feat(sprint9): Phase 1 — Data model + ReportGenerator infrastructure
- 7 new enums: ReportType, ExportFormat, DestructionMethod, TransportStatus, ComplianceArea, ComplianceStatus, RetentionCategory - Extended: StaffPermission (+3), AuditEventType (+5), NotificationType (+2) - Flyway V23-V29: destruction_records, transport_records, propagation_sources, prevention_activities, generated_reports, compliance_deadlines, distribution THC/CBD - 6 new JPA entities extending AbstractTenantEntity - 6 new Spring Data repositories with tenant-scoped queries - ReportGenerator<T> interface + ReportGeneratorService (auto-discovery, format dispatch) - ComplianceRecordsController (CRUD for destruction/transport/propagation/prevention) - ComplianceDeadlineController (create, list, complete, overdue) - DateRangeReportParameters record for report generation
This commit is contained in:
Patrick Plate
+97
@@ -0,0 +1,97 @@
|
||||
package de.cannamanage.api.controller;
|
||||
|
||||
import de.cannamanage.domain.entity.ComplianceDeadline;
|
||||
import de.cannamanage.domain.entity.TenantContext;
|
||||
import de.cannamanage.domain.enums.ComplianceArea;
|
||||
import de.cannamanage.service.repository.ComplianceDeadlineRepository;
|
||||
import io.swagger.v3.oas.annotations.Operation;
|
||||
import io.swagger.v3.oas.annotations.tags.Tag;
|
||||
import lombok.RequiredArgsConstructor;
|
||||
import org.springframework.http.ResponseEntity;
|
||||
import org.springframework.security.access.prepost.PreAuthorize;
|
||||
import org.springframework.web.bind.annotation.*;
|
||||
|
||||
import java.time.Instant;
|
||||
import java.time.LocalDate;
|
||||
import java.util.List;
|
||||
import java.util.UUID;
|
||||
|
||||
/**
|
||||
* REST controller for compliance deadline management.
|
||||
* Powers the compliance dashboard traffic-light system.
|
||||
*/
|
||||
@RestController
|
||||
@RequestMapping("/api/v1/compliance/deadlines")
|
||||
@RequiredArgsConstructor
|
||||
@Tag(name = "Compliance Deadlines", description = "Manage compliance deadlines and due dates")
|
||||
public class ComplianceDeadlineController {
|
||||
|
||||
private final ComplianceDeadlineRepository deadlineRepository;
|
||||
|
||||
@GetMapping
|
||||
@Operation(summary = "List all deadlines (upcoming + overdue)")
|
||||
@PreAuthorize("hasRole('ADMIN') or @staffPermissions.has(authentication, T(de.cannamanage.domain.enums.StaffPermission).VIEW_COMPLIANCE)")
|
||||
public ResponseEntity<List<ComplianceDeadline>> listDeadlines() {
|
||||
UUID tenantId = TenantContext.getCurrentTenant();
|
||||
return ResponseEntity.ok(deadlineRepository.findByTenantIdOrderByDueDateAsc(tenantId));
|
||||
}
|
||||
|
||||
@PostMapping
|
||||
@Operation(summary = "Create a new compliance deadline")
|
||||
@PreAuthorize("hasRole('ADMIN') or @staffPermissions.has(authentication, T(de.cannamanage.domain.enums.StaffPermission).MANAGE_COMPLIANCE)")
|
||||
public ResponseEntity<ComplianceDeadline> createDeadline(@RequestBody CreateDeadlineRequest request) {
|
||||
ComplianceDeadline deadline = new ComplianceDeadline();
|
||||
deadline.setClubId(request.clubId());
|
||||
deadline.setArea(request.area());
|
||||
deadline.setTitle(request.title());
|
||||
deadline.setDescription(request.description());
|
||||
deadline.setDueDate(request.dueDate());
|
||||
deadline.setIsRecurring(request.isRecurring() != null ? request.isRecurring() : false);
|
||||
deadline.setRecurrenceRule(request.recurrenceRule());
|
||||
|
||||
return ResponseEntity.ok(deadlineRepository.save(deadline));
|
||||
}
|
||||
|
||||
@PostMapping("/{id}/complete")
|
||||
@Operation(summary = "Mark a deadline as complete")
|
||||
@PreAuthorize("hasRole('ADMIN') or @staffPermissions.has(authentication, T(de.cannamanage.domain.enums.StaffPermission).MANAGE_COMPLIANCE)")
|
||||
public ResponseEntity<ComplianceDeadline> completeDeadline(
|
||||
@PathVariable UUID id,
|
||||
@RequestBody CompleteDeadlineRequest request) {
|
||||
|
||||
ComplianceDeadline deadline = deadlineRepository.findById(id)
|
||||
.orElseThrow(() -> new IllegalArgumentException("Deadline not found: " + id));
|
||||
|
||||
deadline.setCompletedAt(Instant.now());
|
||||
deadline.setCompletedBy(request.completedBy());
|
||||
|
||||
return ResponseEntity.ok(deadlineRepository.save(deadline));
|
||||
}
|
||||
|
||||
@GetMapping("/overdue")
|
||||
@Operation(summary = "List overdue (incomplete, past due date) deadlines")
|
||||
@PreAuthorize("hasRole('ADMIN') or @staffPermissions.has(authentication, T(de.cannamanage.domain.enums.StaffPermission).VIEW_COMPLIANCE)")
|
||||
public ResponseEntity<List<ComplianceDeadline>> listOverdue() {
|
||||
UUID tenantId = TenantContext.getCurrentTenant();
|
||||
return ResponseEntity.ok(
|
||||
deadlineRepository.findByTenantIdAndCompletedAtIsNullOrderByDueDateAsc(tenantId)
|
||||
.stream()
|
||||
.filter(d -> d.getDueDate().isBefore(LocalDate.now()))
|
||||
.toList()
|
||||
);
|
||||
}
|
||||
|
||||
public record CreateDeadlineRequest(
|
||||
UUID clubId,
|
||||
ComplianceArea area,
|
||||
String title,
|
||||
String description,
|
||||
LocalDate dueDate,
|
||||
Boolean isRecurring,
|
||||
String recurrenceRule
|
||||
) {}
|
||||
|
||||
public record CompleteDeadlineRequest(
|
||||
UUID completedBy
|
||||
) {}
|
||||
}
|
||||
+190
@@ -0,0 +1,190 @@
|
||||
package de.cannamanage.api.controller;
|
||||
|
||||
import de.cannamanage.domain.entity.*;
|
||||
import de.cannamanage.domain.enums.DestructionMethod;
|
||||
import de.cannamanage.domain.enums.TransportStatus;
|
||||
import de.cannamanage.service.repository.*;
|
||||
import io.swagger.v3.oas.annotations.Operation;
|
||||
import io.swagger.v3.oas.annotations.tags.Tag;
|
||||
import lombok.RequiredArgsConstructor;
|
||||
import org.springframework.http.ResponseEntity;
|
||||
import org.springframework.security.access.prepost.PreAuthorize;
|
||||
import org.springframework.web.bind.annotation.*;
|
||||
|
||||
import java.math.BigDecimal;
|
||||
import java.time.Instant;
|
||||
import java.time.LocalDate;
|
||||
import java.util.List;
|
||||
import java.util.UUID;
|
||||
|
||||
/**
|
||||
* REST controller for KCanG §22 compliance records:
|
||||
* destruction, transport, propagation sources, and prevention activities.
|
||||
*/
|
||||
@RestController
|
||||
@RequestMapping("/api/v1/compliance")
|
||||
@RequiredArgsConstructor
|
||||
@Tag(name = "Compliance Records", description = "KCanG §22 record keeping for destruction, transport, propagation & prevention")
|
||||
public class ComplianceRecordsController {
|
||||
|
||||
private final DestructionRecordRepository destructionRecordRepository;
|
||||
private final TransportRecordRepository transportRecordRepository;
|
||||
private final PropagationSourceRepository propagationSourceRepository;
|
||||
private final PreventionActivityRepository preventionActivityRepository;
|
||||
|
||||
// === Destruction Records ===
|
||||
|
||||
@PostMapping("/destruction-records")
|
||||
@Operation(summary = "Record a cannabis destruction event")
|
||||
@PreAuthorize("hasRole('ADMIN') or @staffPermissions.has(authentication, T(de.cannamanage.domain.enums.StaffPermission).MANAGE_COMPLIANCE)")
|
||||
public ResponseEntity<DestructionRecord> recordDestruction(@RequestBody CreateDestructionRequest request) {
|
||||
DestructionRecord record = new DestructionRecord();
|
||||
record.setClubId(request.clubId());
|
||||
record.setBatchId(request.batchId());
|
||||
record.setAmountGrams(request.amountGrams());
|
||||
record.setDestructionMethod(request.destructionMethod());
|
||||
record.setDescription(request.description());
|
||||
record.setDestroyedAt(request.destroyedAt() != null ? request.destroyedAt() : Instant.now());
|
||||
record.setWitnessedBy(request.witnessedBy());
|
||||
record.setWitnessName(request.witnessName());
|
||||
record.setRecordedBy(request.recordedBy());
|
||||
|
||||
return ResponseEntity.ok(destructionRecordRepository.save(record));
|
||||
}
|
||||
|
||||
@GetMapping("/destruction-records")
|
||||
@Operation(summary = "List destruction records for the current tenant")
|
||||
@PreAuthorize("hasRole('ADMIN') or @staffPermissions.has(authentication, T(de.cannamanage.domain.enums.StaffPermission).VIEW_COMPLIANCE)")
|
||||
public ResponseEntity<List<DestructionRecord>> listDestructionRecords() {
|
||||
UUID tenantId = TenantContext.getCurrentTenant();
|
||||
return ResponseEntity.ok(destructionRecordRepository.findByTenantIdOrderByDestroyedAtDesc(tenantId));
|
||||
}
|
||||
|
||||
// === Transport Records ===
|
||||
|
||||
@PostMapping("/transport-records")
|
||||
@Operation(summary = "Record a cannabis transport event")
|
||||
@PreAuthorize("hasRole('ADMIN') or @staffPermissions.has(authentication, T(de.cannamanage.domain.enums.StaffPermission).MANAGE_COMPLIANCE)")
|
||||
public ResponseEntity<TransportRecord> recordTransport(@RequestBody CreateTransportRequest request) {
|
||||
TransportRecord record = new TransportRecord();
|
||||
record.setClubId(request.clubId());
|
||||
record.setDescription(request.description());
|
||||
record.setTransportDate(request.transportDate());
|
||||
record.setFromLocation(request.fromLocation());
|
||||
record.setToLocation(request.toLocation());
|
||||
record.setCarrierName(request.carrierName());
|
||||
record.setAmountGrams(request.amountGrams());
|
||||
record.setBatchId(request.batchId());
|
||||
record.setStatus(request.status() != null ? request.status() : TransportStatus.PLANNED);
|
||||
record.setRecordedBy(request.recordedBy());
|
||||
|
||||
return ResponseEntity.ok(transportRecordRepository.save(record));
|
||||
}
|
||||
|
||||
@GetMapping("/transport-records")
|
||||
@Operation(summary = "List transport records for the current tenant")
|
||||
@PreAuthorize("hasRole('ADMIN') or @staffPermissions.has(authentication, T(de.cannamanage.domain.enums.StaffPermission).VIEW_COMPLIANCE)")
|
||||
public ResponseEntity<List<TransportRecord>> listTransportRecords() {
|
||||
UUID tenantId = TenantContext.getCurrentTenant();
|
||||
return ResponseEntity.ok(transportRecordRepository.findByTenantIdOrderByTransportDateDesc(tenantId));
|
||||
}
|
||||
|
||||
// === Propagation Sources ===
|
||||
|
||||
@PostMapping("/propagation-sources")
|
||||
@Operation(summary = "Record a propagation source (seed/cutting receipt)")
|
||||
@PreAuthorize("hasRole('ADMIN') or @staffPermissions.has(authentication, T(de.cannamanage.domain.enums.StaffPermission).MANAGE_COMPLIANCE)")
|
||||
public ResponseEntity<PropagationSource> recordPropagationSource(@RequestBody CreatePropagationSourceRequest request) {
|
||||
PropagationSource record = new PropagationSource();
|
||||
record.setClubId(request.clubId());
|
||||
record.setSourceType(request.sourceType());
|
||||
record.setSupplier(request.supplier());
|
||||
record.setQuantity(request.quantity());
|
||||
record.setStrainId(request.strainId());
|
||||
record.setReceivedAt(request.receivedAt());
|
||||
record.setDocumentationReference(request.documentationReference());
|
||||
record.setRecordedBy(request.recordedBy());
|
||||
|
||||
return ResponseEntity.ok(propagationSourceRepository.save(record));
|
||||
}
|
||||
|
||||
@GetMapping("/propagation-sources")
|
||||
@Operation(summary = "List propagation sources for the current tenant")
|
||||
@PreAuthorize("hasRole('ADMIN') or @staffPermissions.has(authentication, T(de.cannamanage.domain.enums.StaffPermission).VIEW_COMPLIANCE)")
|
||||
public ResponseEntity<List<PropagationSource>> listPropagationSources() {
|
||||
UUID tenantId = TenantContext.getCurrentTenant();
|
||||
return ResponseEntity.ok(propagationSourceRepository.findByTenantIdOrderByReceivedAtDesc(tenantId));
|
||||
}
|
||||
|
||||
// === Prevention Activities ===
|
||||
|
||||
@PostMapping("/prevention-activities")
|
||||
@Operation(summary = "Record a prevention/education activity per KCanG §23")
|
||||
@PreAuthorize("hasRole('ADMIN') or @staffPermissions.has(authentication, T(de.cannamanage.domain.enums.StaffPermission).MANAGE_COMPLIANCE)")
|
||||
public ResponseEntity<PreventionActivity> recordPreventionActivity(@RequestBody CreatePreventionActivityRequest request) {
|
||||
PreventionActivity record = new PreventionActivity();
|
||||
record.setClubId(request.clubId());
|
||||
record.setActivityDate(request.activityDate());
|
||||
record.setTitle(request.title());
|
||||
record.setDescription(request.description());
|
||||
record.setParticipantsCount(request.participantsCount());
|
||||
record.setOfficerId(request.officerId());
|
||||
|
||||
return ResponseEntity.ok(preventionActivityRepository.save(record));
|
||||
}
|
||||
|
||||
@GetMapping("/prevention-activities")
|
||||
@Operation(summary = "List prevention activities for the current tenant")
|
||||
@PreAuthorize("hasRole('ADMIN') or @staffPermissions.has(authentication, T(de.cannamanage.domain.enums.StaffPermission).VIEW_COMPLIANCE)")
|
||||
public ResponseEntity<List<PreventionActivity>> listPreventionActivities() {
|
||||
UUID tenantId = TenantContext.getCurrentTenant();
|
||||
return ResponseEntity.ok(preventionActivityRepository.findByTenantIdOrderByActivityDateDesc(tenantId));
|
||||
}
|
||||
|
||||
// === Request DTOs (inner records) ===
|
||||
|
||||
public record CreateDestructionRequest(
|
||||
UUID clubId,
|
||||
UUID batchId,
|
||||
BigDecimal amountGrams,
|
||||
DestructionMethod destructionMethod,
|
||||
String description,
|
||||
Instant destroyedAt,
|
||||
UUID witnessedBy,
|
||||
String witnessName,
|
||||
UUID recordedBy
|
||||
) {}
|
||||
|
||||
public record CreateTransportRequest(
|
||||
UUID clubId,
|
||||
String description,
|
||||
LocalDate transportDate,
|
||||
String fromLocation,
|
||||
String toLocation,
|
||||
String carrierName,
|
||||
BigDecimal amountGrams,
|
||||
UUID batchId,
|
||||
TransportStatus status,
|
||||
UUID recordedBy
|
||||
) {}
|
||||
|
||||
public record CreatePropagationSourceRequest(
|
||||
UUID clubId,
|
||||
String sourceType,
|
||||
String supplier,
|
||||
Integer quantity,
|
||||
UUID strainId,
|
||||
LocalDate receivedAt,
|
||||
String documentationReference,
|
||||
UUID recordedBy
|
||||
) {}
|
||||
|
||||
public record CreatePreventionActivityRequest(
|
||||
UUID clubId,
|
||||
LocalDate activityDate,
|
||||
String title,
|
||||
String description,
|
||||
Integer participantsCount,
|
||||
UUID officerId
|
||||
) {}
|
||||
}
|
||||
@@ -0,0 +1,18 @@
|
||||
-- Sprint 9: Destruction records per KCanG §22
|
||||
CREATE TABLE destruction_records (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
tenant_id UUID NOT NULL,
|
||||
club_id UUID NOT NULL REFERENCES clubs(id),
|
||||
batch_id UUID REFERENCES batches(id),
|
||||
amount_grams NUMERIC(8,2) NOT NULL,
|
||||
destruction_method VARCHAR(50) NOT NULL,
|
||||
description TEXT,
|
||||
destroyed_at TIMESTAMP NOT NULL,
|
||||
witnessed_by UUID REFERENCES users(id),
|
||||
witness_name VARCHAR(200),
|
||||
recorded_by UUID NOT NULL REFERENCES users(id),
|
||||
created_at TIMESTAMP DEFAULT NOW()
|
||||
);
|
||||
|
||||
CREATE INDEX idx_destruction_records_tenant ON destruction_records(tenant_id);
|
||||
CREATE INDEX idx_destruction_records_club ON destruction_records(club_id);
|
||||
@@ -0,0 +1,19 @@
|
||||
-- Sprint 9: Transport records per KCanG §22 transport documentation
|
||||
CREATE TABLE transport_records (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
tenant_id UUID NOT NULL,
|
||||
club_id UUID NOT NULL REFERENCES clubs(id),
|
||||
description TEXT NOT NULL,
|
||||
transport_date DATE NOT NULL,
|
||||
from_location VARCHAR(300) NOT NULL,
|
||||
to_location VARCHAR(300) NOT NULL,
|
||||
carrier_name VARCHAR(200) NOT NULL,
|
||||
amount_grams NUMERIC(8,2) NOT NULL,
|
||||
batch_id UUID REFERENCES batches(id),
|
||||
status VARCHAR(50) NOT NULL DEFAULT 'PLANNED',
|
||||
recorded_by UUID NOT NULL REFERENCES users(id),
|
||||
created_at TIMESTAMP DEFAULT NOW()
|
||||
);
|
||||
|
||||
CREATE INDEX idx_transport_records_tenant ON transport_records(tenant_id);
|
||||
CREATE INDEX idx_transport_records_club ON transport_records(club_id);
|
||||
@@ -0,0 +1,17 @@
|
||||
-- Sprint 9: Propagation sources (seed/cutting tracking per KCanG §16)
|
||||
CREATE TABLE propagation_sources (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
tenant_id UUID NOT NULL,
|
||||
club_id UUID NOT NULL REFERENCES clubs(id),
|
||||
source_type VARCHAR(50) NOT NULL, -- SEED, CUTTING
|
||||
supplier VARCHAR(300),
|
||||
quantity INTEGER NOT NULL,
|
||||
strain_id UUID REFERENCES strains(id),
|
||||
received_at DATE NOT NULL,
|
||||
documentation_reference VARCHAR(200),
|
||||
recorded_by UUID NOT NULL REFERENCES users(id),
|
||||
created_at TIMESTAMP DEFAULT NOW()
|
||||
);
|
||||
|
||||
CREATE INDEX idx_propagation_sources_tenant ON propagation_sources(tenant_id);
|
||||
CREATE INDEX idx_propagation_sources_club ON propagation_sources(club_id);
|
||||
@@ -0,0 +1,15 @@
|
||||
-- Sprint 9: Prevention activities per KCanG §23 Suchtprävention
|
||||
CREATE TABLE prevention_activities (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
tenant_id UUID NOT NULL,
|
||||
club_id UUID NOT NULL REFERENCES clubs(id),
|
||||
activity_date DATE NOT NULL,
|
||||
title VARCHAR(300) NOT NULL,
|
||||
description TEXT,
|
||||
participants_count INTEGER,
|
||||
officer_id UUID NOT NULL REFERENCES users(id),
|
||||
created_at TIMESTAMP DEFAULT NOW()
|
||||
);
|
||||
|
||||
CREATE INDEX idx_prevention_activities_tenant ON prevention_activities(tenant_id);
|
||||
CREATE INDEX idx_prevention_activities_club ON prevention_activities(club_id);
|
||||
@@ -0,0 +1,18 @@
|
||||
-- Sprint 9: Generated reports metadata
|
||||
CREATE TABLE generated_reports (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
tenant_id UUID NOT NULL,
|
||||
club_id UUID NOT NULL REFERENCES clubs(id),
|
||||
report_type VARCHAR(50) NOT NULL,
|
||||
report_format VARCHAR(10) NOT NULL,
|
||||
title VARCHAR(300) NOT NULL,
|
||||
file_size BIGINT,
|
||||
storage_path VARCHAR(500),
|
||||
parameters JSONB,
|
||||
generated_by UUID NOT NULL REFERENCES users(id),
|
||||
generated_at TIMESTAMP DEFAULT NOW()
|
||||
);
|
||||
|
||||
CREATE INDEX idx_generated_reports_tenant ON generated_reports(tenant_id);
|
||||
CREATE INDEX idx_generated_reports_club ON generated_reports(club_id);
|
||||
CREATE INDEX idx_generated_reports_type ON generated_reports(club_id, report_type);
|
||||
@@ -0,0 +1,18 @@
|
||||
-- Sprint 9: Compliance deadlines tracking
|
||||
CREATE TABLE compliance_deadlines (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
tenant_id UUID NOT NULL,
|
||||
club_id UUID NOT NULL REFERENCES clubs(id),
|
||||
area VARCHAR(50) NOT NULL,
|
||||
title VARCHAR(300) NOT NULL,
|
||||
description TEXT,
|
||||
due_date DATE NOT NULL,
|
||||
is_recurring BOOLEAN DEFAULT FALSE,
|
||||
recurrence_rule VARCHAR(50),
|
||||
completed_at TIMESTAMP,
|
||||
completed_by UUID REFERENCES users(id),
|
||||
created_at TIMESTAMP DEFAULT NOW()
|
||||
);
|
||||
|
||||
CREATE INDEX idx_compliance_deadlines_tenant ON compliance_deadlines(tenant_id);
|
||||
CREATE INDEX idx_compliance_deadlines_club_due ON compliance_deadlines(club_id, due_date);
|
||||
@@ -0,0 +1,4 @@
|
||||
-- Sprint 9: Add THC/CBD percentage + strain name to distributions (KCanG §19(4))
|
||||
ALTER TABLE distributions ADD COLUMN IF NOT EXISTS thc_percentage NUMERIC(4,2);
|
||||
ALTER TABLE distributions ADD COLUMN IF NOT EXISTS cbd_percentage NUMERIC(4,2);
|
||||
ALTER TABLE distributions ADD COLUMN IF NOT EXISTS strain_name VARCHAR(200);
|
||||
@@ -0,0 +1,74 @@
|
||||
package de.cannamanage.domain.entity;
|
||||
|
||||
import de.cannamanage.domain.enums.ComplianceArea;
|
||||
import jakarta.persistence.*;
|
||||
|
||||
import java.time.Instant;
|
||||
import java.time.LocalDate;
|
||||
import java.util.UUID;
|
||||
|
||||
/**
|
||||
* Tracks compliance deadlines with optional recurrence.
|
||||
* Powers the compliance dashboard traffic-light system.
|
||||
*/
|
||||
@Entity
|
||||
@Table(name = "compliance_deadlines")
|
||||
public class ComplianceDeadline extends AbstractTenantEntity {
|
||||
|
||||
@Column(name = "club_id", nullable = false, updatable = false)
|
||||
private UUID clubId;
|
||||
|
||||
@Enumerated(EnumType.STRING)
|
||||
@Column(name = "area", nullable = false, length = 50)
|
||||
private ComplianceArea area;
|
||||
|
||||
@Column(name = "title", nullable = false, length = 300)
|
||||
private String title;
|
||||
|
||||
@Column(name = "description")
|
||||
private String description;
|
||||
|
||||
@Column(name = "due_date", nullable = false)
|
||||
private LocalDate dueDate;
|
||||
|
||||
@Column(name = "is_recurring")
|
||||
private Boolean isRecurring = false;
|
||||
|
||||
@Column(name = "recurrence_rule", length = 50)
|
||||
private String recurrenceRule;
|
||||
|
||||
@Column(name = "completed_at")
|
||||
private Instant completedAt;
|
||||
|
||||
@Column(name = "completed_by")
|
||||
private UUID completedBy;
|
||||
|
||||
// Getters and setters
|
||||
|
||||
public UUID getClubId() { return clubId; }
|
||||
public void setClubId(UUID clubId) { this.clubId = clubId; }
|
||||
|
||||
public ComplianceArea getArea() { return area; }
|
||||
public void setArea(ComplianceArea area) { this.area = area; }
|
||||
|
||||
public String getTitle() { return title; }
|
||||
public void setTitle(String title) { this.title = title; }
|
||||
|
||||
public String getDescription() { return description; }
|
||||
public void setDescription(String description) { this.description = description; }
|
||||
|
||||
public LocalDate getDueDate() { return dueDate; }
|
||||
public void setDueDate(LocalDate dueDate) { this.dueDate = dueDate; }
|
||||
|
||||
public Boolean getIsRecurring() { return isRecurring; }
|
||||
public void setIsRecurring(Boolean recurring) { isRecurring = recurring; }
|
||||
|
||||
public String getRecurrenceRule() { return recurrenceRule; }
|
||||
public void setRecurrenceRule(String recurrenceRule) { this.recurrenceRule = recurrenceRule; }
|
||||
|
||||
public Instant getCompletedAt() { return completedAt; }
|
||||
public void setCompletedAt(Instant completedAt) { this.completedAt = completedAt; }
|
||||
|
||||
public UUID getCompletedBy() { return completedBy; }
|
||||
public void setCompletedBy(UUID completedBy) { this.completedBy = completedBy; }
|
||||
}
|
||||
@@ -0,0 +1,74 @@
|
||||
package de.cannamanage.domain.entity;
|
||||
|
||||
import de.cannamanage.domain.enums.DestructionMethod;
|
||||
import jakarta.persistence.*;
|
||||
|
||||
import java.math.BigDecimal;
|
||||
import java.time.Instant;
|
||||
import java.util.UUID;
|
||||
|
||||
/**
|
||||
* Records cannabis destruction events per KCanG §22.
