julian
c9a2ef81a9
Version selection is "latest tariff_version with effectiveFrom <= entry time", but the publish handler accepted ANY effectiveFrom (defaulting to now). So an admin could publish a version with a backdated effectiveFrom and silently reprice sessions that had already entered — the retroactive rewrite the versioning exists to prevent. Pricing itself was sound (quote resolves by entry time; payment records tariffVersionId, freezing completed sessions); the leak was the publish side only. Reject effectiveFrom earlier than now (60s skew tolerance); future-dated (scheduling a price change) stays allowed; bad ISO -> 400. Combined with entry-time selection this is structural: once a car has entered, no later publish can reprice it. Did not pin tariffVersionId onto vehicle_entry (not needed). Verified 5/5 via inject against a copy of the live DB. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V