From dc581fa06e74ed4ac6b6f7b0305ac2a9f9b6caee Mon Sep 17 00:00:00 2001
From: Piotr Gawron <piotr.gawron@uni.lu>
Date: Wed, 30 Nov 2016 17:56:14 +0100
Subject: [PATCH] additional rest methods

getElements
getReactions
getOverlays
---
 .../api/overlay/OverlayController.java        |  14 ++
 .../api/overlay/OverlayRestImpl.java          |  45 +++-
 .../api/project/ProjectController.java        |  17 ++
 .../api/project/ProjectRestImpl.java          | 164 ++++++++++++++
 .../services/impl/CommentService.java         | 201 +-----------------
 .../services/impl/LayoutService.java          |  65 ++++--
 .../mapviewer/services/impl/ModelService.java |  52 ++++-
 .../services/interfaces/ICommentService.java  |  23 --
 .../services/interfaces/ILayoutService.java   |  20 +-
 .../services/interfaces/IModelService.java    |   3 +-
 .../services/impl/CommentServiceTest.java     |  70 ------
 .../services/impl/LayoutServiceTest.java      |  32 +--
 .../services/impl/ProjectServiceTest.java     |  18 +-
 .../java/lcsb/mapviewer/bean/ExportBean.java  |   2 +-
 .../java/lcsb/mapviewer/bean/GalaxyBean.java  |   5 +-
 .../java/lcsb/mapviewer/bean/LayoutBean.java  |  15 +-
 .../java/lcsb/mapviewer/bean/MapBean.java     |   6 +-
 .../lcsb/mapviewer/bean/GalaxyBeanTest.java   |   7 +-
 18 files changed, 405 insertions(+), 354 deletions(-)

diff --git a/rest-api/src/main/java/lcsb/mapviewer/api/overlay/OverlayController.java b/rest-api/src/main/java/lcsb/mapviewer/api/overlay/OverlayController.java
index 951a544c14..2f0648325b 100644
--- a/rest-api/src/main/java/lcsb/mapviewer/api/overlay/OverlayController.java
+++ b/rest-api/src/main/java/lcsb/mapviewer/api/overlay/OverlayController.java
@@ -1,6 +1,7 @@
 package lcsb.mapviewer.api.overlay;
 
 import java.util.List;
+import java.util.Map;
 
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.MediaType;
@@ -27,6 +28,19 @@ public class OverlayController extends BaseController {
 		return overlayController.getOverlayList(token, projectId);
 	}
 
+	@RequestMapping(value = "/getOverlayById", method = { RequestMethod.GET, RequestMethod.POST }, produces = { MediaType.APPLICATION_JSON_VALUE })
+	public LayoutView getOverlayById(@RequestParam(value = "token") String token, @RequestParam(value = "projectId") String projectId, @RequestParam(value = "overlayId") String overlayId)
+			throws SecurityException, QueryException {
+		return overlayController.getOverlayById(token, projectId, overlayId);
+	}
+
+	@RequestMapping(value = "/getOverlayElements", method = { RequestMethod.GET, RequestMethod.POST }, produces = { MediaType.APPLICATION_JSON_VALUE })
+	public List<Map<String, Object>> getOverlayElements(@RequestParam(value = "token") String token, @RequestParam(value = "projectId") String projectId,
+			@RequestParam(value = "overlayId") String overlayId, @RequestParam(value = "columns", defaultValue = "") String columns)
+			throws SecurityException, QueryException {
+		return overlayController.getOverlayElements(token, projectId, Integer.valueOf(overlayId), columns);
+	}
+
 	/**
 	 * @return the overlayController
 	 * @see #overlayController
diff --git a/rest-api/src/main/java/lcsb/mapviewer/api/overlay/OverlayRestImpl.java b/rest-api/src/main/java/lcsb/mapviewer/api/overlay/OverlayRestImpl.java
index ad5c2cbdf3..d2638f89fe 100644
--- a/rest-api/src/main/java/lcsb/mapviewer/api/overlay/OverlayRestImpl.java
+++ b/rest-api/src/main/java/lcsb/mapviewer/api/overlay/OverlayRestImpl.java
@@ -1,16 +1,23 @@
 package lcsb.mapviewer.api.overlay;
 
+import java.util.ArrayList;
+import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
 
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.transaction.annotation.Transactional;
 
 import lcsb.mapviewer.api.QueryException;
+import lcsb.mapviewer.model.Project;
 import lcsb.mapviewer.model.map.model.Model;
 import lcsb.mapviewer.services.SecurityException;
 import lcsb.mapviewer.services.interfaces.ILayoutService;
 import lcsb.mapviewer.services.interfaces.IModelService;
 import lcsb.mapviewer.services.interfaces.IUserService;
+import lcsb.mapviewer.services.search.layout.LightLayoutAliasView;
+import lcsb.mapviewer.services.search.layout.LightLayoutReactionView;
+import lcsb.mapviewer.services.view.AuthenticationToken;
 import lcsb.mapviewer.services.view.LayoutView;
 
 @Transactional(value = "txManager")
@@ -26,7 +33,8 @@ public class OverlayRestImpl {
 	private ILayoutService layoutService;
 
 	public List<LayoutView> getOverlayList(String token, String projectId) throws SecurityException, QueryException {
-		Model model = modelService.getLastModelByProjectId(projectId);
+		AuthenticationToken authenticationToken = userService.getToken(token);
+		Model model = modelService.getLastModelByProjectId(projectId, authenticationToken);
 		if (model == null) {
 			throw new QueryException("Project with given id doesn't exist");
 		}
@@ -84,4 +92,39 @@ public class OverlayRestImpl {
 		this.modelService = modelService;
 	}
 
+	public List<Map<String, Object>> getOverlayElements(String token, String projectId, int overlayId, String columns) throws QueryException, SecurityException {
+		List<Map<String, Object>> result = new ArrayList<>();
+		AuthenticationToken authenticationToken = userService.getToken(token);
+
+		Model model = modelService.getLastModelByProjectId(projectId, authenticationToken);
+		if (model == null) {
+			throw new QueryException("Project with given id doesn't exist");
+		}
+		List<LightLayoutAliasView> speciesList = layoutService.getAliasesForLayout(model, overlayId, authenticationToken);
+		for (LightLayoutAliasView lightLayoutAliasView : speciesList) {
+			Map<String, Object> element = new HashMap<>();
+			element.put("type", "ALIAS");
+			element.put("overlayContent", lightLayoutAliasView);
+			result.add(element);
+		}
+
+		List<LightLayoutReactionView> reactions = layoutService.getReactionsForLayout(model, overlayId, authenticationToken);
+		for (LightLayoutReactionView lightLayoutAliasView : reactions) {
+			Map<String, Object> element = new HashMap<>();
+			element.put("type", "REACTION");
+			element.put("overlayContent", lightLayoutAliasView);
+			result.add(element);
+		}
+		return result;
+	}
+
+	public LayoutView getOverlayById(String token, String projectId, String overlayId) throws SecurityException, QueryException {
+		AuthenticationToken authenticationToken = userService.getToken(token);
+		Model model = modelService.getLastModelByProjectId(projectId, authenticationToken);
+		if (model == null) {
+			throw new QueryException("Project with given id doesn't exist");
+		}
+		return layoutService.getLayoutById(model, Integer.valueOf(overlayId), authenticationToken);
+	}
+
 }
diff --git a/rest-api/src/main/java/lcsb/mapviewer/api/project/ProjectController.java b/rest-api/src/main/java/lcsb/mapviewer/api/project/ProjectController.java
index b9bd9dcc00..d68310bbe4 100644
--- a/rest-api/src/main/java/lcsb/mapviewer/api/project/ProjectController.java
+++ b/rest-api/src/main/java/lcsb/mapviewer/api/project/ProjectController.java
@@ -1,5 +1,8 @@
 package lcsb.mapviewer.api.project;
 
+import java.util.List;
+import java.util.Map;
+
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.MediaType;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -9,6 +12,8 @@ import org.springframework.web.bind.annotation.RestController;
 
 import lcsb.mapviewer.api.BaseController;
 import lcsb.mapviewer.services.SecurityException;
+import lcsb.mapviewer.services.search.ElementView;
+import lcsb.mapviewer.services.search.data.LightAliasView;
 
 @RestController
 @RequestMapping("/project")
@@ -22,4 +27,16 @@ public class ProjectController extends BaseController {
 		return projectController.getMetaData(projectId, token);
 	}
 
