JSON API + hook_node_grants() implementations: accessing /jsonapi/node/article as non-admin user results in a cacheability metadata leak

Inspecting the code in EarlyrenderingControllerWrapperSubscriber

    // If early rendering happened, i.e. if code in the controller called
    // drupal_render() outside of a render context, then the bubbleable metadata
    // for that is stored in the current render context.
    if (!$context->isEmpty()) {
      /** @var \Drupal\Core\Render\BubbleableMetadata $early_rendering_bubbleable_metadata */
      $early_rendering_bubbleable_metadata = $context->pop();

the value of $early_rendering_bubbleable_metadata contains only

cacheContexts = [
  "user.node_grants:view"
]

Does this mean that the problem lies with node access permissions? My site is using the group module, although articles are not part of any group. I will try this problem on an environment that is not using group.

I used a separate instance of D8 (8.6.x-dev), with the jsonapi, group, and taxonomy modules installed. The jsonapi response to the query used above was the expected list of articles.

I upgraded my development environment to D8.6.x-dev, but the error still persisits???

I deleted all the groups and group_content entities from the database and then rebuilt the permissions in my development environment, but the leaked metadata error was still reported. However, when I un-installed the group node (gnode) module, the error disappeared and th expected list of articles was returned.

I then re-installed the group node module, and rebuilt permissions, but the error did not come back??? It transpired that doing a drush cache-rebuild was not sufficient. I had to truncate the cache tables in the database to observe the re-appearance of the error message.

Following a series of tests, I can confirm that if the group node module is installed, node access permissions rebuilt, and caches properly cleared, then the leaked metadata message is reported. If the group module is un-installed, node access permissions rebuilt (happens automatically), and caches properly cleared, then the expected list of content is returned. There is no need to have any groups defined, nor to have any group_content in the database.

It appears that this issue should really be on the group issue queue. Moving there.

Further testing shows that the problem is present when the nodeaccess module is installed, so this issue appears to be generic when any node access functionality is enabled. Moving this issue back to project jsonapi.

To check: install and enable nodeaccess, rebuild the access permissions, and truncate the cache tables.

The leaked metadata of "user.node_grants:view" is added to the cacheContexts by the following code in hook_query_node_access_alter() in node.module:

  // Bubble the 'user.node_grants:$op' cache context to the current render
  // context.
  $request = \Drupal::requestStack()->getCurrentRequest();
  $renderer = \Drupal::service('renderer');
  if ($request->isMethodCacheable() && $renderer->hasRenderContext()) {
    $build = ['#cache' => ['contexts' => ['user.node_grants:' . $op]]];
    $renderer->render($build);
  }

So why is the metadata not being correctly bubbled?

The change from v1.21 to 1.22 that has revealed this error was the replacement of the following code

    $context = new RenderContext();
    $response = $this->renderer
      ->executeInRenderContext($context, function () use ($resource, $action, $parameters, $extra_parameters) {
        return call_user_func_array([$resource, $action], array_merge($parameters, $extra_parameters));
      });
    if (!$context->isEmpty()) {
      $response->addCacheableDependency($context->pop());
    }

    return $response;

by the single line

    return call_user_func_array([$resource, $action], array_merge($parameters, $extra_parameters));

It would appear that the code block above was added previously to address a similar issue as discussed in #2952714: Group module's GroupAccessResult::allowedIfHasGroupPermission(s)() does not include cacheability. However, the issue appears to be more significant than the group module or the nodeaccess module.

I can also confirm that the same issue is present with jsonapi release 2.x-dev. Changing the issue metadata.

Thanks for the patch. I can confirm that the patch in #17 has fixed the problem in both of my environments:

• Drupal 8.5.5 + jsonapi 1.22 + group
• Drupal 8.6.0-dev + jsonapi 2.x-dev + nodeaccess

I will leave the status on "Needs work" as the patch failed testing.