5a31f52310
Services: Admin-Lehrer, Backend-Lehrer, Studio v2, Website, Klausur-Service, School-Service, Voice-Service, Geo-Service, BreakPilot Drive, Agent-Core Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
110 lines
7.0 KiB
TypeScript
110 lines
7.0 KiB
TypeScript
/**
|
|
* Compliance Requirements API Route - Proxy to Backend
|
|
*
|
|
* Returns requirements for a specific regulation with implementation status
|
|
*/
|
|
|
|
import { NextRequest, NextResponse } from 'next/server'
|
|
|
|
const BACKEND_URL = process.env.BACKEND_URL || 'http://localhost:8000'
|
|
|
|
export async function GET(request: NextRequest) {
|
|
try {
|
|
const searchParams = request.nextUrl.searchParams
|
|
const regulationCode = searchParams.get('regulation_code')
|
|
|
|
if (!regulationCode) {
|
|
return NextResponse.json(
|
|
{ error: 'regulation_code parameter required' },
|
|
{ status: 400 }
|
|
)
|
|
}
|
|
|
|
// Build query string for backend
|
|
const params = new URLSearchParams()
|
|
params.set('regulation_code', regulationCode)
|
|
if (searchParams.get('status')) params.set('status', searchParams.get('status')!)
|
|
if (searchParams.get('priority')) params.set('priority', searchParams.get('priority')!)
|
|
if (searchParams.get('search')) params.set('search', searchParams.get('search')!)
|
|
|
|
const response = await fetch(
|
|
`${BACKEND_URL}/api/v1/compliance/requirements?${params}`,
|
|
{
|
|
method: 'GET',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
signal: AbortSignal.timeout(30000)
|
|
}
|
|
)
|
|
|
|
if (!response.ok) {
|
|
// Return static BSI data as fallback if backend not available
|
|
if (response.status === 404 && regulationCode.startsWith('BSI')) {
|
|
return NextResponse.json({
|
|
requirements: getBSIRequirements(regulationCode)
|
|
})
|
|
}
|
|
const errorText = await response.text()
|
|
return NextResponse.json(
|
|
{ error: `Backend Error: ${response.status}`, details: errorText },
|
|
{ status: response.status }
|
|
)
|
|
}
|
|
|
|
const data = await response.json()
|
|
return NextResponse.json(data)
|
|
} catch (error) {
|
|
console.error('Requirements proxy error:', error)
|
|
// Return fallback data for BSI
|
|
const regulationCode = request.nextUrl.searchParams.get('regulation_code')
|
|
if (regulationCode?.startsWith('BSI')) {
|
|
return NextResponse.json({
|
|
requirements: getBSIRequirements(regulationCode)
|
|
})
|
|
}
|
|
return NextResponse.json(
|
|
{ error: 'Verbindung zum Backend fehlgeschlagen', requirements: [] },
|
|
{ status: 503 }
|
|
)
|
|
}
|
|
}
|
|
|
|
// Static BSI requirements as fallback (subset)
|
|
function getBSIRequirements(code: string) {
|
|
if (code === 'BSI-TR-03161-1') {
|
|
return [
|
|
{ id: '1', regulation_code: code, article: 'O.Purp_1', title: 'Zweckbindung', description: 'Anwendungszweck klar definiert', implementation_status: 'implemented', priority: 1, controls_count: 2 },
|
|
{ id: '2', regulation_code: code, article: 'O.Data_1', title: 'Datenminimierung', description: 'Nur notwendige Daten erheben', implementation_status: 'implemented', priority: 1, controls_count: 3 },
|
|
{ id: '3', regulation_code: code, article: 'O.Auth_1', title: 'Authentifizierung', description: 'Sichere Authentifizierungsmechanismen', implementation_status: 'verified', priority: 1, controls_count: 4 },
|
|
{ id: '4', regulation_code: code, article: 'O.Auth_2', title: 'Passwortrichtlinie', description: 'Starke Passwoerter erzwingen', implementation_status: 'implemented', priority: 1, controls_count: 2 },
|
|
{ id: '5', regulation_code: code, article: 'O.Cryp_1', title: 'TLS-Verschluesselung', description: 'TLS 1.2+ fuer Transport', implementation_status: 'verified', priority: 1, controls_count: 2 },
