5.2. Signing Offline Receipts

 

 

When making an online transaction, sales transactions are submitted to the Malawi Revenue Authority (MRA) in real-time. In response, the MRA returns a ValidationURL. The POS uses this ValidationURL to generate a QR code.

 

For offline transactions, the POS generates the ValidationURL offline. This is done by creating a HMAC (Hash-based Message Authentication Code) of the invoice request, which includes the invoice number, line items count, and transaction date. The HMAC is created using a secret key received during terminal activation.

 

The function to create this HMAC is called `ComputeOfflineTransactionHMAC(string plainText, string secretKey)`, where `plainText` is a concatenation result of the invoice number, line items count, and transaction date. The resulting HMAC is stored in the database as `offlineSignature`.

 

When the POS regains the ability to connect to the MRA server, it sends the offline transactions to the server. The `offlineSignature` must not be null for these transactions. If `offlineSignature` is null, it indicates the transaction was made online. If it is not null, it indicates the transaction was made offline.