f85876f2a2
Backend del modulo questionari fornitori (design docs/DESIGN_MODULO_QUESTIONARI_FORNITORI.md). Migrazioni 032+033 gia applicate su host (6 tabelle + 10 categorie preset + suppliers.category_id/external_ref/source). SupplyChainController: - categorie: categories/createCategory/updateCategory/deleteCategory (preset org 0 + custom per-org, no delete se in uso) - template: templates/getTemplate/createTemplate/updateTemplate (per-org, scope categoria) - domande: addTemplateQuestion/updateTemplateQuestion/deleteTemplateQuestion (7 tipi, weight, nis2_ref, vuln_flag, high_criticality_only) - import: importSuppliers + bulkUpsertSuppliers (upsert per external_ref, anti formula-injection CSV, max 1000, riusabile da API key) - helper: assertCategoryVisible/assertTemplateOwned/slugify/sanitizeCell Tutte le query org-scoped (no leak cross-org). Route in public/index.php actionMap supply-chain. Smoke: no-auth=401, categcategorie_visibili=10 (preset). USR2 applicato. php -l OK. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
723 lines
33 KiB
PHP
723 lines
33 KiB
PHP
<?php
|
|
/**
|
|
* NIS2 Agile - Supply Chain Controller
|
|
*
|
|
* Gestione fornitori, assessment cybersecurity, risk scoring.
|
|
*/
|
|
|
|
require_once __DIR__ . '/BaseController.php';
|
|
|
|
class SupplyChainController extends BaseController
|
|
{
|
|
public function list(): void
|
|
{
|
|
$this->requireOrgAccess();
|
|
|
|
$suppliers = Database::fetchAll(
|
|
'SELECT * FROM suppliers WHERE organization_id = ? ORDER BY criticality DESC, name',
|
|
[$this->getCurrentOrgId()]
|
|
);
|
|
|
|
$this->jsonSuccess($suppliers);
|
|
}
|
|
|
|
public function create(): void
|
|
{
|
|
$this->requireOrgRole(['org_admin', 'compliance_manager']);
|
|
$this->validateRequired(['name', 'service_type']);
|
|
|
|
$supplierId = Database::insert('suppliers', [
|
|
'organization_id' => $this->getCurrentOrgId(),
|
|
'name' => trim($this->getParam('name')),
|
|
'vat_number' => $this->getParam('vat_number'),
|
|
'contact_email' => $this->getParam('contact_email'),
|
|
'contact_name' => $this->getParam('contact_name'),
|
|
'service_type' => $this->getParam('service_type'),
|
|
'service_description' => $this->getParam('service_description'),
|
|
'criticality' => $this->getParam('criticality', 'medium'),
|
|
'contract_start_date' => $this->getParam('contract_start_date'),
|
|
'contract_expiry_date' => $this->getParam('contract_expiry_date'),
|
|
'notes' => $this->getParam('notes'),
|
|
]);
|
|
|
|
$this->logAudit('supplier_created', 'supplier', $supplierId);
|
|
$this->jsonSuccess(['id' => $supplierId], 'Fornitore aggiunto', 201);
|
|
}
|
|
|
|
public function get(int $id): void
|
|
{
|
|
$this->requireOrgAccess();
|
|
|
|
$supplier = Database::fetchOne(
|
|
'SELECT * FROM suppliers WHERE id = ? AND organization_id = ?',
|
|
[$id, $this->getCurrentOrgId()]
|
|
);
|
|
|
|
if (!$supplier) {
|
|
$this->jsonError('Fornitore non trovato', 404, 'SUPPLIER_NOT_FOUND');
|
|
}
|
|
|
|
$this->jsonSuccess($supplier);
|
|
}
|
|
|
|
public function update(int $id): void
|
|
{
|
|
$this->requireOrgRole(['org_admin', 'compliance_manager']);
|
|
|
|
$updates = [];
|
|
$fields = ['name', 'vat_number', 'contact_email', 'contact_name', 'service_type',
|
|
'service_description', 'criticality', 'contract_start_date', 'contract_expiry_date',
|
|
'security_requirements_met', 'notes', 'status'];
|
|
|
|
foreach ($fields as $field) {
|
|
if ($this->hasParam($field)) {
|
|
$updates[$field] = $this->getParam($field);
|
|
}
|
|
}
|
|
|
|
if (!empty($updates)) {
|
|
Database::update('suppliers', $updates, 'id = ? AND organization_id = ?', [$id, $this->getCurrentOrgId()]);
|
|
$this->logAudit('supplier_updated', 'supplier', $id, $updates);
|
|
}
|
|
|
|
$this->jsonSuccess($updates, 'Fornitore aggiornato');
|
|
}
|
|
|
|
public function delete(int $id): void
