InstallerAccessPolicy.php

<?php

namespace Drupal\Core\Installer;

use Drupal\Core\Session\AccessPolicyBase;
use Drupal\Core\Session\AccountInterface;
use Drupal\Core\Session\CalculatedPermissionsItem;
use Drupal\Core\Session\RefinableCalculatedPermissionsInterface;

/**
 * Grants user 1 an all access pass during install.
 *
 * @internal
 *   The policy is only to be used by the installer.
 */
final class InstallerAccessPolicy extends AccessPolicyBase {
    
    /**
     * {@inheritdoc}
     */
    public function calculatePermissions(AccountInterface $account, string $scope) : RefinableCalculatedPermissionsInterface {
        $calculated_permissions = parent::calculatePermissions($account, $scope);
        // Prevent the access policy from working when not in the installer.
        if ((int) $account->id() !== 1 || !InstallerKernel::installationAttempted()) {
            return $calculated_permissions;
        }
        return $calculated_permissions->addItem(new CalculatedPermissionsItem([], TRUE));
    }
    
    /**
     * {@inheritdoc}
     */
    public function getPersistentCacheContexts() : array {
        // Note that cache contexts in the installer are ignored because
        // \Drupal\Core\Installer\NormalInstallerServiceProvider::register() changes
        // everything to use a memory cache. If this was not the case, then this
        // should also return a cache context related to the return value of
        // \Drupal\Core\Installer\InstallerKernel::installationAttempted().
        return [
            'user.is_super_user',
        ];
    }

}