http PATCH w/ spring-data-rest @PreAuthorize save() method, custom PermissionEvaluator receives null object [DATAREST-945]

bitsofinfo opened DATAREST-945 and commented

Sample project that produces the issue: https://github.com/bitsofinfo/spring-boot-data-pre-authorize-issue

spring-boot 4.1, latest spring-data-jpa/rest libraries

I have a custom repository interface that extends from other interfaces that ultimately extend from PagingAndSortingRepository with an annotated SPeL protected methods like this. I also have a custom PermissionEvaluator

   @Override
    @PostAuthorize("hasPermission(returnObject, 'READ')")
    T findOne(ID id);

    @Override
    @PreAuthorize("hasPermission(#c,'CREATE,UPDATE')")
    <S extends T> S save(@P("c") S data);

I then have a client do a PATCH of a TestRecord. What happens is as follows:

• spring-data-rest, calls findOne(id) with the id of the object being updated (to fetch the original record for update). My PermisionEvaluator is properly called with the object.

• Next, spring-data-rest calls save() with the object to save. However my PermissionEvaluator at this point is passed a null object for #c above.

Also with the initial POST, the targetObject is NULL on save()...

Expected behavior is that my PermissionEvaluator should be invoked with a non-null object when save() is invoked regardless if a POST or a PATCH, and that this all works with intermediary interfaces for repositories deriving from PagingAndSortingRepository

Affects: 2.5.4 (Hopper SR4), 2.4.6 (Gosling SR6)