Issue with automatic identity linking

Start with the identity-linking FAQ and reproduce the OAuth-then-password recovery/update flow described in the issue, comparing auth.users.raw_app_meta_data and auth.identities with the inverse signup flow. Trace the authentication identity-linking implementation in this Go repository; done means the email provider appears in both records and the dashboard's providers list matches the inverse flow.

Bug report

• [ x] I confirm this is a bug with Supabase, not with my own application.
• [ x] I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

Email provider metadata is not updated and identities table not updated when adding email provider to an existing OAuth account. This behaviour is described in the FAQ of the identity linking documentation.

https://supabase.com/docs/guides/auth/auth-identity-linking#how-to-add-emailpassword-login-to-an-oauth-account)

To Reproduce

1. Create an OAuth user ( tested with Google / Apple )
2. Perform a password recovery / update on the email matching the OAuth user

The behaviour is described in the FAQ of the documentation

https://supabase.com/docs/guides/auth/auth-identity-linking#how-to-add-emailpassword-login-to-an-oauth-account)

It is possible to login now with email / password in addition to the OAuth provider. However the implementation seems to be partial.

The raw_app_meta_data column in the auth.users table is not updated with the additional email provider and also there is no additional entry in the auth.identities table for the e-mail provider. As a result the providers column in the Authentication screen is only showing the Apple / Google logo although there is also an email provider configured now for this user.

The raw_app_meta_data column still looks like this although email provider was added:

{"provider": "google", "providers": ["google"]}

Expected behavior

The expected automatic linking behavior should be the same when you do the inverse signup flow:

1. First create a user using the email provider ( normal email / password user )
2. For that user, also do an Oauth signup ( Google / Apple ).

In this case, the raw_app_meta_data column in the auth.users table is updated with the OAuth provider and also an additional row is created in the auth.identities table for the adiditional OAuth provider. Also the providers column in the Authentication screen is correctly showing 2 providers ( email + Google / Apple ).

The raw_app_meta_data is updated when Oauth provider (e.g. Google ) was added in addition to email.

{"provider": "google", "providers": ["google", "email"]}

Screenshots

If applicable, add screenshots to help explain your problem.

System information

Tested with both Kotlin and Swift Auth libraries

Additional context

Add any other context about the problem here.