package org.nuxeo.security.logger;

import java.security.Principal;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.nuxeo.ecm.core.api.security.ACP;
import org.nuxeo.ecm.core.api.security.Access;
import org.nuxeo.ecm.core.model.Document;
import org.nuxeo.ecm.core.query.sql.model.SQLQuery.Transformer;
import org.nuxeo.ecm.core.security.AbstractSecurityPolicy;
import org.nuxeo.ecm.core.security.SecurityPolicy;

public class LogingSecurityPolicy extends AbstractSecurityPolicy implements SecurityPolicy {

    protected static final Log log = LogFactory.getLog(LogingSecurityPolicy.class);

    @Override
    public Transformer getQueryTransformer(String repositoryName) {
        return Transformer.IDENTITY;
    }

    @Override
    public QueryTransformer getQueryTransformer(String repositoryName, String queryLanguage) {
        return  QueryTransformer.IDENTITY;
    }

    @Override
    public boolean isExpressibleInQuery(String repositoryName) {
        return true;
    }

    @Override
    public Access checkPermission(Document doc, ACP mergedAcp, Principal principal, String permission,
            String[] resolvedPermissions, String[] additionalPrincipals) {

        StringBuffer sb = new StringBuffer();

        sb.append("target=");
        try {
            sb.append(doc.getPath().toString());
        } catch (Exception e) {
            sb.append(doc.getUUID());
        }
        sb.append(";checked permissions= ");
        sb.append(permission);
        sb.append(";principal= ");
        sb.append(principal.getName());

        sb.append("\n");
        sb.append("  resolvedPermissions= [");
        for (String p : resolvedPermissions) {
            sb.append(p);
            sb.append(",");
        }
        sb.append("]");


        sb.append("\n");
        sb.append("  groups= [");
        for (String p : additionalPrincipals) {
            sb.append(p);
            sb.append(",");
        }
        sb.append("]");

        log.info("Permission check :" + sb.toString());

        return Access.UNKNOWN;
    }

}

@@ -147,16 +147,104 @@
 actory;%0A
+import org.nuxeo.ecm.core.api.security.ACE;%0Aimport org.nuxeo.ecm.core.api.security.ACL;%0A
 import o
@@ -279,16 +279,16 @@
 ty.ACP;%0A
-
 import o
@@ -543,16 +543,18 @@
 olicy;%0A%0A
+%0A%0A
 public c
@@ -1605,16 +1605,17 @@
 ssion);%0A
+%0A
         
@@ -1695,35 +1695,88 @@
    sb.append(%22%5Cn
-%22);
+  mergedACL= %22);%0A        sb.append(dumpACP(mergedAcp));%0A
 %0A        sb.appe
@@ -1943,17 +1943,16 @@
 (%22%5D%22);%0A%0A
-%0A
         
@@ -2234,10 +2234,413 @@
 %0A    %7D%0A%0A
+    protected String dumpACP(ACP acp)%7B%0A        StringBuffer sb = new StringBuffer();%0A        for (ACL acl : acp.getACLs()) %7B%0A            sb.append(acl.getName());%0A            sb.append(%22 : (%22);%0A            for (ACE ace : acl.getACEs()) %7B%0A                sb.append(ace.toString());%0A                sb.append(%22;%22);%0A            %7D%0A            sb.append(%22)%5Cn%22);%0A        %7D%0A        return sb.toString();%0A    %7D%0A
 %7D%0A

Add more logs to get info on ACLs