continue scaffolding and refine the basic foundation

server/api/topics/[id]/index.get.ts

@@ -1,13 +1,26 @@
-import { and, desc, eq } from "drizzle-orm";
+import { and, asc, eq } from "drizzle-orm";
 import { messages, topics } from "~~/db/schema";
+import { protectRoute } from "~~/server/utils/auth";
 import type { Message, Topic } from '~~/types'
 
 export default defineEventHandler(async (event) => {
     await protectRoute(event);
 
     const db = useDrizzle();
+    const userId = event.context.user.id;
+    const topicId = getRouterParam(event, 'id');
 
-    const rows = await db.select().from(topics).where(and(eq(topics.userId, event.context.user.id), eq(topics.id, getRouterParam(event, 'id')!)));
+    if (!topicId) {
+        throw createError({
+            statusCode: 400,
+            statusMessage: 'Topic ID is required'
+        });
+    }
+
+    const rows = await db
+        .select()
+        .from(topics)
+        .where(and(eq(topics.userId, userId), eq(topics.id, topicId)));
 
     if (rows.length === 0) {
         throw createError({
@@ -17,7 +30,13 @@ export default defineEventHandler(async (event) => {
     }
 
     const topic = rows[0] as Topic & { messages: Message[] };
-    topic.messages = await db.select().from(messages).where(eq(messages.topicId, topic.id)).orderBy(desc(messages.createdAt));
+    
+    // Fetch messages for this topic, ordered chronologically
+    topic.messages = await db
+        .select()
+        .from(messages)
+        .where(eq(messages.topicId, topic.id))
+        .orderBy(asc(messages.createdAt));
 
     return topic;
-});
+});

server/api/topics/[id]/messages/index.post.ts

@@ -0,0 +1,29 @@
+import { eq } from "drizzle-orm";
+import { messages, topics } from "~~/db/schema";
+
+export default defineEventHandler(async (event) => {
+    await protectRoute(event);
+
+    const db = useDrizzle();
+
+    const { id } = event.context.params!;
+
+    const [topic] = await db.select().from(topics).where(eq(topics.id, id));
+    if (topic === undefined || topic.userId !== event.context.user.id) {
+        throw createError({ statusCode: 404, statusMessage: 'Topic not found' });
+    }
+
+    const { content } = await readBody(event);
+    if (!content) {
+        throw createError({ statusCode: 400, statusMessage: 'No content provided' });
+    }
+
+    const [message] = await db.insert(messages).values({
+        topicId: topic.id,
+        userId: event.context.user.id,
+        content,
+        isUser: true,
+    }).returning();
+
+    return message;
+});

server/api/topics/index.get.ts

@@ -1,11 +1,14 @@
 import { topics } from "~~/db/schema";
 import { protectRoute } from "~~/server/utils/auth";
+import { eq } from "drizzle-orm";
 
 export default defineEventHandler(async (event) => {
     await protectRoute(event);
 
     const db = useDrizzle();
+    const userId = event.context.user.id;
 
-    const rows = await db.select().from(topics);
+    // Only return topics for the authenticated user
+    const rows = await db.select().from(topics).where(eq(topics.userId, userId));
     return rows;
 });

server/api/topics/index.post.ts

@@ -1,16 +1,30 @@
-import { topics } from "~~/db/schema";
+import { topics, agents } from "~~/db/schema";
 import { protectRoute } from "~~/server/utils/auth";
+import { eq } from "drizzle-orm";
 
 export default defineEventHandler(async (event) => {
     await protectRoute(event);
 
     const db = useDrizzle();
+    const userId = event.context.user.id;
 
     const body = await readBody(event);
     const { agentId, name } = body;
+    
     if (!agentId || !name) {
         throw createError({ statusCode: 400, statusMessage: 'Missing required fields' });
     }
-    const [inserted] = await db.insert(topics).values({ userId: event.context.user.id, agentId, name }).returning();
+
+    // Verify the agent belongs to this user
+    const [agent] = await db.select().from(agents).where(eq(agents.id, agentId));
+    if (!agent || agent.userId !== userId) {
+        throw createError({ statusCode: 403, statusMessage: 'Agent not found or unauthorized' });
+    }
+
+    const [inserted] = await db
+        .insert(topics)
+        .values({ userId, agentId, name })
+        .returning();
+    
     return inserted;
 });