AdminGit2026/nis2-agile
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FEAT] Epic C / C5.1 — Modulo Stakeholder: registro + matrice di Mendelow (mig.051)

Browse Source 
Registro dedicato degli stakeholder (tabella `stakeholders`, NON una colonna su
suppliers: gli interni non sono fornitori; gli esterni si COLLEGANO opzionalmente
a un supplier esistente senza duplicare il dato).

- mig.051: cfg_stakeholder_types (30 di sistema Stak.01-30 + org-added da Stak.31),
  cfg_stakeholder_quadrants (4, range corretti: Q4 potere 0-2), stakeholders,
  stakeholder_procedures (m2m -> policies). Seeder idempotente seed_stakeholders.php.
- StakeholderController: list/create/update/delete + types/addType + quadrants + pickers.
  Quadrante CALCOLATO a read-time dai range config. Anti-IDOR su org_role/supplier/
  policy/tipo; coerenza kind (interni->organigramma, esterni->fornitore); punteggi 0-5.
- api.js: metodi stk*. stakeholders.html riscritta: registro + matrice di Mendelow
  in SVG dependency-free + modali (stakeholder, nuovo tipo). Voce sidebar V2 (common-bi.js).
- Help aggiornato; cache-buster ?v=20260626 su tutte le pagine; version 1.19.0; sw cache v1.19.0.

Ancoraggio GV.SC-02 (obbligo, art. 24 D.Lgs. 138/2024). La matrice di Mendelow e'
etichettata come BUONA PRASSI, non obbligo NIS2 (regola fonti-certe). Additivo.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
DevEnv nis2-agile
2026-06-16 20:54:57 +02:00
co-authored by Claude Opus 4.8
parent 419162594d
commit c782aa54fa
43 changed files with 1256 additions and 278 deletions
Download Patch File Download Diff File Expand all files Collapse all files
application/cli/seed_stakeholders.php
+151
View File
@@ -0,0 +1,151 @@
<?php
/**
* NIS2 Agile — Importer idempotente del registro Stakeholder (Epic C / C5.1).
* ----------------------------------------------------------------------------
* Crea (se mancanti) le tabelle del modulo Stakeholder (mig.051) e popola i dati
* di SISTEMA: i 4 quadranti della matrice di Mendelow (range corretti, Q4 potere
* 0-2) e i 30 tipi di stakeholder Stak.01-30 (6 Interni / 24 Esterni) dal seed
* autoritativo application/data/nis2_framework_seed.json (chiave stakeholder_types,
* generata dai file docs/simon/*.xlsx — codifica NON variabile).
*
* Idempotente: CREATE TABLE IF NOT EXISTS + INSERT ... ON DUPLICATE KEY UPDATE
* sul PK `code` (nessuna trappola NULL-dedupe: il codice E' la chiave primaria).
* Rilanciabile senza duplicare ne' rompere le FK. Sostituisce i runner usa-e-getta.
*
* NB: la matrice di Mendelow (potere/interesse) e' BUONA PRASSI, NON un obbligo
* NIS2; l'obbligo e' GV.SC-02 (ruoli/responsabilita verso fornitori/clienti/partner).
*
* Uso (dentro il container app):
* docker exec nis2-app php /var/www/nis2-agile/application/cli/seed_stakeholders.php
*
* NB: solo CLI. DB API via PDO singleton (Database::getInstance()), TLS gestito
* dalla config dell'app.
*/
if (PHP_SAPI !== 'cli') {
http_response_code(403);
exit("Solo da CLI.\n");
}
require_once __DIR__ . '/../config/env.php';
require_once __DIR__ . '/../config/database.php';
$pdo = Database::getInstance();
$pdo->exec("SET NAMES utf8mb4 COLLATE utf8mb4_unicode_ci");
// --- DDL (idempotente, FK dentro il CREATE; allineato a docs/sql/051_*.sql) ---
$ddl = [
"CREATE TABLE IF NOT EXISTS cfg_stakeholder_types (
code VARCHAR(16) NOT NULL, organization_id INT NULL,
tipo ENUM('Interno','Esterno') NOT NULL, descr TEXT NOT NULL, ord INT NOT NULL DEFAULT 0,
created_by INT NULL,
created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
PRIMARY KEY (code), KEY idx_cfg_stk_type_org (organization_id),
CONSTRAINT fk_cfg_stk_type_org FOREIGN KEY (organization_id) REFERENCES organizations (id) ON DELETE CASCADE,
CONSTRAINT fk_cfg_stk_type_user FOREIGN KEY (created_by) REFERENCES users (id) ON DELETE SET NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
"CREATE TABLE IF NOT EXISTS cfg_stakeholder_quadrants (
code VARCHAR(4) NOT NULL, organization_id INT NULL,
label VARCHAR(64) NOT NULL, strategy TEXT NULL,
power_min TINYINT NOT NULL, power_max TINYINT NOT NULL,
interest_min TINYINT NOT NULL, interest_max TINYINT NOT NULL, ord INT NOT NULL DEFAULT 0,
PRIMARY KEY (code), KEY idx_cfg_stk_quad_org (organization_id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
"CREATE TABLE IF NOT EXISTS stakeholders (
id INT NOT NULL AUTO_INCREMENT, organization_id INT NOT NULL,
stak_code VARCHAR(16) NOT NULL, name VARCHAR(255) NOT NULL,
org_role_id INT NULL, supplier_id INT NULL,
power TINYINT NULL, interest TINYINT NULL,
contact_name VARCHAR(255) NULL, contact_email VARCHAR(255) NULL, notes TEXT NULL,
created_by INT NULL,
created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
PRIMARY KEY (id),
KEY idx_stk_org (organization_id), KEY idx_stk_org_code (organization_id, stak_code),
KEY idx_stk_role (org_role_id), KEY idx_stk_supplier (supplier_id),
CONSTRAINT fk_stk_org FOREIGN KEY (organization_id) REFERENCES organizations (id) ON DELETE CASCADE,
CONSTRAINT fk_stk_code FOREIGN KEY (stak_code) REFERENCES cfg_stakeholder_types (code),
CONSTRAINT fk_stk_role FOREIGN KEY (org_role_id) REFERENCES org_roles (id) ON DELETE SET NULL,
CONSTRAINT fk_stk_supplier FOREIGN KEY (supplier_id) REFERENCES suppliers (id) ON DELETE SET NULL,
CONSTRAINT fk_stk_user FOREIGN KEY (created_by) REFERENCES users (id) ON DELETE SET NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
"CREATE TABLE IF NOT EXISTS stakeholder_procedures (
stakeholder_id INT NOT NULL, policy_id INT NOT NULL,
PRIMARY KEY (stakeholder_id, policy_id), KEY idx_stk_proc_policy (policy_id),
CONSTRAINT fk_stk_proc_stk FOREIGN KEY (stakeholder_id) REFERENCES stakeholders (id) ON DELETE CASCADE,
CONSTRAINT fk_stk_proc_policy FOREIGN KEY (policy_id) REFERENCES policies (id) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
];
foreach ($ddl as $stmt) {
try { $pdo->exec($stmt); }
catch (PDOException $e) { if (!in_array($e->errorInfo[1] ?? 0, [1050, 1061], true)) { throw $e; } }
}
// --- Dati di sistema ---
$seedPath = __DIR__ . '/../data/nis2_framework_seed.json';
$seed = json_decode(@file_get_contents($seedPath), true);
if (!$seed || empty($seed['stakeholder_types'])) {
fwrite(STDERR, "SEED non leggibile o privo di stakeholder_types: $seedPath\n");
exit(1);
}
// 4 quadranti di sistema — matrice di Mendelow (x=interesse, y=potere).
// REFUSO corretto: Q4 (basso-sinistra, Monitorare) ha potere 0-2 (non 3-5).
$quadrants = [
// code, label, strategy, power_min, power_max, interest_min, interest_max, ord
['Q1', 'Tenere soddisfatti (Keep Satisfied)',
'Stakeholder istituzionali: forte potere di blocco, scarso interesse quotidiano. Tenerli soddisfatti ed evitare scontenti improvvisi.',
3, 5, 0, 2, 1],
['Q2', 'Gestire attivamente (Manage Closely)',
'Stakeholder chiave: decisori principali, supporto vitale. Gestione attiva e coinvolgimento costante.',
3, 5, 3, 5, 2],
['Q3', 'Tenere informati (Keep Informed)',
'Stakeholder operativi: molto coinvolti ma scarso peso decisionale. Tenerli informati.',
0, 2, 3, 5, 3],
['Q4', 'Monitorare (Monitor)',
'Stakeholder marginali: basso potere e basso interesse. Monitoraggio costante col minimo sforzo, comunicazioni periodiche non dispendiose.',
0, 2, 0, 2, 4],
];
$pdo->beginTransaction();
try {
$stQ = $pdo->prepare(
"INSERT INTO cfg_stakeholder_quadrants
(code,label,strategy,power_min,power_max,interest_min,interest_max,ord,organization_id)
VALUES (?,?,?,?,?,?,?,?,NULL)
ON DUPLICATE KEY UPDATE label=VALUES(label),strategy=VALUES(strategy),
power_min=VALUES(power_min),power_max=VALUES(power_max),
interest_min=VALUES(interest_min),interest_max=VALUES(interest_max),ord=VALUES(ord)"
);
foreach ($quadrants as $q) { $stQ->execute($q); }
// 30 tipi di sistema: code PK, organization_id NULL, tipo Interno/Esterno, descr verbatim.
$stT = $pdo->prepare(
"INSERT INTO cfg_stakeholder_types (code,organization_id,tipo,descr,ord)
VALUES (?,NULL,?,?,?)
ON DUPLICATE KEY UPDATE tipo=VALUES(tipo),descr=VALUES(descr),ord=VALUES(ord)"
);
$ord = 0;
foreach ($seed['stakeholder_types'] as $t) {
$ord++;
$tipo = ($t['tipo'] === 'Interno') ? 'Interno' : 'Esterno';
$stT->execute([$t['code'], $tipo, $t['descr'], $ord]);
}
$pdo->commit();
} catch (Throwable $e) {
$pdo->rollBack();
fwrite(STDERR, "SEED FALLITO: " . $e->getMessage() . "\n");
exit(1);
}
$counts = [
'quadranti' => (int) $pdo->query("SELECT COUNT(*) FROM cfg_stakeholder_quadrants WHERE organization_id IS NULL")->fetchColumn(),
'tipi_sistema' => (int) $pdo->query("SELECT COUNT(*) FROM cfg_stakeholder_types WHERE organization_id IS NULL")->fetchColumn(),
'tipi_interni' => (int) $pdo->query("SELECT COUNT(*) FROM cfg_stakeholder_types WHERE organization_id IS NULL AND tipo='Interno'")->fetchColumn(),
'tipi_esterni' => (int) $pdo->query("SELECT COUNT(*) FROM cfg_stakeholder_types WHERE organization_id IS NULL AND tipo='Esterno'")->fetchColumn(),
];
echo "OK seed-stakeholders — " . json_encode($counts, JSON_UNESCAPED_UNICODE) . "\n";
application/controllers/StakeholderController.php
+479
View File
@@ -0,0 +1,479 @@
<?php
/**
* NIS2 Agile - Registro Stakeholder + matrice di Mendelow (Epic C / C5.1)
* ----------------------------------------------------------------------------
* Registro degli stakeholder dell'organizzazione con:
* - TIPO configurabile (cfg_stakeholder_types: 30 di sistema Stak.01-30 +
* voci aggiunte dall'org da Stak.31; codifica di sistema NON variabile);
* - doppia valutazione POTERE/INTERESSE 0-5;
* - collegamento all'organigramma (org_roles) per gli stakeholder INTERNI;
* - collegamento alle procedure (policies) in molti-a-molti;
* - collocazione automatica su una matrice a 4 quadranti (cfg_stakeholder_quadrants),
* calcolata a read-time dai range di config (x=interesse, y=potere).
*
* Modello DEDICATO (tabella stakeholders): gli stakeholder interni non sono
* fornitori. Gli esterni possono COLLEGARSI a un supplier esistente (supplier_id)
* senza copiare dati: il modulo Supply Chain resta intatto e coesiste.
*
* Ancoraggio normativo: GV.SC-02 (obbligo: ruoli/responsabilita verso
* fornitori/clienti/partner -> art. 24 D.Lgs. 138/2024). La matrice di Mendelow
* (potere/interesse) e' BUONA PRASSI, NON un obbligo NIS2.
*
* Multi-tenancy: ogni query filtra organization_id. Scritture: org_admin /
* compliance_manager. Anti-IDOR su tutti i link (org_role_id/supplier_id/policy_id/
* stak_code) verificati appartenere all'org corrente (o di sistema per i tipi).
*
* NOTE strutturali: DB API Database::query/fetchAll/fetchOne/insert/update/delete
* (NON Database::execute). jsonSuccess/jsonError fanno exit.
*/
require_once __DIR__ . '/BaseController.php';
class StakeholderController extends BaseController
{
private const MANAGE_ROLES = ['org_admin', 'compliance_manager'];
// ─────────────────────────────────────────────────────────────────────────
// LETTURE
// ─────────────────────────────────────────────────────────────────────────
/**
* GET /api/stakeholders/list
* Registro dell'org + quadrante calcolato + procedure collegate + i 4 quadranti
* (per disegnare gli assi anche quando non ci sono stakeholder).
*/
public function list(): void
{
$this->requireOrgAccess();
$orgId = $this->getCurrentOrgId();
$quads = $this->loadQuadrants();
$rows = Database::fetchAll(
'SELECT s.id, s.stak_code, t.tipo, t.descr AS type_descr, s.name,
s.org_role_id, r.role_name AS org_role_name,
s.supplier_id, sup.name AS supplier_name,
s.power, s.interest, s.contact_name, s.contact_email, s.notes,
s.created_at, s.updated_at
FROM stakeholders s
JOIN cfg_stakeholder_types t ON t.code = s.stak_code
LEFT JOIN org_roles r ON r.id = s.org_role_id
LEFT JOIN suppliers sup ON sup.id = s.supplier_id
WHERE s.organization_id = ?
