import logging

import httpx

from app.core.config import get_settings


log = logging.getLogger(__name__)
VERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify"


def verify_turnstile(token: str, remote_ip: str | None = None) -> bool:
    settings = get_settings()
    if not settings.turnstile_secret_key or not token:
        return False
    try:
        response = httpx.post(
            VERIFY_URL,
            data={
                "secret": settings.turnstile_secret_key,
                "response": token,
                "remoteip": remote_ip or "",
            },
            timeout=10,
        )
        result = response.json()
    except (httpx.HTTPError, ValueError):
        log.exception("No fue posible consultar Turnstile")
        return False
    hostname = str(result.get("hostname") or "").lower()
    valid_host = hostname in settings.turnstile_hostnames
    if not result.get("success") or not valid_host:
        log.warning("Turnstile rechazado: host=%s codes=%s", hostname, result.get("error-codes", []))
        return False
    return True