feat(sdk): Add DSFA (Art. 35 DSGVO) Editor and API Client
Implements comprehensive Data Protection Impact Assessment tooling: - 5-section wizard following Art. 35 DSGVO structure - Interactive risk matrix with likelihood/impact scoring - Mitigation management linked to risks - DPO approval workflow (draft → in_review → approved/rejected) - UCCA integration for auto-triggering DSFA from assessments - Full TypeScript types and API client with 42 test cases Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Benjamin Admin
355
admin-v2/lib/sdk/dsfa/__tests__/api.test.ts
Normal file
355
admin-v2/lib/sdk/dsfa/__tests__/api.test.ts
Normal file
@@ -0,0 +1,355 @@
|
||||
import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
|
||||
|
||||
// Mock fetch globally
|
||||
const mockFetch = vi.fn()
|
||||
global.fetch = mockFetch
|
||||
|
||||
describe('DSFA API Client', () => {
|
||||
beforeEach(() => {
|
||||
mockFetch.mockClear()
|
||||
})
|
||||
|
||||
afterEach(() => {
|
||||
vi.restoreAllMocks()
|
||||
})
|
||||
|
||||
describe('listDSFAs', () => {
|
||||
it('should fetch DSFAs without status filter', async () => {
|
||||
const mockDSFAs = [
|
||||
{ id: 'dsfa-1', name: 'Test DSFA 1', status: 'draft' },
|
||||
{ id: 'dsfa-2', name: 'Test DSFA 2', status: 'approved' },
|
||||
]
|
||||
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
json: () => Promise.resolve({ dsfas: mockDSFAs }),
|
||||
})
|
||||
|
||||
const { listDSFAs } = await import('../api')
|
||||
const result = await listDSFAs()
|
||||
|
||||
expect(mockFetch).toHaveBeenCalledTimes(1)
|
||||
expect(result).toHaveLength(2)
|
||||
expect(result[0].name).toBe('Test DSFA 1')
|
||||
})
|
||||
|
||||
it('should fetch DSFAs with status filter', async () => {
|
||||
const mockDSFAs = [{ id: 'dsfa-1', name: 'Draft DSFA', status: 'draft' }]
|
||||
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
json: () => Promise.resolve({ dsfas: mockDSFAs }),
|
||||
})
|
||||
|
||||
const { listDSFAs } = await import('../api')
|
||||
const result = await listDSFAs('draft')
|
||||
|
||||
expect(mockFetch).toHaveBeenCalledTimes(1)
|
||||
const calledUrl = mockFetch.mock.calls[0][0]
|
||||
expect(calledUrl).toContain('status=draft')
|
||||
})
|
||||
|
||||
it('should return empty array when no DSFAs', async () => {
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
json: () => Promise.resolve({ dsfas: null }),
|
||||
})
|
||||
|
||||
const { listDSFAs } = await import('../api')
|
||||
const result = await listDSFAs()
|
||||
|
||||
expect(result).toEqual([])
|
||||
})
|
||||
})
|
||||
|
||||
describe('getDSFA', () => {
|
||||
it('should fetch a single DSFA by ID', async () => {
|
||||
const mockDSFA = {
|
||||
id: 'dsfa-123',
|
||||
name: 'Test DSFA',
|
||||
status: 'draft',
|
||||
risks: [],
|
||||
mitigations: [],
|
||||
}
|
||||
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
json: () => Promise.resolve(mockDSFA),
|
||||
})
|
||||
|
||||
const { getDSFA } = await import('../api')
|
||||
const result = await getDSFA('dsfa-123')
|
||||
|
||||
expect(mockFetch).toHaveBeenCalledTimes(1)
|
||||
expect(result.id).toBe('dsfa-123')
|
||||
expect(result.name).toBe('Test DSFA')
|
||||
})
|
||||
|
||||
it('should throw error for non-existent DSFA', async () => {
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: false,
|
||||
status: 404,
|
||||
text: () => Promise.resolve('{"error": "DSFA not found"}'),
|
||||
})
|
||||
|
||||
const { getDSFA } = await import('../api')
|
||||
|
||||
await expect(getDSFA('non-existent')).rejects.toThrow()
|
||||
})
|
||||
})
|
||||
|
||||
describe('createDSFA', () => {
|
||||
it('should create a new DSFA', async () => {
|
||||
const newDSFA = {
|
||||
name: 'New DSFA',
|
||||
description: 'Test description',
|
||||
processing_purpose: 'Testing',
|
||||
}
|
||||
|
||||
const createdDSFA = {
|
||||
id: 'dsfa-new',
|
||||
...newDSFA,
|
||||
status: 'draft',
|
||||
}
|
||||
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
json: () => Promise.resolve(createdDSFA),
|
||||
})
|
||||
|
||||
const { createDSFA } = await import('../api')
|
||||
const result = await createDSFA(newDSFA)
|
||||
|
||||
expect(mockFetch).toHaveBeenCalledTimes(1)
|
||||
expect(result.id).toBe('dsfa-new')
|
||||
expect(result.name).toBe('New DSFA')
|
||||
})
|
||||
})
|
||||
|
||||
describe('updateDSFA', () => {
|
||||
it('should update an existing DSFA', async () => {
|
||||
const updates = {
|
||||
name: 'Updated DSFA Name',
|
||||
processing_purpose: 'Updated purpose',
|
||||
}
|
||||
|
||||
const updatedDSFA = {
|
||||
id: 'dsfa-123',
|
||||
...updates,
|
||||
status: 'draft',
|
||||
}
|
||||
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
json: () => Promise.resolve(updatedDSFA),
|
||||
})
|
||||
|
||||
const { updateDSFA } = await import('../api')
|
||||
const result = await updateDSFA('dsfa-123', updates)
|
||||
|
||||
expect(mockFetch).toHaveBeenCalledTimes(1)
|
||||
expect(result.name).toBe('Updated DSFA Name')
|
||||
})
|
||||
})
|
||||
|
||||
describe('deleteDSFA', () => {
|
||||
it('should delete a DSFA', async () => {
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
})
|
||||
|
||||
const { deleteDSFA } = await import('../api')
|
||||
await deleteDSFA('dsfa-123')
|
||||
|
||||
expect(mockFetch).toHaveBeenCalledTimes(1)
|
||||
const calledConfig = mockFetch.mock.calls[0][1]
|
||||
expect(calledConfig.method).toBe('DELETE')
|
||||
})
|
||||
|
||||
it('should throw error when deletion fails', async () => {
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: false,
