BACKEND.py

import os  # Allows the code to interact with the operating system, e.g., reading environment variables (useful for API keys)
os.environ["EVENTLET_NO_GREENDNS"] = "yes"
# import eventlet  # A library for asynchronous networking, allows handling multiple connections efficiently
# eventlet.monkey_patch()  # Modifies standard Python libraries to work asynchronously with Eventlet
from flask import Flask, render_template, request,send_from_directory   # Flask framework and utilities for web server, templates, handling requests, and returning JSON. Send_from_directory: serves static files (e.g., JavaScript, images, manifest) from a specified directory.
from flask_socketio import SocketIO, emit  # SocketIO enables real-time communication between server and client; emit sends messages to clients
from openai import OpenAI  # OpenAI client library to interact with OpenAI / HuggingFace models
import google.generativeai as genai  # Google Generative AI client library for using Gemini and other Google models
import requests  # Standard library for sending HTTP requests, useful for APIs without a dedicated client
import threading
from dotenv import load_dotenv
from concurrent.futures import ThreadPoolExecutor

#-----------------------------------------MAIN
app = Flask( __name__,)
app.config['SECRET_KEY'] = 'key!secret!'
socketio = SocketIO(app)

#-----------------------------------------ENVIRONMENT VARIABLE
HFtoken = os.getenv("HUGGINGFACE_API_KEY")
MISTRAL_API_KEY = os.getenv("MISTRAL_API_KEY")
MISTRAL_API_URL = "https://api.mistral.ai/v1/chat/completions"
API_URL = "https://router.huggingface.co/v1/chat/completions"

#--------------------------------CHECK FOR HF
def check_hf_connection():
    """HuggingFace API."""
    headers = {"Authorization": f"Bearer {HFtoken}"}
    data = {"model": "openai/gpt-oss-120b:cerebras", "messages": [{"role": "user", "content": "Hello"}]}
    response = requests.post(API_URL, headers=headers, json=data)
    print("HuggingFace Token status:", response.status_code, response.text)
#--------------------------------END CHECK FOR HF
# GEMINI PROMPT
def build_analysis_prompt_Gemini(code: str) -> str:
    return """
        Code Quality Evaluation Prompt
        Objective: Conduct a rigorous and structured academic analysis of the provided source code based on the three core engineering principles defined in the "AI Software Quality" project: Readability, Correctness, and Security. 
        The final output must adhere to a formal, structured format, including definitions, detailed analysis, concrete improvement suggestions, and a numerical score (1-5) for each metric.

        Input Code Snippet:
        {code}

        Evaluation Instructions and Scoring Criteria (1-5 Scale)
        You will analyze the code using the following definitions and scoring rules:
        Principle,"Definition",Scoring (1-5)
        Readability,"The code should be clear, understandable, and easy to read for humans, enabling quick comprehension of its purpose, operation, and modification. Key factors include: meaningful names (to communicate intent), proper structure (modular code), proper formatting (indentation, spacing), and consistent style (avoiding 'clever tricks' or magic numbers)[cite: 79, 80, 82, 86, 118, 141].",1 (Poor/Unintelligible) to 5 (Excellent/Clean Code)
        Correctness,"The code's accuracy in performing its intended tasks, functioning flawlessly under a variety of conditions, and behaving as expected in all scenarios. Factors include: algorithmic suitability (simplest, fast-enough algorithm), avoiding dark corners of the language, proper handling of side effects, and defensive programming (input validation, boundary condition testing, pre/post-conditions, exception handling)[cite: 219, 223, 224, 227, 244, 245, 246, 249].",1 (Fundamentally flawed) to 5 (Thoroughly verified and robust)
        Security,"The code's ability to operate normally under external threats by avoiding vulnerabilities (bugs/weaknesses) that could violate confidentiality, integrity, and availability. Factors include: Input Validation (enforced on the trusted system, using whitelists, canonicalization) [cite: 355, 356, 358, 367], Output Encoding (contextual encoding for untrusted data, sanitization) [cite: 372, 374], Injection Flaw Protection (Parameterized Queries for SQL) [cite: 377], and Least Privilege[cite: 389, 390].",1 (Highly vulnerable) to 5 (Secure/hardened code)

