'use client' import React, { useState, useEffect } from 'react' import { useSDK, Requirement as SDKRequirement, RequirementStatus, RiskSeverity } from '@/lib/sdk' import { StepHeader, STEP_EXPLANATIONS } from '@/components/sdk/StepHeader' // ============================================================================= // TYPES // ============================================================================= type DisplayPriority = 'critical' | 'high' | 'medium' | 'low' type DisplayStatus = 'compliant' | 'partial' | 'non-compliant' | 'not-applicable' interface DisplayRequirement extends SDKRequirement { code: string source: string category: string priority: DisplayPriority displayStatus: DisplayStatus controlsLinked: number evidenceCount: number } // ============================================================================= // HELPER FUNCTIONS // ============================================================================= function mapCriticalityToPriority(criticality: RiskSeverity): DisplayPriority { switch (criticality) { case 'CRITICAL': return 'critical' case 'HIGH': return 'high' case 'MEDIUM': return 'medium' case 'LOW': return 'low' default: return 'medium' } } function mapStatusToDisplayStatus(status: RequirementStatus): DisplayStatus { switch (status) { case 'VERIFIED': case 'IMPLEMENTED': return 'compliant' case 'IN_PROGRESS': return 'partial' case 'NOT_STARTED': return 'non-compliant' default: return 'non-compliant' } } // ============================================================================= // FALLBACK TEMPLATES (used when backend is unavailable) // ============================================================================= const requirementTemplates: Omit[] = [ { id: 'req-gdpr-6', regulation: 'DSGVO', article: 'Art. 6', code: 'GDPR-6.1', title: 'Rechtmaessigkeit der Verarbeitung', description: 'Personenbezogene Daten duerfen nur verarbeitet werden, wenn eine Rechtsgrundlage vorliegt.', source: 'DSGVO Art. 6', category: 'Rechtmaessigkeit', priority: 'critical', criticality: 'CRITICAL', applicableModules: ['mod-gdpr'], status: 'NOT_STARTED', controls: [], }, { id: 'req-gdpr-13', regulation: 'DSGVO', article: 'Art. 13/14', code: 'GDPR-13', title: 'Informationspflichten', description: 'Betroffene Personen muessen ueber die Datenverarbeitung informiert werden.', source: 'DSGVO Art. 13/14', category: 'Transparenz', priority: 'high', criticality: 'HIGH', applicableModules: ['mod-gdpr'], status: 'NOT_STARTED', controls: [], }, { id: 'req-ai-act-9', regulation: 'AI Act', article: 'Art. 9', code: 'AI-ACT-9', title: 'Risikomanagementsystem', description: 'Hochrisiko-KI-Systeme erfordern ein Risikomanagementsystem.', source: 'AI Act Art. 9', category: 'KI-Governance', priority: 'high', criticality: 'HIGH', applicableModules: ['mod-ai-act'], status: 'NOT_STARTED', controls: [], }, { id: 'req-gdpr-32', regulation: 'DSGVO', article: 'Art. 32', code: 'GDPR-32', title: 'Sicherheit der Verarbeitung', description: 'Geeignete technische und organisatorische Massnahmen zur Datensicherheit.', source: 'DSGVO Art. 32', category: 'Sicherheit', priority: 'critical', criticality: 'CRITICAL', applicableModules: ['mod-gdpr', 'mod-iso27001'], status: 'NOT_STARTED', controls: [], }, { id: 'req-gdpr-35', regulation: 'DSGVO', article: 'Art. 35', code: 'GDPR-35', title: 'Datenschutz-Folgenabschaetzung', description: 'Bei hohem Risiko ist eine DSFA durchzufuehren.', source: 'DSGVO Art. 35', category: 'Risikobewertung', priority: 'high', criticality: 'HIGH', applicableModules: ['mod-gdpr'], status: 'NOT_STARTED', controls: [], }, { id: 'req-ai-act-13', regulation: 'AI Act', article: 'Art. 13', code: 'AI-ACT-13', title: 'Transparenzanforderungen', description: 'KI-Systeme muessen fuer Nutzer nachvollziehbar und transparent sein.', source: 'AI Act Art. 13', category: 'Transparenz', priority: 'high', criticality: 'HIGH', applicableModules: ['mod-ai-act'], status: 'NOT_STARTED', controls: [], }, { id: 'req-nis2-21', regulation: 'NIS2', article: 'Art. 21', code: 'NIS2-21', title: 'Risikomanagementmassnahmen', description: 'Wesentliche und wichtige Einrichtungen muessen Cybersicherheitsmassnahmen implementieren.', source: 'NIS2 Art. 21', category: 'Cybersicherheit', priority: 'high', criticality: 'HIGH', applicableModules: ['mod-nis2'], status: 'NOT_STARTED', controls: [], }, ] // ============================================================================= // COMPONENTS // ============================================================================= function AddRequirementForm({ onSubmit, onCancel, }: { onSubmit: (data: { regulation: string; article: string; title: string; description: string; criticality: RiskSeverity }) => void onCancel: () => void }) { const [formData, setFormData] = useState({ regulation: '', article: '', title: '', description: '', criticality: 'MEDIUM' as RiskSeverity, }) return (

Neue Anforderung

setFormData({ ...formData, regulation: e.target.value })} placeholder="z.B. DSGVO" className="w-full px-4 py-2 border border-gray-300 rounded-lg focus:ring-2 focus:ring-purple-500 focus:border-transparent" />
setFormData({ ...formData, article: e.target.value })} placeholder="z.B. Art. 6" className="w-full px-4 py-2 border border-gray-300 rounded-lg focus:ring-2 focus:ring-purple-500 focus:border-transparent" />
setFormData({ ...formData, title: e.target.value })} placeholder="z.B. Rechtmaessigkeit der Verarbeitung" className="w-full px-4 py-2 border border-gray-300 rounded-lg focus:ring-2 focus:ring-purple-500 focus:border-transparent" />