Code with AI Lesson 5: Best Practices and Ethics

✅ Before Using AI:
□ Is the task appropriate for AI assistance?
□ Have I removed all sensitive data?
□ Do I understand the AI's limitations?
□ Will I review and test the output?

✅ During AI Use:
□ Am I maintaining control over decisions?
□ Am I learning from the suggestions?
□ Am I documenting AI contributions?
□ Am I respecting IP rights?

✅ After AI Generation:
□ Have I reviewed for security issues?
□ Have I tested thoroughly?
□ Have I added proper attribution?
□ Have I verified compliance?

🚫 NEVER Share:
- Passwords and API keys
- Customer personal data
- Proprietary algorithms
- Internal documentation
- Security vulnerabilities

✅ SAFE to Share:
- Generic code patterns
- Public documentation
- Open-source examples
- Academic problems
- General architecture questions

# DON'T: Share actual credentials
# "Create a function that connects to database with password 'myS3cr3tP@ss'"

# DO: Use placeholders
# "Create a function that connects to database using environment variables"

import os
from dotenv import load_dotenv

def get_database_connection():
    """Securely connect to database using environment variables."""
    load_dotenv()
    
    db_config = {
        'host': os.getenv('DB_HOST', 'localhost'),
        'user': os.getenv('DB_USER'),
        'password': os.getenv('DB_PASSWORD'),
        'database': os.getenv('DB_NAME')
    }
    
    # Validate configuration
    missing = [k for k, v in db_config.items() if not v]
    if missing:
        raise ValueError(f"Missing environment variables: \{', '.join(missing)\}")
    
    return create_connection(**db_config)

# AI-generated code (needs review)
def get_user_posts(user_id, search_term):
    query = f"SELECT * FROM posts WHERE user_id = {user_id} AND title LIKE '%{search_term}%'"
    return execute_query(query)

# Security issues found:
# 1. SQL injection vulnerability
# 2. No input validation
# 3. No access control

# Secure version
def get_user_posts(user_id, search_term, requesting_user_id):
    """Safely retrieve user posts with proper validation and access control."""
    # Input validation
    if not isinstance(user_id, int) or user_id <= 0:
        raise ValueError("Invalid user ID")
    
    if not search_term or len(search_term) > 100:
        raise ValueError("Invalid search term")
    
    # Access control
    if not can_view_posts(requesting_user_id, user_id):
        raise PermissionError("Insufficient permissions")
    
    # Parameterized query (no SQL injection)
    query = """
        SELECT id, title, content, created_at 
        FROM posts 
        WHERE user_id = ? AND title LIKE ? 
        ORDER BY created_at DESC
        LIMIT 50
    """
    
    # Safe search pattern
    search_pattern = f"%{search_term}%"
    
    return execute_query(query, (user_id, search_pattern))

class AICodeReviewer:
    """Systematic review process for AI-generated code."""
    
    def __init__(self):
        self.checks = [
            self.check_syntax_and_style,
            self.check_logic_correctness,
            self.check_error_handling,
            self.check_performance,
            self.check_security,
            self.check_documentation
        ]
    
    def review_code(self, code_snippet, context):
        """Perform comprehensive code review."""
        issues = []
        suggestions = []
        
        for check in self.checks:
            result = check(code_snippet, context)
            issues.extend(result.get('issues', []))
            suggestions.extend(result.get('suggestions', []))
        
        return {
            'passed': len(issues) == 0,
            'issues': issues,
            'suggestions': suggestions,
            'score': self.calculate_score(issues, suggestions)
        }
    
    def check_syntax_and_style(self, code, context):
        """Check code follows style guidelines."""
        # Example implementation
        issues = []
        suggestions = []
        
        # Check for PEP 8 compliance (Python example)
        if 'def' in code:
            lines = code.split('\n')
            for i, line in enumerate(lines):
                if 'def ' in line and not line.strip().startswith('def '):
                    issues.append(f"Line \{i+1\}: Function definition should start at beginning of line")
                
                if len(line) > 79:
                    suggestions.append(f"Line \{i+1\}: Consider breaking long line (PEP 8)")
        
        return {'issues': issues, 'suggestions': suggestions}

# 1. Unit Tests - Test individual functions
def test_calculate_discount():
    """Test the AI-generated discount calculation."""
    assert calculate_discount(100, 0.1) == 90
    assert calculate_discount(100, 0) == 100
    assert calculate_discount(0, 0.1) == 0
    
    # Edge cases
    with pytest.raises(ValueError):
        calculate_discount(-100, 0.1)  # Negative price
    with pytest.raises(ValueError):
        calculate_discount(100, -0.1)  # Negative discount
    with pytest.raises(ValueError):
        calculate_discount(100, 1.5)   # Discount > 100%

# 2. Integration Tests - Test component interactions
def test_order_processing_flow():
    """Test complete order processing with AI-generated components."""
    # Setup
    order = create_test_order()
    
    # Execute
    validated = validate_order(order)
    priced = calculate_pricing(validated)
    result = process_payment(priced)
    
    # Verify
    assert result.status == 'completed'
    assert result.total == expected_total

# 3. Property-Based Tests - Test with random inputs
from hypothesis import given, strategies as st

@given(
    price=st.floats(min_value=0.01, max_value=10000),
    discount=st.floats(min_value=0, max_value=0.99)
)
def test_discount_properties(price, discount):
    """Test mathematical properties hold for all valid inputs."""
    result = calculate_discount(price, discount)
    
    # Properties that should always be true
            assert result >= 0  # Never negative
            assert result <= price  # Never more than original
            assert abs(result - (price * (1 - discount))) < 0.01  # Correct calculation

# Document AI assistance in your code
"""
Module: User Authentication System
Author: Your Name
Date: 2024-01-15
AI Assistance: Used Claude/GPT-4 for initial implementation
              of JWT token generation and validation
License: MIT
"""

