Fix reauth prompt persisting after successful re-authentication (#22747)

* Evict stale WpApiClient cache after re-authentication

After re-authenticating application passwords, the cached WpApiClient
in WpApiClientProvider still held old credentials, causing the reauth
banner to persist until the app was killed and restarted. This adds a
clearSelfHostedClient() method and calls it after credential storage
so subsequent API calls use a fresh client with updated credentials.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Remove unused removeAllApplicationPasswordCredentials and related code

removeAllApplicationPasswordCredentials and
getResettableApplicationPasswordSitesCount had no callers in the
codebase. Remove them along with hasRegularCredentials and their tests.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Fix checkstyle empty line before closing brace in test

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Rename clearWpComClients to clearAllClients for accuracy

The method clears both wpComClients and selfHostedClients maps but
its name only mentioned WP.com. Rename to clearAllClients to reflect
its actual behavior.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Evict cached client before dispatching DB update

Move clearSelfHostedClient() before updateApplicationPassword() so
any concurrent reader gets a cache miss and uses the already-mutated
in-memory SiteModel, closing a theoretical race window.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Add negative-path verification for clearSelfHostedClient in tests

Verify that clearSelfHostedClient is not called on failure paths
(empty data, site not found) to make the contract explicit and
guard against accidental regressions.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Remove unused removeAllApplicationPasswordCredentials and related code

DispatcherWrapper.removeApplicationPassword had no production callers
and was only referenced in a negative-path test verification. Remove
the dead code and its test assertion.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: adalpari

WordPress/src/main/java/org/wordpress/android/AppInitializer.kt

@@ -699,7 +699,7 @@ class AppInitializer @Inject constructor(
 
         // Clear cached wordpress-rs services and API clients
         wpServiceProvider.clearAll()
-        wpApiClientProvider.clearWpComClients()
+        wpApiClientProvider.clearAllClients()
     }
 
     /*

WordPress/src/main/java/org/wordpress/android/ui/accounts/login/ApplicationPasswordLoginHelper.kt

@@ -13,6 +13,7 @@ import org.wordpress.android.analytics.AnalyticsTracker.Stat
 import org.wordpress.android.fluxc.Dispatcher
 import org.wordpress.android.fluxc.generated.SiteActionBuilder
 import org.wordpress.android.fluxc.model.SiteModel
+import org.wordpress.android.fluxc.network.rest.wpapi.rs.WpApiClientProvider
 import org.wordpress.android.fluxc.store.SiteStore
 import org.wordpress.android.fluxc.utils.AppLogWrapper
 import org.wordpress.android.modules.BG_THREAD
@@ -41,7 +42,8 @@ class ApplicationPasswordLoginHelper @Inject constructor(
     private val appLogWrapper: AppLogWrapper,
     private val apiRootUrlCache: ApiRootUrlCache,
     private val discoverSuccessWrapper: DiscoverSuccessWrapper,
-    private val crashLogging: CrashLogging
+    private val crashLogging: CrashLogging,
+    private val wpApiClientProvider: WpApiClientProvider,
 ) {
     private var processedAppPasswordData: String? = null
 
@@ -118,6 +120,7 @@ class ApplicationPasswordLoginHelper @Inject constructor(
                     apiRestPasswordPlain = urlLogin.password
                     wpApiRestUrl = urlLogin.apiRootUrl
                 }
+                wpApiClientProvider.clearSelfHostedClient(site.id)
                 dispatcherWrapper.updateApplicationPassword(site)
                 trackSuccessful(urlLogin.siteUrl)
                 processedAppPasswordData = urlLogin.siteUrl // Save locally to avoid duplicated calls
@@ -209,38 +212,6 @@ class ApplicationPasswordLoginHelper @Inject constructor(
         return uriLoginWrapper.parseUriLogin(url)
     }
 
-    /**
-     * Removes Application Password credentials for sites that have regular credentials as fallback.
-     * Sites without regular credentials (username/password) are excluded since they can only
-     * authenticate using Application Password.
-     * @return the number of sites that were affected
-     */
-    suspend fun removeAllApplicationPasswordCredentials(): Int {
-        return withContext(bgDispatcher) {
-            val sites = siteStore.sites
-            // Only reset sites that have regular credentials to fall back to
-            val sitesToReset = sites.filter {
-                !it.apiRestUsernameEncrypted.isNullOrEmpty() && it.hasRegularCredentials()
-            }
-            sitesToReset.forEach { site ->
-                site.apply {
-                    apiRestUsernamePlain = ""
-                    apiRestPasswordPlain = ""
-                    apiRestUsernameEncrypted = ""
-                    apiRestPasswordEncrypted = ""
-                    apiRestUsernameIV = ""
-                    apiRestPasswordIV = ""
-                }
-                dispatcherWrapper.removeApplicationPassword(site)
-            }
-            appLogWrapper.d(
-                AppLog.T.DB,
-                "A_P: Removed application password credentials for: ${sitesToReset.size} sites"
-            )
-            sitesToReset.size
-        }
-    }
-
     private fun findSiteByUrl(
         normalizedUrl: String?,
         sites: List<SiteModel>
@@ -283,20 +254,6 @@ class ApplicationPasswordLoginHelper @Inject constructor(
         return url.replaceFirst(host, maskedDomain + tld)
     }
 
