[dev] [Marfuen] feat/framework-instance-requirements

apps/api/src/app.module.ts

@@ -49,6 +49,7 @@ import { SecretsModule } from './secrets/secrets.module';
 import { SecurityPenetrationTestsModule } from './security-penetration-tests/security-penetration-tests.module';
 import { StripeModule } from './stripe/stripe.module';
 import { AdminOrganizationsModule } from './admin-organizations/admin-organizations.module';
+import { FrameworkInstanceRequirementsModule } from './framework-instance-requirements/framework-instance-requirements.module';
 
 @Module({
   imports: [
@@ -110,6 +111,7 @@ import { AdminOrganizationsModule } from './admin-organizations/admin-organizati
     SecurityPenetrationTestsModule,
     StripeModule,
     AdminOrganizationsModule,
+    FrameworkInstanceRequirementsModule,
   ],
   controllers: [AppController],
   providers: [

apps/api/src/controls/controls.service.ts

@@ -20,6 +20,9 @@ const controlInclude = {
       requirement: {
         select: { name: true, identifier: true },
       },
+      frameworkInstanceRequirement: {
+        select: { name: true, identifier: true },
+      },
     },
   },
 } satisfies Prisma.ControlInclude;
@@ -76,6 +79,7 @@ export class ControlsService {
               include: { framework: true },
             },
             requirement: true,
+            frameworkInstanceRequirement: true,
           },
         },
       },
@@ -117,41 +121,71 @@ export class ControlsService {
   }
 
   async getOptions(organizationId: string) {
-    const [policies, tasks, frameworkInstances] = await Promise.all([
-      db.policy.findMany({
-        where: { organizationId },
-        select: { id: true, name: true },
-        orderBy: { name: 'asc' },
-      }),
-      db.task.findMany({
-        where: { organizationId },
-        select: { id: true, title: true },
-        orderBy: { title: 'asc' },
-      }),
-      db.frameworkInstance.findMany({
-        where: { organizationId },
-        include: {
-          framework: {
-            include: {
-              requirements: {
-                select: { id: true, name: true, identifier: true },
+    const [policies, tasks, frameworkInstances, instanceRequirements] =
+      await Promise.all([
+        db.policy.findMany({
+          where: { organizationId },
+          select: { id: true, name: true },
+          orderBy: { name: 'asc' },
+        }),
+        db.task.findMany({
+          where: { organizationId },
+          select: { id: true, title: true },
+          orderBy: { title: 'asc' },
+        }),
+        db.frameworkInstance.findMany({
+          where: { organizationId },
+          include: {
+            framework: {
+              include: {
+                requirements: {
+                  select: { id: true, name: true, identifier: true },
+                },
               },
             },
           },
-        },
-      }),
-    ]);
+        }),
+        db.frameworkInstanceRequirement.findMany({
+          where: {
+            frameworkInstance: { organizationId },
+          },
+          select: {
+            id: true,
+            name: true,
+            identifier: true,
+            frameworkInstanceId: true,
+            frameworkInstance: {
+              select: {
+                framework: { select: { name: true } },
+              },
+            },
+          },
+          orderBy: { name: 'asc' },
+        }),
+      ]);
 
-    const requirements = frameworkInstances.flatMap((fi) =>
+    const templateRequirements = frameworkInstances.flatMap((fi) =>
       fi.framework.requirements.map((req) => ({
         id: req.id,
         name: req.name,
         identifier: req.identifier,
         frameworkInstanceId: fi.id,
         frameworkName: fi.framework.name,
+        isInstanceRequirement: false,
       })),
     );
 
+    const customRequirements = instanceRequirements.map((req) => ({
+      id: req.id,
+      name: req.name,
+      identifier: req.identifier,
+      frameworkInstanceId: req.frameworkInstanceId,
+      frameworkName: req.frameworkInstance.framework.name,
+      isInstanceRequirement: true,
+    }));
+
+    const requirements = [...templateRequirements, ...customRequirements];
+
     return { policies, tasks, requirements };
   }
 
@@ -184,8 +218,14 @@ export class ControlsService {
           db.requirementMap.create({
             data: {
               controlId: control.id,
-              requirementId: mapping.requirementId,
               frameworkInstanceId: mapping.frameworkInstanceId,
+              ...(mapping.requirementId && {
+                requirementId: mapping.requirementId,
+              }),
+              ...(mapping.frameworkInstanceRequirementId && {
+                frameworkInstanceRequirementId:
+                  mapping.frameworkInstanceRequirementId,
+              }),
             },
           }),
         ),

apps/api/src/controls/dto/create-control.dto.ts

@@ -9,9 +9,18 @@ import {
 import { Type } from 'class-transformer';
 
 class RequirementMappingDto {
-  @ApiProperty({ description: 'Requirement ID' })
+  @ApiProperty({ description: 'Template requirement ID', required: false })
+  @IsOptional()
+  @IsString()
+  requirementId?: string;
+
+  @ApiProperty({
+    description: 'Instance requirement ID',
+    required: false,
+  })
+  @IsOptional()
   @IsString()
-  requirementId: string;
+  frameworkInstanceRequirementId?: string;
 
   @ApiProperty({ description: 'Framework instance ID' })
   @IsString()

apps/api/src/framework-instance-requirements/dto/create-framework-instance-requirement.dto.ts

