fix(dex): passwordName must match Dex's internal passwordID() — maps non-[a-z0-9-] to '-'

Tapir used human-readable substitutions ('@' -> '-at-', '.' -> '-dot-') when
deriving the Password CR name from an email. Dex's internal passwordID() maps
every non-[a-z0-9-] character to plain '-'. This caused a name mismatch:
Tapir wrote the CR as 'mathias-at-d-ma-dot-be', Dex looked it up as
'mathias-d-ma-be', got not-found, and returned 'Invalid credentials' on every
invite login — while static configmap passwords (a different code path) worked
fine. Diagnosed by adding the email to staticPasswords and confirming login
succeeded, proving the kubernetes CR lookup was the failure point.

internal/adapters/dex/dex.go

@@ -23,7 +23,6 @@ import (
 	"io"
 	"net/http"
 	"os"
-	"regexp"
 	"strings"
 	"time"
 )
@@ -158,22 +157,25 @@ func (c *PasswordClient) CreatePassword(ctx context.Context, email, bcryptHash,
 	}
 }
 
-// invalidNameChars matches anything not allowed in an RFC-1123 subdomain segment
-// after the explicit @/. substitutions, so any stray character becomes '-'.
-var invalidNameChars = regexp.MustCompile(`[^a-z0-9-]`)
-
-// passwordName maps an email to a valid, deterministic Kubernetes object name:
-// lowercase, '@' -> '-at-', '.' -> '-dot-', any remaining invalid char -> '-',
-// with leading/trailing '-' trimmed. Deterministic so a re-invite targets the
-// same CR (and so Dex's 409 is meaningful).
+// passwordName maps an email to the Kubernetes object name Dex uses internally
+// when looking up a Password CR by email (Dex storage/kubernetes passwordID()).
+// Dex maps every character that is not [a-z0-9-] to '-' — it does NOT use
+// human-readable substitutions like '-at-' or '-dot-'. Using a different scheme
+// creates a name mismatch: Tapir writes the CR under one name, Dex looks it up
+// under another, and every login returns "Invalid credentials".
 func passwordName(email string) string {
 	n := strings.ToLower(strings.TrimSpace(email))
-	n = strings.ReplaceAll(n, "@", "-at-")
-	n = strings.ReplaceAll(n, ".", "-dot-")
-	n = invalidNameChars.ReplaceAllString(n, "-")
-	n = strings.Trim(n, "-")
-	if n == "" {
-		n = "user"
+	var b strings.Builder
+	for _, r := range n {
+		if (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') || r == '-' {
+			b.WriteRune(r)
+		} else {
+			b.WriteRune('-')
+		}
 	}
-	return n
+	result := strings.Trim(b.String(), "-")
+	if result == "" {
+		return "user"
+	}
+	return result
 }

internal/adapters/dex/dex_test.go

@@ -42,7 +42,7 @@ func TestCreatePasswordSuccess(t *testing.T) {
 	require.Equal(t, "New.User@Example.com", gotBody.Email)
 	require.Equal(t, "New.User@Example.com", gotBody.Username)
 	require.Equal(t, "user-uuid-1", gotBody.UserID)
-	require.Equal(t, "new-dot-user-at-example-dot-com", gotBody.Metadata["name"])
+	require.Equal(t, "new-user-example-com", gotBody.Metadata["name"])
 	require.Equal(t, "auth", gotBody.Metadata["namespace"])
 
 	// Hash is stored as the raw bcrypt string — Dex compares it directly.
@@ -90,10 +90,14 @@ func TestNewPasswordClientNotInCluster(t *testing.T) {
 }
 
 func TestPasswordName(t *testing.T) {
+	// Must match Dex's internal passwordID() — maps every non-[a-z0-9-] to '-'.
+	// Using a different scheme (e.g. '-at-', '-dot-') causes a name mismatch:
+	// Tapir writes the CR under one name, Dex looks it up under another.
 	cases := map[string]string{
-		"Alice@Example.com": "alice-at-example-dot-com",
-		"a.b+c@gmail.com":   "a-dot-b-c-at-gmail-dot-com",
-		"UPPER@DOMAIN.IO":   "upper-at-domain-dot-io",
+		"Alice@Example.com": "alice-example-com",
+		"a.b+c@gmail.com":   "a-b-c-gmail-com",
+		"UPPER@DOMAIN.IO":   "upper-domain-io",
+		"mathias@d-ma.be":   "mathias-d-ma-be",
 	}
 	for in, want := range cases {
 		require.Equal(t, want, passwordName(in), in)