|
|
{
|
|
$this->requireOrgRole(['org_admin']);
|
|
$deleted = Database::delete('suppliers', 'id = ? AND organization_id = ?', [$id, $this->getCurrentOrgId()]);
|
|
if ($deleted === 0) {
|
|
$this->jsonError('Fornitore non trovato', 404, 'SUPPLIER_NOT_FOUND');
|
|
}
|
|
$this->logAudit('supplier_deleted', 'supplier', $id);
|
|
$this->jsonSuccess(null, 'Fornitore eliminato');
|
|
}
|
|
|
|
public function assessSupplier(int $id): void
|
|
{
|
|
$this->requireOrgRole(['org_admin', 'compliance_manager']);
|
|
$this->validateRequired(['assessment_responses']);
|
|
|
|
$responses = $this->getParam('assessment_responses');
|
|
$riskScore = $this->calculateSupplierRiskScore($responses);
|
|
|
|
Database::update('suppliers', [
|
|
'assessment_responses' => json_encode($responses),
|
|
'risk_score' => $riskScore,
|
|
'last_assessment_date' => date('Y-m-d'),
|
|
'next_assessment_date' => date('Y-m-d', strtotime('+6 months')),
|
|
'security_requirements_met' => $riskScore >= 70 ? 1 : 0,
|
|
], 'id = ? AND organization_id = ?', [$id, $this->getCurrentOrgId()]);
|
|
|
|
$this->logAudit('supplier_assessed', 'supplier', $id, ['risk_score' => $riskScore]);
|
|
$this->jsonSuccess(['risk_score' => $riskScore], 'Assessment fornitore completato');
|
|
}
|
|
|
|
public function riskOverview(): void
|
|
{
|
|
$this->requireOrgAccess();
|
|
|
|
$overview = Database::fetchAll(
|
|
'SELECT criticality, status,
|
|
COUNT(*) as count,
|
|
AVG(risk_score) as avg_risk_score,
|
|
SUM(CASE WHEN security_requirements_met = 0 THEN 1 ELSE 0 END) as non_compliant
|
|
FROM suppliers
|
|
WHERE organization_id = ?
|
|
GROUP BY criticality, status',
|
|
[$this->getCurrentOrgId()]
|
|
);
|
|
|
|
$expiring = Database::fetchAll(
|
|
'SELECT id, name, contract_expiry_date, criticality
|
|
FROM suppliers
|
|
WHERE organization_id = ? AND contract_expiry_date IS NOT NULL
|
|
AND contract_expiry_date <= DATE_ADD(NOW(), INTERVAL 90 DAY)
|
|
AND status = "active"
|
|
ORDER BY contract_expiry_date',
|
|
[$this->getCurrentOrgId()]
|
|
);
|
|
|
|
$this->jsonSuccess([
|
|
'overview' => $overview,
|
|
'expiring_contracts' => $expiring,
|
|
]);
|
|
}
|
|
|
|
private function calculateSupplierRiskScore(array $responses): int
|
|
{
|
|
if (empty($responses)) return 0;
|
|
|
|
$totalScore = 0;
|
|
$totalWeight = 0;
|
|
|
|
foreach ($responses as $resp) {
|
|
$weight = $resp['weight'] ?? 1;
|
|
$value = match ($resp['value'] ?? '') {
|
|
'yes', 'implemented' => 100,
|
|
'partial' => 50,
|
|
default => 0,
|
|
};
|
|
$totalScore += $value * $weight;
|
|
$totalWeight += 100 * $weight;
|
|
}
|
|
|
|
return $totalWeight > 0 ? (int) round($totalScore / $totalWeight * 100) : 0;
|
|
}
|
|
|
|
// ══════════════════════════════════════════════════════════════════════
|
|
// SELF-ASSESSMENT FORNITORI (P3) — questionario sicurezza Art.21.2.d
|
|
// ══════════════════════════════════════════════════════════════════════
|
|
|
|
private const QUESTIONNAIRE = [
|
|
['key' => 'iso27001', 'q' => 'Disponete di una certificazione ISO/IEC 27001 valida?', 'weight' => 15],
|
|
['key' => 'mfa', 'q' => 'Imponete autenticazione a piu fattori (MFA) per gli accessi ai sistemi che trattano dati del cliente?', 'weight' => 15],
|
|
['key' => 'patching', 'q' => 'Avete un processo formale di patch management e gestione vulnerabilita?', 'weight' => 12],
|
|
['key' => 'backup', 'q' => 'Eseguite backup regolari con test di ripristino documentati?', 'weight' => 12],
|
|
['key' => 'incident', 'q' => 'Disponete di un piano di gestione degli incidenti con notifica al cliente?', 'weight' => 14],
|
|
['key' => 'access_review', 'q' => 'Effettuate revisioni periodiche degli accessi e revoca tempestiva?', 'weight' => 10],
|
|
['key' => 'encryption', 'q' => 'I dati del cliente sono cifrati a riposo e in transito?', 'weight' => 12],
|
|
