Repository navigation
chore: freeze V1 block allow-list from block-library audit (#315) - #332
Merged
Merged
Conversation
Audits every block in @wordpress/block-library v9.44 against the empty-state @wordpress/core-data shim and freezes the V1 enabled_blocks / disabled_blocks config based on that audit. Adds a getEnabledBlockNames() helper on the VisualEditor class that applies the allow-list + deny-list filters and a snapshot test that guards the frozen default set. - docs/block-library-audit.md: per-block classification (green / empty-state / crash) - config/visual-editor.php: frozen enabled_blocks (27) and disabled_blocks (17) - src/VisualEditor.php: getEnabledBlockNames() with allow-list + deny-list + dedup - tests/Unit/VisualEditor/EnabledBlockNamesTest.php: snapshot + 4 behavior tests - README.md: disabled-by-default block summary linking to the audit doc Closes #315
📝 WalkthroughWalkthroughThis change completes the M5 block set audit, establishing a frozen allow-list and deny-list of WordPress blocks in Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~22 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Closed
7 tasks
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/VisualEditor.php`:
- Around line 113-142: The controller currently returns the full registry
instead of honoring the VisualEditor allow/deny lists; update
VisualEditorBlocksController::index() to call
VisualEditor::getEnabledBlockNames() and use that list to filter the registry
results before returning them (e.g. map the enabled names to the corresponding
entries from $this->registry->all()); ensure you reference the
getEnabledBlockNames() method on the VisualEditor instance (or injected service)
and use the registry->all() payload to pick only entries whose 'name' matches
the enabled list so enabled_blocks/disabled_blocks in config are respected.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 3827872d-541a-4b4b-b08d-f67d342de71a
📒 Files selected for processing (5)
README.mdconfig/visual-editor.phpdocs/block-library-audit.mdsrc/VisualEditor.phptests/Unit/VisualEditor/EnabledBlockNamesTest.php
Comment on lines
+113
to
+142
| public function getEnabledBlockNames(): array | ||
| { | ||
| $enabled = $this->stringListFromConfig( 'artisanpack.visual-editor.enabled_blocks' ); | ||
| $disabled = $this->stringListFromConfig( 'artisanpack.visual-editor.disabled_blocks' ); | ||
|
|
||
| $candidates = [] === $enabled | ||
| ? array_column( $this->registry->all(), 'name' ) | ||
| : $enabled; | ||
|
|
||
| $denyIndex = array_flip( $disabled ); | ||
| $seen = []; | ||
| $result = []; | ||
|
|
||
| foreach ( $candidates as $name ) { | ||
| if ( ! is_string( $name ) ) { | ||
| continue; | ||
| } | ||
|
|
||
| $normalized = trim( $name ); | ||
|
|
||
| if ( '' === $normalized || isset( $denyIndex[ $normalized ] ) || isset( $seen[ $normalized ] ) ) { | ||
| continue; | ||
| } | ||
|
|
||
| $seen[ $normalized ] = true; | ||
| $result[] = $normalized; | ||
| } | ||
|
|
||
| return $result; | ||
| } |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify call sites and current blocks API behavior.
rg -nP --type=php '\bgetEnabledBlockNames\s*\(' -C2
rg -nP --type=php 'class\s+VisualEditorBlocksController|function\s+index\s*\(|registry->all\s*\(' -C3Repository: ArtisanPack-UI/visual-editor
Length of output: 5295
🏁 Script executed:
#!/bin/bash
# Check if VisualEditor is used in the controller
cat -n src/Http/Controllers/VisualEditorBlocksController.php
# Search for integration/feature tests of blocks endpoint
find . -type f -name "*.php" -path "*/tests/*" | xargs grep -l "VisualEditorBlocksController\|blocks.*endpoint\|/blocks\|getEnabledBlockNames" | head -10
# Check if there are any route tests
rg -nP --type=php "VisualEditorBlocksController|route.*blocks" tests/Repository: ArtisanPack-UI/visual-editor
Length of output: 1376
🏁 Script executed:
#!/bin/bash
# Check the blocks controller test
cat -n ./tests/Feature/VisualEditor/BlocksControllerTest.php
# Also check if there are any recent commits about filtering
git log --oneline -n 20 --all -- src/Http/Controllers/VisualEditorBlocksController.php 2>/dev/null | head -5Repository: ArtisanPack-UI/visual-editor
Length of output: 1330
🏁 Script executed:
#!/bin/bash
# Check the git commit about freezing the allow-list
git show 29a0d18 --stat 2>/dev/null | head -20
# Check if there are config files for enabled/disabled blocks
rg -P --type=php 'enabled_blocks|disabled_blocks' -C2
# Check if there's documentation about block filtering
find . -type f \( -name "*.md" -o -name "*.php" \) | xargs grep -l "enabled_blocks\|disabled_blocks\|getEnabledBlockNames" | head -10Repository: ArtisanPack-UI/visual-editor
Length of output: 5674
The controller still returns all blocks unfiltered, bypassing the frozen V1 allow-list.
getEnabledBlockNames() was added (commit 29a0d18) but VisualEditorBlocksController::index() never integrated it. The endpoint at line 38 (src/Http/Controllers/VisualEditorBlocksController.php) returns $this->registry->all() unchanged, meaning the configured enabled_blocks and disabled_blocks from config/visual-editor.php are ignored.
