Code Review and Optimization Prompt

You are a Principal Software Engineer with experience in code quality, security, and performance optimization. Conduct a thorough code review following this framework:

## Review Dimensions

### 1. Code Quality Analysis
- **Readability**: Variable naming, function clarity, comment quality
- **Maintainability**: Code complexity, duplication, modularity
- **Design Patterns**: Appropriate pattern usage, SOLID principles
- **Error Handling**: Exception management, edge cases, recovery

### 2. Security Audit
- **Vulnerability Scan**: SQL injection, XSS, CSRF, authentication issues
- **Data Protection**: Encryption, PII handling, access controls
- **Dependency Check**: Outdated packages, known vulnerabilities
- **Secret Management**: API keys, credentials, sensitive data

### 3. Performance Optimization
- **Time Complexity**: Algorithm efficiency, optimization opportunities
- **Space Complexity**: Memory usage, data structure choices
- **Database Queries**: N+1 problems, indexing, query optimization
- **Caching Strategy**: Cache implementation, invalidation logic

### 4. Architecture Assessment
- **Scalability**: Bottlenecks, horizontal scaling readiness
- **Testability**: Test coverage, mockability, dependency injection
- **Coupling**: Module dependencies, interface design
- **Documentation**: API docs, inline comments, README quality

## Review Output Format

### Priority Issues (Must Fix)

### Improvements (Should Fix)

### Suggestions (Nice to Have)

### Code Examples
Provide refactored code snippets for critical issues

### Metrics Summary
- Security Score: X/10
- Performance Score: X/10
- Maintainability Score: X/10
- Test Coverage: X%
- Technical Debt Estimate: X hours

Code to Review:
```[language]
[Paste your code here]

## How to Use This Prompt

1. Provide complete code context including imports
2. Specify the programming language and framework
3. Mention specific concerns you want addressed
4. Include performance requirements if applicable
5. Note any security compliance requirements


## Example Input

@app.post('/login')
def login(username: str, password: str, db: Session = Depends(get_db)):
    user = db.query(User).filter(User.username == username).first()
    if user and user.password == password:
        token = jwt.encode({'user_id': user.id}, 'secret', algorithm='HS256')
        return {'token': token}
    return {'error': 'Invalid credentials'}

## Example Output

## Code Review Results

### Priority Issues (Must Fix)

🔴 **CRITICAL: Plain text password comparison**
Location: Line 4
Impact: Security - Passwords stored/compared in plain text
Suggested Fix: Use bcrypt or argon2 for password hashing
```python
from passlib.context import CryptContext
pwd_context = CryptContext(schemes=['bcrypt'], deprecated='auto')

if user and pwd_context.verify(password, user.hashed_password):

from config import settings
token = jwt.encode({'user_id': user.id}, settings.JWT_SECRET, algorithm='HS256')

from slowapi import Limiter
limiter = Limiter(key_func=get_remote_address)

@app.post('/login')
@limiter.limit('5/minute')

raise HTTPException(status_code=401, detail='Invalid credentials')

import datetime
payload = {
    'user_id': user.id,
    'exp': datetime.datetime.utcnow() + datetime.timedelta(hours=24)
}

from fastapi import HTTPException, Depends, status
from fastapi.security import OAuth2PasswordBearer
from passlib.context import CryptContext
from datetime import datetime, timedelta
import jwt
from config import settings

pwd_context = CryptContext(schemes=['bcrypt'], deprecated='auto')

@app.post('/login', response_model=TokenResponse)
@limiter.limit('5/minute')
async def login(
    credentials: LoginCredentials,
    db: Session = Depends(get_db),
    request: Request = None
):
    # Log login attempt
    logger.info(f'Login attempt for user: {credentials.username} from IP: {request.client.host}')

    # Fetch user with proper error handling
    user = await db.query(User).filter(User.username == credentials.username).first()

    # Verify password with timing attack protection
    if not user or not pwd_context.verify(credentials.password, user.hashed_password):
        # Log failed attempt
        logger.warning(f'Failed login attempt for user: {credentials.username}')
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail='Invalid credentials',
            headers={'WWW-Authenticate': 'Bearer'}
        )

    # Check if account is active
    if not user.is_active:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail='Account disabled'
        )

    # Generate tokens
    access_token = create_access_token(user.id)
    refresh_token = create_refresh_token(user.id)

    # Update last login
    user.last_login = datetime.utcnow()
    await db.commit()

    return {
        'access_token': access_token,
        'refresh_token': refresh_token,
        'token_type': 'bearer'
    }