CaptchaAction

Corex\Forms\Submission\CaptchaAction · class · Forms layer

Derives and normalises the reCAPTCHA action for a form. This is the single source of the action value. The block renderer calls it to stamp the form, and the protection stage calls it to compute the expectation the token is judged against. Because both sides call the same function with the same input, the browser cannot use an action the server does not expect (FR-004) — the check is structural, not merely intended. It lives in the Forms layer, not the captcha add-on: the action is a Forms concept (derived from a flow slug), and the verifier only compares the action it is handed. Keeping it here means a site with corex-forms but no captcha add-on has no missing dependency.

Public API

forFlow(string $slug, ?string $override): string

The action for a form: the explicit override when it normalises to something usable, otherwise a deterministic value derived from the flow slug. Never returns an empty string — an empty action is one the provider rejects.

normalise(?string $raw): ?string

Reduce a raw string to the provider-safe action charset within the length bound, or null when nothing usable remains.