fix(tiktok): default content_posting_method to DIRECT_POST

[giladresisi]

Problem

Scheduled TikTok posts were being marked successful in Postiz and Temporal but never published. The postSocial activity returned postId: "missing" with a tiktok.com/messages release URL.

Root cause: the post had content_posting_method: "UPLOAD" instead of DIRECT_POST. UPLOAD does not publish — TikTok's API delivers the video to the account's app inbox, where the user must manually complete it within ~24h or it's discarded. This is TikTok's SEND_TO_USER_INBOX terminal status, which we (correctly) treat as a successful upload.

Why the agent chose UPLOAD: the chat/MCP agent had to supply content_posting_method with no guidance — it's a bare required enum ('DIRECT_POST' | 'UPLOAD') with no description or default, and TikTok's agent @Rules said nothing about it. For a video post, "UPLOAD" reads like the obvious choice. The user never asked for it; the model guessed.

Fix (three layers)

• @Rules guidance (tiktok.provider.ts): the agent is now told to use DIRECT_POST unless the user explicitly asks to review/edit inside the TikTok app first, and that UPLOAD does not publish.
• Hard default (integration.schedule.post.ts): a PROVIDER_SETTINGS_DEFAULTS map + buildSettings() helper fills content_posting_method with DIRECT_POST when the key is omitted — applied in both the validation and creation paths — so an omitted value can never land on UPLOAD by accident. The default map is TikTok-only; all other providers reduce to the exact prior behavior.
• Schema description (tiktok.dto.ts): @JSONSchema({ description }) explains, on the field itself, that UPLOAD never publishes.

Why all three

They cover different populations, and the layers are not redundant:

Consumer	Reached by
Internal web agent + external MCP agents	@Rules (via integrationSchema), plus the default as a backstop
Public API caller that reads rules from GET /public/v1/integration-settings/:id	@Rules
Public API caller that reads only the settings schema	@JSONSchema description

Note the default only fills a key that is undefined/''. Because the field is required, an agent nearly always sends something — so the prose rule and the field description are what actually steer it away from UPLOAD; the default is insurance against omission.

The @JSONSchema decorator is metadata only — it registers no validator, so @IsIn([...]) still rejects a missing or invalid value and the field remains required. The dashboard is unaffected: its React form hardcodes DIRECT_POST.

Testing

• Validated live over MCP: scheduling a TikTok draft omitting content_posting_method now yields DIRECT_POST.
• Generated-schema check on TikTokDto: description present, enum unchanged, content_posting_method still listed in required.
• Behavior-preserving for non-TikTok providers (defaults map has only a tiktok entry).
• Typechecks (backend).

Not covered here

Two other copies of this enum are documented outside this repo and are unreachable from a backend change. Both are being fixed separately:

• gitroomhq/postiz-docs — public-api/providers/tiktok.mdx describes UPLOAD as "Upload for manual posting"; public-api/openapi.json has a bare enum with no description. (Hand-maintained, not generated.)
• gitroomhq/postiz-agent — the skill bundles its own PROVIDER_SETTINGS.md, which lists the enum with no explanation. Skill runs read that file rather than calling integrations:settings, so no backend fix reaches them.

Notes

First of two related changes. A follow-up feature branch (agent list/update of scheduled posts) stacks on this one and will be opened as a separate PR.

🤖 Generated with Claude Code

[postiz-contribution]

Contribution-checker quality warning
Heuristic score: 1/100 (low). This is a non-blocking warning surfaced by the project's quality settings.

Heuristics that flagged:

• Excessive inline code references: 24 inline refs (>3)
• PR doesn't use the repo's PR template: 5 required checkbox items missing (max 1, match ≥80%)
• Body adds too many extra headers beyond the template: 4 extra headers (>1)
• AI watermark phrase: Matched: "Generated with Claude Code"
• Commit message too long: Longest: 1011 chars

If this is a genuine contribution, please add detail to your PR description and tighten the diff scope before reviewers look at it.

[postiz-agent]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[giladresisi]

Superseded by #1710.

Same fix, cleaner history. The PROVIDER_SETTINGS_DEFAULTS map in integration.schedule.post.ts has been dropped (TikTok-specific value in a generic tools file; only applied on the MCP path; and redundant, since the field is required so an omitted key is rejected by validation rather than falling through to UPLOAD). In its place, #1710 normalizes a missing content_posting_method to DIRECT_POST inside the provider itself, at publish time.

Closing in favour of #1710 — force-push is blocked on this branch, so the rewritten history could not be pushed here.