I need to modernize this legacy authentication system. Here's the current implementation:

[Share complete auth module, database schema, and related middleware]

Current Issues:
- Uses deprecated password hashing (MD5)
- No rate limiting or brute force protection
- Hardcoded session timeout values
- Poor error handling and logging
- No support for modern authentication flows

Goals:
- Implement secure password hashing (bcrypt/Argon2)
- Add rate limiting and account lockout
- Configurable session management
- Comprehensive audit logging
- Prepare for OAuth2/OpenID Connect integration

Constraints:
- Must maintain backward compatibility for existing users
- Cannot change database schema drastically
- Deployment window limited to 2-hour maintenance window
- Must work with existing session middleware

Please provide a step-by-step modernization plan with risk assessment.

# Legacy authentication - security vulnerabilities
import hashlib
import time

def authenticate_user(username, password):
    user = db.get_user(username)
    if user:
        password_hash = hashlib.md5(password.encode()).hexdigest()
        if user.password == password_hash:
            session_id = generate_session()
            sessions[session_id] = {'user_id': user.id, 'created': time.time()}
            return session_id
    return None

def generate_session():
    return hashlib.md5(str(time.time()).encode()).hexdigest()

# Modernized authentication - secure and configurable
import bcrypt
import secrets
from datetime import datetime, timedelta
from typing import Optional
import logging

class AuthenticationService:
    def __init__(self, config):
        self.config = config
        self.logger = logging.getLogger(__name__)
        self.rate_limiter = RateLimiter(config.rate_limit_settings)

    def authenticate_user(self, username: str, password: str, 
                         client_ip: str) -> Optional[str]:
        """
        Authenticate user with modern security practices.

        Args:
            username: User's login name
            password: Plain text password
            client_ip: Client IP for rate limiting

        Returns:
            Session token if authentication successful, None otherwise
        """
        # Rate limiting check
        if not self.rate_limiter.check_attempt(username, client_ip):
            self.logger.warning(
                f"Rate limit exceeded for user {username} from {client_ip}"
            )
            return None

        try:
            user = self.user_repository.get_user_by_username(username)
            if not user or not self._verify_password(password, user.password_hash):
                self.rate_limiter.record_failed_attempt(username, client_ip)
                self.logger.warning(
                    f"Authentication failed for user {username} from {client_ip}"
                )
                return None

            # Check account status
            if user.is_locked or not user.is_active:
                self.logger.warning(
                    f"Authentication attempt for inactive/locked user {username}"
                )
                return None

            # Generate secure session
            session_token = self._generate_session_token()
            session_data = {
                'user_id': user.id,
                'username': username,
                'created_at': datetime.utcnow(),
                'expires_at': datetime.utcnow() + timedelta(
                    seconds=self.config.session_timeout
                ),
                'client_ip': client_ip
            }

            self.session_store.create_session(session_token, session_data)

            # Reset rate limiting on successful auth
            self.rate_limiter.reset_attempts(username, client_ip)

            self.logger.info(f"Successful authentication for user {username}")
            return session_token

        except Exception as e:
            self.logger.error(f"Authentication error: {str(e)}")
            return None

    def _verify_password(self, password: str, password_hash: str) -> bool:
        """Verify password using bcrypt."""
        try:
            return bcrypt.checkpw(password.encode('utf-8'), password_hash.encode('utf-8'))
        except Exception:
            return False

    def _generate_session_token(self) -> str:
        """Generate cryptographically secure session token."""
        return secrets.token_urlsafe(32)

# Legacy code with performance issues
def get_user_posts_with_comments(user_id):
    user = User.objects.get(id=user_id)
    posts = Post.objects.filter(user=user)

    result = []
    for post in posts:
        comments = Comment.objects.filter(post=post)  # N+1 query problem
        post_data = {
            'title': post.title,
            'content': post.content,
            'comment_count': len(comments),
            'recent_comments': [c.content for c in comments[:3]]
        }
        result.append(post_data)
    return result

