Vibe Coding: Using AI Tools and Agents in Python Development

TRADITIONAL                                              PURE VIBE
CODING                                                   CODING
  |--------------------------------------------------------|
  |                                                        |
  Write every   Use AI for     Use AI for    Use AI for   Let AI write
  line by hand  autocomplete   boilerplate   full drafts  everything
                               and snippets  you review

Your prompt + code context
         │
         ▼
  ┌──────────────────────────────────┐
  │        Large Language Model      │
  │   (trained on huge amounts of    │
  │    code from GitHub, docs,       │
  │    Stack Overflow, papers...)    │
  └──────────────────────────────────┘
         │
         ▼
   Generated tokens  →  code output

make a login api

You are a senior Python developer. I'm building a FastAPI application.

Create a POST /auth/login endpoint that:
- Accepts email and password in the request body (use Pydantic v2 BaseModel)
- Queries a SQLAlchemy User model (assume it has id, email, hashed_password fields)
- Verifies the password using passlib bcrypt
- Returns a JWT access token (use python-jose)
- Raises HTTPException 401 if credentials are invalid
- Includes type hints and a brief docstring

Do not create the full app — just the router function and the Pydantic schemas.

# Prompt 1 (weak): "make a function to validate email"
# Typical AI output: minimal, no edge cases
def validate_email_weak(email):
    return "@" in email


# Prompt 2 (better): "Write a Python function that validates an email address
# using a regex. Return True if valid, False otherwise. Add type hints."
# Typical AI output: more careful
import re

def validate_email(email: str) -> bool:
    """Validate an email address using a regex pattern."""
    pattern = r"^[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}$"
    return bool(re.match(pattern, email))


test_emails = [
    "[email protected]",
    "not-an-email",
    "missing@domain",
    "[email protected]",
    "@nodomain.com",
]

print(f"{'email':<30} {'weak':<8} better")
print("-" * 46)
for email in test_emails:
    print(f"{email:<30} {str(validate_email_weak(email)):<8} {validate_email(email)}")

email                          weak     better
----------------------------------------------
[email protected]           True     True
not-an-email                   False    False
missing@domain                 True     False
[email protected]   True     True
@nodomain.com                  True     False

def check_password_strength(password: str) -> str:
    """
    AI-generated function. Review before trusting!
    Returns 'weak', 'medium', or 'strong' based on password rules.
    """
    score = 0

    if len(password) >= 8:
        score += 1
    if any(c.isupper() for c in password):
        score += 1
    if any(c.isdigit() for c in password):
        score += 1
    if any(c in "!@#$%^&*" for c in password):
        score += 1

    print(f"Checking password: {password}")

    if score <= 1:
        return "weak"
    elif score <= 3:
        return "medium"
    else:
        return "strong"


print("Strength:", check_password_strength("Secret1!"))
print("Strength:", check_password_strength("Ab1!"))   # only 4 characters

Checking password: Secret1!
Strength: strong
Checking password: Ab1!
Strength: medium

# Exercise 2: your code here
def check_password_strength_fixed(password: str) -> str:
    ...

# Tests (uncomment when ready):
# assert check_password_strength_fixed("Ab1!") == "weak"
# assert check_password_strength_fixed("abcdefghijkl") == "medium"
# assert check_password_strength_fixed("Correct-Horse-9") == "strong"
# print("Exercise 2 passed")

  You describe             AI generates            You review
  what you want    ──►    the scaffold     ──►    and refine
       │                                               │
       │◄──────────── iterate until correct ───────────┘

Build a FastAPI application for a simple task manager with:

- SQLite database using SQLAlchemy 2.0 (async not required)
- A Task model with: id, title, description, completed (bool), created_at
- CRUD endpoints: GET /tasks, POST /tasks, GET /tasks/{id},
  PATCH /tasks/{id}, DELETE /tasks/{id}
- Pydantic v2 request/response schemas
- Proper 404 handling when a task doesn't exist
- Keep everything in a single file for simplicity

# AI-generated + human-reviewed: Task Manager FastAPI app.
# An AI produces a scaffold like this in seconds. Your job is to
# understand every line of it.

code = '''
# main.py — AI-assisted scaffold, human-reviewed

from datetime import datetime, timezone
from typing import Optional

from fastapi import FastAPI, Depends, HTTPException
from pydantic import BaseModel, Field
from sqlalchemy import create_engine, Column, Integer, String, Boolean, DateTime
from sqlalchemy.orm import DeclarativeBase, Session, sessionmaker

