fix(endpoint-micropub): don't assume mp-syndicate-to is an array

[rmdes]

Problem

Posting fails with

TypeError: syndicateTo?.includes is not a function

whenever a client sends "mp-syndicate-to": [].

getSyndicateToProperty reads the property straight off the JF2 object and
calls .includes on it, but converting mf2 to JF2 leaves it in one of three
shapes:

client sends	after mf2 → JF2	.includes
["a", "b"]	["a", "b"]	array — fine
["a"]	"a"	string — fine
[]	{}	object — throws

An empty array is what an unticked syndication list produces, so this is
reachable through ordinary use rather than a malformed request. The post type
makes no difference; the only other condition is that the publication has
syndication targets configured, since the function returns early when it has
none. That combination is why it presents as intermittent — selecting a single
target makes the same post succeed.

Found from a browser extension that sent the property unconditionally. The
client has been fixed too, but any client can trip this and the failure takes
down post creation entirely.

Fix

Resolve the value to an array once, before the loop:

const syndicateTo = properties["mp-syndicate-to"];
const requested = Array.isArray(syndicateTo)
  ? syndicateTo
  : typeof syndicateTo === "string"
    ? [syndicateTo]
    : [];

Anything that is neither an array nor a string is treated as no targets.

Behaviour change worth noting

The single-target case is now an exact comparison. It was previously
"https://example.website/".includes(uid) — a substring test — which would
also match a uid that merely appeared inside the configured target string.
Exact matching seems clearly right here, but it is a change.

Testing

• Two tests added to packages/endpoint-micropub/test/unit/jf2.js, covering
  the non-array shapes and the string shape. I verified the first fails with
  the original expression, reproducing the reported TypeError exactly.
• 118/118 unit tests pass in endpoint-micropub; eslint and prettier
  clean.
• The integration tests need MongoDB, which I do not have locally — they fail
  identically on an untouched main, so this changes nothing there.

[rmdes]

I can confirm this issue exist on indiekit and my indiekit fork, and impact anyone using a micropub client and NOT selecting a syndication target when publishing a post.

[paulrobertlloyd]

Good catch – thanks for the fix @rmdes!