# Optimized version with proper query planning
from django.db import models
from django.db.models import Prefetch, Count

def get_user_posts_with_comments(user_id):
    """
    Get user posts with comments using optimized queries.
    Reduces database queries from N+1 to 2 queries total.
    """
    recent_comments_prefetch = Prefetch(
        'comments',
        queryset=Comment.objects.select_related('author').order_by('-created_at')[:3],
        to_attr='recent_comments_list'
    )

    posts = (Post.objects
             .filter(user_id=user_id)
             .select_related('user')
             .prefetch_related(recent_comments_prefetch)
             .annotate(comment_count=Count('comments'))
             .order_by('-created_at'))

    result = []
    for post in posts:
        post_data = {
            'title': post.title,
            'content': post.content,
            'comment_count': post.comment_count,
            'recent_comments': [c.content for c in post.recent_comments_list]
        }
        result.append(post_data)

    return result

# Vulnerable to SQL injection
def search_users(search_term):
    query = f"SELECT * FROM users WHERE name LIKE '%{search_term}%'"
    return db.execute(query)

def get_user_posts(user_id, category):
    query = f"""
        SELECT p.* FROM posts p 
        WHERE p.user_id = {user_id} 
        AND p.category = '{category}'
    """
    return db.execute(query)

# Secure implementation with parameterized queries
from typing import List, Dict, Any
import logging

class UserRepository:
    def __init__(self, db_connection):
        self.db = db_connection
        self.logger = logging.getLogger(__name__)

    def search_users(self, search_term: str) -> List[Dict[str, Any]]:
        """
        Search users by name with SQL injection protection.

        Args:
            search_term: Search string (user input)

        Returns:
            List of user records matching search criteria
        """
        # Input validation
        if not search_term or len(search_term.strip()) < 2:
            return []

        # Sanitize input - remove potentially dangerous characters
        sanitized_term = search_term.strip()[:100]  # Limit length

        query = """
            SELECT id, username, email, first_name, last_name, created_at
            FROM users 
            WHERE (first_name ILIKE %s OR last_name ILIKE %s OR username ILIKE %s)
            AND is_active = true
            ORDER BY username
            LIMIT 50
        """

        search_pattern = f"%{sanitized_term}%"

        try:
            result = self.db.execute(query, (search_pattern, search_pattern, search_pattern))
            self.logger.info(f"User search completed for term: {search_term}")
            return result.fetchall()
        except Exception as e:
            self.logger.error(f"User search failed: {str(e)}")
            return []

    def get_user_posts(self, user_id: int, category: str) -> List[Dict[str, Any]]:
        """
        Get user posts by category with proper validation.

        Args:
            user_id: Numeric user ID
            category: Post category (validated against allowed values)

        Returns:
            List of post records
        """
        # Validate user_id is actually an integer
        if not isinstance(user_id, int) or user_id <= 0:
            raise ValueError("Invalid user ID")

        # Validate category against allowed values
        allowed_categories = {'tech', 'business', 'personal', 'public'}
        if category not in allowed_categories:
            raise ValueError(f"Invalid category. Allowed: {allowed_categories}")

        query = """
            SELECT p.id, p.title, p.content, p.created_at, p.updated_at
            FROM posts p
            JOIN users u ON p.user_id = u.id
            WHERE p.user_id = %s 
            AND p.category = %s
            AND p.is_published = true
            AND u.is_active = true
            ORDER BY p.created_at DESC
            LIMIT 100
        """

        try:
            result = self.db.execute(query, (user_id, category))
            return result.fetchall()
        except Exception as e:
            self.logger.error(f"Failed to get user posts: {str(e)}")
            raise

# Before: Inconsistent error handling
def process_payment(amount, card_token):
    try:
        result = payment_gateway.charge(amount, card_token)
        return result
    except:
        return None

def send_notification(user_id, message):
    try:
        user = get_user(user_id)
        email_service.send(user.email, message)
    except Exception as e:
        print(f"Error: {e}")

# After: Standardized error handling with Claude
class PaymentError(Exception):
    """Custom exception for payment-related errors."""
    pass

class NotificationError(Exception):
    """Custom exception for notification-related errors."""
    pass

import logging
from typing import Optional, Dict, Any

logger = logging.getLogger(__name__)

def process_payment(amount: float, card_token: str) -> Dict[str, Any]:
    """
    Process payment with comprehensive error handling.

