Selettore scuola in tutte le pagine

db/migrations/20261003122955_add_superadmin_and_school_roles.php

@@ -0,0 +1,43 @@
+<?php
+
+declare(strict_types=1);
+
+use Phinx\Migration\AbstractMigration;
+
+final class AddSuperadminAndSchoolRoles extends AbstractMigration
+{
+    public function up(): void
+    {
+        // 1) Flag superadmin di piattaforma (gestore del portale)
+        $this->table('auth_users')
+            ->addColumn('is_superadmin', 'char', [
+                'limit'   => 1,
+                'default' => 'N',
+                'null'    => false,
+                'comment' => 'Y = gestore piattaforma, vede tutte le scuole',
+            ])
+            ->update();
+
+        // 2) Ruoli nella scuola 1 ricavati dai ruoli Vanguard attuali
+        $this->execute("
+            UPDATE school_user su
+              JOIN auth_users u ON u.id = su.user_id
+              JOIN auth_roles r ON r.id = u.role_id
+               SET su.school_role = CASE
+                     WHEN LOWER(r.name) = 'admin'   THEN 'admin'
+                     WHEN LOWER(r.name) = 'teacher' THEN 'teacher'
+                     ELSE 'student'
+                   END
+             WHERE su.idschool = 1
+        ");
+    }
+
+    public function down(): void
+    {
+        $this->execute("UPDATE school_user SET school_role = 'student' WHERE idschool = 1");
+
+        $this->table('auth_users')
+            ->removeColumn('is_superadmin')
+            ->update();
+    }
+}

public/admin-services.php

@@ -328,7 +328,7 @@ function teacherOptions(array $teachers, int $selectedId): string
                     </div>
                 </div>
                 <div class="d-flex">
-                    <?php include('include/languageselection.php'); ?>
+                    <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
                     <?php include('include/profiletopbar.php'); ?>
                 </div>
             </div>

public/adminpanel.php

@@ -535,7 +535,7 @@ $italianMonths = [
                     </div>
                 </div>
                 <div class="d-flex">
-                    <?php include('include/languageselection.php'); ?>
+                    <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
                     <?php include('include/profiletopbar.php'); ?>
                 </div>
             </div>

public/associate-services.php

@@ -221,7 +221,7 @@ $associatedClasses = $stmtAssoc->fetchAll();
                     </div>
                 </div>
                 <div class="d-flex">
-                    <?php include('include/languageselection.php'); ?>
+                    <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
                     <?php include('include/profiletopbar.php'); ?>
                 </div>
             </div>

public/bookingpanel.php

@@ -400,7 +400,7 @@ $conn->close();
                     </div>
                 </div>
                 <div class="d-flex">
-                    <?php include('include/languageselection.php'); ?>
+                    <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
                     <?php include('include/profiletopbar.php'); ?>
                 </div>
             </div>

public/bookingpanelorder.php

@@ -450,7 +450,7 @@ $conn->close();
 
                 <div class="d-flex">
 
-                    <?php include('include/languageselection.php'); ?>
+                    <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
 
                     <div class="dropdown d-inline-block">
                         <button type="button" class="btn header-item noti-icon"

public/certificati.php

@@ -195,7 +195,7 @@ $today = date('Y-m-d');
                     </div>
                 </div>
                 <div class="d-flex">
-                    <?php include('include/languageselection.php'); ?>
+                    <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
                     <?php include('include/profiletopbar.php'); ?>
                 </div>
             </div>

public/class/SchoolContext.php

@@ -1,13 +1,17 @@
 <?php
 
 /**
- * SchoolContext
+ * SchoolContext v2
- * Determina la scuola corrente dell'utente loggato e la rende disponibile
+ * Determina la scuola corrente dell'utente loggato, il suo ruolo nella scuola
- * a tutte le pagine (via headscript).
+ * e le scuole tra cui può passare (owner multi-scuola, superadmin).
  *
- * Uso:
+ * Uso (nella headscript):
- *   $school   = SchoolContext::resolve((int)$iduserlogin);
+ *   $schoolData = SchoolContext::resolve((int)$iduserlogin);
- *   $idschool = SchoolContext::id();
+ *   $idschool   = SchoolContext::id();
+ *
+ * Ruoli scuola: owner | admin | teacher | student
+ * Il superadmin di piattaforma (auth_users.is_superadmin = 'Y') può entrare
+ * in qualsiasi scuola: se non ne è membro, il suo ruolo risulta 'superadmin'.
  */
 
 if (!class_exists('DBHandlerSelect')) {
@@ -19,49 +23,53 @@ class SchoolContext
     /** Scuola di fallback durante la fase monoscuola (Seregno) */
     const DEFAULT_SCHOOL = 1;
 
-    /** @var array|null dati della scuola corrente (riga schools + school_role) */
+    /** @var array|null scuola corrente (riga schools + school_role) */
     private static $school = null;
 
-    /**
+    /** @var int */
-     * Risolve la scuola corrente per l'utente indicato.
+    private static $userId = 0;
-     * Chiamare una sola volta per richiesta (nella headscript).
+
-     */
+    /** @var bool */
+    private static $superadmin = false;
+
+    /** @var array scuole di cui l'utente è membro */
+    private static $memberships = [];
+
+    /* ------------------------------------------------------------------ */
+
     public static function resolve(int $userId): array
     {
         if (self::$school !== null) {
             return self::$school;
         }
 
-        $pdo = DBHandlerSelect::getInstance()->getConnection();
+        $pdo = self::pdo();
+        self::$userId = $userId;
 
