⚡ Bolt: O(1) Blockchain Integrity for Resolution Evidence

backend/cache.py

@@ -180,4 +180,5 @@ def invalidate(self):
 blockchain_last_hash_cache = ThreadSafeCache(ttl=3600, max_size=1)
 grievance_last_hash_cache = ThreadSafeCache(ttl=3600, max_size=1)
 visit_last_hash_cache = ThreadSafeCache(ttl=3600, max_size=2)
+resolution_last_hash_cache = ThreadSafeCache(ttl=3600, max_size=1)
 user_issues_cache = ThreadSafeCache(ttl=300, max_size=50) # 5 minutes TTL

backend/init_db.py

@@ -206,6 +206,37 @@ def index_exists(table, index_name):
                 if not index_exists("field_officer_visits", "ix_field_officer_visits_previous_visit_hash"):
                     conn.execute(text("CREATE INDEX IF NOT EXISTS ix_field_officer_visits_previous_visit_hash ON field_officer_visits (previous_visit_hash)"))
 
+            # Resolution Evidence Table Migrations
+            if inspector.has_table("resolution_evidence"):
+                if not column_exists("resolution_evidence", "integrity_hash"):
+                    conn.execute(text("ALTER TABLE resolution_evidence ADD COLUMN integrity_hash VARCHAR"))
+                    logger.info("Added integrity_hash column to resolution_evidence")
+
+                if not column_exists("resolution_evidence", "previous_integrity_hash"):
+                    conn.execute(text("ALTER TABLE resolution_evidence ADD COLUMN previous_integrity_hash VARCHAR"))
+                    logger.info("Added previous_integrity_hash column to resolution_evidence")
+
+                if not index_exists("resolution_evidence", "ix_resolution_evidence_previous_integrity_hash"):
+                    conn.execute(text("CREATE INDEX IF NOT EXISTS ix_resolution_evidence_previous_integrity_hash ON resolution_evidence (previous_integrity_hash)"))
+
+            # Resolution Proof Tokens Table Migrations
+            if inspector.has_table("resolution_proof_tokens"):
+                if not column_exists("resolution_proof_tokens", "expires_at"):
+                    conn.execute(text("ALTER TABLE resolution_proof_tokens ADD COLUMN expires_at DATETIME"))
+                    logger.info("Added expires_at column to resolution_proof_tokens")
+
+                if not column_exists("resolution_proof_tokens", "nonce"):
+                    conn.execute(text("ALTER TABLE resolution_proof_tokens ADD COLUMN nonce VARCHAR"))
+                    logger.info("Added nonce column to resolution_proof_tokens")
+
+                if not column_exists("resolution_proof_tokens", "valid_from"):
+                    conn.execute(text("ALTER TABLE resolution_proof_tokens ADD COLUMN valid_from DATETIME"))
+                    logger.info("Added valid_from column to resolution_proof_tokens")
+
+                if not column_exists("resolution_proof_tokens", "valid_until"):
+                    conn.execute(text("ALTER TABLE resolution_proof_tokens ADD COLUMN valid_until DATETIME"))
+                    logger.info("Added valid_until column to resolution_proof_tokens")
+
             logger.info("Database migration check completed successfully.")
 
     except Exception as e:

backend/models.py

@@ -287,6 +287,10 @@ class ResolutionEvidence(Base):
     server_signature = Column(String, nullable=True)
     verification_status = Column(Enum(VerificationStatus), default=VerificationStatus.PENDING)
 
+    # Blockchain integrity fields
+    integrity_hash = Column(String, nullable=True)
+    previous_integrity_hash = Column(String, nullable=True, index=True)
+
     # Relationships
     grievance = relationship("Grievance", back_populates="resolution_evidence")
     audit_logs = relationship("EvidenceAuditLog", back_populates="evidence")
@@ -307,6 +311,9 @@ class ResolutionProofToken(Base):
     geofence_longitude = Column(Float, nullable=True)
     geofence_radius_meters = Column(Float, default=200.0)
     token_signature = Column(String, nullable=True)
+    nonce = Column(String, nullable=True)
+    valid_from = Column(DateTime, nullable=True)
+    valid_until = Column(DateTime, nullable=True)
 
