From 41476c88f22b74ea9fc48ff667b62cfc7a1d2201 Mon Sep 17 00:00:00 2001 From: DevEnv nis2-agile Date: Tue, 14 Jul 2026 10:09:50 +0200 Subject: [PATCH] =?UTF-8?q?[FIX]=20api.js:=20sessione=20scaduta=20?= =?UTF-8?q?=E2=86=92=20login=20invece=20di=20pagina=20bloccata=20"--"?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bug segnalato da un tester "sono tornato su nis2 e non funziona più" (utente/ aziende "--", inventario bloccato su Caricamento, niente FAB segnalazioni). Causa: un 401 su /auth/refresh (refresh token scaduto/invalido) rientrava nel handler di refresh (la condizione non escludeva l'endpoint auth) → ricorsione: doRefreshToken() non ritornava mai, quindi logout()/redirect a login non scattava e la pagina restava rotta. Riprodotto con puppeteer (access scaduto + refresh invalido → dashboard "--" identica allo screenshot). Fix: escludi /auth/refresh e /auth/login dall'auto-refresh; inoltre un 401 senza refresh token disponibile fa logout() → login. Ora un utente che torna dopo la scadenza del token viene mandato a login (ri-accede) invece di vedere "--". Bug PRE-ESISTENTE in api.js (non introdotto dal V3), critico ora col push tester. Cache-buster api.js ?v=20260627u su tutte le pagine. Co-Authored-By: Claude Opus 4.8 (1M context) --- public/_app-bi-demo.html | 2 +- public/admin/index.html | 2 +- public/admin/organizations.html | 2 +- public/admin/users.html | 2 +- public/architecture.html | 2 +- public/assessment.html | 2 +- public/assets.html | 2 +- public/calendario.html | 2 +- public/companies.html | 2 +- public/competenze.html | 2 +- public/connettori-discovery.html | 2 +- public/controlli-periodici.html | 2 +- public/cross-analysis.html | 2 +- public/dashboard.html | 2 +- public/forgot-password.html | 2 +- public/guida.html | 2 +- public/incidents.html | 2 +- public/integrazioniext.html | 2 +- public/internal-audits.html | 2 +- public/isms.html | 2 +- public/js/api.js | 21 ++++++++++++++++----- public/kb.html | 2 +- public/licenseExt.html | 2 +- public/login.html | 2 +- public/management-review.html | 2 +- public/misure-requisiti.html | 2 +- public/normative.html | 2 +- public/onboarding.html | 2 +- public/organigramma.html | 2 +- public/policies.html | 2 +- public/raci.html | 2 +- public/register.html | 2 +- public/reports.html | 2 +- public/review-schedule.html | 2 +- public/risks.html | 2 +- public/settings.html | 2 +- public/stakeholder-activities.html | 2 +- public/stakeholders.html | 2 +- public/supply-chain.html | 2 +- public/training.html | 2 +- public/whistleblowing.html | 2 +- public/workflow.html | 2 +- 42 files changed, 57 insertions(+), 46 deletions(-) diff --git a/public/_app-bi-demo.html b/public/_app-bi-demo.html index d884ec2..52e136a 100644 --- a/public/_app-bi-demo.html +++ b/public/_app-bi-demo.html @@ -70,7 +70,7 @@ - + + diff --git a/public/admin/organizations.html b/public/admin/organizations.html index 94c2ff8..436a2a2 100644 --- a/public/admin/organizations.html +++ b/public/admin/organizations.html @@ -85,7 +85,7 @@ - + diff --git a/public/admin/users.html b/public/admin/users.html index 7abbdd3..de84433 100644 --- a/public/admin/users.html +++ b/public/admin/users.html @@ -92,7 +92,7 @@ - + diff --git a/public/architecture.html b/public/architecture.html index 1eeea85..0ac93a9 100644 --- a/public/architecture.html +++ b/public/architecture.html @@ -1122,7 +1122,7 @@ - + diff --git a/public/assessment.html b/public/assessment.html index