karrio-server-manager 2025.5rc36__py3-none-any.whl → 2025.5.2__py3-none-any.whl

karrio/server/manager/serializers/shipment.py

@@ -1,3 +1,4 @@
+import uuid
 import typing
 import rest_framework.status as status
 import django.db.transaction as transaction
@@ -48,6 +49,7 @@ from karrio.server.manager.serializers.customs import CustomsSerializer
 from karrio.server.manager.serializers.parcel import ParcelSerializer
 from karrio.server.manager.serializers.rate import RateSerializer
 import karrio.server.manager.models as models
+
 DEFAULT_CARRIER_FILTER: typing.Any = dict(active=True, capability="shipping")
 
 
@@ -128,20 +130,33 @@ class ShipmentSerializer(ShipmentData):
     def create(
         self, validated_data: dict, context: Context, **kwargs
     ) -> models.Shipment:
+        # fmt: off
         service = validated_data.get("service")
         carrier_ids = validated_data.get("carrier_ids") or []
         fetch_rates = validated_data.get("fetch_rates") is not False
         services = [service] if service is not None else validated_data.get("services")
+        options = validated_data.get("options") or {}
+
+        # Check if we should skip rate fetching for has_alternative_services
+        skip_rate_fetching, resolved_carrier_name, _ = (
+            resolve_alternative_service_carrier(
+                service=service,
+                carrier_ids=carrier_ids,
+                carriers=[],  # Pre-check before loading carriers
+                options=options,
+                context=context,
+            )
+        )
+
         carriers = gateway.Carriers.list(
             context=context,
             carrier_ids=carrier_ids,
-            **({"services": services} if any(services) else {}),
+            **({"carrier_name": resolved_carrier_name} if resolved_carrier_name else {}),
+            **({"services": services} if any(services) and not skip_rate_fetching else {}),
             **{"raise_not_found": True, **DEFAULT_CARRIER_FILTER},
         )
         payment = validated_data.get("payment") or lib.to_dict(
-            datatypes.Payment(
-                currency=(validated_data.get("options") or {}).get("currency")
-            )
+            datatypes.Payment(currency=options.get("currency"))
         )
         rating_data = {
             **validated_data,
@@ -151,11 +166,11 @@ class ShipmentSerializer(ShipmentData):
         messages = validated_data.get("messages") or []
         apply_shipping_rules = lib.identity(
             getattr(conf.settings, "SHIPPING_RULES", False)
-            and (validated_data.get("options") or {}).get("apply_shipping_rules", False)
+            and options.get("apply_shipping_rules", False)
         )
 
-        # Get live rates.
-        if fetch_rates or apply_shipping_rules:
+        # Get live rates (skip if has_alternative_services is enabled)
+        if (fetch_rates or apply_shipping_rules) and not skip_rate_fetching:
             rate_response: datatypes.RateResponse = (
                 RateSerializer.map(data=rating_data, context=context)
                 .save(carriers=carriers)
@@ -164,6 +179,16 @@ class ShipmentSerializer(ShipmentData):
             rates = lib.to_dict(rate_response.rates)
             messages = lib.to_dict(rate_response.messages)
 
+        # Create synthetic rate when skipping rate fetching
+        if skip_rate_fetching:
+            _, _, rates = resolve_alternative_service_carrier(
+                service=service,
+                carrier_ids=carrier_ids,
+                carriers=carriers,
+                options=options,
+                context=context,
+            )
+
         shipment = models.Shipment.objects.create(
             **{
                 **{
@@ -219,14 +244,14 @@ class ShipmentSerializer(ShipmentData):
             context=context,
         )
 
-        # Buy label if preferred service is selected or shipping rules should applied.
-        if (service and fetch_rates) or apply_shipping_rules:
+        # Buy label if preferred service is selected, shipping rules applied, or skip rate fetching
+        if (service and fetch_rates) or apply_shipping_rules or skip_rate_fetching:
             return buy_shipment_label(
                 shipment,
                 context=context,
                 service=service,
             )
-
+        # fmt: on
         return shipment
 
