<?php

namespace App\Rules;

use Closure;
use Illuminate\Contracts\Validation\ValidationRule;
use Illuminate\Support\Facades\Http;
use Illuminate\Support\Facades\Request;

/**
 * Verifies a Cloudflare Turnstile response token server-side. A no-op when
 * services.turnstile.secret_key isn't configured, so environments without
 * Turnstile keys (local, CI) aren't blocked.
 */
class Turnstile implements ValidationRule
{
    public function validate(string $attribute, mixed $value, Closure $fail): void
    {
        $secret = config('services.turnstile.secret_key');

        if (blank($secret)) {
            return;
        }

        if (blank($value)) {
            $fail(__('Please complete the verification challenge.'));

            return;
        }

        $response = Http::asForm()->post('https://challenges.cloudflare.com/turnstile/v0/siteverify', [
            'secret' => $secret,
            'response' => $value,
            'remoteip' => Request::ip(),
        ]);

        if (! $response->json('success', false)) {
            $fail(__('The verification challenge failed. Please try again.'));
        }
    }
}