No OneTemporary
Actions

Size

1015 KB

Referenced Files

None

Subscribers

None

View Options

This file is larger than 256 KB, so syntax highlighting was skipped.

	diff --git a/docker/redis/Dockerfile b/docker/redis/Dockerfile
	index fc5a79af..36f88183 100644
	--- a/docker/redis/Dockerfile
	+++ b/docker/redis/Dockerfile
	@@ -1,27 +1,27 @@
	-FROM fedora:30
	+FROM fedora:34

	ENV container docker
	ENV SYSTEMD_PAGER=''

	RUN dnf -y install \
	--setopt 'tsflags=nodocs' \
	bind-utils \
	cronie \
	iproute \
	iptables \
	net-tools \
	procps-ng \
	redis \
	suricata \
	vim-enhanced \
	wget \
	which && \
	dnf clean all

	COPY redis.conf /etc/redis.conf

	RUN systemctl enable redis

	WORKDIR /root/

	CMD ["/usr/bin/redis-server"]
	diff --git a/src/.env.example b/src/.env.example
	index 3f41a803..6cf7d4e7 100644
	--- a/src/.env.example
	+++ b/src/.env.example
	@@ -1,149 +1,152 @@
	APP_NAME=Kolab
	APP_ENV=local
	APP_KEY=
	APP_DEBUG=true
	APP_URL=http://127.0.0.1:8000
	+#APP_PASSPHRASE=
	APP_PUBLIC_URL=
	APP_DOMAIN=kolabnow.com
	APP_THEME=default
	-APP_TENANT_ID=1
	+APP_TENANT_ID=5
	APP_LOCALE=en
	APP_LOCALES=en,de

	ASSET_URL=http://127.0.0.1:8000

	WEBMAIL_URL=/apps
	SUPPORT_URL=/support
	SUPPORT_EMAIL=

	LOG_CHANNEL=stack
	LOG_SLOW_REQUESTS=5

	DB_CONNECTION=mysql
	DB_DATABASE=kolabdev
	DB_HOST=127.0.0.1
	DB_PASSWORD=kolab
	DB_PORT=3306
	DB_USERNAME=kolabdev

	BROADCAST_DRIVER=redis
	CACHE_DRIVER=redis

	QUEUE_CONNECTION=redis

	SESSION_DRIVER=file
	SESSION_LIFETIME=120

	+OPENEXCHANGERATES_API_KEY="from openexchangerates.org"
	+
	MFA_DSN=mysql://roundcube:Welcome2KolabSystems@127.0.0.1/roundcube
	MFA_TOTP_DIGITS=6
	MFA_TOTP_INTERVAL=30
	MFA_TOTP_DIGEST=sha1

	IMAP_URI=ssl://127.0.0.1:993
	IMAP_ADMIN_LOGIN=cyrus-admin
	IMAP_ADMIN_PASSWORD=Welcome2KolabSystems
	IMAP_VERIFY_HOST=false
	IMAP_VERIFY_PEER=false

	LDAP_BASE_DN="dc=mgmt,dc=com"
	LDAP_DOMAIN_BASE_DN="ou=Domains,dc=mgmt,dc=com"
	LDAP_HOSTS=127.0.0.1
	LDAP_PORT=389
	LDAP_SERVICE_BIND_DN="uid=kolab-service,ou=Special Users,dc=mgmt,dc=com"
	LDAP_SERVICE_BIND_PW="Welcome2KolabSystems"
	LDAP_USE_SSL=false
	LDAP_USE_TLS=false

	# Administrative
	LDAP_ADMIN_BIND_DN="cn=Directory Manager"
	LDAP_ADMIN_BIND_PW="Welcome2KolabSystems"
	LDAP_ADMIN_ROOT_DN="dc=mgmt,dc=com"

	# Hosted (public registration)
	LDAP_HOSTED_BIND_DN="uid=hosted-kolab-service,ou=Special Users,dc=mgmt,dc=com"
	LDAP_HOSTED_BIND_PW="Welcome2KolabSystems"
	LDAP_HOSTED_ROOT_DN="dc=hosted,dc=com"

	OPENVIDU_API_PASSWORD=MY_SECRET
	OPENVIDU_API_URL=http://localhost:8080/api/
	OPENVIDU_API_USERNAME=OPENVIDUAPP
	OPENVIDU_API_VERIFY_TLS=true
	OPENVIDU_COTURN_IP=127.0.0.1
	OPENVIDU_COTURN_REDIS_DATABASE=2
	OPENVIDU_COTURN_REDIS_IP=127.0.0.1
	OPENVIDU_COTURN_REDIS_PASSWORD=turn
	# Used as COTURN_IP, TURN_PUBLIC_IP, for KMS_TURN_URL
	OPENVIDU_PUBLIC_IP=127.0.0.1
	OPENVIDU_PUBLIC_PORT=3478
	OPENVIDU_SERVER_PORT=8080
	OPENVIDU_WEBHOOK=true
	OPENVIDU_WEBHOOK_ENDPOINT=http://127.0.0.1:8000/webhooks/meet/openvidu

	# "CDR" events, see https://docs.openvidu.io/en/2.13.0/reference-docs/openvidu-server-cdr/
	#OPENVIDU_WEBHOOK_EVENTS=[sessionCreated,sessionDestroyed,participantJoined,participantLeft,webrtcConnectionCreated,webrtcConnectionDestroyed,recordingStatusChanged,filterEventDispatched,mediaNodeStatusChanged]
	#OPENVIDU_WEBHOOK_HEADERS=[\"Authorization:\ Basic\ SOMETHING\"]

	REDIS_HOST=127.0.0.1
	REDIS_PASSWORD=null
	REDIS_PORT=6379

	SWOOLE_HOT_RELOAD_ENABLE=true
	SWOOLE_HTTP_ACCESS_LOG=true
	SWOOLE_HTTP_HOST=127.0.0.1
	SWOOLE_HTTP_PORT=8000
	SWOOLE_HTTP_REACTOR_NUM=1
	SWOOLE_HTTP_WEBSOCKET=true
	SWOOLE_HTTP_WORKER_NUM=1
	SWOOLE_OB_OUTPUT=true

	PAYMENT_PROVIDER=
	MOLLIE_KEY=
	STRIPE_KEY=
	STRIPE_PUBLIC_KEY=
	STRIPE_WEBHOOK_SECRET=

	MAIL_DRIVER=smtp
	MAIL_HOST=smtp.mailtrap.io
	MAIL_PORT=2525
	MAIL_USERNAME=null
	MAIL_PASSWORD=null
	MAIL_ENCRYPTION=null
	MAIL_FROM_ADDRESS="noreply@example.com"
	MAIL_FROM_NAME="Example.com"
	MAIL_REPLYTO_ADDRESS=null
	MAIL_REPLYTO_NAME=null

	DNS_TTL=3600
	DNS_SPF="v=spf1 mx -all"
	DNS_STATIC="%s. MX 10 ext-mx01.mykolab.com."
	DNS_COPY_FROM=null

	AWS_ACCESS_KEY_ID=
	AWS_SECRET_ACCESS_KEY=
	AWS_DEFAULT_REGION=us-east-1
	AWS_BUCKET=

	PUSHER_APP_ID=
	PUSHER_APP_KEY=
	PUSHER_APP_SECRET=
	PUSHER_APP_CLUSTER=mt1

	MIX_ASSET_PATH='/'
	MIX_PUSHER_APP_KEY="${PUSHER_APP_KEY}"
	MIX_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}"

	JWT_SECRET=
	JWT_TTL=60

	COMPANY_NAME=
	COMPANY_ADDRESS=
	COMPANY_DETAILS=
	COMPANY_EMAIL=
	COMPANY_LOGO=
	COMPANY_FOOTER=

	VAT_COUNTRIES=CH,LI
	VAT_RATE=7.7

	KB_ACCOUNT_DELETE=
	KB_ACCOUNT_SUSPENDED=
	diff --git a/src/app/Auth/SecondFactor.php b/src/app/Auth/SecondFactor.php
	index 1f7fc994..13e114d3 100644
	--- a/src/app/Auth/SecondFactor.php
	+++ b/src/app/Auth/SecondFactor.php
	@@ -1,330 +1,322 @@
	<?php

	namespace App\Auth;

	-use App\Sku;
	-use App\User;
	use Illuminate\Support\Facades\Auth;
	use Illuminate\Support\Facades\DB;
	use Kolab2FA\Storage\Base;

	/**
	* A class to maintain 2-factor authentication
	*/
	class SecondFactor extends Base
	{
	protected $user;
	protected $cache = [];
	protected $config = [
	'keymap' => [],
	];


	/**
	* Class constructor
	*
	* @param \App\User $user User object
	*/
	public function __construct($user)
	{
	$this->user = $user;

	parent::__construct();
	}

	/**
	* Validate 2-factor authentication code
	*
	* @param \Illuminate\Http\Request $request The API request.
	*
	* @return \Illuminate\Http\JsonResponse\|null
	*/
	public function requestHandler($request)
	{
	// get list of configured authentication factors
	$factors = $this->factors();

	// do nothing if no factors configured
	if (empty($factors)) {
	return null;
	}

	if (empty($request->secondfactor) \|\| !is_string($request->secondfactor)) {
	$errors = ['secondfactor' => \trans('validation.2fareq')];
	return response()->json(['status' => 'error', 'errors' => $errors], 422);
	}

	// try to verify each configured factor
	foreach ($factors as $factor) {
	// verify the submitted code
	// if (strpos($factor, 'dummy:') === 0 && (\app('env') != 'production') {
	// if ($request->secondfactor === 'dummy') {
	// return null;
	// }
	// } else
	if ($this->verify($factor, $request->secondfactor)) {
	return null;
	}
	}

	$errors = ['secondfactor' => \trans('validation.2fainvalid')];
	return response()->json(['status' => 'error', 'errors' => $errors], 422);
	}

	/**
	* Remove all configured 2FA methods for the current user
	*
	* @return bool True on success, False otherwise
	*/
	public function removeFactors(): bool
	{
	$this->cache = [];

	$prefs = [];
	$prefs[$this->key2property('blob')] = null;
	$prefs[$this->key2property('factors')] = null;

	return $this->savePrefs($prefs);
	}

	/**
	* Returns a list of 2nd factor methods configured for the user
	*/
	public function factors(): array
	{
	// First check if the user has the 2FA SKU
	- $sku_2fa = Sku::where('title', '2fa')->first();
	+ if ($this->user->hasSku('2fa')) {
	+ $factors = (array) $this->enumerate();
	+ $factors = array_unique($factors);

	- if ($sku_2fa) {
	- $has_2fa = $this->user->entitlements()->where('sku_id', $sku_2fa->id)->first();
	-
	- if ($has_2fa) {
	- $factors = (array) $this->enumerate();
	- $factors = array_unique($factors);
	-
	- return $factors;
	- }
	+ return $factors;
	}

	return [];
	}

	/**
	* Helper method to verify the given method/code tuple
	*
	* @param string $factor Factor identifier (<method>:<id>)
	* @param string $code Authentication code
	*
	* @return bool True on successful validation
	*/
	protected function verify($factor, $code): bool
	{
	$driver = $this->getDriver($factor);
	return $driver->verify($code, time());
	}

	/**
	* Load driver class for the given authentication factor
	*
	* @param string $factor Factor identifier (<method>:<id>)
	*
	* @return \Kolab2FA\Driver\Base
	*/
	protected function getDriver(string $factor)
	{
	list($method) = explode(':', $factor, 2);

	$config = \config('2fa.' . $method, []);

	$driver = \Kolab2FA\Driver\Base::factory($factor, $config);

	// configure driver
	$driver->storage = $this;
	$driver->username = $this->user->email;

	return $driver;
	}

	/**
	* Helper for seeding a Roundcube account with 2FA setup
	* for testing.
	*
	* @param string $email Email address
	*/
	public static function seed(string $email): void
	{
	$config = [
	'kolab_2fa_blob' => [
	'totp:8132a46b1f741f88de25f47e' => [
	'label' => 'Mobile app (TOTP)',
	'created' => 1584573552,
	'secret' => 'UAF477LDHZNWVLNA',
	'active' => true,
	],
	// 'dummy:dummy' => [
	// 'active' => true,
	// ],
	],
	'kolab_2fa_factors' => [
	'totp:8132a46b1f741f88de25f47e',
	// 'dummy:dummy',
	]
	];

	self::dbh()->table('users')->updateOrInsert(
	['username' => $email, 'mail_host' => '127.0.0.1'],
	['preferences' => serialize($config)]
	);
	}

	/**
	* Helper for generating current TOTP code for a test user
	*
	* @param string $email Email address
	*
	* @return string Generated code
	*/
	public static function code(string $email): string
	{
	- $sf = new self(User::where('email', $email)->first());
	+ $sf = new self(\App\User::where('email', $email)->first());
	$driver = $sf->getDriver('totp:8132a46b1f741f88de25f47e');

	return (string) $driver->get_code();
	}


	//******************************************************
	// Methods required by Kolab2FA Storage Base
	//******************************************************

	/**
	* Initialize the storage driver with the given config options
	*/
	public function init(array $config)
	{
	$this->config = array_merge($this->config, $config);
	}

	/**
	* List methods activated for this user
	*/
	public function enumerate()
	{
	if ($factors = $this->getFactors()) {
	return array_keys(array_filter($factors, function ($prop) {
	return !empty($prop['active']);
	}));
	}

	return [];
	}

	/**
	* Read data for the given key
	*/
	public function read($key)
	{
	if (!isset($this->cache[$key])) {
	$factors = $this->getFactors();
	$this->cache[$key] = isset($factors[$key]) ? $factors[$key] : null;
	}

	return $this->cache[$key];
	}

	/**
	* Save data for the given key
	*/
	public function write($key, $value)
	{
	\Log::debug(__METHOD__ . ' ' . @json_encode($value));

	// TODO: Not implemented
	return false;
	}

	/**
	* Remove the data stored for the given key
	*/
	public function remove($key)
	{
	return $this->write($key, null);
	}

	/**
	*
	*/
	protected function getFactors(): array
	{
	$prefs = $this->getPrefs();
	$key = $this->key2property('blob');

	return isset($prefs[$key]) ? (array) $prefs[$key] : [];
	}

	/**
	*
	*/
	protected function key2property($key)
	{
	// map key to configured property name
	if (is_array($this->config['keymap']) && isset($this->config['keymap'][$key])) {
	return $this->config['keymap'][$key];
	}

	// default
	return 'kolab_2fa_' . $key;
	}

	/**
	* Gets user preferences from Roundcube users table
	*/
	protected function getPrefs()
	{
	$user = $this->dbh()->table('users')
	->select('preferences')
	->where('username', strtolower($this->user->email))
	->first();

	return $user ? (array) unserialize($user->preferences) : null;
	}

	/**
	* Saves user preferences in Roundcube users table.
	* This will merge into old preferences
	*/
	protected function savePrefs($prefs)
	{
	$old_prefs = $this->getPrefs();

	if (!is_array($old_prefs)) {
	return false;
	}

	$prefs = array_merge($old_prefs, $prefs);

	$this->dbh()->table('users')
	->where('username', strtolower($this->user->email))
	->update(['preferences' => serialize($prefs)]);

	return true;
	}

	/**
	* Init connection to the Roundcube database
	*/
	public static function dbh()
	{
	$dsn = \config('2fa.dsn');

	if (empty($dsn)) {
	\Log::warning("2-FACTOR database not configured");

	return DB::connection(\config('database.default'));
	}

	\Config::set('database.connections.2fa', ['url' => $dsn]);

	return DB::connection('2fa');
	}
	}
	diff --git a/src/app/Backends/OpenExchangeRates.php b/src/app/Backends/OpenExchangeRates.php
	index e5948551..e1c9367b 100644
	--- a/src/app/Backends/OpenExchangeRates.php
	+++ b/src/app/Backends/OpenExchangeRates.php
	@@ -1,52 +1,52 @@
	<?php

	namespace App\Backends;

	class OpenExchangeRates
	{
	/**
	* Import exchange rates from openexchangerates.org
	*
	- * @param string Base currency
	+ * @param string $baseCurrency Base currency
	*
	* @return array exchange rates
	*/
	public static function retrieveRates($baseCurrency)
	{
	$baseCurrency = strtoupper($baseCurrency);
	$apiKey = \config('services.openexchangerates.api_key');
	$query = http_build_query(['app_id' => $apiKey, 'base' => 'USD']);
	$url = 'https://openexchangerates.org/api/latest.json?' . $query;
	$html = file_get_contents($url, false);
	$rates = [];

	if ($html && ($result = json_decode($html, true)) && !empty($result['rates'])) {
	foreach ($result['rates'] as $code => $rate) {
	$rates[strtoupper($code)] = $rate;
	}

	if ($baseCurrency != 'USD') {
	if ($base = $rates[$baseCurrency]) {
	foreach ($rates as $code => $rate) {
	$rates[$code] = $rate / $base;
	}
	} else {
	$rates = [];
	}
	}

	foreach ($rates as $code => $rate) {
	\Log::debug(sprintf("Update %s: %0.8f", $code, $rate));
	}
	} else {
	throw new \Exception("Failed to parse exchange rates");
	}

	if (count($rates) > 1) {
	$rates[$baseCurrency] = 1;
	return $rates;
	}

	throw new \Exception("Failed to retrieve exchange rates");
	}
	}
	diff --git a/src/app/Console/Command.php b/src/app/Console/Command.php
	index 89c6513c..91380612 100644
	--- a/src/app/Console/Command.php
	+++ b/src/app/Console/Command.php
	@@ -1,199 +1,208 @@
	<?php

	namespace App\Console;

	use Illuminate\Support\Facades\DB;

	abstract class Command extends \Illuminate\Console\Command
	{
	+ /**
	+ * This needs to be here to be used.
	+ *
	+ * @var null
	+ */
	+ protected $commandPrefix = null;
	+
	/**
	* Annotate this command as being dangerous for any potential unintended consequences.
	*
	* Commands are considered dangerous if;
	*
	* * observers are deliberately not triggered, meaning that the deletion of an object model that requires the
	* associated observer to clean some things up, or charge a wallet or something, are deliberately not triggered,
	*
	* * deletion of objects and their relations rely on database foreign keys with obscure cascading,
	*
	* * a command will result in the permanent, irrecoverable loss of data.
	*
	* @var boolean
	*/
	protected $dangerous = false;

	/**
	* Find the domain.
	*
	* @param string $domain Domain ID or namespace
	* @param bool $withDeleted Include deleted
	*
	* @return \App\Domain\|null
	*/
	public function getDomain($domain, $withDeleted = false)
	{
	return $this->getObject(\App\Domain::class, $domain, 'namespace', $withDeleted);
	}

	/**
	* Find an object.
	*
	* @param string $objectClass The name of the class
	* @param string $objectIdOrTitle The name of a database field to match.
	* @param string\|null $objectTitle An additional database field to match.
	* @param bool $withDeleted Act as if --with-deleted was used
	*
	* @return mixed
	*/
	public function getObject($objectClass, $objectIdOrTitle, $objectTitle = null, $withDeleted = false)
	{
	if (!$withDeleted) {
	$withDeleted = $this->hasOption('with-deleted') && $this->option('with-deleted');
	}

	$object = $this->getObjectModel($objectClass, $withDeleted)->find($objectIdOrTitle);

	if (!$object && !empty($objectTitle)) {
	$object = $this->getObjectModel($objectClass, $withDeleted)
	->where($objectTitle, $objectIdOrTitle)->first();
	}

	return $object;
	}

	/**
	* Returns a preconfigured Model object for a specified class.
	*
	* @param string $objectClass The name of the class
	* @param bool $withDeleted Include withTrashed() query
	*
	* @return mixed
	*/
	protected function getObjectModel($objectClass, $withDeleted = false)
	{
	if ($withDeleted) {
	$model = $objectClass::withTrashed();
	} else {
	$model = new $objectClass();
	}

	+ if ($this->commandPrefix == 'scalpel') {
	+ return $model;
	+ }
	+
	$modelsWithTenant = [
	\App\Discount::class,
	\App\Domain::class,
	\App\Group::class,
	\App\Package::class,
	\App\Plan::class,
	\App\Sku::class,
	\App\User::class,
	];

	$modelsWithOwner = [
	\App\Wallet::class,
	];

	- $tenant_id = \config('app.tenant_id');
	+ $tenantId = \config('app.tenant_id');

	// Add tenant filter
	if (in_array($objectClass, $modelsWithTenant)) {
	- $model = $model->withEnvTenant();
	+ $model = $model->withEnvTenantContext();
	} elseif (in_array($objectClass, $modelsWithOwner)) {
	- $model = $model->whereExists(function ($query) use ($tenant_id) {
	+ $model = $model->whereExists(function ($query) use ($tenantId) {
	$query->select(DB::raw(1))
	->from('users')
	->whereRaw('wallets.user_id = users.id')
	- ->whereRaw('users.tenant_id ' . ($tenant_id ? "= $tenant_id" : 'is null'));
	+ ->whereRaw('users.tenant_id ' . ($tenantId ? "= $tenantId" : 'is null'));
	});
	}

	- // TODO: tenant check for Entitlement, Transaction, etc.
	-
	return $model;
	}

	/**
	* Find the user.
	*
	* @param string $user User ID or email
	* @param bool $withDeleted Include deleted
	*
	* @return \App\User\|null
	*/
	public function getUser($user, $withDeleted = false)
	{
	return $this->getObject(\App\User::class, $user, 'email', $withDeleted);
	}

	/**
	* Find the wallet.
	*
	* @param string $wallet Wallet ID
	*
	* @return \App\Wallet\|null
	*/
	public function getWallet($wallet)
	{
	return $this->getObject(\App\Wallet::class, $wallet, null);
	}

	public function handle()
	{
	if ($this->dangerous) {
	$this->warn(
	"This command is a dangerous scalpel command with potentially significant unintended consequences"
	);

	$confirmation = $this->confirm("Are you sure you understand what's about to happen?");

	if (!$confirmation) {
	$this->info("Better safe than sorry.");
	return false;
	}

	$this->info("Vámonos!");
	}

	return true;
	}

	/**
	* Return a string for output, with any additional attributes specified as well.
	*
	* @param mixed $entry An object
	*
	* @return string
	*/
	protected function toString($entry)
	{
	/**
	* Haven't figured out yet, how to test if this command implements an option for additional
	* attributes.
	if (!in_array('attr', $this->options())) {
	return $entry->{$entry->getKeyName()};
	}
	*/

	$str = [
	$entry->{$entry->getKeyName()}
	];

	foreach ($this->option('attr') as $attr) {
	if ($attr == $entry->getKeyName()) {
	$this->warn("Specifying {$attr} is not useful.");
	continue;
	}

	if (!array_key_exists($attr, $entry->toArray())) {
	$this->error("Attribute {$attr} isn't available");
	continue;
	}

	if (is_numeric($entry->{$attr})) {
	$str[] = $entry->{$attr};
	} else {
	$str[] = !empty($entry->{$attr}) ? $entry->{$attr} : "null";
	}
	}

	return implode(" ", $str);
	}
	}
	diff --git a/src/app/Console/Commands/Domain/CreateCommand.php b/src/app/Console/Commands/Domain/CreateCommand.php
	index e976539f..2ff9558b 100644
	--- a/src/app/Console/Commands/Domain/CreateCommand.php
	+++ b/src/app/Console/Commands/Domain/CreateCommand.php
	@@ -1,90 +1,90 @@
	<?php

	namespace App\Console\Commands\Domain;

	use App\Console\Command;
	use Illuminate\Support\Facades\Queue;

	class CreateCommand extends Command
	{
	/**
	* The name and signature of the console command.
	*
	* @var string
	*/
	protected $signature = 'domain:create {domain} {--force}';

	/**
	* The console command description.
	*
	* @var string
	*/
	- protected $description = "Create a domain.";
	+ protected $description = "Create a domain";

	/**
	* Execute the console command.
	*
	* @return mixed
	*/
	public function handle()
	{
	$namespace = \strtolower($this->argument('domain'));

	// must use withTrashed(), because unique constraint
	$domain = \App\Domain::withTrashed()->where('namespace', $namespace)->first();

	if ($domain && !$this->option('force')) {
	$this->error("Domain {$namespace} already exists.");
	return 1;
	}

	if ($domain) {
	if ($domain->deleted_at) {
	// set the status back to new
	$domain->status = \App\Domain::STATUS_NEW;
	$domain->save();

	// remove existing entitlement
	$entitlement = \App\Entitlement::withTrashed()->where(
	[
	'entitleable_id' => $domain->id,
	'entitleable_type' => \App\Domain::class
	]
	)->first();

	if ($entitlement) {
	$entitlement->forceDelete();
	}

	// restore the domain to allow for the observer to handle the create job
	$domain->restore();

	$this->info(
	sprintf(
	"Domain %s with ID %d revived. Remember to assign it to a wallet with 'domain:set-wallet'",
	$domain->namespace,
	$domain->id
	)
	);
	} else {
	$this->error("Domain {$namespace} not marked as deleted... examine more closely");
	return 1;
	}
	} else {
	$domain = \App\Domain::create(
	[
	'namespace' => $namespace,
	'type' => \App\Domain::TYPE_EXTERNAL,
	]
	);

	$this->info(
	sprintf(
	"Domain %s created with ID %d. Remember to assign it to a wallet with 'domain:set-wallet'",
	$domain->namespace,
	$domain->id
	)
	);
	}
	}
	}
	diff --git a/src/app/Console/Commands/Domain/DeleteCommand.php b/src/app/Console/Commands/Domain/DeleteCommand.php
	new file mode 100644
	index 00000000..c18bc6f1
	--- /dev/null
	+++ b/src/app/Console/Commands/Domain/DeleteCommand.php
	@@ -0,0 +1,34 @@
	+<?php
	+
	+namespace App\Console\Commands\Domain;
	+
	+use App\Console\ObjectDeleteCommand;
	+
	+class DeleteCommand extends ObjectDeleteCommand
	+{
	+ protected $dangerous = false;
	+ protected $hidden = false;
	+
	+ protected $objectClass = \App\Domain::class;
	+ protected $objectName = 'domain';
	+ protected $objectTitle = 'namespace';
	+
	+ public function handle()
	+ {
	+ $argument = $this->argument('domain');
	+
	+ $domain = $this->getDomain($argument);
	+
	+ if (!$domain) {
	+ $this->error("No such domain {$argument}");
	+ return 1;
	+ }
	+
	+ if ($domain->isPublic()) {
	+ $this->error("This domain is a public registration domain.");
	+ return 1;
	+ }
	+
	+ parent::handle();
	+ }
	+}
	diff --git a/src/app/Console/Commands/Domain/UsersCommand.php b/src/app/Console/Commands/Domain/UsersCommand.php
	new file mode 100644
	index 00000000..43e4b9c6
	--- /dev/null
	+++ b/src/app/Console/Commands/Domain/UsersCommand.php
	@@ -0,0 +1,13 @@
	+<?php
	+
	+namespace App\Console\Commands\Domain;
	+
	+use App\Console\ObjectRelationListCommand;
	+
	+class UsersCommand extends ObjectRelationListCommand
	+{
	+ protected $objectClass = \App\Domain::class;
	+ protected $objectName = 'domain';
	+ protected $objectTitle = 'namespace';
	+ protected $objectRelation = 'users';
	+}
	diff --git a/src/app/Console/Commands/DomainDelete.php b/src/app/Console/Commands/DomainDelete.php
	deleted file mode 100644
	index 4f9af503..00000000
	--- a/src/app/Console/Commands/DomainDelete.php
	+++ /dev/null
	@@ -1,38 +0,0 @@
	-<?php
	-
	-namespace App\Console\Commands;
	-
	-use App\Console\Command;
	-
	-class DomainDelete extends Command
	-{
	- /**
	- * The name and signature of the console command.
	- *
	- * @var string
	- */
	- protected $signature = 'domain:delete {domain}';
	-
	- /**
	- * The console command description.
	- *
	- * @var string
	- */
	- protected $description = 'Delete a domain';
	-
	- /**
	- * Execute the console command.
	- *
	- * @return mixed
	- */
	- public function handle()
	- {
	- $domain = $this->getDomain($this->argument('domain'));
	-
	- if (!$domain) {
	- return 1;
	- }
	-
	- $domain->delete();
	- }
	-}
	diff --git a/src/app/Console/Commands/DomainList.php b/src/app/Console/Commands/DomainList.php
	index 9356d45a..b15ca7d3 100644
	--- a/src/app/Console/Commands/DomainList.php
	+++ b/src/app/Console/Commands/DomainList.php
	@@ -1,49 +1,49 @@
	<?php

	namespace App\Console\Commands;

	use App\Console\Command;
	use App\Domain;

	class DomainList extends Command
	{
	/**
	* The name and signature of the console command.
	*
	* @var string
	*/
	protected $signature = 'domain:list {--deleted}';

	/**
	* The console command description.
	*
	* @var string
	*/
	protected $description = 'List domains';

	/**
	* Execute the console command.
	*
	* @return mixed
	*/
	public function handle()
	{
	if ($this->option('deleted')) {
	$domains = Domain::withTrashed()->orderBy('namespace');
	} else {
	$domains = Domain::orderBy('namespace');
	}

	- $domains->withEnvTenant()->each(
	+ $domains->withEnvTenantContext()->each(
	function ($domain) {
	$msg = $domain->namespace;

	if ($domain->deleted_at) {
	$msg .= " (deleted at {$domain->deleted_at})";
	}

	$this->info($msg);
	}
	);
	}
	}
	diff --git a/src/app/Console/Commands/DomainListUsers.php b/src/app/Console/Commands/DomainListUsers.php
	deleted file mode 100644
	index 717cee68..00000000
	--- a/src/app/Console/Commands/DomainListUsers.php
	+++ /dev/null
	@@ -1,83 +0,0 @@
	-<?php
	-
	-namespace App\Console\Commands;
	-
	-use App\Console\Command;
	-
	-class DomainListUsers extends Command
	-{
	- /**
	- * The name and signature of the console command.
	- *
	- * @var string
	- */
	- protected $signature = 'domain:list-users {domain}';
	-
	- /**
	- * The console command description.
	- *
	- * @var string
	- */
	- protected $description = 'List the user accounts of a domain';
	-
	- /**
	- * Create a new command instance.
	- *
	- * @return void
	- */
	- public function __construct()
	- {
	- parent::__construct();
	- }
	-
	- /**
	- * Execute the console command.
	- *
	- * @return mixed
	- */
	- public function handle()
	- {
	- $domain = $this->getDomain($this->argument('domain'));
	-
	- if (!$domain) {
	- return 1;
	- }
	-
	- if ($domain->isPublic()) {
	- $this->error("This domain is a public registration domain.");
	- return 1;
	- }
	-
	- // TODO: actually implement listing users
	- $wallet = $domain->wallet();
	-
	- if (!$wallet) {
	- $this->error("This domain isn't billed to a wallet.");
	- return 1;
	- }
	-
	- $mailboxSKU = \App\Sku::where('title', 'mailbox')->first();
	-
	- if (!$mailboxSKU) {
	- $this->error("No mailbox SKU available.");
	- }
	-
	- $entitlements = $wallet->entitlements()
	- ->where('entitleable_type', \App\User::class)
	- ->where('sku_id', $mailboxSKU->id)->get();
	-
	- $users = [];
	-
	- foreach ($entitlements as $entitlement) {
	- $users[] = $entitlement->entitleable;
	- }
	-
	- usort($users, function ($a, $b) {
	- return $a->email > $b->email;
	- });
	-
	- foreach ($users as $user) {
	- $this->info($user->email);
	- }
	- }
	-}
	diff --git a/src/app/Console/Commands/PackageSkus.php b/src/app/Console/Commands/PackageSkus.php
	index 26ea06bb..8ad6cdce 100644
	--- a/src/app/Console/Commands/PackageSkus.php
	+++ b/src/app/Console/Commands/PackageSkus.php
	@@ -1,41 +1,41 @@
	<?php

	namespace App\Console\Commands;

	use App\Console\Command;
	use App\Package;

	class PackageSkus extends Command
	{
	/**
	* The name and signature of the console command.
	*
	* @var string
	*/
	protected $signature = 'package:skus';

	/**
	* The console command description.
	*
	* @var string
	*/
	protected $description = "List SKUs for packages.";

	/**
	* Execute the console command.
	*
	* @return mixed
	*/
	public function handle()
	{
	- $packages = Package::withEnvTenant()->get();
	+ $packages = Package::withEnvTenantContext()->get();

	foreach ($packages as $package) {
	$this->info(sprintf("Package: %s", $package->title));

	foreach ($package->skus as $sku) {
	$this->info(sprintf(" SKU: %s (%d)", $sku->title, $sku->pivot->qty));
	}
	}
	}
	}
	diff --git a/src/app/Console/Commands/PlanPackages.php b/src/app/Console/Commands/PlanPackages.php
	index b827c4d1..086dcf5a 100644
	--- a/src/app/Console/Commands/PlanPackages.php
	+++ b/src/app/Console/Commands/PlanPackages.php
	@@ -1,87 +1,87 @@
	<?php

	namespace App\Console\Commands;

	use App\Plan;
	use Illuminate\Console\Command;

	class PlanPackages extends Command
	{
	/**
	* The name and signature of the console command.
	*
	* @var string
	*/
	protected $signature = 'plan:packages';

	/**
	* The console command description.
	*
	* @var string
	*/
	protected $description = "List packages for plans.";

	/**
	* Create a new command instance.
	*
	* @return void
	*/
	public function __construct()
	{
	parent::__construct();
	}

	/**
	* Execute the console command.
	*
	* @return mixed
	*/
	public function handle()
	{
	- $plans = Plan::withEnvTenant()->get();
	+ $plans = Plan::withEnvTenantContext()->get();

	foreach ($plans as $plan) {
	$this->info(sprintf("Plan: %s", $plan->title));

	$plan_costs = 0;

	foreach ($plan->packages as $package) {
	$qtyMin = $package->pivot->qty_min;
	$qtyMax = $package->pivot->qty_max;

	$discountQty = $package->pivot->discount_qty;
	$discountRate = (100 - $package->pivot->discount_rate) / 100;

	$this->info(
	sprintf(
	" Package: %s (min: %d, max: %d, discount %d%% after the first %d, base cost: %d)",
	$package->title,
	$package->pivot->qty_min,
	$package->pivot->qty_max,
	$package->pivot->discount_rate,
	$package->pivot->discount_qty,
	$package->cost()
	)
	);

	foreach ($package->skus as $sku) {
	$this->info(sprintf(" SKU: %s (%d)", $sku->title, $sku->pivot->qty));
	}

	if ($qtyMin < $discountQty) {
	$plan_costs += $qtyMin * $package->cost();
	} elseif ($qtyMin == $discountQty) {
	$plan_costs += $package->cost();
	} else {
	// base rate
	$plan_costs += $discountQty * $package->cost();

	// discounted rate
	$plan_costs += ($qtyMin - $discountQty) * $package->cost() * $discountRate;
	}
	}

	$this->info(sprintf(" Plan costs per month: %d", $plan_costs));
	}
	}
	}
	diff --git a/src/app/Console/Commands/User/DeleteCommand.php b/src/app/Console/Commands/User/DeleteCommand.php
	new file mode 100644
	index 00000000..92bd800a
	--- /dev/null
	+++ b/src/app/Console/Commands/User/DeleteCommand.php
	@@ -0,0 +1,15 @@
	+<?php
	+
	+namespace App\Console\Commands\User;
	+
	+use App\Console\ObjectDeleteCommand;
	+
	+class DeleteCommand extends ObjectDeleteCommand
	+{
	+ protected $dangerous = false;
	+ protected $hidden = false;
	+
	+ protected $objectClass = \App\User::class;
	+ protected $objectName = 'user';
	+ protected $objectTitle = 'email';
	+}
	diff --git a/src/app/Console/Commands/User/StatusCommand.php b/src/app/Console/Commands/User/StatusCommand.php
	new file mode 100644
	index 00000000..564d3944
	--- /dev/null
	+++ b/src/app/Console/Commands/User/StatusCommand.php
	@@ -0,0 +1,71 @@
	+<?php
	+
	+namespace App\Console\Commands\User;
	+
	+use Illuminate\Console\Command;
	+
	+class StatusCommand extends Command
	+{
	+ /**
	+ * The name and signature of the console command.
	+ *
	+ * @var string
	+ */
	+ protected $signature = 'user:status {user}';
	+
	+ /**
	+ * The console command description.
	+ *
	+ * @var string
	+ */
	+ protected $description = "Show a user's status.";
	+
	+ /**
	+ * Create a new command instance.
	+ *
	+ * @return void
	+ */
	+ public function __construct()
	+ {
	+ parent::__construct();
	+ }
	+
	+ /**
	+ * Execute the console command.
	+ *
	+ * @return mixed
	+ */
	+ public function handle()
	+ {
	+ $user = \App\User::withTrashed()->withEnvTenantContext()->where('email', $this->argument('user'))->first();
	+
	+ if (!$user) {
	+ $user = \App\User::withTrashed()->withEnvTenantContext()->where('id', $this->argument('user'))->first();
	+ }
	+
	+ if (!$user) {
	+ $this->error("No such user '" . $this->argument('user') . "' within this tenant context.");
	+ $this->info("Try ./artisan scalpel:user:read --attr=email --attr=tenant_id " . $this->argument('user'));
	+ return 1;
	+ }
	+
	+ $statuses = [
	+ 'active' => \App\User::STATUS_ACTIVE,
	+ 'suspended' => \App\User::STATUS_SUSPENDED,
	+ 'deleted' => \App\User::STATUS_DELETED,
	+ 'ldapReady' => \App\User::STATUS_LDAP_READY,
	+ 'imapReady' => \App\User::STATUS_IMAP_READY,
	+ ];
	+
	+ $user_state = [];
	+
	+ foreach (\array_keys($statuses) as $state) {
	+ $func = 'is' . \ucfirst($state);
	+ if ($user->$func()) {
	+ $user_state[] = $state;
	+ }
	+ }
	+
	+ $this->info("Status: " . \implode(',', $user_state));
	+ }
	+}
	diff --git a/src/app/Console/Commands/UserStatus.php b/src/app/Console/Commands/UserStatus.php
	deleted file mode 100644
	index 0a6d26e4..00000000
	--- a/src/app/Console/Commands/UserStatus.php
	+++ /dev/null
	@@ -1,53 +0,0 @@
	-<?php
	-
	-namespace App\Console\Commands;
	-
	-use App\Console\Command;
	-use App\User;
	-
	-class UserStatus extends Command
	-{
	- /**
	- * The name and signature of the console command.
	- *
	- * @var string
	- */
	- protected $signature = 'user:status {user}';
	-
	- /**
	- * The console command description.
	- *
	- * @var string
	- */
	- protected $description = 'Display the status of a user';
	-
	- /**
	- * Execute the console command.
	- *
	- * @return mixed
	- */
	- public function handle()
	- {
	- $user = $this->getUser($this->argument('user'));
	-
	- if (!$user) {
	- return 1;
	- }
	-
	- $statuses = [
	- 'active' => User::STATUS_ACTIVE,
	- 'suspended' => User::STATUS_SUSPENDED,
	- 'deleted' => User::STATUS_DELETED,
	- 'ldapReady' => User::STATUS_LDAP_READY,
	- 'imapReady' => User::STATUS_IMAP_READY,
	- ];
	-
	- foreach ($statuses as $text => $bit) {
	- $func = 'is' . \ucfirst($text);
	-
	- $this->info(sprintf("%d %s: %s", $bit, $text, $user->$func()));
	- }
	-
	- $this->info("In total: {$user->status}");
	- }
	-}
	diff --git a/src/app/Console/Commands/WalletBalances.php b/src/app/Console/Commands/WalletBalances.php
	index 9eccfabc..d0821f4b 100644
	--- a/src/app/Console/Commands/WalletBalances.php
	+++ b/src/app/Console/Commands/WalletBalances.php
	@@ -1,60 +1,60 @@
	<?php

	namespace App\Console\Commands;

	use Illuminate\Console\Command;

	class WalletBalances extends Command
	{
	/**
	* The name and signature of the console command.
	*
	* @var string
	*/
	protected $signature = 'wallet:balances';

	/**
	* The console command description.
	*
	* @var string
	*/
	protected $description = 'Show the balance on wallets';

	/**
	* Execute the console command.
	*
	* @return mixed
	*/
	public function handle()
	{
	$wallets = \App\Wallet::select('wallets.*')
	->join('users', 'users.id', '=', 'wallets.user_id')
	- ->withEnvTenant('users')
	+ ->withEnvTenantContext('users')
	->all();

	$wallets->each(
	function ($wallet) {
	if ($wallet->balance == 0) {
	return;
	}

	$user = $wallet->owner;

	if (!$user) {
	return;
	}

	$this->info(
	sprintf(
	"%s: %8s (account: %s/%s (%s))",
	$wallet->id,
	$wallet->balance,
	"https://kolabnow.com/cockpit/admin/accounts/show",
	$user->id,
	$user->email
	)
	);
	}
	);
	}
	}
	diff --git a/src/app/Console/Commands/WalletCharge.php b/src/app/Console/Commands/WalletCharge.php
	index c407e8c9..6ca62cb0 100644
	--- a/src/app/Console/Commands/WalletCharge.php
	+++ b/src/app/Console/Commands/WalletCharge.php
	@@ -1,67 +1,67 @@
	<?php

	namespace App\Console\Commands;

	use App\Console\Command;
	use App\Wallet;

	class WalletCharge extends Command
	{
	/**
	* The name and signature of the console command.
	*
	* @var string
	*/
	protected $signature = 'wallet:charge {wallet?}';

