Support @PostFilter when returning single object

It may appear a bit contrived, but consider this example:

An object is soft-deleted in a server application, setting pojo.deleted = true; In general, this object shall not be retrievable any more, except for users with role="admin".
Imagine a manager method pojoManger.getById(long id). To not return deleted objects in the general case this method would have to be aware about the identity of the current user, and issue a corresponding query against the DAO layer, to (not) deliver an object that was soft-deleted.

My preferred solution would be though, to put @PostFilter(returnObject.deleted == false or hasRole('admin')) on that method, returning null if the expression evaluates to false. Throwing an AccessDeniedException would be inappropriate when a non-admin tries to get a deleted object.

The caller could then throw a NotFoundException() in that case, assuming a REST API application.
At least to me that appears to be a very sensible extension of the filter functionality.

Start by tracing how @PostFilter processes methods that return a single object, using the described getById(long id) case as the behavioral example. Done means a failed filter can return null for a non-admin while retaining the requested role-based filtering behavior; the payload names no source files or tests.