Don't gate capability detection behind a mint for WP.com Simple sites

WP.com Simple sites are proxy-served and OAuth-authed; the application-password
mint returns NotSupported for them, so the pipeline was returning Unprovisionable
and never reaching capability detection (which works fine through the proxy) -- a
regression vs. the old ungated probe. ensureAuth now short-circuits them to a new
SiteAuthState.NotApplicable (treated like Provisioned), and recoverRestUrlIfNeeded
skips them too.

Author: jkmassel

WordPress/src/main/java/org/wordpress/android/repositories/SiteProvisioningSource.kt

@@ -140,7 +140,7 @@ class SiteProvisioningSource @Inject constructor(
 
     private suspend fun runPipeline(siteLocalId: Int): SiteReadiness =
         when (val auth = ensureAuth(siteLocalId)) {
-            SiteAuthState.Provisioned -> coroutineScope {
+            SiteAuthState.Provisioned, SiteAuthState.NotApplicable -> coroutineScope {
                 // Post-auth, the REST-capability chain and the XML-RPC recovery are independent —
                 // each reads the site fresh and writes only its own column — so run them in
                 // parallel. recoverRestUrlIfNeeded precedes detectCapabilities within its branch because
@@ -165,6 +165,10 @@ class SiteProvisioningSource @Inject constructor(
     private suspend fun ensureAuth(siteLocalId: Int): SiteAuthState {
         val site = siteStore.getSiteByLocalId(siteLocalId)
             ?: return SiteAuthState.Unprovisionable(hadCredentials = false)
+        // WP.com Simple sites are fully proxied and OAuth-bearer-authed — no application password
+        // applies (the mint returns NotSupported). Capability detection works through the proxy, so
+        // treat them as ready instead of blocking detection behind a mint that can never run.
+        if (site.isWPComSimpleSite) return SiteAuthState.NotApplicable
         val hadCredentials = !applicationPasswordLoginHelper.siteHasBadCredentials(site)
         if (hadCredentials) {
             when (applicationPasswordValidator.validate(site)) {
@@ -201,7 +205,9 @@ class SiteProvisioningSource @Inject constructor(
      */
     private suspend fun recoverRestUrlIfNeeded(siteLocalId: Int) {
         val site = siteStore.getSiteByLocalId(siteLocalId) ?: return
-        if (!site.wpApiRestUrl.isNullOrEmpty()) return
+        // WP.com Simple sites are proxy-served — no direct REST host to recover (their wpApiRestUrl
+        // is legitimately null), so don't burn a discovery call on them.
+        if (site.isWPComSimpleSite || !site.wpApiRestUrl.isNullOrEmpty()) return
         siteApiRestUrlRecoverer.discoverApiRootUrl(site.url)?.let { apiRootUrl ->
             siteApiRestUrlRecoverer.persistApiRootUrl(siteLocalId, apiRootUrl)
         }
@@ -247,6 +253,10 @@ sealed interface SiteAuthState {
     /** Credentials are usable (validated, or freshly minted). */
     data object Provisioned : SiteAuthState
 
+    /** No application password applies — a WP.com Simple site, which is proxy-served and
+     *  OAuth-bearer-authed. Treated like [Provisioned]: capability detection runs via the proxy. */
+    data object NotApplicable : SiteAuthState
+
     /** Not usable yet, but not a terminal failure — a mint is implied / a transient
      *  validation error occurred. The card stays hidden; the next run retries. */
     data object Provisioning : SiteAuthState

WordPress/src/main/java/org/wordpress/android/ui/mysite/cards/applicationpassword/ApplicationPasswordViewModelSlice.kt

@@ -82,7 +82,8 @@ class ApplicationPasswordViewModelSlice @Inject constructor(
                     uiModelMutable.postValue(null)
                     appLogWrapper.d(AppLog.T.MAIN, "A_P: Provisioning in progress for ${site.url}")
                 }
-                SiteAuthState.Provisioned -> Unit // unreachable: Provisioned never wraps in NeedsAuth
+                SiteAuthState.Provisioned, SiteAuthState.NotApplicable ->
+                    Unit // never wrap in NeedsAuth — they proceed to detection
             }
             // Any terminal provisioned state — the credentials are usable, so the only card left to
             // show is the self-hosted XML-RPC fallback. Capability outcome (Ready/Unreachable) is the

WordPress/src/test/java/org/wordpress/android/repositories/SiteProvisioningSourceTest.kt

@@ -157,6 +157,23 @@ class SiteProvisioningSourceTest : BaseUnitTest(StandardTestDispatcher()) {
         assertThat(result).isEqualTo(SiteReadiness.NeedsAuth(SiteAuthState.Unprovisionable(hadCredentials = false)))
     }
 
+    @Test
+    fun `given a WPCom Simple site, then it detects capabilities without minting`() = test {
+        val simple = SiteModel().apply {
+            id = TEST_SITE_LOCAL_ID
+            url = "https://simple.wordpress.com"
+            setIsWPCom(true) // isWPComSimpleSite = isWPCom && !isWPComAtomic
+            wpApiRestUrl = "https://simple.wordpress.com/wp-json"
+        }
+        whenever(siteStore.getSiteByLocalId(TEST_SITE_LOCAL_ID)).thenReturn(simple)
+        stubCapabilityProbe(ok = true)
+
+        assertThat(source.await(simple)).isEqualTo(SiteReadiness.Ready)
+        // No application password applies — it must not validate or mint, just probe via the proxy.
+        verify(applicationPasswordValidator, never()).validate(any())
+        verify(siteStore, never()).createApplicationPassword(any())
+    }
+
     // endregion
 
     // region recovery + capability stages