     @transaction.atomic
@@ -288,7 +313,16 @@ class ShipmentSerializer(ShipmentData):
 
 
 class ShipmentPurchaseData(Serializer):
-    selected_rate_id = CharField(required=True, help_text="The shipment selected rate.")
+    selected_rate_id = CharField(
+        required=False,
+        allow_null=True,
+        help_text="The shipment selected rate.",
+    )
+    service = CharField(
+        required=False,
+        allow_null=True,
+        help_text="The carrier service to use for the shipment (alternative to selected_rate_id).",
+    )
     label_type = ChoiceField(
         required=False,
         choices=LABEL_TYPES,
@@ -306,6 +340,15 @@ class ShipmentPurchaseData(Serializer):
         required=False, help_text="User metadata for the shipment"
     )
 
+    def validate(self, data):
+        if not data.get("selected_rate_id") and not data.get("service"):
+            raise exceptions.APIException(
+                "Either 'selected_rate_id' or 'service' must be provided.",
+                code="validation_error",
+                status_code=status.HTTP_400_BAD_REQUEST,
+            )
+        return data
+
 
 class ShipmentUpdateData(validators.OptionDefaultSerializer):
     label_type = ChoiceField(
@@ -792,9 +835,15 @@ def create_shipment_tracker(shipment: typing.Optional[models.Shipment], context)
             )
             tracker.save()
             link_org(tracker, context)
-            logger.info("Successfully added a tracker to the shipment", shipment_id=shipment.id)
+            logger.info(
+                "Successfully added a tracker to the shipment", shipment_id=shipment.id
+            )
         except Exception as e:
-            logger.exception("Failed to create new label tracker", error=str(e), shipment_id=shipment.id)
+            logger.exception(
+                "Failed to create new label tracker",
+                error=str(e),
+                shipment_id=shipment.id,
+            )
 
         # Update shipment tracking url if different from the current one
         try:
@@ -815,7 +864,12 @@ def create_shipment_tracker(shipment: typing.Optional[models.Shipment], context)
                 shipment.tracking_url = tracking_url
                 shipment.save(update_fields=["tracking_url"])
         except Exception as e:
-            logger.exception("Failed to update shipment tracking url", error=str(e), shipment_id=shipment.id, tracking_number=shipment.tracking_number)
+            logger.exception(
+                "Failed to update shipment tracking url",
+                error=str(e),
+                shipment_id=shipment.id,
+                tracking_number=shipment.tracking_number,
+            )
 
 
 def generate_custom_invoice(template: str, shipment: models.Shipment, **kwargs):
@@ -843,7 +897,11 @@ def generate_custom_invoice(template: str, shipment: models.Shipment, **kwargs):
         shipment.invoice = document["doc_file"]
         shipment.save(update_fields=["invoice"])
 
-    logger.info("Custom document successfully generated", shipment_id=shipment.id, template=template)
+    logger.info(
+        "Custom document successfully generated",
+        shipment_id=shipment.id,
+        template=template,
+    )
 
     return document
 
@@ -862,3 +920,81 @@ def upload_customs_forms(shipment: models.Shipment, document: dict, context=None
         .save(shipment=shipment)
         .instance
     )
+
+
+def resolve_alternative_service_carrier(
+    service: str,
+    carrier_ids: list,
+    carriers: list,
+    options: dict,
+    context: Context,
+) -> typing.Tuple[bool, typing.Optional[str], typing.List[dict]]:
+    """
+    Resolve carrier and create synthetic rate for has_alternative_services flow.
+
+    When has_alternative_services=True and a service is specified, this function:
+    1. Determines if rate fetching should be skipped
+    2. Resolves the carrier from the service name
+    3. Creates a synthetic rate for direct label purchase
+
+    Returns:
+        Tuple of (skip_rate_fetching, resolved_carrier_name, synthetic_rates)
+    """
+    has_alternative_services = options.get("has_alternative_services", False)
+    skip_rate_fetching = service is not None and has_alternative_services
+
+    if not skip_rate_fetching:
+        return False, None, []
+
+    # Resolve carrier from service when no explicit carrier_ids provided
+    resolved_carrier_name = None
+    if not any(carrier_ids):
+        resolved_carrier_name = utils._get_carrier_for_service(service, context=context)
+        if resolved_carrier_name is None:
+            raise exceptions.APIException(
+                f"Could not resolve carrier for service '{service}'",
+                code="validation_error",
+                status_code=status.HTTP_400_BAD_REQUEST,
+            )
+
+    if len(carriers) == 0:
+        return skip_rate_fetching, resolved_carrier_name, []
+
+    # Find carrier connection matching the service's carrier
+    carrier_name = resolved_carrier_name or utils._get_carrier_for_service(
+        service, context=context
+    )
+    carrier = lib.identity(
+        next(
+            (c for c in carriers if c.carrier_name == carrier_name),
+            carriers[0] if carrier_name is None else None,
+        )
+    )
+
+    if carrier is None:
+        raise exceptions.APIException(
+            f"No carrier connection found for service '{service}'",
+            code="validation_error",
+            status_code=status.HTTP_400_BAD_REQUEST,
+        )
+
+    # Create synthetic rate for direct label purchase
+    synthetic_rates = [
+        {
+            "id": f"rat_{uuid.uuid4().hex}",
+            "carrier_id": carrier.carrier_id,
+            "carrier_name": carrier.carrier_name,
+            "service": service,
+            "currency": options.get("currency") or "USD",
+            "total_charge": 0,
+            "meta": {
+                "carrier_connection_id": carrier.pk,
+                "has_alternative_services": True,
+                "rate_provider": carrier.carrier_name,
+                "service_name": service.upper().replace("_", " "),
+            },
+            "test_mode": context.test_mode,
+        }
+    ]
+
+    return skip_rate_fetching, resolved_carrier_name, synthetic_rates

