feat: agent token, auth.agent middleware, /mcp route with HadoServer skeleton

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BCrwHHnGCB5XH968Nxokqw

core/tests/Feature/AgentTokenCommandTest.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\AgentToken;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class AgentTokenCommandTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_issues_token_creating_user_if_needed(): void
+    {
+        $this->artisan('hado:agent:token', ['login' => 'nikita'])
+            ->expectsOutputToContain('Token: hado_agent_')
+            ->assertSuccessful();
+
+        $user = User::where('login', 'nikita')->sole();
+        $this->assertSame(64, strlen(AgentToken::where('user_id', $user->id)->sole()->token_hash));
+    }
+
+    public function test_reissue_replaces_the_old_token(): void
+    {
+        $this->artisan('hado:agent:token', ['login' => 'nikita'])->assertSuccessful();
+        $old = AgentToken::sole()->token_hash;
+
+        $this->artisan('hado:agent:token', ['login' => 'nikita'])
+            ->expectsOutputToContain('перевыпущен')
+            ->assertSuccessful();
+
+        $this->assertSame(1, AgentToken::count());
+        $this->assertNotSame($old, AgentToken::sole()->token_hash);
+    }
+
+    public function test_revoke_deletes_the_token(): void
+    {
+        $this->artisan('hado:agent:token', ['login' => 'nikita'])->assertSuccessful();
+
+        $this->artisan('hado:agent:token', ['login' => 'nikita', '--revoke' => true])->assertSuccessful();
+
+        $this->assertSame(0, AgentToken::count());
+    }
+}

core/tests/Feature/McpAuthTest.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\AgentToken;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class McpAuthTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private const INITIALIZE = [
+        'jsonrpc' => '2.0', 'id' => 1, 'method' => 'initialize',
+        'params' => ['protocolVersion' => '2025-06-18', 'capabilities' => [], 'clientInfo' => ['name' => 'test', 'version' => '0']],
+    ];
+
+    public function test_requires_agent_token(): void
+    {
+        $this->postJson('/mcp', self::INITIALIZE)->assertStatus(401)->assertJsonPath('message', 'Нужен Bearer-токен агента');
+        $this->postJson('/mcp', self::INITIALIZE, ['Authorization' => 'Bearer nope'])->assertStatus(401)->assertJsonPath('message', 'Неизвестный токен агента');
+    }
+
+    public function test_remote_user_header_is_not_enough(): void
+    {
+        $this->postJson('/mcp', self::INITIALIZE, ['X-Remote-User' => 'nikita'])->assertStatus(401);
+    }
+
+    public function test_valid_token_reaches_the_server(): void
+    {
+        $user = User::create(['login' => 'nikita', 'tz' => 'UTC']);
+        AgentToken::create(['user_id' => $user->id, 'token_hash' => hash('sha256', 'secret')]);
+
+        $this->postJson('/mcp', self::INITIALIZE, ['Authorization' => 'Bearer secret'])
+            ->assertOk()
+            ->assertJsonPath('result.serverInfo.name', 'Hado');
+    }
+}