From c65e1ebb8f5e3ca53de62085afa3e416118ee230 Mon Sep 17 00:00:00 2001
From: Julian Lam <julian@nodebb.org>
Date: Wed, 26 Feb 2025 12:29:52 -0500
Subject: [PATCH] fix: #13202, private note assertion failure when cc property
 is missing

---
 src/activitypub/inbox.js | 2 +-
 src/activitypub/notes.js | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/activitypub/inbox.js b/src/activitypub/inbox.js
index 2887caac04..980709fb58 100644
--- a/src/activitypub/inbox.js
+++ b/src/activitypub/inbox.js
@@ -64,7 +64,7 @@ inbox.create = async (req) => {
 	const { object } = req.body;
 
 	// Alternative logic for non-public objects
-	const isPublic = [...object.to, ...object.cc].includes(activitypub._constants.publicAddress);
+	const isPublic = [...(object.to || []), ...(object.cc || [])].includes(activitypub._constants.publicAddress);
 	if (!isPublic) {
 		return await activitypub.notes.assertPrivate(object);
 	}
diff --git a/src/activitypub/notes.js b/src/activitypub/notes.js
index 2b6a0fceaa..ed0b1f6791 100644
--- a/src/activitypub/notes.js
+++ b/src/activitypub/notes.js
@@ -234,7 +234,7 @@ Notes.assertPrivate = async (object) => {
 	}
 
 	const localUids = [];
-	const recipients = new Set([...object.to, ...object.cc]);
+	const recipients = new Set([...(object.to || []), ...(object.cc || [])]);
 	await Promise.all(Array.from(recipients).map(async (value) => {
 		const { type, id } = await activitypub.helpers.resolveLocalId(value);
 		if (type === 'user') {