-        $schools = self::userSchools($pdo, $userId);
+        $st = $pdo->prepare("SELECT is_superadmin FROM auth_users WHERE id = ?");
+        $st->execute([$userId]);
+        self::$superadmin = ($st->fetchColumn() === 'Y');
+
+        self::$memberships = self::loadMemberships($userId);
 
         // TEMPORANEO (fase monoscuola): utente senza scuola -> agganciato a Seregno
-        if (empty($schools)) {
+        if (empty(self::$memberships) && !self::$superadmin) {
-            $stmt = $pdo->prepare(
+            $ins = $pdo->prepare(
                 "INSERT IGNORE INTO school_user (user_id, idschool, school_role)
                  VALUES (?, ?, 'student')"
             );
-            $stmt->execute([$userId, self::DEFAULT_SCHOOL]);
+            $ins->execute([$userId, self::DEFAULT_SCHOOL]);
-            $schools = self::userSchools($pdo, $userId);
+            self::$memberships = self::loadMemberships($userId);
         }
 
-        if (empty($schools)) {
+        $requested = isset($_SESSION['idschool']) ? (int) $_SESSION['idschool'] : 0;
+        $selected  = self::pick($requested);
+
+        if ($selected === null) {
             http_response_code(403);
             die('Nessuna scuola attiva associata a questo account.');
         }
 
-        // Scuola richiesta in sessione: accettata solo se l'utente ne fa parte
-        $requested = isset($_SESSION['idschool']) ? (int) $_SESSION['idschool'] : 0;
-
-        $selected = $schools[0];
-        foreach ($schools as $row) {
-            if ((int) $row['idschool'] === $requested) {
-                $selected = $row;
-                break;
-            }
-        }
-
         $selected['idschool'] = (int) $selected['idschool'];
         $_SESSION['idschool'] = $selected['idschool'];
 
@@ -69,16 +77,55 @@ class SchoolContext
         return self::$school;
     }
 
-    /** ID della scuola corrente */
+    /**
-    public static function id(): int
+     * Cambia scuola corrente. Ritorna false se l'utente non può accedervi.
+     */
+    public static function switchTo(int $idschool): bool
     {
-        if (self::$school === null) {
+        if ($idschool <= 0) {
-            throw new RuntimeException('SchoolContext::resolve() non ancora chiamato');
+            return false;
         }
-        return self::$school['idschool'];
+        foreach (self::available() as $s) {
+            if ((int) $s['idschool'] === $idschool) {
+                $_SESSION['idschool'] = $idschool;
+                self::$school = null;
+                self::resolve(self::$userId);
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * Scuole tra cui l'utente può scegliere (per il selettore in topbar).
+     * Superadmin: tutte le scuole. Altri: solo quelle di cui è membro.
+     */
+    public static function available(): array
+    {
+        if (!self::$superadmin) {
+            return self::$memberships;
+        }
+
+        $roles = [];
+        foreach (self::$memberships as $m) {
+            $roles[(int) $m['idschool']] = $m['school_role'];
+        }
+
+        $all = self::pdo()->query("SELECT * FROM schools ORDER BY name")->fetchAll();
+        foreach ($all as &$s) {
+            $s['school_role'] = $roles[(int) $s['idschool']] ?? 'superadmin';
+        }
+        unset($s);
+        return $all;
+    }
+
+    /* --------------------------- getter -------------------------------- */
+
+    public static function id(): int
+    {
+        return self::get()['idschool'];
     }
 
-    /** Dati completi della scuola corrente */
     public static function get(): array
     {
         if (self::$school === null) {
@@ -87,25 +134,107 @@ class SchoolContext
         return self::$school;
     }
 
-    /** Ruolo dell'utente nella scuola corrente: student|teacher|admin|owner */
+    /** owner | admin | teacher | student | superadmin */
     public static function role(): string
     {
         return self::get()['school_role'];
     }
 