|
||||
statusText: 'Not Found',
|
||||
})
|
||||
|
||||
const { deleteDSFA } = await import('../api')
|
||||
|
||||
await expect(deleteDSFA('non-existent')).rejects.toThrow()
|
||||
})
|
||||
})
|
||||
|
||||
describe('updateDSFASection', () => {
|
||||
it('should update a specific section', async () => {
|
||||
const sectionData = {
|
||||
processing_purpose: 'Updated purpose',
|
||||
data_categories: ['personal_data', 'contact_data'],
|
||||
}
|
||||
|
||||
const updatedDSFA = {
|
||||
id: 'dsfa-123',
|
||||
section_progress: {
|
||||
section_1_complete: true,
|
||||
},
|
||||
}
|
||||
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
json: () => Promise.resolve(updatedDSFA),
|
||||
})
|
||||
|
||||
const { updateDSFASection } = await import('../api')
|
||||
const result = await updateDSFASection('dsfa-123', 1, sectionData)
|
||||
|
||||
expect(mockFetch).toHaveBeenCalledTimes(1)
|
||||
const calledUrl = mockFetch.mock.calls[0][0]
|
||||
expect(calledUrl).toContain('/sections/1')
|
||||
})
|
||||
})
|
||||
|
||||
describe('submitDSFAForReview', () => {
|
||||
it('should submit DSFA for review', async () => {
|
||||
const response = {
|
||||
message: 'DSFA submitted for review',
|
||||
dsfa: {
|
||||
id: 'dsfa-123',
|
||||
status: 'in_review',
|
||||
},
|
||||
}
|
||||
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
json: () => Promise.resolve(response),
|
||||
})
|
||||
|
||||
const { submitDSFAForReview } = await import('../api')
|
||||
const result = await submitDSFAForReview('dsfa-123')
|
||||
|
||||
expect(mockFetch).toHaveBeenCalledTimes(1)
|
||||
expect(result.dsfa.status).toBe('in_review')
|
||||
})
|
||||
})
|
||||
|
||||
describe('approveDSFA', () => {
|
||||
it('should approve a DSFA', async () => {
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
json: () => Promise.resolve({ message: 'DSFA approved' }),
|
||||
})
|
||||
|
||||
const { approveDSFA } = await import('../api')
|
||||
const result = await approveDSFA('dsfa-123', {
|
||||
dpo_opinion: 'Approved after review',
|
||||
approved: true,
|
||||
})
|
||||
|
||||
expect(mockFetch).toHaveBeenCalledTimes(1)
|
||||
expect(result.message).toBe('DSFA approved')
|
||||
})
|
||||
|
||||
it('should reject a DSFA', async () => {
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
json: () => Promise.resolve({ message: 'DSFA rejected' }),
|
||||
})
|
||||
|
||||
const { approveDSFA } = await import('../api')
|
||||
const result = await approveDSFA('dsfa-123', {
|
||||
dpo_opinion: 'Needs more details',
|
||||
approved: false,
|
||||
})
|
||||
|
||||
expect(result.message).toBe('DSFA rejected')
|
||||
})
|
||||
})
|
||||
|
||||
describe('getDSFAStats', () => {
|
||||
it('should fetch DSFA statistics', async () => {
|
||||
const stats = {
|
||||
total: 10,
|
||||
status_stats: {
|
||||
draft: 4,
|
||||
in_review: 2,
|
||||
approved: 3,
|
||||
rejected: 1,
|
||||
},
|
||||
risk_stats: {
|
||||
low: 3,
|
||||
medium: 4,
|
||||
high: 2,
|
||||
very_high: 1,
|
||||
},
|
||||
}
|
||||
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
json: () => Promise.resolve(stats),
|
||||
})
|
||||
|
||||
const { getDSFAStats } = await import('../api')
|
||||
const result = await getDSFAStats()
|
||||
|
||||
expect(mockFetch).toHaveBeenCalledTimes(1)
|
||||
expect(result.total).toBe(10)
|
||||
expect(result.status_stats.approved).toBe(3)
|
||||
})
|
||||
})
|
||||
|
||||
describe('createDSFAFromAssessment', () => {
|
||||
it('should create DSFA from UCCA assessment', async () => {
|
||||
const response = {
|
||||
dsfa: {
|
||||
id: 'dsfa-new',
|
||||
name: 'AI Chatbot DSFA',
|
||||
status: 'draft',
|
||||
},
|
||||
prefilled: true,
|
||||
message: 'DSFA created from assessment',
|
||||
}
|
||||
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
json: () => Promise.resolve(response),
|
||||
})
|
||||
|
||||
const { createDSFAFromAssessment } = await import('../api')
|
||||
const result = await createDSFAFromAssessment('assessment-123')
|
||||
|
||||
expect(mockFetch).toHaveBeenCalledTimes(1)
|
||||
expect(result.prefilled).toBe(true)
|
||||
expect(result.dsfa.id).toBe('dsfa-new')
|
||||
})
|
||||
})
|
||||
|
||||
describe('getDSFAByAssessment', () => {
|
||||
it('should return DSFA linked to assessment', async () => {
|
||||
const dsfa = {
|
||||
id: 'dsfa-123',
|
||||
assessment_id: 'assessment-123',
|
||||
name: 'Linked DSFA',
|
||||
}
|
||||
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
json: () => Promise.resolve(dsfa),
|
||||
})
|
||||
|
||||
const { getDSFAByAssessment } = await import('../api')
|
||||
const result = await getDSFAByAssessment('assessment-123')
|
||||
|
||||
expect(result?.id).toBe('dsfa-123')
|
||||
})
|
||||
|
||||
it('should return null when no DSFA exists for assessment', async () => {
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: false,
|
||||
status: 404,
|
||||
text: () => Promise.resolve('Not found'),
|
||||
})
|
||||
|
||||
const { getDSFAByAssessment } = await import('../api')
|
||||
const result = await getDSFAByAssessment('no-dsfa-assessment')
|
||||
|
||||
expect(result).toBeNull()
|
||||
})
|
||||
})
|
||||
})
|
||||
255
admin-v2/lib/sdk/dsfa/__tests__/types.test.ts
Normal file
255
admin-v2/lib/sdk/dsfa/__tests__/types.test.ts
Normal file
@@ -0,0 +1,255 @@
|
||||
import { describe, it, expect } from 'vitest'
|
||||
import {
|
||||
calculateRiskLevel,
|
||||
DSFA_SECTIONS,
|
||||
DSFA_STATUS_LABELS,
|
||||
DSFA_RISK_LEVEL_LABELS,
|
||||
DSFA_LEGAL_BASES,
|
||||
DSFA_AFFECTED_RIGHTS,
|
||||
RISK_MATRIX,
|
||||
type DSFARisk,