karrio/server/manager/tests/test_errors.py

@@ -0,0 +1,88 @@
+import json
+from django.urls import reverse
+from rest_framework import status
+from karrio.server.core.tests import APITestCase
+
+
+class TestNotFoundErrors(APITestCase):
+    def test_address_not_found_returns_resource_name(self):
+        url = reverse(
+            "karrio.server.manager:address-details",
+            kwargs=dict(pk="nonexistent_id"),
+        )
+        response = self.client.get(url)
+        response_data = json.loads(response.content)
+
+        self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
+        self.assertDictEqual(
+            response_data,
+            {"errors": [{"code": "not_found", "message": "Address not found"}]},
+        )
+
+    def test_parcel_not_found_returns_resource_name(self):
+        url = reverse(
+            "karrio.server.manager:parcel-details",
+            kwargs=dict(pk="nonexistent_id"),
+        )
+        response = self.client.get(url)
+        response_data = json.loads(response.content)
+
+        self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
+        self.assertDictEqual(
+            response_data,
+            {"errors": [{"code": "not_found", "message": "Parcel not found"}]},
+        )
+
+    def test_shipment_not_found_returns_resource_name(self):
+        url = reverse(
+            "karrio.server.manager:shipment-details",
+            kwargs=dict(pk="nonexistent_id"),
+        )
+        response = self.client.get(url)
+        response_data = json.loads(response.content)
+
+        self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
+        self.assertDictEqual(
+            response_data,
+            {"errors": [{"code": "not_found", "message": "Shipment not found"}]},
+        )
+
+    def test_customs_not_found_returns_resource_name(self):
+        url = reverse(
+            "karrio.server.manager:customs-details",
+            kwargs=dict(pk="nonexistent_id"),
+        )
+        response = self.client.get(url)
+        response_data = json.loads(response.content)
+
+        self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
+        self.assertDictEqual(
+            response_data,
+            {"errors": [{"code": "not_found", "message": "Customs not found"}]},
+        )
+
+
+class TestValidationErrors(APITestCase):
+    def test_shipment_validation_error_format(self):
+        url = reverse("karrio.server.manager:shipment-list")
+        data = {
+            "shipper": {},
+            "recipient": {},
+            "parcels": [],
+        }
+        response = self.client.post(url, data, format="json")
+        response_data = json.loads(response.content)
+
+        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
+        self.assertIn("errors", response_data)
+        self.assertTrue(len(response_data["errors"]) > 0)
+
+    def test_address_validation_error_format(self):
+        url = reverse("karrio.server.manager:address-list")
+        data = {"country_code": "INVALID"}
+        response = self.client.post(url, data, format="json")
+        response_data = json.loads(response.content)
+
+        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
+        self.assertIn("errors", response_data)
+        self.assertTrue(len(response_data["errors"]) > 0)

karrio/server/manager/tests/test_shipments.py

@@ -212,6 +212,144 @@ class TestShipmentPurchase(TestShipmentFixture):
             ).exists()
         )
 