+	@RequestMapping(value = "/getElements", method = { RequestMethod.GET, RequestMethod.POST }, produces = { MediaType.APPLICATION_JSON_VALUE })
+	public List<Map<String, Object>> getElements(@RequestParam(value = "projectId") String projectId, @RequestParam(value = "id", defaultValue = "") String id,
+			@RequestParam(value = "columns", defaultValue = "") String columns, @RequestParam(value = "token") String token) throws SecurityException {
+		return projectController.getElements(projectId, id, columns, token);
+	}
+
+	@RequestMapping(value = "/getReactions", method = { RequestMethod.GET, RequestMethod.POST }, produces = { MediaType.APPLICATION_JSON_VALUE })
+	public List<Map<String, Object>> getReactions(@RequestParam(value = "projectId") String projectId, @RequestParam(value = "id", defaultValue = "") String id,
+			@RequestParam(value = "columns", defaultValue = "") String columns, @RequestParam(value = "token") String token) throws SecurityException {
+		return projectController.getReactions(projectId, id, columns, token);
+	}
+
 }
\ No newline at end of file
diff --git a/rest-api/src/main/java/lcsb/mapviewer/api/project/ProjectRestImpl.java b/rest-api/src/main/java/lcsb/mapviewer/api/project/ProjectRestImpl.java
index 8691ef1ed4..f216787ea3 100644
--- a/rest-api/src/main/java/lcsb/mapviewer/api/project/ProjectRestImpl.java
+++ b/rest-api/src/main/java/lcsb/mapviewer/api/project/ProjectRestImpl.java
@@ -1,13 +1,27 @@
 package lcsb.mapviewer.api.project;
 
+import java.awt.geom.Rectangle2D;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.transaction.annotation.Transactional;
 import org.springframework.web.bind.annotation.RequestParam;
 
 import lcsb.mapviewer.model.Project;
+import lcsb.mapviewer.model.map.model.Model;
+import lcsb.mapviewer.model.map.reaction.Reaction;
+import lcsb.mapviewer.model.map.species.Element;
 import lcsb.mapviewer.services.SecurityException;
+import lcsb.mapviewer.services.UserAccessException;
+import lcsb.mapviewer.services.interfaces.IModelService;
 import lcsb.mapviewer.services.interfaces.IProjectService;
 import lcsb.mapviewer.services.interfaces.IUserService;
+import lcsb.mapviewer.services.search.data.LightReactionView;
 
 @Transactional(value = "txManager")
 public class ProjectRestImpl {
@@ -18,6 +32,9 @@ public class ProjectRestImpl {
 	@Autowired
 	private IProjectService	projectService;
 
+	@Autowired
+	private IModelService		modelService;
+
 	public ProjectMetaData getMetaData(@RequestParam(value = "projectId") String projectId, @RequestParam(value = "token") String token)
 			throws SecurityException {
 
@@ -43,4 +60,151 @@ public class ProjectRestImpl {
 		this.userService = userService;
 	}
 
+	public List<Map<String, Object>> getElements(String projectId, String id, String columns, String token) throws UserAccessException, SecurityException {
+		Model model = modelService.getLastModelByProjectId(projectId, userService.getToken(token));
+		Set<Integer> ids = new HashSet<>();
+		if (!id.equals("")) {
+			for (String str : id.split(",")) {
+				ids.add(Integer.valueOf(str));
+			}
+		}
+		Set<String> columnsSet = createElementColumnSet(columns);
+
+		List<Map<String, Object>> result = new ArrayList<>();
+
+		List<Model> models = new ArrayList<>();
+		models.addAll(model.getSubmodels());
+		models.add(model);
+		for (Model model2 : models) {
+			for (Element element : model2.getElements()) {
+				if (ids.size() == 0 || ids.contains(element.getId())) {
+					result.add(preparedElement(element, columnsSet));
+				}
+			}
+		}
+
+		return result;
+	}
+
+	public List<Map<String, Object>> getReactions(String projectId, String id, String columns, String token) throws UserAccessException, SecurityException {
+		Model model = modelService.getLastModelByProjectId(projectId, userService.getToken(token));
+		Set<Integer> ids = new HashSet<>();
+		if (!id.equals("")) {
+			for (String str : id.split(",")) {
+				ids.add(Integer.valueOf(str));
+			}
+		}
+		Set<String> columnsSet = createReactionColumnSet(columns);
+
+		List<Map<String, Object>> result = new ArrayList<>();
+
+		List<Model> models = new ArrayList<>();
+		models.addAll(model.getSubmodels());
+		models.add(model);
+		for (Model model2 : models) {
+			for (Reaction reaction : model2.getReactions()) {
+				if (ids.size() == 0 || ids.contains(reaction.getId())) {
+					result.add(preparedReaction(reaction, columnsSet));
+				}
+			}
+		}
+
+		return result;
+	}
+
+	private Map<String, Object> preparedReaction(Reaction reaction, Set<String> columnsSet) {
+		Map<String, Object> result = new HashMap<>();
+		for (String string : columnsSet) {
+			String column = string.toLowerCase();
+			Object value = null;
+			if (column.equals("id") || column.equals("idObject")) {
+				value = reaction.getId();
+			} else if (column.equals("modelid")) {
+				value = reaction.getModelData().getId();
+			} else if (column.equals("name")) {
+				value = reaction.getName();
+			} else if (column.equals("centerPoint")) {
+				value = reaction.getCenterPoint();
+			} else if (column.equals("type")) {
+				value = reaction.getStringType();
+			} else if (column.equals("lines")) {
+				value = new LightReactionView(reaction).getLines();
+			} else {
+				value = "Unknown column";
+			}
+			result.put(string, value);
+		}
+		return result;
+	}
+
+	private Map<String, Object> preparedElement(Element element, Set<String> columnsSet) {
+		Map<String, Object> result = new HashMap<>();
+		for (String string : columnsSet) {
+			String column = string.toLowerCase();
+			Object value = null;
+			if (column.equals("id") || column.equals("idObject")) {
+				value = element.getId();
+			} else if (column.equals("modelid")) {
+				value = element.getModelData().getId();
+			} else if (column.equals("name")) {
+				value = element.getName();
+			} else if (column.equals("type")) {
+				value = element.getStringType();
+			} else if (column.equals("bounds")) {
+				value = new Rectangle2D.Double(element.getX(), element.getY(), element.getWidth(), element.getHeight());
+			} else {
+				value = "Unknown column";
+			}
+			result.put(string, value);
+		}
+		return result;
+	}
+
+	private Set<String> createElementColumnSet(String columns) {
+		Set<String> columnsSet = new HashSet<>();
+		if (columns.equals("")) {
+			columnsSet.add("id");
+			columnsSet.add("modelId");
+			columnsSet.add("name");
+			columnsSet.add("type");
+		} else {
+			for (String str : columns.split(",")) {
+				columnsSet.add(str);
+			}
+		}
+		return columnsSet;
+	}
+
+	private Set<String> createReactionColumnSet(String columns) {
+		Set<String> columnsSet = new HashSet<>();
+		if (columns.equals("")) {
+			columnsSet.add("id");
+			columnsSet.add("modelId");
+			columnsSet.add("type");
+			columnsSet.add("lines");
+		} else {
+			for (String str : columns.split(",")) {
+				columnsSet.add(str);
+			}
+		}
+		return columnsSet;
+	}
+
+	/**
+	 * @return the modelService
+	 * @see #modelService
+	 */
+	public IModelService getModelService() {
+		return modelService;
+	}
+
+	/**
+	 * @param modelService
+	 *          the modelService to set
+	 * @see #modelService
+	 */
+	public void setModelService(IModelService modelService) {
+		this.modelService = modelService;
+	}
+
 }
diff --git a/service/src/main/java/lcsb/mapviewer/services/impl/CommentService.java b/service/src/main/java/lcsb/mapviewer/services/impl/CommentService.java
index 19400e3cc9..4e26e586b3 100644
--- a/service/src/main/java/lcsb/mapviewer/services/impl/CommentService.java
+++ b/service/src/main/java/lcsb/mapviewer/services/impl/CommentService.java
@@ -1,9 +1,6 @@
 package lcsb.mapviewer.services.impl;
 
 import java.awt.geom.Point2D;
-import java.io.UnsupportedEncodingException;
-import java.net.URLDecoder;
-import java.net.URLEncoder;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
@@ -19,13 +16,11 @@ import lcsb.mapviewer.common.ObjectUtils;
 import lcsb.mapviewer.common.Pair;
 import lcsb.mapviewer.common.exception.InvalidArgumentException;
 import lcsb.mapviewer.common.exception.InvalidClassException;
-import lcsb.mapviewer.common.exception.NotImplementedException;
 import lcsb.mapviewer.model.map.Comment;
 import lcsb.mapviewer.model.map.model.Model;
 import lcsb.mapviewer.model.map.model.ModelData;
 import lcsb.mapviewer.model.map.reaction.Reaction;
 import lcsb.mapviewer.model.map.species.Element;
-import lcsb.mapviewer.model.map.species.Species;
 import lcsb.mapviewer.model.user.User;
 import lcsb.mapviewer.persist.dao.map.CommentDao;
 import lcsb.mapviewer.services.interfaces.ICommentService;
@@ -57,79 +52,12 @@ public class CommentService implements ICommentService {
 	 * Max distance between two points on map for which two comments should be
 	 * considered as refereing to the same point.
 	 */
-	private static final double		COMMENT_POINT_DISTANCE_EPSILON					 = 0.02;
+	private static final double		COMMENT_POINT_DISTANCE_EPSILON = 0.02;
 