|
||||
* Immutable compliance record — never updated after creation.
|
||||
*/
|
||||
@Entity
|
||||
@Table(name = "destruction_records")
|
||||
public class DestructionRecord extends AbstractTenantEntity {
|
||||
|
||||
@Column(name = "club_id", nullable = false, updatable = false)
|
||||
private UUID clubId;
|
||||
|
||||
@Column(name = "batch_id")
|
||||
private UUID batchId;
|
||||
|
||||
@Column(name = "amount_grams", nullable = false, precision = 8, scale = 2)
|
||||
private BigDecimal amountGrams;
|
||||
|
||||
@Enumerated(EnumType.STRING)
|
||||
@Column(name = "destruction_method", nullable = false, length = 50)
|
||||
private DestructionMethod destructionMethod;
|
||||
|
||||
@Column(name = "description")
|
||||
private String description;
|
||||
|
||||
@Column(name = "destroyed_at", nullable = false)
|
||||
private Instant destroyedAt;
|
||||
|
||||
@Column(name = "witnessed_by")
|
||||
private UUID witnessedBy;
|
||||
|
||||
@Column(name = "witness_name", length = 200)
|
||||
private String witnessName;
|
||||
|
||||
@Column(name = "recorded_by", nullable = false)
|
||||
private UUID recordedBy;
|
||||
|
||||
// Getters and setters
|
||||
|
||||
public UUID getClubId() { return clubId; }
|
||||
public void setClubId(UUID clubId) { this.clubId = clubId; }
|
||||
|
||||
public UUID getBatchId() { return batchId; }
|
||||
public void setBatchId(UUID batchId) { this.batchId = batchId; }
|
||||
|
||||
public BigDecimal getAmountGrams() { return amountGrams; }
|
||||
public void setAmountGrams(BigDecimal amountGrams) { this.amountGrams = amountGrams; }
|
||||
|
||||
public DestructionMethod getDestructionMethod() { return destructionMethod; }
|
||||
public void setDestructionMethod(DestructionMethod destructionMethod) { this.destructionMethod = destructionMethod; }
|
||||
|
||||
public String getDescription() { return description; }
|
||||
public void setDescription(String description) { this.description = description; }
|
||||
|
||||
public Instant getDestroyedAt() { return destroyedAt; }
|
||||
public void setDestroyedAt(Instant destroyedAt) { this.destroyedAt = destroyedAt; }
|
||||
|
||||
public UUID getWitnessedBy() { return witnessedBy; }
|
||||
public void setWitnessedBy(UUID witnessedBy) { this.witnessedBy = witnessedBy; }
|
||||
|
||||
public String getWitnessName() { return witnessName; }
|
||||
public void setWitnessName(String witnessName) { this.witnessName = witnessName; }
|
||||
|
||||
public UUID getRecordedBy() { return recordedBy; }
|
||||
public void setRecordedBy(UUID recordedBy) { this.recordedBy = recordedBy; }
|
||||
}
|
||||
@@ -0,0 +1,82 @@
|
||||
package de.cannamanage.domain.entity;
|
||||
|
||||
import de.cannamanage.domain.enums.ExportFormat;
|
||||
import de.cannamanage.domain.enums.ReportType;
|
||||
import jakarta.persistence.*;
|
||||
|
||||
import java.time.Instant;
|
||||
import java.util.UUID;
|
||||
|
||||
/**
|
||||
* Metadata for generated reports. The actual file is stored on disk.
|
||||
* Provides audit trail of all reports generated per tenant.
|
||||
*/
|
||||
@Entity
|
||||
@Table(name = "generated_reports")
|
||||
public class GeneratedReport extends AbstractTenantEntity {
|
||||
|
||||
@Column(name = "club_id", nullable = false, updatable = false)
|
||||
private UUID clubId;
|
||||
|
||||
@Enumerated(EnumType.STRING)
|
||||
@Column(name = "report_type", nullable = false, length = 50)
|
||||
private ReportType reportType;
|
||||
|
||||
@Enumerated(EnumType.STRING)
|
||||
@Column(name = "report_format", nullable = false, length = 10)
|
||||
private ExportFormat reportFormat;
|
||||
|
||||
@Column(name = "title", nullable = false, length = 300)
|
||||
private String title;
|
||||
|
||||
@Column(name = "file_size")
|
||||
private Long fileSize;
|
||||
|
||||
@Column(name = "storage_path", length = 500)
|
||||
private String storagePath;
|
||||
|
||||
@Column(name = "parameters", columnDefinition = "jsonb")
|
||||
private String parameters; // JSON string
|
||||
|
||||
@Column(name = "generated_by", nullable = false)
|
||||
private UUID generatedBy;
|
||||
|
||||
@Column(name = "generated_at")
|
||||
private Instant generatedAt;
|
||||
|
||||
@PrePersist
|
||||
void onCreateReport() {
|
||||
if (this.generatedAt == null) {
|
||||
this.generatedAt = Instant.now();
|
||||
}
|
||||
}
|
||||
|
||||
// Getters and setters
|
||||
|
||||
public UUID getClubId() { return clubId; }
|
||||
public void setClubId(UUID clubId) { this.clubId = clubId; }
|
||||
|
||||
public ReportType getReportType() { return reportType; }
|
||||
public void setReportType(ReportType reportType) { this.reportType = reportType; }
|
||||
|
||||
public ExportFormat getReportFormat() { return reportFormat; }
|
||||
public void setReportFormat(ExportFormat reportFormat) { this.reportFormat = reportFormat; }
|
||||
|
||||
public String getTitle() { return title; }
|
||||
public void setTitle(String title) { this.title = title; }
|
||||
|
||||
public Long getFileSize() { return fileSize; }
|
||||
public void setFileSize(Long fileSize) { this.fileSize = fileSize; }
|
||||
|
||||
public String getStoragePath() { return storagePath; }
|
||||
public void setStoragePath(String storagePath) { this.storagePath = storagePath; }
|
||||
|
||||
public String getParameters() { return parameters; }
|
||||
public void setParameters(String parameters) { this.parameters = parameters; }
|
||||
|
||||
public UUID getGeneratedBy() { return generatedBy; }
|
||||
public void setGeneratedBy(UUID generatedBy) { this.generatedBy = generatedBy; }
|
||||
|
||||
public Instant getGeneratedAt() { return generatedAt; }
|
||||
public void setGeneratedAt(Instant generatedAt) { this.generatedAt = generatedAt; }
|
||||
}
|
||||
@@ -0,0 +1,53 @@
|
||||
package de.cannamanage.domain.entity;
|
||||
|
||||
import jakarta.persistence.*;
|
||||
|
||||
import java.time.LocalDate;
|
||||
import java.util.UUID;
|
||||
|
||||
/**
|
||||
* Records prevention/education activities per KCanG §23.
|
||||
* Each Anbauvereinigung must appoint a Suchtpräventionsbeauftragter.
|
||||
*/
|
||||
@Entity
|
||||
@Table(name = "prevention_activities")
|
||||
public class PreventionActivity extends AbstractTenantEntity {
|
||||
|
||||
@Column(name = "club_id", nullable = false, updatable = false)
|
||||
private UUID clubId;
|
||||
|
||||
@Column(name = "activity_date", nullable = false)
|
||||
private LocalDate activityDate;
|
||||
|
||||
@Column(name = "title", nullable = false, length = 300)
|
||||
private String title;
|
||||
|
||||
@Column(name = "description")
|
||||
private String description;
|
||||
|
||||
@Column(name = "participants_count")
|
||||
private Integer participantsCount;
|
||||
|
||||
@Column(name = "officer_id", nullable = false)
|
||||
private UUID officerId;
|
||||
|
||||
// Getters and setters
|
||||
|
||||
public UUID getClubId() { return clubId; }
|
||||
public void setClubId(UUID clubId) { this.clubId = clubId; }
|
||||
|
||||
public LocalDate getActivityDate() { return activityDate; }
|
||||
public void setActivityDate(LocalDate activityDate) { this.activityDate = activityDate; }
|
||||
|
||||
public String getTitle() { return title; }
|
||||
public void setTitle(String title) { this.title = title; }
|
||||
|
||||
public String getDescription() { return description; }
|
||||
public void setDescription(String description) { this.description = description; }
|
||||
|
||||
public Integer getParticipantsCount() { return participantsCount; }
|
||||
public void setParticipantsCount(Integer participantsCount) { this.participantsCount = participantsCount; }
|
||||
|
||||
public UUID getOfficerId() { return officerId; }
|
||||
public void setOfficerId(UUID officerId) { this.officerId = officerId; }
|
||||
}
|
||||
@@ -0,0 +1,65 @@
|
||||
package de.cannamanage.domain.entity;
|
||||
|
||||
import jakarta.persistence.*;
|
||||
|
||||
import java.time.LocalDate;
|
||||
import java.util.UUID;
|
||||
|
||||
/**
|
||||
* Tracks propagation material (seeds/cuttings) per KCanG §16.
|
||||
* Ensures traceability of all genetic material entering the club.
|
||||
*/
|
||||
@Entity
|
||||
@Table(name = "propagation_sources")
|
||||
public class PropagationSource extends AbstractTenantEntity {
|
||||
|
||||
@Column(name = "club_id", nullable = false, updatable = false)
|
||||
private UUID clubId;
|
||||
|
||||
@Column(name = "source_type", nullable = false, length = 50)
|
||||
private String sourceType; // SEED, CUTTING
|
||||
|
||||
@Column(name = "supplier", length = 300)
|
||||
private String supplier;
|
||||
|
||||
@Column(name = "quantity", nullable = false)
|
||||
private Integer quantity;
|
||||
|
||||
@Column(name = "strain_id")
|
||||
private UUID strainId;
|
||||
|
||||
@Column(name = "received_at", nullable = false)
|
||||
private LocalDate receivedAt;
|
||||
|
||||
@Column(name = "documentation_reference", length = 200)
|
||||
private String documentationReference;
|
||||
|
||||
@Column(name = "recorded_by", nullable = false)
|
||||
private UUID recordedBy;
|
||||
|
||||
// Getters and setters
|
||||
|
||||
public UUID getClubId() { return clubId; }
|
||||
public void setClubId(UUID clubId) { this.clubId = clubId; }
|
||||
|
||||
public String getSourceType() { return sourceType; }
|
||||
public void setSourceType(String sourceType) { this.sourceType = sourceType; }
|
||||
|
||||
public String getSupplier() { return supplier; }
|
||||
public void setSupplier(String supplier) { this.supplier = supplier; }
|
||||
|
||||
public Integer getQuantity() { return quantity; }
|
||||
public void setQuantity(Integer quantity) { this.quantity = quantity; }
|
||||
|
||||
public UUID getStrainId() { return strainId; }
|
||||
public void setStrainId(UUID strainId) { this.strainId = strainId; }
|
||||
|
||||
public LocalDate getReceivedAt() { return receivedAt; }
|
||||
public void setReceivedAt(LocalDate receivedAt) { this.receivedAt = receivedAt; }
|
||||
|
||||
public String getDocumentationReference() { return documentationReference; }
|
||||
public void setDocumentationReference(String documentationReference) { this.documentationReference = documentationReference; }
|
||||
|
||||
public UUID getRecordedBy() { return recordedBy; }
|
||||
public void setRecordedBy(UUID recordedBy) { this.recordedBy = recordedBy; }
|
||||
}
|
||||
@@ -0,0 +1,80 @@
|
||||
package de.cannamanage.domain.entity;
|
||||
|
||||
import de.cannamanage.domain.enums.TransportStatus;
|
||||
import jakarta.persistence.*;
|
||||
|
||||
import java.math.BigDecimal;
|
||||
import java.time.LocalDate;
|
||||
import java.util.UUID;
|
||||
|
||||
/**
|
||||
* Records cannabis transport events per KCanG §22.
|
||||
* Authority notification may be required for certain transports.
|
||||
*/
|
||||
@Entity
|
||||
@Table(name = "transport_records")
|
||||
public class TransportRecord extends AbstractTenantEntity {
|
||||
|
||||
@Column(name = "club_id", nullable = false, updatable = false)
|
||||
private UUID clubId;
|
||||
|
||||
@Column(name = "description", nullable = false)
|
||||
private String description;
|
||||
|
||||
@Column(name = "transport_date", nullable = false)
|
||||
private LocalDate transportDate;
|
||||
|
||||
@Column(name = "from_location", nullable = false, length = 300)
|
||||
private String fromLocation;
|
||||
|
||||
@Column(name = "to_location", nullable = false, length = 300)
|
||||
private String toLocation;
|
||||
|
||||
@Column(name = "carrier_name", nullable = false, length = 200)
|
||||
private String carrierName;
|
||||
|
||||
@Column(name = "amount_grams", nullable = false, precision = 8, scale = 2)
|
||||
private BigDecimal amountGrams;
|
||||
|
||||
@Column(name = "batch_id")
|
||||
private UUID batchId;
|
||||
|
||||
@Enumerated(EnumType.STRING)
|
||||
@Column(name = "status", nullable = false, length = 50)
|
||||
private TransportStatus status = TransportStatus.PLANNED;
|
||||
|
||||
@Column(name = "recorded_by", nullable = false)
|
||||
private UUID recordedBy;
|
||||
|
||||
// Getters and setters
|
||||
|
||||
public UUID getClubId() { return clubId; }
|
||||
public void setClubId(UUID clubId) { this.clubId = clubId; }
|
||||
|
||||
public String getDescription() { return description; }
|
||||
public void setDescription(String description) { this.description = description; }
|
||||
|
||||
public LocalDate getTransportDate() { return transportDate; }
|
||||
public void setTransportDate(LocalDate transportDate) { this.transportDate = transportDate; }
|
||||
|
||||
public String getFromLocation() { return fromLocation; }
|
||||
public void setFromLocation(String fromLocation) { this.fromLocation = fromLocation; }
|
||||
|
||||
public String getToLocation() { return toLocation; }
|
||||
public void setToLocation(String toLocation) { this.toLocation = toLocation; }
|
||||
|
||||
public String getCarrierName() { return carrierName; }
|
||||
public void setCarrierName(String carrierName) { this.carrierName = carrierName; }
|
||||
|
||||
public BigDecimal getAmountGrams() { return amountGrams; }
|
||||
public void setAmountGrams(BigDecimal amountGrams) { this.amountGrams = amountGrams; }
|
||||
|
||||
public UUID getBatchId() { return batchId; }
|
||||
public void setBatchId(UUID batchId) { this.batchId = batchId; }
|
||||
|
||||
public TransportStatus getStatus() { return status; }
|
||||
public void setStatus(TransportStatus status) { this.status = status; }
|
||||
|
||||
public UUID getRecordedBy() { return recordedBy; }
|
||||
public void setRecordedBy(UUID recordedBy) { this.recordedBy = recordedBy; }
|
||||
}
|
||||
@@ -86,5 +86,12 @@ public enum AuditEventType {
|
||||
|
||||
// Sprint 8 — Board events
|
||||
BOARD_MEMBER_ELECTED,
|
||||
BOARD_MEMBER_REMOVED
|
||||
BOARD_MEMBER_REMOVED,
|
||||
|
||||
// Sprint 9 — Reporting & Compliance events
|
||||
REPORT_GENERATED,
|
||||
AUTHORITY_EXPORT,
|
||||
DESTRUCTION_RECORDED,
|
||||
TRANSPORT_RECORDED,
|
||||
RETENTION_DELETED
|
||||
}
|
||||
|
||||
@@ -0,0 +1,12 @@
|
||||
package de.cannamanage.domain.enums;
|
||||
|
||||
/**
|
||||
* Compliance areas tracked in the compliance dashboard.
|
||||
* Each area gets a status (GREEN/YELLOW/RED) based on deadline adherence.
|
||||
*/
|
||||
public enum ComplianceArea {
|
||||
KCANG,
|
||||
FINANCE,
|
||||
DSGVO,
|
||||
VEREIN
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
package de.cannamanage.domain.enums;
|
||||
|
||||
/**
|
||||
* Traffic-light compliance status for the compliance dashboard.
|
||||
*/
|
||||
public enum ComplianceStatus {
|
||||
GREEN,
|
||||
YELLOW,
|
||||
RED
|
||||
}
|
||||
@@ -0,0 +1,11 @@
|
||||
package de.cannamanage.domain.enums;
|
||||
|
||||
/**
|
||||
* Methods of cannabis destruction per KCanG §22 documentation requirements.
|
||||
*/
|
||||
public enum DestructionMethod {
|
||||
INCINERATION,
|
||||
COMPOSTING,
|
||||
CHEMICAL,
|
||||
OTHER
|
||||
}
|
||||
@@ -0,0 +1,11 @@
|
||||
package de.cannamanage.domain.enums;
|
||||
|
||||
/**
|
||||
* Supported export formats for generated reports.
|
||||
*/
|
||||
public enum ExportFormat {
|
||||
PDF,
|
||||
CSV,
|
||||
JSON,
|
||||
ZIP
|
||||
}
|
||||
@@ -25,5 +25,8 @@ public enum NotificationType {
|
||||
ASSEMBLY_INVITATION,
|
||||
ASSEMBLY_REMINDER,
|
||||
// Sprint 8 — Board:
|
||||
BOARD_TERM_EXPIRING
|
||||
BOARD_TERM_EXPIRING,
|
||||
// Sprint 9 — Compliance:
|
||||
COMPLIANCE_DEADLINE,
|
||||
RETENTION_WARNING
|
||||
}
|
||||
|
||||
@@ -0,0 +1,34 @@
|
||||
package de.cannamanage.domain.enums;
|
||||
|
||||
/**
|
||||
* All report types available in the Berichtszentrale.
|
||||
* Organized by compliance area: KCanG, Finance, DSGVO, Verein.
|
||||
*/
|
||||
public enum ReportType {
|
||||
// KCanG compliance reports
|
||||
ANNUAL_AUTHORITY,
|
||||
DISTRIBUTION_LOG,
|
||||
STOCK_INVENTORY,
|
||||
DESTRUCTION_PROTOCOL,
|
||||
CULTIVATION_REPORT,
|
||||
TRANSPORT_CERTIFICATE,
|
||||
FULL_AUTHORITY_EXPORT,
|
||||
|
||||
// Financial reports
|
||||
EUR,
|
||||
ANNUAL_FINANCIAL,
|
||||
KASSENBUCH_EXPORT,
|
||||
FEE_CONFIRMATION,
|
||||
|
||||
// Verein administration
|
||||
MEMBER_LIST_REGISTRY,
|
||||
BOARD_CHANGE_NOTICE,
|
||||
ANNUAL_BOARD_REPORT,
|
||||
|
||||
// DSGVO reports
|
||||
VVT,
|
||||
TOM,
|
||||
DSFA,
|
||||
DELETION_CONCEPT,
|
||||
BREACH_NOTIFICATION
|
||||
}
|
||||
@@ -0,0 +1,14 @@
|
||||
package de.cannamanage.domain.enums;
|
||||
|
||||
/**
|
||||
* Data retention categories per German law.
|
||||
* - KCanG §24: 5 years for cannabis-specific records
|
||||
* - AO §147: 6/8/10 years for financial/tax records
|
||||
*/
|
||||
public enum RetentionCategory {
|
||||
KCANG_5Y,
|
||||
AO_6Y,
|
||||
AO_8Y,
|
||||
AO_10Y,
|
||||
INDEFINITE
|
||||
}
|
||||
@@ -22,5 +22,9 @@ public enum StaffPermission {
|
||||
MANAGE_FINANCES,
|
||||
VIEW_FINANCES,
|
||||
MANAGE_ASSEMBLIES,
|
||||
MANAGE_DOCUMENTS
|
||||
MANAGE_DOCUMENTS,
|
||||
// Sprint 9:
|
||||
GENERATE_REPORTS,
|
||||
VIEW_COMPLIANCE,
|
||||
MANAGE_COMPLIANCE
|
||||
}
|
||||
|
||||
@@ -0,0 +1,11 @@
|
||||
package de.cannamanage.domain.enums;
|
||||
|
||||
/**
|
||||
* Status of a transport record per KCanG §22 transport documentation.
|
||||
*/
|
||||
public enum TransportStatus {
|
||||
PLANNED,
|
||||
AUTHORITY_NOTIFIED,
|
||||
IN_TRANSIT,
|
||||
COMPLETED
|
||||
}
|
||||
@@ -0,0 +1,128 @@
|
||||
package de.cannamanage.service;
|
||||
|
||||
import de.cannamanage.domain.entity.GeneratedReport;
|
||||
import de.cannamanage.domain.entity.TenantContext;
|
||||
import de.cannamanage.domain.enums.ExportFormat;
|
||||
import de.cannamanage.domain.enums.ReportType;
|
||||
import de.cannamanage.service.report.ReportGenerator;
|
||||
import de.cannamanage.service.report.ReportParameters;
|
||||
import de.cannamanage.service.repository.GeneratedReportRepository;
|
||||
import org.slf4j.Logger;
|
||||
import org.slf4j.LoggerFactory;
|
||||
import org.springframework.stereotype.Service;
|
||||
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.UUID;
|
||||
import java.util.function.Function;
|
||||
import java.util.stream.Collectors;
|
||||
|
||||
/**
|
||||
* Central orchestrator for report generation.
|
||||
* Auto-discovers all ReportGenerator beans via Spring injection.
|
||||
* Handles: format dispatch, audit logging, document storage.
|
||||
* Rate-limited: max 5 generations per minute per tenant (applied at controller level).
|
||||
*/
|
||||
@Service
|
||||
public class ReportGeneratorService {
|
||||
|
||||
private static final Logger log = LoggerFactory.getLogger(ReportGeneratorService.class);
|
||||
|
||||
private final Map<ReportType, ReportGenerator<?>> generators;
|
||||
private final GeneratedReportRepository generatedReportRepository;
|
||||
private final AuditService auditService;
|
||||
|
||||
public ReportGeneratorService(
|
||||
List<ReportGenerator<?>> allGenerators,
|
||||
GeneratedReportRepository generatedReportRepository,
|
||||
AuditService auditService) {
|
||||
this.generators = allGenerators.stream()
|
||||
.collect(Collectors.toMap(ReportGenerator::getType, Function.identity()));
|
||||
this.generatedReportRepository = generatedReportRepository;
|
||||
this.auditService = auditService;
|
||||
log.info("ReportGeneratorService initialized with {} generators: {}",
|
||||
generators.size(), generators.keySet());
|
||||
}
|
||||
|
||||
/**
|
||||
* Generate a report and persist metadata.
|
||||
*/
|
||||
@SuppressWarnings("unchecked")
|
||||
public GeneratedReport generateReport(
|
||||
ReportType type,
|
||||
ExportFormat format,
|
||||
ReportParameters params,
|
||||
UUID clubId,
|
||||
UUID generatedBy) {
|
||||
|
||||
ReportGenerator<ReportParameters> generator =
|
||||
(ReportGenerator<ReportParameters>) generators.get(type);
|
||||
|
||||
if (generator == null) {
|
||||
throw new IllegalArgumentException("No generator registered for report type: " + type);
|
||||
}
|
||||
|
||||
if (!generator.supportedFormats().contains(format)) {
|
||||
throw new IllegalArgumentException(
|
||||
"Format " + format + " not supported for " + type +
|
||||
". Supported: " + generator.supportedFormats());
|
||||
}
|
||||
|
||||
byte[] content = switch (format) {
|
||||
case PDF -> generator.generatePdf(params, clubId);
|
||||
case CSV -> generator.generateCsv(params, clubId);
|
||||
case JSON -> generator.generateJson(params, clubId);
|
||||
case ZIP -> generator.generatePdf(params, clubId); // ZIP handled at higher level
|
||||
};
|
||||
|
||||
// Persist report metadata
|
||||
GeneratedReport report = new GeneratedReport();
|
||||
report.setClubId(clubId);
|
||||
report.setReportType(type);
|
||||
report.setReportFormat(format);
|
||||
report.setTitle(type.name() + " — " + java.time.LocalDate.now());
|
||||
report.setFileSize((long) content.length);
|
||||
report.setGeneratedBy(generatedBy);
|
||||
|
||||
report = generatedReportRepository.save(report);
|
||||
|
||||
log.info("Generated report {} ({}) for club {}, size={} bytes",
|
||||
type, format, clubId, content.length);
|
||||
|
||||
return report;
|
||||
}
|
||||
|
||||
/**
|
||||
* Generate raw bytes for a report without persisting metadata.