	/**
	* The console command description.
	*
	* @var string
	*/
	protected $description = 'Charge wallets';

	/**
	* Execute the console command.
	*
	* @return mixed
	*/
	public function handle()
	{
	if ($wallet = $this->argument('wallet')) {
	// Find specified wallet by ID
	$wallet = $this->getWallet($wallet);

	if (!$wallet \|\| !$wallet->owner) {
	return 1;
	}

	$wallets = [$wallet];
	} else {
	// Get all wallets, excluding deleted accounts
	$wallets = Wallet::select('wallets.*')
	->join('users', 'users.id', '=', 'wallets.user_id')
	- ->withEnvTenant('users')
	+ ->withEnvTenantContext('users')
	->whereNull('users.deleted_at')
	->cursor();
	}

	foreach ($wallets as $wallet) {
	$charge = $wallet->chargeEntitlements();

	if ($charge > 0) {
	$this->info(
	"Charged wallet {$wallet->id} for user {$wallet->owner->email} with {$charge}"
	);

	// Top-up the wallet if auto-payment enabled for the wallet
	\App\Jobs\WalletCharge::dispatch($wallet);
	}

	if ($wallet->balance < 0) {
	// Check the account balance, send notifications, suspend, delete
	\App\Jobs\WalletCheck::dispatch($wallet);
	}
	}
	}
	}
	diff --git a/src/app/Console/Commands/WalletExpected.php b/src/app/Console/Commands/WalletExpected.php
	index fdeecb38..8bd2a523 100644
	--- a/src/app/Console/Commands/WalletExpected.php
	+++ b/src/app/Console/Commands/WalletExpected.php
	@@ -1,68 +1,68 @@
	<?php

	namespace App\Console\Commands;

	use App\Console\Command;

	class WalletExpected extends Command
	{
	/**
	* The name and signature of the console command.
	*
	* @var string
	*/
	protected $signature = 'wallet:expected {--user=} {--non-zero}';

	/**
	* The console command description.
	*
	* @var string
	*/
	protected $description = 'Show expected charges to wallets (for user)';

	/**
	* Execute the console command.
	*
	* @return mixed
	*/
	public function handle()
	{
	if ($this->option('user')) {
	$user = $this->getUser($this->option('user'));

	if (!$user) {
	return 1;
	}

	$wallets = $user->wallets;
	} else {
	$wallets = \App\Wallet::select('wallets.*')
	->join('users', 'users.id', '=', 'wallets.user_id')
	- ->withEnvTenant('users')
	+ ->withEnvTenantContext('users')
	->all();
	}

	foreach ($wallets as $wallet) {
	$charge = 0;
	$expected = $wallet->expectedCharges();

	if (!$wallet->owner) {
	\Log::debug("{$wallet->id} has no owner: {$wallet->user_id}");
	continue;
	}

	if ($this->option('non-zero') && $expected < 1) {
	continue;
	}

	$this->info(
	sprintf(
	"expect charging wallet %s for user %s with %d",
	$wallet->id,
	$wallet->owner->email,
	$expected
	)
	);
	}
	}
	}
	diff --git a/src/app/Console/Development/UserStatus.php b/src/app/Console/Development/UserStatus.php
	deleted file mode 100644
	index c81c73bd..00000000
	--- a/src/app/Console/Development/UserStatus.php
	+++ /dev/null
	@@ -1,86 +0,0 @@
	-<?php
	-
	-namespace App\Console\Development;
	-
	-use App\User;
	-use Illuminate\Console\Command;
	-
	-class UserStatus extends Command
	-{
	- /**
	- * The name and signature of the console command.
	- *
	- * @var string
	- */
	- protected $signature = 'user:status {userid} {--add=} {--del=}';
	-
	- /**
	- * The console command description.
	- *
	- * @var string
	- */
	- protected $description = "Set/get a user's status.";
	-
	- /**
	- * Create a new command instance.
	- *
	- * @return void
	- */
	- public function __construct()
	- {
	- parent::__construct();
	- }
	-
	- /**
	- * Execute the console command.
	- *
	- * @return mixed
	- */
	- public function handle()
	- {
	- $user = User::where('email', $this->argument('userid'))->firstOrFail();
	-
	- $this->info("Found user: {$user->id}");
	-
	- $statuses = [
	- 'active' => User::STATUS_ACTIVE,
	- 'suspended' => User::STATUS_SUSPENDED,
	- 'deleted' => User::STATUS_DELETED,
	- 'ldapReady' => User::STATUS_LDAP_READY,
	- 'imapReady' => User::STATUS_IMAP_READY,
	- ];
	-
	- // I'd prefer "-state" and "+state" syntax, but it's not possible
	- $delete = false;
	- if ($update = $this->option('del')) {
	- $delete = true;
	- } elseif ($update = $this->option('add')) {
	- // do nothing
	- }
	-
	- if (!empty($update)) {
	- $map = \array_change_key_case($statuses);
	- $update = \strtolower($update);
	-
	- if (isset($map[$update])) {
	- if ($delete && $user->status & $map[$update]) {
	- $user->status ^= $map[$update];
	- $user->save();
	- } elseif (!$delete && !($user->status & $map[$update])) {
	- $user->status \|= $map[$update];
	- $user->save();
	- }
	- }
	- }
	-
	- $user_state = [];
	- foreach (\array_keys($statuses) as $state) {
	- $func = 'is' . \ucfirst($state);
	- if ($user->$func()) {
	- $user_state[] = $state;
	- }
	- }
	-
	- $this->info("Status: " . \implode(',', $user_state));
	- }
	-}
	diff --git a/src/app/Console/ObjectDeleteCommand.php b/src/app/Console/ObjectDeleteCommand.php
	index 098d2097..f24e9042 100644
	--- a/src/app/Console/ObjectDeleteCommand.php
	+++ b/src/app/Console/ObjectDeleteCommand.php
	@@ -1,95 +1,109 @@
	<?php

	namespace App\Console;

	use Illuminate\Database\Eloquent\SoftDeletes;
	use Illuminate\Support\Facades\Schema;

	/**
	* This abstract class provides a means to treat objects in our model using CRUD.
	*/
	abstract class ObjectDeleteCommand extends ObjectCommand
	{
	public function __construct()
	{
	$this->description = "Delete a {$this->objectName}";
	$this->signature = sprintf(
	"%s%s:delete {%s}",
	$this->commandPrefix ? $this->commandPrefix . ":" : "",
	$this->objectName,
	$this->objectName
	);

	$class = new $this->objectClass();

	try {
	foreach (Schema::getColumnListing($class->getTable()) as $column) {
	if ($column == "id") {
	continue;
	}

	$this->signature .= " {--{$column}=}";
	}
	} catch (\Exception $e) {
	\Log::error("Could not extract options: {$e->getMessage()}");
	}

	$classes = class_uses_recursive($this->objectClass);

	+ if (in_array(SoftDeletes::class, $classes)) {
	+ $this->signature .= " {--with-deleted : Consider deleted {$this->objectName}s}";
	+ }
	+
	parent::__construct();
	}

	public function getProperties()
	{
	if (!empty($this->properties)) {
	return $this->properties;
	}

	$class = new $this->objectClass();

	$this->properties = [];

	foreach (Schema::getColumnListing($class->getTable()) as $column) {
	if ($column == "id") {
	continue;
	}

	if (($value = $this->option($column)) !== null) {
	$this->properties[$column] = $value;
	}
	}

	return $this->properties;
	}

	/**
	* Execute the console command.
	*
	* @return mixed
	*/
	public function handle()
	{
	$result = parent::handle();

	if (!$result) {
	return 1;
	}

	$argument = $this->argument($this->objectName);

	$object = $this->getObject($this->objectClass, $argument, $this->objectTitle);

	if (!$object) {
	$this->error("No such {$this->objectName} {$argument}");
	return 1;
	}

	if ($this->commandPrefix == 'scalpel') {
	$this->objectClass::withoutEvents(
	function () use ($object) {
	- $object->delete();
	+ if ($object->deleted_at) {
	+ $object->forceDelete();
	+ } else {
	+ $object->delete();
	+ }
	}
	);
	+ } else {
	+ if ($object->deleted_at) {
	+ $object->forceDelete();
	+ } else {
	+ $object->delete();
	+ }
	}
	}
	}
	diff --git a/src/app/Domain.php b/src/app/Domain.php
	index 2da10979..5b3ce1c2 100644
	--- a/src/app/Domain.php
	+++ b/src/app/Domain.php
	@@ -1,464 +1,501 @@
	<?php

	namespace App;

	use App\Wallet;
	use Illuminate\Database\Eloquent\Model;
	use Illuminate\Database\Eloquent\SoftDeletes;

	/**
	* The eloquent definition of a Domain.
	*
	* @property string $namespace
	* @property int $status
	* @property int $tenant_id
	* @property int $type
	*/
	class Domain extends Model
	{
	use SoftDeletes;

	// we've simply never heard of this domain
	public const STATUS_NEW = 1 << 0;
	// it's been activated
	public const STATUS_ACTIVE = 1 << 1;
	// domain has been suspended.
	public const STATUS_SUSPENDED = 1 << 2;
	// domain has been deleted
	public const STATUS_DELETED = 1 << 3;
	// ownership of the domain has been confirmed
	public const STATUS_CONFIRMED = 1 << 4;
	// domain has been verified that it exists in DNS
	public const STATUS_VERIFIED = 1 << 5;
	// domain has been created in LDAP
	public const STATUS_LDAP_READY = 1 << 6;

	// open for public registration
	public const TYPE_PUBLIC = 1 << 0;
	// zone hosted with us
	public const TYPE_HOSTED = 1 << 1;
	// zone registered externally
	public const TYPE_EXTERNAL = 1 << 2;

	public const HASH_CODE = 1;
	public const HASH_TEXT = 2;
	public const HASH_CNAME = 3;

	public $incrementing = false;

	protected $keyType = 'bigint';

	protected $fillable = [
	'namespace',
	'status',
	'type'
	];

	/**
	* Assign a package to a domain. The domain should not belong to any existing entitlements.
	*
	* @param \App\Package $package The package to assign.
	* @param \App\User $user The wallet owner.
	*
	* @return \App\Domain Self
	*/
	public function assignPackage($package, $user)
	{
	// If this domain is public it can not be assigned to a user.
	if ($this->isPublic()) {
	return $this;
	}

	// See if this domain is already owned by another user.
	$wallet = $this->wallet();

	if ($wallet) {
	\Log::error(
	"Domain {$this->namespace} is already assigned to {$wallet->owner->email}"
	);

	return $this;
	}

	$wallet_id = $user->wallets()->first()->id;

	foreach ($package->skus as $sku) {
	for ($i = $sku->pivot->qty; $i > 0; $i--) {
	\App\Entitlement::create(
	[
	'wallet_id' => $wallet_id,
	'sku_id' => $sku->id,
	'cost' => $sku->pivot->cost(),
	'fee' => $sku->pivot->fee(),
	'entitleable_id' => $this->id,
	'entitleable_type' => Domain::class
	]
	);
	}
	}

	return $this;
	}

	/**
	* The domain entitlement.
	*
	* @return \Illuminate\Database\Eloquent\Relations\MorphOne
	*/
	public function entitlement()
	{
	return $this->morphOne('App\Entitlement', 'entitleable');
	}

	/**
	* Return list of public+active domain names (for current tenant)
	*/
	public static function getPublicDomains(): array
	{
	- return self::withEnvTenant()
	+ return self::withEnvTenantContext()
	->whereRaw(sprintf('(type & %s)', Domain::TYPE_PUBLIC))
	->get(['namespace'])->pluck('namespace')->toArray();
	}

	/**
	* Returns whether this domain is active.
	*
	* @return bool
	*/
	public function isActive(): bool
	{
	return ($this->status & self::STATUS_ACTIVE) > 0;
	}

	/**
	* Returns whether this domain is confirmed the ownership of.
	*
	* @return bool
	*/
	public function isConfirmed(): bool
	{
	return ($this->status & self::STATUS_CONFIRMED) > 0;
	}

	/**
	* Returns whether this domain is deleted.
	*
	* @return bool
	*/
	public function isDeleted(): bool
	{
	return ($this->status & self::STATUS_DELETED) > 0;
	}

	/**
	* Returns whether this domain is registered with us.
	*
	* @return bool
	*/
	public function isExternal(): bool
	{
	return ($this->type & self::TYPE_EXTERNAL) > 0;
	}

	/**
	* Returns whether this domain is hosted with us.
	*
	* @return bool
	*/
	public function isHosted(): bool
	{
	return ($this->type & self::TYPE_HOSTED) > 0;
	}

	/**
	* Returns whether this domain is new.
	*
	* @return bool
	*/
	public function isNew(): bool
	{
	return ($this->status & self::STATUS_NEW) > 0;
	}

	/**
	* Returns whether this domain is public.
	*
	* @return bool
	*/
	public function isPublic(): bool
	{
	return ($this->type & self::TYPE_PUBLIC) > 0;
	}

	/**
	* Returns whether this domain is registered in LDAP.
	*
	* @return bool
	*/
	public function isLdapReady(): bool
	{
	return ($this->status & self::STATUS_LDAP_READY) > 0;
	}

	/**
	* Returns whether this domain is suspended.
	*
	* @return bool
	*/
	public function isSuspended(): bool
	{
	return ($this->status & self::STATUS_SUSPENDED) > 0;
	}

	/**
	* Returns whether this (external) domain has been verified
	* to exist in DNS.
	*
	* @return bool
	*/
	public function isVerified(): bool
	{
	return ($this->status & self::STATUS_VERIFIED) > 0;
	}

	/**
	* Ensure the namespace is appropriately cased.
	*/
	public function setNamespaceAttribute($namespace)
	{
	$this->attributes['namespace'] = strtolower($namespace);
	}

	/**
	* Domain status mutator
	*
	* @throws \Exception
	*/
	public function setStatusAttribute($status)
	{
	$new_status = 0;

	$allowed_values = [
	self::STATUS_NEW,
	self::STATUS_ACTIVE,
	self::STATUS_SUSPENDED,
	self::STATUS_DELETED,
	self::STATUS_CONFIRMED,
	self::STATUS_VERIFIED,
	self::STATUS_LDAP_READY,
	];

	foreach ($allowed_values as $value) {
	if ($status & $value) {
	$new_status \|= $value;
	$status ^= $value;
	}
	}

	if ($status > 0) {
	throw new \Exception("Invalid domain status: {$status}");
	}

	if ($this->isPublic()) {
	$this->attributes['status'] = $new_status;
	return;
	}

	if ($new_status & self::STATUS_CONFIRMED) {
	// if we have confirmed ownership of or management access to the domain, then we have
	// also confirmed the domain exists in DNS.
	$new_status \|= self::STATUS_VERIFIED;
	$new_status \|= self::STATUS_ACTIVE;
	}

	if ($new_status & self::STATUS_DELETED && $new_status & self::STATUS_ACTIVE) {
	$new_status ^= self::STATUS_ACTIVE;
	}

	if ($new_status & self::STATUS_SUSPENDED && $new_status & self::STATUS_ACTIVE) {
	$new_status ^= self::STATUS_ACTIVE;
	}

	// if the domain is now active, it is not new anymore.
	if ($new_status & self::STATUS_ACTIVE && $new_status & self::STATUS_NEW) {
	$new_status ^= self::STATUS_NEW;
	}

	$this->attributes['status'] = $new_status;
	}

	/**
	* Ownership verification by checking for a TXT (or CNAME) record
	* in the domain's DNS (that matches the verification hash).
	*
	* @return bool True if verification was successful, false otherwise
	* @throws \Exception Throws exception on DNS or DB errors
	*/
	public function confirm(): bool
	{
	if ($this->isConfirmed()) {
	return true;
	}

	$hash = $this->hash(self::HASH_TEXT);
	$confirmed = false;

	// Get DNS records and find a matching TXT entry
	$records = \dns_get_record($this->namespace, DNS_TXT);

	if ($records === false) {
	throw new \Exception("Failed to get DNS record for {$this->namespace}");
	}

	foreach ($records as $record) {
	if ($record['txt'] === $hash) {
	$confirmed = true;
	break;
	}
	}

	// Get DNS records and find a matching CNAME entry
	// Note: some servers resolve every non-existing name
	// so we need to define left and right side of the CNAME record
	// i.e.: kolab-verify IN CNAME <hash>.domain.tld.
	if (!$confirmed) {
	$cname = $this->hash(self::HASH_CODE) . '.' . $this->namespace;
	$records = \dns_get_record('kolab-verify.' . $this->namespace, DNS_CNAME);

	if ($records === false) {
	throw new \Exception("Failed to get DNS record for {$this->namespace}");
	}

	foreach ($records as $records) {
	if ($records['target'] === $cname) {
	$confirmed = true;
	break;
	}
	}
	}

	if ($confirmed) {
	$this->status \|= Domain::STATUS_CONFIRMED;
	$this->save();
	}

	return $confirmed;
	}

	/**
	* Generate a verification hash for this domain
	*
	* @param int $mod One of: HASH_CNAME, HASH_CODE (Default), HASH_TEXT
	*
	* @return string Verification hash
	*/
	public function hash($mod = null): string
	{
	$cname = 'kolab-verify';

	if ($mod === self::HASH_CNAME) {
	return $cname;
	}

	$hash = \md5('hkccp-verify-' . $this->namespace);

	return $mod === self::HASH_TEXT ? "$cname=$hash" : $hash;
	}

	/**
	* Suspend this domain.
	*
	* @return void
	*/
	public function suspend(): void
	{
	if ($this->isSuspended()) {
	return;
	}

	$this->status \|= Domain::STATUS_SUSPENDED;
	$this->save();
	}

	/**
	* The tenant for this domain.
	*
	* @return \Illuminate\Database\Eloquent\Relations\BelongsTo
	*/
	public function tenant()
	{
	return $this->belongsTo('App\Tenant', 'tenant_id', 'id');
	}

	/**
	* Unsuspend this domain.
	*
	* The domain is unsuspended through either of the following courses of actions;
	*
	* * The account balance has been topped up, or
	* * a suspected spammer has resolved their issues, or
	* * the command-line is triggered.
	*
	* Therefore, we can also confidently set the domain status to 'active' should the ownership of or management
	* access to have been confirmed before.
	*
	* @return void
	*/
	public function unsuspend(): void
	{
	if (!$this->isSuspended()) {
	return;
	}

	$this->status ^= Domain::STATUS_SUSPENDED;

	if ($this->isConfirmed() && $this->isVerified()) {
	$this->status \|= Domain::STATUS_ACTIVE;
	}

	$this->save();
	}

	+ /**
	+ * List the users of a domain, so long as the domain is not a public registration domain.
	+ *
	+ * @return array
	+ */
	+ public function users(): array
	+ {
	+ if ($this->isPublic()) {
	+ return [];
	+ }
	+
	+ $wallet = $this->wallet();
	+
	+ if (!$wallet) {
	+ return [];
	+ }
	+
	+ $mailboxSKU = \App\Sku::withObjectTenantContext($this)->where('title', 'mailbox')->first();
	+
	+ if (!$mailboxSKU) {
	+ \Log::error("No mailbox SKU available.");
	+ return [];
	+ }
	+
	+ $entitlements = $wallet->entitlements()
	+ ->where('entitleable_type', \App\User::class)
	+ ->where('sku_id', $mailboxSKU->id)->get();
	+
	+ $users = [];
	+
	+ foreach ($entitlements as $entitlement) {
	+ $users[] = $entitlement->entitleable;
	+ }
	+
	+ return $users;
	+ }
	+
	/**
	* Verify if a domain exists in DNS
	*
	* @return bool True if registered, False otherwise
	* @throws \Exception Throws exception on DNS or DB errors
	*/
	public function verify(): bool
	{
	if ($this->isVerified()) {
	return true;
	}

	$records = \dns_get_record($this->namespace, DNS_ANY);

	if ($records === false) {
	throw new \Exception("Failed to get DNS record for {$this->namespace}");
	}

	// It may happen that result contains other domains depending on the host DNS setup
	// that's why in_array() and not just !empty()
	if (in_array($this->namespace, array_column($records, 'host'))) {
	$this->status \|= Domain::STATUS_VERIFIED;
	$this->save();

	return true;
	}

	return false;
	}

	/**
	* Returns the wallet by which the domain is controlled
	*
	* @return \App\Wallet A wallet object
	*/
	public function wallet(): ?Wallet
	{
	// Note: Not all domains have a entitlement/wallet
	$entitlement = $this->entitlement()->withTrashed()->orderBy('created_at', 'desc')->first();

	return $entitlement ? $entitlement->wallet : null;
	}
	}
	diff --git a/src/app/Group.php b/src/app/Group.php
	index 06db042e..a131f742 100644
	--- a/src/app/Group.php
	+++ b/src/app/Group.php
	@@ -1,292 +1,292 @@
	<?php

	namespace App;

	use App\Wallet;
	use Illuminate\Database\Eloquent\Model;
	use Illuminate\Database\Eloquent\SoftDeletes;

	/**
	* The eloquent definition of a Group.
	*
	* @property int $id The group identifier
	* @property string $email An email address
	* @property string $members A comma-separated list of email addresses
	* @property int $status The group status
	* @property int $tenant_id Tenant identifier
	*/
	class Group extends Model
	{
	use SoftDeletes;

	// we've simply never heard of this domain
	public const STATUS_NEW = 1 << 0;
	// it's been activated
	public const STATUS_ACTIVE = 1 << 1;
	// domain has been suspended.
	public const STATUS_SUSPENDED = 1 << 2;
	// domain has been deleted
	public const STATUS_DELETED = 1 << 3;
	// domain has been created in LDAP
	public const STATUS_LDAP_READY = 1 << 4;

	public $incrementing = false;

	protected $keyType = 'bigint';

	protected $fillable = [
	'email',
	'status',
	'members'
	];

	/**
	* Assign the group to a wallet.
	*
	* @param \App\Wallet $wallet The wallet
	*
	* @return \App\Group Self
	* @throws \Exception
	*/
	public function assignToWallet(Wallet $wallet): Group
	{
	if (empty($this->id)) {
	throw new \Exception("Group not yet exists");
	}

	if ($this->entitlement()->count()) {
	throw new \Exception("Group already assigned to a wallet");
	}

	- $sku = \App\Sku::where('title', 'group')->first();
	+ $sku = \App\Sku::withObjectTenantContext($this)->where('title', 'group')->first();
	$exists = $wallet->entitlements()->where('sku_id', $sku->id)->count();

	\App\Entitlement::create([
	'wallet_id' => $wallet->id,
	'sku_id' => $sku->id,
	'cost' => $exists >= $sku->units_free ? $sku->cost : 0,
	'fee' => $exists >= $sku->units_free ? $sku->fee : 0,
	'entitleable_id' => $this->id,
	'entitleable_type' => Group::class
	]);

	return $this;
	}

	/**
	* Returns group domain.
	*
	* @return ?\App\Domain The domain group belongs to, NULL if it does not exist
	*/
	public function domain(): ?Domain
	{
	list($local, $domainName) = explode('@', $this->email);

	return Domain::where('namespace', $domainName)->first();
	}

	/**
	* Find whether an email address exists as a group (including deleted groups).
	*
	* @param string $email Email address
	* @param bool $return_group Return Group instance instead of boolean
	*
	* @return \App\Group\|bool True or Group model object if found, False otherwise
	*/
	public static function emailExists(string $email, bool $return_group = false)
	{
	if (strpos($email, '@') === false) {
	return false;
	}

	$email = \strtolower($email);

	$group = self::withTrashed()->where('email', $email)->first();

	if ($group) {
	return $return_group ? $group : true;
	}

	return false;
	}

	/**
	* The group entitlement.
	*
	* @return \Illuminate\Database\Eloquent\Relations\MorphOne
	*/
	public function entitlement()
	{
	return $this->morphOne('App\Entitlement', 'entitleable');
	}

	/**
	* Group members propert accessor. Converts internal comma-separated list into an array
	*
	* @param string $members Comma-separated list of email addresses
	*
	* @return array Email addresses of the group members, as an array
	*/
	public function getMembersAttribute($members): array
	{
	return $members ? explode(',', $members) : [];
	}

	/**
	* Returns whether this domain is active.
	*
	* @return bool
	*/
	public function isActive(): bool
	{
	return ($this->status & self::STATUS_ACTIVE) > 0;
	}

	/**
	* Returns whether this domain is deleted.
	*
	* @return bool
	*/
	public function isDeleted(): bool
	{
	return ($this->status & self::STATUS_DELETED) > 0;
	}

	/**
	* Returns whether this domain is new.
	*
	* @return bool
	*/
	public function isNew(): bool
	{
	return ($this->status & self::STATUS_NEW) > 0;
	}

	/**
	* Returns whether this domain is registered in LDAP.
	*
	* @return bool
	*/
	public function isLdapReady(): bool
	{
	return ($this->status & self::STATUS_LDAP_READY) > 0;
	}

	/**
	* Returns whether this domain is suspended.
	*
	* @return bool
	*/
	public function isSuspended(): bool
	{
	return ($this->status & self::STATUS_SUSPENDED) > 0;
	}

	/**
	* Ensure the email is appropriately cased.
	*
	* @param string $email Group email address
	*/
	public function setEmailAttribute(string $email)
	{
	$this->attributes['email'] = strtolower($email);
	}

	/**
	* Ensure the members are appropriately formatted.
	*
	* @param array $members Email addresses of the group members
	*/
	public function setMembersAttribute(array $members): void
	{
	$members = array_unique(array_filter(array_map('strtolower', $members)));

	sort($members);

	$this->attributes['members'] = implode(',', $members);
	}

	/**
	* Group status mutator
	*
	* @throws \Exception
	*/
	public function setStatusAttribute($status)
	{
	$new_status = 0;

	$allowed_values = [
	self::STATUS_NEW,
	self::STATUS_ACTIVE,
	self::STATUS_SUSPENDED,
	self::STATUS_DELETED,
	self::STATUS_LDAP_READY,
	];

	foreach ($allowed_values as $value) {
	if ($status & $value) {
	$new_status \|= $value;
	$status ^= $value;
	}
	}

	if ($status > 0) {
	throw new \Exception("Invalid group status: {$status}");
	}

	$this->attributes['status'] = $new_status;
	}

	/**
	* Suspend this group.
	*
	* @return void
	*/
	public function suspend(): void
	{
	if ($this->isSuspended()) {
	return;
	}

	$this->status \|= Group::STATUS_SUSPENDED;
	$this->save();
	}

	/**
	* The tenant for this group.
	*
	* @return \Illuminate\Database\Eloquent\Relations\BelongsTo
	*/
	public function tenant()
	{
	return $this->belongsTo('App\Tenant', 'tenant_id', 'id');
	}

	/**
	* Unsuspend this group.
	*
	* @return void
	*/
	public function unsuspend(): void
	{
	if (!$this->isSuspended()) {
	return;
	}

	$this->status ^= Group::STATUS_SUSPENDED;
	$this->save();
	}

	/**
	* Returns the wallet by which the group is controlled
	*
	* @return \App\Wallet A wallet object
	*/
	public function wallet(): ?Wallet
	{
	// Note: Not all domains have a entitlement/wallet
	$entitlement = $this->entitlement()->withTrashed()->orderBy('created_at', 'desc')->first();

	return $entitlement ? $entitlement->wallet : null;
	}
	}
	diff --git a/src/app/Handlers/Beta/Base.php b/src/app/Handlers/Beta/Base.php
	index 59130120..ea2cc882 100644
	--- a/src/app/Handlers/Beta/Base.php
	+++ b/src/app/Handlers/Beta/Base.php
	@@ -1,73 +1,66 @@
	<?php

	namespace App\Handlers\Beta;

	class Base extends \App\Handlers\Base
	{
	/**
	* Check if the SKU is available to the user.
	*
	* @param \App\Sku $sku The SKU object
	* @param \App\User $user The user object
	*
	* @return bool
	*/
	public static function isAvailable(\App\Sku $sku, \App\User $user): bool
	{
	// These SKUs must be:
	// 1) already assigned or
	// 2) active and a 'beta' entitlement must exist.

	if ($sku->active) {
	- $beta = \App\Sku::where('title', 'beta')->first();
	- if (!$beta) {
	- return false;
	- }
	-
	- if ($user->entitlements()->where('sku_id', $beta->id)->first()) {
	- return true;
	- }
	+ return $user->hasSku('beta');
	} else {
	if ($user->entitlements()->where('sku_id', $sku->id)->first()) {
	return true;
	}
	}

	return false;
	}

	/**
	* SKU handler metadata.
	*
	* @param \App\Sku $sku The SKU object
	*
	* @return array
	*/
	public static function metadata(\App\Sku $sku): array
	{
	$data = parent::metadata($sku);

	$data['required'] = ['beta'];

	return $data;
	}

	/**
	* Prerequisites for the Entitlement to be applied to the object.
	*
	* @param \App\Entitlement $entitlement
	* @param mixed $object
	*
	* @return bool
	*/
	public static function preReq($entitlement, $object): bool
	{
	if (!parent::preReq($entitlement, $object)) {
	return false;
	}

	// TODO: User has to have the "beta" entitlement

	return true;
	}
	}
	diff --git a/src/app/Http/Controllers/API/SignupController.php b/src/app/Http/Controllers/API/SignupController.php
	index faa4fe11..d552b1c1 100644
	--- a/src/app/Http/Controllers/API/SignupController.php
	+++ b/src/app/Http/Controllers/API/SignupController.php
	@@ -1,447 +1,448 @@
	<?php

	namespace App\Http\Controllers\API;

	use App\Http\Controllers\Controller;
	use App\Jobs\SignupVerificationEmail;
	use App\Jobs\SignupVerificationSMS;
	use App\Discount;
	use App\Domain;
	use App\Plan;
	use App\Rules\ExternalEmail;
	use App\Rules\UserEmailDomain;
	use App\Rules\UserEmailLocal;
	use App\SignupCode;
	use App\SignupInvitation;
	use App\User;
	use Illuminate\Http\Request;
	use Illuminate\Support\Facades\DB;
	use Illuminate\Support\Facades\Validator;
	use Illuminate\Support\Str;

	/**
	* Signup process API
	*/
	class SignupController extends Controller
	{
	/** @var ?\App\SignupCode A verification code object */
	protected $code;

	/** @var ?\App\Plan Signup plan object */
	protected $plan;


	/**
	* Returns plans definitions for signup.
	*
	* @param \Illuminate\Http\Request $request HTTP request
	*
	* @return \Illuminate\Http\JsonResponse JSON response
	*/
	public function plans(Request $request)
	{
	$plans = [];

	// Use reverse order just to have individual on left, group on right ;)
	- Plan::select()->orderByDesc('title')->get()->map(function ($plan) use (&$plans) {
	- $plans[] = [
	- 'title' => $plan->title,
	- 'name' => $plan->name,
	- 'button' => __('app.planbutton', ['plan' => $plan->name]),
	- 'description' => $plan->description,
	- ];
	- });
	+ Plan::withEnvTenantContext()->orderByDesc('title')->get()
	+ ->map(function ($plan) use (&$plans) {
	+ $plans[] = [
	+ 'title' => $plan->title,
	+ 'name' => $plan->name,
	+ 'button' => __('app.planbutton', ['plan' => $plan->name]),
	+ 'description' => $plan->description,
	+ ];
	+ });

	return response()->json(['status' => 'success', 'plans' => $plans]);
	}

	/**
	* Starts signup process.
	*
	* Verifies user name and email/phone, sends verification email/sms message.
	* Returns the verification code.
	*
	* @param \Illuminate\Http\Request $request HTTP request
	*
	* @return \Illuminate\Http\JsonResponse JSON response
	*/
	public function init(Request $request)
	{
	// Check required fields
	$v = Validator::make(
	$request->all(),
	[
	'email' => 'required',
	'first_name' => 'max:128',
	'last_name' => 'max:128',
	'plan' => 'nullable\|alpha_num\|max:128',
	'voucher' => 'max:32',
	]
	);

	$is_phone = false;
	$errors = $v->fails() ? $v->errors()->toArray() : [];

	// Validate user email (or phone)
	if (empty($errors['email'])) {
	if ($error = $this->validatePhoneOrEmail($request->email, $is_phone)) {
	$errors['email'] = $error;
	}
	}

	if (!empty($errors)) {
	return response()->json(['status' => 'error', 'errors' => $errors], 422);
	}

	// Generate the verification code
	$code = SignupCode::create([
	'email' => $request->email,
	'first_name' => $request->first_name,
	'last_name' => $request->last_name,
	'plan' => $request->plan,
	'voucher' => $request->voucher,
	]);

	// Send email/sms message
	if ($is_phone) {
	SignupVerificationSMS::dispatch($code);
	} else {
	SignupVerificationEmail::dispatch($code);
	}

	return response()->json(['status' => 'success', 'code' => $code->code]);
	}

	/**
	* Returns signup invitation information.
	*
	* @param string $id Signup invitation identifier
	*
	* @return \Illuminate\Http\JsonResponse\|void
	*/
	public function invitation($id)
	{
	- $invitation = SignupInvitation::withEnvTenant()->find($id);
	+ $invitation = SignupInvitation::withEnvTenantContext()->find($id);

	if (empty($invitation) \|\| $invitation->isCompleted()) {
	return $this->errorResponse(404);
	}

	$has_domain = $this->getPlan()->hasDomain();

	$result = [
	'id' => $id,
	'is_domain' => $has_domain,
	'domains' => $has_domain ? [] : Domain::getPublicDomains(),
	];

	return response()->json($result);
	}


	/**
	* Validation of the verification code.
	*
	* @param \Illuminate\Http\Request $request HTTP request
	*
	* @return \Illuminate\Http\JsonResponse JSON response
	*/
	public function verify(Request $request)
	{
	// Validate the request args
	$v = Validator::make(
	$request->all(),
	[
	'code' => 'required',
	'short_code' => 'required',
	]
	);

	if ($v->fails()) {
	return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
	}

	// Validate the verification code
	$code = SignupCode::find($request->code);

	if (
	empty($code)
	\|\| $code->isExpired()
	\|\| Str::upper($request->short_code) !== Str::upper($code->short_code)
	) {
	$errors = ['short_code' => "The code is invalid or expired."];
	return response()->json(['status' => 'error', 'errors' => $errors], 422);
	}

	// For signup last-step mode remember the code object, so we can delete it
	// with single SQL query (->delete()) instead of two (::destroy())
	$this->code = $code;

	$has_domain = $this->getPlan()->hasDomain();

	// Return user name and email/phone/voucher from the codes database,
	// domains list for selection and "plan type" flag
	return response()->json([
	'status' => 'success',
	'email' => $code->email,
	'first_name' => $code->first_name,
	'last_name' => $code->last_name,
	'voucher' => $code->voucher,
	'is_domain' => $has_domain,
	'domains' => $has_domain ? [] : Domain::getPublicDomains(),
	]);
	}

	/**
	* Finishes the signup process by creating the user account.
	*
	* @param \Illuminate\Http\Request $request HTTP request
	*
	* @return \Illuminate\Http\JsonResponse JSON response
	*/
	public function signup(Request $request)
	{
	// Validate input
	$v = Validator::make(
	$request->all(),
	[
	'login' => 'required\|min:2',
	'password' => 'required\|min:4\|confirmed',
	'domain' => 'required',
	'voucher' => 'max:32',
	]
	);

	if ($v->fails()) {
	return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
	}

	// Signup via invitation
	if ($request->invitation) {
	- $invitation = SignupInvitation::withEnvTenant()->find($request->invitation);
	+ $invitation = SignupInvitation::withEnvTenantContext()->find($request->invitation);

	if (empty($invitation) \|\| $invitation->isCompleted()) {
	return $this->errorResponse(404);
	}

	// Check required fields
	$v = Validator::make(
	$request->all(),
	[
	'first_name' => 'max:128',
	'last_name' => 'max:128',
	'voucher' => 'max:32',
	]
	);

	$errors = $v->fails() ? $v->errors()->toArray() : [];

	if (!empty($errors)) {
	return response()->json(['status' => 'error', 'errors' => $errors], 422);
	}

	$settings = [
	'external_email' => $invitation->email,
	'first_name' => $request->first_name,
	'last_name' => $request->last_name,
	];
	} else {
	// Validate verification codes (again)
	$v = $this->verify($request);
	if ($v->status() !== 200) {
	return $v;
	}

	// Get user name/email from the verification code database
	$code_data = $v->getData();

	$settings = [
	'external_email' => $code_data->email,
	'first_name' => $code_data->first_name,
	'last_name' => $code_data->last_name,
	];
	}

	// Find the voucher discount
	if ($request->voucher) {
	$discount = Discount::where('code', \strtoupper($request->voucher))
	->where('active', true)->first();

	if (!$discount) {
	$errors = ['voucher' => \trans('validation.voucherinvalid')];
	return response()->json(['status' => 'error', 'errors' => $errors], 422);
	}
	}

	// Get the plan
	$plan = $this->getPlan();
	$is_domain = $plan->hasDomain();

	$login = $request->login;
	$domain_name = $request->domain;

	// Validate login
	if ($errors = self::validateLogin($login, $domain_name, $is_domain)) {
	return response()->json(['status' => 'error', 'errors' => $errors], 422);
	}

	// We allow only ASCII, so we can safely lower-case the email address
	$login = Str::lower($login);
	$domain_name = Str::lower($domain_name);
	$domain = null;

	DB::beginTransaction();

	// Create domain record
	if ($is_domain) {
	$domain = Domain::create([
	'namespace' => $domain_name,
	'status' => Domain::STATUS_NEW,
	'type' => Domain::TYPE_EXTERNAL,
	]);
	}

	// Create user record
	$user = User::create([
	'email' => $login . '@' . $domain_name,
	'password' => $request->password,
	]);

	if (!empty($discount)) {
	$wallet = $user->wallets()->first();
	$wallet->discount()->associate($discount);
	$wallet->save();
	}

	$user->assignPlan($plan, $domain);

	// Save the external email and plan in user settings
	$user->setSettings($settings);

	// Update the invitation
	if (!empty($invitation)) {
	$invitation->status = SignupInvitation::STATUS_COMPLETED;
	$invitation->user_id = $user->id;
	$invitation->save();
	}

	// Remove the verification code
	if ($this->code) {
	$this->code->delete();
	}

	DB::commit();

	return AuthController::logonResponse($user);
	}

	/**
	* Returns plan for the signup process
	*
	* @returns \App\Plan Plan object selected for current signup process
	*/
	protected function getPlan()
	{
	if (!$this->plan) {
	// Get the plan if specified and exists...
	if ($this->code && $this->code->plan) {
	- $plan = Plan::where('title', $this->code->plan)->first();
	+ $plan = Plan::withEnvTenantContext()->where('title', $this->code->plan)->first();
	}

	// ...otherwise use the default plan
	if (empty($plan)) {
	// TODO: Get default plan title from config
	- $plan = Plan::where('title', 'individual')->first();
	+ $plan = Plan::withEnvTenantContext()->where('title', 'individual')->first();
	}

	$this->plan = $plan;
	}

	return $this->plan;
	}

	/**
	* Checks if the input string is a valid email address or a phone number
	*
	* @param string $input Email address or phone number
	* @param bool $is_phone Will have been set to True if the string is valid phone number
	*
	* @return string Error message on validation error
	*/
	protected static function validatePhoneOrEmail($input, &$is_phone = false): ?string
	{
	$is_phone = false;

	$v = Validator::make(
	['email' => $input],
	['email' => ['required', 'string', new ExternalEmail()]]
	);

	if ($v->fails()) {
	return $v->errors()->toArray()['email'][0];
	}

	// TODO: Phone number support
	/*
	$input = str_replace(array('-', ' '), '', $input);

	if (!preg_match('/^\+?[0-9]{9,12}$/', $input)) {
	return \trans('validation.noemailorphone');
	}

	$is_phone = true;
	*/
	return null;
	}

	/**
	* Login (kolab identity) validation
	*
	* @param string $login Login (local part of an email address)
	* @param string $domain Domain name
	* @param bool $external Enables additional checks for domain part
	*
	* @return array Error messages on validation error
	*/
	protected static function validateLogin($login, $domain, $external = false): ?array
	{
	// Validate login part alone
	$v = Validator::make(
	['login' => $login],
	['login' => ['required', 'string', new UserEmailLocal($external)]]
	);

	if ($v->fails()) {
	return ['login' => $v->errors()->toArray()['login'][0]];
	}

	$domains = $external ? null : Domain::getPublicDomains();

	// Validate the domain
	$v = Validator::make(
	['domain' => $domain],
	['domain' => ['required', 'string', new UserEmailDomain($domains)]]
	);

	if ($v->fails()) {
	return ['domain' => $v->errors()->toArray()['domain'][0]];
	}

	$domain = Str::lower($domain);

	// Check if domain is already registered with us
	if ($external) {
	if (Domain::where('namespace', $domain)->first()) {
	return ['domain' => \trans('validation.domainexists')];
	}
	}

	// Check if user with specified login already exists
	$email = $login . '@' . $domain;
	if (User::emailExists($email) \|\| User::aliasExists($email) \|\| \App\Group::emailExists($email)) {
	return ['login' => \trans('validation.loginexists')];
	}

	return null;
	}
	}
	diff --git a/src/app/Http/Controllers/API/V4/Admin/DiscountsController.php b/src/app/Http/Controllers/API/V4/Admin/DiscountsController.php
	index 072d4981..87f707d0 100644
	--- a/src/app/Http/Controllers/API/V4/Admin/DiscountsController.php
	+++ b/src/app/Http/Controllers/API/V4/Admin/DiscountsController.php
	@@ -1,45 +1,51 @@
	<?php

	namespace App\Http\Controllers\API\V4\Admin;

	use App\Discount;
	use App\Http\Controllers\Controller;

	class DiscountsController extends Controller
	{
	/**
	- * Returns (active) discounts defined in the system.
	+ * Returns (active) discounts defined in the system for the user context.
	+ *
	+ * @param int $id User identifier
	*
	* @return \Illuminate\Http\JsonResponse JSON response
	*/
	- public function index()
	+ public function userDiscounts($id)
	{
	- $discounts = [];
	+ $user = \App\User::find($id);
	+
	+ if (!$this->checkTenant($user)) {
	+ return $this->errorResponse(404);
	+ }