# ── Database Setup ─────────────────────────────────────────────
DATABASE_URL = "sqlite:///./tasks.db"
engine = create_engine(DATABASE_URL, connect_args={"check_same_thread": False})
SessionLocal = sessionmaker(bind=engine)

class Base(DeclarativeBase):
    pass

class Task(Base):
    __tablename__ = "tasks"
    id          = Column(Integer, primary_key=True, index=True)
    title       = Column(String(200), nullable=False)
    description = Column(String(1000), default="")
    completed   = Column(Boolean, default=False)
    # Reviewed: AI used datetime.utcnow (deprecated since Python 3.12)
    created_at  = Column(DateTime, default=lambda: datetime.now(timezone.utc))

Base.metadata.create_all(bind=engine)

# ── Pydantic Schemas ───────────────────────────────────────────
class TaskCreate(BaseModel):
    title: str = Field(..., min_length=1, max_length=200)
    description: str = Field(default="", max_length=1000)

class TaskUpdate(BaseModel):
    title: Optional[str] = Field(None, min_length=1, max_length=200)
    description: Optional[str] = None
    completed: Optional[bool] = None

class TaskResponse(BaseModel):
    id: int
    title: str
    description: str
    completed: bool
    created_at: datetime

    model_config = {"from_attributes": True}  # Pydantic v2

# ── Dependency ─────────────────────────────────────────────────
def get_db():
    db = SessionLocal()
    try:
        yield db
    finally:
        db.close()

# ── App & Routes ───────────────────────────────────────────────
app = FastAPI(title="Task Manager API", version="1.0.0")

@app.get("/tasks", response_model=list[TaskResponse])
def list_tasks(db: Session = Depends(get_db)):
    """Return all tasks."""
    return db.query(Task).all()

@app.post("/tasks", response_model=TaskResponse, status_code=201)
def create_task(payload: TaskCreate, db: Session = Depends(get_db)):
    """Create a new task."""
    task = Task(**payload.model_dump())
    db.add(task)
    db.commit()
    db.refresh(task)
    return task

@app.get("/tasks/{task_id}", response_model=TaskResponse)
def get_task(task_id: int, db: Session = Depends(get_db)):
    """Fetch a single task by ID."""
    task = db.query(Task).filter(Task.id == task_id).first()
    if not task:
        raise HTTPException(status_code=404, detail="Task not found")
    return task

@app.patch("/tasks/{task_id}", response_model=TaskResponse)
def update_task(task_id: int, payload: TaskUpdate, db: Session = Depends(get_db)):
    """Partially update a task."""
    task = db.query(Task).filter(Task.id == task_id).first()
    if not task:
        raise HTTPException(status_code=404, detail="Task not found")
    for field, value in payload.model_dump(exclude_unset=True).items():
        setattr(task, field, value)
    db.commit()
    db.refresh(task)
    return task

@app.delete("/tasks/{task_id}", status_code=204)
def delete_task(task_id: int, db: Session = Depends(get_db)):
    """Delete a task."""
    task = db.query(Task).filter(Task.id == task_id).first()
    if not task:
        raise HTTPException(status_code=404, detail="Task not found")
    db.delete(task)
    db.commit()
'''

print("Task Manager API scaffold (AI-generated, human-reviewed)")
print("Character count:", len(code))
print("\nPatterns you need to understand before you can trust it:")
patterns = [
    "SQLAlchemy 2.0 DeclarativeBase (not the old declarative_base())",
    "Pydantic v2 model_config = {'from_attributes': True}",
    "Dependency injection with Depends(get_db)",
    "model_dump(exclude_unset=True) for partial updates",
    "HTTPException for consistent error responses",
    "status_code=201 for POST, 204 for DELETE",
]
for i, p in enumerate(patterns, 1):
    print(f"  {i}. {p}")

Task Manager API scaffold (AI-generated, human-reviewed)
Character count: 3500

Patterns you need to understand before you can trust it:
  1. SQLAlchemy 2.0 DeclarativeBase (not the old declarative_base())
  2. Pydantic v2 model_config = {'from_attributes': True}
  3. Dependency injection with Depends(get_db)
  4. model_dump(exclude_unset=True) for partial updates
  5. HTTPException for consistent error responses
  6. status_code=201 for POST, 204 for DELETE

Add a GET /tasks/search endpoint to the Task Manager API above.
It should accept a query parameter `q` and return tasks where
the title contains the search string (case-insensitive).
Use SQLAlchemy's ilike() for the filter.