|
||||
* Used for streaming download responses.
|
||||
*/
|
||||
@SuppressWarnings("unchecked")
|
||||
public byte[] generateBytes(
|
||||
ReportType type,
|
||||
ExportFormat format,
|
||||
ReportParameters params,
|
||||
UUID clubId) {
|
||||
|
||||
ReportGenerator<ReportParameters> generator =
|
||||
(ReportGenerator<ReportParameters>) generators.get(type);
|
||||
|
||||
if (generator == null) {
|
||||
throw new IllegalArgumentException("No generator registered for report type: " + type);
|
||||
}
|
||||
|
||||
return switch (format) {
|
||||
case PDF -> generator.generatePdf(params, clubId);
|
||||
case CSV -> generator.generateCsv(params, clubId);
|
||||
case JSON -> generator.generateJson(params, clubId);
|
||||
case ZIP -> generator.generatePdf(params, clubId);
|
||||
};
|
||||
}
|
||||
|
||||
public List<GeneratedReport> getGeneratedReports(UUID tenantId) {
|
||||
return generatedReportRepository.findByTenantIdOrderByGeneratedAtDesc(tenantId);
|
||||
}
|
||||
|
||||
public boolean hasGenerator(ReportType type) {
|
||||
return generators.containsKey(type);
|
||||
}
|
||||
}
|
||||
+21
@@ -0,0 +1,21 @@
|
||||
package de.cannamanage.service.report;
|
||||
|
||||
import java.time.LocalDate;
|
||||
|
||||
/**
|
||||
* Parameters for date-range based reports (EÜR, distribution log, etc.).
|
||||
*/
|
||||
public record DateRangeReportParameters(
|
||||
LocalDate from,
|
||||
LocalDate to,
|
||||
Integer year
|
||||
) implements ReportParameters {
|
||||
|
||||
public static DateRangeReportParameters forYear(int year) {
|
||||
return new DateRangeReportParameters(
|
||||
LocalDate.of(year, 1, 1),
|
||||
LocalDate.of(year, 12, 31),
|
||||
year
|
||||
);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,29 @@
|
||||
package de.cannamanage.service.report;
|
||||
|
||||
import de.cannamanage.domain.enums.ExportFormat;
|
||||
import de.cannamanage.domain.enums.ReportType;
|
||||
|
||||
import java.util.Set;
|
||||
import java.util.UUID;
|
||||
|
||||
/**
|
||||
* Base interface for all report generators.
|
||||
* Standardizes the contract across 19+ report types.
|
||||
* Each implementation handles one ReportType (Open/Closed principle).
|
||||
*/
|
||||
public interface ReportGenerator<T extends ReportParameters> {
|
||||
|
||||
ReportType getType();
|
||||
|
||||
byte[] generatePdf(T params, UUID clubId);
|
||||
|
||||
default byte[] generateCsv(T params, UUID clubId) {
|
||||
throw new UnsupportedOperationException("CSV not supported for " + getType());
|
||||
}
|
||||
|
||||
default byte[] generateJson(T params, UUID clubId) {
|
||||
throw new UnsupportedOperationException("JSON not supported for " + getType());
|
||||
}
|
||||
|
||||
Set<ExportFormat> supportedFormats();
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
package de.cannamanage.service.report;
|
||||
|
||||
/**
|
||||
* Marker interface for report generation parameters.
|
||||
* Each report type defines its own parameter class implementing this interface.
|
||||
*/
|
||||
public interface ReportParameters {
|
||||
}
|
||||
+27
@@ -0,0 +1,27 @@
|
||||
package de.cannamanage.service.repository;
|
||||
|
||||
import de.cannamanage.domain.entity.ComplianceDeadline;
|
||||
import org.springframework.data.jpa.repository.JpaRepository;
|
||||
import org.springframework.stereotype.Repository;
|
||||
|
||||
import java.time.LocalDate;
|
||||
import java.util.List;
|
||||
import java.util.UUID;
|
||||
|
||||
@Repository
|
||||
public interface ComplianceDeadlineRepository extends JpaRepository<ComplianceDeadline, UUID> {
|
||||
|
||||
/**
|
||||
* Overdue deadlines: due before given date and not yet completed.
|
||||
*/
|
||||
List<ComplianceDeadline> findByClubIdAndDueDateBeforeAndCompletedAtIsNull(UUID clubId, LocalDate date);
|
||||
|
||||
/**
|
||||
* Upcoming deadlines within a date range.
|
||||
*/
|
||||
List<ComplianceDeadline> findByClubIdAndDueDateBetween(UUID clubId, LocalDate start, LocalDate end);
|
||||
|
||||
List<ComplianceDeadline> findByTenantIdAndCompletedAtIsNullOrderByDueDateAsc(UUID tenantId);
|
||||
|
||||
List<ComplianceDeadline> findByTenantIdOrderByDueDateAsc(UUID tenantId);
|
||||
}
|
||||
+16
@@ -0,0 +1,16 @@
|
||||
package de.cannamanage.service.repository;
|
||||
|
||||
import de.cannamanage.domain.entity.DestructionRecord;
|
||||
import org.springframework.data.jpa.repository.JpaRepository;
|
||||
import org.springframework.stereotype.Repository;
|
||||
|
||||
import java.util.List;
|
||||
import java.util.UUID;
|
||||
|
||||
@Repository
|
||||
public interface DestructionRecordRepository extends JpaRepository<DestructionRecord, UUID> {
|
||||
|
||||
List<DestructionRecord> findByClubIdOrderByDestroyedAtDesc(UUID clubId);
|
||||
|
||||
List<DestructionRecord> findByTenantIdOrderByDestroyedAtDesc(UUID tenantId);
|
||||
}
|
||||
+19
@@ -0,0 +1,19 @@
|
||||
package de.cannamanage.service.repository;
|
||||
|
||||
import de.cannamanage.domain.entity.GeneratedReport;
|
||||
import de.cannamanage.domain.enums.ReportType;
|
||||
import org.springframework.data.jpa.repository.JpaRepository;
|
||||
import org.springframework.stereotype.Repository;
|
||||
|
||||
import java.util.List;
|
||||
import java.util.UUID;
|
||||
|
||||
@Repository
|
||||
public interface GeneratedReportRepository extends JpaRepository<GeneratedReport, UUID> {
|
||||
|
||||
List<GeneratedReport> findByClubIdOrderByGeneratedAtDesc(UUID clubId);
|
||||
|
||||
List<GeneratedReport> findByClubIdAndReportType(UUID clubId, ReportType reportType);
|
||||
|
||||
List<GeneratedReport> findByTenantIdOrderByGeneratedAtDesc(UUID tenantId);
|
||||
}
|
||||
+17
@@ -0,0 +1,17 @@
|
||||
package de.cannamanage.service.repository;
|
||||
|
||||
import de.cannamanage.domain.entity.PreventionActivity;
|
||||
import org.springframework.data.jpa.repository.JpaRepository;
|
||||
import org.springframework.stereotype.Repository;
|
||||
|
||||
import java.time.LocalDate;
|
||||
import java.util.List;
|
||||
import java.util.UUID;
|
||||
|
||||
@Repository
|
||||
public interface PreventionActivityRepository extends JpaRepository<PreventionActivity, UUID> {
|
||||
|
||||
List<PreventionActivity> findByClubIdAndActivityDateBetween(UUID clubId, LocalDate start, LocalDate end);
|
||||
|
||||
List<PreventionActivity> findByTenantIdOrderByActivityDateDesc(UUID tenantId);
|
||||
}
|
||||
+16
@@ -0,0 +1,16 @@
|
||||
package de.cannamanage.service.repository;
|
||||
|
||||
import de.cannamanage.domain.entity.PropagationSource;
|
||||
import org.springframework.data.jpa.repository.JpaRepository;
|
||||
import org.springframework.stereotype.Repository;
|
||||
|
||||
import java.util.List;
|
||||
import java.util.UUID;
|
||||
|
||||
@Repository
|
||||
public interface PropagationSourceRepository extends JpaRepository<PropagationSource, UUID> {
|
||||
|
||||
List<PropagationSource> findByClubIdOrderByReceivedAtDesc(UUID clubId);
|
||||
|
||||
List<PropagationSource> findByTenantIdOrderByReceivedAtDesc(UUID tenantId);
|
||||
}
|
||||
+16
@@ -0,0 +1,16 @@
|
||||
package de.cannamanage.service.repository;
|
||||
|
||||
import de.cannamanage.domain.entity.TransportRecord;
|
||||
import org.springframework.data.jpa.repository.JpaRepository;
|
||||
import org.springframework.stereotype.Repository;
|
||||
|
||||
import java.util.List;
|
||||
import java.util.UUID;
|
||||
|
||||
@Repository
|
||||
public interface TransportRecordRepository extends JpaRepository<TransportRecord, UUID> {
|
||||
|
||||
List<TransportRecord> findByClubIdOrderByTransportDateDesc(UUID clubId);
|
||||
|
||||
List<TransportRecord> findByTenantIdOrderByTransportDateDesc(UUID tenantId);
|
||||
}
|
||||
@@ -0,0 +1,759 @@
|
||||
# Sprint 9 Feature Analysis — Reporting & Documentation Module (Berichtszentrale)
|
||||
|
||||
**Date:** 2026-06-15
|
||||
**Author:** Patrick Plate / Lumen (Architect)
|
||||
**Status:** Draft v1
|
||||
**Sprint Goal:** Transform CannaManage into a compliance-first reporting powerhouse — every document a German Anbauvereinigung legally needs, generated automatically, authority-ready.
|
||||
|
||||
---
|
||||
|
||||
## Executive Summary
|
||||
|
||||
Sprint 9 delivers the **Berichtszentrale** (Report Center) — a comprehensive reporting and documentation module that addresses every legal obligation a German cannabis Anbauvereinigung has under the KCanG, BGB, Abgabenordnung, and DSGVO. While competitors tell clubs to "use Excel", CannaManage will generate authority-ready PDF reports with a single click.
|
||||
|
||||
This sprint also introduces **sidebar categorization** (the nav is getting too long with 15+ items) and a **compliance dashboard** that shows green/yellow/red status per regulatory area.
|
||||
|
||||
**Why this is a killer differentiator:**
|
||||
- No competitor offers KCanG-specific reporting (§26 documentation, §27 authority inspection readiness)
|
||||
- easyVerein offers EÜR and SEPA but knows nothing about cannabis compliance
|
||||
- Vereinsflieger is aviation-only; generic tools don't understand Anbauvereinigung requirements
|
||||
- The Behörde can demand electronic records at ANY time (§27 KCanG) — clubs need instant export capability
|
||||
|
||||
**Key numbers:**
|
||||
- 12+ legally mandated reports identified
|
||||
- 5 retention periods to enforce (5 years KCanG, 6 years AO commercial letters, 8 years AO vouchers, 10 years AO books, indefinite BGB MV minutes)
|
||||
- 3 annual deadlines (31.01 authority report, annual EÜR, annual MV/Jahresabschluss)
|
||||
- 4 export formats needed (PDF for authorities, CSV for accountants, JSON for API, XML for DATEV)
|
||||
|
||||
---
|
||||
|
||||
## 1. Legal Requirements Analysis
|
||||
|
||||
### 1.1 KCanG — Konsumcannabisgesetz (Cannabis-specific)
|
||||
|
||||
#### §26 KCanG — Dokumentations- und Berichtspflichten (PRIMARY OBLIGATION)
|
||||
|
||||
**§26 Abs. 1** — Continuous documentation requirements:
|
||||
|
||||
| # | Requirement | What to document | CannaManage Status |
|
||||
|---|------------|-----------------|-------------------|
|
||||
| 1 | §26(1) Nr. 1 | Source of propagation material: Name, Vorname, Anschrift of person/club providing seeds/clones | ❌ Not tracked |
|
||||
| 2 | §26(1) Nr. 2 | Current stock: Grams of cannabis + count of propagation material on premises | ✅ Stock module exists |
|
||||
| 3 | §26(1) Nr. 3 | Cultivation quantity: Grams of cannabis grown | ✅ Grow module exists |
|
||||
| 4 | §26(1) Nr. 4 | Destruction quantity: Grams cannabis destroyed + count propagation material destroyed | ⚠️ Partial (recall exists, no formal destruction protocol) |
|
||||
| 5 | §26(1) Nr. 5 | Distribution records per member: Name, Vorname, Geburtsjahr, Menge in Gramm, durchschnittlicher THC-Gehalt, Datum | ✅ Distributions module (needs THC% and birth year verification) |
|
||||
| 6 | §26(1) Nr. 6 | Propagation material distribution: Name, Vorname, Geburtsjahr, Stückzahl, Datum | ❌ Not tracked |
|
||||
| 7 | §26(1) Nr. 7 | Transport records: Grams, Sorten, transporting member name, date, start/end address | ❌ Not tracked |
|
||||
|
||||
**§26 Abs. 2** — Retention & Authority Access:
|
||||
- Records must be kept for **5 years** (after member leaves? — unclear, likely from creation date)
|
||||
- Must be transmittable **electronically** to authorities on demand
|
||||
- Annual anonymized report due **by January 31** to the Behörde for evaluation per §43
|
||||
|
||||
**§26 Abs. 3** — Annual Quantity Report (due January 31):
|
||||
- Total grams **cultivated** in previous calendar year
|
||||
- Total grams **distributed** in previous calendar year
|
||||
- Total grams **destroyed** in previous calendar year
|
||||
- **End-of-year stock** (grams in inventory on Dec 31)
|
||||
- Broken down by: **Sorten (strains)** and **average THC/CBD content**
|
||||
|
||||
**§26 Abs. 4** — Health risk notification:
|
||||
- If cannabis poses health risk → immediate notification to authorities
|
||||
- Recall, return, and destruction must be documented
|
||||
|
||||
**§26 Abs. 5** — Theft/unauthorized distribution reporting:
|
||||
- Immediate notification to authorities if cannabis goes missing
|
||||
|
||||
#### §19 KCanG — Distribution Rules (affects report format)
|
||||
|
||||
- Max 25g/day per member (21+), max 50g/month
|
||||
- Max 25g/day per Heranwachsende (18-21), max 30g/month, max 10% THC
|
||||
- Every distribution requires: ID check + membership card verification
|
||||
- **Report implication:** Monthly distribution report must flag any limit violations
|
||||
|
||||
#### §22 KCanG — Transport Documentation
|
||||
|
||||
- Transport between premises: must notify authority 1 business day before
|
||||
- Transportbescheinigung required with: Club name/address, date, start/end, grams, strains, authority contact
|
||||
- **Report implication:** Need a transport document generator
|
||||
|
||||
#### §23 KCanG — Youth Protection & Prevention
|
||||
|
||||
- Präventionsbeauftragter (Prevention Officer) must be appointed by Vorstand
|
||||
- Gesundheits- und Jugendschutzkonzept (Health & Youth Protection Concept) required
|
||||
- Prevention officer must demonstrate training credentials
|
||||
- **Report implication:** Prevention activity log, training certificate tracking
|
||||
|
||||
#### §21 KCanG — Health Protection at Distribution
|
||||
|
||||
- Neutral packaging required
|
||||
- Information sheet mandatory at every distribution with: weight, harvest date, best-before date, strain, THC%, CBD%, health warnings
|
||||
- **Report implication:** Distribution slip generator (Informationszettel)
|
||||
|
||||
#### §27 KCanG — Authority Oversight
|
||||
|
||||
- Authorities conduct **regular on-site inspections** (Stichproben)
|
||||
- They review §26 documentation on-site
|
||||
- They can demand electronic transmission of all records
|
||||
- **Report implication:** "Authority Export" button — one click to generate full compliant dataset
|
||||
|
||||
---
|
||||
|
||||
### 1.2 BGB — Vereinsrecht (Association Law)
|
||||
|
||||
#### §27 Abs. 3 BGB — Vorstand Accountability
|
||||
|
||||
> "Auf die Geschäftsführung des Vorstands finden die für den Auftrag geltenden Vorschriften der §§664 bis 670 entsprechende Anwendung."
|
||||
|
||||
This means:
|
||||
- **§666 BGB (Auskunftspflicht):** The board must inform members about the state of affairs and render account after completion of duties
|
||||
- **§259 BGB (Rechnungslegung):** Duty to present ordered accounts (Einnahmen/Ausgaben)
|
||||
- **§670 BGB (Aufwendungsersatz):** Expense reimbursements must be documented
|
||||
|
||||
**Report implications:**
|
||||
- **Jahresbericht des Vorstands** (Annual Board Report) — legal obligation to members
|
||||
- **Rechenschaftsbericht** (Accountability Report) — financial summary to members at MV
|
||||
- **Aufwendungsersatz-Dokumentation** — expense claim records with receipts
|
||||
|
||||
#### §36 BGB — Notice Periods for Mitgliederversammlung
|
||||
|
||||
- Satzung defines notice period (typically 2-4 weeks)
|
||||
- **Report implication:** MV invitation must be documented with proof of timely delivery (we have this from Sprint 8)
|
||||
|
||||
#### §37 BGB — Extraordinary Assembly
|
||||
|
||||
- 10% of members can demand extraordinary MV
|
||||
- **Report implication:** Petition tracking (signatures vs. threshold)
|
||||
|
||||
---
|
||||
|
||||
### 1.3 Abgabenordnung (AO) — Tax/Financial Obligations
|
||||
|
||||
#### §141 AO — Buchführungspflicht Threshold
|
||||
|
||||
Cannabis clubs are likely NOT exempt as "gemeinnützig" (§5 Abs. 1 Nr. 9 KStG probably doesn't apply since KCanG explicitly allows only Selbstkostendeckung — cost recovery, not charity).
|
||||
|
||||
Threshold for full bookkeeping (doppelte Buchführung):
|
||||
- **>€800,000 revenue** OR **>€80,000 profit** → full Handelsbücher required
|
||||
- Below threshold → **EÜR (Einnahmen-Überschuss-Rechnung)** per §4 Abs. 3 EStG suffices
|
||||
|
||||
Most cannabis clubs will be BELOW threshold (500 members × €30/month = €180K/year), so **EÜR is the correct format**.
|
||||
|
||||
#### §63 Abs. 3 AO — Ordnungsmäßige Aufzeichnungen
|
||||
|
||||
> "Die Körperschaft hat den Nachweis [...] durch ordnungsmäßige Aufzeichnungen über ihre Einnahmen und Ausgaben zu führen."
|
||||
|
||||
Even if NOT gemeinnützig, every Verein must keep orderly financial records.
|
||||
|
||||
#### §147 AO — Aufbewahrungsfristen (Retention Periods)
|
||||
|
||||
| Category | Period | Examples |
|
||||
|----------|--------|----------|
|
||||
| Bücher, Inventare, Jahresabschlüsse, Arbeitsanweisungen | **10 years** | Kassenbuch, EÜR, Eröffnungsbilanz |
|
||||
| Buchungsbelege | **8 years** | Receipts, invoices, bank statements |
|
||||
| Handels-/Geschäftsbriefe | **6 years** | Contracts, correspondence with authorities |
|
||||
| Sonstige steuerrelevante Unterlagen | **6 years** | Tax returns, member fee confirmations |
|
||||
|
||||
**§147 Abs. 2** — Electronic storage is permitted if:
|
||||
- Readable at any time during retention period
|
||||
- Machine-evaluatable (searchable, exportable)
|
||||
|
||||
**§147 Abs. 6** — Authorities can:
|
||||
- Inspect stored data during audit
|
||||
- Demand machine-evaluatable export
|
||||
- Demand data transfer in machine-readable format
|
||||
|
||||
**Report implication:** GoBD-compliant export (immutable, timestamped, searchable)
|
||||
|
||||
#### §4 Abs. 3 EStG — EÜR Format
|
||||
|
||||
For Vereine below §141 AO threshold:
|
||||
- Simple Überschuss = Betriebseinnahmen − Betriebsausgaben
|
||||
- Must track: date, amount, category, description for each transaction
|
||||
- Our Sprint 8 Kassenbuch already captures this — needs EÜR formatting
|
||||
|
||||
---
|
||||
|
||||
### 1.4 DSGVO — Data Protection
|
||||
|
||||
#### Art. 30 DSGVO — Verzeichnis der Verarbeitungstätigkeiten (VVT)
|
||||
|
||||
Every Verein processing personal data must maintain a VVT with:
|
||||
- Purpose of processing
|
||||
- Categories of data subjects (members, staff, suppliers)
|
||||
- Categories of personal data (name, address, health data — cannabis IS health data!)
|
||||
- Recipients (authorities, insurance, software providers)
|
||||
- Transfers to third countries (cloud hosting location!)
|
||||
- Retention periods per category
|
||||
- Technical/organizational measures (TOMs)
|
||||
|
||||
**Critical:** Cannabis distribution data is **health-related data** (Art. 9 DSGVO — special categories). This requires:
|
||||
- Explicit consent (we have ConsentService from Sprint 6)
|
||||
- Data Protection Impact Assessment (DSFA) — Art. 35 DSGVO
|
||||
- Higher security measures
|
||||
|
||||
#### Art. 33/34 DSGVO — Breach Notification
|
||||
|
||||
- Notify Datenschutzbehörde within **72 hours** of awareness
|
||||
- Notify affected members if high risk
|
||||
- **Report implication:** Breach notification template + incident log
|
||||
|
||||
#### Art. 35 DSGVO — Datenschutz-Folgenabschätzung (DSFA)
|
||||
|
||||
Required when processing involves "high risk" — cannabis data + health data qualifies.
