Fix false "XML-RPC Disabled" card on rate-limited self-hosted sites (#23120)

App-password self-hosted sites could wrongly show the "XML-RPC Disabled"
My Site card even when XML-RPC is enabled, because a transient HTTP 429
(rate-limit) was treated as "XML-RPC unavailable" in two places:

1. Discovery succeeds at login but the authenticated XML-RPC fetch 429s:
   fetchSitesXmlRpcFromApplicationPassword fell back to WPAPI and dropped
   the already-verified endpoint. Now it persists the verified endpoint on
   the WPAPI-stored site via the new URL-keyed updateXmlRpcUrlForWPAPISite.

2. Discovery itself 429s: DiscoveryXMLRPCClient.listMethods swallowed the
   429 as an empty response, so discovery reported MISSING_XMLRPC_METHOD /
   NO_SITE_ERROR, indistinguishable from a genuinely disabled site. (Note:
   Volley's ClientError for 429 extends ServerError, so the 429 must be
   handled inside the ServerError branch.) A new DiscoveryError.RATE_LIMITED
   is now thrown and propagated through verifyXMLRPCUrl /
   checkXMLRPCEndpointValidity.

The card slice no longer shows the warning optimistically:
attemptXmlRpcRediscovery surfaces the card only on a definitive-negative
discovery result (NO_SITE_ERROR, MISSING_XMLRPC_METHOD, XMLRPC_BLOCKED,
XMLRPC_FORBIDDEN); transient/unknown failures keep it hidden and re-check
on the next refresh. It also bails on the first 429 instead of firing a
burst of discovery requests that re-trigger the rate limit.

Genuine detection is preserved: a truly disabled site (clean 404/405/403,
no 429) still surfaces the warning.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: adalpari

WordPress/src/main/java/org/wordpress/android/ui/mysite/cards/applicationpassword/ApplicationPasswordViewModelSlice.kt

@@ -147,7 +147,10 @@ class ApplicationPasswordViewModelSlice @Inject constructor(
         // Only true self-hosted sites need the XML-RPC fallback path — Atomic and Jetpack-WPCom-REST
         // sites talk REST end-to-end and don't need XML-RPC.
         if (!site.isUsingWpComRestApi && site.xmlRpcUrl.isNullOrEmpty()) {
-            buildXmlRpcDisabledCard(site)
+            // A missing xmlRpcUrl doesn't mean XML-RPC is disabled — the login fetch may have fallen back to
+            // WPAPI on a transient error (e.g. a 429 rate-limit). Keep the card hidden and let rediscovery
+            // decide; it only surfaces the warning on a definitive negative.
+            uiModelMutable.postValue(null)
             attemptXmlRpcRediscovery(site)
         } else {
             uiModelMutable.postValue(null)
@@ -235,39 +238,57 @@ class ApplicationPasswordViewModelSlice @Inject constructor(
     @VisibleForTesting(otherwise = VisibleForTesting.PRIVATE)
     internal fun attemptXmlRpcRediscovery(site: SiteModel) {
         scope.launch {
-            try {
-                val xmlRpcEndpoint = withContext(ioDispatcher) {
+            val xmlRpcEndpoint = try {
+                withContext(ioDispatcher) {
                     selfHostedEndpointFinder
                         .verifyOrDiscoverXMLRPCEndpoint(site.url)
                 }
-
-                // Verify with an authenticated call
-                val result = withContext(ioDispatcher) {
-                    siteXMLRPCClient.fetchSites(
-                        xmlRpcEndpoint,
-                        site.apiRestUsernamePlain,
-                        site.apiRestPasswordPlain
+            } catch (e: SelfHostedEndpointFinder.DiscoveryException) {
+                // Only surface the "XML-RPC Disabled" warning on a definitive negative. A transient failure
+                // (e.g. a 429 rate-limit) leaves the state unknown, so keep the card hidden and re-check on the
+                // next refresh rather than wrongly claiming XML-RPC is off.
+                if (e.discoveryError.indicatesXmlRpcUnavailable()) {
+                    buildXmlRpcDisabledCard(site)
+                } else {
+                    uiModelMutable.postValue(null)
+                    appLogWrapper.d(
+                        AppLog.T.MAIN,
+                        "A_P: XML-RPC rediscovery inconclusive for ${site.url} " +
+                            "(${e.discoveryError}) - hiding card"
                     )
                 }
-                if (result.isError) {
-                    return@launch
-                }
+                return@launch
+            }
 
