feat(sdk): Add DSFA (Art. 35 DSGVO) Editor and API Client
Implements comprehensive Data Protection Impact Assessment tooling: - 5-section wizard following Art. 35 DSGVO structure - Interactive risk matrix with likelihood/impact scoring - Mitigation management linked to risks - DPO approval workflow (draft → in_review → approved/rejected) - UCCA integration for auto-triggering DSFA from assessments - Full TypeScript types and API client with 42 test cases Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Benjamin Admin
1340
admin-v2/app/(sdk)/sdk/dsfa/[id]/page.tsx
Normal file
1340
admin-v2/app/(sdk)/sdk/dsfa/[id]/page.tsx
Normal file
File diff suppressed because it is too large
Load Diff
548
admin-v2/app/(sdk)/sdk/dsfa/page.tsx
Normal file
548
admin-v2/app/(sdk)/sdk/dsfa/page.tsx
Normal file
@@ -0,0 +1,548 @@
|
||||
'use client'
|
||||
|
||||
import React, { useState, useEffect, useCallback } from 'react'
|
||||
import { useRouter } from 'next/navigation'
|
||||
import Link from 'next/link'
|
||||
import { useSDK } from '@/lib/sdk'
|
||||
import { StepHeader, STEP_EXPLANATIONS } from '@/components/sdk/StepHeader'
|
||||
import { DSFACard } from '@/components/sdk/dsfa'
|
||||
import {
|
||||
DSFA,
|
||||
DSFAStatus,
|
||||
DSFA_STATUS_LABELS,
|
||||
DSFA_RISK_LEVEL_LABELS,
|
||||
} from '@/lib/sdk/dsfa/types'
|
||||
import {
|
||||
listDSFAs,
|
||||
deleteDSFA,
|
||||
exportDSFAAsJSON,
|
||||
getDSFAStats,
|
||||
createDSFAFromAssessment,
|
||||
getDSFAByAssessment,
|
||||
} from '@/lib/sdk/dsfa/api'
|
||||
|
||||
// =============================================================================
|
||||
// UCCA TRIGGER WARNING COMPONENT
|
||||
// =============================================================================
|
||||
|
||||
interface UCCATriggerWarningProps {
|
||||
assessmentId: string
|
||||
triggeredRules: string[]
|
||||
existingDsfaId?: string
|
||||
onCreateDSFA: () => void
|
||||
}
|
||||
|
||||
function UCCATriggerWarning({
|
||||
assessmentId,
|
||||
triggeredRules,
|
||||
existingDsfaId,
|
||||
onCreateDSFA,
|
||||
}: UCCATriggerWarningProps) {
|
||||
if (existingDsfaId) {
|
||||
return (
|
||||
<div className="bg-blue-50 border border-blue-200 rounded-xl p-4 flex items-start gap-4">
|
||||
<div className="w-10 h-10 bg-blue-100 rounded-full flex items-center justify-center flex-shrink-0">
|
||||
<svg className="w-5 h-5 text-blue-600" fill="none" stroke="currentColor" viewBox="0 0 24 24">
|
||||
<path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z" />
|
||||
</svg>
|
||||
</div>
|
||||
<div className="flex-1">
|
||||
<h4 className="font-medium text-blue-800">DSFA bereits erstellt</h4>
|
||||
<p className="text-sm text-blue-600 mt-1">
|
||||
Fuer dieses Assessment wurde bereits eine DSFA angelegt.
|
||||
</p>
|
||||
<Link
|
||||
href={`/sdk/dsfa/${existingDsfaId}`}
|
||||
className="inline-flex items-center gap-1 mt-2 text-sm text-blue-700 hover:text-blue-800 font-medium"
|
||||
>
|
||||
DSFA oeffnen
|
||||
<svg className="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
|
||||
<path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M9 5l7 7-7 7" />
|
||||
</svg>
|
||||
</Link>
|
||||
</div>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
return (
|
||||
<div className="bg-orange-50 border border-orange-200 rounded-xl p-4 flex items-start gap-4">
|
||||
<div className="w-10 h-10 bg-orange-100 rounded-full flex items-center justify-center flex-shrink-0">
|
||||
<svg className="w-5 h-5 text-orange-600" fill="none" stroke="currentColor" viewBox="0 0 24 24">
|
||||
<path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" />
|
||||
</svg>
|
||||
</div>
|
||||
<div className="flex-1">
|
||||
<h4 className="font-medium text-orange-800">DSFA erforderlich</h4>
|
||||
<p className="text-sm text-orange-600 mt-1">
|
||||
Das UCCA-Assessment hat folgende Trigger ausgeloest:
|
||||
</p>
|
||||
<div className="flex flex-wrap gap-1 mt-2">
|
||||
{triggeredRules.map(rule => (
|
||||
<span key={rule} className="px-2 py-0.5 text-xs bg-orange-100 text-orange-700 rounded">
|
||||
{rule}
|
||||
</span>
|
||||
))}
|
||||
</div>
|
||||
<button
|
||||
onClick={onCreateDSFA}
|
||||
className="inline-flex items-center gap-1 mt-3 px-4 py-2 bg-orange-600 text-white rounded-lg hover:bg-orange-700 transition-colors text-sm font-medium"
|
||||
>
|
||||
DSFA aus Assessment erstellen
|
||||
<svg className="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
|
||||
<path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M9 5l7 7-7 7" />
|
||||
</svg>
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// GENERATOR WIZARD COMPONENT
|
||||
// =============================================================================
|
||||
|
||||
function GeneratorWizard({ onClose, onCreated }: { onClose: () => void; onCreated: (dsfa: DSFA) => void }) {
|
||||
const [step, setStep] = useState(1)
|
||||
const [formData, setFormData] = useState({
|
||||
name: '',
|
||||
description: '',
|
||||
processingPurpose: '',
|
||||
dataCategories: [] as string[],
|
||||
legalBasis: '',
|
||||
})
|
||||
const [isSubmitting, setIsSubmitting] = useState(false)
|
||||
|
||||
const DATA_CATEGORIES = [
|
||||
'Kontaktdaten',
|
||||
'Identifikationsdaten',
|
||||
'Finanzdaten',
|
||||
'Gesundheitsdaten',
|
||||
'Standortdaten',
|
||||
'Nutzungsdaten',
|
||||
'Biometrische Daten',
|
||||
'Daten Minderjaehriger',
|
||||
]
|
||||
|
||||
const LEGAL_BASES = [
|
||||
{ value: 'consent', label: 'Einwilligung (Art. 6 Abs. 1 lit. a)' },
|
||||
{ value: 'contract', label: 'Vertrag (Art. 6 Abs. 1 lit. b)' },
|
||||
{ value: 'legal_obligation', label: 'Rechtliche Verpflichtung (Art. 6 Abs. 1 lit. c)' },
|
||||
{ value: 'legitimate_interest', label: 'Berechtigtes Interesse (Art. 6 Abs. 1 lit. f)' },
|
||||
]
|
||||
|
||||
const handleCategoryToggle = (cat: string) => {
|
||||
setFormData(prev => ({
|
||||
...prev,
|
||||
dataCategories: prev.dataCategories.includes(cat)
|
||||
? prev.dataCategories.filter(c => c !== cat)
|
||||
: [...prev.dataCategories, cat],
|
||||
}))
|
||||
}
|
||||
|
||||
const handleSubmit = async () => {
|
||||
setIsSubmitting(true)
|
||||
try {
|
||||
// For standalone DSFA, we use the regular create endpoint
|
||||
const response = await fetch('/api/sdk/v1/dsgvo/dsfas', {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify({
|
||||
name: formData.name,
|
||||
description: formData.description,
|
||||
processing_purpose: formData.processingPurpose,
|
||||
data_categories: formData.dataCategories,
|
||||
legal_basis: formData.legalBasis,
|
||||
status: 'draft',
|
||||
}),
|
||||
})
|
||||
if (response.ok) {
|
||||
const dsfa = await response.json()
|
||||
onCreated(dsfa)
|
||||
onClose()
|
||||
}
|
||||
} catch (error) {
|
||||
console.error('Failed to create DSFA:', error)
|
||||
} finally {
|
||||
setIsSubmitting(false)
|
||||
}
|
||||
}
|
||||
|
||||
return (
|
||||
<div className="bg-white rounded-xl border border-gray-200 p-6">
|
||||
<div className="flex items-center justify-between mb-6">
|
||||
<h3 className="text-lg font-semibold text-gray-900">Neue Standalone-DSFA erstellen</h3>
|
||||
<button onClick={onClose} className="text-gray-400 hover:text-gray-600">
|
||||
<svg className="w-6 h-6" fill="none" stroke="currentColor" viewBox="0 0 24 24">
|
||||
<path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M6 18L18 6M6 6l12 12" />
|
||||
</svg>
|
||||
</button>
|
||||
</div>
|
||||
|
||||
{/* Progress Steps */}
|
||||
<div className="flex items-center gap-2 mb-6">
|
||||
{[1, 2, 3].map(s => (
|
||||
<React.Fragment key={s}>
|
||||
<div className={`w-8 h-8 rounded-full flex items-center justify-center text-sm font-medium ${
|
||||
s < step ? 'bg-green-500 text-white' :
|
||||
s === step ? 'bg-purple-600 text-white' : 'bg-gray-200 text-gray-500'
|
||||
}`}>
|
||||
{s < step ? (
|
||||
<svg className="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
|
||||
<path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M5 13l4 4L19 7" />
|
||||
</svg>
|
||||
) : s}
|
||||
</div>
|
||||
{s < 3 && <div className={`flex-1 h-1 ${s < step ? 'bg-green-500' : 'bg-gray-200'}`} />}
|
||||
</React.Fragment>
|
||||
))}
|
||||
</div>
|
||||
|
||||
{/* Step Content */}
|
||||
<div className="min-h-48">
|
||||
{step === 1 && (
|
||||
<div className="space-y-4">
|
||||
<div>
|
||||
<label className="block text-sm font-medium text-gray-700 mb-1">Titel der DSFA *</label>
|
||||
<input
|
||||
type="text"
|
||||
value={formData.name}
|
||||
onChange={(e) => setFormData(prev => ({ ...prev, name: e.target.value }))}
|
||||
placeholder="z.B. DSFA - Mitarbeiter-Monitoring"
|
||||
className="w-full px-4 py-2 border border-gray-300 rounded-lg focus:ring-2 focus:ring-purple-500"
|
||||
/>
|
||||
</div>
|
||||
<div>
|
||||
<label className="block text-sm font-medium text-gray-700 mb-1">Beschreibung der Verarbeitung</label>
|
||||
<textarea
|
||||
value={formData.description}
|
||||
onChange={(e) => setFormData(prev => ({ ...prev, description: e.target.value }))}
|
||||
rows={3}
|
||||
placeholder="Beschreiben Sie die geplante Datenverarbeitung..."