    Args:
        amount: Payment amount in dollars
        card_token: Secure card token from frontend

    Returns:
        Dict containing transaction result

    Raises:
        PaymentError: When payment processing fails
    """
    if amount <= 0:
        raise PaymentError("Payment amount must be positive")

    if not card_token:
        raise PaymentError("Card token is required")

    try:
        logger.info(f"Processing payment: ${amount}")
        result = payment_gateway.charge(amount, card_token)

        logger.info(f"Payment successful: {result.transaction_id}")
        return {
            'success': True,
            'transaction_id': result.transaction_id,
            'amount': amount,
            'timestamp': result.timestamp
        }

    except payment_gateway.InsufficientFundsError:
        logger.warning(f"Payment declined - insufficient funds: ${amount}")
        raise PaymentError("Insufficient funds")

    except payment_gateway.InvalidCardError:
        logger.warning(f"Payment declined - invalid card token")
        raise PaymentError("Invalid payment method")

    except Exception as e:
        logger.error(f"Payment processing failed: {str(e)}")
        raise PaymentError("Payment processing unavailable")

def send_notification(user_id: int, message: str) -> bool:
    """
    Send notification with proper error handling.

    Args:
        user_id: Target user ID
        message: Notification message

    Returns:
        True if notification sent successfully

    Raises:
        NotificationError: When notification sending fails
    """
    if not message.strip():
        raise NotificationError("Message cannot be empty")

    try:
        user = get_user(user_id)
        if not user:
            raise NotificationError(f"User not found: {user_id}")

        if not user.email:
            logger.warning(f"User {user_id} has no email address")
            return False

        logger.info(f"Sending notification to user {user_id}")
        email_service.send(user.email, message)

        logger.info(f"Notification sent successfully to {user.email}")
        return True

    except UserNotFoundError:
        logger.error(f"User not found: {user_id}")
        raise NotificationError(f"User not found: {user_id}")

    except EmailServiceError as e:
        logger.error(f"Email service error: {str(e)}")
        raise NotificationError("Email delivery failed")

    except Exception as e:
        logger.error(f"Unexpected error sending notification: {str(e)}")
        raise NotificationError("Notification system unavailable")

# Single large Terraform file - difficult to maintain
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = {
    Name = "main-vpc"
  }
}

resource "aws_subnet" "public" {
  count             = 2
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.${count.index + 1}.0/24"
  availability_zone = data.aws_availability_zones.available.names[count.index]

  tags = {
    Name = "public-subnet-${count.index + 1}"
  }
}

resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id

  tags = {
    Name = "main-igw"
  }
}

# ... 200 more lines of resources

# Main infrastructure file - clean and modular
module "vpc" {
  source = "./modules/vpc"

  vpc_cidr             = var.vpc_cidr
  availability_zones   = var.availability_zones
  public_subnet_cidrs  = var.public_subnet_cidrs
  private_subnet_cidrs = var.private_subnet_cidrs

  tags = local.common_tags
}

module "security" {
  source = "./modules/security"

  vpc_id = module.vpc.vpc_id
  tags   = local.common_tags
}

module "application" {
  source = "./modules/application"

  vpc_id            = module.vpc.vpc_id
  private_subnet_ids = module.vpc.private_subnet_ids
  security_group_ids = module.security.app_security_group_ids

  tags = local.common_tags
}

# modules/vpc/main.tf - Reusable VPC module
variable "vpc_cidr" {
  description = "CIDR block for VPC"
  type        = string
  validation {
    condition = can(cidrhost(var.vpc_cidr, 0))
    error_message = "VPC CIDR must be a valid CIDR block."
  }
}

