Fix create_session API endpoint and perform housekeeping on murfey.server.api.session_info

[tieneupin]

NOTE: This PR will need to be deployed alongside DiamondLightSource/murfey-frontend#88

The create_session FastAPI endpoint previously parsed the visit (e.g. 'cm12345-6') and name (an optional long-form description) directly from the URL path. This is unsafe, as the presence of characters such as '/' in the parametrers will break the URL construction logic.

This PR fixes that by passing the visit and name as part of the JSON data payload instead. The API endpoint path was also changed now that visit and name are no longer needed as URL path parts.

As we insert these items using SQLModel, the package will parametrize these strings before insertion, so that is a safe process, However, some sanitisation was nonetheless applied. For the visit, only alphanumerics, hyphens, and underscores will be retained. For the description, the character allow list is expanded to also include:

• spaces
• forward slashes
• round/square brackets
• periods
• commas
• ampersands
• pluses
• single/double quotes

As part of housekeeping, the way in which the Murfey database tables were imported and called was also standardised. Instead of importing the tables directly, we use import murfey.util.db as MurfeyDB and called tables from MurfeyDB. Type hints were also replaced with more modern variants.

A bug was also identified when seeding the database fixtures upon startup. For integer primary keys, if a value is manually provided as part of the initial insert, it does not update PostGreSQL's internal counter. Subsequent inserts where the primary key is allow to auto-increment will then attempt to insert into that database with the previous primary key, causing the insert to fail. By removing the primary key from the initial insert in the database fixture, the internal PostgreSQL counter is now updated correctly.

[codecov]

Codecov Report

❌ Patch coverage is 77.41935% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 55.43%. Comparing base (5d50503) to head (df3353f).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #906      +/-   ##
==========================================
+ Coverage   55.35%   55.43%   +0.07%     
==========================================
  Files         103      103              
  Lines       11632    11636       +4     
  Branches     1546     1546              
==========================================
+ Hits         6439     6450      +11     
+ Misses       4844     4837       -7     
  Partials      349      349              

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[stephen-riggs]

name definitely needs sanitising - I'd suggest stripping out anything except standard alphanumeric and _ or -

[tieneupin]

Ok, I've tacked on the sanitise() function to both of them.

[tieneupin]

We've applied sanitisation, albeit slightly milder. Besides alphanumerics, hyphens, and underscores, the character allow list is expanded to also include:

• spaces
• forward slashes
• round/square brackets
• periods
• commas
• ampersands
• pluses
• single/double quotes

Because we're not writing an SQL statement directly, but rather inserting it using the sqlalchemy and sqlmodel functions, the insert will be safe.

[stephen-riggs]

probably also worth sanitising the visit in the same way

[tieneupin]

We've decided to sanitise the visit thoroughly, so that only alphanumerics, underscores, and hyphens are retained.