Merge remote-tracking branch 'upstream/master'

27 files changed, 277 insertions, 127 deletions

diff --git a/src/org/traccar/api/AsyncSocket.java b/src/org/traccar/api/AsyncSocket.java
index 4422dbccd..7ac3810fa 100644
--- a/src/org/traccar/api/AsyncSocket.java
+++ b/src/org/traccar/api/AsyncSocket.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2015 - 2016 Anton Tananaev (anton.tananaev@gmail.com)
+ * Copyright 2015 - 2016 Anton Tananaev (anton@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/src/org/traccar/api/AsyncSocketServlet.java b/src/org/traccar/api/AsyncSocketServlet.java
index ef6cef732..9318b6fc6 100644
--- a/src/org/traccar/api/AsyncSocketServlet.java
+++ b/src/org/traccar/api/AsyncSocketServlet.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2015 - 2016 Anton Tananaev (anton.tananaev@gmail.com)
+ * Copyright 2015 - 2016 Anton Tananaev (anton@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/src/org/traccar/api/BaseResource.java b/src/org/traccar/api/BaseResource.java
index 567b9735a..44ef33c53 100644
--- a/src/org/traccar/api/BaseResource.java
+++ b/src/org/traccar/api/BaseResource.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2015 - 2016 Anton Tananaev (anton.tananaev@gmail.com)
+ * Copyright 2015 - 2016 Anton Tananaev (anton@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/src/org/traccar/api/CorsResponseFilter.java b/src/org/traccar/api/CorsResponseFilter.java
index 459fcee66..70ea7e3e1 100644
--- a/src/org/traccar/api/CorsResponseFilter.java
+++ b/src/org/traccar/api/CorsResponseFilter.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2015 - 2016 Anton Tananaev (anton.tananaev@gmail.com)
+ * Copyright 2015 - 2016 Anton Tananaev (anton@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/src/org/traccar/api/ObjectMapperProvider.java b/src/org/traccar/api/ObjectMapperProvider.java
index 6f654118a..c916c1f4c 100644
--- a/src/org/traccar/api/ObjectMapperProvider.java
+++ b/src/org/traccar/api/ObjectMapperProvider.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2015 Anton Tananaev (anton.tananaev@gmail.com)
+ * Copyright 2015 Anton Tananaev (anton@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/src/org/traccar/api/ResourceErrorHandler.java b/src/org/traccar/api/ResourceErrorHandler.java
index be63aad09..1d618b08d 100644
--- a/src/org/traccar/api/ResourceErrorHandler.java
+++ b/src/org/traccar/api/ResourceErrorHandler.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2015 Anton Tananaev (anton.tananaev@gmail.com)
+ * Copyright 2015 - 2016 Anton Tananaev (anton@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,24 +20,22 @@ import org.traccar.helper.Log;
 import javax.ws.rs.WebApplicationException;
 import javax.ws.rs.core.Response;
 import javax.ws.rs.ext.ExceptionMapper;
-import java.util.HashMap;
-import java.util.Map;
 
 public class ResourceErrorHandler implements ExceptionMapper<Exception> {
 
-    private static final String KEY_MESSAGE = "message";
-    private static final String KEY_DETAILS = "details";
-
     @Override
     public Response toResponse(Exception e) {
-        Map<String, String> error = new HashMap<>();
         if (e instanceof WebApplicationException) {
-            WebApplicationException webApplicationException = (WebApplicationException) e;
-            return Response.status(webApplicationException.getResponse().getStatus()).entity(error).build();
+            WebApplicationException exception = (WebApplicationException) e;
+            String message;
+            if (exception.getCause() != null) {
+                message = Log.exceptionStack(exception.getCause());
+            } else {
+                message = Log.exceptionStack(exception);
+            }
+            return Response.fromResponse(exception.getResponse()).entity(message).build();
         } else {
-            error.put(KEY_MESSAGE, e.getMessage());
-            error.put(KEY_DETAILS, Log.exceptionStack(e));
-            return Response.status(Response.Status.BAD_REQUEST).entity(error).build();
+            return Response.status(Response.Status.BAD_REQUEST).entity(Log.exceptionStack(e)).build();
         }
     }
 
diff --git a/src/org/traccar/api/SecurityRequestFilter.java b/src/org/traccar/api/SecurityRequestFilter.java
index f0dd363db..ca3ebf04d 100644
--- a/src/org/traccar/api/SecurityRequestFilter.java
+++ b/src/org/traccar/api/SecurityRequestFilter.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2015 - 2016 Anton Tananaev (anton.tananaev@gmail.com)
+ * Copyright 2015 - 2016 Anton Tananaev (anton@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,6 +17,7 @@ package org.traccar.api;
 
 import org.traccar.Context;
 import org.traccar.api.resource.SessionResource;
+import org.traccar.helper.Log;
 import org.traccar.model.User;
 
 import javax.annotation.security.PermitAll;
@@ -62,26 +63,35 @@ public class SecurityRequestFilter implements ContainerRequestFilter {
 
         SecurityContext securityContext = null;
 
-        String authHeader = requestContext.getHeaderString(AUTHORIZATION_HEADER);
-        if (authHeader != null) {
+        try {
 
-            try {
-                String[] auth = decodeBasicAuth(authHeader);
-                User user = Context.getDataManager().login(auth[0], auth[1]);
-                if (user != null) {
-                    securityContext = new UserSecurityContext(new UserPrincipal(user.getId()));
+            String authHeader = requestContext.getHeaderString(AUTHORIZATION_HEADER);
+            if (authHeader != null) {
+
+                try {
+                    String[] auth = decodeBasicAuth(authHeader);
+                    User user = Context.getPermissionsManager().login(auth[0], auth[1]);
+                    if (user != null) {
+                        Context.getStatisticsManager().registerRequest(user.getId());
+                        securityContext = new UserSecurityContext(new UserPrincipal(user.getId()));
+                    }
+                } catch (SQLException e) {
+                    throw new WebApplicationException(e);
                 }
-            } catch (SQLException e) {
-                throw new WebApplicationException(e);
-            }
 
-        } else if (request.getSession() != null) {
+            } else if (request.getSession() != null) {
+
+                Long userId = (Long) request.getSession().getAttribute(SessionResource.USER_ID_KEY);
+                if (userId != null) {
+                    Context.getPermissionsManager().checkUserEnabled(userId);
+                    Context.getStatisticsManager().registerRequest(userId);
+                    securityContext = new UserSecurityContext(new UserPrincipal(userId));
+                }
 
-            Long userId = (Long) request.getSession().getAttribute(SessionResource.USER_ID_KEY);
-            if (userId != null) {
-                securityContext = new UserSecurityContext(new UserPrincipal(userId));
             }
 
+        } catch (SecurityException e) {
+            Log.warning(e);
         }
 
         if (securityContext != null) {
diff --git a/src/org/traccar/api/UserPrincipal.java b/src/org/traccar/api/UserPrincipal.java
index 25fcdb233..80e92c2dd 100644
--- a/src/org/traccar/api/UserPrincipal.java
+++ b/src/org/traccar/api/UserPrincipal.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2015 Anton Tananaev (anton.tananaev@gmail.com)
+ * Copyright 2015 Anton Tananaev (anton@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/src/org/traccar/api/UserSecurityContext.java b/src/org/traccar/api/UserSecurityContext.java
index 0ff67a0f8..55c0621bc 100644
--- a/src/org/traccar/api/UserSecurityContext.java
+++ b/src/org/traccar/api/UserSecurityContext.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2015 Anton Tananaev (anton.tananaev@gmail.com)
+ * Copyright 2015 Anton Tananaev (anton@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/src/org/traccar/api/resource/AttributeAliasResource.java b/src/org/traccar/api/resource/AttributeAliasResource.java
index 2417fb0ec..db767616f 100644
--- a/src/org/traccar/api/resource/AttributeAliasResource.java
+++ b/src/org/traccar/api/resource/AttributeAliasResource.java
@@ -1,6 +1,6 @@
 /*
- * Copyright 2016 Anton Tananaev (anton.tananaev@gmail.com)
- * Copyright 2016 Andrey Kunitsyn (abyss@fox5.ru)
+ * Copyright 2016 Anton Tananaev (anton@traccar.org)
+ * Copyright 2016 Andrey Kunitsyn (andrey@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -64,7 +64,7 @@ public class AttributeAliasResource extends BaseResource {
 
     @Path("{id}")
     @PUT
-    public Response update(@PathParam("id") long id, AttributeAlias entity) throws SQLException {
+    public Response update(AttributeAlias entity) throws SQLException {
         Context.getPermissionsManager().checkReadonly(getUserId());
         if (!Context.getPermissionsManager().isAdmin(getUserId())) {
             AttributeAlias oldEntity = Context.getAliasesManager().getAttributeAlias(entity.getId());
diff --git a/src/org/traccar/api/resource/CommandResource.java b/src/org/traccar/api/resource/CommandResource.java
index f41faae2e..cce2dac2b 100644
--- a/src/org/traccar/api/resource/CommandResource.java
+++ b/src/org/traccar/api/resource/CommandResource.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2015 Anton Tananaev (anton.tananaev@gmail.com)
+ * Copyright 2015 Anton Tananaev (anton@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/src/org/traccar/api/resource/DeviceGeofenceResource.java b/src/org/traccar/api/resource/DeviceGeofenceResource.java
index 27535617d..6254fe3cf 100644
--- a/src/org/traccar/api/resource/DeviceGeofenceResource.java
+++ b/src/org/traccar/api/resource/DeviceGeofenceResource.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016 Anton Tananaev (anton.tananaev@gmail.com)
+ * Copyright 2016 Anton Tananaev (anton@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/src/org/traccar/api/resource/DevicePermissionResource.java b/src/org/traccar/api/resource/DevicePermissionResource.java
index 7faa1ab09..3b89507fa 100644
--- a/src/org/traccar/api/resource/DevicePermissionResource.java
+++ b/src/org/traccar/api/resource/DevicePermissionResource.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2015 - 2016 Anton Tananaev (anton.tananaev@gmail.com)
+ * Copyright 2015 - 2016 Anton Tananaev (anton@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/src/org/traccar/api/resource/DeviceResource.java b/src/org/traccar/api/resource/DeviceResource.java
index 56787b7bb..e4ecd3625 100644
--- a/src/org/traccar/api/resource/DeviceResource.java
+++ b/src/org/traccar/api/resource/DeviceResource.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2015 - 2016 Anton Tananaev (anton.tananaev@gmail.com)
+ * Copyright 2015 - 2016 Anton Tananaev (anton@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,6 +18,7 @@ package org.traccar.api.resource;
 import org.traccar.Context;
 import org.traccar.api.BaseResource;
 import org.traccar.model.Device;
+import org.traccar.model.DeviceTotalDistance;
 
 import javax.ws.rs.Consumes;
 import javax.ws.rs.DELETE;
@@ -57,6 +58,13 @@ public class DeviceResource extends BaseResource {
     @POST
     public Response add(Device entity) throws SQLException {
         Context.getPermissionsManager().checkReadonly(getUserId());
+        int deviceLimit = Context.getPermissionsManager().getUser(getUserId()).getDeviceLimit();
+        if (deviceLimit != 0) {
+            int deviceCount = Context.getPermissionsManager().getDevicePermissions(getUserId()).size();
+            if (deviceCount >= deviceLimit) {
+                throw new SecurityException("User device limit reached");
+            }
+        }
         Context.getDeviceManager().addDevice(entity);
         Context.getDataManager().linkDevice(getUserId(), entity.getId());
         Context.getPermissionsManager().refreshPermissions();
@@ -68,9 +76,9 @@ public class DeviceResource extends BaseResource {
 
     @Path("{id}")
     @PUT
-    public Response update(@PathParam("id") long id, Device entity) throws SQLException {
+    public Response update(Device entity) throws SQLException {
         Context.getPermissionsManager().checkReadonly(getUserId());
-        Context.getPermissionsManager().checkDevice(getUserId(), id);
+        Context.getPermissionsManager().checkDevice(getUserId(), entity.getId());
         Context.getDeviceManager().updateDevice(entity);
         if (Context.getGeofenceManager() != null) {
             Context.getGeofenceManager().refresh();
@@ -92,4 +100,12 @@ public class DeviceResource extends BaseResource {
         return Response.noContent().build();
     }
 
+    @Path("{id}/distance")
+    @PUT
+    public Response updateTotalDistance(DeviceTotalDistance entity) throws SQLException {
+        Context.getPermissionsManager().checkAdmin(getUserId());
+        Context.getDeviceManager().resetTotalDistance(entity);
+        return Response.noContent().build();
+    }
+
 }
diff --git a/src/org/traccar/api/resource/EventResource.java b/src/org/traccar/api/resource/EventResource.java
index 74a748ea5..c0a8f968d 100644
--- a/src/org/traccar/api/resource/EventResource.java
+++ b/src/org/traccar/api/resource/EventResource.java
@@ -1,14 +1,12 @@
 package org.traccar.api.resource;
 
 import java.sql.SQLException;
-import java.util.Collection;
 
 import javax.ws.rs.Consumes;
 import javax.ws.rs.GET;
 import javax.ws.rs.Path;
 import javax.ws.rs.PathParam;
 import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
 import javax.ws.rs.core.MediaType;
 
 import org.traccar.Context;
@@ -26,14 +24,9 @@ public class EventResource extends BaseResource {
     public Event get(@PathParam("id") long id) throws SQLException {
         Event event = Context.getDataManager().getEvent(id);
         Context.getPermissionsManager().checkDevice(getUserId(), event.getDeviceId());
+        if (event.getGeofenceId() != 0) {
+            Context.getPermissionsManager().checkGeofence(getUserId(), event.getGeofenceId());
+        }
         return event;
     }
-
-    @GET
-    public Collection<Event> get(
-            @QueryParam("deviceId") long deviceId, @QueryParam("type") String type,
-            @QueryParam("interval") int interval) throws SQLException {
-        Context.getPermissionsManager().checkDevice(getUserId(), deviceId);
-        return Context.getDataManager().getLastEvents(deviceId, type, interval);
-    }
 }
diff --git a/src/org/traccar/api/resource/GeofencePermissionResource.java b/src/org/traccar/api/resource/GeofencePermissionResource.java
index 3a82845f5..8faa63d85 100644
--- a/src/org/traccar/api/resource/GeofencePermissionResource.java
+++ b/src/org/traccar/api/resource/GeofencePermissionResource.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016 Anton Tananaev (anton.tananaev@gmail.com)
+ * Copyright 2016 Anton Tananaev (anton@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/src/org/traccar/api/resource/GeofenceResource.java b/src/org/traccar/api/resource/GeofenceResource.java
index 960ab813f..591908813 100644
--- a/src/org/traccar/api/resource/GeofenceResource.java
+++ b/src/org/traccar/api/resource/GeofenceResource.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016 Anton Tananaev (anton.tananaev@gmail.com)
+ * Copyright 2016 Anton Tananaev (anton@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -45,9 +45,13 @@ public class GeofenceResource extends BaseResource {
     @GET
     public Collection<Geofence> get(
             @QueryParam("all") boolean all, @QueryParam("userId") long userId, @QueryParam("groupId") long groupId,
-            @QueryParam("deviceId") long deviceId) throws SQLException {
+            @QueryParam("deviceId") long deviceId, @QueryParam("refresh") boolean refresh) throws SQLException {
 