variable "availability_zones" {
  description = "List of availability zones"
  type        = list(string)
}

resource "aws_vpc" "this" {
  cidr_block           = var.vpc_cidr
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = merge(var.tags, {
    Name = "vpc-${var.environment}"
  })
}

resource "aws_subnet" "public" {
  count = length(var.public_subnet_cidrs)

  vpc_id                  = aws_vpc.this.id
  cidr_block              = var.public_subnet_cidrs[count.index]
  availability_zone       = var.availability_zones[count.index]
  map_public_ip_on_launch = true

  tags = merge(var.tags, {
    Name = "public-subnet-${count.index + 1}"
    Type = "public"
  })
}

output "vpc_id" {
  description = "ID of the VPC"
  value       = aws_vpc.this.id
}

output "public_subnet_ids" {
  description = "IDs of public subnets"
  value       = aws_subnet.public[*].id
}

# Simple CI pipeline - missing important checks
name: Deploy

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-node@v2
        with:
          node-version: '14'
      - run: npm install
      - run: npm test
      - run: npm run build
      - run: aws s3 sync dist/ s3://my-bucket/

# Production-ready CI/CD pipeline with comprehensive checks
name: Build and Deploy

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

env:
  NODE_VERSION: '18.x'
  AWS_REGION: 'us-east-1'

jobs:
  test:
    name: Test and Quality Checks
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'

      - name: Install dependencies
        run: npm ci --prefer-offline --no-audit

      - name: Run linting
        run: |
          npm run lint
          npm run lint:css

      - name: Run type checking
        run: npm run type-check

      - name: Run unit tests
        run: npm run test:coverage

      - name: Run security audit
        run: npm audit --audit-level moderate

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v3
        with:
          file: ./coverage/lcov.info

  build:
    name: Build Application
    needs: test
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'

      - name: Install dependencies
        run: npm ci --prefer-offline --no-audit

      - name: Build application
        run: npm run build:prod

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: build-artifacts
          path: dist/
          retention-days: 30

  deploy:
    name: Deploy to AWS
    needs: [test, build]
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'

    environment:
      name: production
      url: https://myapp.com

    steps:
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: build-artifacts
          path: dist/

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Deploy to S3
        run: |
          aws s3 sync dist/ s3://${{ secrets.S3_BUCKET }}/ \
            --delete \
            --cache-control "max-age=31536000" \
            --exclude "*.html"

          aws s3 sync dist/ s3://${{ secrets.S3_BUCKET }}/ \
            --exclude "*" \
            --include "*.html" \
            --cache-control "max-age=300"

      - name: Invalidate CloudFront
        run: |
          aws cloudfront create-invalidation \
            --distribution-id ${{ secrets.CLOUDFRONT_DISTRIBUTION_ID }} \
            --paths "/*"

      - name: Health check
        run: |
          sleep 30
          response=$(curl -s -o /dev/null -w "%{http_code}" https://myapp.com/health)
          if [ $response != "200" ]; then
            echo "Health check failed with status $response"
            exit 1
          fi
          echo "Deployment successful - health check passed"

# Basic Kubernetes deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
spec:
  replicas: 3
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
      - name: myapp
        image: myapp:latest
        ports:
        - containerPort: 3000

# Production-ready Kubernetes deployment with comprehensive configuration
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  namespace: production
  labels:
    app: myapp
    version: v1.2.3
    component: backend
    managed-by: kubernetes

spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0

  selector:
    matchLabels:
      app: myapp
      component: backend

  template:
    metadata:
      labels:
        app: myapp
        version: v1.2.3
        component: backend
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "3000"
        prometheus.io/path: "/metrics"

    spec:
      serviceAccountName: myapp-service-account
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 1000

      containers:
      - name: myapp
        image: myapp:v1.2.3
        imagePullPolicy: Always

        ports:
        - name: http
          containerPort: 3000
          protocol: TCP

        env:
        - name: NODE_ENV
          value: "production"
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: myapp-secrets
              key: database-url