-    /** Scuole attive a cui l'utente è iscritto */
+    public static function isSuperadmin(): bool
-    private static function userSchools(PDO $pdo, int $userId): array
     {
-        $stmt = $pdo->prepare(
+        return self::$superadmin;
+    }
+
+    public static function isOwner(): bool
+    {
+        return self::role() === 'owner';
+    }
+
+    /** Può gestire la scuola: owner, admin o superadmin */
+    public static function isSchoolAdmin(): bool
+    {
+        return self::$superadmin || in_array(self::role(), ['owner', 'admin'], true);
+    }
+
+    /** Staff della scuola: amministratori + insegnanti */
+    public static function isStaff(): bool
+    {
+        return self::isSchoolAdmin() || self::role() === 'teacher';
+    }
+
+    /** Blocca la pagina se l'utente non è amministratore della scuola */
+    public static function requireSchoolAdmin(): void
+    {
+        if (!self::isSchoolAdmin()) {
+            http_response_code(403);
+            die('Accesso non autorizzato.');
+        }
+    }
+
+    /** Blocca la pagina se l'utente non è superadmin */
+    public static function requireSuperadmin(): void
+    {
+        if (!self::$superadmin) {
+            http_response_code(403);
+            die('Accesso non autorizzato.');
+        }
+    }
+
+    /* --------------------------- interni ------------------------------- */
+
+    private static function pick(int $requested): ?array
+    {
+        // 1) scuola richiesta e l'utente ne è membro
+        foreach (self::$memberships as $m) {
+            if ((int) $m['idschool'] === $requested) {
+                return $m;
+            }
+        }
+
+        // 2) superadmin: può entrare in qualunque scuola esistente
+        if (self::$superadmin) {
+            $pdo = self::pdo();
+            if ($requested > 0) {
+                $st = $pdo->prepare("SELECT * FROM schools WHERE idschool = ?");
+                $st->execute([$requested]);
+                $row = $st->fetch();
+                if ($row) {
+                    $row['school_role'] = 'superadmin';
+                    return $row;
+                }
+            }
+            if (!empty(self::$memberships)) {
+                return self::$memberships[0];
+            }
+            $row = $pdo->query("SELECT * FROM schools ORDER BY idschool LIMIT 1")->fetch();
+            if ($row) {
+                $row['school_role'] = 'superadmin';
+                return $row;
+            }
+            return null;
+        }
+
+        // 3) prima scuola di cui è membro
+        return self::$memberships[0] ?? null;
+    }
+
+    private static function loadMemberships(int $userId): array
+    {
+        $st = self::pdo()->prepare(
             "SELECT s.*, su.school_role
                FROM school_user su
                JOIN schools s ON s.idschool = su.idschool
               WHERE su.user_id = ?
                 AND su.active = 'Y'
                 AND s.status <> 'suspended'
-           ORDER BY su.idschool"
+           ORDER BY s.name"
         );
-        $stmt->execute([$userId]);
+        $st->execute([$userId]);
-        return $stmt->fetchAll();
+        return $st->fetchAll();
+    }
+
+    private static function pdo(): PDO
+    {
+        return DBHandlerSelect::getInstance()->getConnection();
     }
 }

public/dayoff.php

@@ -461,7 +461,7 @@ $insertedCount = isset($_GET['n']) ? (int) $_GET['n'] : null;
                     </div>
                 </div>
                 <div class="d-flex">
-                    <?php include('include/languageselection.php'); ?>
+                    <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
                     <?php include('include/profiletopbar.php'); ?>
                 </div>
             </div>
@@ -692,8 +692,7 @@ $insertedCount = isset($_GET['n']) ? (int) $_GET['n'] : null;
             Swal.fire({
                 title: sameDay ? 'Aggiungere questo giorno?' : 'Aggiungere questo periodo?',
                 html: sameDay ?
-                    'Vuoi impostare come pausa il giorno <strong>' + labelFor(a) + '</strong>?' :
+                    'Vuoi impostare come pausa il giorno <strong>' + labelFor(a) + '</strong>?' : 'Vuoi impostare come pausa tutti i giorni da <strong>' + labelFor(a) + '</strong> a <strong>' + labelFor(b) + '</strong>?',
-                    'Vuoi impostare come pausa tutti i giorni da <strong>' + labelFor(a) + '</strong> a <strong>' + labelFor(b) + '</strong>?',
                 icon: 'question',
                 showCancelButton: true,
                 confirmButtonColor: '#1ebf73',

public/event_form.php

@@ -340,7 +340,7 @@ $pageTitle = $isEdit ? 'Modifica evento' : 'Nuovo evento';
                     </div>
                 </div>
                 <div class="d-flex">
-                    <?php include('include/languageselection.php'); ?>
+                    <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
                     <?php include('include/profiletopbar.php'); ?>
                 </div>
             </div>

public/event_locations.php

@@ -235,7 +235,7 @@ $isEdit = $editId > 0 && $edit;
                     </div>
                 </div>
                 <div class="d-flex">
-                    <?php include('include/languageselection.php'); ?>
+                    <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
                     <?php include('include/profiletopbar.php'); ?>
                 </div>
             </div>

public/event_options.php

@@ -138,7 +138,7 @@ $types = [
                     </div>
                 </div>
                 <div class="d-flex">
-                    <?php include('include/languageselection.php'); ?>
+                    <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
                     <?php include('include/profiletopbar.php'); ?>
                 </div>
             </div>

public/event_participants.php

@@ -297,7 +297,7 @@ function bookingBadge(string $status): array
                     </div>
                 </div>
                 <div class="d-flex">
-                    <?php include('include/languageselection.php'); ?>
+                    <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
                     <?php include('include/profiletopbar.php'); ?>
                 </div>
             </div>

public/event_reminder.php

@@ -124,7 +124,7 @@ $message = $_GET['message'] ?? '';
                     </div>
                 </div>
                 <div class="d-flex">
-                    <?php include('include/languageselection.php'); ?>
+                    <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
                     <?php include('include/profiletopbar.php'); ?>
                 </div>
             </div>

public/events.php

@@ -306,7 +306,7 @@ function statusBadge(string $status): array
                     </div>
                 </div>
                 <div class="d-flex">
-                    <?php include('include/languageselection.php'); ?>
+                    <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
                     <?php include('include/profiletopbar.php'); ?>
                 </div>
             </div>

public/include/headscript.php

@@ -58,6 +58,9 @@ require_once('class/SchoolContext.php');
 $schoolData = SchoolContext::resolve((int) $iduserlogin);
 $idschool   = SchoolContext::id();
 $schoolname = $schoolData['name'];
+$schoolrole = SchoolContext::role();          // owner|admin|teacher|student|superadmin
+$isschooladmin = SchoolContext::isSchoolAdmin();
+$issuperadmin  = SchoolContext::isSuperadmin();
 // ------------------------------
 if (!isset($_SESSION["tempcode"])) {
     $timestampnow = time();

