Build 2 — Refactor a Messy Codebase

# Build 2 — Refactor a Messy Codebase > 🎯 **Hands-on Portfolio Deliverable:** Take a legacy monolithic Python application with mixed concerns and SQL injection risks, and systematically refactor it using AI assist while preserving 100% behavioral parity. --- ## The brief Take a deliberately messy codebase (we provide one OR use your own) and refactor with AI. Maintain behavior; improve quality. Measure before/after. ## The ugly code Sample structure (or use your own): ```python # main.py — 500 lines of mixed concerns def get_user(id): conn = sqlite3.connect('app.db') c = conn.cursor() c.execute(f"SELECT * FROM users WHERE id = {id}") # SQL injection! row = c.fetchone() conn.close() if row: return {'id': row[0], 'name': row[1], 'email': row[2]} return None def create_user(name, email, password): # ...similar mess... @app.route('/api/users/ ') def user_endpoint(id): u = get_user(id) if u: return jsonify(u) return jsonify({'error': 'not found'}), 404 # ... 400 more lines like this ``` Issues: - SQL injection. - No type hints. - No tests. - Mixed concerns (DB, routing, business logic). - No structure. - Long file. ## Step 1: Establish baseline (10 min) Before touching anything: - Run the app; verify it works. - Manually test each endpoint with curl; note behavior. - Run any tests that exist. Document this baseline. Refactor must preserve it. ## Step 2: Plan the refactor (15 min) Discuss with AI: > "I have a 500-line Flask app that does X, Y, Z. It mixes DB calls, business logic, and routing in single functions. It has SQL injection. No tests. What's the refactor plan? Don't write code yet; just sketch the steps." AI suggests: 1. Add type hints + linter. 2. Add minimal tests for current behavior. 3. Extract DB layer (use SQLAlchemy properly). 4. Extract service layer. 5. Use parameterized queries (fix SQL injection). 6. Split files by domain. 7. Add validators (Pydantic). Approve the plan; adjust if needed. ## Step 3: Add tests for current behavior (20 min) CRITICAL FIRST STEP. Without tests, refactoring is gambling. > "Generate pytest tests for the current behavior of these endpoints. Don't change the code; just write tests that pass against current code. Cover all endpoints; include the buggy behavior for now (we'll fix that later, with a different test for the fix)." Tests pass = baseline locked. ## Step 4: Fix critical bugs (e.g., SQL injection) (15 min) > "Fix the SQL injection in get_user. Use parameterized queries. Same signature; same return. The existing tests should still pass." Tests verify the fix doesn't break behavior. ## Step 5: Extract DB layer (20 min) > "Extract all DB code into a UserRepository class (src/repositories/user_repository.py). Use SQLAlchemy. Keep the existing function names as wrappers if needed, OR update all callers. Tests should still pass." AI refactors; you verify tests pass. If tests fail: something behavior-changed. Investigate; don't continue. ## Step 6: Extract service layer (15 min) > "Move business logic out of routes into a UserService class. Routes call services; services call repositories. Tests should still pass." Layered architecture emerging. ## Step 7: Add validators (10 min) > "Add Pydantic schemas for user input. Use them in route signatures. Validation errors should return 422." Tests for invalid input should be added (and pass). ## Step 8: Final polish (15 min) - Type hints everywhere. - Linter passes. - Run all tests. - Update README. ## Step 9: Measure ``` Before: - Lines: 500 - Files: 1 - Cyclomatic complexity (highest): 12 - Type hint coverage: 0% - Test coverage: 0% - Linter issues: 47 After: - Lines: 600 (more files, more boilerplate, but better) - Files: 8 - Cyclomatic complexity (highest): 5 - Type hint coverage: 100% - Test coverage: 85% - Linter issues: 0 - Security issues: 0 (SQL injection fixed) ``` Use `radon` for complexity; `coverage.py` for coverage. ## Deliverables - Refactored codebase. - Tests covering all endpoints; all pass before AND after. - Metrics: before/after comparison. - A `REFACTOR.md` documenting: - The refactor plan. - Which steps used AI heavily. - Where AI got it right; where it didn't. - Total time taken. ## What you'll learn - The "tests first" refactor discipline. - AI's strength in mechanical refactors (extract function, rename). - AI's struggle with semantic refactors ('make it cleaner'). - Layered architecture patterns. - Measuring code quality improvements. ## Stretch - Add async (convert sync Flask to async FastAPI). - Add Docker. - Deploy. --- ## 📊 100-Point Evaluation Rubric | Evaluation Dimension | Weight | Target Standard (Pass ≥ 80%) | |---|:---:|---| | **1. Zero Behavioral Regressions** | 25 pts | Characterization test suite established before refactoring. All existing functionality and endpoints work seamlessly post-refactor with 100% behavioral parity. | | **2. Security & Bug Eliminatio