 	/**
 	 * Default class logger.
 	 */
-	private static Logger					logger																	 = Logger.getLogger(CommentService.class);
-
-	/**
-	 * Number of line with content in serialized comment.
-	 */
-	private static final int			COMMENT_SERIALIZATION_CONTENT_LINE			 = 0;
-
-	/**
-	 * Number of line with coordinates of the comment t in serialized comment.
-	 */
-	private static final int			COMMENT_SERIALIZATION_COORDINATES_LINE	 = 1;
-
-	/**
-	 * Number of line with email in serialized comment.
-	 */
-	private static final int			COMMENT_SERIALIZATION_EMAIL_LINE				 = 2;
-
-	/**
-	 * Number of line with project title in serialized comment.
-	 */
-	private static final int			COMMENT_SERIALIZATION_PROJECT_TITLE_LINE = 3;
-
-	/**
-	 * Number of line with user name in serialized comment.
-	 */
-	private static final int			COMMENT_SERIALIZATION_USER_NAME_LINE		 = 4;
-
-	/**
-	 * Number of line with reason of removing in serialized comment.
-	 */
-	private static final int			COMMENT_SERIALIZATION_REMOVE_REASON_LINE = 5;
-
-	/**
-	 * Number of line with identifier of the commented object in serialized
-	 * comment.
-	 */
-	private static final int			COMMENT_SERIALIZATION_IDENTIFIER_LINE		 = 6;
-
-	/**
-	 * Number of line with class type of the commented object in serialized
-	 * comment.
-	 */
-	private static final int			COMMENT_SERIALIZATION_CLASS_TYPE_LINE		 = 7;
-
-	/**
-	 * Number of line with user login in serialized comment.
-	 */
-	private static final int			COMMENT_SERIALIZATION_USER_LOGIN_LINE		 = 8;
-
-	/**
-	 * Number of line with pinned value in serialized comment.
-	 */
-	private static final int			COMMENT_SERIALIZATION_PINNED_LINE				 = 9;
-
-	/**
-	 * Number of line with deleted value in serialized comment.
-	 */
-	private static final int			COMMENT_SERIALIZATION_DELETED_LINE			 = 10;
-
-	/**
-	 * Encoding used for serialization/deserialization.
-	 */
-	private static final String		SERIALIZATION_ENCODING									 = "UTF-8";
-
-	/**
-	 * Field separator used in serialization.
-	 */
-	private String								fieldSeparatorInSerialization						 = "\t";
+	private static Logger					logger												 = Logger.getLogger(CommentService.class);
 
 	/**
 	 * Data access object fir comments.
@@ -270,131 +198,6 @@ public class CommentService implements ICommentService {
 		return commentDao.getCount();
 	}
 
-	@Override
-	public String createCustomSerializationOfComment(Comment comment) {
-		Model model = comment.getModelData().getModel();
-		String result = "";
-		try {
-			result += URLEncoder.encode(comment.getContent(), SERIALIZATION_ENCODING) + fieldSeparatorInSerialization;
-			result += URLEncoder.encode(comment.getCoordinates().getX() + "," + comment.getCoordinates().getY(), SERIALIZATION_ENCODING)
-					+ fieldSeparatorInSerialization;
-			result += URLEncoder.encode(comment.getEmail(), SERIALIZATION_ENCODING) + fieldSeparatorInSerialization;
-			result += URLEncoder.encode(comment.getModelData().getProject().getProjectId() + "," + comment.getModelData().getMapVersion(), SERIALIZATION_ENCODING)
-					+ fieldSeparatorInSerialization;
-			result += URLEncoder.encode(comment.getName(), SERIALIZATION_ENCODING) + fieldSeparatorInSerialization;
-			result += URLEncoder.encode(comment.getRemoveReason(), SERIALIZATION_ENCODING) + fieldSeparatorInSerialization;
-
-			String identifier = "";
-			if (comment.getTableName() != null) {
-				if (comment.getTableName().getName().contains("Reaction")) {
-					Reaction reaction = model.getReactionByDbId(comment.getTableId());
-					if (reaction != null) {
-						identifier = reaction.getIdReaction();
-					} else {
-						logger.warn("Invalid reaction dbID: " + comment.getTableId() + ". Table: " + comment.getTableName().getName());
-					}
-				} else {
-					Element alias = model.getElementByDbId(comment.getTableId());
-					if (alias != null) {
-						identifier = ((Species) alias).getElementId();
-					} else {
-						logger.warn("Invalid alias dbID: " + comment.getTableId());
-					}
-				}
-			}
-			result += URLEncoder.encode(identifier, SERIALIZATION_ENCODING) + fieldSeparatorInSerialization;
-			if (comment.getTableName() == null) {
-				result += URLEncoder.encode("", SERIALIZATION_ENCODING) + fieldSeparatorInSerialization;
-			} else {
-				result += URLEncoder.encode(comment.getTableName().getCanonicalName(), SERIALIZATION_ENCODING) + fieldSeparatorInSerialization;
-			}
-			if (comment.getUser() == null) {
-				result += URLEncoder.encode("", SERIALIZATION_ENCODING) + fieldSeparatorInSerialization;
-			} else {
-				result += URLEncoder.encode(comment.getUser().getLogin(), SERIALIZATION_ENCODING) + fieldSeparatorInSerialization;
-			}
-			if (comment.isPinned()) {
-				result += URLEncoder.encode("true", SERIALIZATION_ENCODING) + fieldSeparatorInSerialization;
-			} else {
-				result += URLEncoder.encode("false", SERIALIZATION_ENCODING) + fieldSeparatorInSerialization;
-			}
-
-			if (comment.isDeleted()) {
-				result += URLEncoder.encode("true", SERIALIZATION_ENCODING) + fieldSeparatorInSerialization;
-			} else {
-				result += URLEncoder.encode("false", SERIALIZATION_ENCODING) + fieldSeparatorInSerialization;
-			}
-
-			result += "eof" + fieldSeparatorInSerialization;
-		} catch (UnsupportedEncodingException e) {
-			logger.error("UnsupportedEncodingException: " + SERIALIZATION_ENCODING);
-		}
-		return result;
-	}
-
-	@Override
-	public Comment deserializeCustomSerializationOfComment(String serializedComment) {
-		Comment result = new Comment();
-		String[] lines = serializedComment.split(fieldSeparatorInSerialization);
-		try {
-			result.setContent(URLDecoder.decode(lines[COMMENT_SERIALIZATION_CONTENT_LINE], SERIALIZATION_ENCODING));
-			String[] params = URLDecoder.decode(lines[COMMENT_SERIALIZATION_COORDINATES_LINE], SERIALIZATION_ENCODING).split(",");
-			String xStr = params[0];
-			String yStr = params[1];
-			double x = Double.parseDouble(xStr);
-			double y = Double.parseDouble(yStr);
-			result.setCoordinates(new Point2D.Double(x, y));
-			result.setEmail(URLDecoder.decode(lines[COMMENT_SERIALIZATION_EMAIL_LINE], SERIALIZATION_ENCODING));
-			String projectName = URLDecoder.decode(lines[COMMENT_SERIALIZATION_PROJECT_TITLE_LINE], SERIALIZATION_ENCODING).split(",")[0];
-			String mapVersion = URLDecoder.decode(lines[COMMENT_SERIALIZATION_PROJECT_TITLE_LINE], SERIALIZATION_ENCODING).split(",")[1];
-			Model model = (Model) modelService.getLastModelByProjectId(projectName);
-			if (model != null) {
-				if (model.getMapVersion().equals(mapVersion)) {
-					result.setModel(model);
-				} else {
-					throw new NotImplementedException();
-				}
-			} else {
-				throw new InvalidArgumentException("Unknown project: " + projectName);
-			}
-			result.setName(URLDecoder.decode(lines[COMMENT_SERIALIZATION_USER_NAME_LINE], SERIALIZATION_ENCODING));
-			result.setRemoveReason(URLDecoder.decode(lines[COMMENT_SERIALIZATION_REMOVE_REASON_LINE], SERIALIZATION_ENCODING));
-			String id = URLDecoder.decode(lines[COMMENT_SERIALIZATION_IDENTIFIER_LINE], SERIALIZATION_ENCODING);
-			if (id.startsWith("re")) {
-				Reaction reaction = model.getReactionByReactionId(id);
-				if (reaction == null) {
-					logger.error("Unknown reaction: " + id);
-				} else {
-					Integer dbId = model.getReactionByReactionId(id).getId();
-					result.setTableId(dbId);
-				}
-			} else if (id.startsWith("sa")) {
-				Integer dbId = model.getElementByElementId(id).getId();
-				result.setTableId(dbId);
-			}
-			String className = URLDecoder.decode(lines[COMMENT_SERIALIZATION_CLASS_TYPE_LINE], SERIALIZATION_ENCODING);
-			if (className != null && !className.equals("")) {
-				try {
-					Class<?> clazz = Class.forName(className);
-					result.setTableName(clazz);
-				} catch (ClassNotFoundException e) {
-					logger.error("Class not found: " + className);
-				}
-			}
-			String login = URLDecoder.decode(lines[COMMENT_SERIALIZATION_USER_LOGIN_LINE], SERIALIZATION_ENCODING);
-			if (login == null || login.equals("null")) {
-				User user = userService.getUserByLogin(login);
-				result.setUser(user);
-			}
-			result.setPinned(URLDecoder.decode(lines[COMMENT_SERIALIZATION_PINNED_LINE], SERIALIZATION_ENCODING).equalsIgnoreCase("true"));
-			result.setDeleted(URLDecoder.decode(lines[COMMENT_SERIALIZATION_DELETED_LINE], SERIALIZATION_ENCODING).equalsIgnoreCase("true"));
-
-		} catch (UnsupportedEncodingException e) {
-			logger.error("UnsupportedEncodingException: " + SERIALIZATION_ENCODING);
-		}
-		return result;
-	}
-
 	@Override
 	public void removeCommentsForModel(Model model) {
 		List<Comment> comments = commentDao.getCommentByModel(model, null, null);
diff --git a/service/src/main/java/lcsb/mapviewer/services/impl/LayoutService.java b/service/src/main/java/lcsb/mapviewer/services/impl/LayoutService.java
index a9133ea39f..8bd55947eb 100644
--- a/service/src/main/java/lcsb/mapviewer/services/impl/LayoutService.java
+++ b/service/src/main/java/lcsb/mapviewer/services/impl/LayoutService.java
@@ -67,7 +67,7 @@ import lcsb.mapviewer.services.search.layout.LightLayoutReactionViewFactory;
 import lcsb.mapviewer.services.utils.ColorSchemaReader;
 import lcsb.mapviewer.services.utils.EmailSender;
 import lcsb.mapviewer.services.utils.data.ColorSchemaColumn;
-import lcsb.mapviewer.services.view.ConfigurationView;
+import lcsb.mapviewer.services.view.AuthenticationToken;
 import lcsb.mapviewer.services.view.LayoutView;
 import lcsb.mapviewer.services.view.LayoutViewFactory;
 