-    private fun SiteModel.hasRegularCredentials(): Boolean {
-        return !username.isNullOrEmpty() && !password.isNullOrEmpty()
-    }
-
-    /**
-     * Returns the count of sites with Application Password credentials that can be reset
-     * because of having regular credentials
-     */
-    fun getResettableApplicationPasswordSitesCount(): Int {
-        return siteStore.sites.count {
-            !it.apiRestUsernameEncrypted.isNullOrEmpty() && it.hasRegularCredentials()
-        }
-    }
-
     fun siteHasBadCredentials(site: SiteModel) =
         site.apiRestUsernamePlain.isNullOrEmpty() || site.apiRestPasswordPlain.isNullOrEmpty()
 
@@ -358,12 +315,6 @@ class ApplicationPasswordLoginHelper @Inject constructor(
                 SiteActionBuilder.newUpdateApplicationPasswordAction(site)
             )
         }
-
-        fun removeApplicationPassword(site: SiteModel) {
-            dispatcher.dispatch(
-                SiteActionBuilder.newRemoveApplicationPasswordAction(site)
-            )
-        }
     }
 
     class DiscoverSuccessWrapper @Inject constructor() {

WordPress/src/test/java/org/wordpress/android/ui/accounts/login/ApplicationPasswordLoginHelperTest.kt

@@ -17,6 +17,7 @@ import org.mockito.kotlin.verify
 import org.mockito.kotlin.whenever
 import org.wordpress.android.BaseUnitTest
 import org.wordpress.android.fluxc.model.SiteModel
+import org.wordpress.android.fluxc.network.rest.wpapi.rs.WpApiClientProvider
 import org.wordpress.android.fluxc.store.SiteStore
 import org.wordpress.android.fluxc.utils.AppLogWrapper
 import org.wordpress.android.ui.accounts.login.ApplicationPasswordLoginHelper.UriLogin
@@ -71,6 +72,9 @@ class ApplicationPasswordLoginHelperTest : BaseUnitTest() {
     @Mock
     lateinit var crashLogging: CrashLogging
 
+    @Mock
+    lateinit var wpApiClientProvider: WpApiClientProvider
+
     private lateinit var applicationPasswordLoginHelper: ApplicationPasswordLoginHelper
 
     @Before
@@ -86,7 +90,8 @@ class ApplicationPasswordLoginHelperTest : BaseUnitTest() {
             appLogWrapper,
             apiRootUrlCache,
             discoverSuccessWrapper,
-            crashLogging
+            crashLogging,
+            wpApiClientProvider
         )
     }
 
@@ -96,6 +101,7 @@ class ApplicationPasswordLoginHelperTest : BaseUnitTest() {
             UriLogin("", "", "", "")
         )
         assertFalse(result)
+        verify(wpApiClientProvider, times(0)).clearSelfHostedClient(any())
     }
 
     @Test
@@ -149,6 +155,7 @@ class ApplicationPasswordLoginHelperTest : BaseUnitTest() {
         assertTrue(result)
         verify(siteStore).sites
         verify(dispatcherWrapper).updateApplicationPassword(eq(siteModel))
+        verify(wpApiClientProvider).clearSelfHostedClient(eq(siteModel.id))
     }
 
     @Test
@@ -161,7 +168,7 @@ class ApplicationPasswordLoginHelperTest : BaseUnitTest() {
             assertFalse(result)
             verify(siteStore).sites
             verify(dispatcherWrapper, times(0)).updateApplicationPassword(any())
-            verify(dispatcherWrapper, times(0)).removeApplicationPassword(any())
+            verify(wpApiClientProvider, times(0)).clearSelfHostedClient(any())
         }
 
     @Test
@@ -332,174 +339,6 @@ class ApplicationPasswordLoginHelperTest : BaseUnitTest() {
         verify(wpLoginClient).apiDiscovery(eq(TEST_URL))
     }
 