|
||||
type DSFAMitigation,
|
||||
type DSFASectionProgress,
|
||||
type DSFA,
|
||||
} from '../types'
|
||||
|
||||
describe('DSFA_SECTIONS', () => {
|
||||
it('should have 5 sections defined', () => {
|
||||
expect(DSFA_SECTIONS.length).toBe(5)
|
||||
})
|
||||
|
||||
it('should have sections numbered 1-5', () => {
|
||||
const numbers = DSFA_SECTIONS.map(s => s.number)
|
||||
expect(numbers).toEqual([1, 2, 3, 4, 5])
|
||||
})
|
||||
|
||||
it('should have GDPR references for all sections', () => {
|
||||
DSFA_SECTIONS.forEach(section => {
|
||||
expect(section.gdprRef).toBeDefined()
|
||||
expect(section.gdprRef).toContain('Art. 35')
|
||||
})
|
||||
})
|
||||
|
||||
it('should mark first 4 sections as required', () => {
|
||||
const requiredSections = DSFA_SECTIONS.filter(s => s.required)
|
||||
expect(requiredSections.length).toBe(4)
|
||||
expect(requiredSections.map(s => s.number)).toEqual([1, 2, 3, 4])
|
||||
})
|
||||
|
||||
it('should mark section 5 as optional', () => {
|
||||
const section5 = DSFA_SECTIONS.find(s => s.number === 5)
|
||||
expect(section5?.required).toBe(false)
|
||||
})
|
||||
|
||||
it('should have German titles for all sections', () => {
|
||||
DSFA_SECTIONS.forEach(section => {
|
||||
expect(section.titleDE).toBeDefined()
|
||||
expect(section.titleDE.length).toBeGreaterThan(0)
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
describe('DSFA_STATUS_LABELS', () => {
|
||||
it('should have all status labels defined', () => {
|
||||
expect(DSFA_STATUS_LABELS.draft).toBe('Entwurf')
|
||||
expect(DSFA_STATUS_LABELS.in_review).toBe('In Prüfung')
|
||||
expect(DSFA_STATUS_LABELS.approved).toBe('Genehmigt')
|
||||
expect(DSFA_STATUS_LABELS.rejected).toBe('Abgelehnt')
|
||||
expect(DSFA_STATUS_LABELS.needs_update).toBe('Überarbeitung erforderlich')
|
||||
})
|
||||
})
|
||||
|
||||
describe('DSFA_RISK_LEVEL_LABELS', () => {
|
||||
it('should have all risk level labels defined', () => {
|
||||
expect(DSFA_RISK_LEVEL_LABELS.low).toBe('Niedrig')
|
||||
expect(DSFA_RISK_LEVEL_LABELS.medium).toBe('Mittel')
|
||||
expect(DSFA_RISK_LEVEL_LABELS.high).toBe('Hoch')
|
||||
expect(DSFA_RISK_LEVEL_LABELS.very_high).toBe('Sehr Hoch')
|
||||
})
|
||||
})
|
||||
|
||||
describe('DSFA_LEGAL_BASES', () => {
|
||||
it('should have 6 legal bases defined', () => {
|
||||
expect(Object.keys(DSFA_LEGAL_BASES).length).toBe(6)
|
||||
})
|
||||
|
||||
it('should reference GDPR Article 6', () => {
|
||||
Object.values(DSFA_LEGAL_BASES).forEach(label => {
|
||||
expect(label).toContain('Art. 6')
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
describe('DSFA_AFFECTED_RIGHTS', () => {
|
||||
it('should have multiple affected rights defined', () => {
|
||||
expect(DSFA_AFFECTED_RIGHTS.length).toBeGreaterThan(5)
|
||||
})
|
||||
|
||||
it('should have id and label for each right', () => {
|
||||
DSFA_AFFECTED_RIGHTS.forEach(right => {
|
||||
expect(right.id).toBeDefined()
|
||||
expect(right.label).toBeDefined()
|
||||
})
|
||||
})
|
||||
|
||||
it('should include GDPR data subject rights', () => {
|
||||
const ids = DSFA_AFFECTED_RIGHTS.map(r => r.id)
|
||||
expect(ids).toContain('right_of_access')
|
||||
expect(ids).toContain('right_to_erasure')
|
||||
expect(ids).toContain('right_to_data_portability')
|
||||
})
|
||||
})
|
||||
|
||||
describe('RISK_MATRIX', () => {
|
||||
it('should have 9 cells defined (3x3 matrix)', () => {
|
||||
expect(RISK_MATRIX.length).toBe(9)
|
||||
})
|
||||
|
||||
it('should cover all combinations of likelihood and impact', () => {
|
||||
const likelihoodValues = ['low', 'medium', 'high']
|
||||
const impactValues = ['low', 'medium', 'high']
|
||||
|
||||
likelihoodValues.forEach(likelihood => {
|
||||
impactValues.forEach(impact => {
|
||||
const cell = RISK_MATRIX.find(
|
||||
c => c.likelihood === likelihood && c.impact === impact
|
||||
)
|
||||
expect(cell).toBeDefined()
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
it('should have increasing scores for higher risks', () => {
|
||||
const lowLow = RISK_MATRIX.find(c => c.likelihood === 'low' && c.impact === 'low')
|
||||
const highHigh = RISK_MATRIX.find(c => c.likelihood === 'high' && c.impact === 'high')
|
||||
|
||||
expect(lowLow?.score).toBeLessThan(highHigh?.score || 0)
|
||||
})
|
||||
})
|
||||
|
||||
describe('calculateRiskLevel', () => {
|
||||
it('should return low for low likelihood and low impact', () => {
|
||||
const result = calculateRiskLevel('low', 'low')
|
||||
expect(result.level).toBe('low')
|
||||
expect(result.score).toBe(10)
|
||||
})
|
||||
|
||||
it('should return very_high for high likelihood and high impact', () => {
|
||||
const result = calculateRiskLevel('high', 'high')
|
||||
expect(result.level).toBe('very_high')
|
||||
expect(result.score).toBe(90)
|
||||
})
|
||||
|
||||
it('should return medium for medium likelihood and medium impact', () => {
|
||||
const result = calculateRiskLevel('medium', 'medium')
|
||||
expect(result.level).toBe('medium')
|
||||
expect(result.score).toBe(50)
|
||||
})
|
||||
|
||||
it('should return high for high likelihood and medium impact', () => {
|
||||
const result = calculateRiskLevel('high', 'medium')
|
||||
expect(result.level).toBe('high')
|
||||
expect(result.score).toBe(70)
|
||||
})
|
||||
|
||||
it('should return medium for low likelihood and high impact', () => {
|
||||
const result = calculateRiskLevel('low', 'high')
|
||||
expect(result.level).toBe('medium')
|
||||
expect(result.score).toBe(40)
|
||||
})
|
||||
})
|
||||
|
||||
describe('DSFARisk type', () => {