@@ -176,9 +176,7 @@ public class LayoutService implements ILayoutService {
 		List<Layout> layouts = layoutDao.getLayoutsByModel(model);
 		for (Layout layout : layouts) {
 			if (!layout.isPublicLayout() && layout.getCreator() != null) {
-				if (layout.getCreator().getLogin().equals(user.getLogin())) {
-					result.add(layoutViewFactory.create(layout));
-				} else if (userService.userHasPrivilege(user, PrivilegeType.LAYOUT_VIEW, layout)) {
+				if (userCanViewOverlay(layout, user)) {
 					result.add(layoutViewFactory.create(layout));
 				}
 			}
@@ -187,6 +185,23 @@ public class LayoutService implements ILayoutService {
 		return result;
 	}
 
+	private boolean userCanViewOverlay(Layout overlay, User user) {
+		if (overlay.isPublicLayout()) {
+			return true;
+		}
+		if (overlay.getCreator() == null) {
+			return true;
+		}
+		if (overlay.getCreator().getLogin().equals(user.getLogin())) {
+			return true;
+		}
+
+		if (userService.userHasPrivilege(user, PrivilegeType.LAYOUT_VIEW, overlay)) {
+			return true;
+		}
+		return false;
+	}
+
 	@Override
 	public List<LayoutView> getGeneralLayouts(Model model) {
 		List<LayoutView> result = new ArrayList<LayoutView>();
@@ -872,8 +887,8 @@ public class LayoutService implements ILayoutService {
 	}
 
 	@Override
-	public byte[] getInputDataForLayout(LayoutView layoutView) {
-		return getInputDataForLayout(layoutView.getIdObject());
+	public byte[] getInputDataForLayout(LayoutView layoutView, AuthenticationToken token) throws SecurityException {
+		return getInputDataForLayout(layoutView.getIdObject(), token);
 	}
 
 	/**
@@ -885,9 +900,14 @@ public class LayoutService implements ILayoutService {
 	 *          data
 	 * @return original data file for given layout, if such file is not stored in
 	 *         database (compatibility reasons) then null is returned
+	 * @throws SecurityException
 	 */
-	private byte[] getInputDataForLayout(int layoutId) {
+	private byte[] getInputDataForLayout(int layoutId, AuthenticationToken token) throws SecurityException {
 		Layout layout = layoutDao.getById(layoutId);
+		User user = userService.getUserByToken(token);
+		if (!userCanViewOverlay(layout, user)) {
+			throw new SecurityException("User doesn't have access to overlay");
+		}
 		if (layout == null) {
 			return null;
 		} else {
@@ -900,10 +920,10 @@ public class LayoutService implements ILayoutService {
 	}
 
 	@Override
-	public List<LightLayoutAliasView> getAliasesForLayout(Model model, int layoutId) {
+	public List<LightLayoutAliasView> getAliasesForLayout(Model model, int layoutId, AuthenticationToken token) throws SecurityException {
 		try {
 			ColorSchemaReader reader = new ColorSchemaReader();
-			Collection<ColorSchema> schemas = reader.readColorSchema(getInputDataForLayout(layoutId));
+			Collection<ColorSchema> schemas = reader.readColorSchema(getInputDataForLayout(layoutId, token));
 			// colors here are not important
 			ColorModelCommand command = new ColorModelCommand(model, schemas, new ColorExtractor(Color.BLACK, Color.BLACK));
 			LightLayoutAliasViewFactory factory = new LightLayoutAliasViewFactory();
@@ -922,10 +942,10 @@ public class LayoutService implements ILayoutService {
 	}
 
 	@Override
-	public List<LightLayoutReactionView> getReactionsForLayout(Model model, int layoutId) {
+	public List<LightLayoutReactionView> getReactionsForLayout(Model model, int layoutId, AuthenticationToken token) throws SecurityException {
 		try {
 			ColorSchemaReader reader = new ColorSchemaReader();
-			Collection<ColorSchema> schemas = reader.readColorSchema(getInputDataForLayout(layoutId));
+			Collection<ColorSchema> schemas = reader.readColorSchema(getInputDataForLayout(layoutId, token));
 			// colors here are not important
 			ColorModelCommand command = new ColorModelCommand(model, schemas, new ColorExtractor(Color.BLACK, Color.BLACK));
 			LightLayoutReactionViewFactory factory = new LightLayoutReactionViewFactory();
@@ -944,11 +964,11 @@ public class LayoutService implements ILayoutService {
 	}
 
 	@Override
-	public Map<Object, ColorSchema> getElementsForLayout(Model model, Integer layoutId) {
+	public Map<Object, ColorSchema> getElementsForLayout(Model model, Integer layoutId, AuthenticationToken token) throws SecurityException {
 		try {
 			ColorSchemaReader reader = new ColorSchemaReader();
 			Collection<ColorSchema> schemas;
-			schemas = reader.readColorSchema(getInputDataForLayout(layoutId));
+			schemas = reader.readColorSchema(getInputDataForLayout(layoutId, token));
 			// colors here are not important
 			ColorModelCommand command = new ColorModelCommand(model, schemas, new ColorExtractor(Color.BLACK, Color.BLACK));
 			return command.getModifiedElements();
@@ -960,7 +980,8 @@ public class LayoutService implements ILayoutService {
 	}
 