         GeofenceManager geofenceManager = Context.getGeofenceManager();
+        if (refresh) {
+            geofenceManager.refreshGeofences();
+        }
+
         Set<Long> result;
         if (all) {
             Context.getPermissionsManager().checkAdmin(getUserId());
@@ -57,7 +61,7 @@ public class GeofenceResource extends BaseResource {
                 userId = getUserId();
             }
             Context.getPermissionsManager().checkUser(getUserId(), userId);
-            result = new HashSet<Long>(geofenceManager.getUserGeofencesIds(userId));
+            result = new HashSet<>(geofenceManager.getUserGeofencesIds(userId));
         }
 
         if (groupId != 0) {
@@ -84,9 +88,9 @@ public class GeofenceResource extends BaseResource {
 
     @Path("{id}")
     @PUT
-    public Response update(@PathParam("id") long id, Geofence entity) throws SQLException {
+    public Response update(Geofence entity) throws SQLException {
         Context.getPermissionsManager().checkReadonly(getUserId());
-        Context.getPermissionsManager().checkGeofence(getUserId(), id);
+        Context.getPermissionsManager().checkGeofence(getUserId(), entity.getId());
         Context.getGeofenceManager().updateGeofence(entity);
         return Response.ok(entity).build();
     }
diff --git a/src/org/traccar/api/resource/GroupGeofenceResource.java b/src/org/traccar/api/resource/GroupGeofenceResource.java
index 1ef495a86..81fd4e45f 100644
--- a/src/org/traccar/api/resource/GroupGeofenceResource.java
+++ b/src/org/traccar/api/resource/GroupGeofenceResource.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016 Anton Tananaev (anton.tananaev@gmail.com)
+ * Copyright 2016 Anton Tananaev (anton@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/src/org/traccar/api/resource/GroupPermissionResource.java b/src/org/traccar/api/resource/GroupPermissionResource.java
index 94100362b..07f101765 100644
--- a/src/org/traccar/api/resource/GroupPermissionResource.java
+++ b/src/org/traccar/api/resource/GroupPermissionResource.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016 Anton Tananaev (anton.tananaev@gmail.com)
+ * Copyright 2016 Anton Tananaev (anton@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/src/org/traccar/api/resource/GroupResource.java b/src/org/traccar/api/resource/GroupResource.java
index 6b722ef6d..c98a20b7e 100644
--- a/src/org/traccar/api/resource/GroupResource.java
+++ b/src/org/traccar/api/resource/GroupResource.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016 Anton Tananaev (anton.tananaev@gmail.com)
+ * Copyright 2016 Anton Tananaev (anton@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -67,9 +67,9 @@ public class GroupResource extends BaseResource {
 
     @Path("{id}")
     @PUT
-    public Response update(@PathParam("id") long id, Group entity) throws SQLException {
+    public Response update(Group entity) throws SQLException {
         Context.getPermissionsManager().checkReadonly(getUserId());
-        Context.getPermissionsManager().checkGroup(getUserId(), id);
+        Context.getPermissionsManager().checkGroup(getUserId(), entity.getId());
         Context.getDeviceManager().updateGroup(entity);
         if (Context.getGeofenceManager() != null) {
             Context.getGeofenceManager().refresh();
diff --git a/src/org/traccar/api/resource/NotificationResource.java b/src/org/traccar/api/resource/NotificationResource.java
index 5bec7fd85..03f7e4ba0 100644
--- a/src/org/traccar/api/resource/NotificationResource.java
+++ b/src/org/traccar/api/resource/NotificationResource.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016 Anton Tananaev (anton.tananaev@gmail.com)
+ * Copyright 2016 Anton Tananaev (anton@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,6 +18,7 @@ package org.traccar.api.resource;
 import java.sql.SQLException;
 import java.util.Collection;
 
+import javax.mail.MessagingException;
 import javax.ws.rs.Consumes;
 import javax.ws.rs.GET;
 import javax.ws.rs.POST;
@@ -29,7 +30,9 @@ import javax.ws.rs.core.Response;
 
 import org.traccar.Context;
 import org.traccar.api.BaseResource;
+import org.traccar.model.Event;
 import org.traccar.model.Notification;
+import org.traccar.notification.NotificationMail;
 
 @Path("users/notifications")
 @Produces(MediaType.APPLICATION_JSON)
@@ -46,7 +49,7 @@ public class NotificationResource extends BaseResource {
             userId = getUserId();
         }
         Context.getPermissionsManager().checkUser(getUserId(), userId);
-        return Context.getNotificationManager().getUserNotifications(userId);
+        return Context.getNotificationManager().getAllUserNotifications(userId);
     }
 
