feat(content-gate): add per-block access control for Group, Stack, and Row blocks by dkoo · Pull Request #4646 · Automattic/newspack-plugin

dkoo · 2026-04-08T19:39:04Z

All Submissions:

Have you followed the Newspack Contributing guideline?
Does your code follow the WordPress' coding standards and VIP Go coding standards?
Have you checked to ensure there aren't other open Pull Requests for the same update/change?

Changes proposed in this Pull Request:

Adds per-block visibility controls to core/group, core/stack, and core/row blocks, allowing editors to show or hide individual blocks based on one or more content gates, or custom rules using the same Registered and Paid access rules used by content gates.

"Gate" mode:

"Custom" mode:

"Custom" mode exists because publishers often want to control per-block visibility at a different and/or more granular level than content gates. To use a real-world example, a subscriber might have access to restricted content across the site if they have an active subscription to either a Digital-Only or Print+Digital subscription product, but PDF issue embeds on magazine-focused pages should be visible only to Print+Digital subscribers.

Editor UI (edit_others_posts capability required, on supported post types only):

A new Access Control panel appears in the block Inspector for Group, Stack, and Row blocks.
A "Visible to / Hidden to" toggle sets the visibility mode. It is disabled until at least one rule is configured.
A Registered readers toggle restricts the block to logged-in readers, with an optional Require verification sub-option.
Additional toggles appear for each registered custom access rule (e.g. subscription products, institution access). Rules with options render a FormTokenField; free-text rules render a TextControl.
When all rules are cleared the visibility mode resets to "Visible to" automatically.

Frontend evaluation (via render_block filter):

If a block has no active rules, it renders normally with no overhead.
When rules are configured: visible mode renders the block only to matching readers; hidden mode renders it only to non-matching readers.
Registration rules check login status and optionally the email-verified user meta.
Custom access rules delegate to Access_Rules::evaluate_rules(), using the same AND/OR grouped logic as content gates.
Results are cached per request (keyed by user_id + md5(rules)) so repeated blocks with identical rules evaluate only once.

New files:

includes/content-gate/class-block-visibility.php — PHP class with render_block filter, server-side attribute registration, and asset enqueue.
src/content-gate/editor/block-visibility.tsx — React/TS entry: attribute registration filter, Inspector HOC, and all panel components.
src/content-gate/editor/index.d.ts — Shared TypeScript types for the content-gate editor directory.
tests/unit-tests/content-gate/class-block-visibility.php — 24 PHPUnit tests.
src/content-gate/editor/block-visibility.test.ts — 7 Jest tests for the attribute registration filter.

Closes NPPD-1430.

How to test the changes in this Pull Request:

Prerequisites:

Ensure NEWSPACK_CONTENT_GATES is true (n wp config set NEWSPACK_CONTENT_GATES true --raw).
Build assets: n build newspack-plugin. Confirm dist/content-gate-block-visibility.js exists.
Log in as an Editor or Administrator.

Inspector panel:

Create or edit a post. Add a Group block. Open the block Inspector (right sidebar).
Confirm an "Access Control" panel appears near the bottom, above "Advanced".
Expand the panel. Confirm the "Visible to / Hidden to" toggle is visible but disabled (greyed out).
Toggle "Registered readers" on. Confirm the visibility toggle becomes enabled and a "Require verification" checkbox appears beneath it.
Toggle all rules off. Confirm the visibility toggle resets to "Visible to".
Repeat steps 4–8 for a Stack block and a Row block.
Add a Paragraph block. Confirm the Access Control panel does not appear.
Log in as a Contributor. Confirm the Access Control panel does not appear.

Frontend — "Custom" mode with "visible" visibility:

Configure a Group block in "Custom" mode and enable the "Registered readers" rule and "Visible" visibility. Add content inside. Save the post.
Open the post while logged out. Confirm the Group block content is absent from the page source.
Log in as a subscriber. Open the post. Confirm the Group block content is present.
Edit the Group block to add "Active subscription" and choose at least two products. Save.
Open the post while logged out. Confirm the Group block content is absent from the page source.
Log in as a reader who does NOT have an active subscription with any of the required products. Confirm the Group block is absent.
Log in as a reader who has an active subscription with one of the required products and refresh. Confirm the Group block is present.