+    def test_purchase_shipment_with_has_alternative_services(self):
+        """
+        Test that when has_alternative_services is enabled and service is requested
+        but not in rates, the purchase proceeds by delegating service resolution to the carrier.
+        """
+        url = reverse(
+            "karrio.server.manager:shipment-purchase",
+            kwargs=dict(pk=self.shipment.pk),
+        )
+        self.shipment.options = {"has_alternative_services": True}
+        self.shipment.save()
+        data = {"service": "canadapost_expedited_parcel"}
+
+        with patch("karrio.server.core.gateway.utils.identity") as mock:
+            mock.return_value = CREATED_SHIPMENT_RESPONSE
+            response = self.client.post(url, data)
+            response_data = json.loads(response.content)
+
+        self.assertResponseNoErrors(response)  # type: ignore
+        self.assertDictEqual(
+            dict(status=response_data["status"], service=response_data["service"]),
+            dict(status="purchased", service="canadapost_expedited_parcel"),
+        )
+
+
+class TestSingleCallLabelPurchase(APITestCase):
+    """Test single call label purchase via POST to shipment-list with a service specified."""
+
+    def test_single_call_label_purchase(self):
+        """
+        Test that when a shipment is created with a service specified,
+        the label is purchased in a single call after fetching rates.
+        """
+        url = reverse("karrio.server.manager:shipment-list")
+        data = SINGLE_CALL_LABEL_DATA
+
+        with patch("karrio.server.core.gateway.utils.identity") as mock:
+            mock.side_effect = [RETURNED_RATES_VALUE, CREATED_SHIPMENT_RESPONSE]
+            response = self.client.post(url, data)
+            response_data = json.loads(response.content)
+
+        self.assertResponseNoErrors(response)  # type: ignore
+        self.assertDictEqual(
+            {
+                "status": response_data["status"],
+                "carrier_name": response_data["carrier_name"],
+                "service": response_data["service"],
+                "tracking_number": response_data["tracking_number"],
+                "services": response_data["services"],
+                "rates_count": len(response_data["rates"]),
+            },
+            {
+                "status": "purchased",
+                "carrier_name": "canadapost",
+                "service": "canadapost_priority",
+                "tracking_number": "123456789012",
+                "services": ["canadapost_priority"],
+                "rates_count": 1,
+            },
+        )
+
+
+class TestSingleCallWithAlternativeServices(APITestCase):
+    """Test single call label purchase with has_alternative_services flag (skip rate fetching)."""
+
+    def test_single_call_label_purchase_skip_rates(self):
+        """
+        Test that when has_alternative_services=True and service is specified,
+        rate fetching is skipped and label is purchased directly.
+        Carrier is resolved from the service name.
+        """
+        url = reverse("karrio.server.manager:shipment-list")
+        data = SINGLE_CALL_SKIP_RATES_DATA
+
+        with patch("karrio.server.core.gateway.utils.identity") as mock:
+            mock.return_value = CREATED_SHIPMENT_RESPONSE
+            response = self.client.post(url, data)
+            response_data = json.loads(response.content)
+
+            # Verify only 1 call was made (rates were skipped)
+            self.assertEqual(mock.call_count, 1)
+
+        self.assertResponseNoErrors(response)  # type: ignore
+        self.assertDictEqual(
+            {
+                "status": response_data["status"],
+                "carrier_name": response_data["carrier_name"],
+                "service": response_data["service"],
+                "tracking_number": response_data["tracking_number"],
+                "has_alternative_services": response_data["selected_rate"]["meta"].get(
+                    "has_alternative_services"
+                ),
+            },
+            {
+                "status": "purchased",
+                "carrier_name": "canadapost",
+                "service": "canadapost_priority",
+                "tracking_number": "123456789012",
+                "has_alternative_services": True,
+            },
+        )
+
+    def test_single_call_label_purchase_skip_rates_with_carrier_ids(self):
+        """
+        Test that when has_alternative_services=True, service, and carrier_ids are specified,
+        rate fetching is skipped and label is purchased directly.
+        """
+        url = reverse("karrio.server.manager:shipment-list")
+        data = {**SINGLE_CALL_SKIP_RATES_DATA, "carrier_ids": ["canadapost"]}
+
+        with patch("karrio.server.core.gateway.utils.identity") as mock:
+            mock.return_value = CREATED_SHIPMENT_RESPONSE
+            response = self.client.post(url, data)
+            response_data = json.loads(response.content)
+
+            # Verify only 1 call was made (rates were skipped)
+            self.assertEqual(mock.call_count, 1)
+
+        self.assertResponseNoErrors(response)  # type: ignore
+        self.assertDictEqual(
+            {
+                "status": response_data["status"],
+                "carrier_name": response_data["carrier_name"],
+                "service": response_data["service"],
+                "tracking_number": response_data["tracking_number"],
+                "has_alternative_services": response_data["selected_rate"]["meta"].get(
+                    "has_alternative_services"
+                ),
+            },
+            {
+                "status": "purchased",
+                "carrier_name": "canadapost",
+                "service": "canadapost_priority",
+                "tracking_number": "123456789012",
+                "has_alternative_services": True,
+            },
+        )
+
 