|
||||
className="w-full px-4 py-2 border border-gray-300 rounded-lg focus:ring-2 focus:ring-purple-500"
|
||||
/>
|
||||
</div>
|
||||
<div>
|
||||
<label className="block text-sm font-medium text-gray-700 mb-1">Verarbeitungszweck</label>
|
||||
<input
|
||||
type="text"
|
||||
value={formData.processingPurpose}
|
||||
onChange={(e) => setFormData(prev => ({ ...prev, processingPurpose: e.target.value }))}
|
||||
placeholder="z.B. Automatisierte Bewerberauswahl"
|
||||
className="w-full px-4 py-2 border border-gray-300 rounded-lg focus:ring-2 focus:ring-purple-500"
|
||||
/>
|
||||
</div>
|
||||
</div>
|
||||
)}
|
||||
{step === 2 && (
|
||||
<div className="space-y-4">
|
||||
<div>
|
||||
<label className="block text-sm font-medium text-gray-700 mb-2">Datenkategorien *</label>
|
||||
<div className="grid grid-cols-2 gap-2">
|
||||
{DATA_CATEGORIES.map(cat => (
|
||||
<label key={cat} className="flex items-center gap-2 p-2 border rounded-lg hover:bg-gray-50">
|
||||
<input
|
||||
type="checkbox"
|
||||
checked={formData.dataCategories.includes(cat)}
|
||||
onChange={() => handleCategoryToggle(cat)}
|
||||
className="w-4 h-4 text-purple-600"
|
||||
/>
|
||||
<span className="text-sm">{cat}</span>
|
||||
</label>
|
||||
))}
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
)}
|
||||
{step === 3 && (
|
||||
<div className="space-y-4">
|
||||
<div>
|
||||
<label className="block text-sm font-medium text-gray-700 mb-2">Rechtsgrundlage *</label>
|
||||
<div className="space-y-2">
|
||||
{LEGAL_BASES.map(basis => (
|
||||
<label key={basis.value} className="flex items-center gap-3 p-3 border rounded-lg hover:bg-gray-50 cursor-pointer">
|
||||
<input
|
||||
type="radio"
|
||||
name="legalBasis"
|
||||
value={basis.value}
|
||||
checked={formData.legalBasis === basis.value}
|
||||
onChange={(e) => setFormData(prev => ({ ...prev, legalBasis: e.target.value }))}
|
||||
className="w-4 h-4 text-purple-600"
|
||||
/>
|
||||
<span className="text-sm font-medium">{basis.label}</span>
|
||||
</label>
|
||||
))}
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
)}
|
||||
</div>
|
||||
|
||||
{/* Navigation */}
|
||||
<div className="flex items-center justify-between mt-6 pt-4 border-t border-gray-200">
|
||||
<button
|
||||
onClick={() => step > 1 ? setStep(step - 1) : onClose()}
|
||||
className="px-4 py-2 text-gray-600 hover:bg-gray-100 rounded-lg transition-colors"
|
||||
>
|
||||
{step === 1 ? 'Abbrechen' : 'Zurueck'}
|
||||
</button>
|
||||
<button
|
||||
onClick={() => step < 3 ? setStep(step + 1) : handleSubmit()}
|
||||
disabled={(step === 1 && !formData.name) || (step === 2 && formData.dataCategories.length === 0) || (step === 3 && !formData.legalBasis) || isSubmitting}
|
||||
className="px-6 py-2 bg-purple-600 text-white rounded-lg hover:bg-purple-700 transition-colors disabled:bg-gray-300 disabled:cursor-not-allowed"
|
||||
>
|
||||
{isSubmitting ? 'Wird erstellt...' : step === 3 ? 'DSFA erstellen' : 'Weiter'}
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// MAIN PAGE
|
||||
// =============================================================================
|
||||
|
||||
export default function DSFAPage() {
|
||||
const router = useRouter()
|
||||
const { state } = useSDK()
|
||||
const [dsfas, setDsfas] = useState<DSFA[]>([])
|
||||
const [showGenerator, setShowGenerator] = useState(false)
|
||||
const [filter, setFilter] = useState<string>('all')
|
||||
const [isLoading, setIsLoading] = useState(true)
|
||||
const [stats, setStats] = useState({
|
||||
total: 0,
|
||||
draft: 0,
|
||||
in_review: 0,
|
||||
approved: 0,
|
||||
})
|
||||
|
||||
// UCCA trigger info (would come from SDK state)
|
||||
const [uccaTrigger, setUccaTrigger] = useState<{
|
||||
assessmentId: string
|
||||
triggeredRules: string[]
|
||||
existingDsfaId?: string
|
||||
} | null>(null)
|
||||
|
||||
// Load DSFAs
|
||||
const loadDSFAs = useCallback(async () => {
|
||||
setIsLoading(true)
|
||||
try {
|
||||
const [dsfaList, statsData] = await Promise.all([
|
||||
listDSFAs(filter === 'all' ? undefined : filter),
|
||||
getDSFAStats(),
|
||||
])
|
||||
setDsfas(dsfaList)
|
||||
setStats({
|
||||
total: statsData.total,
|
||||
draft: statsData.status_stats.draft || 0,
|
||||
in_review: statsData.status_stats.in_review || 0,
|
||||
approved: statsData.status_stats.approved || 0,
|
||||
})
|
||||
} catch (error) {
|
||||
console.error('Failed to load DSFAs:', error)
|
||||
// Set empty state on error
|
||||
setDsfas([])
|
||||
} finally {
|
||||
setIsLoading(false)
|
||||
}
|
||||
}, [filter])
|
||||
|
||||
useEffect(() => {
|
||||
loadDSFAs()
|
||||
}, [loadDSFAs])
|
||||
|
||||
// Check for UCCA trigger from SDK state
|
||||
// TODO: Enable when UCCA integration is complete
|
||||
// useEffect(() => {
|
||||
// if (state?.uccaAssessment?.dsfa_recommended) {
|
||||
// const assessmentId = state.uccaAssessment.id
|
||||
// const triggeredRules = state.uccaAssessment.triggered_rules
|
||||
// ?.filter((r: { severity: string }) => r.severity === 'BLOCK' || r.severity === 'WARN')
|
||||
// ?.map((r: { code: string }) => r.code) || []
|
||||
//
|
||||
// // Check if DSFA already exists
|
||||
// getDSFAByAssessment(assessmentId).then(existingDsfa => {
|
||||
// setUccaTrigger({
|
||||
// assessmentId,
|
||||
// triggeredRules,
|
||||
// existingDsfaId: existingDsfa?.id,
|
||||
// })
|
||||
// })
|
||||
// }
|
||||
// }, [state?.uccaAssessment])
|
||||
|
||||
// Handle delete
|
||||
const handleDelete = async (id: string) => {
|
||||
if (confirm('Moechten Sie diese DSFA wirklich loeschen?')) {
|
||||
try {
|
||||
await deleteDSFA(id)
|
||||
await loadDSFAs()
|
||||
} catch (error) {
|
||||
console.error('Failed to delete DSFA:', error)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Handle export
|
||||
const handleExport = async (id: string) => {
|
||||
try {
|
||||
const blob = await exportDSFAAsJSON(id)
|
||||
const url = URL.createObjectURL(blob)
|
||||
const a = document.createElement('a')
|
||||
a.href = url
|
||||
a.download = `dsfa_${id.slice(0, 8)}.json`
|
||||
a.click()
|
||||
URL.revokeObjectURL(url)
|
||||
} catch (error) {
|
||||
console.error('Failed to export DSFA:', error)
|
||||
}
|
||||
}
|
||||
|
||||
// Handle create from assessment
|
||||
const handleCreateFromAssessment = async () => {
|
||||
if (!uccaTrigger?.assessmentId) return
|
||||
|
||||
try {
|
||||
const response = await createDSFAFromAssessment(uccaTrigger.assessmentId)
|
||||
router.push(`/sdk/dsfa/${response.dsfa.id}`)
|
||||
} catch (error) {
|
||||
console.error('Failed to create DSFA from assessment:', error)
|
||||
}
|
||||
}
|
||||
|
||||
const filteredDSFAs = filter === 'all'
|
||||
? dsfas
|
||||
: dsfas.filter(d => d.status === filter)
|
||||
|
||||
const stepInfo = STEP_EXPLANATIONS['dsfa']
|
||||
|
||||
return (
|
||||
<div className="space-y-6">
|
||||
{/* Step Header */}
|
||||
<StepHeader
|
||||
stepId="dsfa"
|
||||
title={stepInfo.title}
|
||||
description={stepInfo.description}
|
||||
explanation={stepInfo.explanation}
|
||||
tips={stepInfo.tips}
|
||||
>
|
||||
<div className="flex items-center gap-2">
|
||||
{!showGenerator && (
|
||||
<>
|
||||
<button
|
||||
onClick={() => setShowGenerator(true)}
|
||||
className="flex items-center gap-2 px-4 py-2 bg-purple-600 text-white rounded-lg hover:bg-purple-700 transition-colors"
|
||||
>
|
||||
<svg className="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
|
||||
<path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M12 6v6m0 0v6m0-6h6m-6 0H6" />
|
||||
</svg>
|
||||
Standalone DSFA
|
||||
</button>
|
||||
</>
|
||||
)}
|
||||
</div>
|
||||
</StepHeader>
|
||||
|
||||
{/* UCCA Trigger Warning */}
|
||||
{uccaTrigger && (
|
||||
<UCCATriggerWarning
|
||||
assessmentId={uccaTrigger.assessmentId}