['key' => 'subcontractor', 'q' => 'Valutate la sicurezza dei vostri sub-fornitori (quarta parte)?', 'weight' => 10],
|
|
];
|
|
|
|
/** POST /api/supply-chain/{id}/send-questionnaire (JWT): genera token + link pubblico. */
|
|
public function sendQuestionnaire(int $id): void
|
|
{
|
|
$this->requireOrgRole(['org_admin', 'compliance_manager']);
|
|
$supplier = Database::fetchOne(
|
|
'SELECT id, name, contact_email FROM suppliers WHERE id = ? AND organization_id = ? AND deleted_at IS NULL',
|
|
[$id, $this->getCurrentOrgId()]
|
|
);
|
|
if (!$supplier) {
|
|
$this->jsonError('Fornitore non trovato', 404, 'NOT_FOUND');
|
|
}
|
|
|
|
$rawToken = 'sq_' . bin2hex(random_bytes(20));
|
|
$email = $this->getParam('email') ?: $supplier['contact_email'];
|
|
$expires = date('Y-m-d H:i:s', time() + 30 * 86400);
|
|
|
|
Database::insert('supplier_questionnaires', [
|
|
'organization_id' => $this->getCurrentOrgId(),
|
|
'supplier_id' => $id,
|
|
'token_hash' => hash('sha256', $rawToken),
|
|
'status' => 'sent',
|
|
'sent_to_email' => $email,
|
|
'expires_at' => $expires,
|
|
]);
|
|
|
|
$link = 'https://nis2.agile.software/supplier-assessment.html?token=' . $rawToken;
|
|
|
|
try {
|
|
if ($email && class_exists('EmailService')) {
|
|
$svc = new EmailService();
|
|
if (method_exists($svc, 'send')) {
|
|
$svc->send($email, 'Questionario di sicurezza fornitore - NIS2',
|
|
"<p>Gentile {$supplier['name']},</p><p>vi chiediamo di compilare il questionario di sicurezza al seguente link (valido 30 giorni):</p><p><a href=\"{$link}\">{$link}</a></p>");
|
|
}
|
|
}
|
|
} catch (Throwable $e) {
|
|
error_log('[SUPPLIER_Q] email: ' . $e->getMessage());
|
|
}
|
|
|
|
$this->logAudit('supplier_questionnaire_sent', 'supplier', $id, ['email' => $email]);
|
|
$this->jsonSuccess(['supplier_id' => $id, 'sent_to' => $email, 'link' => $link, 'expires_at' => $expires], 'Questionario generato', 201);
|
|
}
|
|
|
|
/** GET /api/supply-chain/public-questionnaire?token=xxx (NO AUTH). */
|
|
public function publicQuestionnaire(): void
|
|
{
|
|
$q = $this->resolveQuestionnaire($_GET['token'] ?? '');
|
|
if ($q['status'] === 'completed') {
|
|
$this->jsonError('Questionario gia compilato', 409, 'ALREADY_COMPLETED');
|
|
}
|
|
$supplier = Database::fetchOne('SELECT name FROM suppliers WHERE id = ?', [$q['supplier_id']]);
|
|
$this->jsonSuccess([
|
|
'supplier_name' => $supplier['name'] ?? 'Fornitore',
|
|
'questions' => array_map(fn($x) => ['key' => $x['key'], 'question' => $x['q']], self::QUESTIONNAIRE),
|
|
'answer_scale' => ['yes' => 'Si', 'partial' => 'Parzialmente', 'no' => 'No'],
|
|
]);
|
|
}
|
|
|
|
/** POST /api/supply-chain/submit-public-questionnaire (NO AUTH). Body: {token, answers}. */
|
|
public function submitPublicQuestionnaire(): void
|
|
{
|
|
$body = $this->getJsonBody();
|
|
$q = $this->resolveQuestionnaire($body['token'] ?? '');
|
|
if ($q['status'] === 'completed') {
|
|
$this->jsonError('Questionario gia compilato', 409, 'ALREADY_COMPLETED');
|
|
}
|
|
|
|
$answers = is_array($body['answers'] ?? null) ? $body['answers'] : [];
|
|
$scoreMap = ['yes' => 1.0, 'partial' => 0.5, 'no' => 0.0];
|
|
$earned = 0; $maxScore = 0; $clean = [];
|
|
foreach (self::QUESTIONNAIRE as $item) {
|
|
$maxScore += $item['weight'];
|
|
$a = strtolower((string) ($answers[$item['key']] ?? 'no'));
|
|
if (!isset($scoreMap[$a])) $a = 'no';
|
|
$clean[$item['key']] = $a;
|
|
$earned += $item['weight'] * $scoreMap[$a];
|
|
}
|
|
$score = $maxScore > 0 ? (int) round($earned / $maxScore * 100) : 0;
|
|
$riskLevel = $score >= 80 ? 'low' : ($score >= 60 ? 'medium' : ($score >= 40 ? 'high' : 'critical'));
|
|
|
|
// Completamento ATOMICO: vincola lo UPDATE a status='sent' così due submit
|
|
// concorrenti con lo stesso token non possono completare due volte (la seconda
|
|
// tocca 0 righe -> 409). Previene il doppio-submit senza transazione esplicita.