        Required Output Format
        Provide your evaluation using the following structure:

        I. Readability Analysis
        Definition: [The code should be clear, understandable, and easy to read for humans, enabling quick comprehension of its purpose, operation, and modification. Key factors include: meaningful names (to communicate intent), proper structure (modular code), proper formatting (indentation, spacing), and consistent style (avoiding "clever tricks" or magic numbers)]
        Detailed Analysis: Assess the code's clarity, naming conventions (variables, functions), formatting (indentation, spacing), modularity, consistency, and use of 'magic numbers.' Provide specific line-number examples to support your findings.
        Improvement Suggestions: List concrete and actionable changes to elevate the readability to a "Clean Code" standard (e.g., rename variables, refactor complex blocks, define constants for magic numbers).
        Final Readability Score: $\\text{{[X/5]}}$

        II. Correctness Analysis 
        Definition: [The code's accuracy in performing its intended tasks, functioning flawlessly under a variety of conditions, and behaving as expected in all scenarios. Factors include: algorithmic suitability (simplest, fast-enough algorithm), avoiding dark corners of the language, proper handling of side effects, and defensive programming (input validation, boundary condition testing, pre/post-conditions, exception handling)]
        Detailed Analysis: Evaluate the code's logic, algorithm efficiency (if applicable), potential for runtime errors, handling of boundary conditions, side effects, and exception management. Specifically identify any potential logical (semantic) errors.
        Improvement Suggestions: Propose fixes for any logical/functional flaws, suggest adding defensive programming checks (e.g., input domain checks, pre/post-conditions, robust error handling), and advise on algorithmic improvements.
        Final Correctness Score: $\\text{{[X/5]}}$

        III. Security Analysis 
        Definition: [The code's ability to operate normally under external threats by avoiding vulnerabilities (bugs/weaknesses) that could violate confidentiality, integrity, and availability. Factors include: Input Validation (enforced on the trusted system, using whitelists, canonicalization), Output Encoding (contextual encoding for untrusted data, sanitization), Injection Flaw Protection (Parameterized Queries for SQL), and Least Privilege]
        Detailed Analysis: Identify potential security vulnerabilities, focusing on key areas: validation (is input validated on the trusted system?), encoding (is output contextualized?), injection flaws (SQL, command), access control (least privilege), and safe cryptographic practices (if relevant). Provide examples of coding weaknesses.
        Improvement Suggestions: Recommend specific security remediations (e.g., implement whitelists, use parameterized queries, apply contextual output encoding, check error returns).
        Final Security Score: $\\text{{[X/5]}}$

        Final Summary and Results Table
        Briefly summarize the overall quality of the code, noting the most significant risk (lowest score) and its corresponding primary strength (highest score).
        Emphasize the need for human oversight and testing to address the specific weaknesses identified.

        Principle,Final Score (1-5)
        Readability,$\\text{{[X/5]}}$
        Correctness,$\\text{{[X/5]}}$
        Security,$\\text{{[X/5]}}$
        Please keep your answer concise, under 4000 characters total.
        """.format(code=code)