|
||||
it('should accept valid risk data', () => {
|
||||
const risk: DSFARisk = {
|
||||
id: 'risk-001',
|
||||
category: 'confidentiality',
|
||||
description: 'Unauthorized access to personal data',
|
||||
likelihood: 'medium',
|
||||
impact: 'high',
|
||||
risk_level: 'high',
|
||||
affected_data: ['customer_data', 'financial_data'],
|
||||
}
|
||||
|
||||
expect(risk.id).toBe('risk-001')
|
||||
expect(risk.category).toBe('confidentiality')
|
||||
expect(risk.likelihood).toBe('medium')
|
||||
expect(risk.impact).toBe('high')
|
||||
})
|
||||
})
|
||||
|
||||
describe('DSFAMitigation type', () => {
|
||||
it('should accept valid mitigation data', () => {
|
||||
const mitigation: DSFAMitigation = {
|
||||
id: 'mit-001',
|
||||
risk_id: 'risk-001',
|
||||
description: 'Implement encryption at rest',
|
||||
type: 'technical',
|
||||
status: 'implemented',
|
||||
residual_risk: 'low',
|
||||
responsible_party: 'IT Security Team',
|
||||
}
|
||||
|
||||
expect(mitigation.id).toBe('mit-001')
|
||||
expect(mitigation.type).toBe('technical')
|
||||
expect(mitigation.status).toBe('implemented')
|
||||
})
|
||||
})
|
||||
|
||||
describe('DSFASectionProgress type', () => {
|
||||
it('should track completion for all 5 sections', () => {
|
||||
const progress: DSFASectionProgress = {
|
||||
section_1_complete: true,
|
||||
section_2_complete: true,
|
||||
section_3_complete: false,
|
||||
section_4_complete: false,
|
||||
section_5_complete: false,
|
||||
}
|
||||
|
||||
expect(progress.section_1_complete).toBe(true)
|
||||
expect(progress.section_2_complete).toBe(true)
|
||||
expect(progress.section_3_complete).toBe(false)
|
||||
})
|
||||
})
|
||||
|
||||
describe('DSFA type', () => {
|
||||
it('should accept a complete DSFA object', () => {
|
||||
const dsfa: DSFA = {
|
||||
id: 'dsfa-001',
|
||||
tenant_id: 'tenant-001',
|
||||
name: 'AI Chatbot DSFA',
|
||||
description: 'Data Protection Impact Assessment for AI Chatbot',
|
||||
processing_description: 'Automated customer service using AI',
|
||||
processing_purpose: 'Customer support automation',
|
||||
data_categories: ['contact_data', 'inquiry_content'],
|
||||
data_subjects: ['customers'],
|
||||
recipients: ['internal_staff'],
|
||||
legal_basis: 'legitimate_interest',
|
||||
necessity_assessment: 'Required for efficient customer service',
|
||||
proportionality_assessment: 'Minimal data processing for the purpose',
|
||||
risks: [],
|
||||
overall_risk_level: 'medium',
|
||||
risk_score: 50,
|
||||
mitigations: [],
|
||||
dpo_consulted: false,
|
||||
authority_consulted: false,
|
||||
status: 'draft',
|
||||
section_progress: {
|
||||
section_1_complete: true,
|
||||
section_2_complete: true,
|
||||
section_3_complete: false,
|
||||
section_4_complete: false,
|
||||
section_5_complete: false,
|
||||
},
|
||||
conclusion: '',
|
||||
created_at: new Date().toISOString(),
|
||||
updated_at: new Date().toISOString(),
|
||||
created_by: 'user-001',
|
||||
}
|
||||
|
||||
expect(dsfa.id).toBe('dsfa-001')
|
||||
expect(dsfa.name).toBe('AI Chatbot DSFA')
|
||||
expect(dsfa.status).toBe('draft')
|
||||
expect(dsfa.data_categories).toHaveLength(2)
|
||||
})
|
||||
})
|
||||
399
admin-v2/lib/sdk/dsfa/api.ts
Normal file
399
admin-v2/lib/sdk/dsfa/api.ts
Normal file
@@ -0,0 +1,399 @@
|
||||
/**
|
||||
* DSFA API Client
|
||||
*
|
||||
* API client functions for DSFA (Data Protection Impact Assessment) endpoints.
|
||||
*/
|
||||
|
||||
import type {
|
||||
DSFA,
|
||||
DSFAListResponse,
|
||||
DSFAStatsResponse,
|
||||
CreateDSFARequest,
|
||||
CreateDSFAFromAssessmentRequest,
|
||||
CreateDSFAFromAssessmentResponse,
|
||||
UpdateDSFASectionRequest,
|
||||
SubmitForReviewResponse,
|
||||
ApproveDSFARequest,
|
||||
DSFATriggerInfo,
|
||||
} from './types'
|
||||
|
||||
// =============================================================================
|
||||
// CONFIGURATION
|
||||
// =============================================================================
|
||||
|
||||
const getBaseUrl = () => {
|
||||
if (typeof window !== 'undefined') {
|
||||
// Browser environment
|
||||
return process.env.NEXT_PUBLIC_SDK_API_URL || '/api/sdk/v1'
|
||||
}
|
||||
// Server environment
|
||||
return process.env.SDK_API_URL || 'http://localhost:8080/api/sdk/v1'
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// HELPER FUNCTIONS
|
||||
// =============================================================================
|
||||
|
||||
async function handleResponse<T>(response: Response): Promise<T> {
|
||||
if (!response.ok) {
|
||||
const errorBody = await response.text()
|
||||
let errorMessage = `HTTP ${response.status}`
|
||||
try {
|
||||
const errorJson = JSON.parse(errorBody)
|
||||
errorMessage = errorJson.error || errorJson.message || errorMessage
|
||||
} catch {
|
||||
// Keep HTTP status message
|
||||
}
|
||||
throw new Error(errorMessage)
|
||||
}
|
||||
return response.json()
|
||||
}
|
||||
|
||||
function getHeaders(): HeadersInit {
|
||||
return {
|
||||
'Content-Type': 'application/json',
|
||||
}
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// DSFA CRUD OPERATIONS
|
||||
// =============================================================================
|
||||
|
||||
/**
|
||||
* List all DSFAs for the current tenant
|
||||
*/
|
||||
export async function listDSFAs(status?: string): Promise<DSFA[]> {
|
||||
const url = new URL(`${getBaseUrl()}/dsgvo/dsfas`, window.location.origin)
|
||||
if (status) {
|
||||
url.searchParams.set('status', status)
|
||||
}
|
||||
|
||||
