Issue #3527213: Fix cache metadata bubbling

src/Resource/MenuItemsResource.php

@@ -268,7 +268,7 @@ final class MenuItemsResource extends ResourceBase implements ContainerInjection
    * @param \Drupal\system\MenuInterface $menu
    *   The menu that the links belong to.
    */
-  protected function getMenuItems(array $tree, array &$items, CacheableMetadata $cache, MenuInterface $menu) {
+  protected function getMenuItems(array $tree, array &$items, CacheableMetadata &$cache, MenuInterface $menu) {
     $menu_link_content_storage = $this->entityTypeManager->getStorage('menu_link_content');
 
     foreach ($tree as $menu_link) {
@@ -277,7 +277,7 @@ final class MenuItemsResource extends ResourceBase implements ContainerInjection
       }
 
       if ($menu_link->access instanceof AccessResultInterface) {
-        $cache->merge(CacheableMetadata::createFromObject($menu_link->access));
+        $cache = $cache->merge(CacheableMetadata::createFromObject($menu_link->access));
       }
 
       // Only return accessible links.

tests/modules/jsonapi_menu_items_test/config/install/system.menu.jsonapi-menu-items-test2.yml

+id: jsonapi-menu-items-test2
+label: JSON:API menu items test menu 2
+description: 'Test menu 2'
+langcode: en
+locked: true

tests/modules/jsonapi_menu_items_test/jsonapi_menu_items_test.links.menu.yml

@@ -22,3 +22,10 @@ jsonapi_menu_test.user.logout.disabled:
   route_name: user.logout
   enabled: 0
   parent: jsonapi_menu_test.open
+
+# To test access cacheability.
+jsonapi_menu_test2.user.access:
+  title: 'Logout'
+  menu_name: jsonapi-menu-items-test2
+  description: 'Logout.'
+  route_name: user.logout

tests/src/Functional/JsonapiMenuItemsTest.php

@@ -58,8 +58,7 @@ class JsonapiMenuItemsTest extends BrowserTestBase {
    */
   protected function assertCacheContext(array $headers, $expected_cache_context) {
     $cache_contexts = explode(' ', $headers['X-Drupal-Cache-Contexts'][0]);
-    $this
-      ->assertTrue(in_array($expected_cache_context, $cache_contexts), "'" . $expected_cache_context . "' is present in the X-Drupal-Cache-Contexts header.");
+    $this->assertContains($expected_cache_context, $cache_contexts, "'$expected_cache_context' is present in the X-Drupal-Cache-Contexts header.");
   }
 
   /**
@@ -319,6 +318,26 @@ class JsonapiMenuItemsTest extends BrowserTestBase {
     self::assertEquals($expected_items['data'], $content['data']);
   }
 
+  /**
+   * Tests the JSON:API Menu Items resource.
+   */
+  public function testJsonapiMenuItemsResourceCacheabilltyBubbling() {
+    $url = Url::fromRoute('jsonapi_menu_items.menu', [
+      'menu' => 'jsonapi-menu-items-test2',
+    ]);
+    [$content, $headers] = $this->getJsonApiMenuItemsResponse($url);
+    // There are 0 items in this menu because the anonymous user does not have
+    // access to logout.
+    $this->assertCount(0, $content['data']);
+    $this->assertCacheContext($headers, 'user.roles:authenticated');
+
+    $this->drupalLogin($this->account);
+    [$content, $headers] = $this->getJsonApiMenuItemsResponse($url);
+    // There is 1 item in this menu because a user does have access to logout.
+    $this->assertCount(1, $content['data']);
+    $this->assertCacheContext($headers, 'user.roles:authenticated');
+  }
+
   /**
    * Create menu link.
    *