[FIX] api.js: sessione scaduta → login invece di pagina bloccata "--"

Bug segnalato da un tester "sono tornato su nis2 e non funziona più" (utente/
aziende "--", inventario bloccato su Caricamento, niente FAB segnalazioni).
Causa: un 401 su /auth/refresh (refresh token scaduto/invalido) rientrava nel
handler di refresh (la condizione non escludeva l'endpoint auth) → ricorsione:
doRefreshToken() non ritornava mai, quindi logout()/redirect a login non
scattava e la pagina restava rotta. Riprodotto con puppeteer (access scaduto +
refresh invalido → dashboard "--" identica allo screenshot).

Fix: escludi /auth/refresh e /auth/login dall'auto-refresh; inoltre un 401 senza
refresh token disponibile fa logout() → login. Ora un utente che torna dopo la
scadenza del token viene mandato a login (ri-accede) invece di vedere "--".
Bug PRE-ESISTENTE in api.js (non introdotto dal V3), critico ora col push tester.
Cache-buster api.js ?v=20260627u su tutte le pagine.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

public/_app-bi-demo.html

@@ -70,7 +70,7 @@
     </script>
 
     <!-- Stessa logica della app: api.js + common.js (helper) + common-bi.js (override BI) -->
-    <script src="js/api.js?v=20260631"></script>
+    <script src="js/api.js?v=20260627u"></script>
     <script src="js/common.js?v=20260624g"></script>
     <script src="js/common-bi.js?v=20260625d"></script>
     <script>

public/admin/index.html

@@ -162,7 +162,7 @@
     </main>
 
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide → topnav-v3.js (chrome) → i18n → init pagina -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/admin/organizations.html

@@ -85,7 +85,7 @@
     </main>
 
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide → topnav-v3.js (chrome) → i18n → init pagina -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/admin/users.html

@@ -92,7 +92,7 @@
     </main>
 
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide → topnav-v3.js (chrome) → i18n → init pagina -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/architecture.html

@@ -1122,7 +1122,7 @@
 
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/assessment.html

@@ -270,7 +270,7 @@
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help. La logica
          pagina (wizard GAP) resta inline: usa gli stessi id/funzioni di prima. -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/assets.html

@@ -377,7 +377,7 @@
 
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → pagina -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/calendario.html

@@ -190,7 +190,7 @@
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help. La logica del
          calendario (aggregatore read-only) resta inline e usa gli stessi id/funzioni. -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/companies.html

@@ -139,7 +139,7 @@
     </main>
 
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide → topnav-v3.js (chrome) → i18n → help → init pagina -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/competenze.html

@@ -192,7 +192,7 @@
     </div>
 
     <!-- Scripts V3. competenze.js si auto-inizializza su DOMContentLoaded (checkAuth/loadSidebar/I18n/Help). -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/connettori-discovery.html

@@ -98,7 +98,7 @@
 
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → pagina -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/controlli-periodici.html

@@ -155,7 +155,7 @@
 
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → init pagina -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/cross-analysis.html

@@ -222,7 +222,7 @@
 
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → init pagina -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/dashboard.html

@@ -112,7 +112,7 @@
     <!-- Scripts V3: api.js (client REST, prima) → common.js (helper+FAB reali) →
          Lucide self-host → topnav-v3.js (chrome, ridefinisce loadSidebar) →
          i18n → help → dashboard.js -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/forgot-password.html

@@ -73,7 +73,7 @@
     </script>
 
     <!-- Stessa logica della forgot-password.html: ZERO modifiche backend -->
-    <script src="js/api.js?v=20260631"></script>
+    <script src="js/api.js?v=20260627u"></script>
     <script>
         const form  = document.getElementById('forgot-form');
         const err   = document.getElementById('err');

public/guida.html

@@ -1177,7 +1177,7 @@
 
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/incidents.html

@@ -359,7 +359,7 @@
 
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → pagina -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/integrazioniext.html

@@ -931,7 +931,7 @@ curl -H <span class="str">"X-API-Key: nis2_TUA_CHIAVE"</span> \
 
 <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
      topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help -->
-<script src="/js/api.js?v=20260625d"></script>
+<script src="/js/api.js?v=20260627u"></script>
 <script src="/js/common.js?v=20260627t"></script>
 <script src="/vendor/lucide/lucide.min.js"></script>
 <script src="/js/topnav-v3.js?v=20260627t"></script>

public/internal-audits.html

@@ -160,7 +160,7 @@
 
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → init pagina -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/isms.html

@@ -199,7 +199,7 @@
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → isms.js.
          isms.js si auto-inizializza su DOMContentLoaded (checkAuth/I18n/loadSidebar/Help/render). -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/js/api.js

@@ -40,12 +40,23 @@ class NIS2API {
             const response = await fetch(url, config);
             const json = await response.json();
 