+            // Discovery verified a working xmlrpc.php, so XML-RPC is enabled. Confirm the credentials with an
+            // authenticated call before persisting the endpoint, but keep the card hidden either way.
+            val result = withContext(ioDispatcher) {
+                siteXMLRPCClient.fetchSites(
+                    xmlRpcEndpoint,
+                    site.apiRestUsernamePlain,
+                    site.apiRestPasswordPlain
+                )
+            }
+            if (!result.isError) {
                 site.xmlRpcUrl = xmlRpcEndpoint
                 // Persist only the rediscovered column — mirrors healApiRestUrlIfMissing. A full-row
                 // updateSite would rewrite ~80 columns from this in-memory model for a one-field change
                 // (risking clobbering other out-of-band values), so write just xmlRpcUrl.
                 siteStore.persistXmlRpcUrl(site.id, xmlRpcEndpoint)
-                buildCard(site)
-            } catch (
-                @Suppress("SwallowedException")
-                e: SelfHostedEndpointFinder.DiscoveryException
-            ) {
-                // XML-RPC rediscovery failed; card remains visible
             }
+            uiModelMutable.postValue(null)
         }
     }
 
+    // A missing/unusable XML-RPC endpoint is only a genuine "disabled" signal when discovery reaches a
+    // definitive conclusion. Transient errors (RATE_LIMITED, GENERIC_ERROR) and unrelated conditions
+    // (auth/SSL/invalid URL) must not surface the warning, to avoid false positives on throttled sites.
+    private fun SelfHostedEndpointFinder.DiscoveryError.indicatesXmlRpcUnavailable(): Boolean =
+        this == SelfHostedEndpointFinder.DiscoveryError.NO_SITE_ERROR ||
+            this == SelfHostedEndpointFinder.DiscoveryError.MISSING_XMLRPC_METHOD ||
+            this == SelfHostedEndpointFinder.DiscoveryError.XMLRPC_BLOCKED ||
+            this == SelfHostedEndpointFinder.DiscoveryError.XMLRPC_FORBIDDEN
+
     private fun onClick(site: SiteModel, alternativeUrl: String) {
         _onNavigation.postValue(
             Event(

WordPress/src/test/java/org/wordpress/android/ui/mysite/cards/applicationpassword/ApplicationPasswordViewModelSliceTest.kt

@@ -19,6 +19,7 @@ import org.mockito.kotlin.verify
 import org.mockito.kotlin.whenever
 import org.wordpress.android.BaseUnitTest
 import org.mockito.kotlin.mock
+import org.wordpress.android.R
 import org.wordpress.android.fluxc.model.SiteModel
 import org.wordpress.android.fluxc.model.SitesModel
 import org.wordpress.android.fluxc.network.BaseRequest.BaseNetworkError
@@ -424,14 +425,16 @@ class ApplicationPasswordViewModelSliceTest : BaseUnitTest() {
         }
 
     @Test
-    fun `given xmlRpc rediscovery fails, then do not persist`() =
+    fun `given xmlRpc rediscovery fails with a definitive negative, then show the disabled card`() =
         runTest {
             siteTest.xmlRpcUrl = null
             whenever(
                 selfHostedEndpointFinder
                     .verifyOrDiscoverXMLRPCEndpoint(TEST_URL)
             ).thenThrow(
-                mock<SelfHostedEndpointFinder.DiscoveryException>()
+                SelfHostedEndpointFinder.DiscoveryException(
+                    SelfHostedEndpointFinder.DiscoveryError.NO_SITE_ERROR, TEST_URL
+                )
             )
 
