"""Cloudflare Turnstile verification. Bypasses in dev when no secret is set."""
import requests
from flask import current_app, request

_VERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify"


def turnstile_enabled() -> bool:
    return bool(current_app.config.get("TURNSTILE_SECRET_KEY"))


def verify_turnstile() -> bool:
    """Validate the cf-turnstile-response token from the current request form."""
    secret = current_app.config.get("TURNSTILE_SECRET_KEY")
    if not secret:
        return True  # dev bypass

    token = request.form.get("cf-turnstile-response", "")
    if not token:
        return False
    try:
        resp = requests.post(
            _VERIFY_URL,
            data={
                "secret": secret,
                "response": token,
                "remoteip": request.remote_addr,
            },
            timeout=10,
        )
        return bool(resp.json().get("success"))
    except Exception as exc:  # noqa: BLE001
        current_app.logger.error("Turnstile verify failed: %s", exc)
        return False