Run a bash script ONLY after user has logged in once on the machine, then allow script to be run at each log in attempt

I am writing facial recognition to be used for login on Ubuntu. As it stands, I have a bash script which is called whenever an attempt is made to login ie at the Ubuntu login screen. This script, calls a python3 script which returns success/failure depending on whether the not the face is recognised - all good here

My current problem is , the script does not work unless I login and type xhost +. I've done research on this and decided I can do one of two things to fix the problem.

1 - Disable facial recognition on the first login attempt

2- Hardcode xhost + into /etc/profile (bad idea)

The main question here is, is there any way of keeping track if the user has logged in and hiding the script until this happens ? ie like most smartphones do , only allow password authentication for the first login ?

bash script below I have written

#xhost +
export DISPLAY=:0

var1="success"
var=$(/path/to/file/pam_detect.py)

exit_status=$? # This grabs the exit status of the python script we just ran
if [ "${exit_status}" -ne 0 ]; # checks to see if exit status is anything other 
then
    echo "exit ${exit_status}"
    exit 1 # exit status 1 on python script fail (exit 1)
fi

if [ "$var" == "$var1" ]; then
    #echo "exit 0"
    exit 0
else
    #echo "exit 1"
    exit 1
fi

This is called my my /etc/pam.d/common-auth file , using pam exec.so (which gets called when the user attempts login)