|
| 1 | +// Plain-text ad fill for terminals — the MOTD endpoint. |
| 2 | +// |
| 3 | +// curl -s "https://crawlproof.com/api/ads/motd?slot=<slot_id>" |
| 4 | +// curl -s "https://crawlproof.com/api/ads/motd?slot=<slot_id>&cols=64&color=1" |
| 5 | +// |
| 6 | +// Returns an ASCII box (text/plain), sized to `cols`, with optional ANSI |
| 7 | +// colour. Meant for shell MOTDs, SSH login banners, BBS screens, and CLI tools |
| 8 | +// — anywhere an <iframe> can't go. Impressions are metered server-side by |
| 9 | +// serveAd, exactly like the HTML paths; an unknown or inactive slot falls back |
| 10 | +// to the (unmetered) CrawlProof house ad so a login banner is never blank. |
| 11 | + |
| 12 | +import { NextRequest, NextResponse } from "next/server"; |
| 13 | +import { serveAd } from "@/lib/ads/serve"; |
| 14 | +import { houseFill } from "@/lib/ads/house"; |
| 15 | +import { TERMINAL_FORMAT_ID } from "@/lib/ads/formats"; |
| 16 | +import { clampCols, renderCreativeText, terminalDeviceType } from "@/lib/ads/terminal"; |
| 17 | +import { clientIpFromHeaders, lookupGeo } from "@/lib/tracker/geo"; |
| 18 | +import { parseDevice } from "@/lib/tracker/device"; |
| 19 | + |
| 20 | +export const runtime = "nodejs"; |
| 21 | +export const dynamic = "force-dynamic"; |
| 22 | + |
| 23 | +function headers(request: Request): Record<string, string> { |
| 24 | + const origin = request.headers.get("origin"); |
| 25 | + return { |
| 26 | + "content-type": "text/plain; charset=utf-8", |
| 27 | + // Every request is a fresh fill + impression, so never cache at the edge. |
| 28 | + "cache-control": "no-store", |
| 29 | + "access-control-allow-origin": origin ?? "*", |
| 30 | + "access-control-allow-methods": "GET, OPTIONS", |
| 31 | + vary: "Origin", |
| 32 | + "x-robots-tag": "noindex", |
| 33 | + }; |
| 34 | +} |
| 35 | + |
| 36 | +export function OPTIONS(request: NextRequest) { |
| 37 | + return new NextResponse(null, { status: 204, headers: headers(request) }); |
| 38 | +} |
| 39 | + |
| 40 | +// color=1 / true / yes / ansi all opt into ANSI escapes. Default is plain text: |
| 41 | +// a consumer piping us into a file or a web page must not get escape codes. |
| 42 | +function wantsColor(v: string | null): boolean { |
| 43 | + return v !== null && /^(1|true|yes|ansi|on)$/i.test(v); |
| 44 | +} |
| 45 | + |
| 46 | +// Optional publisher-supplied surface tag (?src=bbs, ?src=ssh-banner, …). It |
| 47 | +// rides along on the click URL so one slot can tell its surfaces apart in the |
| 48 | +// advertiser's own analytics. Sanitised hard: it ends up in a printed URL. |
| 49 | +function cleanSrc(v: string | null): string { |
| 50 | + return (v ?? "").trim().replace(/[^\w.-]/g, "").slice(0, 32); |
| 51 | +} |
| 52 | + |
| 53 | +function withParam(rawUrl: string, key: string, value: string): string { |
| 54 | + try { |
| 55 | + const u = new URL(rawUrl); |
| 56 | + u.searchParams.set(key, value); |
| 57 | + return u.toString(); |
| 58 | + } catch { |
| 59 | + return rawUrl; |
| 60 | + } |
| 61 | +} |
| 62 | + |
| 63 | +export async function GET(request: NextRequest) { |
| 64 | + const h = headers(request); |
| 65 | + try { |
| 66 | + const url = new URL(request.url); |
| 67 | + const slotId = url.searchParams.get("slot"); |
| 68 | + const visitorId = url.searchParams.get("v"); |
| 69 | + const cols = clampCols(url.searchParams.get("cols") ?? url.searchParams.get("width")); |
| 70 | + const color = wantsColor(url.searchParams.get("color")); |
| 71 | + const src = cleanSrc(url.searchParams.get("src")); |
| 72 | + |
| 73 | + let fill = null; |
| 74 | + if (slotId) { |
| 75 | + const ip = clientIpFromHeaders(request.headers); |
| 76 | + const geo = await lookupGeo(ip).catch(() => null); |
| 77 | + // Terminal clients identify as curl/wget/etc., which the generic tracker |
| 78 | + // buckets as "bot" — correct for a web page, wrong here, where that's the |
| 79 | + // actual audience. terminalDeviceType keeps real crawlers out and lets |
| 80 | + // shell clients through; anything else falls back to normal parsing. |
| 81 | + const ua = request.headers.get("user-agent"); |
| 82 | + const device = terminalDeviceType(ua) ?? parseDevice(ua).deviceType; |
| 83 | + fill = await serveAd(slotId, TERMINAL_FORMAT_ID, { |
| 84 | + visitorId, |
| 85 | + ip, |
| 86 | + country: geo?.countryCode ?? null, |
| 87 | + device, |
| 88 | + }); |
| 89 | + } |
| 90 | + // No slot given, or the slot is inactive / has no terminal inventory. |
| 91 | + if (!fill) fill = houseFill(TERMINAL_FORMAT_ID); |
| 92 | + |
| 93 | + // Re-render at the caller's width/colour from the same creative + click URL |
| 94 | + // the fill was metered with. House fills keep their own border label so an |
| 95 | + // unsold slot doesn't read as a paid placement. |
| 96 | + // Short key: the click URL is printed as literal text, so every character |
| 97 | + // spent here is a character of box width. |
| 98 | + const clickUrl = src ? withParam(fill.clickUrl, "s", src) : fill.clickUrl; |
| 99 | + const body = renderCreativeText(fill.creative, clickUrl, { |
| 100 | + cols, |
| 101 | + color, |
| 102 | + label: fill.campaignId === "house" ? "CRAWLPROOF ADS" : undefined, |
| 103 | + }); |
| 104 | + return new NextResponse(`${body}\n`, { status: 200, headers: h }); |
| 105 | + } catch { |
| 106 | + // Never fail a login banner: fall back to the house ad at defaults. |
| 107 | + const fallback = houseFill(TERMINAL_FORMAT_ID); |
| 108 | + return new NextResponse(`${fallback.text}\n`, { status: 200, headers: h }); |
| 109 | + } |
| 110 | +} |
0 commit comments