<?php
/**
 * Cloudflare Turnstile Validation for Contact Forms
 *
 * @package Contact Forms
 * @subpackage Validation
 * @since 1.9.14
 */

// phpcs:disable WordPress.Security.NonceVerification, WordPress.Security.ValidatedSanitizedInput -- Server-side CAPTCHA validation requires POST data

class AccuaForm_Validation_Turnstile extends Validation {
	protected $message = 'Please verify you are not a robot.';
	protected $secretKey;

	public function isValid( $value ) {
		// Check if user is whitelisted (from Turnstile plugin).
		if ( function_exists( 'cfturnstile_whitelisted' ) && cfturnstile_whitelisted() ) {
			return true;
		}

		// Check if widget is disabled via filter.
		// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Hook from Simple Cloudflare Turnstile plugin
		if ( function_exists( 'apply_filters' ) && apply_filters( 'cfturnstile_widget_disable', false ) ) {
			return true;
		}

		// Check for Turnstile response.
		if ( ! isset( $_POST['cf-turnstile-response'] ) || empty( $_POST['cf-turnstile-response'] ) ) {
			return false;
		}

		$response = stripslashes_deep( $_POST['cf-turnstile-response'] );

		if ( '' === $response ) {
			return false;
		}

		// Use Turnstile plugin's verification function if available.
		if ( function_exists( 'cfturnstile_check' ) ) {
			$check = cfturnstile_check( $response );

			if ( $check && isset( $check['success'] ) && true === $check['success'] ) {
				return true;
			}

			// Update error message if custom message is available.
			if ( function_exists( 'cfturnstile_failed_message' ) ) {
				$custom_message = cfturnstile_failed_message();
				if ( ! empty( $custom_message ) ) {
					$this->message = $custom_message;
				}
			}

			return false;
		}

		// Fallback: Direct verification if Turnstile plugin is not available.
		if ( empty( $this->secretKey ) ) {
			return false;
		}

		$verify_url = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';

		$verify_data = array(
			'secret'   => $this->secretKey,
			'response' => $response,
			'remoteip' => isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '',
		);

		$response_obj = wp_remote_post(
			$verify_url,
			array(
				'body'    => $verify_data,
				'timeout' => 20,
			)
		);

		if ( is_wp_error( $response_obj ) ) {
			return false;
		}

		$body   = wp_remote_retrieve_body( $response_obj );
		$result = json_decode( $body, true );

		if ( ! empty( $result['success'] ) ) {
			return true;
		}

		return false;
	}
}