ORDER BY t.tipo ASC, s.stak_code ASC, s.name ASC',
[$orgId]
);
// Procedure collegate (m2m) per tutti gli stakeholder in un colpo solo
$procMap = [];
if ($rows) {
$ids = array_map(static fn($r) => (int) $r['id'], $rows);
$place = implode(',', array_fill(0, count($ids), '?'));
foreach (Database::fetchAll(
"SELECT sp.stakeholder_id, sp.policy_id, p.title AS policy_title
FROM stakeholder_procedures sp
JOIN policies p ON p.id = sp.policy_id
WHERE sp.stakeholder_id IN ($place)",
$ids
) as $lp) {
$sid = (int) $lp['stakeholder_id'];
$procMap[$sid][] = ['id' => (int) $lp['policy_id'], 'title' => $lp['policy_title']];
}
}
$stakeholders = [];
foreach ($rows as $r) {
$power = $r['power'] !== null ? (int) $r['power'] : null;
$interest = $r['interest'] !== null ? (int) $r['interest'] : null;
$rated = ($power !== null && $interest !== null);
$quad = $rated ? $this->quadrantFor($quads, $power, $interest) : null;
$sid = (int) $r['id'];
$procs = $procMap[$sid] ?? [];
$stakeholders[] = [
'id' => $sid,
'stak_code' => $r['stak_code'],
'tipo' => $r['tipo'],
'kind' => $r['tipo'] === 'Interno' ? 'internal' : 'external',
'type_descr' => $r['type_descr'],
'name' => $r['name'],
'org_role_id' => $r['org_role_id'] !== null ? (int) $r['org_role_id'] : null,
'org_role_name' => $r['org_role_name'],
'supplier_id' => $r['supplier_id'] !== null ? (int) $r['supplier_id'] : null,
'supplier_name' => $r['supplier_name'],
'power' => $power,
'interest' => $interest,
'rated' => $rated,
'quadrant_code' => $quad['code'] ?? null,
'quadrant_label' => $quad['label'] ?? null,
'contact_name' => $r['contact_name'],
'contact_email' => $r['contact_email'],
'notes' => $r['notes'],
'policies' => $procs,
'policy_ids' => array_map(static fn($p) => $p['id'], $procs),
'updated_at' => $r['updated_at'],
];
}
$this->jsonSuccess([
'stakeholders' => $stakeholders,
'quadrants' => $quads,
'total' => count($stakeholders),
'mendelow_note'=> 'La matrice di Mendelow (potere/interesse) e\' una buona prassi di gestione degli stakeholder, non un obbligo NIS2. L\'obbligo e\' GV.SC-02 (ruoli e responsabilita verso fornitori, clienti e partner).',
]);
}
/**
* GET /api/stakeholders/types
* Tipi visibili all'org: 30 di sistema (organization_id NULL) + quelli aggiunti
* dall'org. La codifica di sistema NON e' modificabile dall'utente.
*/
public function types(): void
{
$this->requireOrgAccess();
$orgId = $this->getCurrentOrgId();
$rows = Database::fetchAll(
'SELECT code, tipo, descr, (organization_id IS NULL) AS is_default, ord
FROM cfg_stakeholder_types
WHERE organization_id IS NULL OR organization_id = ?
ORDER BY ord ASC, code ASC',
[$orgId]
);
$types = array_map(static fn($t) => [
'code' => $t['code'],
'tipo' => $t['tipo'],
'descr' => $t['descr'],
'is_default' => ((int) $t['is_default'] === 1),
], $rows);
$this->jsonSuccess(['types' => $types]);
}
/**
* GET /api/stakeholders/quadrants — i 4 quadranti di sistema (per gli assi).
*/
public function quadrants(): void
{
$this->requireOrgAccess();
$this->jsonSuccess(['quadrants' => $this->loadQuadrants()]);
}
/**
* GET /api/stakeholders/pickers — opzioni leggere per i selettori del form:
* ruoli dell'organigramma (interni) + procedure (m2m) + fornitori (link esterni).
*/
public function pickers(): void
{
$this->requireOrgAccess();
$orgId = $this->getCurrentOrgId();
$roles = Database::fetchAll(
'SELECT id, role_name FROM org_roles WHERE organization_id = ? ORDER BY sort_order ASC, role_name ASC',
[$orgId]
);
$policies = Database::fetchAll(
'SELECT id, title FROM policies WHERE organization_id = ? AND deleted_at IS NULL ORDER BY title ASC',
[$orgId]
);
$suppliers = Database::fetchAll(
'SELECT id, name, stakeholder_type FROM suppliers WHERE organization_id = ? AND deleted_at IS NULL ORDER BY name ASC',
[$orgId]
);
$this->jsonSuccess([
'org_roles' => array_map(static fn($r) => ['id' => (int) $r['id'], 'role_name' => $r['role_name']], $roles),
'policies' => array_map(static fn($p) => ['id' => (int) $p['id'], 'title' => $p['title']], $policies),
'suppliers' => array_map(static fn($s) => ['id' => (int) $s['id'], 'name' => $s['name'], 'stakeholder_type' => $s['stakeholder_type']], $suppliers),
]);
}
// ─────────────────────────────────────────────────────────────────────────
// SCRITTURE
// ─────────────────────────────────────────────────────────────────────────
/**
* POST /api/stakeholders/create
* Body: {stak_code*, name*, org_role_id?, supplier_id?, power?, interest?,
* contact_name?, contact_email?, notes?, policy_ids?:[]}
*/
public function create(): void
{
$this->requireOrgRole(self::MANAGE_ROLES);
$orgId = $this->getCurrentOrgId();
$body = $this->getJsonBody();
$code = trim((string) ($body['stak_code'] ?? ''));
$name = trim((string) ($body['name'] ?? ''));
if ($code === '') { $this->jsonError('Tipo stakeholder (stak_code) obbligatorio', 422, 'MISSING_TYPE'); }
if ($name === '' || mb_strlen($name) > 255) { $this->jsonError('Nome obbligatorio (max 255 caratteri)', 422, 'INVALID_NAME'); }
$tipo = $this->resolveTypeTipo($code, $orgId); // 422 se non visibile
$orgRoleId = $this->validateOrgRoleForKind($body['org_role_id'] ?? null, $tipo, $orgId);
$supplierId = $this->validateSupplierForKind($body['supplier_id'] ?? null, $tipo, $orgId);
$power = $this->validateScore($body['power'] ?? null, 'power');
$interest = $this->validateScore($body['interest'] ?? null, 'interest');
$policyIds = $this->validatePolicyIds($body['policy_ids'] ?? null, $orgId);
// dup soft: stesso tipo + stesso nome nell'org
$dup = Database::fetchOne(
'SELECT id FROM stakeholders WHERE organization_id = ? AND stak_code = ? AND name = ?',
[$orgId, $code, $name]
);
if ($dup) { $this->jsonError('Stakeholder gia\' presente con questo tipo e nome', 409, 'DUPLICATE'); }
$id = Database::insert('stakeholders', [
'organization_id' => $orgId,
'stak_code' => $code,
'name' => $name,
'org_role_id' => $orgRoleId,
'supplier_id' => $supplierId,
'power' => $power,
'interest' => $interest,
'contact_name' => $this->nullableStr($body['contact_name'] ?? null, 255),
'contact_email' => $this->nullableStr($body['contact_email'] ?? null, 255),
'notes' => $this->nullableStr($body['notes'] ?? null),
'created_by' => $this->getCurrentUserId(),
]);
$this->syncPolicies((int) $id, $policyIds);
$this->logAudit('stakeholder_created', 'stakeholder', (int) $id, ['stak_code' => $code, 'name' => $name]);
$this->jsonSuccess(['id' => (int) $id], 'Stakeholder creato', 201);
}
/**
* PUT /api/stakeholders/{id} — update parziale.
*/
public function update(int $id): void
{
$this->requireOrgRole(self::MANAGE_ROLES);
$orgId = $this->getCurrentOrgId();
$body = $this->getJsonBody();
$existing = Database::fetchOne(
'SELECT id, stak_code FROM stakeholders WHERE id = ? AND organization_id = ?',
[$id, $orgId]
);
if (!$existing) { $this->jsonError('Stakeholder non trovato', 404, 'NOT_FOUND'); }
// Il tipo (e quindi il "kind") puo' cambiare: determina quello effettivo
$code = $existing['stak_code'];
if ($this->hasParam('stak_code')) {
$code = trim((string) ($body['stak_code'] ?? ''));
if ($code === '') { $this->jsonError('Tipo stakeholder non valido', 422, 'INVALID_TYPE'); }
}
$tipo = $this->resolveTypeTipo($code, $orgId);
$updates = [];
if ($this->hasParam('stak_code')) { $updates['stak_code'] = $code; }
if ($this->hasParam('name')) {
$name = trim((string) ($body['name'] ?? ''));
if ($name === '' || mb_strlen($name) > 255) { $this->jsonError('Nome non valido (max 255 caratteri)', 422, 'INVALID_NAME'); }
$updates['name'] = $name;
}
// Link coerenti col kind: se cambia il tipo verso Interno azzero supplier (e viceversa)
if ($this->hasParam('org_role_id') || $tipo === 'Esterno') {
$updates['org_role_id'] = $this->validateOrgRoleForKind($body['org_role_id'] ?? null, $tipo, $orgId);
}
if ($this->hasParam('supplier_id') || $tipo === 'Interno') {
$updates['supplier_id'] = $this->validateSupplierForKind($body['supplier_id'] ?? null, $tipo, $orgId);
}
if ($this->hasParam('power')) { $updates['power'] = $this->validateScore($body['power'] ?? null, 'power'); }
if ($this->hasParam('interest')) { $updates['interest'] = $this->validateScore($body['interest'] ?? null, 'interest'); }
if ($this->hasParam('contact_name')) { $updates['contact_name'] = $this->nullableStr($body['contact_name'] ?? null, 255); }
if ($this->hasParam('contact_email')) { $updates['contact_email'] = $this->nullableStr($body['contact_email'] ?? null, 255); }
if ($this->hasParam('notes')) { $updates['notes'] = $this->nullableStr($body['notes'] ?? null); }
if (!empty($updates)) {
Database::update('stakeholders', $updates, 'id = ? AND organization_id = ?', [$id, $orgId]);
}
if ($this->hasParam('policy_ids')) {
$this->syncPolicies($id, $this->validatePolicyIds($body['policy_ids'] ?? null, $orgId));
}
$this->logAudit('stakeholder_updated', 'stakeholder', $id, array_keys($updates));
$this->jsonSuccess(['id' => $id, 'updated' => array_keys($updates)], 'Stakeholder aggiornato');
}
/**
* DELETE /api/stakeholders/{id}
*/
public function delete(int $id): void
{
$this->requireOrgRole(['org_admin']);
$deleted = Database::delete('stakeholders', 'id = ? AND organization_id = ?', [$id, $this->getCurrentOrgId()]);
if ($deleted === 0) { $this->jsonError('Stakeholder non trovato', 404, 'NOT_FOUND'); }
$this->logAudit('stakeholder_deleted', 'stakeholder', $id);
$this->jsonSuccess(null, 'Stakeholder eliminato');
}
/**
* POST /api/stakeholders/types — aggiunge un TIPO org-scoped, codifica
* automatica proseguendo da Stak.31 (codice globalmente univoco: e' PK).
* Body: {tipo*, descr*}
*/
public function addType(): void
{
$this->requireOrgRole(self::MANAGE_ROLES);
$orgId = $this->getCurrentOrgId();
$body = $this->getJsonBody();
$tipo = ($body['tipo'] ?? '') === 'Interno' ? 'Interno' : (($body['tipo'] ?? '') === 'Esterno' ? 'Esterno' : '');
$descr = trim((string) ($body['descr'] ?? ''));
if ($tipo === '') { $this->jsonError('Tipo deve essere "Interno" o "Esterno"', 422, 'INVALID_TIPO'); }
if ($descr === '') { $this->jsonError('Descrizione obbligatoria', 422, 'INVALID_DESCR'); }
// Codice successivo: MAX suffisso numerico tra TUTTI i codici Stak.NN (sistema + org).
$next = $this->nextStakCode();
try {
Database::insert('cfg_stakeholder_types', [
'code' => $next,
'organization_id' => $orgId,
'tipo' => $tipo,
'descr' => $descr,
'ord' => 1000, // le voci org si ordinano dopo le 30 di sistema
'created_by' => $this->getCurrentUserId(),
]);
} catch (PDOException $e) {
// 1062 = race su PK duplicata: ritenta una volta con il codice ricalcolato
if (($e->errorInfo[1] ?? 0) === 1062) {
$next = $this->nextStakCode();
Database::insert('cfg_stakeholder_types', [
'code' => $next, 'organization_id' => $orgId, 'tipo' => $tipo,
'descr' => $descr, 'ord' => 1000, 'created_by' => $this->getCurrentUserId(),
]);
} else { throw $e; }
}
$this->logAudit('stakeholder_type_added', 'cfg_stakeholder_types', null, ['code' => $next, 'tipo' => $tipo]);
$this->jsonSuccess(['code' => $next, 'tipo' => $tipo, 'descr' => $descr], 'Tipo stakeholder aggiunto', 201);
}
// ─────────────────────────────────────────────────────────────────────────
// HELPER
// ─────────────────────────────────────────────────────────────────────────
/** Carica i 4 quadranti di sistema (ordinati). */
private function loadQuadrants(): array
{
$rows = Database::fetchAll(
'SELECT code, label, strategy, power_min, power_max, interest_min, interest_max, ord
FROM cfg_stakeholder_quadrants WHERE organization_id IS NULL ORDER BY ord ASC, code ASC'
);
return array_map(static fn($q) => [
'code' => $q['code'],
'label' => $q['label'],
'strategy' => $q['strategy'],
'power_min' => (int) $q['power_min'],
'power_max' => (int) $q['power_max'],
'interest_min' => (int) $q['interest_min'],
'interest_max' => (int) $q['interest_max'],
], $rows);
}
/** Trova il quadrante che contiene (power, interest) dai range di config. */
private function quadrantFor(array $quads, int $power, int $interest): ?array
{
foreach ($quads as $q) {
if ($power >= $q['power_min'] && $power <= $q['power_max']
&& $interest >= $q['interest_min'] && $interest <= $q['interest_max']) {
return $q;
}
}
return null;
}
/** Verifica che il tipo sia visibile all'org (sistema o proprio) e ne ritorna il "tipo". */
private function resolveTypeTipo(string $code, int $orgId): string
{
$row = Database::fetchOne(
'SELECT tipo FROM cfg_stakeholder_types WHERE code = ? AND (organization_id IS NULL OR organization_id = ?)',
[$code, $orgId]
);
if (!$row) { $this->jsonError('Tipo stakeholder inesistente o non accessibile', 422, 'INVALID_TYPE'); }
return $row['tipo'];
}
/** org_role consentito solo agli INTERNI; deve appartenere all'org (anti-IDOR). */
private function validateOrgRoleForKind($id, string $tipo, int $orgId): ?int
{
$id = ($id === null || $id === '') ? null : (int) $id;
if ($id === null) { return null; }
if ($tipo !== 'Interno') {
$this->jsonError('Il collegamento all\'organigramma e\' previsto solo per stakeholder interni', 422, 'ROLE_NOT_ALLOWED');
}
$row = Database::fetchOne('SELECT id FROM org_roles WHERE id = ? AND organization_id = ?', [$id, $orgId]);
if (!$row) { $this->jsonError('Ruolo dell\'organigramma non valido', 422, 'INVALID_ORG_ROLE'); }
return $id;
}
/** supplier consentito solo agli ESTERNI; deve appartenere all'org (anti-IDOR). */
private function validateSupplierForKind($id, string $tipo, int $orgId): ?int
{
$id = ($id === null || $id === '') ? null : (int) $id;
if ($id === null) { return null; }
if ($tipo !== 'Esterno') {
$this->jsonError('Il collegamento a un fornitore e\' previsto solo per stakeholder esterni', 422, 'SUPPLIER_NOT_ALLOWED');
}
$row = Database::fetchOne('SELECT id FROM suppliers WHERE id = ? AND organization_id = ?', [$id, $orgId]);
if (!$row) { $this->jsonError('Fornitore collegato non valido', 422, 'INVALID_SUPPLIER'); }
return $id;
}
/** Punteggio 0-5 o null (assente / vuoto = non valutato). */
private function validateScore($v, string $field): ?int
{
if ($v === null || $v === '') { return null; }
if (!is_numeric($v)) { $this->jsonError("Valore $field non numerico", 422, 'INVALID_SCORE'); }
$n = (int) $v;
if ($n < 0 || $n > 5) { $this->jsonError("Il valore $field deve essere tra 0 e 5", 422, 'SCORE_OUT_OF_RANGE'); }
return $n;
}
/** Normalizza array di policy_id e verifica che TUTTE appartengano all'org (anti-IDOR). */
private function validatePolicyIds($raw, int $orgId): array
{
if ($raw === null) { return []; }
if (!is_array($raw)) { $this->jsonError('policy_ids deve essere un array', 422, 'INVALID_POLICIES'); }
$ids = array_values(array_unique(array_filter(array_map('intval', $raw), static fn($i) => $i > 0)));
if (!$ids) { return []; }
$place = implode(',', array_fill(0, count($ids), '?'));
$rows = Database::fetchAll(
"SELECT id FROM policies WHERE id IN ($place) AND organization_id = ? AND deleted_at IS NULL",
array_merge($ids, [$orgId])
);
if (count($rows) !== count($ids)) {
$this->jsonError('Una o piu\' procedure collegate non sono valide', 422, 'INVALID_POLICIES');
}
return $ids;
}
/** Sostituisce le procedure collegate (m2m) per uno stakeholder. */
private function syncPolicies(int $stakeholderId, array $policyIds): void
{
Database::delete('stakeholder_procedures', 'stakeholder_id = ?', [$stakeholderId]);
foreach ($policyIds as $pid) {
Database::insert('stakeholder_procedures', ['stakeholder_id' => $stakeholderId, 'policy_id' => $pid]);
}
}
/** Prossimo codice Stak.NN (globale: il codice e' PK). */
private function nextStakCode(): string
{
$max = Database::fetchOne(
"SELECT MAX(CAST(SUBSTRING(code, 6) AS UNSIGNED)) AS m
FROM cfg_stakeholder_types
WHERE code REGEXP '^Stak\\\\.[0-9]+$'"
);
$n = ((int) ($max['m'] ?? 0)) + 1;
return 'Stak.' . str_pad((string) $n, 2, '0', STR_PAD_LEFT);
}
private function nullableStr($v, ?int $max = null): ?string
{
if ($v === null) { return null; }
$s = trim((string) $v);
if ($s === '') { return null; }
if ($max !== null && mb_strlen($s) > $max) { $s = mb_substr($s, 0, $max); }
return $s;
}
}
docs/sql/051_stakeholder_registry.sql
+103
View File
@@ -0,0 +1,103 @@
-- =====================================================================
-- 051 — Registro Stakeholder + matrice di Mendelow (Epic C / C5.1)
-- =====================================================================
-- Simon C5: registro degli stakeholder con tipo configurabile
-- (Stak.01-30 di sistema + voci aggiunte dall'org da Stak.31), doppia
-- valutazione POTERE/INTERESSE 0-5, collegamento all'organigramma
-- (org_roles, per gli stakeholder INTERNI) e alle procedure (policies),
-- e collocazione automatica su una matrice a 4 quadranti.
--
-- Ancoraggio normativo: GV.SC-02 (ruoli/responsabilita verso fornitori,
-- clienti e partner) -> obblighi art. 24 D.Lgs. 138/2024. La matrice di
-- Mendelow (potere/interesse) e' BUONA PRASSI, NON un obbligo NIS2.
--
-- Modello: tabella DEDICATA `stakeholders` (NON una colonna su suppliers):
-- gli stakeholder interni (Dipendenti, Management, Azionisti...) non sono
-- fornitori. Gli esterni possono COLLEGARSI a un supplier esistente
-- (supplier_id, nessuna copia di dati): il modulo Supply Chain resta
-- intatto e coesiste.
--
-- Config-driven: righe di sistema con organization_id NULL; le voci
-- aggiunte dall'org hanno organization_id valorizzato.
--
-- Additivo, reversibile. Runner-safe: solo CREATE TABLE IF NOT EXISTS con
-- le FK DENTRO il corpo del CREATE (il runner non ha pre-check per
-- ADD CONSTRAINT; con IF NOT EXISTS il CREATE e' nativamente idempotente).
-- Nessun DELIMITER, nessuna stored procedure, nessun ';' nei commenti.
--
-- I dati (4 quadranti + 30 tipi di sistema) sono seedati dal CLI
-- idempotente application/cli/seed_stakeholders.php (modello seed_framework.php),
-- che crea anche le tabelle se mancanti. Eseguire dentro il container app:
-- docker exec nis2-app php /var/www/nis2-agile/application/cli/seed_stakeholders.php
-- =====================================================================
CREATE TABLE IF NOT EXISTS cfg_stakeholder_types (
code VARCHAR(16) NOT NULL,
organization_id INT NULL, -- NULL = tipo di sistema; valorizzato = tipo dell'org
tipo ENUM('Interno','Esterno') NOT NULL,
descr TEXT NOT NULL,
ord INT NOT NULL DEFAULT 0,
created_by INT NULL,
created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
PRIMARY KEY (code),
KEY idx_cfg_stk_type_org (organization_id),
CONSTRAINT fk_cfg_stk_type_org FOREIGN KEY (organization_id) REFERENCES organizations (id) ON DELETE CASCADE,
CONSTRAINT fk_cfg_stk_type_user FOREIGN KEY (created_by) REFERENCES users (id) ON DELETE SET NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
CREATE TABLE IF NOT EXISTS cfg_stakeholder_quadrants (
code VARCHAR(4) NOT NULL, -- Q1..Q4
organization_id INT NULL, -- NULL = quadrante di sistema (per C5.1 solo sistema)
label VARCHAR(64) NOT NULL,
strategy TEXT NULL,
power_min TINYINT NOT NULL,
power_max TINYINT NOT NULL,
interest_min TINYINT NOT NULL,
interest_max TINYINT NOT NULL,
ord INT NOT NULL DEFAULT 0,
PRIMARY KEY (code),
KEY idx_cfg_stk_quad_org (organization_id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
CREATE TABLE IF NOT EXISTS stakeholders (
id INT NOT NULL AUTO_INCREMENT,
organization_id INT NOT NULL,
stak_code VARCHAR(16) NOT NULL, -- FK -> cfg_stakeholder_types.code
name VARCHAR(255) NOT NULL,
org_role_id INT NULL, -- solo INTERNI: nodo dell'organigramma
supplier_id INT NULL, -- solo ESTERNI: link opzionale al modulo Supply Chain
power TINYINT NULL, -- 0..5, NULL = non ancora valutato
interest TINYINT NULL, -- 0..5, NULL = non ancora valutato
contact_name VARCHAR(255) NULL,
contact_email VARCHAR(255) NULL,
notes TEXT NULL,
created_by INT NULL,
created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
PRIMARY KEY (id),
KEY idx_stk_org (organization_id),
KEY idx_stk_org_code (organization_id, stak_code),
KEY idx_stk_role (org_role_id),
KEY idx_stk_supplier (supplier_id),
CONSTRAINT fk_stk_org FOREIGN KEY (organization_id) REFERENCES organizations (id) ON DELETE CASCADE,
CONSTRAINT fk_stk_code FOREIGN KEY (stak_code) REFERENCES cfg_stakeholder_types (code),
CONSTRAINT fk_stk_role FOREIGN KEY (org_role_id) REFERENCES org_roles (id) ON DELETE SET NULL,
CONSTRAINT fk_stk_supplier FOREIGN KEY (supplier_id) REFERENCES suppliers (id) ON DELETE SET NULL,
CONSTRAINT fk_stk_user FOREIGN KEY (created_by) REFERENCES users (id) ON DELETE SET NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
CREATE TABLE IF NOT EXISTS stakeholder_procedures (
stakeholder_id INT NOT NULL,
policy_id INT NOT NULL,
PRIMARY KEY (stakeholder_id, policy_id),
KEY idx_stk_proc_policy (policy_id),
CONSTRAINT fk_stk_proc_stk FOREIGN KEY (stakeholder_id) REFERENCES stakeholders (id) ON DELETE CASCADE,
CONSTRAINT fk_stk_proc_policy FOREIGN KEY (policy_id) REFERENCES policies (id) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-- ROLLBACK (manuale):
-- DROP TABLE IF EXISTS stakeholder_procedures
-- DROP TABLE IF EXISTS stakeholders
-- DROP TABLE IF EXISTS cfg_stakeholder_quadrants
-- DROP TABLE IF EXISTS cfg_stakeholder_types
public/_app-bi-demo.html
+3 -3
View File
@@ -70,9 +70,9 @@
</script>
<!-- Stessa logica della app: api.js + common.js (helper) + common-bi.js (override BI) -->
<script src="js/api.js?v=20260625"></script>
<script src="js/common.js?v=20260625"></script>
<script src="js/common-bi.js?v=20260625"></script>
<script src="js/api.js?v=20260626"></script>
<script src="js/common.js?v=20260626"></script>
<script src="js/common-bi.js?v=20260626"></script>
<script>
// Renderizza la sidebar BI (loadSidebar è stato ridefinito da common-bi.js)
document.addEventListener('DOMContentLoaded', function () {
public/architecture.html
+4 -4
View File
@@ -1088,10 +1088,10 @@
</main>
</div>
<script src="js/api.js?v=20260625"></script>
<script src="js/common.js?v=20260625"></script>
<script src="js/i18n.js?v=20260625"></script>
<script src="js/help.js?v=20260625"></script>
<script src="js/api.js?v=20260626"></script>
<script src="js/common.js?v=20260626"></script>
<script src="js/i18n.js?v=20260626"></script>
<script src="js/help.js?v=20260626"></script>
<script>
if (!checkAuth()) throw new Error('Not authenticated');
loadSidebar();
public/assessment.html
+5 -5
View File
@@ -154,8 +154,8 @@
</main>
</div>
<script src="/js/api.js?v=20260625"></script>
<script src="/js/common.js?v=20260625"></script>
<script src="/js/api.js?v=20260626"></script>
<script src="/js/common.js?v=20260626"></script>
<!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
riusando tutti gli helper di common.js (zero backend). -->
@@ -165,9 +165,9 @@
bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
}
</script>
<script src="/js/common-bi.js?v=20260625"></script>
<script src="/js/i18n.js?v=20260625"></script>
<script src="/js/help.js?v=20260625"></script>
<script src="/js/common-bi.js?v=20260626"></script>
<script src="/js/i18n.js?v=20260626"></script>
<script src="/js/help.js?v=20260626"></script>
<script>
// ── Auth check ───────────────────────────────────────────
if (!checkAuth()) throw new Error('Not authenticated');
public/assets.html
+5 -5
View File
@@ -361,8 +361,8 @@
</main>
</div>
<script src="/js/api.js?v=20260625"></script>
<script src="/js/common.js?v=20260625"></script>
<script src="/js/api.js?v=20260626"></script>
<script src="/js/common.js?v=20260626"></script>
<!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
riusando tutti gli helper di common.js (zero backend). -->
@@ -372,9 +372,9 @@
bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
}
</script>
<script src="/js/common-bi.js?v=20260625"></script>
<script src="/js/i18n.js?v=20260625"></script>
<script src="/js/help.js?v=20260625"></script>
<script src="/js/common-bi.js?v=20260626"></script>
<script src="/js/i18n.js?v=20260626"></script>
<script src="/js/help.js?v=20260626"></script>
<script>
// ── Auth & Init ─────────────────────────────────────────
if (!checkAuth()) throw new Error('Not authenticated');
public/companies.html
+5 -5
View File
@@ -349,14 +349,14 @@
</main>
</div>
<script src="js/api.js?v=20260625"></script>
<script src="js/common.js?v=20260625"></script>
<script src="js/api.js?v=20260626"></script>
<script src="js/common.js?v=20260626"></script>
<!-- Bootstrap Italia bundle + override sidebar BI (common-bi.js dopo common.js: ridefinisce solo loadSidebar) -->
<script src="vendor/bootstrap-italia/dist/js/bootstrap-italia.bundle.min.js"></script>
<script>if (window.bootstrap && bootstrap.loadFonts) { bootstrap.loadFonts('vendor/bootstrap-italia/dist/fonts'); }</script>
<script src="js/common-bi.js?v=20260625"></script>
<script src="js/i18n.js?v=20260625"></script>
<script src="js/help.js?v=20260625"></script>
<script src="js/common-bi.js?v=20260626"></script>
<script src="js/i18n.js?v=20260626"></script>
<script src="js/help.js?v=20260626"></script>
<script>
if (!checkAuth()) throw new Error('Not authenticated');
public/competenze.html
+5 -5
View File
@@ -183,12 +183,12 @@
</div>
</div>
<script src="/js/api.js?v=20260625"></script>
<script src="/js/common.js?v=20260625"></script>
<script src="/js/api.js?v=20260626"></script>
<script src="/js/common.js?v=20260626"></script>
<script src="/vendor/bootstrap-italia/dist/js/bootstrap-italia.bundle.min.js"></script>
<script src="/js/common-bi.js?v=20260625"></script>
<script src="/js/i18n.js?v=20260625"></script>
<script src="/js/help.js?v=20260625"></script>
<script src="/js/common-bi.js?v=20260626"></script>
<script src="/js/i18n.js?v=20260626"></script>
<script src="/js/help.js?v=20260626"></script>
<script src="/js/competenze.js?v=20260617"></script>
</body>
</html>
public/cross-analysis.html
+4 -4
View File
@@ -382,8 +382,8 @@
</main>
</div>
<script src="/js/api.js?v=20260625"></script>
<script src="/js/common.js?v=20260625"></script>
<script src="/js/api.js?v=20260626"></script>
<script src="/js/common.js?v=20260626"></script>
<!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
riusando tutti gli helper di common.js (zero backend). -->
@@ -393,8 +393,8 @@
bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
}
</script>
<script src="/js/common-bi.js?v=20260625"></script>
<script src="/js/i18n.js?v=20260625"></script>
<script src="/js/common-bi.js?v=20260626"></script>
<script src="/js/i18n.js?v=20260626"></script>
<script>
const SPRITE = '/vendor/bootstrap-italia/dist/svg/sprites.svg';
function ico(name, cls) { return `<svg class="ico ${cls||''}" aria-hidden="true"><use href="${SPRITE}#${name}"></use></svg>`; }
public/dashboard.html
+5 -5
View File
@@ -143,8 +143,8 @@
</main>
</div>
<script src="/js/api.js?v=20260625"></script>
<script src="/js/common.js?v=20260625"></script>
<script src="/js/api.js?v=20260626"></script>
<script src="/js/common.js?v=20260626"></script>
<!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
riusando tutti gli helper di common.js (zero backend). -->
@@ -154,9 +154,9 @@
bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
}
</script>
<script src="/js/common-bi.js?v=20260625"></script>
<script src="/js/i18n.js?v=20260625"></script>
<script src="/js/help.js?v=20260625"></script>
<script src="/js/common-bi.js?v=20260626"></script>
<script src="/js/i18n.js?v=20260626"></script>
<script src="/js/help.js?v=20260626"></script>
<script>
// ── Auth check ───────────────────────────────────────────
if (!checkAuth()) throw new Error('Not authenticated');
public/forgot-password.html
+1 -1
View File
@@ -73,7 +73,7 @@
</script>
<!-- Stessa logica della forgot-password.html: ZERO modifiche backend -->
<script src="js/api.js?v=20260625"></script>
<script src="js/api.js?v=20260626"></script>
<script>
const form = document.getElementById('forgot-form');
const err = document.getElementById('err');
public/guida.html
+5 -5
View File
@@ -1142,8 +1142,8 @@
</main>
</div>
<script src="/js/api.js?v=20260625"></script>
<script src="/js/common.js?v=20260625"></script>
<script src="/js/api.js?v=20260626"></script>
<script src="/js/common.js?v=20260626"></script>
<!-- Bootstrap Italia bundle (accordion) + override sidebar BI (common-bi.js).