     @POST
@@ -56,4 +59,12 @@ public class NotificationResource extends BaseResource {
         Context.getNotificationManager().updateNotification(entity);
         return Response.ok(entity).build();
     }
+
+    @Path("test")
+    @POST
+    public Response testMail() throws MessagingException {
+        NotificationMail.sendMailSync(getUserId(), new Event("test", 0), null);
+        return Response.noContent().build();
+    }
+
 }
diff --git a/src/org/traccar/api/resource/PositionResource.java b/src/org/traccar/api/resource/PositionResource.java
index e00e06e7a..84f406bee 100644
--- a/src/org/traccar/api/resource/PositionResource.java
+++ b/src/org/traccar/api/resource/PositionResource.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2015 Anton Tananaev (anton.tananaev@gmail.com)
+ * Copyright 2015 - 2016 Anton Tananaev (anton@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,34 +17,79 @@ package org.traccar.api.resource;
 
 import org.traccar.Context;
 import org.traccar.api.BaseResource;
+import org.traccar.helper.DateUtil;
 import org.traccar.model.Position;
-import org.traccar.web.JsonConverter;
+import org.traccar.web.CsvBuilder;
+import org.traccar.web.GpxBuilder;
 
 import javax.ws.rs.Consumes;
 import javax.ws.rs.GET;
 import javax.ws.rs.Path;
 import javax.ws.rs.Produces;
 import javax.ws.rs.QueryParam;
+import javax.ws.rs.core.HttpHeaders;
 import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+
 import java.sql.SQLException;
+import java.util.ArrayList;
 import java.util.Collection;
+import java.util.List;
 
 @Path("positions")
-@Produces(MediaType.APPLICATION_JSON)
 @Consumes(MediaType.APPLICATION_JSON)
 public class PositionResource extends BaseResource {
 
+    public static final String TEXT_CSV = "text/csv";
+    public static final String CONTENT_DISPOSITION_VALUE_CSV = "attachment; filename=positions.csv";
+    public static final String GPX = "application/gpx+xml";
+    public static final String CONTENT_DISPOSITION_VALUE_GPX = "attachment; filename=positions.gpx";
+
     @GET
-    public Collection<Position> get(
-            @QueryParam("deviceId") long deviceId, @QueryParam("from") String from, @QueryParam("to") String to)
+    @Produces(MediaType.APPLICATION_JSON)
+    public Collection<Position> getJson(
+            @QueryParam("deviceId") long deviceId, @QueryParam("id") List<Long> positionIds,
+            @QueryParam("from") String from, @QueryParam("to") String to)
             throws SQLException {
-        if (deviceId == 0) {
+        if (!positionIds.isEmpty()) {
+            ArrayList<Position> positions = new ArrayList<>();
+            for (Long positionId : positionIds) {
+                Position position = Context.getDataManager().getPosition(positionId);
+                Context.getPermissionsManager().checkDevice(getUserId(), position.getDeviceId());
+                positions.add(position);
+            }
+            return positions;
+        } else if (deviceId == 0) {
             return Context.getDeviceManager().getInitialState(getUserId());
         } else {
             Context.getPermissionsManager().checkDevice(getUserId(), deviceId);
             return Context.getDataManager().getPositions(
-                    deviceId, JsonConverter.parseDate(from), JsonConverter.parseDate(to));
+                    deviceId, DateUtil.parseDate(from), DateUtil.parseDate(to));
         }
     }
 
+    @GET
+    @Produces(TEXT_CSV)
+    public Response getCsv(
+            @QueryParam("deviceId") long deviceId, @QueryParam("from") String from, @QueryParam("to") String to)
+            throws SQLException {
+        Context.getPermissionsManager().checkDevice(getUserId(), deviceId);
+        CsvBuilder csv = new CsvBuilder();
+        csv.addHeaderLine(new Position());
+        csv.addArray(Context.getDataManager().getPositions(
+                deviceId, DateUtil.parseDate(from), DateUtil.parseDate(to)));
+        return Response.ok(csv.build()).header(HttpHeaders.CONTENT_DISPOSITION, CONTENT_DISPOSITION_VALUE_CSV).build();
+    }
+
+    @GET
+    @Produces(GPX)
+    public Response getGpx(
+            @QueryParam("deviceId") long deviceId, @QueryParam("from") String from, @QueryParam("to") String to)
+            throws SQLException {
+        Context.getPermissionsManager().checkDevice(getUserId(), deviceId);
+        GpxBuilder gpx = new GpxBuilder(Context.getIdentityManager().getDeviceById(deviceId).getName());
+        gpx.addPositions(Context.getDataManager().getPositions(
+                deviceId, DateUtil.parseDate(from), DateUtil.parseDate(to)));
+        return Response.ok(gpx.build()).header(HttpHeaders.CONTENT_DISPOSITION, CONTENT_DISPOSITION_VALUE_GPX).build();
+    }
 }
diff --git a/src/org/traccar/api/resource/ReportResource.java b/src/org/traccar/api/resource/ReportResource.java
index 0dd0452ff..e37d6f01d 100644
--- a/src/org/traccar/api/resource/ReportResource.java
+++ b/src/org/traccar/api/resource/ReportResource.java
@@ -1,6 +1,9 @@
 package org.traccar.api.resource;
 
