feat(accounts): allow usernames from CERN Auth social + guest providers

invenio.cfg

@@ -241,6 +241,20 @@ SECURITY_CHANGEABLE = False  # local login: allow users to change psw
 SECURITY_CONFIRMABLE = False  # local login: users can confirm e-mail address
 SECURITY_LOGIN_WITHOUT_CONFIRMATION = True  # require users to confirm email before being able to login
 
+ACCOUNTS_USERNAME_REGEX = r"^[a-zA-Z0-9-_:.+]{1,255}@?[a-zA-Z0-9-_:.+]{1,255}$"
+"""Allows all supported `sub` values from CERN Auth.
+
+See the full list of examples: https://auth.docs.cern.ch/user-documentation/oidc/config/#non-cern-account-examples.
+
+  - CERN usernames (`mcurie`)
+  - Social login identifiers (`1118564@google`, `9158807@edugain.ch`) which look like email addresses but aren't necessarily valid
+  - Guest email addresses (`guest:pablo.picasso@example.com`) which is simply the guest's full email prefixed with `guest:`
+"""
+
+ACCOUNTS_USERNAME_RULES_TEXT = _(
+    "Please use either a CERN username, a guest email address, or a social login identifier."
+)
+
 # Emails sending
 # Disable sending all account-related emails because of CERN SSO usage
 SECURITY_SEND_PASSWORD_CHANGE_EMAIL = False