630fffc0cc	feat: Academy integration — training gap detection after document approval (F7) ... - Migration 115: compliance_role_training_mapping table (org roles → training codes) - TrainingLinkService: queries training_modules/matrix/assignments to find gaps per person and role. Gracefully degrades when Go training tables don't exist yet. - document_review_routes: 2 new endpoints (training-requirements, training-gaps) - _notify_approval() now checks training gaps and sends emails to persons with outstanding modules, linking to /sdk/training/learner [migration-approved] Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-03 22:03:25 +02:00
Benjamin Admin	965af3a34c	feat: A/B Testing + Compliance Report PDF (F5 + F8) ... F5: A/B Testing for Consent Rate - Migration 116: banner_variants table + variant tracking in audit log - BannerABService: deterministic sticky bucketing via device hash, chi-squared significance testing, variant CRUD - banner_ab_routes: 6 endpoints (CRUD + stats + assign) - ABTestPanel.tsx: variant creation, traffic sliders, opt-in comparison chart with winner/significance badges - New "A/B-Test" tab in cookie-banner page F8: Compliance Report PDF - CompliancePDFGenerator: reportlab-based A4 PDF covering all modules (Company Profile, TOM, VVT, DSFA, Risks, Vendors, Incidents, Reviews, Consents, Roles) - compliance_report_routes: GET /compliance/report/pdf - "Compliance-Report herunterladen" button on SDK dashboard [migration-approved] Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-03 21:42:50 +02:00
Benjamin Admin	c3fcfe88ee	feat: Vendor-level consent + Consent analytics (F4 + F6) ... F4: Granular Vendor-Level Consent - Migration 113: vendor_consents JSONB on banner_consents + audit_log - ConsentCreate schema + BannerConsentDB model extended - banner_consent_service stores vendor_consents alongside categories - Audit trail includes vendor-level decisions + user_agent F6: Consent Rate Analytics - Migration 114: user_agent on audit_log + time-series index - BannerAnalyticsService: time series, category breakdown, device stats - banner_analytics_routes: 4 endpoints (overview, time-series, categories, devices) - AnalyticsDashboard.tsx: KPIs, bar chart, category bars, device breakdown - New "Analytik" tab in cookie-banner page [migration-approved] Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-03 20:58:06 +02:00
Benjamin Admin	36d9f929c6	feat: Cookie-Banner Verarbeiter-Tabelle + Multi-Site UI (F9 + F3) ... F9: Verarbeiter-Tabelle - VendorTable.tsx: 82+ vendors grouped by category with expandable cookie details - EmbeddableVendorHTML.tsx: Copy-pasteable HTML table for privacy policy - Tab system: Konfiguration | Verarbeiter | Einbettung F3: Multi-Site UI - SiteSelector.tsx: Domain dropdown with "Neue Seite anlegen" dialog - useCookieBanner hook extended with sites management - Config/vendors reload per selected site Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-03 20:40:18 +02:00
Benjamin Admin	4c92b17617	feat: Rollenkonzept module + Document Generator review integration (Phase 4-5) ... - New /sdk/rollenkonzept/ module with 3 tabs (Rollen, Zuordnung, Reviews) - 7 standard compliance roles (DSB, GF, IT-Leiter, HR, Marketing, Compliance, Einkauf) - Inline role editing with test email via Mailpit - Document-to-role mapping table (editable per tenant) - Review list with status filters and approve/reject workflow - ReviewAssignmentPanel in Document Generator preview tab - "Zur Pruefung senden" button creates reviews + sends notification emails - Approval notification sent to all affected roles after document sign-off - Sidebar navigation link added Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-03 13:09:32 +02:00
Benjamin Admin	9b4be663f7	feat: Rollenkonzept backend + SOP template (Phase 1-3) ... - Migration 111: 3 new tables (org_roles, document_reviews, document_role_mapping) with seed data mapping all 71 doc types to 7 compliance roles - org_role_routes.py: CRUD for roles, seed defaults, test email, mapping API - document_review_routes.py: Review lifecycle (create→send→approve/reject) with approval notification to all affected roles - Migration 112: SOP template (ISO 9001 structure, 21 placeholders) - Added standard_operating_procedure to TemplateType, doc-labels, presets [migration-approved] Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-03 13:03:38 +02:00
