/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

var PASSWORD_CHECKING_ACTION = {
  accountLogin: true,
  accountDestroy: true,
  passwordChange: true,
}

var ACCOUNT_STATUS_ACTION = {
  accountStatusCheck: true
}

var EMAIL_SENDING_ACTION = {
  accountCreate: true,
  recoveryEmailResendCode: true,
  passwordForgotSendCode: true,
  passwordForgotResendCode: true
}

module.exports = {

  isPasswordCheckingAction: function isPasswordCheckingAction(action) {
    return PASSWORD_CHECKING_ACTION[action]
  },

  isAccountStatusAction: function isAccountStatusAction(action) {
    return ACCOUNT_STATUS_ACTION[action]
  },

  isEmailSendingAction: function isEmailSendingAction(action) {
    return EMAIL_SENDING_ACTION[action]
  }

}

@@ -199,16 +199,121 @@
 0/. */%0A%0A
+// Actions that, if allowed, would allow an attacker%0A// to try a candidtate password against an account.%0A
 var PASS
@@ -414,67 +414,531 @@
 %0A%7D%0A%0A
-var ACCOUNT_STATUS_ACTION = %7B%0A  accountStatusCheck: true%0A%7D%0A
+// Actions that, if allowed, would allow an attacker%0A// to check whether an account exists for a particular user.%0A// Basically any unauthenticated endpoint that takes%0A// an email address as input.%0Avar ACCOUNT_STATUS_ACTION = %7B%0A  accountCreate: true,%0A  accountLogin: true,%0A  accountDestroy: true,%0A  accountLock: true,%0A  accountUnlockResendCode: true,%0A  passwordChange: true,%0A  passwordForgotSendCode: true,%0A  accountStatusCheck: true%0A%7D%0A%0A// Actions that send an email, and hence might make%0A// us look like spammers if abused.
 %0Avar
@@ -986,16 +986,49 @@
 : true,%0A
+  accountUnlockResendCode: true,%0A
   recove

Include more action names in various checks.