Create Django models for a blog platform with:
- User profile (extends Django's built-in User with bio and avatar_url)
- Post model (title, content, author FK to User, published_at, is_published, slug)
- Tag model (name, slug) with ManyToMany to Post
- Comment model (post FK, author FK, body, created_at)

Use __str__ methods, Meta classes with ordering, and include
a custom manager on Post that returns only published posts.

# AI-generated Django models for a blog platform, with our review notes.

django_models_code = '''
# models.py — AI-generated, human-reviewed

from django.db import models
from django.contrib.auth.models import User
from django.utils.text import slugify
from django.utils import timezone


class UserProfile(models.Model):
    user       = models.OneToOneField(User, on_delete=models.CASCADE, related_name="profile")
    bio        = models.TextField(blank=True)
    avatar_url = models.URLField(blank=True)

    def __str__(self):
        return f"Profile of {self.user.username}"


class Tag(models.Model):
    name = models.CharField(max_length=50, unique=True)
    slug = models.SlugField(max_length=50, unique=True)

    def save(self, *args, **kwargs):
        if not self.slug:
            self.slug = slugify(self.name)
        super().save(*args, **kwargs)

    def __str__(self):
        return self.name

    class Meta:
        ordering = ["name"]


class PublishedManager(models.Manager):
    """Custom manager that returns only published posts."""
    def get_queryset(self):
        return super().get_queryset().filter(is_published=True)


class Post(models.Model):
    title        = models.CharField(max_length=300)
    slug         = models.SlugField(max_length=300, unique=True)
    content      = models.TextField()
    author       = models.ForeignKey(User, on_delete=models.CASCADE, related_name="posts")
    tags         = models.ManyToManyField(Tag, blank=True, related_name="posts")
    is_published = models.BooleanField(default=False)
    published_at = models.DateTimeField(null=True, blank=True)
    created_at   = models.DateTimeField(auto_now_add=True)
    updated_at   = models.DateTimeField(auto_now=True)

    objects   = models.Manager()        # default manager
    published = PublishedManager()      # custom manager

    def save(self, *args, **kwargs):
        if not self.slug:
            self.slug = slugify(self.title)
        if self.is_published and not self.published_at:
            self.published_at = timezone.now()
        super().save(*args, **kwargs)

    def __str__(self):
        return self.title

    class Meta:
        ordering = ["-published_at"]


class Comment(models.Model):
    post       = models.ForeignKey(Post, on_delete=models.CASCADE, related_name="comments")
    author     = models.ForeignKey(User, on_delete=models.CASCADE, related_name="comments")
    body       = models.TextField()
    created_at = models.DateTimeField(auto_now_add=True)

    def __str__(self):
        return f"Comment by {self.author.username} on {self.post.title}"

    class Meta:
        ordering = ["created_at"]
'''

print("Django models generated by AI")
print("=" * 50)

review_points = {
    "What the AI got right": [
        "Used OneToOneField (not ForeignKey) for UserProfile",
        "Custom manager correctly overrides get_queryset()",
        "auto_now_add vs auto_now used correctly",
        "ManyToManyField with blank=True (not null=True)",
        "on_delete=CASCADE on all ForeignKeys",
        "Auto-sets published_at when first published",
    ],
    "Things to discuss": [
        "Slug auto-generation: what happens with duplicate titles?",
        "No max_length on TextField fields (fine, but intentional?)",
        "No signal to auto-create UserProfile on User creation",
        "published_at ordering may show unpublished posts oddly",
    ]
}

for category, points in review_points.items():
    print(f"\n{category}:")
    for point in points:
        print(f"  - {point}")

Django models generated by AI
==================================================

What the AI got right:
  - Used OneToOneField (not ForeignKey) for UserProfile
  - Custom manager correctly overrides get_queryset()
  - auto_now_add vs auto_now used correctly
  - ManyToManyField with blank=True (not null=True)
  - on_delete=CASCADE on all ForeignKeys
  - Auto-sets published_at when first published

Things to discuss:
  - Slug auto-generation: what happens with duplicate titles?
  - No max_length on TextField fields (fine, but intentional?)
  - No signal to auto-create UserProfile on User creation
  - published_at ordering may show unpublished posts oddly

import re

def slugify(text: str) -> str:
    """Simplified version of django.utils.text.slugify."""
    text = re.sub(r"[^\w\s-]", "", text.lower()).strip()
    return re.sub(r"[-\s]+", "-", text)


# Exercise 4: your code here
def unique_slug(title: str, existing: set[str]) -> str:
    ...

# Tests (uncomment when ready):
# assert unique_slug("Hello World", set()) == "hello-world"
# assert unique_slug("Hello World", {"hello-world"}) == "hello-world-2"
# assert unique_slug("Hello World", {"hello-world", "hello-world-2"}) == "hello-world-3"
# print("Exercise 4 passed")