 SHIPMENT_DATA = {
     "recipient": {
@@ -260,11 +398,21 @@ SHIPMENT_RATES = {
             "total_charge": 106.71,
             "transit_days": 2,
             "extra_charges": [
-                {"name": "Duty and taxes", "amount": 13.92, "currency": "CAD", "id": ANY},
+                {
+                    "name": "Duty and taxes",
+                    "amount": 13.92,
+                    "currency": "CAD",
+                    "id": ANY,
+                },
                 {"name": "Fuel surcharge", "amount": 2.7, "currency": "CAD", "id": ANY},
                 {"name": "SMB Savings", "amount": -11.74, "currency": "CAD", "id": ANY},
                 {"name": "Discount", "amount": -9.04, "currency": "CAD", "id": ANY},
-                {"name": "Base surcharge", "amount": 101.83, "currency": "CAD", "id": ANY},
+                {
+                    "name": "Base surcharge",
+                    "amount": 101.83,
+                    "currency": "CAD",
+                    "id": ANY,
+                },
             ],
             "meta": {
                 "ext": "canadapost",
@@ -535,7 +683,12 @@ PURCHASED_SHIPMENT = {
                 {"name": "Fuel surcharge", "amount": 2.7, "currency": "CAD", "id": ANY},
                 {"name": "SMB Savings", "amount": -11.74, "currency": "CAD", "id": ANY},
                 {"name": "Discount", "amount": -9.04, "currency": "CAD", "id": ANY},
-                {"name": "Duties and taxes", "amount": 13.92, "currency": "CAD", "id": ANY},
+                {
+                    "name": "Duties and taxes",
+                    "amount": 13.92,
+                    "currency": "CAD",
+                    "id": ANY,
+                },
             ],
             "meta": {
                 "service_name": "CANADAPOST PRIORITY",
@@ -679,11 +832,31 @@ CANCEL_RESPONSE = {
             "total_charge": 106.71,
             "transit_days": 2,
             "extra_charges": [
-                {"name": "Base charge", "amount": 101.83, "currency": "CAD", "id": None},
-                {"name": "Fuel surcharge", "amount": 2.7, "currency": "CAD", "id": None},
-                {"name": "SMB Savings", "amount": -11.74, "currency": "CAD", "id": None},
+                {
+                    "name": "Base charge",
+                    "amount": 101.83,
+                    "currency": "CAD",
+                    "id": None,
+                },
+                {
+                    "name": "Fuel surcharge",
+                    "amount": 2.7,
+                    "currency": "CAD",
+                    "id": None,
+                },
+                {
+                    "name": "SMB Savings",
+                    "amount": -11.74,
+                    "currency": "CAD",
+                    "id": None,
+                },
                 {"name": "Discount", "amount": -9.04, "currency": "CAD", "id": None},
-                {"name": "Duties and taxes", "amount": 13.92, "currency": "CAD", "id": None},
+                {
+                    "name": "Duties and taxes",
+                    "amount": 13.92,
+                    "currency": "CAD",
+                    "id": None,
+                },
             ],
             "meta": {
                 "carrier_connection_id": ANY,
@@ -797,11 +970,31 @@ CANCEL_PURCHASED_RESPONSE = {
             "total_charge": 106.71,
             "transit_days": 2,
             "extra_charges": [
-                {"name": "Base charge", "amount": 101.83, "currency": "CAD", "id": None},
-                {"name": "Fuel surcharge", "amount": 2.7, "currency": "CAD", "id": None},
-                {"name": "SMB Savings", "amount": -11.74, "currency": "CAD", "id": None},
+                {
+                    "name": "Base charge",
+                    "amount": 101.83,
+                    "currency": "CAD",
+                    "id": None,
+                },
+                {
+                    "name": "Fuel surcharge",
+                    "amount": 2.7,
+                    "currency": "CAD",
+                    "id": None,
+                },
+                {
+                    "name": "SMB Savings",
+                    "amount": -11.74,
+                    "currency": "CAD",
+                    "id": None,
+                },
                 {"name": "Discount", "amount": -9.04, "currency": "CAD", "id": None},
-                {"name": "Duties and taxes", "amount": 13.92, "currency": "CAD", "id": None},
+                {
+                    "name": "Duties and taxes",
+                    "amount": 13.92,
+                    "currency": "CAD",
+                    "id": None,
+                },
             ],
             "meta": {
                 "carrier_connection_id": ANY,
@@ -831,3 +1024,75 @@ CANCEL_PURCHASED_RESPONSE = {
     "label_url": None,
     "invoice_url": None,
 }
+
+SINGLE_CALL_LABEL_DATA = {
+    "recipient": {
+        "address_line1": "125 Church St",
+        "person_name": "John Poop",
+        "company_name": "A corp.",
+        "phone_number": "514 000 0000",
+        "city": "Moncton",
+        "country_code": "CA",
+        "postal_code": "E1C4Z8",
+        "residential": False,
+        "state_code": "NB",
+    },
+    "shipper": {
+        "address_line1": "5840 Oak St",
+        "person_name": "Jane Doe",
+        "company_name": "B corp.",
+        "phone_number": "514 000 9999",
+        "city": "Vancouver",
+        "country_code": "CA",
+        "postal_code": "V6M2V9",
+        "residential": False,
+        "state_code": "BC",
+    },
+    "parcels": [
+        {
+            "weight": 1,
+            "weight_unit": "KG",
+            "package_preset": "canadapost_corrugated_small_box",
+        }
+    ],
+    "payment": {"currency": "CAD", "paid_by": "sender"},
+    "service": "canadapost_priority",
+    "carrier_ids": ["canadapost"],
+    "options": {"insurance": 100},
+}
+
+SINGLE_CALL_SKIP_RATES_DATA = {
+    # Note: No carrier_ids provided - carrier is resolved from service name
+    "recipient": {
+        "address_line1": "125 Church St",
+        "person_name": "John Poop",
+        "company_name": "A corp.",
+        "phone_number": "514 000 0000",
+        "city": "Moncton",
+        "country_code": "CA",
+        "postal_code": "E1C4Z8",
+        "residential": False,
+        "state_code": "NB",
+    },
+    "shipper": {
+        "address_line1": "5840 Oak St",
+        "person_name": "Jane Doe",
+        "company_name": "B corp.",
+        "phone_number": "514 000 9999",
+        "city": "Vancouver",
+        "country_code": "CA",
+        "postal_code": "V6M2V9",
+        "residential": False,
+        "state_code": "BC",
+    },
+    "parcels": [
+        {
+            "weight": 1,
+            "weight_unit": "KG",
+            "package_preset": "canadapost_corrugated_small_box",
+        }
+    ],
+    "payment": {"currency": "CAD", "paid_by": "sender"},
+    "service": "canadapost_priority",
+    "options": {"has_alternative_services": True},
+}