|
|
{ id: '6', regulation_code: code, article: 'O.Cryp_2', title: 'Encryption at Rest', description: 'Sensible Daten verschluesseln', implementation_status: 'implemented', priority: 1, controls_count: 2 },
|
|
{ id: '7', regulation_code: code, article: 'O.Priv_1', title: 'Datenschutzerklaerung', description: 'Transparente Information', implementation_status: 'verified', priority: 1, controls_count: 1 },
|
|
{ id: '8', regulation_code: code, article: 'O.Log_1', title: 'Security Logging', description: 'Sicherheitsereignisse protokollieren', implementation_status: 'in_progress', priority: 1, controls_count: 2 },
|
|
]
|
|
}
|
|
if (code === 'BSI-TR-03161-2') {
|
|
return [
|
|
{ id: '20', regulation_code: code, article: 'O.Sess_1', title: 'Session-Timeout', description: 'Automatische Sitzungsbeendigung', implementation_status: 'implemented', priority: 1, controls_count: 2 },
|
|
{ id: '21', regulation_code: code, article: 'O.Input_1', title: 'Eingabevalidierung', description: 'Alle Eingaben validieren', implementation_status: 'verified', priority: 1, controls_count: 3 },
|
|
{ id: '22', regulation_code: code, article: 'O.SQL_1', title: 'SQL-Injection Schutz', description: 'Prepared Statements', implementation_status: 'verified', priority: 1, controls_count: 2 },
|
|
{ id: '23', regulation_code: code, article: 'O.XSS_1', title: 'XSS-Schutz', description: 'Output Encoding', implementation_status: 'verified', priority: 1, controls_count: 3 },
|
|
{ id: '24', regulation_code: code, article: 'O.CSRF_1', title: 'CSRF-Schutz', description: 'Anti-CSRF Token', implementation_status: 'implemented', priority: 1, controls_count: 2 },
|
|
{ id: '25', regulation_code: code, article: 'O.Head_1', title: 'Security Headers', description: 'X-Content-Type-Options', implementation_status: 'verified', priority: 1, controls_count: 1 },
|
|
{ id: '26', regulation_code: code, article: 'O.API_1', title: 'API-Authentifizierung', description: 'JWT/OAuth', implementation_status: 'verified', priority: 1, controls_count: 2 },
|
|
{ id: '27', regulation_code: code, article: 'O.API_2', title: 'Rate Limiting', description: 'Anfragen begrenzen', implementation_status: 'implemented', priority: 1, controls_count: 1 },
|
|
]
|
|
}
|
|
if (code === 'BSI-TR-03161-3') {
|
|
return [
|
|
{ id: '40', regulation_code: code, article: 'O.Arch_1', title: 'Defense in Depth', description: 'Mehrschichtige Sicherheit', implementation_status: 'implemented', priority: 1, controls_count: 3 },
|
|
{ id: '41', regulation_code: code, article: 'O.DB_1', title: 'Datenbank-Sicherheit', description: 'DB abhaerten', implementation_status: 'implemented', priority: 1, controls_count: 2 },
|
|
{ id: '42', regulation_code: code, article: 'O.Cont_1', title: 'Container-Sicherheit', description: 'Images scannen', implementation_status: 'in_progress', priority: 1, controls_count: 2 },
|
|
{ id: '43', regulation_code: code, article: 'O.Sec_1', title: 'Secrets Management', description: 'Zentrale Secrets-Verwaltung', implementation_status: 'verified', priority: 1, controls_count: 2 },
|
|
{ id: '44', regulation_code: code, article: 'O.Mon_1', title: 'Zentrale Logs', description: 'Log-Aggregation', implementation_status: 'implemented', priority: 1, controls_count: 1 },
|
|
{ id: '45', regulation_code: code, article: 'O.CI_1', title: 'Pipeline-Sicherheit', description: 'CI/CD absichern', implementation_status: 'in_progress', priority: 1, controls_count: 2 },
|
|
{ id: '46', regulation_code: code, article: 'O.DR_1', title: 'Backup-Strategie', description: '3-2-1 Backup-Regel', implementation_status: 'implemented', priority: 1, controls_count: 1 },
|
|
]
|
|
}
|
|
return []
|
|
}
|