Source:
<code>public void authorize( ContainerRequestContext request ) { if(logger.isTraceEnabled()){ logger.debug( "PathPermissionsFilter.authorize" ); } final String PATH_MSG = "---- Checked permissions for path --------------------------------------------\n" + "Requested path: \n" + "Requested action: \n" + "Requested permission: \n" + "Permitted: \n"; ApplicationInfo application = null; try { application = management.getApplicationInfo( getApplicationIdentifier() ); EntityManager em = emf.getEntityManager( application.getId() ); if ( SubjectUtils.isAnonymous() ) { Map<String, String> roles = null; try { roles = em.getRoles(); if (logger.isTraceEnabled()) { logger.trace("found roles {}", roles); } } catch ( Exception e ) { logger.error( "Unable to retrieve roles", e ); } if ( ( roles != null ) && roles.containsKey( "guest" ) ) { loginApplicationGuest( application ); } else { throw mappableSecurityException( "unauthorized", "No application guest access authorized" ); } } Subject currentUser = SubjectUtils.getSubject(); if ( currentUser == null ) { return; } String applicationName = application.getName().toLowerCase(); String operation = request.getMethod().toLowerCase(); String path = request.getUriInfo().getPath().toLowerCase().replace(applicationName, ""); String perm = getPermissionFromPath( em.getApplicationRef().getUuid(), operation, path ); <START> if ( "/users/me".equals( path ) ) { <END> logger.debug("Allowing access to /users/me", getSubject().toString() ); return; } boolean permitted = currentUser.isPermitted( perm ); if ( logger.isDebugEnabled() ) { logger.debug( PATH_MSG, path, operation, perm, permitted ); } SubjectUtils.checkPermission( perm ); Subject subject = SubjectUtils.getSubject(); if ( logger.isDebugEnabled() ) { logger.debug("Checked subject for perm {}", subject != null ? subject.toString() : "", perm); logger.debug("------------------------------------------------------------------------------"); } } catch (Exception e){ throw mappableSecurityException( "unauthorized", "Subject does not have permission to access this resource" ); } }</code><technical_language>Dave -- allow automatic access /users/me for GET</technical_language>

Target:
public void authorize( ContainerRequestContext request ) { if(logger.isTraceEnabled()){ logger.debug( "PathPermissionsFilter.authorize" ); } final String PATH_MSG = "---- Checked permissions for path --------------------------------------------\n" + "Requested path: \n" + "Requested action: \n" + "Requested permission: \n" + "Permitted: \n"; ApplicationInfo application = null; try { application = management.getApplicationInfo( getApplicationIdentifier() ); EntityManager em = emf.getEntityManager( application.getId() ); if ( SubjectUtils.isAnonymous() ) { Map<String, String> roles = null; try { roles = em.getRoles(); if (logger.isTraceEnabled()) { logger.trace("found roles {}", roles); } } catch ( Exception e ) { logger.error( "Unable to retrieve roles", e ); } if ( ( roles != null ) && roles.containsKey( "guest" ) ) { loginApplicationGuest( application ); } else { throw mappableSecurityException( "unauthorized", "No application guest access authorized" ); } } Subject currentUser = SubjectUtils.getSubject(); if ( currentUser == null ) { return; } String applicationName = application.getName().toLowerCase(); String operation = request.getMethod().toLowerCase(); String path = request.getUriInfo().getPath().toLowerCase().replace(applicationName, ""); String perm = getPermissionFromPath( em.getApplicationRef().getUuid(), operation, path ); if ( "/users/me".equals( path ) && request.getMethod().equalsIgnoreCase( "get" )) { logger.debug("Allowing access to /users/me", getSubject().toString() ); return; } boolean permitted = currentUser.isPermitted( perm ); if ( logger.isDebugEnabled() ) { logger.debug( PATH_MSG, path, operation, perm, permitted ); } SubjectUtils.checkPermission( perm ); Subject subject = SubjectUtils.getSubject(); if ( logger.isDebugEnabled() ) { logger.debug("Checked subject for perm {}", subject != null ? subject.toString() : "", perm); logger.debug("------------------------------------------------------------------------------"); } } catch (Exception e){ throw mappableSecurityException( "unauthorized", "Subject does not have permission to access this resource" ); } }