	- Discount::withEnvTenant()
	+ $discounts = Discount::withObjectTenantContext($user)
	->where('active', true)
	->orderBy('discount')
	->get()
	- ->map(function ($discount) use (&$discounts) {
	+ ->map(function ($discount) {
	$label = $discount->discount . '% - ' . $discount->description;

	if ($discount->code) {
	$label .= " [{$discount->code}]";
	}

	- $discounts[] = [
	+ return [
	'id' => $discount->id,
	'discount' => $discount->discount,
	'code' => $discount->code,
	'description' => $discount->description,
	'label' => $label,
	];
	});

	return response()->json([
	'status' => 'success',
	'list' => $discounts,
	'count' => count($discounts),
	]);
	}
	}
	diff --git a/src/app/Http/Controllers/API/V4/Admin/DomainsController.php b/src/app/Http/Controllers/API/V4/Admin/DomainsController.php
	index aead2568..5d09a4b1 100644
	--- a/src/app/Http/Controllers/API/V4/Admin/DomainsController.php
	+++ b/src/app/Http/Controllers/API/V4/Admin/DomainsController.php
	@@ -1,104 +1,104 @@
	<?php

	namespace App\Http\Controllers\API\V4\Admin;

	use App\Domain;
	use App\User;
	use Illuminate\Http\Request;

	class DomainsController extends \App\Http\Controllers\API\V4\DomainsController
	{
	/**
	* Search for domains
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function index()
	{
	$search = trim(request()->input('search'));
	$owner = trim(request()->input('owner'));
	$result = collect([]);

	if ($owner) {
	- if ($owner = User::withEnvTenant()->find($owner)) {
	+ if ($owner = User::find($owner)) {
	foreach ($owner->wallets as $wallet) {
	$entitlements = $wallet->entitlements()->where('entitleable_type', Domain::class)->get();

	foreach ($entitlements as $entitlement) {
	$domain = $entitlement->entitleable;
	$result->push($domain);
	}
	}

	$result = $result->sortBy('namespace')->values();
	}
	} elseif (!empty($search)) {
	- if ($domain = Domain::withEnvTenant()->where('namespace', $search)->first()) {
	+ if ($domain = Domain::where('namespace', $search)->first()) {
	$result->push($domain);
	}
	}

	// Process the result
	$result = $result->map(function ($domain) {
	$data = $domain->toArray();
	$data = array_merge($data, self::domainStatuses($domain));
	return $data;
	});

	$result = [
	'list' => $result,
	'count' => count($result),
	'message' => \trans('app.search-foundxdomains', ['x' => count($result)]),
	];

	return response()->json($result);
	}

	/**
	* Suspend the domain
	*
	* @param \Illuminate\Http\Request $request The API request.
	* @param string $id Domain identifier
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	public function suspend(Request $request, $id)
	{
	- $domain = Domain::withEnvTenant()->find($id);
	+ $domain = Domain::find($id);

	- if (empty($domain) \|\| $domain->isPublic()) {
	+ if (!$this->checkTenant($domain) \|\| $domain->isPublic()) {
	return $this->errorResponse(404);
	}

	$domain->suspend();

	return response()->json([
	'status' => 'success',
	'message' => __('app.domain-suspend-success'),
	]);
	}

	/**
	* Un-Suspend the domain
	*
	* @param \Illuminate\Http\Request $request The API request.
	* @param string $id Domain identifier
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	public function unsuspend(Request $request, $id)
	{
	- $domain = Domain::withEnvTenant()->find($id);
	+ $domain = Domain::find($id);

	- if (empty($domain) \|\| $domain->isPublic()) {
	+ if (!$this->checkTenant($domain) \|\| $domain->isPublic()) {
	return $this->errorResponse(404);
	}

	$domain->unsuspend();

	return response()->json([
	'status' => 'success',
	'message' => __('app.domain-unsuspend-success'),
	]);
	}
	}
	diff --git a/src/app/Http/Controllers/API/V4/Admin/GroupsController.php b/src/app/Http/Controllers/API/V4/Admin/GroupsController.php
	index 4dc5d03b..7489ca0a 100644
	--- a/src/app/Http/Controllers/API/V4/Admin/GroupsController.php
	+++ b/src/app/Http/Controllers/API/V4/Admin/GroupsController.php
	@@ -1,118 +1,118 @@
	<?php

	namespace App\Http\Controllers\API\V4\Admin;

	use App\Group;
	use App\User;
	use Illuminate\Http\Request;

	class GroupsController extends \App\Http\Controllers\API\V4\GroupsController
	{
	/**
	* Search for groups
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function index()
	{
	$search = trim(request()->input('search'));
	$owner = trim(request()->input('owner'));
	$result = collect([]);

	if ($owner) {
	- if ($owner = User::withEnvTenant()->find($owner)) {
	+ if ($owner = User::find($owner)) {
	foreach ($owner->wallets as $wallet) {
	$wallet->entitlements()->where('entitleable_type', Group::class)->get()
	->each(function ($entitlement) use ($result) {
	$result->push($entitlement->entitleable);
	});
	}

	$result = $result->sortBy('namespace')->values();
	}
	} elseif (!empty($search)) {
	- if ($group = Group::withEnvTenant()->where('email', $search)->first()) {
	+ if ($group = Group::where('email', $search)->first()) {
	$result->push($group);
	}
	}

	// Process the result
	$result = $result->map(function ($group) {
	$data = [
	'id' => $group->id,
	'email' => $group->email,
	];

	$data = array_merge($data, self::groupStatuses($group));
	return $data;
	});

	$result = [
	'list' => $result,
	'count' => count($result),
	'message' => \trans('app.search-foundxdistlists', ['x' => count($result)]),
	];

	return response()->json($result);
	}

	/**
	* Create a new group.
	*
	* @param \Illuminate\Http\Request $request The API request.
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	public function store(Request $request)
	{
	return $this->errorResponse(404);
	}

	/**
	* Suspend a group
	*
	* @param \Illuminate\Http\Request $request The API request.
	* @param string $id Group identifier
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	public function suspend(Request $request, $id)
	{
	- $group = Group::withEnvTenant()->find($id);
	+ $group = Group::find($id);

	- if (empty($group)) {
	+ if (!$this->checkTenant($group)) {
	return $this->errorResponse(404);
	}

	$group->suspend();

	return response()->json([
	'status' => 'success',
	'message' => __('app.distlist-suspend-success'),
	]);
	}

	/**
	* Un-Suspend a group
	*
	* @param \Illuminate\Http\Request $request The API request.
	* @param string $id Group identifier
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	public function unsuspend(Request $request, $id)
	{
	- $group = Group::withEnvTenant()->find($id);
	+ $group = Group::find($id);

	- if (empty($group)) {
	+ if (!$this->checkTenant($group)) {
	return $this->errorResponse(404);
	}

	$group->unsuspend();

	return response()->json([
	'status' => 'success',
	'message' => __('app.distlist-unsuspend-success'),
	]);
	}
	}
	diff --git a/src/app/Http/Controllers/API/V4/Admin/PackagesController.php b/src/app/Http/Controllers/API/V4/Admin/PackagesController.php
	deleted file mode 100644
	index ba72eacc..00000000
	--- a/src/app/Http/Controllers/API/V4/Admin/PackagesController.php
	+++ /dev/null
	@@ -1,7 +0,0 @@
	-<?php
	-
	-namespace App\Http\Controllers\API\V4\Admin;
	-
	-class PackagesController extends \App\Http\Controllers\API\V4\PackagesController
	-{
	-}
	diff --git a/src/app/Http/Controllers/API/V4/Admin/StatsController.php b/src/app/Http/Controllers/API/V4/Admin/StatsController.php
	index bf5dccde..e85e4df1 100644
	--- a/src/app/Http/Controllers/API/V4/Admin/StatsController.php
	+++ b/src/app/Http/Controllers/API/V4/Admin/StatsController.php
	@@ -1,369 +1,367 @@
	<?php

	namespace App\Http\Controllers\API\V4\Admin;

	use App\Providers\PaymentProvider;
	use App\User;
	use Carbon\Carbon;
	use Illuminate\Http\Request;
	use Illuminate\Support\Facades\Auth;
	use Illuminate\Support\Facades\DB;

	class StatsController extends \App\Http\Controllers\Controller
	{
	public const COLOR_GREEN = '#48d368'; // '#28a745'
	public const COLOR_GREEN_DARK = '#19692c';
	public const COLOR_RED = '#e77681'; // '#dc3545'
	public const COLOR_RED_DARK = '#a71d2a';
	public const COLOR_BLUE = '#4da3ff'; // '#007bff'
	public const COLOR_BLUE_DARK = '#0056b3';
	public const COLOR_ORANGE = '#f1a539';

	/** @var array List of enabled charts */
	protected $charts = [
	'discounts',
	'income',
	'users',
	'users-all',
	];

	/**
	* Fetch chart data
	*
	* @param string $chart Name of the chart
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function chart($chart)
	{
	if (!preg_match('/^[a-z-]+$/', $chart)) {
	return $this->errorResponse(404);
	}

	$method = 'chart' . implode('', array_map('ucfirst', explode('-', $chart)));

	if (!in_array($chart, $this->charts) \|\| !method_exists($this, $method)) {
	return $this->errorResponse(404);
	}

	$result = $this->{$method}();

	return response()->json($result);
	}

	/**
	* Get discounts chart
	*/
	protected function chartDiscounts(): array
	{
	$discounts = DB::table('wallets')
	->selectRaw("discount, count(discount_id) as cnt")
	->join('discounts', 'discounts.id', '=', 'wallets.discount_id')
	->join('users', 'users.id', '=', 'wallets.user_id')
	->where('discount', '>', 0)
	->whereNull('users.deleted_at')
	->groupBy('discounts.discount');

	$addTenantScope = function ($builder, $tenantId) {
	return $builder->where('users.tenant_id', $tenantId);
	};

	$discounts = $this->applyTenantScope($discounts, $addTenantScope)
	->pluck('cnt', 'discount')->all();

	$labels = array_keys($discounts);
	$discounts = array_values($discounts);

	// $labels = [10, 25, 30, 100];
	// $discounts = [100, 120, 30, 50];

	$labels = array_map(function ($item) {
	return $item . '%';
	}, $labels);

	// See https://frappe.io/charts/docs for format/options description

	return [
	'title' => 'Discounts',
	'type' => 'donut',
	'colors' => [
	self::COLOR_BLUE,
	self::COLOR_BLUE_DARK,
	self::COLOR_GREEN,
	self::COLOR_GREEN_DARK,
	self::COLOR_ORANGE,
	self::COLOR_RED,
	self::COLOR_RED_DARK
	],
	'maxSlices' => 8,
	'tooltipOptions' => [], // does not work without it (https://github.com/frappe/charts/issues/314)
	'data' => [
	'labels' => $labels,
	'datasets' => [
	[
	'values' => $discounts
	]
	]
	]
	];
	}

	/**
	* Get income chart
	*/
	protected function chartIncome(): array
	{
	$weeks = 8;
	$start = Carbon::now();
	$labels = [];

	while ($weeks > 0) {
	$labels[] = $start->format('Y-W');
	$weeks--;
	if ($weeks) {
	$start->subWeeks(1);
	}
	}

	$labels = array_reverse($labels);
	$start->startOfWeek(Carbon::MONDAY);

	$payments = DB::table('payments')
	->selectRaw("date_format(updated_at, '%Y-%v') as period, sum(amount) as amount")
	->where('updated_at', '>=', $start->toDateString())
	->where('status', PaymentProvider::STATUS_PAID)
	->whereIn('type', [PaymentProvider::TYPE_ONEOFF, PaymentProvider::TYPE_RECURRING])
	->groupByRaw('1');

	$addTenantScope = function ($builder, $tenantId) {
	$where = '`wallet_id` IN ('
	. 'select `id` from `wallets` '
	. 'join `users` on (`wallets`.`user_id` = `users`.`id`) '
	. 'where `payments`.`wallet_id` = `wallets`.`id` '
	. 'and `users`.`tenant_id` = ' . intval($tenantId)
	. ')';

	return $builder->whereRaw($where);
	};

	$payments = $this->applyTenantScope($payments, $addTenantScope)
	->pluck('amount', 'period')
	->map(function ($amount) {
	return $amount / 100;
	});

	// TODO: exclude refunds/chargebacks

	$empty = array_fill_keys($labels, 0);
	$payments = array_values(array_merge($empty, $payments->all()));

	// $payments = [1000, 1200.25, 3000, 1897.50, 2000, 1900, 2134, 3330];

	$avg = collect($payments)->slice(0, count($labels) - 1)->avg();

	// See https://frappe.io/charts/docs for format/options description

	return [
	'title' => 'Income in CHF - last 8 weeks',
	'type' => 'bar',
	'colors' => [self::COLOR_BLUE],
	'axisOptions' => [
	'xIsSeries' => true,
	],
	'data' => [
	'labels' => $labels,
	'datasets' => [
	[
	// 'name' => 'Payments',
	'values' => $payments
	]
	],
	'yMarkers' => [
	[
	'label' => sprintf('average = %.2f', $avg),
	'value' => $avg,
	'options' => [ 'labelPos' => 'left' ] // default: 'right'
	]
	]
	]
	];
	}

	/**
	* Get created/deleted users chart
	*/
	protected function chartUsers(): array
	{
	$weeks = 8;
	$start = Carbon::now();
	$labels = [];

	while ($weeks > 0) {
	$labels[] = $start->format('Y-W');
	$weeks--;
	if ($weeks) {
	$start->subWeeks(1);
	}
	}

	$labels = array_reverse($labels);
	$start->startOfWeek(Carbon::MONDAY);

	$created = DB::table('users')
	->selectRaw("date_format(created_at, '%Y-%v') as period, count(*) as cnt")
	->where('created_at', '>=', $start->toDateString())
	->groupByRaw('1');

	$deleted = DB::table('users')
	->selectRaw("date_format(deleted_at, '%Y-%v') as period, count(*) as cnt")
	->where('deleted_at', '>=', $start->toDateString())
	->groupByRaw('1');

	$created = $this->applyTenantScope($created)->get();
	$deleted = $this->applyTenantScope($deleted)->get();

	$empty = array_fill_keys($labels, 0);
	$created = array_values(array_merge($empty, $created->pluck('cnt', 'period')->all()));
	$deleted = array_values(array_merge($empty, $deleted->pluck('cnt', 'period')->all()));

	// $created = [5, 2, 4, 2, 0, 5, 2, 4];
	// $deleted = [1, 2, 3, 1, 2, 1, 2, 3];

	$avg = collect($created)->slice(0, count($labels) - 1)->avg();

	// See https://frappe.io/charts/docs for format/options description

	return [
	'title' => 'Users - last 8 weeks',
	'type' => 'bar', // Required to fix https://github.com/frappe/charts/issues/294
	'colors' => [self::COLOR_GREEN, self::COLOR_RED],
	'axisOptions' => [
	'xIsSeries' => true,
	],
	'data' => [
	'labels' => $labels,
	'datasets' => [
	[
	'name' => 'Created',
	'chartType' => 'bar',
	'values' => $created
	],
	[
	'name' => 'Deleted',
	'chartType' => 'line',
	'values' => $deleted
	]
	],
	'yMarkers' => [
	[
	'label' => sprintf('average = %.1f', $avg),
	'value' => collect($created)->avg(),
	'options' => [ 'labelPos' => 'left' ] // default: 'right'
	]
	]
	]
	];
	}

	/**
	* Get all users chart
	*/
	protected function chartUsersAll(): array
	{
	$weeks = 54;
	$start = Carbon::now();
	$labels = [];

	while ($weeks > 0) {
	$labels[] = $start->format('Y-W');
	$weeks--;
	if ($weeks) {
	$start->subWeeks(1);
	}
	}

	$labels = array_reverse($labels);
	$start->startOfWeek(Carbon::MONDAY);

	$created = DB::table('users')
	->selectRaw("date_format(created_at, '%Y-%v') as period, count(*) as cnt")
	->where('created_at', '>=', $start->toDateString())
	->groupByRaw('1');

	$deleted = DB::table('users')
	->selectRaw("date_format(deleted_at, '%Y-%v') as period, count(*) as cnt")
	->where('deleted_at', '>=', $start->toDateString())
	->groupByRaw('1');

	$created = $this->applyTenantScope($created)->get();
	$deleted = $this->applyTenantScope($deleted)->get();
	$count = $this->applyTenantScope(DB::table('users')->whereNull('deleted_at'))->count();

	$empty = array_fill_keys($labels, 0);
	$created = array_merge($empty, $created->pluck('cnt', 'period')->all());
	$deleted = array_merge($empty, $deleted->pluck('cnt', 'period')->all());
	$all = [];

	foreach (array_reverse($labels) as $label) {
	$all[] = $count;
	$count -= $created[$label] - $deleted[$label];
	}

	$all = array_reverse($all);

	// $start = 3000;
	// for ($i = 0; $i < count($labels); $i++) {
	// $all[$i] = $start + $i * 15;
	// }

	// See https://frappe.io/charts/docs for format/options description

	return [
	'title' => 'All Users - last year',
	'type' => 'line',
	'colors' => [self::COLOR_GREEN],
	'axisOptions' => [
	'xIsSeries' => true,
	'xAxisMode' => 'tick',
	],
	'lineOptions' => [
	'hideDots' => true,
	'regionFill' => true,
	],
	'data' => [
	'labels' => $labels,
	'datasets' => [
	[
	// 'name' => 'Existing',
	'values' => $all
	]
	]
	]
	];
	}

	/**
	* Add tenant scope to the queries when needed
	*
	* @param \Illuminate\Database\Query\Builder $query The query
	* @param callable $addQuery Additional tenant-scope query-modifier
	*
	* @return \Illuminate\Database\Query\Builder
	*/
	protected function applyTenantScope($query, $addQuery = null)
	{
	$user = Auth::guard()->user();

	if ($user->role == 'reseller') {
	if ($addQuery) {
	$query = $addQuery($query, \config('app.tenant_id'));
	} else {
	- $query = $query->withEnvTenant();
	+ $query = $query->withEnvTenantContext();
	}
	}

	- // TODO: Tenant selector for admins
	-
	return $query;
	}
	}
	diff --git a/src/app/Http/Controllers/API/V4/Admin/UsersController.php b/src/app/Http/Controllers/API/V4/Admin/UsersController.php
	index a430b675..a07dc280 100644
	--- a/src/app/Http/Controllers/API/V4/Admin/UsersController.php
	+++ b/src/app/Http/Controllers/API/V4/Admin/UsersController.php
	@@ -1,257 +1,306 @@
	<?php

	namespace App\Http\Controllers\API\V4\Admin;

	use App\Domain;
	use App\Group;
	use App\Sku;
	use App\User;
	use App\UserAlias;
	use App\UserSetting;
	+use App\Wallet;
	use Illuminate\Http\Request;
	use Illuminate\Support\Facades\Validator;

	class UsersController extends \App\Http\Controllers\API\V4\UsersController
	{
	/**
	* Delete a user.
	*
	* @param int $id User identifier
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	public function destroy($id)
	{
	return $this->errorResponse(404);
	}

	/**
	* Searching of user accounts.
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function index()
	{
	$search = trim(request()->input('search'));
	$owner = trim(request()->input('owner'));
	$result = collect([]);

	if ($owner) {
	- $owner = User::where('id', $owner)
	- ->withEnvTenant()
	- ->whereNull('role')
	- ->first();
	+ $owner = User::find($owner);

	if ($owner) {
	- $result = $owner->users(false)->whereNull('role')->orderBy('email')->get();
	+ $result = $owner->users(false)->orderBy('email')->get();
	}
	} elseif (strpos($search, '@')) {
	// Search by email
	$result = User::withTrashed()->where('email', $search)
	- ->withEnvTenant()
	- ->whereNull('role')
	->orderBy('email')
	->get();

	if ($result->isEmpty()) {
	// Search by an alias
	$user_ids = UserAlias::where('alias', $search)->get()->pluck('user_id');

	// Search by an external email
	$ext_user_ids = UserSetting::where('key', 'external_email')
	->where('value', $search)
	->get()
	->pluck('user_id');

	$user_ids = $user_ids->merge($ext_user_ids)->unique();

	// Search by a distribution list email
	if ($group = Group::withTrashed()->where('email', $search)->first()) {
	$user_ids = $user_ids->merge([$group->wallet()->user_id])->unique();
	}

	if (!$user_ids->isEmpty()) {
	$result = User::withTrashed()->whereIn('id', $user_ids)
	- ->withEnvTenant()
	- ->whereNull('role')
	->orderBy('email')
	->get();
	}
	}
	} elseif (is_numeric($search)) {
	// Search by user ID
	$user = User::withTrashed()->where('id', $search)
	- ->withEnvTenant()
	- ->whereNull('role')
	->first();

	if ($user) {
	$result->push($user);
	}
	- } elseif (!empty($search)) {
	+ } elseif (strpos($search, '.') !== false) {
	// Search by domain
	$domain = Domain::withTrashed()->where('namespace', $search)
	- ->withEnvTenant()
	->first();

	if ($domain) {
	- if (
	- ($wallet = $domain->wallet())
	- && ($owner = $wallet->owner()->withTrashed()->withEnvTenant()->first())
	- && empty($owner->role)
	- ) {
	+ if (($wallet = $domain->wallet()) && ($owner = $wallet->owner()->withTrashed()->first())) {
	+ $result->push($owner);
	+ }
	+ }
	+ } elseif (!empty($search)) {
	+ $wallet = Wallet::find($search);
	+
	+ if ($wallet) {
	+ if ($owner = $wallet->owner()->withTrashed()->first()) {
	$result->push($owner);
	}
	}
	}

	// Process the result
	- $result = $result->map(function ($user) {
	- $data = $user->toArray();
	- $data = array_merge($data, self::userStatuses($user));
	- return $data;
	- });
	+ $result = $result->map(
	+ function ($user) {
	+ $data = $user->toArray();
	+ $data = array_merge($data, self::userStatuses($user));
	+ return $data;
	+ }
	+ );

	$result = [
	'list' => $result,
	'count' => count($result),
	'message' => \trans('app.search-foundxusers', ['x' => count($result)]),
	];

	return response()->json($result);
	}

	/**
	* Reset 2-Factor Authentication for the user
	*
	* @param \Illuminate\Http\Request $request The API request.
	* @param string $id User identifier
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	public function reset2FA(Request $request, $id)
	{
	- $user = User::withEnvTenant()->find($id);
	+ $user = User::find($id);

	- if (empty($user) \|\| !$this->guard()->user()->canUpdate($user)) {
	+ if (!$this->checkTenant($user)) {
	return $this->errorResponse(404);
	}

	- $sku = Sku::where('title', '2fa')->first();
	+ if (!$this->guard()->user()->canUpdate($user)) {
	+ return $this->errorResponse(403);
	+ }
	+
	+ $sku = Sku::withObjectTenantContext($user)->where('title', '2fa')->first();

	// Note: we do select first, so the observer can delete
	// 2FA preferences from Roundcube database, so don't
	// be tempted to replace first() with delete() below
	$entitlement = $user->entitlements()->where('sku_id', $sku->id)->first();
	$entitlement->delete();

	return response()->json([
	'status' => 'success',
	'message' => __('app.user-reset-2fa-success'),
	]);
	}

	+ /**
	+ * Display information on the user account specified by $id.
	+ *
	+ * @param int $id The account to show information for.
	+ *
	+ * @return \Illuminate\Http\JsonResponse
	+ */
	+ public function show($id)
	+ {
	+ $user = User::find($id);
	+
	+ if (!$this->checkTenant($user)) {
	+ return $this->errorResponse(404);
	+ }
	+
	+ if (!$this->guard()->user()->canRead($user)) {
	+ return $this->errorResponse(403);
	+ }
	+
	+ $response = $this->userResponse($user);
	+
	+ // Simplified Entitlement/SKU information,
	+ // TODO: I agree this format may need to be extended in future
	+ $response['skus'] = [];
	+ foreach ($user->entitlements as $ent) {
	+ $sku = $ent->sku;
	+ if (!isset($response['skus'][$sku->id])) {
	+ $response['skus'][$sku->id] = ['costs' => [], 'count' => 0];
	+ }
	+ $response['skus'][$sku->id]['count']++;
	+ $response['skus'][$sku->id]['costs'][] = $ent->cost;
	+ }
	+
	+ return response()->json($response);
	+ }
	+
	/**
	* Create a new user record.
	*
	* @param \Illuminate\Http\Request $request The API request.
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	public function store(Request $request)
	{
	return $this->errorResponse(404);
	}

	/**
	* Suspend the user
	*
	* @param \Illuminate\Http\Request $request The API request.
	* @param string $id User identifier
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	public function suspend(Request $request, $id)
	{
	- $user = User::withEnvTenant()->find($id);
	+ $user = User::find($id);

	- if (empty($user) \|\| !$this->guard()->user()->canUpdate($user)) {
	+ if (!$this->checkTenant($user)) {
	return $this->errorResponse(404);
	}

	+ if (!$this->guard()->user()->canUpdate($user)) {
	+ return $this->errorResponse(403);
	+ }
	+
	$user->suspend();

	return response()->json([
	'status' => 'success',
	'message' => __('app.user-suspend-success'),
	]);
	}

	/**
	* Un-Suspend the user
	*
	* @param \Illuminate\Http\Request $request The API request.
	* @param string $id User identifier
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	public function unsuspend(Request $request, $id)
	{
	- $user = User::withEnvTenant()->find($id);
	+ $user = User::find($id);

	- if (empty($user) \|\| !$this->guard()->user()->canUpdate($user)) {
	+ if (!$this->checkTenant($user)) {
	return $this->errorResponse(404);
	}

	+ if (!$this->guard()->user()->canUpdate($user)) {
	+ return $this->errorResponse(403);
	+ }
	+
	$user->unsuspend();

	return response()->json([
	'status' => 'success',
	'message' => __('app.user-unsuspend-success'),
	]);
	}

	/**
	* Update user data.
	*
	* @param \Illuminate\Http\Request $request The API request.
	* @param string $id User identifier
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	public function update(Request $request, $id)
	{
	- $user = User::withEnvTenant()->find($id);
	+ $user = User::find($id);

	- if (empty($user) \|\| !$this->guard()->user()->canUpdate($user)) {
	+ if (!$this->checkTenant($user)) {
	return $this->errorResponse(404);
	}

	+ if (!$this->guard()->user()->canUpdate($user)) {
	+ return $this->errorResponse(403);
	+ }
	+
	// For now admins can change only user external email address

	$rules = [];

	if (array_key_exists('external_email', $request->input())) {
	$rules['external_email'] = 'email';
	}

	// Validate input
	$v = Validator::make($request->all(), $rules);

	if ($v->fails()) {
	return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
	}

	// Update user settings
	$settings = $request->only(array_keys($rules));

	if (!empty($settings)) {
	$user->setSettings($settings);
	}

	return response()->json([
	'status' => 'success',
	'message' => __('app.user-update-success'),
	]);
	}
	}
	diff --git a/src/app/Http/Controllers/API/V4/Admin/WalletsController.php b/src/app/Http/Controllers/API/V4/Admin/WalletsController.php
	index 586cc146..205531cd 100644
	--- a/src/app/Http/Controllers/API/V4/Admin/WalletsController.php
	+++ b/src/app/Http/Controllers/API/V4/Admin/WalletsController.php
	@@ -1,159 +1,158 @@
	<?php

	namespace App\Http\Controllers\API\V4\Admin;

	use App\Discount;
	use App\Http\Controllers\API\V4\PaymentsController;
	use App\Providers\PaymentProvider;
	use App\Transaction;
	use App\Wallet;
	use Illuminate\Http\Request;
	-use Illuminate\Support\Facades\Auth;
	use Illuminate\Support\Facades\DB;
	use Illuminate\Support\Facades\Validator;

	class WalletsController extends \App\Http\Controllers\API\V4\WalletsController
	{
	/**
	* Return data of the specified wallet.
	*
	* @param string $id A wallet identifier
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	public function show($id)
	{
	$wallet = Wallet::find($id);

	- if (empty($wallet) \|\| !Auth::guard()->user()->canRead($wallet)) {
	+ if (empty($wallet) \|\| !$this->checkTenant($wallet->owner)) {
	return $this->errorResponse(404);
	}

	$result = $wallet->toArray();

	$result['discount'] = 0;
	$result['discount_description'] = '';

	if ($wallet->discount) {
	$result['discount'] = $wallet->discount->discount;
	$result['discount_description'] = $wallet->discount->description;
	}

	$result['mandate'] = PaymentsController::walletMandate($wallet);

	$provider = PaymentProvider::factory($wallet);

	$result['provider'] = $provider->name();
	$result['providerLink'] = $provider->customerLink($wallet);
	$result['notice'] = $this->getWalletNotice($wallet); // for resellers

	return response()->json($result);
	}

	/**
	* Award/penalize a wallet.
	*
	* @param \Illuminate\Http\Request $request The API request.
	* @param string $id Wallet identifier
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	public function oneOff(Request $request, $id)
	{
	$wallet = Wallet::find($id);
	- $user = Auth::guard()->user();
	+ $user = $this->guard()->user();

	- if (empty($wallet) \|\| !$user->canRead($wallet)) {
	+ if (empty($wallet) \|\| !$this->checkTenant($wallet->owner)) {
	return $this->errorResponse(404);
	}

	// Check required fields
	$v = Validator::make(
	$request->all(),
	[
	'amount' => 'required\|numeric',
	'description' => 'required\|string\|max:1024',
	]
	);

	if ($v->fails()) {
	return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
	}

	$amount = (int) ($request->amount * 100);
	$type = $amount > 0 ? Transaction::WALLET_AWARD : Transaction::WALLET_PENALTY;

	DB::beginTransaction();

	$wallet->balance += $amount;
	$wallet->save();

	Transaction::create(
	[
	'user_email' => \App\Utils::userEmailOrNull(),
	'object_id' => $wallet->id,
	'object_type' => Wallet::class,
	'type' => $type,
	'amount' => $amount,
	'description' => $request->description
	]
	);

	if ($user->role == 'reseller') {
	if ($user->tenant && ($tenant_wallet = $user->tenant->wallet())) {
	$desc = ($amount > 0 ? 'Awarded' : 'Penalized') . " user {$wallet->owner->email}";
	$method = $amount > 0 ? 'debit' : 'credit';
	$tenant_wallet->{$method}(abs($amount), $desc);
	}
	}

	DB::commit();

	$response = [
	'status' => 'success',
	'message' => \trans("app.wallet-{$type}-success"),
	'balance' => $wallet->balance
	];

	return response()->json($response);
	}

	/**
	* Update wallet data.
	*
	* @param \Illuminate\Http\Request $request The API request.
	* @param string $id Wallet identifier
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	public function update(Request $request, $id)
	{
	$wallet = Wallet::find($id);

	- if (empty($wallet) \|\| !Auth::guard()->user()->canRead($wallet)) {
	+ if (empty($wallet) \|\| !$this->checkTenant($wallet->owner)) {
	return $this->errorResponse(404);
	}

	if (array_key_exists('discount', $request->input())) {
	if (empty($request->discount)) {
	$wallet->discount()->dissociate();
	$wallet->save();
	- } elseif ($discount = Discount::withEnvTenant()->find($request->discount)) {
	+ } elseif ($discount = Discount::withObjectTenantContext($wallet->owner)->find($request->discount)) {
	$wallet->discount()->associate($discount);
	$wallet->save();
	}
	}

	$response = $wallet->toArray();

	if ($wallet->discount) {
	$response['discount'] = $wallet->discount->discount;
	$response['discount_description'] = $wallet->discount->description;
	}

	$response['status'] = 'success';
	$response['message'] = \trans('app.wallet-update-success');

	return response()->json($response);
	}
	}
	diff --git a/src/app/Http/Controllers/API/V4/DomainsController.php b/src/app/Http/Controllers/API/V4/DomainsController.php
	index c33308ce..c9769463 100644
	--- a/src/app/Http/Controllers/API/V4/DomainsController.php
	+++ b/src/app/Http/Controllers/API/V4/DomainsController.php
	@@ -1,381 +1,389 @@
	<?php

	namespace App\Http\Controllers\API\V4;

	use App\Domain;
	use App\Http\Controllers\Controller;
	use App\Backends\LDAP;
	use Carbon\Carbon;
	use Illuminate\Http\Request;
	-use Illuminate\Support\Facades\Auth;

	class DomainsController extends Controller
	{
	/**
	* Return a list of domains owned by the current user
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function index()
	{
	- $user = Auth::guard()->user();
	+ $user = $this->guard()->user();
	$list = [];

	foreach ($user->domains() as $domain) {
	if (!$domain->isPublic()) {
	$data = $domain->toArray();
	$data = array_merge($data, self::domainStatuses($domain));
	$list[] = $data;
	}
	}

	return response()->json($list);
	}

	/**
	* Show the form for creating a new resource.
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function create()
	{
	return $this->errorResponse(404);
	}

	/**
	* Confirm ownership of the specified domain (via DNS check).
	*
	* @param int $id Domain identifier
	*
	* @return \Illuminate\Http\JsonResponse\|void
	*/
	public function confirm($id)
	{
	- $domain = Domain::findOrFail($id);
	+ $domain = Domain::find($id);

	- // Only owner (or admin) has access to the domain
	- if (!Auth::guard()->user()->canRead($domain)) {
	+ if (!$this->checkTenant($domain)) {
	+ return $this->errorResponse(404);
	+ }
	+
	+ if (!$this->guard()->user()->canRead($domain)) {
	return $this->errorResponse(403);
	}

	if (!$domain->confirm()) {
	return response()->json([
	'status' => 'error',
	'message' => \trans('app.domain-verify-error'),
	]);
	}

	return response()->json([
	'status' => 'success',
	'statusInfo' => self::statusInfo($domain),
	'message' => \trans('app.domain-verify-success'),
	]);
	}

	/**
	* Remove the specified resource from storage.
	*
	* @param int $id
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function destroy($id)
	{
	return $this->errorResponse(404);
	}

	/**
	* Show the form for editing the specified resource.
	*
	* @param int $id
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function edit($id)
	{
	return $this->errorResponse(404);
	}

	/**
	* Store a newly created resource in storage.
	*
	* @param \Illuminate\Http\Request $request
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function store(Request $request)
	{
	return $this->errorResponse(404);
	}

	/**
	* Get the information about the specified domain.
	*
	* @param int $id Domain identifier
	*
	* @return \Illuminate\Http\JsonResponse\|void
	*/
	public function show($id)
	{
	- $domain = Domain::withEnvTenant()->findOrFail($id);
	+ $domain = Domain::find($id);
	+
	+ if (!$this->checkTenant($domain)) {
	+ return $this->errorResponse(404);
	+ }

	- // Only owner (or admin) has access to the domain
	- if (!Auth::guard()->user()->canRead($domain)) {
	+ if (!$this->guard()->user()->canRead($domain)) {
	return $this->errorResponse(403);
	}

	$response = $domain->toArray();

	// Add hash information to the response
	$response['hash_text'] = $domain->hash(Domain::HASH_TEXT);
	$response['hash_cname'] = $domain->hash(Domain::HASH_CNAME);
	$response['hash_code'] = $domain->hash(Domain::HASH_CODE);

	// Add DNS/MX configuration for the domain
	$response['dns'] = self::getDNSConfig($domain);
	$response['config'] = self::getMXConfig($domain->namespace);

	// Status info
	$response['statusInfo'] = self::statusInfo($domain);

	$response = array_merge($response, self::domainStatuses($domain));

	return response()->json($response);
	}

	/**
	* Fetch domain status (and reload setup process)
	*
	* @param int $id Domain identifier
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function status($id)
	{
	- $domain = Domain::withEnvTenant()->findOrFail($id);
	+ $domain = Domain::find($id);
	+
	+ if (!$this->checkTenant($domain)) {
	+ return $this->errorResponse(404);
	+ }

	- // Only owner (or admin) has access to the domain
	- if (!Auth::guard()->user()->canRead($domain)) {
	+ if (!$this->guard()->user()->canRead($domain)) {
	return $this->errorResponse(403);
	}

	$response = self::statusInfo($domain);

	if (!empty(request()->input('refresh'))) {
	$updated = false;
	$last_step = 'none';

	foreach ($response['process'] as $idx => $step) {
	$last_step = $step['label'];

	if (!$step['state']) {
	if (!$this->execProcessStep($domain, $step['label'])) {
	break;
	}

	$updated = true;
	}
	}

	if ($updated) {
	$response = self::statusInfo($domain);
	}

	$success = $response['isReady'];
	$suffix = $success ? 'success' : 'error-' . $last_step;

	$response['status'] = $success ? 'success' : 'error';
	$response['message'] = \trans('app.process-' . $suffix);
	}

	$response = array_merge($response, self::domainStatuses($domain));

	return response()->json($response);
	}

	/**
	* Update the specified resource in storage.
	*
	* @param \Illuminate\Http\Request $request
	* @param int $id
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function update(Request $request, $id)
	{
	return $this->errorResponse(404);
	}

	/**
	* Provide DNS MX information to configure specified domain for
	*/
	protected static function getMXConfig(string $namespace): array
	{
	$entries = [];

	// copy MX entries from an existing domain
	if ($master = \config('dns.copyfrom')) {
	// TODO: cache this lookup
	foreach ((array) dns_get_record($master, DNS_MX) as $entry) {
	$entries[] = sprintf(
	"@\t%s\t%s\tMX\t%d %s.",
	\config('dns.ttl', $entry['ttl']),
	$entry['class'],
	$entry['pri'],
	$entry['target']
	);
	}
	} elseif ($static = \config('dns.static')) {
	$entries[] = strtr($static, array('\n' => "\n", '%s' => $namespace));
	}

	// display SPF settings
	if ($spf = \config('dns.spf')) {
	$entries[] = ';';
	foreach (['TXT', 'SPF'] as $type) {
	$entries[] = sprintf(
	"@\t%s\tIN\t%s\t\"%s\"",
	\config('dns.ttl'),
	$type,
	$spf
	);
	}
	}

	return $entries;
	}

	/**
	* Provide sample DNS config for domain confirmation
	*/
	protected static function getDNSConfig(Domain $domain): array
	{
	$serial = date('Ymd01');
	$hash_txt = $domain->hash(Domain::HASH_TEXT);
	$hash_cname = $domain->hash(Domain::HASH_CNAME);
	$hash = $domain->hash(Domain::HASH_CODE);

	return [
	"@ IN SOA ns1.dnsservice.com. hostmaster.{$domain->namespace}. (",
	" {$serial} 10800 3600 604800 86400 )",
	";",
	"@ IN A <some-ip>",
	"www IN A <some-ip>",
	";",
	"{$hash_cname}.{$domain->namespace}. IN CNAME {$hash}.{$domain->namespace}.",
	"@ 3600 TXT \"{$hash_txt}\"",
	];
	}

	/**
	* Prepare domain statuses for the UI
	*
	* @param \App\Domain $domain Domain object
	*
	* @return array Statuses array
	*/
	protected static function domainStatuses(Domain $domain): array
	{
	return [
	'isLdapReady' => $domain->isLdapReady(),
	'isConfirmed' => $domain->isConfirmed(),
	'isVerified' => $domain->isVerified(),
	'isSuspended' => $domain->isSuspended(),
	'isActive' => $domain->isActive(),
	'isDeleted' => $domain->isDeleted() \|\| $domain->trashed(),
	];
	}

	/**
	* Domain status (extended) information.
	*
	* @param \App\Domain $domain Domain object
	*
	* @return array Status information
	*/
	public static function statusInfo(Domain $domain): array
	{
	$process = [];

	// If that is not a public domain, add domain specific steps
	$steps = [
	'domain-new' => true,
	'domain-ldap-ready' => $domain->isLdapReady(),
	'domain-verified' => $domain->isVerified(),
	'domain-confirmed' => $domain->isConfirmed(),
	];

	$count = count($steps);

	// Create a process check list
	foreach ($steps as $step_name => $state) {
	$step = [
	'label' => $step_name,
	'title' => \trans("app.process-{$step_name}"),
	'state' => $state,
	];

	if ($step_name == 'domain-confirmed' && !$state) {
	$step['link'] = "/domain/{$domain->id}";
	}

	$process[] = $step;

	if ($state) {
	$count--;
	}
	}

	$state = $count === 0 ? 'done' : 'running';

	// After 180 seconds assume the process is in failed state,
	// this should unlock the Refresh button in the UI
	if ($count > 0 && $domain->created_at->diffInSeconds(Carbon::now()) > 180) {
	$state = 'failed';
	}

	return [
	'process' => $process,
	'processState' => $state,
	'isReady' => $count === 0,
	];
	}