public/include/options.php

@@ -147,7 +147,7 @@ $conn->close();
                     </div>
                 </div>
                 <div class="d-flex">
-                    <?php include('include/languageselection.php'); ?>
+                    <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
                     <div class="dropdown d-inline-block">
                         <button type="button" class="btn header-item noti-icon" data-bs-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                             <i class="bx bx-search icon-sm align-middle"></i>

public/include/schoolswitcher.php

@@ -0,0 +1,46 @@
+<?php
+
+/**
+ * Selettore scuola in topbar.
+ * Visibile solo se l'utente ha accesso a più di una scuola.
+ * Include: <?php include('include/schoolswitcher.php'); ?>
+ */
+$__schools = SchoolContext::available();
+
+if (count($__schools) > 1) :
+    if (empty($_SESSION['csrf_switch'])) {
+        $_SESSION['csrf_switch'] = bin2hex(random_bytes(16));
+    }
+    $__current = SchoolContext::get();
+    $__roleLabels = [
+        'owner'      => 'Titolare',
+        'admin'      => 'Admin',
+        'teacher'    => 'Insegnante',
+        'student'    => 'Allievo',
+        'superadmin' => 'Superadmin',
+    ];
+?>
+    <div class="dropdown d-inline-block">
+        <button type="button" class="btn header-item" data-bs-toggle="dropdown" aria-haspopup="true" aria-expanded="false" title="Cambia scuola">
+            <i class="bx bx-buildings font-size-20 align-middle"></i>
+            <span class="d-none d-xl-inline-block ms-1 fw-semibold"><?php echo htmlspecialchars($__current['name'], ENT_QUOTES, 'UTF-8'); ?></span>
+            <i class="bx bx-chevron-down d-none d-xl-inline-block"></i>
+        </button>
+        <div class="dropdown-menu dropdown-menu-end" style="min-width: 260px;">
+            <h6 class="dropdown-header">Le tue scuole</h6>
+            <?php foreach ($__schools as $__s) :
+                $__isCurrent = ((int) $__s['idschool'] === (int) $__current['idschool']);
+                $__role = $__roleLabels[$__s['school_role']] ?? $__s['school_role'];
+            ?>
+                <form method="post" action="switchschool.php" class="m-0">
+                    <input type="hidden" name="idschool" value="<?php echo (int) $__s['idschool']; ?>">
+                    <input type="hidden" name="token" value="<?php echo $_SESSION['csrf_switch']; ?>">
+                    <button type="submit" class="dropdown-item d-flex justify-content-between align-items-center <?php echo $__isCurrent ? 'active' : ''; ?>" <?php echo $__isCurrent ? 'disabled' : ''; ?>>
+                        <span><?php echo htmlspecialchars($__s['name'], ENT_QUOTES, 'UTF-8'); ?></span>
+                        <span class="badge rounded-pill bg-light text-dark ms-2"><?php echo htmlspecialchars($__role, ENT_QUOTES, 'UTF-8'); ?></span>
+                    </button>
+                </form>
+            <?php endforeach; ?>
+        </div>
+    </div>
+<?php endif; ?>

public/insegnanti.php

@@ -487,7 +487,7 @@ $teachers = $pdo->query("SELECT e.*,
                     </div>
                 </div>
                 <div class="d-flex">
-                    <?php include('include/languageselection.php'); ?>
+                    <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
                     <?php include('include/profiletopbar.php'); ?>
                 </div>
             </div>

public/notification.php

@@ -1,12 +1,12 @@
 <?php require_once('include/headscript.php'); ?>
 <?php // optionquery
-$optionquery = new WA_MySQLi_RS("optionquery",$bkngstm,0);
+$optionquery = new WA_MySQLi_RS("optionquery", $bkngstm, 0);
 $optionquery->setQuery("SELECT * FROM option");
 $optionquery->execute();
 ?>
 
 <?php
-        // Crea la connessione al database
+// Crea la connessione al database
 $conn = new mysqli($servername, $username, $password, $dbname);
 // Verifica se il modulo è stato inviato
 if ($_SERVER["REQUEST_METHOD"] == "POST") {
@@ -37,8 +37,8 @@ if ($_SERVER["REQUEST_METHOD"] == "POST") {
 
 
 <?php
-    $iduser=$iduserlogin;
+$iduser = $iduserlogin;
-    // Crea la connessione al database
+// Crea la connessione al database
 $conn = new mysqli($servername, $username, $password, $dbname);
 
 // Verifica la connessione
@@ -49,41 +49,40 @@ if ($conn->connect_error) {
 
 
 
-	// Ottieni i dati dal database in base all'id dell'utente
+// Ottieni i dati dal database in base all'id dell'utente
 $sqldata = "SELECT * FROM auth_users WHERE id = '$iduserlogin'";
 $resultdata = $conn->query($sqldata);
 
 if ($resultdata->num_rows > 0) {
     $rowdata = $resultdata->fetch_assoc();
-    $notificationmail=$rowdata['classnotification'];
+    $notificationmail = $rowdata['classnotification'];
     $notificationorder = $rowdata['ordernotification'];
-
 }
 
 ?>
 <!doctype html>
 <html lang="en">
 
-    <head>
+<head>
 
-        <meta charset="utf-8" />
+    <meta charset="utf-8" />
-<title>YogiBook - Prenotazioni YogaSoul</title>
+    <title>YogiBook - Prenotazioni YogaSoul</title>
-        <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-        <meta content="YogiBook - Prenotazione facile YogaSOul" name="description" />
+    <meta content="YogiBook - Prenotazione facile YogaSOul" name="description" />
-        <meta content="Advanced Creative Solutions" name="author" />
+    <meta content="Advanced Creative Solutions" name="author" />
-        <!-- App favicon -->
+    <!-- App favicon -->
-        <link rel="shortcut icon" href="assets/images/favicon.ico">
+    <link rel="shortcut icon" href="assets/images/favicon.ico">
 