# Prompt: "Generate Django admin.py for the blog models above.
#          Include list_display, search_fields, list_filter,
#          prepopulated_fields for slugs, and inline for comments."

admin_code = '''
# admin.py — AI-generated in ~3 seconds

from django.contrib import admin
from .models import UserProfile, Post, Tag, Comment


@admin.register(UserProfile)
class UserProfileAdmin(admin.ModelAdmin):
    list_display = ("user", "bio")
    search_fields = ("user__username", "user__email")


@admin.register(Tag)
class TagAdmin(admin.ModelAdmin):
    list_display = ("name", "slug")
    prepopulated_fields = {"slug": ("name",)}


class CommentInline(admin.TabularInline):
    model = Comment
    extra = 0
    readonly_fields = ("author", "created_at")


@admin.register(Post)
class PostAdmin(admin.ModelAdmin):
    list_display  = ("title", "author", "is_published", "published_at", "created_at")
    list_filter   = ("is_published", "tags", "created_at")
    search_fields = ("title", "content", "author__username")
    prepopulated_fields = {"slug": ("title",)}
    filter_horizontal   = ("tags",)
    inlines = [CommentInline]
    date_hierarchy = "created_at"


@admin.register(Comment)
class CommentAdmin(admin.ModelAdmin):
    list_display  = ("author", "post", "created_at")
    search_fields = ("author__username", "body")
    list_filter   = ("created_at",)
'''

print("Django admin.py — AI-generated output")
print("-" * 50)
print("Time to generate manually: ~15-20 minutes")
print("Time with AI:              ~30 seconds")
print("\nThis is where AI saves real time: it knows the admin API well.")
print("But you still need to know what each option does to check it.")

Django admin.py — AI-generated output
--------------------------------------------------
Time to generate manually: ~15-20 minutes
Time with AI:              ~30 seconds

This is where AI saves real time: it knows the admin API well.
But you still need to know what each option does to check it.

Generate a production-ready docker-compose.yml for a Django application with:
- Django app running with gunicorn (web service)
- PostgreSQL 16 database (db service)
- Nginx as reverse proxy (nginx service)
- Redis for caching (redis service)

Requirements:
- Use named volumes for postgres data and static files
- Django reads DB config from environment variables
- Nginx serves static files directly and proxies /api/ to gunicorn
- Include a healthcheck for the database
- Use a .env file for secrets (do not hardcode passwords)

# AI-generated Docker Compose, Nginx config and Dockerfile, with review notes.

docker_compose = '''
# docker-compose.yml (AI-generated, reviewed)
# Reviewed: removed the AI's `version: "3.9"` line. Compose v2 ignores it
# and prints a warning that it is obsolete.

services:

  db:
    image: postgres:16-alpine
    volumes:
      - postgres_data:/var/lib/postgresql/data
    environment:
      POSTGRES_DB:       ${POSTGRES_DB}
      POSTGRES_USER:     ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    restart: unless-stopped

  web:
    build: .
    command: gunicorn blogplatform.wsgi:application --bind 0.0.0.0:8000 --workers 3
    volumes:
      - static_files:/app/staticfiles
    environment:
      DATABASE_URL:  postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db/${POSTGRES_DB}
      REDIS_URL:     redis://redis:6379/0
      SECRET_KEY:    ${DJANGO_SECRET_KEY}
      DEBUG:         "False"
      ALLOWED_HOSTS: ${ALLOWED_HOSTS}
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_started
    restart: unless-stopped

  nginx:
    image: nginx:1.25-alpine
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - static_files:/app/staticfiles:ro
    depends_on:
      - web
    restart: unless-stopped

volumes:
  postgres_data:
  static_files:
'''

nginx_conf = '''
# nginx/nginx.conf (AI-generated)

upstream django {
    server web:8000;
}

server {
    listen 80;
    server_name _;

    # Serve static files directly
    location /static/ {
        alias /app/staticfiles/;
        expires 30d;
        add_header Cache-Control "public, immutable";
    }

    # Proxy everything else to Django
    location / {
        proxy_pass         http://django;
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}
'''

dockerfile = '''
# Dockerfile (AI-generated multi-stage build)

FROM python:3.12-slim AS builder
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir --user -r requirements.txt