 	@Override
-	public List<FullLayoutAliasView> getFullAliasesForLayoutByIds(Model model, List<Pair<Integer, Integer>> identifiers, int layoutId) {
+	public List<FullLayoutAliasView> getFullAliasesForLayoutByIds(Model model, List<Pair<Integer, Integer>> identifiers, int layoutId, AuthenticationToken token)
+			throws SecurityException {
 		try {
 			Set<Integer> ids = new HashSet<>();
 			for (Pair<Integer, Integer> pair : identifiers) {
@@ -969,7 +990,7 @@ public class LayoutService implements ILayoutService {
 
 			ColorSchemaReader reader = new ColorSchemaReader();
 			Collection<ColorSchema> schemas;
-			schemas = reader.readColorSchema(getInputDataForLayout(layoutId));
+			schemas = reader.readColorSchema(getInputDataForLayout(layoutId, token));
 			// colors here are not important
 			ColorModelCommand command = new ColorModelCommand(model, schemas, new ColorExtractor(Color.BLACK, Color.BLACK));
 			FullLayoutAliasViewFactory factory = new FullLayoutAliasViewFactory();
@@ -1006,4 +1027,18 @@ public class LayoutService implements ILayoutService {
 	public List<LayoutView> getCustomLayouts(Model model, String token) throws SecurityException {
 		return this.getCustomLayouts(model, userService.getUserByToken(token));
 	}
+
+	@Override
+	public LayoutView getLayoutById(Model model, int overlayId, AuthenticationToken token) throws SecurityException {
+		User user = userService.getUserByToken(token);
+		Layout layout = layoutDao.getById(overlayId);
+		if (!layout.isPublicLayout() && layout.getCreator() != null) {
+			if (userCanViewOverlay(layout, user)) {
+				return layoutViewFactory.create(layout);
+			} else {
+				throw new SecurityException("User doesn't have access to the overlay");
+			}
+		}
+		return layoutViewFactory.create(layout);
+	}
 }
diff --git a/service/src/main/java/lcsb/mapviewer/services/impl/ModelService.java b/service/src/main/java/lcsb/mapviewer/services/impl/ModelService.java
index 65b0ce3877..190a4fdd5a 100644
--- a/service/src/main/java/lcsb/mapviewer/services/impl/ModelService.java
+++ b/service/src/main/java/lcsb/mapviewer/services/impl/ModelService.java
@@ -31,15 +31,19 @@ import lcsb.mapviewer.model.map.model.ModelData;
 import lcsb.mapviewer.model.map.model.ModelFullIndexed;
 import lcsb.mapviewer.model.map.reaction.Reaction;
 import lcsb.mapviewer.model.map.species.Element;
+import lcsb.mapviewer.model.user.PrivilegeType;
 import lcsb.mapviewer.model.user.User;
+import lcsb.mapviewer.persist.dao.ProjectDao;
 import lcsb.mapviewer.persist.dao.map.ModelDao;
 import lcsb.mapviewer.services.interfaces.ILayoutService;
 import lcsb.mapviewer.services.interfaces.IModelService;
+import lcsb.mapviewer.services.interfaces.IUserService;
 import lcsb.mapviewer.services.search.data.FullAliasView;
 import lcsb.mapviewer.services.search.data.FullAliasViewFactory;
 import lcsb.mapviewer.services.search.data.LightAliasView;
 import lcsb.mapviewer.services.search.data.LightAliasViewFactory;
 import lcsb.mapviewer.services.search.data.LightReactionView;
+import lcsb.mapviewer.services.view.AuthenticationToken;
 import lcsb.mapviewer.services.view.LayoutView;
 import lcsb.mapviewer.services.view.ModelView;
 import lcsb.mapviewer.services.view.ModelViewFactory;
@@ -69,12 +73,21 @@ public class ModelService implements IModelService {
 	 */
 	private static Set<String>				modelsInLoadStage	= new HashSet<>();
 
+	/**
+	 * Service that manages and gives access to user information.
+	 */
+	@Autowired
+	private IUserService							userService;
+
 	/**
 	 * Data access object for models.
 	 */
 	@Autowired
 	private ModelDao									modelDao;
 
+	@Autowired
+	private ProjectDao								projectDao;
+
 	/**
 	 * Object allowing access to the mesh database.
 	 */
@@ -118,7 +131,7 @@ public class ModelService implements IModelService {
 	private TaxonomyBackend						taxonomyBackend;
 
 	@Override
-	public Model getLastModelByProjectId(String projectName) {
+	public Model getLastModelByProjectId(String projectName, AuthenticationToken token) {
 		if (projectName == null) {
 			return null;
 		}
@@ -171,6 +184,9 @@ public class ModelService implements IModelService {
 				}
 			}
 		}
+		if (!userService.userHasPrivilege(token, PrivilegeType.VIEW_PROJECT, model.getProject())) {
+			throw new SecurityException("User doesn't have access to project");
+		}
 		return model;
 	}
 
@@ -513,4 +529,38 @@ public class ModelService implements IModelService {
 		return result;
 	}
 
+	/**
+	 * @return the userService
+	 * @see #userService
+	 */
+	public IUserService getUserService() {
+		return userService;
+	}
+
+	/**
+	 * @param userService
+	 *          the userService to set
+	 * @see #userService
+	 */
+	public void setUserService(IUserService userService) {
+		this.userService = userService;
+	}
+
+	/**
+	 * @return the projectDao
+	 * @see #projectDao
+	 */
+	public ProjectDao getProjectDao() {
+		return projectDao;
+	}
+
+	/**
+	 * @param projectDao
+	 *          the projectDao to set
+	 * @see #projectDao
+	 */
+	public void setProjectDao(ProjectDao projectDao) {
+		this.projectDao = projectDao;
+	}
+
 }
diff --git a/service/src/main/java/lcsb/mapviewer/services/interfaces/ICommentService.java b/service/src/main/java/lcsb/mapviewer/services/interfaces/ICommentService.java
index 7e916fc60e..5a693b923e 100644
--- a/service/src/main/java/lcsb/mapviewer/services/interfaces/ICommentService.java
+++ b/service/src/main/java/lcsb/mapviewer/services/interfaces/ICommentService.java
@@ -73,29 +73,6 @@ public interface ICommentService {
 	 */
 	long getCommentCount();
 
-	/**
-	 * 
-	 * Sometimes we have to dump all coments from the model without information
-	 * about primary keys in the database. This method is responsible for this
-	 * task (it changes all PK into identifiers used by external source).
-	 * 
-	 * @param comment
-	 *          comment to serialize
-	 * @return serialized string of the comment
-	 */
-	String createCustomSerializationOfComment(Comment comment);
-
-	/**
-	 * Method used for deserialization of comment. Serialized object doesn't have
-	 * information about primary/foreign keys (only identifiers from external
-	 * sources) - this information must be restored from DB.
-	 * 
-	 * @param serializedComment
-	 *          serialized comment
-	 * @return Comment after deserialization
-	 */
-	Comment deserializeCustomSerializationOfComment(String serializedComment);
-
 	/**
 	 * Removes comments from the model.
 	 * 
diff --git a/service/src/main/java/lcsb/mapviewer/services/interfaces/ILayoutService.java b/service/src/main/java/lcsb/mapviewer/services/interfaces/ILayoutService.java
index 4ba5e2c952..f93121cc18 100644
--- a/service/src/main/java/lcsb/mapviewer/services/interfaces/ILayoutService.java
+++ b/service/src/main/java/lcsb/mapviewer/services/interfaces/ILayoutService.java
@@ -19,7 +19,7 @@ import lcsb.mapviewer.services.search.layout.LightLayoutAliasView;
 import lcsb.mapviewer.services.search.layout.LightLayoutReactionView;
 import lcsb.mapviewer.services.utils.EmailSender;
 import lcsb.mapviewer.services.utils.data.ColorSchemaType;
-import lcsb.mapviewer.services.view.ConfigurationView;
+import lcsb.mapviewer.services.view.AuthenticationToken;
 import lcsb.mapviewer.services.view.LayoutView;
 
 /**
@@ -430,8 +430,9 @@ public interface ILayoutService {
 	 *          layout for which we want to retrieve original file data
 	 * @return original data file for given layout, if such file is not stored in
 	 *         database (compatibility reasons) then null is returned
+	 * @throws SecurityException
 	 */
-	byte[] getInputDataForLayout(LayoutView layout);
+	byte[] getInputDataForLayout(LayoutView layout, AuthenticationToken token) throws SecurityException;
 
 	/**
 	 * Returns a list of {@link LightLayoutAliasView aliases} that are visualized
@@ -443,8 +444,9 @@ public interface ILayoutService {
 	 *          identifier of the layout
 	 * @return a list of {@link LightLayoutAliasView aliases} that are visualized
 	 *         in a {@link lcsb.mapviewer.model.map.layout.Layout}
+	 * @throws SecurityException
 	 */
-	List<LightLayoutAliasView> getAliasesForLayout(Model model, int layoutId);
+	List<LightLayoutAliasView> getAliasesForLayout(Model model, int layoutId, AuthenticationToken token) throws SecurityException;
 
