[FEAT] ISO-readiness: Audit interni (§9.2) + Riesame Direzione (§9.3) + Calendario scadenze (mig.055-056, v1.22.0)
Rilascio unico (3 moduli) costruito in flotta parallela + verifica avversariale. MODULO A — Audit interni (ISO 27001 §9.2, mig.055): internal_audits + internal_audit_items; codice AUD-NNN; checklist pre-popolata (clausole 4-10 + Annex A applicabili dal SoA); esiti per riga; apertura non conformità collegata a NCR/CAPA (source polimorfico); report HTML stampabile. InternalAuditController + internal-audits.html. MODULO B — Riesame di Direzione (ISO 27001 §9.3, mig.056): management_reviews + management_review_decisions; codice RD-AAAA-NN; INPUT aggregati automaticamente dai moduli (gather: NC/CAPA, audit interni, rischi+trattamenti, KPI/score, obiettivi, formazione, stakeholder, normative, scadenze), congelati nello snapshot all'approvazione; decisioni; verbale stampabile. ManagementReviewController + management-review.html. MODULO C — Calendario unico scadenze: aggregatore SOLA LETTURA (nessuna migrazione) di tutte le scadenze (incidenti/policy/rischi/NC-CAPA/formazione/stakeholder/audit/riesame/review_schedule), griglia mensile + lista + filtri + deep-link. CalendarController + calendario.html. Integrazione: router (3 controller+actionMap), api.js, sidebar V2+legacy, help.js (3 sezioni), i18n (IT+EN), review_schedule ENUM += internal_audit. v1.22.0 + sw cache + cache-buster 20260630. Verifica flotta (28 agenti, 4 dim + avversariale): 9 finding confermati, TUTTI corretti — MAJOR gatherRisks (risk_treatments.organization_id inesistente → JOIN risks); nextCode numerico (no dup >99/anno); footer report audit con etichetta "ISO buona prassi, non obbligo"; help 24→25 clausole; ARIA tab/calendario; focus modali; tasti su celle calendario; rimossi helper api morti. Smoke prod OK (calendario 18 eventi, audit AUD-001 25 item + report + audit→NCR + audit→calendario, riesame gather/decisione/approve/report, gatherRisks ora available); org 151 ripulita. Additivo. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
DevEnv nis2-agile
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
18a4a0b509
commit
79ca72fba9
@@ -0,0 +1,87 @@
|
||||
<?php
|
||||
/**
|
||||
* NIS2 Agile — DDL idempotente Audit interni (Modulo A, mig.055).
|
||||
* ----------------------------------------------------------------------------
|
||||
* Crea (se mancanti) le tabelle del modulo Audit interni (ISO 27001 §9.2):
|
||||
* - internal_audits (programma/sessioni di audit)
|
||||
* - internal_audit_items (checklist: clausole 4-10, Annex A, NIS2, custom)
|
||||
* NESSUN dato di sistema: le checklist sono pre-popolate per-org dal controller
|
||||
* al create (clausole statiche + Annex A dal SoA dell'org).
|
||||
*
|
||||
* Idempotente: CREATE TABLE IF NOT EXISTS (re-eseguibile senza errore).
|
||||
* Allineato a docs/sql/055_internal_audits.sql.
|
||||
*
|
||||
* Uso (dentro il container app):
|
||||
* docker exec nis2-app php /var/www/nis2-agile/application/cli/seed_internal_audits.php
|
||||
*/
|
||||
|
||||
if (PHP_SAPI !== 'cli') { http_response_code(403); exit("Solo da CLI.\n"); }
|
||||
|
||||
require_once __DIR__ . '/../config/env.php';
|
||||
require_once __DIR__ . '/../config/database.php';
|
||||
|
||||
$pdo = Database::getInstance();
|
||||
$pdo->exec("SET NAMES utf8mb4 COLLATE utf8mb4_unicode_ci");
|
||||
|
||||
$ddl = [
|
||||
"CREATE TABLE IF NOT EXISTS internal_audits (
|
||||
id INT NOT NULL AUTO_INCREMENT, organization_id INT NOT NULL,
|
||||
code VARCHAR(20) NULL, title VARCHAR(255) NOT NULL,
|
||||
scope TEXT NULL, criteria TEXT NULL,
|
||||
planned_date DATE NULL, executed_date DATE NULL,
|
||||
status ENUM('planned','in_progress','completed','cancelled') NOT NULL DEFAULT 'planned',
|
||||
lead_auditor_user_id INT NULL, lead_auditor_role_id INT NULL,
|
||||
conclusion TEXT NULL, created_by INT NULL,
|
||||
created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
||||
updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
|
||||
PRIMARY KEY (id), KEY idx_intaud_org (organization_id),
|
||||
CONSTRAINT fk_intaud_org FOREIGN KEY (organization_id) REFERENCES organizations (id) ON DELETE CASCADE,
|
||||
CONSTRAINT fk_intaud_lead_user FOREIGN KEY (lead_auditor_user_id) REFERENCES users (id) ON DELETE SET NULL,
|
||||
CONSTRAINT fk_intaud_lead_role FOREIGN KEY (lead_auditor_role_id) REFERENCES org_roles (id) ON DELETE SET NULL,
|
||||
CONSTRAINT fk_intaud_creator FOREIGN KEY (created_by) REFERENCES users (id) ON DELETE SET NULL
|
||||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
|
||||
|
||||
"CREATE TABLE IF NOT EXISTS internal_audit_items (
|
||||
id INT NOT NULL AUTO_INCREMENT, audit_id INT NOT NULL,
|
||||
ref_type ENUM('clause','annex_control','nis2_measure','custom') NOT NULL DEFAULT 'clause',
|
||||
ref_code VARCHAR(32) NULL, checkpoint TEXT NOT NULL,
|
||||
result ENUM('da_verificare','conforme','non_conforme','osservazione','opportunita','non_applicabile') NOT NULL DEFAULT 'da_verificare',
|
||||
note TEXT NULL, ord INT NOT NULL DEFAULT 0,
|
||||
PRIMARY KEY (id), KEY idx_intauditem_audit (audit_id),
|
||||
CONSTRAINT fk_intauditem_audit FOREIGN KEY (audit_id) REFERENCES internal_audits (id) ON DELETE CASCADE
|
||||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
|
||||
];
|
||||
|
||||
foreach ($ddl as $stmt) {
|
||||
try { $pdo->exec($stmt); }
|
||||
catch (PDOException $e) { if (!in_array($e->errorInfo[1] ?? 0, [1050, 1061], true)) { throw $e; } }
|
||||
}
|
||||
|
||||
// Estende l'ENUM del calendario (review_schedule) con 'internal_audit' così la
|
||||
// data pianificata dell'audit compare nel calendario NIS2. Idempotente in effetto.
|
||||
// Include i valori già introdotti da seeder precedenti (stakeholder_activity) per
|
||||
// non regredirli; se 'internal_audit' è già presente l'ALTER è un no-op.
|
||||
try {
|
||||
$cur = (string) $pdo->query("SELECT COLUMN_TYPE FROM information_schema.COLUMNS
|
||||
WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 'review_schedule' AND COLUMN_NAME = 'entity_type'")->fetchColumn();
|
||||
if (!str_contains($cur, "'internal_audit'")) {
|
||||
$vals = ['role','skill','inventory','procedure','risk','supplier','measure','custom','stakeholder_activity','internal_audit'];
|
||||
// conserva eventuali valori extra già presenti nell'ENUM corrente
|
||||
if (preg_match_all("/'([^']+)'/", $cur, $m)) {
|
||||
foreach ($m[1] as $v) { if (!in_array($v, $vals, true)) { $vals[] = $v; } }
|
||||
}
|
||||
$enum = "'" . implode("','", $vals) . "'";
|
||||
$pdo->exec("ALTER TABLE review_schedule MODIFY COLUMN entity_type ENUM($enum) NOT NULL");
|
||||
}
|
||||
} catch (PDOException $e) {
|
||||
fwrite(STDERR, "WARN ALTER review_schedule: " . $e->getMessage() . "\n");
|
||||
}
|
||||
|
||||
$counts = [];
|
||||
foreach (['internal_audits', 'internal_audit_items'] as $t) {
|
||||
$counts[$t] = (int) $pdo->query("SELECT COUNT(*) FROM $t")->fetchColumn();
|
||||
}
|
||||
$enum = $pdo->query("SELECT COLUMN_TYPE FROM information_schema.COLUMNS
|
||||
WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 'review_schedule' AND COLUMN_NAME = 'entity_type'")->fetchColumn();
|
||||
echo "OK seed-internal-audits — " . json_encode($counts, JSON_UNESCAPED_UNICODE) . "\n";
|
||||
echo "review_schedule.entity_type has internal_audit: " . (str_contains((string) $enum, 'internal_audit') ? 'YES' : 'NO') . "\n";
|
||||
@@ -0,0 +1,77 @@
|
||||
<?php
|
||||
/**
|
||||
* NIS2 Agile — DDL idempotente Riesame di Direzione (ISO 27001 §9.3, mig.056).
|
||||
* ----------------------------------------------------------------------------
|
||||
* Crea (se mancanti) le tabelle del Modulo B "Riesame di Direzione":
|
||||
* - management_reviews (il verbale: input aggregati congelati + esiti)
|
||||
* - management_review_decisions (decisioni/output → owner ruolo, scadenza, CAPA)
|
||||
*
|
||||
* NESSUN dato di sistema: i riesami sono per-org (creati dall'utente).
|
||||
*
|
||||
* Idempotente: CREATE TABLE IF NOT EXISTS (re-eseguibile senza errore; in caso
|
||||
* di tabella già presente ignora gli errno 1050/1061). Allineato a
|
||||
* docs/sql/056_management_reviews.sql.
|
||||
*
|
||||
* Uso (dentro il container app, o sull'host con la stessa connessione PDO):
|
||||
* docker exec nis2-app php /var/www/nis2-agile/application/cli/seed_management_reviews.php
|
||||
*/
|
||||
|
||||
if (PHP_SAPI !== 'cli') { http_response_code(403); exit("Solo da CLI.\n"); }
|
||||
|
||||
require_once __DIR__ . '/../config/env.php';
|
||||
require_once __DIR__ . '/../config/database.php';
|
||||
|
||||
$pdo = Database::getInstance();
|
||||
$pdo->exec("SET NAMES utf8mb4 COLLATE utf8mb4_unicode_ci");
|
||||
|
||||
$ddl = [
|
||||
"CREATE TABLE IF NOT EXISTS management_reviews (
|
||||
id INT NOT NULL AUTO_INCREMENT,
|
||||
organization_id INT NOT NULL,
|
||||
code VARCHAR(20) NULL,
|
||||
review_date DATE NULL,
|
||||
period_label VARCHAR(100) NULL,
|
||||
chair_user_id INT NULL,
|
||||
attendees JSON NULL,
|
||||
status ENUM('draft','approved') NOT NULL DEFAULT 'draft',
|
||||
approved_by INT NULL,
|
||||
approved_at DATETIME NULL,
|
||||
snapshot JSON NULL,
|
||||
conclusions TEXT NULL,
|
||||
created_by INT NULL,
|
||||
created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
||||
updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
|
||||
PRIMARY KEY (id),
|
||||
KEY idx_mgr_org (organization_id),
|
||||
CONSTRAINT fk_mgr_org FOREIGN KEY (organization_id) REFERENCES organizations (id) ON DELETE CASCADE,
|
||||
CONSTRAINT fk_mgr_chair FOREIGN KEY (chair_user_id) REFERENCES users (id) ON DELETE SET NULL,
|
||||
CONSTRAINT fk_mgr_approved FOREIGN KEY (approved_by) REFERENCES users (id) ON DELETE SET NULL,
|
||||
CONSTRAINT fk_mgr_creator FOREIGN KEY (created_by) REFERENCES users (id) ON DELETE SET NULL
|
||||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
|
||||
|
||||
"CREATE TABLE IF NOT EXISTS management_review_decisions (
|
||||
id INT NOT NULL AUTO_INCREMENT,
|
||||
review_id INT NOT NULL,
|
||||
decision TEXT NOT NULL,
|
||||
owner_role_id INT NULL,
|
||||
due_date DATE NULL,
|
||||
status ENUM('open','in_progress','done') NOT NULL DEFAULT 'open',
|
||||
capa_id INT NULL,
|
||||
ord INT NOT NULL DEFAULT 0,
|
||||
PRIMARY KEY (id),
|
||||
KEY idx_mrd_review (review_id),
|
||||
CONSTRAINT fk_mrd_review FOREIGN KEY (review_id) REFERENCES management_reviews (id) ON DELETE CASCADE,
|
||||
CONSTRAINT fk_mrd_owner FOREIGN KEY (owner_role_id) REFERENCES org_roles (id) ON DELETE SET NULL
|
||||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
|
||||
];
|
||||
|
||||
foreach ($ddl as $stmt) {
|
||||
try { $pdo->exec($stmt); }
|
||||
catch (PDOException $e) { if (!in_array($e->errorInfo[1] ?? 0, [1050, 1061], true)) { throw $e; } }
|
||||
}
|
||||
|
||||
$counts = [];
|
||||
foreach (['management_reviews', 'management_review_decisions'] as $t) {
|
||||
$counts[$t] = (int) $pdo->query("SELECT COUNT(*) FROM $t")->fetchColumn();
|
||||
}
|
||||
echo "OK seed-management-reviews — " . json_encode($counts, JSON_UNESCAPED_UNICODE) . "\n";
|
||||
@@ -0,0 +1,470 @@
|
||||
<?php
|
||||
/**
|
||||
* NIS2 Agile - Calendario unico delle scadenze (Modulo C)
|
||||
* ----------------------------------------------------------------------------
|
||||
* AGGREGATORE IN SOLA LETTURA. Nessuna tabella propria, nessuna migrazione: le
|
||||
* scadenze vivono gia' nei moduli sorgente, ciascuna col proprio ciclo di vita.
|
||||
* Questo controller fa una UNION LIVE di TUTTE le sorgenti e normalizza ogni
|
||||
* evento in una forma unica:
|
||||
* { source, type, title, date (YYYY-MM-DD), status, severity, entity_type,
|
||||
* entity_id, link }
|
||||
* dove status e' calcolato LIVE confrontando la data con oggi (come review_schedule):
|
||||
* - done = scadenza gia' assolta/chiusa
|
||||
* - overdue = data < oggi e non assolta
|
||||
* - due_soon = data entro 14 giorni da oggi
|
||||
* - upcoming = data oltre 14 giorni
|
||||
*
|
||||
* Generalizza il pattern di DashboardController::deadlines() su TUTTE le sorgenti.
|
||||
* Ogni sorgente e' racchiusa in un try/catch DIFENSIVO: alcune tabelle (Modulo A
|
||||
* internal_audits, Modulo B management_reviews) potrebbero non esistere ancora, e
|
||||
* il calendario deve continuare a funzionare comunque (degrada solo quella fonte).
|
||||
*
|
||||
* Multi-tenancy: OGNI query filtra organization_id (anti-IDOR). Sola lettura →
|
||||
* requireOrgAccess(). NOTE: Database::query/fetchAll/fetchOne; jsonSuccess/Error exit.
|
||||
*/
|
||||
|
||||
require_once __DIR__ . '/BaseController.php';
|
||||
|
||||
class CalendarController extends BaseController
|
||||
{
|
||||
/** Soglia "in scadenza": eventi entro N giorni da oggi (inclusi) sono due_soon. */
|
||||
private const DUE_SOON_DAYS = 14;
|
||||
|
||||
/** Tipi noti (per la validazione del filtro ?types= e per la legenda frontend). */
|
||||
private const KNOWN_TYPES = [
|
||||
'incident_early_warning', 'incident_notification', 'incident_final_report',
|
||||
'policy_review', 'risk_treatment', 'control_review',
|
||||
'nc_target_close', 'capa_action', 'training_due',
|
||||
'stakeholder_activity', 'review_schedule',
|
||||
'internal_audit', 'management_review_decision',
|
||||
];
|
||||
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
// GET /api/calendar/events?from=YYYY-MM-DD&to=YYYY-MM-DD&types=csv
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
public function events(): void
|
||||
{
|
||||
$this->requireOrgAccess();
|
||||
$orgId = $this->getCurrentOrgId();
|
||||
|
||||
[$from, $to] = $this->resolveRange();
|
||||
$typeFilter = $this->resolveTypeFilter();
|
||||
|
||||
$events = $this->collect($orgId, $from, $to);
|
||||
|
||||
// Filtro per tipo richiesto (applicato in PHP, gli eventi sono pochi per org).