-        <!-- Bootstrap Css -->
+    <!-- Bootstrap Css -->
-        <link href="assets/css/bootstrap.min.css" id="bootstrap-style" rel="stylesheet" type="text/css" />
+    <link href="assets/css/bootstrap.min.css" id="bootstrap-style" rel="stylesheet" type="text/css" />
-        <!-- Icons Css -->
+    <!-- Icons Css -->
-        <link href="assets/css/icons.min.css" rel="stylesheet" type="text/css" />
+    <link href="assets/css/icons.min.css" rel="stylesheet" type="text/css" />
-        <!-- App Css-->
+    <!-- App Css-->
-        <link href="assets/css/app.min.css" id="app-style" rel="stylesheet" type="text/css" />
+    <link href="assets/css/app.min.css" id="app-style" rel="stylesheet" type="text/css" />
-<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css">
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css">
 
-<script src="https://cdn.jsdelivr.net/npm/sweetalert2@10"></script>
+    <script src="https://cdn.jsdelivr.net/npm/sweetalert2@10"></script>
-<link rel="stylesheet" href="https://code.jquery.com/ui/1.12.1/themes/base/jquery-ui.css">
+    <link rel="stylesheet" href="https://code.jquery.com/ui/1.12.1/themes/base/jquery-ui.css">
     <script src="https://code.jquery.com/jquery-3.6.0.min.js"></script>
     <script src="https://code.jquery.com/ui/1.12.1/jquery-ui.js"></script>
 
@@ -91,252 +90,255 @@ if ($resultdata->num_rows > 0) {
 
     <script>
         $(function() {
-            $("#expiryDate").datepicker({ dateFormat: "yy-mm-dd" });
+            $("#expiryDate").datepicker({
+                dateFormat: "yy-mm-dd"
+            });
         });
     </script>
-<style>
+    <style>
-  .custom-card {
+        .custom-card {
-    margin: 10px auto;
+            margin: 10px auto;
-    display: flex;
+            display: flex;
-    width: 90%;
+            width: 90%;
-    max-width: 700px;
+            max-width: 700px;
-    background-color: white;
+            background-color: white;
-    box-shadow: 0px 2px 4px rgba(0, 0, 0, 0.1);
+            box-shadow: 0px 2px 4px rgba(0, 0, 0, 0.1);
-    border-radius: 8px;
+            border-radius: 8px;
-    overflow: hidden;
+            overflow: hidden;
-    cursor: pointer;
+            cursor: pointer;
-    transition: transform 0.2s;
+            transition: transform 0.2s;
-  }
+        }
 
-  .custom-card:hover {
+        .custom-card:hover {
-    transform: translateY(-5px);
+            transform: translateY(-5px);
-  }
+        }
 
-  .custom-date-box {
+        .custom-date-box {
-    flex: 1;
+            flex: 1;
-    background-color: red;
+            background-color: red;
-    color: white;
+            color: white;
-    display: flex;
+            display: flex;
-    flex-direction: column;
+            flex-direction: column;
-    justify-content: center;
+            justify-content: center;
-    align-items: center;
+            align-items: center;
-    padding: 0;
+            padding: 0;
-    font-size: 60px;
+            font-size: 60px;
-    font-weight: bold;
+            font-weight: bold;
-    border-top-left-radius: 8px;
+            border-top-left-radius: 8px;
-    border-bottom-left-radius: 8px;
+            border-bottom-left-radius: 8px;
-  }
+        }
 
-  .custom-day {
+        .custom-day {
-    line-height: 1;
+            line-height: 1;
-  }
+        }
 
-  .custom-month {
+        .custom-month {
-    font-size: 28px;
+            font-size: 28px;
-  }
+        }
 
-  .custom-event-details {
+        .custom-event-details {
-    flex: 2;
+            flex: 2;
-    display: flex;
+            display: flex;
-    flex-direction: column;
+            flex-direction: column;
-    padding: 10px 20px;
+            padding: 10px 20px;
-    background-color: lightblue;
+            background-color: lightblue;
-  }
+        }
 
-  .custom-heading {
+        .custom-heading {
-    margin-top: 0;
+            margin-top: 0;
-    font-size: 24px;
+            font-size: 24px;
-  }
+        }
 
-  .custom-paragraph {
+        .custom-paragraph {
-    margin-bottom: 5px;
+            margin-bottom: 5px;
-  }
+        }
 
-  .custom-actions {
+        .custom-actions {
-    display: none;
+            display: none;
-    flex-direction: row;
+            flex-direction: row;
-    justify-content: space-between;
+            justify-content: space-between;
-    margin-top: 10px;
+            margin-top: 10px;
-  }
+        }
 
-  .custom-card.expanded .custom-actions {
+        .custom-card.expanded .custom-actions {
-    display: flex;
+            display: flex;
-  }
+        }
 
-  .custom-action-button {
+        .custom-action-button {
-    background-color: #f0f0f0;
+            background-color: #f0f0f0;
-    border: none;
+            border: none;
-    padding: 8px 12px;
+            padding: 8px 12px;
-    border-radius: 4px;
+            border-radius: 4px;
-    cursor: pointer;
+            cursor: pointer;
-    transition: background-color 0.2s;
+            transition: background-color 0.2s;
-  }
+        }
 
