<?php
header("Content-Type: application/json");

$SECRET_KEY = "0x4AAAAAACM4pYfoEOuPyDIvrrDSY0vqM5Y";

$input = json_decode(file_get_contents("php://input"), true);
$token = $input["token"] ?? null;

if (!$token) {
    echo json_encode(["success" => false, "error" => "missing-token"]);
    exit;
}

$data = http_build_query([
    "secret" => $SECRET_KEY,
    "response" => $token,
    "remoteip" => $_SERVER["REMOTE_ADDR"]
]);

$context = stream_context_create([
    "http" => [
        "method"  => "POST",
        "header"  => "Content-Type: application/x-www-form-urlencoded\r\n",
        "content" => $data
    ]
]);

$response = file_get_contents(
    "https://challenges.cloudflare.com/turnstile/v0/siteverify",
    false,
    $context
);

$result = json_decode($response, true);

echo json_encode([
    "success" => $result["success"] ?? false,
    "error-codes" => $result["error-codes"] ?? []
]);
?>