Add basic update tool (respecting ActiveAdmin form + authorization)

[lloydwatkin]

Summary

Adds a basic update MCP tool — the first write operation — that modifies a single record while enforcing the same three rules as the ActiveAdmin UI:

1. Editable resources only — refused unless the resource exposes the :update action (resource.defined_actions). Resources registered actions :index, :show stay read-only.
2. Authorization — the update runs through the resource namespace's authorization adapter (adapter.new(config, current_user).authorized?(:update, record)), so CanCanCan/Pundit rules apply for the authenticated MCP user.
3. Permitted fields only — attributes are filtered through the resource's permit_params by driving ActiveAdmin's own permitted_params, so only fields the admin form accepts are written. Anything else is dropped (fails closed if permit params can't be resolved).

Validation failures return the record's full_messages; unknown resource / missing record / missing args return clear errors.

Usage

update(resource: "User", id: 42, attributes: { name: "New name" })

Changes

• lib/active_admin_mcp/record_updater.rb (new) — the gating + update logic
• lib/active_admin_mcp/request_handler.rb — new update tool schema + dispatch; threads current_user in via the constructor
• lib/active_admin_mcp/resource_registry.rb — find now also returns the ActiveAdmin resource config so the updater can inspect actions/authorization
• app/controllers/active_admin_mcp/mcp_controller.rb — passes current_mcp_user to the handler
• README.md — documents the tool and its rules

Tests

59 examples, 0 failures.

• New record_updater_spec.rb (8 examples) covering each gate, validation failures, permitted-field filtering, and an error-named-attribute regression
• Updated request_handler_spec.rb — tools/list now includes update, plus dispatch coverage; updated resource_registry_spec.rb for the new find contract

Note — stacked on #2

This branch is built on top of the RSpec suite from #2, so the diff currently also includes those spec-infrastructure commits. Once #2 is merged to main, this diff will reduce to just the update feature. Please merge #2 first.

Follow-up

The permit-params path is unit-tested against a controller double, not a live ActiveAdmin controller (booting a full AA dummy app is a larger lift and needs its own harness). A dummy-app-backed integration spec for permitted_params and the end-to-end update flow is a sensible follow-up before relying on this in production.

🤖 Generated with Claude Code