karrio/server/manager/views/manifests.py

@@ -10,7 +10,7 @@ import rest_framework.pagination as pagination
 import rest_framework.throttling as throttling
 import django_filters.rest_framework as django_filters
 
-from karrio.server.core.logging import logger
+from karrio.server.core.utils import validate_resource_token
 import karrio.server.openapi as openapi
 import karrio.server.core.views.api as api
 import karrio.server.core.filters as filters
@@ -107,26 +107,24 @@ class ManifestDetails(api.APIView):
 
 class ManifestDoc(django_downloadview.VirtualDownloadView):
     @openapi.extend_schema(exclude=True)
-    def get(
-        self,
-        request: request.Request,
-        pk: str,
-        doc: str = "manifest",
-        format: str = "pdf",
-        **kwargs,
-    ):
+    def get(self, req: request.Request, pk: str, doc: str = "manifest", format: str = "pdf", **kwargs):
         """Retrieve a manifest file."""
+        error = validate_resource_token(req, "manifest", [pk], "manifest")
+        if error:
+            return error
+
+        query_params = req.GET.dict()
+
         self.manifest = models.Manifest.objects.get(pk=pk, manifest__isnull=False)
         self.document = getattr(self.manifest, doc, None)
         self.name = f"{doc}_{self.manifest.id}.{format}"
 