common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI. -->
<script src="/vendor/bootstrap-italia/dist/js/bootstrap-italia.bundle.min.js"></script>
@@ -1152,9 +1152,9 @@
bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
}
</script>
<script src="/js/common-bi.js?v=20260625"></script>
<script src="/js/i18n.js?v=20260625"></script>
<script src="/js/help.js?v=20260625"></script>
<script src="/js/common-bi.js?v=20260626"></script>
<script src="/js/i18n.js?v=20260626"></script>
<script src="/js/help.js?v=20260626"></script>
<script>
// La guida è accessibile anche da non autenticati (utile per onboarding)
// ma se sei loggato carichi sidebar + i18n normalmente. Stessa logica
public/incidents.html
+5 -5
View File
@@ -351,8 +351,8 @@
</main>
</div>
<script src="/js/api.js?v=20260625"></script>
<script src="/js/common.js?v=20260625"></script>
<script src="/js/api.js?v=20260626"></script>
<script src="/js/common.js?v=20260626"></script>
<!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
riusando tutti gli helper di common.js (zero backend). -->
@@ -362,9 +362,9 @@
bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
}
</script>
<script src="/js/common-bi.js?v=20260625"></script>
<script src="/js/i18n.js?v=20260625"></script>
<script src="/js/help.js?v=20260625"></script>
<script src="/js/common-bi.js?v=20260626"></script>
<script src="/js/i18n.js?v=20260626"></script>
<script src="/js/help.js?v=20260626"></script>
<script>
// ── Auth & Init ──────────────────────────────────────────────
if (!checkAuth()) throw new Error('Not authenticated');
public/index.php
+13
View File
@@ -91,6 +91,7 @@ $controllerMap = [
'raci' => 'RaciController', // A4 Fase 4.3 — Matrice RACI + link m2m (procedure/inventario/rischi/misure)
'review-schedule' => 'ReviewScheduleController', // A4 Fase 4.4 — Scadenziario centralizzato (revisioni periodiche GV.PO-02/GV.SC-07/PR.AT/DE.CM)
'framework' => 'FrameworkController', // Epic C / C1 — Elenco canonico Misure/Requisiti (cfg_nis2_*, read-only)
'stakeholders' => 'StakeholderController', // Epic C / C5 — Registro stakeholder + matrice di Mendelow
'assessments' => 'AssessmentController',
'isms' => 'IsmsModelController', // Modello Organizzativo SGSI (ISO 27001/27017/27018 + SoA)
'dashboard' => 'DashboardController',
@@ -429,6 +430,18 @@ $actionMap = [
'POST:{id}/score' => 'score',
],
// ── StakeholderController (Epic C / C5 — registro + Mendelow) ─────────────
'stakeholders' => [
'GET:list' => 'list',
'GET:types' => 'types',
'POST:types' => 'addType',
'GET:quadrants' => 'quadrants',
'GET:pickers' => 'pickers',
'POST:create' => 'create',
'PUT:{id}' => 'update',
'DELETE:{id}' => 'delete',
],
// ── AuditController ─────────────────────────────
'audit' => [
'GET:controls' => 'listControls',
public/integrazioniext.html
+2 -2
View File
@@ -910,8 +910,8 @@ curl -H <span class="str">"X-API-Key: nis2_TUA_CHIAVE"</span> \
</main>
<script src="js/common.js?v=20260625"></script>
<script src="js/i18n.js?v=20260625"></script>
<script src="js/common.js?v=20260626"></script>
<script src="js/i18n.js?v=20260626"></script>
<script>
function showTab(id) {
document.querySelectorAll('.tab-btn').forEach((b, i) => {
public/isms.html
+5 -5
View File
@@ -184,8 +184,8 @@
</main>
</div>
<script src="/js/api.js?v=20260625"></script>
<script src="/js/common.js?v=20260625"></script>
<script src="/js/api.js?v=20260626"></script>
<script src="/js/common.js?v=20260626"></script>
<!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
riusando tutti gli helper di common.js (zero backend). -->
@@ -195,9 +195,9 @@
bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
}
</script>
<script src="/js/common-bi.js?v=20260625"></script>
<script src="/js/i18n.js?v=20260625"></script>
<script src="/js/help.js?v=20260625"></script>
<script src="/js/common-bi.js?v=20260626"></script>
<script src="/js/i18n.js?v=20260626"></script>
<script src="/js/help.js?v=20260626"></script>
<script src="/js/isms.js"></script>
</body>
</html>
public/js/api.js
+14
View File
@@ -295,6 +295,20 @@ class NIS2API {
// ═══════════════════════════════════════════════════════════════════
stakeholderMap() { return this._acn(this.get('/supply-chain/stakeholder-map')); }
// ═══════════════════════════════════════════════════════════════════
// Registro Stakeholder + matrice di Mendelow (Epic C / C5). Tutti _acn.
// Tipo configurabile (Stak.01-30 + org-added), potere/interesse 0-5,
// link organigramma (interni) / procedure (m2m). Quadrante calcolato lato API.
// ═══════════════════════════════════════════════════════════════════
stkList() { return this._acn(this.get('/stakeholders/list')); }
stkTypes() { return this._acn(this.get('/stakeholders/types')); }
stkAddType(d) { return this._acn(this.post('/stakeholders/types', d || {})); }
stkQuadrants() { return this._acn(this.get('/stakeholders/quadrants')); }
stkPickers() { return this._acn(this.get('/stakeholders/pickers')); }
stkCreate(d) { return this._acn(this.post('/stakeholders/create', d || {})); }
stkUpdate(id, d) { return this._acn(this.put(`/stakeholders/${id}`, d || {})); }
stkDelete(id) { return this._acn(this.del(`/stakeholders/${id}`)); }
// ═══════════════════════════════════════════════════════════════════
// Dashboard
// ═══════════════════════════════════════════════════════════════════
public/js/common-bi.js
+1
View File
@@ -77,6 +77,7 @@
{ name: 'Incidenti', href: 'incidents.html', icon: iconBell(), i18nKey: 'nav.incidents' },
{ name: 'Policy', href: 'policies.html', icon: iconDocumentText(), i18nKey: 'nav.policies' },
{ name: 'Supply Chain', href: 'supply-chain.html', icon: iconLink(), i18nKey: 'nav.supply_chain' },
{ name: 'Stakeholder', href: 'stakeholders.html', icon: '<svg viewBox="0 0 20 20" fill="currentColor"><path fill-rule="evenodd" d="M10 9a3 3 0 100-6 3 3 0 000 6zm-7 9a7 7 0 1114 0H3z" clip-rule="evenodd"/><path d="M5.5 7.5a2 2 0 11-2.999.001A2 2 0 015.5 7.5zM17.5 7.5a2 2 0 11-2.999.001A2 2 0 0117.5 7.5z"/></svg>', i18nKey: 'nav.stakeholders' },
{ name: 'Segnalazioni', href: 'whistleblowing.html', icon: '<svg viewBox="0 0 20 20" fill="currentColor"><path fill-rule="evenodd" d="M5 9V7a5 5 0 0110 0v2a2 2 0 012 2v5a2 2 0 01-2 2H5a2 2 0 01-2-2v-5a2 2 0 012-2zm8-2v2H7V7a3 3 0 016 0z" clip-rule="evenodd"/></svg>' },
{ name: 'Normative', href: 'normative.html', icon: '<svg viewBox="0 0 20 20" fill="currentColor"><path fill-rule="evenodd" d="M4 4a2 2 0 012-2h4.586A2 2 0 0112 2.586L15.414 6A2 2 0 0116 7.414V16a2 2 0 01-2 2H6a2 2 0 01-2-2V4zm2 6a1 1 0 011-1h6a1 1 0 110 2H7a1 1 0 01-1-1zm1 3a1 1 0 100 2h6a1 1 0 100-2H7z" clip-rule="evenodd"/></svg>' },
{ name: 'AI Cross-Analysis', href: 'cross-analysis.html', icon: '<svg viewBox="0 0 20 20" fill="currentColor"><path d="M13 6a3 3 0 11-6 0 3 3 0 016 0zM18 8a2 2 0 11-4 0 2 2 0 014 0zM14 15a4 4 0 00-8 0v3h8v-3zM6 8a2 2 0 11-4 0 2 2 0 014 0zM16 18v-3a5.972 5.972 0 00-.75-2.906A3.005 3.005 0 0119 15v3h-3zM4.75 12.094A5.973 5.973 0 004 15v3H1v-3a3 3 0 013.75-2.906z"/></svg>' },
public/js/help.js
+17 -18
View File
@@ -364,41 +364,40 @@ const HelpSystem = (function () {
// ─── Stakeholder estesi (A4 Fase 4.5) ─────────────────────────
'stakeholders': {
title: 'Guida - Stakeholder',
intro: 'La Mappa Stakeholder è una vista di sintesi delle parti interessate dell\'organizzazione, raggruppate in fornitori, clienti e partner. Riusa i dati del modulo Supply Chain (nessuna duplicazione): il dettaglio e la valutazione dei fornitori restano lì, mentre qui puoi avere il quadro d\'insieme e aggiungere o etichettare clienti e partner. È uno strumento di supporto organizzativo, non un parere legale.',
intro: 'Il modulo Stakeholder è un registro delle parti interessate dell\'organizzazione (interne ed esterne). Per ognuna scegli un tipo dall\'elenco configurabile (Stak.01–30 di sistema, puoi aggiungerne altri), la colleghi all\'organigramma (se interna) o a un fornitore della Supply Chain (se esterna) e alle procedure, e ne valuti potere e interesse (0–5). In base a questi due valori il sistema colloca automaticamente lo stakeholder su una matrice a quattro quadranti. È uno strumento di supporto organizzativo, non un parere legale.',
sections: [
{
heading: 'I tre gruppi',
heading: 'Tipi di stakeholder',
items: [
'<strong>Fornitori</strong>: chi fornisce beni o servizi (inclusi i fornitori ICT). Il loro dettaglio e la valutazione di sicurezza si gestiscono nel modulo Supply Chain.',
'<strong>Clienti</strong>: le parti a cui l\'organizzazione eroga servizi rilevanti per la continuità.',
'<strong>Partner</strong>: soggetti con cui esistono accordi o collaborazioni rilevanti per la sicurezza.'
'<strong>Interni</strong> (Stak.01–06): dipendenti, management, azionisti, collaboratori, sindacalisti, volontari/associati. Si collegano a un nodo dell\'<strong>organigramma</strong>.',
'<strong>Esterni</strong> (Stak.07–30): clienti, fornitori, partner, autorità, banche, assicurazioni, comunità, media… Possono essere <strong>collegati a un fornitore</strong> già censito in Supply Chain (nessuna duplicazione del dato).',
'Puoi <strong>aggiungere nuovi tipi</strong>: ricevono in automatico il codice successivo (da Stak.31). I 30 tipi di sistema non sono modificabili.'
]
},
{
heading: 'Come si usa',
heading: 'Valutazione e matrice di Mendelow',
items: [
'<strong>Aggiungi stakeholder</strong>: registri nome, tipo (fornitore/cliente/partner), tipo di servizio o relazione, contatto e criticità.',
'Per i fornitori, usa il modulo <strong>Supply Chain</strong> per il dettaglio completo, i questionari e la valutazione del rischio (qui niente duplicati).',
'La vista raggruppata aiuta a documentare ruoli e responsabilità verso tutte le parti interessate, non solo i fornitori.'
'Assegna <strong>potere</strong> (capacità di influenzare l\'azienda) e <strong>interesse</strong> (quanto è coinvolto) con valori da 0 a 5.',
'La <strong>matrice di Mendelow</strong> (x = interesse, y = potere) colloca lo stakeholder in un quadrante: <strong>Q1 Tenere soddisfatti</strong>, <strong>Q2 Gestire attivamente</strong>, <strong>Q3 Tenere informati</strong>, <strong>Q4 Monitorare</strong>.',
'La matrice è una <strong>buona prassi</strong> di gestione degli stakeholder, <strong>non un obbligo NIS2</strong>. Gli stakeholder non ancora valutati restano elencati a parte, da completare.'
]
},
{
heading: 'Riferimenti normativi',
items: [
'<strong>GV.SC-02</strong>: ruoli e responsabilità per la sicurezza della catena di fornitura sono stabiliti verso fornitori, <strong>clienti</strong> e <strong>partner</strong>.',
'<strong>GV.SC-04</strong>: i fornitori sono noti e prioritizzati in base alla criticità (l\'estensione a clienti e partner è coperta da GV.SC-02).',
'<strong>GV.SC-05</strong>: i requisiti di sicurezza sono integrati nei contratti e negli accordi con i fornitori e le altre terze parti rilevanti.',
'<strong>GV.SC-07</strong>: i rischi e i rapporti con le parti interessate sono monitorati e rivisti nel tempo.'
'<strong>GV.SC-02</strong> (obbligo): ruoli e responsabilità per la sicurezza sono stabiliti e comunicati verso fornitori, <strong>clienti</strong> e <strong>partner</strong>.',
'<strong>GV.OC</strong>: comprensione del contesto organizzativo e delle parti interessate.',
'<strong>GV.SC-04/05/07</strong>: fornitori prioritizzati per criticità, requisiti di sicurezza negli accordi, monitoraggio e revisione nel tempo.'
