PermissionEvaluator targetDomainObject is always null when checking hasPermission - spring-security

Question

I am developing a Spring Data Rest project, and want to check for user permission when he creates or updates a resource
Here's my laptop class
#Getter
#Setter
#Entity
public class Laptop {
#Id
#GeneratedValue(strategy = GenerationType.IDENTITY)
private Long id;
#Column
private String model;
#Column
private Long userId;
#PrePersist
void onCreate() {
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
AppUser appUser = (AppUser) authentication.getPrincipal();
userId = appUser.getId();
}
}
Now what I want to do, is to check before user updates the laptop, to make sure that he's updating his laptop and not other's.
Here's my LaptopRepository
#RepositoryRestResource(collectionResourceRel = "content")
public interface LaptopRepository extends CrudRepository<Laptop, Long> {
#Override
//#PreAuthorize("hasPermission(#entity, 'CREATE')")
#PreAuthorize("#entity.userId == principal.id")
<S extends Laptop> S save(S entity);
}
And here's the PermissionEvaluator's method
#Override
public boolean hasPermission(Authentication authentication,
Object targetDomainObject, Object permission) {
return true;
}
Now the point is
How do I distinguish between POST and PUT methods?
If I change my #PreAuthorize to just pass the entity to the hasPermission method to just test, it always gets passes as null

Answer 1

As stated in the guides
import org.springframework.security.access.method.P;
...
#PreAuthorize("#c.name == authentication.name")
public void doSomething(#P("c") Contact contact);
import org.springframework.data.repository.query.Param;
...
#PreAuthorize("#n == authentication.name")
Contact findContactByName(#Param("n") String name);
Adding any of the annotations resolved the problem with null object, and I can distinguish between PUT and POST checking if target's id is null or not