<?php
namespace Zadex\Forms;

defined('ABSPATH') || exit;

/**
 * Google reCAPTCHA v2 (checkbox) / v3 (score) verification through `wp_remote_post` (stubbed in tests).
 * Keys live in the plugin settings (`recaptcha_site_key`, `recaptcha_secret`, Zadex > Settings); the secret
 * is never printed. v3 tokens must score at least `zadex/forms/recaptcha_threshold` (default 0.5).
 */
final class Recaptcha
{
    public const VERIFY_URL = 'https://www.google.com/recaptcha/api/siteverify';

    public static function verify(string $token, string $secret, string $version, string $ip = ''): bool
    {
        if ($token === '' || $secret === '') {
            return false;
        }
        $response = wp_remote_post(self::VERIFY_URL, [
            'timeout' => 10,
            'body'    => array_filter(['secret' => $secret, 'response' => $token, 'remoteip' => $ip]),
        ]);
        if (is_wp_error($response)) {
            return false;
        }
        $body = json_decode((string) wp_remote_retrieve_body($response), true);
        if (!is_array($body) || empty($body['success'])) {
            return false;
        }
        if ($version === 'v3') {
            $threshold = (float) apply_filters('zadex/forms/recaptcha_threshold', 0.5);
            $score = isset($body['score']) && is_numeric($body['score']) ? (float) $body['score'] : 0.0;
            if ($score < $threshold) {
                return false;
            }
            if (isset($body['action']) && $body['action'] !== 'submit') {
                return false;
            }
        }
        return true;
    }
}