     # Relationship
     grievance = relationship("Grievance", back_populates="resolution_tokens")

backend/resolution_proof_service.py

@@ -25,6 +25,7 @@
     EvidenceAuditLog, VerificationStatus, GrievanceStatus
 )
 from backend.config import get_config
+from backend.cache import resolution_last_hash_cache
 
 logger = logging.getLogger(__name__)
 
@@ -197,6 +198,7 @@ def generate_proof_token(
             geofence_radius_meters=geofence_radius,
             valid_from=now,
             valid_until=valid_until,
+            expires_at=valid_until,
             nonce=nonce,
             token_signature=signature,
             is_used=False,
@@ -368,7 +370,20 @@ def submit_evidence(
         bundle_str = json.dumps(metadata_bundle, sort_keys=True)
         server_signature = ResolutionProofService._sign_payload(bundle_str)
 
-        # 6. Create evidence record
+        # 6. Blockchain feature: calculate integrity hash for the evidence (Issue #292)
+        # Performance Boost: Use thread-safe cache to eliminate DB query for last hash
+        prev_hash = resolution_last_hash_cache.get("last_hash")
+        if prev_hash is None:
+            # Cache miss: Fetch only the last hash from DB
+            prev_evidence = db.query(ResolutionEvidence.integrity_hash).order_by(ResolutionEvidence.id.desc()).first()
+            prev_hash = prev_evidence[0] if prev_evidence and prev_evidence[0] else ""
+            resolution_last_hash_cache.set(data=prev_hash, key="last_hash")
+
+        # Chaining logic: hash(evidence_hash|token_id|gps_latitude|gps_longitude|prev_hash)
+        hash_content = f"{evidence_hash}|{token.token_id}|{gps_latitude}|{gps_longitude}|{prev_hash}"
+        integrity_hash = ResolutionProofService._sign_payload(hash_content)
+
+        # 7. Create evidence record
         evidence = ResolutionEvidence(
             grievance_id=token.grievance_id,
             token_id=token.id,
@@ -380,18 +395,23 @@ def submit_evidence(
             metadata_bundle=metadata_bundle,
             server_signature=server_signature,
             verification_status=VerificationStatus.VERIFIED,
+            integrity_hash=integrity_hash,
+            previous_integrity_hash=prev_hash
         )
 
         db.add(evidence)
 
-        # 7. Mark token as used
+        # 8. Mark token as used
         token.is_used = True
         token.used_at = datetime.now(timezone.utc)
 
         db.commit()
         db.refresh(evidence)
 
-        # 8. Create audit log
+        # Update cache after successful commit to prevent cache poisoning
+        resolution_last_hash_cache.set(data=integrity_hash, key="last_hash")
+
+        # 9. Create audit log
         ResolutionProofService._create_audit_log(
             evidence_id=evidence.id,
             action="created",
@@ -430,16 +450,18 @@ def verify_evidence(grievance_id: int, db: Session) -> Dict[str, Any]:
         Checks:
         - Evidence exists
         - Evidence hash integrity (re-sign and compare)
+        - Blockchain integrity (recompute chain hash)
         - Location match (within geofence)
 
         Returns:
             Verification result dictionary
         """
-        evidence_records = db.query(ResolutionEvidence).filter(
+        # Performance Boost: Fetch only the latest record to minimize DB load
+        evidence = db.query(ResolutionEvidence).filter(
             ResolutionEvidence.grievance_id == grievance_id
-        ).all()
+        ).order_by(ResolutionEvidence.id.desc()).first()
 
-        if not evidence_records:
+        if not evidence:
             return {
                 "grievance_id": grievance_id,
                 "is_verified": False,
@@ -452,9 +474,6 @@ def verify_evidence(grievance_id: int, db: Session) -> Dict[str, Any]:
                 "message": "No resolution evidence found for this grievance"
             }
 
-        # Use the most recent evidence
-        evidence = evidence_records[-1]
-
         # Re-verify the server signature
         bundle_str = json.dumps(evidence.metadata_bundle, sort_keys=True)
         signature_valid = ResolutionProofService._verify_signature(
@@ -475,9 +494,18 @@ def verify_evidence(grievance_id: int, db: Session) -> Dict[str, Any]:
             )
             location_match = is_inside
 
