[cklemming]

This.

We've implemented a convoluted solution for this where - if the OAuth user does not exist but the OAuth email is in use by a password-based user - the following happens.

1. We prompt user to authenticate with their password.

2. Once successfully authenticated, we link the OAuth auth method to their user to be used in parallel with a password-based login.

Not every Auth provider might support linking multiple Auth methods to a single user, we use Firebase Auth and for us this works fine. We even support multiple OAuth options (FB, Google) and do the same matching between the providers.