# When using significant AI-generated portions
# ai_generated_start
def complex_algorithm_from_ai():
    """
    This function was primarily generated using AI assistance.
    Reviewed and tested by: Your Name
    Date: 2024-01-15
    """
    # Implementation here
    pass
# ai_generated_end

# GDPR-compliant AI usage example
class GDPRCompliantAIHelper:
    """Ensures GDPR compliance when using AI tools."""
    
    def prepare_data_for_ai(self, user_data):
        """Remove PII before sending to AI."""
        # Anonymize personal identifiers
        anonymized = {
            'user_id': self.generate_anonymous_id(),
            'age_group': self.categorize_age(user_data.get('age')),
            'region': self.generalize_location(user_data.get('address')),
            # Never include: name, email, phone, SSN, etc.
        }
        return anonymized
    
    def document_ai_usage(self, purpose, data_used):
        """Maintain audit trail for compliance."""
        return {
            'timestamp': datetime.now(),
            'purpose': purpose,
            'data_categories': self.classify_data(data_used),
            'ai_tool': 'Internal AI Assistant',
            'retention_period': '90 days',
            'legal_basis': 'legitimate_interest'
        }

| Regulation | Applies To | AI Restrictions | Verification Method |
|------------|------------|-----------------|-------------------|
| GDPR | User data | No PII in prompts | Automated scanning |
| HIPAA | Health data | No PHI sharing | Manual review |
| PCI DSS | Payment data | No card numbers | Pre-commit hooks |
| SOC 2 | All systems | Audit trails | Quarterly review |

# Well-structured AI-assisted project
project/
├── src/
│   ├── core/           # Core business logic
│   ├── utils/          # Utility functions
│   ├── ai_generated/   # Clearly marked AI code
│   └── tests/          # Comprehensive tests
├── docs/
│   ├── ai_usage.md     # Document AI assistance
│   └── architecture.md # System design docs
├── .ai-config          # AI tool configuration
└── README.md           # Project overview

# .ai-config example
{
    "ai_tools_used": ["GitHub Copilot", "Claude"],
    "code_review_required": true,
    "sensitive_paths": ["src/auth/", "src/payment/"],
    "ai_assisted_files": [
        {
            "path": "src/utils/validators.py",
            "ai_contribution": "60%",
            "reviewed_by": "team_lead",
            "date": "2024-01-15"
        }
    ]
}

# AI Usage Guidelines for Development Team

## Approved Tools
- GitHub Copilot (company license)
- Claude (for architecture discussions only)
- ChatGPT (for learning, not production code)

## Usage Rules
1. Never share proprietary code with external AI
2. All AI-generated code must be reviewed
3. Security-critical code requires manual writing
4. Document AI usage in commit messages

## Code Review Process
- [ ] Mark AI-generated sections
- [ ] Verify logic correctness
- [ ] Check security implications
- [ ] Ensure style consistency
- [ ] Validate test coverage

## Commit Message Format

## Professional Development

### Balancing AI Use with Skill Growth
Maintaining and developing core programming skills.

**Learning Strategy:**
1. **Understand Before Using** - Know what AI generates
2. **Challenge Yourself** - Solve problems manually first
3. **Learn from AI** - Study generated solutions
4. **Build Foundations** - Master core concepts
5. **Stay Current** - Keep up with AI developments

### 💡 Pro Tip: The 70-20-10 Rule for AI Usage
Balance your learning with this proven framework:
- **70%** - Hands-on coding without AI assistance
- **20%** - Collaborative coding with AI as a pair programmer
- **10%** - Pure AI generation for learning new patterns

This ensures you maintain core skills while leveraging AI effectively.

**Skill Development Plan:**
```python
class DeveloperGrowthTracker:
    """Track skill development alongside AI usage."""
    
    def __init__(self):
        self.skills = {
            'problem_solving': 0,
            'code_reading': 0,
            'debugging': 0,
            'system_design': 0,
            'ai_prompting': 0
\}
        self.ai_usage_log = []
    
    def log_coding_session(self, task, ai_used, self_solved):
        """Track balance between AI assistance and independent work."""
        session = {
            'date': datetime.now(),
            'task': task,
            'ai_percentage': ai_used / (ai_used + self_solved) * 100,
            'learnings': []
\}
        # Update skills based on session
        if session['ai_percentage'] < 30:
            self.skills['problem_solving'] += 2
        elif session['ai_percentage'] < 70:
            self.skills['problem_solving'] += 1
            self.skills['ai_prompting'] += 1
        else:
            self.skills['ai_prompting'] += 2
        
        self.ai_usage_log.append(session)
        
    def get_growth_report(self):
        """Generate personal development insights."""
        return {
            'skill_levels': self.skills,
            'ai_dependency': np.mean([s['ai_percentage'] for s in self.ai_usage_log]),
            'recommendation': self.get_recommendation()
\}

# .ai-workflow.yaml
development_process:
  planning:
    - Define requirements clearly
    - Break into smaller tasks
    - Identify AI-suitable portions
  
  implementation:
    - Start with manual approach
    - Use AI for boilerplate
    - Validate generated code
    - Add comprehensive tests
  
  review:
    - Security audit
    - Performance check
    - Documentation update
    - Team review if needed
  
  deployment:
    - Final security scan
    - Monitor AI-generated components
    - Document AI contributions
    - Gather metrics

tools:
  editor: "VS Code with Copilot"
  testing: "pytest with hypothesis"
  security: "bandit, safety"
  documentation: "AI-assisted but human-reviewed"

principles:
  - "AI enhances, doesn't replace"
  - "Always understand what you deploy"
  - "Security and privacy first"
  - "Continuous learning mindset"