CAPTCHA

import "github.com/go-mizu/mizu/middlewares/captcha"

app := mizu.New()

// Google reCAPTCHA v2
app.Use(captcha.ReCaptchaV2("your-secret-key"))

const (
    ProviderRecaptchaV2 // Google reCAPTCHA v2 (checkbox)
    ProviderRecaptchaV3 // Google reCAPTCHA v3 (invisible)
    ProviderHCaptcha    // hCaptcha
    ProviderTurnstile   // Cloudflare Turnstile
    ProviderCustom      // Custom verification
)

app.Use(captcha.ReCaptchaV2(os.Getenv("RECAPTCHA_SECRET")))

<script src="https://www.google.com/recaptcha/api.js" async defer></script>
<form method="POST" action="/submit">
    <div class="g-recaptcha" data-sitekey="your-site-key"></div>
    <button type="submit">Submit</button>
</form>

// Require minimum score of 0.7
app.Use(captcha.ReCaptchaV3(os.Getenv("RECAPTCHA_SECRET"), 0.7))

<script src="https://www.google.com/recaptcha/api.js?render=your-site-key"></script>
<script>
grecaptcha.ready(function() {
    grecaptcha.execute('your-site-key', {action: 'submit'})
    .then(function(token) {
        document.getElementById('captcha-token').value = token;
    });
});
</script>
<form method="POST" action="/submit">
    <input type="hidden" id="captcha-token" name="g-recaptcha-response">
    <button type="submit">Submit</button>
</form>

app.Use(captcha.HCaptcha(os.Getenv("HCAPTCHA_SECRET")))

<script src="https://js.hcaptcha.com/1/api.js" async defer></script>
<form method="POST" action="/submit">
    <div class="h-captcha" data-sitekey="your-site-key"></div>
    <button type="submit">Submit</button>
</form>

app.Use(captcha.Turnstile(os.Getenv("TURNSTILE_SECRET")))

<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>
<form method="POST" action="/submit">
    <div class="cf-turnstile" data-sitekey="your-site-key"></div>
    <button type="submit">Submit</button>
</form>

app.Use(captcha.WithOptions(captcha.Options{
    Provider:  captcha.ProviderRecaptchaV2,
    Secret:    os.Getenv("RECAPTCHA_SECRET"),
    SkipPaths: []string{
        "/api/webhook",    // External webhooks
        "/api/health",     // Health checks
    },
}))

// Token from header instead of form
app.Use(captcha.WithOptions(captcha.Options{
    Provider:    captcha.ProviderRecaptchaV3,
    Secret:      secret,
    TokenLookup: "header:X-Captcha-Token",
}))

app.Use(captcha.WithOptions(captcha.Options{
    Provider: captcha.ProviderRecaptchaV2,
    Secret:   secret,
    ErrorHandler: func(c *mizu.Ctx, err error) error {
        if err == captcha.ErrMissingToken {
            return c.JSON(400, map[string]string{
                "error": "Please complete the CAPTCHA",
            })
        }
        return c.JSON(403, map[string]string{
            "error": "CAPTCHA verification failed. Please try again.",
        })
    },
}))

app.Use(captcha.Custom(
    func(token string, c *mizu.Ctx) (bool, error) {
        // Custom verification logic
        return myVerifier.Verify(token, c.ClientIP())
    },
    "form:my-captcha-token",
))

// Only protect specific routes
registerCaptcha := captcha.ReCaptchaV2(secret)
loginCaptcha := captcha.ReCaptchaV3(secret, 0.5)

app.Post("/register", registerHandler, registerCaptcha)
app.Post("/login", loginHandler, loginCaptcha)

// New creates middleware with default provider
func New(secret string) mizu.Middleware

// WithOptions creates middleware with custom options
func WithOptions(opts Options) mizu.Middleware

// Provider-specific constructors
func ReCaptchaV2(secret string) mizu.Middleware
func ReCaptchaV3(secret string, minScore float64) mizu.Middleware
func HCaptcha(secret string) mizu.Middleware
func Turnstile(secret string) mizu.Middleware

// Custom creates middleware with custom verifier
func Custom(verifier func(string, *mizu.Ctx) (bool, error), tokenLookup string) mizu.Middleware

var (
    ErrMissingToken // Token not found in request
    ErrInvalidToken // Token verification failed
    ErrVerifyFailed // Verification request failed
)