|
||||
if ($typeFilter !== null) {
|
||||
$events = array_values(array_filter($events, static fn($e) => in_array($e['type'], $typeFilter, true)));
|
||||
}
|
||||
|
||||
// Ordina: overdue prima, poi per data crescente.
|
||||
usort($events, static function ($a, $b) {
|
||||
$oa = $a['status'] === 'overdue' ? 0 : 1;
|
||||
$ob = $b['status'] === 'overdue' ? 0 : 1;
|
||||
if ($oa !== $ob) { return $oa <=> $ob; }
|
||||
return strcmp($a['date'], $b['date']);
|
||||
});
|
||||
|
||||
$this->jsonSuccess([
|
||||
'from' => $from,
|
||||
'to' => $to,
|
||||
'today' => date('Y-m-d'),
|
||||
'due_soon_days'=> self::DUE_SOON_DAYS,
|
||||
'known_types' => self::KNOWN_TYPES,
|
||||
'count' => count($events),
|
||||
'events' => $events,
|
||||
]);
|
||||
}
|
||||
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
// GET /api/calendar/summary — conteggi per stato (e per tipo)
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
public function summary(): void
|
||||
{
|
||||
$this->requireOrgAccess();
|
||||
$orgId = $this->getCurrentOrgId();
|
||||
|
||||
[$from, $to] = $this->resolveRange();
|
||||
$events = $this->collect($orgId, $from, $to);
|
||||
|
||||
$byStatus = ['overdue' => 0, 'due_soon' => 0, 'upcoming' => 0, 'done' => 0];
|
||||
$byType = [];
|
||||
foreach ($events as $e) {
|
||||
$byStatus[$e['status']] = ($byStatus[$e['status']] ?? 0) + 1;
|
||||
$byType[$e['type']] = ($byType[$e['type']] ?? 0) + 1;
|
||||
}
|
||||
// Aperte = tutte tranne done (utile come badge dashboard).
|
||||
$open = $byStatus['overdue'] + $byStatus['due_soon'] + $byStatus['upcoming'];
|
||||
|
||||
$this->jsonSuccess([
|
||||
'from' => $from,
|
||||
'to' => $to,
|
||||
'today' => date('Y-m-d'),
|
||||
'total' => count($events),
|
||||
'open' => $open,
|
||||
'by_status' => $byStatus,
|
||||
'by_type' => $byType,
|
||||
]);
|
||||
}
|
||||
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
// RACCOLTA — UNION di tutte le sorgenti, ognuna difensiva (try/catch)
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
|
||||
/**
|
||||
* Raccoglie e normalizza tutti gli eventi della finestra [from,to] per l'org.
|
||||
* Ogni sorgente che fallisce (tabella/colonna mancante) viene saltata senza
|
||||
* far cadere l'intero calendario.
|
||||
*/
|
||||
private function collect(int $orgId, string $from, string $to): array
|
||||
{
|
||||
$events = [];
|
||||
$sources = [
|
||||
'incidents' => fn() => $this->srcIncidents($orgId, $from, $to),
|
||||
'policies' => fn() => $this->srcPolicies($orgId, $from, $to),
|
||||
'risk_treatments' => fn() => $this->srcRiskTreatments($orgId, $from, $to),
|
||||
'controls' => fn() => $this->srcControls($orgId, $from, $to),
|
||||
'non_conformities' => fn() => $this->srcNonConformities($orgId, $from, $to),
|
||||
'capa_actions' => fn() => $this->srcCapaActions($orgId, $from, $to),
|
||||
'training' => fn() => $this->srcTraining($orgId, $from, $to),
|
||||
'stk_activities' => fn() => $this->srcStkActivities($orgId, $from, $to),
|
||||
'review_schedule' => fn() => $this->srcReviewSchedule($orgId, $from, $to),
|
||||
'internal_audits' => fn() => $this->srcInternalAudits($orgId, $from, $to),
|
||||
'mgmt_reviews' => fn() => $this->srcManagementReviewDecisions($orgId, $from, $to),
|
||||
];
|
||||
foreach ($sources as $rows) {
|
||||
try {
|
||||
foreach ($rows() as $ev) {
|
||||
if ($ev !== null) { $events[] = $ev; }
|
||||
}
|
||||
} catch (\Throwable $e) {
|
||||
// Sorgente non disponibile (es. tabella di un modulo non ancora migrato):
|
||||
// si ignora senza compromettere le altre fonti.
|
||||
continue;
|
||||
}
|
||||
}
|
||||
return $events;
|
||||
}
|
||||
|
||||
/** Incidenti Art.23: early_warning / notification / final_report (datetime). */
|
||||
private function srcIncidents(int $orgId, string $from, string $to): array
|
||||
{
|
||||
$rows = Database::fetchAll(
|
||||
'SELECT id, title, severity,
|
||||
early_warning_due, early_warning_sent_at,
|
||||
notification_due, notification_sent_at,
|
||||
final_report_due, final_report_sent_at
|
||||
FROM incidents
|
||||
WHERE organization_id = ? AND is_significant = 1
|
||||
AND status NOT IN ("closed", "post_mortem")',
|
||||
[$orgId]
|
||||
);
|
||||
$out = [];
|
||||
foreach ($rows as $r) {
|
||||
if ($r['early_warning_due'] && !$r['early_warning_sent_at']) {
|
||||
$out[] = $this->makeEvent('incidents', 'incident_early_warning',
|
||||
'Early Warning: ' . $r['title'], $r['early_warning_due'],
|
||||
'critical', 'incident', (int) $r['id'], '/incidents.html', $from, $to, false);
|
||||
}
|
||||
if ($r['notification_due'] && !$r['notification_sent_at']) {
|
||||
$out[] = $this->makeEvent('incidents', 'incident_notification',
|
||||
'Notifica CSIRT: ' . $r['title'], $r['notification_due'],
|
||||
'high', 'incident', (int) $r['id'], '/incidents.html', $from, $to, false);
|
||||
}
|
||||
if ($r['final_report_due'] && !$r['final_report_sent_at']) {
|
||||
$out[] = $this->makeEvent('incidents', 'incident_final_report',
|
||||
'Report finale: ' . $r['title'], $r['final_report_due'],
|
||||
'medium', 'incident', (int) $r['id'], '/incidents.html', $from, $to, false);
|
||||
}
|
||||
}
|
||||
return array_values(array_filter($out));
|
||||
}
|
||||
|
||||
/** Revisione policy/procedure: policies.next_review_date (status != archived). */
|
||||
private function srcPolicies(int $orgId, string $from, string $to): array
|
||||
{
|
||||
$rows = Database::fetchAll(
|
||||
'SELECT id, title, next_review_date
|
||||
FROM policies
|
||||
WHERE organization_id = ? AND next_review_date IS NOT NULL
|
||||
AND status NOT IN ("archived")',
|
||||
[$orgId]
|
||||
);
|
||||
$out = [];
|
||||
foreach ($rows as $r) {
|
||||
$out[] = $this->makeEvent('policies', 'policy_review',
|
||||
'Revisione policy: ' . $r['title'], $r['next_review_date'],
|
||||
'medium', 'policy', (int) $r['id'], '/policies.html', $from, $to, false);
|
||||
}
|
||||
return array_values(array_filter($out));
|
||||
}
|
||||
|
||||
/** Trattamenti rischio: risk_treatments.due_date JOIN risks (org via risks). */
|
||||
private function srcRiskTreatments(int $orgId, string $from, string $to): array
|
||||
{
|
||||
$rows = Database::fetchAll(
|
||||
'SELECT rt.id, rt.due_date, r.title AS risk_title
|
||||
FROM risk_treatments rt
|
||||
JOIN risks r ON r.id = rt.risk_id
|
||||
WHERE r.organization_id = ? AND rt.status IN ("planned", "in_progress")
|
||||
AND rt.due_date IS NOT NULL',
|
||||
[$orgId]
|
||||
);
|
||||
$out = [];
|
||||
foreach ($rows as $r) {
|
||||
$out[] = $this->makeEvent('risk_treatments', 'risk_treatment',
|
||||
'Trattamento rischio: ' . $r['risk_title'], $r['due_date'],
|
||||
'medium', 'risk_treatment', (int) $r['id'], '/risks.html', $from, $to, false);
|
||||
}
|
||||
return array_values(array_filter($out));
|
||||
}
|
||||
|
||||
/** Revisione controlli: compliance_controls.next_review_date (non verificati/in corso). */
|
||||
private function srcControls(int $orgId, string $from, string $to): array
|
||||
{
|
||||
$rows = Database::fetchAll(
|
||||
'SELECT id, control_code, title, next_review_date, status
|
||||
FROM compliance_controls
|
||||
WHERE organization_id = ? AND next_review_date IS NOT NULL',
|
||||
[$orgId]
|
||||
);
|
||||
$out = [];
|
||||
foreach ($rows as $r) {
|
||||
$title = trim((string) $r['control_code'] . ' ' . (string) $r['title']);
|
||||
$out[] = $this->makeEvent('compliance_controls', 'control_review',
|
||||
'Revisione controllo: ' . $title, $r['next_review_date'],
|
||||
'medium', 'compliance_control', (int) $r['id'], '/reports.html', $from, $to, false);
|
||||
}
|
||||
return array_values(array_filter($out));
|
||||
}
|
||||
|
||||
/** Non conformita': non_conformities.target_close_date (status non chiuso). */
|
||||
private function srcNonConformities(int $orgId, string $from, string $to): array
|
||||
{
|
||||
$rows = Database::fetchAll(
|
||||
'SELECT id, ncr_code, title, target_close_date
|
||||
FROM non_conformities
|
||||
WHERE organization_id = ? AND target_close_date IS NOT NULL
|
||||
AND status NOT IN ("closed", "cancelled")',
|
||||
[$orgId]
|
||||
);
|
||||
$out = [];
|
||||
foreach ($rows as $r) {
|
||||
$title = trim((string) $r['ncr_code'] . ' ' . (string) $r['title']);
|
||||
$out[] = $this->makeEvent('non_conformities', 'nc_target_close',
|
||||
'Chiusura NC: ' . $title, $r['target_close_date'],
|
||||
'high', 'non_conformity', (int) $r['id'], '/reports.html', $from, $to, false);
|
||||
}
|
||||
return array_values(array_filter($out));
|
||||
}
|
||||
|
||||
/** Azioni correttive: capa_actions.due_date (status non completed/verified). */
|
||||
private function srcCapaActions(int $orgId, string $from, string $to): array
|
||||
{
|
||||
$rows = Database::fetchAll(
|
||||
'SELECT id, capa_code, title, due_date
|
||||
FROM capa_actions
|
||||
WHERE organization_id = ? AND due_date IS NOT NULL
|
||||
AND status NOT IN ("completed", "verified")',
|
||||
[$orgId]
|
||||
);
|
||||
$out = [];
|
||||
foreach ($rows as $r) {
|
||||
$title = trim((string) $r['capa_code'] . ' ' . (string) $r['title']);
|
||||
$out[] = $this->makeEvent('capa_actions', 'capa_action',
|
||||
'Azione correttiva: ' . $title, $r['due_date'],
|
||||
'medium', 'capa_action', (int) $r['id'], '/reports.html', $from, $to, false);
|
||||
}
|
||||
return array_values(array_filter($out));
|
||||
}
|
||||
|
||||
/** Formazione: training_assignments.due_date (status assigned/in_progress). */
|
||||
private function srcTraining(int $orgId, string $from, string $to): array
|
||||
{
|
||||
$rows = Database::fetchAll(
|
||||
'SELECT ta.id, ta.due_date, tc.title, u.full_name
|
||||
FROM training_assignments ta
|
||||
JOIN training_courses tc ON tc.id = ta.course_id
|
||||
LEFT JOIN users u ON u.id = ta.user_id
|
||||
WHERE ta.organization_id = ? AND ta.status IN ("assigned", "in_progress")
|
||||
AND ta.due_date IS NOT NULL',
|
||||
[$orgId]
|
||||
);
|
||||
$out = [];
|
||||
foreach ($rows as $r) {
|
||||
$who = $r['full_name'] ? (' - ' . $r['full_name']) : '';
|
||||
$out[] = $this->makeEvent('training', 'training_due',
|
||||
'Formazione: ' . $r['title'] . $who, $r['due_date'],
|
||||
'low', 'training', (int) $r['id'], '/training.html', $from, $to, false);
|
||||
}
|
||||
return array_values(array_filter($out));
|
||||
}
|
||||
|
||||
/**
|
||||
* Attivita' stakeholder (C5.2): stk_activities.due_date (preferita) e, se assente,
|
||||
* planned_date. Esclude annullate/completate. due_date "assolta" se completed.
|
||||
*/
|
||||
private function srcStkActivities(int $orgId, string $from, string $to): array
|
||||
{
|
||||
$rows = Database::fetchAll(
|
||||
'SELECT id, title, type, planned_date, due_date, status
|
||||
FROM stk_activities
|
||||
WHERE organization_id = ? AND status NOT IN ("cancelled")',
|
||||
[$orgId]
|
||||
);
|
||||
$out = [];
|
||||
foreach ($rows as $r) {
|
||||
$done = ($r['status'] === 'completed');
|
||||
$date = $r['due_date'] ?: $r['planned_date'];
|
||||
if (!$date) { continue; }
|
||||
$label = ($r['due_date'] ? 'Scadenza attivita': 'Attivita pianificata') . ': ' . $r['title'];
|
||||
$out[] = $this->makeEvent('stk_activities', 'stakeholder_activity',
|
||||
$label, $date, 'medium', 'stk_activity', (int) $r['id'],
|
||||
'/stakeholder-activities.html', $from, $to, $done);
|
||||
}
|
||||
return array_values(array_filter($out));
|
||||
}
|
||||
|
||||
/** Scadenziario revisioni periodiche (A4 4.4): review_schedule.next_review_date. */
|
||||
private function srcReviewSchedule(int $orgId, string $from, string $to): array
|
||||
{
|
||||
$rows = Database::fetchAll(
|
||||
'SELECT id, title, entity_type, next_review_date, last_reviewed_at
|
||||
FROM review_schedule
|
||||
WHERE organization_id = ? AND next_review_date IS NOT NULL',
|
||||
[$orgId]
|
||||
);
|
||||
$out = [];
|
||||
foreach ($rows as $r) {
|
||||
$out[] = $this->makeEvent('review_schedule', 'review_schedule',
|
||||
$r['title'], $r['next_review_date'],
|
||||
'medium', 'review_schedule', (int) $r['id'], '/review-schedule.html', $from, $to, false);
|
||||
}
|
||||
return array_values(array_filter($out));
|
||||
}
|
||||
|
||||
/** Audit interni (Modulo A, opzionale): internal_audits.planned_date. */
|
||||
private function srcInternalAudits(int $orgId, string $from, string $to): array
|
||||
{
|
||||
$rows = Database::fetchAll(
|
||||
'SELECT id, code, title, planned_date, status
|
||||
FROM internal_audits
|
||||
WHERE organization_id = ? AND planned_date IS NOT NULL',
|
||||
[$orgId]
|
||||
);
|
||||
$out = [];
|
||||
foreach ($rows as $r) {
|
||||
$done = in_array($r['status'], ['completed', 'cancelled'], true);
|
||||
$title = trim((string) $r['code'] . ' ' . (string) $r['title']);
|
||||
$out[] = $this->makeEvent('internal_audits', 'internal_audit',
|
||||
'Audit interno: ' . $title, $r['planned_date'],
|
||||
'medium', 'internal_audit', (int) $r['id'], '/internal-audits.html', $from, $to, $done);
|
||||
}
|
||||
return array_values(array_filter($out));
|
||||
}
|
||||
|
||||
/**
|
||||
* Decisioni del riesame di direzione (Modulo B, opzionale):
|
||||
* management_review_decisions.due_date JOIN management_reviews per filtrare per org.
