Aug 7 - Update: add external inspector

app/routes/auth.py

@@ -431,20 +431,64 @@ def create_user():
 
     if form.validate_on_submit():
         role = 'inspector' if director_editing else form.role.data
+
+        # MT-15 — an external inspector works for the customer or a third
+        # party, so we never set a password on their behalf. They are invited
+        # exactly like a customer: created with password_set=False (which the
+        # login route refuses until they finish), given a one-time token, and
+        # emailed a link to choose their own password.
+        invite = (role == 'external_inspector')
+
+        # UserForm.password is Optional() because the same form is used for
+        # EDIT, where blank means "keep current". On CREATE a blank password
+        # would otherwise store the hash of an empty string, so require one
+        # unless the account is being invited to choose their own.
+        if not invite and not form.password.data:
+            flash('Please set a password, or choose the External Inspector role '
+                  'to send an invitation instead.', 'danger')
+            return render_template('auth/user_form.html', form=form, user=None,
+                                   title='Create User',
+                                   director_editing=director_editing)
+
         user = User(
             username=form.username.data,
             full_name=form.full_name.data.strip() or None,
             email=form.email.data.strip().lower(),
-            role=role
+            role=role,
+            password_set=not invite,
         )
-        user.set_password(form.password.data)
+        if invite:
+            # A random unguessable placeholder — password_set=False already
+            # blocks login, but never leave an account holding a known or
+            # empty-string hash.
+            import secrets
+            user.set_password(secrets.token_hex(32))
+        else:
+            user.set_password(form.password.data)
         db.session.add(user)
+        db.session.flush()          # need user.id before minting the token
+
+        token = user.generate_set_password_token(expires_hours=72) if invite else None
         db.session.commit()
-        logger.info('AUTH | user_create | admin_id=%s admin=%s new_user=%s role=%s',
-                    current_user.id, current_user.username, user.username, user.role)
+
+        logger.info('AUTH | user_create | admin_id=%s admin=%s new_user=%s role=%s invite=%s',
+                    current_user.id, current_user.username, user.username,
+                    user.role, invite)
         log_action(ACTION_CREATE, 'User', user.id, user.username,
-                   f'role={user.role}; email={user.email}')
-        flash(f'User {user.username} created successfully.', 'success')
+                   f'role={user.role}; email={user.email}; invite_sent={invite}')
+
+        if invite:
+            # Reuses the customer invitation email — the copy ("an account has
+            # been created for you… set your password") is already correct for
+            # any invited account. Imported inside the function to keep the
+            # auth ↔ customers import graph acyclic.
+            from app.routes.customers import _send_invite_email
+            _send_invite_email(user, token, base_url=request.host_url)
+            flash(f'External inspector {user.display_name} created. An invitation '
+                  f'email has been sent to {user.email} with a link to set their '
+                  f'password.', 'success')
+        else:
+            flash(f'User {user.username} created successfully.', 'success')
         return redirect(url_for('auth.list_users'))
 
     return render_template('auth/user_form.html', form=form, title='Create User',
@@ -488,12 +532,49 @@ def edit_user(user_id):
                            title='Edit User', director_editing=director_editing)
 
 
+@bp.route('/users/<int:user_id>/resend-invite', methods=['POST'])
+@login_required
+@admin_required
+def resend_invite(user_id):
+    """Re-send the set-password invitation for an account still awaiting setup.
+
+    Without this an invitation that bounces, is deleted or expires leaves the
+    account permanently unusable — password_set=False blocks login and only a
+    valid token can clear it. Mirrors customers.resend_invite for staff-side
+    accounts (currently only external inspectors are ever invited this way).
+    """
+    user = db.session.get(User, user_id)
+    if user is None:
+        abort(404)
+    if user.password_set:
+        flash(f'{user.display_name} has already completed their account setup.',
+              'info')
+        return redirect(url_for('auth.list_users'))
+
+    # A fresh token invalidates the previous link.
+    token = user.generate_set_password_token(expires_hours=72)
+    db.session.commit()
+
+    logger.info('AUTH | resend_invite | admin=%s user=%s',
+                current_user.username, user.username)
+    log_action(ACTION_UPDATE, 'User', user.id, user.username,
+               'invitation email resent')
+
+    from app.routes.customers import _send_invite_email
+    _send_invite_email(user, token, base_url=request.host_url)
+
+    flash(f'Invitation resent to {user.email}.', 'success')
+    return redirect(url_for('auth.list_users'))
+
+
 @bp.route('/users/<int:user_id>/assign-contracts', methods=['GET', 'POST'])
 @login_required
 @admin_required
 def assign_inspector_contracts(user_id):
     user = db.session.get(User, user_id)
-    if user is None or user.role != 'inspector':
+    # MT-15: external inspectors are scoped by the same InspectorAssignment
+    # rows, so this page must accept them too.
+    if user is None or not user.is_inspector:
         abort(404)
 
     from app.models.project import Project