]
}
],
references: [
'NIST CSF 2.0 / GV.SC-02 - Ruoli e responsabilità verso fornitori, clienti e partner',
'NIST CSF 2.0 / GV.SC-04 - Fornitori noti e prioritizzati per criticità (clienti/partner: GV.SC-02)',
'NIST CSF 2.0 / GV.SC-05 - Requisiti di sicurezza negli accordi',
'NIST CSF 2.0 / GV.SC-07 - Monitoraggio e revisione delle parti interessate',
'NIST CSF 2.0 / GV.SC-02 - Ruoli e responsabilità verso fornitori, clienti e partner (obbligo)',
'NIST CSF 2.0 / GV.OC - Contesto organizzativo e parti interessate',
'NIST CSF 2.0 / GV.SC-04/05/07 - Prioritizzazione, accordi e monitoraggio delle terze parti',
'Obblighi: la gestione della supply chain è prevista dall\'art. 24 del D.Lgs. 138/2024.',
'NOTA: gli obblighi normativi in Italia derivano dal D.Lgs. 138/2024; la mappa stakeholder e i framework NIST CSF/ACN sono strumenti di supporto, non un parere legale.'
'La matrice di Mendelow (potere/interesse) è una buona prassi di gestione, NON un requisito NIS2.',
'NOTA: gli obblighi normativi in Italia derivano dal D.Lgs. 138/2024; la matrice e i framework NIST CSF/ACN sono strumenti di supporto, non un parere legale.'
]
},
public/kb.html
+5 -5
View File
@@ -151,8 +151,8 @@
</div>
<!-- Stessa logica JS della pagina live (parita' funzionale assoluta, zero backend). -->
<script src="/js/common.js?v=20260625"></script>
<script src="/js/api.js?v=20260625"></script>
<script src="/js/common.js?v=20260626"></script>
<script src="/js/api.js?v=20260626"></script>
<!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI. -->
<script src="/vendor/bootstrap-italia/dist/js/bootstrap-italia.bundle.min.js"></script>
@@ -161,9 +161,9 @@
bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
}
</script>
<script src="/js/common-bi.js?v=20260625"></script>
<script src="/js/i18n.js?v=20260625"></script>
<script src="/js/help.js?v=20260625"></script>
<script src="/js/common-bi.js?v=20260626"></script>
<script src="/js/i18n.js?v=20260626"></script>
<script src="/js/help.js?v=20260626"></script>
<script src="/js/kb.js"></script>
<script>
// Gate auth + chrome come le altre pagine -bi.
public/licenseExt.html
+1 -1
View File
@@ -515,7 +515,7 @@ body { background: var(--bg-main); }
<div id="toast"></div>
<script src="js/api.js?v=20260625"></script>
<script src="js/api.js?v=20260626"></script>
<script>
// ══════════════════════════════════════════════════════
// CONFIG
public/login.html
+2 -2
View File
@@ -94,8 +94,8 @@
</script>
<!-- Stessa logica della login attuale: ZERO modifiche backend -->
<script src="js/api.js?v=20260625"></script>
<script src="js/common.js?v=20260625"></script>
<script src="js/api.js?v=20260626"></script>
<script src="js/common.js?v=20260626"></script>
<script>
if (api.isAuthenticated()) { window.location.href = 'dashboard.html'; }
public/misure-requisiti.html
+6 -6
View File
@@ -6,7 +6,7 @@
<title>Misure e Requisiti - NIS2 Agile</title>
<!-- Bootstrap Italia v2.18.1 self-hostato (regola: MAI CDN). Caricato PRIMA di style.css. -->
<link rel="stylesheet" href="/vendor/bootstrap-italia/dist/css/bootstrap-italia.min.css">
<link rel="stylesheet" href="/css/style.css?v=20260625">
<link rel="stylesheet" href="/css/style.css?v=20260626">
<style>
.mr-intro { background:#eff6ff; border-left:4px solid var(--primary,#2563eb); padding:14px 18px; border-radius:8px; margin-bottom:14px; font-size:.92rem; line-height:1.6; }
.mr-note { font-size:.82rem; color:#92400e; background:#fffbeb; border:1px solid #fde68a; border-radius:8px; padding:10px 12px; margin:0 0 16px; }
@@ -162,12 +162,12 @@
</div>
</div>
<script src="/js/api.js?v=20260625"></script>
<script src="/js/common.js?v=20260625"></script>
<script src="/js/api.js?v=20260626"></script>
<script src="/js/common.js?v=20260626"></script>
<script src="/vendor/bootstrap-italia/dist/js/bootstrap-italia.bundle.min.js"></script>
<script src="/js/common-bi.js?v=20260625"></script>
<script src="/js/i18n.js?v=20260625"></script>
<script src="/js/help.js?v=20260625"></script>
<script src="/js/common-bi.js?v=20260626"></script>
<script src="/js/i18n.js?v=20260626"></script>
<script src="/js/help.js?v=20260626"></script>
<script>
'use strict';
/*
public/mktg-api-doc.html
+1 -1
View File
@@ -424,6 +424,6 @@ curl https://nis2.agile.software/api/services/status</pre>
</div>
</div>
<script src="js/common.js?v=20260625"></script>
<script src="js/common.js?v=20260626"></script>
</body>
</html>
public/normative.html
+5 -5
View File
@@ -112,8 +112,8 @@
</main>
</div>
<script src="/js/api.js?v=20260625"></script>
<script src="/js/common.js?v=20260625"></script>
<script src="/js/api.js?v=20260626"></script>
<script src="/js/common.js?v=20260626"></script>
<!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
riusando tutti gli helper di common.js (zero backend). -->
@@ -123,9 +123,9 @@
bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
}
</script>
<script src="/js/common-bi.js?v=20260625"></script>
<script src="/js/i18n.js?v=20260625"></script>
<script src="/js/help.js?v=20260625"></script>
<script src="/js/common-bi.js?v=20260626"></script>
<script src="/js/i18n.js?v=20260626"></script>
<script src="/js/help.js?v=20260626"></script>
<script>
if (!checkAuth()) throw new Error('Not authenticated');
loadSidebar();
public/onboarding.html
+2 -2
View File
@@ -494,8 +494,8 @@
</script>
<!-- Stessa logica della onboarding.html: ZERO modifiche backend -->
<script src="js/api.js?v=20260625"></script>
<script src="js/common.js?v=20260625"></script>
<script src="js/api.js?v=20260626"></script>
<script src="js/common.js?v=20260626"></script>
<script>
// ── Auth check ──────────────────────────────────────────────────
if (!checkAuth()) throw new Error('Not authenticated');
public/organigramma.html
+5 -5
View File
@@ -138,12 +138,12 @@
</div>
</div>
<script src="/js/api.js?v=20260625"></script>
<script src="/js/common.js?v=20260625"></script>
<script src="/js/api.js?v=20260626"></script>
<script src="/js/common.js?v=20260626"></script>
<script src="/vendor/bootstrap-italia/dist/js/bootstrap-italia.bundle.min.js"></script>
<script src="/js/common-bi.js?v=20260625"></script>
<script src="/js/i18n.js?v=20260625"></script>
<script src="/js/help.js?v=20260625"></script>
<script src="/js/common-bi.js?v=20260626"></script>
<script src="/js/i18n.js?v=20260626"></script>
<script src="/js/help.js?v=20260626"></script>
<script src="/js/organigramma.js?v=20260617"></script>
</body>
</html>
public/policies.html
+5 -5
View File
@@ -333,8 +333,8 @@
</main>
</div>
<script src="/js/api.js?v=20260625"></script>
<script src="/js/common.js?v=20260625"></script>
<script src="/js/api.js?v=20260626"></script>
<script src="/js/common.js?v=20260626"></script>
<!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
riusando tutti gli helper di common.js (zero backend). -->
@@ -344,9 +344,9 @@
bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
}
</script>
<script src="/js/common-bi.js?v=20260625"></script>
<script src="/js/i18n.js?v=20260625"></script>
<script src="/js/help.js?v=20260625"></script>
<script src="/js/common-bi.js?v=20260626"></script>
<script src="/js/i18n.js?v=20260626"></script>
<script src="/js/help.js?v=20260626"></script>
<script>
// ── Auth & Init ─────────────────────────────────────────
if (!checkAuth()) throw new Error('Not authenticated');
public/raci.html
+5 -5
View File
@@ -131,12 +131,12 @@
</main>
</div>
<script src="/js/api.js?v=20260625"></script>
<script src="/js/common.js?v=20260625"></script>
<script src="/js/api.js?v=20260626"></script>
<script src="/js/common.js?v=20260626"></script>
<script src="/vendor/bootstrap-italia/dist/js/bootstrap-italia.bundle.min.js"></script>
<script src="/js/common-bi.js?v=20260625"></script>
<script src="/js/i18n.js?v=20260625"></script>
<script src="/js/help.js?v=20260625"></script>
<script src="/js/common-bi.js?v=20260626"></script>
<script src="/js/i18n.js?v=20260626"></script>
<script src="/js/help.js?v=20260626"></script>
<script src="/js/raci.js?v=20260619"></script>
</body>
</html>
public/register.html
+2 -2
View File
@@ -268,8 +268,8 @@
</script>
<!-- Stessa logica della register.html: ZERO modifiche backend -->
<script src="js/api.js?v=20260625"></script>
<script src="js/common.js?v=20260625"></script>
<script src="js/api.js?v=20260626"></script>
<script src="js/common.js?v=20260626"></script>
<script>
if (api.isAuthenticated()) { window.location.href = 'dashboard.html'; }
public/reports.html
+5 -5
View File
@@ -443,8 +443,8 @@
</main>
</div>
<script src="/js/api.js?v=20260625"></script>
<script src="/js/common.js?v=20260625"></script>
<script src="/js/api.js?v=20260626"></script>
<script src="/js/common.js?v=20260626"></script>
<!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
riusando tutti gli helper di common.js (zero backend). -->
@@ -454,9 +454,9 @@
bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
}
</script>
<script src="/js/common-bi.js?v=20260625"></script>
<script src="/js/i18n.js?v=20260625"></script>
<script src="/js/help.js?v=20260625"></script>
<script src="/js/common-bi.js?v=20260626"></script>
<script src="/js/i18n.js?v=20260626"></script>
<script src="/js/help.js?v=20260626"></script>
<script>
// ── Auth & Init ─────────────────────────────────────────
if (!checkAuth()) throw new Error('Not authenticated');
public/review-schedule.html
+5 -5
View File
@@ -141,12 +141,12 @@
</div>
</div>
<script src="/js/api.js?v=20260625"></script>
<script src="/js/common.js?v=20260625"></script>
<script src="/js/api.js?v=20260626"></script>
<script src="/js/common.js?v=20260626"></script>
<script src="/vendor/bootstrap-italia/dist/js/bootstrap-italia.bundle.min.js"></script>
<script src="/js/common-bi.js?v=20260625"></script>
<script src="/js/i18n.js?v=20260625"></script>
<script src="/js/help.js?v=20260625"></script>
<script src="/js/common-bi.js?v=20260626"></script>
<script src="/js/i18n.js?v=20260626"></script>
<script src="/js/help.js?v=20260626"></script>
<script>
'use strict';
/*
public/risks.html
+5 -5
View File
@@ -494,8 +494,8 @@
</main>
</div>
<script src="/js/api.js?v=20260625"></script>
<script src="/js/common.js?v=20260625"></script>
<script src="/js/api.js?v=20260626"></script>
<script src="/js/common.js?v=20260626"></script>
<!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
riusando tutti gli helper di common.js (zero backend). -->
@@ -505,9 +505,9 @@
bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
}
</script>
<script src="/js/common-bi.js?v=20260625"></script>
<script src="/js/i18n.js?v=20260625"></script>
<script src="/js/help.js?v=20260625"></script>
<script src="/js/common-bi.js?v=20260626"></script>
<script src="/js/i18n.js?v=20260626"></script>
<script src="/js/help.js?v=20260626"></script>
<script>
// ── Auth & Init ──────────────────────────────────────────────
if (!checkAuth()) throw new Error('Not authenticated');
public/settings.html
+5 -5
View File
@@ -672,8 +672,8 @@
</main>
</div>
<script src="/js/api.js?v=20260625"></script>
<script src="/js/common.js?v=20260625"></script>
<script src="/js/api.js?v=20260626"></script>
<script src="/js/common.js?v=20260626"></script>
<!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
riusando tutti gli helper di common.js (zero backend). -->
@@ -683,9 +683,9 @@
bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
}
</script>
<script src="/js/common-bi.js?v=20260625"></script>
<script src="/js/i18n.js?v=20260625"></script>
<script src="/js/help.js?v=20260625"></script>
<script src="/js/common-bi.js?v=20260626"></script>
<script src="/js/i18n.js?v=20260626"></script>
<script src="/js/help.js?v=20260626"></script>
<script>
// ── Auth check ───────────────────────────────────────────
if (!checkAuth()) throw new Error('Not authenticated');
public/setup-org.html
+2 -2
View File
@@ -165,8 +165,8 @@
</main>
</div>
<script src="js/api.js?v=20260625"></script>
<script src="js/common.js?v=20260625"></script>
<script src="js/api.js?v=20260626"></script>
<script src="js/common.js?v=20260626"></script>
<script>
// ── Auth check ───────────────────────────────────────────
if (!checkAuth()) throw new Error('Not authenticated');
public/stakeholders.html
+343 -125
View File
@@ -6,44 +6,68 @@
<title>Stakeholder - NIS2 Agile</title>
<!-- Bootstrap Italia v2.18.1 self-hostato (regola: MAI CDN). Caricato PRIMA di style.css. -->
<link rel="stylesheet" href="/vendor/bootstrap-italia/dist/css/bootstrap-italia.min.css">
<link rel="stylesheet" href="/css/style.css?v=20260617">
<link rel="stylesheet" href="/css/style.css?v=20260626">
<style>
.stk-intro { background:#eff6ff; border-left:4px solid var(--primary,#2563eb); padding:14px 18px; border-radius:8px; margin-bottom:16px; font-size:.92rem; line-height:1.6; }
.stk-note { font-size:.82rem; color:#92400e; background:#fffbeb; border:1px solid #fde68a; border-radius:8px; padding:10px 12px; margin:0 0 18px; }
.stk-intro { background:#eff6ff; border-left:4px solid var(--primary,#2563eb); padding:14px 18px; border-radius:8px; margin-bottom:12px; font-size:.92rem; line-height:1.6; }
.stk-note { font-size:.82rem; color:#92400e; background:#fffbeb; border:1px solid #fde68a; border-radius:8px; padding:10px 12px; margin:0 0 16px; }
.stk-toolbar { display:flex; gap:8px; flex-wrap:wrap; align-items:center; margin-bottom:14px; }
.stk-toolbar .grow { flex:1 1 auto; }
.stk-toolbar .btn { padding:4px 12px; font-size:.8rem; }
.stk-toolbar .btn { padding:5px 12px; font-size:.82rem; }
/* Matrice Mendelow */