FROM python:3.12-slim
WORKDIR /app
COPY --from=builder /root/.local /root/.local
COPY . .
ENV PATH=/root/.local/bin:$PATH
RUN python manage.py collectstatic --no-input
EXPOSE 8000
'''

files = {
    "docker-compose.yml": docker_compose,
    "nginx/nginx.conf": nginx_conf,
    "Dockerfile": dockerfile,
}

print("Infrastructure files generated by AI:")
print("=" * 50)
for filename, content in files.items():
    lines = len(content.strip().splitlines())
    print(f"  {filename:<25} ({lines} lines)")

print("\nKey decisions AI made correctly:")
decisions = [
    "postgres:16-alpine (not latest — pinned version)",
    "healthcheck with condition: service_healthy (not just depends_on)",
    "Secrets via environment variables, not hardcoded",
    "Named volumes (not bind mounts) for production data",
    "Multi-stage Dockerfile (builder → final) reduces image size",
    "Host and X-Forwarded-* headers passed on, so Django sees the real host and client IP",
    "Static files served by Nginx, not gunicorn",
]
for d in decisions:
    print(f"  [ok]    {d}")

print("\nWhat AI missed (always check):")
missed = [
    "HTTPS/TLS configuration (needs certbot or cert volume)",
    "Django migration command on startup",
    "Rate limiting in Nginx",
    "Log rotation configuration",
    "Prompt asked Nginx to proxy only /api/; the config proxies everything at /",
    "collectstatic runs at build time, so settings must import without real secrets",
    "Dockerfile runs as root (no USER line) and has no CMD of its own",
]
for m in missed:
    print(f"  [check] {m}")

Infrastructure files generated by AI:
==================================================
  docker-compose.yml        (58 lines)
  nginx/nginx.conf          (26 lines)
  Dockerfile                (14 lines)

Key decisions AI made correctly:
  [ok]    postgres:16-alpine (not latest — pinned version)
  [ok]    healthcheck with condition: service_healthy (not just depends_on)
  [ok]    Secrets via environment variables, not hardcoded
  [ok]    Named volumes (not bind mounts) for production data
  [ok]    Multi-stage Dockerfile (builder → final) reduces image size
  [ok]    Host and X-Forwarded-* headers passed on, so Django sees the real host and client IP
  [ok]    Static files served by Nginx, not gunicorn

What AI missed (always check):
  [check] HTTPS/TLS configuration (needs certbot or cert volume)
  [check] Django migration command on startup
  [check] Rate limiting in Nginx
  [check] Log rotation configuration
  [check] Prompt asked Nginx to proxy only /api/; the config proxies everything at /
  [check] collectstatic runs at build time, so settings must import without real secrets
  [check] Dockerfile runs as root (no USER line) and has no CMD of its own

AUTOCOMPLETE          CHAT            AGENT
     │                 │               │
  Single line     Multi-turn       Multi-step
  suggestion      conversation     autonomous
                                   task execution
     │                 │               │
"completes       "answers your    "reads files,
  your code"      question"        writes code,
                                   runs tests,
                                   fixes errors"

       Goal: "Add pagination to the FastAPI endpoint"
              │
              ▼
    ┌─────────────────────────────┐
    │   LLM (the "brain")         │
    └─────────────────────────────┘
              │  decides to use tools:
     ┌────────┼────────┬──────────┐
     ▼        ▼        ▼          ▼
 read_file  write_    run_       search_
            file      tests      docs
     │        │        │          │
     └────────┴────────┴──────────┘
              │  results feed back
              ▼
    ┌─────────────────────────────┐
    │   LLM decides next step     │
    └─────────────────────────────┘
              │
              ▼
         Done (or loop again)

# A simple agent loop, simulated in pure Python (no AI library needed).

import json
from typing import Callable


# ── Tool definitions (functions the "agent" can call) ──────────
def read_file_tool(path: str) -> str:
    """Simulated file reader."""
    mock_files = {
        "main.py": "from fastapi import FastAPI\napp = FastAPI()\n",
        "requirements.txt": "fastapi==0.111.0\nuvicorn==0.29.0\n",
    }
    return mock_files.get(path, f"ERROR: File '{path}' not found")


def write_file_tool(path: str, content: str) -> str:
    """Simulated file writer."""
    return f"SUCCESS: Wrote {len(content)} bytes to {path}"


def run_tests_tool(test_path: str) -> str:
    """Simulated test runner."""
    # In reality, this would call subprocess.run(["pytest", test_path])
    return "PASSED: 3 tests passed in 0.42s"