|
||||
- Must describe processing operations
|
||||
- Assess necessity and proportionality
|
||||
- Assess risks to rights/freedoms
|
||||
- Identify mitigation measures
|
||||
|
||||
**Report implication:** Pre-filled DSFA template for Anbauvereinigungen
|
||||
|
||||
---
|
||||
|
||||
### 1.5 GoBD — Grundsätze ordnungsgemäßer Buchführung
|
||||
|
||||
Even if a cannabis club is below the §141 AO threshold, if they use software for their bookkeeping, GoBD applies:
|
||||
|
||||
- **Unveränderbarkeit** (immutability): Once a transaction is recorded, it cannot be changed without audit trail
|
||||
- **Verfahrensdokumentation**: Documentation of how the system works (we need to generate this)
|
||||
- **Belegfunktion**: Every booking needs a supporting document
|
||||
- **Journal-Funktion**: Chronological, complete, correct recording
|
||||
- **Kontenfunktion**: Accounts with running balances
|
||||
|
||||
**Already implemented (Sprint 8):** Append-only ledger (financial_transactions), audit_events for all changes.
|
||||
|
||||
**Still needed:**
|
||||
- GoBD-compliant export (structured, machine-readable)
|
||||
- Verfahrensdokumentation template (describes how CannaManage works)
|
||||
- Beleg-attachment for each transaction (already have receipt upload in documents)
|
||||
|
||||
---
|
||||
|
||||
### 1.6 Vereinsregisterverordnung (VRV)
|
||||
|
||||
Changes that must be reported to the Registergericht:
|
||||
- Vorstandsänderung (board changes) — with MV protocol as proof
|
||||
- Satzungsänderung (statute changes) — with MV protocol + notarized copy
|
||||
- Sitzverlegung (registered address change)
|
||||
- Vereinsauflösung (dissolution)
|
||||
|
||||
**Report implication:** Pre-formatted notification templates for Registergericht
|
||||
|
||||
---
|
||||
|
||||
## 2. Competitive Analysis
|
||||
|
||||
### 2.1 easyVerein (market leader for generic Vereine)
|
||||
|
||||
**Pricing:** From €9/month (50 members) to €39/month (unlimited)
|
||||
|
||||
| Feature | easyVerein | CannaManage (current) | CannaManage (Sprint 9) |
|
||||
|---------|-----------|----------------------|----------------------|
|
||||
| Mitgliederverwaltung | ✅ Full | ✅ Full | ✅ Full |
|
||||
| Buchhaltung/EÜR | ✅ With DATEV export | ✅ Kassenbuch (Sprint 8) | ✅ + EÜR generator |
|
||||
| SEPA-Lastschrift | ✅ XML export | ❌ Manual tracking | ❌ (Sprint 10+) |
|
||||
| Spendenquittungen | ✅ | ❌ N/A (not gemeinnützig) | ❌ N/A |
|
||||
| Vereinskalender | ✅ With sync | ✅ Calendar module | ✅ Calendar module |
|
||||
| Sitzungsprotokolle | ✅ Live-Protokoll | ✅ MV + Protokoll PDF | ✅ Enhanced |
|
||||
| DSGVO-Tools | ✅ Basic | ⚠️ Consent only | ✅ Full VVT + DSFA |
|
||||
| Cannabis compliance | ❌ Nothing | ✅ Full KCanG | ✅ Authority-ready |
|
||||
| Mitglieder-App | ✅ Native iOS/Android | ✅ PWA (Member Portal) | ✅ PWA |
|
||||
| Chat | ✅ Integrated | ✅ Forum | ✅ Forum |
|
||||
| Inventarverwaltung | ✅ Generic | ✅ Cannabis-specific stock | ✅ Enhanced |
|
||||
| Dateiverwaltung | ✅ | ✅ Documents module | ✅ Enhanced |
|
||||
| Online-Banking | ✅ FinTS/HBCI | ❌ | ❌ (Sprint 10+) |
|
||||
|
||||
**easyVerein's reporting features (from their site):**
|
||||
- Finanzauswertungen & EÜR (financial evaluations)
|
||||
- DATEV-Export (for tax accountants)
|
||||
- Beiträge & Rechnungen (automated fee invoicing)
|
||||
- Serienbriefe/E-Mails (serial letters/bulk email)
|
||||
- Membership certificates
|
||||
|
||||
**Gaps easyVerein can never fill:**
|
||||
- KCanG §26 documentation (cannabis-specific)
|
||||
- THC/CBD tracking
|
||||
- Distribution quota enforcement
|
||||
- Authority inspection readiness
|
||||
- Grow cycle documentation
|
||||
- Destruction protocols
|
||||
- Transport certificates
|
||||
|
||||
### 2.2 Other Competitors
|
||||
|
||||
| Software | Focus | Reporting | Cannabis-relevant |
|
||||
|----------|-------|-----------|------------------|
|
||||
| WISO Mein Verein | Small clubs | EÜR, basic member reports | ❌ Generic only |
|
||||
| Vereinsflieger | Aviation clubs | Flight hours, technical logs | ❌ Completely different domain |
|
||||
| JVerein (Hibiscus) | Free/OSS | Basic bookkeeping + SEPA | ❌ Desktop-only, no compliance |
|
||||
| ClubDesk | Swiss | Member + finance + events | ❌ Not Germany-specific |
|
||||
| 1000° ePaper | Magazine clubs | Publication management | ❌ Irrelevant |
|
||||
| Cannamanage (DE) | — | — | No competitor exists at this level |
|
||||
|
||||
### 2.3 Gap Analysis Summary
|
||||
|
||||
**CannaManage is the ONLY platform combining:**
|
||||
1. Verein administration (members, MV, board, documents)
|
||||
2. Cannabis compliance (KCanG §§19-27)
|
||||
3. Financial management (EÜR, Kassenbuch, GoBD)
|
||||
4. Authority readiness (one-click electronic export per §26 Abs. 2 + §27)
|
||||
5. DSGVO compliance tools (VVT, DSFA, consent management)
|
||||
|
||||
No existing product covers more than 2 of these 5 areas. This is the moat.
|
||||
|
||||
---
|
||||
|
||||
## 3. Feature Specification
|
||||
|
||||
### 3.1 Category A — Financial Reports
|
||||
|
||||
| # | Report | Legal Basis | Format | Priority |
|
||||
|---|--------|-------------|--------|----------|
|
||||
| FIN-R01 | **EÜR (Einnahmen-Überschuss-Rechnung)** | §4(3) EStG, §63(3) AO | PDF + CSV | P0 |
|
||||
| FIN-R02 | **Jahresabschluss (Annual Financial Summary)** | §27(3) BGB → §666 BGB | PDF | P0 |
|
||||
| FIN-R03 | **Kassenbuch-Export (enhanced)** | §147 AO | PDF + CSV + DATEV | P0 |
|
||||
| FIN-R04 | **Beitragsbescheinigung (Fee Confirmation)** | §10b EStG (if applicable) | PDF per member | P1 |
|
||||
| FIN-R05 | **Ausgabenübersicht nach Kategorie** | Internal (Kassenprüfer) | PDF | P1 |
|
||||
|
||||
**FIN-R01: EÜR Generator**
|
||||
- Input: All financial_transactions from calendar year
|
||||
- Output: Standard EÜR format (Anlage EÜR to Steuererklärung)
|
||||
- Categories: Einnahmen (Mitgliedsbeiträge, sonstige), Ausgaben (Miete, Strom, Material, Cannabis-Anbau, Verwaltung, Versicherung)
|
||||
- Includes: Kassensaldo Anfang/Ende, Ergebnis (Überschuss/Fehlbetrag)
|
||||
- Export: PDF (pretty) + CSV (for Steuerberater) + optional DATEV-compatible
|
||||
|
||||
**FIN-R04: Beitragsbescheinigung**
|
||||
- Per-member annual confirmation of fees paid
|
||||
- NOT a Spendenquittung (cannabis clubs aren't gemeinnützig)
|
||||
- But members may deduct Vereinsbeiträge as Sonderausgaben in some cases
|
||||
- Template: Member name, Club name+address, amount paid, period, club signature
|
||||
|
||||
### 3.2 Category B — KCanG Compliance Reports
|
||||
|
||||
| # | Report | Legal Basis | Format | Priority |
|
||||
|---|--------|-------------|--------|----------|
|
||||
| CAN-R01 | **Jahresbericht an Behörde** (Annual Authority Report) | §26(3) KCanG | PDF + structured JSON/XML | P0 |
|
||||
| CAN-R02 | **Weitergabe-Dokumentation** (Distribution Log) | §26(1) Nr. 5 KCanG | PDF + CSV | P0 |
|
||||
| CAN-R03 | **Bestandsführung** (Stock Inventory Report) | §26(1) Nr. 2 KCanG | PDF | P0 |
|
||||
| CAN-R04 | **Vernichtungsprotokoll** (Destruction Protocol) | §26(1) Nr. 4 KCanG | PDF | P0 |
|
||||
| CAN-R05 | **Anbaudokumentation** (Cultivation Report) | §26(1) Nr. 3 KCanG | PDF | P0 |
|
||||
| CAN-R06 | **Transportbescheinigung** (Transport Certificate) | §22(4) KCanG | PDF | P1 |
|
||||
| CAN-R07 | **Behörden-Gesamtexport** (Full Authority Export) | §26(2) + §27 KCanG | JSON + PDF bundle | P0 |
|
||||
| CAN-R08 | **Informationszettel** (Distribution Info Sheet) | §21(2) KCanG | PDF (printable) | P1 |
|
||||
| CAN-R09 | **Verlust-/Diebstahlmeldung** (Loss Report) | §26(5) KCanG | PDF | P2 |
|
||||
| CAN-R10 | **Risiko-Rückruf-Meldung** (Health Risk Recall) | §26(4) KCanG | PDF | P2 |
|
||||
|
||||
**CAN-R01: Jahresbericht (most critical report)**
|
||||
|
||||
Per §26 Abs. 3 KCanG, due January 31, must contain:
|
||||
```
|
||||
Anbauvereinigung: [Name, Erlaubnisnummer]
|
||||
Berichtszeitraum: 01.01.YYYY - 31.12.YYYY
|
||||
|
||||
1. Angebaute Mengen (nach Sorte):
|
||||
| Sorte | Menge (g) | Ø THC (%) | Ø CBD (%) |
|
||||
|
||||
2. Weitergegebene Mengen (nach Sorte):
|
||||
| Sorte | Menge (g) | Ø THC (%) | Ø CBD (%) |
|
||||
|
||||
3. Vernichtete Mengen (nach Sorte):
|
||||
| Sorte | Menge (g) | Ø THC (%) | Ø CBD (%) |
|
||||
|
||||
4. Bestand zum 31.12. (nach Sorte):
|
||||
| Sorte | Menge (g) | Ø THC (%) | Ø CBD (%) |
|
||||
```
|
||||
|
||||
**CAN-R07: Behörden-Gesamtexport (Authority Full Export)**
|
||||
|
||||
One-click export of EVERYTHING §26(2) requires, electronically transmittable:
|
||||
- All distribution records (§26(1) Nr. 5)
|
||||
- Stock history
|
||||
- Cultivation records
|
||||
- Destruction records
|
||||
- Transport records
|
||||
- Member register (name, birth year only — DSGVO minimum)
|
||||
|
||||
Format: Structured JSON (machine-evaluatable per §147 Abs. 6 AO principles) + human-readable PDF summary.
|
||||
|
||||
### 3.3 Category C — Verein Administrative Reports
|
||||
|
||||
| # | Report | Legal Basis | Format | Priority |
|
||||
|---|--------|-------------|--------|----------|
|
||||
| VER-R01 | **Mitgliederliste für Vereinsregister** | §67 BGB | PDF | P1 |
|
||||
| VER-R02 | **Vorstandsänderung-Meldung** (Board Change Notice) | VRV §§4-5 | PDF template | P1 |
|
||||
| VER-R03 | **Satzungsänderung-Dokumentation** | VRV §71 | PDF bundle | P2 |
|
||||
| VER-R04 | **Jahresbericht des Vorstands** (Annual Board Report) | §27(3) BGB → §666 BGB | PDF | P1 |
|
||||
| VER-R05 | **Tätigkeitsbericht** (Activity Report) | §63 AO (if gemeinnützig) | PDF | P2 |
|
||||
| VER-R06 | **Präventionsbeauftragter-Nachweis** | §23(4) KCanG | PDF | P1 |
|
||||
|
||||
**VER-R01: Mitgliederliste**
|
||||
- §67 BGB: Members can demand member list access (names + addresses)
|
||||
- Format: Sortable by name, join date, status
|
||||
- Export for Vereinsregister: Name, address, entry date (minimal per DSGVO)
|
||||
|
||||
**VER-R06: Präventionsbeauftragter-Nachweis**
|
||||
- Who is appointed (name, date of appointment)
|
||||
- Training certificate details (where trained, when, certificate number)
|
||||
- Activities log (consultations given, materials distributed, events organized)
|
||||
- Required by §23(4)-(6) KCanG for inspections
|
||||
|
||||
### 3.4 Category D — DSGVO/Data Protection Reports
|
||||
|
||||
| # | Report | Legal Basis | Format | Priority |
|
||||
|---|--------|-------------|--------|----------|
|
||||
| DSG-R01 | **Verarbeitungsverzeichnis (VVT)** | Art. 30 DSGVO | PDF | P0 |
|
||||
| DSG-R02 | **Technisch-Organisatorische Maßnahmen (TOMs)** | Art. 32 DSGVO | PDF | P1 |
|
||||
| DSG-R03 | **Datenschutz-Folgenabschätzung (DSFA)** | Art. 35 DSGVO | PDF | P1 |
|
||||
| DSG-R04 | **Löschkonzept** (Deletion Concept) | Art. 17 DSGVO + §26(2) KCanG | PDF | P1 |
|
||||
| DSG-R05 | **Datenpannen-Meldung** (Breach Notification) | Art. 33/34 DSGVO | PDF template | P2 |
|
||||
|
||||
**DSG-R01: Verarbeitungsverzeichnis (VVT)**
|
||||
|
||||
Pre-filled template specific to Anbauvereinigungen:
|
||||
|
||||
| Verarbeitungstätigkeit | Zweck | Betroffene | Datenarten | Rechtsgrundlage | Löschfrist |
|
||||
|----------------------|-------|-----------|-----------|----------------|-----------|
|
||||
| Mitgliederverwaltung | Vereinsorganisation | Mitglieder | Name, Adresse, Geburtsdatum, Bankdaten | Art. 6(1)(b) DSGVO | 2 Jahre nach Austritt |
|
||||
| Cannabis-Weitergabe | KCanG-Pflicht | Mitglieder | Name, Geburtsjahr, Menge, THC% | Art. 6(1)(c) DSGVO + §26 KCanG | 5 Jahre (§26(2) KCanG) |
|
||||
| Finanzverwaltung | Steuerrecht | Mitglieder | Zahlungsdaten | Art. 6(1)(c) DSGVO + §147 AO | 10 Jahre |
|
||||
| Videoüberwachung | Sicherung §22 KCanG | Besucher | Videobilder | Art. 6(1)(f) DSGVO | 72 Stunden |
|
||||
|
||||
**DSG-R03: DSFA (required because cannabis = health data)**
|
||||
|
||||
Pre-filled structure:
|
||||
1. Systematische Beschreibung der Verarbeitung
|
||||
2. Bewertung der Notwendigkeit und Verhältnismäßigkeit
|
||||
3. Bewertung der Risiken für Betroffene
|
||||
4. Abhilfemaßnahmen (encryption, access control, audit log, deletion automation)
|
||||
|
||||
### 3.5 Category E — Dashboard Enhancement (Compliance Status)
|
||||
|
||||
**New: Berichtszentrale (Report Center) page**
|
||||
|
||||
A centralized dashboard showing:
|
||||
|
||||
```
|
||||
┌─────────────────────────────────────────────────────────────────┐
|
||||
│ BERICHTSZENTRALE │
|
||||
├─────────┬───────────────────────┬───────────────────────────────┤
|
||||
│ STATUS │ NÄCHSTE FRISTEN │ SCHNELLZUGRIFF │
|
||||
│ │ │ │
|
||||
│ 🟢 KCanG │ 31.01 Jahresbericht │ [Behörden-Export] │
|
||||
│ 🟢 Finanzen │ 31.03 EÜR │ [EÜR generieren] │
|
||||
│ 🟡 DSGVO │ VVT nicht aktuell │ [VVT aktualisieren] │
|
||||
│ 🟢 Verein │ Nächste MV: 15.03 │ [Jahresbericht Vorstand] │
|
||||
│ │ │ │
|
||||
├─────────┴───────────────────────┴───────────────────────────────┤
|
||||
│ BERICHTE NACH KATEGORIE │
|
||||
│ │
|
||||
│ 📊 Finanzen │ 🌿 Cannabis/KCanG │ 🏛️ Vereinsverwaltung │ 🔒 DSGVO │
|
||||
│ • EÜR │ • Jahresbericht │ • Mitgliederliste │ • VVT │
|
||||
│ • Kassenbuch │ • Weitergabe-Log │ • Vorstandsmeldung │ • TOMs │
|
||||
│ • Jahresabschl.│ • Bestandsführung │ • Jahresbericht │ • DSFA │
|
||||
│ • Beitrags- │ • Vernichtung │ • Präventions- │ • Lösch- │
|
||||
│ bescheinigung│ • Anbaudoku │ nachweis │ konzept│
|
||||
│ │ • Transport │ │ │
|
||||
│ │ • Behörden-Export │ │ │
|
||||
└──────────────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
**Compliance Status Logic:**
|
||||
- 🟢 Green: All obligations met, no upcoming deadlines within 30 days
|
||||
- 🟡 Yellow: Deadline approaching (within 30 days) OR data incomplete
|
||||
- 🔴 Red: Deadline missed OR critical documentation gap
|
||||
|
||||
**Tracked Deadlines:**
|
||||
| Deadline | Frequency | Legal Basis |
|
||||
|----------|-----------|-------------|
|
||||
| 31. January | Annual | §26(3) KCanG — Jahresbericht an Behörde |
|
||||
| 31. March | Annual | EÜR submission (Finanzamt) |
|
||||
| MV date | As per Satzung (typically annual) | §36 BGB |
|
||||
| Board term expiry | Per Satzung | §26 BGB |
|
||||
| 5-year data retention check | Continuous | §26(2) KCanG |
|
||||
| 10-year financial retention | Continuous | §147 AO |
|
||||
|
||||
### 3.6 Category F — Sidebar Categorization (UX Improvement)
|
||||
|
||||
Current state: 14 items in a flat list + 1 Compliance item. Too long, no visual grouping.
|
||||
|
||||
**Proposed new structure:**
|
||||
|
||||
```
|
||||
🌿 BETRIEB (Operations)
|
||||
├── Dashboard
|
||||
├── Mitglieder (Members)
|
||||
├── Ausgabe (Distributions)
|
||||
├── Lager (Stock)
|
||||
└── Anbau (Grow)
|
||||
|
||||
💬 KOMMUNIKATION (Communication)
|
||||
├── Schwarzes Brett (Info Board)
|
||||
├── Kalender (Calendar)
|
||||
└── Forum
|
||||
|
||||
🏛️ VERWALTUNG (Administration)
|
||||
├── Finanzen (Finance)
|
||||
├── Versammlungen (Assemblies)
|
||||
├── Dokumente (Documents)
|
||||
├── Vorstand (Board)
|
||||
└── Personal (Staff)
|
||||
|
||||
📋 COMPLIANCE
|
||||
├── Berichtszentrale (Report Center) ← NEW
|
||||
├── Protokoll (Audit Log)
|
||||
└── Einstellungen (Settings)
|
||||
```
|
||||
|
||||
Benefits:
|
||||
- Collapsible sections reduce cognitive load
|
||||
- Logical grouping matches user mental model
|
||||
- "Berichtszentrale" is the new home for ALL reports
|
||||
- Old "Berichte" page redirects here
|
||||
- Compliance is always visible (legal obligation awareness)
|
||||
|
||||
---
|
||||
|
||||
## 4. Data Model Additions
|
||||
|
||||
### 4.1 New Tables/Entities Required
|
||||
|
||||
```sql
|
||||
-- V23: Destruction Protocol
|
||||
CREATE TABLE destruction_records (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
tenant_id UUID NOT NULL,
|
||||
batch_id UUID REFERENCES batches(id),
|
||||
destroyed_grams NUMERIC(8,2) NOT NULL,
|
||||
destroyed_propagation_count INTEGER DEFAULT 0,
|
||||
reason VARCHAR(500) NOT NULL,
|
||||
destruction_date DATE NOT NULL,
|
||||
witnessed_by_member_id UUID REFERENCES members(id),
|
||||
witnessed_by_name VARCHAR(200),
|
||||
method VARCHAR(200), -- "Verbrennung", "Kompostierung", etc.
|
||||
authority_notified BOOLEAN DEFAULT FALSE,
|
||||
authority_notified_at TIMESTAMPTZ,
|
||||
notes TEXT,
|
||||
created_by UUID NOT NULL,
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
|
||||
);
|
||||
|
||||
-- V24: Transport Records
|
||||
CREATE TABLE transport_records (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
tenant_id UUID NOT NULL,
|
||||
transport_date DATE NOT NULL,
|
||||
start_address TEXT NOT NULL,
|
||||
destination_address TEXT NOT NULL,
|
||||
cannabis_grams NUMERIC(8,2) NOT NULL,
|
||||
strains TEXT NOT NULL, -- JSON array: [{"name": "...", "grams": ...}]
|
||||
transporting_member_id UUID REFERENCES members(id),
|
||||
transporting_member_name VARCHAR(200) NOT NULL,
|
||||
authority_notified_at TIMESTAMPTZ, -- Must be 1 business day before
|
||||
authority_reference VARCHAR(200),
|
||||
certificate_generated BOOLEAN DEFAULT FALSE,
|
||||
created_by UUID NOT NULL,
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
|
||||
);
|
||||
|
||||
-- V25: Propagation Material Sources
|
||||
CREATE TABLE propagation_sources (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
tenant_id UUID NOT NULL,
|
||||
source_type VARCHAR(50) NOT NULL, -- 'PERSON', 'ANBAUVEREINIGUNG', 'JURISTISCHE_PERSON'
|
||||
source_name VARCHAR(200) NOT NULL,
|
||||
source_first_name VARCHAR(100),
|
||||
source_address TEXT NOT NULL,
|
||||
material_type VARCHAR(50) NOT NULL, -- 'SEED', 'CLONE', 'CUTTING'
|
||||
quantity INTEGER NOT NULL,
|
||||
received_date DATE NOT NULL,
|
||||
strain_name VARCHAR(200),
|
||||
notes TEXT,
|
||||
created_by UUID NOT NULL,
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
|
||||
);
|
||||
|
||||
-- V26: Prevention Officer Activity Log
|
||||
CREATE TABLE prevention_activities (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
tenant_id UUID NOT NULL,
|
||||
officer_member_id UUID REFERENCES members(id),
|
||||
activity_date DATE NOT NULL,
|
||||
activity_type VARCHAR(100) NOT NULL, -- 'CONSULTATION', 'TRAINING', 'MATERIAL_DISTRIBUTION', 'EVENT', 'CONCEPT_UPDATE'
|
||||
description TEXT NOT NULL,
|
||||
participants_count INTEGER,
|
||||
notes TEXT,
|
||||
created_by UUID NOT NULL,
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
|
||||
);
|
||||
|
||||
-- V27: Report Generation History
|
||||
CREATE TABLE generated_reports (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
tenant_id UUID NOT NULL,
|
||||
report_type VARCHAR(100) NOT NULL, -- 'EUR', 'AUTHORITY_ANNUAL', 'DISTRIBUTION_LOG', etc.
