Use query parameters wherever possible in Neo4jStore

alchemiscale/models.py

@@ -8,6 +8,7 @@
 from pydantic import BaseModel, Field, validator, root_validator
 from gufe.tokenization import GufeKey
 from re import fullmatch
+import unicodedata
 
 
 class Scope(BaseModel):
@@ -113,6 +114,7 @@
         """Return `True` if this Scope has no unspecified elements."""
         return all(self.to_tuple())
 
+class InvalidGufeKeyError(ValueError): ...
 
 class ScopedKey(BaseModel):
     """Unique identifier for GufeTokenizables in state store.
@@ -131,8 +133,32 @@
         frozen = True
 
     @validator("gufe_key")
-    def cast_gufe_key(cls, v):
-        return GufeKey(v)
+    def gufe_key_validator(cls, v):
+        v = str(v)
+
+        # GufeKey is of form <prefix>-<hex>
+        prefix, token = v.split("-")
+        if not prefix or not token:
+            raise InvalidGufeKeyError("gufe_key must be of the form '<prefix>-<hex>'")
+
+        # Normalize the input to NFC form
+
+        v_normalized = unicodedata.normalize("NFC", v)
+
+        # Ensure that there are no control characters
+        if any(unicodedata.category(c) == "Cc" for c in v_normalized):
+            raise InvalidGufeKeyError("gufe_key contains invalid control characters")
+
+        # Allowed characters: letters, numbers, underscores, hyphens
+        allowed_chars = set(
+            "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-"
+        )
+
+        if not set(v_normalized).issubset(allowed_chars):
+            raise InvalidGufeKeyError("gufe_key contains invalid characters")
+
+        # Cast to GufeKey
+        return GufeKey(v_normalized)
 
     def __repr__(self):  # pragma: no cover
         return f"<ScopedKey('{str(self)}')>"