Custom fulfillment provider price is unsafe and shipping price becomes stale

[anubus298]

Problem 1
In the checkout guide Medusa says guide:

• list shipping options
• if price_type = calculated → call calculate shipping option price
• then add shipping method to cart.

My custom fulfillment provider depends on the cart items data (for example weight).
The problem: on client request we must pass data object:

sdk.store.fulfillment.calculate(shippingOption.id, {
  cart_id: cart.id,
  data: {
    // some custom values
  },
})

How can I prevent the customer from changing this data manually in front-end and abuse it?

Problem 2
If user goes back to cart page and changes quantity or adds/removes an item, the shipping fee is not recalculated again.
The user can go back to checkout and pay the old stale shipping price.

• How should this be handled correctly?

• Should Medusa re-trigger calculation automatically when cart changes?

• Or should we override a cart updated event and recalc shipping method price manually?