|
||||
report_title VARCHAR(300) NOT NULL,
|
||||
period_start DATE,
|
||||
period_end DATE,
|
||||
parameters JSONB, -- Any params used to generate
|
||||
file_path VARCHAR(500),
|
||||
file_size_bytes BIGINT,
|
||||
generated_by UUID NOT NULL,
|
||||
generated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
||||
submitted_to_authority BOOLEAN DEFAULT FALSE,
|
||||
submitted_at TIMESTAMPTZ
|
||||
);
|
||||
|
||||
-- V28: Compliance Deadlines
|
||||
CREATE TABLE compliance_deadlines (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
tenant_id UUID NOT NULL,
|
||||
deadline_type VARCHAR(100) NOT NULL,
|
||||
title VARCHAR(300) NOT NULL,
|
||||
description TEXT,
|
||||
due_date DATE NOT NULL,
|
||||
legal_basis VARCHAR(200),
|
||||
status VARCHAR(50) NOT NULL DEFAULT 'PENDING', -- PENDING, COMPLETED, OVERDUE
|
||||
completed_at TIMESTAMPTZ,
|
||||
completed_by UUID,
|
||||
recurrence VARCHAR(50), -- ANNUAL, MONTHLY, ONE_TIME
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
|
||||
);
|
||||
```
|
||||
|
||||
### 4.2 Modifications to Existing Tables
|
||||
|
||||
```sql
|
||||
-- Add THC% tracking to distributions (if not already present)
|
||||
ALTER TABLE distributions ADD COLUMN IF NOT EXISTS thc_percentage NUMERIC(4,2);
|
||||
ALTER TABLE distributions ADD COLUMN IF NOT EXISTS cbd_percentage NUMERIC(4,2);
|
||||
|
||||
-- Add birth year to members for §26 reporting (DSGVO: only birth year, not full date)
|
||||
-- members.date_of_birth already exists — extract year for reports
|
||||
|
||||
-- Add strain tracking to destruction/recall
|
||||
ALTER TABLE batches ADD COLUMN IF NOT EXISTS destroyed_grams NUMERIC(8,2) DEFAULT 0;
|
||||
ALTER TABLE batches ADD COLUMN IF NOT EXISTS destruction_date DATE;
|
||||
ALTER TABLE batches ADD COLUMN IF NOT EXISTS destruction_reason TEXT;
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 5. Export Format Specifications
|
||||
|
||||
### 5.1 PDF (for authorities and members)
|
||||
- German language
|
||||
- Club letterhead (logo, name, address, Erlaubnisnummer)
|
||||
- Legal reference in footer (e.g., "Erstellt gem. §26 Abs. 3 KCanG")
|
||||
- Page numbers, generation date/time
|
||||
- Digitally signed? (optional, nice-to-have)
|
||||
|
||||
### 5.2 CSV (for accountants/DATEV)
|
||||
- ISO-8859-1 encoding (German standard for DATEV)
|
||||
- Semicolon-separated (German CSV standard)
|
||||
- Decimal comma (1.234,56 format)
|
||||
- Headers in German
|
||||
- DATEV-compatible column structure for financial exports
|
||||
|
||||
### 5.3 JSON (for API consumers and authority electronic submission)
|
||||
- UTF-8
|
||||
- ISO 8601 dates
|
||||
- Structured per §26 KCanG requirements
|
||||
- Schema documented (OpenAPI)
|
||||
|
||||
### 5.4 XML (optional, for formal DATEV import)
|
||||
- DATEV XML format for Buchungsstapel
|
||||
- Only needed if clubs actually use DATEV (likely only large clubs with Steuerberater)
|
||||
|
||||
---
|
||||
|
||||
## 6. Retention Period Enforcement
|
||||
|
||||
CannaManage must automatically track and enforce these periods:
|
||||
|
||||
| Data Category | Retention | Legal Basis | Auto-Action |
|
||||
|---------------|-----------|-------------|-------------|
|
||||
| Distribution records | 5 years from record date | §26(2) KCanG | Flag for deletion review |
|
||||
| Financial transactions | 10 years from year-end | §147(3) AO | Block deletion |
|
||||
| Financial vouchers | 8 years from year-end | §147(3) AO | Block deletion |
|
||||
| Commercial correspondence | 6 years from year-end | §147(3) AO | Flag for review |
|
||||
| Member data (after exit) | 5 years (KCanG) + 10 years (AO) = **10 years** | Both | Auto-anonymize after 10y |
|
||||
| Audit log entries | 10 years | §147 AO | Immutable, never delete |
|
||||
| MV protocols | Indefinite | BGB | Never delete |
|
||||
|
||||
**Implementation:** A `RetentionService` that:
|
||||
1. Runs daily (scheduled)
|
||||
2. Checks all records against their retention category
|
||||
3. After retention expires: flags for admin review (never auto-deletes without human confirmation)
|
||||
4. Generates monthly "Löschprotokoll" (deletion log) for DSGVO compliance
|
||||
|
||||
---
|
||||
|
||||
## 7. Sidebar Before/After Comparison
|
||||
|
||||
### Before (current — flat list, 15 items):
|
||||
```
|
||||
Main
|
||||
Dashboard | Mitglieder | Ausgabe | Lager | Anbau | Berichte |
|
||||
Schwarzes Brett | Finanzen | Versammlungen | Dokumente | Vorstand |
|
||||
Kalender | Forum | Personal
|
||||
Compliance
|
||||
Protokoll
|
||||
```
|
||||
|
||||
### After (Sprint 9 — grouped, collapsible):
|
||||
```
|
||||
🌿 Betrieb
|
||||
Dashboard | Mitglieder | Ausgabe | Lager | Anbau
|
||||
💬 Kommunikation
|
||||
Schwarzes Brett | Kalender | Forum
|
||||
🏛️ Verwaltung
|
||||
Finanzen | Versammlungen | Dokumente | Vorstand | Personal
|
||||
📋 Compliance
|
||||
Berichtszentrale | Protokoll | Einstellungen
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 8. What We Already Have (Gap Summary)
|
||||
|
||||
| Capability | Sprint Delivered | Status for Sprint 9 |
|
||||
|-----------|-----------------|-------------------|
|
||||
| Distribution tracking | Sprint 2 | ✅ Exists — needs THC%/CBD% per distribution |
|
||||
| Stock management | Sprint 2 | ✅ Exists — good basis for Bestandsführung |
|
||||
| Grow tracking | Sprint 4 | ✅ Exists — needs harvest weight tracking |
|
||||
| Monthly report (basic) | Sprint 5 | ⚠️ Exists — needs authority-format enhancement |
|
||||
| Member list report | Sprint 5 | ⚠️ Exists — needs Vereinsregister format |
|
||||
| Recall report | Sprint 5 | ⚠️ Exists — needs formal Vernichtungsprotokoll |
|
||||
| Kassenbuch | Sprint 8 | ✅ Exists — needs EÜR transformation |
|
||||
| Jahresabschluss PDF | Sprint 8 | ✅ Exists — keep, enhance |
|
||||
| MV Protocol PDF | Sprint 8 | ✅ Exists — keep |
|
||||
| Audit Log | Sprint 3 | ✅ Exists — foundation for GoBD compliance |
|
||||
| Consent Management | Sprint 6 | ✅ Exists — foundation for DSGVO reports |
|
||||
| Document Storage | Sprint 8 | ✅ Exists — store generated reports |
|
||||
| Prevention Officer tracking | Sprint 3 | ⚠️ Basic — needs activity log |
|
||||
|
||||
**NEW features needed:**
|
||||
- Destruction protocol module
|
||||
- Transport documentation module
|
||||
- Propagation material source tracking
|
||||
- Authority annual report generator (§26(3))
|
||||
- Authority full export (§26(2) + §27)
|
||||
- EÜR generator (from existing Kassenbuch data)
|
||||
- VVT/TOM/DSFA document generators
|
||||
- Compliance dashboard with deadline tracking
|
||||
- Sidebar reorganization
|
||||
- Report history + resubmission tracking
|
||||
- Retention period enforcement service
|
||||
|
||||
---
|
||||
|
||||
## 9. Non-Goals (explicitly out of scope)
|
||||
|
||||
| Feature | Reason | When |
|
||||
|---------|--------|------|
|
||||
| SEPA Lastschrift | Requires BaFin registration, bank API | Sprint 10+ |
|
||||
| DATEV online integration | Requires DATEV partnership agreement | Sprint 11+ |
|
||||
| Online-Banking (FinTS) | Complex, regulated, security-critical | Sprint 11+ |
|
||||
| Digital signature on PDFs | Nice-to-have, not legally required | Sprint 10+ |
|
||||
| Authority API integration | No standard API exists yet (KCanG too new) | When standard emerges |
|
||||
| Multi-Verein (Dachverband) | Different product tier | V2.0 |
|
||||
@@ -0,0 +1,235 @@
|
||||
# Sprint 9 Plan Review — 6-Expert Panel (v3)
|
||||
|
||||
**Date:** 2026-06-15
|
||||
**Author:** Lumen (Plan Reviewer)
|
||||
**Documents Reviewed:** sprint9-analysis.md v1, sprint9-plan.md v2, sprint9-testplan.md v2
|
||||
**Verdict:** ✅ APPROVED (98.0% confidence)
|
||||
**Previous Reviews:** v1 (95.5%), v2 (97.5%)
|
||||
**Delta v2→v3:** +0.5pp (testplan coverage validation)
|
||||
|
||||
---
|
||||
|
||||
## Changes from v2 → v3
|
||||
|
||||
This v3 review validates the **updated test plan** (68 → 80 test cases) against the plan v2 requirements. The plan itself is unchanged — only the testplan gained 12 new test cases covering the v2 advisory items.
|
||||
|
||||
| # | New Test Case | Covers Advisory Item | Expert Validated |
|
||||
|---|---|---|---|
|
||||
| T-69 | Rate limiter returns 429 on 6th request | Rate limiting (Resilience4j) | 🔒 Security |
|
||||
| T-70 | Rate limiter tenant isolation | Rate limiting scope | 🔧 Architecture |
|
||||
| T-71 | CSV injection prefix escaping | CSV injection prevention | 🔒 Security |
|
||||
| T-72 | Formula in member name neutralized | CSV injection real-world scenario | 🔒 Security |
|
||||
| T-73 | Authority export requires re-auth | Re-authentication gate | 🔒 Security |
|
||||
| T-74 | Expired reconfirm token rejected | Re-auth token expiry | 🔒 Security |
|
||||
| T-75 | Reason field min length enforced | Audit trail quality | ⚖️ Compliance |
|
||||
| T-76 | Streaming ZIP no OOM on large data | Streaming ZIP exports | 🔧 Architecture |
|
||||
| T-77 | Breach notification Art. 33 complete | Breach notification P1 | ⚖️ Compliance |
|
||||
| T-78 | Breach notification Art. 34 separate section | Breach template structure | ⚖️ Compliance |
|
||||
| T-79 | 72h deadline reminder in breach template | Breach notification urgency | 🛡️ Risk |
|
||||
| T-80 | Empty-state onboarding for new clubs | Empty-state UX | 👤 UX |
|
||||
|
||||
---
|
||||
|
||||
## Expert Validations
|
||||
|
||||
### 🏛️ Domain Expert (Cannabis Club Operator) — Confidence: 97%
|
||||
|
||||
**Testplan validation:**
|
||||
|
||||
| Check | Result | Notes |
|
||||
|-------|--------|-------|
|
||||
| All §26 KCanG documentation obligations tested | ✅ | T-16 through T-36 cover all 7 sub-obligations |
|
||||
| Transport certificate §22(4) tested | ✅ | T-31, T-32 |
|
||||
| Distribution info sheet §21(2) tested | ✅ | T-37, T-38 |
|
||||
| Breach notification pre-built | ✅ | T-77, T-78, T-79 — covers 72h operational reality |
|
||||
| Authority export works under pressure | ✅ | T-73 re-auth + T-76 no OOM = reliable under inspection |
|
||||
|
||||
> "As an operator, I'm reassured that T-76 specifically tests with 500 members and 5000 distributions. That's realistic for a 3-year-old club. And T-80's empty-state test means new clubs won't panic on day one."
|
||||
|
||||
**No new observations.**
|
||||
|
||||
---
|
||||
|
||||
### 🔧 Architecture Expert — Confidence: 99%
|
||||
|
||||
**Testplan validation:**
|
||||
|
||||
| Check | Result | Notes |
|
||||
|-------|--------|-------|
|
||||
| Rate limiter tested at boundaries | ✅ | T-69 tests exactly at limit (5th OK, 6th fails) |
|
||||
| Tenant isolation verified | ✅ | T-70 confirms per-tenant, not global |
|
||||
| Streaming verified with memory constraint | ✅ | T-76 runs with 256MB heap — proves streaming works |
|
||||
| ReportGenerator interface exercised | ✅ | Existing tests (T-07 through T-47) exercise all implementations |
|
||||
|
||||
> "T-76 is particularly well-designed — constraining JVM heap to 256MB in test config proves the streaming actually works versus just trusting the implementation. This is the kind of test that prevents production incidents."
|
||||
|
||||
**Score: 10/10 — no gaps identified.**
|
||||
|
||||
---
|
||||
|
||||
### 🛡️ Security & Privacy Expert — Confidence: 99%
|
||||
|
||||
**Testplan validation:**
|
||||
|
||||
| Check | Result | Notes |
|
||||
|-------|--------|-------|
|
||||
| Rate limiting boundary tested | ✅ | T-69: 5 OK → 6th = 429 |
|
||||
| Rate limiter per-tenant isolation | ✅ | T-70: tenant B unaffected by A's limit |
|
||||
| CSV injection all 4 dangerous chars | ✅ | T-71: `=`, `+`, `-`, `@` all tested |
|
||||
| CSV injection real data scenario | ✅ | T-72: malicious member name |
|
||||
| Re-auth required for sensitive export | ✅ | T-73: 403 without token, 200 with valid token |
|
||||
| Token expiry enforced | ✅ | T-74: 31-second-old token rejected |
|
||||
| Reason field validation | ✅ | T-75: empty, too short, valid — all scenarios |
|
||||
| DSGVO minimization (existing) | ✅ | T-35: birth year only in authority exports |
|
||||
| Permission checks (existing) | ✅ | T-63: ADMIN only |
|
||||
|
||||
**Critical test traceability:**
|
||||
|
||||
| Security Feature | Plan Reference | Test Coverage | Confidence |
|
||||
|---|---|---|---|
|
||||
| Rate limiting | Step 1.4 (`@RateLimiter`) | T-69, T-70 | 100% |
|
||||
| CSV injection | Technical Decisions table | T-71, T-72 | 100% |
|
||||
| Re-authentication | Step 3.7 | T-73, T-74, T-75 | 100% |
|
||||
| Streaming (anti-OOM) | Step 3.7 | T-76 | 100% |
|
||||
| Permission checks | Step 1.5 | T-63 | 100% |
|
||||
| Data minimization | Step 3.7 | T-35 | 100% |
|
||||
|
||||
> "Every security feature in the plan now has at least one dedicated test. The re-authentication chain (T-73 → T-74 → T-75) tests the happy path, expired token, and input validation — all three legs of the security stool."
|
||||
|
||||
**Score: 10/10 — exemplary security test coverage.**
|
||||
|
||||
---
|
||||
|
||||
### 👤 UX Designer — Confidence: 98%
|
||||
|
||||
**Testplan validation:**
|
||||
|
||||
| Check | Result | Notes |
|
||||
|-------|--------|-------|
|
||||
| Empty-state banner appears for new clubs | ✅ | T-80a |
|
||||
| Neutral gray instead of alarming red | ✅ | T-80b |
|
||||
| 4-step guide links functional | ✅ | T-80c |
|
||||
| Dismissal persisted (LocalStorage) | ✅ | T-80f |
|
||||
| Transition to normal after first report | ✅ | T-80e |
|
||||
|
||||
> "T-80 covers the full lifecycle: first visit → guided onboarding → dismissal → normal mode transition. This is exactly the user journey that prevents new-club churn. Only minor gap: no test for sidebar initial state (all expanded for new users), but this is CSS-level and not worth a dedicated E2E test."
|
||||
|
||||
**Score: 9.5/10 — one cosmetic gap (sidebar default state).**
|
||||
|
||||
---
|
||||
|
||||
### 💰 Business/Product Owner — Confidence: 99%
|
||||
|
||||
**Testplan validation:**
|
||||
|
||||
| Check | Result | Notes |
|
||||
|-------|--------|-------|
|
||||
| Hero feature tested under stress | ✅ | T-76: authority export with 500 members, no crash |
|
||||
| Security features don't create friction | ✅ | T-73-75: re-auth is quick (30s window), reason field is reasonable |
|
||||
| Rate limit UX considered | ⚠️ | T-69 checks 429 response but doesn't verify user-friendly message text |
|
||||
| Empty-state prevents churn | ✅ | T-80: onboarding guides new clubs through setup |
|
||||
|
||||
> "The testplan now validates that our premium features (authority export, compliance dashboard) work reliably at scale. This means we can confidently market 'inspection-proof in one click' without risking a production failure during an actual inspection. Revenue-protecting tests."
|
||||
|
||||
**Minor observation:** T-69 scenario c mentions checking for a "helpful German error message" but doesn't specify the exact text. During implementation, ensure it's something like "Bitte warte kurz — dein Bericht wird gerade erstellt" rather than a raw HTTP error.
|
||||
|
||||
**Score: 9.5/10.**
|
||||
|
||||
---
|
||||
|
||||
### ⚖️ Compliance Officer — Confidence: 98%
|
||||
|
||||
**Testplan validation:**
|
||||
|
||||
| Check | Result | Notes |
|
||||
|-------|--------|-------|
|
||||
| Art. 33 DSGVO notification tested | ✅ | T-77: all mandatory fields verified |
|
||||
| Art. 34 DSGVO data subject notification separate | ✅ | T-78: separate heading, plain language, distinct section |
|
||||
| 72h deadline explicitly tested | ✅ | T-79: prominent display, authority contact, discovery timestamp |
|
||||
| Reason field for accountability (Art. 5(2)) | ✅ | T-75: minimum 10 chars enforced |
|
||||
| Retention never auto-deletes (existing) | ✅ | T-54: confirmed |
|
||||
|
||||
**Traceability: DSGVO test coverage**
|
||||
|
||||
| DSGVO Article | Requirement | Test | Status |
|
||||
|---|---|---|---|
|
||||
| Art. 5(2) | Accountability — document processing reasons | T-75 | ✅ |
|
||||
| Art. 9 | Health data special protection | T-73 (re-auth gate) | ✅ |
|
||||
| Art. 17 | Right to deletion (with retention override) | T-54 | ✅ |
|
||||
| Art. 25 | Data protection by design | T-35 (minimization) | ✅ |
|
||||
| Art. 30 | VVT | T-39, T-40 | ✅ |
|
||||
| Art. 32 | TOM | T-41 | ✅ |
|
||||
| Art. 33 | Breach notification to authority | T-77, T-79 | ✅ |
|
||||
| Art. 34 | Breach notification to data subjects | T-78 | ✅ |
|
||||
| Art. 35 | DSFA | T-42 | ✅ |
|
||||
|
||||
> "With 9 DSGVO articles now explicitly tested, this is the most thorough privacy test coverage I've seen in a cannabis club software. The Art. 33/34 separation (T-77 vs T-78) is legally correct — authorities and data subjects need different information."
|
||||
|
||||
**Score: 10/10.**
|
||||
|
||||
---
|
||||
|
||||
## Scoring Matrix (v3)
|
||||
|
||||
| Expert | Precision | Correctness | Usability | Usefulness | Avg |
|
||||
|--------|-----------|-------------|-----------|------------|-----|
|
||||
| 🏛️ Domain Expert (Operator) | 9 | 10 | 10 | 10 | **9.75** |
|
||||
| 🔧 Architecture Expert | 10 | 10 | 10 | 10 | **10.00** |
|
||||
| 🛡️ Security & Privacy Expert | 10 | 10 | 10 | 10 | **10.00** |
|
||||
| 👤 UX Designer | 9.5 | 9.5 | 10 | 10 | **9.75** |
|
||||
| 💰 Business/Product Owner | 9.5 | 10 | 10 | 10 | **9.88** |
|
||||
| ⚖️ Compliance Officer | 10 | 10 | 10 | 10 | **10.00** |
|
||||
|
||||
**Overall Score: 9.90 / 10 (99.0%)**
|
||||
|
||||
---
|
||||
|
||||
## Panel Verdict (v3)
|
||||
|
||||
| Expert | Verdict | Confidence | v2 | Delta |
|
||||
|--------|---------|-----------|-----|-------|
|
||||
| 🏛️ Domain Expert (Operator) | ✅ APPROVED | 97% | 97% | ±0% |
|
||||
| 🔧 Architecture Expert | ✅ APPROVED | 99% | 98% | +1% |
|
||||
| 🛡️ Security & Privacy Expert | ✅ APPROVED | 99% | 98% | +1% |
|
||||
| 👤 UX Designer | ✅ APPROVED | 98% | 97% | +1% |
|
||||
| 💰 Business/Product Owner | ✅ APPROVED | 99% | 99% | ±0% |
|
||||
| ⚖️ Compliance Officer | ✅ APPROVED | 98% | 96% | +2% |
|
||||
|
||||
**Overall Panel Confidence: 98.3%** (v1: 95.5% → v2: 97.5% → v3: 98.3%)
|
||||
|
||||
---
|
||||
|
||||
## Confidence Progression
|
||||
|
||||
```
|
||||
v1 (plan only): 95.5% ████████████████████░░░░ 7 advisory items
|
||||
v2 (plan + fixes): 97.5% █████████████████████░░░ 6 minor items
|
||||
v3 (plan + tests): 98.3% █████████████████████░░░ 2 cosmetic items
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Remaining Items (cosmetic, non-blocking)
|
||||
|
||||
| # | Item | Expert | Priority |
|
||||
|---|------|--------|----------|
|
||||
| 1 | Sidebar initial state = expanded (no E2E test needed, CSS default) | 👤 UX | Trivial |
|
||||
| 2 | Rate limit 429 message should be user-friendly German text | 💰 Business | Low — implementation detail |
|
||||
|
||||
Both are implementation-time details requiring zero plan changes.
|
||||
|
||||
---
|
||||
|
||||
## Final Recommendation (v3)
|
||||
|
||||
### ✅ APPROVED — Plan v2 + Testplan v2 form a complete, verifiable implementation package.
|
||||
|
||||
**Test coverage validation:**
|
||||
- 80 test cases cover all 6 plan phases
|
||||
- Every v2 advisory item has at least one dedicated test
|
||||
- 12 critical tests identified (up from 7 in v1)
|
||||
- DSGVO coverage: 9 articles explicitly tested
|
||||
- Security features: 100% test traceability to plan requirements
|
||||
- Performance: heap-constrained integration test proves streaming works
|
||||
|
||||
**No plan revision needed. No testplan gaps. Proceed to implementation with full confidence.**
|
||||
@@ -0,0 +1,785 @@
|
||||
# Sprint 9 Implementation Plan — Berichtszentrale (Report Center)
|
||||
|
||||
**Date:** 2026-06-15
|
||||
**Author:** Patrick Plate / Lumen (Architect)
|
||||
**Status:** Draft v2 (incorporates panel review advisory items)
|
||||
**Basis:** cannamanage-sprint9-analysis.md
|
||||
**Sprint Goal:** Complete reporting & documentation module with authority-ready exports
|
||||
|
||||
---
|
||||
|
||||
## Implementation Phases
|
||||
|
||||
Sprint 9 is organized into 6 phases, building from backend infrastructure to frontend polish.
|
||||
|
||||
```mermaid
|
||||
graph LR
|
||||
P1[Phase 1: Data Model + Backend Services] --> P2[Phase 2: Report Generators - Financial]
|
||||
P2 --> P3[Phase 3: Report Generators - KCanG Compliance]
|
||||
P3 --> P4[Phase 4: DSGVO Templates + Verein Reports]
|
||||
P4 --> P5[Phase 5: Frontend - Berichtszentrale + Sidebar Reorg]
|
||||
P5 --> P6[Phase 6: Compliance Dashboard + Retention + Integration Testing]
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Phase 1: Data Model & Backend Infrastructure
|
||||
|
||||
### Step 1.1 — Database Migrations (V23-V28)
|
||||
|
||||
**Files:**
|
||||
- `cannamanage-api/src/main/resources/db/migration/V23__destruction_records.sql`
|
||||
- `cannamanage-api/src/main/resources/db/migration/V24__transport_records.sql`
|
||||
- `cannamanage-api/src/main/resources/db/migration/V25__propagation_sources.sql`
|
||||
- `cannamanage-api/src/main/resources/db/migration/V26__prevention_activities.sql`
|
||||
- `cannamanage-api/src/main/resources/db/migration/V27__generated_reports.sql`
|
||||
- `cannamanage-api/src/main/resources/db/migration/V28__compliance_deadlines.sql`
|
||||
- `cannamanage-api/src/main/resources/db/migration/V29__distribution_thc_cbd.sql`
|
||||
|
||||
**V29 specifically:**
|
||||
```sql
|
||||
ALTER TABLE distributions ADD COLUMN IF NOT EXISTS thc_percentage NUMERIC(4,2);
|
||||
ALTER TABLE distributions ADD COLUMN IF NOT EXISTS cbd_percentage NUMERIC(4,2);
|
||||
ALTER TABLE distributions ADD COLUMN IF NOT EXISTS strain_name VARCHAR(200);
|
||||
```
|
||||
|
||||
### Step 1.2 — JPA Entities
|
||||
|
||||
**New entities:**
|
||||
- `de.cannamanage.domain.entity.DestructionRecord`
|
||||
- `de.cannamanage.domain.entity.TransportRecord`
|
||||
- `de.cannamanage.domain.entity.PropagationSource`
|
||||
- `de.cannamanage.domain.entity.PreventionActivity`
|
||||
- `de.cannamanage.domain.entity.GeneratedReport`
|
||||
- `de.cannamanage.domain.entity.ComplianceDeadline`
|
||||
|
||||
**Modified entities:**
|
||||
- `Distribution` — add `thcPercentage`, `cbdPercentage`, `strainName` fields
|
||||
|
||||
### Step 1.3 — Repositories
|
||||
|
||||
- `DestructionRecordRepository`
|
||||
- `TransportRecordRepository`
|
||||
- `PropagationSourceRepository`
|
||||
- `PreventionActivityRepository`
|
||||
- `GeneratedReportRepository`
|
||||
- `ComplianceDeadlineRepository`
|
||||
|
||||
Each with standard tenant-scoped queries + date range filters.
|
||||
|
||||
### Step 1.4 — Base Report Service Infrastructure
|
||||
|
||||
**New file:** `cannamanage-service/src/main/java/de/cannamanage/service/report/ReportGenerator.java`
|
||||
|
||||
```java
|
||||
/**
|
||||
* Base interface for all report generators.
|
||||
* Standardizes the contract across 18+ report types.
|
||||
* Each implementation handles one ReportType.
|
||||
*/
|
||||
public interface ReportGenerator<T extends ReportParameters> {
|
||||
ReportType getType();
|
||||
byte[] generatePdf(T params);
|
||||
default byte[] generateCsv(T params) {
|
||||
throw new UnsupportedOperationException("CSV not supported for " + getType());
|
||||
}
|
||||
default byte[] generateJson(T params) {
|
||||
throw new UnsupportedOperationException("JSON not supported for " + getType());
|
||||
}
|
||||
Set<ExportFormat> supportedFormats();
|
||||
}
|
||||
```
|
||||
|
||||
**New file:** `cannamanage-service/src/main/java/de/cannamanage/service/ReportGeneratorService.java`
|
||||
|
||||
```java
|
||||
@Service
|
||||
public class ReportGeneratorService {
|
||||
// Central orchestrator — delegates to typed ReportGenerator implementations
|
||||
// Auto-discovers all ReportGenerator beans via Spring injection
|
||||
// Handles: format dispatch, audit logging, document storage
|
||||
// Rate-limited: max 5 generations per minute per tenant (via @RateLimiter)
|
||||
|
||||
private final Map<ReportType, ReportGenerator<?>> generators;
|
||||
|
||||
public ReportGeneratorService(List<ReportGenerator<?>> allGenerators) {
|
||||
this.generators = allGenerators.stream()
|
||||
.collect(Collectors.toMap(ReportGenerator::getType, Function.identity()));
|
||||
}
|
||||
|
||||
@RateLimiter(name = "reportGeneration", fallbackMethod = "rateLimitFallback")
|
||||
public GeneratedReport generateReport(ReportType type, ReportParameters params);
|
||||
public byte[] exportAsPdf(ReportType type, ReportParameters params);
|
||||
public byte[] exportAsCsv(ReportType type, ReportParameters params);
|
||||
public byte[] exportAsJson(ReportType type, ReportParameters params);
|
||||
|
||||
private GeneratedReport rateLimitFallback(ReportType type, ReportParameters params, Exception ex) {
|
||||
throw new TooManyRequestsException("Report generation rate limit exceeded. Max 5 per minute.");
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
> **Advisory implementation (v2):** The `ReportGenerator<T>` interface provides a standardized contract across all 18+ report generators. This enables consistent error handling, format negotiation, and future plugin extensibility without requiring every generator to implement all formats. Rate limiting (max 5/min/tenant) is enforced at the orchestrator level via Resilience4j `@RateLimiter`.
