jsonapi-8.x-2.x-dev/tests/modules/jsonapi_test_field_access/jsonapi_test_field_access.module

<?php

/**
 * @file
 * Contains hook implementations for testing the JSON:API module.
 */

use Drupal\Core\Field\FieldDefinitionInterface;
use Drupal\Core\Access\AccessResult;
use Drupal\Core\Session\AccountInterface;

/**
 * Implements hook_entity_field_access().
 */
function jsonapi_test_field_access_entity_field_access($operation, FieldDefinitionInterface $field_definition, AccountInterface $account) {
  // @see \Drupal\Tests\jsonapi\Functional\ResourceTestBase::testRelationships().
  if ($field_definition->getName() === 'field_jsonapi_test_entity_ref') {
    // Forbid access in all cases.
    $permission = "field_jsonapi_test_entity_ref $operation access";
    $access_result = $account->hasPermission($permission)
      ? AccessResult::allowed()
      : AccessResult::forbidden("The '$permission' permission is required.");
    return $access_result->addCacheContexts(['user.permissions']);
  }

  // No opinion.
  return AccessResult::neutral();
}