Federation pull now mirrors this instance's own listings instead of the peer's catalogue

[rubenvdlinde]

What goes wrong

The federation "Pull now" action does not fetch the peer. It passes the peer URL to OpenCatalogi in a parameter OpenCatalogi ignores, so what gets mirrored as the peer's catalogue is this instance's own directory listing. Federation is also off by default and can only be switched on through app config, not in the settings page.

Evidence, re-read at c9760e0

• lib/Service/Federation/FederationService.php:428-434 fetchPeerCatalog() gets OCA\OpenCatalogi\Service\DirectoryService and calls $directory->getDirectory(['url' => $peerUrl]). The comment above it says the URL is passed "so OC performs the SSRF-aware HTTP call and returns the published publications".
• OpenCatalogi lib/Service/DirectoryService.php:2423 getDirectory(array $requestParams), read on ConductionNL/opencatalogi development at 2ccec488, reads only filters, limit, offset and include-federated from $requestParams. It never reads url. It builds its listing from the local directory and this instance's own directory route (opencatalogi.directory.index, :2492-2494).
• The result is used as the peer's entries (:441-446) and written as mirrors into the organisation schema (FederationService.php:56 PEER_MIRROR_TYPE) by pullPeer().
• Switch: lib/Service/Federation/FederationConfig.php:56 reads federation_enabled with default false, and lib/Repair/InitializeSettings.php:125-126 seeds it to false. No controller or src/ code writes it. src/views/settings/sections/FederationSettings.vue:56-60 only tells the admin "Enable it in the app configuration", which means occ config:app:set.

Why it matters

An admin who enables federation and presses Pull now gets duplicated local listings labelled as coming from the peer, which silently pollutes the organisation register rather than failing.

Needs a live check

Code reading across two repos. Confirm with a pull against a peer whose catalogue differs from the local one, and compare the mirrored entries.

Surfaced by the capability matrix in stackiq#1072 (merge 38b9938), rows share-federation-pull and share-federation-peers.

[github-actions]

Thank you for opening this issue! It has been assigned to @rubenvdlinde for review.

What happens next:

1. A maintainer will review this issue and determine the appropriate action
2. If accepted, it may be converted into an OpenSpec change for structured development
3. You will be notified of any status changes

Triage labels:

• triage:accept-feature — accepted as a new feature
• triage:accept-bugfix — accepted as a bug fix
• triage:needs-info — more information needed
• triage:wontfix — will not be addressed
• triage:duplicate — duplicate of another issue