backend: implement offline QR session caching with Redis

[ShantKhatri]

Summary

Product doc section 5.9 specifies Offline QR Mode — QR codes should work fully offline once generated. Implement a Redis-backed QR session cache in the backend so that the public profile data is served from cache, reducing DB load and supporting limited offline scenarios.

Context

The public profile route at apps/backend/src/routes/public.ts currently queries PostgreSQL on every request. Adding Redis caching here allows the profile resolution to serve from cache during poor connectivity scenarios at events.

Tasks

• ensure Redis plugin is available in the Fastify instance (apps/backend/src/plugins/).
• in apps/backend/src/routes/public.ts, after a successful DB fetch:
  • serialize the public profile to JSON and store in Redis as profile:<username> with a 5-minute TTL.
  • on subsequent requests, check Redis first; return cached data with X-Cache: HIT header.
• cache invalidation: when a user updates their profile (PUT /api/profiles/me), delete the profile:<username> key.
• add cache headers to the HTTP response: Cache-Control: public, max-age=300, stale-while-revalidate=60.
• add a GET /api/public/:username/qr-session endpoint that returns a pre-signed, short-lived (10 minute) token encoding the profile snapshot — intended for the native app to generate QR codes that don't depend on live connectivity.
• write tests asserting cache HIT/MISS behavior and invalidation.

Acceptance Criteria

• Redis cache reduces database calls on repeat views.
• profile updates invalidate cache immediately.
• X-Cache header indicates HIT or MISS.
• QR session endpoint returns a token that can be decoded offline.

Difficulty

advanced — requires Redis integration, cache invalidation strategy, and token design for offline scenarios.

[Harxhit]

Hi, I’d love to work on this issue as well. I’m actively building caching systems in my own projects, so this aligns closely with the kind of backend infrastructure work I’ve been doing recently. I’m interested in handling the Redis integration, cache HIT/MISS flow, invalidation strategy, QR session token generation, and the related integration tests end-to-end.

One quick clarification before I start: for the QR session endpoint, would you prefer a signed JWT-style payload for offline decoding, or a Redis/session-backed token approach?

[ShantKhatri]

Hi, I’d love to work on this issue as well. I’m actively building caching systems in my own projects, so this aligns closely with the kind of backend infrastructure work I’ve been doing recently. I’m interested in handling the Redis integration, cache HIT/MISS flow, invalidation strategy, QR session token generation, and the related integration tests end-to-end.

One quick clarification before I start: for the QR session endpoint, would you prefer a signed JWT-style payload for offline decoding, or a Redis/session-backed token approach?

Hi @Harxhit, I'd be happy to assign you, but it would be better if we had PRs for the assigned one. Happy to help you further.

[Dipti45sktech]

Hi @ShantKhatri , since this is an open issue, I'd love to work on it if you could assign it to me?

[SdSarthak]

Hi @nowbind,

I'd love to work on this issue under GirlScript Summer of Code 2026.

Redis-backed caching with TTL and cache invalidation is something I've worked with in data-intensive backend systems. The design here is well-scoped — cache the public profile on first fetch, invalidate on profile update, add X-Cache headers for observability, and expose a pre-signed QR session endpoint for offline scenarios.

I'm comfortable with the full implementation: Fastify plugin registration, Redis key design, HMAC token generation for the QR session endpoint, and writing the HIT/MISS/invalidation test cases.

Could you please assign this to me?

Thanks!

[Jason170-beep]

Hi @nowbind,

I'd love to work on this issue under GirlScript Summer of Code 2026.

Redis-backed caching with TTL and cache invalidation is something I've worked with in data-intensive backend systems. The design here is well-scoped — cache the public profile on first fetch, invalidate on profile update, add X-Cache headers for observability, and expose a pre-signed QR session endpoint for offline scenarios.

I'm comfortable with the full implementation: Fastify plugin registration, Redis key design, HMAC token generation for the QR session endpoint, and writing the HIT/MISS/invalidation test cases.

Could you please assign this to me?

Thanks!

Which LLM did you copy pasted this?