        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 500m
            memory: 512Mi

        livenessProbe:
          httpGet:
            path: /health
            port: http
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 3

        readinessProbe:
          httpGet:
            path: /ready
            port: http
          initialDelaySeconds: 5
          periodSeconds: 5
          timeoutSeconds: 3
          failureThreshold: 3

        securityContext:
          allowPrivilegeEscalation: false
          runAsNonRoot: true
          runAsUser: 1000
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true

        volumeMounts:
        - name: tmp
          mountPath: /tmp

      volumes:
      - name: tmp
        emptyDir: {}

      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app
                  operator: In
                  values:
                  - myapp
              topologyKey: kubernetes.io/hostname

---
apiVersion: v1
kind: Service
metadata:
  name: myapp-service
  namespace: production

spec:
  type: ClusterIP
  ports:
  - name: http
    port: 80
    targetPort: http
    protocol: TCP

  selector:
    app: myapp
    component: backend

---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: myapp-pdb
  namespace: production

spec:
  minAvailable: 2
  selector:
    matchLabels:
      app: myapp
      component: backend

# AI-generated Prometheus configuration for application monitoring
global:
  scrape_interval: 15s
  evaluation_interval: 15s

rule_files:
  - "alert_rules.yml"

alerting:
  alertmanagers:
    - static_configs:
        - targets:
          - alertmanager:9093

scrape_configs:
  - job_name: 'myapp'
    static_configs:
      - targets: ['myapp:3000']
    metrics_path: /metrics
    scrape_interval: 5s
    scrape_timeout: 3s

  - job_name: 'node'
    static_configs:
      - targets: ['node-exporter:9100']

  - job_name: 'postgres'
    static_configs:
      - targets: ['postgres-exporter:9187']

# alert_rules.yml
groups:
  - name: application.rules
    rules:
      - alert: HighErrorRate
        expr: rate(http_requests_total{status=~"5.."}[5m]) > 0.1
        for: 2m
        labels:
          severity: critical
        annotations:
          summary: "High error rate detected"
          description: "Error rate is {{ $value }} requests/second"

      - alert: HighLatency
        expr: histogram_quantile(0.95, rate(http_request_duration_seconds_bucket[5m])) > 0.5
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "High latency detected"
          description: "95th percentile latency is {{ $value }} seconds"

      - alert: DatabaseConnectionsHigh
        expr: pg_stat_database_numbackends / pg_settings_max_connections * 100 > 80
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "Database connections high"
          description: "Database connections at {{ $value }}% of maximum"

# AI-generated incident response automation
import json
import subprocess
import datetime
from typing import Dict, List, Optional
import logging

class IncidentResponseAutomation:
    def __init__(self, config_file: str):
        with open(config_file, 'r') as f:
            self.config = json.load(f)
        self.logger = logging.getLogger(__name__)

    def handle_high_cpu_alert(self, hostname: str, cpu_threshold: float) -> Dict:
        """Automated response to high CPU alerts."""

        incident_id = self._generate_incident_id()
        self.logger.info(f"Handling high CPU incident {incident_id} on {hostname}")

        response = {
            'incident_id': incident_id,
            'hostname': hostname,
            'timestamp': datetime.datetime.utcnow().isoformat(),
            'actions_taken': [],
            'diagnostics': {}
        }

        try:
            response['diagnostics'] = self._collect_cpu_diagnostics(hostname)
            response['actions_taken'].append("Collected CPU diagnostics")

            top_processes = response['diagnostics'].get('top_processes', [])
            for process in top_processes:
                if self._is_problematic_process(process):
                    action = self._handle_problematic_process(hostname, process)
                    response['actions_taken'].append(action)

            if self._should_scale_application(hostname, cpu_threshold):
                scale_action = self._scale_application(hostname)
                response['actions_taken'].append(scale_action)

            self._update_incident_dashboard(incident_id, response)
            response['actions_taken'].append("Updated monitoring dashboard")

        except Exception as e:
            self.logger.error(f"Error in incident response: {str(e)}")
            response['error'] = str(e)

        return response

# AI-generated capacity planning automation
import pandas as pd
import numpy as np
from sklearn.linear_model import LinearRegression
from datetime import datetime, timedelta

class CapacityPlanner:
    def __init__(self, metrics_source):
        self.metrics_source = metrics_source

    def analyze_resource_trends(self, days_back: int = 30, 
                              forecast_days: int = 90) -> dict:
        """Analyze resource usage trends and predict future capacity needs."""

