package captcha

/**
 * Cap 验证码后端验证 - Go
 *
 * 环境变量: CAPTCHA_SECRET_KEY=sk-your-secret-key
 */

import (
	"bytes"
	"encoding/json"
	"fmt"
	"net/http"
	"os"
	"time"
)

var (
	capServer = getEnvOrDefault("CAP_SERVER", "https://cap.tokengx.cn")
	capSecret = os.Getenv("CAPTCHA_SECRET_KEY")
)

func getEnvOrDefault(key, defaultVal string) string {
	if val := os.Getenv(key); val != "" {
		return val
	}
	return defaultVal
}

// CaptchaResult 验证结果
type CaptchaResult struct {
	Success bool   `json:"success"`
	Error   string `json:"error,omitempty"`
}

// siteverify 请求体
type verifyRequest struct {
	Response string `json:"response"`
	Secret   string `json:"secret"`
}

// siteverify 响应体
type verifyResponse struct {
	Success bool `json:"success"`
}

// VerifyCaptcha 验证 Cap 验证码 Token
func VerifyCaptcha(token string) CaptchaResult {
	if capSecret == "" {
		fmt.Println("错误: CAPTCHA_SECRET_KEY 环境变量未设置")
		return CaptchaResult{Success: false, Error: "server-config-error"}
	}

	if token == "" {
		return CaptchaResult{Success: false, Error: "missing-token"}
	}

	reqBody, _ := json.Marshal(verifyRequest{
		Response: token,
		Secret:   capSecret,
	})

	client := &http.Client{Timeout: 10 * time.Second}
	resp, err := client.Post(
		capServer+"/siteverify",
		"application/json",
		bytes.NewBuffer(reqBody),
	)
	if err != nil {
		fmt.Printf("Cap siteverify error: %v\n", err)
		return CaptchaResult{Success: false, Error: "network-error"}
	}
	defer resp.Body.Close()

	var result verifyResponse
	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
		return CaptchaResult{Success: false, Error: "decode-error"}
	}

	return CaptchaResult{Success: result.Success}
}

// ─── Gin 使用示例 ────────────────────────────────────────────

/*
package main

import (
	"net/http"
	"github.com/gin-gonic/gin"
)

type LoginRequest struct {
	Username     string `json:"username" binding:"required"`
	Password     string `json:"password" binding:"required"`
	CaptchaToken string `json:"captchaToken" binding:"required"`
}

func loginHandler(c *gin.Context) {
	var req LoginRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"success": false, "error": "参数错误"})
		return
	}

	result := VerifyCaptcha(req.CaptchaToken)
	if !result.Success {
		c.JSON(http.StatusBadRequest, gin.H{
			"success": false,
			"error":   "人机验证失败，请重试",
		})
		return
	}

	// 处理登录逻辑...
	c.JSON(http.StatusOK, gin.H{"success": true})
}

func main() {
	r := gin.Default()
	r.POST("/api/login", loginHandler)
	r.Run(":8080")
}
*/
