continue scaffolding and refine the basic foundation

server/api/topics/index.post.ts

@@ -1,16 +1,30 @@
-import { topics } from "~~/db/schema";
+import { topics, agents } from "~~/db/schema";
 import { protectRoute } from "~~/server/utils/auth";
+import { eq } from "drizzle-orm";
 
 export default defineEventHandler(async (event) => {
     await protectRoute(event);
 
     const db = useDrizzle();
+    const userId = event.context.user.id;
 
     const body = await readBody(event);
     const { agentId, name } = body;
+    
     if (!agentId || !name) {
         throw createError({ statusCode: 400, statusMessage: 'Missing required fields' });
     }
-    const [inserted] = await db.insert(topics).values({ userId: event.context.user.id, agentId, name }).returning();
+
+    // Verify the agent belongs to this user
+    const [agent] = await db.select().from(agents).where(eq(agents.id, agentId));
+    if (!agent || agent.userId !== userId) {
+        throw createError({ statusCode: 403, statusMessage: 'Agent not found or unauthorized' });
+    }
+
+    const [inserted] = await db
+        .insert(topics)
+        .values({ userId, agentId, name })
+        .returning();
+    
     return inserted;
 });