Frontend — "Custom" mode with "hidden" visibility:

Switch the same block to "Hidden to". Save.
Open while logged in. Confirm block content is absent.
Open while logged out. Confirm block content is present.

Verification sub-option:

Enable "Require verification". Save.
Log in as an unverified reader. Confirm the block is hidden (for "Visible to" mode).
Verify the reader's email. Confirm the block becomes visible.

Front-end — "Gate" mode

Change the block configuration to "Gate" mode and select several content gates. Save.
Repeat block visibility tests for logged-out readers, logged-in readers who can't bypass any of the selected gates, and logged-in readers who can bypass at least one selected gate.

Post type guard:

Open a post type not in Content_Restriction_Control::get_available_post_types(). Confirm the Access Control panel does not appear and the JS asset is not enqueued.

Editors are exempt:

While logged in as a user who has edit access to the containing post (such as an admin, editor, or author/contributor for that post), preview or view the post on the front-end. Confirm that all blocks are visible regardless of access requirements.

Graceful degradation:

Check out another branch of this repo, or deactivate the Newspack Plugin entirely.
Refresh the post in the editor and confirm that all Group/Row/Stack blocks continue to render without block validation errors.
View the post on the front-end and confirm that all Group/Row/Stack blocks render and are visible to all readers.

Other information:

Have you added an explanation of what your changes do and why you'd like us to include them?
Have you written new tests for your changes, as applicable?
Have you successfully ran tests with your changes locally?

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…ests

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

… localized rules

…tration

…anel

…ix setRegistration param

…filter

…lity

Copilot

Pull request overview

Adds per-block visibility controls for core/group, core/stack, and core/row blocks using Newspack Content Gate access rules, enabling editors to show/hide individual blocks to specific reader segments without creating a full gate.

Changes:

Adds a new editor Inspector “Access Control” panel and registers block attributes for visibility mode + rule configuration.
Adds a PHP render_block filter to enforce per-block visibility on the frontend, with per-request caching.
Adds PHPUnit + Jest coverage and wires the new editor bundle into Webpack.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
`webpack.config.js`	Adds a new build entry for the block-visibility editor script.
`includes/content-gate/class-content-gate.php`	Includes the new Block_Visibility feature file.
`includes/content-gate/class-block-visibility.php`	Implements server-side attribute registration, editor asset enqueue, and frontend render filtering/caching.
`src/content-gate/editor/block-visibility.tsx`	Registers attributes and injects the Inspector panel UI for target blocks.
`src/content-gate/editor/editor.scss`	Styles the Access Control panel UI elements.
`src/content-gate/editor/index.d.ts`	Adds shared TS types used by the content-gate editor code.
`tests/unit-tests/content-gate/class-block-visibility.php`	Adds PHPUnit tests for rule evaluation, rendering behavior, and caching.
`src/content-gate/editor/block-visibility.test.ts`	Adds Jest tests for the attribute registration filter.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

includes/content-gate/class-block-visibility.php

src/content-gate/editor/block-visibility.tsx

tests/unit-tests/content-gate/class-block-visibility.php

- Use [] not stdClass as default for newspackAccessControlRules block attribute - Add comment on get_post_type() === false in enqueue_block_editor_assets - Fix setRegistration to not mutate its parameter; use immutable spread - Fix counting_rule test to use unique ID per run to avoid closure issues - Fix "Visiblity" typo in VisibilityControl help text - Guard test_rule registration against duplicate registration across tests Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Bypass access control during REST requests so blocks are never hidden in the editor's block renderer or preview contexts - Defensively cast newspackAccessControlRules to array in case the block parser yields a stdClass for the object-typed attribute - Fix FormTokenField empty label; use config.name + hideLabelFromVision Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Cover the case where a user with edit_post capability on the current post sees all blocks regardless of access rules, and verify that a non-editor is still subject to normal rule evaluation. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Blocks can now be linked to one or more existing content gates instead of defining access rules inline. Gate rules are resolved server-side at render time so any change to a gate is immediately reflected in every block that references it. - Add newspackAccessControlMode attribute ('gate' default, 'custom') - Add newspackAccessControlGateIds array attribute for gate links - Gate mode uses OR logic: reader must satisfy any one selected gate - Deleted/unpublished gates are silently skipped; a block with only inactive gates passes through with no restriction - Localize available published gates to newspackBlockVisibility JS data - Add GateControls FormTokenField component to the inspector panel - Add mode toggle (Gate / Custom) with Gate as the default - Add 7 new PHPUnit tests covering gate mode evaluation paths Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

dkoo and others added 19 commits April 7, 2026 16:32

feat(content-gate): add Block_Visibility class skeleton

87e2a3b

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

test(content-gate): complete Block_Visibility hook coverage

4b2c0f2

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat(content-gate): implement render_block fast path

bce2306

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

test(content-gate): add is_admin fast path coverage

e3920bb

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat(content-gate): implement registration rule evaluation

4479ff3

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

style(content-gate): remove trailing whitespace in Block_Visibility t…

a066381

…ests

test(content-gate): add access rule evaluation and caching tests

c572a67

feat(content-gate): implement block visibility render filter

fe6fbe5

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat(content-gate): register block attributes server-side

2dd68d6

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat(content-gate): enqueue block visibility editor assets

ea4eb67

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix(content-gate): use edit_others_posts cap and strip callbacks from…

39954f5

… localized rules

feat(content-gate): add block visibility JS entry and attribute regis…

ee8e3d0

…tration

feat(content-gate): implement block visibility Inspector panel

b2c8ea2

feat(content-gate): add AccessRuleValueControl for block visibility p…

9b6b327

…anel

fix(content-gate): handle is_boolean rules, use config.placeholder, f…

28a509f

…ix setRegistration param

test(content-gate): add JS unit tests for block visibility attribute …

4b725c5

…filter

style: tweak styles for Access Control block visibility panel

1af1acb

refactor(content-gate): replace any with proper types in block-visibi…

1ea2dc8

…lity

refactor: prettier formatting

323b7aa

dkoo requested a review from Copilot April 8, 2026 19:39

Copilot started reviewing on behalf of dkoo April 8, 2026 19:40 View session

Copilot AI reviewed Apr 8, 2026

View reviewed changes

dkoo and others added 3 commits April 8, 2026 13:54

fix: allow editors to bypass access requirements

f7f2f15

dkoo requested a review from thomasguillot April 8, 2026 20:18

dkoo self-assigned this Apr 8, 2026

dkoo added [Status] Needs Review The issue or pull request needs to be reviewed [Status] Needs Design Review labels Apr 8, 2026

dkoo marked this pull request as ready for review April 8, 2026 20:24

dkoo requested a review from a team as a code owner April 8, 2026 20:24

dkoo and others added 5 commits April 8, 2026 14:39

refactor: allow the blocks that can get access rules to be filtered

f3dccb5

docs: update docblock

e822588

refactor: apply filter to all instances of $target_blocks

2b50ec8

style: tweak UI in Access Control panel

a0ee1ea

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(content-gate): add per-block access control for Group, Stack, and Row blocks#4646

feat(content-gate): add per-block access control for Group, Stack, and Row blocks#4646
dkoo wants to merge 28 commits intotrunkfrom
feat/block-access-control

dkoo commented Apr 8, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dkoo commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

All Submissions:

Changes proposed in this Pull Request:

How to test the changes in this Pull Request:

Prerequisites:

Inspector panel:

Frontend — "Custom" mode with "visible" visibility:

Frontend — "Custom" mode with "hidden" visibility:

Verification sub-option:

Front-end — "Gate" mode

Post type guard:

Editors are exempt:

Graceful degradation:

Other information:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dkoo commented Apr 8, 2026 •

edited

Loading