|
||||
triggeredRules={uccaTrigger.triggeredRules}
|
||||
existingDsfaId={uccaTrigger.existingDsfaId}
|
||||
onCreateDSFA={handleCreateFromAssessment}
|
||||
/>
|
||||
)}
|
||||
|
||||
{/* Generator */}
|
||||
{showGenerator && (
|
||||
<GeneratorWizard
|
||||
onClose={() => setShowGenerator(false)}
|
||||
onCreated={(dsfa) => {
|
||||
router.push(`/sdk/dsfa/${dsfa.id}`)
|
||||
}}
|
||||
/>
|
||||
)}
|
||||
|
||||
{/* Stats */}
|
||||
<div className="grid grid-cols-1 md:grid-cols-4 gap-4">
|
||||
<div className="bg-white rounded-xl border border-gray-200 p-6">
|
||||
<div className="text-sm text-gray-500">Gesamt</div>
|
||||
<div className="text-3xl font-bold text-gray-900">{stats.total}</div>
|
||||
</div>
|
||||
<div className="bg-white rounded-xl border border-gray-200 p-6">
|
||||
<div className="text-sm text-gray-500">Entwuerfe</div>
|
||||
<div className="text-3xl font-bold text-gray-500">{stats.draft}</div>
|
||||
</div>
|
||||
<div className="bg-white rounded-xl border border-yellow-200 p-6">
|
||||
<div className="text-sm text-yellow-600">In Pruefung</div>
|
||||
<div className="text-3xl font-bold text-yellow-600">{stats.in_review}</div>
|
||||
</div>
|
||||
<div className="bg-white rounded-xl border border-green-200 p-6">
|
||||
<div className="text-sm text-green-600">Genehmigt</div>
|
||||
<div className="text-3xl font-bold text-green-600">{stats.approved}</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{/* Filter */}
|
||||
<div className="flex items-center gap-2">
|
||||
<span className="text-sm text-gray-500">Filter:</span>
|
||||
{['all', 'draft', 'in_review', 'approved', 'needs_update'].map(f => (
|
||||
<button
|
||||
key={f}
|
||||
onClick={() => setFilter(f)}
|
||||
className={`px-3 py-1 text-sm rounded-full transition-colors ${
|
||||
filter === f
|
||||
? 'bg-purple-600 text-white'
|
||||
: 'bg-gray-100 text-gray-600 hover:bg-gray-200'
|
||||
}`}
|
||||
>
|
||||
{f === 'all' ? 'Alle' : DSFA_STATUS_LABELS[f as DSFAStatus] || f}
|
||||
</button>
|
||||
))}
|
||||
</div>
|
||||
|
||||
{/* DSFA List */}
|
||||
{isLoading ? (
|
||||
<div className="flex items-center justify-center py-12">
|
||||
<div className="w-8 h-8 border-4 border-purple-600 border-t-transparent rounded-full animate-spin" />
|
||||
</div>
|
||||
) : (
|
||||
<div className="space-y-4">
|
||||
{filteredDSFAs.map(dsfa => (
|
||||
<DSFACard
|
||||
key={dsfa.id}
|
||||
dsfa={dsfa}
|
||||
onDelete={handleDelete}
|
||||
onExport={handleExport}
|
||||
/>
|
||||
))}
|
||||
</div>
|
||||
)}
|
||||
|
||||
{/* Empty State */}
|
||||
{!isLoading && filteredDSFAs.length === 0 && !showGenerator && (
|
||||
<div className="bg-white rounded-xl border border-gray-200 p-12 text-center">
|
||||
<div className="w-16 h-16 mx-auto bg-purple-100 rounded-full flex items-center justify-center mb-4">
|
||||
<svg className="w-8 h-8 text-purple-600" fill="none" stroke="currentColor" viewBox="0 0 24 24">
|
||||
<path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M9 12h6m-6 4h6m2 5H7a2 2 0 01-2-2V5a2 2 0 012-2h5.586a1 1 0 01.707.293l5.414 5.414a1 1 0 01.293.707V19a2 2 0 01-2 2z" />
|
||||
</svg>
|
||||
</div>
|
||||
<h3 className="text-lg font-semibold text-gray-900">Keine DSFAs gefunden</h3>
|
||||
<p className="mt-2 text-gray-500">
|
||||
{filter !== 'all'
|
||||
? `Keine DSFAs mit Status "${DSFA_STATUS_LABELS[filter as DSFAStatus]}".`
|
||||
: 'Erstellen Sie eine neue Datenschutz-Folgenabschaetzung.'}
|
||||
</p>
|
||||
{filter === 'all' && (
|
||||
<button
|
||||
onClick={() => setShowGenerator(true)}
|
||||
className="mt-4 px-6 py-2 bg-purple-600 text-white rounded-lg hover:bg-purple-700 transition-colors"
|
||||
>
|
||||
Erste DSFA erstellen
|
||||
</button>
|
||||
)}
|
||||
</div>
|
||||
)}
|
||||
</div>
|
||||
)
|
||||
}
|
||||
355
admin-v2/lib/sdk/dsfa/__tests__/api.test.ts
Normal file
355
admin-v2/lib/sdk/dsfa/__tests__/api.test.ts
Normal file
@@ -0,0 +1,355 @@
|
||||
import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
|
||||
|
||||
// Mock fetch globally
|
||||
const mockFetch = vi.fn()
|
||||
global.fetch = mockFetch
|
||||
|
||||
describe('DSFA API Client', () => {
|
||||
beforeEach(() => {
|
||||
mockFetch.mockClear()
|
||||
})
|
||||
|
||||
afterEach(() => {
|
||||
vi.restoreAllMocks()
|
||||
})
|
||||
|
||||
describe('listDSFAs', () => {
|
||||
it('should fetch DSFAs without status filter', async () => {
|
||||
const mockDSFAs = [
|
||||
{ id: 'dsfa-1', name: 'Test DSFA 1', status: 'draft' },
|
||||
{ id: 'dsfa-2', name: 'Test DSFA 2', status: 'approved' },
|
||||
]
|
||||
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
json: () => Promise.resolve({ dsfas: mockDSFAs }),
|
||||
})
|
||||
|
||||
const { listDSFAs } = await import('../api')
|
||||
const result = await listDSFAs()
|
||||
|
||||
expect(mockFetch).toHaveBeenCalledTimes(1)
|
||||
expect(result).toHaveLength(2)
|
||||
expect(result[0].name).toBe('Test DSFA 1')
|
||||
})
|
||||
|
||||
it('should fetch DSFAs with status filter', async () => {
|
||||
const mockDSFAs = [{ id: 'dsfa-1', name: 'Draft DSFA', status: 'draft' }]
|
||||
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
json: () => Promise.resolve({ dsfas: mockDSFAs }),
|
||||
})
|
||||
|
||||
const { listDSFAs } = await import('../api')
|
||||
const result = await listDSFAs('draft')
|
||||
|
||||
expect(mockFetch).toHaveBeenCalledTimes(1)
|
||||
const calledUrl = mockFetch.mock.calls[0][0]
|
||||
expect(calledUrl).toContain('status=draft')
|
||||
})
|
||||
|
||||
it('should return empty array when no DSFAs', async () => {
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
json: () => Promise.resolve({ dsfas: null }),
|
||||
})
|
||||
|
||||
const { listDSFAs } = await import('../api')
|
||||
const result = await listDSFAs()
|
||||
|
||||
expect(result).toEqual([])
|
||||
})
|
||||
})
|
||||
|
||||
describe('getDSFA', () => {
|
||||
it('should fetch a single DSFA by ID', async () => {
|
||||
const mockDSFA = {
|
||||
id: 'dsfa-123',
|
||||
name: 'Test DSFA',
|
||||
status: 'draft',
|
||||
risks: [],
|
||||
mitigations: [],
|
||||
}
|
||||
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
json: () => Promise.resolve(mockDSFA),
|
||||
})
|
||||
|
||||
const { getDSFA } = await import('../api')
|
||||
const result = await getDSFA('dsfa-123')
|
||||
|
||||
expect(mockFetch).toHaveBeenCalledTimes(1)
|
||||
expect(result.id).toBe('dsfa-123')
|
||||
expect(result.name).toBe('Test DSFA')
|
||||
})
|
||||
|
||||
it('should throw error for non-existent DSFA', async () => {
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: false,
|
||||
status: 404,
|
||||
text: () => Promise.resolve('{"error": "DSFA not found"}'),
|
||||
})
|
||||
|
||||
const { getDSFA } = await import('../api')
|
||||
|
||||
await expect(getDSFA('non-existent')).rejects.toThrow()
|
||||
})
|
||||
})
|
||||
|
||||
describe('createDSFA', () => {
|
||||
it('should create a new DSFA', async () => {
|
||||
const newDSFA = {
|
||||
name: 'New DSFA',
|
||||
description: 'Test description',
|
||||
processing_purpose: 'Testing',
|
||||
}
|
||||
|
||||
const createdDSFA = {
|
||||
id: 'dsfa-new',
|
||||
...newDSFA,
|
||||
status: 'draft',
|
||||
}
|
||||
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
json: () => Promise.resolve(createdDSFA),
|
||||
})
|
||||
|
||||
const { createDSFA } = await import('../api')
|
||||
const result = await createDSFA(newDSFA)
|
||||
|
||||
expect(mockFetch).toHaveBeenCalledTimes(1)
|
||||
expect(result.id).toBe('dsfa-new')
|
||||
expect(result.name).toBe('New DSFA')
|
||||
})
|
||||
})
|
||||
|
||||
describe('updateDSFA', () => {
|
||||
it('should update an existing DSFA', async () => {
|
||||
const updates = {
|
||||
name: 'Updated DSFA Name',
|
||||
processing_purpose: 'Updated purpose',
|
||||