	/**
	* Execute (synchronously) specified step in a domain setup process.
	*
	* @param \App\Domain $domain Domain object
	* @param string $step Step identifier (as in self::statusInfo())
	*
	* @return bool True if the execution succeeded, False otherwise
	*/
	public static function execProcessStep(Domain $domain, string $step): bool
	{
	try {
	switch ($step) {
	case 'domain-ldap-ready':
	// Domain not in LDAP, create it
	if (!$domain->isLdapReady()) {
	LDAP::createDomain($domain);
	$domain->status \|= Domain::STATUS_LDAP_READY;
	$domain->save();
	}
	return $domain->isLdapReady();

	case 'domain-verified':
	// Domain existence not verified
	$domain->verify();
	return $domain->isVerified();

	case 'domain-confirmed':
	// Domain ownership confirmation
	$domain->confirm();
	return $domain->isConfirmed();
	}
	} catch (\Exception $e) {
	\Log::error($e);
	}

	return false;
	}
	}
	diff --git a/src/app/Http/Controllers/API/V4/GroupsController.php b/src/app/Http/Controllers/API/V4/GroupsController.php
	index 0c2e3daa..ed7158a8 100644
	--- a/src/app/Http/Controllers/API/V4/GroupsController.php
	+++ b/src/app/Http/Controllers/API/V4/GroupsController.php
	@@ -1,507 +1,507 @@
	<?php

	namespace App\Http\Controllers\API\V4;

	use App\Http\Controllers\Controller;
	use App\Domain;
	use App\Group;
	use App\User;
	use Carbon\Carbon;
	use Illuminate\Http\Request;
	use Illuminate\Support\Facades\DB;
	use Illuminate\Support\Facades\Validator;

	class GroupsController extends Controller
	{
	/**
	* Show the form for creating a new group.
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function create()
	{
	return $this->errorResponse(404);
	}

	/**
	* Delete a group.
	*
	* @param int $id Group identifier
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	public function destroy($id)
	{
	- $group = Group::withEnvTenant()->find($id);
	+ $group = Group::find($id);

	- if (empty($group)) {
	+ if (!$this->checkTenant($group)) {
	return $this->errorResponse(404);
	}

	if (!$this->guard()->user()->canDelete($group)) {
	return $this->errorResponse(403);
	}

	$group->delete();

	return response()->json([
	'status' => 'success',
	'message' => __('app.distlist-delete-success'),
	]);
	}

	/**
	* Show the form for editing the specified group.
	*
	* @param int $id Group identifier
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function edit($id)
	{
	return $this->errorResponse(404);
	}

	/**
	* Listing of groups belonging to the authenticated user.
	*
	* The group-entitlements billed to the current user wallet(s)
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function index()
	{
	$user = $this->guard()->user();

	$result = $user->groups()->orderBy('email')->get()
	->map(function (Group $group) {
	$data = [
	'id' => $group->id,
	'email' => $group->email,
	];

	$data = array_merge($data, self::groupStatuses($group));
	return $data;
	});

	return response()->json($result);
	}

	/**
	* Display information of a group specified by $id.
	*
	* @param int $id The group to show information for.
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function show($id)
	{
	- $group = Group::withEnvTenant()->find($id);
	+ $group = Group::find($id);

	- if (empty($group)) {
	+ if (!$this->checkTenant($group)) {
	return $this->errorResponse(404);
	}

	if (!$this->guard()->user()->canRead($group)) {
	return $this->errorResponse(403);
	}

	$response = $group->toArray();

	$response = array_merge($response, self::groupStatuses($group));
	$response['statusInfo'] = self::statusInfo($group);

	return response()->json($response);
	}

	/**
	* Fetch group status (and reload setup process)
	*
	* @param int $id Group identifier
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function status($id)
	{
	- $group = Group::withEnvTenant()->find($id);
	+ $group = Group::find($id);

	- if (empty($group)) {
	+ if (!$this->checkTenant($group)) {
	return $this->errorResponse(404);
	}

	if (!$this->guard()->user()->canRead($group)) {
	return $this->errorResponse(403);
	}

	$response = self::statusInfo($group);

	if (!empty(request()->input('refresh'))) {
	$updated = false;
	$async = false;
	$last_step = 'none';

	foreach ($response['process'] as $idx => $step) {
	$last_step = $step['label'];

	if (!$step['state']) {
	$exec = $this->execProcessStep($group, $step['label']);

	if (!$exec) {
	if ($exec === null) {
	$async = true;
	}

	break;
	}

	$updated = true;
	}
	}

	if ($updated) {
	$response = self::statusInfo($group);
	}

	$success = $response['isReady'];
	$suffix = $success ? 'success' : 'error-' . $last_step;

	$response['status'] = $success ? 'success' : 'error';
	$response['message'] = \trans('app.process-' . $suffix);

	if ($async && !$success) {
	$response['processState'] = 'waiting';
	$response['status'] = 'success';
	$response['message'] = \trans('app.process-async');
	}
	}

	$response = array_merge($response, self::groupStatuses($group));

	return response()->json($response);
	}

	/**
	* Group status (extended) information
	*
	* @param \App\Group $group Group object
	*
	* @return array Status information
	*/
	public static function statusInfo(Group $group): array
	{
	$process = [];
	$steps = [
	'distlist-new' => true,
	'distlist-ldap-ready' => $group->isLdapReady(),
	];

	// Create a process check list
	foreach ($steps as $step_name => $state) {
	$step = [
	'label' => $step_name,
	'title' => \trans("app.process-{$step_name}"),
	'state' => $state,
	];

	$process[] = $step;
	}

	$domain = $group->domain();

	// If that is not a public domain, add domain specific steps
	if ($domain && !$domain->isPublic()) {
	$domain_status = DomainsController::statusInfo($domain);
	$process = array_merge($process, $domain_status['process']);
	}

	$all = count($process);
	$checked = count(array_filter($process, function ($v) {
	return $v['state'];
	}));

	$state = $all === $checked ? 'done' : 'running';

	// After 180 seconds assume the process is in failed state,
	// this should unlock the Refresh button in the UI
	if ($all !== $checked && $group->created_at->diffInSeconds(Carbon::now()) > 180) {
	$state = 'failed';
	}

	return [
	'process' => $process,
	'processState' => $state,
	'isReady' => $all === $checked,
	];
	}

	/**
	* Create a new group record.
	*
	* @param \Illuminate\Http\Request $request The API request.
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	public function store(Request $request)
	{
	$current_user = $this->guard()->user();
	$owner = $current_user->wallet()->owner;

	if ($owner->id != $current_user->id) {
	return $this->errorResponse(403);
	}

	$email = request()->input('email');
	$members = request()->input('members');
	$errors = [];

	// Validate group address
	if ($error = GroupsController::validateGroupEmail($email, $owner)) {
	$errors['email'] = $error;
	}

	// Validate members' email addresses
	if (empty($members) \|\| !is_array($members)) {
	$errors['members'] = \trans('validation.listmembersrequired');
	} else {
	foreach ($members as $i => $member) {
	if (is_string($member) && !empty($member)) {
	if ($error = GroupsController::validateMemberEmail($member, $owner)) {
	$errors['members'][$i] = $error;
	} elseif (\strtolower($member) === \strtolower($email)) {
	$errors['members'][$i] = \trans('validation.memberislist');
	}
	} else {
	unset($members[$i]);
	}
	}
	}

	if (!empty($errors)) {
	return response()->json(['status' => 'error', 'errors' => $errors], 422);
	}

	DB::beginTransaction();

	// Create the group
	$group = new Group();
	$group->email = $email;
	$group->members = $members;
	$group->save();

	$group->assignToWallet($owner->wallets->first());

	DB::commit();

	return response()->json([
	'status' => 'success',
	'message' => __('app.distlist-create-success'),
	]);
	}

	/**
	* Update a group.
	*
	* @param \Illuminate\Http\Request $request The API request.
	* @param string $id Group identifier
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	public function update(Request $request, $id)
	{
	- $group = Group::withEnvTenant()->find($id);
	+ $group = Group::find($id);

	- if (empty($group)) {
	+ if (!$this->checkTenant($group)) {
	return $this->errorResponse(404);
	}

	$current_user = $this->guard()->user();

	if (!$current_user->canUpdate($group)) {
	return $this->errorResponse(403);
	}

	$owner = $group->wallet()->owner;

	// It is possible to update members property only for now
	$members = request()->input('members');
	$errors = [];

	// Validate members' email addresses
	if (empty($members) \|\| !is_array($members)) {
	$errors['members'] = \trans('validation.listmembersrequired');
	} else {
	foreach ((array) $members as $i => $member) {
	if (is_string($member) && !empty($member)) {
	if ($error = GroupsController::validateMemberEmail($member, $owner)) {
	$errors['members'][$i] = $error;
	} elseif (\strtolower($member) === $group->email) {
	$errors['members'][$i] = \trans('validation.memberislist');
	}
	} else {
	unset($members[$i]);
	}
	}
	}

	if (!empty($errors)) {
	return response()->json(['status' => 'error', 'errors' => $errors], 422);
	}

	$group->members = $members;
	$group->save();

	return response()->json([
	'status' => 'success',
	'message' => __('app.distlist-update-success'),
	]);
	}

	/**
	* Execute (synchronously) specified step in a group setup process.
	*
	* @param \App\Group $group Group object
	* @param string $step Step identifier (as in self::statusInfo())
	*
	* @return bool\|null True if the execution succeeded, False if not, Null when
	* the job has been sent to the worker (result unknown)
	*/
	public static function execProcessStep(Group $group, string $step): ?bool
	{
	try {
	if (strpos($step, 'domain-') === 0) {
	return DomainsController::execProcessStep($group->domain(), $step);
	}

	switch ($step) {
	case 'distlist-ldap-ready':
	// Group not in LDAP, create it
	$job = new \App\Jobs\Group\CreateJob($group->id);
	$job->handle();

	$group->refresh();

	return $group->isLdapReady();
	}
	} catch (\Exception $e) {
	\Log::error($e);
	}

	return false;
	}

	/**
	* Prepare group statuses for the UI
	*
	* @param \App\Group $group Group object
	*
	* @return array Statuses array
	*/
	protected static function groupStatuses(Group $group): array
	{
	return [
	'isLdapReady' => $group->isLdapReady(),
	'isSuspended' => $group->isSuspended(),
	'isActive' => $group->isActive(),
	'isDeleted' => $group->isDeleted() \|\| $group->trashed(),
	];
	}

	/**
	* Validate an email address for use as a group email
	*
	* @param string $email Email address
	* @param \App\User $user The group owner
	*
	* @return ?string Error message on validation error
	*/
	public static function validateGroupEmail($email, \App\User $user): ?string
	{
	if (empty($email)) {
	return \trans('validation.required', ['attribute' => 'email']);
	}

	if (strpos($email, '@') === false) {
	return \trans('validation.entryinvalid', ['attribute' => 'email']);
	}

	list($login, $domain) = explode('@', \strtolower($email));

	if (strlen($login) === 0 \|\| strlen($domain) === 0) {
	return \trans('validation.entryinvalid', ['attribute' => 'email']);
	}

	// Check if domain exists
	$domain = Domain::where('namespace', $domain)->first();

	if (empty($domain)) {
	return \trans('validation.domaininvalid');
	}

	$wallet = $domain->wallet();

	// The domain must be owned by the user
	if (!$wallet \|\| !$user->wallets()->find($wallet->id)) {
	return \trans('validation.domainnotavailable');
	}

	// Validate login part alone
	$v = Validator::make(
	['email' => $login],
	['email' => [new \App\Rules\UserEmailLocal(true)]]
	);

	if ($v->fails()) {
	return $v->errors()->toArray()['email'][0];
	}

	// Check if a user with specified address already exists
	if (User::emailExists($email)) {
	return \trans('validation.entryexists', ['attribute' => 'email']);
	}

	// Check if an alias with specified address already exists.
	if (User::aliasExists($email)) {
	return \trans('validation.entryexists', ['attribute' => 'email']);
	}

	if (Group::emailExists($email)) {
	return \trans('validation.entryexists', ['attribute' => 'email']);
	}

	return null;
	}

	/**
	* Validate an email address for use as a group member
	*
	* @param string $email Email address
	* @param \App\User $user The group owner
	*
	* @return ?string Error message on validation error
	*/
	public static function validateMemberEmail($email, \App\User $user): ?string
	{
	$v = Validator::make(
	['email' => $email],
	['email' => [new \App\Rules\ExternalEmail()]]
	);

	if ($v->fails()) {
	return $v->errors()->toArray()['email'][0];
	}

	// A local domain user must exist
	if (!User::where('email', \strtolower($email))->first()) {
	list($login, $domain) = explode('@', \strtolower($email));

	$domain = Domain::where('namespace', $domain)->first();

	// We return an error only if the domain belongs to the group owner
	if ($domain && ($wallet = $domain->wallet()) && $user->wallets()->find($wallet->id)) {
	return \trans('validation.notalocaluser');
	}
	}

	return null;
	}
	}
	diff --git a/src/app/Http/Controllers/API/V4/OpenViduController.php b/src/app/Http/Controllers/API/V4/OpenViduController.php
	index ac21c63c..21d00c0a 100644
	--- a/src/app/Http/Controllers/API/V4/OpenViduController.php
	+++ b/src/app/Http/Controllers/API/V4/OpenViduController.php
	@@ -1,590 +1,589 @@
	<?php

	namespace App\Http\Controllers\API\V4;

	use App\Http\Controllers\Controller;
	use App\OpenVidu\Connection;
	use App\OpenVidu\Room;
	use Illuminate\Http\Request;
	use Illuminate\Support\Facades\Auth;
	use Illuminate\Support\Facades\Validator;

	class OpenViduController extends Controller
	{
	public const AUTH_HEADER = 'X-Meet-Auth-Token';

	/**
	* Accept the room join request.
	*
	* @param string $id Room identifier (name)
	* @param string $reqid Request identifier
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function acceptJoinRequest($id, $reqid)
	{
	$room = Room::where('name', $id)->first();

	// This isn't a room, bye bye
	if (!$room) {
	return $this->errorResponse(404, \trans('meet.room-not-found'));
	}

	// Only the moderator can do it
	if (!$this->isModerator($room)) {
	return $this->errorResponse(403);
	}

	if (!$room->requestAccept($reqid)) {
	return $this->errorResponse(500, \trans('meet.session-request-accept-error'));
	}

	return response()->json(['status' => 'success']);
	}

	/**
	* Deny the room join request.
	*
	* @param string $id Room identifier (name)
	* @param string $reqid Request identifier
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function denyJoinRequest($id, $reqid)
	{
	$room = Room::where('name', $id)->first();

	// This isn't a room, bye bye
	if (!$room) {
	return $this->errorResponse(404, \trans('meet.room-not-found'));
	}

	// Only the moderator can do it
	if (!$this->isModerator($room)) {
	return $this->errorResponse(403);
	}

	if (!$room->requestDeny($reqid)) {
	return $this->errorResponse(500, \trans('meet.session-request-deny-error'));
	}

	return response()->json(['status' => 'success']);
	}

	/**
	* Close the room session.
	*
	* @param string $id Room identifier (name)
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function closeRoom($id)
	{
	$room = Room::where('name', $id)->first();

	// This isn't a room, bye bye
	if (!$room) {
	return $this->errorResponse(404, \trans('meet.room-not-found'));
	}

	$user = Auth::guard()->user();

	// Only the room owner can do it
	if (!$user \|\| $user->id != $room->user_id) {
	return $this->errorResponse(403);
	}

	if (!$room->deleteSession()) {
	return $this->errorResponse(500, \trans('meet.session-close-error'));
	}

	return response()->json([
	'status' => 'success',
	'message' => __('meet.session-close-success'),
	]);
	}

	/**
	* Create a connection for screen sharing.
	*
	* @param string $id Room identifier (name)
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function createConnection($id)
	{
	$room = Room::where('name', $id)->first();

	// This isn't a room, bye bye
	if (!$room) {
	return $this->errorResponse(404, \trans('meet.room-not-found'));
	}

	$connection = $this->getConnectionFromRequest();

	if (
	!$connection
	\|\| $connection->session_id != $room->session_id
	\|\| ($connection->role & Room::ROLE_PUBLISHER) == 0
	) {
	return $this->errorResponse(403);
	}

	$response = $room->getSessionToken(Room::ROLE_SCREEN);

	return response()->json(['status' => 'success', 'token' => $response['token']]);
	}

	/**
	* Dismiss the participant/connection from the session.
	*
	* @param string $id Room identifier (name)
	* @param string $conn Connection identifier
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function dismissConnection($id, $conn)
	{
	$connection = Connection::where('id', $conn)->first();

	// There's no such connection, bye bye
	if (!$connection \|\| $connection->room->name != $id) {
	return $this->errorResponse(404, \trans('meet.connection-not-found'));
	}

	// Only the moderator can do it
	if (!$this->isModerator($connection->room)) {
	return $this->errorResponse(403);
	}

	if (!$connection->dismiss()) {
	return $this->errorResponse(500, \trans('meet.connection-dismiss-error'));
	}

	return response()->json(['status' => 'success']);
	}

	/**
	* Listing of rooms that belong to the authenticated user.
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function index()
	{
	$user = Auth::guard()->user();

	$rooms = Room::where('user_id', $user->id)->orderBy('name')->get();

	if (count($rooms) == 0) {
	// Create a room for the user (with a random and unique name)
	while (true) {
	$name = strtolower(\App\Utils::randStr(3, 3, '-'));
	if (!Room::where('name', $name)->count()) {
	break;
	}
	}

	$room = Room::create([
	'name' => $name,
	'user_id' => $user->id
	]);

	$rooms = collect([$room]);
	}

	$result = [
	'list' => $rooms,
	'count' => count($rooms),
	];

	return response()->json($result);
	}

	/**
	* Join the room session. Each room has one owner, and the room isn't open until the owner
	* joins (and effectively creates the session).
	*
	* @param string $id Room identifier (name)
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function joinRoom($id)
	{
	$room = Room::where('name', $id)->first();

	// Room does not exist, or the owner is deleted
	if (!$room \|\| !$room->owner) {
	return $this->errorResponse(404, \trans('meet.room-not-found'));
	}

	// Check if there's still a valid meet entitlement for the room owner
	- $sku = \App\Sku::where('title', 'meet')->first();
	- if ($sku && !$room->owner->entitlements()->where('sku_id', $sku->id)->first()) {
	+ if (!$room->owner->hasSku('meet')) {
	return $this->errorResponse(404, \trans('meet.room-not-found'));
	}

	$user = Auth::guard()->user();
	$isOwner = $user && $user->id == $room->user_id;
	$init = !empty(request()->input('init'));

	// There's no existing session
	if (!$room->hasSession()) {
	// Participants can't join the room until the session is created by the owner
	if (!$isOwner) {
	return $this->errorResponse(422, \trans('meet.session-not-found'), ['code' => 323]);
	}

	// The room owner can create the session on request
	if (!$init) {
	return $this->errorResponse(422, \trans('meet.session-not-found'), ['code' => 324]);
	}

	$session = $room->createSession();

	if (empty($session)) {
	return $this->errorResponse(500, \trans('meet.session-create-error'));
	}
	}

	$password = (string) $room->getSetting('password');

	$config = [
	'locked' => $room->getSetting('locked') === 'true',
	'nomedia' => $room->getSetting('nomedia') === 'true',
	'password' => $isOwner ? $password : '',
	'requires_password' => !$isOwner && strlen($password),
	];

	$response = ['config' => $config];

	// Validate room password
	if (!$isOwner && strlen($password)) {
	$request_password = request()->input('password');
	if ($request_password !== $password) {
	return $this->errorResponse(422, \trans('meet.session-password-error'), $response + ['code' => 325]);
	}
	}

	// Handle locked room
	if (!$isOwner && $config['locked']) {
	$nickname = request()->input('nickname');
	$picture = request()->input('picture');
	$requestId = request()->input('requestId');

	$request = $requestId ? $room->requestGet($requestId) : null;

	$error = \trans('meet.session-room-locked-error');

	// Request already has been processed (not accepted yet, but it could be denied)
	if (empty($request['status']) \|\| $request['status'] != Room::REQUEST_ACCEPTED) {
	if (!$request) {
	if (empty($nickname) \|\| empty($requestId) \|\| !preg_match('/^[a-z0-9]{8,32}$/i', $requestId)) {
	return $this->errorResponse(422, $error, $response + ['code' => 326]);
	}

	if (empty($picture)) {
	$svg = file_get_contents(resource_path('images/user.svg'));
	$picture = 'data:image/svg+xml;base64,' . base64_encode($svg);
	} elseif (!preg_match('\|^data:image/png;base64,[a-zA-Z0-9=+/]+$\|', $picture)) {
	return $this->errorResponse(422, $error, $response + ['code' => 326]);
	}

	// TODO: Resize when big/make safe the user picture?

	$request = ['nickname' => $nickname, 'requestId' => $requestId, 'picture' => $picture];

	if (!$room->requestSave($requestId, $request)) {
	// FIXME: should we use error code 500?
	return $this->errorResponse(422, $error, $response + ['code' => 326]);
	}

	// Send the request (signal) to the owner
	$result = $room->signal('joinRequest', $request, Room::ROLE_MODERATOR);
	}

	return $this->errorResponse(422, $error, $response + ['code' => 327]);
	}
	}

	// Initialize connection tokens
	if ($init) {
	// Choose the connection role
	$canPublish = !empty(request()->input('canPublish')) && (empty($config['nomedia']) \|\| $isOwner);
	$role = $canPublish ? Room::ROLE_PUBLISHER : Room::ROLE_SUBSCRIBER;
	if ($isOwner) {
	$role \|= Room::ROLE_MODERATOR;
	$role \|= Room::ROLE_OWNER;
	}

	// Create session token for the current user/connection
	$response = $room->getSessionToken($role);

	if (empty($response)) {
	return $this->errorResponse(500, \trans('meet.session-join-error'));
	}

	// Get up-to-date connections metadata
	$response['connections'] = $room->getSessionConnections();

	$response_code = 200;
	$response['role'] = $role;
	$response['config'] = $config;
	} else {
	$response_code = 422;
	$response['code'] = 322;
	}

	return response()->json($response, $response_code);
	}

	/**
	* Set the domain configuration.
	*
	* @param string $id Room identifier (name)
	*
	* @return \Illuminate\Http\JsonResponse\|void
	*/
	public function setRoomConfig($id)
	{
	$room = Room::where('name', $id)->first();

	// Room does not exist, or the owner is deleted
	if (!$room \|\| !$room->owner) {
	return $this->errorResponse(404);
	}

	$user = Auth::guard()->user();

	// Only room owner can configure the room
	if ($user->id != $room->user_id) {
	return $this->errorResponse(403);
	}

	$input = request()->input();
	$errors = [];

	foreach ($input as $key => $value) {
	switch ($key) {
	case 'password':
	if ($value === null \|\| $value === '') {
	$input[$key] = null;
	} else {
	// TODO: Do we have to validate the password in any way?
	}
	break;

	case 'locked':
	$input[$key] = $value ? 'true' : null;
	break;

	case 'nomedia':
	$input[$key] = $value ? 'true' : null;
	break;

	default:
	$errors[$key] = \trans('meet.room-unsupported-option-error');
	}
	}

	if (!empty($errors)) {
	return response()->json(['status' => 'error', 'errors' => $errors], 422);
	}

	if (!empty($input)) {
	$room->setSettings($input);
	}

	return response()->json([
	'status' => 'success',
	'message' => \trans('meet.room-setconfig-success'),
	]);
	}

	/**
	* Update the participant/connection parameters (e.g. role).
	*
	* @param string $id Room identifier (name)
	* @param string $conn Connection identifier
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function updateConnection($id, $conn)
	{
	$connection = Connection::where('id', $conn)->first();

	// There's no such connection, bye bye
	if (!$connection \|\| $connection->room->name != $id) {
	return $this->errorResponse(404, \trans('meet.connection-not-found'));
	}

	foreach (request()->input() as $key => $value) {
	switch ($key) {
	case 'hand':
	// Only possible on user's own connection(s)
	if (!$this->isSelfConnection($connection)) {
	return $this->errorResponse(403);
	}

	if ($value) {
	// Store current time, so we know the order in the queue
	$connection->metadata = ['hand' => time()] + $connection->metadata;
	} else {
	$connection->metadata = array_diff_key($connection->metadata, ['hand' => 0]);
	}

	break;

	case 'language':
	// Only the moderator can do it
	if (!$this->isModerator($connection->room)) {
	return $this->errorResponse(403);
	}

	if ($value) {
	if (preg_match('/^[a-z]{2}$/', $value)) {
	$connection->metadata = ['language' => $value] + $connection->metadata;
	}
	} else {
	$connection->metadata = array_diff_key($connection->metadata, ['language' => 0]);
	}

	break;

	case 'role':
	// Only the moderator can do it
	if (!$this->isModerator($connection->room)) {
	return $this->errorResponse(403);
	}

	// The 'owner' role is not assignable
	if ($value & Room::ROLE_OWNER && !($connection->role & Room::ROLE_OWNER)) {
	return $this->errorResponse(403);
	} elseif (!($value & Room::ROLE_OWNER) && ($connection->role & Room::ROLE_OWNER)) {
	return $this->errorResponse(403);
	}

	// The room owner has always a 'moderator' role
	if (!($value & Room::ROLE_MODERATOR) && $connection->role & Room::ROLE_OWNER) {
	$value \|= Room::ROLE_MODERATOR;
	}

	// Promotion to publisher? Put the user hand down
	if ($value & Room::ROLE_PUBLISHER && !($connection->role & Room::ROLE_PUBLISHER)) {
	$connection->metadata = array_diff_key($connection->metadata, ['hand' => 0]);
	}

	// Non-publisher cannot be a language interpreter
	if (!($value & Room::ROLE_PUBLISHER)) {
	$connection->metadata = array_diff_key($connection->metadata, ['language' => 0]);
	}

	$connection->{$key} = $value;
	break;
	}
	}

	// The connection observer will send a signal to everyone when needed
	$connection->save();

	return response()->json(['status' => 'success']);
	}

	/**
	* Webhook as triggered from OpenVidu server
	*
	* @param \Illuminate\Http\Request $request The API request.
	*
	* @return \Illuminate\Http\Response The response
	*/
	public function webhook(Request $request)
	{
	\Log::debug($request->getContent());

	switch ((string) $request->input('event')) {
	case 'sessionDestroyed':
	// When all participants left the room OpenVidu dispatches sessionDestroyed
	// event. We'll remove the session reference from the database.
	$sessionId = $request->input('sessionId');
	$room = Room::where('session_id', $sessionId)->first();

	if ($room) {
	$room->session_id = null;
	$room->save();
	}

	// Remove all connections
	// Note: We could remove connections one-by-one via the 'participantLeft' event
	// but that could create many INSERTs when the session (with many participants) ends
	// So, it is better to remove them all in a single INSERT.
	Connection::where('session_id', $sessionId)->delete();

	break;
	}

	return response('Success', 200);
	}

	/**
	* Check if current user is a moderator for the specified room.
	*
	* @param \App\OpenVidu\Room $room The room
	*
	* @return bool True if the current user is the room moderator
	*/
	protected function isModerator(Room $room): bool
	{
	$user = Auth::guard()->user();

	// The room owner is a moderator
	if ($user && $user->id == $room->user_id) {
	return true;
	}

	// Moderator's authentication via the extra request header
	if (
	($connection = $this->getConnectionFromRequest())
	&& $connection->session_id === $room->session_id
	&& $connection->role & Room::ROLE_MODERATOR
	) {
	return true;
	}

	return false;
	}

	/**
	* Check if current user "owns" the specified connection.
	*
	* @param \App\OpenVidu\Connection $connection The connection
	*
	* @return bool
	*/
	protected function isSelfConnection(Connection $connection): bool
	{
	return ($conn = $this->getConnectionFromRequest())
	&& $conn->id === $connection->id;
	}

	/**
	* Get the connection object for the token in current request headers.
	* It will also validate the token.
	*
	* @return \App\OpenVidu\Connection\|null Connection (if exists and the token is valid)
	*/
	protected function getConnectionFromRequest()
	{
	// Authenticate the user via the extra request header
	if ($token = request()->header(self::AUTH_HEADER)) {
	list($connId, ) = explode(':', base64_decode($token), 2);

	if (
	($connection = Connection::find($connId))
	&& $connection->metadata['authToken'] === $token
	) {
	return $connection;
	}
	}

	return null;
	}
	}
	diff --git a/src/app/Http/Controllers/API/V4/PackagesController.php b/src/app/Http/Controllers/API/V4/PackagesController.php
	index 25dae9a1..1e592bc8 100644
	--- a/src/app/Http/Controllers/API/V4/PackagesController.php
	+++ b/src/app/Http/Controllers/API/V4/PackagesController.php
	@@ -1,112 +1,112 @@
	<?php

	namespace App\Http\Controllers\API\V4;

	use App\Package;
	use App\Http\Controllers\Controller;
	use Illuminate\Http\Request;

	class PackagesController extends Controller
	{
	/**
	* Show the form for creating a new package.
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function create()
	{
	// TODO
	return $this->errorResponse(404);
	}

	/**
	* Remove the specified package from storage.
	*
	* @param int $id Package identifier
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function destroy($id)
	{
	// TODO
	return $this->errorResponse(404);
	}

	/**
	* Show the form for editing the specified package.
	*
	* @param int $id Package identifier
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function edit($id)
	{
	// TODO
	return $this->errorResponse(404);
	}

	/**
	* Display a listing of packages.
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function index()
	{
	// TODO: Packages should have an 'active' flag too, I guess
	$response = [];
	- $packages = Package::select()->orderBy('title')->get();
	+ $packages = Package::withSubjectTenantContext()->select()->orderBy('title')->get();

	foreach ($packages as $package) {
	$response[] = [
	'id' => $package->id,
	'title' => $package->title,
	'name' => $package->name,
	'description' => $package->description,
	'cost' => $package->cost(),
	'isDomain' => $package->isDomain(),
	];
	}

	return response()->json($response);
	}

	/**
	* Store a newly created package in storage.
	*
	* @param \Illuminate\Http\Request $request
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function store(Request $request)
	{
	// TODO
	return $this->errorResponse(404);
	}

	/**
	* Display the specified package.
	*
	* @param int $id Package identifier
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function show($id)
	{
	// TODO
	return $this->errorResponse(404);
	}

	/**
	* Update the specified package in storage.
	*
	* @param \Illuminate\Http\Request $request Request object
	* @param int $id Package identifier
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function update(Request $request, $id)
	{
	// TODO
	return $this->errorResponse(404);
	}
	}
	diff --git a/src/app/Http/Controllers/API/V4/PaymentsController.php b/src/app/Http/Controllers/API/V4/PaymentsController.php
	index e46b8f88..b1d2ab87 100644
	--- a/src/app/Http/Controllers/API/V4/PaymentsController.php
	+++ b/src/app/Http/Controllers/API/V4/PaymentsController.php
	@@ -1,475 +1,474 @@
	<?php

	namespace App\Http\Controllers\API\V4;

	use App\Http\Controllers\Controller;
	use App\Providers\PaymentProvider;
	use App\Wallet;
	use App\Payment;
	use Illuminate\Http\Request;
	-use Illuminate\Support\Facades\Auth;
	use Illuminate\Support\Facades\Validator;

	class PaymentsController extends Controller
	{
	/**
	* Get the auto-payment mandate info.
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	public function mandate()
	{
	- $user = Auth::guard()->user();
	+ $user = $this->guard()->user();

	// TODO: Wallet selection
	$wallet = $user->wallets()->first();

	$mandate = self::walletMandate($wallet);

	return response()->json($mandate);
	}

	/**
	* Create a new auto-payment mandate.
	*
	* @param \Illuminate\Http\Request $request The API request.
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	public function mandateCreate(Request $request)
	{
	- $current_user = Auth::guard()->user();
	+ $user = $this->guard()->user();

	// TODO: Wallet selection
	- $wallet = $current_user->wallets()->first();
	+ $wallet = $user->wallets()->first();

	// Input validation
	if ($errors = self::mandateValidate($request, $wallet)) {
	return response()->json(['status' => 'error', 'errors' => $errors], 422);
	}

	$wallet->setSettings([
	'mandate_amount' => $request->amount,
	'mandate_balance' => $request->balance,
	]);

	$mandate = [
	'currency' => 'CHF',
	'description' => \config('app.name') . ' Auto-Payment Setup',
	'methodId' => $request->methodId
	];

	// Normally the auto-payment setup operation is 0, if the balance is below the threshold
	// we'll top-up the wallet with the configured auto-payment amount
	if ($wallet->balance < intval($request->balance * 100)) {
	$mandate['amount'] = intval($request->amount * 100);
	}

	$provider = PaymentProvider::factory($wallet);

	$result = $provider->createMandate($wallet, $mandate);

	$result['status'] = 'success';

	return response()->json($result);
	}

	/**
	* Revoke the auto-payment mandate.
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	public function mandateDelete()
	{
	- $user = Auth::guard()->user();
	+ $user = $this->guard()->user();

	// TODO: Wallet selection
	$wallet = $user->wallets()->first();

	$provider = PaymentProvider::factory($wallet);

	$provider->deleteMandate($wallet);

	$wallet->setSetting('mandate_disabled', null);

	return response()->json([
	'status' => 'success',
	'message' => \trans('app.mandate-delete-success'),
	]);
	}

	/**
	* Update a new auto-payment mandate.
	*
	* @param \Illuminate\Http\Request $request The API request.
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	public function mandateUpdate(Request $request)
	{
	- $current_user = Auth::guard()->user();
	+ $user = $this->guard()->user();

	// TODO: Wallet selection
	- $wallet = $current_user->wallets()->first();
	+ $wallet = $user->wallets()->first();

	// Input validation
	if ($errors = self::mandateValidate($request, $wallet)) {
	return response()->json(['status' => 'error', 'errors' => $errors], 422);
	}

	$wallet->setSettings([
	'mandate_amount' => $request->amount,
	'mandate_balance' => $request->balance,
	// Re-enable the mandate to give it a chance to charge again
	// after it has been disabled (e.g. because the mandate amount was too small)
	'mandate_disabled' => null,
	]);

	// Trigger auto-payment if the balance is below the threshold
	if ($wallet->balance < intval($request->balance * 100)) {
	\App\Jobs\WalletCharge::dispatch($wallet);
	}

	$result = self::walletMandate($wallet);
	$result['status'] = 'success';
	$result['message'] = \trans('app.mandate-update-success');

	return response()->json($result);
	}

	/**
	* Validate an auto-payment mandate request.
	*
	* @param \Illuminate\Http\Request $request The API request.
	* @param \App\Wallet $wallet The wallet
	*
	* @return array\|null List of errors on error or Null on success
	*/
	protected static function mandateValidate(Request $request, Wallet $wallet)
	{
	$rules = [
	'amount' => 'required\|numeric',
	'balance' => 'required\|numeric\|min:0',
	];

	// Check required fields
	$v = Validator::make($request->all(), $rules);

	// TODO: allow comma as a decimal point?

	if ($v->fails()) {
	return $v->errors()->toArray();
	}

	$amount = (int) ($request->amount * 100);

	// Validate the minimum value
	// It has to be at least minimum payment amount and must cover current debt
	if (
	$wallet->balance < 0
	&& $wallet->balance * -1 > PaymentProvider::MIN_AMOUNT
	&& $wallet->balance + $amount < 0
	) {
	return ['amount' => \trans('validation.minamountdebt')];
	}

	if ($amount < PaymentProvider::MIN_AMOUNT) {
	$min = intval(PaymentProvider::MIN_AMOUNT / 100) . ' CHF';
	return ['amount' => \trans('validation.minamount', ['amount' => $min])];
	}

	return null;
	}

	/**
	* Create a new payment.
	*
	* @param \Illuminate\Http\Request $request The API request.
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	public function store(Request $request)
	{
	- $current_user = Auth::guard()->user();
	+ $user = $this->guard()->user();

	// TODO: Wallet selection
	- $wallet = $current_user->wallets()->first();
	+ $wallet = $user->wallets()->first();

	$rules = [
	'amount' => 'required\|numeric',
	];

	// Check required fields
	$v = Validator::make($request->all(), $rules);

	// TODO: allow comma as a decimal point?

	if ($v->fails()) {
	return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
	}

	$amount = (int) ($request->amount * 100);

	// Validate the minimum value
	if ($amount < PaymentProvider::MIN_AMOUNT) {
	$min = intval(PaymentProvider::MIN_AMOUNT / 100) . ' CHF';
	$errors = ['amount' => \trans('validation.minamount', ['amount' => $min])];
	return response()->json(['status' => 'error', 'errors' => $errors], 422);
	}

	$request = [
	'type' => PaymentProvider::TYPE_ONEOFF,
	'currency' => $request->currency,
	'amount' => $amount,
	'methodId' => $request->methodId,
	'description' => \config('app.name') . ' Payment',
	];

	$provider = PaymentProvider::factory($wallet);

	$result = $provider->payment($wallet, $request);

	$result['status'] = 'success';

	return response()->json($result);
	}

	/**
	* Delete a pending payment.
	*
	* @param \Illuminate\Http\Request $request The API request.
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	// TODO currently unused
	// public function cancel(Request $request)
	// {
	- // $current_user = Auth::guard()->user();
	+ // $user = $this->guard()->user();

	// // TODO: Wallet selection
	- // $wallet = $current_user->wallets()->first();
	+ // $wallet = $user->wallets()->first();

	// $paymentId = $request->payment;

	// $user_owns_payment = Payment::where('id', $paymentId)
	// ->where('wallet_id', $wallet->id)
	// ->exists();

	// if (!$user_owns_payment) {
	// return $this->errorResponse(404);
	// }

	// $provider = PaymentProvider::factory($wallet);
	// if ($provider->cancel($wallet, $paymentId)) {
	// $result = ['status' => 'success'];
	// return response()->json($result);
	// }

	// return $this->errorResponse(404);
	// }

	/**
	* Update payment status (and balance).
	*
	* @param string $provider Provider name
	*
	* @return \Illuminate\Http\Response The response
	*/
	public function webhook($provider)
	{
	$code = 200;

	if ($provider = PaymentProvider::factory($provider)) {
	$code = $provider->webhook();
	}

	return response($code < 400 ? 'Success' : 'Server error', $code);
	}

	/**
	* Top up a wallet with a "recurring" payment.
	*
	* @param \App\Wallet $wallet The wallet to charge
	*
	* @return bool True if the payment has been initialized
	*/
	public static function topUpWallet(Wallet $wallet): bool
	{
	if ((bool) $wallet->getSetting('mandate_disabled')) {
	return false;
	}

	$min_balance = (int) (floatval($wallet->getSetting('mandate_balance')) * 100);
	$amount = (int) (floatval($wallet->getSetting('mandate_amount')) * 100);

	// The wallet balance is greater than the auto-payment threshold
	if ($wallet->balance >= $min_balance) {
	// Do nothing
	return false;
	}

	$provider = PaymentProvider::factory($wallet);
	$mandate = (array) $provider->getMandate($wallet);

	if (empty($mandate['isValid'])) {
	return false;
	}

	// The defined top-up amount is not enough
	// Disable auto-payment and notify the user
	if ($wallet->balance + $amount < 0) {
	// Disable (not remove) the mandate
	$wallet->setSetting('mandate_disabled', 1);
	\App\Jobs\PaymentMandateDisabledEmail::dispatch($wallet);
	return false;
	}

	$request = [
	'type' => PaymentProvider::TYPE_RECURRING,
	'currency' => 'CHF',
	'amount' => $amount,
	'methodId' => PaymentProvider::METHOD_CREDITCARD,
	'description' => \config('app.name') . ' Recurring Payment',
	];

	$result = $provider->payment($wallet, $request);

	return !empty($result);
	}

	/**
	* Returns auto-payment mandate info for the specified wallet
	*
	* @param \App\Wallet $wallet A wallet object
	*
	* @return array A mandate metadata
	*/
	public static function walletMandate(Wallet $wallet): array
	{
	$provider = PaymentProvider::factory($wallet);

	// Get the Mandate info
	$mandate = (array) $provider->getMandate($wallet);

	$mandate['amount'] = (int) (PaymentProvider::MIN_AMOUNT / 100);
	$mandate['balance'] = 0;
	$mandate['isDisabled'] = !empty($mandate['id']) && $wallet->getSetting('mandate_disabled');

	foreach (['amount', 'balance'] as $key) {
	if (($value = $wallet->getSetting("mandate_{$key}")) !== null) {
	$mandate[$key] = $value;
	}
	}

	return $mandate;
	}


	/**
	* List supported payment methods.
	*
	* @param \Illuminate\Http\Request $request The API request.
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	- public static function paymentMethods(Request $request)
	+ public function paymentMethods(Request $request)
	{
	- $user = Auth::guard()->user();
	+ $user = $this->guard()->user();

	// TODO: Wallet selection
	$wallet = $user->wallets()->first();

	$methods = PaymentProvider::paymentMethods($wallet, $request->type);

	\Log::debug("Provider methods" . var_export(json_encode($methods), true));

	return response()->json($methods);
	}

	/**
	* Check for pending payments.
	*
	* @param \Illuminate\Http\Request $request The API request.
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	- public static function hasPayments(Request $request)
	+ public function hasPayments(Request $request)
	{
	- $user = Auth::guard()->user();
	+ $user = $this->guard()->user();

	// TODO: Wallet selection
	$wallet = $user->wallets()->first();

	$exists = Payment::where('wallet_id', $wallet->id)
	->where('type', PaymentProvider::TYPE_ONEOFF)
	->whereIn('status', [
	PaymentProvider::STATUS_OPEN,
	PaymentProvider::STATUS_PENDING,
	PaymentProvider::STATUS_AUTHORIZED])
	->exists();

	return response()->json([
	'status' => 'success',
	'hasPending' => $exists
	]);
	}

