title: Creating deeply nested object in Prisma securely
body: <p>I am using Prisma and Nextjs with the following data structure, with authentication using Next-Auth.</p>
  <pre><code>user
  |--&gt;profile
       |--&gt;log
             |--&gt;sublog
  </code></pre>
  <p>Right now the CRUD is sent to the database via API routes on Nextjs. And I want to write to <code>sublog</code> securely via the API.</p>
  <p>So when I write this, it is open-ended:</p>
  <pre><code>const sublog = await prisma.sublog.create({
   data: {
           name: req.body.name,
           content: req.body.content,
           log: {
              connect: {
                 id: req.body.logId,
                }
            }
         }
  })
  </code></pre>
  <p>I have access to the user session from the frontend and backend in order to get the userID. But I am not sure how to make the form submission secure that only if the user who owns the <code>log</code> can they be allowed to submit a <code>sublog</code>.</p>
  <p>Any ideas on how to securely submit something securely while it is deeply nested?</p>
  <p>P.S. Note that I can turn on and off any component that edit/delete data at the frontend - but that's only on the frontend, I want to secure it on the API so that even if the client somehow is able to access a form within the <code>log</code> that doesn't belong to them, it would still push an error from the API since the client don't belong there.</p>