Calling hasPermission from inside alterPermissions causes memory leak

working on it !

Opened a Merge Request to fix the memory exhaustion bug. The issue was caused by an infinite recursion loop when $account->hasPermission() is called from within alterPermissions(). I've added a $processing state tracker to safely short-circuit recursive calls during the calculation phase, along with a dedicated unit test (testRecursiveAccessPolicy) to prevent future regressions. Needs review!

I re-verified this locally using a test module that reproduces the scenario (calling $account->hasPermission() inside alterPermissions(), then drush en). With the MR patch applied to AccessPolicyProcessor.php, the module installs cleanly — no memory exhaustion or infinite recursion.

The fix tracks in-progress calculations in a $processing array, so recursive calls safely return partial permissions instead of looping.

The "Needs Work" status may have been set before the patch was fully applied in the test environment. Happy to share the test module if useful.

This issue does not have the proposed resolution section, which is used by reviewers and committers to understand how the problem is to be fixed. I am tagging for an issue summary. The is related to the Core Documentation Gate. Thanks

What is really interesting, is that this only occurs when using $account->hasPermission function inside of my alterPermissions.

Well yes, the system is calculating your permissions and inside that calculation you are asking for the fully calculated permissions :D

From what you wrote on Slack, you're trying to grant a few permissions to whoever has a certain permission. That can indeed be achieved in the alter method and requires no extra cache stuff, provided your list of "extra permissions" never changes.

Otherwise you need a cache invalidation when that does happen e.g.:

• Extra permissions are configured on a form, so you need to add the config object's cache tag
• Extra permissions are hard-coded, you need a manual cache rebuild when you change the list
• Extra permissions depend on other global factors, you need a cache context that represents said global factors

So how do you check what permissions someone has? Well you have all of them in the alter method already!

public function alterPermissions(AccountInterface $account, string $scope, RefinableCalculatedPermissionsInterface $calculated_permissions): void {
  parent::alterPermissions($account, $scope, $calculated_permissions);
  foreach ($calculated_permissions->getItemsByScope($scope) as $item) {
    if ($item->isAdmin()) {
      //No point in adding permissions, they have them all.
      continue;
    }
    if ($item->hasPermission('what you seek')) {
      $new_item = new CalculatedPermissionsItem(
        array_merge($item->getPermissions(), ['new permissions here']),
        FALSE,
        $item->getScope(),
        $item->getIdentifier()
      );
      // This will replace the original with the new one.
      $calculated_permissions->addItem($new_item, TRUE);
    }
  }
}