<?php
/**
 * includes/recaptcha.php — Google reCAPTCHA v3 verification.
 * No Composer dependency: uses file_get_contents() with a POST stream context,
 * matching the no-dependency style of includes/mailer.php.
 */

/** True if reCAPTCHA is turned on and a site key is configured. */
function recaptcha_enabled(): bool {
    return get_setting('recaptcha_enabled', '0') === '1' && get_setting('recaptcha_site_key') !== '';
}

/**
 * Verify a reCAPTCHA v3 token against Google's siteverify endpoint.
 * Returns true only if the request succeeded and the score meets $min_score.
 */
function verify_recaptcha(string $token, float $min_score = 0.5): bool {
    $secret = get_setting('recaptcha_secret_key');
    if ($secret === '' || $token === '') return false;

    $post_data = http_build_query([
        'secret'   => $secret,
        'response' => $token,
        'remoteip' => $_SERVER['REMOTE_ADDR'] ?? '',
    ]);

    $context = stream_context_create([
        'http' => [
            'method'  => 'POST',
            'header'  => "Content-Type: application/x-www-form-urlencoded\r\n",
            'content' => $post_data,
            'timeout' => 10,
        ],
    ]);

    try {
        $response = @file_get_contents('https://www.google.com/recaptcha/api/siteverify', false, $context);
        if ($response === false) return false;

        $result = json_decode($response, true);
        if (!is_array($result)) return false;

        return !empty($result['success']) && (float)($result['score'] ?? 0) >= $min_score;
    } catch (Throwable $e) {
        error_log('reCAPTCHA verify error: ' . $e->getMessage());
        return false;
    }
}