Fix NPE when creating app password for site with no username

[adalpari]

Description

Fixes a NullPointerException thrown while creating an Application Password for a self-hosted site that has no stored username.

In ApplicationPasswordsManager.getOrFetchUsername, a non-WPCOM site passed site.username straight into UsernameFetchPayload's non-null String constructor. Since SiteModel.username is a Java (nullable) field, a null value triggered the compiler-generated overload-disambiguation getClass() check, crashing with:

java.lang.NullPointerException: Attempt to invoke virtual method
'java.lang.Class java.lang.Object.getClass()' on a null object reference
    at ...ApplicationPasswordsManager.getOrFetchUsername(ApplicationPasswordsManager.kt:77)

The fix guards for a null/empty username and returns a NOT_AUTHENTICATED error payload instead of crashing. The existing caller already converts an error payload into an ApplicationPasswordCreationResult.Failure, consistent with the equivalent guard in createApplicationPassword.

Testing instructions

I don't think there's a manual way to test this.

[dangermattic]

	1 Warning
⚠️	PR is not assigned to a milestone.

Generated by 🚫 Danger

[wpmobilebot]

📲 You can test the changes from this Pull Request in WordPress Android by scanning the QR code below to install the corresponding build.

	App Name	WordPress Android
	Build Type	Debug
	Version	pr22984-f420d15
	Build Number	1495
	Application ID	org.wordpress.android.prealpha
	Commit	f420d15
	Installation URL	6s9r5oh0nuk7g

Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

[wpmobilebot]

📲 You can test the changes from this Pull Request in Jetpack Android by scanning the QR code below to install the corresponding build.

	App Name	Jetpack Android
	Build Type	Debug
	Version	pr22984-f420d15
	Build Number	1495
	Application ID	com.jetpack.android.prealpha
	Commit	f420d15
	Installation URL	71hndkilf2jbg

Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 37.40%. Comparing base (b992ed0) to head (f420d15).

Additional details and impacted files

@@               Coverage Diff                @@
##           release/26.8   #22984      +/-   ##
================================================
+ Coverage         37.38%   37.40%   +0.01%     
================================================
  Files              2320     2320              
  Lines            124718   124725       +7     
  Branches          16963    16964       +1     
================================================
+ Hits              46631    46652      +21     
+ Misses            74323    74311      -12     
+ Partials           3764     3762       -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[nbradbury]

@adalpari Claude flagged this:

Adjacent pre-existing bug (out of scope, worth flagging). The PR description says the new guard is “consistent with the equivalent guard in createApplicationPassword” — but that equivalent guard at lines 98-113 is actually missing a return:

[adalpari]

@adalpari Claude flagged this:

Adjacent pre-existing bug (out of scope, worth flagging). The PR description says the new guard is “consistent with the equivalent guard in createApplicationPassword” — but that equivalent guard at lines 98-113 is actually missing a return:

I've added that change now. Thanks!

[nbradbury]

Looks good!