Honor validated registration usernames

identity-provisioner/provisioner.py

@@ -36,7 +36,7 @@ class LLDAPProvisioner:
     def provision(self, payload: dict[str, Any]) -> Result:
         _required(payload, "user_id", "tenant", "primary_email", "idempotency_key", "correlation_id")
         email = str(payload["primary_email"]).strip().lower()
-        username = _username(email)
+        username = _username(email, payload.get("preferred_username"))
         token = self._login()
         users, groups = self._directory(token)
         existing = next((user for user in users if user.get("id") == username), None)
@@ -259,7 +259,14 @@ def dispatch(
     raise KeyError(path)
 
 
-def _username(email: str) -> str:
+def _username(email: str, preferred: object = None) -> str:
+    if preferred is not None:
+        value = str(preferred).strip().lower()
+        if not re.fullmatch(r"[a-z][a-z0-9._-]{2,31}", value):
+            raise ValueError("preferred_username is invalid")
+        if value in {"admin", "administrator", "platform-root", "root", "system"}:
+            raise ValueError("preferred_username is reserved")
+        return value
     local = email.partition("@")[0].lower()
     value = re.sub(r"[^a-z0-9._-]+", "-", local).strip("-")
     if not value or "@" not in email: