Use the reCAPTCHA Enterprise API.

tests/php/fixtures/router.php

@@ -41,8 +41,18 @@ function xxx_page_route() {
     file_put_contents("$state/tables.ser", serialize(array('tables' => SiteData::$tables,
                                                            'passwordLength' => SiteData::$passwordLength)), LOCK_EX);
   });
-  FakeRecaptcha::install(function ($post) {
-    return json_encode(array('success' => ($post['response'] ?? '') === 'pass'));
+  FakeRecaptcha::install(function ($post) use ($file) {
+    $token = $post['event']['token'] ?? '';
+    if ($token === 'unreachable')
+      return FALSE;
+    if ($token === 'api-error')
+      return '{"error":{"code":403,"status":"PERMISSION_DENIED"}}';
+    $action = $file === XXX_ROOT . '/publish/login.php' ? 'login' : 'submit';
+    return json_encode(array('tokenProperties' => array(
+      'valid' => in_array($token, array('pass', 'wrong-host', 'wrong-action'), TRUE),
+      'hostname' => $token === 'wrong-host' ? 'evil.example' : 'site.test',
+      'action' => $token === 'wrong-action' ? 'other' : $action,
+    )));
   });
 
   if (!isset($_SERVER['HTTP_X_TEST_PLAIN']))

tests/php/fixtures/test.env

@@ -5,7 +5,8 @@ DB_PASS=test-pass
 DB_NAME=test-db
 SITE_URL=https://site.test
 RECAPTCHA_SITE_KEY=test-site-key
-RECAPTCHA_SECRET=test-secret
+RECAPTCHA_PROJECT_ID=test-project
+RECAPTCHA_API_KEY=test-api-key
 GOOGLE_ANALYTICS_ID=
 UPLOAD_DIR=
 UPLOAD_DIR_LIMIT_MB=1