        end_date = datetime.utcnow()
        start_date = end_date - timedelta(days=days_back)

        metrics = self._collect_historical_metrics(start_date, end_date)

        analysis = {
            'cpu_analysis': self._analyze_cpu_trends(metrics, forecast_days),
            'memory_analysis': self._analyze_memory_trends(metrics, forecast_days),
            'storage_analysis': self._analyze_storage_trends(metrics, forecast_days),
            'recommendations': []
        }

        analysis['recommendations'] = self._generate_recommendations(analysis)

        return analysis

    def _analyze_cpu_trends(self, metrics: pd.DataFrame, 
                           forecast_days: int) -> dict:
        """Analyze CPU usage trends and predict future needs."""

        cpu_data = metrics['cpu_usage'].resample('1H').mean()

        X = np.arange(len(cpu_data)).reshape(-1, 1)
        y = cpu_data.values

        model = LinearRegression()
        model.fit(X, y)

        future_X = np.arange(len(cpu_data), 
                           len(cpu_data) + (forecast_days * 24)).reshape(-1, 1)
        future_usage = model.predict(future_X)

        current_avg = cpu_data.tail(24 * 7).mean()
        peak_usage = cpu_data.tail(24 * 7).max()
        predicted_peak = future_usage.max()

        return {
            'current_average': current_avg,
            'current_peak': peak_usage,
            'predicted_average': future_usage.mean(),
            'predicted_peak': predicted_peak,
            'growth_rate': model.coef_[0] * 24,
            'capacity_warning': predicted_peak > 80,
        }

#!/bin/bash
# AI-generated comprehensive backup validation script

set -euo pipefail

BACKUP_DIR="/backup"
LOG_FILE="/var/log/backup-validation.log"
NOTIFICATION_WEBHOOK="${SLACK_WEBHOOK_URL:-}"

log() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

validate_database_backup() {
    local backup_file="$1"
    local test_db="backup_validation_$(date +%s)"

    log "Validating database backup: $backup_file"
    createdb "$test_db"

    if pg_restore -d "$test_db" "$backup_file" 2>/dev/null; then
        log "Database backup restore successful"

        local table_count=$(psql -d "$test_db" -t -c "SELECT COUNT(*) FROM information_schema.tables WHERE table_schema = 'public';" | tr -d ' ')
        log "Backup contains $table_count tables"

        dropdb "$test_db"
        return 0
    else
        log "Database backup validation failed"
        dropdb "$test_db" 2>/dev/null || true
        return 1
    fi
}

main() {
    log "Starting backup validation process"

    local overall_status="SUCCESS"

    while IFS= read -r -d '' backup_file; do
        if ! validate_database_backup "$backup_file"; then
            overall_status="FAILURE"
        fi
    done < <(find "$BACKUP_DIR" -name "*.sql.gz" -mtime -1 -print0)

    log "Backup validation complete - Status: $overall_status"

    if [[ -n "$NOTIFICATION_WEBHOOK" ]]; then
        curl -X POST -H 'Content-type: application/json' \
            --data "{\"text\":\"Backup Validation: $overall_status\"}" \
            "$NOTIFICATION_WEBHOOK"
    fi

    [[ "$overall_status" == "SUCCESS" ]] && exit 0 || exit 1
}

main "$@"

# AI-generated cloud migration planning tool
import boto3
import json
from dataclasses import dataclass
from typing import List, Dict, Optional
from datetime import datetime