|
||||
*/
|
||||
private function srcManagementReviewDecisions(int $orgId, string $from, string $to): array
|
||||
{
|
||||
$rows = Database::fetchAll(
|
||||
'SELECT d.id, d.decision, d.due_date, d.status, mr.code AS review_code
|
||||
FROM management_review_decisions d
|
||||
JOIN management_reviews mr ON mr.id = d.review_id
|
||||
WHERE mr.organization_id = ? AND d.due_date IS NOT NULL',
|
||||
[$orgId]
|
||||
);
|
||||
$out = [];
|
||||
foreach ($rows as $r) {
|
||||
$done = ($r['status'] === 'done');
|
||||
$txt = mb_substr((string) $r['decision'], 0, 120);
|
||||
$out[] = $this->makeEvent('management_reviews', 'management_review_decision',
|
||||
'Decisione riesame: ' . $txt, $r['due_date'],
|
||||
'medium', 'management_review_decision', (int) $r['id'],
|
||||
'/management-review.html', $from, $to, $done);
|
||||
}
|
||||
return array_values(array_filter($out));
|
||||
}
|
||||
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
// HELPER
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
|
||||
/**
|
||||
* Normalizza una riga in evento di calendario. Ritorna null se la data
|
||||
* (normalizzata a Y-m-d) cade fuori dalla finestra [from,to]. $done forza
|
||||
* lo status a 'done' (scadenza gia' assolta/chiusa), altrimenti lo calcola
|
||||
* LIVE rispetto a oggi.
|
||||
*/
|
||||
private function makeEvent(
|
||||
string $source, string $type, string $title, ?string $rawDate,
|
||||
string $severity, string $entityType, int $entityId, string $link,
|
||||
string $from, string $to, bool $done
|
||||
): ?array {
|
||||
if (!$rawDate) { return null; }
|
||||
$date = substr((string) $rawDate, 0, 10); // DATETIME o DATE → Y-m-d
|
||||
if (!preg_match('/^\d{4}-\d{2}-\d{2}$/', $date)) { return null; }
|
||||
if ($date < $from || $date > $to) { return null; }
|
||||
|
||||
return [
|
||||
'source' => $source,
|
||||
'type' => $type,
|
||||
'title' => mb_substr($title, 0, 255),
|
||||
'date' => $date,
|
||||
'status' => $this->computeStatus($date, $done),
|
||||
'severity' => $severity,
|
||||
'entity_type' => $entityType,
|
||||
'entity_id' => $entityId,
|
||||
'link' => $link,
|
||||
];
|
||||
}
|
||||
|
||||
/** Stato LIVE: done | overdue | due_soon (<=N gg) | upcoming. */
|
||||
private function computeStatus(string $date, bool $done): string
|
||||
{
|
||||
if ($done) { return 'done'; }
|
||||
$today = new DateTimeImmutable('today');
|
||||
$d = DateTimeImmutable::createFromFormat('!Y-m-d', $date);
|
||||
if (!$d) { return 'upcoming'; }
|
||||
$diffDays = (int) $today->diff($d)->format('%r%a');
|
||||
if ($diffDays < 0) { return 'overdue'; }
|
||||
if ($diffDays <= self::DUE_SOON_DAYS) { return 'due_soon'; }
|
||||
return 'upcoming';
|
||||
}
|
||||
|
||||
/**
|
||||
* Risolve la finestra [from,to]. Default ampio: dal 1° giorno di 1 mese fa al
|
||||
* 1° giorno di 13 mesi avanti (copre tutto cio' che ha senso vedere in un
|
||||
* calendario annuale). Param from/to opzionali sovrascrivono (validati Y-m-d).
|
||||
*/
|
||||
private function resolveRange(): array
|
||||
{
|
||||
$from = $this->validDate($this->getParam('from'));
|
||||
$to = $this->validDate($this->getParam('to'));
|
||||
if (!$from) { $from = (new DateTimeImmutable('first day of this month'))->modify('-1 month')->format('Y-m-d'); }
|
||||
if (!$to) { $to = (new DateTimeImmutable('first day of this month'))->modify('+13 months')->format('Y-m-d'); }
|
||||
if ($from > $to) { [$from, $to] = [$to, $from]; }
|
||||
return [$from, $to];
|
||||
}
|
||||
|
||||
/** Filtro tipi: ?types=a,b,c → solo i tipi noti; null = nessun filtro. */
|
||||
private function resolveTypeFilter(): ?array
|
||||
{
|
||||
$raw = $this->getParam('types');
|
||||
if ($raw === null || $raw === '') { return null; }
|
||||
$parts = array_filter(array_map('trim', explode(',', (string) $raw)), static fn($t) => $t !== '');
|
||||
$valid = array_values(array_intersect($parts, self::KNOWN_TYPES));
|
||||
return $valid ?: null;
|
||||
}
|
||||
|
||||
/** Valida una data Y-m-d; ritorna la stringa normalizzata o null. */
|
||||
private function validDate($v): ?string
|
||||
{
|
||||
if ($v === null || $v === '') { return null; }
|
||||
$s = trim((string) $v);
|
||||
$dt = DateTime::createFromFormat('Y-m-d', $s);
|
||||
return ($dt && $dt->format('Y-m-d') === $s) ? $s : null;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,633 @@
|
||||
<?php
|
||||
/**
|
||||
* NIS2 Agile - Audit interni (ISO 27001 §9.2) — MODULO A
|
||||
* ----------------------------------------------------------------------------
|
||||
* Ciclo audit interno: programma -> checklist di conduzione -> esiti -> finding NC.
|
||||
* - PROGRAMMA: internal_audits (code AUD-NNN progressivo per org, scope, criteri,
|
||||
* auditor capo come utente o ruolo organigramma, date pianificate/eseguite,
|
||||
* stato, conclusione). La data pianificata alimenta il calendario (review_schedule).
|
||||
* - CHECKLIST: internal_audit_items pre-popolata al create con le clausole 4-10
|
||||
* ISO 27001 (lista statica) + i controlli Annex A applicabili dal SoA dell'org
|
||||
* (isms_soa.applicable=1, query difensiva: la tabella potrebbe non esistere).
|
||||
* - FINDING: una voce non_conforme può generare una NC (non_conformities,
|
||||
* source='audit', source_entity_type='internal_audit_item'), che confluisce
|
||||
* nel modulo NCR/CAPA esistente.
|
||||
* - EVIDENZE: su evidence_files (entity_type='internal_audit') — gestite altrove.
|
||||
* - REPORT: HTML stampabile (no PDF lib).
|
||||
*
|
||||
* Multi-tenancy: ogni query filtra organization_id. Anti-IDOR su audit/item/role
|
||||
* (verificati appartenenti all'org). logAudit su create/update/delete.
|
||||
* NOTE: Database::query/fetchAll/fetchOne/insert/update/delete; jsonSuccess/Error exit.
|
||||
*/
|
||||
|
||||
require_once __DIR__ . '/BaseController.php';
|
||||
|
||||
class InternalAuditController extends BaseController
|
||||
{
|
||||
private const MANAGE_ROLES = ['org_admin', 'compliance_manager', 'auditor'];
|
||||
|
||||
/**
|
||||
* Clausole 4-10 ISO/IEC 27001:2022 — checklist statica (ref_type='clause').
|
||||
* Pre-popolata al create di ogni audit; l'auditor parte già con la checklist.
|
||||
*/
|
||||
private const ISO_CLAUSES = [
|
||||
['4.1', 'Comprensione dell\'organizzazione e del suo contesto'],
|
||||
['4.2', 'Comprensione delle esigenze e aspettative delle parti interessate'],
|
||||
['4.3', 'Determinazione dello scopo del SGSI'],
|
||||
['4.4', 'Sistema di gestione per la sicurezza delle informazioni'],
|
||||
['5.1', 'Leadership e impegno della direzione'],
|
||||
['5.2', 'Politica per la sicurezza delle informazioni'],
|
||||
['5.3', 'Ruoli, responsabilità e autorità organizzative'],
|
||||
['6.1.1', 'Azioni per affrontare rischi e opportunità — generalità'],
|
||||
['6.1.2', 'Valutazione del rischio per la sicurezza delle informazioni'],
|
||||
['6.1.3', 'Trattamento del rischio per la sicurezza delle informazioni (SoA)'],
|
||||
['6.2', 'Obiettivi di sicurezza delle informazioni e pianificazione'],
|
||||
['6.3', 'Pianificazione delle modifiche'],
|
||||
['7.1', 'Risorse'],
|
||||
['7.2', 'Competenza'],
|
||||
['7.3', 'Consapevolezza'],
|
||||
['7.4', 'Comunicazione'],
|
||||
['7.5', 'Informazioni documentate'],
|
||||
['8.1', 'Pianificazione e controllo operativi'],
|
||||
['8.2', 'Valutazione del rischio per la sicurezza delle informazioni'],
|
||||
['8.3', 'Trattamento del rischio per la sicurezza delle informazioni'],
|
||||
['9.1', 'Monitoraggio, misurazione, analisi e valutazione'],
|
||||
['9.2', 'Audit interno'],
|
||||
['9.3', 'Riesame di direzione'],
|
||||
['10.1', 'Miglioramento continuo'],
|
||||
['10.2', 'Non conformità e azioni correttive'],
|
||||
];
|
||||
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
// PROGRAMMA AUDIT
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
|
||||
/** GET /api/internal-audits/list */
|
||||
public function list(): void
|
||||
{
|
||||
$this->requireOrgAccess();
|
||||
$orgId = $this->getCurrentOrgId();
|
||||
$rows = Database::fetchAll(
|
||||
'SELECT a.id, a.code, a.title, a.status, a.planned_date, a.executed_date,
|
||||
a.lead_auditor_user_id, u.full_name AS lead_auditor_name,
|
||||
a.lead_auditor_role_id, r.role_name AS lead_auditor_role_name, a.updated_at,
|
||||
(SELECT COUNT(*) FROM internal_audit_items i WHERE i.audit_id = a.id) AS n_items,
|
||||
(SELECT COUNT(*) FROM internal_audit_items i WHERE i.audit_id = a.id AND i.result = \'non_conforme\') AS n_nc
|
||||
FROM internal_audits a
|
||||
LEFT JOIN users u ON u.id = a.lead_auditor_user_id
|
||||
LEFT JOIN org_roles r ON r.id = a.lead_auditor_role_id
|
||||
WHERE a.organization_id = ?
|
||||
ORDER BY (a.planned_date IS NULL), a.planned_date DESC, a.id DESC',
|
||||
[$orgId]
|
||||
);
|
||||
$out = array_map(static fn($a) => [
|
||||
'id' => (int) $a['id'], 'code' => $a['code'], 'title' => $a['title'], 'status' => $a['status'],
|
||||
'planned_date' => $a['planned_date'], 'executed_date' => $a['executed_date'],
|
||||
'lead_auditor_user_id' => $a['lead_auditor_user_id'] !== null ? (int) $a['lead_auditor_user_id'] : null,
|
||||
'lead_auditor_name' => $a['lead_auditor_name'],
|
||||
'lead_auditor_role_id' => $a['lead_auditor_role_id'] !== null ? (int) $a['lead_auditor_role_id'] : null,
|
||||
'lead_auditor_role_name' => $a['lead_auditor_role_name'],
|
||||
'n_items' => (int) $a['n_items'], 'n_nc' => (int) $a['n_nc'], 'updated_at' => $a['updated_at'],
|
||||
], $rows);
|
||||
$this->jsonSuccess(['audits' => $out]);
|
||||
}
|
||||
|
||||
/** GET /api/internal-audits/{id} (con items) */
|
||||
public function get(int $id): void
|
||||
{
|
||||
$this->requireOrgAccess();
|
||||
$orgId = $this->getCurrentOrgId();
|
||||
$a = Database::fetchOne(
|
||||
'SELECT a.*, u.full_name AS lead_auditor_name, r.role_name AS lead_auditor_role_name
|
||||
FROM internal_audits a
|
||||
LEFT JOIN users u ON u.id = a.lead_auditor_user_id
|
||||
LEFT JOIN org_roles r ON r.id = a.lead_auditor_role_id
|
||||
WHERE a.id = ? AND a.organization_id = ?',
|
||||
[$id, $orgId]
|
||||
);
|
||||
if (!$a) { $this->jsonError('Audit non trovato', 404, 'NOT_FOUND'); }
|
||||
$this->jsonSuccess([
|
||||
'id' => (int) $a['id'], 'code' => $a['code'], 'title' => $a['title'],
|
||||
'scope' => $a['scope'], 'criteria' => $a['criteria'],
|
||||
'planned_date' => $a['planned_date'], 'executed_date' => $a['executed_date'],
|
||||
'status' => $a['status'],
|
||||
'lead_auditor_user_id' => $a['lead_auditor_user_id'] !== null ? (int) $a['lead_auditor_user_id'] : null,
|
||||
'lead_auditor_name' => $a['lead_auditor_name'],
|
||||
'lead_auditor_role_id' => $a['lead_auditor_role_id'] !== null ? (int) $a['lead_auditor_role_id'] : null,
|
||||
'lead_auditor_role_name' => $a['lead_auditor_role_name'],
|
||||
'conclusion' => $a['conclusion'], 'updated_at' => $a['updated_at'],
|
||||
'items' => $this->loadItems($id),
|
||||
]);
|
||||
}
|
||||
|
||||
/**
|
||||
* POST /api/internal-audits/create
|
||||
* Genera code AUD-NNN progressivo per org e PRE-POPOLA la checklist:
|
||||
* - clausole 4-10 ISO 27001 (statiche),
|
||||
* - controlli Annex A applicabili dal SoA dell'org (se isms_soa esiste).
