Pattern directory: apply the editor block allowlist during validation

[obenland]

What

The Pattern Directory editor already keeps wporg/* blocks and a small set of core blocks out of the inserter via the allowed_block_types_all filter, but the REST content validator only checked that each submitted block was registered — so those same block types were still accepted on the server (its error message even promises "core blocks" only). This makes the server enforce the same policy as the editor, from one shared place, and closes a few adjacent gaps found in review.

Changes

Block allowlist (server-side)

• Extracts the disallowed set and the wporg/* rule into a shared DISALLOWED_BLOCK_TYPES constant and is_block_allowed_in_pattern() predicate.
• remove_disallowed_blocks() (the editor filter) now uses the predicate instead of its own inline list.
• validate_content() runs every submitted block — flattened, so nested blocks are covered — through the same predicate and returns a rest_pattern_disallowed_blocks error for anything the editor wouldn't offer.
• Adds core/pattern to the disallowed set: it splices another registered pattern in by slug on render, the same indirection core/block and core/template-part are already blocked for.

Validate the exact stored content

• Stops normalising \n\n out of the content before parsing. That normalisation could hide a block from the validator (e.g. a <!-- wp:shortcode\n\n--> delimiter) while it still parsed as a real block once stored. Whitespace-only separator "blocks" are skipped during flattening instead.

Interactivity directives

• Rejects data-wp-* directives carried in a block's inner HTML (rest_pattern_interactivity_directive). KSES preserves them and they sit in inner HTML, out of reach of the block-attribute check. Shared as content_has_block_directives(), which skips tokenising entirely when no data-wp- marker is present.

Translation import path

• Translator-supplied strings are assembled into stored markup without passing through the REST validators, so the same block-allowlist and directive checks now run on the translation import too; create_or_update_translated_pattern() returns a WP_Error when content is refused, and the cron logs the refusal (pattern name + locale) to the server log.

pattern_content REST field

• Guards the field so it only returns content for an actual wporg-pattern, returning empty when the id resolves to a different post type.

Tests

• New test_wporg_blocks_are_disallowed covering the wporg/* path, plus data-provider cases for core/nextpage, core/shortcode (flat and nested), core/pattern, the \n\n-in-delimiter bypass, and interactivity directives (data-wp-interactive/data-wp-init, data-wp-bind--src). The existing core/nextpage "valid" case moved to "disallowed" to match the editor.
• Full plugin suite green (139 tests); phpcs clean.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.