}
|
||||
|
||||
const updatedDSFA = {
|
||||
id: 'dsfa-123',
|
||||
...updates,
|
||||
status: 'draft',
|
||||
}
|
||||
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
json: () => Promise.resolve(updatedDSFA),
|
||||
})
|
||||
|
||||
const { updateDSFA } = await import('../api')
|
||||
const result = await updateDSFA('dsfa-123', updates)
|
||||
|
||||
expect(mockFetch).toHaveBeenCalledTimes(1)
|
||||
expect(result.name).toBe('Updated DSFA Name')
|
||||
})
|
||||
})
|
||||
|
||||
describe('deleteDSFA', () => {
|
||||
it('should delete a DSFA', async () => {
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
})
|
||||
|
||||
const { deleteDSFA } = await import('../api')
|
||||
await deleteDSFA('dsfa-123')
|
||||
|
||||
expect(mockFetch).toHaveBeenCalledTimes(1)
|
||||
const calledConfig = mockFetch.mock.calls[0][1]
|
||||
expect(calledConfig.method).toBe('DELETE')
|
||||
})
|
||||
|
||||
it('should throw error when deletion fails', async () => {
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: false,
|
||||
statusText: 'Not Found',
|
||||
})
|
||||
|
||||
const { deleteDSFA } = await import('../api')
|
||||
|
||||
await expect(deleteDSFA('non-existent')).rejects.toThrow()
|
||||
})
|
||||
})
|
||||
|
||||
describe('updateDSFASection', () => {
|
||||
it('should update a specific section', async () => {
|
||||
const sectionData = {
|
||||
processing_purpose: 'Updated purpose',
|
||||
data_categories: ['personal_data', 'contact_data'],
|
||||
}
|
||||
|
||||
const updatedDSFA = {
|
||||
id: 'dsfa-123',
|
||||
section_progress: {
|
||||
section_1_complete: true,
|
||||
},
|
||||
}
|
||||
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
json: () => Promise.resolve(updatedDSFA),
|
||||
})
|
||||
|
||||
const { updateDSFASection } = await import('../api')
|
||||
const result = await updateDSFASection('dsfa-123', 1, sectionData)
|
||||
|
||||
expect(mockFetch).toHaveBeenCalledTimes(1)
|
||||
const calledUrl = mockFetch.mock.calls[0][0]
|
||||
expect(calledUrl).toContain('/sections/1')
|
||||
})
|
||||
})
|
||||
|
||||
describe('submitDSFAForReview', () => {
|
||||
it('should submit DSFA for review', async () => {
|
||||
const response = {
|
||||
message: 'DSFA submitted for review',
|
||||
dsfa: {
|
||||
id: 'dsfa-123',
|
||||
status: 'in_review',
|
||||
},
|
||||
}
|
||||
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
json: () => Promise.resolve(response),
|
||||
})
|
||||
|
||||
const { submitDSFAForReview } = await import('../api')
|
||||
const result = await submitDSFAForReview('dsfa-123')
|
||||
|
||||
expect(mockFetch).toHaveBeenCalledTimes(1)
|
||||
expect(result.dsfa.status).toBe('in_review')
|
||||
})
|
||||
})
|
||||
|
||||
describe('approveDSFA', () => {
|
||||
it('should approve a DSFA', async () => {
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
json: () => Promise.resolve({ message: 'DSFA approved' }),
|
||||
})
|
||||
|
||||
const { approveDSFA } = await import('../api')
|
||||
const result = await approveDSFA('dsfa-123', {
|
||||
dpo_opinion: 'Approved after review',
|
||||
approved: true,
|
||||
})
|
||||
|
||||
expect(mockFetch).toHaveBeenCalledTimes(1)
|
||||
expect(result.message).toBe('DSFA approved')
|
||||
})
|
||||
|
||||
it('should reject a DSFA', async () => {
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
json: () => Promise.resolve({ message: 'DSFA rejected' }),
|
||||
})
|
||||
|
||||
const { approveDSFA } = await import('../api')
|
||||
const result = await approveDSFA('dsfa-123', {
|
||||
dpo_opinion: 'Needs more details',
|
||||
approved: false,
|
||||
})
|
||||
|
||||
expect(result.message).toBe('DSFA rejected')
|
||||
})
|
||||
})
|
||||
|
||||
describe('getDSFAStats', () => {
|
||||
it('should fetch DSFA statistics', async () => {
|
||||
const stats = {
|
||||
total: 10,
|
||||
status_stats: {
|
||||
draft: 4,
|
||||
in_review: 2,
|
||||
approved: 3,
|
||||
rejected: 1,
|
||||
},
|
||||
risk_stats: {
|
||||
low: 3,
|
||||
medium: 4,
|
||||
high: 2,
|
||||
very_high: 1,
|
||||
},
|
||||
}
|
||||
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
json: () => Promise.resolve(stats),
|
||||
})
|
||||
|
||||
const { getDSFAStats } = await import('../api')
|
||||
const result = await getDSFAStats()
|
||||
|
||||
expect(mockFetch).toHaveBeenCalledTimes(1)
|
||||
expect(result.total).toBe(10)
|
||||
expect(result.status_stats.approved).toBe(3)
|
||||
})
|
||||
})
|
||||
|
||||
describe('createDSFAFromAssessment', () => {
|
||||
it('should create DSFA from UCCA assessment', async () => {
|
||||
const response = {
|
||||
dsfa: {
|
||||
id: 'dsfa-new',
|
||||
name: 'AI Chatbot DSFA',
|
||||
status: 'draft',
|
||||
},
|
||||
prefilled: true,
|
||||
message: 'DSFA created from assessment',
|
||||
}
|
||||
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
json: () => Promise.resolve(response),
|
||||
})
|
||||
|
||||
const { createDSFAFromAssessment } = await import('../api')
|
||||
const result = await createDSFAFromAssessment('assessment-123')
|
||||
|
||||
expect(mockFetch).toHaveBeenCalledTimes(1)
|
||||
expect(result.prefilled).toBe(true)
|
||||
expect(result.dsfa.id).toBe('dsfa-new')
|
||||
})
|
||||
})
|
||||
|
||||
describe('getDSFAByAssessment', () => {
|
||||
it('should return DSFA linked to assessment', async () => {
|
||||
const dsfa = {
|
||||
id: 'dsfa-123',
|
||||
assessment_id: 'assessment-123',
|
||||
name: 'Linked DSFA',
|
||||
}
|
||||
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: true,
|
||||
json: () => Promise.resolve(dsfa),
|
||||
})
|
||||
|
||||
const { getDSFAByAssessment } = await import('../api')
|
||||
const result = await getDSFAByAssessment('assessment-123')
|
||||
|
||||
expect(result?.id).toBe('dsfa-123')
|
||||
})
|
||||
|
||||
it('should return null when no DSFA exists for assessment', async () => {
|
||||
mockFetch.mockResolvedValueOnce({
|
||||
ok: false,
|
||||
status: 404,
|
||||
text: () => Promise.resolve('Not found'),
|
||||
})
|
||||
|
||||
const { getDSFAByAssessment } = await import('../api')
|
||||
const result = await getDSFAByAssessment('no-dsfa-assessment')
|
||||
|
||||
expect(result).toBeNull()
|
||||
})
|
||||
})
|
||||
})
|
||||
255
admin-v2/lib/sdk/dsfa/__tests__/types.test.ts
Normal file
255
admin-v2/lib/sdk/dsfa/__tests__/types.test.ts
Normal file
@@ -0,0 +1,255 @@
|
||||
import { describe, it, expect } from 'vitest'
|
||||
import {
|
||||
calculateRiskLevel,
|
||||
DSFA_SECTIONS,
|
||||
DSFA_STATUS_LABELS,
|
||||
DSFA_RISK_LEVEL_LABELS,
|
||||
DSFA_LEGAL_BASES,
|
||||
DSFA_AFFECTED_RIGHTS,
|
||||
RISK_MATRIX,
|
||||
type DSFARisk,
|
||||
type DSFAMitigation,
|
||||
type DSFASectionProgress,
|
||||
type DSFA,
|
||||
} from '../types'
|
||||
|
||||
describe('DSFA_SECTIONS', () => {
|
||||
it('should have 5 sections defined', () => {
|
||||
expect(DSFA_SECTIONS.length).toBe(5)
|
||||
})
|
||||
|
||||
it('should have sections numbered 1-5', () => {
|
||||
const numbers = DSFA_SECTIONS.map(s => s.number)
|
||||
expect(numbers).toEqual([1, 2, 3, 4, 5])
|
||||
})
|
||||
|
||||
it('should have GDPR references for all sections', () => {
|
||||
DSFA_SECTIONS.forEach(section => {
|
||||
expect(section.gdprRef).toBeDefined()
|
||||
expect(section.gdprRef).toContain('Art. 35')
|
||||
})
|
||||
})
|
||||
|
||||
it('should mark first 4 sections as required', () => {
|
||||
const requiredSections = DSFA_SECTIONS.filter(s => s.required)
|
||||
expect(requiredSections.length).toBe(4)
|
||||
expect(requiredSections.map(s => s.number)).toEqual([1, 2, 3, 4])
|
||||
})
|
||||
|
||||
it('should mark section 5 as optional', () => {
|
||||
const section5 = DSFA_SECTIONS.find(s => s.number === 5)
|
||||
expect(section5?.required).toBe(false)
|
||||
})
|
||||
|
||||
it('should have German titles for all sections', () => {