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
 import java.sql.SQLException;
+import java.util.Collection;
 import java.util.List;
 
 import javax.ws.rs.Consumes;
@@ -13,107 +16,119 @@ import javax.ws.rs.core.MediaType;
 import javax.ws.rs.core.Response;
 
 import org.traccar.api.BaseResource;
+import org.traccar.helper.DateUtil;
+import org.traccar.model.Event;
+import org.traccar.model.Position;
 import org.traccar.reports.Events;
 import org.traccar.reports.Summary;
 import org.traccar.reports.Trips;
+import org.traccar.reports.model.SummaryReport;
+import org.traccar.reports.model.TripReport;
 import org.traccar.reports.Route;
-import org.traccar.web.JsonConverter;
 
 @Path("reports")
 @Consumes(MediaType.APPLICATION_JSON)
 public class ReportResource extends BaseResource {
 
-    public static final String TEXT_CSV = "text/csv";
-    public static final String CONTENT_DISPOSITION_VALUE = "attachment; filename=report.csv";
+    private static final String XLSX = "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet";
+    private static final String CONTENT_DISPOSITION_VALUE_XLSX = "attachment; filename=report.xlsx";
 
     @Path("route")
     @GET
     @Produces(MediaType.APPLICATION_JSON)
-    public Response getRouteJson(
+    public Collection<Position> getRoute(
             @QueryParam("deviceId") final List<Long> deviceIds, @QueryParam("groupId") final List<Long> groupIds,
             @QueryParam("from") String from, @QueryParam("to") String to) throws SQLException {
-        return Response.ok(Route.getJson(getUserId(), deviceIds, groupIds,
-                JsonConverter.parseDate(from), JsonConverter.parseDate(to))).build();
+        return Route.getObjects(getUserId(), deviceIds, groupIds,
+                DateUtil.parseDate(from), DateUtil.parseDate(to));
     }
 
     @Path("route")
     @GET
-    @Produces(TEXT_CSV)
-    public Response getRouteCsv(
+    @Produces(XLSX)
+    public Response getRouteExcel(
             @QueryParam("deviceId") final List<Long> deviceIds, @QueryParam("groupId") final List<Long> groupIds,
-            @QueryParam("from") String from, @QueryParam("to") String to) throws SQLException {
-        return Response.ok(Route.getCsv(getUserId(), deviceIds, groupIds,
-                JsonConverter.parseDate(from), JsonConverter.parseDate(to)))
-                .header(HttpHeaders.CONTENT_DISPOSITION, CONTENT_DISPOSITION_VALUE)
-                .build();
+            @QueryParam("from") String from, @QueryParam("to") String to) throws SQLException, IOException {
+        ByteArrayOutputStream stream = new ByteArrayOutputStream();
+        Route.getExcel(stream, getUserId(), deviceIds, groupIds,
+                DateUtil.parseDateTime(from), DateUtil.parseDateTime(to));
+
+        return Response.ok(stream.toByteArray())
+                .header(HttpHeaders.CONTENT_DISPOSITION, CONTENT_DISPOSITION_VALUE_XLSX).build();
     }
 
     @Path("events")
     @GET
     @Produces(MediaType.APPLICATION_JSON)
-    public Response getEventsJson(
+    public Collection<Event> getEvents(
             @QueryParam("deviceId") final List<Long> deviceIds, @QueryParam("groupId") final List<Long> groupIds,
             @QueryParam("type") final List<String> types,
             @QueryParam("from") String from, @QueryParam("to") String to) throws SQLException {
-        return Response.ok(Events.getJson(getUserId(), deviceIds, groupIds, types,
-                JsonConverter.parseDate(from), JsonConverter.parseDate(to))).build();
+        return Events.getObjects(getUserId(), deviceIds, groupIds, types,
+                DateUtil.parseDate(from), DateUtil.parseDate(to));
     }
 
     @Path("events")
     @GET
-    @Produces(TEXT_CSV)
-    public Response getEventsCsv(
+    @Produces(XLSX)
+    public Response getEventsExcel(
             @QueryParam("deviceId") final List<Long> deviceIds, @QueryParam("groupId") final List<Long> groupIds,
             @QueryParam("type") final List<String> types,
-            @QueryParam("from") String from, @QueryParam("to") String to) throws SQLException {
-        return Response.ok(Events.getCsv(getUserId(), deviceIds, groupIds,
-                types, JsonConverter.parseDate(from), JsonConverter.parseDate(to)))
-                .header(HttpHeaders.CONTENT_DISPOSITION, CONTENT_DISPOSITION_VALUE)
-                .build();
+            @QueryParam("from") String from, @QueryParam("to") String to) throws SQLException, IOException {
+        ByteArrayOutputStream stream = new ByteArrayOutputStream();
+        Events.getExcel(stream, getUserId(), deviceIds, groupIds, types,
+                DateUtil.parseDateTime(from), DateUtil.parseDateTime(to));
+
+        return Response.ok(stream.toByteArray())
+                .header(HttpHeaders.CONTENT_DISPOSITION, CONTENT_DISPOSITION_VALUE_XLSX).build();
     }
 
