<?php
declare(strict_types=1);

final class Turnstile
{
    private const VERIFY_URL = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';

    public static function verify(string $token, string $secretKey, string $remoteIp): bool
    {
        if ($token === '' || $secretKey === '') {
            return false;
        }

        $payload = http_build_query([
            'secret' => $secretKey,
            'response' => $token,
            'remoteip' => $remoteIp,
        ]);

        $context = stream_context_create([
            'http' => [
                'method' => 'POST',
                'header' => "Content-Type: application/x-www-form-urlencoded\r\n",
                'content' => $payload,
                'timeout' => 8,
            ],
        ]);

        $response = @file_get_contents(self::VERIFY_URL, false, $context);
        if ($response === false) {
            return false;
        }

        $data = json_decode($response, true);
        return is_array($data) && ($data['success'] ?? false) === true;
    }
}