|
||||
DSFA_SECTIONS.forEach(section => {
|
||||
expect(section.titleDE).toBeDefined()
|
||||
expect(section.titleDE.length).toBeGreaterThan(0)
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
describe('DSFA_STATUS_LABELS', () => {
|
||||
it('should have all status labels defined', () => {
|
||||
expect(DSFA_STATUS_LABELS.draft).toBe('Entwurf')
|
||||
expect(DSFA_STATUS_LABELS.in_review).toBe('In Prüfung')
|
||||
expect(DSFA_STATUS_LABELS.approved).toBe('Genehmigt')
|
||||
expect(DSFA_STATUS_LABELS.rejected).toBe('Abgelehnt')
|
||||
expect(DSFA_STATUS_LABELS.needs_update).toBe('Überarbeitung erforderlich')
|
||||
})
|
||||
})
|
||||
|
||||
describe('DSFA_RISK_LEVEL_LABELS', () => {
|
||||
it('should have all risk level labels defined', () => {
|
||||
expect(DSFA_RISK_LEVEL_LABELS.low).toBe('Niedrig')
|
||||
expect(DSFA_RISK_LEVEL_LABELS.medium).toBe('Mittel')
|
||||
expect(DSFA_RISK_LEVEL_LABELS.high).toBe('Hoch')
|
||||
expect(DSFA_RISK_LEVEL_LABELS.very_high).toBe('Sehr Hoch')
|
||||
})
|
||||
})
|
||||
|
||||
describe('DSFA_LEGAL_BASES', () => {
|
||||
it('should have 6 legal bases defined', () => {
|
||||
expect(Object.keys(DSFA_LEGAL_BASES).length).toBe(6)
|
||||
})
|
||||
|
||||
it('should reference GDPR Article 6', () => {
|
||||
Object.values(DSFA_LEGAL_BASES).forEach(label => {
|
||||
expect(label).toContain('Art. 6')
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
describe('DSFA_AFFECTED_RIGHTS', () => {
|
||||
it('should have multiple affected rights defined', () => {
|
||||
expect(DSFA_AFFECTED_RIGHTS.length).toBeGreaterThan(5)
|
||||
})
|
||||
|
||||
it('should have id and label for each right', () => {
|
||||
DSFA_AFFECTED_RIGHTS.forEach(right => {
|
||||
expect(right.id).toBeDefined()
|
||||
expect(right.label).toBeDefined()
|
||||
})
|
||||
})
|
||||
|
||||
it('should include GDPR data subject rights', () => {
|
||||
const ids = DSFA_AFFECTED_RIGHTS.map(r => r.id)
|
||||
expect(ids).toContain('right_of_access')
|
||||
expect(ids).toContain('right_to_erasure')
|
||||
expect(ids).toContain('right_to_data_portability')
|
||||
})
|
||||
})
|
||||
|
||||
describe('RISK_MATRIX', () => {
|
||||
it('should have 9 cells defined (3x3 matrix)', () => {
|
||||
expect(RISK_MATRIX.length).toBe(9)
|
||||
})
|
||||
|
||||
it('should cover all combinations of likelihood and impact', () => {
|
||||
const likelihoodValues = ['low', 'medium', 'high']
|
||||
const impactValues = ['low', 'medium', 'high']
|
||||
|
||||
likelihoodValues.forEach(likelihood => {
|
||||
impactValues.forEach(impact => {
|
||||
const cell = RISK_MATRIX.find(
|
||||
c => c.likelihood === likelihood && c.impact === impact
|
||||
)
|
||||
expect(cell).toBeDefined()
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
it('should have increasing scores for higher risks', () => {
|
||||
const lowLow = RISK_MATRIX.find(c => c.likelihood === 'low' && c.impact === 'low')
|
||||
const highHigh = RISK_MATRIX.find(c => c.likelihood === 'high' && c.impact === 'high')
|
||||
|
||||
expect(lowLow?.score).toBeLessThan(highHigh?.score || 0)
|
||||
})
|
||||
})
|
||||
|
||||
describe('calculateRiskLevel', () => {
|
||||
it('should return low for low likelihood and low impact', () => {
|
||||
const result = calculateRiskLevel('low', 'low')
|
||||
expect(result.level).toBe('low')
|
||||
expect(result.score).toBe(10)
|
||||
})
|
||||
|
||||
it('should return very_high for high likelihood and high impact', () => {
|
||||
const result = calculateRiskLevel('high', 'high')
|
||||
expect(result.level).toBe('very_high')
|
||||
expect(result.score).toBe(90)
|
||||
})
|
||||
|
||||
it('should return medium for medium likelihood and medium impact', () => {
|
||||
const result = calculateRiskLevel('medium', 'medium')
|
||||
expect(result.level).toBe('medium')
|
||||
expect(result.score).toBe(50)
|
||||
})
|
||||
|
||||
it('should return high for high likelihood and medium impact', () => {
|
||||
const result = calculateRiskLevel('high', 'medium')
|
||||
expect(result.level).toBe('high')
|
||||
expect(result.score).toBe(70)
|
||||
})
|
||||
|
||||
it('should return medium for low likelihood and high impact', () => {
|
||||
const result = calculateRiskLevel('low', 'high')
|
||||
expect(result.level).toBe('medium')
|
||||
expect(result.score).toBe(40)
|
||||
})
|
||||
})
|
||||
|
||||
describe('DSFARisk type', () => {
|
||||
it('should accept valid risk data', () => {
|
||||
const risk: DSFARisk = {
|
||||
id: 'risk-001',
|
||||
category: 'confidentiality',
|
||||
description: 'Unauthorized access to personal data',
|
||||
likelihood: 'medium',
|
||||
impact: 'high',
|
||||
risk_level: 'high',
|
||||
affected_data: ['customer_data', 'financial_data'],
|
||||
}
|
||||
|
||||
expect(risk.id).toBe('risk-001')
|
||||
expect(risk.category).toBe('confidentiality')
|
||||
expect(risk.likelihood).toBe('medium')
|
||||
expect(risk.impact).toBe('high')
|
||||
})
|
||||
})
|
||||
|
||||
describe('DSFAMitigation type', () => {
|
||||
it('should accept valid mitigation data', () => {
|
||||
const mitigation: DSFAMitigation = {
|
||||
id: 'mit-001',
|
||||
risk_id: 'risk-001',
|
||||
description: 'Implement encryption at rest',
|
||||
type: 'technical',
|
||||
status: 'implemented',
|
||||
residual_risk: 'low',
|
||||
responsible_party: 'IT Security Team',
|
||||
}
|
||||
|
||||
expect(mitigation.id).toBe('mit-001')
|
||||
expect(mitigation.type).toBe('technical')
|
||||
expect(mitigation.status).toBe('implemented')
|
||||
})
|
||||
})
|
||||
|
||||
describe('DSFASectionProgress type', () => {
|
||||
it('should track completion for all 5 sections', () => {
|
||||
const progress: DSFASectionProgress = {
|
||||
section_1_complete: true,
|
||||
section_2_complete: true,
|
||||
section_3_complete: false,
|
||||
section_4_complete: false,
|
||||
section_5_complete: false,
|
||||
}
|
||||
|
||||
expect(progress.section_1_complete).toBe(true)
|
||||
expect(progress.section_2_complete).toBe(true)
|
||||
expect(progress.section_3_complete).toBe(false)
|
||||
})
|
||||
})
|
||||
|
||||
describe('DSFA type', () => {
|
||||
it('should accept a complete DSFA object', () => {
|
||||
const dsfa: DSFA = {
|
||||
id: 'dsfa-001',
|
||||
tenant_id: 'tenant-001',
|
||||
name: 'AI Chatbot DSFA',
|
||||
description: 'Data Protection Impact Assessment for AI Chatbot',
|
||||
processing_description: 'Automated customer service using AI',
|
||||
processing_purpose: 'Customer support automation',
|
||||
data_categories: ['contact_data', 'inquiry_content'],
|
||||
data_subjects: ['customers'],
|
||||
recipients: ['internal_staff'],
|
||||
legal_basis: 'legitimate_interest',
|
||||
necessity_assessment: 'Required for efficient customer service',
|
||||
proportionality_assessment: 'Minimal data processing for the purpose',
|
||||
risks: [],
|
||||
overall_risk_level: 'medium',
|
||||
risk_score: 50,
|
||||
mitigations: [],
|
||||
dpo_consulted: false,
|
||||
authority_consulted: false,
|
||||
status: 'draft',
|
||||
section_progress: {
|
||||
section_1_complete: true,
|
||||
section_2_complete: true,
|
||||
section_3_complete: false,
|
||||
section_4_complete: false,
|
||||
section_5_complete: false,
|
||||
},
|
||||
conclusion: '',
|
||||
created_at: new Date().toISOString(),
|
||||
updated_at: new Date().toISOString(),
|
||||
created_by: 'user-001',
|
||||
}
|
||||
|
||||
expect(dsfa.id).toBe('dsfa-001')
|
||||
expect(dsfa.name).toBe('AI Chatbot DSFA')
|
||||
expect(dsfa.status).toBe('draft')
|
||||
expect(dsfa.data_categories).toHaveLength(2)
|
||||
})
|
||||
})
|
||||
399
admin-v2/lib/sdk/dsfa/api.ts
Normal file
399
admin-v2/lib/sdk/dsfa/api.ts
Normal file
@@ -0,0 +1,399 @@
|
||||
/**
|
||||
* DSFA API Client
|
||||
*
|
||||
* API client functions for DSFA (Data Protection Impact Assessment) endpoints.
