33 lines
1.2 KiB
PHP
33 lines
1.2 KiB
PHP
|
<?php
|
||
|
|
declare(strict_types=1);
|
||
|
|
|
||
|
|
/** Optional Cloudflare Turnstile verification. Only enforced when TURNSTILE_SECRET_KEY is set. */
|
||
|
|
final class Turnstile
|
||
|
|
{
|
||
|
|
public static function enabled(): bool
|
||
|
|
{
|
||
|
|
return Config::get('TURNSTILE_SECRET_KEY') !== null;
|
||
|
|
}
|
||
|
|
|
||
|
|
public static function verify(?string $token, string $ip): bool
|
||
|
|
{
|
||
|
|
if (!self::enabled()) {
|
||
|
|
return true;
|
||
|
|
}
|
||
|
|
if (!$token) {
|
||
|
|
return false;
|
||
|
|
}
|
||
|
|
$res = Http::request('POST', 'https://challenges.cloudflare.com/turnstile/v0/siteverify', http_build_query([
|
||
|
|
'secret' => Config::require('TURNSTILE_SECRET_KEY'),
|
||
|
|
'response' => $token,
|
||
|
|
'remoteip' => $ip,
|
||
|
|
]), ['Content-Type' => 'application/x-www-form-urlencoded'], 6);
|
||
|
|
if ($res['error'] !== null || $res['status'] !== 200) {
|
||
|
|
// Fail open on provider outage so real visitors are never blocked; honeypot + rate limit still apply.
|
||
|
|
Log::warn('Turnstile verification unavailable', ['status' => $res['status'], 'error' => $res['error']]);
|
||
|
|
return true;
|
||
|
|
}
|
||
|
|
return (bool)($res['json']['success'] ?? false);
|
||
|
|
}
|
||
|
|
}
|