#GPT PROMPT
def build_analysis_prompt_GPT(code: str) -> str:
    return f"""
        Task:
        Evaluate the following code snippet according to the three software engineering quality principles: Readability, Correctness, and Security.
        1. Readability
        Definition: How clear, understandable, and easy the code is for humans to read and maintain.
        Evaluate based on:
        Consistent use of meaningful names for variables and functions.
        Logical and modular code structure.
        Comments used only where necessary (avoid over-commenting).
        Proper formatting: indentation, spacing, line length, and avoidance of “magic numbers.”
        Consistent style and idiomatic patterns (Clean Code principles).
        Provide:
        Detailed analysis of the code’s readability.
        Specific examples of unclear or unclear-styled lines.
        Improvement suggestions.
        A score from 1–5 (1 = unreadable, 5 = highly readable).
        2. Correctness
        Definition: The degree to which the code performs its intended task accurately and reliably.
        Evaluate based on:
        Logical accuracy and absence of semantic or logical errors.
        Handling of side effects and boundary conditions.
        Use of assertions, input validation, and exception handling.
        Algorithmic stability and consistency between design and implementation.
        Evidence of systematic testing or testability.
        Provide:
        Analysis of whether the code behaves as intended.
        Examples of logic or design flaws.
        Concrete corrections or validation improvements.
        A score from 1–5 (1 = incorrect, 5 = fully correct).
        3. Security
        Definition: The extent to which the code adheres to secure development principles (based on OWASP Secure Coding Practices).
        Evaluate based on:
        Input validation and sanitization against injection or malicious data.
        Proper output encoding and escaping.
        Access control and principle of least privilege.
        Secure handling of credentials and cryptography.
        Use of trusted libraries and secure communication protocols (e.g., TLS/SSL).
        Provide:
        Security analysis and identification of potential vulnerabilities.
        Line-specific or structural examples.
        Remediation recommendations.
        A score from 1–5 (1 = insecure, 5 = highly secure).
        Summary Table (Markdown Format)
        Principle	Score	Key Issue	Suggested Fix
        Readability			
        Correctness			
        Security			
        End with a short concluding paragraph (3–4 sentences) summarizing the overall quality, reliability, and risk level of the evaluated code.
        Code to analyze:
        {code}
        Please keep your answer concise, under 4000 characters total.

        """

#Mistral PROMPT
def build_analysis_prompt_Mistral(code: str) -> str:
    return f"""

        **Prompt:**

        *You are tasked with evaluating the following source code according to the three core principles of software quality: **Readability, Correctness, and Security**. Your evaluation must be rigorous, structured, and grounded in the definitions, best practices, and empirical findings outlined in the research by Ben-Lulu & Shem-Tov (2025).*

        ### **1. Readability Evaluation**
        **Definition:** Readability refers to the clarity, understandability, and ease of reading the code for humans. It encompasses both operational readability (how the code functions) and conceptual readability (the intent and purpose of the code).

        **Analysis Criteria:**
        - **Naming Conventions:** Are variable, function, and class names meaningful, consistent, and self-documenting?
        - **Code Structure:** Is the code modular, logically organized, and free of unnecessary complexity?
        - **Comments and Documentation:** Are comments used judiciously (not excessive or redundant) and do they clarify non-obvious logic?
        - **Formatting:** Is the code properly indented, spaced, and formatted for visual clarity?
        - **Magic Numbers:** Are hard-coded values replaced with named constants?
        - **Language Idioms:** Does the code follow conventional language constructs and avoid "clever" or obscure tricks?

        **Improvement Suggestions:**
        - Propose refactoring for unclear or overly complex sections.
        - Recommend renaming ambiguous variables or functions.
        - Suggest adding or removing comments where appropriate.

        **Score (1–5):**
        - **5:** Exemplary readability; code is self-documenting and effortless to understand.
        - **4:** Good readability; minor improvements could enhance clarity.
        - **3:** Adequate readability; some sections require effort to decipher.
        - **2:** Poor readability; significant refactoring needed.
        - **1:** Unreadable; code logic is obscured by poor practices.

        ---

        ### **2. Correctness Evaluation**
        **Definition:** Correctness measures whether the code performs its intended function accurately and reliably under all specified conditions. It requires thorough testing, logical consistency, and adherence to requirements.

        **Analysis Criteria:**
        - **Logical Accuracy:** Does the code implement the intended logic without errors or edge-case failures?
        - **Input/Output Validation:** Are inputs validated, and are outputs consistent with expectations?
        - **Error Handling:** Does the code gracefully handle exceptions, edge cases, and invalid inputs?
        - **Testing Coverage:** Are there tests (unit, integration, or manual) to verify correctness? If not, identify potential gaps.
        - **Algorithm Choice:** Is the algorithm appropriate for the task, or are there more efficient/robust alternatives?
        - **Side Effects:** Does the code avoid unintended side effects (e.g., race conditions, undefined behavior)?

        **Improvement Suggestions:**
        - Highlight logical flaws or edge cases not addressed.
        - Recommend additional test cases or validation checks.
        - Suggest algorithmic optimizations or safer alternatives.

        **Score (1–5):**
        - **5:** Flawless correctness; code behaves as intended in all scenarios.
        - **4:** Mostly correct; minor edge cases or optimizations needed.
        - **3:** Partially correct; some logical or functional issues present.
        - **2:** Significant correctness issues; fails in key scenarios.
        - **1:** Fundamentally incorrect; does not fulfill requirements.