|
|
$upd = Database::query(
|
|
'UPDATE supplier_questionnaires SET status=?, answers=?, score=?, risk_level=?, completed_at=NOW()
|
|
WHERE id=? AND status=?',
|
|
['completed', json_encode($clean, JSON_UNESCAPED_UNICODE), $score, $riskLevel, $q['id'], 'sent']
|
|
);
|
|
if ($upd->rowCount() === 0) {
|
|
$this->jsonError('Questionario gia compilato', 409, 'ALREADY_COMPLETED');
|
|
}
|
|
|
|
// Coerenza con assessSupplier: suppliers.risk_score = punteggio di COMPLIANCE
|
|
// (alto = buono), e security_requirements_met soglia 70. NON sovrascriviamo
|
|
// suppliers.criticality (è la criticità del fornitore, non l'esito del questionario).
|
|
Database::query(
|
|
'UPDATE suppliers SET risk_score=?, security_requirements_met=?, last_assessment_date=CURDATE()
|
|
WHERE id=? AND organization_id=?',
|
|
[$score, $score >= 70 ? 1 : 0, $q['supplier_id'], $q['organization_id']]
|
|
);
|
|
|
|
$this->jsonSuccess(['score' => $score, 'risk_level' => $riskLevel], 'Questionario inviato. Grazie.', 201);
|
|
}
|
|
|
|
/** GET /api/supply-chain/{id}/questionnaire-status (JWT). */
|
|
public function questionnaireStatus(int $id): void
|
|
{
|
|
$this->requireOrgAccess();
|
|
$rows = Database::fetchAll(
|
|
'SELECT id, status, score, risk_level, sent_to_email, sent_at, completed_at, expires_at
|
|
FROM supplier_questionnaires WHERE supplier_id = ? AND organization_id = ? ORDER BY sent_at DESC',
|
|
[$id, $this->getCurrentOrgId()]
|
|
);
|
|
$this->jsonSuccess(['questionnaires' => $rows]);
|
|
}
|
|
|
|
// ══════════════════════════════════════════════════════════════════════
|
|
// MODULO QUESTIONARI CONFIGURABILE (Fase 1) — categorie, template, domande
|
|
// ══════════════════════════════════════════════════════════════════════
|
|
|
|
/** GET /api/supply-chain/categories — preset di sistema (org 0) + categorie dell'org. */
|
|
public function categories(): void
|
|
{
|
|
$this->requireOrgAccess();
|
|
$rows = Database::fetchAll(
|
|
'SELECT id, organization_id, slug, name, description, is_system
|
|
FROM supplier_categories
|
|
WHERE organization_id = 0 OR organization_id = ?
|
|
ORDER BY is_system DESC, name',
|
|
[$this->getCurrentOrgId()]
|
|
);
|
|
$this->jsonSuccess($rows);
|
|
}
|
|
|
|
/** POST /api/supply-chain/categories — crea categoria custom per l'org. */
|
|
public function createCategory(): void
|
|
{
|
|
$this->requireOrgRole(['org_admin', 'compliance_manager']);
|
|
$this->validateRequired(['name']);
|
|
|
|
$name = trim((string) $this->getParam('name'));
|
|
$slug = $this->slugify($this->getParam('slug') ?: $name);
|
|
if ($slug === '') {
|
|
$this->jsonError('Nome categoria non valido', 422, 'INVALID_NAME');
|
|
}
|
|
|
|
// Nessun conflitto con slug esistente (preset o della stessa org)
|
|
$exists = Database::fetchOne(
|
|
'SELECT id FROM supplier_categories WHERE slug = ? AND organization_id IN (0, ?)',
|
|
[$slug, $this->getCurrentOrgId()]
|
|
);
|
|
if ($exists) {
|
|
$this->jsonError('Esiste gia una categoria con questo identificativo', 409, 'DUPLICATE_SLUG');
|
|
}
|
|
|
|
$id = Database::insert('supplier_categories', [
|
|
'organization_id' => $this->getCurrentOrgId(),
|
|
'slug' => $slug,
|
|
'name' => $name,
|
|
'description' => $this->getParam('description'),
|
|
'is_system' => 0,
|
|
]);
|
|
$this->logAudit('supplier_category_created', 'supplier_category', $id);
|
|
$this->jsonSuccess(['id' => $id], 'Categoria creata', 201);
|
|
}
|
|
|
|
/** PUT /api/supply-chain/categories/{id} — modifica categoria custom (no preset). */
|
|
public function updateCategory(int $id): void
|
|
{
|
|
$this->requireOrgRole(['org_admin', 'compliance_manager']);
|
|
$cat = Database::fetchOne(
|
|
'SELECT id FROM supplier_categories WHERE id = ? AND organization_id = ?',
|
|
[$id, $this->getCurrentOrgId()]
|
|
);
|
|
if (!$cat) {
|
|
$this->jsonError('Categoria non trovata o non modificabile', 404, 'NOT_FOUND');
|
|
}
|
|
$updates = [];
|
|
foreach (['name', 'description'] as $f) {
|
|
if ($this->hasParam($f)) $updates[$f] = $this->getParam($f);
|
|
}
|
|
if (!empty($updates)) {
|
|