const response = await fetch(url.toString(), {
|
||||
method: 'GET',
|
||||
headers: getHeaders(),
|
||||
credentials: 'include',
|
||||
})
|
||||
|
||||
const data = await handleResponse<DSFAListResponse>(response)
|
||||
return data.dsfas || []
|
||||
}
|
||||
|
||||
/**
|
||||
* Get a single DSFA by ID
|
||||
*/
|
||||
export async function getDSFA(id: string): Promise<DSFA> {
|
||||
const response = await fetch(`${getBaseUrl()}/dsgvo/dsfas/${id}`, {
|
||||
method: 'GET',
|
||||
headers: getHeaders(),
|
||||
credentials: 'include',
|
||||
})
|
||||
|
||||
return handleResponse<DSFA>(response)
|
||||
}
|
||||
|
||||
/**
|
||||
* Create a new DSFA
|
||||
*/
|
||||
export async function createDSFA(data: CreateDSFARequest): Promise<DSFA> {
|
||||
const response = await fetch(`${getBaseUrl()}/dsgvo/dsfas`, {
|
||||
method: 'POST',
|
||||
headers: getHeaders(),
|
||||
credentials: 'include',
|
||||
body: JSON.stringify(data),
|
||||
})
|
||||
|
||||
return handleResponse<DSFA>(response)
|
||||
}
|
||||
|
||||
/**
|
||||
* Update an existing DSFA
|
||||
*/
|
||||
export async function updateDSFA(id: string, data: Partial<DSFA>): Promise<DSFA> {
|
||||
const response = await fetch(`${getBaseUrl()}/dsgvo/dsfas/${id}`, {
|
||||
method: 'PUT',
|
||||
headers: getHeaders(),
|
||||
credentials: 'include',
|
||||
body: JSON.stringify(data),
|
||||
})
|
||||
|
||||
return handleResponse<DSFA>(response)
|
||||
}
|
||||
|
||||
/**
|
||||
* Delete a DSFA
|
||||
*/
|
||||
export async function deleteDSFA(id: string): Promise<void> {
|
||||
const response = await fetch(`${getBaseUrl()}/dsgvo/dsfas/${id}`, {
|
||||
method: 'DELETE',
|
||||
headers: getHeaders(),
|
||||
credentials: 'include',
|
||||
})
|
||||
|
||||
if (!response.ok) {
|
||||
throw new Error(`Failed to delete DSFA: ${response.statusText}`)
|
||||
}
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// DSFA SECTION OPERATIONS
|
||||
// =============================================================================
|
||||
|
||||
/**
|
||||
* Update a specific section of a DSFA
|
||||
*/
|
||||
export async function updateDSFASection(
|
||||
id: string,
|
||||
sectionNumber: number,
|
||||
data: UpdateDSFASectionRequest
|
||||
): Promise<DSFA> {
|
||||
const response = await fetch(`${getBaseUrl()}/dsgvo/dsfas/${id}/sections/${sectionNumber}`, {
|
||||
method: 'PUT',
|
||||
headers: getHeaders(),
|
||||
credentials: 'include',
|
||||
body: JSON.stringify(data),
|
||||
})
|
||||
|
||||
return handleResponse<DSFA>(response)
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// DSFA WORKFLOW OPERATIONS
|
||||
// =============================================================================
|
||||
|
||||
/**
|
||||
* Submit a DSFA for DPO review
|
||||
*/
|
||||
export async function submitDSFAForReview(id: string): Promise<SubmitForReviewResponse> {
|
||||
const response = await fetch(`${getBaseUrl()}/dsgvo/dsfas/${id}/submit-for-review`, {
|
||||
method: 'POST',
|
||||
headers: getHeaders(),
|
||||
credentials: 'include',
|
||||
})
|
||||
|
||||
return handleResponse<SubmitForReviewResponse>(response)
|
||||
}
|
||||
|
||||
/**
|
||||
* Approve or reject a DSFA (DPO/CISO/GF action)
|
||||
*/
|
||||
export async function approveDSFA(id: string, data: ApproveDSFARequest): Promise<{ message: string }> {
|
||||
const response = await fetch(`${getBaseUrl()}/dsgvo/dsfas/${id}/approve`, {
|
||||
method: 'POST',
|
||||
headers: getHeaders(),
|
||||
credentials: 'include',
|
||||
body: JSON.stringify(data),
|
||||
})
|
||||
|
||||
return handleResponse<{ message: string }>(response)
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// DSFA STATISTICS
|
||||
// =============================================================================
|
||||
|
||||
/**
|
||||
* Get DSFA statistics for the dashboard
|
||||
*/
|
||||
export async function getDSFAStats(): Promise<DSFAStatsResponse> {
|
||||
const response = await fetch(`${getBaseUrl()}/dsgvo/dsfas/stats`, {
|
||||
method: 'GET',
|
||||
headers: getHeaders(),
|
||||
credentials: 'include',
|
||||
})
|
||||
|
||||
return handleResponse<DSFAStatsResponse>(response)
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// UCCA INTEGRATION
|
||||
// =============================================================================
|
||||
|
||||
/**
|
||||
* Create a DSFA from a UCCA assessment (pre-filled)
|
||||
*/
|
||||
export async function createDSFAFromAssessment(
|
||||
assessmentId: string,
|
||||
data?: CreateDSFAFromAssessmentRequest
|
||||
): Promise<CreateDSFAFromAssessmentResponse> {
|
||||
const response = await fetch(`${getBaseUrl()}/dsgvo/dsfas/from-assessment/${assessmentId}`, {
|
||||
method: 'POST',
|
||||
headers: getHeaders(),
|
||||
credentials: 'include',
|
||||
body: JSON.stringify(data || {}),
|
||||
})
|
||||
|
||||
return handleResponse<CreateDSFAFromAssessmentResponse>(response)
|
||||
}
|
||||
|
||||
/**
|
||||
* Get a DSFA by its linked UCCA assessment ID
|
||||
*/
|
||||
export async function getDSFAByAssessment(assessmentId: string): Promise<DSFA | null> {
|
||||
try {
|
||||
const response = await fetch(`${getBaseUrl()}/dsgvo/dsfas/by-assessment/${assessmentId}`, {
|
||||
method: 'GET',
|
||||
headers: getHeaders(),
|
||||
credentials: 'include',
|
||||
})
|
||||
|
||||
if (response.status === 404) {
|
||||
return null
|
||||
}
|
||||
|
||||
return handleResponse<DSFA>(response)
|
||||
} catch (error) {
|
||||
// Return null if DSFA not found
|
||||
return null
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if a DSFA is required for a UCCA assessment
