botcheck

type AnswerStore interface {
	// Use records challengeID as answered for endpoint, kept until expires,
	// and reports false when it was answered before.
	Use(ctx context.Context, challengeID, endpoint string, expires time.Time) (bool, error)
	// Recent counts the challenges endpoint had answered since since.
	Recent(ctx context.Context, endpoint string, since time.Time) (int, error)
	// Sweep deletes the answers whose challenge expired before now.
	Sweep(ctx context.Context, now time.Time) (int64, error)
}

type Challenge struct {
	// Provider is pow, turnstile, hcaptcha or none.
	Provider string `json:"provider" example:"pow"`
	// Token is the proof-of-work challenge; the answer is Token~counter, the
	// counter whose SHA-256 of Token~counter has Difficulty leading zero bits.
	Token      string `json:"token,omitempty"`
	Difficulty int    `json:"difficulty,omitempty"`
	// SiteKey is the Turnstile or hCaptcha widget's site key; the answer is
	// the token the widget produces.
	SiteKey   string    `json:"site_key,omitempty"`
	ExpiresAt time.Time `json:"expires_at,omitzero"`
}

type Checker struct {
	Settings SettingsStore
	Answers  AnswerStore
	// Key signs proof-of-work challenges; nil leaves the deployment unable to
	// issue one.
	Key []byte
	// Secret reads the stored secret holding a provider's secret key.
	Secret func(ctx context.Context, name string) (string, error)
	// Verifier asks a provider about a token.
	Verifier interface {
		Verify(ctx context.Context, provider, secret, token string) error
	}
	// Now is the clock; nil is time.Now.
	Now func() time.Time
}

type Input struct {
	Provider                *string `json:"provider,omitempty"`
	SiteKey                 *string `json:"site_key,omitempty"`
	SecretName              *string `json:"secret_name,omitempty"`
	AllowPublicWithoutCheck *bool   `json:"allow_public_without_check,omitempty"`
	Difficulty              *int    `json:"difficulty,omitempty"`
	MaxDifficulty           *int    `json:"max_difficulty,omitempty"`
	RateThreshold           *int    `json:"rate_threshold,omitempty"`
	ChallengeTTLSeconds     *int    `json:"challenge_ttl_seconds,omitempty"`
}

type PostgresAnswers struct {
	// contains filtered or unexported fields
}

type Settings struct {
	// Provider is pow, turnstile, hcaptcha or none.
	Provider string `json:"provider" example:"pow"`
	// SiteKey is the Turnstile or hCaptcha site key a page renders the
	// widget with. It is public.
	SiteKey string `json:"site_key"`
	// SecretName is the stored secret (Admin > Secrets) holding the
	// provider's secret key, whose allow_connections names SecretUse and
	// which lists no personas. The key never leaves the server.
	SecretName string `json:"secret_name"`
	// AllowPublicWithoutCheck lets a public endpoint be bound and answered
	// while the provider is none.
	AllowPublicWithoutCheck bool `json:"allow_public_without_check"`
	// Difficulty is the proof-of-work's leading zero bits while an endpoint
	// is quiet, and MaxDifficulty the most a flood raises it to.
	Difficulty    int `json:"difficulty"`
	MaxDifficulty int `json:"max_difficulty"`
	// RateThreshold is the answers a minute an endpoint takes before each
	// doubling of its rate adds a bit of difficulty.
	RateThreshold int `json:"rate_threshold"`
	// ChallengeTTLSeconds is how long a challenge may be answered.
	ChallengeTTLSeconds int `json:"challenge_ttl_seconds"`
}

type SettingsStore interface {
	Get(ctx context.Context) (settingsjson.Stored[Settings], error)
	Set(ctx context.Context, v Settings, author string) error
}

type Verifier struct {
	// contains filtered or unexported fields
}

type View struct {
	Settings
	UpdatedBy string `json:"updated_by,omitempty"`
	UpdatedAt string `json:"updated_at,omitempty"`
}