FormChallengeContextFactory

Corex\Forms\Submission\FormChallengeContextFactory · class · Forms layer

Builds the server-side {@see ChallengeContext} a submission is judged against. Every value here is resolved from stored configuration — the form’s own protection block and the global captcha settings — never from the request. The effective threshold is form-override → global → conservative default; the action is derived from the flow slug (or a form override); the allowed hostnames come from an explicit allowlist that defaults to this site’s own host. That is what lets the verifier trust the expectation rather than the token.

Public API

__construct(ChallengeSettings $settings, ClientAddress $client)

forForm(string $slug, array $protection): ChallengeContext

isProtected(array $protection): bool

Whether this form should be captcha-protected: its own off opts out entirely; otherwise it follows whether the site has a real provider configured. Consumed by the renderer to decide whether to enqueue the provider script and stamp the token field.

widgetProvider(): string

The provider whose widget a protected form shows, or ” when the provider shows none.

siteKey(): string

The key the provider’s widget is rendered with. It is public by design; the secret is not.

providerConfigured(): bool