|
||||
*/
|
||||
public function create(): void
|
||||
{
|
||||
$this->requireOrgRole(self::MANAGE_ROLES);
|
||||
$orgId = $this->getCurrentOrgId();
|
||||
$b = $this->getJsonBody();
|
||||
|
||||
$title = trim((string) ($b['title'] ?? ''));
|
||||
if ($title === '' || mb_strlen($title) > 255) { $this->jsonError('Titolo obbligatorio (max 255)', 422, 'INVALID_TITLE'); }
|
||||
$status = in_array($b['status'] ?? '', ['planned', 'in_progress', 'completed', 'cancelled'], true) ? $b['status'] : 'planned';
|
||||
$planned = $this->validateDate($b['planned_date'] ?? null, 'planned_date');
|
||||
$executed = $this->validateDate($b['executed_date'] ?? null, 'executed_date');
|
||||
$leadUserId = $this->validateUser($b['lead_auditor_user_id'] ?? null, $orgId);
|
||||
$leadRoleId = $this->validateRole($b['lead_auditor_role_id'] ?? null, $orgId);
|
||||
|
||||
$code = $this->generateAuditCode($orgId);
|
||||
$id = (int) Database::insert('internal_audits', [
|
||||
'organization_id' => $orgId,
|
||||
'code' => $code,
|
||||
'title' => $title,
|
||||
'scope' => $this->nullableStr($b['scope'] ?? null),
|
||||
'criteria' => $this->nullableStr($b['criteria'] ?? null),
|
||||
'planned_date' => $planned,
|
||||
'executed_date' => $executed,
|
||||
'status' => $status,
|
||||
'lead_auditor_user_id' => $leadUserId,
|
||||
'lead_auditor_role_id' => $leadRoleId,
|
||||
'conclusion' => $this->nullableStr($b['conclusion'] ?? null),
|
||||
'created_by' => $this->getCurrentUserId(),
|
||||
]);
|
||||
|
||||
$seeded = $this->seedChecklist($id, $orgId);
|
||||
$this->upsertCalendar($id, $orgId, $code, $title, $planned);
|
||||
$this->logAudit('internal_audit_created', 'internal_audit', $id, ['code' => $code, 'title' => $title, 'items' => $seeded]);
|
||||
$this->jsonSuccess(['id' => $id, 'code' => $code, 'items_seeded' => $seeded], 'Audit creato', 201);
|
||||
}
|
||||
|
||||
/** PUT /api/internal-audits/{id} */
|
||||
public function update(int $id): void
|
||||
{
|
||||
$this->requireOrgRole(self::MANAGE_ROLES);
|
||||
$orgId = $this->getCurrentOrgId();
|
||||
$b = $this->getJsonBody();
|
||||
|
||||
$a = Database::fetchOne('SELECT id, code, title, planned_date FROM internal_audits WHERE id = ? AND organization_id = ?', [$id, $orgId]);
|
||||
if (!$a) { $this->jsonError('Audit non trovato', 404, 'NOT_FOUND'); }
|
||||
|
||||
$updates = [];
|
||||
if ($this->hasParam('title')) {
|
||||
$title = trim((string) ($b['title'] ?? ''));
|
||||
if ($title === '' || mb_strlen($title) > 255) { $this->jsonError('Titolo non valido (max 255)', 422, 'INVALID_TITLE'); }
|
||||
$updates['title'] = $title;
|
||||
}
|
||||
if ($this->hasParam('scope')) { $updates['scope'] = $this->nullableStr($b['scope'] ?? null); }
|
||||
if ($this->hasParam('criteria')) { $updates['criteria'] = $this->nullableStr($b['criteria'] ?? null); }
|
||||
if ($this->hasParam('planned_date')) { $updates['planned_date'] = $this->validateDate($b['planned_date'] ?? null, 'planned_date'); }
|
||||
if ($this->hasParam('executed_date')) { $updates['executed_date'] = $this->validateDate($b['executed_date'] ?? null, 'executed_date'); }
|
||||
if ($this->hasParam('status') && in_array($b['status'], ['planned', 'in_progress', 'completed', 'cancelled'], true)) { $updates['status'] = $b['status']; }
|
||||
if ($this->hasParam('conclusion')) { $updates['conclusion'] = $this->nullableStr($b['conclusion'] ?? null); }
|
||||
if ($this->hasParam('lead_auditor_user_id')) { $updates['lead_auditor_user_id'] = $this->validateUser($b['lead_auditor_user_id'] ?? null, $orgId); }
|
||||
if ($this->hasParam('lead_auditor_role_id')) { $updates['lead_auditor_role_id'] = $this->validateRole($b['lead_auditor_role_id'] ?? null, $orgId); }
|
||||
|
||||
if (!empty($updates)) {
|
||||
Database::update('internal_audits', $updates, 'id = ? AND organization_id = ?', [$id, $orgId]);
|
||||
}
|
||||
// riallinea il calendario
|
||||
$title = $updates['title'] ?? $a['title'];
|
||||
$planned = array_key_exists('planned_date', $updates) ? $updates['planned_date'] : $a['planned_date'];
|
||||
$this->upsertCalendar($id, $orgId, $a['code'], $title, $planned);
|
||||
|
||||
$this->logAudit('internal_audit_updated', 'internal_audit', $id, array_keys($updates));
|
||||
$this->jsonSuccess(['id' => $id, 'updated' => array_keys($updates)], 'Audit aggiornato');
|
||||
}
|
||||
|
||||
/** DELETE /api/internal-audits/{id} (org_admin) */
|
||||
public function delete(int $id): void
|
||||
{
|
||||
$this->requireOrgRole(['org_admin']);
|
||||
$orgId = $this->getCurrentOrgId();
|
||||
$a = Database::fetchOne('SELECT id FROM internal_audits WHERE id = ? AND organization_id = ?', [$id, $orgId]);
|
||||
if (!$a) { $this->jsonError('Audit non trovato', 404, 'NOT_FOUND'); }
|
||||
Database::delete('review_schedule', 'organization_id = ? AND entity_type = ? AND entity_id = ?', [$orgId, 'internal_audit', $id]);
|
||||
Database::delete('internal_audits', 'id = ? AND organization_id = ?', [$id, $orgId]); // items in cascata
|
||||
$this->logAudit('internal_audit_deleted', 'internal_audit', $id);
|
||||
$this->jsonSuccess(null, 'Audit eliminato');
|
||||
}
|
||||
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
// VOCI DI CHECKLIST
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
|
||||
/**
|
||||
* PUT /api/internal-audits/items/{subId} Body: {result?, note?}
|
||||
* Aggiorna esito/note di una voce, verificando che appartenga a un audit dell'org.
|
||||
*/
|
||||
public function updateItem(int $itemId): void
|
||||
{
|
||||
$this->requireOrgRole(self::MANAGE_ROLES);
|
||||
$orgId = $this->getCurrentOrgId();
|
||||
$item = $this->assertItem($itemId, $orgId);
|
||||
$b = $this->getJsonBody();
|
||||
|
||||
$updates = [];
|
||||
if ($this->hasParam('result')) {
|
||||
$allowed = ['da_verificare', 'conforme', 'non_conforme', 'osservazione', 'opportunita', 'non_applicabile'];
|
||||
if (!in_array($b['result'] ?? '', $allowed, true)) { $this->jsonError('Esito non valido', 422, 'INVALID_RESULT'); }
|
||||
$updates['result'] = $b['result'];
|
||||
}
|
||||
if ($this->hasParam('note')) { $updates['note'] = $this->nullableStr($b['note'] ?? null); }
|
||||
if ($this->hasParam('checkpoint')) {
|
||||
$cp = trim((string) ($b['checkpoint'] ?? ''));
|
||||
if ($cp === '') { $this->jsonError('Checkpoint non valido', 422, 'INVALID_CHECKPOINT'); }
|
||||
$updates['checkpoint'] = mb_substr($cp, 0, 2000);
|
||||
}
|
||||
if (empty($updates)) { $this->jsonError('Nessun campo da aggiornare', 400, 'NO_UPDATES'); }
|
||||
|
||||
Database::update('internal_audit_items', $updates, 'id = ?', [$itemId]);
|
||||
$this->logAudit('internal_audit_item_updated', 'internal_audit_item', $itemId, ['audit_id' => (int) $item['audit_id']] + array_fill_keys(array_keys($updates), 1));
|
||||
$this->jsonSuccess(['id' => $itemId, 'updated' => array_keys($updates)], 'Voce aggiornata');
|
||||
}
|
||||
|
||||
/**
|
||||
* POST /api/internal-audits/items Body: {audit_id*, checkpoint*, ref_type?, ref_code?, note?, result?}
|
||||
* Aggiunge una voce custom alla checklist (l'audit deve appartenere all'org).
|
||||
*/
|
||||
public function addItem(): void
|
||||
{
|
||||
$this->requireOrgRole(self::MANAGE_ROLES);
|
||||
$orgId = $this->getCurrentOrgId();
|
||||
$b = $this->getJsonBody();
|
||||
|
||||
$auditId = (int) ($b['audit_id'] ?? 0);
|
||||
$this->assertAudit($auditId, $orgId);
|
||||
|
||||
$checkpoint = trim((string) ($b['checkpoint'] ?? ''));
|
||||
if ($checkpoint === '') { $this->jsonError('Checkpoint obbligatorio', 422, 'INVALID_CHECKPOINT'); }
|
||||
$refType = in_array($b['ref_type'] ?? '', ['clause', 'annex_control', 'nis2_measure', 'custom'], true) ? $b['ref_type'] : 'custom';
|
||||
$result = in_array($b['result'] ?? '', ['da_verificare', 'conforme', 'non_conforme', 'osservazione', 'opportunita', 'non_applicabile'], true) ? $b['result'] : 'da_verificare';
|
||||
|
||||
$maxOrd = (int) (Database::fetchOne('SELECT COALESCE(MAX(ord), 0) AS m FROM internal_audit_items WHERE audit_id = ?', [$auditId])['m'] ?? 0);
|
||||
$id = (int) Database::insert('internal_audit_items', [
|
||||
'audit_id' => $auditId,
|
||||
'ref_type' => $refType,
|
||||
'ref_code' => $this->nullableStr($b['ref_code'] ?? null, 32),
|
||||
'checkpoint' => mb_substr($checkpoint, 0, 2000),
|
||||
'result' => $result,
|
||||
'note' => $this->nullableStr($b['note'] ?? null),
|
||||
'ord' => $maxOrd + 1,
|
||||
]);
|
||||
$this->logAudit('internal_audit_item_added', 'internal_audit_item', $id, ['audit_id' => $auditId]);
|
||||
$this->jsonSuccess(['id' => $id], 'Voce aggiunta', 201);
|
||||
}
|
||||
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
// FINDING -> NON CONFORMITA'
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
|
||||
/**
|
||||
* POST /api/internal-audits/{id}/raiseNcr Body: {item_id?}
|
||||
* Crea una NC (non_conformities) da una voce non conforme dell'audit.
|
||||
* source='audit' (l'ENUM 004 NON ha 'internal_audit'),
|
||||
* source_entity_type='internal_audit_item', source_entity_id=item_id.
|
||||
* Idempotente: se esiste già una NC per quella voce la restituisce.
|
||||
*/
|
||||
public function raiseNcr(int $id): void
|
||||
{
|
||||
$this->requireOrgRole(self::MANAGE_ROLES);
|
||||
$orgId = $this->getCurrentOrgId();
|
||||
$audit = Database::fetchOne('SELECT id, code FROM internal_audits WHERE id = ? AND organization_id = ?', [$id, $orgId]);
|
||||
if (!$audit) { $this->jsonError('Audit non trovato', 404, 'NOT_FOUND'); }
|
||||
$b = $this->getJsonBody();
|
||||
|
||||
$itemId = (int) ($b['item_id'] ?? 0);
|
||||
if ($itemId <= 0) { $this->jsonError('item_id obbligatorio', 422, 'MISSING_ITEM'); }
|
||||
$item = Database::fetchOne('SELECT id, audit_id, ref_type, ref_code, checkpoint FROM internal_audit_items WHERE id = ? AND audit_id = ?', [$itemId, $id]);
|
||||
if (!$item) { $this->jsonError('Voce non trovata in questo audit', 404, 'ITEM_NOT_FOUND'); }
|
||||
|
||||
// Idempotenza: una sola NC per voce
|
||||
$existing = Database::fetchOne(
|
||||
"SELECT id, ncr_code FROM non_conformities
|
||||
WHERE organization_id = ? AND source = 'audit' AND source_entity_type = 'internal_audit_item' AND source_entity_id = ?",
|
||||
[$orgId, $itemId]
|
||||
);
|
||||
if ($existing) {
|
||||
$this->jsonSuccess(['id' => (int) $existing['id'], 'ncr_code' => $existing['ncr_code'], 'already' => true], 'Non conformità già aperta per questa voce');
|
||||
}
|
||||
|
||||
$checkpoint = (string) $item['checkpoint'];
|
||||
$refCode = $item['ref_code'] ? '[' . $item['ref_code'] . '] ' : '';
|
||||
$titleBase = $refCode . $checkpoint;
|
||||
$title = mb_strlen($titleBase) > 200 ? mb_substr($titleBase, 0, 197) . '...' : $titleBase;
|
||||
if ($title === '') { $title = 'Non conformità da audit interno ' . $audit['code']; }
|
||||
|
||||
$ncrCode = $this->generateCode('NCR');
|
||||
$ncrId = (int) Database::insert('non_conformities', [
|
||||
'organization_id' => $orgId,
|
||||
'ncr_code' => $ncrCode,
|
||||
'title' => $title,
|
||||
'description' => "Rilevata nell'audit interno {$audit['code']}" . ($item['ref_code'] ? " (rif. {$item['ref_code']})" : '') . ": {$checkpoint}",
|
||||
'source' => 'audit',
|
||||
'source_entity_type' => 'internal_audit_item',
|
||||
'source_entity_id' => $itemId,
|
||||
'severity' => 'minor',
|
||||
'status' => 'open',
|
||||
'identified_by' => $this->getCurrentUserId(),
|
||||
]);
|
||||
$this->logAudit('internal_audit_ncr_raised', 'non_conformity', $ncrId, ['ncr_code' => $ncrCode, 'audit_id' => $id, 'item_id' => $itemId]);
|
||||
$this->jsonSuccess(['id' => $ncrId, 'ncr_code' => $ncrCode, 'already' => false], 'Non conformità creata', 201);
|
||||
}
|
||||
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
// REPORT
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
|
||||
/** GET /api/internal-audits/{id}/report — HTML stampabile (no PDF lib). */
|
||||
public function report(int $id): void
|
||||
{
|
||||
$this->requireOrgRole(['org_admin', 'compliance_manager', 'auditor', 'board_member']);
|
||||
$orgId = $this->getCurrentOrgId();
|
||||
$a = Database::fetchOne(
|
||||
'SELECT a.*, u.full_name AS lead_auditor_name, r.role_name AS lead_auditor_role_name, o.name AS org_name
|
||||
FROM internal_audits a
|
||||
LEFT JOIN users u ON u.id = a.lead_auditor_user_id
|
||||
LEFT JOIN org_roles r ON r.id = a.lead_auditor_role_id
|
||||
LEFT JOIN organizations o ON o.id = a.organization_id
|
||||
WHERE a.id = ? AND a.organization_id = ?',
|
||||
[$id, $orgId]
|
||||
);
|
||||
if (!$a) { $this->jsonError('Audit non trovato', 404, 'NOT_FOUND'); }
|
||||
$items = $this->loadItems($id);
|
||||
|
||||
header('Content-Type: text/html; charset=utf-8');
|
||||
echo $this->renderReport($a, $items);
|
||||
exit;
|
||||
}
|
||||
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
// HELPER
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
|
||||
private function loadItems(int $auditId): array
|
||||
{
|
||||
$rows = Database::fetchAll(
|
||||
'SELECT id, ref_type, ref_code, checkpoint, result, note, ord
|
||||
FROM internal_audit_items WHERE audit_id = ?
|
||||
ORDER BY FIELD(ref_type, \'clause\',\'annex_control\',\'nis2_measure\',\'custom\'), ord ASC, id ASC',
|
||||
[$auditId]
|
||||
);
|
||||
// mappa item -> eventuale NC già aperta (per il pulsante "apri NC" del frontend)
|
||||
$ncByItem = [];
|
||||
$ncs = Database::fetchAll(
|
||||
"SELECT source_entity_id, id, ncr_code FROM non_conformities
|
||||
WHERE source = 'audit' AND source_entity_type = 'internal_audit_item'
|
||||
AND source_entity_id IN (SELECT id FROM internal_audit_items WHERE audit_id = ?)",
|
||||
[$auditId]
|
||||
);
|
||||
foreach ($ncs as $n) { $ncByItem[(int) $n['source_entity_id']] = ['id' => (int) $n['id'], 'ncr_code' => $n['ncr_code']]; }
|
||||
|
||||
return array_map(static function ($r) use ($ncByItem) {
|
||||
$iid = (int) $r['id'];
|
||||
return [
|
||||
'id' => $iid, 'ref_type' => $r['ref_type'], 'ref_code' => $r['ref_code'],
|
||||
'checkpoint' => $r['checkpoint'], 'result' => $r['result'], 'note' => $r['note'],
|
||||
'ord' => (int) $r['ord'],
|
||||
'ncr' => $ncByItem[$iid] ?? null,
|
||||
];
|
||||
}, $rows);
|
||||
}
|
||||
|
||||
/** Genera code AUD-NNN progressivo per org (es. AUD-001). */
|
||||
private function generateAuditCode(int $orgId): string
|
||||
{
|
||||
$n = (int) (Database::fetchOne(
|
||||
"SELECT COUNT(*) AS c FROM internal_audits WHERE organization_id = ?",
|
||||
[$orgId]
|
||||
)['c'] ?? 0);
|
||||
// evita collisione su uno UNIQUE eventuale futuro: incrementa finché libero
|
||||
for ($i = $n + 1; $i < $n + 1000; $i++) {
|
||||
$code = 'AUD-' . str_pad((string) $i, 3, '0', STR_PAD_LEFT);
|
||||
$exists = Database::fetchOne('SELECT id FROM internal_audits WHERE organization_id = ? AND code = ?', [$orgId, $code]);
|
||||
if (!$exists) { return $code; }
|
||||
}
|
||||
return 'AUD-' . str_pad((string) ($n + 1), 3, '0', STR_PAD_LEFT);
|
||||
}
|
||||
|
||||
/**
|
||||
* Pre-popola la checklist: clausole 4-10 (statiche) + Annex A applicabili da SoA.
|
||||
* Ritorna il numero di voci create.