-  .custom-action-button:hover {
+        .custom-action-button:hover {
-    background-color: #e0e0e0;
+            background-color: #e0e0e0;
-  }
+        }
 
-  @media (max-width: 768px) {
+        @media (max-width: 768px) {
-    .custom-card {
+            .custom-card {
-      flex-direction: column;
+                flex-direction: column;
-    }
+            }
 
-    .custom-date-box, .custom-event-details {
+            .custom-date-box,
-      width: 100%;
+            .custom-event-details {
-      border-radius: 0;
+                width: 100%;
-    }
+                border-radius: 0;
+            }
 
-    .custom-event-time {
+            .custom-event-time {
-      font-size: 24px;
+                font-size: 24px;
-    }
+            }
-  }
+        }
-</style>
+    </style>
-<script>
+    <script>
-    function confirmDelete(id, deletePageUrl) {
+        function confirmDelete(id, deletePageUrl) {
-  Swal.fire({
+            Swal.fire({
-    title: "Sei sicuro?",
+                title: "Sei sicuro?",
-    text: "Questa prenotazione verrà cancellata definitivamente!  Ricordati poi di riprogrammare la tua lezione!",
+                text: "Questa prenotazione verrà cancellata definitivamente!  Ricordati poi di riprogrammare la tua lezione!",
-    icon: "warning",
+                icon: "warning",
-    showCancelButton: true,
+                showCancelButton: true,
-    confirmButtonColor: "#d33",
+                confirmButtonColor: "#d33",
-    cancelButtonColor: "#3085d6",
+                cancelButtonColor: "#3085d6",
-    confirmButtonText: "Sì, cancella!",
+                confirmButtonText: "Sì, cancella!",
-    cancelButtonText: "Annulla"
+                cancelButtonText: "Annulla"
-  }).then((result) => {
+            }).then((result) => {
-   if (result.isConfirmed) {
+                if (result.isConfirmed) {
-      // Reindirizza direttamente alla pagina di cancellazione con l'ID come parametro.
+                    // Reindirizza direttamente alla pagina di cancellazione con l'ID come parametro.
-      window.location.href = `deleteclass.php?id=${id}`;
+                    window.location.href = `deleteclass.php?id=${id}`;
-    }
+                }
-  });
+            });
-}
+        }
-</script>
+    </script>
 
-    <body>
+<body>
 
     <!-- <body data-layout="horizontal"> -->
 
-        <!-- Begin page -->
+    <!-- Begin page -->
-        <div id="layout-wrapper">
+    <div id="layout-wrapper">
 
-            <!-- Top Bar -->
+        <!-- Top Bar -->
-            <header id="page-topbar" class="isvertical-topbar">
+        <header id="page-topbar" class="isvertical-topbar">
-                <div class="navbar-header">
+            <div class="navbar-header">
-                    <div class="d-flex">
+                <div class="d-flex">
-                        <!-- LOGO -->
+                    <!-- LOGO -->
-                        <?php include('include/logoarea.php'); ?>
+                    <?php include('include/logoarea.php'); ?>
 