-    @Test
-    fun `removeAllApplicationPasswordCredentials with no sites completes without errors`() = runTest {
-        whenever(siteStore.sites).thenReturn(emptyList())
-
-        applicationPasswordLoginHelper.removeAllApplicationPasswordCredentials()
-
-        verify(siteStore).sites
-        verify(dispatcherWrapper, times(0)).updateApplicationPassword(any())
-        verify(dispatcherWrapper, times(0)).removeApplicationPassword(any())
-    }
-
-    @Test
-    fun `removeAllApplicationPasswordCredentials clears all password fields for site with regular credentials`() =
-        runTest {
-            val site = SiteModel().apply {
-                id = 1
-                url = TEST_URL
-                username = "regular_user"
-                password = "regular_password"
-                apiRestUsernamePlain = TEST_USER
-                apiRestPasswordPlain = TEST_PASSWORD
-                apiRestUsernameEncrypted = "encrypted_user"
-                apiRestPasswordEncrypted = "encrypted_password"
-                apiRestUsernameIV = "user_iv"
-                apiRestPasswordIV = "password_iv"
-            }
-            whenever(siteStore.sites).thenReturn(listOf(site))
-
-            applicationPasswordLoginHelper.removeAllApplicationPasswordCredentials()
-
-            verify(siteStore).sites
-            verify(dispatcherWrapper).removeApplicationPassword(eq(site))
-
-            // Verify all password fields are cleared
-            assertEquals("", site.apiRestUsernamePlain)
-            assertEquals("", site.apiRestPasswordPlain)
-            assertEquals("", site.apiRestUsernameEncrypted)
-            assertEquals("", site.apiRestPasswordEncrypted)
-            assertEquals("", site.apiRestUsernameIV)
-            assertEquals("", site.apiRestPasswordIV)
-        }
-
-    @Test
-    fun `removeAllApplicationPasswordCredentials only resets sites with regular credentials`() = runTest {
-        val siteWithRegularCredentials = SiteModel().apply {
-            id = 1
-            url = "http://site1.com"
-            username = "regular_user1"
-            password = "regular_password1"
-            apiRestUsernamePlain = "user1"
-            apiRestPasswordPlain = "password1"
-            apiRestUsernameEncrypted = "encrypted_user1"
-            apiRestPasswordEncrypted = "encrypted_password1"
-            apiRestUsernameIV = "user_iv1"
-            apiRestPasswordIV = "password_iv1"
-        }
-        val siteWithoutRegularCredentials = SiteModel().apply {
-            id = 2
-            url = "http://site2.com"
-            username = ""
-            password = ""
-            apiRestUsernamePlain = "user2"
-            apiRestPasswordPlain = "password2"
-            apiRestUsernameEncrypted = "encrypted_user2"
-            apiRestPasswordEncrypted = "encrypted_password2"
-            apiRestUsernameIV = "user_iv2"
-            apiRestPasswordIV = "password_iv2"
-        }
-        val siteWithNoAppPassword = SiteModel().apply {
-            id = 3
-            url = "http://site3.com"
-            username = "regular_user3"
-            password = "regular_password3"
-            // This site has no Application Password credentials set
-        }
-        whenever(siteStore.sites).thenReturn(
-            listOf(siteWithRegularCredentials, siteWithoutRegularCredentials, siteWithNoAppPassword)
-        )
-
-        applicationPasswordLoginHelper.removeAllApplicationPasswordCredentials()
-
-        verify(siteStore).sites
-        // Only the site with regular credentials AND app password should be reset
-        verify(dispatcherWrapper).removeApplicationPassword(eq(siteWithRegularCredentials))
-        // Site without regular credentials should NOT be reset
-        verify(dispatcherWrapper, times(0)).removeApplicationPassword(eq(siteWithoutRegularCredentials))
-        // Site with no app password encrypted should NOT be reset
-        verify(dispatcherWrapper, times(0)).removeApplicationPassword(eq(siteWithNoAppPassword))
-
-        // Verify password fields are cleared only for site with regular credentials
-        assertEquals("", siteWithRegularCredentials.apiRestUsernamePlain)
-        assertEquals("", siteWithRegularCredentials.apiRestUsernameEncrypted)
-
-        // Verify password fields are preserved for site without regular credentials
-        assertEquals("user2", siteWithoutRegularCredentials.apiRestUsernamePlain)
-        assertEquals("encrypted_user2", siteWithoutRegularCredentials.apiRestUsernameEncrypted)
-    }
-
-    @Test
-    fun `removeAllApplicationPasswordCredentials preserves other site fields`() = runTest {
-        val site = SiteModel().apply {
-            id = 1
-            url = TEST_URL
-            name = "Test Site"
-            description = "Test Description"
