You can owerride request.body.data as you need.
The next code adds User from the default plugin User & Permissions to the Todo entity
/**
* todo controller
*/
import { factories } from "@strapi/strapi";
export default factories.createCoreController(
"api::todo.todo",
({ strapi }) => ({
async create(ctx) {
ctx.request.body.data.user = ctx.state.user;
await super.create(ctx);
},
})
);