MCP: bloquear escritura de records por accessList del usuario

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

mcp-server/tools/records/addModuleToRecord.js

@@ -3,6 +3,7 @@ import { withAuth, getSessionCredentials } from "../../auth/index.js";
 import { handleApiResponse, handleToolError, validateRequired } from "../helpers/errorHandler.js";
 import { AcaiHttpClient } from "../helpers/acaiHttpClient.js";
 import { withAuthParams } from "../helpers/authSchema.js";
+import { canAccessTable } from "../helpers/accessControl.js";
 
 export function registerAddModuleToRecordTool(server) {
     server.tool(
@@ -29,6 +30,12 @@ Response includes: sectionId, moduleId, position, totalModules`,
                 const validationError = validateRequired({ tableName, recordNum, moduleId }, ['tableName', 'recordNum', 'moduleId'], 'add_module_to_record');
                 if (validationError) return validationError;
 
+                // Check table access
+                const accessCheck = canAccessTable(tableName);
+                if (!accessCheck.allowed) {
+                    return { content: [{ type: "text", text: JSON.stringify({ success: false, error: accessCheck.error }) }], isError: true };
+                }
+
                 const sessionId = extra.sessionId;
                 const credentials = await getSessionCredentials(sessionId);
                 const payload = {