Development Methodology (DDD/TDD)

# RED: Write a failing test first
def test_user_registration():
    """
    GIVEN: Valid user information exists
    WHEN: User registers
    THEN: User is created and a welcome email is sent
    """
    user_service = UserService()
    result = user_service.register(
        email="[email protected]",
        password="SecurePass123!"
    )
 
    assert result.success is True
    assert result.user.id is not None
    assert email_service.welcome_email_sent("[email protected]") is True
 
# Run test (expected to fail - not implemented yet)
# > pytest test_user_service.py - test_user_registration FAILED
 
# ====================================
 
# GREEN: Pass the test with minimal code
class UserService:
    def register(self, email: str, password: str) -> RegistrationResult:
        user = User.create(email, password)
        user_repository.save(user)
        email_service.send_welcome(email)
        return RegistrationResult.success(user)
 
# Run test (passes)
# > pytest test_user_service.py - test_user_registration PASSED
 
# ====================================
 
# REFACTOR: Improve code quality (tests keep passing)
class UserService:
    def __init__(
        self,
        user_repo: UserRepository,
        email_service: EmailService,
        password_validator: PasswordValidator
    ):
        self.user_repo = user_repo
        self.email_service = email_service
        self.password_validator = password_validator
 
    def register(self, email: str, password: str) -> RegistrationResult:
        if not self.password_validator.validate(password):
            return RegistrationResult.failure("Invalid password")
 
        user = User.create(email, password)
        self.user_repo.save(user)
        self.email_service.send_welcome(email)
        return RegistrationResult.success(user)
 
# Run test (still passes)
# > pytest test_user_service.py - test_user_registration PASSED

Wrong approach: "Let's change all the code at once!"
  --> High risk of breaking existing functionality
  --> Hard to identify where problems occurred

Right approach: "Record current behavior with tests, then change incrementally!"
  --> Tests immediately tell you if existing functionality breaks
  --> Just rollback the last change if problems occur

## Code Analysis Report
 
- Target: src/auth/ (authentication module)
- Files: 8 Python files
- Lines of code: 1,850 lines
- Test coverage: 5%
 
## Discovered Problems
1. Duplicate authentication logic (same code repeated in 3 places)
2. Hardcoded secret key (written directly in config.py)
3. SQL Injection vulnerability (user_repository.py)
4. Insufficient tests (5%, target 85%)

class TestExistingLoginBehavior:
    """Characterization test recording the current login function behavior"""
 
    def test_valid_login_returns_token(self):
        """
        GIVEN: A registered user exists
        WHEN: Login with correct password
        THEN: Record the response returned by current implementation
        """
        user = create_test_user(
            email="[email protected]",
            password="password123"
        )
 
        result = login_service.login("[email protected]", "password123")
 
        # Record current behavior as-is (not judging right or wrong)
        assert result["status"] == "success"
        assert result["token"] is not None
        assert result["expires_in"] == 3600  # Current expiration time
 
    def test_wrong_password_returns_error(self):
        """Record current behavior for login with wrong password"""
        create_test_user(email="[email protected]", password="password123")
 
        result = login_service.login("[email protected]", "wrongpassword")
 
        assert result["status"] == "error"
        assert result["code"] == 401

# BEFORE: Code before improvement
def login(email, password):
    # SQL Injection vulnerability
    user = db.query("SELECT * FROM users WHERE email = '" + email + "'")
    if user and check_password(user.password, password):
        token = generate_token(user.id)
        return {"status": "success", "token": token}
    return {"status": "error", "code": 401}
 
# ====================================
 
# AFTER: Code after improvement (completed over 3 iterations)
def login(email: str, password: str) -> LoginResult:
    """Process user login."""
    # Iteration 1: Use parameterized query to prevent SQL Injection
    user = user_repository.find_by_email(email)
 
    if not user:
        return LoginResult.failure("Invalid credentials")
 
    # Iteration 2: Centralize authentication logic
    if not auth_service.verify_password(user, password):
        return LoginResult.failure("Invalid credentials")
 
    # Iteration 3: Separate token service
    token = token_service.generate(user.id)
    return LoginResult.success(token)

# Run TDD (when development_mode: tdd)
> /moai run SPEC-AUTH-001

# Run DDD (when development_mode: ddd)
> /moai run SPEC-AUTH-001

constitution:
  development_mode: tdd  # Use TDD methodology
 
  tdd_settings:
    test_first_required: true         # Tests must be written before implementation
    red_green_refactor: true          # Follow RED-GREEN-REFACTOR cycle
    min_coverage_per_commit: 80       # Minimum coverage per commit
    mutation_testing_enabled: false   # Mutation testing (optional)
 
  test_coverage_target: 85            # Overall coverage target

constitution:
  development_mode: ddd  # Use DDD methodology
 
  ddd_settings:
    require_existing_tests: true      # Existing tests required before refactoring
    characterization_tests: true      # Auto-generate characterization tests
    behavior_snapshots: true          # Use snapshot tests
    max_transformation_size: small    # Limit change size
    preserve_before_improve: true     # Must preserve before improving
 
  test_coverage_target: 85            # Overall coverage target

Problems:
- 2 SQL Injection vulnerabilities
- Hardcoded secret key
- Duplicate authentication logic in 3 places
- Test coverage 5%
- High code complexity

# Step 1: Create SPEC (Plan)
> /moai plan "Refactor legacy authentication system. Fix SQL Injection, move secret key to environment variables, centralize authentication logic"
 
# manager-spec creates SPEC-AUTH-REFACTOR-001

# Step 2: Run DDD (Run)
> /moai run SPEC-AUTH-REFACTOR-001
 
# manager-ddd executes ANALYZE-PRESERVE-IMPROVE cycle
# ANALYZE: Analyze code, generate list of problems
# PRESERVE: Write 156 characterization tests
# IMPROVE: Incremental improvement over 3 iterations

# Step 3: Sync documentation (Sync)
> /moai sync SPEC-AUTH-REFACTOR-001
 
# manager-docs updates API documentation, generates refactoring report