Competizione coi GRC enterprise sul risk management quantitativo:
- FairService: simulazione Monte Carlo FAIR (PERT su TEF e Loss Magnitude),
ALE in EUR con percentili P10/P50/P90 + istogramma, deterministico (seed da input)
- RiskController::computeFair -> POST /risks/{id}/fair (persiste parametri+ALE)
- RiskController::fairRegister -> GET /risks/fairRegister (portfolio ALE EUR)
- KRI: listKri/createKri/updateKri (GET/POST /risks/kri, PUT /risks/kri/{id})
con stato semaforo green/amber/red su soglie+direzione
- Migrazione 026: risks += parametri FAIR + ale_min/ml/max/mean; nuova tabella kri
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Il FAB ARIA (common.js) chiamava POST /api/ai/ask ma il controller non esisteva
(assistente AI rotto). Creato AiController::ask -> AIService::askWithRag con RAG su KB
+ grounding fonti certe. Verificato in produzione: rag_used=True, cita Ambiti NIS2 / Determina ACN.
Fix DNS Qdrant: nei worker php-fpm (musl) getenv e gethostbyname NON funzionano per
hostname Docker single-label; funziona solo un IP letterale. VectorService fallback ->
172.21.0.3 (fpm-safe); QDRANT_URL compose resta hostname per CLI. Vedi nota drift in VectorService.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- ServicesController: nuovo endpoint GET /api/services/full-snapshot
Aggrega gap-analysis, measures, incidents, training, deadlines,
compliance-summary in una sola chiamata (reduce 6 round-trip → 1)
Parametro ?days=N per finestra deadlines (default 30, max 365)
- public/index.php: route GET:fullSnapshot aggiunta all'action map services
- public/simulate-nis2-big.php: wrapper SSE per simulate-nis2-big.php
Esegue il simulatore come sottoprocesso CLI con NIS2_SSE=1 e
streama l'output al browser tramite Server-Sent Events
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- index.html: CTA "Registrati" → "Richiedi accesso" (anchor form)
Badge hero "Accesso su invito — Richiedi il tuo codice per iniziare"
Sezione #richiedi-accesso con form lead (nome, email, azienda, ruolo,
dimensioni, messaggio) + JS submit asincrono + stato successo/errore
CTA finale aggiornato con messaggio codice invito
- ContactController.php: POST /api/contact/request-invite
Validazione campi, rate limit 3/10min per IP, email a info@agile.software
tramite EmailService con template HTML branded
- index.php: route contact → ContactController + action requestInvite
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
AuthController:
- register() accetta `role` diretto (compliance_manager, org_admin, auditor, board_member, consultant)
- Aggiunto validateInvite() → POST /api/auth/validate-invite (no auth)
OnboardingController:
- Aggiunto lookupPiva() → POST /api/onboarding/lookup-piva (no auth, rate limit 10/min)
usato da register.html per P.IVA lookup pre-login
Router (index.php):
- Aggiunto POST:validateInvite e POST:lookupPiva
api.js:
- register() invia sia `role` che `user_type` per retrocompatibilità
simulate-nis2.php:
- SIM-06: B2B provisioning via X-Provision-Secret → org + JWT + API Key
- Filtro NIS2_SIM=SIM06 via goto per skip SIM-01→05 indipendenti
- readEnvValue() helper per leggere PROVISION_SECRET da .env
register.html:
- lookupPiva usa /onboarding/lookup-piva (endpoint pubblico)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
ServicesController:
- POST /api/services/token: lg231 invia API key → riceve JWT 15min
- POST /api/services/sso: SSO federato con identità utente + responsabilità
→ crea/trova utente NIS2 + emette JWT 2h con ruolo e responsibilities
- Audit trail: ogni chiamata esterna autenticata loggata (api.external_call)
- SSO login loggato come auth.sso_login severity=warning con responsabilità
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Rimozione prefisso /nis2/ da tutti i path frontend e router:
- index.php: basePath '' (da '/nis2')
- api.js: baseUrl '/api' (da '/nis2/api')
- Tutti i file HTML: path assoluti senza prefisso /nis2/
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1. Fix auto-fill visura: mapping corretto suggested_sector e employees_range,
indicatori visivi verdi sui campi auto-compilati, fatturato sempre manuale
2. Adesione volontaria: colonna voluntary_compliance, checkbox in onboarding
step 5 quando not_applicable, toggle in settings, reset su ri-classificazione
3. Modulo NCR/CAPA: NonConformityController con 10 endpoint API,
tabelle non_conformities + capa_actions, generazione NCR dai gap assessment,
predisposizione integrazione SistemiG.agile (webhook + sync)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Critical fixes discovered during end-to-end testing:
Router (index.php):
- Rewrote route resolution engine to properly handle /{id}/subAction patterns
- All routes like GET /assessments/{id}/questions, POST /incidents/{id}/early-warning,
GET /organizations/{id}/members now resolve correctly
- Routes with kebab-case sub-actions (early-warning, ai-analyze) now convert to camelCase
- Controller methods receive correct arguments via spread operator
EmailService.php:
- Fix PHP parse error: ?? operator cannot be used inside string interpolation {}
- Extract incident_code to variable before interpolation (3 occurrences)
assessment.html:
- Fix data structure handling: API returns categories with nested questions array
- Fix field names: question_code (not question_id), response_value (not compliance_level)
- Fix answer enum values: not_implemented/partial/implemented (not Italian)
- Fix question text field: question_text (not text/question/title)
- Show NIS2 article and ISO 27001 control references
- Fix response restoration from existing answers
dashboard.html:
- Fix data mapping from overview API response structure
- risks.total instead of open_risks, policies array instead of approved_policies
- Calculate training completion percentage from training object
- Load deadlines/activity from dedicated endpoints (not included in overview)
onboarding.html:
- Fix field name mismatches: annual_turnover_eur, contact_email, contact_phone,
full_name, phone (matching OnboardingController expected params)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- New 5-step onboarding wizard (onboarding.html) replacing setup-org.html
- Step 1: Choose data source (Upload Visura / CertiSource / Manual)
- Step 2: PDF upload with AI extraction or CertiSource P.IVA lookup
- Step 3: Verify/complete company data with NIS2 sector mapping
- Step 4: User profile completion
- Step 5: NIS2 classification (Essential/Important) with summary
- OnboardingController with upload-visura, fetch-company, complete endpoints
- VisuraService with Claude AI PDF extraction and ATECO-to-NIS2 mapping
- CertiSource API integration for automatic company data retrieval
- Updated login/register redirects to point to new onboarding wizard
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
