Merge pull request #267 from Jambox11/feature/claim-evidence-content-hash

feat: claim evidence URL + SHA-256 commitment (file_claim, events, st…

Author: jhayniffy

backend/loadtests/claim-submit.js

@@ -70,7 +70,7 @@ export default function () {
       policyId: 1,
       amount: '100',
       details: 'k6 load test claim — staging only',
-      imageUrls: [],
+      evidence: [],
     },
     JWT,
     'build-tx',

backend/src/claims/claims.controller.ts

@@ -115,7 +115,7 @@ export class ClaimsController {
       policyId: dto.policyId,
       amount: BigInt(dto.amount),
       details: dto.details,
-      imageUrls: dto.imageUrls,
+      evidence: dto.evidence,
     });
   }
 
@@ -190,3 +190,4 @@ export class ClaimsController {
       unsubscribe();
     });
   }
+}

backend/src/claims/claims.service.ts

@@ -315,7 +315,7 @@ export class ClaimsService {
     policyId: number;
     amount: bigint;
     details: string;
-    imageUrls: string[];
+    evidence: { url: string; contentSha256Hex: string }[];
   }) {
     return this.soroban.buildFileClaimTransaction(args);
   }

backend/src/claims/dto/build-claim-transaction.dto.ts

@@ -1,4 +1,5 @@
 import { ApiProperty } from '@nestjs/swagger';
+import { Type } from 'class-transformer';
 import {
   IsArray,
   IsInt,
@@ -7,6 +8,7 @@ import {
   Matches,
   MaxLength,
   Validate,
+  ValidateNested,
   ValidatorConstraint,
   ValidatorConstraintInterface,
 } from 'class-validator';
@@ -21,6 +23,26 @@ class PositiveIntStringConstraint implements ValidatorConstraintInterface {
   }
 }
 
+export class ClaimEvidenceItemDto {
+  @ApiProperty({
+    description: 'Evidence location (e.g. ipfs:// or gateway URL).',
+    example: 'ipfs://QmXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX',
+  })
+  @IsString()
+  url!: string;
+
+  @ApiProperty({
+    description: 'Lowercase hex SHA-256 of file bytes (64 chars). Prefer value from IPFS upload/proxy.',
+    example:
+      '0100000000000000000000000000000000000000000000000000000000000000',
+  })
+  @IsString()
+  @Matches(/^[0-9a-fA-F]{64}$/, {
+    message: 'contentSha256Hex must be 64 hex characters (32-byte SHA-256)',
+  })
+  contentSha256Hex!: string;
+}
+
 export class BuildClaimTransactionDto {
   @ApiProperty({
     description: 'Stellar public key of the claimant.',
@@ -57,10 +79,12 @@ export class BuildClaimTransactionDto {
   details!: string;
 
   @ApiProperty({
-    description: 'List of IPFS URLs (or CIDs) for evidence images.',
-    example: ['https://ipfs.io/ipfs/Qm...'],
+    description:
+      'Evidence attachments: URL plus SHA-256 content hash (from proxy when pinning).',
+    type: [ClaimEvidenceItemDto],
   })
   @IsArray()
-  @IsString({ each: true })
-  imageUrls!: string[];
+  @ValidateNested({ each: true })
+  @Type(() => ClaimEvidenceItemDto)
+  evidence!: ClaimEvidenceItemDto[];
 }

backend/src/events/events.schema.ts

@@ -39,8 +39,8 @@ export interface ClaimFiledEvent {
   policy_id: number;
   /** Requested payout in stroops (i128 as string). */
   amount: string;
-  /** FNV-1a u64 hash of concatenated IPFS CIDs (number). Full CIDs stored off-chain. */
-  image_hash: number;
+  /** SHA-256 digests (32 bytes each), same order as claim evidence; commitment only on-chain. */
+  evidence_hashes: string[];
   /** Ledger sequence at filing time. */
   filed_at: number;
 }

backend/src/events/events.test.ts

@@ -41,7 +41,9 @@ describe('clm_filed', () => {
     version: SCHEMA_VERSION,
     policy_id: 3,
     amount: '5000000',
-    image_hash: 2864434397,
+    evidence_hashes: [
+      '0100000000000000000000000000000000000000000000000000000000000000',
+    ],
     filed_at: LEDGER,
   };
 
@@ -62,7 +64,9 @@ describe('clm_filed', () => {
     expect(p.version).toBe(SCHEMA_VERSION);
     expect(p.policy_id).toBe(3);
     expect(p.amount).toBe('5000000');
-    expect(p.image_hash).toBe(2864434397);
+    expect(p.evidence_hashes).toEqual([
+      '0100000000000000000000000000000000000000000000000000000000000000',
+    ]);
     expect(p.filed_at).toBe(LEDGER);
   });
 });
@@ -300,7 +304,13 @@ describe('parseEvent', () => {
   });
 
   it('returns null for unsupported schema version', () => {
-    const payload = { version: 999, policy_id: 1, amount: '0', image_hash: 0, filed_at: 0 };
+    const payload = {
+      version: 999,
+      policy_id: 1,
+      amount: '0',
+      evidence_hashes: [],
+      filed_at: 0,
+    };
     expect(parseEvent(['niffyins', 'clm_filed', 1n, HOLDER], payload, LEDGER, TX)).toBeNull();
   });
 

backend/src/indexer/indexer.service.ts

@@ -3,6 +3,7 @@ import { ConfigService } from '@nestjs/config';
 import { Prisma } from '@prisma/client';
 import { PrismaService } from '../prisma/prisma.service';
 import { SorobanService } from '../rpc/soroban.service';
+import { parseEvent } from '../events/events.schema';
 import { rpc as SorobanRpc, scValToNative } from '@stellar/stellar-sdk';
 
 type IndexerTx = Prisma.TransactionClient;
@@ -327,6 +328,10 @@ export class IndexerService {
     });
   }
 
