<?php
/**
 * Cap 验证码后端验证 - PHP
 *
 * 环境变量: CAPTCHA_SECRET_KEY=sk-your-secret-key
 */

$CAP_SERVER = getenv('CAP_SERVER') ?: 'https://cap.tokengx.cn';
$CAP_SECRET = getenv('CAPTCHA_SECRET_KEY');

/**
 * 验证 Cap 验证码 Token
 *
 * @param string $token 前端获取的验证码 Token
 * @return array ['success' => bool, 'error' => string|null]
 */
function verifyCaptcha($token) {
    global $CAP_SERVER, $CAP_SECRET;

    if (!$CAP_SECRET) {
        error_log('CAPTCHA_SECRET_KEY 环境变量未设置');
        return ['success' => false, 'error' => 'server-config-error'];
    }

    if (!$token) {
        return ['success' => false, 'error' => 'missing-token'];
    }

    $response = @file_get_contents($CAP_SERVER . '/siteverify', false, stream_context_create([
        'http' => [
            'method' => 'POST',
            'header' => "Content-Type: application/json\r\n",
            'content' => json_encode([
                'response' => $token,
                'secret' => $CAP_SECRET,
            ]),
            'timeout' => 10,
        ],
    ]));

    if ($response === false) {
        error_log('Cap siteverify 请求失败');
        return ['success' => false, 'error' => 'network-error'];
    }

    $data = json_decode($response, true);
    return ['success' => ($data['success'] ?? false) === true];
}

// ─── 使用示例 ────────────────────────────────────────────────

/*
// api/login.php 或 Laravel Controller

$captchaToken = $_POST['captchaToken'] ?? '';

$result = verifyCaptcha($captchaToken);
if (!$result['success']) {
    http_response_code(400);
    echo json_encode([
        'success' => false,
        'error' => '人机验证失败，请重试'
    ]);
    exit;
}

// 处理登录逻辑...
echo json_encode(['success' => true]);
*/
?>
