<?php

declare(strict_types=1);

/**
 * CAPTCHA / challenge configuration.
 *
 * The self-hosted "puzzle" provider is the default and requires no external
 * keys, so a fresh install works immediately. reCAPTCHA, hCaptcha and Turnstile
 * are pluggable alternatives configured with their site/secret keys.
 */

return [
    // Active provider: puzzle | recaptcha | hcaptcha | turnstile
    'provider' => env('CAPTCHA_PROVIDER', 'puzzle'),

    'recaptcha' => [
        'site_key' => env('RECAPTCHA_SITE_KEY', ''),
        'secret'   => env('RECAPTCHA_SECRET', ''),
        'verify_url' => 'https://www.google.com/recaptcha/api/siteverify',
    ],

    'hcaptcha' => [
        'site_key' => env('HCAPTCHA_SITE_KEY', ''),
        'secret'   => env('HCAPTCHA_SECRET', ''),
        'verify_url' => 'https://hcaptcha.com/siteverify',
    ],

    'turnstile' => [
        'site_key' => env('TURNSTILE_SITE_KEY', ''),
        'secret'   => env('TURNSTILE_SECRET', ''),
        'verify_url' => 'https://challenges.cloudflare.com/turnstile/v0/siteverify',
    ],

    // Puzzle tuning: a solve faster than this (ms) is suspicious (bot-like),
    // slower than max is treated as human/idle.
    'puzzle' => [
        'min_solve_ms' => 350,
        'max_retries'  => 3,
    ],
];
