feat(security): exclude hidden/masked columns from create and update payloads

pkg/resolvemcp/security_hooks.go

@@ -36,6 +36,21 @@ func RegisterSecurityHooks(handler *Handler, securityList *security.SecurityList
 		return nil
 	})
 
+	// BeforeHandle: preload column rules for writes before the handler opens its
+	// transaction; the write hooks below only read the cache.
+	handler.Hooks().Register(BeforeHandle, func(hookCtx *HookContext) error {
+		return security.PreloadSecurityRules(newSecurityContext(hookCtx), securityList, hookCtx.Operation)
+	})
+
+	// BeforeCreate/BeforeUpdate: drop columns hidden or masked for the user from the
+	// write payload, so they cannot be inserted or updated.
+	handler.Hooks().Register(BeforeCreate, func(hookCtx *HookContext) error {
+		return security.ApplyWriteColumnSecurity(newSecurityContext(hookCtx), securityList)
+	})
+	handler.Hooks().Register(BeforeUpdate, func(hookCtx *HookContext) error {
+		return security.ApplyWriteColumnSecurity(newSecurityContext(hookCtx), securityList)
+	})
+
 	// BeforeRead (1st): load RLS + CLS rules from the provider into SecurityList.
 	handler.Hooks().Register(BeforeRead, func(hookCtx *HookContext) error {
 		return security.LoadSecurityRules(newSecurityContext(hookCtx), securityList)
@@ -123,6 +138,14 @@ func (s *securityContext) SetQuery(query interface{}) {
 	}
 }
 
+func (s *securityContext) GetData() interface{} {
+	return s.ctx.Data
+}
+
+func (s *securityContext) SetData(data interface{}) {
+	s.ctx.Data = data
+}
+
 func (s *securityContext) GetResult() interface{} {
 	return s.ctx.Result
 }