@dataclass
class MigrationAssessment:
    server_name: str
    current_specs: Dict
    recommended_instance: str
    monthly_cost: float
    migration_complexity: str
    dependencies: List[str]
    risks: List[str]

class CloudMigrationPlanner:
    def __init__(self, aws_region: str = 'us-east-1'):
        self.ec2 = boto3.client('ec2', region_name=aws_region)
        self.pricing = boto3.client('pricing', region_name='us-east-1')

    def assess_server_migration(self, server_inventory: List[Dict]) -> List[MigrationAssessment]:
        """Assess servers for cloud migration readiness and costs."""

        assessments = []
        for server in server_inventory:
            assessment = self._analyze_server(server)
            assessments.append(assessment)
        return assessments

    def generate_migration_plan(self, assessments: List[MigrationAssessment]) -> Dict:
        """Generate comprehensive migration plan."""

        migration_waves = self._plan_migration_waves(assessments)

        plan = {
            'overview': {
                'total_servers': len(assessments),
                'estimated_monthly_cost': sum(a.monthly_cost for a in assessments),
                'migration_waves': len(migration_waves),
                'estimated_duration_weeks': len(migration_waves) * 2
            },
            'migration_waves': migration_waves,
            'risk_analysis': self._analyze_overall_risks(assessments),
            'recommendations': self._generate_recommendations(assessments)
        }

        return plan

# AI-generated feature flag pattern for safe refactoring deployment
import os
from typing import Optional

class FeatureFlags:
    def __init__(self):
        self.flags = {
            'use_new_auth_service': self._get_flag_value('NEW_AUTH_SERVICE', 0),
            'enable_optimized_queries': self._get_flag_value('OPTIMIZED_QUERIES', 0),
            'use_new_payment_flow': self._get_flag_value('NEW_PAYMENT_FLOW', 0)
        }

    def _get_flag_value(self, flag_name: str, default: int) -> int:
        return int(os.getenv(f'FEATURE_FLAG_{flag_name}', default))

    def is_enabled(self, flag_name: str, user_id: Optional[int] = None) -> bool:
        flag_value = self.flags.get(flag_name, 0)

        if flag_value == 0:
            return False
        elif flag_value == 100:
            return True
        else:
            if user_id:
                return (user_id % 100) < flag_value
            return False

def authenticate_user(username: str, password: str, user_id: int) -> Optional[str]:
    """Authentication with gradual rollout of new implementation."""

    if feature_flags.is_enabled('use_new_auth_service', user_id):
        return new_authentication_service.authenticate(username, password)
    else:
        return legacy_authentication_service.authenticate(username, password)

# Create feature branch
git checkout -b refactor/authentication-modernization

# Break refactoring into logical commits
git add auth/models.py
git commit -m "refactor(auth): modernize user model with type hints

- Add comprehensive type annotations
- Improve password validation logic  
- Add audit logging fields
- Generated with Claude assistance, reviewed for correctness"

git add auth/services.py
git commit -m "refactor(auth): implement secure authentication service

- Replace MD5 with bcrypt password hashing
- Add rate limiting and account lockout
- Implement comprehensive error handling
- Add security audit logging
- Generated with Claude, reviewed for security"

# Refactoring Documentation Template

## Problem Statement
- [Original issue or technical debt]
- [Performance/security/maintainability concerns]
- [Business impact of the problem]

## AI-Assisted Solution
### Tool Used
- Claude/GitHub Copilot/etc.
- Date of assistance

### Approach
- [High-level strategy provided by AI]
- [Specific techniques or patterns suggested]
- [Human modifications and validation performed]

## Human Review and Validation
- [Security review findings]
- [Performance testing results]  
- [Business logic validation]
- [Integration testing outcomes]

## Implementation Notes
- [Deployment strategy used]
- [Monitoring and alerting added]
- [Rollback procedures]
- [Known limitations or follow-up work needed]

## Knowledge Sharing
- [Key patterns that can be reused]
- [Lessons learned about AI assistance effectiveness]
- [Recommendations for similar future refactoring]