-            siteId = 12345L
-            username = "regular_user"
-            password = "regular_password"
-            apiRestUsernamePlain = TEST_USER
-            apiRestPasswordPlain = TEST_PASSWORD
-            apiRestUsernameEncrypted = "encrypted_user"
-        }
-        whenever(siteStore.sites).thenReturn(listOf(site))
-
-        applicationPasswordLoginHelper.removeAllApplicationPasswordCredentials()
-
-        verify(dispatcherWrapper).removeApplicationPassword(eq(site))
-
-        // Verify non-password fields are preserved
-        assertEquals(1, site.id)
-        assertEquals(TEST_URL, site.url)
-        assertEquals("Test Site", site.name)
-        assertEquals("Test Description", site.description)
-        assertEquals(12345L, site.siteId)
-
-        // Verify Application Password fields are cleared
-        assertEquals("", site.apiRestUsernamePlain)
-        assertEquals("", site.apiRestPasswordPlain)
-
-        // Verify regular credentials are preserved
-        assertEquals("regular_user", site.username)
-        assertEquals("regular_password", site.password)
-    }
-
-    @Test
-    fun `removeAllApplicationPasswordCredentials does not reset site with only username`() = runTest {
-        val site = SiteModel().apply {
-            id = 1
-            url = TEST_URL
-            username = "regular_user"
-            password = "" // No password
-            apiRestUsernameEncrypted = "encrypted_user"
-        }
-        whenever(siteStore.sites).thenReturn(listOf(site))
-
-        applicationPasswordLoginHelper.removeAllApplicationPasswordCredentials()
-
-        verify(dispatcherWrapper, times(0)).removeApplicationPassword(any())
-        assertEquals("encrypted_user", site.apiRestUsernameEncrypted)
-    }
-
-    @Test
-    fun `removeAllApplicationPasswordCredentials does not reset site with only password`() = runTest {
-        val site = SiteModel().apply {
-            id = 1
-            url = TEST_URL
-            username = "" // No username
-            password = "regular_password"
-            apiRestUsernameEncrypted = "encrypted_user"
-        }
-        whenever(siteStore.sites).thenReturn(listOf(site))
-
-        applicationPasswordLoginHelper.removeAllApplicationPasswordCredentials()
-
-        verify(dispatcherWrapper, times(0)).removeApplicationPassword(any())
-        assertEquals("encrypted_user", site.apiRestUsernameEncrypted)
-    }
-
     @Test
     fun `maskUrl with no dot returns url unmasked`() {
         val result = applicationPasswordLoginHelper.maskUrl("https://localhost")
@@ -542,63 +381,4 @@ class ApplicationPasswordLoginHelperTest : BaseUnitTest() {
         val result = applicationPasswordLoginHelper.maskUrl("https://ab.com")
         assertEquals("https://xx.com", result)
     }
-
-    @Test
-    fun `getResettableApplicationPasswordSitesCount returns count of sites with regular credentials`() {
-        val siteWithRegularCredentials = SiteModel().apply {
-            id = 1
-            username = "user"
-            password = "password"
-            apiRestUsernameEncrypted = "encrypted"
-        }
-        val siteWithoutRegularCredentials = SiteModel().apply {
-            id = 2
-            username = ""
-            password = ""
-            apiRestUsernameEncrypted = "encrypted"
-        }
-        val siteWithNoAppPassword = SiteModel().apply {
-            id = 3
-            username = "user"
-            password = "password"
-            apiRestUsernameEncrypted = ""
-        }
-        whenever(siteStore.sites).thenReturn(
-            listOf(siteWithRegularCredentials, siteWithoutRegularCredentials, siteWithNoAppPassword)
-        )
-
-        val count = applicationPasswordLoginHelper.getResettableApplicationPasswordSitesCount()
-
-        assertEquals(1, count)
-    }
-
-    @Test
-    fun `getResettableApplicationPasswordSitesCount returns zero when no sites have regular credentials`() {
-        val site = SiteModel().apply {
-            id = 1
-            username = ""
-            password = ""
-            apiRestUsernameEncrypted = "encrypted"
-        }
-        whenever(siteStore.sites).thenReturn(listOf(site))
-
-        val count = applicationPasswordLoginHelper.getResettableApplicationPasswordSitesCount()
-
-        assertEquals(0, count)
-    }
-
-    @Test
-    fun `getResettableApplicationPasswordSitesCount returns zero when no sites have app password`() {
-        val site = SiteModel().apply {
-            id = 1
-            username = "user"
-            password = "password"
-            apiRestUsernameEncrypted = ""
-        }
-        whenever(siteStore.sites).thenReturn(listOf(site))
-
-        val count = applicationPasswordLoginHelper.getResettableApplicationPasswordSitesCount()
-
-        assertEquals(0, count)
-    }
 }