+        # Verify blockchain integrity
+        prev_hash = evidence.previous_integrity_hash or ""
+        # Re-derive token_id for hash (it's in metadata_bundle)
+        token_uuid = evidence.metadata_bundle.get("token_id", "")
+        hash_content = f"{evidence.evidence_hash}|{token_uuid}|{evidence.gps_latitude}|{evidence.gps_longitude}|{prev_hash}"
+        computed_integrity_hash = ResolutionProofService._sign_payload(hash_content)
+        blockchain_valid = (computed_integrity_hash == evidence.integrity_hash)
+
         is_verified = (
             signature_valid and
             location_match and
+            blockchain_valid and
             evidence.verification_status == VerificationStatus.VERIFIED
         )
 
@@ -493,8 +521,9 @@ def verify_evidence(grievance_id: int, db: Session) -> Dict[str, Any]:
             "resolution_timestamp": resolution_ts,
             "location_match": location_match,
             "evidence_integrity": signature_valid,
+            "blockchain_integrity": blockchain_valid,
             "evidence_hash": evidence.evidence_hash,
-            "evidence_count": len(evidence_records),
+            "evidence_count": db.query(ResolutionEvidence).filter(ResolutionEvidence.grievance_id == grievance_id).count(),
             "message": (
                 "Resolution verified with cryptographic proof"
                 if is_verified

backend/routers/resolution_proof.py

@@ -19,7 +19,7 @@
     GenerateRPTRequest, RPTResponse,
     SubmitEvidenceRequest, EvidenceResponse,
     VerificationResponse, AuditTrailResponse,
-    DuplicateCheckResponse,
+    DuplicateCheckResponse, BlockchainVerificationResponse,
 )
 
 logger = logging.getLogger(__name__)
@@ -201,6 +201,52 @@ def get_audit_log(
 # DUPLICATE / FRAUD DETECTION
 # ============================================================================
 
+from backend.models import ResolutionEvidence
+
+@router.get("/{evidence_id}/blockchain-verify", response_model=BlockchainVerificationResponse)
+def verify_evidence_blockchain(
+    evidence_id: int,
+    db: Session = Depends(get_db)
+):
+    """
+    Verify the cryptographic integrity of a resolution evidence record using blockchain-style chaining.
+    Optimized: Uses previous_integrity_hash column for O(1) verification.
+    """
+    try:
+        evidence = db.query(ResolutionEvidence).filter(ResolutionEvidence.id == evidence_id).first()
+
+        if not evidence:
+            raise HTTPException(status_code=404, detail="Evidence not found")
+
+        # Determine previous hash (O(1) from stored column)
+        prev_hash = evidence.previous_integrity_hash or ""
+
+        # Chaining logic: hash(evidence_hash|token_id|gps_latitude|gps_longitude|prev_hash)
+        # Re-derive token_id for hash (it's in metadata_bundle)
+        token_uuid = evidence.metadata_bundle.get("token_id", "")
+        hash_content = f"{evidence.evidence_hash}|{token_uuid}|{evidence.gps_latitude}|{evidence.gps_longitude}|{prev_hash}"
+        computed_hash = ResolutionProofService._sign_payload(hash_content)
+
+        is_valid = (computed_hash == evidence.integrity_hash)
+
+        if is_valid:
+            message = "Integrity verified. This evidence record is cryptographically sealed and part of a secure chain."
+        else:
+            message = "Integrity check failed! The evidence data does not match its cryptographic seal."
+
+        return BlockchainVerificationResponse(
+            is_valid=is_valid,
+            current_hash=evidence.integrity_hash,
+            computed_hash=computed_hash,
+            message=message
+        )
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"Error verifying evidence blockchain for {evidence_id}: {e}", exc_info=True)
+        raise HTTPException(status_code=500, detail="Failed to verify evidence integrity")
+
+
 @router.post("/flag-duplicate", response_model=DuplicateCheckResponse)
 def flag_duplicate_evidence(
     evidence_hash: str,

backend/schemas.py

@@ -301,9 +301,9 @@ class ClosureStatusResponse(BaseModel):
     days_remaining: Optional[int] = Field(None, description="Days until deadline")
 
 class BlockchainVerificationResponse(BaseModel):
-    is_valid: bool = Field(..., description="Whether the issue integrity is intact")
+    is_valid: bool = Field(..., description="Whether the issue/record integrity is intact")
     current_hash: Optional[str] = Field(None, description="Current integrity hash stored in DB")
-    computed_hash: str = Field(..., description="Hash computed from current issue data and previous issue's hash")
+    computed_hash: str = Field(..., description="Hash computed from current data and previous hash")
     message: str = Field(..., description="Verification result message")