05/06 Fix some notable and quality issues

app/routes/customers.py

@@ -13,7 +13,6 @@ Provides a single screen to:
 """
 
 import logging
-from urllib.parse import urlparse
 from flask import Blueprint, render_template, redirect, url_for, flash, request, abort
 from flask_login import login_required, current_user
 from app import db
@@ -21,21 +20,10 @@ from app.models.user import User
 from app.models.project import Project, CustomerAssignment
 from app.models.facility import Facility
 from app.utils.forms import CustomerUserForm, CustomerAssignmentForm, CustomerInviteForm, SetPasswordForm
-from app.utils.decorators import admin_required, supervisor_required
+from app.utils.decorators import admin_required, supervisor_required, safe_redirect_url
 from app.utils.audit import log_action, ACTION_CREATE, ACTION_UPDATE, ACTION_DELETE
 from app.utils.scope import get_customer_scope
 
-
-def _safe_referrer(fallback: str) -> str:
-    """Return request.referrer only if it is a safe relative URL, else fallback."""
-    ref = request.referrer
-    if not ref:
-        return fallback
-    parsed = urlparse(ref)
-    if parsed.netloc or parsed.scheme:
-        return fallback
-    return ref
-
 logger = logging.getLogger(__name__)
 
 bp = Blueprint('customers', __name__, url_prefix='/customers')
@@ -496,7 +484,7 @@ def toggle_active(customer_id):
     log_action(ACTION_UPDATE, 'User', customer.id, customer.username,
                f'account {label} via customer_mgmt by {current_user.username}')
     flash(f'Customer "{customer.username}" has been {label}.', 'success')
-    return redirect(_safe_referrer(url_for('customers.index')))
+    return redirect(safe_redirect_url(request.referrer, fallback=url_for('customers.index')))
 
 
 # ── AJAX: facilities for a project (used by add-assignment form) ──────────────