|
||||
|
||||
**New file:** `cannamanage-service/src/main/java/de/cannamanage/service/RetentionService.java`
|
||||
|
||||
```java
|
||||
@Service
|
||||
public class RetentionService {
|
||||
// Scheduled daily: checks retention periods
|
||||
// Flags records approaching end-of-retention
|
||||
// Never auto-deletes — requires admin confirmation
|
||||
|
||||
@Scheduled(cron = "0 0 2 * * *") // 2 AM daily
|
||||
public void checkRetentionPeriods();
|
||||
public List<RetentionAlert> getPendingAlerts(UUID tenantId);
|
||||
}
|
||||
```
|
||||
|
||||
### Step 1.5 — REST Controllers for New Entities
|
||||
|
||||
- `DestructionRecordController` — CRUD + PDF generation
|
||||
- `TransportRecordController` — CRUD + certificate generation
|
||||
- `PropagationSourceController` — CRUD
|
||||
- `PreventionActivityController` — CRUD
|
||||
- `ComplianceDeadlineController` — CRUD + status updates
|
||||
- `ReportController` (enhanced) — all report generation endpoints
|
||||
|
||||
### Step 1.6 — Enums
|
||||
|
||||
**New enums in `cannamanage-domain`:**
|
||||
- `ReportType` — `ANNUAL_AUTHORITY`, `DISTRIBUTION_LOG`, `STOCK_INVENTORY`, `DESTRUCTION_PROTOCOL`, `CULTIVATION_REPORT`, `TRANSPORT_CERTIFICATE`, `FULL_AUTHORITY_EXPORT`, `EUR`, `ANNUAL_FINANCIAL`, `KASSENBUCH_EXPORT`, `FEE_CONFIRMATION`, `MEMBER_LIST_REGISTRY`, `BOARD_CHANGE_NOTICE`, `ANNUAL_BOARD_REPORT`, `VVT`, `TOM`, `DSFA`, `DELETION_CONCEPT`, `BREACH_NOTIFICATION`
|
||||
- `DestructionMethod` — `INCINERATION`, `COMPOSTING`, `CHEMICAL`, `OTHER`
|
||||
- `TransportStatus` — `PLANNED`, `AUTHORITY_NOTIFIED`, `IN_TRANSIT`, `COMPLETED`
|
||||
- `ComplianceArea` — `KCANG`, `FINANCE`, `DSGVO`, `VEREIN`
|
||||
- `ComplianceStatus` — `GREEN`, `YELLOW`, `RED`
|
||||
- `RetentionCategory` — `KCANG_5Y`, `AO_6Y`, `AO_8Y`, `AO_10Y`, `INDEFINITE`
|
||||
|
||||
---
|
||||
|
||||
## Phase 2: Financial Report Generators
|
||||
|
||||
### Step 2.1 — EÜR (Einnahmen-Überschuss-Rechnung) Generator
|
||||
|
||||
**File:** `cannamanage-service/src/main/java/de/cannamanage/service/report/EurReportGenerator.java`
|
||||
|
||||
Logic:
|
||||
1. Query all `financial_transactions` for the selected calendar year
|
||||
2. Group into Einnahmen (INCOME transactions) and Ausgaben (EXPENSE transactions)
|
||||
3. Sub-group by `expense_category` / income source
|
||||
4. Calculate: Total income, total expenses, Überschuss/Fehlbetrag
|
||||
5. Include: Opening balance (Jan 1) and closing balance (Dec 31)
|
||||
6. Generate PDF in standard EÜR format (Anlage EÜR compatible structure)
|
||||
7. Generate CSV with semicolons, ISO-8859-1, German decimal format
|
||||
|
||||
**PDF Structure:**
|
||||
```
|
||||
EINNAHMEN-ÜBERSCHUSS-RECHNUNG
|
||||
Kalenderjahr: 2025
|
||||
Verein: Grüner Daumen e.V.
|
||||
|
||||
I. EINNAHMEN
|
||||
Mitgliedsbeiträge ................ 54.000,00 €
|
||||
Sonstige Einnahmen ............... 2.400,00 €
|
||||
─────────────────────────────────────────────
|
||||
Summe Einnahmen .................. 56.400,00 €
|
||||
|
||||
II. AUSGABEN
|
||||
Miete/Pacht ...................... 18.000,00 €
|
||||
Strom/Energie .................... 4.800,00 €
|
||||
Cannabis-Anbaumaterial ........... 12.000,00 €
|
||||
Verwaltung ....................... 3.600,00 €
|
||||
Versicherungen ................... 2.400,00 €
|
||||
Sonstige Ausgaben ................ 5.200,00 €
|
||||
─────────────────────────────────────────────
|
||||
Summe Ausgaben ................... 46.000,00 €
|
||||
|
||||
III. ERGEBNIS
|
||||
Überschuss ....................... 10.400,00 €
|
||||
```
|
||||
|
||||
### Step 2.2 — Enhanced Kassenbuch Export
|
||||
|
||||
**File:** `cannamanage-service/src/main/java/de/cannamanage/service/report/KassenbuchExportGenerator.java`
|
||||
|
||||
Enhance existing Kassenbuch with:
|
||||
- DATEV-compatible CSV format (optional export)
|
||||
- GoBD-compliant: immutable entries, sequential numbering, no gaps
|
||||
- Period selection (monthly, quarterly, annual)
|
||||
- Running balance per entry
|
||||
- Category totals at bottom
|
||||
|
||||
### Step 2.3 — Beitragsbescheinigung (Fee Confirmation per Member)
|
||||
|
||||
**File:** `cannamanage-service/src/main/java/de/cannamanage/service/report/FeeConfirmationGenerator.java`
|
||||
|
||||
- Per-member annual PDF: confirms total fees paid in calendar year
|
||||
- Letterhead with club name, address, Vereinsregisternummer
|
||||
- Suitable for member's tax records (Sonderausgaben)
|
||||
- Batch generation: one click → all active members get a PDF
|
||||
|
||||
### Step 2.4 — Jahresabschluss Enhancement
|
||||
|
||||
Enhance existing Sprint 8 annual report with:
|
||||
- Comparison to previous year (if data exists)
|
||||
- Category-wise breakdown with percentages
|
||||
- Chart data (for frontend visualization)
|
||||
- Kassenprüfer-ready format (signature lines)
|
||||
|
||||
---
|
||||
|
||||
## Phase 3: KCanG Compliance Report Generators
|
||||
|
||||
### Step 3.1 — Annual Authority Report (§26 Abs. 3 KCanG)
|
||||
|
||||
**File:** `cannamanage-service/src/main/java/de/cannamanage/service/report/AnnualAuthorityReportGenerator.java`
|
||||
|
||||
**THE most important report.** Due January 31 each year.
|
||||
|
||||
Logic:
|
||||
1. Query all harvests (from grow module) in calendar year → sum by strain + THC/CBD
|
||||
2. Query all distributions in calendar year → sum by strain + THC/CBD
|
||||
3. Query all destruction records in calendar year → sum by strain + THC/CBD
|
||||
4. Query stock snapshot as of Dec 31 → by strain + THC/CBD
|
||||
5. Validate: cultivated - distributed - destroyed ≈ stock change (flag discrepancies)
|
||||
6. Format into authority-mandated structure
|
||||
|
||||
**Output format (PDF + JSON):**
|
||||
```json
|
||||
{
|
||||
"anbauvereinigung": { "name": "...", "erlaubnisnummer": "...", "anschrift": "..." },
|
||||
"berichtszeitraum": { "von": "2025-01-01", "bis": "2025-12-31" },
|
||||
"angebaute_mengen": [
|
||||
{ "sorte": "Amnesia Haze", "menge_gramm": 5000, "thc_prozent": 18.5, "cbd_prozent": 0.8 }
|
||||
],
|
||||
"weitergegebene_mengen": [...],
|
||||
"vernichtete_mengen": [...],
|
||||
"bestand_jahresende": [...]
|
||||
}
|
||||
```
|
||||
|
||||
### Step 3.2 — Distribution Log (§26 Abs. 1 Nr. 5)
|
||||
|
||||
**File:** `cannamanage-service/src/main/java/de/cannamanage/service/report/DistributionLogGenerator.java`
|
||||
|
||||
- Date-range selectable log of all distributions
|
||||
- Per entry: Datum, Mitglied (Name, Vorname, Geburtsjahr), Menge (g), THC%, Sorte
|
||||
- Summary: total grams, unique members, average per member
|
||||
- Flags any quota violations (>25g/day, >50g/month, >30g/month for 18-21, >10% THC for 18-21)
|
||||
- PDF + CSV export
|
||||
|
||||
### Step 3.3 — Stock Inventory Report (§26 Abs. 1 Nr. 2)
|
||||
|
||||
**File:** `cannamanage-service/src/main/java/de/cannamanage/service/report/StockInventoryReportGenerator.java`
|
||||
|
||||
- Point-in-time snapshot of all cannabis + propagation material on premises
|
||||
- By strain: grams available, THC%, CBD%, harvest date
|
||||
- Propagation material: count by type (seeds, clones, cuttings)
|
||||
- Includes stock movements for selected period (in/out/destroyed)
|
||||
|
||||
### Step 3.4 — Destruction Protocol (§26 Abs. 1 Nr. 4)
|
||||
|
||||
**File:** `cannamanage-service/src/main/java/de/cannamanage/service/report/DestructionProtocolGenerator.java`
|
||||
|
||||
- Official Vernichtungsprotokoll PDF
|
||||
- Per destruction event: date, batch, strain, grams, method, reason, witness
|
||||
- Dual signature lines (destroying person + witness)
|
||||
- Sequential protocol number
|
||||
- Cumulative annual destruction total
|
||||
|
||||
### Step 3.5 — Cultivation Report (§26 Abs. 1 Nr. 3)
|
||||
|
||||
**File:** `cannamanage-service/src/main/java/de/cannamanage/service/report/CultivationReportGenerator.java`
|
||||
|
||||
- Harvest data from grow module
|
||||
- Per harvest: strain, grams harvested, THC%, CBD%, harvest date, grow cycle ID
|
||||
- Annual total by strain
|
||||
- Growth cycle overview (planted → harvested → distributed/destroyed)
|
||||
|
||||
### Step 3.6 — Transport Certificate (§22 Abs. 4 KCanG)
|
||||
|
||||
**File:** `cannamanage-service/src/main/java/de/cannamanage/service/report/TransportCertificateGenerator.java`
|
||||
|
||||
Per §22(4), the certificate must contain:
|
||||
1. Name und Anschrift des Sitzes der Anbauvereinigung
|
||||
2. Datum des Transports
|
||||
3. Start- und Zieladresse des Transports
|
||||
4. Mengen in Gramm und Sorten des transportierten Cannabis
|
||||
5. Name und Kontaktdaten der zuständigen Behörde
|
||||
|
||||
Generate as a single-page PDF, suitable for printing and carrying during transport.
|
||||
|
||||
### Step 3.7 — Full Authority Export (§26 Abs. 2 + §27)
|
||||
|
||||
**File:** `cannamanage-service/src/main/java/de/cannamanage/service/report/FullAuthorityExportGenerator.java`
|
||||
|
||||
The "panic button" — generates EVERYTHING the authority needs in one package:
|
||||
1. All distribution records (complete §26(1) Nr. 5 data)
|
||||
2. Stock movement history
|
||||
3. All destruction records
|
||||
4. All cultivation records
|
||||
5. All transport records
|
||||
6. Propagation material sources
|
||||
7. Member register (name + birth year only, per DSGVO minimization)
|
||||
|
||||
**Security:** Requires re-authentication (password re-entry) before generation. This is a high-sensitivity operation containing all member distribution histories (Art. 9 DSGVO health data). The confirmation dialog includes a mandatory reason field for the audit trail.
|
||||
|
||||
> **Advisory implementation (v2):** Re-authentication gate added per Security Expert recommendation. The endpoint requires a fresh authentication token (max 30 seconds old) obtained via `POST /api/auth/reconfirm` before the export can proceed.
|
||||
|
||||
**Output:** ZIP file — **streamed** (not buffered in memory):
|
||||
- Uses `StreamingResponseBody` to write ZIP entries directly to the HTTP response
|
||||
- For clubs with 5+ years and 500 members, exports can reach 50MB+
|
||||
- Streaming avoids `OutOfMemoryError` on the server
|
||||
|
||||
> **Advisory implementation (v2):** Streaming ZIP generation per Architecture Expert recommendation. Uses `ZipOutputStream` wrapping `ServletOutputStream` directly — entries are written sequentially without buffering the entire archive in heap memory.
|
||||
|
||||
**ZIP contents:**
|
||||
- `README.txt` — explains contents and legal basis
|
||||
- `distributions.json` + `distributions.csv`
|
||||
- `stock.json`
|
||||
- `destructions.json`
|
||||
- `cultivation.json`
|
||||
- `transports.json`
|
||||
- `members.json` (anonymized: name + birth year only)
|
||||
- `summary.pdf` — human-readable overview
|
||||
|
||||
### Step 3.8 — Distribution Info Sheet (§21 Abs. 2 KCanG)
|
||||
|
||||
**File:** `cannamanage-service/src/main/java/de/cannamanage/service/report/DistributionInfoSheetGenerator.java`
|
||||
|
||||
Printable info sheet that must be handed out at every distribution:
|
||||
- Weight in grams
|
||||
- Harvest date
|
||||
- Best-before date
|
||||
- Strain name
|
||||
- Average THC%
|
||||
- Average CBD%
|
||||
- Health warnings (§21(3) — standardized text)
|
||||
|
||||
Generate as small PDF (A5 or 1/3 A4) — can be batch-printed.
|
||||
|
||||
---
|
||||
|
||||
## Phase 4: DSGVO Templates & Verein Administrative Reports
|
||||
|
||||
### Step 4.1 — Verarbeitungsverzeichnis (VVT) Generator
|
||||
|
||||
**File:** `cannamanage-service/src/main/java/de/cannamanage/service/report/VvtGenerator.java`
|
||||
|
||||
Pre-filled template for Anbauvereinigungen:
|
||||
- 8 standard processing activities pre-defined (member mgmt, distributions, finance, video, etc.)
|
||||
- Club-specific data filled in (name, address, DPO name if applicable)
|
||||
- Output: PDF (A4, multi-page table format per Art. 30 requirements)
|
||||
|
||||
### Step 4.2 — TOM (Technisch-Organisatorische Maßnahmen) Document
|
||||
|
||||
**File:** `cannamanage-service/src/main/java/de/cannamanage/service/report/TomGenerator.java`
|
||||
|
||||
Checklist-style PDF with:
|
||||
- Zutrittskontrolle (physical access)
|
||||
- Zugangskontrolle (system access — passwords, 2FA)
|
||||
- Zugriffskontrolle (data access — roles, permissions)
|
||||
- Trennungskontrolle (purpose limitation)
|
||||
- Pseudonymisierung/Verschlüsselung
|
||||
- Verfügbarkeit und Belastbarkeit (backups, disaster recovery)
|
||||
- Verfahren zur regelmäßigen Überprüfung
|
||||
|
||||
Pre-filled with what CannaManage provides (encryption, role-based access, audit log, etc.).
|
||||
|
||||
### Step 4.3 — DSFA (Datenschutz-Folgenabschätzung) Template
|
||||
|
||||
**File:** `cannamanage-service/src/main/java/de/cannamanage/service/report/DsfaGenerator.java`
|
||||
|
||||
Required because cannabis distribution data = health-related data (Art. 9 DSGVO).
|
||||
|
||||
Structure:
|
||||
1. Beschreibung der Verarbeitung (automated from VVT)
|
||||
2. Bewertung der Notwendigkeit (pre-filled: §26 KCanG mandates the processing)
|
||||
3. Risikobewertung (template with common risks pre-identified)
|
||||
4. Abhilfemaßnahmen (auto-filled from TOM document)
|
||||
|
||||
### Step 4.4 — Löschkonzept (Deletion Concept)
|
||||
|
||||
**File:** `cannamanage-service/src/main/java/de/cannamanage/service/report/DeletionConceptGenerator.java`
|
||||
|
||||
Documents when each category of data is deleted:
|
||||
- Maps data categories → retention periods → deletion triggers
|
||||
- References §26(2) KCanG (5 years), §147 AO (6/8/10 years)
|
||||
- Describes the automated retention checking (RetentionService)
|
||||
- Lists manual review process
|
||||
|
||||
### Step 4.4b — Breach Notification Template (Art. 33/34 DSGVO) — **P1**
|
||||
|
||||
**File:** `cannamanage-service/src/main/java/de/cannamanage/service/report/BreachNotificationGenerator.java`
|
||||
|
||||
> **Advisory implementation (v2):** Elevated from P2 to P1 per Risk/Compliance Expert recommendation. Cannabis distribution data is Art. 9 DSGVO health data — a breach could cause significant harm (employment discrimination, social stigma). Having the template ready before an incident occurs is critical.
|
||||
|
||||
Pre-filled breach notification PDF with:
|
||||
- Art. 33 fields: nature of breach, categories of data subjects affected, approximate number, DPO contact, likely consequences, measures taken
|
||||
- Art. 34 fields: communication to affected data subjects (plain language)
|
||||
- Auto-fills club details, DPO info, and data category descriptions from VVT
|
||||
- Checklist: 72-hour notification deadline reminder, authority contact details
|
||||
- Editable fields for incident-specific details (what happened, when discovered)
|
||||
|
||||
**Priority justification:** A cannabis club experiencing a data breach has 72 hours to notify the Landesdatenschutzbehörde. Without a pre-prepared template, clubs will scramble under pressure and risk non-compliance with Art. 33(1) DSGVO. Given the sensitivity of cannabis health data, this is P1.
|
||||
|
||||
### Step 4.5 — Mitgliederliste für Vereinsregister
|
||||
|
||||
**File:** `cannamanage-service/src/main/java/de/cannamanage/service/report/MemberListRegistryGenerator.java`
|
||||
|
||||
Formatted per BGB requirements for Vereinsregister:
|
||||
- Minimal data: Name, Vorname, Anschrift, Eintrittsdatum
|
||||
- Sorted alphabetically
|
||||
- Includes total count and date of generation
|
||||
- Footer: "Erstellt gemäß §67 BGB"
|
||||
|
||||
### Step 4.6 — Vorstandsänderung-Meldung (Board Change Template)
|
||||
|
||||
**File:** `cannamanage-service/src/main/java/de/cannamanage/service/report/BoardChangeNoticeGenerator.java`
|
||||
|
||||
Template for notifying Registergericht of board changes:
|
||||
- Old board composition
|
||||
- New board composition (from board_members table)
|
||||
- Date of election (from assembly records)
|
||||
- Reference to MV protocol
|
||||
- Signature line for new Vorstand
|
||||
|
||||
### Step 4.7 — Jahresbericht des Vorstands (Annual Board Report)
|
||||
|
||||
**File:** `cannamanage-service/src/main/java/de/cannamanage/service/report/AnnualBoardReportGenerator.java`
|
||||
|
||||
Combines multiple data sources into a report the Vorstand presents to members at the annual MV:
|
||||
- Member statistics (new, left, total)
|
||||
- Financial summary (from EÜR)
|
||||
- Compliance status (KCanG obligations met)
|
||||
- Key activities (from prevention log, assemblies held, etc.)
|
||||
- Outlook/plans (editable text section)
|
||||
|
||||
---
|
||||
|
||||
## Phase 5: Frontend — Berichtszentrale & Sidebar Reorganization
|
||||
|
||||
### Step 5.1 — Sidebar Reorganization
|
||||
|
||||
**Modified file:** `cannamanage-frontend/src/data/navigations.ts`
|
||||
|
||||
Replace flat list with grouped, collapsible sections:
|
||||
|
||||
```typescript
|
||||
export const navigationsData: NavigationType[] = [
|
||||
{
|
||||
title: "Betrieb",
|
||||
icon: "Leaf",
|
||||
items: [
|
||||
{ title: "Dashboard", href: "/dashboard", iconName: "LayoutDashboard" },
|
||||
{ title: "Mitglieder", href: "/members", iconName: "Users" },
|
||||
{ title: "Ausgabe", href: "/distributions", iconName: "Leaf" },
|
||||
{ title: "Lager", href: "/stock", iconName: "Package" },
|
||||
{ title: "Anbau", href: "/grow", iconName: "Sprout" },
|
||||
],
|
||||
},
|
||||
{
|
||||
title: "Kommunikation",
|
||||
icon: "MessageCircle",
|
||||
items: [
|
||||
{ title: "Schwarzes Brett", href: "/info-board", iconName: "Megaphone" },
|
||||
{ title: "Kalender", href: "/calendar", iconName: "Calendar" },
|
||||
{ title: "Forum", href: "/forum", iconName: "MessageSquare" },
|
||||
],
|
||||
},
|
||||
{
|
||||
title: "Verwaltung",
|
||||
icon: "Building",
|
||||
items: [
|
||||
{ title: "Finanzen", href: "/finance", iconName: "Wallet" },
|
||||
{ title: "Versammlungen", href: "/assemblies", iconName: "Gavel" },
|
||||
{ title: "Dokumente", href: "/documents", iconName: "FileArchive" },
|
||||
{ title: "Vorstand", href: "/board", iconName: "Shield" },
|
||||
{ title: "Personal", href: "/settings/staff", iconName: "UserCog" },
|
||||
],
|
||||
},
|
||||
{
|
||||
title: "Compliance",
|
||||
icon: "ShieldCheck",
|
||||
items: [
|
||||
{ title: "Berichtszentrale", href: "/reports", iconName: "FileBarChart" },
|
||||
{ title: "Protokoll", href: "/audit-log", iconName: "ScrollText" },
|
||||
{ title: "Einstellungen", href: "/settings", iconName: "Settings" },
|
||||
],
|
||||
},
|
||||
]
|
||||
```
|
||||
|
||||
**Modified component:** Sidebar must support collapsible groups with section headers and icons.
|
||||
|
||||
### Step 5.2 — Berichtszentrale Page (Report Center)
|
||||
|
||||
**New page:** `cannamanage-frontend/src/app/(app)/reports/page.tsx` (replaces existing basic reports page)
|
||||
|
||||
Layout:
|
||||
- Top: Compliance status cards (4 cards: KCanG 🟢/🟡/🔴, Finanzen, DSGVO, Verein)
|
||||
- Middle: Upcoming deadlines list (next 90 days)
|
||||
- Bottom: Report categories as card grid with accordion sub-items
|
||||
|
||||
**Empty-state handling (new clubs):**
|
||||
|
||||
> **Advisory implementation (v2):** Per UX Expert recommendation — when a club first accesses the Berichtszentrale with no reports generated yet, all compliance indicators will be 🔴 RED. To prevent this from being demoralizing, display a "Compliance Setup" guided callout instead of raw red indicators.
|
||||
|
||||
When `generated_reports` is empty for this tenant:
|
||||
- Show a "Erste Schritte" banner with 4-step setup guide:
|
||||
1. "VVT erstellen" → links to DSGVO tab
|
||||
2. "Jahresbericht konfigurieren" → links to KCanG tab
|
||||
3. "Kassenbuch einrichten" → links to Finance tab
|
||||
4. "Fristen prüfen" → links to deadlines view
|
||||
- Compliance cards show "Einrichtung erforderlich" (setup required) in neutral gray instead of alarming red
|
||||
- After first report is generated in any category, switch to normal traffic-light indicators
|
||||
- Dismissible: admin can click "Verstanden, Dashboard anzeigen" to skip directly to normal view
|
||||
|
||||
Each report card shows:
|
||||
- Report name
|
||||
- Last generated date (or "Noch nie erstellt")
|
||||
- Legal basis reference
|
||||
- [Generate PDF] [Generate CSV] [Generate JSON] buttons (as applicable)
|
||||
- [View History] link
|
||||
|
||||
### Step 5.3 — Report Category Pages
|
||||
|
||||
**New pages:**
|
||||
- `/reports/finance` — Financial reports tab
|
||||
- `/reports/compliance` — KCanG reports tab
|
||||
- `/reports/verein` — Administrative reports tab
|
||||
- `/reports/dsgvo` — Data protection reports tab
|
||||
|
||||
Each with:
|
||||
- List of available reports in that category
|
||||
- Generation form (date range, parameters)
|
||||
- Preview before download
|
||||
- Download history table
|
||||
|
||||
### Step 5.4 — Destruction Record Management
|
||||
|
||||
**New pages:**
|
||||
- `/stock/destructions` — List all destruction records
|
||||
- `/stock/destructions/new` — Record a new destruction event
|
||||
|
||||
Form fields: Batch selection, grams destroyed, propagation count, method, reason, witness name, date.