# ── Agent loop (simplified) ────────────────────────────────────
TOOLS: dict[str, Callable] = {
    "read_file": read_file_tool,
    "write_file": write_file_tool,
    "run_tests": run_tests_tool,
}


def simulate_agent(goal: str, planned_steps: list[dict]) -> None:
    """
    Simulates an agent loop.
    In production, each step would be decided by the LLM
    based on the previous tool output.
    """
    print(f"AGENT GOAL: {goal}")
    print("=" * 60)

    for step_num, step in enumerate(planned_steps, 1):
        tool_name = step["tool"]
        args = step["args"]
        reason = step["reason"]

        print(f"\nStep {step_num}: [{tool_name}]")
        print(f"  Reason: {reason}")
        print(f"  Args:   {json.dumps(args)}")

        if tool_name in TOOLS:
            result = TOOLS[tool_name](**args)
            print(f"  Result: {result}")
        else:
            print(f"  Result: ERROR - unknown tool '{tool_name}'")

    print("\n" + "=" * 60)
    print("Agent finished all steps")


# Simulated agent execution plan (in reality, the LLM decides each step)
simulate_agent(
    goal="Add a health check endpoint to the FastAPI app",
    planned_steps=[
        {
            "tool": "read_file",
            "args": {"path": "main.py"},
            "reason": "Read existing code to understand current structure"
        },
        {
            "tool": "write_file",
            "args": {
                "path": "main.py",
                "content": (
                    "from fastapi import FastAPI\n"
                    "app = FastAPI()\n\n"
                    "@app.get('/health')\n"
                    "def health_check():\n"
                    "    return {'status': 'ok'}\n"
                )
            },
            "reason": "Write updated main.py with health endpoint added"
        },
        {
            "tool": "run_tests",
            "args": {"test_path": "test_main.py"},
            "reason": "Verify nothing is broken after the change"
        },
    ]
)

AGENT GOAL: Add a health check endpoint to the FastAPI app
============================================================

Step 1: [read_file]
  Reason: Read existing code to understand current structure
  Args:   {"path": "main.py"}
  Result: from fastapi import FastAPI
app = FastAPI()


Step 2: [write_file]
  Reason: Write updated main.py with health endpoint added
  Args:   {"path": "main.py", "content": "from fastapi import FastAPI\napp = FastAPI()\n\[email protected]('/health')\ndef health_check():\n    return {'status': 'ok'}\n"}
  Result: SUCCESS: Wrote 113 bytes to main.py

Step 3: [run_tests]
  Reason: Verify nothing is broken after the change
  Args:   {"test_path": "test_main.py"}
  Result: PASSED: 3 tests passed in 0.42s

============================================================
Agent finished all steps

# Exercise 6: your code here

# Spot the hallucinations: each snippet contains a typical AI mistake.

print("=" * 60)
print("HALLUCINATION EXAMPLES: spot the bug")
print("=" * 60)

# Example 1: non-existent FastAPI parameter
example_1 = '''
# AI generated this. What's wrong?
from fastapi import FastAPI
app = FastAPI()

@app.get("/items")
async def get_items(limit: int = Query(default=10, max_value=100)):
    ...  # Bug: FastAPI's Query uses `le=` not `max_value=`
         # Correct: Query(default=10, le=100)
         # (Query is also never imported.)
'''

# Example 2: invented Django ORM method
example_2 = '''
# AI generated this. What's wrong?
# "Use the .recent() manager method to get the latest 5 posts."

posts = Post.objects.recent(5)  # Bug: .recent() does not exist!
                                 # Correct: Post.objects.order_by('-created_at')[:5]
'''

# Example 3: outdated Pydantic API
example_3 = '''
# AI generated this Pydantic v2 code. What's wrong?
from pydantic import BaseModel

class User(BaseModel):
    name: str
    age: int

    @validator("age")      # Bug: @validator is the Pydantic v1 API
    def age_must_be_positive(cls, v):
        ...                # (deprecated in v2, and not imported here)
                           # Correct v2: @field_validator("age") + @classmethod
'''

# Example 4: insecure advice
example_4 = '''
# AI said: "Here's how to hash a password securely"
import hashlib

def hash_password(password: str) -> str:
    return hashlib.md5(password.encode()).hexdigest()  # WRONG!
    # MD5 is cryptographically broken.
    # Never use MD5 or SHA1 for passwords.
    # Correct: use bcrypt, argon2, or scrypt.
'''

examples = [
    ("FastAPI - wrong Query parameter name", "max_value= doesn't exist -> use le="),
    ("Django ORM - invented method", ".recent() doesn't exist -> use .order_by()"),
    ("Pydantic v2 - outdated decorator", "@validator is the v1 API -> use @field_validator"),
    ("Security - broken hash function", "MD5 is broken for passwords -> use bcrypt or argon2"),
]

print("\nHallucination Summary:")
print("-" * 60)
for i, (category, fix) in enumerate(examples, 1):
    print(f"  {i}. {category}")
    print(f"     Fix: {fix}")
    print()