|
||||
*/
|
||||
|
||||
import type {
|
||||
DSFA,
|
||||
DSFAListResponse,
|
||||
DSFAStatsResponse,
|
||||
CreateDSFARequest,
|
||||
CreateDSFAFromAssessmentRequest,
|
||||
CreateDSFAFromAssessmentResponse,
|
||||
UpdateDSFASectionRequest,
|
||||
SubmitForReviewResponse,
|
||||
ApproveDSFARequest,
|
||||
DSFATriggerInfo,
|
||||
} from './types'
|
||||
|
||||
// =============================================================================
|
||||
// CONFIGURATION
|
||||
// =============================================================================
|
||||
|
||||
const getBaseUrl = () => {
|
||||
if (typeof window !== 'undefined') {
|
||||
// Browser environment
|
||||
return process.env.NEXT_PUBLIC_SDK_API_URL || '/api/sdk/v1'
|
||||
}
|
||||
// Server environment
|
||||
return process.env.SDK_API_URL || 'http://localhost:8080/api/sdk/v1'
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// HELPER FUNCTIONS
|
||||
// =============================================================================
|
||||
|
||||
async function handleResponse<T>(response: Response): Promise<T> {
|
||||
if (!response.ok) {
|
||||
const errorBody = await response.text()
|
||||
let errorMessage = `HTTP ${response.status}`
|
||||
try {
|
||||
const errorJson = JSON.parse(errorBody)
|
||||
errorMessage = errorJson.error || errorJson.message || errorMessage
|
||||
} catch {
|
||||
// Keep HTTP status message
|
||||
}
|
||||
throw new Error(errorMessage)
|
||||
}
|
||||
return response.json()
|
||||
}
|
||||
|
||||
function getHeaders(): HeadersInit {
|
||||
return {
|
||||
'Content-Type': 'application/json',
|
||||
}
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// DSFA CRUD OPERATIONS
|
||||
// =============================================================================
|
||||
|
||||
/**
|
||||
* List all DSFAs for the current tenant
|
||||
*/
|
||||
export async function listDSFAs(status?: string): Promise<DSFA[]> {
|
||||
const url = new URL(`${getBaseUrl()}/dsgvo/dsfas`, window.location.origin)
|
||||
if (status) {
|
||||
url.searchParams.set('status', status)
|
||||
}
|
||||
|
||||
const response = await fetch(url.toString(), {
|
||||
method: 'GET',
|
||||
headers: getHeaders(),
|
||||
credentials: 'include',
|
||||
})
|
||||
|
||||
const data = await handleResponse<DSFAListResponse>(response)
|
||||
return data.dsfas || []
|
||||
}
|
||||
|
||||
/**
|
||||
* Get a single DSFA by ID
|
||||
*/
|
||||
export async function getDSFA(id: string): Promise<DSFA> {
|
||||
const response = await fetch(`${getBaseUrl()}/dsgvo/dsfas/${id}`, {
|
||||
method: 'GET',
|
||||
headers: getHeaders(),
|
||||
credentials: 'include',
|
||||
})
|
||||
|
||||
return handleResponse<DSFA>(response)
|
||||
}
|
||||
|
||||
/**
|
||||
* Create a new DSFA
|
||||
*/
|
||||
export async function createDSFA(data: CreateDSFARequest): Promise<DSFA> {
|
||||
const response = await fetch(`${getBaseUrl()}/dsgvo/dsfas`, {
|
||||
method: 'POST',
|
||||
headers: getHeaders(),
|
||||
credentials: 'include',
|
||||
body: JSON.stringify(data),
|
||||
})
|
||||
|
||||
return handleResponse<DSFA>(response)
|
||||
}
|
||||
|
||||
/**
|
||||
* Update an existing DSFA
|
||||
*/
|
||||
export async function updateDSFA(id: string, data: Partial<DSFA>): Promise<DSFA> {
|
||||
const response = await fetch(`${getBaseUrl()}/dsgvo/dsfas/${id}`, {
|
||||
method: 'PUT',
|
||||
headers: getHeaders(),
|
||||
credentials: 'include',
|
||||
body: JSON.stringify(data),
|
||||
})
|
||||
|
||||
return handleResponse<DSFA>(response)
|
||||
}
|
||||
|
||||
/**
|
||||
* Delete a DSFA
|
||||
*/
|
||||
export async function deleteDSFA(id: string): Promise<void> {
|
||||
const response = await fetch(`${getBaseUrl()}/dsgvo/dsfas/${id}`, {
|
||||
method: 'DELETE',
|
||||
headers: getHeaders(),
|
||||
credentials: 'include',
|
||||
})
|
||||
|
||||
if (!response.ok) {
|
||||
throw new Error(`Failed to delete DSFA: ${response.statusText}`)
|
||||
}
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// DSFA SECTION OPERATIONS
|
||||
// =============================================================================
|
||||
|
||||
/**
|
||||
* Update a specific section of a DSFA
|
||||
*/
|
||||
export async function updateDSFASection(
|
||||
id: string,
|
||||
sectionNumber: number,
|
||||
data: UpdateDSFASectionRequest
|
||||
): Promise<DSFA> {
|
||||
const response = await fetch(`${getBaseUrl()}/dsgvo/dsfas/${id}/sections/${sectionNumber}`, {
|
||||
method: 'PUT',
|
||||
headers: getHeaders(),
|
||||
credentials: 'include',
|
||||
body: JSON.stringify(data),
|
||||
})
|
||||
|
||||
return handleResponse<DSFA>(response)
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// DSFA WORKFLOW OPERATIONS
|
||||
// =============================================================================
|
||||
|
||||
/**
|
||||
* Submit a DSFA for DPO review
|
||||
*/
|
||||
export async function submitDSFAForReview(id: string): Promise<SubmitForReviewResponse> {
|
||||
const response = await fetch(`${getBaseUrl()}/dsgvo/dsfas/${id}/submit-for-review`, {
|
||||
method: 'POST',
|
||||
headers: getHeaders(),
|
||||
credentials: 'include',
|
||||
})
|
||||
|
||||
return handleResponse<SubmitForReviewResponse>(response)
|
||||
}
|
||||
|
||||
/**
|
||||
* Approve or reject a DSFA (DPO/CISO/GF action)
|
||||
*/
|
||||
export async function approveDSFA(id: string, data: ApproveDSFARequest): Promise<{ message: string }> {
|
||||
const response = await fetch(`${getBaseUrl()}/dsgvo/dsfas/${id}/approve`, {
|
||||
method: 'POST',
|
||||
headers: getHeaders(),
|
||||
credentials: 'include',
|
||||
body: JSON.stringify(data),
|
||||
})
|
||||
|
||||
return handleResponse<{ message: string }>(response)
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// DSFA STATISTICS
|
||||
// =============================================================================
|
||||
|
||||
/**
|
||||
* Get DSFA statistics for the dashboard
|
||||
*/
|
||||
export async function getDSFAStats(): Promise<DSFAStatsResponse> {
|
||||
const response = await fetch(`${getBaseUrl()}/dsgvo/dsfas/stats`, {
|
||||
method: 'GET',
|
||||
headers: getHeaders(),
|
||||
credentials: 'include',
|
||||
})
|
||||
|
||||
return handleResponse<DSFAStatsResponse>(response)
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// UCCA INTEGRATION
|
||||
// =============================================================================
|
||||
|
||||
/**
|
||||
* Create a DSFA from a UCCA assessment (pre-filled)
|
||||
*/
|
||||
export async function createDSFAFromAssessment(
|
||||
assessmentId: string,
|
||||
data?: CreateDSFAFromAssessmentRequest
|
||||
): Promise<CreateDSFAFromAssessmentResponse> {
|
||||
const response = await fetch(`${getBaseUrl()}/dsgvo/dsfas/from-assessment/${assessmentId}`, {
|
||||
method: 'POST',
|
||||
headers: getHeaders(),
|
||||
credentials: 'include',
|
||||
body: JSON.stringify(data || {}),
|
||||
})
|
||||
|
||||
return handleResponse<CreateDSFAFromAssessmentResponse>(response)
|
||||
}
|
||||
|
||||
/**
|
||||
* Get a DSFA by its linked UCCA assessment ID
|
||||
*/
|
||||
export async function getDSFAByAssessment(assessmentId: string): Promise<DSFA | null> {
|
||||
try {
|
||||
const response = await fetch(`${getBaseUrl()}/dsgvo/dsfas/by-assessment/${assessmentId}`, {
|
||||
method: 'GET',
|
||||
headers: getHeaders(),
|
||||
credentials: 'include',
|
||||
})
|
||||
|
||||
if (response.status === 404) {
|
||||
return null
|
||||
}
|
||||
|
||||
return handleResponse<DSFA>(response)
|
||||
} catch (error) {
|
||||
// Return null if DSFA not found
|
||||
return null
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if a DSFA is required for a UCCA assessment
|
||||
*/
|
||||
export async function checkDSFARequired(assessmentId: string): Promise<DSFATriggerInfo> {
|
||||
const response = await fetch(`${getBaseUrl()}/ucca/assessments/${assessmentId}/dsfa-required`, {
|
||||
method: 'GET',
|
||||
headers: getHeaders(),
|
||||
credentials: 'include',
|
||||
})
|
||||
|
||||
return handleResponse<DSFATriggerInfo>(response)
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// EXPORT
|
||||
// =============================================================================
|
||||
|
||||
/**
|
||||
* Export a DSFA as JSON
|
||||
*/
|
||||
export async function exportDSFAAsJSON(id: string): Promise<Blob> {
|
||||
const response = await fetch(`${getBaseUrl()}/dsgvo/dsfas/${id}/export?format=json`, {
|
||||
method: 'GET',
|
||||
headers: {
|
||||
'Accept': 'application/json',
|
||||
},
|
||||
credentials: 'include',
|
||||
})
|
||||
|
||||
if (!response.ok) {
|
||||
throw new Error(`Export failed: ${response.statusText}`)
|
||||
}
|
||||
|
||||
return response.blob()
|
||||
}
|
||||
|
||||
/**
|