|
||||
*/
|
||||
private function seedChecklist(int $auditId, int $orgId): int
|
||||
{
|
||||
$ord = 0;
|
||||
$count = 0;
|
||||
foreach (self::ISO_CLAUSES as [$code, $checkpoint]) {
|
||||
Database::insert('internal_audit_items', [
|
||||
'audit_id' => $auditId,
|
||||
'ref_type' => 'clause',
|
||||
'ref_code' => $code,
|
||||
'checkpoint' => $checkpoint,
|
||||
'result' => 'da_verificare',
|
||||
'ord' => $ord++,
|
||||
]);
|
||||
$count++;
|
||||
}
|
||||
// Annex A dal SoA dell'org (query difensiva: isms_soa potrebbe non esistere)
|
||||
try {
|
||||
$soa = Database::fetchAll(
|
||||
"SELECT control_code, source_ref FROM isms_soa
|
||||
WHERE organization_id = ? AND applicable = 1
|
||||
ORDER BY control_code ASC",
|
||||
[$orgId]
|
||||
);
|
||||
$ord = 0;
|
||||
foreach ($soa as $s) {
|
||||
$cp = $s['source_ref'] ? (string) $s['source_ref'] : ('Controllo applicabile (SoA): ' . $s['control_code']);
|
||||
Database::insert('internal_audit_items', [
|
||||
'audit_id' => $auditId,
|
||||
'ref_type' => 'annex_control',
|
||||
'ref_code' => mb_substr((string) $s['control_code'], 0, 32),
|
||||
'checkpoint' => mb_substr($cp, 0, 2000),
|
||||
'result' => 'da_verificare',
|
||||
'ord' => $ord++,
|
||||
]);
|
||||
$count++;
|
||||
}
|
||||
} catch (PDOException $e) {
|
||||
// tabella SoA assente o non popolata per l'org: la checklist resta con le sole clausole
|
||||
error_log('[InternalAudit] SoA seed skipped: ' . $e->getMessage());
|
||||
}
|
||||
return $count;
|
||||
}
|
||||
|
||||
/** Crea/aggiorna/elimina la riga di calendario (review_schedule) per l'audit. */
|
||||
private function upsertCalendar(int $auditId, int $orgId, ?string $code, string $title, ?string $plannedDate): void
|
||||
{
|
||||
if ($plannedDate === null) {
|
||||
Database::delete('review_schedule', 'organization_id = ? AND entity_type = ? AND entity_id = ?', [$orgId, 'internal_audit', $auditId]);
|
||||
return;
|
||||
}
|
||||
$label = mb_substr('Audit interno ' . ($code ? $code . ': ' : '') . $title, 0, 255);
|
||||
try {
|
||||
Database::query(
|
||||
'INSERT INTO review_schedule (organization_id, entity_type, entity_id, title, next_review_date, created_by)
|
||||
VALUES (?, ?, ?, ?, ?, ?)
|
||||
ON DUPLICATE KEY UPDATE title = VALUES(title), next_review_date = VALUES(next_review_date)',
|
||||
[$orgId, 'internal_audit', $auditId, $label, $plannedDate, $this->getCurrentUserId()]
|
||||
);
|
||||
} catch (PDOException $e) {
|
||||
// l'ENUM review_schedule.entity_type potrebbe non includere ancora 'internal_audit'
|
||||
// (estensione lato seeder/flotta): non bloccare la creazione dell'audit.
|
||||
error_log('[InternalAudit] calendar upsert skipped: ' . $e->getMessage());
|
||||
}
|
||||
}
|
||||
|
||||
private function assertAudit(int $id, int $orgId): array
|
||||
{
|
||||
$a = Database::fetchOne('SELECT id, code FROM internal_audits WHERE id = ? AND organization_id = ?', [$id, $orgId]);
|
||||
if (!$a) { $this->jsonError('Audit non trovato', 404, 'NOT_FOUND'); }
|
||||
return $a;
|
||||
}
|
||||
|
||||
/** Verifica che la voce appartenga a un audit dell'org (anti-IDOR). */
|
||||
private function assertItem(int $itemId, int $orgId): array
|
||||
{
|
||||
$item = Database::fetchOne(
|
||||
'SELECT i.id, i.audit_id FROM internal_audit_items i
|
||||
JOIN internal_audits a ON a.id = i.audit_id
|
||||
WHERE i.id = ? AND a.organization_id = ?',
|
||||
[$itemId, $orgId]
|
||||
);
|
||||
if (!$item) { $this->jsonError('Voce non trovata', 404, 'NOT_FOUND'); }
|
||||
return $item;
|
||||
}
|
||||
|
||||
private function validateUser($id, int $orgId): ?int
|
||||
{
|
||||
$id = ($id === null || $id === '') ? null : (int) $id;
|
||||
if ($id === null) { return null; }
|
||||
// l'utente deve essere membro dell'org (anti-IDOR)
|
||||
$row = Database::fetchOne(
|
||||
'SELECT u.id FROM users u
|
||||
JOIN user_organizations uo ON uo.user_id = u.id
|
||||
WHERE u.id = ? AND uo.organization_id = ?',
|
||||
[$id, $orgId]
|
||||
);
|
||||
if (!$row) { $this->jsonError('Auditor capo non valido', 422, 'INVALID_AUDITOR'); }
|
||||
return $id;
|
||||
}
|
||||
|
||||
private function validateRole($id, int $orgId): ?int
|
||||
{
|
||||
$id = ($id === null || $id === '') ? null : (int) $id;
|
||||
if ($id === null) { return null; }
|
||||
$row = Database::fetchOne('SELECT id FROM org_roles WHERE id = ? AND organization_id = ?', [$id, $orgId]);
|
||||
if (!$row) { $this->jsonError('Ruolo auditor non valido', 422, 'INVALID_ROLE'); }
|
||||
return $id;
|
||||
}
|
||||
|
||||
private function validateDate($v, string $field): ?string
|
||||
{
|
||||
if ($v === null || $v === '') { return null; }
|
||||
$d = trim((string) $v);
|
||||
$dt = DateTime::createFromFormat('Y-m-d', $d);
|
||||
if (!$dt || $dt->format('Y-m-d') !== $d) { $this->jsonError("Data $field non valida (atteso AAAA-MM-GG)", 422, 'INVALID_DATE'); }
|
||||
return $d;
|
||||
}
|
||||
|
||||
private function nullableStr($v, ?int $max = null): ?string
|
||||
{
|
||||
if ($v === null) { return null; }
|
||||
$s = trim((string) $v);
|
||||
if ($s === '') { return null; }
|
||||
if ($max !== null && mb_strlen($s) > $max) { $s = mb_substr($s, 0, $max); }
|
||||
return $s;
|
||||
}
|
||||
|
||||
/** Report HTML stampabile, self-contained (no PDF lib, no asset esterni). */
|
||||
private function renderReport(array $a, array $items): string
|
||||
{
|
||||
$esc = static fn($s) => htmlspecialchars((string) ($s ?? ''), ENT_QUOTES, 'UTF-8');
|
||||
$resLabels = [
|
||||
'da_verificare' => 'Da verificare', 'conforme' => 'Conforme', 'non_conforme' => 'Non conforme',
|
||||
'osservazione' => 'Osservazione', 'opportunita' => 'Opportunità', 'non_applicabile' => 'Non applicabile',
|
||||
];
|
||||
$resColors = [
|
||||
'da_verificare' => '#6b7280', 'conforme' => '#166534', 'non_conforme' => '#991b1b',
|
||||
'osservazione' => '#92400e', 'opportunita' => '#1e40af', 'non_applicabile' => '#6b7280',
|
||||
];
|
||||
$typeLabels = ['clause' => 'Clausole ISO 27001', 'annex_control' => 'Controlli Annex A', 'nis2_measure' => 'Misure NIS2', 'custom' => 'Voci aggiuntive'];
|
||||
|
||||
// raggruppa per ref_type mantenendo l'ordine
|
||||
$groups = [];
|
||||
foreach ($items as $it) { $groups[$it['ref_type']][] = $it; }
|
||||
|
||||
// conteggi esiti
|
||||
$tally = [];
|
||||
foreach ($items as $it) { $tally[$it['result']] = ($tally[$it['result']] ?? 0) + 1; }
|
||||
|
||||
$leadParts = [];
|
||||
if (!empty($a['lead_auditor_name'])) { $leadParts[] = $a['lead_auditor_name']; }
|
||||
if (!empty($a['lead_auditor_role_name'])) { $leadParts[] = '(' . $a['lead_auditor_role_name'] . ')'; }
|
||||
$lead = $leadParts ? implode(' ', $leadParts) : '—';
|
||||
|
||||
$h = '<!DOCTYPE html><html lang="it"><head><meta charset="UTF-8">';
|
||||
$h .= '<meta name="viewport" content="width=device-width, initial-scale=1">';
|
||||
$h .= '<title>Report audit interno ' . $esc($a['code']) . '</title><style>';
|
||||
$h .= 'body{font-family:-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;color:#1f2937;max-width:900px;margin:24px auto;padding:0 20px;line-height:1.5;}';
|
||||
$h .= 'h1{font-size:1.5rem;margin:0 0 4px;}h2{font-size:1.05rem;margin:26px 0 10px;border-bottom:2px solid #e5e7eb;padding-bottom:5px;}';
|
||||
$h .= '.sub{color:#6b7280;font-size:.9rem;margin-bottom:18px;}';
|
||||
$h .= '.meta{width:100%;border-collapse:collapse;font-size:.9rem;margin-bottom:8px;}';
|
||||
$h .= '.meta th{text-align:left;width:170px;color:#6b7280;font-weight:600;vertical-align:top;padding:5px 10px 5px 0;}';
|
||||
$h .= '.meta td{padding:5px 0;vertical-align:top;}';
|
||||
$h .= 'table.cl{width:100%;border-collapse:collapse;font-size:.86rem;margin-bottom:10px;}';
|
||||
$h .= 'table.cl th,table.cl td{text-align:left;padding:7px 9px;border:1px solid #e5e7eb;vertical-align:top;}';
|
||||
$h .= 'table.cl th{background:#f9fafb;font-size:.72rem;text-transform:uppercase;letter-spacing:.03em;color:#6b7280;}';
|
||||
$h .= '.pill{display:inline-block;font-size:.72rem;font-weight:700;padding:2px 8px;border-radius:6px;color:#fff;white-space:nowrap;}';
|
||||
$h .= '.tally span{display:inline-block;margin-right:10px;font-size:.85rem;}';
|
||||
$h .= '.print-btn{margin:0 0 18px;padding:8px 16px;border:1px solid #2563eb;background:#2563eb;color:#fff;border-radius:8px;cursor:pointer;font-size:.9rem;}';
|
||||
$h .= '@media print{.print-btn{display:none;}body{margin:0;}}';
|
||||
$h .= '</style></head><body>';
|
||||
$h .= '<button class="print-btn" onclick="window.print()">Stampa / Salva PDF</button>';
|
||||
$h .= '<h1>Report di audit interno</h1>';
|
||||
$h .= '<div class="sub">' . $esc($a['org_name']) . ' · ISO/IEC 27001 §9.2 · generato il ' . date('d/m/Y H:i') . '</div>';
|
||||
|
||||
$h .= '<table class="meta">';
|
||||
$h .= '<tr><th>Codice</th><td>' . $esc($a['code']) . '</td></tr>';
|
||||
$h .= '<tr><th>Titolo</th><td>' . $esc($a['title']) . '</td></tr>';
|
||||
$h .= '<tr><th>Stato</th><td>' . $esc($a['status']) . '</td></tr>';
|
||||
$h .= '<tr><th>Auditor capo</th><td>' . $esc($lead) . '</td></tr>';
|
||||
$h .= '<tr><th>Data pianificata</th><td>' . ($a['planned_date'] ? $esc(date('d/m/Y', strtotime($a['planned_date']))) : '—') . '</td></tr>';
|
||||
$h .= '<tr><th>Data esecuzione</th><td>' . ($a['executed_date'] ? $esc(date('d/m/Y', strtotime($a['executed_date']))) : '—') . '</td></tr>';
|
||||
$h .= '<tr><th>Ambito (scope)</th><td>' . nl2br($esc($a['scope'])) . '</td></tr>';
|
||||
$h .= '<tr><th>Criteri</th><td>' . nl2br($esc($a['criteria'])) . '</td></tr>';
|
||||
$h .= '</table>';
|
||||
|
||||
$h .= '<h2>Sintesi esiti</h2><div class="tally">';
|
||||
foreach ($resLabels as $k => $lbl) {
|
||||
$c = $tally[$k] ?? 0;
|
||||
$h .= '<span><span class="pill" style="background:' . $resColors[$k] . '">' . $esc($lbl) . '</span> ' . $c . '</span>';
|
||||
}
|
||||
$h .= '</div>';
|
||||
|
||||
foreach ($typeLabels as $type => $label) {
|
||||
if (empty($groups[$type])) { continue; }
|
||||
$h .= '<h2>' . $esc($label) . '</h2>';
|
||||
$h .= '<table class="cl"><thead><tr><th style="width:70px;">Rif.</th><th>Punto di verifica</th><th style="width:120px;">Esito</th><th>Note</th></tr></thead><tbody>';
|
||||
foreach ($groups[$type] as $it) {
|
||||
$col = $resColors[$it['result']] ?? '#6b7280';
|
||||
$rl = $resLabels[$it['result']] ?? $it['result'];
|
||||
$ncSuffix = $it['ncr'] ? ' <em style="color:#991b1b;font-size:.78rem;">NC ' . $esc($it['ncr']['ncr_code']) . '</em>' : '';
|
||||
$h .= '<tr><td>' . $esc($it['ref_code']) . '</td><td>' . $esc($it['checkpoint']) . $ncSuffix . '</td>';
|
||||
$h .= '<td><span class="pill" style="background:' . $col . '">' . $esc($rl) . '</span></td>';
|
||||
$h .= '<td>' . nl2br($esc($it['note'])) . '</td></tr>';
|
||||
}
|
||||
$h .= '</tbody></table>';
|
||||
}
|
||||
|
||||
if (!empty($a['conclusion'])) {
|
||||
$h .= '<h2>Conclusioni</h2><p>' . nl2br($esc($a['conclusion'])) . '</p>';
|
||||
}
|
||||
|
||||
$h .= '<p style="margin-top:30px;color:#9ca3af;font-size:.78rem;">Documento generato da NIS2 Agile. ISO/IEC 27001 §9.2 e\' una buona prassi volontaria; gli obblighi normativi in Italia derivano da NIS2 / D.Lgs. 138/2024. Strumento di supporto organizzativo, non un parere legale.</p>';
|
||||
$h .= '</body></html>';
|
||||
return $h;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,835 @@
|
||||
<?php
|
||||
/**
|
||||
* NIS2 Agile — Riesame di Direzione (ISO 27001 §9.3) — Modulo B
|
||||
* ----------------------------------------------------------------------------
|
||||
* Produce il VERBALE del riesame periodico del SGSI con:
|
||||
* - INPUT del riesame AGGREGATI automaticamente dai moduli esistenti (gather),
|
||||
* rivisti dall'utente e CONGELATI nello `snapshot` JSON all'approvazione;
|
||||
* - OUTPUT = decisioni (management_review_decisions) con owner (ruolo org),
|
||||
* scadenza e link facoltativo a una CAPA.
|
||||
*
|
||||
* Il `gather` è difensivo by-design: ogni sezione legge il proprio modulo in
|
||||
* try/catch isolato (alcune tabelle potrebbero non esistere ancora — es.
|
||||
* internal_audits/Modulo A, isms_*, normative_*). Se una fonte fallisce o manca,
|
||||
* la sezione viene marcata `available=false` SENZA rompere il resto.
|
||||
*
|
||||
* Multi-tenancy: OGNI query filtra organization_id. Anti-IDOR: owner_role_id e
|
||||
* capa_id collegati a una decisione sono verificati appartenere all'org.
|
||||
* NOTE: Database::query/fetchAll/fetchOne/insert/update/delete; jsonSuccess/Error exit.
|
||||
*/
|
||||
|
||||
require_once __DIR__ . '/BaseController.php';
|
||||
|
||||
class ManagementReviewController extends BaseController
|
||||
{
|
||||
private const MANAGE_ROLES = ['org_admin', 'compliance_manager'];
|
||||
private const APPROVE_ROLES = ['org_admin'];
|
||||
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
// VERBALI (CRUD)
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
|
||||
/** GET /api/management-reviews/list */
|
||||
public function list(): void
|
||||
{
|
||||
$this->requireOrgAccess();
|
||||
$orgId = $this->getCurrentOrgId();
|
||||
$rows = Database::fetchAll(
|
||||
'SELECT r.id, r.code, r.review_date, r.period_label, r.status, r.approved_at, r.updated_at,
|
||||
u.full_name AS chair_name,
|
||||
(SELECT COUNT(*) FROM management_review_decisions d WHERE d.review_id = r.id) AS n_decisions,
|
||||
(SELECT COUNT(*) FROM management_review_decisions d WHERE d.review_id = r.id AND d.status = \'done\') AS n_done
|
||||
FROM management_reviews r
|
||||
LEFT JOIN users u ON u.id = r.chair_user_id
|
||||
WHERE r.organization_id = ?