     @Path("summary")
     @GET
     @Produces(MediaType.APPLICATION_JSON)
-    public Response getSummaryJson(
+    public Collection<SummaryReport> getSummary(
             @QueryParam("deviceId") final List<Long> deviceIds, @QueryParam("groupId") final List<Long> groupIds,
             @QueryParam("from") String from, @QueryParam("to") String to) throws SQLException {
-        return Response.ok(Summary.getJson(getUserId(), deviceIds, groupIds,
-                JsonConverter.parseDate(from), JsonConverter.parseDate(to))).build();
+        return Summary.getObjects(getUserId(), deviceIds, groupIds,
+                DateUtil.parseDate(from), DateUtil.parseDate(to));
     }
 
     @Path("summary")
     @GET
-    @Produces(TEXT_CSV)
-    public Response getSummaryCsv(
+    @Produces(XLSX)
+    public Response getSummaryExcel(
             @QueryParam("deviceId") final List<Long> deviceIds, @QueryParam("groupId") final List<Long> groupIds,
-            @QueryParam("from") String from, @QueryParam("to") String to) throws SQLException {
-        return Response.ok(Summary.getCsv(getUserId(), deviceIds, groupIds,
-                JsonConverter.parseDate(from), JsonConverter.parseDate(to)))
-                .header(HttpHeaders.CONTENT_DISPOSITION, CONTENT_DISPOSITION_VALUE)
-                .build();
+            @QueryParam("from") String from, @QueryParam("to") String to) throws SQLException, IOException {
+        ByteArrayOutputStream stream = new ByteArrayOutputStream();
+        Summary.getExcel(stream, getUserId(), deviceIds, groupIds,
+                DateUtil.parseDateTime(from), DateUtil.parseDateTime(to));
+
+        return Response.ok(stream.toByteArray())
+                .header(HttpHeaders.CONTENT_DISPOSITION, CONTENT_DISPOSITION_VALUE_XLSX).build();
     }
 
     @Path("trips")
     @GET
     @Produces(MediaType.APPLICATION_JSON)
-    public Response getTripsJson(
+    public Collection<TripReport> getTrips(
             @QueryParam("deviceId") final List<Long> deviceIds, @QueryParam("groupId") final List<Long> groupIds,
             @QueryParam("from") String from, @QueryParam("to") String to) throws SQLException {
-        return Response.ok(Trips.getJson(getUserId(), deviceIds, groupIds,
-                JsonConverter.parseDate(from), JsonConverter.parseDate(to))).build();
+        return Trips.getObjects(getUserId(), deviceIds, groupIds,
+                DateUtil.parseDate(from), DateUtil.parseDate(to));
     }
 
     @Path("trips")
     @GET
-    @Produces(TEXT_CSV)
-    public Response getTripsCsv(
+    @Produces(XLSX)
+    public Response getTripsExcel(
             @QueryParam("deviceId") final List<Long> deviceIds, @QueryParam("groupId") final List<Long> groupIds,
-            @QueryParam("from") String from, @QueryParam("to") String to) throws SQLException {
-        return Response.ok(Trips.getCsv(getUserId(), deviceIds, groupIds,
-                JsonConverter.parseDate(from), JsonConverter.parseDate(to)))
-                .header(HttpHeaders.CONTENT_DISPOSITION, CONTENT_DISPOSITION_VALUE)
-                .build();
+            @QueryParam("from") String from, @QueryParam("to") String to) throws SQLException, IOException {
+        ByteArrayOutputStream stream = new ByteArrayOutputStream();
+        Trips.getExcel(stream, getUserId(), deviceIds, groupIds,
+                DateUtil.parseDateTime(from), DateUtil.parseDateTime(to));
+
+        return Response.ok(stream.toByteArray())
+                .header(HttpHeaders.CONTENT_DISPOSITION, CONTENT_DISPOSITION_VALUE_XLSX).build();
     }
 
 }
diff --git a/src/org/traccar/api/resource/ServerResource.java b/src/org/traccar/api/resource/ServerResource.java
index 0ca0d62aa..034a5c492 100644
--- a/src/org/traccar/api/resource/ServerResource.java
+++ b/src/org/traccar/api/resource/ServerResource.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2015 Anton Tananaev (anton.tananaev@gmail.com)
+ * Copyright 2015 Anton Tananaev (anton@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/src/org/traccar/api/resource/SessionResource.java b/src/org/traccar/api/resource/SessionResource.java
index deed70b37..5f1c597d1 100644
--- a/src/org/traccar/api/resource/SessionResource.java
+++ b/src/org/traccar/api/resource/SessionResource.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2015 Anton Tananaev (anton.tananaev@gmail.com)
+ * Copyright 2015 Anton Tananaev (anton@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -29,6 +29,7 @@ import javax.ws.rs.GET;
 import javax.ws.rs.POST;
 import javax.ws.rs.Path;
 import javax.ws.rs.Produces;
+import javax.ws.rs.QueryParam;
 import javax.ws.rs.WebApplicationException;
 import javax.ws.rs.core.MediaType;
 import javax.ws.rs.core.Response;
@@ -48,7 +49,7 @@ public class SessionResource extends BaseResource {
 
