import httpx
from .config import get_settings

settings = get_settings()

CAPTCHA_VERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify"


async def verify_captcha(token: str, remote_ip: str | None = None) -> bool:
    payload = {
        "secret": settings.captcha_secret.get_secret_value(),
        "response": token,
    }
    if remote_ip:
        payload["remoteip"] = remote_ip

    async with httpx.AsyncClient(timeout=10.0) as client:
        response = await client.post(CAPTCHA_VERIFY_URL, data=payload)
        # Cloudflare returns a JSON body describing success/failure even on
        # non-2xx responses (e.g. a bad secret or expired token) - treat
        # that as "verification failed" rather than raising on the status.
        body = response.json()

    return bool(body.get("success"))