According to the official documentation on precautions and the example account linking with actions, when linking accounts using an external custom application, I should ask the user to authenticate with another identity to ensure they own both accounts.
However, what should I do if a user logs in with a new identity (e.g., Facebook) and I find another account with the same email that already includes two linked identities: the primary identity being login/password and the secondary identity being Google? I want to link this new Facebook identity under the login/password identity (to have one account with login/password primary identity and two secondary identities Google and Facebook ). Should I ask the user to authenticate with both the login/password and Google identities to verify ownership, or is it sufficient to require authentication only for the login/password identity, since the login/password and Google identities have already been linked in the past?