Espone API JSON e MCP HTTP per far lavorare gli agenti sul CRM.

Gli agenti autenticati con token Bearer possono leggere today/pipeline e annotare attività, con host MCP allineati a quelli di produzione.

Co-authored-by: Cursor <cursoragent@cursor.com>

test/controllers/api_tokens_controller_test.rb

@@ -0,0 +1,34 @@
+require "test_helper"
+
+class ApiTokensControllerTest < ActionDispatch::IntegrationTest
+  test "requires login" do
+    get api_tokens_path
+    assert_redirected_to login_path
+  end
+
+  test "user can create and revoke own token" do
+    login_as users(:marco)
+    follow_redirect! if response.redirect?
+
+    assert_difference -> { users(:marco).api_tokens.active.count }, 1 do
+      post api_tokens_path, params: { name: "Codex" }
+    end
+    assert_redirected_to api_tokens_path
+    follow_redirect!
+    assert_response :success
+    assert_match(/crm_/, response.body)
+
+    token = users(:marco).api_tokens.active.last
+    delete api_token_path(token)
+    assert_redirected_to api_tokens_path
+    assert token.reload.revoked?
+  end
+
+  test "non admin can open token page" do
+    login_as users(:marco)
+    follow_redirect! if response.redirect?
+    get api_tokens_path
+    assert_response :success
+    assert_match(/Token API/, response.body)
+  end
+end