RecaptchaV3Captcha
Corex\Captcha\RecaptchaV3Captcha · class · Add-ons layer
Google reCAPTCHA v3 driver. Where {@see RemoteCaptcha} reads only success — which is why the score threshold and action settings had no effect — this driver reads the whole v3 response and returns a typed verdict. It fails closed: every failure path yields a non-passed {@see ChallengeVerification}, never an exception to the caller and never a silent pass. The checks run in a deliberate order (research.md R3). Replay is checked last, so a token rejected for any earlier reason is never recorded — a forged token cannot poison the replay store, and a token rejected only on score stays replayable if the threshold is later lowered.
Public API
Section titled “Public API”__construct(string $verifyUrl, string $secret, TokenReplayGuard $replay)
Section titled “__construct(string $verifyUrl, string $secret, TokenReplayGuard $replay)”verify(string $token, array $context): bool
Section titled “verify(string $token, array $context): bool”Legacy boolean contract. It cannot judge a v3 token meaningfully — with no server-side expectations it fails closed on the hostname check — so it exists only to satisfy the {@see Captcha} interface. Real verification goes through {@see challenge()}, which {@see \Corex\Forms\Submission\Stages\ProtectionStage} selects via instanceof VerifyingChallenge.