http PATCH w/ spring-data-rest @PreAuthorize save() method, custom PermissionEvaluator receives null object

Summary

Sample: https://github.com/bitsofinfo/spring-boot-data-pre-authorize-issue

spring-security 4.1.3, spring-boot 4.1, latest spring-data-jpa/rest libraries

I have a custom repository interface that extends from other interfaces that ultimately extend from PagingAndSortingRepository with an annotated SPeL protected methods like this. I also have a custom PermissionEvaluator

    @Override
    @PostAuthorize("hasPermission(returnObject, 'READ')")
    T findOne(ID id);

    @Override
    @PreAuthorize("hasPermission(#c,'CREATE,UPDATE')")
    <S extends T> S save(@P("c") S data);

I then have a client do a PATCH of a TestRecord. What happens is as follows

• spring-data-rest, calls findOne(id) with the id of the object being updated (to fetch the original record for update). My PermisionEvaluator is properly called with the object.
• Next, spring-data-rest calls save() with the object to save. However my PermissionEvaluator at this point is passed a null object for #c above.

Also with the initial POST, the targetObject is NULL on save()...

Expected Behavior

Expected behavior is that my PermissionEvaluator should be invoked with a non-null object when save() is invoked regardless if a POST or a PATCH, and that this all works with intermediary interfaces for repositories deriving from PagingAndSortingRepository

Start with the linked sample repository and reproduce both the POST and PATCH flows using the @PreAuthorize save() method and custom PermissionEvaluator. Trace the repository call through the intermediary interfaces extending PagingAndSortingRepository, then verify that the evaluator receives a non-null object for both operations.