From d8003a681b4e3037ffabb9e45196bfba1bf50c74 Mon Sep 17 00:00:00 2001
From: Brock Fanning <1319083+brockfanning@users.noreply.github.com>
Date: Thu, 29 Oct 2026 14:18:00 +0000
Subject: [PATCH] WS-551: Logging for troubleshooting login.gov auth.

---
 .../foia_non_sso/src/Service/SamlServiceDecorator.php     | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/docroot/modules/custom/foia_non_sso/src/Service/SamlServiceDecorator.php b/docroot/modules/custom/foia_non_sso/src/Service/SamlServiceDecorator.php
index f025d44fe..d70197c90 100644
--- a/docroot/modules/custom/foia_non_sso/src/Service/SamlServiceDecorator.php
+++ b/docroot/modules/custom/foia_non_sso/src/Service/SamlServiceDecorator.php
@@ -115,12 +115,18 @@ protected function doLogin($unique_id, ?AccountInterface $account = NULL) {
 
     if ($login_gov && $account && !$account->hasRole('non_sso')) {
       $this->foiaLogger->warning(
-        'FOIA rule: login blocked for uid @uid because CSP attribute is present and user lacks non_sso role.',
+        'Login.gov login blocked for uid @uid because CSP attribute is present and user lacks non_sso role.',
         ['@uid' => $account->id()]
       );
 
       throw new AccessDeniedHttpException('Login rejected due to FOIA Non-SSO policy.');
     }
+    if ($csp_present) {
+      $this->foiaLogger->warning('SAML login allowed for uid @uid. CSP attribute: @csp.', [
+        '@uid' => $account->id(),
+        '@csp' => $attributes['CSP'],
+      ]);
+    }
 
     return parent::doLogin($unique_id, $account);
   }