ProtectionStage
Corex\Forms\Submission\Stages\ProtectionStage · class · Forms layer
Honeypot + captcha protection. The honeypot and throttle checks are unchanged. What changed is captcha: where this stage used to call a boolean verify() on an always-empty token — so configuring reCAPTCHA rejected every real submission — it now runs the scored, typed verdict when the provider supports it, judging the token against the server’s expected action and threshold. The typed outcome, including the effective threshold that judged the request, is persisted for the administrator to inspect. Both are read from the request as it was received, not from the values the stage before handed on. The validation stage runs first and keeps only the answers of the flow’s fields, and neither the trap field nor the token is one: read from those values, a filled trap field was never seen and the provider was handed an empty token whatever the page had sent.