             applicationPasswordViewModelSlice
@@ -441,5 +444,33 @@ class ApplicationPasswordViewModelSliceTest : BaseUnitTest() {
                 .verifyOrDiscoverXMLRPCEndpoint(TEST_URL)
             verify(siteStore, never()).persistXmlRpcUrl(any(), any())
             assert(siteTest.xmlRpcUrl.isNullOrEmpty())
+            val card = applicationPasswordCard
+            assertNotNull(card)
+            assert(card is MySiteCardAndItem.Item.SingleActionCard)
+            assert(
+                (card as MySiteCardAndItem.Item.SingleActionCard).textResource ==
+                    R.string.xmlrpc_disabled_card_text
+            )
+        }
+
+    @Test
+    fun `given xmlRpc rediscovery fails transiently with rate limiting, then keep the card hidden`() =
+        runTest {
+            siteTest.xmlRpcUrl = null
+            whenever(
+                selfHostedEndpointFinder
+                    .verifyOrDiscoverXMLRPCEndpoint(TEST_URL)
+            ).thenThrow(
+                SelfHostedEndpointFinder.DiscoveryException(
+                    SelfHostedEndpointFinder.DiscoveryError.RATE_LIMITED, TEST_URL
+                )
+            )
+
+            applicationPasswordViewModelSlice
+                .attemptXmlRpcRediscovery(siteTest)
+
+            verify(siteStore, never()).persistXmlRpcUrl(any(), any())
+            assert(siteTest.xmlRpcUrl.isNullOrEmpty())
+            assertNull(applicationPasswordCard)
         }
 }

libs/fluxc/src/main/java/org/wordpress/android/fluxc/network/discovery/DiscoveryXMLRPCClient.java

@@ -116,11 +116,19 @@ public Object[] listMethods(@NonNull String url) throws DiscoveryException {
                 // In the event of an SSL handshake error we should stop attempting discovery
                 throw new DiscoveryException(DiscoveryError.ERRONEOUS_SSL_CERTIFICATE, url);
             } else if (e.getCause() instanceof ServerError) {
+                // Note: Volley's ClientError (used for 4xx) extends ServerError, so 4xx responses land here too.
                 NetworkResponse networkResponse = ((ServerError) e.getCause()).networkResponse;
                 if (networkResponse == null) {
                     return null;
                 }
 
+                if (networkResponse.statusCode == 429) {
+                    // A 429 (rate-limited) is transient. Falling through to the null return below would be read
+                    // as "no XML-RPC methods found" and misclassified as MISSING_XMLRPC_METHOD/NO_SITE_ERROR,
+                    // so surface a distinct transient error instead.
+                    throw new DiscoveryException(DiscoveryError.RATE_LIMITED, url);
+                }
+
                 if (networkResponse.statusCode == 405 && !new String(networkResponse.data).contains(
                         "XML-RPC server accepts POST requests only.")) {
                     // XML-RPC is blocked by the server (POST request returns a 405 "Method Not Allowed" error)

libs/fluxc/src/main/java/org/wordpress/android/fluxc/network/discovery/SelfHostedEndpointFinder.java

@@ -45,6 +45,9 @@ public enum DiscoveryError implements OnChangedError {
         WORDPRESS_COM_SITE,
         XMLRPC_BLOCKED,
         XMLRPC_FORBIDDEN,
+        // Transient: the server rate-limited us (HTTP 429). Kept distinct from the "missing/blocked" errors so
+        // callers don't misread a temporary throttle as XML-RPC being disabled.
+        RATE_LIMITED,
         GENERIC_ERROR
     }
 
@@ -54,7 +57,7 @@ public static class DiscoveryException extends Exception {
         @NonNull public final DiscoveryError discoveryError;
         @Nullable public final String failedUrl;
 
-        DiscoveryException(@NonNull DiscoveryError failureType, @Nullable String failedUrl) {
+        public DiscoveryException(@NonNull DiscoveryError failureType, @Nullable String failedUrl) {
             this.discoveryError = failureType;
             this.failedUrl = failedUrl;
         }
@@ -183,7 +186,8 @@ private String verifyXMLRPCUrl(@NonNull final String siteUrl) throws DiscoveryEx
                 if (e.discoveryError == DiscoveryError.ERRONEOUS_SSL_CERTIFICATE
                     || e.discoveryError == DiscoveryError.HTTP_AUTH_REQUIRED
                     || e.discoveryError == DiscoveryError.MISSING_XMLRPC_METHOD
-                    || e.discoveryError == DiscoveryError.XMLRPC_BLOCKED) {
+                    || e.discoveryError == DiscoveryError.XMLRPC_BLOCKED
+                    || e.discoveryError == DiscoveryError.RATE_LIMITED) {
                     throw e;
                 }
                 // Otherwise. swallow the error since we are just verifying various URLs
@@ -353,6 +357,10 @@ private boolean checkXMLRPCEndpointValidity(@NonNull String url) throws Discover
                 throw new DiscoveryException(DiscoveryError.XMLRPC_BLOCKED, url);
             } else if (e.discoveryError.equals(DiscoveryError.MISSING_XMLRPC_METHOD)) {
                 throw new DiscoveryException(DiscoveryError.MISSING_XMLRPC_METHOD, url);
+            } else if (e.discoveryError.equals(DiscoveryError.RATE_LIMITED)) {
+                // Surface the transient throttle instead of swallowing it and returning false (which callers
+                // would treat as "endpoint found but methods missing").
+                throw new DiscoveryException(DiscoveryError.RATE_LIMITED, url);
             }
         } catch (IllegalArgumentException e) {
             // The XML-RPC client returns this error in case of redirect to an invalid URL.