     @PermitAll
     @GET
-    public User get() throws SQLException {
+    public User get(@QueryParam("token") String token) throws SQLException {
         Long userId = (Long) request.getSession().getAttribute(USER_ID_KEY);
         if (userId == null) {
             Cookie[] cookies = request.getCookies();
@@ -64,7 +65,13 @@ public class SessionResource extends BaseResource {
                 }
             }
             if (email != null && password != null) {
-                User user = Context.getDataManager().login(email, password);
+                User user = Context.getPermissionsManager().login(email, password);
+                if (user != null) {
+                    userId = user.getId();
+                    request.getSession().setAttribute(USER_ID_KEY, userId);
+                }
+            } else if (token != null) {
+                User user = Context.getPermissionsManager().getUserByToken(token);
                 if (user != null) {
                     userId = user.getId();
                     request.getSession().setAttribute(USER_ID_KEY, userId);
@@ -73,6 +80,7 @@ public class SessionResource extends BaseResource {
         }
 
         if (userId != null) {
+            Context.getPermissionsManager().checkUserEnabled(userId);
             return Context.getPermissionsManager().getUser(userId);
         } else {
             throw new WebApplicationException(Response.status(Response.Status.NOT_FOUND).build());
diff --git a/src/org/traccar/api/resource/StatisticsResource.java b/src/org/traccar/api/resource/StatisticsResource.java
new file mode 100644
index 000000000..e801d4ff3
--- /dev/null
+++ b/src/org/traccar/api/resource/StatisticsResource.java
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2016 Anton Tananaev (anton@traccar.org)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.traccar.api.resource;
+
+import org.traccar.Context;
+import org.traccar.api.BaseResource;
+import org.traccar.helper.DateUtil;
+import org.traccar.model.Statistics;
+
+import javax.ws.rs.Consumes;
+import javax.ws.rs.GET;
+import javax.ws.rs.Path;
+import javax.ws.rs.Produces;
+import javax.ws.rs.QueryParam;
+import javax.ws.rs.core.MediaType;
+import java.sql.SQLException;
+import java.util.Collection;
+
+@Path("statistics")
+@Produces(MediaType.APPLICATION_JSON)
+@Consumes(MediaType.APPLICATION_JSON)
+public class StatisticsResource extends BaseResource {
+
+    @GET
+    public Collection<Statistics> get(
+            @QueryParam("from") String from, @QueryParam("to") String to) throws SQLException {
+        Context.getPermissionsManager().checkAdmin(getUserId());
+        return Context.getDataManager().getStatistics(DateUtil.parseDate(from), DateUtil.parseDate(to));
+    }
+
+}
diff --git a/src/org/traccar/api/resource/UserResource.java b/src/org/traccar/api/resource/UserResource.java
index 2d187fe9d..678daac9b 100644
--- a/src/org/traccar/api/resource/UserResource.java
+++ b/src/org/traccar/api/resource/UserResource.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2015 - 2016 Anton Tananaev (anton.tananaev@gmail.com)
+ * Copyright 2015 - 2016 Anton Tananaev (anton@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -32,6 +32,7 @@ import javax.ws.rs.core.MediaType;
 import javax.ws.rs.core.Response;
 import java.sql.SQLException;
 import java.util.Collection;
+import java.util.Date;
 
 @Path("users")
 @Produces(MediaType.APPLICATION_JSON)
@@ -49,6 +50,13 @@ public class UserResource extends BaseResource {
     public Response add(User entity) throws SQLException {
         if (!Context.getPermissionsManager().isAdmin(getUserId())) {
             Context.getPermissionsManager().checkRegistration(getUserId());
+            Context.getPermissionsManager().checkUserUpdate(getUserId(), new User(), entity);
+            entity.setDeviceLimit(Context.getConfig().getInteger("users.defaultDeviceLimit"));
+            int expirationDays = Context.getConfig().getInteger("users.defaultExpirationDays");
+            if (expirationDays > 0) {
+                entity.setExpirationTime(
+                    new Date(System.currentTimeMillis() + (long) expirationDays * 24 * 3600 * 1000));
+            }
         }
         Context.getPermissionsManager().addUser(entity);
         if (Context.getNotificationManager() != null) {
@@ -59,12 +67,10 @@ public class UserResource extends BaseResource {
 
     @Path("{id}")
     @PUT
-    public Response update(@PathParam("id") long id, User entity) throws SQLException {
-        if (entity.getAdmin()) {
-            Context.getPermissionsManager().checkAdmin(getUserId());
-        } else {
-            Context.getPermissionsManager().checkUser(getUserId(), entity.getId());
-        }
+    public Response update(User entity) throws SQLException {
+        User before = Context.getPermissionsManager().getUser(entity.getId());
+        Context.getPermissionsManager().checkUser(getUserId(), entity.getId());
+        Context.getPermissionsManager().checkUserUpdate(getUserId(), before, entity);
         Context.getPermissionsManager().updateUser(entity);
         if (Context.getNotificationManager() != null) {
             Context.getNotificationManager().refresh();