	/**
	* List pending payments.
	*
	* @param \Illuminate\Http\Request $request The API request.
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	- public static function payments(Request $request)
	+ public function payments(Request $request)
	{
	- $user = Auth::guard()->user();
	+ $user = $this->guard()->user();

	// TODO: Wallet selection
	$wallet = $user->wallets()->first();

	$pageSize = 10;
	$page = intval(request()->input('page')) ?: 1;
	$hasMore = false;
	$result = Payment::where('wallet_id', $wallet->id)
	->where('type', PaymentProvider::TYPE_ONEOFF)
	->whereIn('status', [
	PaymentProvider::STATUS_OPEN,
	PaymentProvider::STATUS_PENDING,
	PaymentProvider::STATUS_AUTHORIZED])
	->orderBy('created_at', 'desc')
	->limit($pageSize + 1)
	->offset($pageSize * ($page - 1))
	->get();

	if (count($result) > $pageSize) {
	$result->pop();
	$hasMore = true;
	}

	$result = $result->map(function ($item) {
	$provider = PaymentProvider::factory($item->provider);
	$payment = $provider->getPayment($item->id);
	$entry = [
	'id' => $item->id,
	'createdAt' => $item->created_at->format('Y-m-d H:i'),
	'type' => $item->type,
	'description' => $item->description,
	'amount' => $item->amount,
	'status' => $item->status,
	'isCancelable' => $payment['isCancelable'],
	'checkoutUrl' => $payment['checkoutUrl']
	];

	return $entry;
	});

	return response()->json([
	'status' => 'success',
	'list' => $result,
	'count' => count($result),
	'hasMore' => $hasMore,
	'page' => $page,
	]);
	}
	}
	diff --git a/src/app/Http/Controllers/API/V4/Reseller/DomainsController.php b/src/app/Http/Controllers/API/V4/Reseller/DomainsController.php
	index c4565e6b..b24b5839 100644
	--- a/src/app/Http/Controllers/API/V4/Reseller/DomainsController.php
	+++ b/src/app/Http/Controllers/API/V4/Reseller/DomainsController.php
	@@ -1,7 +1,55 @@
	<?php

	namespace App\Http\Controllers\API\V4\Reseller;

	+use App\Domain;
	+use App\User;
	+
	class DomainsController extends \App\Http\Controllers\API\V4\Admin\DomainsController
	{
	+ /**
	+ * Search for domains
	+ *
	+ * @return \Illuminate\Http\JsonResponse
	+ */
	+ public function index()
	+ {
	+ $search = trim(request()->input('search'));
	+ $owner = trim(request()->input('owner'));
	+ $result = collect([]);
	+
	+ if ($owner) {
	+ if ($owner = User::withSubjectTenantContext()->find($owner)) {
	+ foreach ($owner->wallets as $wallet) {
	+ $entitlements = $wallet->entitlements()->where('entitleable_type', Domain::class)->get();
	+
	+ foreach ($entitlements as $entitlement) {
	+ $domain = $entitlement->entitleable;
	+ $result->push($domain);
	+ }
	+ }
	+
	+ $result = $result->sortBy('namespace')->values();
	+ }
	+ } elseif (!empty($search)) {
	+ if ($domain = Domain::withSubjectTenantContext()->where('namespace', $search)->first()) {
	+ $result->push($domain);
	+ }
	+ }
	+
	+ // Process the result
	+ $result = $result->map(function ($domain) {
	+ $data = $domain->toArray();
	+ $data = array_merge($data, self::domainStatuses($domain));
	+ return $data;
	+ });
	+
	+ $result = [
	+ 'list' => $result,
	+ 'count' => count($result),
	+ 'message' => \trans('app.search-foundxdomains', ['x' => count($result)]),
	+ ];
	+
	+ return response()->json($result);
	+ }
	}
	diff --git a/src/app/Http/Controllers/API/V4/Reseller/GroupsController.php b/src/app/Http/Controllers/API/V4/Reseller/GroupsController.php
	index 20794447..6891a00b 100644
	--- a/src/app/Http/Controllers/API/V4/Reseller/GroupsController.php
	+++ b/src/app/Http/Controllers/API/V4/Reseller/GroupsController.php
	@@ -1,7 +1,57 @@
	<?php

	namespace App\Http\Controllers\API\V4\Reseller;

	+use App\Group;
	+use App\User;
	+
	class GroupsController extends \App\Http\Controllers\API\V4\Admin\GroupsController
	{
	+ /**
	+ * Search for groups
	+ *
	+ * @return \Illuminate\Http\JsonResponse
	+ */
	+ public function index()
	+ {
	+ $search = trim(request()->input('search'));
	+ $owner = trim(request()->input('owner'));
	+ $result = collect([]);
	+
	+ if ($owner) {
	+ if ($owner = User::withSubjectTenantContext()->find($owner)) {
	+ foreach ($owner->wallets as $wallet) {
	+ $wallet->entitlements()->where('entitleable_type', Group::class)->get()
	+ ->each(function ($entitlement) use ($result) {
	+ $result->push($entitlement->entitleable);
	+ });
	+ }
	+
	+ $result = $result->sortBy('namespace')->values();
	+ }
	+ } elseif (!empty($search)) {
	+ if ($group = Group::withSubjectTenantContext()->where('email', $search)->first()) {
	+ $result->push($group);
	+ }
	+ }
	+
	+ // Process the result
	+ $result = $result->map(function ($group) {
	+ $data = [
	+ 'id' => $group->id,
	+ 'email' => $group->email,
	+ ];
	+
	+ $data = array_merge($data, self::groupStatuses($group));
	+ return $data;
	+ });
	+
	+ $result = [
	+ 'list' => $result,
	+ 'count' => count($result),
	+ 'message' => \trans('app.search-foundxdistlists', ['x' => count($result)]),
	+ ];
	+
	+ return response()->json($result);
	+ }
	}
	diff --git a/src/app/Http/Controllers/API/V4/Reseller/InvitationsController.php b/src/app/Http/Controllers/API/V4/Reseller/InvitationsController.php
	index 94f72634..dea45808 100644
	--- a/src/app/Http/Controllers/API/V4/Reseller/InvitationsController.php
	+++ b/src/app/Http/Controllers/API/V4/Reseller/InvitationsController.php
	@@ -1,252 +1,261 @@
	<?php

	namespace App\Http\Controllers\API\V4\Reseller;

	use App\Http\Controllers\Controller;
	use App\SignupInvitation;
	use Illuminate\Http\Request;
	use Illuminate\Support\Facades\Validator;

	class InvitationsController extends Controller
	{
	/**
	* Show the form for creating a new resource.
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function create()
	{
	return $this->errorResponse(404);
	}

	/**
	* Remove the specified invitation.
	*
	* @param int $id Invitation identifier
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function destroy($id)
	{
	- $invitation = SignupInvitation::withUserTenant()->find($id);
	+ $invitation = SignupInvitation::withSubjectTenantContext()->find($id);

	if (empty($invitation)) {
	return $this->errorResponse(404);
	}

	$invitation->delete();

	return response()->json([
	'status' => 'success',
	'message' => trans('app.signup-invitation-delete-success'),
	]);
	}

	/**
	* Show the form for editing the specified resource.
	*
	* @param int $id Invitation identifier
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function edit($id)
	{
	return $this->errorResponse(404);
	}

	/**
	* Display a listing of the resource.
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function index()
	{
	$pageSize = 10;
	$search = request()->input('search');
	$page = intval(request()->input('page')) ?: 1;
	$hasMore = false;

	- $result = SignupInvitation::withUserTenant()
	+ $result = SignupInvitation::withSubjectTenantContext()
	->latest()
	->limit($pageSize + 1)
	->offset($pageSize * ($page - 1));

	if ($search) {
	if (strpos($search, '@')) {
	$result->where('email', $search);
	} else {
	$result->whereLike('email', $search);
	}
	}

	$result = $result->get();

	if (count($result) > $pageSize) {
	$result->pop();
	$hasMore = true;
	}

	$result = $result->map(function ($invitation) {
	return $this->invitationToArray($invitation);
	});

	return response()->json([
	'status' => 'success',
	'list' => $result,
	'count' => count($result),
	'hasMore' => $hasMore,
	'page' => $page,
	]);
	}

	/**
	* Resend the specified invitation.
	*
	* @param int $id Invitation identifier
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function resend($id)
	{
	- $invitation = SignupInvitation::withUserTenant()->find($id);
	+ $invitation = SignupInvitation::withSubjectTenantContext()->find($id);

	if (empty($invitation)) {
	return $this->errorResponse(404);
	}

	if ($invitation->isFailed() \|\| $invitation->isSent()) {
	// Note: The email sending job will be dispatched by the observer
	$invitation->status = SignupInvitation::STATUS_NEW;
	$invitation->save();
	}

	return response()->json([
	'status' => 'success',
	'message' => trans('app.signup-invitation-resend-success'),
	'invitation' => $this->invitationToArray($invitation),
	]);
	}

	/**
	* Store a newly created resource in storage.
	*
	* @param \Illuminate\Http\Request $request
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function store(Request $request)
	{
	$errors = [];
	$invitations = [];

	+ $envTenantId = \config('app.tenant_id');
	+ $subjectTenantId = auth()->user()->tenant_id;
	+
	if (!empty($request->file) && is_object($request->file)) {
	// Expected a text/csv file with multiple email addresses
	if (!$request->file->isValid()) {
	$errors = ['file' => [$request->file->getErrorMessage()]];
	} else {
	$fh = fopen($request->file->getPathname(), 'r');
	$line_number = 0;
	$error = null;

	while ($line = fgetcsv($fh)) {
	$line_number++;

	// @phpstan-ignore-next-line
	if (count($line) >= 1 && $line[0]) {
	$email = trim($line[0]);

	if (strpos($email, '@')) {
	$v = Validator::make(['email' => $email], ['email' => 'email:filter\|required']);

	if ($v->fails()) {
	$args = ['email' => $email, 'line' => $line_number];
	$error = trans('app.signup-invitations-csv-invalid-email', $args);
	break;
	}

	$invitations[] = ['email' => $email];
	}
	}
	}

	fclose($fh);

	if ($error) {
	$errors = ['file' => $error];
	} elseif (empty($invitations)) {
	$errors = ['file' => trans('app.signup-invitations-csv-empty')];
	}
	}
	} else {
	// Expected 'email' field with an email address
	$v = Validator::make($request->all(), ['email' => 'email\|required']);

	if ($v->fails()) {
	$errors = $v->errors()->toArray();
	} else {
	$invitations[] = ['email' => $request->email];
	}
	}

	if (!empty($errors)) {
	return response()->json(['status' => 'error', 'errors' => $errors], 422);
	}

	$count = 0;
	foreach ($invitations as $idx => $invitation) {
	- SignupInvitation::create($invitation);
	+ $inv = SignupInvitation::create($invitation);
	$count++;
	+
	+ // Set the invitation tenant to the reseller tenant
	+ if ($envTenantId != $subjectTenantId) {
	+ $inv->tenant_id = $subjectTenantId;
	+ $inv->save();
	+ }
	}

	return response()->json([
	'status' => 'success',
	'message' => \trans_choice('app.signup-invitations-created', $count, ['count' => $count]),
	'count' => $count,
	]);
	}

	/**
	* Display the specified resource.
	*
	* @param int $id Invitation identifier
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function show($id)
	{
	return $this->errorResponse(404);
	}

	/**
	* Update the specified resource in storage.
	*
	* @param \Illuminate\Http\Request $request
	* @param int $id
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function update(Request $request, $id)
	{
	return $this->errorResponse(404);
	}

	/**
	* Convert an invitation object to an array for output
	*
	* @param \App\SignupInvitation $invitation The signup invitation object
	*
	* @return array
	*/
	protected static function invitationToArray(SignupInvitation $invitation): array
	{
	return [
	'id' => $invitation->id,
	'email' => $invitation->email,
	'isNew' => $invitation->isNew(),
	'isSent' => $invitation->isSent(),
	'isFailed' => $invitation->isFailed(),
	'isCompleted' => $invitation->isCompleted(),
	'created' => $invitation->created_at->toDateTimeString(),
	];
	}
	}
	diff --git a/src/app/Http/Controllers/API/V4/Reseller/PackagesController.php b/src/app/Http/Controllers/API/V4/Reseller/PackagesController.php
	deleted file mode 100644
	index ba5742df..00000000
	--- a/src/app/Http/Controllers/API/V4/Reseller/PackagesController.php
	+++ /dev/null
	@@ -1,7 +0,0 @@
	-<?php
	-
	-namespace App\Http\Controllers\API\V4\Reseller;
	-
	-class PackagesController extends \App\Http\Controllers\API\V4\PackagesController
	-{
	-}
	diff --git a/src/app/Http/Controllers/API/V4/Reseller/StatsController.php b/src/app/Http/Controllers/API/V4/Reseller/StatsController.php
	index 8491caa8..46082df0 100644
	--- a/src/app/Http/Controllers/API/V4/Reseller/StatsController.php
	+++ b/src/app/Http/Controllers/API/V4/Reseller/StatsController.php
	@@ -1,14 +1,37 @@
	<?php

	namespace App\Http\Controllers\API\V4\Reseller;

	+use Illuminate\Support\Facades\Auth;
	+
	class StatsController extends \App\Http\Controllers\API\V4\Admin\StatsController
	{
	/** @var array List of enabled charts */
	protected $charts = [
	'discounts',
	// 'income',
	'users',
	'users-all',
	];
	+
	+ /**
	+ * Add tenant scope to the queries when needed
	+ *
	+ * @param \Illuminate\Database\Query\Builder $query The query
	+ * @param callable $addQuery Additional tenant-scope query-modifier
	+ *
	+ * @return \Illuminate\Database\Query\Builder
	+ */
	+ protected function applyTenantScope($query, $addQuery = null)
	+ {
	+ $user = Auth::guard()->user();
	+
	+ if ($addQuery) {
	+ $query = $addQuery($query, $user->tenant_id);
	+ } else {
	+ $query = $query->withSubjectTenantContext();
	+ }
	+
	+ return $query;
	+ }
	}
	diff --git a/src/app/Http/Controllers/API/V4/Reseller/UsersController.php b/src/app/Http/Controllers/API/V4/Reseller/UsersController.php
	index 8c9921cf..14281701 100644
	--- a/src/app/Http/Controllers/API/V4/Reseller/UsersController.php
	+++ b/src/app/Http/Controllers/API/V4/Reseller/UsersController.php
	@@ -1,7 +1,108 @@
	<?php

	namespace App\Http\Controllers\API\V4\Reseller;

	+use App\Domain;
	+use App\Group;
	+use App\User;
	+use App\UserAlias;
	+use App\UserSetting;
	+
	class UsersController extends \App\Http\Controllers\API\V4\Admin\UsersController
	{
	+ /**
	+ * Searching of user accounts.
	+ *
	+ * @return \Illuminate\Http\JsonResponse
	+ */
	+ public function index()
	+ {
	+ $search = trim(request()->input('search'));
	+ $owner = trim(request()->input('owner'));
	+ $result = collect([]);
	+
	+ if ($owner) {
	+ $owner = User::where('id', $owner)
	+ ->withSubjectTenantContext()
	+ ->whereNull('role')
	+ ->first();
	+
	+ if ($owner) {
	+ $result = $owner->users(false)->whereNull('role')->orderBy('email')->get();
	+ }
	+ } elseif (strpos($search, '@')) {
	+ // Search by email
	+ $result = User::withTrashed()->where('email', $search)
	+ ->withSubjectTenantContext()
	+ ->whereNull('role')
	+ ->orderBy('email')
	+ ->get();
	+
	+ if ($result->isEmpty()) {
	+ // Search by an alias
	+ $user_ids = UserAlias::where('alias', $search)->get()->pluck('user_id');
	+
	+ // Search by an external email
	+ $ext_user_ids = UserSetting::where('key', 'external_email')
	+ ->where('value', $search)
	+ ->get()
	+ ->pluck('user_id');
	+
	+ $user_ids = $user_ids->merge($ext_user_ids)->unique();
	+
	+ // Search by a distribution list email
	+ if ($group = Group::withTrashed()->where('email', $search)->first()) {
	+ $user_ids = $user_ids->merge([$group->wallet()->user_id])->unique();
	+ }
	+
	+ if (!$user_ids->isEmpty()) {
	+ $result = User::withTrashed()->whereIn('id', $user_ids)
	+ ->withSubjectTenantContext()
	+ ->whereNull('role')
	+ ->orderBy('email')
	+ ->get();
	+ }
	+ }
	+ } elseif (is_numeric($search)) {
	+ // Search by user ID
	+ $user = User::withTrashed()->where('id', $search)
	+ ->withSubjectTenantContext()
	+ ->whereNull('role')
	+ ->first();
	+
	+ if ($user) {
	+ $result->push($user);
	+ }
	+ } elseif (!empty($search)) {
	+ // Search by domain
	+ $domain = Domain::withTrashed()->where('namespace', $search)
	+ ->withSubjectTenantContext()
	+ ->first();
	+
	+ if ($domain) {
	+ if (
	+ ($wallet = $domain->wallet())
	+ && ($owner = $wallet->owner()->withTrashed()->withSubjectTenantContext()->first())
	+ && empty($owner->role)
	+ ) {
	+ $result->push($owner);
	+ }
	+ }
	+ }
	+
	+ // Process the result
	+ $result = $result->map(function ($user) {
	+ $data = $user->toArray();
	+ $data = array_merge($data, self::userStatuses($user));
	+ return $data;
	+ });
	+
	+ $result = [
	+ 'list' => $result,
	+ 'count' => count($result),
	+ 'message' => \trans('app.search-foundxusers', ['x' => count($result)]),
	+ ];
	+
	+ return response()->json($result);
	+ }
	}
	diff --git a/src/app/Http/Controllers/API/V4/Reseller/WalletsController.php b/src/app/Http/Controllers/API/V4/Reseller/WalletsController.php
	index 2edcde8b..8a704a86 100644
	--- a/src/app/Http/Controllers/API/V4/Reseller/WalletsController.php
	+++ b/src/app/Http/Controllers/API/V4/Reseller/WalletsController.php
	@@ -1,11 +1,7 @@
	<?php

	namespace App\Http\Controllers\API\V4\Reseller;

	-use App\Discount;
	-use App\Wallet;
	-use Illuminate\Http\Request;
	-
	class WalletsController extends \App\Http\Controllers\API\V4\Admin\WalletsController
	{
	}
	diff --git a/src/app/Http/Controllers/API/V4/SkusController.php b/src/app/Http/Controllers/API/V4/SkusController.php
	index 423822a2..0d49d694 100644
	--- a/src/app/Http/Controllers/API/V4/SkusController.php
	+++ b/src/app/Http/Controllers/API/V4/SkusController.php
	@@ -1,193 +1,192 @@
	<?php

	namespace App\Http\Controllers\API\V4;

	use App\Http\Controllers\Controller;
	use App\Sku;
	use Illuminate\Http\Request;
	-use Illuminate\Support\Facades\Auth;

	class SkusController extends Controller
	{
	/**
	* Show the form for creating a new sku.
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function create()
	{
	// TODO
	return $this->errorResponse(404);
	}

	/**
	* Remove the specified sku from storage.
	*
	* @param int $id SKU identifier
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function destroy($id)
	{
	// TODO
	return $this->errorResponse(404);
	}

	/**
	* Show the form for editing the specified sku.
	*
	* @param int $id SKU identifier
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function edit($id)
	{
	// TODO
	return $this->errorResponse(404);
	}

	/**
	* Get a list of active SKUs.
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function index()
	{
	// Note: Order by title for consistent ordering in tests
	- $skus = Sku::withEnvTenant()->where('active', true)->orderBy('title')->get();
	+ $skus = Sku::withSubjectTenantContext()->where('active', true)->orderBy('title')->get();

	$response = [];

	foreach ($skus as $sku) {
	if ($data = $this->skuElement($sku)) {
	$response[] = $data;
	}
	}

	usort($response, function ($a, $b) {
	return ($b['prio'] <=> $a['prio']);
	});

	return response()->json($response);
	}

	/**
	* Store a newly created sku in storage.
	*
	* @param \Illuminate\Http\Request $request
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function store(Request $request)
	{
	// TODO
	return $this->errorResponse(404);
	}

	/**
	* Display the specified sku.
	*
	* @param int $id SKU identifier
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function show($id)
	{
	// TODO
	return $this->errorResponse(404);
	}

	/**
	* Update the specified sku in storage.
	*
	* @param \Illuminate\Http\Request $request Request object
	* @param int $id SKU identifier
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function update(Request $request, $id)
	{
	// TODO
	return $this->errorResponse(404);
	}

	/**
	* Get a list of SKUs available to the user.
	*
	* @param int $id User identifier
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function userSkus($id)
	{
	- $user = \App\User::withEnvTenant()->find($id);
	+ $user = \App\User::find($id);

	- if (empty($user)) {
	+ if (!$this->checkTenant($user)) {
	return $this->errorResponse(404);
	}

	- if (!Auth::guard()->user()->canRead($user)) {
	+ if (!$this->guard()->user()->canRead($user)) {
	return $this->errorResponse(403);
	}

	$type = request()->input('type');
	$response = [];

	// Note: Order by title for consistent ordering in tests
	- $skus = Sku::withEnvTenant()->orderBy('title')->get();
	+ $skus = Sku::withObjectTenantContext($user)->orderBy('title')->get();

	foreach ($skus as $sku) {
	if (!class_exists($sku->handler_class)) {
	continue;
	}

	if (!$sku->handler_class::isAvailable($sku, $user)) {
	continue;
	}

	if ($data = $this->skuElement($sku)) {
	if ($type && $type != $data['type']) {
	continue;
	}

	$response[] = $data;
	}
	}

	usort($response, function ($a, $b) {
	return ($b['prio'] <=> $a['prio']);
	});

	return response()->json($response);
	}

	/**
	* Convert SKU information to metadata used by UI to
	* display the form control
	*
	* @param \App\Sku $sku SKU object
	*
	* @return array\|null Metadata
	*/
	protected function skuElement($sku): ?array
	{
	if (!class_exists($sku->handler_class)) {
	return null;
	}

	$data = array_merge($sku->toArray(), $sku->handler_class::metadata($sku));

	// ignore incomplete handlers
	if (empty($data['type'])) {
	return null;
	}

	// Use localized value, toArray() does not get them right
	$data['name'] = $sku->name;
	$data['description'] = $sku->description;

	unset($data['handler_class'], $data['created_at'], $data['updated_at'], $data['fee'], $data['tenant_id']);

	return $data;
	}
	}
	diff --git a/src/app/Http/Controllers/API/V4/UsersController.php b/src/app/Http/Controllers/API/V4/UsersController.php
	index f60698a3..c8c0309a 100644
	--- a/src/app/Http/Controllers/API/V4/UsersController.php
	+++ b/src/app/Http/Controllers/API/V4/UsersController.php
	@@ -1,813 +1,813 @@
	<?php

	namespace App\Http\Controllers\API\V4;

	use App\Http\Controllers\Controller;
	use App\Domain;
	use App\Group;
	use App\Rules\UserEmailDomain;
	use App\Rules\UserEmailLocal;
	use App\Sku;
	use App\User;
	use Carbon\Carbon;
	use Illuminate\Http\Request;
	use Illuminate\Support\Facades\DB;
	use Illuminate\Support\Facades\Validator;
	use Illuminate\Support\Str;

	class UsersController extends Controller
	{
	/** @const array List of user setting keys available for modification in UI */
	public const USER_SETTINGS = [
	'billing_address',
	'country',
	'currency',
	'external_email',
	'first_name',
	'last_name',
	'organization',
	'phone',
	];

	/**
	* On user create it is filled with a user or group object to force-delete
	* before the creation of a new user record is possible.
	*
	* @var \App\User\|\App\Group\|null
	*/
	protected $deleteBeforeCreate;


	/**
	* Delete a user.
	*
	* @param int $id User identifier
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	public function destroy($id)
	{
	- $user = User::find($id);
	+ $user = User::withEnvTenantContext()->find($id);

	if (empty($user)) {
	return $this->errorResponse(404);
	}

	// User can't remove himself until he's the controller
	if (!$this->guard()->user()->canDelete($user)) {
	return $this->errorResponse(403);
	}

	$user->delete();

	return response()->json([
	'status' => 'success',
	'message' => __('app.user-delete-success'),
	]);
	}

	/**
	* Listing of users.
	*
	* The user-entitlements billed to the current user wallet(s)
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function index()
	{
	$user = $this->guard()->user();

	$result = $user->users()->orderBy('email')->get()->map(function ($user) {
	$data = $user->toArray();
	$data = array_merge($data, self::userStatuses($user));
	return $data;
	});

	return response()->json($result);
	}

	/**
	* Display information on the user account specified by $id.
	*
	* @param int $id The account to show information for.
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function show($id)
	{
	- $user = User::find($id);
	+ $user = User::withEnvTenantContext()->find($id);

	if (empty($user)) {
	return $this->errorResponse(404);
	}

	if (!$this->guard()->user()->canRead($user)) {
	return $this->errorResponse(403);
	}

	$response = $this->userResponse($user);

	// Simplified Entitlement/SKU information,
	// TODO: I agree this format may need to be extended in future
	$response['skus'] = [];
	foreach ($user->entitlements as $ent) {
	$sku = $ent->sku;
	if (!isset($response['skus'][$sku->id])) {
	$response['skus'][$sku->id] = ['costs' => [], 'count' => 0];
	}
	$response['skus'][$sku->id]['count']++;
	$response['skus'][$sku->id]['costs'][] = $ent->cost;
	}

	return response()->json($response);
	}

	/**
	* Fetch user status (and reload setup process)
	*
	* @param int $id User identifier
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function status($id)
	{
	- $user = User::find($id);
	+ $user = User::withEnvTenantContext()->find($id);

	if (empty($user)) {
	return $this->errorResponse(404);
	}

	if (!$this->guard()->user()->canRead($user)) {
	return $this->errorResponse(403);
	}

	$response = self::statusInfo($user);

	if (!empty(request()->input('refresh'))) {
	$updated = false;
	$async = false;
	$last_step = 'none';

	foreach ($response['process'] as $idx => $step) {
	$last_step = $step['label'];

	if (!$step['state']) {
	$exec = $this->execProcessStep($user, $step['label']);

	if (!$exec) {
	if ($exec === null) {
	$async = true;
	}

	break;
	}

	$updated = true;
	}
	}

	if ($updated) {
	$response = self::statusInfo($user);
	}

	$success = $response['isReady'];
	$suffix = $success ? 'success' : 'error-' . $last_step;

	$response['status'] = $success ? 'success' : 'error';
	$response['message'] = \trans('app.process-' . $suffix);

	if ($async && !$success) {
	$response['processState'] = 'waiting';
	$response['status'] = 'success';
	$response['message'] = \trans('app.process-async');
	}
	}

	$response = array_merge($response, self::userStatuses($user));

	return response()->json($response);
	}

	/**
	* User status (extended) information
	*
	* @param \App\User $user User object
	*
	* @return array Status information
	*/
	public static function statusInfo(User $user): array
	{
	$process = [];
	$steps = [
	'user-new' => true,
	'user-ldap-ready' => $user->isLdapReady(),
	'user-imap-ready' => $user->isImapReady(),
	];

	// Create a process check list
	foreach ($steps as $step_name => $state) {
	$step = [
	'label' => $step_name,
	'title' => \trans("app.process-{$step_name}"),
	'state' => $state,
	];

	$process[] = $step;
	}

	list ($local, $domain) = explode('@', $user->email);
	$domain = Domain::where('namespace', $domain)->first();

	// If that is not a public domain, add domain specific steps
	if ($domain && !$domain->isPublic()) {
	$domain_status = DomainsController::statusInfo($domain);
	$process = array_merge($process, $domain_status['process']);
	}

	$all = count($process);
	$checked = count(array_filter($process, function ($v) {
	return $v['state'];
	}));

	$state = $all === $checked ? 'done' : 'running';

	// After 180 seconds assume the process is in failed state,
	// this should unlock the Refresh button in the UI
	if ($all !== $checked && $user->created_at->diffInSeconds(Carbon::now()) > 180) {
	$state = 'failed';
	}

	// Check if the user is a controller of his wallet
	$isController = $user->canDelete($user);
	$hasCustomDomain = $user->wallet()->entitlements()
	->where('entitleable_type', Domain::class)
	->count() > 0;

	// Get user's entitlements titles
	$skus = $user->entitlements()->select('skus.title')
	->join('skus', 'skus.id', '=', 'entitlements.sku_id')
	->get()
	->pluck('title')
	->sort()
	->unique()
	->values()
	->all();

	return [
	'skus' => $skus,
	// TODO: This will change when we enable all users to create domains
	'enableDomains' => $isController && $hasCustomDomain,
	// TODO: Make 'enableDistlists' working for wallet controllers that aren't account owners
	'enableDistlists' => $isController && $hasCustomDomain && in_array('distlist', $skus),
	'enableUsers' => $isController,
	'enableWallets' => $isController,
	'process' => $process,
	'processState' => $state,
	'isReady' => $all === $checked,
	];
	}

	/**
	* Create a new user record.
	*
	* @param \Illuminate\Http\Request $request The API request.
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	public function store(Request $request)
	{
	$current_user = $this->guard()->user();
	$owner = $current_user->wallet()->owner;

	if ($owner->id != $current_user->id) {
	return $this->errorResponse(403);
	}

	$this->deleteBeforeCreate = null;

	if ($error_response = $this->validateUserRequest($request, null, $settings)) {
	return $error_response;
	}

	- if (empty($request->package) \|\| !($package = \App\Package::find($request->package))) {
	+ if (empty($request->package) \|\| !($package = \App\Package::withEnvTenantContext()->find($request->package))) {
	$errors = ['package' => \trans('validation.packagerequired')];
	return response()->json(['status' => 'error', 'errors' => $errors], 422);
	}

	if ($package->isDomain()) {
	$errors = ['package' => \trans('validation.packageinvalid')];
	return response()->json(['status' => 'error', 'errors' => $errors], 422);
	}

	DB::beginTransaction();

	// @phpstan-ignore-next-line
	if ($this->deleteBeforeCreate) {
	$this->deleteBeforeCreate->forceDelete();
	}

	// Create user record
	$user = User::create([
	'email' => $request->email,
	'password' => $request->password,
	]);

	$owner->assignPackage($package, $user);

	if (!empty($settings)) {
	$user->setSettings($settings);
	}

	if (!empty($request->aliases)) {
	$user->setAliases($request->aliases);
	}

	DB::commit();

	return response()->json([
	'status' => 'success',
	'message' => __('app.user-create-success'),
	]);
	}

	/**
	* Update user data.
	*
	* @param \Illuminate\Http\Request $request The API request.
	* @param string $id User identifier
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	public function update(Request $request, $id)
	{
	- $user = User::find($id);
	+ $user = User::withEnvTenantContext()->find($id);

	if (empty($user)) {
	return $this->errorResponse(404);
	}

	$current_user = $this->guard()->user();

	// TODO: Decide what attributes a user can change on his own profile
	if (!$current_user->canUpdate($user)) {
	return $this->errorResponse(403);
	}

	if ($error_response = $this->validateUserRequest($request, $user, $settings)) {
	return $error_response;
	}

	// Entitlements, only controller can do that
	if ($request->skus !== null && !$current_user->canDelete($user)) {
	return $this->errorResponse(422, "You have no permission to change entitlements");
	}

	DB::beginTransaction();

	$this->updateEntitlements($user, $request->skus);

	if (!empty($settings)) {
	$user->setSettings($settings);
	}

	if (!empty($request->password)) {
	$user->password = $request->password;
	$user->save();
	}

	if (isset($request->aliases)) {
	$user->setAliases($request->aliases);
	}

	// TODO: Make sure that UserUpdate job is created in case of entitlements update
	// and no password change. So, for example quota change is applied to LDAP
	// TODO: Review use of $user->save() in the above context

	DB::commit();

	$response = [
	'status' => 'success',
	'message' => __('app.user-update-success'),
	];

	// For self-update refresh the statusInfo in the UI
	if ($user->id == $current_user->id) {
	$response['statusInfo'] = self::statusInfo($user);
	}

	return response()->json($response);
	}

	/**
	* Update user entitlements.
	*
	* @param \App\User $user The user
	* @param array $rSkus List of SKU IDs requested for the user in the form [id=>qty]
	*/
	protected function updateEntitlements(User $user, $rSkus)
	{
	if (!is_array($rSkus)) {
	return;
	}

	// list of skus, [id=>obj]
	- $skus = Sku::all()->mapWithKeys(
	+ $skus = Sku::withEnvTenantContext()->get()->mapWithKeys(
	function ($sku) {
	return [$sku->id => $sku];
	}
	);

	// existing entitlement's SKUs
	$eSkus = [];

	$user->entitlements()->groupBy('sku_id')
	->selectRaw('count(*) as total, sku_id')->each(
	function ($e) use (&$eSkus) {
	$eSkus[$e->sku_id] = $e->total;
	}
	);

	foreach ($skus as $skuID => $sku) {
	$e = array_key_exists($skuID, $eSkus) ? $eSkus[$skuID] : 0;
	$r = array_key_exists($skuID, $rSkus) ? $rSkus[$skuID] : 0;

	if ($sku->handler_class == \App\Handlers\Mailbox::class) {
	if ($r != 1) {
	throw new \Exception("Invalid quantity of mailboxes");
	}
	}

	if ($e > $r) {
	// remove those entitled more than existing
	$user->removeSku($sku, ($e - $r));
	} elseif ($e < $r) {
	// add those requested more than entitled
	$user->assignSku($sku, ($r - $e));
	}
	}
	}

	/**
	* Create a response data array for specified user.
	*
	* @param \App\User $user User object
	*
	* @return array Response data
	*/
	public static function userResponse(User $user): array
	{
	$response = $user->toArray();

	// Settings
	$response['settings'] = [];
	foreach ($user->settings()->whereIn('key', self::USER_SETTINGS)->get() as $item) {
	$response['settings'][$item->key] = $item->value;
	}

	// Aliases
	$response['aliases'] = [];
	foreach ($user->aliases as $item) {
	$response['aliases'][] = $item->alias;
	}

	// Status info
	$response['statusInfo'] = self::statusInfo($user);

	$response = array_merge($response, self::userStatuses($user));

	// Add more info to the wallet object output
	$map_func = function ($wallet) use ($user) {
	$result = $wallet->toArray();

	if ($wallet->discount) {
	$result['discount'] = $wallet->discount->discount;
	$result['discount_description'] = $wallet->discount->description;
	}

	if ($wallet->user_id != $user->id) {
	$result['user_email'] = $wallet->owner->email;
	}

	$provider = \App\Providers\PaymentProvider::factory($wallet);
	$result['provider'] = $provider->name();

	return $result;
	};

	// Information about wallets and accounts for access checks
	$response['wallets'] = $user->wallets->map($map_func)->toArray();
	$response['accounts'] = $user->accounts->map($map_func)->toArray();
	$response['wallet'] = $map_func($user->wallet());

	return $response;
	}

	/**
	* Prepare user statuses for the UI
	*
	* @param \App\User $user User object
	*
	* @return array Statuses array
	*/
	protected static function userStatuses(User $user): array
	{
	return [
	'isImapReady' => $user->isImapReady(),
	'isLdapReady' => $user->isLdapReady(),
	'isSuspended' => $user->isSuspended(),
	'isActive' => $user->isActive(),
	'isDeleted' => $user->isDeleted() \|\| $user->trashed(),
	];
	}

	/**
	* Validate user input
	*
	* @param \Illuminate\Http\Request $request The API request.
	* @param \App\User\|null $user User identifier
	* @param array $settings User settings (from the request)
	*
	* @return \Illuminate\Http\JsonResponse\|null The error response on error
	*/
	protected function validateUserRequest(Request $request, $user, &$settings = [])
	{
	$rules = [
	'external_email' => 'nullable\|email',
	'phone' => 'string\|nullable\|max:64\|regex:/^[0-9+() -]+$/',
	'first_name' => 'string\|nullable\|max:128',
	'last_name' => 'string\|nullable\|max:128',
	'organization' => 'string\|nullable\|max:512',
	'billing_address' => 'string\|nullable\|max:1024',
	'country' => 'string\|nullable\|alpha\|size:2',
	'currency' => 'string\|nullable\|alpha\|size:3',
	'aliases' => 'array\|nullable',
	];

	if (empty($user) \|\| !empty($request->password) \|\| !empty($request->password_confirmation)) {
	$rules['password'] = 'required\|min:4\|max:2048\|confirmed';
	}

	$errors = [];

	// Validate input
	$v = Validator::make($request->all(), $rules);

	if ($v->fails()) {
	$errors = $v->errors()->toArray();
	}

	$controller = $user ? $user->wallet()->owner : $this->guard()->user();

	// For new user validate email address
	if (empty($user)) {
	$email = $request->email;

	if (empty($email)) {
	$errors['email'] = \trans('validation.required', ['attribute' => 'email']);
	} elseif ($error = self::validateEmail($email, $controller, $this->deleteBeforeCreate)) {
	$errors['email'] = $error;
	}
	}

	// Validate aliases input
	if (isset($request->aliases)) {
	$aliases = [];
	$existing_aliases = $user ? $user->aliases()->get()->pluck('alias')->toArray() : [];

	foreach ($request->aliases as $idx => $alias) {
	if (is_string($alias) && !empty($alias)) {
	// Alias cannot be the same as the email address (new user)
	if (!empty($email) && Str::lower($alias) == Str::lower($email)) {
	continue;
	}

	// validate new aliases
	if (
	!in_array($alias, $existing_aliases)
	&& ($error = self::validateAlias($alias, $controller))
	) {
	if (!isset($errors['aliases'])) {
	$errors['aliases'] = [];
	}
	$errors['aliases'][$idx] = $error;
	continue;
	}

	$aliases[] = $alias;
	}
	}

	$request->aliases = $aliases;
	}

	if (!empty($errors)) {
	return response()->json(['status' => 'error', 'errors' => $errors], 422);
	}

	// Update user settings
	$settings = $request->only(array_keys($rules));
	unset($settings['password'], $settings['aliases'], $settings['email']);

	return null;
	}

	/**
	* Execute (synchronously) specified step in a user setup process.
	*
	* @param \App\User $user User object
	* @param string $step Step identifier (as in self::statusInfo())
	*
	* @return bool\|null True if the execution succeeded, False if not, Null when
	* the job has been sent to the worker (result unknown)
	*/
	public static function execProcessStep(User $user, string $step): ?bool
	{
	try {
	if (strpos($step, 'domain-') === 0) {
	list ($local, $domain) = explode('@', $user->email);
	$domain = Domain::where('namespace', $domain)->first();

	return DomainsController::execProcessStep($domain, $step);
	}

	switch ($step) {
	case 'user-ldap-ready':
	// User not in LDAP, create it
	$job = new \App\Jobs\User\CreateJob($user->id);
	$job->handle();

	$user->refresh();

	return $user->isLdapReady();

	case 'user-imap-ready':
	// User not in IMAP? Verify again
	// Do it synchronously if the imap admin credentials are available
	// otherwise let the worker do the job
	if (!\config('imap.admin_password')) {
	\App\Jobs\User\VerifyJob::dispatch($user->id);

	return null;
	}

	$job = new \App\Jobs\User\VerifyJob($user->id);
	$job->handle();

	$user->refresh();

	return $user->isImapReady();
	}
	} catch (\Exception $e) {
	\Log::error($e);
	}

	return false;
	}

	/**
	* Email address validation for use as a user mailbox (login).
	*
	* @param string $email Email address
	* @param \App\User $user The account owner
	* @param null\|\App\User\|\App\Group $deleted Filled with an instance of a deleted user or group
	* with the specified email address, if exists
	*
	* @return ?string Error message on validation error
	*/
	public static function validateEmail(string $email, \App\User $user, &$deleted = null): ?string
	{
	$deleted = null;

	if (strpos($email, '@') === false) {
	return \trans('validation.entryinvalid', ['attribute' => 'email']);
	}

	list($login, $domain) = explode('@', Str::lower($email));

	if (strlen($login) === 0 \|\| strlen($domain) === 0) {
	return \trans('validation.entryinvalid', ['attribute' => 'email']);
	}

	// Check if domain exists
	- $domain = Domain::where('namespace', $domain)->first();
	+ $domain = Domain::withEnvTenantContext()->where('namespace', $domain)->first();

	if (empty($domain)) {
	return \trans('validation.domaininvalid');
	}

	// Validate login part alone
	$v = Validator::make(
	['email' => $login],
	['email' => ['required', new UserEmailLocal(!$domain->isPublic())]]
	);

	if ($v->fails()) {
	return $v->errors()->toArray()['email'][0];
	}

	// Check if it is one of domains available to the user
	$domains = \collect($user->domains())->pluck('namespace')->all();

	if (!in_array($domain->namespace, $domains)) {
	return \trans('validation.entryexists', ['attribute' => 'domain']);
	}

	// Check if a user with specified address already exists
	if ($existing_user = User::emailExists($email, true)) {
	// If this is a deleted user in the same custom domain
	// we'll force delete him before
	if (!$domain->isPublic() && $existing_user->trashed()) {
	$deleted = $existing_user;
	} else {
	return \trans('validation.entryexists', ['attribute' => 'email']);
	}
	}

	// Check if an alias with specified address already exists.
	if (User::aliasExists($email)) {
	return \trans('validation.entryexists', ['attribute' => 'email']);
	}