||||
* Export a DSFA as PDF
|
||||
*/
|
||||
export async function exportDSFAAsPDF(id: string): Promise<Blob> {
|
||||
const response = await fetch(`${getBaseUrl()}/dsgvo/dsfas/${id}/export/pdf`, {
|
||||
method: 'GET',
|
||||
headers: {
|
||||
'Accept': 'application/pdf',
|
||||
},
|
||||
credentials: 'include',
|
||||
})
|
||||
|
||||
if (!response.ok) {
|
||||
throw new Error(`PDF export failed: ${response.statusText}`)
|
||||
}
|
||||
|
||||
return response.blob()
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// RISK & MITIGATION OPERATIONS
|
||||
// =============================================================================
|
||||
|
||||
/**
|
||||
* Add a risk to a DSFA
|
||||
*/
|
||||
export async function addDSFARisk(dsfaId: string, risk: {
|
||||
category: string
|
||||
description: string
|
||||
likelihood: 'low' | 'medium' | 'high'
|
||||
impact: 'low' | 'medium' | 'high'
|
||||
affected_data?: string[]
|
||||
}): Promise<DSFA> {
|
||||
const dsfa = await getDSFA(dsfaId)
|
||||
const newRisk = {
|
||||
id: crypto.randomUUID(),
|
||||
...risk,
|
||||
risk_level: calculateRiskLevelString(risk.likelihood, risk.impact),
|
||||
affected_data: risk.affected_data || [],
|
||||
}
|
||||
|
||||
const updatedRisks = [...(dsfa.risks || []), newRisk]
|
||||
return updateDSFA(dsfaId, { risks: updatedRisks } as Partial<DSFA>)
|
||||
}
|
||||
|
||||
/**
|
||||
* Remove a risk from a DSFA
|
||||
*/
|
||||
export async function removeDSFARisk(dsfaId: string, riskId: string): Promise<DSFA> {
|
||||
const dsfa = await getDSFA(dsfaId)
|
||||
const updatedRisks = (dsfa.risks || []).filter(r => r.id !== riskId)
|
||||
return updateDSFA(dsfaId, { risks: updatedRisks } as Partial<DSFA>)
|
||||
}
|
||||
|
||||
/**
|
||||
* Add a mitigation to a DSFA
|
||||
*/
|
||||
export async function addDSFAMitigation(dsfaId: string, mitigation: {
|
||||
risk_id: string
|
||||
description: string
|
||||
type: 'technical' | 'organizational' | 'legal'
|
||||
responsible_party: string
|
||||
}): Promise<DSFA> {
|
||||
const dsfa = await getDSFA(dsfaId)
|
||||
const newMitigation = {
|
||||
id: crypto.randomUUID(),
|
||||
...mitigation,
|
||||
status: 'planned' as const,
|
||||
residual_risk: 'medium' as const,
|
||||
}
|
||||
|
||||
const updatedMitigations = [...(dsfa.mitigations || []), newMitigation]
|
||||
return updateDSFA(dsfaId, { mitigations: updatedMitigations } as Partial<DSFA>)
|
||||
}
|
||||
|
||||
/**
|
||||
* Update mitigation status
|
||||
*/
|
||||
export async function updateDSFAMitigationStatus(
|
||||
dsfaId: string,
|
||||
mitigationId: string,
|
||||
status: 'planned' | 'in_progress' | 'implemented' | 'verified'
|
||||
): Promise<DSFA> {
|
||||
const dsfa = await getDSFA(dsfaId)
|
||||
const updatedMitigations = (dsfa.mitigations || []).map(m => {
|
||||
if (m.id === mitigationId) {
|
||||
return {
|
||||
...m,
|
||||
status,
|
||||
...(status === 'implemented' && { implemented_at: new Date().toISOString() }),
|
||||
...(status === 'verified' && { verified_at: new Date().toISOString() }),
|
||||
}
|
||||
}
|
||||
return m
|
||||
})
|
||||
|
||||
return updateDSFA(dsfaId, { mitigations: updatedMitigations } as Partial<DSFA>)
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// HELPER FUNCTIONS
|
||||
// =============================================================================
|
||||
|
||||
function calculateRiskLevelString(
|
||||
likelihood: 'low' | 'medium' | 'high',
|
||||
impact: 'low' | 'medium' | 'high'
|
||||
): string {
|
||||
const matrix: Record<string, Record<string, string>> = {
|
||||
low: { low: 'low', medium: 'low', high: 'medium' },
|
||||
medium: { low: 'low', medium: 'medium', high: 'high' },
|
||||
high: { low: 'medium', medium: 'high', high: 'very_high' },
|
||||
}
|
||||
return matrix[likelihood]?.[impact] || 'medium'
|
||||
}
|
||||
8
admin-v2/lib/sdk/dsfa/index.ts
Normal file
8
admin-v2/lib/sdk/dsfa/index.ts
Normal file
@@ -0,0 +1,8 @@
|
||||
/**
|
||||
* DSFA Module
|
||||
*
|
||||
* Exports for DSFA (Data Protection Impact Assessment) functionality.
|
||||
*/
|
||||
|
||||
export * from './types'
|
||||
export * from './api'
|
||||
365
admin-v2/lib/sdk/dsfa/types.ts
Normal file
365
admin-v2/lib/sdk/dsfa/types.ts
Normal file
@@ -0,0 +1,365 @@
|
||||
/**
|
||||
* DSFA Types - Datenschutz-Folgenabschätzung (Art. 35 DSGVO)
|
||||
*
|
||||
* TypeScript type definitions for DSFA (Data Protection Impact Assessment)
|
||||
* aligned with the backend Go models.
|
||||
*/
|
||||
|
||||
// =============================================================================
|
||||
// ENUMS & CONSTANTS
|
||||
// =============================================================================
|
||||
|
||||
export type DSFAStatus = 'draft' | 'in_review' | 'approved' | 'rejected' | 'needs_update'
|
||||
|
||||
export type DSFARiskLevel = 'low' | 'medium' | 'high' | 'very_high'
|
||||
|
||||
export type DSFARiskCategory = 'confidentiality' | 'integrity' | 'availability' | 'rights_freedoms'
|
||||
|
||||
export type DSFAMitigationType = 'technical' | 'organizational' | 'legal'
|
||||
|
||||
export type DSFAMitigationStatus = 'planned' | 'in_progress' | 'implemented' | 'verified'
|
||||
|
||||
export const DSFA_STATUS_LABELS: Record<DSFAStatus, string> = {
|
||||
draft: 'Entwurf',
|
||||
in_review: 'In Prüfung',
|
||||
approved: 'Genehmigt',
|
||||
rejected: 'Abgelehnt',
|
||||
needs_update: 'Überarbeitung erforderlich',
|
||||
}
|
||||
|
||||
export const DSFA_RISK_LEVEL_LABELS: Record<DSFARiskLevel, string> = {
|
||||
low: 'Niedrig',
|
||||
medium: 'Mittel',
|
||||
high: 'Hoch',
|
||||
very_high: 'Sehr Hoch',
|
||||
}
|
||||
|
||||
export const DSFA_LEGAL_BASES = {
|
||||
consent: 'Art. 6 Abs. 1 lit. a DSGVO - Einwilligung',
|
||||
contract: 'Art. 6 Abs. 1 lit. b DSGVO - Vertrag',
|
||||
legal_obligation: 'Art. 6 Abs. 1 lit. c DSGVO - Rechtliche Verpflichtung',
|
||||
vital_interests: 'Art. 6 Abs. 1 lit. d DSGVO - Lebenswichtige Interessen',
|
||||
public_interest: 'Art. 6 Abs. 1 lit. e DSGVO - Öffentliches Interesse',
|
||||
legitimate_interest: 'Art. 6 Abs. 1 lit. f DSGVO - Berechtigtes Interesse',
|
||||
}
|
||||
|
||||
export const DSFA_AFFECTED_RIGHTS = [
|
||||
{ id: 'right_to_information', label: 'Recht auf Information (Art. 13/14)' },
|
||||
{ id: 'right_of_access', label: 'Auskunftsrecht (Art. 15)' },
|
||||
{ id: 'right_to_rectification', label: 'Recht auf Berichtigung (Art. 16)' },
|
||||
{ id: 'right_to_erasure', label: 'Recht auf Löschung (Art. 17)' },
|
||||
{ id: 'right_to_restriction', label: 'Recht auf Einschränkung (Art. 18)' },
|
||||
{ id: 'right_to_data_portability', label: 'Recht auf Datenübertragbarkeit (Art. 20)' },
|
||||
{ id: 'right_to_object', label: 'Widerspruchsrecht (Art. 21)' },
|
||||
{ id: 'right_not_to_be_profiled', label: 'Recht bzgl. Profiling (Art. 22)' },
|
||||
{ id: 'freedom_of_expression', label: 'Meinungsfreiheit' },
|
||||
{ id: 'freedom_of_association', label: 'Versammlungsfreiheit' },
|
||||
{ id: 'non_discrimination', label: 'Nichtdiskriminierung' },
|
||||
{ id: 'data_security', label: 'Datensicherheit' },
|
||||
]
|
||||
|
||||
// =============================================================================
|
||||
// SUB-TYPES
|
||||
// =============================================================================
|
||||
|
||||
export interface DSFARisk {
|
||||
id: string
|
||||
category: DSFARiskCategory
|
||||
description: string
|
||||
likelihood: 'low' | 'medium' | 'high'
|
||||
impact: 'low' | 'medium' | 'high'
|
||||
risk_level: string
|
||||
affected_data: string[]
|
||||
}
|
||||
|
||||
export interface DSFAMitigation {
|
||||
id: string
|
||||
risk_id: string
|
||||
description: string
|
||||
type: DSFAMitigationType
|
||||
status: DSFAMitigationStatus
|
||||
implemented_at?: string
|
||||
verified_at?: string
|
||||
residual_risk: 'low' | 'medium' | 'high'
|
||||
tom_reference?: string
|
||||
responsible_party: string
|
||||
}
|
||||
|
||||
export interface DSFAReviewComment {
|
||||
id: string
|
||||
section: number
|
||||
comment: string
|
||||
created_by: string
|
||||
created_at: string
|
||||
resolved: boolean
|
||||
}
|
||||
|
||||
export interface DSFASectionProgress {
|
||||
section_1_complete: boolean
|
||||
section_2_complete: boolean
|
||||
section_3_complete: boolean
|
||||
section_4_complete: boolean
|
||||
section_5_complete: boolean
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// MAIN DSFA TYPE
|
||||
// =============================================================================
|
||||
|
||||
export interface DSFA {
|
||||
id: string
|
||||
tenant_id: string
|
||||
namespace_id?: string
|
||||
processing_activity_id?: string
|
||||
assessment_id?: string
|
||||
name: string