-                        <button type="button" class="btn btn-sm px-3 font-size-24 header-item waves-effect vertical-menu-btn">
+                    <button type="button" class="btn btn-sm px-3 font-size-24 header-item waves-effect vertical-menu-btn">
-                            <i class="bx bx-menu align-middle"></i>
+                        <i class="bx bx-menu align-middle"></i>
+                    </button>
+
+                    <!-- start page title -->
+                    <div class="page-title-box align-self-center d-none d-md-block">
+                        <h4 class="page-title mb-0">Notifiche</h4>
+                    </div>
+                    <!-- end page title -->
+
+                </div>
+
+                <div class="d-flex">
+
+                    <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
+
+                    <div class="dropdown d-inline-block">
+                        <button type="button" class="btn header-item noti-icon"
+                            data-bs-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+                            <i class="bx bx-search icon-sm align-middle"></i>
                         </button>
-
+                        <div class="dropdown-menu dropdown-menu-lg dropdown-menu-end p-0">
-                        <!-- start page title -->
+                            <form class="p-2">
-                        <div class="page-title-box align-self-center d-none d-md-block">
+                                <div class="search-box">
-                            <h4 class="page-title mb-0">Notifiche</h4>
+                                    <div class="position-relative">
-                        </div>
+                                        <input type="text" class="form-control rounded bg-light border-0" placeholder="Search...">
-                        <!-- end page title -->
+                                        <i class="bx bx-search search-icon"></i>
-
-                    </div>
-
-                    <div class="d-flex">
-          
-                        <?php include('include/languageselection.php'); ?>
-
-                        <div class="dropdown d-inline-block">
-                            <button type="button" class="btn header-item noti-icon"
-                                data-bs-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
-                                <i class="bx bx-search icon-sm align-middle"></i>
-                            </button>
-                            <div class="dropdown-menu dropdown-menu-lg dropdown-menu-end p-0">
-                                <form class="p-2">
-                                    <div class="search-box">
-                                        <div class="position-relative">
-                                            <input type="text" class="form-control rounded bg-light border-0" placeholder="Search...">
-                                            <i class="bx bx-search search-icon"></i>
-                                        </div>
-                                    </div>
-                                </form>
-                            </div>
-                        </div>
-
-                        
-            
-                        <?php include('include/profiletopbar.php'); ?>
-                    </div>
-                </div>
-            </header>
-			<?php include('include/sidebar.php'); ?>
-		   
-           <header class="ishorizontal-topbar">
-                <div class="navbar-header">
-                    <div class="d-flex">
-                        
-
-                        
-
-                    </div>
-
-                   
-                </div>
-
-                <div class="topnav">
-                    <div class="container-fluid">
-                        <nav class="navbar navbar-light navbar-expand-lg topnav-menu">
-    
-                            
-                        </nav>
-                    </div>
-                </div>
-            </header>
-
-            <!-- ============================================================== -->
-            <!-- Start right Content here -->
-            <!-- ============================================================== -->
-            <div class="main-content">
-                <div class="page-content">
-                    <div class="container-fluid">
-                        
-
-
-                      <div class="row">
-                            <div class="col-xl-12">
-                                <div class="card">
-                                    <div class="card-body">
-                                    <?php if (isset($message)) { ?>
-                              <div class="alert alert-success" role="alert">
-                                           Preferenze aggiornate con successo
-                                    </div><?php } ?>
-                                <p>Di seguito puoi modificare le preferenze di notifiche del sistema prenotazione YogiBook</p>
-                                      <div class="table-responsive">
-                                      
-                   <form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
-    <div class="form-check form-switch mb-3" dir="ltr">
-        <input type="checkbox" class="form-check-input" id="emailNotifications" name="emailNotifications" value="Y" <?php echo $notificationmail === 'Y' ? 'checked' : ''; ?>>
-        <label class="form-check-label" for="emailNotifications">Notifiche prossime lezioni</label>
-        <p>Notifiche di reminder delle lezioni che hai prenotato</p>
-    </div>
-    <div class="form-check form-switch mb-3" dir="ltr">
-        <input type="checkbox" class="form-check-input" id="orderNotifications" name="orderNotifications" value="Y" <?php echo $notificationorder === 'Y' ? 'checked' : ''; ?>>
-        <label class="form-check-label" for="orderNotifications">Notifiche ordini inseriti</label>
-        <p>Notifiche di reminder degli ordini che hai effettuato</p>
-    </div>
-
-    <input type="hidden" class="form-control" name="iduser" value="<?php echo $iduserlogin; ?>">
-    <input type="hidden" class="form-control" name="kind" value="insert">
-    <input type="hidden" class="form-control" name="message" value="Y">
-    
-    <input type="submit" class="btn btn-primary w-md" name="submit" value="Aggiorna">
-</form>
-
-                                      
-
-                                      
-                                      
-                                        </div>  
-
-                                
                                     </div>
+                                </div>
+                            </form>
+                        </div>
+                    </div>
+
+
+
+                    <?php include('include/profiletopbar.php'); ?>
+                </div>
+            </div>
+        </header>
+        <?php include('include/sidebar.php'); ?>
+
+        <header class="ishorizontal-topbar">
+            <div class="navbar-header">
+                <div class="d-flex">
+
+
+
+
+                </div>
+
+
+            </div>
+
+            <div class="topnav">
+                <div class="container-fluid">
+                    <nav class="navbar navbar-light navbar-expand-lg topnav-menu">
+
+
+                    </nav>
+                </div>
+            </div>
+        </header>
+
+        <!-- ============================================================== -->
+        <!-- Start right Content here -->
+        <!-- ============================================================== -->
+        <div class="main-content">
+            <div class="page-content">
+                <div class="container-fluid">
+
+
+
+                    <div class="row">
+                        <div class="col-xl-12">
+                            <div class="card">
+                                <div class="card-body">
+                                    <?php if (isset($message)) { ?>
+                                        <div class="alert alert-success" role="alert">
+                                            Preferenze aggiornate con successo
+                                        </div><?php } ?>
+                                    <p>Di seguito puoi modificare le preferenze di notifiche del sistema prenotazione YogiBook</p>
+                                    <div class="table-responsive">
+
+                                        <form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
+                                            <div class="form-check form-switch mb-3" dir="ltr">
+                                                <input type="checkbox" class="form-check-input" id="emailNotifications" name="emailNotifications" value="Y" <?php echo $notificationmail === 'Y' ? 'checked' : ''; ?>>
+                                                <label class="form-check-label" for="emailNotifications">Notifiche prossime lezioni</label>
+                                                <p>Notifiche di reminder delle lezioni che hai prenotato</p>
+                                            </div>
+                                            <div class="form-check form-switch mb-3" dir="ltr">
+                                                <input type="checkbox" class="form-check-input" id="orderNotifications" name="orderNotifications" value="Y" <?php echo $notificationorder === 'Y' ? 'checked' : ''; ?>>
+                                                <label class="form-check-label" for="orderNotifications">Notifiche ordini inseriti</label>
+                                                <p>Notifiche di reminder degli ordini che hai effettuato</p>
+                                            </div>
+
+                                            <input type="hidden" class="form-control" name="iduser" value="<?php echo $iduserlogin; ?>">
+                                            <input type="hidden" class="form-control" name="kind" value="insert">
+                                            <input type="hidden" class="form-control" name="message" value="Y">
+
+                                            <input type="submit" class="btn btn-primary w-md" name="submit" value="Aggiorna">
+                                        </form>
+
+
+
+
+
+                                    </div>
+
+
                                 </div>
                             </div>
+                        </div>
 
 
 
