04/27 Updated customer invitation allow customer to create username & password 4

app/models/user.py

@@ -83,13 +83,20 @@ class User(UserMixin, db.Model):
         user = User.query.filter_by(set_password_token=token).first()
         if user is None:
             return None
+        # Guard: account must still be in pending-setup state
+        if user.password_set:
+            return None
         if user.set_password_token_expires is None:
             return None
         if now_eastern() > user.set_password_token_expires:
             return None
-        # Constant-time comparison — prevents timing oracle on the stored token
+        # Constant-time comparison — prevents timing oracle on the stored token.
+        # Wrapped in try/except to guard against unexpected type mismatches.
+        try:
             if not hmac.compare_digest(user.set_password_token, token):
                 return None
+        except (TypeError, ValueError):
+            return None
         return user
 
     def __repr__(self):