Database::update('supplier_categories', $updates, 'id = ? AND organization_id = ?', [$id, $this->getCurrentOrgId()]);
|
|
$this->logAudit('supplier_category_updated', 'supplier_category', $id, $updates);
|
|
}
|
|
$this->jsonSuccess($updates, 'Categoria aggiornata');
|
|
}
|
|
|
|
/** DELETE /api/supply-chain/categories/{id} — elimina categoria custom (no preset, no se in uso). */
|
|
public function deleteCategory(int $id): void
|
|
{
|
|
$this->requireOrgRole(['org_admin']);
|
|
$cat = Database::fetchOne(
|
|
'SELECT id FROM supplier_categories WHERE id = ? AND organization_id = ?',
|
|
[$id, $this->getCurrentOrgId()]
|
|
);
|
|
if (!$cat) {
|
|
$this->jsonError('Categoria non trovata o non eliminabile', 404, 'NOT_FOUND');
|
|
}
|
|
$inUse = Database::fetchOne(
|
|
'SELECT COUNT(*) AS n FROM suppliers WHERE category_id = ? AND organization_id = ?',
|
|
[$id, $this->getCurrentOrgId()]
|
|
);
|
|
if ((int) ($inUse['n'] ?? 0) > 0) {
|
|
$this->jsonError('Categoria in uso da uno o piu fornitori', 409, 'CATEGORY_IN_USE');
|
|
}
|
|
Database::delete('supplier_categories', 'id = ? AND organization_id = ?', [$id, $this->getCurrentOrgId()]);
|
|
$this->logAudit('supplier_category_deleted', 'supplier_category', $id);
|
|
$this->jsonSuccess(null, 'Categoria eliminata');
|
|
}
|
|
|
|
/** GET /api/supply-chain/templates — lista template dell'org (+ conteggio domande). */
|
|
public function templates(): void
|
|
{
|
|
$this->requireOrgAccess();
|
|
$rows = Database::fetchAll(
|
|
'SELECT t.id, t.name, t.description, t.category_id, t.current_version, t.status,
|
|
t.is_default, t.pass_threshold, c.name AS category_name,
|
|
(SELECT COUNT(*) FROM questionnaire_questions q WHERE q.template_id = t.id) AS question_count
|
|
FROM questionnaire_templates t
|
|
LEFT JOIN supplier_categories c ON c.id = t.category_id
|
|
WHERE t.organization_id = ?
|
|
ORDER BY t.is_default DESC, t.name',
|
|
[$this->getCurrentOrgId()]
|
|
);
|
|
$this->jsonSuccess($rows);
|
|
}
|
|
|
|
/** GET /api/supply-chain/templates/{id} — template + domande ordinate. */
|
|
public function getTemplate(int $id): void
|
|
{
|
|
$this->requireOrgAccess();
|
|
$tpl = Database::fetchOne(
|
|
'SELECT * FROM questionnaire_templates WHERE id = ? AND organization_id = ?',
|
|
[$id, $this->getCurrentOrgId()]
|
|
);
|
|
if (!$tpl) {
|
|
$this->jsonError('Template non trovato', 404, 'NOT_FOUND');
|
|
}
|
|
$tpl['questions'] = Database::fetchAll(
|
|
'SELECT id, question_code, question_text, question_type, options, weight,
|
|
is_required, order_index, nis2_ref, vuln_flag, high_criticality_only
|
|
FROM questionnaire_questions WHERE template_id = ? ORDER BY order_index, id',
|
|
[$id]
|
|
);
|
|
$this->jsonSuccess($tpl);
|
|
}
|
|
|
|
/** POST /api/supply-chain/templates — crea template (vuoto o da scope). */
|
|
public function createTemplate(): void
|
|
{
|
|
$this->requireOrgRole(['org_admin', 'compliance_manager']);
|
|
$this->validateRequired(['name']);
|
|
|
|
$categoryId = $this->getParam('category_id');
|
|
if ($categoryId !== null && $categoryId !== '') {
|
|
$this->assertCategoryVisible((int) $categoryId);
|
|
}
|
|
|
|
$id = Database::insert('questionnaire_templates', [
|
|
'organization_id' => $this->getCurrentOrgId(),
|
|
'category_id' => ($categoryId !== null && $categoryId !== '') ? (int) $categoryId : null,
|
|
'name' => trim((string) $this->getParam('name')),
|
|
'description' => $this->getParam('description'),
|
|
'current_version' => '1.0',
|
|
'status' => 'draft',
|
|
'pass_threshold' => $this->getParam('pass_threshold') !== null ? (int) $this->getParam('pass_threshold') : null,
|
|
'is_default' => $this->getParam('is_default') ? 1 : 0,
|
|
'created_by' => $this->getCurrentUserId(),
|
|
]);
|
|
$this->logAudit('questionnaire_template_created', 'questionnaire_template', $id);
|
|
$this->jsonSuccess(['id' => $id], 'Template creato', 201);
|
|
}
|
|
|
|
/** PUT /api/supply-chain/templates/{id} — aggiorna metadati template. */
|
|
public function updateTemplate(int $id): void
|
|
{
|
|
$this->requireOrgRole(['org_admin', 'compliance_manager']);
|
|
