Contain unexpected throws in SiteXmlRpcUrlRecoverer

discoverAndVerifyXmlRpcUrl caught only DiscoveryException, so a RuntimeException from the
discovery/verify path would escape the async, cancel the whole provisioning coroutine, and reach
appScope (no SupervisorJob/handler). Catch CancellationException + generic Exception like the sibling
SiteApiRestUrlRecoverer, so any failure degrades to the XML-RPC-disabled card and retries next run.

Author: jkmassel

WordPress/src/main/java/org/wordpress/android/ui/accounts/login/SiteXmlRpcUrlRecoverer.kt

@@ -12,14 +12,16 @@ import org.wordpress.android.util.AppLog
 import javax.inject.Inject
 import javax.inject.Named
 import javax.inject.Singleton
+import kotlin.coroutines.cancellation.CancellationException
 
 /**
  * Heals [SiteModel.xmlRpcUrl] for true self-hosted sites whose XML-RPC endpoint was never
  * discovered (or was previously gated). The REST counterpart is [SiteApiRestUrlRecoverer]; this
  * follows the same shape so callers never hold a mutated [SiteModel]:
  *
  * - [discoverAndVerifyXmlRpcUrl] discovers the endpoint and confirms it works with an authenticated
- *   call, returning the verified URL (or `null` if discovery/verification fails).
+ *   call using the site's application-password credentials, returning the verified URL (or `null`
+ *   if discovery/verification fails).
  * - [persistXmlRpcUrl] writes only that one column to the DB row for `localId`.
  */
 @Singleton
@@ -30,7 +32,7 @@ class SiteXmlRpcUrlRecoverer @Inject constructor(
     private val appLogWrapper: AppLogWrapper,
     @param:Named(BG_THREAD) private val bgDispatcher: CoroutineDispatcher,
 ) {
-    @Suppress("SwallowedException")
+    @Suppress("SwallowedException", "TooGenericExceptionCaught")
     suspend fun discoverAndVerifyXmlRpcUrl(site: SiteModel): String? = withContext(bgDispatcher) {
         try {
             val endpoint = selfHostedEndpointFinder.verifyOrDiscoverXMLRPCEndpoint(site.url)
@@ -45,9 +47,21 @@ class SiteXmlRpcUrlRecoverer @Inject constructor(
             } else {
                 endpoint
             }
+        } catch (e: CancellationException) {
+            throw e
         } catch (e: SelfHostedEndpointFinder.DiscoveryException) {
+            // Expected when the site has no reachable XML-RPC endpoint — surfaces as the
+            // XML-RPC-disabled card (xmlRpcUrl stays empty) and retries on the next run.
             appLogWrapper.w(AppLog.T.API, "XML-RPC discovery failed for ${site.url}")
             null
+        } catch (e: Exception) {
+            // Best-effort recovery must never let an unexpected throw escape and cancel the
+            // provisioning pipeline (mirrors SiteApiRestUrlRecoverer). Same null -> disabled-card surface.
+            appLogWrapper.e(
+                AppLog.T.API,
+                "XML-RPC discovery threw for ${site.url}: ${e::class.simpleName}: ${e.message}"
+            )
+            null
         }
     }
 

WordPress/src/test/java/org/wordpress/android/ui/accounts/login/SiteXmlRpcUrlRecovererTest.kt

@@ -56,7 +56,8 @@ class SiteXmlRpcUrlRecovererTest : BaseUnitTest() {
     @Test
     fun `given discovery and authenticated verify succeed, then returns the endpoint`() = test {
         whenever(selfHostedEndpointFinder.verifyOrDiscoverXMLRPCEndpoint(site.url)).thenReturn(ENDPOINT)
-        whenever(siteXMLRPCClient.fetchSites(eq(ENDPOINT), any(), any()))
+        // The site's stored credentials are forwarded to the authenticated verify call.
+        whenever(siteXMLRPCClient.fetchSites(eq(ENDPOINT), eq("user"), eq("pass")))
             .thenReturn(SitesModel(listOf(SiteModel())))
 
         assertThat(recoverer.discoverAndVerifyXmlRpcUrl(site)).isEqualTo(ENDPOINT)
@@ -70,6 +71,16 @@ class SiteXmlRpcUrlRecovererTest : BaseUnitTest() {
         assertThat(recoverer.discoverAndVerifyXmlRpcUrl(site)).isNull()
     }
 
+    @Test
+    fun `given discovery throws an unexpected exception, then returns null`() = test {
+        // A non-DiscoveryException (e.g. a RuntimeException from the network/parse path) must be
+        // contained, not propagated — otherwise it cancels the whole provisioning pipeline.
+        whenever(selfHostedEndpointFinder.verifyOrDiscoverXMLRPCEndpoint(site.url))
+            .thenThrow(RuntimeException("unexpected"))
+
+        assertThat(recoverer.discoverAndVerifyXmlRpcUrl(site)).isNull()
+    }
+
     @Test
     fun `given the authenticated verify errors, then returns null`() = test {
         whenever(selfHostedEndpointFinder.verifyOrDiscoverXMLRPCEndpoint(site.url)).thenReturn(ENDPOINT)