 	/**
 	 * Returns a list of {@link LightLayoutReactionView reactions} that are
@@ -456,8 +458,9 @@ public interface ILayoutService {
 	 *          identifier of the layout
 	 * @return a list of {@link LightLayoutReactionView reactions} that are
 	 *         visualized in a {@link lcsb.mapviewer.model.map.layout.Layout}
+	 * @throws SecurityException
 	 */
-	List<LightLayoutReactionView> getReactionsForLayout(Model model, int layoutId);
+	List<LightLayoutReactionView> getReactionsForLayout(Model model, int layoutId, AuthenticationToken token) throws SecurityException;
 
 	/**
 	 * Returns mapping between {@link lcsb.mapviewer.model.map.species.Element
@@ -471,8 +474,9 @@ public interface ILayoutService {
 	 *          identifier of the layout
 	 * @return a list of {@link LightLayoutReactionView reactions} that are
 	 *         visualized in a {@link lcsb.mapviewer.model.map.layout.Layout}
+	 * @throws SecurityException
 	 */
-	Map<Object, ColorSchema> getElementsForLayout(Model model, Integer layoutId);
+	Map<Object, ColorSchema> getElementsForLayout(Model model, Integer layoutId, AuthenticationToken token) throws SecurityException;
 
 	/**
 	 * Returns a list of {@link FullLayoutAliasView aliases} that are visualized
@@ -491,8 +495,10 @@ public interface ILayoutService {
 	 *          identifier} (in {@link Pair#right}).
 	 * @return a list of {@link LightLayoutAliasView aliases} that are visualized
 	 *         in a {@link lcsb.mapviewer.model.map.layout.Layout}
+	 * @throws SecurityException
 	 */
-	List<FullLayoutAliasView> getFullAliasesForLayoutByIds(Model model, List<Pair<Integer, Integer>> identifiers, int layoutId);
+	List<FullLayoutAliasView> getFullAliasesForLayoutByIds(Model model, List<Pair<Integer, Integer>> identifiers, int layoutId, AuthenticationToken token)
+			throws SecurityException;
 
 	/**
 	 * Returns {@link EmailSender} used by the service.
@@ -511,4 +517,6 @@ public interface ILayoutService {
 
 	List<LayoutView> getCustomLayouts(Model model, String token) throws SecurityException;
 
+	LayoutView getLayoutById(Model model, int overlayId, AuthenticationToken authenticationToken) throws SecurityException;
+
 }
diff --git a/service/src/main/java/lcsb/mapviewer/services/interfaces/IModelService.java b/service/src/main/java/lcsb/mapviewer/services/interfaces/IModelService.java
index 6dd73441b5..8c80125bac 100644
--- a/service/src/main/java/lcsb/mapviewer/services/interfaces/IModelService.java
+++ b/service/src/main/java/lcsb/mapviewer/services/interfaces/IModelService.java
@@ -10,6 +10,7 @@ import lcsb.mapviewer.model.user.User;
 import lcsb.mapviewer.services.search.data.FullAliasView;
 import lcsb.mapviewer.services.search.data.LightAliasView;
 import lcsb.mapviewer.services.search.data.LightReactionView;
+import lcsb.mapviewer.services.view.AuthenticationToken;
 import lcsb.mapviewer.services.view.ModelView;
 import lcsb.mapviewer.services.view.ProjectView;
 
@@ -29,7 +30,7 @@ public interface IModelService {
 	 *          {@link lcsb.mapviewer.model.Project#projectId project identifier}
 	 * @return the newest model for the project
 	 */
-	Model getLastModelByProjectId(String projectId);
+	Model getLastModelByProjectId(String projectId, AuthenticationToken token);
 
 	/**
 	 * Caches information about all pubmed articles for the given model.
diff --git a/service/src/test/java/lcsb/mapviewer/services/impl/CommentServiceTest.java b/service/src/test/java/lcsb/mapviewer/services/impl/CommentServiceTest.java
index df6d60a4f6..f8dbf01337 100644
--- a/service/src/test/java/lcsb/mapviewer/services/impl/CommentServiceTest.java
+++ b/service/src/test/java/lcsb/mapviewer/services/impl/CommentServiceTest.java
@@ -185,76 +185,6 @@ public class CommentServiceTest extends ServiceTestFunctions {
 		}
 	}
 
-	@Test
-	public void testSerialization() throws Exception {
-		try {
-			commentService.addComment("John Doe", "a@a.pl", "Conteneta 1", model, new Point2D.Double(0, 1), alias, false, model);
-			commentService.addComment("John Doe", "a@a.pl", "Contenetb 2", model, new Point2D.Double(0, 2), alias, false, model);
-			commentService.addComment("John Doe", "a@a.pl", "Contenetc 3", model, new Point2D.Double(0, 3), alias2, false, model);
-			commentService.addComment("John Doe", "a@a.pl", "Contenetc 4", model, new Point2D.Double(0, 4), null, false, model);
-			commentService.addComment("John Doe", "a@a.pl", "Contenetc 5", model, new Point2D.Double(0, 5), null, true, model);
-
-			List<Comment> comments = commentDao.getCommentByModel(model, null, null);
-
-			for (Comment comment : comments) {
-				String serializedObject = commentService.createCustomSerializationOfComment(comment);
-				Comment comment2 = commentService.deserializeCustomSerializationOfComment(serializedObject);
-
-				assertTrue("Comparison of comments doesn't work.", areCommentsEqual(comment, comment));
-				assertTrue("Serialized comments are different.", areCommentsEqual(comment, comment2));
-
-				String serializedObject2 = commentService.createCustomSerializationOfComment(comment2);
-				assertEquals(serializedObject, serializedObject2);
-			}
-
-			for (Comment comment : comments) {
-				commentDao.delete(comment);
-			}
-
-		} catch (Exception e) {
-			e.printStackTrace();
-			throw e;
-		}
-	}
-
-	private boolean areCommentsEqual(Comment comment1, Comment comment2) {
-		boolean result = true;
-
-		if (comment1 == null)
-			return comment2 == null;
-		if (comment2 == null)
-			return false;
-		if (comment1.getContent() != null) {
-			result &= comment1.getContent().equals(comment2.getContent());
-		} else {
-			result &= (comment2.getContent() == null);
-		}
-		result &= comment1.getCoordinates().equals(comment2.getCoordinates());
-		result &= comment1.getEmail().equals(comment2.getEmail());
-		result &= comment1.getModelData().getMapVersion().equals(comment2.getModelData().getMapVersion());
-		result &= comment1.getName().equals(comment2.getName());
-		result &= comment1.getRemoveReason().equals(comment2.getRemoveReason());
-		if (comment1.getTableId() != null)
-			result &= comment1.getTableId().equals(comment2.getTableId());
-		else
-			result &= (comment2.getTableId() == null);
-		if (comment1.getTableName() == null)
-			result &= (comment2.getTableName() == null);
-		else
-			result &= comment1.getTableName().equals(comment2.getTableName());
-
-		if (comment1.getUser() == null) {
-			result &= (comment2.getUser() == null);
-		} else {
-			result &= comment1.getUser().getLogin().equals(comment2.getUser().getLogin());
-		}
-
-		result &= comment1.isPinned() == comment2.isPinned();
-		result &= comment1.isDeleted() == comment2.isDeleted();
-
-		return result;
-	}
-
 	@Test
 	public void testReactionComment() throws Exception {
 		try {
diff --git a/service/src/test/java/lcsb/mapviewer/services/impl/LayoutServiceTest.java b/service/src/test/java/lcsb/mapviewer/services/impl/LayoutServiceTest.java
index 2fdd6be5f2..d7f39c505b 100644
--- a/service/src/test/java/lcsb/mapviewer/services/impl/LayoutServiceTest.java
+++ b/service/src/test/java/lcsb/mapviewer/services/impl/LayoutServiceTest.java
@@ -44,29 +44,29 @@ import lcsb.mapviewer.services.view.AuthenticationToken;
 import lcsb.mapviewer.services.view.LayoutView;
 
 public class LayoutServiceTest extends ServiceTestFunctions {
-	Logger				 logger					= Logger.getLogger(LayoutServiceTest.class);
+	Logger							logger				 = Logger.getLogger(LayoutServiceTest.class);
 
-	Project				 project				= null;
-	Model					 model					= null;
+	Project							project				 = null;
+	Model								model					 = null;
 
-	String				 projectId			= "Some_id";
-	String				 clearProjectId	= "Some_id2";
+	String							projectId			 = "Some_id";
+	String							clearProjectId = "Some_id2";
 