$tpl = Database::fetchOne(
|
|
'SELECT id FROM questionnaire_templates WHERE id = ? AND organization_id = ?',
|
|
[$id, $this->getCurrentOrgId()]
|
|
);
|
|
if (!$tpl) {
|
|
$this->jsonError('Template non trovato', 404, 'NOT_FOUND');
|
|
}
|
|
$updates = [];
|
|
foreach (['name', 'description', 'status'] as $f) {
|
|
if ($this->hasParam($f)) $updates[$f] = $this->getParam($f);
|
|
}
|
|
if ($this->hasParam('category_id')) {
|
|
$cid = $this->getParam('category_id');
|
|
if ($cid !== null && $cid !== '') $this->assertCategoryVisible((int) $cid);
|
|
$updates['category_id'] = ($cid !== null && $cid !== '') ? (int) $cid : null;
|
|
}
|
|
if ($this->hasParam('pass_threshold')) {
|
|
$updates['pass_threshold'] = $this->getParam('pass_threshold') !== null ? (int) $this->getParam('pass_threshold') : null;
|
|
}
|
|
if ($this->hasParam('is_default')) {
|
|
$updates['is_default'] = $this->getParam('is_default') ? 1 : 0;
|
|
}
|
|
if (!empty($updates)) {
|
|
Database::update('questionnaire_templates', $updates, 'id = ? AND organization_id = ?', [$id, $this->getCurrentOrgId()]);
|
|
$this->logAudit('questionnaire_template_updated', 'questionnaire_template', $id, $updates);
|
|
}
|
|
$this->jsonSuccess($updates, 'Template aggiornato');
|
|
}
|
|
|
|
/** POST /api/supply-chain/templates/{id}/questions — aggiunge una domanda. */
|
|
public function addTemplateQuestion(int $id): void
|
|
{
|
|
$this->requireOrgRole(['org_admin', 'compliance_manager']);
|
|
$this->assertTemplateOwned($id);
|
|
$this->validateRequired(['question_text']);
|
|
|
|
$type = $this->getParam('question_type', 'yes_no_partial');
|
|
$allowed = ['yes_no_partial', 'single_choice', 'multi_choice', 'scale_1_5', 'text', 'number', 'file'];
|
|
if (!in_array($type, $allowed, true)) {
|
|
$this->jsonError('Tipo domanda non valido', 422, 'INVALID_TYPE');
|
|
}
|
|
|
|
$options = $this->getParam('options');
|
|
$maxOrder = Database::fetchOne('SELECT COALESCE(MAX(order_index),0) AS m FROM questionnaire_questions WHERE template_id = ?', [$id]);
|
|
|
|
$qid = Database::insert('questionnaire_questions', [
|
|
'template_id' => $id,
|
|
'organization_id' => $this->getCurrentOrgId(),
|
|
'question_code' => $this->getParam('question_code'),
|
|
'question_text' => trim((string) $this->getParam('question_text')),
|
|
'question_type' => $type,
|
|
'options' => $options !== null ? json_encode($options, JSON_UNESCAPED_UNICODE) : null,
|
|
'weight' => $this->getParam('weight') !== null ? (float) $this->getParam('weight') : 1.0,
|
|
'is_required' => $this->getParam('is_required', true) ? 1 : 0,
|
|
'order_index' => $this->getParam('order_index') !== null ? (int) $this->getParam('order_index') : ((int) ($maxOrder['m'] ?? 0) + 1),
|
|
'nis2_ref' => $this->getParam('nis2_ref'),
|
|
'vuln_flag' => $this->getParam('vuln_flag'),
|
|
'high_criticality_only' => $this->getParam('high_criticality_only') ? 1 : 0,
|
|
]);
|
|
$this->logAudit('questionnaire_question_added', 'questionnaire_template', $id, ['question_id' => $qid]);
|
|
$this->jsonSuccess(['id' => $qid], 'Domanda aggiunta', 201);
|
|
}
|
|
|
|
/** PUT /api/supply-chain/questions/{id} — modifica domanda. */
|
|
public function updateTemplateQuestion(int $id): void
|
|
{
|
|
$this->requireOrgRole(['org_admin', 'compliance_manager']);
|
|
$q = Database::fetchOne(
|
|
'SELECT id FROM questionnaire_questions WHERE id = ? AND organization_id = ?',
|
|
[$id, $this->getCurrentOrgId()]
|
|
);
|
|
if (!$q) {
|
|
$this->jsonError('Domanda non trovata', 404, 'NOT_FOUND');
|
|
}
|
|
$updates = [];
|
|
foreach (['question_code', 'question_text', 'nis2_ref', 'vuln_flag'] as $f) {
|
|
if ($this->hasParam($f)) $updates[$f] = $this->getParam($f);
|
|
}
|
|
if ($this->hasParam('question_type')) {
|
|
$type = $this->getParam('question_type');
|
|
$allowed = ['yes_no_partial', 'single_choice', 'multi_choice', 'scale_1_5', 'text', 'number', 'file'];
|
|
if (!in_array($type, $allowed, true)) $this->jsonError('Tipo domanda non valido', 422, 'INVALID_TYPE');
|
|
$updates['question_type'] = $type;
|
|
}
|
|
if ($this->hasParam('options')) {
|
|