        ---

        ### **3. Security Evaluation**
        **Definition:** Security assesses the code’s resilience to vulnerabilities, attacks, and unintended exposures. It includes input validation, secure coding practices, and protection against common threats (e.g., injections, overflows, data leaks).

        **Analysis Criteria:**
        - **Input Sanitization:** Are all external inputs validated and sanitized (e.g., SQL injection, XSS, command injection)?
        - **Authentication/Authorization:** Are sensitive operations protected by access controls?
        - **Data Protection:** Is sensitive data (e.g., passwords, API keys) encrypted, hashed, or securely stored?
        - **Dependency Security:** Are third-party libraries up-to-date and free of known vulnerabilities?
        - **Error Exposure:** Do error messages avoid leaking sensitive information?
        - **Cryptographic Practices:** Are strong encryption and secure protocols used where applicable?

        **Improvement Suggestions:**
        - Identify potential vulnerabilities and recommend fixes (e.g., parameterized queries for SQL).
        - Suggest secure alternatives for risky practices (e.g., plaintext passwords).
        - Advise on dependency updates or security tools (e.g., SAST/DAST).

        **Score (1–5):**
        - **5:** Exemplary security; resilient to attacks and follows best practices.
        - **4:** Mostly secure; minor vulnerabilities or improvements needed.
        - **3:** Adequate security; some risks require mitigation.
        - **2:** Poor security; significant vulnerabilities present.
        - **1:** Critically insecure; immediate action required.

        ---

        ### **Summary and Results Table**
        Provide a **concise summary** of the code’s overall quality, emphasizing strengths and critical weaknesses. Conclude with a **Markdown table** summarizing the scores and key findings:

        ```markdown
        | Principle   | Score (1–5) | Key Strengths                          | Critical Weaknesses                  |
        |-------------|-------------|----------------------------------------|---------------------------------------|
        | Readability | [Score]     | [Strength 1], [Strength 2]            | [Weakness 1], [Weakness 2]            |
        | Correctness | [Score]     | [Strength 1], [Strength 2]            | [Weakness 1], [Weakness 2]            |
        | Security    | [Score]     | [Strength 1], [Strength 2]            | [Weakness 1], [Weakness 2]            |
        ```

        **Final Notes:**
        - If the code is part of a larger system, comment on its integration risks.
        - Flag any "code smells" or anti-patterns observed.
        - Emphasize the importance of **human review** for critical systems, per Ben-Lulu & Shem-Tov (2025).

        ---

        **Begin your evaluation now.**
        {code}
        Please keep your answer concise, under 4000 characters total.

        """

def HuggingFaceAPI_GPT(prompt: str) -> str:
    clientGPT = OpenAI(base_url="https://router.huggingface.co/v1",api_key=HFtoken,)
    completion = clientGPT.chat.completions.create(
        model="openai/gpt-oss-120b:cerebras",
        messages=[{"role": "user", "content": prompt}],
    )
    return completion.choices[0].message.content

def GeminiAPI(prompt: str) -> str:
    genai.configure(api_key=os.getenv("GEMINI_API_KEY"))
    model = genai.GenerativeModel("gemini-2.5-flash")
    response = model.generate_content(prompt)
    return response.text

def MistralAPI(prompt: str) -> str:
    headers = {"Authorization": f"Bearer {MISTRAL_API_KEY}","Content-Type": "application/json", }
    data = {"model": "mistral-tiny","messages": [{"role": "user", "content": prompt}], }
    mistral_response = requests.post(MISTRAL_API_URL, headers=headers, json=data)
    return mistral_response.json()['choices'][0]['message']['content']

def GPTJudgeAPI(responses: list, question: str) -> str:
    client = OpenAI(api_key=os.getenv("OPENAI_API_KEY"))
    
    prompt = f"""
        **Role:**
        You are the **Judge**. You merge multiple AI reviews into one decisive, high-quality evaluation.

        **Inputs:**
        * Three model responses about a single code snippet.
        * The original **Question / Code**.

        **Objective:**
        Produce one unified, academically styled evaluation that is consistent with the project’s three principles: **Readability**, **Correctness**, **Security**.