	// Check if a group with specified address already exists
	if ($existing_group = Group::emailExists($email, true)) {
	// If this is a deleted group in the same custom domain
	// we'll force delete it before
	if (!$domain->isPublic() && $existing_group->trashed()) {
	$deleted = $existing_group;
	} else {
	return \trans('validation.entryexists', ['attribute' => 'email']);
	}
	}

	return null;
	}

	/**
	* Email address validation for use as an alias.
	*
	* @param string $email Email address
	* @param \App\User $user The account owner
	*
	* @return ?string Error message on validation error
	*/
	public static function validateAlias(string $email, \App\User $user): ?string
	{
	if (strpos($email, '@') === false) {
	return \trans('validation.entryinvalid', ['attribute' => 'alias']);
	}

	list($login, $domain) = explode('@', Str::lower($email));

	if (strlen($login) === 0 \|\| strlen($domain) === 0) {
	return \trans('validation.entryinvalid', ['attribute' => 'alias']);
	}

	// Check if domain exists
	- $domain = Domain::where('namespace', $domain)->first();
	+ $domain = Domain::withEnvTenantContext()->where('namespace', $domain)->first();

	if (empty($domain)) {
	return \trans('validation.domaininvalid');
	}

	// Validate login part alone
	$v = Validator::make(
	['alias' => $login],
	['alias' => ['required', new UserEmailLocal(!$domain->isPublic())]]
	);

	if ($v->fails()) {
	return $v->errors()->toArray()['alias'][0];
	}

	// Check if it is one of domains available to the user
	$domains = \collect($user->domains())->pluck('namespace')->all();

	if (!in_array($domain->namespace, $domains)) {
	return \trans('validation.entryexists', ['attribute' => 'domain']);
	}

	// Check if a user with specified address already exists
	if ($existing_user = User::emailExists($email, true)) {
	// Allow an alias in a custom domain to an address that was a user before
	if ($domain->isPublic() \|\| !$existing_user->trashed()) {
	return \trans('validation.entryexists', ['attribute' => 'alias']);
	}
	}

	// Check if an alias with specified address already exists
	if (User::aliasExists($email)) {
	// Allow assigning the same alias to a user in the same group account,
	// but only for non-public domains
	if ($domain->isPublic()) {
	return \trans('validation.entryexists', ['attribute' => 'alias']);
	}
	}

	// Check if a group with specified address already exists
	if (Group::emailExists($email)) {
	return \trans('validation.entryexists', ['attribute' => 'alias']);
	}

	return null;
	}
	}
	diff --git a/src/app/Http/Controllers/API/V4/WalletsController.php b/src/app/Http/Controllers/API/V4/WalletsController.php
	index 40fd6997..4d28659f 100644
	--- a/src/app/Http/Controllers/API/V4/WalletsController.php
	+++ b/src/app/Http/Controllers/API/V4/WalletsController.php
	@@ -1,330 +1,341 @@
	<?php

	namespace App\Http\Controllers\API\V4;

	use App\Transaction;
	use App\Wallet;
	use App\Http\Controllers\Controller;
	use App\Providers\PaymentProvider;
	use Carbon\Carbon;
	use Illuminate\Http\Request;
	-use Illuminate\Support\Facades\Auth;

	/**
	* API\WalletsController
	*/
	class WalletsController extends Controller
	{
	/**
	* Display a listing of the resource.
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function index()
	{
	return $this->errorResponse(404);
	}

	/**
	* Show the form for creating a new resource.
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function create()
	{
	return $this->errorResponse(404);
	}

	/**
	* Store a newly created resource in storage.
	*
	* @param \Illuminate\Http\Request $request
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function store(Request $request)
	{
	return $this->errorResponse(404);
	}

	/**
	* Return data of the specified wallet.
	*
	* @param string $id A wallet identifier
	*
	* @return \Illuminate\Http\JsonResponse The response
	*/
	public function show($id)
	{
	$wallet = Wallet::find($id);

	- if (empty($wallet)) {
	+ if (empty($wallet) \|\| !$this->checkTenant($wallet->owner)) {
	return $this->errorResponse(404);
	}

	// Only owner (or admin) has access to the wallet
	- if (!Auth::guard()->user()->canRead($wallet)) {
	+ if (!$this->guard()->user()->canRead($wallet)) {
	return $this->errorResponse(403);
	}

	$result = $wallet->toArray();

	$provider = \App\Providers\PaymentProvider::factory($wallet);

	$result['provider'] = $provider->name();
	$result['notice'] = $this->getWalletNotice($wallet);

	return response()->json($result);
	}

	/**
	* Show the form for editing the specified resource.
	*
	* @param int $id
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function edit($id)
	{
	return $this->errorResponse(404);
	}

	/**
	* Update the specified resource in storage.
	*
	* @param \Illuminate\Http\Request $request
	* @param string $id
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function update(Request $request, $id)
	{
	return $this->errorResponse(404);
	}

	/**
	* Remove the specified resource from storage.
	*
	* @param int $id
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function destroy($id)
	{
	return $this->errorResponse(404);
	}

	/**
	* Download a receipt in pdf format.
	*
	* @param string $id Wallet identifier
	* @param string $receipt Receipt identifier (YYYY-MM)
	*
	* @return \Illuminate\Http\Response
	*/
	public function receiptDownload($id, $receipt)
	{
	$wallet = Wallet::find($id);

	+ if (empty($wallet) \|\| !$this->checkTenant($wallet->owner)) {
	+ return $this->errorResponse(404);
	+ }
	+
	// Only owner (or admin) has access to the wallet
	- if (!Auth::guard()->user()->canRead($wallet)) {
	+ if (!$this->guard()->user()->canRead($wallet)) {
	abort(403);
	}

	list ($year, $month) = explode('-', $receipt);

	if (empty($year) \|\| empty($month) \|\| $year < 2000 \|\| $month < 1 \|\| $month > 12) {
	abort(404);
	}

	if ($receipt >= date('Y-m')) {
	abort(404);
	}

	$params = [
	'id' => sprintf('%04d-%02d', $year, $month),
	'site' => \config('app.name')
	];

	$filename = \trans('documents.receipt-filename', $params);

	$receipt = new \App\Documents\Receipt($wallet, (int) $year, (int) $month);

	$content = $receipt->pdfOutput();

	return response($content)
	->withHeaders([
	'Content-Type' => 'application/pdf',
	'Content-Disposition' => 'attachment; filename="' . $filename . '"',
	'Content-Length' => strlen($content),
	]);
	}

	/**
	* Fetch wallet receipts list.
	*
	* @param string $id Wallet identifier
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function receipts($id)
	{
	$wallet = Wallet::find($id);

	+ if (empty($wallet) \|\| !$this->checkTenant($wallet->owner)) {
	+ return $this->errorResponse(404);
	+ }
	+
	// Only owner (or admin) has access to the wallet
	- if (!Auth::guard()->user()->canRead($wallet)) {
	+ if (!$this->guard()->user()->canRead($wallet)) {
	return $this->errorResponse(403);
	}

	$result = $wallet->payments()
	->selectRaw('distinct date_format(updated_at, "%Y-%m") as ident')
	->where('status', PaymentProvider::STATUS_PAID)
	->where('amount', '<>', 0)
	->orderBy('ident', 'desc')
	->get()
	->whereNotIn('ident', [date('Y-m')]) // exclude current month
	->pluck('ident');

	return response()->json([
	'status' => 'success',
	'list' => $result,
	'count' => count($result),
	'hasMore' => false,
	'page' => 1,
	]);
	}

	/**
	* Fetch wallet transactions.
	*
	* @param string $id Wallet identifier
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public function transactions($id)
	{
	$wallet = Wallet::find($id);

	+ if (empty($wallet) \|\| !$this->checkTenant($wallet->owner)) {
	+ return $this->errorResponse(404);
	+ }
	+
	// Only owner (or admin) has access to the wallet
	- if (!Auth::guard()->user()->canRead($wallet)) {
	+ if (!$this->guard()->user()->canRead($wallet)) {
	return $this->errorResponse(403);
	}

	$pageSize = 10;
	$page = intval(request()->input('page')) ?: 1;
	$hasMore = false;
	$isAdmin = $this instanceof Admin\WalletsController;

	if ($transaction = request()->input('transaction')) {
	// Get sub-transactions for the specified transaction ID, first
	// check access rights to the transaction's wallet

	$transaction = $wallet->transactions()->where('id', $transaction)->first();

	if (!$transaction) {
	return $this->errorResponse(404);
	}

	$result = Transaction::where('transaction_id', $transaction->id)->get();
	} else {
	// Get main transactions (paged)
	$result = $wallet->transactions()
	// FIXME: Do we know which (type of) transaction has sub-transactions
	// without the sub-query?
	->selectRaw(", (SELECT count() FROM transactions sub "
	. "WHERE sub.transaction_id = transactions.id) AS cnt")
	->whereNull('transaction_id')
	->latest()
	->limit($pageSize + 1)
	->offset($pageSize * ($page - 1))
	->get();

	if (count($result) > $pageSize) {
	$result->pop();
	$hasMore = true;
	}
	}

	$result = $result->map(function ($item) use ($isAdmin) {
	$entry = [
	'id' => $item->id,
	'createdAt' => $item->created_at->format('Y-m-d H:i'),
	'type' => $item->type,
	'description' => $item->shortDescription(),
	'amount' => $item->amount,
	'hasDetails' => !empty($item->cnt),
	];

	if ($isAdmin && $item->user_email) {
	$entry['user'] = $item->user_email;
	}

	return $entry;
	});

	return response()->json([
	'status' => 'success',
	'list' => $result,
	'count' => count($result),
	'hasMore' => $hasMore,
	'page' => $page,
	]);
	}

	/**
	* Returns human readable notice about the wallet state.
	*
	* @param \App\Wallet $wallet The wallet
	*/
	protected function getWalletNotice(Wallet $wallet): ?string
	{
	// there is no credit
	if ($wallet->balance < 0) {
	return \trans('app.wallet-notice-nocredit');
	}

	// the discount is 100%, no credit is needed
	if ($wallet->discount && $wallet->discount->discount == 100) {
	return null;
	}

	// the owner was created less than a month ago
	if ($wallet->owner->created_at > Carbon::now()->subMonthsWithoutOverflow(1)) {
	// but more than two weeks ago, notice of trial ending
	if ($wallet->owner->created_at <= Carbon::now()->subWeeks(2)) {
	return \trans('app.wallet-notice-trial-end');
	}

	return \trans('app.wallet-notice-trial');
	}

	if ($until = $wallet->balanceLastsUntil()) {
	if ($until->isToday()) {
	return \trans('app.wallet-notice-today');
	}

	// Once in a while we got e.g. "3 weeks" instead of expected "4 weeks".
	// It's because $until uses full seconds, but $now is more precise.
	// We make sure both have the same time set.
	$now = Carbon::now()->setTimeFrom($until);

	$diffOptions = [
	'syntax' => Carbon::DIFF_ABSOLUTE,
	'parts' => 1,
	];

	if ($now->diff($until)->days > 31) {
	$diffOptions['parts'] = 2;
	}

	$params = [
	'date' => $until->toDateString(),
	'days' => $now->diffForHumans($until, $diffOptions),
	];

	return \trans('app.wallet-notice-date', $params);
	}

	return null;
	}
	}
	diff --git a/src/app/Http/Controllers/Controller.php b/src/app/Http/Controllers/Controller.php
	index bbb21465..73e7c7d5 100644
	--- a/src/app/Http/Controllers/Controller.php
	+++ b/src/app/Http/Controllers/Controller.php
	@@ -1,61 +1,84 @@
	<?php

	namespace App\Http\Controllers;

	use Illuminate\Foundation\Bus\DispatchesJobs;
	use Illuminate\Routing\Controller as BaseController;
	use Illuminate\Foundation\Validation\ValidatesRequests;
	use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
	use Illuminate\Support\Facades\Auth;

	class Controller extends BaseController
	{
	use AuthorizesRequests;
	use DispatchesJobs;
	use ValidatesRequests;


	/**
	* Common error response builder for API (JSON) responses
	*
	* @param int $code Error code
	* @param string $message Error message
	* @param array $data Additional response data
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	public static function errorResponse(int $code, string $message = null, array $data = [])
	{
	$errors = [
	400 => "Bad request",
	401 => "Unauthorized",
	403 => "Access denied",
	404 => "Not found",
	405 => "Method not allowed",
	422 => "Input validation error",
	429 => "Too many requests",
	500 => "Internal server error",
	];

	$response = [
	'status' => 'error',
	'message' => $message ?: (isset($errors[$code]) ? $errors[$code] : "Server error"),
	];

	if (!empty($data)) {
	$response = $response + $data;
	}

	return response()->json($response, $code);
	}

	+ /**
	+ * Check if current user has access to the specified object
	+ * by being an admin or existing in the same tenant context.
	+ *
	+ * @param ?object $object Model object
	+ *
	+ * @return bool
	+ */
	+ protected function checkTenant(object $object = null): bool
	+ {
	+ if (empty($object)) {
	+ return false;
	+ }
	+
	+ $user = $this->guard()->user();
	+
	+ if ($user->role == 'admin') {
	+ return true;
	+ }
	+
	+ return $object->tenant_id == $user->tenant_id;
	+ }
	+
	/**
	* Get the guard to be used during authentication.
	*
	* @return \Illuminate\Contracts\Auth\Guard
	*/
	protected function guard()
	{
	return Auth::guard();
	}
	}
	diff --git a/src/app/Http/Middleware/AuthenticateReseller.php b/src/app/Http/Middleware/AuthenticateReseller.php
	index 9d4308ea..6eabf3b6 100644
	--- a/src/app/Http/Middleware/AuthenticateReseller.php
	+++ b/src/app/Http/Middleware/AuthenticateReseller.php
	@@ -1,34 +1,30 @@
	<?php

	namespace App\Http\Middleware;

	use Closure;

	class AuthenticateReseller
	{
	/**
	* Handle an incoming request.
	*
	* @param \Illuminate\Http\Request $request
	* @param \Closure $next
	* @return mixed
	*/
	public function handle($request, Closure $next)
	{
	$user = auth()->user();

	if (!$user) {
	abort(401, "Unauthorized");
	}

	if ($user->role !== "reseller") {
	abort(403, "Unauthorized");
	}

	- if ($user->tenant_id != \config('app.tenant_id')) {
	- abort(403, "Unauthorized");
	- }
	-
	return $next($request);
	}
	}
	diff --git a/src/app/Observers/SkuObserver.php b/src/app/Observers/SkuObserver.php
	index dca338f8..7ebf6c1b 100644
	--- a/src/app/Observers/SkuObserver.php
	+++ b/src/app/Observers/SkuObserver.php
	@@ -1,30 +1,28 @@
	<?php

	namespace App\Observers;

	use App\Sku;

	class SkuObserver
	{
	/**
	* Ensure the SKU ID is a custom ID (uuid).
	*
	* @param Sku $sku The SKU object
	*
	* @return void
	*/
	public function creating(Sku $sku)
	{
	while (true) {
	$allegedly_unique = \App\Utils::uuidStr();
	if (!Sku::find($allegedly_unique)) {
	$sku->{$sku->getKeyName()} = $allegedly_unique;
	break;
	}
	}

	$sku->tenant_id = \config('app.tenant_id');
	-
	- // TODO: We should make sure that tenant_id + title is unique
	}
	}
	diff --git a/src/app/Observers/UserAliasObserver.php b/src/app/Observers/UserAliasObserver.php
	index 544a7765..8f9891a5 100644
	--- a/src/app/Observers/UserAliasObserver.php
	+++ b/src/app/Observers/UserAliasObserver.php
	@@ -1,77 +1,84 @@
	<?php

	namespace App\Observers;

	use App\Domain;
	use App\User;
	use App\UserAlias;

	class UserAliasObserver
	{
	/**
	* Handle the "creating" event on an alias
	*
	* Ensures that there's no user with specified email.
	*
	* @param \App\UserAlias $alias The user email alias
	*
	* @return bool
	*/
	public function creating(UserAlias $alias): bool
	{
	$alias->alias = \strtolower($alias->alias);

	list($login, $domain) = explode('@', $alias->alias);

	$domain = Domain::where('namespace', $domain)->first();

	if (!$domain) {
	\Log::error("Failed creating alias {$alias->alias}. Domain does not exist.");
	return false;
	}

	+ if ($alias->user) {
	+ if ($alias->user->tenant_id != $domain->tenant_id) {
	+ \Log::error("Reseller for user '{$alias->user->email}' and domain '{$domain->namespace}' differ.");
	+ return false;
	+ }
	+ }
	+
	return true;
	}

	/**
	* Handle the user alias "created" event.
	*
	* @param \App\UserAlias $alias User email alias
	*
	* @return void
	*/
	public function created(UserAlias $alias)
	{
	if ($alias->user) {
	\App\Jobs\User\UpdateJob::dispatch($alias->user_id);
	}
	}

	/**
	* Handle the user setting "updated" event.
	*
	* @param \App\UserAlias $alias User email alias
	*
	* @return void
	*/
	public function updated(UserAlias $alias)
	{
	if ($alias->user) {
	\App\Jobs\User\UpdateJob::dispatch($alias->user_id);
	}
	}

	/**
	* Handle the user setting "deleted" event.
	*
	* @param \App\UserAlias $alias User email alias
	*
	* @return void
	*/
	public function deleted(UserAlias $alias)
	{
	if ($alias->user) {
	\App\Jobs\User\UpdateJob::dispatch($alias->user_id);
	}
	}
	}
	diff --git a/src/app/Providers/AppServiceProvider.php b/src/app/Providers/AppServiceProvider.php
	index 84b15482..8ae94ddd 100644
	--- a/src/app/Providers/AppServiceProvider.php
	+++ b/src/app/Providers/AppServiceProvider.php
	@@ -1,116 +1,158 @@
	<?php

	namespace App\Providers;

	use Illuminate\Database\Query\Builder;
	use Illuminate\Support\Facades\Blade;
	use Illuminate\Support\Facades\DB;
	use Illuminate\Support\Facades\Schema;
	use Illuminate\Support\ServiceProvider;

	class AppServiceProvider extends ServiceProvider
	{
	/**
	* Register any application services.
	*
	* @return void
	*/
	public function register()
	{
	//
	}

	/**
	* Bootstrap any application services.
	*
	* @return void
	*/
	public function boot()
	{
	\App\Discount::observe(\App\Observers\DiscountObserver::class);
	\App\Domain::observe(\App\Observers\DomainObserver::class);
	\App\Entitlement::observe(\App\Observers\EntitlementObserver::class);
	\App\Group::observe(\App\Observers\GroupObserver::class);
	\App\OpenVidu\Connection::observe(\App\Observers\OpenVidu\ConnectionObserver::class);
	\App\Package::observe(\App\Observers\PackageObserver::class);
	\App\PackageSku::observe(\App\Observers\PackageSkuObserver::class);
	\App\Plan::observe(\App\Observers\PlanObserver::class);
	\App\PlanPackage::observe(\App\Observers\PlanPackageObserver::class);
	\App\SignupCode::observe(\App\Observers\SignupCodeObserver::class);
	\App\SignupInvitation::observe(\App\Observers\SignupInvitationObserver::class);
	\App\Sku::observe(\App\Observers\SkuObserver::class);
	\App\Transaction::observe(\App\Observers\TransactionObserver::class);
	\App\User::observe(\App\Observers\UserObserver::class);
	\App\UserAlias::observe(\App\Observers\UserAliasObserver::class);
	\App\UserSetting::observe(\App\Observers\UserSettingObserver::class);
	\App\VerificationCode::observe(\App\Observers\VerificationCodeObserver::class);
	\App\Wallet::observe(\App\Observers\WalletObserver::class);

	Schema::defaultStringLength(191);

	// Log SQL queries in debug mode
	if (\config('app.debug')) {
	DB::listen(function ($query) {
	\Log::debug(
	sprintf(
	'[SQL] %s [%s]: %.4f sec.',
	$query->sql,
	implode(', ', $query->bindings),
	$query->time / 1000
	)
	);
	});
	}

	// Register some template helpers
	- Blade::directive('theme_asset', function ($path) {
	- $path = trim($path, '/\'"');
	- return "<?php echo secure_asset('themes/' . \$env['app.theme'] . '/' . '$path'); ?>";
	- });
	+ Blade::directive(
	+ 'theme_asset',
	+ function ($path) {
	+ $path = trim($path, '/\'"');
	+ return "<?php echo secure_asset('themes/' . \$env['app.theme'] . '/' . '$path'); ?>";
	+ }
	+ );
	+
	+ Builder::macro(
	+ 'withEnvTenantContext',
	+ function (string $table = null) {
	+ $tenantId = \config('app.tenant_id');

	- // Query builder 'withEnvTenant' macro
	- Builder::macro('withEnvTenant', function (string $table = null) {
	- $tenant_id = \config('app.tenant_id');
	+ if ($tenantId) {
	+ /** @var Builder $this */
	+ return $this->where(($table ? "$table." : "") . "tenant_id", $tenantId);
	+ }

	- if ($tenant_id) {
	/** @var Builder $this */
	- return $this->where(($table ? "$table." : '') . 'tenant_id', $tenant_id);
	+ return $this->whereNull(($table ? "$table." : "") . "tenant_id");
	}
	+ );
	+
	+ Builder::macro(
	+ 'withObjectTenantContext',
	+ function (object $object, string $table = null) {
	+ // backend artisan cli
	+ if (app()->runningInConsole()) {
	+ /** @var Builder $this */
	+ return $this->where(($table ? "$table." : "") . "tenant_id", $object->tenant_id);
	+ }
	+
	+ $subject = auth()->user();
	+
	+ if ($subject->role == "admin") {
	+ /** @var Builder $this */
	+ return $this->where(($table ? "$table." : "") . "tenant_id", $object->tenant_id);
	+ }

	- /** @var Builder $this */
	- return $this->whereNull(($table ? "$table." : '') . 'tenant_id');
	- });
	+ $tenantId = $subject->tenant_id;

	- // Query builder 'withUserTenant' macro
	- Builder::macro('withUserTenant', function (string $table = null) {
	- $tenant_id = auth()->user()->tenant_id;
	+ if ($tenantId) {
	+ /** @var Builder $this */
	+ return $this->where(($table ? "$table." : "") . "tenant_id", $tenantId);
	+ }

	- if ($tenant_id) {
	/** @var Builder $this */
	- return $this->where(($table ? "$table." : '') . 'tenant_id', $tenant_id);
	+ return $this->whereNull(($table ? "$table." : "") . "tenant_id");
	}
	+ );
	+
	+ Builder::macro(
	+ 'withSubjectTenantContext',
	+ function (string $table = null) {
	+ if ($user = auth()->user()) {
	+ $tenantId = $user->tenant_id;
	+ } else {
	+ $tenantId = \config('app.tenant_id');
	+ }
	+
	+ if ($tenantId) {
	+ /** @var Builder $this */
	+ return $this->where(($table ? "$table." : "") . "tenant_id", $tenantId);
	+ }

	- /** @var Builder $this */
	- return $this->whereNull(($table ? "$table." : '') . 'tenant_id');
	- });
	+ /** @var Builder $this */
	+ return $this->whereNull(($table ? "$table." : "") . "tenant_id");
	+ }
	+ );

	// Query builder 'whereLike' mocro
	- Builder::macro('whereLike', function (string $column, string $search, int $mode = 0) {
	- $search = addcslashes($search, '%_');
	-
	- switch ($mode) {
	- case 2:
	- $search .= '%';
	- break;
	- case 1:
	- $search = '%' . $search;
	- break;
	- default:
	- $search = '%' . $search . '%';
	- }
	+ Builder::macro(
	+ 'whereLike',
	+ function (string $column, string $search, int $mode = 0) {
	+ $search = addcslashes($search, '%_');
	+
	+ switch ($mode) {
	+ case 2:
	+ $search .= '%';
	+ break;
	+ case 1:
	+ $search = '%' . $search;
	+ break;
	+ default:
	+ $search = '%' . $search . '%';
	+ }

	- /** @var Builder $this */
	- return $this->where($column, 'like', $search);
	- });
	+ /** @var Builder $this */
	+ return $this->where($column, 'like', $search);
	+ }
	+ );
	}
	}
	diff --git a/src/app/Providers/Payment/Mollie.php b/src/app/Providers/Payment/Mollie.php
	index 0cbceab5..9b8101ae 100644
	--- a/src/app/Providers/Payment/Mollie.php
	+++ b/src/app/Providers/Payment/Mollie.php
	@@ -1,621 +1,622 @@
	<?php

	namespace App\Providers\Payment;

	use App\Payment;
	use App\Utils;
	use App\Wallet;
	use Illuminate\Support\Facades\DB;
	use Mollie\Api\Exceptions\ApiException;
	use Mollie\Api\Types;

	class Mollie extends \App\Providers\PaymentProvider
	{
	/**
	* Get a link to the customer in the provider's control panel
	*
	* @param \App\Wallet $wallet The wallet
	*
	* @return string\|null The string representing <a> tag
	*/
	public function customerLink(Wallet $wallet): ?string
	{
	$customer_id = self::mollieCustomerId($wallet, false);

	if (!$customer_id) {
	return null;
	}

	return sprintf(
	'<a href="https://www.mollie.com/dashboard/customers/%s" target="_blank">%s</a>',
	$customer_id,
	$customer_id
	);
	}

	/**
	* Create a new auto-payment mandate for a wallet.
	*
	* @param \App\Wallet $wallet The wallet
	* @param array $payment Payment data:
	* - amount: Value in cents (optional)
	* - currency: The operation currency
	* - description: Operation desc.
	* - methodId: Payment method
	*
	* @return array Provider payment data:
	* - id: Operation identifier
	* - redirectUrl: the location to redirect to
	*/
	public function createMandate(Wallet $wallet, array $payment): ?array
	{
	// Register the user in Mollie, if not yet done
	$customer_id = self::mollieCustomerId($wallet, true);

	if (!isset($payment['amount'])) {
	$payment['amount'] = 0;
	}

	$amount = $this->exchange($payment['amount'], $wallet->currency, $payment['currency']);
	$payment['currency_amount'] = $amount;

	$request = [
	'amount' => [
	'currency' => $payment['currency'],
	'value' => sprintf('%.2f', $amount / 100),
	],
	'customerId' => $customer_id,
	'sequenceType' => 'first',
	'description' => $payment['description'],
	'webhookUrl' => Utils::serviceUrl('/api/webhooks/payment/mollie'),
	'redirectUrl' => self::redirectUrl(),
	'locale' => 'en_US',
	'method' => $payment['methodId']
	];

	// Create the payment in Mollie
	$response = mollie()->payments()->create($request);

	if ($response->mandateId) {
	$wallet->setSetting('mollie_mandate_id', $response->mandateId);
	}

	// Store the payment reference in database
	$payment['status'] = $response->status;
	$payment['id'] = $response->id;
	$payment['type'] = self::TYPE_MANDATE;

	$this->storePayment($payment, $wallet->id);

	return [
	'id' => $response->id,
	'redirectUrl' => $response->getCheckoutUrl(),
	];
	}

	/**
	* Revoke the auto-payment mandate for the wallet.
	*
	* @param \App\Wallet $wallet The wallet
	*
	* @return bool True on success, False on failure
	*/
	public function deleteMandate(Wallet $wallet): bool
	{
	// Get the Mandate info
	$mandate = self::mollieMandate($wallet);

	// Revoke the mandate on Mollie
	if ($mandate) {
	$mandate->revoke();

	$wallet->setSetting('mollie_mandate_id', null);
	}

	return true;
	}

	/**
	* Get a auto-payment mandate for the wallet.
	*
	* @param \App\Wallet $wallet The wallet
	*
	* @return array\|null Mandate information:
	* - id: Mandate identifier
	* - method: user-friendly payment method desc.
	* - methodId: Payment method
	* - isPending: the process didn't complete yet
	* - isValid: the mandate is valid
	*/
	public function getMandate(Wallet $wallet): ?array
	{
	// Get the Mandate info
	$mandate = self::mollieMandate($wallet);

	if (empty($mandate)) {
	return null;
	}

	$result = [
	'id' => $mandate->id,
	'isPending' => $mandate->isPending(),
	'isValid' => $mandate->isValid(),
	'method' => self::paymentMethod($mandate, 'Unknown method'),
	'methodId' => $mandate->method
	];

	return $result;
	}

	/**
	* Get a provider name
	*
	* @return string Provider name
	*/
	public function name(): string
	{
	return 'mollie';
	}

	/**
	* Create a new payment.
	*
	* @param \App\Wallet $wallet The wallet
	* @param array $payment Payment data:
	* - amount: Value in cents
	* - currency: The operation currency
	* - type: oneoff/recurring
	* - description: Operation desc.
	* - methodId: Payment method
	*
	* @return array Provider payment data:
	* - id: Operation identifier
	* - redirectUrl: the location to redirect to
	*/
	public function payment(Wallet $wallet, array $payment): ?array
	{
	if ($payment['type'] == self::TYPE_RECURRING) {
	return $this->paymentRecurring($wallet, $payment);
	}

	// Register the user in Mollie, if not yet done
	$customer_id = self::mollieCustomerId($wallet, true);

	$amount = $this->exchange($payment['amount'], $wallet->currency, $payment['currency']);
	$payment['currency_amount'] = $amount;

	// Note: Required fields: description, amount/currency, amount/value
	$request = [
	'amount' => [
	'currency' => $payment['currency'],
	// a number with two decimals is required (note that JPK and ISK don't require decimals,
	// but we're not using them currently)
	'value' => sprintf('%.2f', $amount / 100),
	],
	'customerId' => $customer_id,
	'sequenceType' => $payment['type'],
	'description' => $payment['description'],
	'webhookUrl' => Utils::serviceUrl('/api/webhooks/payment/mollie'),
	'locale' => 'en_US',
	'method' => $payment['methodId'],
	'redirectUrl' => self::redirectUrl() // required for non-recurring payments
	];

	// TODO: Additional payment parameters for better fraud protection:
	// billingEmail - for bank transfers, Przelewy24, but not creditcard
	// billingAddress (it is a structured field not just text)

	// Create the payment in Mollie
	$response = mollie()->payments()->create($request);

	// Store the payment reference in database
	$payment['status'] = $response->status;
	$payment['id'] = $response->id;

	$this->storePayment($payment, $wallet->id);

	return [
	'id' => $payment['id'],
	'redirectUrl' => $response->getCheckoutUrl(),
	];
	}


	/**
	* Cancel a pending payment.
	*
	* @param \App\Wallet $wallet The wallet
	* @param string $paymentId Payment Id
	*
	* @return bool True on success, False on failure
	*/
	public function cancel(Wallet $wallet, $paymentId): bool
	{
	$response = mollie()->payments()->delete($paymentId);

	$db_payment = Payment::find($paymentId);
	$db_payment->status = $response->status;
	$db_payment->save();

	return true;
	}


	/**
	* Create a new automatic payment operation.
	*
	* @param \App\Wallet $wallet The wallet
	* @param array $payment Payment data (see self::payment())
	*
	* @return array Provider payment/session data:
	* - id: Operation identifier
	*/
	protected function paymentRecurring(Wallet $wallet, array $payment): ?array
	{
	// Check if there's a valid mandate
	$mandate = self::mollieMandate($wallet);

	if (empty($mandate) \|\| !$mandate->isValid() \|\| $mandate->isPending()) {
	return null;
	}

	$customer_id = self::mollieCustomerId($wallet, true);

	// Note: Required fields: description, amount/currency, amount/value
	$amount = $this->exchange($payment['amount'], $wallet->currency, $payment['currency']);
	$payment['currency_amount'] = $amount;

	$request = [
	'amount' => [
	'currency' => $payment['currency'],
	// a number with two decimals is required
	'value' => sprintf('%.2f', $amount / 100),
	],
	'customerId' => $customer_id,
	'sequenceType' => $payment['type'],
	'description' => $payment['description'],
	'webhookUrl' => Utils::serviceUrl('/api/webhooks/payment/mollie'),
	'locale' => 'en_US',
	'method' => $payment['methodId'],
	'mandateId' => $mandate->id
	];

	// Create the payment in Mollie
	$response = mollie()->payments()->create($request);

	// Store the payment reference in database
	$payment['status'] = $response->status;
	$payment['id'] = $response->id;

	DB::beginTransaction();

	$payment = $this->storePayment($payment, $wallet->id);

	// Mollie can return 'paid' status immediately, so we don't
	// have to wait for the webhook. What's more, the webhook would ignore
	// the payment because it will be marked as paid before the webhook.
	// Let's handle paid status here too.
	if ($response->isPaid()) {
	self::creditPayment($payment, $response);
	$notify = true;
	} elseif ($response->isFailed()) {
	// Note: I didn't find a way to get any description of the problem with a payment
	\Log::info(sprintf('Mollie payment failed (%s)', $response->id));

	// Disable the mandate
	$wallet->setSetting('mandate_disabled', 1);
	$notify = true;
	}

	DB::commit();

	if (!empty($notify)) {
	\App\Jobs\PaymentEmail::dispatch($payment);
	}

	return [
	'id' => $payment['id'],
	];
	}

	/**
	* Update payment status (and balance).
	*
	* @return int HTTP response code
	*/
	public function webhook(): int
	{
	$payment_id = \request()->input('id');

	if (empty($payment_id)) {
	return 200;
	}

	$payment = Payment::find($payment_id);

	if (empty($payment)) {
	// Mollie recommends to return "200 OK" even if the payment does not exist
	return 200;
	}

	// Get the payment details from Mollie
	// TODO: Consider https://github.com/mollie/mollie-api-php/issues/502 when it's fixed
	$mollie_payment = mollie()->payments()->get($payment_id);

	if (empty($mollie_payment)) {
	// Mollie recommends to return "200 OK" even if the payment does not exist
	return 200;
	}

	$refunds = [];

	if ($mollie_payment->isPaid()) {
	// The payment is paid. Update the balance, and notify the user
	if ($payment->status != self::STATUS_PAID && $payment->amount > 0) {
	$credit = true;
	$notify = $payment->type == self::TYPE_RECURRING;
	}

	// The payment has been (partially) refunded.
	// Let's process refunds with status "refunded".
	if ($mollie_payment->hasRefunds()) {
	foreach ($mollie_payment->refunds() as $refund) {
	if ($refund->isTransferred() && $refund->amount->value) {
	$refunds[] = [
	'id' => $refund->id,
	'description' => $refund->description,
	'amount' => round(floatval($refund->amount->value) * 100),
	'type' => self::TYPE_REFUND,
	'currency' => $refund->amount->currency
	];
	}
	}
	}

	// The payment has been (partially) charged back.
	// Let's process chargebacks (they have no states as refunds)
	if ($mollie_payment->hasChargebacks()) {
	foreach ($mollie_payment->chargebacks() as $chargeback) {
	if ($chargeback->amount->value) {
	$refunds[] = [
	'id' => $chargeback->id,
	'amount' => round(floatval($chargeback->amount->value) * 100),
	'type' => self::TYPE_CHARGEBACK,
	'currency' => $chargeback->amount->currency
	];
	}
	}
	}

	// In case there were multiple auto-payment setup requests (e.g. caused by a double
	// form submission) we end up with multiple payment records and mollie_mandate_id
	// pointing to the one from the last payment not the successful one.
	// We make sure to use mandate id from the successful "first" payment.
	if (
	$payment->type == self::TYPE_MANDATE
	&& $mollie_payment->mandateId
	&& $mollie_payment->sequenceType == Types\SequenceType::SEQUENCETYPE_FIRST
	) {
	$payment->wallet->setSetting('mollie_mandate_id', $mollie_payment->mandateId);
	}
	} elseif ($mollie_payment->isFailed()) {
	// Note: I didn't find a way to get any description of the problem with a payment
	\Log::info(sprintf('Mollie payment failed (%s)', $payment->id));

	// Disable the mandate
	if ($payment->type == self::TYPE_RECURRING) {
	$notify = true;
	$payment->wallet->setSetting('mandate_disabled', 1);
	}
	}

	DB::beginTransaction();

	// This is a sanity check, just in case the payment provider api
	// sent us open -> paid -> open -> paid. So, we lock the payment after
	// recivied a "final" state.
	$pending_states = [self::STATUS_OPEN, self::STATUS_PENDING, self::STATUS_AUTHORIZED];
	if (in_array($payment->status, $pending_states)) {
	$payment->status = $mollie_payment->status;
	$payment->save();
	}

	if (!empty($credit)) {
	self::creditPayment($payment, $mollie_payment);
	}

	foreach ($refunds as $refund) {
	$this->storeRefund($payment->wallet, $refund);
	}

	DB::commit();

	if (!empty($notify)) {
	\App\Jobs\PaymentEmail::dispatch($payment);
	}

	return 200;
	}

	/**
	* Get Mollie customer identifier for specified wallet.
	* Create one if does not exist yet.
	*
	* @param \App\Wallet $wallet The wallet
	* @param bool $create Create the customer if does not exist yet
	*
	* @return ?string Mollie customer identifier
	*/
	protected static function mollieCustomerId(Wallet $wallet, bool $create = false): ?string
	{
	$customer_id = $wallet->getSetting('mollie_id');

	// Register the user in Mollie
	if (empty($customer_id) && $create) {
	$customer = mollie()->customers()->create([
	'name' => $wallet->owner->name(),
	'email' => $wallet->id . '@private.' . \config('app.domain'),
	]);

	$customer_id = $customer->id;

	$wallet->setSetting('mollie_id', $customer->id);
	}

	return $customer_id;
	}

	/**
	* Get the active Mollie auto-payment mandate
	*/
	protected static function mollieMandate(Wallet $wallet)
	{
	$customer_id = $wallet->getSetting('mollie_id');
	$mandate_id = $wallet->getSetting('mollie_mandate_id');

	// Get the manadate reference we already have
	if ($customer_id && $mandate_id) {
	try {
	return mollie()->mandates()->getForId($customer_id, $mandate_id);
	} catch (ApiException $e) {
	// FIXME: What about 404?
	if ($e->getCode() == 410) {
	// The mandate is gone, remove the reference
	$wallet->setSetting('mollie_mandate_id', null);
	return null;
	}

	// TODO: Maybe we shouldn't always throw? It make sense in the job
	// but for example when we're just fetching wallet info...
	throw $e;
	}
	}
	}

	/**
	* Apply the successful payment's pecunia to the wallet
	*/
	protected static function creditPayment($payment, $mollie_payment)
	{
	// Extract the payment method for transaction description
	$method = self::paymentMethod($mollie_payment, 'Mollie');

	// TODO: Localization?
	$description = $payment->type == self::TYPE_RECURRING ? 'Auto-payment' : 'Payment';
	$description .= " transaction {$payment->id} using {$method}";

	$payment->wallet->credit($payment->amount, $description);

	// Unlock the disabled auto-payment mandate
	if ($payment->wallet->balance >= 0) {
	$payment->wallet->setSetting('mandate_disabled', null);
	}
	}

	/**
	* Extract payment method description from Mollie payment/mandate details
	*/
	protected static function paymentMethod($object, $default = ''): string
	{
	$details = $object->details;

	// Mollie supports 3 methods here
	switch ($object->method) {
	case self::METHOD_CREDITCARD:
	// If the customer started, but never finished the 'first' payment
	// card details will be empty, and mandate will be 'pending'.
	if (empty($details->cardNumber)) {
	return 'Credit Card';
	}

	return sprintf(
	'%s (** ** %s)',
	$details->cardLabel ?: 'Card', // @phpstan-ignore-line
	$details->cardNumber
	);

	case self::METHOD_DIRECTDEBIT:
	return sprintf('Direct Debit (%s)', $details->customerAccount);

	case self::METHOD_PAYPAL:
	return sprintf('PayPal (%s)', $details->consumerAccount);
	}

	return $default;
	}

	/**
	* List supported payment methods.
	*
	* @param string $type The payment type for which we require a method (oneoff/recurring).
	*
	* @return array Array of array with available payment methods:
	* - id: id of the method
	* - name: User readable name of the payment method
	* - minimumAmount: Minimum amount to be charged in cents
	* - currency: Currency used for the method
	* - exchangeRate: The projected exchange rate (actual rate is determined during payment)
	* - icon: An icon (icon name) representing the method
	*/
	public function providerPaymentMethods($type): array
	{
	$providerMethods = array_merge(
	// Fallback to EUR methods (later provider methods will override earlier ones)
	(array) mollie()->methods()->allActive(
	[
	'sequenceType' => $type,
	'amount' => [
	'value' => '1.00',
	'currency' => 'EUR'
	]
	]
	),
	// Prefer CHF methods
	(array) mollie()->methods()->allActive(
	[
	'sequenceType' => $type,
	'amount' => [
	'value' => '1.00',
	'currency' => 'CHF'
	]
	]
	)
	);

	$availableMethods = [];
	+
	foreach ($providerMethods as $method) {
	$availableMethods[$method->id] = [
	'id' => $method->id,
	'name' => $method->description,
	'minimumAmount' => round(floatval($method->minimumAmount->value) * 100), // Converted to cents
	'currency' => $method->minimumAmount->currency,
	'exchangeRate' => \App\Utils::exchangeRate('CHF', $method->minimumAmount->currency)
	];
	}

	return $availableMethods;
	}

	/**
	* Get a payment.
	*
	* @param string $paymentId Payment identifier
	*
	* @return array Payment information:
	* - id: Payment identifier
	* - status: Payment status
	* - isCancelable: The payment can be canceled
	* - checkoutUrl: The checkout url to complete the payment or null if none
	*/
	public function getPayment($paymentId): array
	{
	$payment = mollie()->payments()->get($paymentId);

	return [
	'id' => $payment->id,
	'status' => $payment->status,
	'isCancelable' => $payment->isCancelable,
	'checkoutUrl' => $payment->getCheckoutUrl()
	];
	}
	}
	diff --git a/src/app/Tenant.php b/src/app/Tenant.php
	index 608b1897..c233f671 100644
	--- a/src/app/Tenant.php
	+++ b/src/app/Tenant.php
	@@ -1,52 +1,53 @@
	<?php

	namespace App;

	use Illuminate\Database\Eloquent\Model;

