From 0c537c217fe77e216b9d776debbd19a4a55ab476 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Thu, 30 Jul 2026 09:43:23 +0000
Subject: [PATCH] feat(ads): rotate real campaigns on a slotless /api/ads/motd
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A bare `curl https://crawlproof.com/api/ads/motd` could only ever return
the house ad: serving needs a slot, because the impression row is what a
later click resolves back to, so no slot meant no paid fill.

Add ADS_DEFAULT_SLOT_ID — the slot credited when a request names none.
Anonymous terminal traffic is the network's own inventory, so it points at
CrawlProof's own publisher slot, and the endpoint now rotates real
campaigns on every load. Unset, behaviour is unchanged (house ad).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .env.example              |  4 ++++
 app/api/ads/motd/route.ts | 12 +++++++++++-
 lib/env.ts                |  6 ++++++
 3 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/.env.example b/.env.example
index 031cddd6..c89143a5 100644
--- a/.env.example
+++ b/.env.example
@@ -13,6 +13,10 @@ SUPABASE_SERVICE_ROLE_KEY=YOUR_SERVICE_ROLE_KEY
 MAXMIND_LICENSE_KEY=
 MAXMIND_GEOLITE2_CITY_DB_PATH=data/GeoLite2-City.mmdb
 
+# Ad network: slot credited when a serving request names none (a bare curl of
+# /api/ads/motd). Without it, slotless requests can only return the house ad.
+ADS_DEFAULT_SLOT_ID=
+
 # CoinPay credit purchases
 COINPAY_MERCHANT_ID=merchant_xxx
 COINPAY_API_KEY=cp_xxx
diff --git a/app/api/ads/motd/route.ts b/app/api/ads/motd/route.ts
index a55db6b8..300ae496 100644
--- a/app/api/ads/motd/route.ts
+++ b/app/api/ads/motd/route.ts
@@ -8,6 +8,11 @@
 // — anywhere an <iframe> can't go. Impressions are metered server-side by
 // serveAd, exactly like the HTML paths; an unknown or inactive slot falls back
 // to the (unmetered) CrawlProof house ad so a login banner is never blank.
+//
+// `slot` identifies the publisher placement being filled — that's who the
+// impression and any click earnings are credited to. Omitting it (a bare curl
+// of this URL) uses ADS_DEFAULT_SLOT_ID, the network's own slot, so the
+// endpoint still rotates real campaigns on every load.
 
 import { NextRequest, NextResponse } from "next/server";
 import { serveAd } from "@/lib/ads/serve";
@@ -16,6 +21,7 @@ import { TERMINAL_FORMAT_ID } from "@/lib/ads/formats";
 import { clampCols, renderCreativeText, terminalDeviceType } from "@/lib/ads/terminal";
 import { clientIpFromHeaders, lookupGeo } from "@/lib/tracker/geo";
 import { parseDevice } from "@/lib/tracker/device";
+import { env } from "@/lib/env";
 
 export const runtime = "nodejs";
 export const dynamic = "force-dynamic";
@@ -64,7 +70,11 @@ export async function GET(request: NextRequest) {
   const h = headers(request);
   try {
     const url = new URL(request.url);
-    const slotId = url.searchParams.get("slot");
+    // No ?slot= (someone just curling the bare URL) falls back to the network's
+    // default slot, so the endpoint rotates real campaigns on every load
+    // instead of only ever showing the house ad. Serving needs *a* slot: the
+    // impression row is what a click later resolves back to.
+    const slotId = url.searchParams.get("slot") || env.adsDefaultSlotId;
     const visitorId = url.searchParams.get("v");
     const cols = clampCols(url.searchParams.get("cols") ?? url.searchParams.get("width"));
     const color = wantsColor(url.searchParams.get("color"));
diff --git a/lib/env.ts b/lib/env.ts
index 89fcf527..1a859417 100644
--- a/lib/env.ts
+++ b/lib/env.ts
@@ -15,6 +15,12 @@ export const env = {
     process.env.MAXMIND_GEOLITE2_CITY_DB_PATH ??
     process.env.GEOLITE2_CITY_DB_PATH ??
     "data/GeoLite2-City.mmdb",
+  // Ad network — slot used when a serving request names none (the bare
+  // /api/ads/motd URL). Without it a slotless request can't meter an
+  // impression, so it can only ever return the house ad. Points at the
+  // network's own publisher slot: anonymous terminal traffic is CrawlProof's
+  // own inventory, so its impressions/clicks accrue there.
+  adsDefaultSlotId: process.env.ADS_DEFAULT_SLOT_ID ?? "",
   // CoinPay — crypto credit purchases.
   coinpayMerchantId: process.env.COINPAY_MERCHANT_ID ?? "",
   coinpayApiKey: process.env.COINPAY_API_KEY ?? "",