Design Hotspot Self-Service as a Transaction
Join OTP identity, payment, voucher issuance and RouterOS access without creating duplicate service.
Join OTP identity, payment, voucher issuance and RouterOS access without creating duplicate service.
Four systems must agree
A self-service hotspot purchase crosses identity verification, payment, entitlement creation and network authorization. Treat the journey as one recoverable transaction so a retry cannot charge twice or issue multiple vouchers.
Identity
Bind the verified contact to a short-lived purchase attempt.
Money
Trust a verified gateway callback, never a browser redirect alone.
Access
Create one entitlement with an explicit start, limit and expiry.
Keep OTP narrow
Rate-limit requests by contact, device and network. Expire codes quickly, store them safely and never reveal whether an unrelated account exists. Successful verification should authorize only the pending action.
Make callbacks idempotent
Assign an immutable merchant reference before redirecting to payment. When callbacks repeat, return the previously recorded result. Reconcile gateway amount, currency and status before granting access.
Model voucher state
Use created, issued, active, exhausted, expired and reversed states. Preserve payment and redemption references. A printed code should not be the database identity.
Handle partial failure
If payment succeeds but RouterOS provisioning is unavailable, queue entitlement delivery and show a truthful pending state. Never ask the customer to pay again merely because network activation was delayed.
Put it into operation
- Open attempt. Create a unique purchase reference and requested offer
- Verify contact. Complete the rate-limited OTP challenge
- Confirm funds. Validate the server-to-server gateway result
- Issue once. Create or retrieve the single entitlement
- Audit. Record actor, timestamps, gateway reference and activation result
Research basis: MikroTik RouterOS HotSpot documentation; OWASP Authentication Cheat Sheet; PCI SSC payment guidance. Implementation details must be verified against the deployed release and local policy.