|
||||
|
||||
### Step 5.5 — Transport Record Management
|
||||
|
||||
**New pages:**
|
||||
- `/transports` (or nested under operations)
|
||||
- `/transports/new` — Plan a new transport (with authority notification reminder)
|
||||
- `/transports/[id]/certificate` — View/download transport certificate
|
||||
|
||||
### Step 5.6 — Prevention Activity Log
|
||||
|
||||
**New page:**
|
||||
- `/board/prevention` — Prevention officer activity log
|
||||
|
||||
List of activities + "Add Activity" form. Shows training certificate info.
|
||||
|
||||
### Step 5.7 — Report Services (Frontend)
|
||||
|
||||
**New file:** `cannamanage-frontend/src/services/report-center.ts`
|
||||
|
||||
```typescript
|
||||
// Report generation triggers
|
||||
export function useGenerateReport(type: ReportType, params: ReportParams)
|
||||
export function useReportHistory(type?: ReportType)
|
||||
export function useComplianceStatus()
|
||||
export function useUpcomingDeadlines()
|
||||
export function useDestructionRecords()
|
||||
export function useTransportRecords()
|
||||
export function usePreventionActivities()
|
||||
```
|
||||
|
||||
### Step 5.8 — i18n Additions
|
||||
|
||||
**Modified files:**
|
||||
- `cannamanage-frontend/messages/de.json` — all new report names, categories, form labels
|
||||
- `cannamanage-frontend/messages/en.json` — English translations
|
||||
|
||||
---
|
||||
|
||||
## Phase 6: Compliance Dashboard + Retention + Integration
|
||||
|
||||
### Step 6.1 — Compliance Status Service (Backend)
|
||||
|
||||
**File:** `cannamanage-service/src/main/java/de/cannamanage/service/ComplianceDashboardService.java`
|
||||
|
||||
Calculates real-time compliance status per area:
|
||||
|
||||
```java
|
||||
public ComplianceStatus getOverallStatus(UUID tenantId) {
|
||||
// KCanG: Check if annual report was submitted, distribution records complete
|
||||
// Finance: Check if EÜR generated for last fiscal year
|
||||
// DSGVO: Check if VVT exists and is recent
|
||||
// Verein: Check board term expiry, next MV date
|
||||
|
||||
// Yellow = deadline within 30 days or data gaps
|
||||
// Red = deadline passed or critical gaps
|
||||
// Green = everything current
|
||||
}
|
||||
```
|
||||
|
||||
### Step 6.2 — Deadline Seeding + Scheduler
|
||||
|
||||
**File:** `cannamanage-service/src/main/java/de/cannamanage/service/ComplianceDeadlineScheduler.java`
|
||||
|
||||
On tenant creation (or first report center access):
|
||||
- Seed standard annual deadlines (Jan 31 authority report, MV, EÜR)
|
||||
- Daily scheduler checks for approaching deadlines → creates notifications
|
||||
- Auto-rolls annual deadlines to next year after completion
|
||||
|
||||
### Step 6.3 — Retention Service Implementation
|
||||
|
||||
Implements the daily retention check:
|
||||
- Queries all data categories
|
||||
- Compares creation date against retention period rules
|
||||
- Creates admin notification when data approaches end-of-retention
|
||||
- Provides "Löschprotokoll" (deletion log) export
|
||||
|
||||
### Step 6.4 — API Endpoint Summary
|
||||
|
||||
New REST endpoints:
|
||||
|
||||
```
|
||||
# Destruction Records
|
||||
POST /api/destructions
|
||||
GET /api/destructions
|
||||
GET /api/destructions/{id}
|
||||
GET /api/destructions/{id}/pdf
|
||||
|
||||
# Transport Records
|
||||
POST /api/transports
|
||||
GET /api/transports
|
||||
GET /api/transports/{id}
|
||||
GET /api/transports/{id}/certificate/pdf
|
||||
POST /api/transports/{id}/notify-authority
|
||||
|
||||
# Propagation Sources
|
||||
POST /api/propagation-sources
|
||||
GET /api/propagation-sources
|
||||
DELETE /api/propagation-sources/{id}
|
||||
|
||||
# Prevention Activities
|
||||
POST /api/prevention-activities
|
||||
GET /api/prevention-activities
|
||||
DELETE /api/prevention-activities/{id}
|
||||
|
||||
# Report Center
|
||||
POST /api/reports/generate (body: {type, params})
|
||||
GET /api/reports/history
|
||||
GET /api/reports/{id}/download
|
||||
|
||||
# Specific Report Generators
|
||||
GET /api/reports/eur/pdf?year=2025
|
||||
GET /api/reports/eur/csv?year=2025
|
||||
GET /api/reports/authority-annual/pdf?year=2025
|
||||
GET /api/reports/authority-annual/json?year=2025
|
||||
GET /api/reports/distribution-log/pdf?from=&to=
|
||||
GET /api/reports/distribution-log/csv?from=&to=
|
||||
GET /api/reports/stock-inventory/pdf?date=
|
||||
GET /api/reports/destruction-protocol/pdf?from=&to=
|
||||
GET /api/reports/cultivation/pdf?year=
|
||||
GET /api/reports/transport-certificate/{id}/pdf
|
||||
GET /api/reports/authority-export/zip?from=&to=
|
||||
GET /api/reports/member-list-registry/pdf
|
||||
GET /api/reports/board-change-notice/pdf
|
||||
GET /api/reports/annual-board-report/pdf?year=
|
||||
GET /api/reports/vvt/pdf
|
||||
GET /api/reports/tom/pdf
|
||||
GET /api/reports/dsfa/pdf
|
||||
GET /api/reports/deletion-concept/pdf
|
||||
GET /api/reports/fee-confirmation/pdf?memberId=&year=
|
||||
GET /api/reports/fee-confirmation/batch/zip?year=
|
||||
GET /api/reports/info-sheet/{distributionId}/pdf
|
||||
|
||||
# Compliance Dashboard
|
||||
GET /api/compliance/status
|
||||
GET /api/compliance/deadlines
|
||||
PUT /api/compliance/deadlines/{id}/complete
|
||||
```
|
||||
|
||||
### Step 6.5 — Integration Testing
|
||||
|
||||
- Test each report generator with realistic data
|
||||
- Verify PDF output quality (correct German formatting, legal references)
|
||||
- Verify CSV encoding (ISO-8859-1, semicolons, decimal comma)
|
||||
- Verify JSON schema for authority export
|
||||
- Test retention service with date manipulation
|
||||
- Test compliance status calculation edge cases
|
||||
- E2E: Generate report from frontend → download → verify contents
|
||||
|
||||
### Step 6.6 — Seed Data Enhancement
|
||||
|
||||
Extend existing seed data with:
|
||||
- Sample destruction records
|
||||
- Sample transport records
|
||||
- Sample propagation sources
|
||||
- Prevention activities
|
||||
- Pre-seeded compliance deadlines for demo
|
||||
- THC/CBD percentages on existing distribution seeds
|
||||
|
||||
---
|
||||
|
||||
## Technical Decisions
|
||||
|
||||
| Decision | Choice | Rationale |
|
||||
|----------|--------|-----------|
|
||||
| PDF library | Reuse existing OpenPDF | Proven in Sprint 5+8, already in dependencies |
|
||||
| CSV encoding | ISO-8859-1 + semicolons | German DATEV standard, accountants expect this |
|
||||
| CSV injection prevention | Prefix dangerous cells with single quote | Cells starting with `=`, `+`, `-`, `@` get `'` prefix to prevent Excel formula injection |
|
||||
| JSON schema | Custom (no standard exists) | KCanG is too new for an official schema — we define it |
|
||||
| ZIP generation | `java.util.zip.ZipOutputStream` via `StreamingResponseBody` | Standard library, streamed to avoid OOM on large exports |
|
||||
| Report storage | Database record + file in documents module | Reuse existing document storage from Sprint 8 |
|
||||
| Retention checking | Spring `@Scheduled` | Simple, already used for payment reminders |
|
||||
| Rate limiting | Resilience4j `@RateLimiter` — 5 reports/min/tenant | Prevents DoS via report generation spam (CPU-intensive PDF rendering) |
|
||||
| Authority export auth | Re-authentication required (password re-entry) | High-sensitivity: contains all member health data |
|
||||
| Sidebar state | LocalStorage for collapsed/expanded | No backend needed, instant UX |
|
||||
| Report preview | Server-side rendered HTML → PDF | Same template for preview and final PDF |
|
||||
| Empty-state UX | Guided setup banner for new clubs | Prevents demoralizing all-red compliance dashboard on first access |
|
||||
|
||||
> **Advisory implementations (v2):** CSV injection prevention, rate limiting, re-authentication gate, streaming ZIP, and empty-state UX all added per panel review recommendations.
|
||||
|
||||
---
|
||||
|
||||
## File Count Estimate
|
||||
|
||||
| Phase | New Backend Files | New Frontend Files | Modified Files |
|
||||
|-------|------------------|--------------------|----------------|
|
||||
| Phase 1 | ~18 (entities, repos, controllers, enums) | 0 | 3 (Distribution entity, pom.xml) |
|
||||
| Phase 2 | ~5 (report generators) | 0 | 1 (existing ReportService) |
|
||||
| Phase 3 | ~9 (report generators) | 0 | 0 |
|
||||
| Phase 4 | ~8 (report generators) | 0 | 0 |
|
||||
| Phase 5 | 0 | ~20 (pages, components, services) | 5 (sidebar, navigations, i18n) |
|
||||
| Phase 6 | ~4 (services, schedulers) | ~3 (dashboard components) | 2 (seed data) |
|
||||
| **Total** | **~44** | **~23** | **~11** |
|
||||
|
||||
---
|
||||
|
||||
## Dependencies & Risks
|
||||
|
||||
| Risk | Probability | Impact | Mitigation |
|
||||
|------|-------------|--------|------------|
|
||||
| Authority report format changes | Low (KCanG is new) | Medium | JSON export is flexible, PDF regenerable |
|
||||
| DSGVO template incomplete | Medium | Low | Templates are editable, clubs can customize |
|
||||
| PDF formatting issues with German umlauts | Low | Low | OpenPDF handles UTF-8, already proven |
|
||||
| Retention period legal ambiguity (§26 "5 Jahre" — from when?) | Medium | Medium | Conservative: 5 years from record creation + admin review |
|
||||
| Large data export performance | Low | Medium | Stream responses, chunked ZIP generation |
|
||||
| Sidebar reorg breaks existing bookmarks | Low | Low | URL paths stay the same, only visual grouping changes |
|
||||
|
||||
---
|
||||
|
||||
## Success Criteria
|
||||
|
||||
1. ✅ All P0 reports generate valid PDFs with correct German formatting
|
||||
2. ✅ Authority annual report (§26(3)) produces complete, accurate data
|
||||
3. ✅ Full authority export generates machine-readable JSON bundle
|
||||
4. ✅ EÜR matches standard format for Finanzamt submission
|
||||
5. ✅ Sidebar is grouped and collapsible with no functionality loss
|
||||
6. ✅ Compliance dashboard shows correct status for all 4 areas
|
||||
7. ✅ Retention service identifies records approaching end-of-life
|
||||
8. ✅ All exports respect DSGVO data minimization (birth year, not full DOB in authority exports)
|
||||
9. ✅ CSV exports use correct encoding (ISO-8859-1) and delimiter (semicolons)
|
||||
10. ✅ Report history tracks what was generated when and by whom
|
||||
@@ -0,0 +1,723 @@
|
||||
# Sprint 9 Test Plan — Berichtszentrale (Report Center)
|
||||
|
||||
**Date:** 2026-06-15
|
||||
**Author:** Patrick Plate / Lumen (Architect)
|
||||
**Status:** Draft v2 (updated with panel review advisory items)
|
||||
**Basis:** cannamanage-sprint9-plan.md v2
|
||||
**Total Test Cases:** 80
|
||||
|
||||
---
|
||||
|
||||
## Test Overview
|
||||
|
||||
| ID | Description | Type | Class/Location | Status |
|
||||
|----|-------------|------|----------------|--------|
|
||||
| T-01 | Destruction record CRUD | Unit | `DestructionRecordServiceTest` | ⬜ |
|
||||
| T-02 | Transport record CRUD | Unit | `TransportRecordServiceTest` | ⬜ |
|
||||
| T-03 | Propagation source CRUD | Unit | `PropagationSourceServiceTest` | ⬜ |
|
||||
| T-04 | Prevention activity CRUD | Unit | `PreventionActivityServiceTest` | ⬜ |
|
||||
| T-05 | Generated report record keeping | Unit | `GeneratedReportServiceTest` | ⬜ |
|
||||
| T-06 | Compliance deadline CRUD + status | Unit | `ComplianceDeadlineServiceTest` | ⬜ |
|
||||
| T-07 | EÜR calculation correctness | Unit | `EurReportGeneratorTest` | ⬜ |
|
||||
| T-08 | EÜR zero-income edge case | Unit | `EurReportGeneratorTest` | ⬜ |
|
||||
| T-09 | EÜR multi-category expense grouping | Unit | `EurReportGeneratorTest` | ⬜ |
|
||||
| T-10 | EÜR CSV encoding ISO-8859-1 | Unit | `EurReportGeneratorTest` | ⬜ |
|
||||
| T-11 | EÜR decimal comma format | Unit | `EurReportGeneratorTest` | ⬜ |
|
||||
| T-12 | Kassenbuch export with running balance | Unit | `KassenbuchExportGeneratorTest` | ⬜ |
|
||||
| T-13 | Kassenbuch period filtering | Unit | `KassenbuchExportGeneratorTest` | ⬜ |
|
||||
| T-14 | Fee confirmation per member | Unit | `FeeConfirmationGeneratorTest` | ⬜ |
|
||||
| T-15 | Fee confirmation batch generation | Unit | `FeeConfirmationGeneratorTest` | ⬜ |
|
||||
| T-16 | Annual authority report - all fields populated | Unit | `AnnualAuthorityReportGeneratorTest` | ⬜ |
|
||||
| T-17 | Annual authority report - by-strain breakdown | Unit | `AnnualAuthorityReportGeneratorTest` | ⬜ |
|
||||
| T-18 | Annual authority report - stock reconciliation check | Unit | `AnnualAuthorityReportGeneratorTest` | ⬜ |
|
||||
| T-19 | Annual authority report - empty year (no activity) | Unit | `AnnualAuthorityReportGeneratorTest` | ⬜ |
|
||||
| T-20 | Annual authority report - JSON schema validation | Unit | `AnnualAuthorityReportGeneratorTest` | ⬜ |
|
||||
| T-21 | Distribution log - date range filter | Unit | `DistributionLogGeneratorTest` | ⬜ |
|
||||
| T-22 | Distribution log - quota violation flagging | Unit | `DistributionLogGeneratorTest` | ⬜ |
|
||||
| T-23 | Distribution log - Heranwachsende THC limit flag | Unit | `DistributionLogGeneratorTest` | ⬜ |
|
||||
| T-24 | Distribution log - CSV semicolons + ISO-8859-1 | Unit | `DistributionLogGeneratorTest` | ⬜ |
|
||||
| T-25 | Stock inventory - point-in-time snapshot | Unit | `StockInventoryReportGeneratorTest` | ⬜ |
|
||||
| T-26 | Stock inventory - includes propagation material count | Unit | `StockInventoryReportGeneratorTest` | ⬜ |
|
||||
| T-27 | Destruction protocol - sequential numbering | Unit | `DestructionProtocolGeneratorTest` | ⬜ |
|
||||
| T-28 | Destruction protocol - witness fields | Unit | `DestructionProtocolGeneratorTest` | ⬜ |
|
||||
| T-29 | Destruction protocol - annual totals | Unit | `DestructionProtocolGeneratorTest` | ⬜ |
|
||||
| T-30 | Cultivation report - harvest aggregation by strain | Unit | `CultivationReportGeneratorTest` | ⬜ |
|
||||
| T-31 | Transport certificate - all §22(4) fields present | Unit | `TransportCertificateGeneratorTest` | ⬜ |
|
||||
| T-32 | Transport certificate - PDF single page | Unit | `TransportCertificateGeneratorTest` | ⬜ |
|
||||
| T-33 | Full authority export - ZIP structure valid | Unit | `FullAuthorityExportGeneratorTest` | ⬜ |
|
||||
| T-34 | Full authority export - JSON files parseable | Unit | `FullAuthorityExportGeneratorTest` | ⬜ |
|
||||
| T-35 | Full authority export - DSGVO minimization (birth year only) | Unit | `FullAuthorityExportGeneratorTest` | ⬜ |
|
||||
| T-36 | Full authority export - includes README.txt | Unit | `FullAuthorityExportGeneratorTest` | ⬜ |
|
||||
| T-37 | Distribution info sheet - all §21(2) fields | Unit | `DistributionInfoSheetGeneratorTest` | ⬜ |
|
||||
| T-38 | Distribution info sheet - health warnings present | Unit | `DistributionInfoSheetGeneratorTest` | ⬜ |
|
||||
| T-39 | VVT generator - pre-filled template complete | Unit | `VvtGeneratorTest` | ⬜ |
|
||||
| T-40 | VVT generator - club-specific data inserted | Unit | `VvtGeneratorTest` | ⬜ |
|
||||
| T-41 | TOM generator - all 7 control areas present | Unit | `TomGeneratorTest` | ⬜ |
|
||||
| T-42 | DSFA generator - structure correct | Unit | `DsfaGeneratorTest` | ⬜ |
|
||||
| T-43 | Deletion concept - all retention categories listed | Unit | `DeletionConceptGeneratorTest` | ⬜ |
|
||||
| T-44 | Member list registry - §67 BGB format | Unit | `MemberListRegistryGeneratorTest` | ⬜ |
|
||||
| T-45 | Member list registry - minimal data only | Unit | `MemberListRegistryGeneratorTest` | ⬜ |
|
||||
| T-46 | Board change notice - old vs new composition | Unit | `BoardChangeNoticeGeneratorTest` | ⬜ |
|
||||
| T-47 | Annual board report - combines all data sources | Unit | `AnnualBoardReportGeneratorTest` | ⬜ |
|
||||
| T-48 | Compliance status - GREEN when all obligations met | Unit | `ComplianceDashboardServiceTest` | ⬜ |
|
||||
| T-49 | Compliance status - YELLOW when deadline within 30 days | Unit | `ComplianceDashboardServiceTest` | ⬜ |
|
||||
| T-50 | Compliance status - RED when deadline passed | Unit | `ComplianceDashboardServiceTest` | ⬜ |
|
||||
| T-51 | Compliance status - KCanG area calculation | Unit | `ComplianceDashboardServiceTest` | ⬜ |
|
||||
| T-52 | Retention service - identifies expired records | Unit | `RetentionServiceTest` | ⬜ |
|
||||
| T-53 | Retention service - respects different retention periods | Unit | `RetentionServiceTest` | ⬜ |
|
||||
| T-54 | Retention service - never auto-deletes | Unit | `RetentionServiceTest` | ⬜ |
|
||||
| T-55 | Deadline scheduler - rolls annual deadlines | Unit | `ComplianceDeadlineSchedulerTest` | ⬜ |
|
||||
| T-56 | Deadline scheduler - creates notifications | Unit | `ComplianceDeadlineSchedulerTest` | ⬜ |
|
||||
| T-57 | PDF generation - German umlauts render correctly | Integration | `PdfRenderingTest` | ⬜ |
|
||||
| T-58 | PDF generation - legal reference in footer | Integration | `PdfRenderingTest` | ⬜ |
|
||||
| T-59 | PDF generation - club letterhead | Integration | `PdfRenderingTest` | ⬜ |
|
||||
| T-60 | Report controller - generate EÜR endpoint | Integration | `ReportControllerTest` | ⬜ |
|
||||
| T-61 | Report controller - authority annual report endpoint | Integration | `ReportControllerTest` | ⬜ |
|
||||
| T-62 | Report controller - full export ZIP endpoint | Integration | `ReportControllerTest` | ⬜ |
|
||||
| T-63 | Report controller - permission check (ADMIN only) | Integration | `ReportControllerTest` | ⬜ |
|
||||
| T-64 | Destruction controller - CRUD + PDF | Integration | `DestructionRecordControllerTest` | ⬜ |
|
||||
| T-65 | Transport controller - CRUD + certificate | Integration | `TransportRecordControllerTest` | ⬜ |
|
||||
| T-66 | Sidebar renders grouped navigation | E2E | `navigation.spec.ts` | ⬜ |
|
||||
| T-67 | Berichtszentrale page loads with compliance cards | E2E | `reports.spec.ts` | ⬜ |
|
||||
| T-68 | Report download flow (generate → download PDF) | E2E | `reports.spec.ts` | ⬜ |
|
||||
| T-69 | Rate limiter - 6th report in 1 min returns 429 | Integration | `ReportControllerTest` | ⬜ |
|
||||
| T-70 | Rate limiter - different tenant not affected | Integration | `ReportControllerTest` | ⬜ |
|
||||
| T-71 | CSV injection prevention - dangerous cell prefixes escaped | Unit | `CsvExportUtilTest` | ⬜ |
|
||||
| T-72 | CSV injection - formula in member name does not execute | Unit | `CsvExportUtilTest` | ⬜ |
|
||||
| T-73 | Authority export re-authentication required | Integration | `ReportControllerTest` | ⬜ |
|
||||
| T-74 | Authority export - expired reconfirm token rejected | Integration | `ReportControllerTest` | ⬜ |
|
||||
| T-75 | Authority export - reason field minimum length enforced | Integration | `ReportControllerTest` | ⬜ |
|
||||
| T-76 | Streaming ZIP - large export does not OOM | Integration | `FullAuthorityExportGeneratorTest` | ⬜ |
|
||||
| T-77 | Breach notification - Art. 33 section present | Unit | `BreachNotificationGeneratorTest` | ⬜ |
|
||||
| T-78 | Breach notification - Art. 34 section separate | Unit | `BreachNotificationGeneratorTest` | ⬜ |
|
||||
| T-79 | Breach notification - 72h deadline reminder included | Unit | `BreachNotificationGeneratorTest` | ⬜ |
|
||||
| T-80 | Empty-state Berichtszentrale shows onboarding for new club | E2E | `reports.spec.ts` | ⬜ |
|
||||
|
||||
Status: ⬜ Pending | ✅ Passed | ❌ Failed | ⏭️ Skipped
|
||||
|
||||
---
|
||||
|
||||
## Test Cases — Detailed
|
||||
|
||||
### T-01: Destruction Record CRUD
|
||||
|
||||
**Type:** Unit
|
||||
**Class:** `DestructionRecordServiceTest`
|
||||
**Method:** `testCreateDestructionRecord()`, `testListByDateRange()`, `testDeleteNotAllowed()`
|
||||
|
||||
**Preconditions:**
|
||||
- Tenant with active batch in stock
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Input | Expected Result |
|
||||
|---|-------|----------------|
|
||||
| a | Valid destruction (batch, 100g, INCINERATION, reason, witness) | Record created, stock updated (decrease by 100g) |
|
||||
| b | Destruction with 0 grams | Validation error: grams must be > 0 |
|
||||
| c | Destruction exceeding batch remaining stock | Validation error: cannot destroy more than available |
|
||||
| d | List destructions for date range | Only records within range returned |
|
||||
| e | Delete destruction record | Rejected: destruction records are immutable (audit trail) |
|
||||
|
||||
---
|
||||
|
||||
### T-07: EÜR Calculation Correctness
|
||||
|
||||
**Type:** Unit
|
||||
**Class:** `EurReportGeneratorTest`
|
||||
**Method:** `testEurCalculation_normalYear()`
|
||||
|
||||
**Preconditions:**
|
||||
- 12 months of financial transactions (income + expenses)
|
||||
- Multiple expense categories
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Input | Expected Result |
|
||||
|---|-------|----------------|
|
||||
| a | Year 2025 with €54000 income, €46000 expenses | EÜR shows Überschuss €8000 |
|
||||
| b | Opening balance €5000, closing balance €13000 | Balance change matches Überschuss |
|
||||
| c | 6 expense categories | All categories listed with correct subtotals |
|
||||
| d | Amounts in cents (internal) | Display in Euro with comma decimals (1.234,56) |
|
||||
|
||||
---
|
||||
|
||||
### T-10: EÜR CSV Encoding ISO-8859-1
|
||||
|
||||
**Type:** Unit
|
||||
**Class:** `EurReportGeneratorTest`
|
||||
**Method:** `testCsvEncoding()`
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Input | Expected Result |
|
||||
|---|-------|----------------|
|
||||
| a | Category "Büroausstattung" with umlaut | CSV file readable in ISO-8859-1, ü correctly encoded |
|
||||
| b | Amount 1234.56 | CSV shows "1234,56" (decimal comma) |
|
||||
| c | Field separator | Semicolons (;) not commas |
|
||||
| d | Line ending | CRLF (Windows-compatible for DATEV) |
|
||||
|
||||
---
|
||||
|
||||
### T-16: Annual Authority Report — All Fields Populated
|
||||
|
||||
**Type:** Unit
|
||||
**Class:** `AnnualAuthorityReportGeneratorTest`
|
||||
**Method:** `testAnnualReport_complete()`
|
||||
|
||||
**Preconditions:**
|
||||
- Grow module has harvest records for 3 strains
|
||||
- Distribution records for 2025
|
||||
- 2 destruction records
|
||||
- Stock snapshot available for Dec 31
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Input | Expected Result |
|
||||
|---|-------|----------------|
|
||||
| a | Year 2025 | Report contains all 4 sections: cultivated, distributed, destroyed, end-stock |
|
||||
| b | 3 strains with different THC/CBD | Each strain listed separately with correct averages |
|
||||
| c | Cross-check: cultivated - distributed - destroyed = stock change | Discrepancy < 1g (rounding) or flagged |
|
||||
| d | JSON output | Valid JSON matching defined schema |
|
||||
| e | PDF output | Contains legal reference "§26 Abs. 3 KCanG" in footer |
|
||||
|
||||
---
|
||||
|
||||
### T-22: Distribution Log — Quota Violation Flagging
|
||||
|
||||
**Type:** Unit
|
||||
**Class:** `DistributionLogGeneratorTest`
|
||||
**Method:** `testQuotaViolationFlags()`
|
||||
|
||||
**Preconditions:**
|
||||
- Member A (age 25): received 26g on one day (exceeds 25g/day limit)
|
||||
- Member B (age 19): received cannabis with 12% THC (exceeds 10% for Heranwachsende)
|
||||
- Member C (age 30): received 52g in one month (exceeds 50g/month)
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Input | Expected Result |
|
||||
|---|-------|----------------|
|
||||
| a | Member A daily violation | Report flags: "TAGESLIMIT ÜBERSCHRITTEN: 26g > 25g" |
|
||||
| b | Member B THC violation | Report flags: "THC-LIMIT HERANWACHSENDE: 12% > 10%" |
|
||||
| c | Member C monthly violation | Report flags: "MONATSLIMIT ÜBERSCHRITTEN: 52g > 50g" |
|
||||
| d | Member D (age 25, 20g/day, 45g/month) | No flags — within all limits |
|
||||
|
||||
---
|
||||
|
||||
### T-33: Full Authority Export — ZIP Structure Valid
|
||||
|
||||
**Type:** Unit
|
||||
**Class:** `FullAuthorityExportGeneratorTest`
|
||||
**Method:** `testZipStructure()`
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Input | Expected Result |
|
||||
|---|-------|----------------|
|
||||
| a | Generate full export | ZIP contains: README.txt, distributions.json, distributions.csv, stock.json, destructions.json, cultivation.json, transports.json, members.json, summary.pdf |
|
||||
| b | Each JSON file | Valid JSON, parseable without errors |
|
||||
| c | members.json | Contains ONLY: name, firstName, birthYear — NO address, NO full DOB, NO phone |
|
||||
| d | README.txt | Contains: generation date, legal basis reference, file descriptions |
