Handle deletion of app password when authenticated with WPCom

[itsmeichigo]

Close WOOMOB-1177

Description

This PR adds the support for cleaning up application password when user is authenticated with WPCom. The idea to delete passwords in two places:

• Delete password created for the last site upon switching to a different site. In this case, only delete password remotely to avoid deleting the password created for the new site by mistake (race condition).
• Delete password when logging out. In this case, delete both locally and remotely.

Apologies for the large changes, most of them come from unit tests. Specifically:

• Updates ApplicationPasswordUseCase to support deleting password remotely only.
• Moves the trigger to delete password from SessionManager to DefaultStoresManager for separation of concern and easier testing.
• Updates SessionManager to support delete password when authenticated with WPCom.
• Updates DefaultStoresManager to trigger delete password remotely only for switching sites (in removeDefaultStore) and locally upon logout (in deauthenticate).
• Updates app password use cases for testability.
• Updates ApplicationPasswordNameAndUUIDMapper to support parsing app password from Jetpack-proxied response with data envelope.
• Adds tests.

Testing steps

WPCom authentication

• Using at least 2 test stores, revoke all app passwords for your user in wp-admin > Users > Profile.
• Log in to Store A on the app as the same user using WPCom credentials.
• Confirm in wp-admin that an application password is created for your user.
• Switch to Store B. Confirm that:
  • The password created in Store A is deleted.
  • The app works correctly with direct requests to store B (confirmed with Proxyman).
  • A password is created for your user in store B.
• Repeat the steps with another test store if you have more, or switch back and forth between the stores.
• Log out of the app. Confirm that the password created for the last store is removed.

Site credentials / app password login

• Using a self-hosted store, revoke all app passwords for your user in wp-admin > Users > Profile.
• Log in to the store on the app using site credentials.
• Check on wp-admin and confirm that a password is created for your user.
• Log out of the app.
• Check on wp-admin and confirm that the created password has been removed.

Testing information

• Confirmed the above steps with 3 test stores.
• Added unit tests for app password use cases and default stores manager.

Screenshots

No UI changes.

---

• I have considered if this change warrants user-facing release notes and have added them to RELEASE-NOTES.txt if necessary.

[wpmobilebot]

📲 You can test the changes from this Pull Request in WooCommerce iOS Prototype by scanning the QR code below to install the corresponding build.

	App Name	WooCommerce iOS Prototype
	Build Number	pr16046-f302200
	Version	23.1
	Bundle ID	com.automattic.alpha.woocommerce
	Commit	f302200
	Installation URL	55n8r8v7bc460

Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

[itsmeichigo]

These tests are removed as they are incorrect. Unit tests should only test immediate functionalities.

[RafaelKayumov]

LGTM.

WP.com authorized accounts switching produced a new password after login on site B and deleted the password on site A. Store credentials login produced a new application password. Logging out caused the password deletion.

Just left a couple of non-blocking comments.

[RafaelKayumov]

NIT: Will the applicationPasswordUseCase instance live until the next deleteApplicationPassword(using creds: Credentials?, locally: Bool) is called? Should we clean that up after async task is completed?

[itsmeichigo]

Cleanup added in f302200.

[RafaelKayumov]

I'm still not fluent with the application passwords states and logic. So the question: what's the reason for removing the password deletion on reset call?

[RafaelKayumov]

Was the deleteApplicationPassword(locally: true) just moved outside of the reset?

[itsmeichigo]

Yes just moved outside for separation of concern. The method is not called anywhere else other than DefaultStoresManager.