OAuth users are asked for their current password when trying to set a local password for the first time

Description:

Users who registered via OAuth SSO might want to create a password for direct login with RC later on. If they try to do so via My Account -> Profile, they are presented with text fields to enter a new password, but upon submitting are asked to enter their current password as confirmation, which they do not have yet.

Steps to reproduce:

1. Activate OAuth SSO via some provider (e.g. Google)
2. Register a new Account via OAuth SSO and login to that account
3. Go to My Account -> Profile
4. Try to enter a new password (which would be the first password for that user) and the confirmation and submit

Expected behavior:

New password should submit and be set without asking for the current one as confirmation, since the user hasn't set a password yet, or fields for entering a new password should be deactivated for OAuth users.

Actual behavior:

Server asks for current password as confirmation, which is not known to the user.

Server Setup Information:

• Version of Rocket.Chat Server: 3.13.2
• Operating System: Ubuntu 20.04
• Deployment Method: snap
• Number of Running Instances: 1
• NodeJS Version: v12.21.0
• MongoDB Version: 3.6.14 / wiredTiger (oplog Enabled)

Client Setup Information

• Browser Version: Firefox 88.0.1 (64-bit)
• Operating System: Windows 10

Additional context

Admin-option Enforce password fallback under Accounts -> Two Factor Authentication is turned off

Workarounds

• Have an admin send a new (temporary) password to the user via email
• Forgot password option (not tested, but think that should work)

Start by reproducing the OAuth registration flow, then inspect the My Account → Profile password-setting path and how it handles users without an existing password. Done means an OAuth user can set a first local password without a nonexistent current-password confirmation, or the new-password fields are disabled for OAuth users.