	/**
	* The eloquent definition of a Tenant.
	*
	* @property int $id
	* @property string $title
	*/
	class Tenant extends Model
	{
	protected $fillable = [
	+ 'id',
	'title',
	];

	protected $keyType = 'bigint';

	/**
	* Discounts assigned to this tenant.
	*
	* @return \Illuminate\Database\Eloquent\Relations\HasMany
	*/
	public function discounts()
	{
	return $this->hasMany('App\Discount');
	}

	/**
	* SignupInvitations assigned to this tenant.
	*
	* @return \Illuminate\Database\Eloquent\Relations\HasMany
	*/
	public function signupInvitations()
	{
	return $this->hasMany('App\SignupInvitation');
	}

	/*
	* Returns the wallet of the tanant (reseller's wallet).
	*
	* @return ?\App\Wallet A wallet object
	*/
	public function wallet(): ?Wallet
	{
	$user = \App\User::where('role', 'reseller')->where('tenant_id', $this->id)->first();

	return $user ? $user->wallets->first() : null;
	}
	}
	diff --git a/src/app/User.php b/src/app/User.php
	index 55379903..173b749a 100644
	--- a/src/app/User.php
	+++ b/src/app/User.php
	@@ -1,758 +1,758 @@
	<?php

	namespace App;

	use App\Entitlement;
	use App\UserAlias;
	use App\Sku;
	use App\Traits\UserAliasesTrait;
	use App\Traits\SettingsTrait;
	use App\Wallet;
	use Illuminate\Database\Eloquent\SoftDeletes;
	use Illuminate\Foundation\Auth\User as Authenticatable;
	use Iatstuti\Database\Support\NullableFields;
	use Tymon\JWTAuth\Contracts\JWTSubject;

	/**
	* The eloquent definition of a User.
	*
	* @property string $email
	* @property int $id
	* @property string $password
	* @property int $status
	* @property int $tenant_id
	*/
	class User extends Authenticatable implements JWTSubject
	{
	use NullableFields;
	use UserAliasesTrait;
	use SettingsTrait;
	use SoftDeletes;

	// a new user, default on creation
	public const STATUS_NEW = 1 << 0;
	// it's been activated
	public const STATUS_ACTIVE = 1 << 1;
	// user has been suspended
	public const STATUS_SUSPENDED = 1 << 2;
	// user has been deleted
	public const STATUS_DELETED = 1 << 3;
	// user has been created in LDAP
	public const STATUS_LDAP_READY = 1 << 4;
	// user mailbox has been created in IMAP
	public const STATUS_IMAP_READY = 1 << 5;


	// change the default primary key type
	public $incrementing = false;
	protected $keyType = 'bigint';

	/**
	* The attributes that are mass assignable.
	*
	* @var array
	*/
	protected $fillable = [
	'id',
	'email',
	'password',
	'password_ldap',
	'status',
	];

	/**
	* The attributes that should be hidden for arrays.
	*
	* @var array
	*/
	protected $hidden = [
	'password',
	'password_ldap',
	'role'
	];

	protected $nullable = [
	'password',
	'password_ldap'
	];

	/**
	* Any wallets on which this user is a controller.
	*
	* This does not include wallets owned by the user.
	*
	* @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
	*/
	public function accounts()
	{
	return $this->belongsToMany(
	'App\Wallet', // The foreign object definition
	'user_accounts', // The table name
	'user_id', // The local foreign key
	'wallet_id' // The remote foreign key
	);
	}

	/**
	* Email aliases of this user.
	*
	* @return \Illuminate\Database\Eloquent\Relations\HasMany
	*/
	public function aliases()
	{
	return $this->hasMany('App\UserAlias', 'user_id');
	}

	/**
	* Assign a package to a user. The user should not have any existing entitlements.
	*
	* @param \App\Package $package The package to assign.
	* @param \App\User\|null $user Assign the package to another user.
	*
	* @return \App\User
	*/
	public function assignPackage($package, $user = null)
	{
	if (!$user) {
	$user = $this;
	}

	$wallet_id = $this->wallets()->first()->id;

	foreach ($package->skus as $sku) {
	for ($i = $sku->pivot->qty; $i > 0; $i--) {
	\App\Entitlement::create(
	[
	'wallet_id' => $wallet_id,
	'sku_id' => $sku->id,
	'cost' => $sku->pivot->cost(),
	'fee' => $sku->pivot->fee(),
	'entitleable_id' => $user->id,
	'entitleable_type' => User::class
	]
	);
	}
	}

	return $user;
	}

	/**
	* Assign a package plan to a user.
	*
	* @param \App\Plan $plan The plan to assign
	* @param \App\Domain $domain Optional domain object
	*
	* @return \App\User Self
	*/
	public function assignPlan($plan, $domain = null): User
	{
	$this->setSetting('plan_id', $plan->id);

	foreach ($plan->packages as $package) {
	if ($package->isDomain()) {
	$domain->assignPackage($package, $this);
	} else {
	$this->assignPackage($package);
	}
	}

	return $this;
	}

	/**
	* Assign a Sku to a user.
	*
	* @param \App\Sku $sku The sku to assign.
	* @param int $count Count of entitlements to add
	*
	* @return \App\User Self
	* @throws \Exception
	*/
	public function assignSku(Sku $sku, int $count = 1): User
	{
	// TODO: I guess wallet could be parametrized in future
	$wallet = $this->wallet();
	$exists = $this->entitlements()->where('sku_id', $sku->id)->count();

	while ($count > 0) {
	\App\Entitlement::create([
	'wallet_id' => $wallet->id,
	'sku_id' => $sku->id,
	'cost' => $exists >= $sku->units_free ? $sku->cost : 0,
	'fee' => $exists >= $sku->units_free ? $sku->fee : 0,
	'entitleable_id' => $this->id,
	'entitleable_type' => User::class
	]);

	$exists++;
	$count--;
	}

	return $this;
	}

	/**
	* Check if current user can delete another object.
	*
	* @param mixed $object A user\|domain\|wallet\|group object
	*
	* @return bool True if he can, False otherwise
	*/
	public function canDelete($object): bool
	{
	if (!method_exists($object, 'wallet')) {
	return false;
	}

	$wallet = $object->wallet();

	// TODO: For now controller can delete/update the account owner,
	// this may change in future, controllers are not 0-regression feature

	return $this->wallets->contains($wallet) \|\| $this->accounts->contains($wallet);
	}

	/**
	* Check if current user can read data of another object.
	*
	* @param mixed $object A user\|domain\|wallet\|group object
	*
	* @return bool True if he can, False otherwise
	*/
	public function canRead($object): bool
	{
	if ($this->role == 'admin') {
	return true;
	}

	if ($object instanceof User && $this->id == $object->id) {
	return true;
	}

	if ($this->role == 'reseller') {
	if ($object instanceof User && $object->role == 'admin') {
	return false;
	}

	if ($object instanceof Wallet && !empty($object->owner)) {
	$object = $object->owner;
	}

	return isset($object->tenant_id) && $object->tenant_id == $this->tenant_id;
	}

	if ($object instanceof Wallet) {
	return $object->user_id == $this->id \|\| $object->controllers->contains($this);
	}

	if (!method_exists($object, 'wallet')) {
	return false;
	}

	$wallet = $object->wallet();

	return $wallet && ($this->wallets->contains($wallet) \|\| $this->accounts->contains($wallet));
	}

	/**
	* Check if current user can update data of another object.
	*
	* @param mixed $object A user\|domain\|wallet\|group object
	*
	* @return bool True if he can, False otherwise
	*/
	public function canUpdate($object): bool
	{
	if ($object instanceof User && $this->id == $object->id) {
	return true;
	}

	if ($this->role == 'admin') {
	return true;
	}

	if ($this->role == 'reseller') {
	if ($object instanceof User && $object->role == 'admin') {
	return false;
	}

	if ($object instanceof Wallet && !empty($object->owner)) {
	$object = $object->owner;
	}

	return isset($object->tenant_id) && $object->tenant_id == $this->tenant_id;
	}

	return $this->canDelete($object);
	}

	/**
	* Return the \App\Domain for this user.
	*
	* @return \App\Domain\|null
	*/
	public function domain()
	{
	list($local, $domainName) = explode('@', $this->email);

	$domain = \App\Domain::withTrashed()->where('namespace', $domainName)->first();

	return $domain;
	}

	/**
	* List the domains to which this user is entitled.
	* Note: Active public domains are also returned (for the user tenant).
	*
	* @return Domain[] List of Domain objects
	*/
	public function domains(): array
	{
	if ($this->tenant_id) {
	$domains = Domain::where('tenant_id', $this->tenant_id);
	} else {
	- $domains = Domain::withEnvTenant();
	+ $domains = Domain::withEnvTenantContext();
	}

	$domains = $domains->whereRaw(sprintf('(type & %s)', Domain::TYPE_PUBLIC))
	->whereRaw(sprintf('(status & %s)', Domain::STATUS_ACTIVE))
	->get()
	->all();

	foreach ($this->wallets as $wallet) {
	$entitlements = $wallet->entitlements()->where('entitleable_type', Domain::class)->get();
	foreach ($entitlements as $entitlement) {
	$domains[] = $entitlement->entitleable;
	}
	}

	foreach ($this->accounts as $wallet) {
	$entitlements = $wallet->entitlements()->where('entitleable_type', Domain::class)->get();
	foreach ($entitlements as $entitlement) {
	$domains[] = $entitlement->entitleable;
	}
	}

	return $domains;
	}

	/**
	* The user entitlement.
	*
	* @return \Illuminate\Database\Eloquent\Relations\MorphOne
	*/
	public function entitlement()
	{
	return $this->morphOne('App\Entitlement', 'entitleable');
	}

	/**
	* Entitlements for this user.
	*
	* Note that these are entitlements that apply to the user account, and not entitlements that
	* this user owns.
	*
	* @return \Illuminate\Database\Eloquent\Relations\HasMany
	*/
	public function entitlements()
	{
	return $this->hasMany('App\Entitlement', 'entitleable_id', 'id')
	->where('entitleable_type', User::class);
	}

	/**
	* Find whether an email address exists as a user (including deleted users).
	*
	* @param string $email Email address
	* @param bool $return_user Return User instance instead of boolean
	*
	* @return \App\User\|bool True or User model object if found, False otherwise
	*/
	public static function emailExists(string $email, bool $return_user = false)
	{
	if (strpos($email, '@') === false) {
	return false;
	}

	$email = \strtolower($email);

	$user = self::withTrashed()->where('email', $email)->first();

	if ($user) {
	return $return_user ? $user : true;
	}

	return false;
	}

	/**
	* Helper to find user by email address, whether it is
	* main email address, alias or an external email.
	*
	* If there's more than one alias NULL will be returned.
	*
	* @param string $email Email address
	* @param bool $external Search also for an external email
	*
	* @return \App\User User model object if found
	*/
	public static function findByEmail(string $email, bool $external = false): ?User
	{
	if (strpos($email, '@') === false) {
	return null;
	}

	$email = \strtolower($email);

	$user = self::where('email', $email)->first();

	if ($user) {
	return $user;
	}

	$aliases = UserAlias::where('alias', $email)->get();

	if (count($aliases) == 1) {
	return $aliases->first()->user;
	}

	// TODO: External email

	return null;
	}

	public function getJWTIdentifier()
	{
	return $this->getKey();
	}

	public function getJWTCustomClaims()
	{
	return [];
	}

	/**
	* Return groups controlled by the current user.
	*
	* @param bool $with_accounts Include groups assigned to wallets
	* the current user controls but not owns.
	*
	* @return \Illuminate\Database\Eloquent\Builder Query builder
	*/
	public function groups($with_accounts = true)
	{
	$wallets = $this->wallets()->pluck('id')->all();

	if ($with_accounts) {
	$wallets = array_merge($wallets, $this->accounts()->pluck('wallet_id')->all());
	}

	return Group::select(['groups.*', 'entitlements.wallet_id'])
	->distinct()
	->join('entitlements', 'entitlements.entitleable_id', '=', 'groups.id')
	->whereIn('entitlements.wallet_id', $wallets)
	->where('entitlements.entitleable_type', Group::class);
	}

	/**
	* Check if user has an entitlement for the specified SKU.
	*
	* @param string $title The SKU title
	*
	* @return bool True if specified SKU entitlement exists
	*/
	- public function hasSku($title): bool
	+ public function hasSku(string $title): bool
	{
	- $sku = Sku::where('title', $title)->first();
	+ $sku = Sku::withObjectTenantContext($this)->where('title', $title)->first();

	if (!$sku) {
	return false;
	}

	return $this->entitlements()->where('sku_id', $sku->id)->count() > 0;
	}

	/**
	* Returns whether this domain is active.
	*
	* @return bool
	*/
	public function isActive(): bool
	{
	return ($this->status & self::STATUS_ACTIVE) > 0;
	}

	/**
	* Returns whether this domain is deleted.
	*
	* @return bool
	*/
	public function isDeleted(): bool
	{
	return ($this->status & self::STATUS_DELETED) > 0;
	}

	/**
	* Returns whether this (external) domain has been verified
	* to exist in DNS.
	*
	* @return bool
	*/
	public function isImapReady(): bool
	{
	return ($this->status & self::STATUS_IMAP_READY) > 0;
	}

	/**
	* Returns whether this user is registered in LDAP.
	*
	* @return bool
	*/
	public function isLdapReady(): bool
	{
	return ($this->status & self::STATUS_LDAP_READY) > 0;
	}

	/**
	* Returns whether this user is new.
	*
	* @return bool
	*/
	public function isNew(): bool
	{
	return ($this->status & self::STATUS_NEW) > 0;
	}

	/**
	* Returns whether this domain is suspended.
	*
	* @return bool
	*/
	public function isSuspended(): bool
	{
	return ($this->status & self::STATUS_SUSPENDED) > 0;
	}

	/**
	* A shortcut to get the user name.
	*
	* @param bool $fallback Return "<aa.name> User" if there's no name
	*
	* @return string Full user name
	*/
	public function name(bool $fallback = false): string
	{
	$firstname = $this->getSetting('first_name');
	$lastname = $this->getSetting('last_name');

	$name = trim($firstname . ' ' . $lastname);

	if (empty($name) && $fallback) {
	return \config('app.name') . ' User';
	}

	return $name;
	}

	/**
	* Remove a number of entitlements for the SKU.
	*
	* @param \App\Sku $sku The SKU
	* @param int $count The number of entitlements to remove
	*
	* @return User Self
	*/
	public function removeSku(Sku $sku, int $count = 1): User
	{
	$entitlements = $this->entitlements()
	->where('sku_id', $sku->id)
	->orderBy('cost', 'desc')
	->orderBy('created_at')
	->get();

	$entitlements_count = count($entitlements);

	foreach ($entitlements as $entitlement) {
	if ($entitlements_count <= $sku->units_free) {
	continue;
	}

	if ($count > 0) {
	$entitlement->delete();
	$entitlements_count--;
	$count--;
	}
	}

	return $this;
	}

	/**
	* Any (additional) properties of this user.
	*
	* @return \Illuminate\Database\Eloquent\Relations\HasMany
	*/
	public function settings()
	{
	return $this->hasMany('App\UserSetting', 'user_id');
	}

	/**
	* Suspend this domain.
	*
	* @return void
	*/
	public function suspend(): void
	{
	if ($this->isSuspended()) {
	return;
	}

	$this->status \|= User::STATUS_SUSPENDED;
	$this->save();
	}

	/**
	* The tenant for this user account.
	*
	* @return \Illuminate\Database\Eloquent\Relations\BelongsTo
	*/
	public function tenant()
	{
	return $this->belongsTo('App\Tenant', 'tenant_id', 'id');
	}

	/**
	* Unsuspend this domain.
	*
	* @return void
	*/
	public function unsuspend(): void
	{
	if (!$this->isSuspended()) {
	return;
	}

	$this->status ^= User::STATUS_SUSPENDED;
	$this->save();
	}

	/**
	* Return users controlled by the current user.
	*
	* @param bool $with_accounts Include users assigned to wallets
	* the current user controls but not owns.
	*
	* @return \Illuminate\Database\Eloquent\Builder Query builder
	*/
	public function users($with_accounts = true)
	{
	$wallets = $this->wallets()->pluck('id')->all();

	if ($with_accounts) {
	$wallets = array_merge($wallets, $this->accounts()->pluck('wallet_id')->all());
	}

	return $this->select(['users.*', 'entitlements.wallet_id'])
	->distinct()
	->leftJoin('entitlements', 'entitlements.entitleable_id', '=', 'users.id')
	->whereIn('entitlements.wallet_id', $wallets)
	->where('entitlements.entitleable_type', User::class);
	}

	/**
	* Verification codes for this user.
	*
	* @return \Illuminate\Database\Eloquent\Relations\HasMany
	*/
	public function verificationcodes()
	{
	return $this->hasMany('App\VerificationCode', 'user_id', 'id');
	}

	/**
	* Returns the wallet by which the user is controlled
	*
	* @return ?\App\Wallet A wallet object
	*/
	public function wallet(): ?Wallet
	{
	$entitlement = $this->entitlement()->withTrashed()->orderBy('created_at', 'desc')->first();

	// TODO: No entitlement should not happen, but in tests we have
	// such cases, so we fallback to the user's wallet in this case
	return $entitlement ? $entitlement->wallet : $this->wallets()->first();
	}

	/**
	* Wallets this user owns.
	*
	* @return \Illuminate\Database\Eloquent\Relations\HasMany
	*/
	public function wallets()
	{
	return $this->hasMany('App\Wallet');
	}

	/**
	* User password mutator
	*
	* @param string $password The password in plain text.
	*
	* @return void
	*/
	public function setPasswordAttribute($password)
	{
	if (!empty($password)) {
	$this->attributes['password'] = bcrypt($password, [ "rounds" => 12 ]);
	$this->attributes['password_ldap'] = '{SSHA512}' . base64_encode(
	pack('H*', hash('sha512', $password))
	);
	}
	}

	/**
	* User LDAP password mutator
	*
	* @param string $password The password in plain text.
	*
	* @return void
	*/
	public function setPasswordLdapAttribute($password)
	{
	$this->setPasswordAttribute($password);
	}

	/**
	* User status mutator
	*
	* @throws \Exception
	*/
	public function setStatusAttribute($status)
	{
	$new_status = 0;

	$allowed_values = [
	self::STATUS_NEW,
	self::STATUS_ACTIVE,
	self::STATUS_SUSPENDED,
	self::STATUS_DELETED,
	self::STATUS_LDAP_READY,
	self::STATUS_IMAP_READY,
	];

	foreach ($allowed_values as $value) {
	if ($status & $value) {
	$new_status \|= $value;
	$status ^= $value;
	}
	}

	if ($status > 0) {
	throw new \Exception("Invalid user status: {$status}");
	}

	$this->attributes['status'] = $new_status;
	}
	}
	diff --git a/src/app/Utils.php b/src/app/Utils.php
	index 467f2e3e..6fa74742 100644
	--- a/src/app/Utils.php
	+++ b/src/app/Utils.php
	@@ -1,430 +1,462 @@
	<?php

	namespace App;

	use Carbon\Carbon;
	use Illuminate\Support\Facades\Auth;
	use Ramsey\Uuid\Uuid;
	use Illuminate\Support\Facades\Cache;

	/**
	* Small utility functions for App.
	*/
	class Utils
	{
	// Note: Removed '0', 'O', '1', 'I' as problematic with some fonts
	public const CHARS = '23456789ABCDEFGHJKLMNPQRSTUVWXYZ';

	/**
	* Count the number of lines in a file.
	*
	* Useful for progress bars.
	*
	* @param string $file The filepath to count the lines of.
	*
	* @return int
	*/
	public static function countLines($file)
	{
	$fh = fopen($file, 'rb');
	$numLines = 0;

	while (!feof($fh)) {
	$numLines += substr_count(fread($fh, 8192), "\n");
	}

	fclose($fh);

	return $numLines;
	}

	/**
	* Return the country ISO code for an IP address.
	*
	* @return string
	*/
	public static function countryForIP($ip)
	{
	if (strpos(':', $ip) === false) {
	$query = "
	SELECT country FROM ip4nets
	WHERE INET_ATON(net_number) <= INET_ATON(?)
	AND INET_ATON(net_broadcast) >= INET_ATON(?)
	ORDER BY INET_ATON(net_number), net_mask DESC LIMIT 1
	";
	} else {
	$query = "
	SELECT id FROM ip6nets
	WHERE INET6_ATON(net_number) <= INET6_ATON(?)
	AND INET6_ATON(net_broadcast) >= INET6_ATON(?)
	ORDER BY INET6_ATON(net_number), net_mask DESC LIMIT 1
	";
	}

	$nets = \Illuminate\Support\Facades\DB::select($query, [$ip, $ip]);

	if (sizeof($nets) > 0) {
	return $nets[0]->country;
	}

	return 'CH';
	}

	/**
	* Return the country ISO code for the current request.
	*/
	public static function countryForRequest()
	{
	$request = \request();
	$ip = $request->ip();

	return self::countryForIP($ip);
	}

	/**
	* Shortcut to creating a progress bar of a particular format with a particular message.
	*
	* @param \Illuminate\Console\OutputStyle $output Console output object
	* @param int $count Number of progress steps
	* @param string $message The description
	*
	* @return \Symfony\Component\Console\Helper\ProgressBar
	*/
	public static function createProgressBar($output, $count, $message = null)
	{
	$bar = $output->createProgressBar($count);

	$bar->setFormat(
	'%current:7s%/%max:7s% [%bar%] %percent:3s%% %elapsed:7s%/%estimated:-7s% %message% '
	);

	if ($message) {
	$bar->setMessage($message . " ...");
	}

	$bar->start();

	return $bar;
	}

	/**
	* Return the number of days in the month prior to this one.
	*
	* @return int
	*/
	public static function daysInLastMonth()
	{
	$start = new Carbon('first day of last month');
	$end = new Carbon('last day of last month');

	return $start->diffInDays($end) + 1;
	}

	/**
	* Download a file from the interwebz and store it locally.
	*
	* @param string $source The source location
	* @param string $target The target location
	* @param bool $force Force the download (and overwrite target)
	*
	* @return void
	*/
	public static function downloadFile($source, $target, $force = false)
	{
	if (is_file($target) && !$force) {
	return;
	}

	\Log::info("Retrieving {$source}");

	$fp = fopen($target, 'w');

	$curl = curl_init();
	curl_setopt($curl, CURLOPT_URL, $source);
	curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
	curl_setopt($curl, CURLOPT_FILE, $fp);
	curl_exec($curl);

	if (curl_errno($curl)) {
	\Log::error("Request error on {$source}: " . curl_error($curl));

	curl_close($curl);
	fclose($fp);

	unlink($target);
	return;
	}

	curl_close($curl);
	fclose($fp);
	}

	+
	+ /**
	+ * Generate a passphrase. Not intended for use in production, so limited to environments that are not production.
	+ *
	+ * @return string
	+ */
	+ public static function generatePassphrase()
	+ {
	+ if (\config('app.env') == 'production') {
	+ throw new \Exception("Thou shall not pass!");
	+ }
	+
	+ if (\config('app.passphrase')) {
	+ return \config('app.passphrase');
	+ }
	+
	+ $alphaLow = 'abcdefghijklmnopqrstuvwxyz';
	+ $alphaUp = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
	+ $num = '0123456789';
	+ $stdSpecial = '~`!@#$%^&*()-_+=[{]}\\\|\'";:/?.>,<';
	+
	+ $source = $alphaLow . $alphaUp . $num . $stdSpecial;
	+
	+ $result = '';
	+
	+ for ($x = 0; $x < 16; $x++) {
	+ $result .= substr($source, rand(0, (strlen($source) - 1)), 1);
	+ }
	+
	+ return $result;
	+ }
	+
	/**
	* Calculate the broadcast address provided a net number and a prefix.
	*
	* @param string $net A valid IPv6 network number.
	* @param int $prefix The network prefix.
	*
	* @return string
	*/
	public static function ip6Broadcast($net, $prefix)
	{
	$netHex = bin2hex(inet_pton($net));

	// Overwriting first address string to make sure notation is optimal
	$net = inet_ntop(hex2bin($netHex));

	// Calculate the number of 'flexible' bits
	$flexbits = 128 - $prefix;

	// Build the hexadecimal string of the last address
	$lastAddrHex = $netHex;

	// We start at the end of the string (which is always 32 characters long)
	$pos = 31;
	while ($flexbits > 0) {
	// Get the character at this position
	$orig = substr($lastAddrHex, $pos, 1);

	// Convert it to an integer
	$origval = hexdec($orig);

	// OR it with (2^flexbits)-1, with flexbits limited to 4 at a time
	$newval = $origval \| (pow(2, min(4, $flexbits)) - 1);

	// Convert it back to a hexadecimal character
	$new = dechex($newval);

	// And put that character back in the string
	$lastAddrHex = substr_replace($lastAddrHex, $new, $pos, 1);

	// We processed one nibble, move to previous position
	$flexbits -= 4;
	$pos -= 1;
	}

	// Convert the hexadecimal string to a binary string
	$lastaddrbin = hex2bin($lastAddrHex);

	// And create an IPv6 address from the binary string
	$lastaddrstr = inet_ntop($lastaddrbin);

	return $lastaddrstr;
	}

	/**
	* Provide all unique combinations of elements in $input, with order and duplicates irrelevant.
	*
	* @param array $input The input array of elements.
	*
	* @return array[]
	*/
	public static function powerSet(array $input): array
	{
	$output = [];

	for ($x = 0; $x < count($input); $x++) {
	self::combine($input, $x + 1, 0, [], 0, $output);
	}

	return $output;
	}

	/**
	* Returns the current user's email address or null.
	*
	* @return string
	*/
	public static function userEmailOrNull(): ?string
	{
	$user = Auth::user();

	if (!$user) {
	return null;
	}

	return $user->email;
	}

	/**
	* Returns a random string consisting of a quantity of segments of a certain length joined.
	*
	* Example:
	*
	* ```php
	* $roomName = strtolower(\App\Utils::randStr(3, 3, '-');
	* // $roomName == '3qb-7cs-cjj'
	* ```
	*
	* @param int $length The length of each segment
	* @param int $qty The quantity of segments
	* @param string $join The string to use to join the segments
	*
	* @return string
	*/
	public static function randStr($length, $qty = 1, $join = '')
	{
	$chars = env('SHORTCODE_CHARS', self::CHARS);

	$randStrs = [];

	for ($x = 0; $x < $qty; $x++) {
	$randStrs[$x] = [];

	for ($y = 0; $y < $length; $y++) {
	$randStrs[$x][] = $chars[rand(0, strlen($chars) - 1)];
	}

	shuffle($randStrs[$x]);

	$randStrs[$x] = implode('', $randStrs[$x]);
	}

	return implode($join, $randStrs);
	}

	/**
	* Returns a UUID in the form of an integer.
	*
	* @return integer
	*/
	public static function uuidInt(): int
	{
	$hex = Uuid::uuid4();
	$bin = pack('h*', str_replace('-', '', $hex));
	$ids = unpack('L', $bin);
	$id = array_shift($ids);

	return $id;
	}

	/**
	* Returns a UUID in the form of a string.
	*
	* @return string
	*/
	public static function uuidStr(): string
	{
	return Uuid::uuid4()->toString();
	}

	private static function combine($input, $r, $index, $data, $i, &$output): void
	{
	$n = count($input);

	// Current cobination is ready
	if ($index == $r) {
	$output[] = array_slice($data, 0, $r);
	return;
	}

	// When no more elements are there to put in data[]
	if ($i >= $n) {
	return;
	}

	// current is included, put next at next location
	$data[$index] = $input[$i];
	self::combine($input, $r, $index + 1, $data, $i + 1, $output);

	// current is excluded, replace it with next (Note that i+1
	// is passed, but index is not changed)
	self::combine($input, $r, $index, $data, $i + 1, $output);
	}

	/**
	* Create self URL
	*
	* @param string $route Route/Path
	* @todo Move this to App\Http\Controllers\Controller
	*
	* @return string Full URL
	*/
	public static function serviceUrl(string $route): string
	{
	$url = \config('app.public_url');

	if (!$url) {
	$url = \config('app.url');
	}

	return rtrim(trim($url, '/') . '/' . ltrim($route, '/'), '/');
	}

	/**
	* Create a configuration/environment data to be passed to
	* the UI
	*
	* @todo Move this to App\Http\Controllers\Controller
	*
	* @return array Configuration data
	*/
	public static function uiEnv(): array
	{
	$countries = include resource_path('countries.php');
	$req_domain = preg_replace('/:[0-9]+$/', '', request()->getHttpHost());
	$sys_domain = \config('app.domain');
	$opts = [
	'app.name',
	'app.url',
	'app.domain',
	'app.theme',
	'app.webmail_url',
	'app.support_email',
	'mail.from.address'
	];

	$env = \app('config')->getMany($opts);

	$env['countries'] = $countries ?: [];
	$env['view'] = 'root';
	$env['jsapp'] = 'user.js';

	if ($req_domain == "admin.$sys_domain") {
	$env['jsapp'] = 'admin.js';
	} elseif ($req_domain == "reseller.$sys_domain") {
	$env['jsapp'] = 'reseller.js';
	}

	$env['paymentProvider'] = \config('services.payment_provider');
	$env['stripePK'] = \config('services.stripe.public_key');

	$env['languages'] = \App\Http\Controllers\ContentController::locales();
	$env['menu'] = \App\Http\Controllers\ContentController::menu();

	return $env;
	}

	/**
	* Retrieve an exchange rate.
	*
	* @param string $sourceCurrency: Currency from which to convert
	* @param string $targetCurrency: Currency to convert to
	*
	* @return float Exchange rate
	*/
	public static function exchangeRate(string $sourceCurrency, string $targetCurrency): float
	{
	if (strcasecmp($sourceCurrency, $targetCurrency) == 0) {
	return 1.0;
	}

	$currencyFile = resource_path("exchangerates-$sourceCurrency.php");

	//Attempt to find the reverse exchange rate, if we don't have the file for the source currency
	if (!file_exists($currencyFile)) {
	$rates = include resource_path("exchangerates-$targetCurrency.php");
	if (!isset($rates[$sourceCurrency])) {
	throw new \Exception("Failed to find the reverse exchange rate for " . $sourceCurrency);
	}
	return 1.0 / floatval($rates[$sourceCurrency]);
	}

	$rates = include $currencyFile;
	if (!isset($rates[$targetCurrency])) {
	throw new \Exception("Failed to find exchange rate for " . $targetCurrency);
	}

	return floatval($rates[$targetCurrency]);
	}
	}
	diff --git a/src/config/app.php b/src/config/app.php
	index 95ee7939..a62ef771 100644
	--- a/src/config/app.php
	+++ b/src/config/app.php
	@@ -1,276 +1,278 @@
	<?php

	return [

	/*
	\|--------------------------------------------------------------------------
	\| Application Name
	\|--------------------------------------------------------------------------
	\|
	\| This value is the name of your application. This value is used when the
	\| framework needs to place the application's name in a notification or
	\| any other location as required by the application or its packages.
	\|
	*/

	'name' => env('APP_NAME', 'Laravel'),

	/*
	\|--------------------------------------------------------------------------
	\| Application Environment
	\|--------------------------------------------------------------------------
	\|
	\| This value determines the "environment" your application is currently
	\| running in. This may determine how you prefer to configure various
	\| services the application utilizes. Set this in your ".env" file.
	\|
	*/

	'env' => env('APP_ENV', 'production'),

	/*
	\|--------------------------------------------------------------------------
	\| Application Debug Mode
	\|--------------------------------------------------------------------------
	\|
	\| When your application is in debug mode, detailed error messages with
	\| stack traces will be shown on every error that occurs within your
	\| application. If disabled, a simple generic error page is shown.
	\|
	*/

	'debug' => env('APP_DEBUG', false),

	/*
	\|--------------------------------------------------------------------------
	\| Application URL
	\|--------------------------------------------------------------------------
	\|
	\| This URL is used by the console to properly generate URLs when using
	\| the Artisan command line tool. You should set this to the root of
	\| your application so that it is used when running Artisan tasks.
	*/

	'url' => env('APP_URL', 'http://localhost'),

	+ 'passphrase' => env('APP_PASSPHRASE', null),
	+
	'public_url' => env('APP_PUBLIC_URL', env('APP_URL', 'http://localhost')),

	'asset_url' => env('ASSET_URL', null),

	'support_url' => env('SUPPORT_URL', null),

	'support_email' => env('SUPPORT_EMAIL', null),

	'webmail_url' => env('WEBMAIL_URL', null),

	'theme' => env('APP_THEME', 'default'),

	'tenant_id' => env('APP_TENANT_ID', null),

	/*
	\|--------------------------------------------------------------------------
	\| Application Domain
	\|--------------------------------------------------------------------------
	\|
	\| System domain used for user signup (kolab identity)
	*/
	'domain' => env('APP_DOMAIN', 'domain.tld'),

	/*
	\|--------------------------------------------------------------------------
	\| Application Timezone
	\|--------------------------------------------------------------------------
	\|
	\| Here you may specify the default timezone for your application, which
	\| will be used by the PHP date and date-time functions. We have gone
	\| ahead and set this to a sensible default for you out of the box.
	\|
	*/

	'timezone' => 'UTC',

	/*
	\|--------------------------------------------------------------------------
	\| Application Locale Configuration
	\|--------------------------------------------------------------------------
	\|
	\| The application locale determines the default locale that will be used
	\| by the translation service provider. You are free to set this value
	\| to any of the locales which will be supported by the application.
	\|
	*/

	'locale' => env('APP_LOCALE', 'en'),

	/*
	\|--------------------------------------------------------------------------
	\| Application Fallback Locale
	\|--------------------------------------------------------------------------
	\|
	\| The fallback locale determines the locale to use when the current one
	\| is not available. You may change the value to correspond to any of
	\| the language folders that are provided through your application.
	\|
	*/

	'fallback_locale' => 'en',

	/*
	\|--------------------------------------------------------------------------
	\| Faker Locale
	\|--------------------------------------------------------------------------
	\|
	\| This locale will be used by the Faker PHP library when generating fake
	\| data for your database seeds. For example, this will be used to get
	\| localized telephone numbers, street address information and more.
	\|
	*/

	'faker_locale' => 'en_US',

	/*
	\|--------------------------------------------------------------------------
	\| Encryption Key
	\|--------------------------------------------------------------------------
	\|
	\| This key is used by the Illuminate encrypter service and should be set
	\| to a random, 32 character string, otherwise these encrypted strings
	\| will not be safe. Please do this before deploying an application!
	\|
	*/

	'key' => env('APP_KEY'),

	'cipher' => 'AES-256-CBC',

	/*
	\|--------------------------------------------------------------------------
	\| Autoloaded Service Providers
	\|--------------------------------------------------------------------------
	\|
	\| The service providers listed here will be automatically loaded on the
	\| request to your application. Feel free to add your own services to
	\| this array to grant expanded functionality to your applications.
	\|
	*/

	'providers' => [
	/*
	* Laravel Framework Service Providers...
	*/
	Illuminate\Auth\AuthServiceProvider::class,
	Illuminate\Broadcasting\BroadcastServiceProvider::class,
	Illuminate\Bus\BusServiceProvider::class,
	Illuminate\Cache\CacheServiceProvider::class,
	Illuminate\Foundation\Providers\ConsoleSupportServiceProvider::class,
	Illuminate\Cookie\CookieServiceProvider::class,
	Illuminate\Database\DatabaseServiceProvider::class,
	Illuminate\Encryption\EncryptionServiceProvider::class,
	Illuminate\Filesystem\FilesystemServiceProvider::class,
	Illuminate\Foundation\Providers\FoundationServiceProvider::class,
	Illuminate\Hashing\HashServiceProvider::class,
	Illuminate\Mail\MailServiceProvider::class,
	Illuminate\Notifications\NotificationServiceProvider::class,
	Illuminate\Pagination\PaginationServiceProvider::class,
	Illuminate\Pipeline\PipelineServiceProvider::class,
	Illuminate\Queue\QueueServiceProvider::class,
	Illuminate\Redis\RedisServiceProvider::class,
	Illuminate\Auth\Passwords\PasswordResetServiceProvider::class,
	Illuminate\Session\SessionServiceProvider::class,
	Illuminate\Translation\TranslationServiceProvider::class,
	Illuminate\Validation\ValidationServiceProvider::class,
	Illuminate\View\ViewServiceProvider::class,

	/*
	* Package Service Providers...
	*/
	Barryvdh\DomPDF\ServiceProvider::class,

	/*
	* Application Service Providers...
	*/
	App\Providers\AppServiceProvider::class,
	App\Providers\AuthServiceProvider::class,
	// App\Providers\BroadcastServiceProvider::class,
	App\Providers\EventServiceProvider::class,
	App\Providers\HorizonServiceProvider::class,
	App\Providers\RouteServiceProvider::class,
	],

	/*
	\|--------------------------------------------------------------------------
	\| Class Aliases
	\|--------------------------------------------------------------------------
	\|
	\| This array of class aliases will be registered when this application
	\| is started. However, feel free to register as many as you wish as
	\| the aliases are "lazy" loaded so they don't hinder performance.
	\|
	*/

	'aliases' => [
	'App' => Illuminate\Support\Facades\App::class,
	'Arr' => Illuminate\Support\Arr::class,
	'Artisan' => Illuminate\Support\Facades\Artisan::class,
	'Auth' => Illuminate\Support\Facades\Auth::class,
	'Blade' => Illuminate\Support\Facades\Blade::class,
	'Broadcast' => Illuminate\Support\Facades\Broadcast::class,
	'Bus' => Illuminate\Support\Facades\Bus::class,
	'Cache' => Illuminate\Support\Facades\Cache::class,
	'Config' => Illuminate\Support\Facades\Config::class,
	'Cookie' => Illuminate\Support\Facades\Cookie::class,
	'Crypt' => Illuminate\Support\Facades\Crypt::class,
	'DB' => Illuminate\Support\Facades\DB::class,
	'Eloquent' => Illuminate\Database\Eloquent\Model::class,
	'Event' => Illuminate\Support\Facades\Event::class,
	'File' => Illuminate\Support\Facades\File::class,
	'Gate' => Illuminate\Support\Facades\Gate::class,
	'Hash' => Illuminate\Support\Facades\Hash::class,
	'Lang' => Illuminate\Support\Facades\Lang::class,
	'Log' => Illuminate\Support\Facades\Log::class,
	'Mail' => Illuminate\Support\Facades\Mail::class,
	'Notification' => Illuminate\Support\Facades\Notification::class,
	'Password' => Illuminate\Support\Facades\Password::class,
	'PDF' => Barryvdh\DomPDF\Facade::class,
	'Queue' => Illuminate\Support\Facades\Queue::class,
	'Redirect' => Illuminate\Support\Facades\Redirect::class,
	'Redis' => Illuminate\Support\Facades\Redis::class,
	'Request' => Illuminate\Support\Facades\Request::class,
	'Response' => Illuminate\Support\Facades\Response::class,
	'Route' => Illuminate\Support\Facades\Route::class,
	'Schema' => Illuminate\Support\Facades\Schema::class,
	'Session' => Illuminate\Support\Facades\Session::class,
	'Storage' => Illuminate\Support\Facades\Storage::class,
	'Str' => Illuminate\Support\Str::class,
	'URL' => Illuminate\Support\Facades\URL::class,
	'Validator' => Illuminate\Support\Facades\Validator::class,
	'View' => Illuminate\Support\Facades\View::class,
	],

	// Locations of knowledge base articles
	'kb' => [
	// An article about suspended accounts
	'account_suspended' => env('KB_ACCOUNT_SUSPENDED'),
	// An article about a way to delete an owned account
	'account_delete' => env('KB_ACCOUNT_DELETE'),
	],

	'company' => [
	'name' => env('COMPANY_NAME'),
	'address' => env('COMPANY_ADDRESS'),
	'details' => env('COMPANY_DETAILS'),
	'email' => env('COMPANY_EMAIL'),
	'logo' => env('COMPANY_LOGO'),
	'footer' => env('COMPANY_FOOTER', env('COMPANY_DETAILS')),
	],

	'vat' => [
	'countries' => env('VAT_COUNTRIES'),
	'rate' => (float) env('VAT_RATE'),
	],

	'payment' => [
	'methods_oneoff' => env('PAYMENT_METHODS_ONEOFF', "creditcard,paypal,banktransfer"),
	'methods_recurring' => env('PAYMENT_METHODS_RECURRING', "creditcard"),
	],
	];
	diff --git a/src/database/migrations/2020_05_05_095212_create_tenants_table.php b/src/database/migrations/2020_05_05_095212_create_tenants_table.php
	index 8a1a463a..3f9a8217 100644
	--- a/src/database/migrations/2020_05_05_095212_create_tenants_table.php
	+++ b/src/database/migrations/2020_05_05_095212_create_tenants_table.php
	@@ -1,84 +1,83 @@
	<?php

	use Illuminate\Database\Migrations\Migration;
	use Illuminate\Database\Schema\Blueprint;
	use Illuminate\Support\Facades\Schema;

	// phpcs:ignore
	class CreateTenantsTable extends Migration
	{
	/**
	* Run the migrations.
	*
	* @return void
	*/
	public function up()
	{
	Schema::create(
	'tenants',
	function (Blueprint $table) {
	$table->bigIncrements('id');
	$table->string('title', 32);
	$table->timestamps();
	}
	);

