EDIT

import java.util.Collection;

import java.util.Set;

import java.util.UUID;

import org.springframework.security.access.ConfigAttribute;

import eu.etaxonomy.cdm.hibernate.HibernateProxyHelper;

import eu.etaxonomy.cdm.model.occurrence.DerivedUnit;

import eu.etaxonomy.cdm.persistence.hibernate.permission.CdmAuthority;

 * see  https://dev.e-taxonomy.eu/redmine/issues/7018

 *

    /* (non-Javadoc)

     * @see eu.etaxonomy.cdm.persistence.hibernate.permission.voter.CdmPermissionVoter#furtherVotingDescisions(org.springframework.security.core.Authentication, java.lang.Object, java.util.Collection, eu.etaxonomy.cdm.persistence.hibernate.permission.voter.TaxonBaseVoter.ValidationResult)

     */

    @Override

    protected Integer furtherVotingDescisions(CdmAuthority CdmAuthority, Object object, Collection<ConfigAttribute> attributes,

            ValidationResult validationResult) {

        boolean isUuidMatchInOriginals = CdmAuthority.hasTargetUuid() && propagateGrantsFromOriginal(CdmAuthority.getTargetUUID(), (SpecimenOrObservationBase)object);

        if ( isUuidMatchInOriginals  && validationResult.isClassMatch && validationResult.isPermissionMatch){

            logger.debug("permission, class and uuid in originals are matching => ACCESS_GRANTED");

            return ACCESS_GRANTED;

        }

        return null;

    }

    /**

     * @param targetUuid

     * @param sob

     * @return

     */

    private boolean propagateGrantsFromOriginal(UUID targetUuid, SpecimenOrObservationBase<?>  sob){

        if (targetUuid.equals(sob.getUuid())) {

            return true;

        } else {

            if(sob instanceof DerivedUnit) {

                Set<SpecimenOrObservationBase> originals = HibernateProxyHelper.deproxy(sob, DerivedUnit.class).getOriginals();

                if(originals.size() == 1){

                    SpecimenOrObservationBase original = originals.iterator().next();

                    return  propagateGrantsFromOriginal(targetUuid, original);

                }

            }

        }

        return false;

    }

        // we always return true here to allow deleting the reference