+  /**
+   * On-chain `ClaimFiled` carries claim_id + holder in topics and `evidence_hashes` in the value.
+   * Full claim rows need policy_id / amount / URLs from `get_claim` — backfill TBD.
+   */
   private async handleClaimFiled(tx: IndexerTx, data: EventPayload, event: SorobanEvent) {
     const claimId = getNumberValue(data.claim_id);
     const policyDbId = `${getStringValue(data.claimant)}:${getNumberValue(data.policy_id)}`;

backend/src/ipfs/ipfs.controller.ts

@@ -131,6 +131,12 @@ export class IpfsController {
             'https://cloudflare-ipfs.com/ipfs/QmXoypizjW3WknFiJnKLwHCnL72vedxjQkDDP1mXWo6uco',
           ],
         },
+        contentSha256Hex: {
+          type: 'string',
+          example:
+            'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',
+          description: 'SHA-256 of uploaded bytes (64 hex chars); use in file_claim evidence.',
+        },
         filename: { type: 'string', example: 'document.pdf' },
         size: { type: 'number', example: 123456 },
         mimeType: { type: 'string', example: 'application/pdf' },

backend/src/ipfs/services/idempotency.service.ts

@@ -21,6 +21,7 @@ export interface IdempotencyRecord {
     cid: string;
     gatewayUrls: string[];
     uploadedAt: string;
+    contentSha256Hex?: string;
   };
   /** Timestamp when the record was created */
   createdAt: string;
@@ -120,7 +121,7 @@ export class IdempotencyService {
   async storeResult(
     key: string,
     contentHash: string,
-    response: { cid: string; gatewayUrls: string[] },
+    response: { cid: string; gatewayUrls: string[]; contentSha256Hex: string },
   ): Promise<void> {
     const record: IdempotencyRecord = {
       key,
@@ -129,6 +130,7 @@ export class IdempotencyService {
         cid: response.cid,
         gatewayUrls: response.gatewayUrls,
         uploadedAt: new Date().toISOString(),
+        contentSha256Hex: response.contentSha256Hex,
       },
       createdAt: new Date().toISOString(),
       hitCount: 0,

backend/src/ipfs/services/ipfs.service.ts

@@ -18,6 +18,8 @@ export interface IpfsUploadResponse {
   cid: string;
   /** Gateway URLs where the content can be accessed */
   gatewayUrls: string[];
+  /** SHA-256 hex (64 chars) of uploaded bytes (after EXIF strip); for `file_claim` evidence. */
+  contentSha256Hex: string;
   /** Original filename (sanitized) */
   filename?: string;
   /** File size in bytes */
@@ -140,12 +142,17 @@ export class IpfsService {
 
     if (!idempotencyCheck.shouldUpload && idempotencyCheck.existingRecord) {
       this.logger.log(`Returning cached response for idempotent request: ${idempotencyCheck.key}`);
+      const cached = idempotencyCheck.existingRecord.response;
       return {
-        ...idempotencyCheck.existingRecord.response,
+        cid: cached.cid,
+        gatewayUrls: cached.gatewayUrls,
+        contentSha256Hex:
+          cached.contentSha256Hex ?? idempotencyCheck.contentHash,
         filename: sanitizedFilename,
         size: processedBuffer.length,
         mimeType,
         duplicated: true,
+        uploadedAt: cached.uploadedAt,
       };
     }
 
@@ -160,9 +167,12 @@ export class IpfsService {
       throw new ServiceUnavailableException('IPFS provider is temporarily unavailable');
     }
 
+    const contentSha256Hex =
+      this.fileValidationService.calculateContentHash(processedBuffer);
+
     // Upload to IPFS
     this.logger.debug(`Uploading ${sanitizedFilename} (${processedBuffer.length} bytes) to IPFS`);
-    
+
     let uploadResult: IpfsUploadResult;
     try {
       uploadResult = await this.provider.upload(
@@ -183,7 +193,7 @@ export class IpfsService {
     await this.idempotencyService.storeResult(
       idempotencyCheck.key,
       contentHash,
-      { cid: uploadResult.cid, gatewayUrls },
+      { cid: uploadResult.cid, gatewayUrls, contentSha256Hex },
     );
 
     const duration = Date.now() - startTime;
@@ -194,6 +204,7 @@ export class IpfsService {
     return {
       cid: uploadResult.cid,
       gatewayUrls,
+      contentSha256Hex,
       filename: sanitizedFilename,
       size: uploadResult.size,
       mimeType: uploadResult.mimeType,