This is a classic dilemma in authentication design, but the industry-standard solution is to decouple the concept of a password from the concept of an account. When a user tries to reset a password for a social-only account, the most user-friendly approach is to send them an email explaining that they signed up via Google and provide a link to log in that way instead. If you want to allow them to create a password later, your system should trigger a set password flow that adds a credential to their existing profile without breaking the link to their identity provider. This keeps the user experience clean while preventing the frustration of an endless loop. It essentially treats the social login as the primary authentication method while leaving the door open for a traditional email and password fallback if the user eventually decides they want one.

The OAuth identity crisis is a common conundrum many developers face when dealing with passwordless authentication methods like "Login with Google." The issue arises because OAuth doesn't actually store a password, so when a user requests a password reset, it's like asking to reset a credential that never existed in the first place. In this scenario, the best approach is to redirect the user to the OAuth provider's password reset flow, allowing them to reset their Google account password, which in turn will update their OAuth credentials. This way, you're not trying to reset a non-existent password, but rather updating the underlying credentials that power the OAuth flow. It's a subtle distinction, but an important one when designing passwordless authentication systems.

That is a classic friction point in modern app development, and the best approach is to decouple your password reset flow from your primary authentication logic. Instead of trying to reset a nonexistent password, you should verify the user via their email address and then offer them the option to set a local password if they want to move away from third-party providers. If they attempt to use a "Forgot Password" link while having only an OAuth account, your system should detect that status and gracefully prompt them to log in via Google instead. You can also send them an automated email explaining that they never created a password, which helps clear up any confusion about why the reset process is not triggering. By handling this edge case with a clear explanation, you prevent user frustration while keeping your security model consistent.