|
||||
*/
|
||||
export async function checkDSFARequired(assessmentId: string): Promise<DSFATriggerInfo> {
|
||||
const response = await fetch(`${getBaseUrl()}/ucca/assessments/${assessmentId}/dsfa-required`, {
|
||||
method: 'GET',
|
||||
headers: getHeaders(),
|
||||
credentials: 'include',
|
||||
})
|
||||
|
||||
return handleResponse<DSFATriggerInfo>(response)
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// EXPORT
|
||||
// =============================================================================
|
||||
|
||||
/**
|
||||
* Export a DSFA as JSON
|
||||
*/
|
||||
export async function exportDSFAAsJSON(id: string): Promise<Blob> {
|
||||
const response = await fetch(`${getBaseUrl()}/dsgvo/dsfas/${id}/export?format=json`, {
|
||||
method: 'GET',
|
||||
headers: {
|
||||
'Accept': 'application/json',
|
||||
},
|
||||
credentials: 'include',
|
||||
})
|
||||
|
||||
if (!response.ok) {
|
||||
throw new Error(`Export failed: ${response.statusText}`)
|
||||
}
|
||||
|
||||
return response.blob()
|
||||
}
|
||||
|
||||
/**
|
||||
* Export a DSFA as PDF
|
||||
*/
|
||||
export async function exportDSFAAsPDF(id: string): Promise<Blob> {
|
||||
const response = await fetch(`${getBaseUrl()}/dsgvo/dsfas/${id}/export/pdf`, {
|
||||
method: 'GET',
|
||||
headers: {
|
||||
'Accept': 'application/pdf',
|
||||
},
|
||||
credentials: 'include',
|
||||
})
|
||||
|
||||
if (!response.ok) {
|
||||
throw new Error(`PDF export failed: ${response.statusText}`)
|
||||
}
|
||||
|
||||
return response.blob()
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// RISK & MITIGATION OPERATIONS
|
||||
// =============================================================================
|
||||
|
||||
/**
|
||||
* Add a risk to a DSFA
|
||||
*/
|
||||
export async function addDSFARisk(dsfaId: string, risk: {
|
||||
category: string
|
||||
description: string
|
||||
likelihood: 'low' | 'medium' | 'high'
|
||||
impact: 'low' | 'medium' | 'high'
|
||||
affected_data?: string[]
|
||||
}): Promise<DSFA> {
|
||||
const dsfa = await getDSFA(dsfaId)
|
||||
const newRisk = {
|
||||
id: crypto.randomUUID(),
|
||||
...risk,
|
||||
risk_level: calculateRiskLevelString(risk.likelihood, risk.impact),
|
||||
affected_data: risk.affected_data || [],
|
||||
}
|
||||
|
||||
const updatedRisks = [...(dsfa.risks || []), newRisk]
|
||||
return updateDSFA(dsfaId, { risks: updatedRisks } as Partial<DSFA>)
|
||||
}
|
||||
|
||||
/**
|
||||
* Remove a risk from a DSFA
|
||||
*/
|
||||
export async function removeDSFARisk(dsfaId: string, riskId: string): Promise<DSFA> {
|
||||
const dsfa = await getDSFA(dsfaId)
|
||||
const updatedRisks = (dsfa.risks || []).filter(r => r.id !== riskId)
|
||||
return updateDSFA(dsfaId, { risks: updatedRisks } as Partial<DSFA>)
|
||||
}
|
||||
|
||||
/**
|
||||
* Add a mitigation to a DSFA
|
||||
*/
|
||||
export async function addDSFAMitigation(dsfaId: string, mitigation: {
|
||||
risk_id: string
|
||||
description: string
|
||||
type: 'technical' | 'organizational' | 'legal'
|
||||
responsible_party: string
|
||||
}): Promise<DSFA> {
|
||||
const dsfa = await getDSFA(dsfaId)
|
||||
const newMitigation = {
|
||||
id: crypto.randomUUID(),
|
||||
...mitigation,
|
||||
status: 'planned' as const,
|
||||
residual_risk: 'medium' as const,
|
||||
}
|
||||
|
||||
const updatedMitigations = [...(dsfa.mitigations || []), newMitigation]
|
||||
return updateDSFA(dsfaId, { mitigations: updatedMitigations } as Partial<DSFA>)
|
||||
}
|
||||
|
||||
/**
|
||||
* Update mitigation status
|
||||
*/
|
||||
export async function updateDSFAMitigationStatus(
|
||||
dsfaId: string,
|
||||
mitigationId: string,
|
||||
status: 'planned' | 'in_progress' | 'implemented' | 'verified'
|
||||
): Promise<DSFA> {
|
||||
const dsfa = await getDSFA(dsfaId)
|
||||
const updatedMitigations = (dsfa.mitigations || []).map(m => {
|
||||
if (m.id === mitigationId) {
|
||||
return {
|
||||
...m,
|
||||
status,
|
||||
...(status === 'implemented' && { implemented_at: new Date().toISOString() }),
|
||||
...(status === 'verified' && { verified_at: new Date().toISOString() }),
|
||||
}
|
||||
}
|
||||
return m
|
||||
})
|
||||
|
||||
return updateDSFA(dsfaId, { mitigations: updatedMitigations } as Partial<DSFA>)
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// HELPER FUNCTIONS
|
||||
// =============================================================================
|
||||
|
||||
function calculateRiskLevelString(
|
||||
likelihood: 'low' | 'medium' | 'high',
|
||||
impact: 'low' | 'medium' | 'high'
|
||||
): string {
|
||||
const matrix: Record<string, Record<string, string>> = {
|
||||
low: { low: 'low', medium: 'low', high: 'medium' },
|
||||
medium: { low: 'low', medium: 'medium', high: 'high' },
|
||||
high: { low: 'medium', medium: 'high', high: 'very_high' },
|
||||
}
|
||||
return matrix[likelihood]?.[impact] || 'medium'
|
||||
}
|
||||
8
admin-v2/lib/sdk/dsfa/index.ts
Normal file
8
admin-v2/lib/sdk/dsfa/index.ts
Normal file
@@ -0,0 +1,8 @@
|
||||
/**
|
||||
* DSFA Module
|
||||
*
|
||||
* Exports for DSFA (Data Protection Impact Assessment) functionality.
|
||||
*/
|
||||
|
||||
export * from './types'
|
||||
export * from './api'
|
||||
365
admin-v2/lib/sdk/dsfa/types.ts
Normal file
365
admin-v2/lib/sdk/dsfa/types.ts
Normal file
@@ -0,0 +1,365 @@
|
||||
/**
|
||||
* DSFA Types - Datenschutz-Folgenabschätzung (Art. 35 DSGVO)
|
||||
*
|
||||
* TypeScript type definitions for DSFA (Data Protection Impact Assessment)
|
||||
* aligned with the backend Go models.