-        query_params = request.GET.dict()
         self.preview = "preview" in query_params
         self.attachment = "download" in query_params
 
-        response = super(ManifestDoc, self).get(request, pk, doc, format, **kwargs)
-        response["X-Frame-Options"] = "ALLOWALL"
-        return response
+        resp = super(ManifestDoc, self).get(req, pk, doc, format, **kwargs)
+        resp["X-Frame-Options"] = "ALLOWALL"
+        return resp
 
     def get_file(self):
         content = base64.b64decode(self.document or "")

karrio/server/manager/views/shipments.py

@@ -14,7 +14,6 @@ import karrio.lib as lib
 import karrio.server.openapi as openapi
 import karrio.server.core.filters as filters
 import karrio.server.manager.models as models
-from karrio.server.core.logging import logger
 from karrio.server.core.views.api import GenericAPIView, APIView
 from karrio.server.core.filters import ShipmentFilters
 from karrio.server.manager.router import router
@@ -267,12 +266,19 @@ class ShipmentDocs(VirtualDownloadView):
         format: str = "pdf",
         **kwargs,
     ):
-        """Retrieve a shipment label."""
+        """Retrieve a shipment label or invoice."""
+        from karrio.server.core.utils import validate_resource_token
+
+        error = validate_resource_token(request, "shipment", [pk], doc)
+        if error:
+            return error
+
+        query_params = request.GET.dict()
+
         self.shipment = models.Shipment.objects.get(pk=pk, label__isnull=False)
         self.document = getattr(self.shipment, doc, None)
         self.name = f"{doc}_{self.shipment.tracking_number}.{format}"
 
-        query_params = request.GET.dict()
         self.preview = "preview" in query_params
         self.attachment = "download" in query_params
 

{karrio_server_manager-2025.5rc36.dist-info → karrio_server_manager-2025.5.2.dist-info}/METADATA

@@ -1,9 +1,9 @@
 Metadata-Version: 2.4
 Name: karrio_server_manager
-Version: 2025.5rc36
+Version: 2025.5.2
 Summary: Multi-carrier shipping API Shipments manager module
 Author-email: karrio <hello@karrio.io>
-License-Expression: Apache-2.0
+License-Expression: LGPL-3.0
 Project-URL: Homepage, https://github.com/karrioapi/karrio
 Classifier: Programming Language :: Python :: 3
 Requires-Python: >=3.11

{karrio_server_manager-2025.5rc36.dist-info → karrio_server_manager-2025.5.2.dist-info}/RECORD