libs/fluxc/src/main/java/org/wordpress/android/fluxc/persistence/SiteSqlUtils.kt

@@ -404,6 +404,17 @@ class SiteSqlUtils
         return updateApplicationPasswordCredentials(localId, usernamePlain, passwordPlain)
     }
 
+    /**
+     * URL-keyed variant of [updateXmlRpcUrl] for ORIGIN_WPAPI sites fetched without a local id. Used when an
+     * application-password site falls back to the WPAPI fetch even though XML-RPC discovery already verified a
+     * working xmlrpc.php endpoint, so the verified endpoint is recorded rather than lost. See
+     * [updateWpApiRestUrlForWPAPISite].
+     */
+    fun updateXmlRpcUrlForWPAPISite(siteUrl: String, xmlRpcUrl: String): Int {
+        val localId = wpApiSiteLocalIdByUrl(siteUrl) ?: return 0
+        return updateXmlRpcUrl(localId, xmlRpcUrl)
+    }
+
     private fun wpApiSiteLocalIdByUrl(siteUrl: String): Int? =
         WellSql.select(SiteModel::class.java)
                 .where().beginGroup()

libs/fluxc/src/main/java/org/wordpress/android/fluxc/store/SiteStore.kt

@@ -1559,13 +1559,17 @@ open class SiteStore @Inject constructor(
                             " (${sites.error?.message})," +
                             " falling back to WPAPI"
                     )
-                    // Use apiRootUrl as the base URL for
-                    // WPAPI discovery since payload.url
-                    // is the xmlrpc.php endpoint.
+                    // Use apiRootUrl as the base URL for WPAPI discovery since payload.url is the xmlrpc.php
+                    // endpoint. This action is only dispatched after verifyOrDiscoverXMLRPCEndpoint already
+                    // confirmed payload.url is a working xmlrpc.php endpoint, so this fetch failure is transient
+                    // (e.g. a 429 rate-limit) or auth-only — XML-RPC itself is enabled. Pass the verified
+                    // endpoint through so it's recorded on the WPAPI-stored site and the "XML-RPC Disabled" card
+                    // isn't shown for a site that actually supports XML-RPC.
                     fetchSiteWPAPIFromApplicationPassword(
                         payload.copy(
                             url = payload.apiRootUrl
-                        )
+                        ),
+                        verifiedXmlRpcUrl = payload.url,
                     )
                 } else {
                     updateSites(sites)
@@ -1596,7 +1600,8 @@ open class SiteStore @Inject constructor(
 
     @Suppress("TooGenericExceptionCaught")
     internal suspend fun fetchSiteWPAPIFromApplicationPassword(
-        payload: RefreshSitesXMLRPCApplicationPasswordCredentialsPayload
+        payload: RefreshSitesXMLRPCApplicationPasswordCredentialsPayload,
+        verifiedXmlRpcUrl: String? = null,
     ): OnSiteChanged {
         return coroutineEngine.withDefaultContext(
             T.API,
@@ -1628,6 +1633,13 @@ open class SiteStore @Inject constructor(
                         },
                         { siteSqlUtils.updateWpApiRestUrlForWPAPISite(siteModel.url, it) }
                     )
+                    // When XML-RPC discovery already verified an endpoint but the XML-RPC fetch fell back to
+                    // WPAPI, record the verified endpoint (keyed by siteModel.url, since the fresh site has no
+                    // local id) so XML-RPC-dependent features stay available and the "XML-RPC Disabled" card
+                    // isn't shown.
+                    if (!verifiedXmlRpcUrl.isNullOrEmpty()) {
+                        siteSqlUtils.updateXmlRpcUrlForWPAPISite(siteModel.url, verifiedXmlRpcUrl)
+                    }
                 }
                 result
             } catch (e: Exception) {

libs/fluxc/src/test/java/org/wordpress/android/fluxc/persistence/SiteSqlUtilsTest.kt

