{
  "summary": "Brief description of the fix approach",
  "changes": [
    {
      "file_path": "src/utils/sanitize.py",
      "change_type": "modify",
      "current_code": "def sanitize(value):\n    return re.sub(r'[^a-zA-Z0-9]', '', value)",
      "proposed_code": "def sanitize(value, preserve_special_chars=False):\n    if preserve_special_chars:\n        return value\n    return re.sub(r'[^a-zA-Z0-9]', '', value)",
      "explanation": "Add flag to preserve special characters when needed"
    }
  ],
  "test_cases": [
    {
      "name": "test_login_special_chars_password",
      "description": "Verify login works with special characters in password",
      "test_code": "def test_login_special_chars_password():\n    result = login('user', 'P@ss#123')\n    assert result.success == True",
      "category": "regression"
    },
    {
      "name": "test_login_emoji_password",
      "description": "Verify login handles unicode/emoji in password",
      "test_code": "def test_login_emoji_password():\n    result = login('user', 'P@ss\ud83d\udd11')\n    assert result.success == True",
      "category": "edge_case"
    }
  ],
  "risk_level": "low",
  "risk_explanation": "Change is isolated to sanitize function, added parameter is backward-compatible",
  "scope": "Single function in utils module",
  "side_effects": [
    "Other callers of sanitize() continue working unchanged"
  ],
  "rollback_plan": "Revert the single commit to restore original sanitize() behavior",
  "estimated_effort": "Small - single function change with tests"
}

{
  "summary": "Add preserve_special_chars parameter to sanitize() and use it in password validation",
  "changes": [
    {
      "file_path": "src/utils/sanitize.py",
      "change_type": "modify",
      "current_code": "def sanitize(value: str) -> str:\n    \"\"\"Remove special characters for safe storage.\"\"\"\n    return re.sub(r'[^a-zA-Z0-9]', '', value)",
      "proposed_code": "def sanitize(value: str, preserve_password_chars: bool = False) -> str:\n    \"\"\"Remove special characters for safe storage.\n    \n    Args:\n        value: The string to sanitize\n        preserve_password_chars: If True, preserve characters valid in passwords\n    \"\"\"\n    if preserve_password_chars:\n        # Only remove truly dangerous characters, keep password chars like @#$%\n        return re.sub(r'[<>\"\\']', '', value)\n    return re.sub(r'[^a-zA-Z0-9]', '', value)",
      "explanation": "Add optional parameter to preserve password-valid special characters. Default behavior unchanged for backward compatibility."
    },
    {
      "file_path": "src/auth/verify.py",
      "change_type": "modify",
      "current_code": "    password = sanitize(password)",
      "proposed_code": "    password = sanitize(password, preserve_password_chars=True)",
      "explanation": "Update password verification to preserve special characters"
    }
  ],
  "test_cases": [
    {
      "name": "test_login_password_with_special_chars",
      "description": "Regression test: login should succeed with special characters in password",
      "test_code": "def test_login_password_with_special_chars():\n    \"\"\"Regression test for bug: special chars stripped from password.\"\"\"\n    user = create_user('testuser', 'P@ss#123$')\n    result = login('testuser', 'P@ss#123$')\n    assert result.success is True\n    assert result.user_id == user.id",
      "category": "regression"
    },
    {
      "name": "test_login_password_all_special_chars",
      "description": "Edge case: password consisting mostly of special characters",
      "test_code": "def test_login_password_all_special_chars():\n    \"\"\"Edge case: password with many special characters.\"\"\"\n    password = '!@#$%^&*()'  # All special chars\n    user = create_user('testuser', password)\n    result = login('testuser', password)\n    assert result.success is True",
      "category": "edge_case"
    },
    {
      "name": "test_sanitize_backward_compat",
      "description": "Ensure sanitize() default behavior unchanged",
      "test_code": "def test_sanitize_backward_compat():\n    \"\"\"Verify default sanitize behavior is unchanged.\"\"\"\n    assert sanitize('hello@world#123') == 'helloworld123'\n    assert sanitize('  spaces  ') == 'spaces'",
      "category": "regression"
    }
  ],
  "risk_level": "low",
  "risk_explanation": "The fix is backward compatible: sanitize() keeps default behavior, only password verification path uses the new flag. Existing sanitize() callers are unaffected.",
  "scope": "Two files: utils/sanitize.py (add parameter) and auth/verify.py (pass flag)",
  "side_effects": [
    "None expected - default behavior unchanged",
    "Password verification may now accept previously rejected passwords (desired)"
  ],
  "rollback_plan": "Revert the two file changes. Since this is a bug fix, reverting restores the bug but doesn't break anything new.",
  "estimated_effort": "Small - 2 file changes, ~10 lines of code, 3 test cases"
}