1 files changed, 20 insertions, 8 deletions
diff --git a/src/main/java/org/traccar/api/resource/PositionResource.java b/src/main/java/org/traccar/api/resource/PositionResource.java
index 2c0724df8..099d97632 100644
--- a/src/main/java/org/traccar/api/resource/PositionResource.java
+++ b/src/main/java/org/traccar/api/resource/PositionResource.java
@@ -15,10 +15,12 @@
  */
 package org.traccar.api.resource;
 
-import org.traccar.Context;
 import org.traccar.api.BaseResource;
 import org.traccar.helper.model.PositionUtil;
+import org.traccar.model.BaseModel;
+import org.traccar.model.Device;
 import org.traccar.model.Position;
+import org.traccar.model.User;
 import org.traccar.model.UserRestrictions;
 import org.traccar.storage.StorageException;
 import org.traccar.storage.query.Columns;
@@ -35,6 +37,7 @@ import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Date;
 import java.util.List;
+import java.util.stream.Collectors;
 
 @Path("positions")
 @Produces(MediaType.APPLICATION_JSON)
@@ -47,18 +50,16 @@ public class PositionResource extends BaseResource {
             @QueryParam("from") Date from, @QueryParam("to") Date to)
             throws StorageException {
         if (!positionIds.isEmpty()) {
-            ArrayList<Position> positions = new ArrayList<>();
-            for (Long positionId : positionIds) {
+            var positions = new ArrayList<Position>();
+            for (long positionId : positionIds) {
                 Position position = storage.getObject(Position.class, new Request(
                         new Columns.All(), new Condition.Equals("id", "id", positionId)));
-                Context.getPermissionsManager().checkDevice(getUserId(), position.getDeviceId());
+                permissionsService.checkPermission(Device.class, getUserId(), position.getDeviceId());
                 positions.add(position);
             }
             return positions;
-        } else if (deviceId == 0) {
-            return Context.getDeviceManager().getInitialState(getUserId());
-        } else {
-            Context.getPermissionsManager().checkDevice(getUserId(), deviceId);
+        } else if (deviceId > 0) {
+            permissionsService.checkPermission(Device.class, getUserId(), deviceId);
             if (from != null && to != null) {
                 permissionsService.checkRestriction(getUserId(), UserRestrictions::getDisableReports);
                 return PositionUtil.getPositions(storage, deviceId, from, to);
@@ -66,6 +67,17 @@ public class PositionResource extends BaseResource {
                 return storage.getObjects(Position.class, new Request(
                         new Columns.All(), new Condition.LatestPositions(deviceId)));
             }
+        } else {
+            var devices = storage.getObjects(Device.class, new Request(
+                    new Columns.Include("id"),
+                    new Condition.Permission(User.class, getUserId(), Device.class)));
+            var deviceIds = devices.stream().map(BaseModel::getId).collect(Collectors.toUnmodifiableSet());
+
+            var positions = storage.getObjects(Position.class, new Request(
+                    new Columns.All(), new Condition.LatestPositions()));
+            return positions.stream()
+                    .filter(position -> deviceIds.contains(position.getDeviceId()))
+                    .collect(Collectors.toList());
         }
     }