@@ -82,25 +82,26 @@ karrio/server/manager/serializers/manifest.py,sha256=mSneCk_7HMXpi64_7hggWvkR7Ma
 karrio/server/manager/serializers/parcel.py,sha256=733Bg26lVbEkoWtAVM5Qt2IRBS2QDuVxhG40Hiqh3bw,2621
 karrio/server/manager/serializers/pickup.py,sha256=sX0VmcQxGkXn3IEosMuFwdXh4HhdkPcuBOp79O8PoDQ,9233
 karrio/server/manager/serializers/rate.py,sha256=7vYK_v8iWEDnswqYHG2Lir16_UhHTOxW5rdC6lw3lzA,652
-karrio/server/manager/serializers/shipment.py,sha256=G4vA51UFHvBVNNR9z3Vtac-Y7GexjGadPOCRxSUVqRE,30355
+karrio/server/manager/serializers/shipment.py,sha256=N4mld4eIM1HQ6NdsQ7gDt73aDv4j0wHM4AAMfgChnMc,34919
 karrio/server/manager/serializers/tracking.py,sha256=ixrAjIiZQsvSt4y0qtisGkt6TFOJ3ORNkJAQVt6YQrA,12483
 karrio/server/manager/tests/__init__.py,sha256=Y1UNteEE60vWdUAkjbldu_r_-h4u0He8-UoiBgTjKcU,391
 karrio/server/manager/tests/test_addresses.py,sha256=pNkZC_yJyb29ZlEOtOAs4blcEYiOarw0zhZIZC5uj1w,3111
 karrio/server/manager/tests/test_custom_infos.py,sha256=iv2cLdZVoVWFZK_mDUEnrZssncAnQcn87Rn2sAk8UQI,2731
+karrio/server/manager/tests/test_errors.py,sha256=QYsGLUtwMvrHeX1XSCpdteTKbug7-y1-Xgvbl96aN9g,3220
 karrio/server/manager/tests/test_parcels.py,sha256=lVLBOsHzXgXQvYjHIUy5oiPvrMfxYpueVvvhtuhstWk,2559
 karrio/server/manager/tests/test_pickups.py,sha256=8jxddwTnBvBM9FOyWxW9TtZ-GOVYUje7HQ2EZjsbtD8,10681
-karrio/server/manager/tests/test_shipments.py,sha256=9QlsvAZK0owvDwK8lVAdVVUYAtFOkr7cIKoU7W-wRls,26946
+karrio/server/manager/tests/test_shipments.py,sha256=LBblskbeJyUvWtJdy5hZPvumuOT2PE__ikIK3YlvcnY,35914
 karrio/server/manager/tests/test_trackers.py,sha256=KvmWkplokNDZ0dzB16mFl0WcMJ0OYp_ErZeWJPGW_NA,7151
 karrio/server/manager/views/__init__.py,sha256=kDFUaORRQ3Xh0ZPm-Jk88Ss8dgGYM57iUFXb9TPMzh0,401
 karrio/server/manager/views/addresses.py,sha256=7YCAs2ZYgd1icYwMcGGWfX7A7vZEL4BEAbU4eIxhiMY,4620
 karrio/server/manager/views/customs.py,sha256=-ZreiKyJ1xeLeNVG53nMfRQFeURduWr1QkDItdLPnE8,4875
 karrio/server/manager/views/documents.py,sha256=znW54qJ_k7WInIut5FBZFDT93CioozXTOYFKRSUTBhA,4005
-karrio/server/manager/views/manifests.py,sha256=4VyeiFaeKkWRvKmZZcfw7qjHynsR03t4M_fwwiZklZQ,5171
+karrio/server/manager/views/manifests.py,sha256=_Dd83YxVJOgWhAhD745Kr4tcLWnKaU1dxnT5xB8opvk,5227
 karrio/server/manager/views/parcels.py,sha256=hZY45rg6SrTWfQqyJ38MGKSor1yqgPUEVHtu16aG37g,4594
 karrio/server/manager/views/pickups.py,sha256=gmpxz9ot1OR-BP1qh-0MXU3kUJi1ht_74hfaLJzJ42w,5503
-karrio/server/manager/views/shipments.py,sha256=_5EJfgxEO6H2EdQQbaSwILgnim7slqxMKDkEk_97F9c,10267
+karrio/server/manager/views/shipments.py,sha256=TqLpBH5Jf-rI3enJwvNptRwGzfo7co9R1VSP_oqhB3o,10419
 karrio/server/manager/views/trackers.py,sha256=3oGn2qDpHgk8GZvuz-Cb93Fc0j_h_HbXQR692Zhfiok,12363
-karrio_server_manager-2025.5rc36.dist-info/METADATA,sha256=gqVdjXCp3F4TIfvQWnxEJ76Js6deZo0n6BRct9pJC9I,734
-karrio_server_manager-2025.5rc36.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-karrio_server_manager-2025.5rc36.dist-info/top_level.txt,sha256=D1D7x8R3cTfjF_15mfiO7wCQ5QMtuM4x8GaPr7z5i78,12
-karrio_server_manager-2025.5rc36.dist-info/RECORD,,
+karrio_server_manager-2025.5.2.dist-info/METADATA,sha256=WZxA5Br3FwwK7PO0Au-FKvQPHFPUcXevyuoaK596rWQ,730
+karrio_server_manager-2025.5.2.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+karrio_server_manager-2025.5.2.dist-info/top_level.txt,sha256=D1D7x8R3cTfjF_15mfiO7wCQ5QMtuM4x8GaPr7z5i78,12
+karrio_server_manager-2025.5.2.dist-info/RECORD,,