.mx-card { border:1px solid var(--gray-200,#e5e7eb); border-radius:12px; padding:16px 18px; margin-bottom:18px; background:#fff; }
.mx-card h3 { margin:0 0 4px; font-size:1.02rem; }
.mx-sub { font-size:.8rem; color:var(--gray-500,#6b7280); margin-bottom:12px; }
.mx-wrap { display:flex; gap:20px; flex-wrap:wrap; align-items:flex-start; }
.mx-chart { flex:1 1 460px; min-width:300px; max-width:560px; }
.mx-side { flex:1 1 220px; min-width:200px; }
.mx-svg { width:100%; height:auto; display:block; }
.mx-dot { cursor:pointer; }
.mx-dot:focus { outline:2px solid #1d4ed8; outline-offset:2px; }
.mx-legend { display:flex; flex-direction:column; gap:6px; margin-top:6px; }
.mx-legend .it { display:flex; align-items:center; gap:8px; font-size:.8rem; }
.mx-sw { width:14px; height:14px; border-radius:4px; flex:0 0 auto; }
.mx-unrated { margin-top:6px; }
.mx-unrated h4 { font-size:.82rem; text-transform:uppercase; letter-spacing:.04em; color:var(--gray-500,#6b7280); margin:0 0 6px; }
.mx-unrated ul { list-style:none; margin:0; padding:0; max-height:240px; overflow:auto; }
.mx-unrated li { font-size:.84rem; padding:5px 8px; border:1px solid var(--gray-100,#f3f4f6); border-radius:7px; margin-bottom:5px; cursor:pointer; display:flex; justify-content:space-between; gap:8px; }
.mx-unrated li:hover { background:var(--gray-50,#f9fafb); }
/* Registro */
.stk-group { border:1px solid var(--gray-200,#e5e7eb); border-radius:10px; margin-bottom:14px; overflow:hidden; }
.stk-group-head { background:var(--gray-50,#f9fafb); padding:11px 14px; display:flex; justify-content:space-between; align-items:center; flex-wrap:wrap; gap:6px; }
.stk-group-title { font-weight:700; font-size:.98rem; }
.stk-count { display:inline-block; font-size:.72rem; font-weight:800; padding:2px 10px; border-radius:20px; background:#e0f2fe; color:#075985; margin-left:8px; }
.stk-table { width:100%; border-collapse:collapse; font-size:.88rem; }
.stk-table th, .stk-table td { text-align:left; padding:9px 12px; border-top:1px solid var(--gray-100,#f3f4f6); vertical-align:top; }
.stk-table th { font-size:.74rem; text-transform:uppercase; letter-spacing:.04em; color:var(--gray-500,#6b7280); }
.stk-badge { display:inline-block; font-size:.7rem; font-weight:700; padding:2px 8px; border-radius:6px; }
.stk-badge.crit-low { background:#dcfce7; color:#166534; }
.stk-badge.crit-medium { background:#fef3c7; color:#92400e; }
.stk-badge.crit-high { background:#ffedd5; color:#9a3412; }
.stk-badge.crit-critical { background:#fee2e2; color:#991b1b; }
.stk-badge.st { background:#f1f5f9; color:#475569; }
.stk-table th { font-size:.72rem; text-transform:uppercase; letter-spacing:.04em; color:var(--gray-500,#6b7280); }
.stk-badge { display:inline-block; font-size:.7rem; font-weight:700; padding:2px 8px; border-radius:6px; white-space:nowrap; }
.stk-badge.code { background:#f1f5f9; color:#475569; font-family:monospace; }
.stk-badge.q1 { background:#fef3c7; color:#92400e; }
.stk-badge.q2 { background:#fee2e2; color:#991b1b; }
.stk-badge.q3 { background:#dbeafe; color:#1e40af; }
.stk-badge.q4 { background:#f3f4f6; color:#374151; }
.stk-badge.na { background:#f3f4f6; color:#9ca3af; }
.stk-pi { font-family:monospace; font-size:.82rem; white-space:nowrap; }
.stk-empty { text-align:center; padding:22px 16px; color:var(--gray-500,#6b7280); font-size:.86rem; }
.stk-link { font-size:.78rem; }
/* Modale */
.sm-overlay { display:none; position:fixed; inset:0; background:rgba(15,23,42,.5); z-index:1050; align-items:flex-start; justify-content:center; overflow:auto; padding:40px 16px; }
.sm-overlay.open { display:flex; }
.sm-dialog { background:#fff; border-radius:12px; width:100%; max-width:560px; box-shadow:0 20px 50px rgba(0,0,0,.25); }
.sm-dialog { background:#fff; border-radius:12px; width:100%; max-width:600px; box-shadow:0 20px 50px rgba(0,0,0,.25); }
.sm-head { display:flex; justify-content:space-between; align-items:center; padding:16px 20px; border-bottom:1px solid var(--gray-100,#f3f4f6); }
.sm-head h3 { margin:0; font-size:1.05rem; }
.sm-body { padding:18px 20px; }
.sm-foot { padding:14px 20px; border-top:1px solid var(--gray-100,#f3f4f6); display:flex; justify-content:flex-end; gap:10px; }
.sm-field { margin-bottom:14px; }
.sm-field label { display:block; font-weight:600; font-size:.86rem; margin-bottom:4px; }
.sm-field input[type=text], .sm-field input[type=email], .sm-field select, .sm-field textarea { width:100%; padding:9px 10px; border:1px solid var(--gray-200,#e5e7eb); border-radius:8px; font-size:.9rem; }
.sm-field textarea { min-height:64px; resize:vertical; }
.sm-row { display:flex; gap:12px; }
.sm-row > .sm-field { flex:1 1 0; }
.sm-field .hint { font-weight:400; color:var(--gray-500,#6b7280); font-size:.78rem; }
.sm-field input[type=text], .sm-field input[type=email], .sm-field select, .sm-field textarea { width:100%; padding:9px 10px; border:1px solid var(--gray-200,#e5e7eb); border-radius:8px; font-size:.9rem; background:#fff; }
.sm-field select[multiple] { min-height:108px; }
.sm-field textarea { min-height:60px; resize:vertical; }
.sm-row { display:flex; gap:12px; flex-wrap:wrap; }
.sm-row > .sm-field { flex:1 1 0; min-width:140px; }
.sm-err { color:#b91c1c; font-size:.82rem; min-height:18px; }
.sm-close { background:none; border:none; font-size:1.4rem; line-height:1; cursor:pointer; color:var(--gray-400,#9ca3af); }
.hidden { display:none !important; }
</style>
<!-- PWA:start -->
<link rel="manifest" href="/manifest.webmanifest">
@@ -66,22 +90,41 @@
<header class="content-header">
<h2 data-i18n="stk.title">Stakeholder</h2>
<div class="content-header-actions">
<button class="btn btn-outline btn-sm" onclick="stkTypeOpen()">+ Aggiungi tipo</button>
<button class="btn btn-primary btn-sm" onclick="stkOpen()">+ Aggiungi stakeholder</button>
</div>
</header>
<div class="content-body">
<div class="stk-intro">
<strong>Mappa degli stakeholder.</strong>
Vista di sintesi di fornitori, clienti e partner della tua organizzazione, raggruppati per tipo. Riusa i dati della Supply Chain: il dettaglio e la valutazione dei fornitori restano nel modulo dedicato.
<strong>Mappatura e gestione degli stakeholder.</strong>
Registra gli stakeholder interni ed esterni scegliendo il tipo dall'elenco (puoi aggiungerne di nuovi),
collegali all'organigramma (interni) o a un fornitore della Supply Chain (esterni) e alle procedure,
e valuta <em>potere</em> e <em>interesse</em> (0–5): il sistema li colloca automaticamente sulla matrice.
</div>
<div class="stk-note">
Ancoraggio: <strong>GV.SC-02</strong> (ruoli e responsabilità definiti verso fornitori, clienti e partner) con <strong>GV.SC-04/05/07</strong>. Gli obblighi di gestione del rischio della catena di fornitura fanno capo all'<strong>art. 24 D.Lgs. 138/2024</strong>. Strumento di supporto, non un parere legale.
Ancoraggio: <strong>GV.SC-02</strong> (ruoli e responsabilità verso fornitori, clienti e partner) —
obbligo di gestione del rischio della catena di fornitura ai sensi dell'<strong>art. 24 D.Lgs. 138/2024</strong>.
La <strong>matrice di Mendelow</strong> (potere/interesse) è una <strong>buona prassi</strong> di gestione,
<strong>non un obbligo NIS2</strong>. Strumento di supporto, non un parere legale.
</div>
<div class="stk-toolbar">
<span class="grow"></span>
<a class="btn btn-outline btn-sm" href="supply-chain.html" data-i18n="stk.manage_suppliers">Gestisci fornitori in Supply Chain</a>
<a class="btn btn-outline btn-sm" href="supply-chain.html">Gestisci fornitori in Supply Chain</a>
</div>
<!-- Matrice di Mendelow -->
<div class="mx-card" id="mx-card">
<h3>Matrice di Mendelow <span style="font-weight:400;font-size:.8rem;color:#6b7280;">(buona prassi · x = interesse, y = potere)</span></h3>
<div class="mx-sub">Ogni stakeholder valutato è collocato nel quadrante in base a potere e interesse. Clicca un punto per modificarlo.</div>
<div class="mx-wrap">
<div class="mx-chart" id="mx-chart"></div>
<div class="mx-side">
<div class="mx-legend" id="mx-legend"></div>
<div class="mx-unrated" id="mx-unrated"></div>
</div>
</div>
</div>
<div id="stk-groups" aria-live="polite"></div>
@@ -95,58 +138,87 @@
<div class="sm-head"><h3 id="stk-modal-title">Aggiungi stakeholder</h3><button class="sm-close" type="button" onclick="stkClose()" aria-label="Chiudi">&times;</button></div>
<div class="sm-body">
<input type="hidden" id="stk-id">
<div class="sm-field"><label for="stk-f-name">Nome *</label><input type="text" id="stk-f-name" maxlength="255" placeholder="es. Acme Cloud S.p.A."></div>
<div class="sm-row">
<div class="sm-field"><label for="stk-f-type">Tipo</label>
<select id="stk-f-type" onchange="stkOnTypeChange()">
<option value="supplier">Fornitore</option>
<option value="customer">Cliente</option>
<option value="partner">Partner</option>
</select>
<div class="sm-field"><label for="stk-f-type">Tipo stakeholder *</label>
<select id="stk-f-type" onchange="stkOnTypeChange()"></select>
</div>
<div class="sm-field"><label for="stk-f-service">Servizio / relazione *</label><input type="text" id="stk-f-service" maxlength="255" placeholder="es. Hosting, consulenza, contratto quadro"></div>
<div class="sm-field"><label for="stk-f-name">Nome / denominazione *</label><input type="text" id="stk-f-name" maxlength="255" placeholder="es. Mario Rossi · Acme S.p.A."></div>
</div>
<div class="sm-field" id="stk-wrap-role">
<label for="stk-f-role">Collegamento all'organigramma <span class="hint">(interni)</span></label>
<select id="stk-f-role"><option value="">— Nessuno —</option></select>
</div>
<div class="sm-field hidden" id="stk-wrap-supplier">
<label for="stk-f-supplier">Collegamento a un fornitore <span class="hint">(esterni · dalla Supply Chain)</span></label>
<select id="stk-f-supplier"><option value="">— Nessuno —</option></select>
</div>
<div class="sm-row">
<div class="sm-field"><label for="stk-f-crit">Criticità</label>
<select id="stk-f-crit">
<option value="low">Bassa</option>
<option value="medium" selected>Media</option>
<option value="high">Alta</option>
<option value="critical">Critica</option>
</select>
<div class="sm-field"><label for="stk-f-power">Potere sull'azienda (0–5)</label>
<select id="stk-f-power"></select>
</div>
<div class="sm-field"><label for="stk-f-interest">Interesse sull'azienda (0–5)</label>
<select id="stk-f-interest"></select>
</div>
</div>
<div class="sm-field">
<label for="stk-f-procs">Procedure collegate <span class="hint">(Ctrl/Cmd per selezione multipla)</span></label>
<select id="stk-f-procs" multiple></select>
</div>
<div class="sm-row">
<div class="sm-field"><label for="stk-f-contact-name">Nome contatto</label><input type="text" id="stk-f-contact-name" maxlength="255"></div>
<div class="sm-field"><label for="stk-f-contact-email">Email contatto</label><input type="email" id="stk-f-contact-email" maxlength="255" placeholder="referente@esempio.it"></div>
</div>
<div class="sm-field"><label for="stk-f-contact-email">Email contatto</label><input type="email" id="stk-f-contact-email" maxlength="255" placeholder="referente@esempio.it"></div>
<div class="sm-field"><label for="stk-f-notes">Note</label><textarea id="stk-f-notes" maxlength="2000"></textarea></div>
<div class="sm-err" id="stk-err" role="alert"></div>
</div>
<div class="sm-foot"><button class="btn btn-outline" type="button" onclick="stkClose()">Annulla</button><button class="btn btn-primary" type="button" id="stk-save" onclick="stkSave()">Salva</button></div>
</div>
</div>
<script src="/js/api.js?v=20260625"></script>
<script src="/js/common.js?v=20260625"></script>
<!-- Modale aggiungi tipo -->
<div class="sm-overlay" id="stk-type-modal" role="dialog" aria-modal="true" aria-labelledby="stk-type-title">
<div class="sm-dialog" style="max-width:480px;">
<div class="sm-head"><h3 id="stk-type-title">Aggiungi tipo stakeholder</h3><button class="sm-close" type="button" onclick="stkTypeClose()" aria-label="Chiudi">&times;</button></div>
<div class="sm-body">
<p style="font-size:.84rem;color:#6b7280;margin:0 0 12px;">Il nuovo tipo riceverà automaticamente il codice successivo (proseguendo da <code>Stak.30</code>). I 30 tipi di sistema non sono modificabili.</p>
<div class="sm-field"><label for="stk-t-tipo">Categoria *</label>
<select id="stk-t-tipo"><option value="Interno">Interno</option><option value="Esterno" selected>Esterno</option></select>
</div>
<div class="sm-field"><label for="stk-t-descr">Descrizione *</label><textarea id="stk-t-descr" maxlength="1000" placeholder="es. Comunità accademica: università e centri di ricerca partner."></textarea></div>
<div class="sm-err" id="stk-t-err" role="alert"></div>
</div>
<div class="sm-foot"><button class="btn btn-outline" type="button" onclick="stkTypeClose()">Annulla</button><button class="btn btn-primary" type="button" id="stk-t-save" onclick="stkTypeSave()">Salva</button></div>
</div>
</div>
<script src="/js/api.js?v=20260626"></script>
<script src="/js/common.js?v=20260626"></script>
<script src="/vendor/bootstrap-italia/dist/js/bootstrap-italia.bundle.min.js"></script>
<script src="/js/common-bi.js?v=20260625"></script>
<script src="/js/i18n.js?v=20260625"></script>
<script src="/js/help.js?v=20260625"></script>
<script src="/js/common-bi.js?v=20260626"></script>
<script src="/js/i18n.js?v=20260626"></script>
<script src="/js/help.js?v=20260626"></script>
<script>
'use strict';
/*
* NIS2 Agile - Mappa stakeholder (A4 Fase 4.5)
* Vista di sintesi fornitori/clienti/partner: riusa la tabella suppliers (stakeholder_type).