|
||||
description: string
|
||||
|
||||
// Section 1: Systematische Beschreibung (Art. 35 Abs. 7 lit. a)
|
||||
processing_description: string
|
||||
processing_purpose: string
|
||||
data_categories: string[]
|
||||
data_subjects: string[]
|
||||
recipients: string[]
|
||||
legal_basis: string
|
||||
legal_basis_details?: string
|
||||
|
||||
// Section 2: Notwendigkeit & Verhältnismäßigkeit (Art. 35 Abs. 7 lit. b)
|
||||
necessity_assessment: string
|
||||
proportionality_assessment: string
|
||||
data_minimization?: string
|
||||
alternatives_considered?: string
|
||||
retention_justification?: string
|
||||
|
||||
// Section 3: Risikobewertung (Art. 35 Abs. 7 lit. c)
|
||||
risks: DSFARisk[]
|
||||
overall_risk_level: DSFARiskLevel
|
||||
risk_score: number
|
||||
affected_rights?: string[]
|
||||
triggered_rule_codes?: string[]
|
||||
|
||||
// Section 4: Abhilfemaßnahmen (Art. 35 Abs. 7 lit. d)
|
||||
mitigations: DSFAMitigation[]
|
||||
tom_references?: string[]
|
||||
|
||||
// Section 5: Stellungnahme DSB (Art. 35 Abs. 2 + Art. 36)
|
||||
dpo_consulted: boolean
|
||||
dpo_consulted_at?: string
|
||||
dpo_name?: string
|
||||
dpo_opinion?: string
|
||||
dpo_approved?: boolean
|
||||
authority_consulted: boolean
|
||||
authority_consulted_at?: string
|
||||
authority_reference?: string
|
||||
authority_decision?: string
|
||||
|
||||
// Workflow & Approval
|
||||
status: DSFAStatus
|
||||
submitted_for_review_at?: string
|
||||
submitted_by?: string
|
||||
conclusion: string
|
||||
review_comments?: DSFAReviewComment[]
|
||||
|
||||
// Section Progress Tracking
|
||||
section_progress: DSFASectionProgress
|
||||
|
||||
// Metadata & Audit
|
||||
metadata?: Record<string, unknown>
|
||||
created_at: string
|
||||
updated_at: string
|
||||
created_by: string
|
||||
approved_by?: string
|
||||
approved_at?: string
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// API REQUEST/RESPONSE TYPES
|
||||
// =============================================================================
|
||||
|
||||
export interface DSFAListResponse {
|
||||
dsfas: DSFA[]
|
||||
}
|
||||
|
||||
export interface DSFAStatsResponse {
|
||||
status_stats: Record<DSFAStatus | 'total', number>
|
||||
risk_stats: Record<DSFARiskLevel, number>
|
||||
total: number
|
||||
}
|
||||
|
||||
export interface CreateDSFARequest {
|
||||
name: string
|
||||
description?: string
|
||||
processing_description?: string
|
||||
processing_purpose?: string
|
||||
data_categories?: string[]
|
||||
legal_basis?: string
|
||||
}
|
||||
|
||||
export interface CreateDSFAFromAssessmentRequest {
|
||||
name?: string
|
||||
description?: string
|
||||
}
|
||||
|
||||
export interface CreateDSFAFromAssessmentResponse {
|
||||
dsfa: DSFA
|
||||
prefilled: boolean
|
||||
assessment: unknown // UCCA Assessment
|
||||
message: string
|
||||
}
|
||||
|
||||
export interface UpdateDSFASectionRequest {
|
||||
// Section 1
|
||||
processing_description?: string
|
||||
processing_purpose?: string
|
||||
data_categories?: string[]
|
||||
data_subjects?: string[]
|
||||
recipients?: string[]
|
||||
legal_basis?: string
|
||||
legal_basis_details?: string
|
||||
|
||||
// Section 2
|
||||
necessity_assessment?: string
|
||||
proportionality_assessment?: string
|
||||
data_minimization?: string
|
||||
alternatives_considered?: string
|
||||
retention_justification?: string
|
||||
|
||||
// Section 3
|
||||
overall_risk_level?: DSFARiskLevel
|
||||
risk_score?: number
|
||||
affected_rights?: string[]
|
||||
|
||||
// Section 5
|
||||
dpo_consulted?: boolean
|
||||
dpo_name?: string
|
||||
dpo_opinion?: string
|
||||
authority_consulted?: boolean
|
||||
authority_reference?: string
|
||||
authority_decision?: string
|
||||
}
|
||||
|
||||
export interface SubmitForReviewResponse {
|
||||
message: string
|
||||
dsfa: DSFA
|
||||
}
|
||||
|
||||
export interface ApproveDSFARequest {
|
||||
dpo_opinion: string
|
||||
approved: boolean
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// UCCA INTEGRATION TYPES
|
||||
// =============================================================================
|
||||
|
||||
export interface DSFATriggerInfo {
|
||||
required: boolean
|
||||
reason: string
|
||||
triggered_rules: string[]
|
||||
assessment_id?: string
|
||||
existing_dsfa_id?: string
|
||||
}
|
||||
|
||||
export interface UCCATriggeredRule {
|
||||
code: string
|
||||
title: string
|
||||
description: string
|
||||
severity: 'INFO' | 'WARN' | 'BLOCK'
|
||||
gdpr_ref?: string
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// HELPER TYPES FOR UI
|
||||
// =============================================================================
|
||||
|
||||
export interface DSFASectionConfig {
|
||||
number: number
|
||||
title: string
|
||||
titleDE: string
|
||||
description: string
|
||||
gdprRef: string
|
||||
fields: string[]
|
||||
required: boolean
|
||||
}
|
||||
|
||||
export const DSFA_SECTIONS: DSFASectionConfig[] = [
|
||||
{
|
||||
number: 1,
|
||||
title: 'Processing Description',
|
||||
titleDE: 'Systematische Beschreibung',
|
||||
description: 'Beschreiben Sie die geplante Verarbeitung, ihren Zweck, die Datenkategorien und Rechtsgrundlage.',
|
||||
gdprRef: 'Art. 35 Abs. 7 lit. a DSGVO',
|
||||
fields: ['processing_description', 'processing_purpose', 'data_categories', 'data_subjects', 'recipients', 'legal_basis'],
|
||||
required: true,
|
||||
},
|
||||
{
|
||||
number: 2,
|
||||
title: 'Necessity & Proportionality',
|
||||
titleDE: 'Notwendigkeit & Verhältnismäßigkeit',
|
||||
description: 'Begründen Sie, warum die Verarbeitung notwendig ist und welche Alternativen geprüft wurden.',
|
||||
gdprRef: 'Art. 35 Abs. 7 lit. b DSGVO',
|
||||
fields: ['necessity_assessment', 'proportionality_assessment', 'data_minimization', 'alternatives_considered'],
|
||||
required: true,
|
||||
},
|
||||
{
|
||||
number: 3,
|
||||
title: 'Risk Assessment',
|
||||
titleDE: 'Risikobewertung',
|
||||
description: 'Identifizieren und bewerten Sie die Risiken für die Rechte und Freiheiten der Betroffenen.',
|
||||
gdprRef: 'Art. 35 Abs. 7 lit. c DSGVO',
|
||||
fields: ['risks', 'overall_risk_level', 'risk_score', 'affected_rights'],
|
||||
required: true,
|
||||
},
|
||||
{
|
||||
number: 4,
|
||||
title: 'Mitigation Measures',
|
||||
titleDE: 'Abhilfemaßnahmen',
|
||||
description: 'Definieren Sie technische und organisatorische Maßnahmen zur Risikominimierung.',
|
||||
gdprRef: 'Art. 35 Abs. 7 lit. d DSGVO',
|
||||
fields: ['mitigations', 'tom_references'],
|
||||
required: true,
|
||||
},
|
||||
{
|
||||
number: 5,
|
||||
title: 'DPO Opinion',
|
||||
titleDE: 'Stellungnahme DSB',
|
||||
description: 'Dokumentieren Sie die Konsultation des Datenschutzbeauftragten und ggf. der Aufsichtsbehörde.',
|
||||
gdprRef: 'Art. 35 Abs. 2 + Art. 36 DSGVO',
|
||||
fields: ['dpo_consulted', 'dpo_opinion', 'authority_consulted', 'authority_reference'],
|
||||
required: false,
|
||||
},
|
||||
]
|
||||
|
||||
// =============================================================================
|
||||
// RISK MATRIX HELPERS
|
||||
// =============================================================================
|
||||
|
||||
export interface RiskMatrixCell {
|
||||
likelihood: 'low' | 'medium' | 'high'
|
||||
impact: 'low' | 'medium' | 'high'
|
||||
level: DSFARiskLevel
|
||||
score: number
|
||||
}
|
||||
|
||||
export const RISK_MATRIX: RiskMatrixCell[] = [
|
||||
// Low likelihood
|
||||
{ likelihood: 'low', impact: 'low', level: 'low', score: 10 },
|
||||
{ likelihood: 'low', impact: 'medium', level: 'low', score: 20 },
|
||||
{ likelihood: 'low', impact: 'high', level: 'medium', score: 40 },
|
||||
// Medium likelihood
|
||||
{ likelihood: 'medium', impact: 'low', level: 'low', score: 20 },
|
||||
{ likelihood: 'medium', impact: 'medium', level: 'medium', score: 50 },
|
||||
{ likelihood: 'medium', impact: 'high', level: 'high', score: 70 },
|
||||
// High likelihood
|
||||
{ likelihood: 'high', impact: 'low', level: 'medium', score: 40 },
|
||||
{ likelihood: 'high', impact: 'medium', level: 'high', score: 70 },
|
||||
{ likelihood: 'high', impact: 'high', level: 'very_high', score: 90 },
|
||||
]
|
||||
|
||||
export function calculateRiskLevel(
|
||||
likelihood: 'low' | 'medium' | 'high',
|
||||
impact: 'low' | 'medium' | 'high'
|
||||
): { level: DSFARiskLevel; score: number } {
|
||||
const cell = RISK_MATRIX.find(c => c.likelihood === likelihood && c.impact === impact)
|
||||
return cell ? { level: cell.level, score: cell.score } : { level: 'medium', score: 50 }
|
||||
}
|
||||
1011
ai-compliance-sdk/docs/DEVELOPER.md
Normal file
1011
ai-compliance-sdk/docs/DEVELOPER.md
Normal file
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user