Stop full-row site writes from clobbering xmlRpcUrl

xmlRpcUrl is set either out of band (XML-RPC rediscovery) or by the
WP.com REST sync (meta.links.xmlrpc). A full-row insertOrUpdateSite
UPDATE built from a partial SiteModel that doesn't carry it — e.g. the
WPAPI fetch, which builds a model with a null xmlRpcUrl — wrote that
null over a good value.

Preserve XMLRPC_URL on absence in the generic update path: keep the
stored value when the inbound model has none, persist it when the model
carries one (the WP.com sync, including a changed endpoint after a
domain migration). Add a targeted updateXmlRpcUrl writer for the
single-column rediscovery heal; the recovery flow that calls it lands
separately.

Extends the #22905 fix to XMLRPC_URL.

Author: jkmassel

libs/fluxc/src/main/java/org/wordpress/android/fluxc/persistence/SiteSqlUtils.kt

@@ -221,9 +221,18 @@ class SiteSqlUtils
             AppLog.d(DB, "Updating site: " + finalSiteModel.url)
             val oldId = siteResult[0].id
             try {
-                // WP_API_REST_URL and the application-password credential columns are written out of band by
-                // dedicated single-column writers (updateWpApiRestUrl / updateApplicationPasswordCredentials),
-                // so they're excluded from the generic mapper to keep stale full-row writes from clobbering them.
+                // WP_API_REST_URL and the application-password credential columns are discovered/healed out
+                // of band — never carried by the general site-sync responses — so they're excluded from the
+                // generic mapper and written only by their dedicated writers (updateWpApiRestUrl /
+                // updateApplicationPasswordCredentials); a stale full-row write must not clobber them.
+                //
+                // XMLRPC_URL is different: the WP.com REST sync reliably carries it (meta.links.xmlrpc), so
+                // the generic write persists it — that's how a changed endpoint (e.g. a domain migration)
+                // lands. But partial writers that don't carry it (the WPAPI fetch builds a model with a null
+                // xmlRpcUrl) must not clear a stored/rediscovered value, so preserve it on absence.
+                if (finalSiteModel.xmlRpcUrl.isNullOrEmpty()) {
+                    finalSiteModel.xmlRpcUrl = siteResult[0].xmlRpcUrl
+                }
                 WellSql.update(SiteModel::class.java).whereId(oldId)
                         .put(
                                 finalSiteModel,
@@ -295,6 +304,23 @@ class SiteSqlUtils
      */
     fun clearWpApiRestUrl(localId: Int): Int = updateWpApiRestUrl(localId, "")
 
+    /**
+     * Targeted writer for [SiteModel.xmlRpcUrl], used by the XML-RPC rediscovery heal to persist just that
+     * one column without a full-row write of an in-memory model. Unlike [updateWpApiRestUrl], XMLRPC_URL is
+     * NOT excluded from the generic mapper — the WP.com sync reliably carries it — but the generic update
+     * path preserves it on absence, so a partial write can't clobber a rediscovered value. (The recovery flow
+     * that calls this lands separately.)
+     */
+    fun updateXmlRpcUrl(localId: Int, xmlRpcUrl: String): Int {
+        return WellSql.update(SiteModel::class.java)
+                .whereId(localId)
+                .put(xmlRpcUrl, { value ->
+                    val cv = ContentValues()
+                    cv.put(SiteModelTable.XMLRPC_URL, value)
+                    cv
+                }).execute()
+    }
+
     /**
      * Targeted writer for the application-password credential columns: the encrypted username and password
      * and their IVs. The four are written as a set — the IVs are required to decrypt the ciphertext, so

libs/fluxc/src/test/java/org/wordpress/android/fluxc/persistence/SiteSqlUtilsTest.kt

@@ -191,6 +191,82 @@ class SiteSqlUtilsTest {
         assertThat(stored.apiRestPasswordIV).isEmpty()
     }
 
+    @Test
+    fun `updateXmlRpcUrl writes the column and leaves other fields alone`() {
+        WellSql.insert(SiteModel().apply {
+            siteId = 42
+            url = "https://example.test"
+            name = "Example"
+            xmlRpcUrl = null
+        }).execute()
+        val localId = siteSqlUtils.getSites().single().id
+
+        val rowsUpdated = siteSqlUtils.updateXmlRpcUrl(localId, "https://example.test/xmlrpc.php")
+
+        assertThat(rowsUpdated).isEqualTo(1)
+        val stored = siteSqlUtils.getSites().single()
+        assertThat(stored.xmlRpcUrl).isEqualTo("https://example.test/xmlrpc.php")
+        assertThat(stored.url).isEqualTo("https://example.test")
+        assertThat(stored.name).isEqualTo("Example")
+    }
+
+    @Test
+    fun `updateXmlRpcUrl returns 0 when no site row matches the local id`() {
+        val rowsUpdated = siteSqlUtils.updateXmlRpcUrl(localId = 999, xmlRpcUrl = "https://example.test/xmlrpc.php")
+
+        assertThat(rowsUpdated).isEqualTo(0)
+    }
+
+    @Test
+    fun `insertOrUpdateSite update does not clobber xmlRpcUrl from a stale model`() {
+        // Absence is preserved: a partial writer that doesn't carry xmlRpcUrl (e.g. the WPAPI fetch) must
+        // not clear a stored/rediscovered value, even though XMLRPC_URL is not excluded from the mapper.
+        val xmlRpc = "https://example.test/xmlrpc.php"
+        WellSql.insert(SiteModel().apply {
+            siteId = 42
+            url = "https://example.test"
+            name = "Example"
+            xmlRpcUrl = xmlRpc
+        }).execute()
+        val localId = siteSqlUtils.getSites().single().id
+
+        val stale = SiteModel().apply {
+            id = localId
+            siteId = 42
+            url = "https://example.test"
+            name = "Updated name"
+            xmlRpcUrl = null
+        }
+        siteSqlUtils.insertOrUpdateSite(stale)
+
+        val stored = siteSqlUtils.getSites().single()
+        assertThat(stored.xmlRpcUrl).isEqualTo(xmlRpc) // preserved
+        assertThat(stored.name).isEqualTo("Updated name") // other columns still update
+    }
+
+    @Test
+    fun `insertOrUpdateSite update persists a changed xmlRpcUrl carried by the inbound model`() {
+        // Presence is authoritative: the WP.com sync reliably carries meta.links.xmlrpc, so a non-empty
+        // inbound value (e.g. a domain migration) must overwrite the stored one — only absence is preserved.
+        WellSql.insert(SiteModel().apply {
+            siteId = 42
+            url = "https://example.test"
+            xmlRpcUrl = "https://example.test/xmlrpc.php"
+        }).execute()
+        val localId = siteSqlUtils.getSites().single().id
+
+        val migrated = SiteModel().apply {
+            id = localId
+            siteId = 42
+            url = "https://example.test"
+            xmlRpcUrl = "https://migrated.test/xmlrpc.php"
+        }
+        siteSqlUtils.insertOrUpdateSite(migrated)
+
+        assertThat(siteSqlUtils.getSites().single().xmlRpcUrl)
+                .isEqualTo("https://migrated.test/xmlrpc.php")
+    }
+
     // Raw read that bypasses SiteSqlUtils' decryptAPIRestCredentials, so tests can assert on the stored
     // ciphertext columns directly without invoking the AndroidKeyStore-backed EncryptionUtils.
     private fun storedSite(): SiteModel = WellSql.select(SiteModel::class.java).asModel.single()