Updated functionalities 2

app/routes/customers.py

@@ -13,6 +13,7 @@ Provides a single screen to:
 """
 
 import logging
+from urllib.parse import urlparse
 from flask import Blueprint, render_template, redirect, url_for, flash, request, abort
 from flask_login import login_required, current_user
 from app import db
@@ -24,6 +25,17 @@ from app.utils.decorators import admin_required, supervisor_required
 from app.utils.audit import log_action, ACTION_CREATE, ACTION_UPDATE, ACTION_DELETE
 from app.utils.scope import get_customer_scope
 
+
+def _safe_referrer(fallback: str) -> str:
+    """Return request.referrer only if it is a safe relative URL, else fallback."""
+    ref = request.referrer
+    if not ref:
+        return fallback
+    parsed = urlparse(ref)
+    if parsed.netloc or parsed.scheme:
+        return fallback
+    return ref
+
 logger = logging.getLogger(__name__)
 
 bp = Blueprint('customers', __name__, url_prefix='/customers')
@@ -88,12 +100,24 @@ def index():
     # All active projects for the assignment modal
     projects = Project.query.filter_by(active=True).order_by(Project.name).all()
 
+    # ── Expired pending-setup invitations ─────────────────────────────────
+    # Surface customer accounts whose invitation token has expired but
+    # password_set is still False — they need a fresh invite to log in.
+    from app.utils.time_utils import now_eastern
+    expired_invitations = [
+        c for c in customers
+        if not c.password_set
+        and c.set_password_token_expires is not None
+        and c.set_password_token_expires < now_eastern()
+    ]
+
     return render_template(
         'customers/index.html',
-        customers      = customers,
-        assignment_map = assignment_map,
-        scope_map      = scope_map,
-        projects       = projects,
+        customers           = customers,
+        assignment_map      = assignment_map,
+        scope_map           = scope_map,
+        projects            = projects,
+        expired_invitations = expired_invitations,
     )
 
 
@@ -467,7 +491,7 @@ def toggle_active(customer_id):
     log_action(ACTION_UPDATE, 'User', customer.id, customer.username,
                f'account {label} via customer_mgmt by {current_user.username}')
     flash(f'Customer "{customer.username}" has been {label}.', 'success')
-    return redirect(request.referrer or url_for('customers.index'))
+    return redirect(_safe_referrer(url_for('customers.index')))
 
 
 # ── AJAX: facilities for a project (used by add-assignment form) ──────────────