[ArtificialOwl]

Summary

When a file received through a federated share is reshared locally, the recipient's copy sits on a shared storage that wraps the federated one. FederationService::getRemoteRedirectURL() detected that storage as federated, but read the remote server, the share token and the file path from the recipient's wrapping storage. For a single reshared file that path is empty, so the remote server opened the root of the federated share instead of the file.

Permissions still come from the recipient's own copy. The access token sent to the remote server takes its write flag from that copy, and the remote server removes edit rights when the flag is off, so a read-only local reshare stays read-only.

Other changes:

• getRemoteRedirectURL() now declares a ?string return type.
• The Psalm baseline is updated for the new SharingExternalStorage reference.

TODO

• Test end to end: share a file from instance A to B, reshare it locally on B (read-only and editable), and open it on B

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Documentation (manuals or wiki) has been updated or is not required

AI (if applicable)

• The content of this PR was partly or fully generated using AI

🤖 Generated with Claude Code