DGI9-610: Prevent page_cache caching where an ip cache context is relevant.

embargo.services.yml

@@ -69,3 +69,7 @@ services:
       - '@entity_type.manager'
     tags:
       - { name: 'cache.context' }
+  embargo.page_cache_request_policy.deny_ip_dependent_response:
+    class: Drupal\embargo\PageCache\DenyIpDependentResponse
+    tags:
+      { name: page_cache_response_policy }

modules/migrate_embargoes_to_embargo/src/Plugin/migrate/source/Entity.php

@@ -56,7 +56,7 @@ public static function create(
     array $configuration,
     $plugin_id,
     $plugin_definition,
-    MigrationInterface $migration = NULL,
+    ?MigrationInterface $migration = NULL,
   ) {
     return new static(
       $configuration,

src/Controller/IpRangeAccessExemptionController.php

@@ -25,7 +25,7 @@ class IpRangeAccessExemptionController extends ControllerBase {
    * @param \Symfony\Component\HttpFoundation\Request|null $request
    *   The current request.
    */
-  public function __construct(Request $request = NULL) {
+  public function __construct(?Request $request = NULL) {
     $this->request = $request;
   }
 

src/PageCache/DenyIpDependentResponse.php

@@ -0,0 +1,59 @@
+<?php
+
+namespace Drupal\embargo\PageCache;
+
+use Drupal\Core\Cache\RefinableCacheableDependencyInterface;
+use Drupal\Core\PageCache\ResponsePolicyInterface;
+use Drupal\Core\Routing\AccessAwareRouterInterface;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Avoid page_cache when IP embargoes are in play.
+ *
+ * IP embargoes break the assumption made by page_cache that all anonymous
+ * requests are equivalent, so let's avoid allowing things to go to the
+ * page_cache for anonymous users when an access result has the
+ * `ip.embargo_range` (or wider `ip`) context.
+ */
+class DenyIpDependentResponse implements ResponsePolicyInterface {
+
+  /**
+   * Cache contexts of which the presence should suppress page_cache.
+   */
+  protected const IP_CONTEXTS = [
+    'ip.embargo_range',
+    // XXX: `ip.embargo_range` could be optimized away if the `ip` context
+    // itself is added, so let's also account for it.
+    'ip',
+  ];
+
+  /**
+   * {@inheritDoc}
+   */
+  public function check(Response $response, Request $request) : ?string {
+    if (!$request->attributes->has(AccessAwareRouterInterface::ACCESS_RESULT)) {
+      // No access result; unable to check.
+      return NULL;
+    }
+
+    /** @var \Drupal\Core\Access\AccessResultInterface $access_result */
+    $access_result = $request->attributes->get(AccessAwareRouterInterface::ACCESS_RESULT);
+
+    if (!($access_result instanceof RefinableCacheableDependencyInterface)) {
+      // Access result is not cacheable; unable to check cache contexts.
+      return NULL;
+    }
+
+    $cache_contexts = $access_result->getCacheContexts();
+
+    if (array_intersect(static::IP_CONTEXTS, $cache_contexts)) {
+      // Access result has relevant context; avoiding page cache.
+      return ResponsePolicyInterface::DENY;
+    }
+
+    // No candidate IP cache contexts present on access result; passing.
+    return NULL;
+  }
+
+}

src/Plugin/search_api/processor/EmbargoJoinProcessor.php

@@ -104,7 +104,7 @@ public static function supportsIndex(IndexInterface $index) {
   /**
    * {@inheritdoc}
    */
-  public function getPropertyDefinitions(DatasourceInterface $datasource = NULL) : array {
+  public function getPropertyDefinitions(?DatasourceInterface $datasource = NULL) : array {
     $properties = [];
 
     if ($datasource === NULL) {

src/Plugin/search_api/processor/EmbargoProcessor.php

@@ -88,7 +88,7 @@ public static function create(ContainerInterface $container, array $configuratio
   /**
    * {@inheritdoc}
    */
-  public function getPropertyDefinitions(DatasourceInterface $datasource = NULL) : array {
+  public function getPropertyDefinitions(?DatasourceInterface $datasource = NULL) : array {
     $properties = [];
 
     if ($datasource === NULL) {