|
||||
ORDER BY (r.review_date IS NULL), r.review_date DESC, r.id DESC',
|
||||
[$orgId]
|
||||
);
|
||||
$out = array_map(static fn($r) => [
|
||||
'id' => (int) $r['id'],
|
||||
'code' => $r['code'],
|
||||
'review_date' => $r['review_date'],
|
||||
'period_label' => $r['period_label'],
|
||||
'status' => $r['status'],
|
||||
'chair_name' => $r['chair_name'],
|
||||
'approved_at' => $r['approved_at'],
|
||||
'n_decisions' => (int) $r['n_decisions'],
|
||||
'n_done' => (int) $r['n_done'],
|
||||
'updated_at' => $r['updated_at'],
|
||||
], $rows);
|
||||
$this->jsonSuccess(['reviews' => $out]);
|
||||
}
|
||||
|
||||
/** GET /api/management-reviews/{id} (con decisions + snapshot) */
|
||||
public function get(int $id): void
|
||||
{
|
||||
$this->requireOrgAccess();
|
||||
$orgId = $this->getCurrentOrgId();
|
||||
$r = Database::fetchOne(
|
||||
'SELECT r.*, u.full_name AS chair_name, a.full_name AS approver_name
|
||||
FROM management_reviews r
|
||||
LEFT JOIN users u ON u.id = r.chair_user_id
|
||||
LEFT JOIN users a ON a.id = r.approved_by
|
||||
WHERE r.id = ? AND r.organization_id = ?',
|
||||
[$id, $orgId]
|
||||
);
|
||||
if (!$r) { $this->jsonError('Riesame non trovato', 404, 'NOT_FOUND'); }
|
||||
|
||||
$att = $r['attendees'] ? json_decode($r['attendees'], true) : [];
|
||||
$snap = $r['snapshot'] ? json_decode($r['snapshot'], true) : null;
|
||||
$this->jsonSuccess([
|
||||
'id' => (int) $r['id'],
|
||||
'code' => $r['code'],
|
||||
'review_date' => $r['review_date'],
|
||||
'period_label' => $r['period_label'],
|
||||
'chair_user_id' => $r['chair_user_id'] !== null ? (int) $r['chair_user_id'] : null,
|
||||
'chair_name' => $r['chair_name'],
|
||||
'attendees' => is_array($att) ? $att : [],
|
||||
'status' => $r['status'],
|
||||
'approved_by' => $r['approved_by'] !== null ? (int) $r['approved_by'] : null,
|
||||
'approver_name' => $r['approver_name'],
|
||||
'approved_at' => $r['approved_at'],
|
||||
'conclusions' => $r['conclusions'],
|
||||
'snapshot' => is_array($snap) ? $snap : null,
|
||||
'created_at' => $r['created_at'],
|
||||
'updated_at' => $r['updated_at'],
|
||||
'decisions' => $this->loadDecisions($id),
|
||||
]);
|
||||
}
|
||||
|
||||
/** POST /api/management-reviews/create (genera code RD-AAAA-NN) */
|
||||
public function create(): void
|
||||
{
|
||||
$this->requireOrgRole(self::MANAGE_ROLES);
|
||||
$orgId = $this->getCurrentOrgId();
|
||||
$b = $this->getJsonBody();
|
||||
|
||||
$reviewDate = $this->validateDate($b['review_date'] ?? null, 'review_date');
|
||||
$period = $this->nullableStr($b['period_label'] ?? null, 100);
|
||||
$chairId = $this->validateUser($b['chair_user_id'] ?? null, $orgId);
|
||||
$attendees = $this->validateAttendees($b['attendees'] ?? null);
|
||||
$conclusions = $this->nullableStr($b['conclusions'] ?? null);
|
||||
|
||||
$year = $reviewDate ? (int) substr($reviewDate, 0, 4) : (int) date('Y');
|
||||
$code = $this->nextCode($orgId, $year);
|
||||
|
||||
$id = Database::insert('management_reviews', [
|
||||
'organization_id' => $orgId,
|
||||
'code' => $code,
|
||||
'review_date' => $reviewDate,
|
||||
'period_label' => $period,
|
||||
'chair_user_id' => $chairId,
|
||||
'attendees' => $attendees !== null ? json_encode($attendees, JSON_UNESCAPED_UNICODE) : null,
|
||||
'status' => 'draft',
|
||||
'conclusions' => $conclusions,
|
||||
'created_by' => $this->getCurrentUserId(),
|
||||
]);
|
||||
$this->logAudit('mgmt_review_created', 'management_review', (int) $id, ['code' => $code]);
|
||||
$this->jsonSuccess(['id' => (int) $id, 'code' => $code], 'Riesame creato', 201);
|
||||
}
|
||||
|
||||
/** PUT /api/management-reviews/{id} */
|
||||
public function update(int $id): void
|
||||
{
|
||||
$this->requireOrgRole(self::MANAGE_ROLES);
|
||||
$orgId = $this->getCurrentOrgId();
|
||||
$b = $this->getJsonBody();
|
||||
|
||||
$r = Database::fetchOne('SELECT id, status FROM management_reviews WHERE id = ? AND organization_id = ?', [$id, $orgId]);
|
||||
if (!$r) { $this->jsonError('Riesame non trovato', 404, 'NOT_FOUND'); }
|
||||
if ($r['status'] === 'approved') { $this->jsonError('Il riesame è approvato e non può essere modificato', 409, 'REVIEW_APPROVED'); }
|
||||
|
||||
$updates = [];
|
||||
if ($this->hasParam('review_date')) { $updates['review_date'] = $this->validateDate($b['review_date'] ?? null, 'review_date'); }
|
||||
if ($this->hasParam('period_label')) { $updates['period_label'] = $this->nullableStr($b['period_label'] ?? null, 100); }
|
||||
if ($this->hasParam('chair_user_id')) { $updates['chair_user_id'] = $this->validateUser($b['chair_user_id'] ?? null, $orgId); }
|
||||
if ($this->hasParam('attendees')) {
|
||||
$att = $this->validateAttendees($b['attendees'] ?? null);
|
||||
$updates['attendees'] = $att !== null ? json_encode($att, JSON_UNESCAPED_UNICODE) : null;
|
||||
}
|
||||
if ($this->hasParam('conclusions')) { $updates['conclusions'] = $this->nullableStr($b['conclusions'] ?? null); }
|
||||
// snapshot editabile finché draft: l'utente rivede gli input prima del congelamento
|
||||
if ($this->hasParam('snapshot')) {
|
||||
$snap = $b['snapshot'] ?? null;
|
||||
$updates['snapshot'] = is_array($snap) ? json_encode($snap, JSON_UNESCAPED_UNICODE) : null;
|
||||
}
|
||||
|
||||
if (!empty($updates)) {
|
||||
Database::update('management_reviews', $updates, 'id = ? AND organization_id = ?', [$id, $orgId]);
|
||||
}
|
||||
$this->logAudit('mgmt_review_updated', 'management_review', $id, array_keys($updates));
|
||||
$this->jsonSuccess(['id' => $id, 'updated' => array_keys($updates)], 'Riesame aggiornato');
|
||||
}
|
||||
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
// GATHER — aggregazione automatica degli INPUT del riesame
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
|
||||
/**
|
||||
* GET /api/management-reviews/gather
|
||||
* Aggrega gli INPUT del riesame (ISO 27001 §9.3.2) leggendo i moduli esistenti.
|
||||
* Ogni sezione è in try/catch isolato e org-scoped: una fonte mancante/rotta
|
||||
* non blocca le altre. L'utente rivede il risultato e lo congela nello snapshot.
|
||||
*/
|
||||
public function gather(): void
|
||||
{
|
||||
$this->requireOrgRole(self::MANAGE_ROLES);
|
||||
$orgId = $this->getCurrentOrgId();
|
||||
$this->jsonSuccess($this->buildGather($orgId));
|
||||
}
|
||||
|
||||
/** Costruisce l'oggetto strutturato delle sezioni di input (riusato da approve). */
|
||||
private function buildGather(int $orgId): array
|
||||
{
|
||||
$sections = [
|
||||
'nonconformities' => $this->sec(fn() => $this->gatherNonConformities($orgId)),
|
||||
'corrective_actions' => $this->sec(fn() => $this->gatherCorrectiveActions($orgId)),
|
||||
'internal_audits' => $this->sec(fn() => $this->gatherInternalAudits($orgId)),
|
||||
'risks' => $this->sec(fn() => $this->gatherRisks($orgId)),
|
||||
'compliance_score' => $this->sec(fn() => $this->gatherComplianceScore($orgId)),
|
||||
'objectives' => $this->sec(fn() => $this->gatherObjectives($orgId)),
|
||||
'training' => $this->sec(fn() => $this->gatherTraining($orgId)),
|
||||
'stakeholders' => $this->sec(fn() => $this->gatherStakeholders($orgId)),
|
||||
'normative' => $this->sec(fn() => $this->gatherNormative($orgId)),
|
||||
'upcoming_deadlines' => $this->sec(fn() => $this->gatherDeadlines($orgId)),
|
||||
];
|
||||
return [
|
||||
'generated_at' => date('Y-m-d H:i:s'),
|
||||
'sections' => $sections,
|
||||
];
|
||||
}
|
||||
|
||||
/** Wrapper difensivo: esegue $fn; se lancia (tabella mancante, ecc.) marca available=false. */
|
||||
private function sec(callable $fn): array
|
||||
{
|
||||
try {
|
||||
$data = $fn();
|
||||
return array_merge(['available' => true], $data);
|
||||
} catch (\Throwable $e) {
|
||||
return ['available' => false, 'reason' => 'not_available'];
|
||||
}
|
||||
}
|
||||
|
||||
/** 4. Stato NC/azioni correttive — non_conformities aperte. */
|
||||
private function gatherNonConformities(int $orgId): array
|
||||
{
|
||||
$open = ['open', 'investigating', 'action_planned', 'correcting', 'verifying'];
|
||||
$place = implode(',', array_fill(0, count($open), '?'));
|
||||
$rows = Database::fetchAll(
|
||||
"SELECT id, ncr_code, title, severity, status, target_close_date
|
||||
FROM non_conformities
|
||||
WHERE organization_id = ? AND status IN ($place)
|
||||
ORDER BY (target_close_date IS NULL), target_close_date ASC, id DESC
|
||||
LIMIT 100",
|
||||
array_merge([$orgId], $open)
|
||||
);
|
||||
return [
|
||||
'open_count' => count($rows),
|
||||
'items' => array_map(static fn($r) => [
|
||||
'id' => (int) $r['id'], 'code' => $r['ncr_code'], 'title' => $r['title'],
|
||||
'severity' => $r['severity'], 'status' => $r['status'], 'due_date' => $r['target_close_date'],
|
||||
], $rows),
|
||||
];
|
||||
}
|
||||
|
||||
/** 1. Azioni dal riesame precedente / CAPA non chiuse. */
|
||||
private function gatherCorrectiveActions(int $orgId): array
|
||||
{
|
||||
$open = ['planned', 'in_progress'];
|
||||
$place = implode(',', array_fill(0, count($open), '?'));
|
||||
$rows = Database::fetchAll(
|
||||
"SELECT id, capa_code, title, status, due_date, action_type
|
||||
FROM capa_actions
|
||||
WHERE organization_id = ? AND status IN ($place)
|
||||
ORDER BY (due_date IS NULL), due_date ASC, id DESC
|
||||
LIMIT 100",
|
||||
array_merge([$orgId], $open)
|
||||
);
|
||||
return [
|
||||
'open_count' => count($rows),
|
||||
'items' => array_map(static fn($r) => [
|
||||
'id' => (int) $r['id'], 'code' => $r['capa_code'], 'title' => $r['title'],
|
||||
'status' => $r['status'], 'due_date' => $r['due_date'], 'type' => $r['action_type'],
|
||||
], $rows),
|
||||
];
|
||||
}
|
||||
|
||||
/** 3. Risultati audit interni (Modulo A — la tabella potrebbe non esistere). */
|
||||
private function gatherInternalAudits(int $orgId): array
|
||||
{
|
||||
// Se internal_audits non esiste, la query lancia e sec() marca available=false.
|
||||
$rows = Database::fetchAll(
|
||||
'SELECT id, code, title, status, planned_date, executed_date, conclusion
|
||||
FROM internal_audits
|
||||
WHERE organization_id = ?
|
||||
ORDER BY (planned_date IS NULL), planned_date DESC, id DESC
|
||||
LIMIT 50',
|
||||
[$orgId]
|
||||
);
|
||||
$completed = 0; $planned = 0;
|
||||
foreach ($rows as $r) {
|
||||
if ($r['status'] === 'completed') { $completed++; }
|
||||
elseif (in_array($r['status'], ['planned', 'in_progress'], true)) { $planned++; }
|
||||
}
|
||||
return [
|
||||
'total' => count($rows),
|
||||
'completed' => $completed,
|
||||
'planned' => $planned,
|
||||
'items' => array_map(static fn($r) => [
|
||||
'id' => (int) $r['id'], 'code' => $r['code'], 'title' => $r['title'],
|
||||
'status' => $r['status'], 'planned_date' => $r['planned_date'],
|
||||
'executed_date' => $r['executed_date'],
|
||||
'conclusion' => $r['conclusion'] !== null ? mb_substr((string) $r['conclusion'], 0, 280) : null,
|
||||
], $rows),
|
||||
];
|
||||
}
|
||||
|
||||
/** 7. Stato rischi + trattamenti. */
|
||||
private function gatherRisks(int $orgId): array
|
||||
{
|
||||
$byStatus = Database::fetchAll(
|
||||
'SELECT status, COUNT(*) AS c FROM risks WHERE organization_id = ? GROUP BY status',
|
||||
[$orgId]
|
||||
);
|
||||
$statusMap = [];
|
||||
foreach ($byStatus as $s) { $statusMap[$s['status']] = (int) $s['c']; }
|
||||
|
||||
// risk_treatments NON ha organization_id: si filtra via JOIN su risks (come CalendarController).