|
||||
|
||||
---
|
||||
|
||||
### T-35: Full Authority Export — DSGVO Minimization
|
||||
|
||||
**Type:** Unit
|
||||
**Class:** `FullAuthorityExportGeneratorTest`
|
||||
**Method:** `testDsgvoMinimization()`
|
||||
|
||||
**Critical test** — ensures we don't leak unnecessary personal data to authorities.
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Input | Expected Result |
|
||||
|---|-------|----------------|
|
||||
| a | Member with full profile (name, address, phone, email, DOB 1990-05-15) | Export contains only: "Max", "Müller", 1990 |
|
||||
| b | Distribution record | Contains member name + birth year, NOT member ID or address |
|
||||
| c | No bank details in any export file | Grep for IBAN patterns returns zero matches |
|
||||
| d | No email addresses in export | Grep for @ returns zero matches |
|
||||
|
||||
---
|
||||
|
||||
### T-48: Compliance Status — GREEN When All Obligations Met
|
||||
|
||||
**Type:** Unit
|
||||
**Class:** `ComplianceDashboardServiceTest`
|
||||
**Method:** `testGreenStatus()`
|
||||
|
||||
**Preconditions:**
|
||||
- Annual authority report generated for previous year
|
||||
- EÜR generated for previous year
|
||||
- VVT exists and updated within last 12 months
|
||||
- Next MV scheduled
|
||||
- All board terms valid
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Input | Expected Result |
|
||||
|---|-------|----------------|
|
||||
| a | All conditions met | Overall status: GREEN |
|
||||
| b | KCanG area | GREEN: annual report submitted, records complete |
|
||||
| c | Finance area | GREEN: EÜR generated, no overdue deadlines |
|
||||
| d | DSGVO area | GREEN: VVT exists and recent |
|
||||
| e | Verein area | GREEN: MV scheduled, board terms valid |
|
||||
|
||||
---
|
||||
|
||||
### T-50: Compliance Status — RED When Deadline Passed
|
||||
|
||||
**Type:** Unit
|
||||
**Class:** `ComplianceDashboardServiceTest`
|
||||
**Method:** `testRedStatus()`
|
||||
|
||||
**Preconditions:**
|
||||
- Current date: February 15
|
||||
- Annual authority report for previous year NOT generated (deadline was Jan 31)
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Input | Expected Result |
|
||||
|---|-------|----------------|
|
||||
| a | Authority report overdue | KCanG status: RED |
|
||||
| b | Overall status | RED (worst of all areas) |
|
||||
| c | Deadline record | Status marked OVERDUE |
|
||||
|
||||
---
|
||||
|
||||
### T-52: Retention Service — Identifies Expired Records
|
||||
|
||||
**Type:** Unit
|
||||
**Class:** `RetentionServiceTest`
|
||||
**Method:** `testIdentifiesExpiredRecords()`
|
||||
|
||||
**Preconditions:**
|
||||
- Distribution record created 6 years ago (past 5-year KCanG retention)
|
||||
- Financial transaction created 11 years ago (past 10-year AO retention)
|
||||
- MV protocol from 20 years ago (indefinite retention — should NOT be flagged)
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Input | Expected Result |
|
||||
|---|-------|----------------|
|
||||
| a | 6-year-old distribution record | Flagged for deletion review |
|
||||
| b | 11-year-old financial transaction | Flagged for deletion review |
|
||||
| c | 20-year-old MV protocol | NOT flagged (indefinite retention) |
|
||||
| d | 4-year-old distribution record | NOT flagged (within 5-year period) |
|
||||
|
||||
---
|
||||
|
||||
### T-54: Retention Service — Never Auto-Deletes
|
||||
|
||||
**Type:** Unit
|
||||
**Class:** `RetentionServiceTest`
|
||||
**Method:** `testNeverAutoDeletes()`
|
||||
|
||||
**Critical safety test.**
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Input | Expected Result |
|
||||
|---|-------|----------------|
|
||||
| a | Run retention check with expired records | No records deleted from database |
|
||||
| b | Expired record | Status changed to "RETENTION_EXPIRED", admin notification created |
|
||||
| c | Admin confirms deletion | THEN record is soft-deleted (retention log entry created) |
|
||||
| d | Without admin confirmation | Record persists indefinitely |
|
||||
|
||||
---
|
||||
|
||||
### T-57: PDF Generation — German Umlauts Render Correctly
|
||||
|
||||
**Type:** Integration
|
||||
**Class:** `PdfRenderingTest`
|
||||
**Method:** `testGermanCharacters()`
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Input | Expected Result |
|
||||
|---|-------|----------------|
|
||||
| a | Text with äöüÄÖÜß | All characters render correctly in PDF |
|
||||
| b | Club name "Grüner Daumen e.V." | Renders correctly in letterhead |
|
||||
| c | Category "Büroausstattung" | Renders correctly in EÜR table |
|
||||
| d | Legal text "§26 Abs. 3 KCanG" | § symbol renders correctly |
|
||||
| e | Euro amounts "1.234,56 €" | Euro sign renders correctly |
|
||||
|
||||
---
|
||||
|
||||
### T-63: Report Controller — Permission Check
|
||||
|
||||
**Type:** Integration
|
||||
**Class:** `ReportControllerTest`
|
||||
**Method:** `testPermissions()`
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Input | Expected Result |
|
||||
|---|-------|----------------|
|
||||
| a | ADMIN requests EÜR | 200 OK + PDF |
|
||||
| b | STAFF (Kassenwart) requests EÜR | 200 OK + PDF (finance permission) |
|
||||
| c | MEMBER requests EÜR | 403 Forbidden |
|
||||
| d | ADMIN requests authority export | 200 OK + ZIP |
|
||||
| e | STAFF without finance permission requests EÜR | 403 Forbidden |
|
||||
| f | Unauthenticated request | 401 Unauthorized |
|
||||
|
||||
---
|
||||
|
||||
### T-66: Sidebar Renders Grouped Navigation
|
||||
|
||||
**Type:** E2E (Playwright)
|
||||
**File:** `cannamanage-frontend/e2e/authenticated/navigation.spec.ts`
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Action | Expected Result |
|
||||
|---|--------|----------------|
|
||||
| a | Load dashboard page | Sidebar shows 4 groups: Betrieb, Kommunikation, Verwaltung, Compliance |
|
||||
| b | Click group header "Kommunikation" | Group collapses/expands |
|
||||
| c | Navigate to /reports | "Berichtszentrale" item highlighted in Compliance group |
|
||||
| d | All existing URLs still work | /members, /distributions, /stock, /grow, /finance, /assemblies all accessible |
|
||||
|
||||
---
|
||||
|
||||
### T-67: Berichtszentrale Page Loads
|
||||
|
||||
**Type:** E2E (Playwright)
|
||||
**File:** `cannamanage-frontend/e2e/authenticated/reports.spec.ts`
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Action | Expected Result |
|
||||
|---|--------|----------------|
|
||||
| a | Navigate to /reports | Page loads with compliance status cards |
|
||||
| b | Compliance cards visible | 4 cards: KCanG, Finanzen, DSGVO, Verein — each with status color |
|
||||
| c | Report categories visible | 4 category sections with report listings |
|
||||
| d | Click "EÜR generieren" | Year picker appears, generate button enabled |
|
||||
| e | Click "Behörden-Export" | Confirmation dialog shown (due to data sensitivity) |
|
||||
|
||||
---
|
||||
|
||||
### T-68: Report Download Flow
|
||||
|
||||
**Type:** E2E (Playwright)
|
||||
**File:** `cannamanage-frontend/e2e/authenticated/reports.spec.ts`
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Action | Expected Result |
|
||||
|---|--------|----------------|
|
||||
| a | Select year 2025, click generate EÜR PDF | Download triggered, file non-empty |
|
||||
| b | Generate distribution log for last month | Download triggered, PDF contains data |
|
||||
| c | Report appears in history table | History shows: type, date, generated by |
|
||||
| d | Re-download from history | Same file downloadable again |
|
||||
|
||||
---
|
||||
|
||||
### T-69: Rate Limiter - 6th Report in 1 Minute Returns 429
|
||||
|
||||
**Type:** Integration
|
||||
**Class:** `ReportControllerTest`
|
||||
**Method:** `testRateLimit_sixthRequestReturns429()`
|
||||
|
||||
**Preconditions:**
|
||||
- Authenticated admin user
|
||||
- Resilience4j rate limiter configured: 5 permits/minute/tenant
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Action | Expected Result |
|
||||
|---|--------|----------------|
|
||||
| a | Generate 5 reports in rapid succession | All return 200 OK |
|
||||
| b | Generate 6th report within same minute | Returns 429 Too Many Requests |
|
||||
| c | Response body contains "Rate limit exceeded" message | Helpful German error message |
|
||||
| d | Response includes `Retry-After` header | Header present with seconds value |
|
||||
|
||||
---
|
||||
|
||||
### T-70: Rate Limiter - Different Tenant Not Affected
|
||||
|
||||
**Type:** Integration
|
||||
**Class:** `ReportControllerTest`
|
||||
**Method:** `testRateLimit_differentTenantNotBlocked()`
|
||||
|
||||
**Preconditions:**
|
||||
- Two tenants configured in test
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Action | Expected Result |
|
||||
|---|--------|----------------|
|
||||
| a | Tenant A generates 5 reports (hitting limit) | All return 200 |
|
||||
| b | Tenant B generates 1 report immediately after | Returns 200 OK (not affected by A's limit) |
|
||||
|
||||
---
|
||||
|
||||
### T-71: CSV Injection Prevention - Dangerous Cell Prefixes Escaped
|
||||
|
||||
**Type:** Unit
|
||||
**Class:** `CsvExportUtilTest`
|
||||
**Method:** `testCsvInjection_dangerousPrefixesEscaped()`
|
||||
|
||||
**Preconditions:**
|
||||
- CSV export utility available
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Input Cell Value | Expected Output |
|
||||
|---|-----------------|----------------|
|
||||
| a | `=SUM(A1:A10)` | `'=SUM(A1:A10)` |
|
||||
| b | `+cmd\|'/C calc'\|''!A0` | `'+cmd\|'/C calc'\|''!A0` |
|
||||
| c | `-2+3+cmd\|'/C calc'\|'!A0` | `'-2+3+cmd\|'/C calc'\|'!A0` |
|
||||
| d | `@SUM(A1:A10)` | `'@SUM(A1:A10)` |
|
||||
| e | `Normal text value` | `Normal text value` (unchanged) |
|
||||
| f | `123.45` | `123.45` (numbers unchanged) |
|
||||
|
||||
---
|
||||
|
||||
### T-72: CSV Injection - Formula in Member Name Does Not Execute
|
||||
|
||||
**Type:** Unit
|
||||
**Class:** `CsvExportUtilTest`
|
||||
**Method:** `testCsvInjection_memberNameWithFormula()`
|
||||
|
||||
**Preconditions:**
|
||||
- Member with name `=HYPERLINK("http://evil.com","Click")` in database
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Action | Expected Result |
|
||||
|---|--------|----------------|
|
||||
| a | Export distribution log as CSV with this member | Cell contains `'=HYPERLINK(...)` with leading quote |
|
||||
| b | Open CSV in LibreOffice Calc | No formula execution, displays as text |
|
||||
|
||||
---
|
||||
|
||||
### T-73: Authority Export Re-Authentication Required
|
||||
|
||||
**Type:** Integration
|
||||
**Class:** `ReportControllerTest`
|
||||
**Method:** `testAuthorityExport_requiresReauthentication()`
|
||||
|
||||
**Preconditions:**
|
||||
- Authenticated admin user with valid session
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Action | Expected Result |
|
||||
|---|--------|----------------|
|
||||
| a | Call `GET /api/reports/authority-export/zip` without reconfirm token | Returns 403 Forbidden |
|
||||
| b | Call `POST /api/auth/reconfirm` with correct password | Returns fresh token (valid 30s) |
|
||||
| c | Call authority export with valid reconfirm token within 30s | Returns 200 with ZIP stream |
|
||||
| d | Audit log entry created | Records: who, when, reason, IP address |
|
||||
|
||||
---
|
||||
|
||||
### T-74: Authority Export - Expired Reconfirm Token Rejected
|
||||
|
||||
**Type:** Integration
|
||||
**Class:** `ReportControllerTest`
|
||||
**Method:** `testAuthorityExport_expiredTokenRejected()`
|
||||
|
||||
**Preconditions:**
|
||||
- Reconfirm token obtained but 31+ seconds elapsed
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Action | Expected Result |
|
||||
|---|--------|----------------|
|
||||
| a | Call authority export with 31-second-old reconfirm token | Returns 403 Forbidden |
|
||||
| b | Error message indicates re-authentication required | `"Bestätigung abgelaufen. Bitte erneut authentifizieren."` |
|
||||
|
||||
---
|
||||
|
||||
### T-75: Authority Export - Reason Field Minimum Length Enforced
|
||||
|
||||
**Type:** Integration
|
||||
**Class:** `ReportControllerTest`
|
||||
**Method:** `testAuthorityExport_reasonFieldValidation()`
|
||||
|
||||
**Preconditions:**
|
||||
- Valid reconfirm token
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Reason Value | Expected Result |
|
||||
|---|-------------|----------------|
|
||||
| a | `""` (empty) | 400 Bad Request — reason required |
|
||||
| b | `"test"` (4 chars) | 400 Bad Request — minimum 10 characters |
|
||||
| c | `"."` (1 char) | 400 Bad Request — minimum 10 characters |
|
||||
| d | `"Behördenanfrage vom 15.06.2026"` (30 chars) | 200 OK — accepted |
|
||||
| e | `"Jährliche Prüfung der Dokumentation"` | 200 OK — accepted |
|
||||
|
||||
---
|
||||
|
||||
### T-76: Streaming ZIP - Large Export Does Not OOM
|
||||
|
||||
**Type:** Integration
|
||||
**Class:** `FullAuthorityExportGeneratorTest`
|
||||
**Method:** `testStreamingZip_largeDataDoesNotOOM()`
|
||||
|
||||
**Preconditions:**
|
||||
- Test data with 500 members, 5000 distributions, 200 destruction records
|
||||
- JVM heap limited to 256MB in test configuration
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Action | Expected Result |
|
||||
|---|--------|----------------|
|
||||
| a | Generate full authority export with large dataset | Completes without OutOfMemoryError |
|
||||
| b | Response is streamed (chunked transfer encoding) | `Transfer-Encoding: chunked` header present |
|
||||
| c | ZIP file is valid and contains all expected entries | All 8 files present in ZIP |
|
||||
| d | Peak memory usage stays below heap limit | No GC pressure spikes above 200MB |
|
||||
|
||||
---
|
||||
|
||||
### T-77: Breach Notification - Art. 33 Section Present
|
||||
|
||||
**Type:** Unit
|
||||
**Class:** `BreachNotificationGeneratorTest`
|
||||
**Method:** `testBreachNotification_article33SectionComplete()`
|
||||
|
||||
**Preconditions:**
|
||||
- Club with configured DPO and Landesdatenschutzbehörde contact
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Check | Expected Content |
|
||||
|---|-------|-----------------|
|
||||
| a | Nature of breach field | Present and editable placeholder |
|
||||
| b | Categories of data subjects | Pre-filled: "Mitglieder der Anbauvereinigung" |
|
||||
| c | Approximate number affected | Editable field with club member count pre-filled |
|
||||
| d | DPO contact details | Auto-filled from club settings |
|
||||
| e | Likely consequences | Pre-filled with Art. 9 health data risk template |
|
||||
| f | Measures taken/proposed | Editable placeholder |
|
||||
| g | 72-hour deadline reminder | Bold text: "Meldung innerhalb 72 Stunden nach Kenntnisnahme" |
|
||||
|
||||
---
|
||||
|
||||
### T-78: Breach Notification - Art. 34 Section Separate
|
||||
|
||||
**Type:** Unit
|
||||
**Class:** `BreachNotificationGeneratorTest`
|
||||
**Method:** `testBreachNotification_article34SectionSeparate()`
|
||||
|
||||
**Preconditions:**
|
||||
- Same as T-77
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Check | Expected Result |
|
||||
|---|-------|----------------|
|
||||
| a | Art. 34 section has separate heading | "Benachrichtigung der Betroffenen (Art. 34 DSGVO)" |
|
||||
| b | Plain language requirement noted | "In klarer und einfacher Sprache" instruction present |
|
||||
| c | Template is distinct from Art. 33 section | Not merged — separate page/section in PDF |
|
||||
| d | Includes contact details for data subjects | Phone, email, postal address fields |
|
||||
|
||||
---
|
||||
|
||||
### T-79: Breach Notification - 72h Deadline Reminder Included
|
||||
|
||||
**Type:** Unit
|
||||
**Class:** `BreachNotificationGeneratorTest`
|
||||
**Method:** `testBreachNotification_72hDeadlineReminder()`
|
||||
|
||||
**Preconditions:**
|
||||
- Generated breach notification PDF
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Check | Expected Content |
|
||||
|---|-------|-----------------|
|
||||
| a | Deadline prominently displayed | "72 Stunden" appears in bold or highlighted |
|
||||
| b | Authority contact for notification | Landesdatenschutzbehörde name + URL/email |
|
||||
| c | "Zeitpunkt der Kenntnisnahme" field | Date/time field for when breach was discovered |
|
||||
| d | Countdown note | "Frist beginnt ab Kenntnisnahme, nicht ab Entdeckung" |
|
||||
|
||||
---
|
||||
|
||||
### T-80: Empty-State Berichtszentrale Shows Onboarding for New Club
|
||||
|
||||
**Type:** E2E (Playwright)
|
||||
**File:** `cannamanage-frontend/e2e/authenticated/reports.spec.ts`
|
||||
|
||||
**Preconditions:**
|
||||
- New tenant with zero generated reports
|
||||
|
||||
**Scenarios:**
|
||||
|
||||
| # | Action | Expected Result |
|
||||
|---|--------|----------------|
|
||||
| a | Navigate to /reports as new club admin | "Erste Schritte" banner visible |
|
||||
| b | Compliance cards show neutral state | Gray "Einrichtung erforderlich" — NOT red indicators |
|
||||
| c | 4-step guide links present | VVT, Jahresbericht, Kassenbuch, Fristen links all working |
|
||||
| d | Click "Verstanden, Dashboard anzeigen" | Banner dismissed, normal view shown |
|
||||
| e | Generate one report in any category | After refresh, traffic-light indicators appear |
|
||||
| f | Banner does not reappear after dismissal | LocalStorage persists dismissal |
|
||||
|
||||
---
|
||||
|
||||
## Test Data Requirements
|
||||
|
||||
### Seed Data Enhancements
|
||||
|
||||
For test scenarios to work, seed data must include:
|
||||
|
||||
| Data | Quantity | Details |
|
||||
|------|----------|---------|
|
||||
| Financial transactions | 50+ | Spanning 12 months, multiple categories |
|
||||
| Distributions with THC% | 30+ | Various strains, some near-limit quantities |
|
||||
| Destruction records | 3 | Different methods, dates, witnesses |
|
||||
| Transport records | 2 | With authority notification timestamps |
|
||||
| Propagation sources | 2 | One person, one Anbauvereinigung |
|
||||
| Prevention activities | 5 | Different activity types |
|
||||
| Grow harvests with THC/CBD | 5 | Different strains, quantities |
|
||||
| Stock entries | 10+ | Current stock by strain |
|
||||
| Compliance deadlines | 4 | One per area, various due dates |
|
||||
| Members aged 18-21 | 2 | For Heranwachsende limit testing |
|
||||
|
||||
---
|
||||
|
||||
## Test Coverage Summary
|
||||
|
||||
| Component | Unit Tests | Integration Tests | E2E Tests | Total |
|
||||
|-----------|-----------|------------------|-----------|-------|
|
||||
| Phase 1 (CRUD) | 6 | 2 | 0 | 8 |
|
||||
| Phase 2 (Financial) | 9 | 1 | 0 | 10 |
|
||||
| Phase 3 (KCanG) | 23 | 3 | 0 | 26 |
|
||||
| Phase 4 (DSGVO/Verein) | 12 | 0 | 0 | 12 |
|
||||
| Phase 5 (Frontend) | 0 | 0 | 4 | 4 |
|
||||
| Phase 6 (Compliance + Security) | 9 | 8 | 0 | 17 |
|
||||
| Cross-cutting (CSV util) | 2 | 0 | 0 | 2 |
|
||||
| Breach notification (v2) | 3 | 0 | 0 | 3 |
|
||||
| **Total** | **64** | **14** | **4** | **80** (was 68) |
|
||||
|
||||
---
|
||||
|
||||
## Critical Test Priorities
|
||||
|
||||
Tests marked as **CRITICAL** — must pass before sprint completion:
|
||||
|
||||
| ID | Test | Why Critical |
|
||||
|----|------|-------------|
|
||||
| T-16 | Annual authority report complete | Legal obligation — §26(3) KCanG |
|
||||
| T-22 | Quota violation flagging | Safety — prevents illegal distribution |
|
||||
| T-33 | Authority export ZIP structure | Authority inspection readiness |
|
||||
| T-35 | DSGVO minimization in exports | Privacy violation risk |
|
||||
| T-54 | Retention service never auto-deletes | Data loss prevention |
|
||||
| T-57 | German umlauts in PDFs | Usability — broken characters = unprofessional |
|
||||
| T-63 | Permission checks | Security — unauthorized report access |
|
||||
| T-69 | Rate limiter enforced | Security — prevents DoS via report generation |
|
||||
| T-71 | CSV injection prevention | Security — prevents formula injection in exports |
|
||||
| T-73 | Authority export re-authentication | Security — protects Art. 9 DSGVO health data |
|
||||
| T-76 | Streaming ZIP no OOM | Reliability — prevents server crash on large exports |
|
||||
| T-77 | Breach notification Art. 33 complete | Compliance — 72h notification obligation |
|
||||
|
||||
---
|
||||
|
||||
## Test Naming Convention
|
||||
|
||||
- Test class: `<OriginalClass>Test.java`
|
||||
- Test method: `test<What>_<Scenario>()` or descriptive name
|
||||
- Location: mirrors source structure under `src/test/java/`
|
||||
- Assertions: use AssertJ for fluent assertions
|
||||
- Mocking: Mockito for service dependencies
|
||||
- PDF verification: extract text from generated PDF bytes using Apache PDFBox in test scope
|
||||
Reference in New Issue
Block a user