class AccountPermissionsCacheContext

class AccountPermissionsCacheContext extends UserCacheContextBase implements CacheContextInterface {
    
    /**
     * The permissions hash generator.
     *
     * @var \Drupal\Core\Session\PermissionsHashGeneratorInterface
     */
    protected $permissionsHashGenerator;
    
    /**
     * Constructs a new UserCacheContext service.
     *
     * @param \Drupal\Core\Session\AccountInterface $user
     *   The current user.
     * @param \Drupal\Core\Session\PermissionsHashGeneratorInterface $permissions_hash_generator
     *   The permissions hash generator.
     */
    public function __construct(AccountInterface $user, PermissionsHashGeneratorInterface $permissions_hash_generator) {
        $this->user = $user;
        $this->permissionsHashGenerator = $permissions_hash_generator;
    }
    
    /**
     * {@inheritdoc}
     */
    public static function getLabel() {
        return t("Account's permissions");
    }
    
    /**
     * {@inheritdoc}
     */
    public function getContext() {
        return $this->permissionsHashGenerator
            ->generate($this->user);
    }
    
    /**
     * {@inheritdoc}
     */
    public function getCacheableMetadata() {
        $cacheable_metadata = new CacheableMetadata();
        // The permissions hash changes when:
        // - a user is updated to have different roles;
        $tags = [
            'user:' . $this->user
                ->id(),
        ];
        // - a role is updated to have different permissions.
        foreach ($this->user
            ->getRoles() as $rid) {
            $tags[] = "config:user.role.{$rid}";
        }
        return $cacheable_metadata->setCacheTags($tags);
    }

}