|
||||
$treat = Database::fetchOne(
|
||||
"SELECT
|
||||
SUM(CASE WHEN rt.status = 'completed' THEN 1 ELSE 0 END) AS completed,
|
||||
SUM(CASE WHEN rt.status IN ('planned','in_progress') THEN 1 ELSE 0 END) AS open,
|
||||
SUM(CASE WHEN rt.status = 'overdue' OR (rt.due_date IS NOT NULL AND rt.due_date < CURDATE() AND rt.status <> 'completed') THEN 1 ELSE 0 END) AS overdue,
|
||||
COUNT(*) AS total
|
||||
FROM risk_treatments rt JOIN risks r ON r.id = rt.risk_id
|
||||
WHERE r.organization_id = ?",
|
||||
[$orgId]
|
||||
) ?: [];
|
||||
|
||||
$top = Database::fetchAll(
|
||||
"SELECT id, title, inherent_risk_score, residual_risk_score, status
|
||||
FROM risks
|
||||
WHERE organization_id = ? AND status <> 'closed'
|
||||
ORDER BY inherent_risk_score DESC, id DESC LIMIT 10",
|
||||
[$orgId]
|
||||
);
|
||||
return [
|
||||
'total' => (int) array_sum($statusMap),
|
||||
'by_status' => $statusMap,
|
||||
'treatments' => [
|
||||
'total' => (int) ($treat['total'] ?? 0),
|
||||
'completed' => (int) ($treat['completed'] ?? 0),
|
||||
'open' => (int) ($treat['open'] ?? 0),
|
||||
'overdue' => (int) ($treat['overdue'] ?? 0),
|
||||
],
|
||||
'top_risks' => array_map(static fn($r) => [
|
||||
'id' => (int) $r['id'], 'title' => $r['title'],
|
||||
'inherent' => $r['inherent_risk_score'] !== null ? (int) $r['inherent_risk_score'] : null,
|
||||
'residual' => $r['residual_risk_score'] !== null ? (int) $r['residual_risk_score'] : null,
|
||||
'status' => $r['status'],
|
||||
], $top),
|
||||
];
|
||||
}
|
||||
|
||||
/** 5. Risultati monitoraggio/KPI: avanzamento SoA (isms_soa) se presente. */
|
||||
private function gatherComplianceScore(int $orgId): array
|
||||
{
|
||||
$soa = Database::fetchOne(
|
||||
"SELECT COUNT(*) AS total,
|
||||
SUM(CASE WHEN applicable = 1 THEN 1 ELSE 0 END) AS applicable,
|
||||
ROUND(AVG(CASE WHEN applicable = 1 THEN implementation_pct END)) AS avg_pct,
|
||||
SUM(CASE WHEN applicable = 1 AND implementation_status = 'implemented' THEN 1 ELSE 0 END) AS implemented,
|
||||
SUM(CASE WHEN applicable = 1 AND implementation_status = 'verified' THEN 1 ELSE 0 END) AS verified
|
||||
FROM isms_soa WHERE organization_id = ?",
|
||||
[$orgId]
|
||||
) ?: [];
|
||||
return [
|
||||
'soa_controls_total' => (int) ($soa['total'] ?? 0),
|
||||
'soa_controls_applicable' => (int) ($soa['applicable'] ?? 0),
|
||||
'soa_avg_implementation' => $soa['avg_pct'] !== null ? (int) $soa['avg_pct'] : null,
|
||||
'soa_implemented' => (int) ($soa['implemented'] ?? 0),
|
||||
'soa_verified' => (int) ($soa['verified'] ?? 0),
|
||||
];
|
||||
}
|
||||
|
||||
/** 6. Raggiungimento obiettivi SGSI: isms_models.isms_objectives (JSON) se presente. */
|
||||
private function gatherObjectives(int $orgId): array
|
||||
{
|
||||
$row = Database::fetchOne('SELECT isms_objectives FROM isms_models WHERE organization_id = ?', [$orgId]);
|
||||
$objs = ($row && $row['isms_objectives']) ? json_decode($row['isms_objectives'], true) : [];
|
||||
$items = is_array($objs) ? array_values(array_filter(array_map(static function ($o) {
|
||||
if (is_string($o)) { return ['title' => mb_substr($o, 0, 280)]; }
|
||||
if (is_array($o)) {
|
||||
return [
|
||||
'title' => isset($o['title']) ? mb_substr((string) $o['title'], 0, 280)
|
||||
: (isset($o['name']) ? mb_substr((string) $o['name'], 0, 280) : null),
|
||||
'target' => $o['target'] ?? null,
|
||||
'status' => $o['status'] ?? null,
|
||||
];
|
||||
}
|
||||
return null;
|
||||
}, $objs))) : [];
|
||||
return ['count' => count($items), 'items' => $items];
|
||||
}
|
||||
|
||||
/** Formazione non conforme: assegnazioni scadute/non completate. */
|
||||
private function gatherTraining(int $orgId): array
|
||||
{
|
||||
$row = Database::fetchOne(
|
||||
"SELECT
|
||||
SUM(CASE WHEN status = 'overdue' OR (due_date IS NOT NULL AND due_date < CURDATE() AND status <> 'completed') THEN 1 ELSE 0 END) AS overdue,
|
||||
SUM(CASE WHEN status = 'completed' THEN 1 ELSE 0 END) AS completed,
|
||||
COUNT(*) AS total
|
||||
FROM training_assignments WHERE organization_id = ?",
|
||||
[$orgId]
|
||||
) ?: [];
|
||||
return [
|
||||
'total' => (int) ($row['total'] ?? 0),
|
||||
'completed' => (int) ($row['completed'] ?? 0),
|
||||
'overdue' => (int) ($row['overdue'] ?? 0),
|
||||
];
|
||||
}
|
||||
|
||||
/** 8. Feedback parti interessate: attività stakeholder (stk_activities). */
|
||||
private function gatherStakeholders(int $orgId): array
|
||||
{
|
||||
$row = Database::fetchOne(
|
||||
"SELECT
|
||||
COUNT(*) AS total,
|
||||
SUM(CASE WHEN status = 'sent' THEN 1 ELSE 0 END) AS sent,
|
||||
SUM(CASE WHEN status = 'completed' THEN 1 ELSE 0 END) AS completed
|
||||
FROM stk_activities WHERE organization_id = ?",
|
||||
[$orgId]
|
||||
) ?: [];
|
||||
$recent = Database::fetchAll(
|
||||
'SELECT id, title, type, status, due_date FROM stk_activities
|
||||
WHERE organization_id = ? ORDER BY id DESC LIMIT 10',
|
||||
[$orgId]
|
||||
);
|
||||
return [
|
||||
'total' => (int) ($row['total'] ?? 0),
|
||||
'sent' => (int) ($row['sent'] ?? 0),
|
||||
'completed' => (int) ($row['completed'] ?? 0),
|
||||
'items' => array_map(static fn($a) => [
|
||||
'id' => (int) $a['id'], 'title' => $a['title'], 'type' => $a['type'],
|
||||
'status' => $a['status'], 'due_date' => $a['due_date'],
|
||||
], $recent),
|
||||
];
|
||||
}
|
||||
|
||||
/** 9. Aggiornamenti normativi non ACK (normative_updates / normative_ack). */
|
||||
private function gatherNormative(int $orgId): array
|
||||
{
|
||||
$rows = Database::fetchAll(
|
||||
'SELECT u.id, u.title, u.source, u.reference, u.impact_level, u.effective_date
|
||||
FROM normative_updates u
|
||||
WHERE u.is_published = 1
|
||||
AND NOT EXISTS (
|
||||
SELECT 1 FROM normative_ack a
|
||||
WHERE a.normative_update_id = u.id AND a.organization_id = ?
|
||||
)
|
||||
ORDER BY u.published_at DESC
|
||||
LIMIT 50',
|
||||
[$orgId]
|
||||
);
|
||||
return [
|
||||
'pending_count' => count($rows),
|
||||
'items' => array_map(static fn($r) => [
|
||||
'id' => (int) $r['id'], 'title' => $r['title'], 'source' => $r['source'],
|
||||
'reference' => $r['reference'], 'impact' => $r['impact_level'],
|
||||
'effective_date' => $r['effective_date'],
|
||||
], $rows),
|
||||
];
|
||||
}
|
||||
|
||||
/** Scadenze imminenti (review_schedule, 90 gg). */
|
||||
private function gatherDeadlines(int $orgId): array
|
||||
{
|
||||
$rows = Database::fetchAll(
|
||||
'SELECT id, entity_type, title, next_review_date
|
||||
FROM review_schedule
|
||||
WHERE organization_id = ? AND next_review_date <= DATE_ADD(CURDATE(), INTERVAL 90 DAY)
|
||||
ORDER BY next_review_date ASC
|
||||
LIMIT 100',
|
||||
[$orgId]
|
||||
);
|
||||
$today = date('Y-m-d');
|
||||
return [
|
||||
'count' => count($rows),
|
||||
'items' => array_map(static fn($r) => [
|
||||
'id' => (int) $r['id'], 'entity_type' => $r['entity_type'], 'title' => $r['title'],
|
||||
'next_review_date' => $r['next_review_date'],
|
||||
'overdue' => ($r['next_review_date'] !== null && $r['next_review_date'] < $today),
|
||||
], $rows),
|
||||
];
|
||||
}
|
||||
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
// DECISIONI (OUTPUT)
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
|
||||
/** POST /api/management-reviews/{id}/decisions Body: {decision*, owner_role_id?, due_date?, status?, capa_id?} */
|
||||
public function addDecision(int $id): void
|
||||
{
|
||||
$this->requireOrgRole(self::MANAGE_ROLES);
|
||||
$orgId = $this->getCurrentOrgId();
|
||||
$r = Database::fetchOne('SELECT id, status FROM management_reviews WHERE id = ? AND organization_id = ?', [$id, $orgId]);
|
||||
if (!$r) { $this->jsonError('Riesame non trovato', 404, 'NOT_FOUND'); }
|
||||
if ($r['status'] === 'approved') { $this->jsonError('Il riesame è approvato: non si possono aggiungere decisioni', 409, 'REVIEW_APPROVED'); }
|
||||
$b = $this->getJsonBody();
|
||||
|
||||
$decision = trim((string) ($b['decision'] ?? ''));
|
||||
if ($decision === '') { $this->jsonError('Testo della decisione obbligatorio', 422, 'EMPTY_DECISION'); }
|
||||
|
||||
$ord = (int) (Database::fetchOne('SELECT COALESCE(MAX(ord), 0) + 1 AS n FROM management_review_decisions WHERE review_id = ?', [$id])['n'] ?? 1);
|
||||
|
||||
$did = Database::insert('management_review_decisions', [
|
||||
'review_id' => $id,
|
||||
'decision' => mb_substr($decision, 0, 5000),
|
||||
'owner_role_id' => $this->validateRole($b['owner_role_id'] ?? null, $orgId),
|
||||
'due_date' => $this->validateDate($b['due_date'] ?? null, 'due_date'),
|
||||
'status' => in_array($b['status'] ?? '', ['open', 'in_progress', 'done'], true) ? $b['status'] : 'open',
|
||||
'capa_id' => $this->validateCapa($b['capa_id'] ?? null, $orgId),
|
||||
'ord' => $ord,
|
||||
]);
|
||||
$this->logAudit('mgmt_review_decision_added', 'management_review', $id, ['decision_id' => (int) $did]);
|
||||
$this->jsonSuccess(['id' => (int) $did], 'Decisione aggiunta', 201);
|
||||
}
|
||||
|
||||
/** PUT /api/management-reviews/decisions/{subId} */
|
||||
public function updateDecision(int $subId): void
|
||||
{
|
||||
$this->requireOrgRole(self::MANAGE_ROLES);
|
||||
$orgId = $this->getCurrentOrgId();
|
||||
$b = $this->getJsonBody();
|
||||
|
||||
// Anti-IDOR: la decisione deve appartenere a un riesame dell'org.
|
||||
$d = Database::fetchOne(
|
||||
'SELECT d.id, r.status AS review_status
|
||||
FROM management_review_decisions d
|
||||
JOIN management_reviews r ON r.id = d.review_id
|
||||
WHERE d.id = ? AND r.organization_id = ?',
|
||||
[$subId, $orgId]
|
||||
);
|
||||
if (!$d) { $this->jsonError('Decisione non trovata', 404, 'NOT_FOUND'); }
|
||||
if ($d['review_status'] === 'approved') { $this->jsonError('Il riesame è approvato: decisione non modificabile', 409, 'REVIEW_APPROVED'); }
|
||||
|
||||
$updates = [];
|
||||
if ($this->hasParam('decision')) {
|
||||
$decision = trim((string) ($b['decision'] ?? ''));
|
||||
if ($decision === '') { $this->jsonError('Testo della decisione obbligatorio', 422, 'EMPTY_DECISION'); }
|
||||
$updates['decision'] = mb_substr($decision, 0, 5000);
|
||||
}
|
||||
if ($this->hasParam('owner_role_id')) { $updates['owner_role_id'] = $this->validateRole($b['owner_role_id'] ?? null, $orgId); }
|
||||
if ($this->hasParam('due_date')) { $updates['due_date'] = $this->validateDate($b['due_date'] ?? null, 'due_date'); }
|
||||
if ($this->hasParam('status') && in_array($b['status'], ['open', 'in_progress', 'done'], true)) { $updates['status'] = $b['status']; }
|
||||
if ($this->hasParam('capa_id')) { $updates['capa_id'] = $this->validateCapa($b['capa_id'] ?? null, $orgId); }
|
||||
|
||||
if (!empty($updates)) {
|
||||
Database::update('management_review_decisions', $updates, 'id = ?', [$subId]);
|
||||
}
|
||||
$this->logAudit('mgmt_review_decision_updated', 'management_review_decision', $subId, array_keys($updates));
|
||||
$this->jsonSuccess(['id' => $subId, 'updated' => array_keys($updates)], 'Decisione aggiornata');
|
||||
}
|
||||
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
// APPROVE — congela snapshot + immutabilità
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
|
||||
/** POST /api/management-reviews/{id}/approve (org_admin) */
|
||||
public function approve(int $id): void
|
||||
{
|
||||
$this->requireOrgRole(self::APPROVE_ROLES);
|
||||
$orgId = $this->getCurrentOrgId();
|
||||
$r = Database::fetchOne('SELECT id, status, snapshot FROM management_reviews WHERE id = ? AND organization_id = ?', [$id, $orgId]);
|
||||
if (!$r) { $this->jsonError('Riesame non trovato', 404, 'NOT_FOUND'); }
|
||||
if ($r['status'] === 'approved') { $this->jsonError('Riesame già approvato', 409, 'ALREADY_APPROVED'); }
|
||||
|
||||
// Congela lo snapshot: usa quello già salvato (rivisto dall'utente) oppure,
|
||||
// se assente, ricalcola gli input aggregati al momento dell'approvazione.