@@ -374,6 +376,6 @@ if ($resultdata->num_rows > 0) {
 
         <script src="assets/js/app.js"></script>
 
-    </body>
+</body>
 
 </html>

public/options.php

@@ -147,7 +147,7 @@ $conn->close();
                     </div>
                 </div>
                 <div class="d-flex">
-                    <?php include('include/languageselection.php'); ?>
+                    <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
                     <div class="dropdown d-inline-block">
                         <button type="button" class="btn header-item noti-icon" data-bs-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                             <i class="bx bx-search icon-sm align-middle"></i>

public/optionsschool.php

@@ -112,7 +112,7 @@ $showTeacher    = ($opt['show_teacher'] ?? 'N') === 'Y';
                     </div>
                 </div>
                 <div class="d-flex">
-                    <?php include('include/languageselection.php'); ?>
+                    <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
                     <?php include('include/profiletopbar.php'); ?>
                 </div>
             </div>

public/orderbooklist.php

@@ -235,7 +235,7 @@ $services = $pdo->query("SELECT idservice, servicename, day, time FROM service O
                     </div>
                 </div>
                 <div class="d-flex">
-                    <?php include('include/languageselection.php'); ?>
+                    <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
                     <?php include('include/profiletopbar.php'); ?>
                 </div>
             </div>

public/orders.php

@@ -386,7 +386,7 @@ unset($order);
           </div>
         </div>
         <div class="d-flex">
-          <?php include('include/languageselection.php'); ?>
+          <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
           <?php include('include/profiletopbar.php'); ?>
         </div>
       </div>

public/ordersummary.php

@@ -184,7 +184,7 @@ $qParam = $q !== '' ? '&q=' . urlencode($q) : '';
                     </div>
                 </div>
                 <div class="d-flex">
-                    <?php include('include/languageselection.php'); ?>
+                    <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
                     <?php include('include/profiletopbar.php'); ?>
                 </div>
             </div>

public/pendingbookedclass.php

@@ -201,7 +201,7 @@ $fmt = function ($dt) {
           </div>
         </div>
         <div class="d-flex">
-          <?php include('include/languageselection.php'); ?>
+          <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
           <?php include('include/profiletopbar.php'); ?>
         </div>
       </div>

public/selectorder.php

@@ -231,7 +231,7 @@ $conn->close();
           </div>
         </div>
         <div class="d-flex">
-          <?php include('include/languageselection.php'); ?>
+          <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
           <?php include('include/profiletopbar.php'); ?>
         </div>
       </div>

public/situationusers.php

@@ -244,7 +244,7 @@ $users = $pdo->query($sql)->fetchAll();
                     </div>
                 </div>
                 <div class="d-flex">
-                    <?php include('include/languageselection.php'); ?>
+                    <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
                     <?php include('include/profiletopbar.php'); ?>
                 </div>
             </div>

public/statistiche.php

@@ -642,7 +642,7 @@ $periodLabel = date('d/m/Y', strtotime($from)) . ' – ' . date('d/m/Y', strtoti
                     </div>
                 </div>
                 <div class="d-flex">
-                    <?php include('include/languageselection.php'); ?>
+                    <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
                     <?php include('include/profiletopbar.php'); ?>
                 </div>
             </div>

public/switchschool.php

@@ -0,0 +1,31 @@
+<?php
+
+/**
+ * Cambio scuola corrente (owner multi-scuola / superadmin).
+ * Riceve POST: idschool, token. Reindirizza alla pagina principale
+ * della nuova scuola (non alla pagina precedente, i cui ID
+ * appartenevano alla scuola di prima).
+ */
+require_once('include/headscript.php');
+
+if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+    header('Location: adminpanel.php');
+    exit;
+}
+
+$token = $_POST['token'] ?? '';
+if (empty($_SESSION['csrf_switch']) || !hash_equals($_SESSION['csrf_switch'], $token)) {
+    http_response_code(400);
+    die('Richiesta non valida.');
+}
+
+$target = (int) ($_POST['idschool'] ?? 0);
+
+if (!SchoolContext::switchTo($target)) {
+    http_response_code(403);
+    die('Non hai accesso a questa scuola.');
+}
+
+$landing = SchoolContext::isStaff() ? 'adminpanel.php' : 'userpanel.php';
+header('Location: ' . $landing);
+exit;

public/updateservice.php

@@ -163,7 +163,7 @@ $result = $conn->query($query);
 
                 <div class="d-flex">
 
-                    <?php include('include/languageselection.php'); ?>
+                    <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
 
                     <div class="dropdown d-inline-block">
                         <button type="button" class="btn header-item noti-icon"

public/userpanel.php

@@ -537,7 +537,7 @@ $italianMonths = [
                     </div>
                 </div>
                 <div class="d-flex">
-                    <?php include('include/languageselection.php'); ?>
+                    <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
                     <?php include('include/profiletopbar.php'); ?>
                 </div>
             </div>

public/userprofile.php

@@ -286,7 +286,7 @@ $currentYear = date('Y');
                     </div>
                 </div>
                 <div class="d-flex">
-                    <?php include('include/languageselection.php'); ?>
+                    <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
                     <?php include('include/profiletopbar.php'); ?>
                 </div>
             </div>

public/userprofiledoc.php

@@ -307,7 +307,7 @@ $documents = $stmtDocs->fetchAll();
                     </div>
                 </div>
                 <div class="d-flex">
-                    <?php include('include/languageselection.php'); ?>
+                    <?php include('include/schoolswitcher.php'); ?><?php include('include/languageselection.php'); ?>
                     <?php include('include/profiletopbar.php'); ?>
                 </div>
             </div>