 	@Autowired
-	LayoutDao			 layoutDao;
+	LayoutDao						layoutDao;
 
-	EmailSender		 originalSender;
+	EmailSender					originalSender;
 
 	@Autowired
-	ILayoutService layoutService;
+	ILayoutService			layoutService;
 
 	// assume that we have admin account with all the privileges
-	AuthenticationToken adminToken;
+	AuthenticationToken	adminToken;
 
 	@Before
 	public void setUp() throws Exception {
 		adminToken = userService.login("admin", "admin");
-		
+
 		logService.setLoggedUser(userService.getUserByLogin(Configuration.ANONYMOUS_LOGIN));
 
 		// we use custom threads because in layoutservice there is commit method
@@ -227,7 +227,7 @@ public class LayoutServiceTest extends ServiceTestFunctions {
 			assertEquals(0, layouts.size());
 
 			// null user shouldn't have acces to custom layouts
-			layouts = layoutService.getCustomLayouts(model, (User)null);
+			layouts = layoutService.getCustomLayouts(model, (User) null);
 			assertEquals(0, layouts.size());
 
 			layoutService.removeLayout(row, null);
@@ -433,10 +433,12 @@ public class LayoutServiceTest extends ServiceTestFunctions {
 
 			LayoutView row = layoutService.createLayout(params);
 
+			AuthenticationToken token = userService.login(user.getLogin(), "passwd");
+
 			assertNotNull(row);
 			assertNotNull(row.getIdObject());
 			assertTrue("true".equalsIgnoreCase(row.getInputDataAvailable()));
-			byte[] inputData = layoutService.getInputDataForLayout(row);
+			byte[] inputData = layoutService.getInputDataForLayout(row, token);
 			assertNotNull(inputData);
 			byte[] originalData = IOUtils.toByteArray(new FileInputStream("testFiles/enricoData/ge001.txt"));
 			assertEquals(new String(originalData, StandardCharsets.UTF_8), new String(inputData, StandardCharsets.UTF_8));
@@ -468,11 +470,13 @@ public class LayoutServiceTest extends ServiceTestFunctions {
 
 			LayoutView row = layoutService.createLayout(params);
 
-			List<LightLayoutAliasView> result = layoutService.getAliasesForLayout(model, row.getIdObject());
+			AuthenticationToken token = userService.login(user.getLogin(), "passwd");
+
+			List<LightLayoutAliasView> result = layoutService.getAliasesForLayout(model, row.getIdObject(), token);
 
 			assertTrue(result.size() > 0);
 
-			List<LightLayoutReactionView> result2 = layoutService.getReactionsForLayout(model, row.getIdObject());
+			List<LightLayoutReactionView> result2 = layoutService.getReactionsForLayout(model, row.getIdObject(), token);
 
 			assertEquals(1, result2.size());
 
diff --git a/service/src/test/java/lcsb/mapviewer/services/impl/ProjectServiceTest.java b/service/src/test/java/lcsb/mapviewer/services/impl/ProjectServiceTest.java
index fe60864e19..3014801953 100644
--- a/service/src/test/java/lcsb/mapviewer/services/impl/ProjectServiceTest.java
+++ b/service/src/test/java/lcsb/mapviewer/services/impl/ProjectServiceTest.java
@@ -260,7 +260,7 @@ public class ProjectServiceTest extends ServiceTestFunctions {
 			AuthenticationToken token = userService.login("gawi", "gawi");
 			Project project = projectService.getProjectByProjectId(projectId, token);
 
-			Model model = modelService.getLastModelByProjectId(projectId);
+			Model model = modelService.getLastModelByProjectId(projectId, token);
 			assertNotNull(model);
 			assertEquals("main", model.getName());
 			assertEquals(3, model.getSubmodelConnections().size());
@@ -654,7 +654,7 @@ public class ProjectServiceTest extends ServiceTestFunctions {
 			String filename = "testFiles/complexModel/complex_model_with_data_mining.zip";
 			Project project = createComplexProject(name, filename);
 
-			Model model = modelService.getLastModelByProjectId(name);
+			Model model = modelService.getLastModelByProjectId(name, adminToken);
 			assertNotNull(model);
 			assertEquals("main", model.getName());
 			assertEquals(ProjectStatus.DONE, project.getStatus());
@@ -709,7 +709,7 @@ public class ProjectServiceTest extends ServiceTestFunctions {
 			String filename = "testFiles/complexModel/complex_model_with_images.zip";
 			Project project = createComplexProject(name, filename);
 
-			Model model = modelService.getLastModelByProjectId(name);
+			Model model = modelService.getLastModelByProjectId(name, adminToken);
 			assertNotNull(model);
 			assertEquals("main", model.getName());
 			assertEquals(ProjectStatus.DONE, project.getStatus());
@@ -754,7 +754,7 @@ public class ProjectServiceTest extends ServiceTestFunctions {
 			AuthenticationToken token = userService.login("gawi", "gawi");
 			Project project = projectService.getProjectByProjectId(projectId, token);
 
-			Model model = modelService.getLastModelByProjectId(name);
+			Model model = modelService.getLastModelByProjectId(name, adminToken);
 			assertNotNull(model);
 			assertEquals("main", model.getName());
 			assertEquals(ProjectStatus.DONE, project.getStatus());
@@ -776,7 +776,7 @@ public class ProjectServiceTest extends ServiceTestFunctions {
 			String filename = "testFiles/complexModel/complex_model_with_layouts.zip";
 			Project project = createComplexProject(projectId, filename);
 
-			Model model = modelService.getLastModelByProjectId(projectId);
+			Model model = modelService.getLastModelByProjectId(projectId, adminToken);
 			assertNotNull(model);
 			assertEquals("main", model.getName());
 			assertEquals(ProjectStatus.DONE, project.getStatus());
@@ -806,7 +806,7 @@ public class ProjectServiceTest extends ServiceTestFunctions {
 			String filename = "testFiles/complexModel/complex_model_with_submaps.zip";
 			Project project = createComplexProject(name, filename);
 
-			Model model = modelService.getLastModelByProjectId(name);
+			Model model = modelService.getLastModelByProjectId(name, adminToken);
 			assertNotNull(model);
 			assertEquals("main", model.getName());
 			assertEquals(ProjectStatus.DONE, project.getStatus());
@@ -825,7 +825,7 @@ public class ProjectServiceTest extends ServiceTestFunctions {
 			String filename = "testFiles/complexModel/empty_complex_model.zip";
 			Project project = createComplexProject(name, filename);
 
-			Model model = modelService.getLastModelByProjectId(name);
+			Model model = modelService.getLastModelByProjectId(name, adminToken);
 			assertNotNull(model);
 			assertEquals(ProjectStatus.DONE, project.getStatus());
 			projectService.removeProject(project, null, false, adminToken);
@@ -842,7 +842,7 @@ public class ProjectServiceTest extends ServiceTestFunctions {
 			String filename = "testFiles/complexModel/empty_complex_model2.zip";
 			Project project = createComplexProject(name, filename);
 
-			Model model = modelService.getLastModelByProjectId(name);
+			Model model = modelService.getLastModelByProjectId(name, adminToken);
 			assertNotNull(model);
 			assertEquals(ProjectStatus.DONE, project.getStatus());
 			projectService.removeProject(project, null, false, adminToken);
@@ -859,7 +859,7 @@ public class ProjectServiceTest extends ServiceTestFunctions {
 			String filename = "testFiles/complexModel/empty_complex_model3.zip";
 			Project project = createComplexProject(name, filename);
 
