Espone API JSON e MCP HTTP per far lavorare gli agenti sul CRM.

Gli agenti autenticati con token Bearer possono leggere today/pipeline e annotare attività, con host MCP allineati a quelli di produzione.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/views/admin/show.html.erb

@@ -28,5 +28,13 @@
       <p class="mt-4 text-sm text-zinc-700 dark:text-zinc-300"><%= @mail_identities_count %> account</p>
       <div class="mt-4 text-sm font-medium">Configura SMTP →</div>
     <% end %>
+
+    <%= link_to api_tokens_path, class: "rounded-2xl border border-zinc-200 bg-white text-zinc-900 dark:border-zinc-800 dark:bg-zinc-900 dark:text-zinc-100 p-6 transition hover:border-zinc-400 dark:hover:border-zinc-500" do %>
+      <div class="text-xs font-semibold uppercase tracking-wide text-zinc-400">Agenti</div>
+      <h2 class="mt-2 text-xl font-semibold tracking-tight">Token API</h2>
+      <p class="mt-2 text-sm text-zinc-500">Autenticazione Bearer per Cursor, Claude Code e Codex. Il valore in chiaro si vede una sola volta.</p>
+      <p class="mt-4 text-sm text-zinc-700 dark:text-zinc-300"><%= @api_tokens_count %> attivi</p>
+      <div class="mt-4 text-sm font-medium">Gestisci token →</div>
+    <% end %>
   </div>
 </div>

app/views/api_tokens/index.html.erb

@@ -0,0 +1,53 @@
+<div class="space-y-6">
+  <div>
+    <h1 class="text-2xl font-semibold tracking-tight">Token API</h1>
+    <p class="mt-1 text-sm text-zinc-500">
+      Servono agli agenti (Cursor, Claude Code, Codex) per lavorare sul CRM. Il valore in chiaro si vede una sola volta.
+    </p>
+  </div>
+
+  <% if @revealed_token.present? %>
+    <div class="rounded-xl border border-amber-300 bg-amber-50 p-5 text-amber-950 dark:border-amber-700 dark:bg-amber-950 dark:text-amber-100">
+      <p class="text-sm font-semibold">Nuovo token — copialo ora</p>
+      <p class="mt-1 text-xs">Non verrà più mostrato. Incollalo in <code>CRM_API_TOKEN</code> nella config MCP.</p>
+      <pre class="mt-3 overflow-x-auto rounded-lg bg-white px-3 py-2 text-sm text-zinc-900 dark:bg-zinc-900 dark:text-zinc-100"><%= @revealed_token %></pre>
+    </div>
+  <% end %>
+
+  <section class="<%= card_class %> p-5">
+    <h2 class="text-lg font-semibold tracking-tight">Nuovo token</h2>
+    <%= form_with url: api_tokens_path, method: :post, class: "mt-4 flex flex-col gap-3 sm:flex-row sm:items-end" do %>
+      <div class="flex-1">
+        <label class="mb-1 block text-xs font-medium text-zinc-500" for="name">Nome</label>
+        <%= text_field_tag :name, nil, placeholder: "es. Cursor sul portatile", required: true, class: input_class %>
+      </div>
+      <%= submit_tag "Crea token", class: "#{btn_primary} sm:mb-0" %>
+    <% end %>
+  </section>
+
+  <section class="<%= card_class %>">
+    <% if @api_tokens.empty? %>
+      <p class="p-5 text-sm text-zinc-500">Nessun token attivo.</p>
+    <% else %>
+      <ul class="divide-y divide-zinc-100 dark:divide-zinc-800">
+        <% @api_tokens.each do |token| %>
+          <li class="flex flex-wrap items-center justify-between gap-3 p-4">
+            <div>
+              <div class="font-medium"><%= token.name %></div>
+              <div class="mt-0.5 text-xs text-zinc-500">
+                <%= token.masked %>
+                · creato <%= format_dt(token.created_at) %>
+                <% if token.last_used_at %>
+                  · usato <%= format_dt(token.last_used_at) %>
+                <% else %>
+                  · mai usato
+                <% end %>
+              </div>
+            </div>
+            <%= button_to "Revoca", api_token_path(token), method: :delete, class: "#{btn_danger} text-sm", data: { turbo_confirm: "Revocare questo token?" } %>
+          </li>
+        <% end %>
+      </ul>
+    <% end %>
+  </section>
+</div>

app/views/settings/show.html.erb

@@ -66,6 +66,7 @@
       <% end %>
       <li><%= link_to "Email e campagne", dashboard_mailings_path, class: "hover:underline" %></li>
       <li><%= link_to "Import CSV organizzazioni", new_import_path, class: "hover:underline" %></li>
+      <li><%= link_to "Token API (agenti)", api_tokens_path, class: "hover:underline" %></li>
       <li><%= link_to "Cambio password", edit_password_path, class: "hover:underline" %></li>
     </ul>
   </section>

app/views/shared/_user_menu.html.erb

@@ -9,6 +9,7 @@
       <%= link_to "Impostazioni", admin_path, class: "block px-4 py-2.5 text-sm text-zinc-700 hover:bg-zinc-50 dark:text-zinc-200 dark:hover:bg-zinc-800" %>
       <%= link_to "Utenti", users_path, class: "block px-4 py-2.5 text-sm text-zinc-700 hover:bg-zinc-50 dark:text-zinc-200 dark:hover:bg-zinc-800" %>
     <% end %>
+    <%= link_to "Token API", api_tokens_path, class: "block px-4 py-2.5 text-sm text-zinc-700 hover:bg-zinc-50 dark:text-zinc-200 dark:hover:bg-zinc-800" %>
     <%= link_to "Password", edit_password_path, class: "block px-4 py-2.5 text-sm text-zinc-700 hover:bg-zinc-50 dark:text-zinc-200 dark:hover:bg-zinc-800" %>
     <%= button_to "Esci", logout_path, method: :delete, class: "block w-full px-4 py-2.5 text-left text-sm text-zinc-700 hover:bg-zinc-50 dark:text-zinc-200 dark:hover:bg-zinc-800" %>
   </div>