class InstallerAccessPolicy

final class InstallerAccessPolicy extends AccessPolicyBase {
    
    /**
     * {@inheritdoc}
     */
    public function calculatePermissions(AccountInterface $account, string $scope) : RefinableCalculatedPermissionsInterface {
        $calculated_permissions = parent::calculatePermissions($account, $scope);
        // Prevent the access policy from working when not in the installer.
        if ((int) $account->id() !== 1 || !InstallerKernel::installationAttempted()) {
            return $calculated_permissions;
        }
        return $calculated_permissions->addItem(new CalculatedPermissionsItem([], TRUE));
    }
    
    /**
     * {@inheritdoc}
     */
    public function getPersistentCacheContexts() : array {
        // Note that cache contexts in the installer are ignored because
        // \Drupal\Core\Installer\NormalInstallerServiceProvider::register() changes
        // everything to use a memory cache. If this was not the case, then this
        // should also return a cache context related to the return value of
        // \Drupal\Core\Installer\InstallerKernel::installationAttempted().
        return [
            'user.is_super_user',
        ];
    }

}