* Lettura via api.stakeholderMap() (_acn). Creazione/etichettatura via api.createSupplier/updateSupplier
* (NON _acn -> ritornano {success,...}). Ancoraggio GV.SC-02 + GV.SC-04/05/07. Obblighi: art. 24 D.Lgs. 138/2024.
* NIS2 Agile - Registro Stakeholder + matrice di Mendelow (Epic C / C5.1)
* Tabella dedicata `stakeholders` (NON suppliers): interni -> org_roles,
* esterni -> link opzionale a un supplier. Doppia valutazione potere/interesse
* 0-5 -> quadrante calcolato lato API (cfg_stakeholder_quadrants). Procedure m2m.
* Ancoraggio GV.SC-02 (obbligo). Matrice di Mendelow = buona prassi, non obbligo.
*/
let STK = { groups: { supplier: [], customer: [], partner: [] }, counts: {} };
let STK = { list: [], quadrants: [], types: [], pickers: { org_roles: [], policies: [], suppliers: [] } };
// Stile per quadrante (codici dal seed: Q1 keep satisfied, Q2 manage closely, Q3 keep informed, Q4 monitor)
const QSTYLE = {
Q1: { fill:'#fef3c7', stroke:'#f59e0b', dot:'#d97706', cls:'q1' },
Q2: { fill:'#fee2e2', stroke:'#ef4444', dot:'#dc2626', cls:'q2' },
Q3: { fill:'#dbeafe', stroke:'#3b82f6', dot:'#2563eb', cls:'q3' },
Q4: { fill:'#f3f4f6', stroke:'#9ca3af', dot:'#6b7280', cls:'q4' },
};
function el(id) { return document.getElementById(id); }
function esc(s) { const d = document.createElement('div'); d.textContent = (s == null ? '' : String(s)); return d.innerHTML; }
const TYPE_TITLE = { supplier: 'Fornitori', customer: 'Clienti', partner: 'Partner' };
const TYPE_ORDER = ['supplier', 'customer', 'partner'];
const CRIT_LABELS = { low: 'Bassa', medium: 'Media', high: 'Alta', critical: 'Critica' };
const STATUS_LABELS = { active: 'Attivo', under_review: 'In revisione', suspended: 'Sospeso', terminated: 'Cessato' };
function escAttr(s) { return esc(s).replace(/"/g, '&quot;'); }
document.addEventListener('DOMContentLoaded', async function () {
if (typeof checkAuth === 'function' && !checkAuth()) return;
@@ -154,125 +226,271 @@
if (typeof loadSidebar === 'function') loadSidebar();
if (window.HelpSystem && HelpSystem.init) HelpSystem.init();
document.addEventListener('keydown', function (e) { if (e.key === 'Escape') stkClose(); });
const ov = el('stk-modal');
if (ov) ov.addEventListener('click', function (e) { if (e.target === ov) stkClose(); });
document.addEventListener('keydown', function (e) { if (e.key === 'Escape') { stkClose(); stkTypeClose(); } });
['stk-modal','stk-type-modal'].forEach(function (mid) {
const ov = el(mid);
if (ov) ov.addEventListener('click', function (e) { if (e.target === ov) ov.classList.remove('open'); });
});
await stkLoad();
// Popola le select dei punteggi 0-5
['stk-f-power','stk-f-interest'].forEach(function (sid) {
let html = '<option value="">— non valutato —</option>';
for (let i = 0; i <= 5; i++) html += '<option value="' + i + '">' + i + '</option>';
el(sid).innerHTML = html;
});
await stkLoadAll();
});
async function stkLoad() {
async function stkLoadAll() {
el('stk-groups').innerHTML = '<div class="stk-empty">Caricamento…</div>';
try {
const data = await api.stakeholderMap();
STK.groups = (data && data.groups) || { supplier: [], customer: [], partner: [] };
STK.counts = (data && data.counts) || {};
stkRender();
const [list, types, pickers] = await Promise.all([api.stkList(), api.stkTypes(), api.stkPickers()]);
STK.list = (list && list.stakeholders) || [];
STK.quadrants = (list && list.quadrants) || [];
STK.types = (types && types.types) || [];
STK.pickers = (pickers) || { org_roles: [], policies: [], suppliers: [] };
stkFillFormSelects();
renderMatrix();
renderRegistry();
} catch (e) {
el('stk-groups').innerHTML = '<div class="stk-empty">Errore nel caricamento: ' + esc(e.message || e) + '</div>';
}
}
function stkRender() {
const total = TYPE_ORDER.reduce((n, t) => n + ((STK.groups[t] || []).length), 0);
if (!total) {
el('stk-groups').innerHTML = '<div class="stk-empty">Nessuno stakeholder registrato. Aggiungine uno con "+ Aggiungi stakeholder". I fornitori inseriti dalla Supply Chain compaiono automaticamente qui.</div>';
// ── Selettori del form (tipo / organigramma / fornitori / procedure) ──
function stkFillFormSelects() {
// Tipo (optgroup Interni/Esterni)
const interni = STK.types.filter(t => t.tipo === 'Interno');
const esterni = STK.types.filter(t => t.tipo === 'Esterno');
const optsFor = arr => arr.map(t => '<option value="' + escAttr(t.code) + '">' + esc(t.code) + ' — ' + esc((t.descr || '').slice(0, 70)) + '</option>').join('');
el('stk-f-type').innerHTML =
'<optgroup label="Interni">' + optsFor(interni) + '</optgroup>' +
'<optgroup label="Esterni">' + optsFor(esterni) + '</optgroup>';
el('stk-f-role').innerHTML = '<option value="">— Nessuno —</option>' +
(STK.pickers.org_roles || []).map(r => '<option value="' + r.id + '">' + esc(r.role_name) + '</option>').join('');
el('stk-f-supplier').innerHTML = '<option value="">— Nessuno —</option>' +
(STK.pickers.suppliers || []).map(s => '<option value="' + s.id + '">' + esc(s.name) + '</option>').join('');
el('stk-f-procs').innerHTML =
(STK.pickers.policies || []).map(p => '<option value="' + p.id + '">' + esc(p.title) + '</option>').join('') ||
'<option value="" disabled>Nessuna procedura disponibile</option>';
}
function tipoOfCode(code) {
const t = STK.types.find(x => x.code === code);
return t ? t.tipo : null;
}
// ── Matrice di Mendelow (SVG dipendency-free) ──
function renderMatrix() {
const PADX = 64, PADTOP = 16, S = 360, W = PADX + S + 24, H = PADTOP + S + 52;
const quads = STK.quadrants.length ? STK.quadrants
: [{code:'Q1',power_min:3,power_max:5,interest_min:0,interest_max:2},
{code:'Q2',power_min:3,power_max:5,interest_min:3,interest_max:5},
{code:'Q3',power_min:0,power_max:2,interest_min:3,interest_max:5},
{code:'Q4',power_min:0,power_max:2,interest_min:0,interest_max:2}];
const px = v => PADX + (v / 5) * S; // interesse -> x
const py = v => PADTOP + (1 - v / 5) * S; // potere -> y (invertito)
let svg = '<svg class="mx-svg" viewBox="0 0 ' + W + ' ' + H + '" role="img" aria-label="Matrice di Mendelow potere/interesse">';
// Rettangoli dei quadranti
quads.forEach(function (q) {
const x0 = q.interest_min <= 2 ? PADX : PADX + S / 2;
const x1 = q.interest_max <= 2 ? PADX + S / 2 : PADX + S;
const y0 = q.power_max >= 3 ? PADTOP : PADTOP + S / 2; // alto
const y1 = q.power_min >= 3 ? PADTOP + S / 2 : PADTOP + S; // basso
const st = QSTYLE[q.code] || QSTYLE.Q4;
svg += '<rect x="' + x0 + '" y="' + y0 + '" width="' + (x1 - x0) + '" height="' + (y1 - y0) + '" fill="' + st.fill + '" stroke="' + st.stroke + '" stroke-width="1" opacity="0.55"/>';
const lbl = (q.label || q.code).replace(/\s*\(.*\)/, '');
svg += '<text x="' + (x0 + 8) + '" y="' + (y0 + 16) + '" font-size="11" font-weight="700" fill="#374151">' + esc(q.code) + '</text>';
svg += '<text x="' + (x0 + 8) + '" y="' + (y0 + 30) + '" font-size="10" fill="#4b5563">' + esc(lbl.slice(0, 26)) + '</text>';
});
// Assi
svg += '<line x1="' + PADX + '" y1="' + PADTOP + '" x2="' + PADX + '" y2="' + (PADTOP + S) + '" stroke="#9ca3af" stroke-width="1.5"/>';
svg += '<line x1="' + PADX + '" y1="' + (PADTOP + S) + '" x2="' + (PADX + S) + '" y2="' + (PADTOP + S) + '" stroke="#9ca3af" stroke-width="1.5"/>';
// Etichette assi
svg += '<text x="' + (PADX + S / 2) + '" y="' + (PADTOP + S + 40) + '" font-size="12" font-weight="700" fill="#374151" text-anchor="middle">Interesse →</text>';
svg += '<text transform="translate(16,' + (PADTOP + S / 2) + ') rotate(-90)" font-size="12" font-weight="700" fill="#374151" text-anchor="middle">Potere →</text>';
svg += '<text x="' + PADX + '" y="' + (PADTOP + S + 18) + '" font-size="10" fill="#6b7280" text-anchor="middle">0</text>';
svg += '<text x="' + (PADX + S) + '" y="' + (PADTOP + S + 18) + '" font-size="10" fill="#6b7280" text-anchor="middle">5</text>';
svg += '<text x="' + (PADX - 10) + '" y="' + (PADTOP + S) + '" font-size="10" fill="#6b7280" text-anchor="end">0</text>';
svg += '<text x="' + (PADX - 10) + '" y="' + (PADTOP + 6) + '" font-size="10" fill="#6b7280" text-anchor="end">5</text>';
// Punti (con jitter deterministico per celle affollate)
const rated = STK.list.filter(s => s.rated);
const cellCount = {}, cellIdx = {};
rated.forEach(s => { const k = s.power + '_' + s.interest; cellCount[k] = (cellCount[k] || 0) + 1; });
rated.forEach(function (s) {
const k = s.power + '_' + s.interest;
const n = cellCount[k]; const i = (cellIdx[k] = (cellIdx[k] || 0) + 1) - 1;
let ox = 0, oy = 0;
if (n > 1) { const ang = (2 * Math.PI * i) / n; const rad = 9; ox = Math.cos(ang) * rad; oy = Math.sin(ang) * rad; }
const cx = px(s.interest) + ox, cy = py(s.power) + oy;
const st = QSTYLE[s.quadrant_code] || QSTYLE.Q4;
const tip = s.name + ' (' + s.stak_code + ') · Potere ' + s.power + ' / Interesse ' + s.interest + ' · ' + (s.quadrant_label || '');
svg += '<circle class="mx-dot" tabindex="0" role="button" cx="' + cx.toFixed(1) + '" cy="' + cy.toFixed(1) + '" r="7" fill="' + st.dot + '" stroke="#fff" stroke-width="1.5" '
+ 'onclick="stkOpen(' + s.id + ')" onkeydown="if(event.key===\'Enter\'||event.key===\' \'){event.preventDefault();stkOpen(' + s.id + ');}">'
+ '<title>' + escAttr(tip) + '</title></circle>';
});
svg += '</svg>';
el('mx-chart').innerHTML = svg;
// Legenda
el('mx-legend').innerHTML = (STK.quadrants.length ? STK.quadrants : quads).map(function (q) {
const st = QSTYLE[q.code] || QSTYLE.Q4;
const n = STK.list.filter(s => s.quadrant_code === q.code).length;
return '<div class="it"><span class="mx-sw" style="background:' + st.dot + '"></span><span><strong>' + esc(q.code) + '</strong> ' + esc((q.label || '')) + ' · ' + n + '</span></div>';
}).join('');
// Non valutati
const unrated = STK.list.filter(s => !s.rated);
el('mx-unrated').innerHTML = unrated.length
? '<h4>Da valutare (' + unrated.length + ')</h4><ul>' + unrated.map(s =>
'<li onclick="stkOpen(' + s.id + ')"><span>' + esc(s.name) + '</span><span class="stk-badge code">' + esc(s.stak_code) + '</span></li>').join('') + '</ul>'
: '';
}
// ── Registro per categoria ──
function renderRegistry() {
if (!STK.list.length) {
el('stk-groups').innerHTML = '<div class="stk-empty">Nessuno stakeholder registrato. Aggiungine uno con "+ Aggiungi stakeholder".</div>';
return;
}
el('stk-groups').innerHTML = TYPE_ORDER.map(stkGroupHtml).join('');
}
function stkGroupHtml(type) {
const items = STK.groups[type] || [];
const count = STK.counts[type] != null ? STK.counts[type] : items.length;
let inner;
if (!items.length) {
inner = '<div class="stk-empty">Nessun ' + esc(TYPE_TITLE[type].toLowerCase().replace(/i$/, 'e')) + ' registrato.</div>';
} else {
const rows = items.map(function (s) {
const crit = s.criticality || 'medium';
const isSupplier = (s.stakeholder_type || 'supplier') === 'supplier';
const actions = '<button class="btn btn-outline" style="padding:3px 8px;font-size:.74rem;" onclick="stkOpen(' + s.id + ')">Modifica</button>'
+ (isSupplier ? ' <a class="stk-link" href="supply-chain.html">Dettaglio in Supply Chain</a>' : '');
return '<tr>'
+ '<td><strong>' + esc(s.name) + '</strong>'
+ (s.contact_name || s.contact_email ? '<div style="font-size:.78rem;color:var(--gray-500,#6b7280);margin-top:2px;">' + esc(s.contact_name || '') + (s.contact_email ? ' · ' + esc(s.contact_email) : '') + '</div>' : '') + '</td>'
+ '<td>' + (s.service_type ? esc(s.service_type) : '—') + '</td>'
+ '<td><span class="stk-badge crit-' + esc(crit) + '">' + esc(CRIT_LABELS[crit] || crit) + '</span></td>'
+ '<td><span class="stk-badge st">' + esc(STATUS_LABELS[s.status] || s.status || '—') + '</span></td>'
+ '<td>' + actions + '</td>'
+ '</tr>';
}).join('');
inner = '<table class="stk-table"><thead><tr>'
+ '<th>Nome</th><th>Servizio / relazione</th><th>Criticità</th><th>Stato</th><th>Azioni</th>'
+ '</tr></thead><tbody>' + rows + '</tbody></table>';
}
return '<div class="stk-group">'
+ '<div class="stk-group-head"><div class="stk-group-title">' + esc(TYPE_TITLE[type]) + '<span class="stk-count">' + count + '</span></div></div>'
+ inner + '</div>';
}
function stkAllItems() {
return TYPE_ORDER.reduce((acc, t) => acc.concat(STK.groups[t] || []), []);
const groups = [
{ tipo: 'Interno', title: 'Stakeholder interni' },
{ tipo: 'Esterno', title: 'Stakeholder esterni' },
];
el('stk-groups').innerHTML = groups.map(function (g) {
const items = STK.list.filter(s => s.tipo === g.tipo);
let inner;
if (!items.length) {
inner = '<div class="stk-empty">Nessuno stakeholder ' + (g.tipo === 'Interno' ? 'interno' : 'esterno') + ' registrato.</div>';