$opt = $this->getParam('options');
|
|
$updates['options'] = $opt !== null ? json_encode($opt, JSON_UNESCAPED_UNICODE) : null;
|
|
}
|
|
if ($this->hasParam('weight')) $updates['weight'] = (float) $this->getParam('weight');
|
|
if ($this->hasParam('order_index')) $updates['order_index'] = (int) $this->getParam('order_index');
|
|
if ($this->hasParam('is_required')) $updates['is_required'] = $this->getParam('is_required') ? 1 : 0;
|
|
if ($this->hasParam('high_criticality_only')) $updates['high_criticality_only'] = $this->getParam('high_criticality_only') ? 1 : 0;
|
|
|
|
if (!empty($updates)) {
|
|
Database::update('questionnaire_questions', $updates, 'id = ? AND organization_id = ?', [$id, $this->getCurrentOrgId()]);
|
|
$this->logAudit('questionnaire_question_updated', 'questionnaire_question', $id, $updates);
|
|
}
|
|
$this->jsonSuccess($updates, 'Domanda aggiornata');
|
|
}
|
|
|
|
/** DELETE /api/supply-chain/questions/{id} — elimina domanda. */
|
|
public function deleteTemplateQuestion(int $id): void
|
|
{
|
|
$this->requireOrgRole(['org_admin', 'compliance_manager']);
|
|
$deleted = Database::delete('questionnaire_questions', 'id = ? AND organization_id = ?', [$id, $this->getCurrentOrgId()]);
|
|
if ($deleted === 0) {
|
|
$this->jsonError('Domanda non trovata', 404, 'NOT_FOUND');
|
|
}
|
|
$this->logAudit('questionnaire_question_deleted', 'questionnaire_question', $id);
|
|
$this->jsonSuccess(null, 'Domanda eliminata');
|
|
}
|
|
|
|
/** POST /api/supply-chain/import — import massivo fornitori (CSV/JSON), upsert per external_ref. */
|
|
public function importSuppliers(): void
|
|
{
|
|
$this->requireOrgRole(['org_admin', 'compliance_manager']);
|
|
$body = $this->getJsonBody();
|
|
$rows = $body['suppliers'] ?? $body['rows'] ?? null;
|
|
if (!is_array($rows) || empty($rows)) {
|
|
$this->jsonError('Nessun fornitore da importare (campo "suppliers" array)', 422, 'NO_ROWS');
|
|
}
|
|
if (count($rows) > 1000) {
|
|
$this->jsonError('Troppi record in un singolo import (max 1000)', 422, 'TOO_MANY');
|
|
}
|
|
|
|
$result = $this->bulkUpsertSuppliers($rows, 'csv');
|
|
$this->logAudit('suppliers_imported', 'supplier', null, $result);
|
|
$this->jsonSuccess($result, 'Import completato');
|
|
}
|
|
|
|
/**
|
|
* Upsert massivo fornitori per (organization_id, external_ref). Riusato da import CSV
|
|
* e da ServicesController (API key, scope write:suppliers). Sanitizza i campi.
|
|
* @return array{created:int,updated:int,skipped:int,errors:array}
|
|
*/
|
|
public function bulkUpsertSuppliers(array $rows, string $source): array
|
|
{
|
|
$orgId = $this->getCurrentOrgId();
|
|
$created = 0; $updated = 0; $skipped = 0; $errors = [];
|
|
|
|
foreach ($rows as $i => $r) {
|
|
$name = trim((string) ($r['name'] ?? ''));
|
|
if ($name === '') { $skipped++; $errors[] = ['row' => $i, 'error' => 'name mancante']; continue; }
|
|
|
|
$extRef = isset($r['external_ref']) ? trim((string) $r['external_ref']) : null;
|
|
$extRef = ($extRef === '') ? null : $extRef;
|
|
|
|
$crit = strtolower((string) ($r['criticality'] ?? 'medium'));
|
|
if (!in_array($crit, ['low', 'medium', 'high', 'critical'], true)) $crit = 'medium';
|
|
|
|
$catId = null;
|
|
if (!empty($r['category_slug'])) {
|
|
$cat = Database::fetchOne(
|
|
'SELECT id FROM supplier_categories WHERE slug = ? AND organization_id IN (0, ?)',
|
|
[$this->slugify((string) $r['category_slug']), $orgId]
|
|
);
|
|
$catId = $cat['id'] ?? null;
|
|
} elseif (!empty($r['category_id'])) {
|
|
$catId = (int) $r['category_id'];
|
|
}
|
|
|
|
$data = [
|
|
'name' => $name,
|
|
'vat_number' => $this->sanitizeCell($r['vat_number'] ?? null),
|
|
'contact_email' => $this->sanitizeCell($r['contact_email'] ?? null),
|
|
'contact_name' => $this->sanitizeCell($r['contact_name'] ?? null),
|
|
'service_type' => $this->sanitizeCell($r['service_type'] ?? 'altro'),
|
|
'service_description' => $this->sanitizeCell($r['service_description'] ?? null),
|
|
'criticality' => $crit,
|
|
'category_id' => $catId,
|
|
];
|
|
|
|
// Upsert per external_ref (se presente), altrimenti insert nuovo.
