--- a/src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorSearch.java	Fri Jul 13 20:41:02 2012 +0200
+++ b/src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorSearch.java	Tue Aug 28 20:23:12 2012 +0200
@@ -15,6 +15,8 @@
 import org.restlet.resource.Get;
 
 import de.mpiwg.itgroup.annotations.Annotation;
+import de.mpiwg.itgroup.annotations.Person;
+import de.mpiwg.itgroup.annotations.neo4j.AnnotationStore;
 
 /**
  * Implements the "search" uri of the Annotator API. see
@@ -41,7 +43,7 @@
         logger.debug("AnnotatorSearch doGetJSON!");
         setCorsHeaders();
         // do authentication
-        String authUser = this.checkAuthToken(entity);
+        Person authUser = Person.createPersonWithId(this.checkAuthToken(entity));
         logger.debug("request authenticated=" + authUser);
 
         Form form = getRequest().getResourceRef().getQueryAsForm();
@@ -53,10 +55,11 @@
         JSONArray results = new JSONArray();
         // do search
         logger.debug(String.format("searching for uri=%s user=%s", uri, user));
-        List<Annotation> annots = getAnnotationStore().searchByUriUser(uri, user, limit, offset);
+        AnnotationStore store = getAnnotationStore();
+        List<Annotation> annots = store.searchByUriUser(uri, user, limit, offset);
         for (Annotation annot : annots) {
             // check permission
-            if (!annot.isActionAllowed("read", authUser)) continue;
+            if (!annot.isActionAllowed("read", authUser, store)) continue;
             JSONObject jo = createAnnotatorJson(annot, (authUser == null));
             if (jo != null) {
                 results.put(jo);