|
||||
$existing = $r['snapshot'] ? json_decode($r['snapshot'], true) : null;
|
||||
$snapshot = is_array($existing) && !empty($existing) ? $existing : $this->buildGather($orgId);
|
||||
$snapshot['frozen_at'] = date('Y-m-d H:i:s');
|
||||
|
||||
Database::update('management_reviews', [
|
||||
'status' => 'approved',
|
||||
'approved_by' => $this->getCurrentUserId(),
|
||||
'approved_at' => date('Y-m-d H:i:s'),
|
||||
'snapshot' => json_encode($snapshot, JSON_UNESCAPED_UNICODE),
|
||||
], 'id = ? AND organization_id = ?', [$id, $orgId]);
|
||||
|
||||
$this->logAudit('mgmt_review_approved', 'management_review', $id, ['frozen' => true]);
|
||||
$this->jsonSuccess(['id' => $id, 'status' => 'approved'], 'Riesame approvato');
|
||||
}
|
||||
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
// REPORT — verbale HTML stampabile
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
|
||||
/** GET /api/management-reviews/{id}/report (verbale HTML stampabile) */
|
||||
public function report(int $id): void
|
||||
{
|
||||
$this->requireOrgRole(['org_admin', 'compliance_manager', 'board_member', 'auditor']);
|
||||
$orgId = $this->getCurrentOrgId();
|
||||
$r = Database::fetchOne(
|
||||
'SELECT r.*, u.full_name AS chair_name, a.full_name AS approver_name, o.name AS org_name
|
||||
FROM management_reviews r
|
||||
LEFT JOIN users u ON u.id = r.chair_user_id
|
||||
LEFT JOIN users a ON a.id = r.approved_by
|
||||
LEFT JOIN organizations o ON o.id = r.organization_id
|
||||
WHERE r.id = ? AND r.organization_id = ?',
|
||||
[$id, $orgId]
|
||||
);
|
||||
if (!$r) { $this->jsonError('Riesame non trovato', 404, 'NOT_FOUND'); }
|
||||
|
||||
$decisions = $this->loadDecisions($id);
|
||||
$snapshot = $r['snapshot'] ? json_decode($r['snapshot'], true) : ($r['status'] === 'approved' ? null : $this->buildGather($orgId));
|
||||
|
||||
header('Content-Type: text/html; charset=utf-8');
|
||||
echo $this->renderReportHtml($r, $decisions, is_array($snapshot) ? $snapshot : ['sections' => []]);
|
||||
exit;
|
||||
}
|
||||
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
// HELPER
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
|
||||
private function loadDecisions(int $reviewId): array
|
||||
{
|
||||
$rows = Database::fetchAll(
|
||||
'SELECT d.id, d.decision, d.owner_role_id, ro.role_name AS owner_role_name,
|
||||
d.due_date, d.status, d.capa_id, c.capa_code, d.ord
|
||||
FROM management_review_decisions d
|
||||
LEFT JOIN org_roles ro ON ro.id = d.owner_role_id
|
||||
LEFT JOIN capa_actions c ON c.id = d.capa_id
|
||||
WHERE d.review_id = ? ORDER BY d.ord ASC, d.id ASC',
|
||||
[$reviewId]
|
||||
);
|
||||
return array_map(static fn($d) => [
|
||||
'id' => (int) $d['id'],
|
||||
'decision' => $d['decision'],
|
||||
'owner_role_id' => $d['owner_role_id'] !== null ? (int) $d['owner_role_id'] : null,
|
||||
'owner_role_name' => $d['owner_role_name'],
|
||||
'due_date' => $d['due_date'],
|
||||
'status' => $d['status'],
|
||||
'capa_id' => $d['capa_id'] !== null ? (int) $d['capa_id'] : null,
|
||||
'capa_code' => $d['capa_code'],
|
||||
'ord' => (int) $d['ord'],
|
||||
], $rows);
|
||||
}
|
||||
|
||||
/** Genera RD-AAAA-NN univoco per org+anno (NN progressivo, 2 cifre). */
|
||||
private function nextCode(int $orgId, int $year): string
|
||||
{
|
||||
$prefix = 'RD-' . $year . '-';
|
||||
// progressivo NUMERICO (non lessicografico: 'RD-2026-100' verrebbe < 'RD-2026-99')
|
||||
$row = Database::fetchOne(
|
||||
"SELECT MAX(CAST(SUBSTRING_INDEX(code, '-', -1) AS UNSIGNED)) AS n
|
||||
FROM management_reviews WHERE organization_id = ? AND code LIKE ?",
|
||||
[$orgId, $prefix . '%']
|
||||
);
|
||||
$next = ((int) ($row['n'] ?? 0)) + 1;
|
||||
return $prefix . str_pad((string) $next, 2, '0', STR_PAD_LEFT);
|
||||
}
|
||||
|
||||
private function validateUser($id, int $orgId): ?int
|
||||
{
|
||||
$id = ($id === null || $id === '') ? null : (int) $id;
|
||||
if ($id === null) { return null; }
|
||||
// l'utente deve essere membro dell'org (anti-IDOR)
|
||||
$ok = Database::fetchOne(
|
||||
'SELECT user_id FROM user_organizations WHERE user_id = ? AND organization_id = ?',
|
||||
[$id, $orgId]
|
||||
);
|
||||
if (!$ok) { $this->jsonError('Utente presidente non valido per questa organizzazione', 422, 'INVALID_CHAIR'); }
|
||||
return $id;
|
||||
}
|
||||
|
||||
private function validateRole($id, int $orgId): ?int
|
||||
{
|
||||
$id = ($id === null || $id === '') ? null : (int) $id;
|
||||
if ($id === null) { return null; }
|
||||
$ok = Database::fetchOne('SELECT id FROM org_roles WHERE id = ? AND organization_id = ?', [$id, $orgId]);
|
||||
if (!$ok) { $this->jsonError('Ruolo owner non valido', 422, 'INVALID_ROLE'); }
|
||||
return $id;
|
||||
}
|
||||
|
||||
private function validateCapa($id, int $orgId): ?int
|
||||
{
|
||||
$id = ($id === null || $id === '') ? null : (int) $id;
|
||||
if ($id === null) { return null; }
|
||||
$ok = Database::fetchOne('SELECT id FROM capa_actions WHERE id = ? AND organization_id = ?', [$id, $orgId]);
|
||||
if (!$ok) { $this->jsonError('Azione CAPA collegata non valida', 422, 'INVALID_CAPA'); }
|
||||
return $id;
|
||||
}
|
||||
|
||||
private function validateAttendees($raw): ?array
|
||||
{
|
||||
if ($raw === null) { return null; }
|
||||
if (!is_array($raw)) { $this->jsonError('attendees deve essere un array', 422, 'INVALID_ATTENDEES'); }
|
||||
$out = [];
|
||||
foreach ($raw as $a) {
|
||||
if (is_string($a)) { $name = trim($a); $role = ''; }
|
||||
elseif (is_array($a)) { $name = trim((string) ($a['name'] ?? '')); $role = trim((string) ($a['role'] ?? '')); }
|
||||
else { continue; }
|
||||
if ($name === '') { continue; }
|
||||
$item = ['name' => mb_substr($name, 0, 150)];
|
||||
if ($role !== '') { $item['role'] = mb_substr($role, 0, 150); }
|
||||
$out[] = $item;
|
||||
}
|
||||
return $out;
|
||||
}
|
||||
|
||||
private function validateDate($v, string $field): ?string
|
||||
{
|
||||
if ($v === null || $v === '') { return null; }
|
||||
$d = trim((string) $v);
|
||||
$dt = DateTime::createFromFormat('Y-m-d', $d);
|
||||
if (!$dt || $dt->format('Y-m-d') !== $d) { $this->jsonError("Data $field non valida (atteso AAAA-MM-GG)", 422, 'INVALID_DATE'); }
|
||||
return $d;
|
||||
}
|
||||
|
||||
private function nullableStr($v, ?int $max = null): ?string
|
||||
{
|
||||
if ($v === null) { return null; }
|
||||
$s = trim((string) $v);
|
||||
if ($s === '') { return null; }
|
||||
if ($max !== null && mb_strlen($s) > $max) { $s = mb_substr($s, 0, $max); }
|
||||
return $s;
|
||||
}
|
||||
|
||||
/** HTML del verbale (stampabile). Tutto escapato (esc). */
|
||||
private function renderReportHtml(array $r, array $decisions, array $snapshot): string
|
||||
{
|
||||
$esc = static fn($s) => htmlspecialchars((string) ($s ?? ''), ENT_QUOTES, 'UTF-8');
|
||||
$sections = $snapshot['sections'] ?? [];
|
||||
|
||||
$stLabel = $r['status'] === 'approved' ? 'APPROVATO' : 'BOZZA';
|
||||
$att = $r['attendees'] ? json_decode($r['attendees'], true) : [];
|
||||
$attList = '';
|
||||
if (is_array($att) && $att) {
|
||||
$attList = '<ul>' . implode('', array_map(static function ($a) use ($esc) {
|
||||
$n = is_array($a) ? ($a['name'] ?? '') : $a;
|
||||
$ro = is_array($a) ? ($a['role'] ?? '') : '';
|
||||
return '<li>' . $esc($n) . ($ro ? ' — <em>' . $esc($ro) . '</em>' : '') . '</li>';
|
||||
}, $att)) . '</ul>';
|
||||
} else {
|
||||
$attList = '<p class="muted">Nessun partecipante indicato.</p>';
|
||||
}
|
||||
|
||||
// Tabella decisioni
|
||||
$decRows = '';
|
||||
if ($decisions) {
|
||||
foreach ($decisions as $d) {
|
||||
$stMap = ['open' => 'Aperta', 'in_progress' => 'In corso', 'done' => 'Conclusa'];
|
||||
$decRows .= '<tr><td>' . $esc($d['decision']) . '</td>'
|
||||
. '<td>' . $esc($d['owner_role_name'] ?: '—') . '</td>'
|
||||
. '<td>' . $esc($d['due_date'] ?: '—') . '</td>'
|
||||
. '<td>' . $esc($stMap[$d['status']] ?? $d['status']) . '</td>'
|
||||
. '<td>' . $esc($d['capa_code'] ?: '—') . '</td></tr>';
|
||||
}
|
||||
} else {
|
||||
$decRows = '<tr><td colspan="5" class="muted">Nessuna decisione registrata.</td></tr>';
|
||||
}
|
||||
|
||||
$inputs = $this->renderInputsHtml($sections, $esc);
|
||||
|
||||
return '<!DOCTYPE html><html lang="it"><head><meta charset="utf-8">'
|
||||
. '<title>Verbale Riesame di Direzione ' . $esc($r['code']) . '</title>'
|
||||
. '<style>'
|
||||
. 'body{font-family:-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;color:#1f2937;max-width:900px;margin:24px auto;padding:0 20px;line-height:1.5;}'
|
||||
. 'h1{font-size:1.5rem;border-bottom:3px solid #0066CC;padding-bottom:8px;}'
|
||||
. 'h2{font-size:1.1rem;margin-top:28px;color:#0066CC;border-bottom:1px solid #e5e7eb;padding-bottom:4px;}'
|
||||
. 'h3{font-size:.95rem;margin:18px 0 6px;}'
|
||||
. '.meta{background:#f8fafc;border:1px solid #e5e7eb;border-radius:8px;padding:14px 18px;font-size:.9rem;}'
|
||||
. '.meta div{margin:3px 0;} .badge{display:inline-block;padding:2px 10px;border-radius:6px;font-weight:700;font-size:.8rem;}'
|
||||
. '.b-approved{background:#dcfce7;color:#166534;} .b-draft{background:#f3f4f6;color:#6b7280;}'
|
||||
. 'table{width:100%;border-collapse:collapse;font-size:.86rem;margin:8px 0 16px;}'
|
||||
. 'th,td{border:1px solid #e5e7eb;padding:7px 10px;text-align:left;vertical-align:top;}'
|
||||
. 'th{background:#f1f5f9;font-size:.78rem;text-transform:uppercase;letter-spacing:.03em;}'
|
||||
. '.muted{color:#9ca3af;} ul{margin:4px 0;padding-left:20px;}'
|
||||
. '.foot{margin-top:36px;font-size:.78rem;color:#6b7280;border-top:1px solid #e5e7eb;padding-top:10px;}'
|
||||
. '@media print{body{margin:0;} h2{page-break-after:avoid;}}'
|
||||
. '</style></head><body>'
|
||||
. '<h1>Verbale del Riesame di Direzione</h1>'
|
||||
. '<div class="meta">'
|
||||
. '<div><strong>Organizzazione:</strong> ' . $esc($r['org_name']) . '</div>'
|
||||
. '<div><strong>Codice:</strong> ' . $esc($r['code']) . ' <span class="badge ' . ($r['status'] === 'approved' ? 'b-approved' : 'b-draft') . '">' . $stLabel . '</span></div>'
|
||||
. '<div><strong>Data riesame:</strong> ' . $esc($r['review_date'] ?: '—') . '</div>'
|
||||
. '<div><strong>Periodo di riferimento:</strong> ' . $esc($r['period_label'] ?: '—') . '</div>'
|
||||
. '<div><strong>Presidente:</strong> ' . $esc($r['chair_name'] ?: '—') . '</div>'
|
||||
. ($r['status'] === 'approved' ? '<div><strong>Approvato da:</strong> ' . $esc($r['approver_name'] ?: '—') . ' il ' . $esc($r['approved_at']) . '</div>' : '')
|
||||
. '</div>'
|
||||
. '<h2>Partecipanti</h2>' . $attList
|
||||
. '<h2>Elementi in ingresso (ISO/IEC 27001 §9.3.2)</h2>' . $inputs
|
||||
. '<h2>Conclusioni</h2>' . ($r['conclusions'] ? '<p>' . nl2br($esc($r['conclusions'])) . '</p>' : '<p class="muted">Nessuna conclusione registrata.</p>')
|
||||
. '<h2>Decisioni e azioni (elementi in uscita §9.3.3)</h2>'
|
||||
. '<table><thead><tr><th>Decisione</th><th>Responsabile (ruolo)</th><th>Scadenza</th><th>Stato</th><th>CAPA</th></tr></thead><tbody>'
|
||||
. $decRows . '</tbody></table>'
|
||||
. '<div class="foot">Documento generato da NIS2 Agile — riesame periodico del SGSI (ISO/IEC 27001 cl. 9.3; buona prassi di governance NIS2 GV.PO-02). Strumento di supporto, non sostituisce l\'auditor.</div>'
|
||||
. '</body></html>';
|
||||
}
|
||||
|
||||
/** Rende le sezioni di input dello snapshot in HTML compatto. */
|
||||
private function renderInputsHtml(array $sections, callable $esc): string
|
||||
{
|
||||
$titles = [
|
||||
'corrective_actions' => 'Stato azioni dal riesame precedente / CAPA aperte',
|
||||
'stakeholders' => 'Cambiamenti del contesto e parti interessate',
|
||||
'internal_audits' => 'Risultati degli audit interni',
|
||||
'nonconformities' => 'Non conformità e azioni correttive',
|
||||
'compliance_score' => 'Risultati del monitoraggio (avanzamento SoA / KPI)',
|
||||
'objectives' => 'Raggiungimento degli obiettivi del SGSI',
|
||||
'risks' => 'Valutazione dei rischi e stato del trattamento',
|
||||
'normative' => 'Aggiornamenti normativi non riscontrati (ACK)',
|
||||
'training' => 'Formazione e consapevolezza',
|
||||
'upcoming_deadlines' => 'Scadenze imminenti (90 giorni)',
|
||||
];
|
||||
$html = '';
|
||||
foreach ($titles as $key => $title) {
|
||||
$sec = $sections[$key] ?? null;
|
||||
$html .= '<h3>' . $esc($title) . '</h3>';
|
||||
if (!is_array($sec) || empty($sec['available'])) {
|
||||
$html .= '<p class="muted">Dato non disponibile.</p>';
|
||||
continue;
|
||||
}
|
||||
$html .= '<p>' . $esc($this->summarizeSection($key, $sec)) . '</p>';
|
||||
$items = $sec['items'] ?? null;
|
||||
if (is_array($items) && $items) {
|
||||
$html .= '<ul>';
|
||||
foreach (array_slice($items, 0, 15) as $it) {
|
||||
$label = $it['title'] ?? ($it['code'] ?? '');
|
||||
$extra = [];
|
||||
foreach (['code', 'status', 'severity', 'due_date', 'next_review_date', 'impact', 'reference'] as $f) {
|
||||
if (!empty($it[$f]) && $it[$f] !== $label) { $extra[] = $esc($it[$f]); }
|
||||
}
|
||||
$html .= '<li>' . $esc($label) . ($extra ? ' <span class="muted">(' . implode(' · ', $extra) . ')</span>' : '') . '</li>';
|
||||
}
|
||||
$html .= '</ul>';
|
||||
}
|
||||
}
|
||||
return $html;
|
||||
}
|
||||
|
||||
/** Frase di sintesi numerica per sezione. */
|
||||
private function summarizeSection(string $key, array $sec): string
|
||||
{
|
||||
switch ($key) {
|
||||
case 'nonconformities': return (int) ($sec['open_count'] ?? 0) . ' non conformità aperte.';
|
||||
case 'corrective_actions': return (int) ($sec['open_count'] ?? 0) . ' azioni correttive in corso.';
|
||||
case 'internal_audits': return (int) ($sec['total'] ?? 0) . ' audit interni (' . (int) ($sec['completed'] ?? 0) . ' completati, ' . (int) ($sec['planned'] ?? 0) . ' pianificati).';
|
||||
case 'risks':
|
||||
$t = $sec['treatments'] ?? [];
|
||||
return (int) ($sec['total'] ?? 0) . ' rischi censiti; trattamenti: ' . (int) ($t['completed'] ?? 0) . ' completati, ' . (int) ($t['open'] ?? 0) . ' aperti, ' . (int) ($t['overdue'] ?? 0) . ' in ritardo.';
|
||||
case 'compliance_score':
|
||||
$pct = $sec['soa_avg_implementation'];
|
||||
return 'Avanzamento medio SoA: ' . ($pct !== null ? (int) $pct . '%' : 'n/d') . ' su ' . (int) ($sec['soa_controls_applicable'] ?? 0) . ' controlli applicabili.';
|
||||
case 'objectives': return (int) ($sec['count'] ?? 0) . ' obiettivi SGSI definiti.';
|
||||
case 'training': return (int) ($sec['completed'] ?? 0) . '/' . (int) ($sec['total'] ?? 0) . ' assegnazioni completate, ' . (int) ($sec['overdue'] ?? 0) . ' in ritardo.';
|
||||
case 'stakeholders': return (int) ($sec['total'] ?? 0) . ' attività verso stakeholder (' . (int) ($sec['completed'] ?? 0) . ' completate).';
|
||||
case 'normative': return (int) ($sec['pending_count'] ?? 0) . ' aggiornamenti normativi da riscontrare.';
|
||||
case 'upcoming_deadlines': return (int) ($sec['count'] ?? 0) . ' scadenze nei prossimi 90 giorni.';
|
||||
}
|
||||
return '';
|
||||
}
|
||||
}
|
||||
@@ -42,7 +42,7 @@ class ReviewScheduleController extends BaseController
|
||||
private const MANAGE_ROLES = ['org_admin', 'compliance_manager'];
|
||||
|
||||
private const ENTITY_TYPES = [
|
||||
'role', 'skill', 'inventory', 'procedure', 'risk', 'supplier', 'measure', 'custom', 'stakeholder_activity',
|
||||
'role', 'skill', 'inventory', 'procedure', 'risk', 'supplier', 'measure', 'custom', 'stakeholder_activity', 'internal_audit',
|
||||
];
|
||||
|
||||
// ═══════════════════════════════════════════════════════════════════════
|
||||
|
||||
Reference in New Issue
Block a user