@@ -0,0 +1,43 @@
+import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
+import {
+  IsArray,
+  IsString,
+  IsNotEmpty,
+  IsOptional,
+  MaxLength,
+} from 'class-validator';
+
+export class CreateFrameworkInstanceRequirementDto {
+  @ApiProperty({ example: 'frm_abc123' })
+  @IsString()
+  @IsNotEmpty()
+  @MaxLength(255)
+  frameworkInstanceId: string;
+
+  @ApiProperty({ example: 'Custom Access Control' })
+  @IsString()
+  @IsNotEmpty()
+  @MaxLength(255)
+  name: string;
+
+  @ApiPropertyOptional({ example: 'CUSTOM-1' })
+  @IsString()
+  @IsOptional()
+  @MaxLength(255)
+  identifier?: string;
+
+  @ApiProperty({ example: 'Custom requirement for access control policies' })
+  @IsString()
+  @IsNotEmpty()
+  @MaxLength(5000)
+  description: string;
+
+  @ApiPropertyOptional({
+    description: 'Control IDs to link to this requirement',
+    type: [String],
+  })
+  @IsOptional()
+  @IsArray()
+  @IsString({ each: true })
+  controlIds?: string[];
+}

apps/api/src/framework-instance-requirements/dto/update-framework-instance-requirement.dto.ts

@@ -0,0 +1,22 @@
+import { ApiPropertyOptional } from '@nestjs/swagger';
+import { IsString, IsOptional, MaxLength } from 'class-validator';
+
+export class UpdateFrameworkInstanceRequirementDto {
+  @ApiPropertyOptional()
+  @IsString()
+  @IsOptional()
+  @MaxLength(255)
+  name?: string;
+
+  @ApiPropertyOptional()
+  @IsString()
+  @IsOptional()
+  @MaxLength(255)
+  identifier?: string;
+
+  @ApiPropertyOptional()
+  @IsString()
+  @IsOptional()
+  @MaxLength(5000)
+  description?: string;
+}

apps/api/src/framework-instance-requirements/framework-instance-requirements.controller.ts

@@ -0,0 +1,92 @@
+import {
+  Body,
+  Controller,
+  Delete,
+  Get,
+  Param,
+  Patch,
+  Post,
+  Query,
+  UseGuards,
+} from '@nestjs/common';
+import {
+  ApiTags,
+  ApiBearerAuth,
+  ApiOperation,
+  ApiQuery,
+} from '@nestjs/swagger';
+import { HybridAuthGuard } from '../auth/hybrid-auth.guard';
+import { PermissionGuard } from '../auth/permission.guard';
+import { RequirePermission } from '../auth/require-permission.decorator';
+import { OrganizationId } from '../auth/auth-context.decorator';
+import { FrameworkInstanceRequirementsService } from './framework-instance-requirements.service';
+import { CreateFrameworkInstanceRequirementDto } from './dto/create-framework-instance-requirement.dto';
+import { UpdateFrameworkInstanceRequirementDto } from './dto/update-framework-instance-requirement.dto';
+
+@ApiTags('Framework Instance Requirements')
+@ApiBearerAuth()
+@UseGuards(HybridAuthGuard, PermissionGuard)
+@Controller({ path: 'framework-instance-requirements', version: '1' })
+export class FrameworkInstanceRequirementsController {
+  constructor(
+    private readonly service: FrameworkInstanceRequirementsService,
+  ) {}
+
+  @Get()
+  @RequirePermission('framework', 'read')
+  @ApiOperation({
+    summary: 'List custom requirements for a framework instance',
+  })
+  @ApiQuery({ name: 'frameworkInstanceId', required: true, type: String })
+  async findAll(
+    @OrganizationId() organizationId: string,
+    @Query('frameworkInstanceId') frameworkInstanceId: string,
+  ) {
+    const data = await this.service.findAll(
+      frameworkInstanceId,
+      organizationId,
+    );
+    return { data, count: data.length };
+  }
+
+  @Get(':id')
+  @RequirePermission('framework', 'read')
+  @ApiOperation({ summary: 'Get a single framework instance requirement' })
+  async findOne(
+    @OrganizationId() organizationId: string,
+    @Param('id') id: string,
+  ) {
+    return this.service.findOne(id, organizationId);
+  }
+
+  @Post()
+  @RequirePermission('framework', 'create')
+  @ApiOperation({ summary: 'Create a framework instance requirement' })
+  async create(
+    @OrganizationId() organizationId: string,
+    @Body() dto: CreateFrameworkInstanceRequirementDto,
+  ) {
+    return this.service.create(dto, organizationId);
+  }
+
+  @Patch(':id')
+  @RequirePermission('framework', 'update')
+  @ApiOperation({ summary: 'Update a framework instance requirement' })
+  async update(
+    @OrganizationId() organizationId: string,
+    @Param('id') id: string,
+    @Body() dto: UpdateFrameworkInstanceRequirementDto,
+  ) {
+    return this.service.update(id, dto, organizationId);
+  }
+
+  @Delete(':id')
+  @RequirePermission('framework', 'delete')
+  @ApiOperation({ summary: 'Delete a framework instance requirement' })
+  async delete(
+    @OrganizationId() organizationId: string,
+    @Param('id') id: string,
+  ) {
+    return this.service.delete(id, organizationId);
+  }
+}

apps/api/src/framework-instance-requirements/framework-instance-requirements.module.ts

@@ -0,0 +1,12 @@
+import { Module } from '@nestjs/common';
+import { AuthModule } from '../auth/auth.module';
+import { FrameworkInstanceRequirementsController } from './framework-instance-requirements.controller';
+import { FrameworkInstanceRequirementsService } from './framework-instance-requirements.service';
+
+@Module({
+  imports: [AuthModule],
+  controllers: [FrameworkInstanceRequirementsController],
+  providers: [FrameworkInstanceRequirementsService],
+  exports: [FrameworkInstanceRequirementsService],
+})
+export class FrameworkInstanceRequirementsModule {}