} else {
const rows = items.map(function (s) {
const q = s.quadrant_code ? '<span class="stk-badge ' + (QSTYLE[s.quadrant_code] || QSTYLE.Q4).cls + '">' + esc(s.quadrant_code) + ' · ' + esc((s.quadrant_label || '').replace(/\s*\(.*\)/, '')) + '</span>' : '<span class="stk-badge na">da valutare</span>';
const pi = s.rated ? '<span class="stk-pi">P' + s.power + ' · I' + s.interest + '</span>' : '<span class="stk-pi" style="color:#9ca3af">—</span>';
const link = s.org_role_name ? ('👤 ' + esc(s.org_role_name)) : (s.supplier_name ? ('🏢 ' + esc(s.supplier_name)) : '—');
const procs = (s.policy_ids && s.policy_ids.length) ? (s.policy_ids.length + ' proc.') : '—';
return '<tr>'
+ '<td><span class="stk-badge code">' + esc(s.stak_code) + '</span></td>'
+ '<td><strong>' + esc(s.name) + '</strong>'
+ (s.contact_name || s.contact_email ? '<div style="font-size:.78rem;color:#6b7280;margin-top:2px;">' + esc(s.contact_name || '') + (s.contact_email ? ' · ' + esc(s.contact_email) : '') + '</div>' : '') + '</td>'
+ '<td>' + pi + '</td>'
+ '<td>' + q + '</td>'
+ '<td style="font-size:.82rem;">' + link + '</td>'
+ '<td style="font-size:.82rem;">' + procs + '</td>'
+ '<td style="white-space:nowrap;">'
+ '<button class="btn btn-outline" style="padding:3px 8px;font-size:.74rem;" onclick="stkOpen(' + s.id + ')">Modifica</button> '
+ '<button class="btn btn-outline" style="padding:3px 8px;font-size:.74rem;color:#b91c1c;border-color:#fecaca;" onclick="stkDelete(' + s.id + ')">Elimina</button>'
+ '</td></tr>';
}).join('');
inner = '<table class="stk-table"><thead><tr>'
+ '<th>Codice</th><th>Nome</th><th>Pot./Int.</th><th>Quadrante</th><th>Collegamento</th><th>Procedure</th><th>Azioni</th>'
+ '</tr></thead><tbody>' + rows + '</tbody></table>';
}
return '<div class="stk-group"><div class="stk-group-head"><div class="stk-group-title">' + esc(g.title)
+ '<span class="stk-count">' + items.length + '</span></div></div>' + inner + '</div>';
}).join('');
}
// ── Modale stakeholder ──
function stkOpen(id) {
const s = id ? stkAllItems().find(x => x.id === id) : null;
const s = id ? STK.list.find(x => x.id === id) : null;
el('stk-modal-title').textContent = s ? 'Modifica stakeholder' : 'Aggiungi stakeholder';
el('stk-id').value = s ? s.id : '';
el('stk-f-type').value = s ? s.stak_code : (el('stk-f-type').querySelector('option') ? el('stk-f-type').querySelector('option').value : '');
el('stk-f-name').value = s ? (s.name || '') : '';
el('stk-f-type').value = s ? (s.stakeholder_type || 'supplier') : 'supplier';
el('stk-f-service').value = s ? (s.service_type || '') : '';
el('stk-f-crit').value = s ? (s.criticality || 'medium') : 'medium';
el('stk-f-role').value = s && s.org_role_id ? String(s.org_role_id) : '';
el('stk-f-supplier').value = s && s.supplier_id ? String(s.supplier_id) : '';
el('stk-f-power').value = s && s.power != null ? String(s.power) : '';
el('stk-f-interest').value = s && s.interest != null ? String(s.interest) : '';
el('stk-f-contact-name').value = s ? (s.contact_name || '') : '';
el('stk-f-contact-email').value = s ? (s.contact_email || '') : '';
el('stk-f-notes').value = s ? (s.notes || '') : '';
// procedure multi-select
const sel = el('stk-f-procs'); const have = (s && s.policy_ids) || [];
Array.prototype.forEach.call(sel.options, o => { o.selected = have.indexOf(parseInt(o.value, 10)) !== -1; });
el('stk-err').textContent = '';
stkOnTypeChange();
el('stk-modal').classList.add('open');
setTimeout(() => el('stk-f-name').focus(), 50);
}
function stkClose() { el('stk-modal').classList.remove('open'); }
// Per clienti/partner il servizio è meno ovvio: precompila un default ragionevole se vuoto.
// Mostra organigramma per interni, fornitore per esterni
function stkOnTypeChange() {
const t = el('stk-f-type').value;
const svc = el('stk-f-service');
if (!svc.value.trim()) {
if (t === 'customer') svc.value = 'Cliente';
else if (t === 'partner') svc.value = 'Partner';
}
const tipo = tipoOfCode(el('stk-f-type').value);
const isInt = tipo === 'Interno';
el('stk-wrap-role').classList.toggle('hidden', !isInt);
el('stk-wrap-supplier').classList.toggle('hidden', isInt);
if (isInt) el('stk-f-supplier').value = ''; else el('stk-f-role').value = '';
}
async function stkSave() {
const id = el('stk-id').value;
const code = el('stk-f-type').value;
const name = el('stk-f-name').value.trim();
let service = el('stk-f-service').value.trim();
const type = el('stk-f-type').value;
if (!code) { el('stk-err').textContent = 'Seleziona un tipo.'; return; }
if (!name) { el('stk-err').textContent = 'Il nome è obbligatorio.'; return; }
// service_type è obbligatorio lato backend: forziamo un default coerente per clienti/partner.
if (!service) {
service = type === 'customer' ? 'Cliente' : (type === 'partner' ? 'Partner' : '');
}
if (!service) { el('stk-err').textContent = 'Indica il servizio o la relazione.'; return; }
const tipo = tipoOfCode(code);
const procs = Array.prototype.filter.call(el('stk-f-procs').options, o => o.selected).map(o => parseInt(o.value, 10)).filter(Boolean);
const payload = {
stak_code: code,
name: name,
stakeholder_type: type,
service_type: service,
criticality: el('stk-f-crit').value,
org_role_id: tipo === 'Interno' && el('stk-f-role').value ? parseInt(el('stk-f-role').value, 10) : null,
supplier_id: tipo === 'Esterno' && el('stk-f-supplier').value ? parseInt(el('stk-f-supplier').value, 10) : null,
power: el('stk-f-power').value !== '' ? parseInt(el('stk-f-power').value, 10) : null,
interest: el('stk-f-interest').value !== '' ? parseInt(el('stk-f-interest').value, 10) : null,
policy_ids: procs,
contact_name: el('stk-f-contact-name').value.trim(),
contact_email: el('stk-f-contact-email').value.trim()
contact_email: el('stk-f-contact-email').value.trim(),
notes: el('stk-f-notes').value.trim(),
};
const btn = el('stk-save'); btn.disabled = true;
try {
const r = id ? await api.updateSupplier(parseInt(id, 10), payload) : await api.createSupplier(payload);
if (r && r.success === false) { el('stk-err').textContent = r.message || 'Errore nel salvataggio.'; return; }
if (id) await api.stkUpdate(parseInt(id, 10), payload); else await api.stkCreate(payload);
showNotification(id ? 'Stakeholder aggiornato.' : 'Stakeholder aggiunto.', 'success');
stkClose();
await stkLoad();
await stkLoadAll();
} catch (e) {
el('stk-err').textContent = (e && e.message) ? e.message : 'Errore nel salvataggio.';
} finally { btn.disabled = false; }
}
async function stkDelete(id) {
const s = STK.list.find(x => x.id === id);
if (!confirm('Eliminare lo stakeholder "' + (s ? s.name : '') + '"?')) return;
try {
await api.stkDelete(id);
showNotification('Stakeholder eliminato.', 'success');
await stkLoadAll();
} catch (e) { showNotification((e && e.message) || 'Errore nell\'eliminazione.', 'error'); }
}
// ── Modale aggiungi tipo ──
function stkTypeOpen() { el('stk-t-err').textContent = ''; el('stk-t-descr').value = ''; el('stk-type-modal').classList.add('open'); setTimeout(() => el('stk-t-descr').focus(), 50); }
function stkTypeClose() { el('stk-type-modal').classList.remove('open'); }
async function stkTypeSave() {
const tipo = el('stk-t-tipo').value;
const descr = el('stk-t-descr').value.trim();
if (!descr) { el('stk-t-err').textContent = 'La descrizione è obbligatoria.'; return; }
const btn = el('stk-t-save'); btn.disabled = true;
try {
const r = await api.stkAddType({ tipo: tipo, descr: descr });
showNotification('Tipo aggiunto: ' + (r && r.code ? r.code : ''), 'success');
stkTypeClose();
const types = await api.stkTypes();
STK.types = (types && types.types) || STK.types;
stkFillFormSelects();
} catch (e) {
el('stk-t-err').textContent = (e && e.message) ? e.message : 'Errore nel salvataggio.';
} finally { btn.disabled = false; }
}
</script>
</body>
</html>
public/supply-chain.html
+5 -5
View File
@@ -477,8 +477,8 @@
</main>
</div>
<script src="/js/api.js?v=20260625"></script>
<script src="/js/common.js?v=20260625"></script>
<script src="/js/api.js?v=20260626"></script>
<script src="/js/common.js?v=20260626"></script>
<!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
riusando tutti gli helper di common.js (zero backend). -->
@@ -488,9 +488,9 @@
bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
}
</script>
<script src="/js/common-bi.js?v=20260625"></script>
<script src="/js/i18n.js?v=20260625"></script>
<script src="/js/help.js?v=20260625"></script>
<script src="/js/common-bi.js?v=20260626"></script>
<script src="/js/i18n.js?v=20260626"></script>
<script src="/js/help.js?v=20260626"></script>
<script>
// ── Auth & Init ─────────────────────────────────────────
if (!checkAuth()) throw new Error('Not authenticated');
public/sw.js
+1 -1
View File
@@ -13,7 +13,7 @@
* Il nome cache include la release: va BUMPATO ad ogni rilascio (vedi version.json),
* cosi' activate elimina automaticamente la shell vecchia.
*/
const CACHE = 'nis2-shell-v1.18.4';
const CACHE = 'nis2-shell-v1.19.0';
const PRECACHE = [
'/offline.html',
public/training.html
+5 -5
View File
@@ -292,8 +292,8 @@
</main>
</div>
<script src="/js/api.js?v=20260625"></script>
<script src="/js/common.js?v=20260625"></script>
<script src="/js/api.js?v=20260626"></script>
<script src="/js/common.js?v=20260626"></script>
<!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
riusando tutti gli helper di common.js (zero backend). -->
@@ -303,9 +303,9 @@
bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
}
</script>
<script src="/js/common-bi.js?v=20260625"></script>
<script src="/js/i18n.js?v=20260625"></script>
<script src="/js/help.js?v=20260625"></script>
<script src="/js/common-bi.js?v=20260626"></script>
<script src="/js/i18n.js?v=20260626"></script>
<script src="/js/help.js?v=20260626"></script>
<script>
// ── Auth & Init ─────────────────────────────────────────
if (!checkAuth()) throw new Error('Not authenticated');
public/version.json
+1 -1
View File
@@ -1 +1 @@
{"version": "1.18.4", "build": "2026-06-16-v1.18.4", "date": "2026-06-16", "changelog": "Epic C / C4 - inventario a DUE voci (ID.AM-01 Hardware, ID.AM-02 Software/Servizi/Sistemi) + sottoclassi configurabili (default di sistema + create dall'utente). mig.050: cfg_inventory_voci, inventory_subclassi, assets.voce_code/subclass_id; 20 asset migrati. AssetController voce/subclass + endpoint subclasses; assets.html selettori voce+sottoclasse. Fix: apostrofo non escapato che rompeva il JS dell'Inventario; cache-buster common-bi.js (fix sidebar C3). Additivo."}
{"version": "1.19.0", "build": "2026-06-16-v1.19.0", "date": "2026-06-16", "changelog": "Epic C / C5.1 - Modulo Stakeholder: registro dedicato con tipo configurabile (Stak.01-30 di sistema + org-added da Stak.31), doppia valutazione potere/interesse 0-5, collegamento all'organigramma (interni) e a un fornitore Supply Chain (esterni), procedure m2m, e matrice di Mendelow a 4 quadranti (buona prassi, non obbligo NIS2; obbligo = GV.SC-02). mig.051: cfg_stakeholder_types, cfg_stakeholder_quadrants, stakeholders, stakeholder_procedures. StakeholderController + endpoint /api/stakeholders/*; stakeholders.html riscritta con matrice SVG dependency-free; voce sidebar V2 (common-bi.js). Additivo."}
public/whistleblowing.html
+5 -5
View File
@@ -207,8 +207,8 @@
<!-- Report Detail Modal handled by common.js showModal -->
<script src="/js/api.js?v=20260625"></script>
<script src="/js/common.js?v=20260625"></script>
<script src="/js/api.js?v=20260626"></script>
<script src="/js/common.js?v=20260626"></script>
<!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
riusando tutti gli helper di common.js (zero backend). -->
@@ -218,9 +218,9 @@
bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
}
</script>
<script src="/js/common-bi.js?v=20260625"></script>
<script src="/js/i18n.js?v=20260625"></script>
<script src="/js/help.js?v=20260625"></script>
<script src="/js/common-bi.js?v=20260626"></script>
<script src="/js/i18n.js?v=20260626"></script>
<script src="/js/help.js?v=20260626"></script>
<script>
if (!checkAuth()) throw new Error('Not authenticated');
loadSidebar();
public/workflow.html
+3 -3
View File
@@ -319,9 +319,9 @@
</main>
</div>
<script src="js/api.js?v=20260625"></script>
<script src="js/common.js?v=20260625"></script>
<script src="js/i18n.js?v=20260625"></script>
<script src="js/api.js?v=20260626"></script>
<script src="js/common.js?v=20260626"></script>
<script src="js/i18n.js?v=20260626"></script>
<script>
if (!checkAuth()) throw new Error('Not authenticated');
loadSidebar();