        **Evaluation framework to apply:**

        * **Readability:** meaningful names, clear structure and modularity, minimal but useful comments, proper formatting, no magic numbers, idiomatic style.
        * **Correctness:** accurate logic, handling of side effects and boundary conditions, assertions/validation/exception handling, algorithmic stability, testability.
        * **Security:** input validation and sanitization, output encoding, injection defenses, least privilege and access control, safe credential/crypto practices, trusted libs and secure transport.

        **Merge rules:**

        1. Read all three responses. Extract the **most accurate, specific, and evidence-based** points from each.
        2. Resolve conflicts. Prefer analyses with concrete code evidence and standard-backed reasoning. Drop contradictions and irrelevant content.
        3. Do **not** repeat text from the inputs. Write a single coherent explanation. Be concise and decisive.
        4. If a claim lacks evidence, rewrite or omit it. If evidence exists, cite the exact line(s) or fragment(s) from the code.
        5. No hedging. If information is missing, state the assumption briefly and proceed.

        **Output format (Markdown):**

        1. **Unified Evaluation** — one flowing analysis organized by the three principles, but written as a **single integrated narrative**.

        * Embed short code quotes where needed.
        * Tie each finding to a concrete symptom or risk.

        2. **Actionable Improvements** — bullet list of precise fixes and refactors.

        3. **Scores (1–5)** — one per principle.

        4. **Summary Table:**

        | Principle   | Score | Key Issue | Suggested Fix |
        | ----------- | ----- | --------- | ------------- |
        | Readability |       |           |               |
        | Correctness |       |           |               |
        | Security    |       |           |               |

        5. **Final Verdict (3–4 sentences)** — overall quality, reliability, and risk level.

        **Constraints:**

        * Academic tone. Clear, non-redundant prose.
        * No external tools, no web browsing.
        * Do not ask the user follow-ups unless the code intent is truly ambiguous; if so, state the assumption explicitly and continue.

        **Question / Code:**
        {question}

        """   
     
    completion = client.chat.completions.create(
        model="gpt-4o-mini",
        messages=[{"role": "user", "content": prompt}],
        max_tokens=800, 
    )  
      
    return completion.choices[0].message.content


# Receiving code as text(string) from the user
@socketio.on('send_code')
def handle_code(data):

    code = data.get('code')
    print('Received code:', code)
    
    promptGPT = build_analysis_prompt_GPT(code)
    promptGEMINI = build_analysis_prompt_Gemini(code)
    promptMistral = build_analysis_prompt_Mistral(code)


    with ThreadPoolExecutor(max_workers=3) as executor:
        future_GPT = executor.submit(HuggingFaceAPI_GPT, promptGPT)
        future_Gemini = executor.submit(GeminiAPI, promptGEMINI)
        future_Mistral = executor.submit(MistralAPI, promptMistral)

    futures = [future_GPT, future_Gemini, future_Mistral]
    all_responses = [future.result() for future in futures]
    print("All models finished. Sending to Judge...")
    
    emit('code_result', {'result': f"GPT:\n{all_responses[0]}"})
    emit('code_result', {'result': f"Gemini:\n{all_responses[1]}"})
    emit('code_result', {'result': f"Mistral:\n{all_responses[2]}"})

    judge_result = GPTJudgeAPI(all_responses, code)
    print("Judge returned.")
    emit('code_result', {'result': f"Judge:\n{judge_result}"})
 

#home page
@app.route('/')
def index():
    return render_template('index.html')

# Flask route to serve the service worker JavaScript file.
# This is used in Progressive Web Apps (PWAs) to enable features like offline support,
# caching, and background sync. The service worker must be accessible from the root scope
# (i.e., '/service_worker.js') to control the entire application.
# Since Flask does not serve files from the root directory by default,
# we manually serve the file using send_from_directory and os.getcwd().
@app.route('/service_worker.js')
def sw():
    return send_from_directory(os.getcwd(), 'service_worker.js')


if __name__ == '__main__':
    #check_hf_connection()
    print("AIREC: http://localhost:5001/")
    socketio.run(app, port=5001)