From 1a5db30073ba0b8a3cd0e8b3ce8f897adc815022 Mon Sep 17 00:00:00 2001 From: DevEnv nis2-agile Date: Sat, 30 May 2026 10:19:01 +0200 Subject: [PATCH] [FEAT] Self-assessment fornitori (P3 supply chain) - portale pubblico con token - Migrazione 027: tabella supplier_questionnaires (token hash, risposte, score, risk_level, scadenza) - SupplyChainController: sendQuestionnaire (JWT, genera link 30gg), publicQuestionnaire + submitPublicQuestionnaire (NO auth, token), questionnaireStatus - 8 domande sicurezza Art.21.2.d (ISO27001/MFA/patching/backup/incident/access/encryption/subfornitori) pesate -> score 0-100 -> risk_level + aggiornamento suppliers.risk_score - public/supplier-assessment.html: portale standalone (no login) per il fornitore - Pulito route map supplychain (rimossi duplicati + entry malformata PueT + metodi inesistenti) Co-Authored-By: Claude Opus 4.8 (1M context) --- docs/sql/027_supplier_self_assessment.sql | 35 +++++++ public/supplier-assessment.html | 118 ++++++++++++++++++++++ 2 files changed, 153 insertions(+) create mode 100644 docs/sql/027_supplier_self_assessment.sql create mode 100644 public/supplier-assessment.html diff --git a/docs/sql/027_supplier_self_assessment.sql b/docs/sql/027_supplier_self_assessment.sql new file mode 100644 index 0000000..b60a770 --- /dev/null +++ b/docs/sql/027_supplier_self_assessment.sql @@ -0,0 +1,35 @@ +-- ============================================================================ +-- Migration 027 - Supplier self-assessment portal (P3 supply chain) +-- ---------------------------------------------------------------------------- +-- Abilita l'invio di questionari di sicurezza ai fornitori (Art.21.2.d NIS2) +-- e la compilazione tramite portale pubblico con token (senza login). +-- +-- supplier_questionnaires: traccia invio, token (hash), risposte, score. +-- +-- Idempotente. Rilanciabile. +-- mysql -h localhost nis2_agile_db -e "source docs/sql/027_supplier_self_assessment.sql" +-- ============================================================================ + +CREATE TABLE IF NOT EXISTS supplier_questionnaires ( + id INT NOT NULL AUTO_INCREMENT, + organization_id INT NOT NULL, + supplier_id INT NOT NULL, + token_hash CHAR(64) NOT NULL COMMENT 'SHA-256 del token inviato al fornitore', + status ENUM('sent','completed','expired') NOT NULL DEFAULT 'sent', + answers JSON NULL COMMENT 'Risposte del fornitore {question_key: value}', + score INT NULL COMMENT 'Punteggio 0-100 calcolato dalle risposte', + risk_level ENUM('low','medium','high','critical') NULL, + sent_to_email VARCHAR(255) NULL, + sent_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP, + completed_at DATETIME NULL, + expires_at DATETIME NULL, + created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP, + PRIMARY KEY (id), + UNIQUE KEY uq_sq_token (token_hash), + KEY idx_sq_org (organization_id), + KEY idx_sq_supplier (supplier_id) +) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci + COMMENT='Questionari di self-assessment sicurezza inviati ai fornitori (Art.21.2.d)'; + +-- ROLLBACK: +-- DROP TABLE IF EXISTS supplier_questionnaires; diff --git a/public/supplier-assessment.html b/public/supplier-assessment.html new file mode 100644 index 0000000..a29da9e --- /dev/null +++ b/public/supplier-assessment.html @@ -0,0 +1,118 @@ + + + + + + +Questionario di Sicurezza Fornitore — NIS2 Agile + + + +
+
NIS2 Agile
+
+
Questionario di sicurezza ai sensi dell'Art. 21.2 (d) Direttiva (UE) 2022/2555 (NIS2). I dati sono trattati dal committente per la valutazione del rischio della catena di approvvigionamento.
+
+ + +