-            // Token expired - try refresh
+            // Token expired - try refresh. ESCLUDI gli endpoint auth stessi: un 401 su
-            if (response.status === 401 && this.refreshToken && !options._isRetry) {
+            // /auth/refresh (refresh token scaduto/invalido) NON deve ri-triggerare il
+            // refresh → altrimenti ricorsione infinita, doRefreshToken() non ritorna mai,
+            // logout()/redirect non scatta e l'utente resta su una pagina rotta ("--").
+            // (Bug utente "sono tornato dopo un po'": access scaduto + refresh non valido.)
+            const isAuthEndpoint = endpoint === '/auth/refresh' || endpoint === '/auth/login';
+            if (response.status === 401 && !isAuthEndpoint && !options._isRetry) {
+                if (this.refreshToken) {
                     const refreshed = await this.doRefreshToken();
                     if (refreshed) {
                         return this.request(method, endpoint, data, { ...options, _isRetry: true });
                     }
+                    // refresh fallito → doRefreshToken() ha già fatto logout()+redirect a login
+                } else {
+                    // 401 senza refresh token → sessione non recuperabile → vai a login
+                    this.logout();
+                }
             }
 
             if (!json.success && !options.silent) {

public/kb.html

@@ -175,7 +175,7 @@
 
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → kb.js -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/licenseExt.html

@@ -515,7 +515,7 @@ body { background: var(--bg-main); }
 
 <div id="toast"></div>
 
-<script src="js/api.js?v=20260631"></script>
+<script src="js/api.js?v=20260627u"></script>
 <script>
 // ══════════════════════════════════════════════════════
 // CONFIG

public/login.html

@@ -94,7 +94,7 @@
     </script>
 
     <!-- Stessa logica della login attuale: ZERO modifiche backend -->
-    <script src="js/api.js?v=20260631"></script>
+    <script src="js/api.js?v=20260627u"></script>
     <script src="js/common.js?v=20260624g"></script>
     <script>
         if (api.isAuthenticated()) { window.location.href = 'dashboard.html'; }

public/management-review.html

@@ -147,7 +147,7 @@
 
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → init pagina -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/misure-requisiti.html

@@ -175,7 +175,7 @@
     </div>
 
     <!-- Scripts V3 (ordine ESATTO come dashboard.html) -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/normative.html

@@ -137,7 +137,7 @@
     </main>
 
     <!-- Scripts V3 (ordine ESATTO come dashboard.html) -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/onboarding.html

@@ -494,7 +494,7 @@
     </script>
 
     <!-- Stessa logica della onboarding.html: ZERO modifiche backend -->
-    <script src="js/api.js?v=20260631"></script>
+    <script src="js/api.js?v=20260627u"></script>
     <script src="js/common.js?v=20260624g"></script>
     <script>
         // ── Auth check ──────────────────────────────────────────────────

public/organigramma.html

@@ -151,7 +151,7 @@
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → organigramma.js.
          organigramma.js si auto-inizializza su DOMContentLoaded (checkAuth/loadSidebar/I18n/Help). -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/policies.html

@@ -340,7 +340,7 @@
 
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → pagina -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/raci.html

@@ -141,7 +141,7 @@
     </main>
 
     <!-- Scripts V3. raci.js si auto-inizializza su DOMContentLoaded (checkAuth/loadSidebar/I18n/Help). -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/register.html

@@ -268,7 +268,7 @@
     </script>
 
     <!-- Stessa logica della register.html: ZERO modifiche backend -->
-    <script src="js/api.js?v=20260631"></script>
+    <script src="js/api.js?v=20260627u"></script>
     <script src="js/common.js?v=20260624g"></script>
     <script>
         if (api.isAuthenticated()) { window.location.href = 'dashboard.html'; }

public/reports.html

@@ -232,7 +232,7 @@
 
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → init pagina -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/review-schedule.html

@@ -157,7 +157,7 @@
     </div>
 
     <!-- Scripts V3 (ordine ESATTO come dashboard.html) -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/risks.html

@@ -502,7 +502,7 @@
 
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → pagina -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/settings.html

@@ -735,7 +735,7 @@
     <!-- Scripts V3: api.js (client REST, prima) → common.js (helper+FAB reali) →
          Lucide self-host → topnav-v3.js (chrome, ridefinisce loadSidebar) →
          i18n → help → init pagina (inline, invariato). -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/stakeholder-activities.html

@@ -215,7 +215,7 @@
 
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → init pagina -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/stakeholders.html

@@ -210,7 +210,7 @@
 
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → init pagina -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/supply-chain.html

@@ -542,7 +542,7 @@
 
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → init pagina -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/training.html

@@ -190,7 +190,7 @@
     <!-- Scripts V3: api.js → common.js (helper+FAB reali+showModal/showNotification) →
          Lucide self-host → topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help.
          La logica della pagina e' inline (nessun training.js): preservata invariata. -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/whistleblowing.html

@@ -258,7 +258,7 @@
 
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → init pagina -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>

public/workflow.html

@@ -143,7 +143,7 @@
 
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → init pagina. -->
-    <script src="/js/api.js?v=20260625d"></script>
+    <script src="/js/api.js?v=20260627u"></script>
     <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
     <script src="/js/topnav-v3.js?v=20260627t"></script>