============================================================
HALLUCINATION EXAMPLES: spot the bug
============================================================

Hallucination Summary:
------------------------------------------------------------
  1. FastAPI - wrong Query parameter name
     Fix: max_value= doesn't exist -> use le=

  2. Django ORM - invented method
     Fix: .recent() doesn't exist -> use .order_by()

  3. Pydantic v2 - outdated decorator
     Fix: @validator is the v1 API -> use @field_validator

  4. Security - broken hash function
     Fix: MD5 is broken for passwords -> use bcrypt or argon2

# OWASP Top 10 issues that show up in AI-generated code.

print("Common OWASP Issues in AI-Generated Python Code")
print("=" * 60)

security_issues = [
    {
        "owasp": "A01 - Broken Access Control",
        "ai_code": "@app.delete('/users/{user_id}')\ndef delete_user(user_id: int, db=Depends(get_db)):\n    # No check if current user == user_id or is admin!",
        "fix": "Always verify current_user.id == user_id or current_user.is_admin",
    },
    {
        "owasp": "A02 - Cryptographic Failures",
        "ai_code": "token = base64.b64encode(str(user.id).encode()).decode()  # NOT a token!",
        "fix": "Use a signed JWT (e.g. PyJWT) or secrets.token_urlsafe() for random tokens",
    },
    {
        "owasp": "A03 - Injection",
        "ai_code": "cursor.execute(f\"SELECT * FROM users WHERE name = '{name}'\")",
        "fix": "Use parameterized queries: cursor.execute('...WHERE name = %s', (name,))",
    },
    {
        "owasp": "A05 - Security Misconfiguration",
        "ai_code": "SECRET_KEY = 'dev-secret-key-12345'  # Hardcoded in settings.py",
        "fix": "SECRET_KEY = os.environ['DJANGO_SECRET_KEY']  # From env vars",
    },
    {
        "owasp": "A09 - Security Logging and Monitoring Failures",
        "ai_code": "print(f'Login attempt: {username} / {password}')",
        "fix": "Never log passwords. Log: 'Login attempt for user {username}'",
    },
]

for issue in security_issues:
    print(f"\n{issue['owasp']}")
    print(f"   AI Generated: {issue['ai_code'].splitlines()[0]}")
    print(f"   Fix:          {issue['fix']}")

Common OWASP Issues in AI-Generated Python Code
============================================================

A01 - Broken Access Control
   AI Generated: @app.delete('/users/{user_id}')
   Fix:          Always verify current_user.id == user_id or current_user.is_admin

A02 - Cryptographic Failures
   AI Generated: token = base64.b64encode(str(user.id).encode()).decode()  # NOT a token!
   Fix:          Use a signed JWT (e.g. PyJWT) or secrets.token_urlsafe() for random tokens

A03 - Injection
   AI Generated: cursor.execute(f"SELECT * FROM users WHERE name = '{name}'")
   Fix:          Use parameterized queries: cursor.execute('...WHERE name = %s', (name,))

A05 - Security Misconfiguration
   AI Generated: SECRET_KEY = 'dev-secret-key-12345'  # Hardcoded in settings.py
   Fix:          SECRET_KEY = os.environ['DJANGO_SECRET_KEY']  # From env vars

A09 - Security Logging and Monitoring Failures
   AI Generated: print(f'Login attempt: {username} / {password}')
   Fix:          Never log passwords. Log: 'Login attempt for user {username}'

import sqlite3

conn = sqlite3.connect(":memory:")
conn.execute("CREATE TABLE users (name TEXT, email TEXT)")
conn.executemany("INSERT INTO users VALUES (?, ?)",
                 [("alice", "[email protected]"), ("bob", "[email protected]")])

def find_user_unsafe(name: str):
    return conn.execute(f"SELECT * FROM users WHERE name = '{name}'").fetchall()

print(find_user_unsafe("alice"))
print(find_user_unsafe("x' OR '1'='1"))   # leaks every row


# Exercise 7: your code here
def find_user_safe(name: str):
    ...

# Tests (uncomment when ready):
# assert find_user_safe("alice") == [("alice", "[email protected]")]
# assert find_user_safe("x' OR '1'='1") == []
# print("Exercise 7 passed")

