I wrestled with this same issue in a separate thread ( pcf assign output params for canvas app operations ) . Rather than using adal, I decided to push the database operations back up to PowerApps. I could say I did it because I wasn't certain the token would be available without MFA, but really... it's just because I'm lazy.
Within your Canvas app, what you need to do is define one or more Output type params, then give it the data you need to undertake your action (e.g. for an update, the GUID and attributes to update) then you call notifyOutputChanged to let the canvas app know your output is ready. Back up in your Canvas App, you just put your logic into the OnChange event on the control (which is essentially what you are calling with notifyOutputChanged). Then, your outputs should be available in <controlname>.<outputparamname> so you can do your CDS operations from up here or even in Flow.
Quick note though: a big drawback you're going to run into with this approach is the known bug @HemantG and team are working on where a canvas app caches its embedded pcf and doesn't refresh the control when you update pcf in solution. Because you will be splitting your logic across the pcf and the canvas app, you will likely need to iterate a few times and will need to delete the canvas app and recreate it every time you make a change in pcf. Definitely a big headache, but they are working on a fix and I'm sure it will be available soon.