[FEAT] A4 Fasi 4.4 + 4.5 (A4 COMPLETA 5/5): scadenziario centralizzato review_schedule (mig.044; ReviewScheduleController list/create/update/delete/complete/sync) + stakeholder estesi clienti/partner GV.SC-02 (mig.045 suppliers.stakeholder_type, SupplyChainController::stakeholderMap). Pagine review-schedule.html + stakeholders.html (Bootstrap Italia/AGID). Workflow build+review adversariale (3 major risolti: 045 da DELIMITER -> ALTER bare runner-safe). help GV.SC-04/05 allineati al titolo canonico ACN. Cache-buster ?v=20260620.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-15 23:10:28 +02:00
parent c7d36c910f
commit c5b00ccd96
48 changed files with 1597 additions and 122 deletions
@@ -0,0 +1,50 @@
+-- ============================================================================
+-- Migration 044 — A4 Fase 4.4: Scadenziario centralizzato delle revisioni.
+-- ----------------------------------------------------------------------------
+-- 1 tabella ADDITIVA. Idempotente (CREATE TABLE IF NOT EXISTS). Applicare con la
+-- STESSA connessione PDO dell'app (container nis2-db via TCP+TLS), via runner
+-- scripts/migrate-a4.php. Runner-safe: solo CREATE TABLE, niente DELIMITER /
+-- stored procedure, nessun ';' dentro commenti o stringhe.
+--
+-- Cosa fa: raccoglie in un unico registro le scadenze di revisione periodica
+-- (ruoli, competenze, inventario, procedure, rischi, fornitori, misure, voci
+-- custom). Lo stato (ok/due/overdue) e' calcolato LIVE dal controller in base a
+-- next_review_date e NON ci si affida alla colonna persistita.
+--
+-- Ancoraggio normativo (docs/DESIGN_A4_RELATIONAL.md):
+--   - GV.PO-02 (NIST CSF 2.0): le policy/procedure sono riesaminate periodicamente
+--   - GV.SC-07 (NIST CSF 2.0): la sicurezza dei fornitori e' monitorata/rivista
+--   - PR.AT: formazione e sensibilizzazione ricorrenti
+--   - DE.CM: monitoraggio continuo
+--   - art. 24 D.Lgs. 138/2024: misure di gestione del rischio mantenute aggiornate
+-- Disclaimer: la periodicita' puntuale e' buona prassi dove non fissata da norma;
+-- e' uno strumento di supporto, non un parere legale.
+--
+-- Multi-tenancy: organization_id NOT NULL (FK organizations, ON DELETE CASCADE).
+-- owner_role_id -> org_roles (mig.041) ON DELETE SET NULL. created_by -> users
+-- ON DELETE SET NULL. UNIQUE (org, entity_type, entity_id) abilita l'upsert
+-- idempotente di sync() (le voci custom con entity_id NULL non collidono in MySQL).
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS review_schedule (
+    id INT AUTO_INCREMENT PRIMARY KEY,
+    organization_id INT NOT NULL,
+    entity_type ENUM('role','skill','inventory','procedure','risk','supplier','measure','custom') NOT NULL,
+    entity_id INT NULL,
+    title VARCHAR(255) NOT NULL,
+    owner_role_id INT NULL,
+    frequency_months INT NULL,
+    last_reviewed_at DATE NULL,
+    next_review_date DATE NOT NULL,
+    status ENUM('ok','due','overdue') NOT NULL DEFAULT 'ok',
+    notes TEXT NULL,
+    created_by INT NULL,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+    FOREIGN KEY (organization_id) REFERENCES organizations(id) ON DELETE CASCADE,
+    FOREIGN KEY (owner_role_id) REFERENCES org_roles(id) ON DELETE SET NULL,
+    FOREIGN KEY (created_by) REFERENCES users(id) ON DELETE SET NULL,
+    UNIQUE KEY uk_rs_entity (organization_id, entity_type, entity_id),
+    INDEX idx_rs_org_next (organization_id, next_review_date),
+    INDEX idx_rs_entity (organization_id, entity_type, entity_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;