@@ -135,6 +135,41 @@ class SiteSqlUtilsTest {
                 .isEqualTo("https://selfhosted.test/wp-json/")
     }
 
+    @Test
+    fun `updateXmlRpcUrlForWPAPISite updates the matching WPAPI site by url`() {
+        WellSql.insert(SiteModel().apply {
+            url = "https://selfhosted.test"
+            origin = SiteModel.ORIGIN_WPAPI
+            xmlRpcUrl = null
+        }).execute()
+
+        val rows = siteSqlUtils.updateXmlRpcUrlForWPAPISite(
+                siteUrl = "https://selfhosted.test",
+                xmlRpcUrl = "https://selfhosted.test/xmlrpc.php"
+        )
+
+        assertThat(rows).isEqualTo(1)
+        assertThat(siteSqlUtils.getSites().single().xmlRpcUrl)
+                .isEqualTo("https://selfhosted.test/xmlrpc.php")
+    }
+
+    @Test
+    fun `updateXmlRpcUrlForWPAPISite leaves a non-WPAPI site with the same url untouched`() {
+        WellSql.insert(SiteModel().apply {
+            url = "https://shared.test"
+            origin = SiteModel.ORIGIN_WPCOM_REST
+            xmlRpcUrl = null
+        }).execute()
+
+        val rows = siteSqlUtils.updateXmlRpcUrlForWPAPISite(
+                siteUrl = "https://shared.test",
+                xmlRpcUrl = "https://shared.test/xmlrpc.php"
+        )
+
+        assertThat(rows).isEqualTo(0)
+        assertThat(siteSqlUtils.getSites().single().xmlRpcUrl).isNull()
+    }
+
     @Test
     fun `updateWpApiRestUrlForWPAPISite leaves a non-WPAPI site with the same url untouched`() {
         WellSql.insert(SiteModel().apply {

libs/fluxc/src/test/java/org/wordpress/android/fluxc/store/SiteStoreTest.kt

@@ -592,6 +592,53 @@ class SiteStoreTest {
             )
         }
 
+    @Test
+    fun `fetchSitesXmlRpc AP fallback persists verified xmlrpc endpoint on WPAPI site`() =
+        test {
+            org.mockito.Mockito.mockStatic(
+                org.wordpress.android.util.AppLog::class.java
+            ).use {
+                // Given: XML-RPC discovery already verified this endpoint (that's the only reason this action
+                // is dispatched), but the authenticated XML-RPC fetch fails transiently (e.g. a 429 rate-limit).
+                val xmlRpcEndpoint = "https://example.com/xmlrpc.php"
+                val payload =
+                    SiteStore.RefreshSitesXMLRPCApplicationPasswordCredentialsPayload(
+                        username = "appUser",
+                        password = "appPass",
+                        url = xmlRpcEndpoint,
+                        apiRootUrl = "https://example.com/wp-json/",
+                    )
+                val erroredSites = SitesModel().apply { error = BaseNetworkError(PARSE_ERROR) }
+                whenever(
+                    siteXMLRPCClient.fetchSitesFromApplicationPassword(
+                        payload.url,
+                        payload.apiRootUrl,
+                        payload.username,
+                        payload.password
+                    )
+                ).thenReturn(erroredSites)
+                val fetchedSite = SiteModel().apply {
+                    name = "Test Site"
+                    origin = SiteModel.ORIGIN_WPAPI
+                    url = "https://example.com"
+                }
+                whenever(siteWPAPIClient.fetchWPAPISite(any<SiteStore.FetchWPAPISitePayload>()))
+                    .thenReturn(fetchedSite)
+                whenever(siteSqlUtils.insertOrUpdateSite(fetchedSite)).thenReturn(1)
+
+                // When
+                val result = siteStore.fetchSitesXmlRpcFromApplicationPassword(payload)
+
+                // Then: the WPAPI fallback stored the site, and the verified xmlrpc endpoint is recorded so the
+                // "XML-RPC Disabled" card isn't shown for a site that actually supports XML-RPC.
+                assertThat(result.isError).isFalse()
+                verify(siteSqlUtils).updateXmlRpcUrlForWPAPISite(
+                    "https://example.com",
+                    xmlRpcEndpoint
+                )
+            }
+        }
+
     @Test
     fun `updateApplicationPassword persists credentials and wpApiRestUrl via targeted writers`() {
         val existing = SiteModel().apply {