Wiring required
+ use ArtisanPackUI\VisualEditor\VisualEditor;
+
public function __construct(
protected BlockTypeRegistry $registry,
+ protected VisualEditor $editor,
) {
}
public function index(): JsonResponse
{
+ $enabled = array_flip( $this->editor->getEnabledBlockNames() );
+ $blocks = array_values( array_filter(
+ $this->registry->all(),
+ static fn ( array $block ): bool => isset( $enabled[ $block['name'] ?? '' ] )
+ ) );
- return response()->json( ['blocks' => $this->registry->all()] );
+ return response()->json( ['blocks' => $blocks] );
}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@src/VisualEditor.php` around lines 113 - 142, The controller currently
returns the full registry instead of honoring the VisualEditor allow/deny lists;
update VisualEditorBlocksController::index() to call
VisualEditor::getEnabledBlockNames() and use that list to filter the registry
results before returning them (e.g. map the enabled names to the corresponding
entries from $this->registry->all()); ensure you reference the
getEnabledBlockNames() method on the VisualEditor instance (or injected service)
and use the registry->all() payload to pick only entries whose 'name' matches
the enabled list so enabled_blocks/disabled_blocks in config are respected.
ViewFromTheBox
marked this pull request as ready for review
April 19, 2026 22:39
github-project-automation
Bot
moved this from In Review
to Done
in ArtisanPack UI Overview
This was referenced Apr 19, 2026
This was referenced Apr 30, 2026
This was referenced May 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Audits every block in
@wordpress/block-libraryv9.44 against the empty-state@wordpress/core-datashim and freezes the V1enabled_blocks/disabled_blocksconfig based on that audit. Adds agetEnabledBlockNames()helper on theVisualEditorclass that applies the allow-list + deny-list filters, plus a snapshot test that guards the frozen default set.Closes: #315
Type of Change
Related Issue
Issue: #315
Motivation and Context
V1 is adopting
@wordpress/*packages as a dependency (umbrella #309). Without an explicit allow-list, users hit unsupported-path errors when they insert blocks that depend on WordPress data thecore-datashim does not provide (navigation, query, post-, site-, taxonomy widgets). Freezing the allow-list against an empirical audit of every block gives users a clean inserter of blocks guaranteed to render against the shim.The follow-up work — forking the enabled blocks into
artisanpack/*for deep customization — is tracked under the new V2 umbrella #331 and deliberately not scoped here.Changes Made
docs/block-library-audit.md— per-block classification (green / empty-state / crash) for every block in@wordpress/block-library, with rationale for each bucket.config/visual-editor.php— frozenenabled_blocks(27 entries) anddisabled_blocks(17 entries) arrays matching the audit. Comment block points readers at the audit doc.src/VisualEditor.php— newgetEnabledBlockNames()method. Applies the allow-list, removes deny-listed names, de-duplicates while preserving order, falls back to the full registry when the allow-list is empty.tests/Unit/VisualEditor/EnabledBlockNamesTest.php— snapshot guard against the frozen default set + 4 behavior tests (deny wins, empty-allow fallback, de-dup, non-string filtering).README.md— new "Block defaults" section listing disabled-by-default categories and why, linking to the audit doc.How Has This Been Tested?
Testing Environment:
release/1.0)Tests Performed:
./vendor/bin/pest tests/Unit/VisualEditor/EnabledBlockNamesTest.php --compact— 5 passed, 6 assertions../vendor/bin/pest --compact— full suite 71 passed, 195 assertions.docs/block-library-audit.mdand the README "Block defaults" section for readability and accuracy against the issue's acceptance criteria.Accessibility Tests Run
Not applicable — this PR only changes server-side config, a PHP helper, tests, and documentation. No UI surface is added or modified.
Details: No new UI affordances were introduced.
Tests Added
Test details: Added
tests/Unit/VisualEditor/EnabledBlockNamesTest.phpwith a snapshot test for the frozen default set plus behavior coverage for allow/deny precedence, empty-allow fallback, de-duplication, and non-string filtering.Documentation
Documentation details: New
docs/block-library-audit.mdcaptures the full per-block classification. README gains a "Block defaults" section summarizing the disabled categories. Theconfig/visual-editor.phpblock section now includes a frozen-defaults note that points to the audit doc.Screenshots
Not applicable.
Pre-Submission Checklist
Summary by CodeRabbit
New Features
Documentation