Merge branch 'stable-3.2' into stable-3.3

* stable-3.2:
  Always replicate changes regardless of the permissions

Change-Id: I8395f1ac7eebea3e6f5995434b05aa0c9de06552

src/main/java/com/googlesource/gerrit/plugins/replication/pull/Source.java

diff --git a/src/main/java/com/googlesource/gerrit/plugins/replication/pull/Source.java b/src/main/java/com/googlesource/gerrit/plugins/replication/pull/Source.java
index 565caee..ec61a5d 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/replication/pull/Source.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/replication/pull/Source.java
@@ -294,12 +294,25 @@
                   try {
                     projectState = projectCache.get(project);
                   } catch (StorageException e) {
+                    repLog.warn(
+                        "NOT scheduling replication {}:{} because could not open source project",
+                        project,
+                        ref,
+                        e);
                     return false;
                   }
                   if (!projectState.isPresent()) {
+                    repLog.warn(
+                        "NOT scheduling replication {}:{} because project does not exist",
+                        project,
+                        ref);
                     throw new NoSuchProjectException(project);
                   }
                   if (!projectState.get().statePermitsRead()) {
+                    repLog.warn(
+                        "NOT scheduling replication {}:{} because project is not readable",
+                        project,
+                        ref);
                     return false;
                   }
                   if (!shouldReplicate(projectState.get(), userProvider.get())) {
@@ -309,12 +322,18 @@
                     return true;
                   }
                   try {
-                    permissionBackend
-                        .user(userProvider.get())
-                        .project(project)
-                        .ref(ref)
-                        .check(RefPermission.READ);
+                    if (!ref.startsWith(RefNames.REFS_CHANGES)) {
+                      permissionBackend
+                          .user(userProvider.get())
+                          .project(project)
+                          .ref(ref)
+                          .check(RefPermission.READ);
+                    }
                   } catch (AuthException e) {
+                    repLog.warn(
+                        "NOT scheduling replication {}:{} because lack of permissions to access project/ref",
+                        project,
+                        ref);
                     return false;
                   }
                   return true;
@@ -327,6 +346,7 @@
       Throwables.throwIfUnchecked(e);
       throw new RuntimeException(e);
     }
+    repLog.warn("NOT scheduling replication {}:{}", project, ref);
     return false;
   }