|
|
$existing = null;
|
|
if ($extRef !== null) {
|
|
$existing = Database::fetchOne(
|
|
'SELECT id FROM suppliers WHERE organization_id = ? AND external_ref = ?',
|
|
[$orgId, $extRef]
|
|
);
|
|
}
|
|
|
|
if ($existing) {
|
|
Database::update('suppliers', $data, 'id = ? AND organization_id = ?', [$existing['id'], $orgId]);
|
|
$updated++;
|
|
} else {
|
|
Database::insert('suppliers', array_merge($data, [
|
|
'organization_id' => $orgId,
|
|
'external_ref' => $extRef,
|
|
'source' => $source,
|
|
]));
|
|
$created++;
|
|
}
|
|
}
|
|
|
|
return ['created' => $created, 'updated' => $updated, 'skipped' => $skipped, 'errors' => array_slice($errors, 0, 50)];
|
|
}
|
|
|
|
// --- helper privati Fase 1 ---
|
|
|
|
/** Verifica che la categoria sia visibile all'org (preset o propria). */
|
|
private function assertCategoryVisible(int $categoryId): void
|
|
{
|
|
$cat = Database::fetchOne(
|
|
'SELECT id FROM supplier_categories WHERE id = ? AND organization_id IN (0, ?)',
|
|
[$categoryId, $this->getCurrentOrgId()]
|
|
);
|
|
if (!$cat) {
|
|
$this->jsonError('Categoria non valida', 422, 'INVALID_CATEGORY');
|
|
}
|
|
}
|
|
|
|
/** Verifica che il template appartenga all'org corrente. */
|
|
private function assertTemplateOwned(int $templateId): void
|
|
{
|
|
$tpl = Database::fetchOne(
|
|
'SELECT id FROM questionnaire_templates WHERE id = ? AND organization_id = ?',
|
|
[$templateId, $this->getCurrentOrgId()]
|
|
);
|
|
if (!$tpl) {
|
|
$this->jsonError('Template non trovato', 404, 'NOT_FOUND');
|
|
}
|
|
}
|
|
|
|
/** Slug stabile: minuscole, alfanumerico + underscore. */
|
|
private function slugify(string $s): string
|
|
{
|
|
$s = strtolower(trim($s));
|
|
$s = preg_replace('/[^a-z0-9]+/', '_', $s);
|
|
return trim((string) $s, '_');
|
|
}
|
|
|
|
/** Sanitizza una cella import: anti formula-injection CSV + trim. */
|
|
private function sanitizeCell($v): ?string
|
|
{
|
|
if ($v === null) return null;
|
|
$v = trim((string) $v);
|
|
if ($v === '') return null;
|
|
// neutralizza formula-injection (Excel/Sheets) prefissando un apice
|
|
if (preg_match('/^[=+\-@]/', $v)) {
|
|
$v = "'" . $v;
|
|
}
|
|
return $v;
|
|
}
|
|
|
|
/** Risolve un token grezzo nel record questionario, validando scadenza. */
|
|
private function resolveQuestionnaire(string $rawToken): array
|
|
{
|
|
if (!preg_match('/^sq_[a-f0-9]{40}$/', $rawToken)) {
|
|
$this->jsonError('Token non valido', 404, 'INVALID_TOKEN');
|
|
}
|
|
$q = Database::fetchOne('SELECT * FROM supplier_questionnaires WHERE token_hash = ?', [hash('sha256', $rawToken)]);
|
|
if (!$q) {
|
|
$this->jsonError('Questionario non trovato', 404, 'NOT_FOUND');
|
|
}
|
|
if ($q['expires_at'] && strtotime($q['expires_at']) < time() && $q['status'] !== 'completed') {
|
|
Database::query('UPDATE supplier_questionnaires SET status=? WHERE id=?', ['expired', $q['id']]);
|
|
$this->jsonError('Questionario scaduto', 410, 'EXPIRED');
|
|
}
|
|
return $q;
|
|
}
|
|
}
|