|
||||
*/
|
||||
|
||||
// =============================================================================
|
||||
// ENUMS & CONSTANTS
|
||||
// =============================================================================
|
||||
|
||||
export type DSFAStatus = 'draft' | 'in_review' | 'approved' | 'rejected' | 'needs_update'
|
||||
|
||||
export type DSFARiskLevel = 'low' | 'medium' | 'high' | 'very_high'
|
||||
|
||||
export type DSFARiskCategory = 'confidentiality' | 'integrity' | 'availability' | 'rights_freedoms'
|
||||
|
||||
export type DSFAMitigationType = 'technical' | 'organizational' | 'legal'
|
||||
|
||||
export type DSFAMitigationStatus = 'planned' | 'in_progress' | 'implemented' | 'verified'
|
||||
|
||||
export const DSFA_STATUS_LABELS: Record<DSFAStatus, string> = {
|
||||
draft: 'Entwurf',
|
||||
in_review: 'In Prüfung',
|
||||
approved: 'Genehmigt',
|
||||
rejected: 'Abgelehnt',
|
||||
needs_update: 'Überarbeitung erforderlich',
|
||||
}
|
||||
|
||||
export const DSFA_RISK_LEVEL_LABELS: Record<DSFARiskLevel, string> = {
|
||||
low: 'Niedrig',
|
||||
medium: 'Mittel',
|
||||
high: 'Hoch',
|
||||
very_high: 'Sehr Hoch',
|
||||
}
|
||||
|
||||
export const DSFA_LEGAL_BASES = {
|
||||
consent: 'Art. 6 Abs. 1 lit. a DSGVO - Einwilligung',
|
||||
contract: 'Art. 6 Abs. 1 lit. b DSGVO - Vertrag',
|
||||
legal_obligation: 'Art. 6 Abs. 1 lit. c DSGVO - Rechtliche Verpflichtung',
|
||||
vital_interests: 'Art. 6 Abs. 1 lit. d DSGVO - Lebenswichtige Interessen',
|
||||
public_interest: 'Art. 6 Abs. 1 lit. e DSGVO - Öffentliches Interesse',
|
||||
legitimate_interest: 'Art. 6 Abs. 1 lit. f DSGVO - Berechtigtes Interesse',
|
||||
}
|
||||
|
||||
export const DSFA_AFFECTED_RIGHTS = [
|
||||
{ id: 'right_to_information', label: 'Recht auf Information (Art. 13/14)' },
|
||||
{ id: 'right_of_access', label: 'Auskunftsrecht (Art. 15)' },
|
||||
{ id: 'right_to_rectification', label: 'Recht auf Berichtigung (Art. 16)' },
|
||||
{ id: 'right_to_erasure', label: 'Recht auf Löschung (Art. 17)' },
|
||||
{ id: 'right_to_restriction', label: 'Recht auf Einschränkung (Art. 18)' },
|
||||
{ id: 'right_to_data_portability', label: 'Recht auf Datenübertragbarkeit (Art. 20)' },
|
||||
{ id: 'right_to_object', label: 'Widerspruchsrecht (Art. 21)' },
|
||||
{ id: 'right_not_to_be_profiled', label: 'Recht bzgl. Profiling (Art. 22)' },
|
||||
{ id: 'freedom_of_expression', label: 'Meinungsfreiheit' },
|
||||
{ id: 'freedom_of_association', label: 'Versammlungsfreiheit' },
|
||||
{ id: 'non_discrimination', label: 'Nichtdiskriminierung' },
|
||||
{ id: 'data_security', label: 'Datensicherheit' },
|
||||
]
|
||||
|
||||
// =============================================================================
|
||||
// SUB-TYPES
|
||||
// =============================================================================
|
||||
|
||||
export interface DSFARisk {
|
||||
id: string
|
||||
category: DSFARiskCategory
|
||||
description: string
|
||||
likelihood: 'low' | 'medium' | 'high'
|
||||
impact: 'low' | 'medium' | 'high'
|
||||
risk_level: string
|
||||
affected_data: string[]
|
||||
}
|
||||
|
||||
export interface DSFAMitigation {
|
||||
id: string
|
||||
risk_id: string
|
||||
description: string
|
||||
type: DSFAMitigationType
|
||||
status: DSFAMitigationStatus
|
||||
implemented_at?: string
|
||||
verified_at?: string
|
||||
residual_risk: 'low' | 'medium' | 'high'
|
||||
tom_reference?: string
|
||||
responsible_party: string
|
||||
}
|
||||
|
||||
export interface DSFAReviewComment {
|
||||
id: string
|
||||
section: number
|
||||
comment: string
|
||||
created_by: string
|
||||
created_at: string
|
||||
resolved: boolean
|
||||
}
|
||||
|
||||
export interface DSFASectionProgress {
|
||||
section_1_complete: boolean
|
||||
section_2_complete: boolean
|
||||
section_3_complete: boolean
|
||||
section_4_complete: boolean
|
||||
section_5_complete: boolean
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// MAIN DSFA TYPE
|
||||
// =============================================================================
|
||||
|
||||
export interface DSFA {
|
||||
id: string
|
||||
tenant_id: string
|
||||
namespace_id?: string
|
||||
processing_activity_id?: string
|
||||
assessment_id?: string
|
||||
name: string
|
||||
description: string
|
||||
|
||||
// Section 1: Systematische Beschreibung (Art. 35 Abs. 7 lit. a)
|
||||
processing_description: string
|
||||
processing_purpose: string
|
||||
data_categories: string[]
|
||||
data_subjects: string[]
|
||||
recipients: string[]
|
||||
legal_basis: string
|
||||
legal_basis_details?: string
|
||||
|
||||
// Section 2: Notwendigkeit & Verhältnismäßigkeit (Art. 35 Abs. 7 lit. b)
|
||||
necessity_assessment: string
|
||||
proportionality_assessment: string
|
||||
data_minimization?: string
|
||||
alternatives_considered?: string
|
||||
retention_justification?: string
|
||||
|
||||
// Section 3: Risikobewertung (Art. 35 Abs. 7 lit. c)
|
||||
risks: DSFARisk[]
|
||||
overall_risk_level: DSFARiskLevel
|
||||
risk_score: number
|
||||
affected_rights?: string[]
|
||||
triggered_rule_codes?: string[]
|
||||
|
||||
// Section 4: Abhilfemaßnahmen (Art. 35 Abs. 7 lit. d)
|
||||
mitigations: DSFAMitigation[]
|
||||
tom_references?: string[]
|
||||
|
||||
// Section 5: Stellungnahme DSB (Art. 35 Abs. 2 + Art. 36)
|
||||
dpo_consulted: boolean
|
||||
dpo_consulted_at?: string
|
||||
dpo_name?: string
|
||||
dpo_opinion?: string
|
||||
dpo_approved?: boolean
|
||||
authority_consulted: boolean
|
||||
authority_consulted_at?: string
|
||||
authority_reference?: string
|
||||
authority_decision?: string
|
||||
|
||||
// Workflow & Approval
|
||||
status: DSFAStatus
|
||||
submitted_for_review_at?: string
|
||||
submitted_by?: string
|
||||
conclusion: string
|
||||
review_comments?: DSFAReviewComment[]
|
||||
|
||||
// Section Progress Tracking
|
||||
section_progress: DSFASectionProgress
|
||||
|
||||
// Metadata & Audit
|
||||
metadata?: Record<string, unknown>
|
||||
created_at: string
|
||||
updated_at: string
|
||||
created_by: string
|
||||
approved_by?: string
|
||||
approved_at?: string
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// API REQUEST/RESPONSE TYPES
|
||||
// =============================================================================
|
||||
|
||||
export interface DSFAListResponse {
|
||||
dsfas: DSFA[]
|
||||
}
|
||||
|
||||
export interface DSFAStatsResponse {
|
||||
