Only allow oauth login against current login method

There's probably a needed frontend change here too, but can handle that after the fact

apps/core/lib/core/services/users.ex

@@ -373,8 +373,9 @@ defmodule Core.Services.Users do
         |> Map.merge(login_args(service))
         |> Map.put(:password, Ecto.UUID.generate())
         |> create_user()
-      %User{} = user ->
+      %User{login_method: ^service} = user ->
         update_user(login_args(service), user)
+      _ -> {:error, "you don't have login with #{service} enabled"}
     end
   end
 

apps/core/test/services/accounts_test.exs

@@ -335,7 +335,7 @@ defmodule Core.Services.AccountsTest do
       assert invite.user_id == user.id
     end
 
-    test "nonroot users can create group members", %{account: account} do
+    test "nonroot users cannot create group members", %{account: account} do
       {:error, _} = Accounts.create_invite(%{email: "[email protected]"}, insert(:user, account: account))
     end
   end

apps/core/test/services/users_test.exs

@@ -524,13 +524,19 @@ defmodule Core.Services.UsersTest do
     end
 
     test "it will update login method for existing users" do
-      user = insert(:user)
+      user = insert(:user, login_method: :google)
 
       {:ok, upd} = Users.bootstrap_user(:google, %{email: user.email})
 
       assert upd.id == user.id
       assert upd.login_method == :google
     end
+
+    test "it will not allow logins w/o login method set" do
+      user = insert(:user)
+
+      {:error, _} = Users.bootstrap_user(:google, %{email: user.email})
+    end
   end
 
   describe "#create_trust_relationship" do