-			Model model = modelService.getLastModelByProjectId(name);
+			Model model = modelService.getLastModelByProjectId(name, adminToken);
 			assertNotNull(model);
 			assertEquals(ProjectStatus.DONE, project.getStatus());
 			projectService.removeProject(project, null, false, adminToken);
diff --git a/web/src/main/java/lcsb/mapviewer/bean/ExportBean.java b/web/src/main/java/lcsb/mapviewer/bean/ExportBean.java
index 98492a664e..a516eed1bd 100644
--- a/web/src/main/java/lcsb/mapviewer/bean/ExportBean.java
+++ b/web/src/main/java/lcsb/mapviewer/bean/ExportBean.java
@@ -1217,7 +1217,7 @@ public class ExportBean extends AbstractManagedBean {
 					model(colorModel);
 			List<Integer> visibleLayoutIds = deserializeIdList(visibleLayouts);
 			for (Integer integer : visibleLayoutIds) {
-				Map<Object, ColorSchema> map = getLayoutService().getElementsForLayout(colorModel, integer);
+				Map<Object, ColorSchema> map = getLayoutService().getElementsForLayout(colorModel, integer, userBean.getAuthenticationToken());
 				params.addVisibleLayout(map);
 			}
 
diff --git a/web/src/main/java/lcsb/mapviewer/bean/GalaxyBean.java b/web/src/main/java/lcsb/mapviewer/bean/GalaxyBean.java
index 76f48ed82a..38aa8ac6b8 100644
--- a/web/src/main/java/lcsb/mapviewer/bean/GalaxyBean.java
+++ b/web/src/main/java/lcsb/mapviewer/bean/GalaxyBean.java
@@ -83,9 +83,10 @@ public class GalaxyBean extends AbstractManagedBean implements Serializable {
 				String login = requestParams.get("login");
 				String password = requestParams.get("password");
 				String modelName = requestParams.get("model");
-				Model model = (Model) modelService.getLastModelByProjectId(modelName);
-				User user = null;
+				
 				AuthenticationToken token = userService.login(login, password);
+				Model model = (Model) modelService.getLastModelByProjectId(modelName, token);
+				User user = null;
 				if (token != null) {
 					user = userService.getUserByToken(token);
 				}
diff --git a/web/src/main/java/lcsb/mapviewer/bean/LayoutBean.java b/web/src/main/java/lcsb/mapviewer/bean/LayoutBean.java
index 4335317709..6ade0bf8dc 100644
--- a/web/src/main/java/lcsb/mapviewer/bean/LayoutBean.java
+++ b/web/src/main/java/lcsb/mapviewer/bean/LayoutBean.java
@@ -31,6 +31,7 @@ import lcsb.mapviewer.events.ObjectRemovedEvent;
 import lcsb.mapviewer.model.map.layout.InvalidColorSchemaException;
 import lcsb.mapviewer.model.map.model.Model;
 import lcsb.mapviewer.model.user.User;
+import lcsb.mapviewer.services.SecurityException;
 import lcsb.mapviewer.services.interfaces.ILayoutService;
 import lcsb.mapviewer.services.interfaces.ILayoutService.CreateLayoutParams;
 import lcsb.mapviewer.services.interfaces.IModelService;
@@ -289,7 +290,7 @@ public class LayoutBean extends AbstractManagedBean implements Serializable {
 	 */
 	public void addAnonymousLayout(ProjectView project) {
 		errorOccurred = false;
-		Model model = modelService.getLastModelByProjectId(project.getProjectId());
+		Model model = modelService.getLastModelByProjectId(project.getProjectId(), userBean.getAuthenticationToken());
 		addLayout(model, null);
 	}
 
@@ -663,10 +664,11 @@ public class LayoutBean extends AbstractManagedBean implements Serializable {
 	 * 
 	 * @throws IOException
 	 *           thrown when there are some problems with sending file
+	 * @throws SecurityException
 	 */
-	public void downloadInputData(LayoutView layout) throws IOException {
+	public void downloadInputData(LayoutView layout) throws IOException, SecurityException {
 		// get input data from database
-		byte[] data = layoutService.getInputDataForLayout(layout);
+		byte[] data = layoutService.getInputDataForLayout(layout, userBean.getAuthenticationToken());
 		String string = new String(data, StandardCharsets.UTF_8);
 
 		sendFileAsResponse(string, "layout_" + layout.getIdObject() + ".txt", MimeType.TEXT);
@@ -718,7 +720,7 @@ public class LayoutBean extends AbstractManagedBean implements Serializable {
 		int layoutId = Integer.valueOf(getRequestParameter("layoutId").replace("cv", ""));
 		String string = "[]";
 		try {
-			List<LightLayoutAliasView> list = layoutService.getAliasesForLayout(getCurrentTopModel(), layoutId);
+			List<LightLayoutAliasView> list = layoutService.getAliasesForLayout(getCurrentTopModel(), layoutId, userBean.getAuthenticationToken());
 			LightLayoutAliasViewFactory factory = new LightLayoutAliasViewFactory();
 			string = factory.createGson(list);
 		} catch (Exception e) {
@@ -741,7 +743,8 @@ public class LayoutBean extends AbstractManagedBean implements Serializable {
 		String string = "[]";
 		try {
 			List<Pair<Integer, Integer>> identifiers = deserializeJsonIds(getRequestParameter("ids"));
-			List<FullLayoutAliasView> list = layoutService.getFullAliasesForLayoutByIds(getCurrentTopModel(), identifiers, layoutId);
+			List<FullLayoutAliasView> list = layoutService
+					.getFullAliasesForLayoutByIds(getCurrentTopModel(), identifiers, layoutId, userBean.getAuthenticationToken());
 			string = new FullLayoutAliasViewFactory().createGson(list);
 		} catch (Exception e) {
 			sendError("Internal server error", e);
@@ -761,7 +764,7 @@ public class LayoutBean extends AbstractManagedBean implements Serializable {
 		int layoutId = Integer.valueOf(getRequestParameter("layoutId").replace("cv", ""));
 		String string = "[]";
 		try {
-			List<LightLayoutReactionView> list = layoutService.getReactionsForLayout(getCurrentTopModel(), layoutId);
+			List<LightLayoutReactionView> list = layoutService.getReactionsForLayout(getCurrentTopModel(), layoutId, userBean.getAuthenticationToken());
 			LightLayoutReactionViewFactory factory = new LightLayoutReactionViewFactory();
 			string = factory.createGson(list);
 		} catch (Exception e) {
diff --git a/web/src/main/java/lcsb/mapviewer/bean/MapBean.java b/web/src/main/java/lcsb/mapviewer/bean/MapBean.java
index 96969e65a2..8274f958c8 100644
--- a/web/src/main/java/lcsb/mapviewer/bean/MapBean.java
+++ b/web/src/main/java/lcsb/mapviewer/bean/MapBean.java
@@ -425,10 +425,10 @@ public class MapBean extends AbstractManagedBean implements Serializable {
 			public void propertyChange(final PropertyChangeEvent arg0) {
 				if (CURRENT_MODEL_ID_PROPERTY.equals(arg0.getPropertyName())) {
 					try {
-						setCurrentTopModel(getModelService().getLastModelByProjectId((String) arg0.getNewValue()));
+						setCurrentTopModel(getModelService().getLastModelByProjectId((String) arg0.getNewValue(), userBean.getAuthenticationToken()));
 						setCurrentProjectView(getProjectService().getProjectViewByProjectId(currentMap.getProject().getProjectId(), userBean.getAuthenticationToken()));
 					} catch (Exception e) {
-						setCurrentTopModel(getModelService().getLastModelByProjectId((String) arg0.getOldValue()));
+						setCurrentTopModel(getModelService().getLastModelByProjectId((String) arg0.getOldValue(), userBean.getAuthenticationToken()));
 						logger.error(e, e);
 					}
 				}
@@ -959,7 +959,7 @@ public class MapBean extends AbstractManagedBean implements Serializable {
 	 */
 	protected final Model getCurrentTopModel() {
 		if (currentMap == null) {
-			setCurrentTopModel(this.getModelService().getLastModelByProjectId(getCurrentMapId()));
+			setCurrentTopModel(this.getModelService().getLastModelByProjectId(getCurrentMapId(), userBean.getAuthenticationToken()));
 		}
 		return currentMap;
 	}
diff --git a/web/src/test/java/lcsb/mapviewer/bean/GalaxyBeanTest.java b/web/src/test/java/lcsb/mapviewer/bean/GalaxyBeanTest.java
index e262ca8c8d..12824a1765 100644
--- a/web/src/test/java/lcsb/mapviewer/bean/GalaxyBeanTest.java
+++ b/web/src/test/java/lcsb/mapviewer/bean/GalaxyBeanTest.java
@@ -12,8 +12,7 @@ import org.junit.Test;
 
 public class GalaxyBeanTest extends WebTestFunctions {
 
-	GalaxyBean	galaxyBean;
-	
+	GalaxyBean galaxyBean;
 
 	@Before
 	public void setUp() throws Exception {
@@ -28,7 +27,9 @@ public class GalaxyBeanTest extends WebTestFunctions {
 	@Test
 	@Ignore
 	public void test() {
-		galaxyBean.createLayout("CC75308E16F6AA9C", "NAME\tVALUE\nSNCA\t1\nPINK1\t-1\n", (Model) modelService.getLastModelByProjectId("pdmap"), userService.getUserByLogin("galaxy"));
+		galaxyBean.createLayout(
+				"CC75308E16F6AA9C", "NAME\tVALUE\nSNCA\t1\nPINK1\t-1\n", (Model) modelService.getLastModelByProjectId("pdmap", adminToken),
+				userService.getUserByLogin("galaxy"));
 	}
 
 	/**
-- 
GitLab