status_stats: Record<DSFAStatus | 'total', number>
|
||||
risk_stats: Record<DSFARiskLevel, number>
|
||||
total: number
|
||||
}
|
||||
|
||||
export interface CreateDSFARequest {
|
||||
name: string
|
||||
description?: string
|
||||
processing_description?: string
|
||||
processing_purpose?: string
|
||||
data_categories?: string[]
|
||||
legal_basis?: string
|
||||
}
|
||||
|
||||
export interface CreateDSFAFromAssessmentRequest {
|
||||
name?: string
|
||||
description?: string
|
||||
}
|
||||
|
||||
export interface CreateDSFAFromAssessmentResponse {
|
||||
dsfa: DSFA
|
||||
prefilled: boolean
|
||||
assessment: unknown // UCCA Assessment
|
||||
message: string
|
||||
}
|
||||
|
||||
export interface UpdateDSFASectionRequest {
|
||||
// Section 1
|
||||
processing_description?: string
|
||||
processing_purpose?: string
|
||||
data_categories?: string[]
|
||||
data_subjects?: string[]
|
||||
recipients?: string[]
|
||||
legal_basis?: string
|
||||
legal_basis_details?: string
|
||||
|
||||
// Section 2
|
||||
necessity_assessment?: string
|
||||
proportionality_assessment?: string
|
||||
data_minimization?: string
|
||||
alternatives_considered?: string
|
||||
retention_justification?: string
|
||||
|
||||
// Section 3
|
||||
overall_risk_level?: DSFARiskLevel
|
||||
risk_score?: number
|
||||
affected_rights?: string[]
|
||||
|
||||
// Section 5
|
||||
dpo_consulted?: boolean
|
||||
dpo_name?: string
|
||||
dpo_opinion?: string
|
||||
authority_consulted?: boolean
|
||||
authority_reference?: string
|
||||
authority_decision?: string
|
||||
}
|
||||
|
||||
export interface SubmitForReviewResponse {
|
||||
message: string
|
||||
dsfa: DSFA
|
||||
}
|
||||
|
||||
export interface ApproveDSFARequest {
|
||||
dpo_opinion: string
|
||||
approved: boolean
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// UCCA INTEGRATION TYPES
|
||||
// =============================================================================
|
||||
|
||||
export interface DSFATriggerInfo {
|
||||
required: boolean
|
||||
reason: string
|
||||
triggered_rules: string[]
|
||||
assessment_id?: string
|
||||
existing_dsfa_id?: string
|
||||
}
|
||||
|
||||
export interface UCCATriggeredRule {
|
||||
code: string
|
||||
title: string
|
||||
description: string
|
||||
severity: 'INFO' | 'WARN' | 'BLOCK'
|
||||
gdpr_ref?: string
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// HELPER TYPES FOR UI
|
||||
// =============================================================================
|
||||
|
||||
export interface DSFASectionConfig {
|
||||
number: number
|
||||
title: string
|
||||
titleDE: string
|
||||
description: string
|
||||
gdprRef: string
|
||||
fields: string[]
|
||||
required: boolean
|
||||
}
|
||||
|
||||
export const DSFA_SECTIONS: DSFASectionConfig[] = [
|
||||
{
|
||||
number: 1,
|
||||
title: 'Processing Description',
|
||||
titleDE: 'Systematische Beschreibung',
|
||||
description: 'Beschreiben Sie die geplante Verarbeitung, ihren Zweck, die Datenkategorien und Rechtsgrundlage.',
|
||||
gdprRef: 'Art. 35 Abs. 7 lit. a DSGVO',
|
||||
fields: ['processing_description', 'processing_purpose', 'data_categories', 'data_subjects', 'recipients', 'legal_basis'],
|
||||
required: true,
|
||||
},
|
||||
{
|
||||
number: 2,
|
||||
title: 'Necessity & Proportionality',
|
||||
titleDE: 'Notwendigkeit & Verhältnismäßigkeit',
|
||||
description: 'Begründen Sie, warum die Verarbeitung notwendig ist und welche Alternativen geprüft wurden.',
|
||||
gdprRef: 'Art. 35 Abs. 7 lit. b DSGVO',
|
||||
fields: ['necessity_assessment', 'proportionality_assessment', 'data_minimization', 'alternatives_considered'],
|
||||
required: true,
|
||||
},
|
||||
{
|
||||
number: 3,
|
||||
title: 'Risk Assessment',
|
||||
titleDE: 'Risikobewertung',
|
||||
description: 'Identifizieren und bewerten Sie die Risiken für die Rechte und Freiheiten der Betroffenen.',
|
||||
gdprRef: 'Art. 35 Abs. 7 lit. c DSGVO',
|
||||
fields: ['risks', 'overall_risk_level', 'risk_score', 'affected_rights'],
|
||||
required: true,
|
||||
},
|
||||
{
|
||||
number: 4,
|
||||
title: 'Mitigation Measures',
|
||||
titleDE: 'Abhilfemaßnahmen',
|
||||
description: 'Definieren Sie technische und organisatorische Maßnahmen zur Risikominimierung.',
|
||||
gdprRef: 'Art. 35 Abs. 7 lit. d DSGVO',
|
||||
fields: ['mitigations', 'tom_references'],
|
||||
required: true,
|
||||
},
|
||||
{
|
||||
number: 5,
|
||||
title: 'DPO Opinion',
|
||||
titleDE: 'Stellungnahme DSB',
|
||||
description: 'Dokumentieren Sie die Konsultation des Datenschutzbeauftragten und ggf. der Aufsichtsbehörde.',
|
||||
gdprRef: 'Art. 35 Abs. 2 + Art. 36 DSGVO',
|
||||
fields: ['dpo_consulted', 'dpo_opinion', 'authority_consulted', 'authority_reference'],
|
||||
required: false,
|
||||
},
|
||||
]
|
||||
|
||||
// =============================================================================
|
||||
// RISK MATRIX HELPERS
|
||||
// =============================================================================
|
||||
|
||||
export interface RiskMatrixCell {
|
||||
likelihood: 'low' | 'medium' | 'high'
|
||||
impact: 'low' | 'medium' | 'high'
|
||||
level: DSFARiskLevel
|
||||
score: number
|
||||
}
|
||||
|
||||
export const RISK_MATRIX: RiskMatrixCell[] = [
|
||||
// Low likelihood
|
||||
{ likelihood: 'low', impact: 'low', level: 'low', score: 10 },
|
||||
{ likelihood: 'low', impact: 'medium', level: 'low', score: 20 },
|
||||
{ likelihood: 'low', impact: 'high', level: 'medium', score: 40 },
|
||||
// Medium likelihood
|
||||
{ likelihood: 'medium', impact: 'low', level: 'low', score: 20 },
|
||||
{ likelihood: 'medium', impact: 'medium', level: 'medium', score: 50 },
|
||||
{ likelihood: 'medium', impact: 'high', level: 'high', score: 70 },
|
||||
// High likelihood
|
||||
{ likelihood: 'high', impact: 'low', level: 'medium', score: 40 },
|
||||
{ likelihood: 'high', impact: 'medium', level: 'high', score: 70 },
|
||||
{ likelihood: 'high', impact: 'high', level: 'very_high', score: 90 },
|
||||
]
|
||||
|
||||
export function calculateRiskLevel(
|
||||
likelihood: 'low' | 'medium' | 'high',
|
||||
impact: 'low' | 'medium' | 'high'
|
||||
): { level: DSFARiskLevel; score: number } {
|
||||
const cell = RISK_MATRIX.find(c => c.likelihood === likelihood && c.impact === impact)
|
||||
return cell ? { level: cell.level, score: cell.score } : { level: 'medium', score: 50 }
|
||||
}
|
||||
Reference in New Issue
Block a user