Benjamin Admin	ce52dd153e	feat: Complete template coverage — 13 presets, 71 doc types, 100% mapped ... - Split presets into interface + data files (500-line budget) - Extract DOC_LABELS into doc-labels.ts with all 71 template types - Add 3 new presets: Cloud/SaaS-Anbieter, Finanzdienstleister, Plattform - Expand Enterprise preset to 48 docs (full ISMS + BCM + DSR) - Every template type appears in at least one preset - ISO references verified: citations only, no copyrighted standard text Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-03 10:59:58 +02:00
Benjamin Admin	3aff80fb0c	fix: Complete recommended docs for all 10 industry presets ... Every preset now includes DSGVO-mandatory docs (TOM, VVT, Löschkonzept) plus Cookie-Banner/Policy, Mitarbeiter-DSI, Bewerber-DSI, and industry-specific extras (DSFA, Whistleblower, ISMS, TIA, etc.). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-03 10:07:30 +02:00
Benjamin Admin	15a1879803	fix: Cookie banner closeable + sidebar accessible while banner is open ... - X button to close banner (SDK admin context only) - Overlay leaves sidebar area accessible (ml-16/ml-64) - Click overlay backdrop to dismiss - Preview page: close banner on API error (don't trap user) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-03 09:10:37 +02:00
Benjamin Admin	a1272390ff	fix: Cookie banner closeable + sidebar accessible while banner is open ... - X button to close banner (SDK admin context only) - Overlay leaves sidebar area accessible (ml-16/ml-64) - Click overlay backdrop to dismiss - Preview page: close banner on API error (don't trap user) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-03 09:08:05 +02:00
Benjamin Admin	ca6da1acea	fix: Cookie banner closeable + sidebar accessible while banner is open ... - X button to close banner (SDK admin context only) - Overlay leaves sidebar area accessible (ml-16/ml-64) - Click overlay backdrop to dismiss - Preview page: close banner on API error (don't trap user) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-03 09:08:05 +02:00
Benjamin Admin	40e2c76ab3	fix: Show industry presets on project selector page ... Presets were only visible after entering a project. Now they appear on the /sdk landing page where users first see their project list. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-03 09:05:08 +02:00
Benjamin Admin	e8b5c90a49	fix: Route all banner API calls through Next.js proxy (SSL cert fix) ... Browser blocks direct calls to backend-compliance:8093 due to self-signed SSL certificate. All banner API calls now go through Next.js API proxy at /api/sdk/v1/banner/* which runs server-side. - New catch-all proxy: /api/sdk/v1/banner/[[...path]]/route.ts Maps to backend-compliance:8002/api/compliance/banner/* - Preview page: uses /api/sdk/v1/banner/ instead of https://macmini:8093 - CMP Dashboard: uses proxy for banner stats + compliance proxy for DSR/einwilligungen - Fixes: banner not closeable due to API errors, consent not saving Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-03 08:53:41 +02:00
Benjamin Admin	6af35dbf5f	fix: Route all banner API calls through Next.js proxy (SSL cert fix) ... Browser blocks direct calls to backend-compliance:8093 due to self-signed SSL certificate. All banner API calls now go through Next.js API proxy at /api/sdk/v1/banner/* which runs server-side. - New catch-all proxy: /api/sdk/v1/banner/[[...path]]/route.ts Maps to backend-compliance:8002/api/compliance/banner/* - Preview page: uses /api/sdk/v1/banner/ instead of https://macmini:8093 - CMP Dashboard: uses proxy for banner stats + compliance proxy for DSR/einwilligungen - Fixes: banner not closeable due to API errors, consent not saving Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-03 08:53:38 +02:00
Benjamin Admin	c5678c7101	fix: Route all banner API calls through Next.js proxy (SSL cert fix) ... Browser blocks direct calls to backend-compliance:8093 due to self-signed SSL certificate. All banner API calls now go through Next.js API proxy at /api/sdk/v1/banner/* which runs server-side. - New catch-all proxy: /api/sdk/v1/banner/[[...path]]/route.ts Maps to backend-compliance:8002/api/compliance/banner/* - Preview page: uses /api/sdk/v1/banner/ instead of https://macmini:8093 - CMP Dashboard: uses proxy for banner stats + compliance proxy for DSR/einwilligungen - Fixes: banner not closeable due to API errors, consent not saving Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-05-03 08:53:20 +02:00