From 396783cd41f5be21cc7e2014472fa435615ce67c Mon Sep 17 00:00:00 2001
From: DevEnv nis2-agile <dev@certisource.it>
Date: Wed, 26 Aug 2026 18:14:07 +0200
Subject: [PATCH] [FIX] Documenti Istituzionali (#499): le 5 voci standard non
 comparivano mai (NO_ORG)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Root cause: InstitutionalDocsController::list() usava requireAuth()+getCurrentOrgId(),
ma currentOrgId e' popolato solo da requireOrgAccess() → getCurrentOrgId() = null →
l'endpoint rispondeva sempre NO_ORG (400) → loadDocs riceveva standards=[] → la card
mostrava solo "Aggiungi voce" (screenshot Simon). L'endpoint NON aveva mai funzionato a runtime.
- Backend: list() usa resolveOrgId() (risolve X-Organization-Id senza lanciare) e restituisce
  SEMPRE le 5 voci standard; i documenti salvati solo se un'org e' selezionata.
- Frontend (dashboard.js): render condiviso + STD_FALLBACK → le 5 voci si mostrano sempre,
  anche se l'API fallisce. Buster dashboard.js 20260825.
- Backend attivato via reload php-fpm host.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../InstitutionalDocsController.php           | 12 ++--
 public/dashboard.html                         |  2 +-
 public/js/dashboard.js                        | 55 +++++++++++--------
 3 files changed, 40 insertions(+), 29 deletions(-)

diff --git a/application/controllers/InstitutionalDocsController.php b/application/controllers/InstitutionalDocsController.php
index ffbbd5d..50ca7fb 100644
--- a/application/controllers/InstitutionalDocsController.php
+++ b/application/controllers/InstitutionalDocsController.php
@@ -33,16 +33,18 @@ class InstitutionalDocsController extends BaseController
     public function list(): void
     {
         $this->requireAuth();
-        $orgId = $this->getCurrentOrgId();
-        if (!$orgId) { $this->jsonError('Nessuna organizzazione selezionata', 400, 'NO_ORG'); }
-
-        $rows = Database::fetchAll(
+        // BUGFIX (#499): usare requireAuth+getCurrentOrgId dava sempre NO_ORG (currentOrgId
+        // e' popolato solo da requireOrgAccess) → le 5 voci standard non comparivano MAI.
+        // Ora risolviamo l'org dall'header e restituiamo SEMPRE le 5 voci standard;
+        // i documenti salvati si aggiungono solo se un'org e' selezionata.
+        $orgId = $this->resolveOrgId();
+        $rows = $orgId ? Database::fetchAll(
             "SELECT id, doc_key, title, description, file_url, is_standard, sort_order, updated_at
              FROM institutional_documents
              WHERE organization_id = ?
              ORDER BY is_standard DESC, sort_order ASC, id ASC",
             [$orgId]
-        );
+        ) : [];
         $this->jsonSuccess(['docs' => $rows, 'standards' => self::STANDARDS]);
     }
 
diff --git a/public/dashboard.html b/public/dashboard.html
index f818884..12a6757 100644
--- a/public/dashboard.html
+++ b/public/dashboard.html
@@ -118,7 +118,7 @@
     <script src="/js/topnav-v3.js?v=20260729"></script>
     <script src="/js/i18n.js?v=20260731"></script>
     <script src="/js/help.js?v=20260806b"></script>
-    <script src="/js/dashboard.js?v=20260724a"></script>
+    <script src="/js/dashboard.js?v=20260825"></script>
     <script>
         // ── Auth check ───────────────────────────────────────────
         if (!checkAuth()) throw new Error('Not authenticated');
diff --git a/public/js/dashboard.js b/public/js/dashboard.js
index a87285c..fd07297 100644
--- a/public/js/dashboard.js
+++ b/public/js/dashboard.js
@@ -318,34 +318,43 @@
         for (var i = 0; i < standards.length; i++) if (standards[i].label === label) return standards[i].key;
         return null;
     }
+    // Le 5 voci standard DEVONO essere sempre presenti anche se l'API non risponde.
+    var STD_FALLBACK = [
+        { key: 'codice_etico', label: 'Codice Etico' },
+        { key: 'mission', label: 'Mission' },
+        { key: 'vision', label: 'Vision' },
+        { key: 'statuto', label: 'Statuto' },
+        { key: 'piano_sanzionatorio', label: 'Piano Sanzionatorio' }
+    ];
+    function renderDocsCard(docs, standards) {
+        var card = document.getElementById('doc-card'); if (!card) return;
+        standards = (standards && standards.length) ? standards : STD_FALLBACK;
+        docs = docs || [];
+        var byKey = {}; var customs = [];
+        docs.forEach(function (d) { if (d.doc_key) byKey[d.doc_key] = d; else customs.push(d); });
+        var html = '';
+        standards.forEach(function (s) {
+            var item = byKey[s.key] || { doc_key: s.key, title: s.label, is_standard: 1 };
+            html += docRow(item, s.label);
+        });
+        customs.forEach(function (d) { html += docRow(d, null); });
+        if (canEditDocs()) {
+            html += '<button class="btn-ghost doc-add" type="button" style="margin-top:8px">' +
+                '<i data-lucide="plus" class="ic"></i>Aggiungi voce</button>';
+        }
+        card.innerHTML = '<div class="doc-list">' + html + '</div>';
+        refreshIcons();
+        wireDocEvents(card, standards);
+    }
     function loadDocs() {
         var card = document.getElementById('doc-card'); if (!card) return;
         setLoading('doc-card');
         api.request('GET', '/institutional-docs/list').then(function (res) {
             var data = (res && res.data) || res || {};
-            var docs = data.docs || [];
-            var standards = data.standards || [];
-            var byKey = {}; var customs = [];
-            docs.forEach(function (d) {
-                if (d.doc_key) byKey[d.doc_key] = d; else customs.push(d);
-            });
-            var html = '';
-            // 5 voci standard sempre presenti
-            standards.forEach(function (s) {
-                var item = byKey[s.key] || { doc_key: s.key, title: s.label, is_standard: 1 };
-                html += docRow(item, s.label);
-            });
-            // voci custom
-            customs.forEach(function (d) { html += docRow(d, null); });
-            if (canEditDocs()) {
-                html += '<button class="btn-ghost doc-add" type="button" style="margin-top:8px">' +
-                    '<i data-lucide="plus" class="ic"></i>Aggiungi voce</button>';
-            }
-            card.innerHTML = '<div class="doc-list">' + html + '</div>';
-            refreshIcons();
-            wireDocEvents(card, standards);
-        }).catch(function (e) {
-            setError('doc-card', (e && e.message) || 'Riprova tra poco.');
+            renderDocsCard(data.docs || [], data.standards);
+        }).catch(function () {
+            // Anche in caso di errore mostriamo comunque le 5 voci standard.
+            renderDocsCard([], STD_FALLBACK);
         });
     }
     function docModal(opts, standards) {