[('alice', '[email protected]')]
[('alice', '[email protected]'), ('bob', '[email protected]')]

         YOU define the goal
         and break it into tasks
                  │
                  ▼
         ┌────────────────┐
    ┌───►│   GENERATE     │  ← Write a clear, specific prompt
    │    └────────────────┘
    │             │
    │             ▼
    │    ┌────────────────┐
    │    │    REVIEW      │  ← Read every line. Understand it.
    │    └────────────────┘
    │             │
    │             ▼
    │    ┌────────────────┐
    │    │    REFINE      │  ← Edit, fix, improve
    │    └────────────────┘
    │             │
    │             ▼
    │    ┌────────────────┐
    └────┤     TEST       │  ← Write tests, run them
         └────────────────┘
                  │
                  ▼
               OWN IT
         (You are responsible
          for this code now)

# Simulating the debug -> prompt -> fix -> test loop with an AI assistant.

print("Debugging Workflow with AI Assistance")
print("=" * 60)

# Step 1: You encounter a bug
buggy_code = """
def calculate_discount(price: float, discount_pct: float) -> float:
    return price - (price * discount_pct)  # Bug: discount_pct is 0-100 not 0-1
"""

# Step 2: You run it and see unexpected output
def calculate_discount_buggy(price: float, discount_pct: float) -> float:
    return price - (price * discount_pct)

print("\nStep 1: Observe unexpected behaviour")
result = calculate_discount_buggy(100, 20)  # Expecting $80, passing 20%
print(f"  Price: $100, Discount: 20%")
print(f"  Expected: $80.00")
print(f"  Got:      ${result:.2f}  <- wrong: 20 was treated as 2000%")

# Step 3: Good prompt to AI (include context + error)
prompt_to_ai = '''
My Python function returns wrong results. Here's the code:

    def calculate_discount(price: float, discount_pct: float) -> float:
        return price - (price * discount_pct)

When I call calculate_discount(100, 20), I expect $80.00 (20% off).
But I get -1900.0.

What's wrong and how do I fix it?
'''

print("\nStep 2: Craft a precise prompt to AI")
print("-" * 40)
print("Good prompt includes:")
print("  - the actual code")
print("  - the inputs used")
print("  - the expected output")
print("  - the actual output received")

# Step 4: AI explains and provides fix
print("\nStep 3: AI Response (simulated)")
print("-" * 40)
print("The bug: discount_pct should be divided by 100 if passed as")
print("a percentage (0-100) rather than a fraction (0.0-1.0).")

# Step 5: Apply and verify the fix
def calculate_discount_fixed(price: float, discount_pct: float) -> float:
    """Calculate price after discount. discount_pct is 0-100 (e.g., 20 = 20%)."""
    if not (0 <= discount_pct <= 100):
        raise ValueError(f"discount_pct must be between 0 and 100, got {discount_pct}")
    return price * (1 - discount_pct / 100)

print("\nStep 4: Apply and verify the fix")
print("-" * 40)
test_cases = [
    (100.0, 20, 80.0),
    (200.0, 50, 100.0),
    (99.99, 10, 89.991),
    (0.0, 100, 0.0),
]
all_pass = True
for price, pct, expected in test_cases:
    result = calculate_discount_fixed(price, pct)
    passed = abs(result - expected) < 0.001
    status = "PASS" if passed else "FAIL"
    print(f"  {status} discount({price}, {pct}%) = ${result:.3f} (expected ${expected:.3f})")
    if not passed:
        all_pass = False

print(f"\nAll tests passed: {all_pass}")

Debugging Workflow with AI Assistance
============================================================

Step 1: Observe unexpected behaviour
  Price: $100, Discount: 20%
  Expected: $80.00
  Got:      $-1900.00  <- wrong: 20 was treated as 2000%

Step 2: Craft a precise prompt to AI
----------------------------------------
Good prompt includes:
  - the actual code
  - the inputs used
  - the expected output
  - the actual output received

Step 3: AI Response (simulated)
----------------------------------------
The bug: discount_pct should be divided by 100 if passed as
a percentage (0-100) rather than a fraction (0.0-1.0).

Step 4: Apply and verify the fix
----------------------------------------
  PASS discount(100.0, 20%) = $80.000 (expected $80.000)
  PASS discount(200.0, 50%) = $100.000 (expected $100.000)
  PASS discount(99.99, 10%) = $89.991 (expected $89.991)
  PASS discount(0.0, 100%) = $0.000 (expected $0.000)

All tests passed: True