Skip to content

CMM-2304: Detect Jetpack status for application-password sites - #23248

Closed
nbradbury wants to merge 5 commits into
trunkfrom
issue/CMM-2304-jetpack-status
Closed

CMM-2304: Detect Jetpack status for application-password sites#23248
nbradbury wants to merge 5 commits into
trunkfrom
issue/CMM-2304-jetpack-status

Conversation

@nbradbury

@nbradbury nbradbury commented Aug 20, 2026

Copy link
Copy Markdown
Contributor

Description

TL/DR: Fixes CMM-2304. Sites added with an application password never had their Jetpack fields populated, which produced two visible bugs. This fills them in from the site's own REST API.


The WPAPI site fetch (ORIGIN_WPAPI) wrote name, description, hasWooCommerce and friends but left isJetpackInstalled, isJetpackConnected and siteId at their defaults. So the Jetpack app offered to install a plugin that was already installed, and the WordPress app told the owner of a plain self-hosted site that their site has the Jetpack plugin. SiteWPAPIRestClient now reads isJetpackInstalled from the jetpack/ REST namespace (registered only while the plugin is active) and, for application-password sites, reads the connection state and the WP.com blog id via wordpress-rs JetpackConnectionClient.status() — the only source for either. The blog id matters because Stats reads it; detecting the flags without it would just swap "Install Jetpack" for a Stats screen that errors.

Three supporting changes fall out of that. canInitiateJetpackRestConnection now accepts an unknown Jetpack version — the REST namespace carries no version, and checkMinimalVersion(null, …) returns false, which would have routed these sites to the web-view flow that can't work with an application password. fetchWPAPISite(site) carries the local id onto the returned model, or SiteSqlUtils falls through to a SITE_ID + URL match, misses, and inserts a duplicate row once a real blog id is present. And the two unsolicited Jetpack-app promos in the WordPress app (app-open overlay, My Site feature card) are gated on a new SiteModel?.canUseJetpackApp(); shouldRemoveJetpackFeatures() itself is untouched, since it's the feature-removal invariant for nav visibility and the Me row.

Testing instructions

Jetpack app, self-hosted site with Jetpack installed:

  1. Add the site with an application password.
  2. Open Stats.
  • Verify you are offered the in-app connection flow, not "Install Jetpack".
  1. Complete the connection, then force-refresh the site list.
  • Verify Stats loads (this needs the WP.com blog id to have been stored).
  • Verify the site list shows one row for the site, not two.

Jetpack app, self-hosted site without Jetpack:

  1. Add the site with an application password, open Stats.
  • Verify you still get the install/connect prompt.

WordPress app, self-hosted site without Jetpack:

  1. Add the site with an application password and open the app.
  • Verify no "Your site has the Jetpack plugin" overlay on launch.
  • Verify no Jetpack feature card on My Site.
  1. Switch to a WP.com or Jetpack-connected site.
  • Verify the overlay and card do appear there.

Sites added with an application password never had their Jetpack fields
populated, so the Jetpack app offered to install a plugin that was already
there and the WordPress app told sites without Jetpack that they had it.
The WPAPI fetch now derives isJetpackInstalled from the site's REST
namespaces and reads the connection state and WP.com blog id over
wordpress-rs, and the two unsolicited Jetpack-app promos are gated on
whether the selected site can actually use that app.
@dangermattic

dangermattic commented Aug 20, 2026

Copy link
Copy Markdown
Collaborator
1 Warning
⚠️ This PR is larger than 300 lines of changes. Please consider splitting it into smaller PRs for easier and faster reviews.
1 Message
📖 This PR is still a Draft: some checks will be skipped.

Generated by 🚫 Danger

@wpmobilebot

wpmobilebot commented Aug 20, 2026

Copy link
Copy Markdown
Contributor

App Icon📲 You can test the changes from this Pull Request in WordPress Android by scanning the QR code below to install the corresponding build.

App NameWordPress Android
Build TypeDebug
Versionpr23248-c430c49
Build Number1498
Application IDorg.wordpress.android.prealpha
Commitc430c49
Installation URL64s0b4u646ku0
Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

@wpmobilebot

wpmobilebot commented Aug 20, 2026

Copy link
Copy Markdown
Contributor

App Icon📲 You can test the changes from this Pull Request in Jetpack Android by scanning the QR code below to install the corresponding build.

App NameJetpack Android
Build TypeDebug
Versionpr23248-c430c49
Build Number1498
Application IDcom.jetpack.android.prealpha
Commitc430c49
Installation URL28d0kprhr1p18
Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

The guard clauses put the function at three returns against a limit of two,
so they collapse into a single condition.
@wpmobilebot

wpmobilebot commented Aug 20, 2026

Copy link
Copy Markdown
Contributor

🤖 Build Failure Analysis

This build has failures. Claude has analyzed them - check the build annotations for details.

CMM-2304 lists MenuActivity's missing navigation branches under "Separate
bugs found while tracing" and asks for them to be split out, so revert them
here and keep this branch to Jetpack detection.

The change is unrelated to detection: those actions were silently dropped by
`else -> {}` regardless of a site's Jetpack state. It also only covers two of
the three missing branches -- ShowJetpackRemovalStaticPostersView is still
unhandled -- which is better resolved together in the follow-up.
Detecting `isJetpackConnected` for application-password sites was not enough
to open Stats. The flag says the site is connected to *an* account, but the
blog ID belongs to whichever account made the connection, which needn't be
the one signed in here. Stats are served by WordPress.com, so the request
reached the right site and was refused: `403 - user cannot view stats`.

Add `WpComSiteAccessChecker`, which asks whether this account can reach a
site over the WordPress.com REST API -- true for sites already accessed that
way, and otherwise only when the same blog ID also arrived from `/me/sites`,
since the account's site list is the record of what it can reach.

`ListItemActionHandler` now requires that before routing to Stats, so an
unowned site falls through to the connection flow instead of a screen that
errors. `canInitiateJetpackRestConnection` takes the same signal, because
its "already connected" check would otherwise reject these sites and drop
them into the web-view flow; the REST flow's ConnectUser step is exactly
what links the signed-in account.
StatsConnectJetpackActivity pitches installing Jetpack with no branch on
whether the site has it, and only consults canInitiateJetpackRestConnection
once its button is tapped. Routing an already-installed site here therefore
told the user to install a plugin that was in front of them -- the symptom
CMM-2304 is about.

Start the connection flow directly when Jetpack is installed, and never
build the pitch. That flow's install step recognises Jetpack is present and
moves on to connecting the account, which is the step actually missing.
Sites without Jetpack are unaffected and still get the install screen.
@nbradbury

Copy link
Copy Markdown
Contributor Author

Closing this. Claude made a real mess of it and introduced some errors.

@nbradbury nbradbury closed this Aug 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants