fix(blocks): allow opted-in post types on the public /articles endpoint

[jason10lee]

All Submissions:

• Have you followed the Newspack Contributing guidelines?
• Does your code follow the WordPress and VIP Go coding standards?
• Have you checked there aren't other open PRs for the same change?

Changes proposed in this Pull Request:

Restores Sponsors load-more in Homepage Posts / Carousel (resolves NPPM-2972).

NPPM-2964 (#471) narrowed the public /articles endpoint to is_post_type_viewable() post types. The Sponsors CPT is public=false, so it's dropped there — a Sponsors-only block renders page 1 via SSR (which queries directly, not through /articles) but load-more / infinite-scroll returns empty.

Design — explicit opt-in, not a broad marker:

• newspack-blocks adds a newspack_blocks_articles_allowed_post_types filter: is_post_type_viewable( $type ) || in_array( $type, $allowed, true ). Default [] → no behavior change for any site that doesn't opt in.
• newspack-sponsors hooks it to allow only its own CPT — one explicit, documented, per-CPT exposure decision, living next to the CPT.

I deliberately did not widen via post_type_supports( 'newspack_blocks' ) (the other option floated on the ticket). That marker is declared broadly (post, page, Events Calendar, Listings, Collections, Sponsors) and isn't a "safe to expose anonymously" signal — using it would auto-expose any future public=false CPT that opts into block support. The explicit filter keeps the anonymous-exposure decision auditable and owned by the plugin registering the CPT.

Why this is a low-sensitivity opt-in: Sponsor data (name, logo, disclosure/byline) is already surfaced publicly as sponsor labels; the endpoint still returns only publish status to anonymous callers; and #471's specificPosts protection still holds for every type not on the allow-list (WP_Query post_type ∧ post__in intersection).

How to test the changes in this Pull Request:

1. n test-php --filter HomepagePostsBlockTest — the new test_articles_endpoint_allows_filter_allowlisted_post_type passes: an allow-listed non-viewable CPT is served and a non-allow-listed one is still dropped.
2. With newspack-sponsors active, a Sponsors-only Homepage Posts block with more sponsors than the page size: load-more now returns sponsors (previously empty). Page-1 SSR already worked via the same build_articles_query, so this only realigns the REST path with it.

Other information:

• Have you added an explanation of what your changes do and why?
• Have you written new tests for your changes, as applicable?
• Have you successfully run tests with your changes locally?

Note: the Sponsors-side opt-in isn't unit-tested (newspack-sponsors has no PHPUnit suite); the filter mechanism is covered in newspack-blocks, and the Sponsors query itself is exercised by the existing page-1 SSR path.

[Copilot]

Pull request overview

Restores Sponsors “load more” behavior in Homepage Posts / Carousel by allowing explicit opt-in of non-viewable CPTs on the public newspack-blocks/v1/articles endpoint, without broadly loosening the endpoint’s visibility gate.

Changes:

• Added a newspack_blocks_articles_allowed_post_types allow-list filter to the public /articles endpoint gating logic (viewable OR explicitly allow-listed).
• Opted the Sponsors CPT into that allow-list from newspack-sponsors, keeping the exposure decision co-located with the CPT definition.
• Added a PHPUnit test to verify allow-listed non-viewable CPTs are served while other non-viewable CPTs remain excluded.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
plugins/newspack-sponsors/includes/class-core.php	Hooks the new allow-list filter to permit the Sponsors CPT on the public /articles endpoint.
plugins/newspack-blocks/src/blocks/homepage-articles/class-wp-rest-newspack-articles-controller.php	Extends post-type filtering to include an explicit allow-list via newspack_blocks_articles_allowed_post_types.
plugins/newspack-blocks/tests/test-homepage-posts-block.php	Adds coverage for allow-listed non-viewable CPTs being served (and other non-viewable CPTs staying blocked).