package com.prudas.app.service;

import com.prudas.app.config.AppProperties;
import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j;
import org.springframework.stereotype.Component;
import org.springframework.web.client.RestClient;

import java.util.Map;

/**
 * Server-side verification of a Google reCAPTCHA v3 token. Disabled by
 * default (app.recaptcha.enabled=false) so the project runs out of the box
 * without external credentials; enable it and set RECAPTCHA_SECRET_KEY once
 * you've registered a site key for your domain.
 */
@Component
@RequiredArgsConstructor
@Slf4j
public class RecaptchaClient {

    private static final String VERIFY_URL = "https://www.google.com/recaptcha/api/siteverify";

    private final AppProperties appProperties;
    private final RestClient restClient = RestClient.create();

    public boolean isHuman(String token) {
        if (!appProperties.recaptcha().enabled()) {
            return true; // reCAPTCHA not configured for this deployment
        }
        if (token == null || token.isBlank()) {
            return false;
        }
        try {
            @SuppressWarnings("unchecked")
            Map<String, Object> response = restClient.post()
                    .uri(VERIFY_URL + "?secret={secret}&response={token}", appProperties.recaptcha().secretKey(), token)
                    .retrieve()
                    .body(Map.class);

            if (response == null) {
                return false;
            }
            boolean success = Boolean.TRUE.equals(response.get("success"));
            double score = response.get("score") instanceof Number n ? n.doubleValue() : 0.0;
            return success && score >= appProperties.recaptcha().minScore();
        } catch (Exception ex) {
            log.warn("reCAPTCHA verification call failed, treating as not-human", ex);
            return false;
        }
    }
}