f1e0607..6e728b9 100644 --- a/public/assessment.html +++ b/public/assessment.html @@ -270,7 +270,7 @@ - + diff --git a/public/assets.html b/public/assets.html index fd98d70..4c17a14 100644 --- a/public/assets.html +++ b/public/assets.html @@ -377,7 +377,7 @@ - + diff --git a/public/calendario.html b/public/calendario.html index 70db9ce..57a5948 100644 --- a/public/calendario.html +++ b/public/calendario.html @@ -190,7 +190,7 @@ - + diff --git a/public/companies.html b/public/companies.html index c43e901..886eea9 100644 --- a/public/companies.html +++ b/public/companies.html @@ -139,7 +139,7 @@ - + diff --git a/public/competenze.html b/public/competenze.html index 541369c..3496e58 100644 --- a/public/competenze.html +++ b/public/competenze.html @@ -192,7 +192,7 @@ - + diff --git a/public/connettori-discovery.html b/public/connettori-discovery.html index e222f94..d143644 100644 --- a/public/connettori-discovery.html +++ b/public/connettori-discovery.html @@ -98,7 +98,7 @@ - + diff --git a/public/controlli-periodici.html b/public/controlli-periodici.html index fcd8dd4..1585cfc 100644 --- a/public/controlli-periodici.html +++ b/public/controlli-periodici.html @@ -155,7 +155,7 @@ - + diff --git a/public/cross-analysis.html b/public/cross-analysis.html index 387f0c2..594489c 100644 --- a/public/cross-analysis.html +++ b/public/cross-analysis.html @@ -222,7 +222,7 @@ - + diff --git a/public/dashboard.html b/public/dashboard.html index 73fb3c8..5695ac7 100644 --- a/public/dashboard.html +++ b/public/dashboard.html @@ -112,7 +112,7 @@ - + diff --git a/public/forgot-password.html b/public/forgot-password.html index 465d774..b7fceb5 100644 --- a/public/forgot-password.html +++ b/public/forgot-password.html @@ -73,7 +73,7 @@ - + + diff --git a/public/incidents.html b/public/incidents.html index e12c9f7..ad4a143 100644 --- a/public/incidents.html +++ b/public/incidents.html @@ -359,7 +359,7 @@ - + diff --git a/public/integrazioniext.html b/public/integrazioniext.html index 6f53e6a..859a220 100644 --- a/public/integrazioniext.html +++ b/public/integrazioniext.html @@ -931,7 +931,7 @@ curl -H "X-API-Key: nis2_TUA_CHIAVE" \ - + diff --git a/public/internal-audits.html b/public/internal-audits.html index 8ecd6c7..773953c 100644 --- a/public/internal-audits.html +++ b/public/internal-audits.html @@ -160,7 +160,7 @@ - + diff --git a/public/isms.html b/public/isms.html index 48006e2..826d655 100644 --- a/public/isms.html +++ b/public/isms.html @@ -199,7 +199,7 @@ - + diff --git a/public/js/api.js b/public/js/api.js index c34d272..c953ab2 100644 --- a/public/js/api.js +++ b/public/js/api.js @@ -40,11 +40,22 @@ class NIS2API { const response = await fetch(url, config); const json = await response.json(); - // Token expired - try refresh - if (response.status === 401 && this.refreshToken && !options._isRetry) { - const refreshed = await this.doRefreshToken(); - if (refreshed) { - return this.request(method, endpoint, data, { ...options, _isRetry: true }); + // Token expired - try refresh. ESCLUDI gli endpoint auth stessi: un 401 su + // /auth/refresh (refresh token scaduto/invalido) NON deve ri-triggerare il + // refresh → altrimenti ricorsione infinita, doRefreshToken() non ritorna mai, + // logout()/redirect non scatta e l'utente resta su una pagina rotta ("--"). + // (Bug utente "sono tornato dopo un po'": access scaduto + refresh non valido.) + const isAuthEndpoint = endpoint === '/auth/refresh' || endpoint === '/auth/login'; + if (response.status === 401 && !isAuthEndpoint && !options._isRetry) { + if (this.refreshToken) { + const refreshed = await this.doRefreshToken(); + if (refreshed) { + return this.request(method, endpoint, data, { ...options, _isRetry: true }); + } + // refresh fallito → doRefreshToken() ha già fatto logout()+redirect a login + } else { + // 401 senza refresh token → sessione non recuperabile → vai a login + this.logout(); } } diff --git a/public/kb.html b/public/kb.html index 74d6c49..ab4a1bf 100644 --- a/public/kb.html +++ b/public/kb.html @@ -175,7 +175,7 @@ - + diff --git a/public/licenseExt.html b/public/licenseExt.html index af96c81..b3bc2e4 100644 --- a/public/licenseExt.html +++ b/public/licenseExt.html @@ -515,7 +515,7 @@ body { background: var(--bg-main); }
- + - + + diff --git a/public/misure-requisiti.html b/public/misure-requisiti.html index a8eb56f..52e46a1 100644 --- a/public/misure-requisiti.html +++ b/public/misure-requisiti.html @@ -175,7 +175,7 @@ - + diff --git a/public/normative.html b/public/normative.html index 0e670c3..602b43f 100644 --- a/public/normative.html +++ b/public/normative.html @@ -137,7 +137,7 @@ - + diff --git a/public/onboarding.html b/public/onboarding.html index c090a81..5a74d3e 100644 --- a/public/onboarding.html +++ b/public/onboarding.html @@ -494,7 +494,7 @@ - + + diff --git a/public/policies.html b/public/policies.html index 4c48eae..2a5751e 100644 --- a/public/policies.html +++ b/public/policies.html @@ -340,7 +340,7 @@ - + diff --git a/public/raci.html b/public/raci.html index 3af485a..c5baaad 100644 --- a/public/raci.html +++ b/public/raci.html @@ -141,7 +141,7 @@ - + diff --git a/public/register.html b/public/register.html index 6c263dc..ba113d1 100644 --- a/public/register.html +++ b/public/register.html @@ -268,7 +268,7 @@ - + + diff --git a/public/review-schedule.html b/public/review-schedule.html index abcc85f..b61594f 100644 --- a/public/review-schedule.html +++ b/public/review-schedule.html @@ -157,7 +157,7 @@ - + diff --git a/public/risks.html b/public/risks.html index 6d1b234..ea695c8 100644 --- a/public/risks.html +++ b/public/risks.html @@ -502,7 +502,7 @@ - + diff --git a/public/settings.html b/public/settings.html index f973ef9..2116cfb 100644 --- a/public/settings.html +++ b/public/settings.html @@ -735,7 +735,7 @@ - + diff --git a/public/stakeholder-activities.html b/public/stakeholder-activities.html index 927b524..616c895 100644 --- a/public/stakeholder-activities.html +++ b/public/stakeholder-activities.html @@ -215,7 +215,7 @@ - + diff --git a/public/stakeholders.html b/public/stakeholders.html index aeff7ec..9f5feb2 100644 --- a/public/stakeholders.html +++ b/public/stakeholders.html @@ -210,7 +210,7 @@ - + diff --git a/public/supply-chain.html b/public/supply-chain.html index 07f2c89..9ba14ec 100644 --- a/public/supply-chain.html +++ b/public/supply-chain.html @@ -542,7 +542,7 @@ - + diff --git a/public/training.html b/public/training.html index 65dc15e..e16ee56 100644 --- a/public/training.html +++ b/public/training.html @@ -190,7 +190,7 @@ - + diff --git a/public/whistleblowing.html b/public/whistleblowing.html index 38077f6..ac7ac46 100644 --- a/public/whistleblowing.html +++ b/public/whistleblowing.html @@ -258,7 +258,7 @@ - + diff --git a/public/workflow.html b/public/workflow.html index 4e1fa1d..89c311d 100644 --- a/public/workflow.html +++ b/public/workflow.html @@ -143,7 +143,7 @@ - +