MCP: bloquear escritura de records por accessList del usuario

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

mcp-server/tools/records/createUpdate.js

@@ -4,6 +4,7 @@ import { handleToolError, validateRequired, handleApiResponse } from "../helpers
 import { AcaiHttpClient } from "../helpers/acaiHttpClient.js";
 import { table } from "console";
 import { withAuthParams } from "../helpers/authSchema.js";
+import { canAccessTable } from "../helpers/accessControl.js";
 
 export function registerCreateOrUpdateRecordTool(server) {
     server.tool(
@@ -26,6 +27,12 @@ export function registerCreateOrUpdateRecordTool(server) {
                 const validationError = validateRequired({ tableName, fields }, ['tableName', 'fields'], 'create_or_update_record');
                 if (validationError) return validationError;
 
+                // Check table access
+                const accessCheck = canAccessTable(tableName);
+                if (!accessCheck.allowed) {
+                    return { content: [{ type: "text", text: JSON.stringify({ success: false, error: accessCheck.error }) }], isError: true };
+                }
+
                 // if fields is string, try to parse as JSON
                 if (typeof fields === 'string') {
                     try {