package turnstile

import (
	"encoding/json"
	"net/http"
	"net/url"

	"github.com/spf13/viper"
)

func VerifyTurnstile(token, ip string) (bool, error) {
	form := url.Values{}
	form.Set("secret", viper.GetString("secrets.turnstile_secret"))
	form.Set("response", token)
	form.Set("remoteip", ip)

	resp, err := http.PostForm(
		"https://challenges.cloudflare.com/turnstile/v0/siteverify",
		form,
	)
	if err != nil {
		return false, err
	}
	defer resp.Body.Close()

	var result struct {
		Success bool `json:"success"`
	}
	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
		return false, err
	}

	return result.Success, nil
}