Ratcheting search : Does it return 0 or 1 result on a user's first login?

When a user logs in for the first time with any IdP and Auth0 runs the force-users-login-most-secure-method.js rules, does this piece of code execute because the search for auth0 profiles with the same email address comes back empty? Or does that search always produce at least one result, which is the profile of the user that is in the login process right now?

If it's the latter does that mean that this piece of code never actually executes because at least one search result is always returned?

If so, what do you think about changing this piece of code to deny the user access instead of permitting them. The rationale would be that this is a code path we never expect to execute and so if it does something unexpected is happening and we should probably deny access just to be safe.

Start in rules/force-users-login-most-secure-method.js, especially the profile search at lines 62-65 and the fallback at lines 101-103. Verify Auth0's first-login search behavior for each IdP and determine whether the fallback can execute. Done means the result is documented and, if the proposed policy is accepted, the fallback behavior is changed accordingly.