human-readable-get-document-permissions.xqy

xquery version "1.0-ml";

import module namespace sec="http://marklogic.com/xdmp/security" at "/MarkLogic/security.xqy";

declare function local:get-role-names($role-ids) {
  xdmp:invoke-function(
    function() {
      sec:get-role-names($role-ids)
    },
    <options xmlns="xdmp:eval">
      <database>{xdmp:security-database()}</database>
    </options>
  )
};

text {
  "(",
  fn:string-join(
    for $p in xdmp:document-get-permissions("/sources/asdf/0687d420902_metadata.xml")
    let $capability := $p/sec:capability/text()
    let $role-name  := local:get-role-names($p/sec:role-id/text())
    return fn:concat('xdmp:permission("', $role-name, '", "', $capability, '")')
    , ", "
  ),
  ")"
}

Sample output:
( xdmp:permission("rest-extension-user", "execute"), xdmp:permission("rest-admin", "update"), xdmp:permission("rest-admin", "read") )