	- \App\Tenant::create(['title' => 'Kolab Now']);
	+ $tenantId = \config('app.tenant_id');

	- foreach (['users', 'discounts', 'domains', 'plans', 'packages', 'skus'] as $table_name) {
	+ $tenant = \App\Tenant::create(['id' => $tenantId, 'title' => 'Kolab Now']);
	+
	+ foreach (['users', 'discounts', 'domains', 'plans', 'packages', 'skus'] as $tableName) {
	Schema::table(
	- $table_name,
	+ $tableName,
	function (Blueprint $table) {
	$table->bigInteger('tenant_id')->unsigned()->nullable();
	$table->foreign('tenant_id')->references('id')->on('tenants')->onDelete('set null');
	}
	);

	- if ($tenant_id = \config('app.tenant_id')) {
	- DB::statement("UPDATE `{$table_name}` SET `tenant_id` = {$tenant_id}");
	+ if ($tenantId) {
	+ DB::statement("UPDATE `{$tableName}` SET `tenant_id` = {$tenantId}");
	}
	}

	// Add fee column
	foreach (['entitlements', 'skus'] as $table) {
	Schema::table(
	$table,
	function (Blueprint $table) {
	$table->integer('fee')->nullable();
	}
	);
	}
	-
	- // FIXME: Should we also have package_skus.fee ?
	- // We have package_skus.cost, but I think it is not used anywhere.
	}

	/**
	* Reverse the migrations.
	*
	* @return void
	*/
	public function down()
	{
	- foreach (['users', 'discounts', 'domains', 'plans', 'packages', 'skus'] as $table_name) {
	+ foreach (['users', 'discounts', 'domains', 'plans', 'packages', 'skus'] as $tableName) {
	Schema::table(
	- $table_name,
	+ $tableName,
	function (Blueprint $table) {
	$table->dropForeign(['tenant_id']);
	$table->dropColumn('tenant_id');
	}
	);
	}

	foreach (['entitlements', 'skus'] as $table) {
	Schema::table(
	$table,
	function (Blueprint $table) {
	$table->dropColumn('fee');
	}
	);
	}

	Schema::dropIfExists('tenants');
	}
	}
	diff --git a/src/database/seeds/local/DiscountSeeder.php b/src/database/seeds/local/DiscountSeeder.php
	index 7862bdb5..1d22bdd5 100644
	--- a/src/database/seeds/local/DiscountSeeder.php
	+++ b/src/database/seeds/local/DiscountSeeder.php
	@@ -1,42 +1,58 @@
	<?php

	namespace Database\Seeds\Local;

	use App\Discount;
	use Illuminate\Database\Seeder;

	class DiscountSeeder extends Seeder
	{
	/**
	* Run the database seeds.
	*
	* @return void
	*/
	public function run()
	{
	Discount::create(
	[
	'description' => 'Free Account',
	'discount' => 100,
	'active' => true,
	]
	);

	Discount::create(
	[
	'description' => 'Student or Educational Institution',
	'discount' => 30,
	'active' => true,
	]
	);

	Discount::create(
	[
	'description' => 'Test voucher',
	'discount' => 10,
	'active' => true,
	'code' => 'TEST',
	]
	);
	+
	+ // We're running in reseller mode, add a sample discount
	+ $tenants = \App\Tenant::where('id', '!=', \config('app.tenant_id'))->get();
	+
	+ foreach ($tenants as $tenant) {
	+ $discount = Discount::create(
	+ [
	+ 'description' => "Sample Discount by Reseller '{$tenant->title}'",
	+ 'discount' => 10,
	+ 'active' => true,
	+ ]
	+ );
	+
	+ $discount->tenant_id = $tenant->id;
	+ $discount->save();
	+ }
	}
	}
	diff --git a/src/database/seeds/local/DomainSeeder.php b/src/database/seeds/local/DomainSeeder.php
	index 3b2bf128..e85e230a 100644
	--- a/src/database/seeds/local/DomainSeeder.php
	+++ b/src/database/seeds/local/DomainSeeder.php
	@@ -1,81 +1,85 @@
	<?php

	namespace Database\Seeds\Local;

	use App\Domain;
	use Illuminate\Database\Seeder;

	class DomainSeeder extends Seeder
	{
	/**
	* Run the database seeds.
	*
	* @return void
	*/
	public function run()
	{
	$domains = [
	"kolabnow.com",
	"mykolab.com",
	"attorneymail.ch",
	"barmail.ch",
	"collaborative.li",
	"diplomail.ch",
	"freedommail.ch",
	"groupoffice.ch",
	"journalistmail.ch",
	"legalprivilege.ch",
	"libertymail.co"
	];

	foreach ($domains as $domain) {
	Domain::create(
	[
	'namespace' => $domain,
	'status' => Domain::STATUS_CONFIRMED + Domain::STATUS_ACTIVE,
	- 'type' => Domain::TYPE_PUBLIC
	+ 'type' => Domain::TYPE_PUBLIC,
	]
	);
	}

	if (!in_array(\config('app.domain'), $domains)) {
	Domain::create(
	[
	'namespace' => \config('app.domain'),
	'status' => DOMAIN::STATUS_CONFIRMED + Domain::STATUS_ACTIVE,
	- 'type' => Domain::TYPE_PUBLIC
	+ 'type' => Domain::TYPE_PUBLIC,
	]
	);
	}

	$domains = [
	'example.com',
	'example.net',
	'example.org'
	];

	foreach ($domains as $domain) {
	Domain::create(
	[
	'namespace' => $domain,
	'status' => Domain::STATUS_CONFIRMED + Domain::STATUS_ACTIVE,
	- 'type' => Domain::TYPE_EXTERNAL
	+ 'type' => Domain::TYPE_EXTERNAL,
	]
	);
	}

	- // example tenant domain, note that 'tenant_id' is not a fillable.
	- $domain = Domain::create(
	- [
	- 'namespace' => 'example-tenant.dev-local',
	- 'status' => Domain::STATUS_CONFIRMED + Domain::STATUS_ACTIVE,
	- 'type' => Domain::TYPE_PUBLIC
	- ]
	- );
	+ // We're running in reseller mode, add a sample discount
	+ $tenants = \App\Tenant::where('id', '!=', \config('app.tenant_id'))->get();

	- $tenant = \App\Tenant::where('title', 'Sample Tenant')->first();
	+ foreach ($tenants as $tenant) {
	+ $domainNamespace = strtolower(str_replace(' ', '-', $tenant->title)) . '.dev-local';

	- $domain->tenant_id = $tenant->id;
	- $domain->save();
	+ $domain = Domain::create(
	+ [
	+ 'namespace' => $domainNamespace,
	+ 'status' => Domain::STATUS_CONFIRMED + Domain::STATUS_ACTIVE,
	+ 'type' => Domain::TYPE_PUBLIC,
	+ ]
	+ );
	+
	+ $domain->tenant_id = $tenant->id;
	+ $domain->save();
	+ }
	}
	}
	diff --git a/src/database/seeds/local/PackageSeeder.php b/src/database/seeds/local/PackageSeeder.php
	index a5bb1b4a..78ecdf9c 100644
	--- a/src/database/seeds/local/PackageSeeder.php
	+++ b/src/database/seeds/local/PackageSeeder.php
	@@ -1,84 +1,166 @@
	<?php

	namespace Database\Seeds\Local;

	use App\Package;
	use App\Sku;
	use Illuminate\Database\Seeder;

	class PackageSeeder extends Seeder
	{
	/**
	* Run the database seeds.
	*
	* @return void
	*/
	public function run()
	{
	- $skuGroupware = Sku::firstOrCreate(['title' => 'groupware']);
	- $skuMailbox = Sku::firstOrCreate(['title' => 'mailbox']);
	- $skuStorage = Sku::firstOrCreate(['title' => 'storage']);
	+ $skuDomain = Sku::where(['title' => 'domain-hosting', 'tenant_id' => \config('app.tenant_id')])->first();
	+ $skuGroupware = Sku::where(['title' => 'groupware', 'tenant_id' => \config('app.tenant_id')])->first();
	+ $skuMailbox = Sku::where(['title' => 'mailbox', 'tenant_id' => \config('app.tenant_id')])->first();
	+ $skuStorage = Sku::where(['title' => 'storage', 'tenant_id' => \config('app.tenant_id')])->first();

	$package = Package::create(
	[
	'title' => 'kolab',
	'name' => 'Groupware Account',
	'description' => 'A fully functional groupware account.',
	- 'discount_rate' => 0
	+ 'discount_rate' => 0,
	]
	);

	$skus = [
	$skuMailbox,
	$skuGroupware,
	$skuStorage
	];

	$package->skus()->saveMany($skus);

	// This package contains 2 units of the storage SKU, which just so happens to also
	// be the number of SKU free units.
	$package->skus()->updateExistingPivot(
	$skuStorage,
	- ['qty' => 2],
	+ ['qty' => 5],
	false
	);

	$package = Package::create(
	[
	'title' => 'lite',
	'name' => 'Lite Account',
	'description' => 'Just mail and no more.',
	- 'discount_rate' => 0
	+ 'discount_rate' => 0,
	]
	);

	$skus = [
	$skuMailbox,
	$skuStorage
	];

	$package->skus()->saveMany($skus);

	$package->skus()->updateExistingPivot(
	- Sku::firstOrCreate(['title' => 'storage']),
	- ['qty' => 2],
	+ $skuStorage,
	+ ['qty' => 5],
	false
	);

	$package = Package::create(
	[
	'title' => 'domain-hosting',
	'name' => 'Domain Hosting',
	'description' => 'Use your own, existing domain.',
	- 'discount_rate' => 0
	+ 'discount_rate' => 0,
	]
	);

	$skus = [
	- Sku::firstOrCreate(['title' => 'domain-hosting'])
	+ $skuDomain
	];

	$package->skus()->saveMany($skus);
	+
	+ // We're running in reseller mode, add a sample discount
	+ $tenants = \App\Tenant::where('id', '!=', \config('app.tenant_id'))->get();
	+
	+ foreach ($tenants as $tenant) {
	+ $skuDomain = Sku::where(['title' => 'domain-hosting', 'tenant_id' => $tenant->id])->first();
	+ $skuGroupware = Sku::where(['title' => 'groupware', 'tenant_id' => $tenant->id])->first();
	+ $skuMailbox = Sku::where(['title' => 'mailbox', 'tenant_id' => $tenant->id])->first();
	+ $skuStorage = Sku::where(['title' => 'storage', 'tenant_id' => $tenant->id])->first();
	+
	+ $package = Package::create(
	+ [
	+ 'title' => 'kolab',
	+ 'name' => 'Groupware Account',
	+ 'description' => 'A fully functional groupware account.',
	+ 'discount_rate' => 0
	+ ]
	+ );
	+
	+ $package->tenant_id = $tenant->id;
	+ $package->save();
	+
	+ $skus = [
	+ $skuMailbox,
	+ $skuGroupware,
	+ $skuStorage
	+ ];
	+
	+ $package->skus()->saveMany($skus);
	+
	+ // This package contains 2 units of the storage SKU, which just so happens to also
	+ // be the number of SKU free units.
	+ $package->skus()->updateExistingPivot(
	+ $skuStorage,
	+ ['qty' => 5],
	+ false
	+ );
	+
	+ $package = Package::create(
	+ [
	+ 'title' => 'lite',
	+ 'name' => 'Lite Account',
	+ 'description' => 'Just mail and no more.',
	+ 'discount_rate' => 0
	+ ]
	+ );
	+
	+ $package->tenant_id = $tenant->id;
	+ $package->save();
	+
	+ $skus = [
	+ $skuMailbox,
	+ $skuStorage
	+ ];
	+
	+ $package->skus()->saveMany($skus);
	+
	+ $package->skus()->updateExistingPivot(
	+ $skuStorage,
	+ ['qty' => 5],
	+ false
	+ );
	+
	+ $package = Package::create(
	+ [
	+ 'title' => 'domain-hosting',
	+ 'name' => 'Domain Hosting',
	+ 'description' => 'Use your own, existing domain.',
	+ 'discount_rate' => 0
	+ ]
	+ );
	+
	+ $package->tenant_id = $tenant->id;
	+ $package->save();
	+
	+ $skus = [
	+ $skuDomain
	+ ];
	+
	+ $package->skus()->saveMany($skus);
	+ }
	}
	}
	diff --git a/src/database/seeds/local/PlanSeeder.php b/src/database/seeds/local/PlanSeeder.php
	index a696e6b2..81db47ba 100644
	--- a/src/database/seeds/local/PlanSeeder.php
	+++ b/src/database/seeds/local/PlanSeeder.php
	@@ -1,169 +1,141 @@
	<?php

	namespace Database\Seeds\Local;

	use App\Package;
	use App\Plan;
	use Illuminate\Database\Seeder;

	class PlanSeeder extends Seeder
	{
	/**
	* Run the database seeds.
	*
	* @return void
	*/
	public function run()
	{
	- /*
	- $plan = Plan::create(
	- [
	- 'title' => 'family',
	- 'description' => 'A group of accounts for 2 or more users.',
	- 'discount_qty' => 0,
	- 'discount_rate' => 0
	- ]
	- );
	-
	- $packages = [
	- Package::firstOrCreate(['title' => 'kolab']),
	- Package::firstOrCreate(['title' => 'domain-hosting'])
	- ];
	-
	- $plan->packages()->saveMany($packages);
	-
	- $plan->packages()->updateExistingPivot(
	- Package::firstOrCreate(['title' => 'kolab']),
	- [
	- 'qty_min' => 2,
	- 'qty_max' => -1,
	- 'discount_qty' => 2,
	- 'discount_rate' => 50
	- ],
	- false
	- );
	-
	- $plan = Plan::create(
	- [
	- 'title' => 'small-business',
	- 'description' => 'Accounts for small business owners.',
	- 'discount_qty' => 0,
	- 'discount_rate' => 10
	- ]
	- );
	-
	- $packages = [
	- Package::firstOrCreate(['title' => 'kolab']),
	- Package::firstOrCreate(['title' => 'domain-hosting'])
	- ];
	-
	- $plan->packages()->saveMany($packages);
	-
	- $plan->packages()->updateExistingPivot(
	- Package::firstOrCreate(['title' => 'kolab']),
	- [
	- 'qty_min' => 5,
	- 'qty_max' => 25,
	- 'discount_qty' => 5,
	- 'discount_rate' => 30
	- ],
	- false
	- );
	-
	- $plan = Plan::create(
	- [
	- 'title' => 'large-business',
	- 'description' => 'Accounts for large businesses.',
	- 'discount_qty' => 0,
	- 'discount_rate' => 10
	- ]
	- );
	-
	- $packages = [
	- Package::firstOrCreate(['title' => 'kolab']),
	- Package::firstOrCreate(['title' => 'lite']),
	- Package::firstOrCreate(['title' => 'domain-hosting'])
	- ];
	-
	- $plan->packages()->saveMany($packages);
	-
	- $plan->packages()->updateExistingPivot(
	- Package::firstOrCreate(['title' => 'kolab']),
	- [
	- 'qty_min' => 20,
	- 'qty_max' => -1,
	- 'discount_qty' => 10,
	- 'discount_rate' => 10
	- ],
	- false
	- );
	-
	- $plan->packages()->updateExistingPivot(
	- Package::firstOrCreate(['title' => 'lite']),
	- [
	- 'qty_min' => 0,
	- 'qty_max' => -1,
	- 'discount_qty' => 10,
	- 'discount_rate' => 10
	- ],
	- false
	- );
	- */
	-
	$description = <<<'EOD'
	<p>Everything you need to get started or try Kolab Now, including:</p>
	<ul>
	<li>Perfect for anyone wanting to move to Kolab Now</li>
	<li>Suite of online apps: Secure email, calendar, address book, files and more</li>
	<li>Access for anywhere: Sync all your devices to your Kolab Now account</li>
	<li>Secure hosting: Managed right here on our own servers in Switzerland </li>
	<li>Start protecting your data today, no ads, no crawling, no compromise</li>
	<li>An ideal replacement for services like Gmail, Office 365, etc…</li>
	</ul>
	EOD;

	$plan = Plan::create(
	[
	'title' => 'individual',
	'name' => 'Individual Account',
	'description' => $description,
	'discount_qty' => 0,
	'discount_rate' => 0
	]
	);

	$packages = [
	- Package::firstOrCreate(['title' => 'kolab'])
	+ Package::where(['title' => 'kolab', 'tenant_id' => \config('app.tenant_id')])->first()
	];

	$plan->packages()->saveMany($packages);

	$description = <<<'EOD'
	<p>All the features of the Individual Account, with the following extras:</p>
	<ul>
	<li>Perfect for anyone wanting to move a group or small business to Kolab Now</li>
	<li>Recommended to support users from 1 to 100</li>
	<li>Use your own personal domains with Kolab Now</li>
	<li>Manage and add users through our online admin area</li>
	<li>Flexible pricing based on user count</li>
	</ul>
	EOD;

	$plan = Plan::create(
	[
	'title' => 'group',
	'name' => 'Group Account',
	'description' => $description,
	'discount_qty' => 0,
	'discount_rate' => 0
	]
	);

	$packages = [
	- Package::firstOrCreate(['title' => 'domain-hosting']),
	- Package::firstOrCreate(['title' => 'kolab']),
	+ Package::where(['title' => 'domain-hosting', 'tenant_id' => \config('app.tenant_id')])->first(),
	+ Package::where(['title' => 'kolab', 'tenant_id' => \config('app.tenant_id')])->first()
	];

	$plan->packages()->saveMany($packages);
	+
	+ // We're running in reseller mode, add a sample discount
	+ $tenants = \App\Tenant::where('id', '!=', \config('app.tenant_id'))->get();
	+
	+ foreach ($tenants as $tenant) {
	+ $description = <<<'EOD'
	+<p>Everything you need to get started or try Kolab Now, including:</p>
	+<ul>
	+ <li>Perfect for anyone wanting to move to Kolab Now</li>
	+ <li>Suite of online apps: Secure email, calendar, address book, files and more</li>
	+ <li>Access for anywhere: Sync all your devices to your Kolab Now account</li>
	+ <li>Secure hosting: Managed right here on our own servers in Switzerland </li>
	+ <li>Start protecting your data today, no ads, no crawling, no compromise</li>
	+ <li>An ideal replacement for services like Gmail, Office 365, etc…</li>
	+</ul>
	+EOD;
	+
	+ $plan = Plan::create(
	+ [
	+ 'title' => 'individual',
	+ 'name' => 'Individual Account',
	+ 'description' => $description,
	+ 'discount_qty' => 0,
	+ 'discount_rate' => 0
	+ ]
	+ );
	+
	+ $plan->tenant_id = $tenant->id;
	+ $plan->save();
	+
	+ $packages = [
	+ Package::where(['title' => 'kolab', 'tenant_id' => $tenant->id])->first()
	+ ];
	+
	+ $plan->packages()->saveMany($packages);
	+
	+ $description = <<<'EOD'
	+<p>All the features of the Individual Account, with the following extras:</p>
	+<ul>
	+ <li>Perfect for anyone wanting to move a group or small business to Kolab Now</li>
	+ <li>Recommended to support users from 1 to 100</li>
	+ <li>Use your own personal domains with Kolab Now</li>
	+ <li>Manage and add users through our online admin area</li>
	+ <li>Flexible pricing based on user count</li>
	+</ul>
	+EOD;
	+
	+ $plan = Plan::create(
	+ [
	+ 'title' => 'group',
	+ 'name' => 'Group Account',
	+ 'description' => $description,
	+ 'discount_qty' => 0,
	+ 'discount_rate' => 0
	+ ]
	+ );
	+
	+ $plan->tenant_id = $tenant->id;
	+ $plan->save();
	+
	+ $packages = [
	+ Package::where(['title' => 'domain-hosting', 'tenant_id' => $tenant->id])->first(),
	+ Package::where(['title' => 'kolab', 'tenant_id' => $tenant->id])->first()
	+ ];
	+
	+ $plan->packages()->saveMany($packages);
	+ }
	}
	}
	diff --git a/src/database/seeds/local/SkuSeeder.php b/src/database/seeds/local/SkuSeeder.php
	index ce890425..cc4b26ca 100644
	--- a/src/database/seeds/local/SkuSeeder.php
	+++ b/src/database/seeds/local/SkuSeeder.php
	@@ -1,217 +1,332 @@
	<?php

	namespace Database\Seeds\Local;

	use App\Sku;
	use Illuminate\Database\Seeder;

	class SkuSeeder extends Seeder
	{
	/**
	* Run the database seeds.
	*
	* @return void
	*/
	public function run()
	{
	Sku::create(
	[
	'title' => 'mailbox',
	'name' => 'User Mailbox',
	'description' => 'Just a mailbox',
	- 'cost' => 444,
	+ 'cost' => 500,
	'units_free' => 0,
	'period' => 'monthly',
	'handler_class' => 'App\Handlers\Mailbox',
	'active' => true,
	]
	);

	Sku::create(
	[
	'title' => 'domain',
	'name' => 'Hosted Domain',
	'description' => 'Somewhere to place a mailbox',
	'cost' => 100,
	'period' => 'monthly',
	'handler_class' => 'App\Handlers\Domain',
	'active' => false,
	]
	);

	Sku::create(
	[
	'title' => 'domain-registration',
	'name' => 'Domain Registration',
	'description' => 'Register a domain with us',
	'cost' => 101,
	'period' => 'yearly',
	'handler_class' => 'App\Handlers\DomainRegistration',
	'active' => false,
	]
	);

	Sku::create(
	[
	'title' => 'domain-hosting',
	'name' => 'External Domain',
	'description' => 'Host a domain that is externally registered',
	'cost' => 100,
	'units_free' => 1,
	'period' => 'monthly',
	'handler_class' => 'App\Handlers\DomainHosting',
	'active' => true,
	]
	);

	Sku::create(
	[
	'title' => 'domain-relay',
	'name' => 'Domain Relay',
	'description' => 'A domain you host at home, for which we relay email',
	'cost' => 103,
	'period' => 'monthly',
	'handler_class' => 'App\Handlers\DomainRelay',
	'active' => false,
	]
	);

	Sku::create(
	[
	'title' => 'storage',
	'name' => 'Storage Quota',
	'description' => 'Some wiggle room',
	'cost' => 25,
	- 'units_free' => 2,
	+ 'units_free' => 5,
	'period' => 'monthly',
	'handler_class' => 'App\Handlers\Storage',
	'active' => true,
	]
	);

	Sku::create(
	[
	'title' => 'groupware',
	'name' => 'Groupware Features',
	'description' => 'Groupware functions like Calendar, Tasks, Notes, etc.',
	- 'cost' => 555,
	+ 'cost' => 490,
	'units_free' => 0,
	'period' => 'monthly',
	'handler_class' => 'App\Handlers\Groupware',
	'active' => true,
	]
	);

	Sku::create(
	[
	'title' => 'resource',
	'name' => 'Resource',
	'description' => 'Reservation taker',
	'cost' => 101,
	'period' => 'monthly',
	'handler_class' => 'App\Handlers\Resource',
	'active' => false,
	]
	);

	Sku::create(
	[
	'title' => 'shared_folder',
	'name' => 'Shared Folder',
	'description' => 'A shared folder',
	'cost' => 89,
	'period' => 'monthly',
	'handler_class' => 'App\Handlers\SharedFolder',
	'active' => false,
	]
	);

	Sku::create(
	[
	'title' => '2fa',
	'name' => '2-Factor Authentication',
	'description' => 'Two factor authentication for webmail and administration panel',
	'cost' => 0,
	'units_free' => 0,
	'period' => 'monthly',
	'handler_class' => 'App\Handlers\Auth2F',
	'active' => true,
	]
	);

	Sku::create(
	[
	'title' => 'activesync',
	'name' => 'Activesync',
	'description' => 'Mobile synchronization',
	- 'cost' => 100,
	+ 'cost' => 0,
	'units_free' => 0,
	'period' => 'monthly',
	'handler_class' => 'App\Handlers\Activesync',
	'active' => true,
	]
	);

	// Check existence because migration might have added this already
	- if (!\App\Sku::where('title', 'beta')->first()) {
	+ $sku = \App\Sku::where(['title' => 'beta', 'tenant_id' => \config('app.tenant_id')])->first();
	+
	+ if (!$sku) {
	Sku::create(
	[
	'title' => 'beta',
	'name' => 'Private Beta (invitation only)',
	'description' => 'Access to the private beta program subscriptions',
	'cost' => 0,
	'units_free' => 0,
	'period' => 'monthly',
	'handler_class' => 'App\Handlers\Beta',
	'active' => false,
	]
	);
	}

	// Check existence because migration might have added this already
	- if (!\App\Sku::where('title', 'meet')->first()) {
	+ $sku = \App\Sku::where(['title' => 'meet', 'tenant_id' => \config('app.tenant_id')])->first();
	+
	+ if (!$sku) {
	Sku::create(
	[
	'title' => 'meet',
	'name' => 'Voice & Video Conferencing (public beta)',
	'description' => 'Video conferencing tool',
	'cost' => 0,
	'units_free' => 0,
	'period' => 'monthly',
	'handler_class' => 'App\Handlers\Meet',
	'active' => true,
	]
	);
	}

	// Check existence because migration might have added this already
	- if (!\App\Sku::where('title', 'group')->first()) {
	+ $sku = \App\Sku::where(['title' => 'group', 'tenant_id' => \config('app.tenant_id')])->first();
	+
	+ if (!$sku) {
	Sku::create(
	[
	'title' => 'group',
	'name' => 'Group',
	'description' => 'Distribution list',
	'cost' => 0,
	'units_free' => 0,
	'period' => 'monthly',
	'handler_class' => 'App\Handlers\Group',
	'active' => true,
	]
	);
	}

	// Check existence because migration might have added this already
	- if (!\App\Sku::where('title', 'distlist')->first()) {
	- \App\Sku::create([
	- 'title' => 'distlist',
	- 'name' => 'Distribution lists',
	- 'description' => 'Access to mail distribution lists',
	- 'cost' => 0,
	- 'units_free' => 0,
	- 'period' => 'monthly',
	- 'handler_class' => 'App\Handlers\Distlist',
	- 'active' => true,
	- ]);
	+ $sku = \App\Sku::where(['title' => 'distlist', 'tenant_id' => \config('app.tenant_id')])->first();
	+
	+ if (!$sku) {
	+ \App\Sku::create(
	+ [
	+ 'title' => 'distlist',
	+ 'name' => 'Distribution lists',
	+ 'description' => 'Access to mail distribution lists',
	+ 'cost' => 0,
	+ 'units_free' => 0,
	+ 'period' => 'monthly',
	+ 'handler_class' => 'App\Handlers\Distlist',
	+ 'active' => true,
	+ ]
	+ );
	+ }
	+
	+ // for tenants that are not the configured tenant id
	+ $tenants = \App\Tenant::where('id', '!=', \config('app.tenant_id'))->get();
	+
	+ foreach ($tenants as $tenant) {
	+ $sku = Sku::create(
	+ [
	+ 'title' => 'mailbox',
	+ 'name' => 'User Mailbox',
	+ 'description' => 'Just a mailbox',
	+ 'cost' => 500,
	+ 'fee' => 333,
	+ 'units_free' => 0,
	+ 'period' => 'monthly',
	+ 'handler_class' => 'App\Handlers\Mailbox',
	+ 'active' => true,
	+ ]
	+ );
	+
	+ $sku->tenant_id = $tenant->id;
	+ $sku->save();
	+
	+ $sku = Sku::create(
	+ [
	+ 'title' => 'storage',
	+ 'name' => 'Storage Quota',
	+ 'description' => 'Some wiggle room',
	+ 'cost' => 25,
	+ 'fee' => 16,
	+ 'units_free' => 5,
	+ 'period' => 'monthly',
	+ 'handler_class' => 'App\Handlers\Storage',
	+ 'active' => true,
	+ ]
	+ );
	+
	+ $sku->tenant_id = $tenant->id;
	+ $sku->save();
	+
	+ $sku = Sku::create(
	+ [
	+ 'title' => 'domain-hosting',
	+ 'name' => 'External Domain',
	+ 'description' => 'Host a domain that is externally registered',
	+ 'cost' => 100,
	+ 'fee' => 66,
	+ 'units_free' => 1,
	+ 'period' => 'monthly',
	+ 'handler_class' => 'App\Handlers\DomainHosting',
	+ 'active' => true,
	+ ]
	+ );
	+
	+ $sku->tenant_id = $tenant->id;
	+ $sku->save();
	+
	+ $sku = Sku::create(
	+ [
	+ 'title' => 'groupware',
	+ 'name' => 'Groupware Features',
	+ 'description' => 'Groupware functions like Calendar, Tasks, Notes, etc.',
	+ 'cost' => 490,
	+ 'fee' => 327,
	+ 'units_free' => 0,
	+ 'period' => 'monthly',
	+ 'handler_class' => 'App\Handlers\Groupware',
	+ 'active' => true,
	+ ]
	+ );
	+
	+ $sku->tenant_id = $tenant->id;
	+ $sku->save();
	+
	+ $sku = Sku::create(
	+ [
	+ 'title' => '2fa',
	+ 'name' => '2-Factor Authentication',
	+ 'description' => 'Two factor authentication for webmail and administration panel',
	+ 'cost' => 0,
	+ 'units_free' => 0,
	+ 'period' => 'monthly',
	+ 'handler_class' => 'App\Handlers\Auth2F',
	+ 'active' => true,
	+ ]
	+ );
	+
	+ $sku->tenant_id = $tenant->id;
	+ $sku->save();
	+
	+ $sku = Sku::create(
	+ [
	+ 'title' => 'activesync',
	+ 'name' => 'Activesync',
	+ 'description' => 'Mobile synchronization',
	+ 'cost' => 0,
	+ 'units_free' => 0,
	+ 'period' => 'monthly',
	+ 'handler_class' => 'App\Handlers\Activesync',
	+ 'active' => true,
	+ ]
	+ );
	+
	+ $sku->tenant_id = $tenant->id;
	+ $sku->save();
	}
	}
	}
	diff --git a/src/database/seeds/local/TenantSeeder.php b/src/database/seeds/local/TenantSeeder.php
	index 1f6c10c5..0c8c18f4 100644
	--- a/src/database/seeds/local/TenantSeeder.php
	+++ b/src/database/seeds/local/TenantSeeder.php
	@@ -1,29 +1,37 @@
	<?php

	namespace Database\Seeds\Local;

	use App\Tenant;
	use Illuminate\Database\Seeder;

	class TenantSeeder extends Seeder
	{
	/**
	* Run the database seeds.
	*
	* @return void
	*/
	public function run()
	{
	- if (!Tenant::find(1)) {
	- Tenant::create([
	- 'title' => 'Kolab Now'
	- ]);
	- }
	+ if (\config('app.tenant_id')) {
	+ $tenant = Tenant::where(['title' => 'Kolab Now'])->first();
	+
	+ if (!$tenant) {
	+ Tenant::create(['title' => 'Kolab Now']);
	+ }
	+
	+ $tenant = Tenant::where(['title' => 'Sample Tenant'])->first();
	+
	+ if (!$tenant) {
	+ $tenant = Tenant::create(['title' => 'Sample Tenant']);
	+ }
	+
	+ $tenant = Tenant::where(['title' => 'kanarip.ch'])->first();

	- if (!Tenant::find(2)) {
	- Tenant::create([
	- 'title' => 'Sample Tenant'
	- ]);
	+ if (!$tenant) {
	+ $tenant = Tenant::create(['title' => 'kanarip.ch']);
	+ }
	}
	}
	}
	diff --git a/src/database/seeds/local/UserSeeder.php b/src/database/seeds/local/UserSeeder.php
	index 44fa220d..44583ba2 100644
	--- a/src/database/seeds/local/UserSeeder.php
	+++ b/src/database/seeds/local/UserSeeder.php
	@@ -1,174 +1,204 @@
	<?php

	namespace Database\Seeds\Local;

	use App\Auth\SecondFactor;
	use App\Domain;
	use App\Entitlement;
	use App\User;
	use App\Sku;
	use Carbon\Carbon;
	use Illuminate\Database\Seeder;
	use App\Wallet;

	class UserSeeder extends Seeder
	{
	/**
	* Run the database seeds.
	*
	* @return void
	*/
	public function run()
	{
	$domain = Domain::create(
	[
	'namespace' => 'kolab.org',
	'status' => Domain::STATUS_NEW
	+ Domain::STATUS_ACTIVE
	+ Domain::STATUS_CONFIRMED
	+ Domain::STATUS_VERIFIED,
	'type' => Domain::TYPE_EXTERNAL
	]
	);

	$john = User::create(
	[
	'email' => 'john@kolab.org',
	- 'password' => 'simple123',
	+ 'password' => \App\Utils::generatePassphrase()
	]
	);

	$john->setSettings(
	[
	'first_name' => 'John',
	'last_name' => 'Doe',
	'currency' => 'USD',
	'country' => 'US',
	'billing_address' => "601 13th Street NW\nSuite 900 South\nWashington, DC 20005",
	'external_email' => 'john.doe.external@gmail.com',
	'organization' => 'Kolab Developers',
	'phone' => '+1 509-248-1111',
	]
	);

	$john->setAliases(['john.doe@kolab.org']);

	$wallet = $john->wallets->first();

	- $package_domain = \App\Package::where('title', 'domain-hosting')->first();
	- $package_kolab = \App\Package::where('title', 'kolab')->first();
	- $package_lite = \App\Package::where('title', 'lite')->first();
	+ $packageDomain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
	+ $packageKolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
	+ $packageLite = \App\Package::withEnvTenantContext()->where('title', 'lite')->first();

	- $domain->assignPackage($package_domain, $john);
	- $john->assignPackage($package_kolab);
	+ $domain->assignPackage($packageDomain, $john);
	+ $john->assignPackage($packageKolab);

	$jack = User::create(
	[
	'email' => 'jack@kolab.org',
	- 'password' => 'simple123',
	+ 'password' => \App\Utils::generatePassphrase()
	]
	);

	$jack->setSettings(
	[
	'first_name' => 'Jack',
	'last_name' => 'Daniels',
	'currency' => 'USD',
	'country' => 'US'
	]
	);

	$jack->setAliases(['jack.daniels@kolab.org']);

	- $john->assignPackage($package_kolab, $jack);
	+ $john->assignPackage($packageKolab, $jack);

	foreach ($john->entitlements as $entitlement) {
	$entitlement->created_at = Carbon::now()->subMonthsWithoutOverflow(1);
	$entitlement->updated_at = Carbon::now()->subMonthsWithoutOverflow(1);
	$entitlement->save();
	}

	$ned = User::create(
	[
	'email' => 'ned@kolab.org',
	- 'password' => 'simple123',
	+ 'password' => \App\Utils::generatePassphrase()
	]
	);

	$ned->setSettings(
	[
	'first_name' => 'Edward',
	'last_name' => 'Flanders',
	'currency' => 'USD',
	'country' => 'US'
	]
	);

	- $john->assignPackage($package_kolab, $ned);
	+ $john->assignPackage($packageKolab, $ned);

	- $ned->assignSku(\App\Sku::where('title', 'activesync')->first(), 1);
	+ $ned->assignSku(\App\Sku::withEnvTenantContext()->where('title', 'activesync')->first(), 1);

	// Ned is a controller on Jack's wallet
	$john->wallets()->first()->addController($ned);

	// Ned is also our 2FA test user
	- $sku2fa = Sku::firstOrCreate(['title' => '2fa']);
	+ $sku2fa = Sku::withEnvTenantContext()->where('title', '2fa')->first();
	+
	$ned->assignSku($sku2fa);
	+
	try {
	SecondFactor::seed('ned@kolab.org');
	} catch (\Exception $e) {
	// meh
	}

	$joe = User::create(
	[
	'email' => 'joe@kolab.org',
	- 'password' => 'simple123',
	+ 'password' => \App\Utils::generatePassphrase()
	]
	);

	- $john->assignPackage($package_lite, $joe);
	+ $john->assignPackage($packageLite, $joe);

	//$john->assignSku(Sku::firstOrCreate(['title' => 'beta']));
	//$john->assignSku(Sku::firstOrCreate(['title' => 'meet']));

	$joe->setAliases(['joe.monster@kolab.org']);

	// factory(User::class, 10)->create();

	$jeroen = User::create(
	[
	'email' => 'jeroen@jeroen.jeroen',
	- 'password' => 'jeroen',
	+ 'password' => \App\Utils::generatePassphrase()
	]
	);

	$jeroen->role = 'admin';
	$jeroen->save();

	- $tenant1 = \App\Tenant::where('title', 'Kolab Now')->first();
	- $tenant2 = \App\Tenant::where('title', 'Sample Tenant')->first();
	-
	- $reseller1 = User::create(
	+ $reseller = User::create(
	[
	- 'email' => 'reseller@kolabnow.com',
	- 'password' => 'reseller',
	+ 'email' => 'reseller@' . \config('app.domain'),
	+ 'password' => \App\Utils::generatePassphrase()
	]
	);

	- $reseller1->tenant_id = $tenant1->id;
	- $reseller1->role = 'reseller';
	- $reseller1->save();
	+ $reseller->role = 'reseller';
	+ $reseller->save();

	- $reseller2 = User::create(
	- [
	- 'email' => 'reseller@reseller.com',
	- 'password' => 'reseller',
	- ]
	- );
	+ $reseller->assignPackage($packageKolab);
	+
	+ // for tenants that are not the configured tenant id
	+ $tenants = \App\Tenant::where('id', '!=', \config('app.tenant_id'))->get();
	+
	+ foreach ($tenants as $tenant) {
	+ $domain = Domain::where('tenant_id', $tenant->id)->first();

	- $reseller2->tenant_id = $tenant2->id;
	- $reseller2->role = 'reseller';
	- $reseller2->save();
	+ $packageKolab = \App\Package::where(
	+ [
	+ 'title' => 'kolab',
	+ 'tenant_id' => $tenant->id
	+ ]
	+ )->first();
	+
	+ if ($domain) {
	+ $reseller = User::create(
	+ [
	+ 'email' => 'reseller@' . $domain->namespace,
	+ 'password' => \App\Utils::generatePassphrase()
	+ ]
	+ );
	+
	+ $reseller->role = 'reseller';
	+ $reseller->tenant_id = $tenant->id;
	+ $reseller->save();
	+
	+ $reseller->assignPackage($packageKolab);
	+
	+ $user = User::create(
	+ [
	+ 'email' => 'user@' . $domain->namespace,
	+ 'password' => \App\Utils::generatePassphrase()
	+ ]
	+ );
	+
	+ $user->tenant_id = $tenant->id;
	+ $user->save();
	+
	+ $user->assignPackage($packageKolab);
	+ }
	+ }
	}
	}
	diff --git a/src/phpstan.neon b/src/phpstan.neon
	index 97d6cf14..4cb7f813 100644
	--- a/src/phpstan.neon
	+++ b/src/phpstan.neon
	@@ -1,15 +1,16 @@
	includes:
	- ./vendor/nunomaduro/larastan/extension.neon
	parameters:
	ignoreErrors:
	- '#Access to an undefined property Illuminate\\Contracts\\Auth\\Authenticatable#'
	- '#Access to an undefined property [a-zA-Z\\]+::\$pivot#'
	- - '#Call to an undefined [a-zA-Z0-9<>\\ ]+::withEnvTenant#'
	- - '#Call to an undefined [a-zA-Z0-9<>\\ ]+::withUserTenant#'
	+ - '#Call to an undefined [a-zA-Z0-9<>\\ ]+::withEnvTenantContext#'
	+ - '#Call to an undefined [a-zA-Z0-9<>\\ ]+::withObjectTenantContext#'
	+ - '#Call to an undefined [a-zA-Z0-9<>\\ ]+::withSubjectTenantContext#'
	- '#Call to an undefined method Tests\\Browser::#'
	level: 4
	parallel:
	processTimeout: 300.0
	paths:
	- app/
	- tests/
	diff --git a/src/resources/vue/Admin/User.vue b/src/resources/vue/Admin/User.vue
	index cff26837..4de58e1e 100644
	--- a/src/resources/vue/Admin/User.vue
	+++ b/src/resources/vue/Admin/User.vue
	@@ -1,705 +1,705 @@
	<template>
	<div class="container">
	<div class="card" id="user-info">
	<div class="card-body">
	<h1 class="card-title">{{ user.email }}</h1>
	<div class="card-text">
	<form class="read-only short">
	<div v-if="user.wallet.user_id != user.id" class="form-group row plaintext">
	<label for="manager" class="col-sm-4 col-form-label">{{ $t('user.managed-by') }}</label>
	<div class="col-sm-8">
	<span class="form-control-plaintext" id="manager">
	<router-link :to="{ path: '/user/' + user.wallet.user_id }">{{ user.wallet.user_email }}</router-link>
	</span>
	</div>
	</div>
	<div class="form-group row plaintext">
	<label for="userid" class="col-sm-4 col-form-label">ID <span class="text-muted">({{ $t('form.created') }})</span></label>
	<div class="col-sm-8">
	<span class="form-control-plaintext" id="userid">
	{{ user.id }} <span class="text-muted">({{ user.created_at }})</span>
	</span>
	</div>
	</div>
	<div class="form-group row plaintext">
	<label for="status" class="col-sm-4 col-form-label">{{ $t('form.status') }}</label>
	<div class="col-sm-8">
	<span class="form-control-plaintext" id="status">
	<span :class="$root.userStatusClass(user)">{{ $root.userStatusText(user) }}</span>
	</span>
	</div>
	</div>
	<div class="form-group row plaintext" v-if="user.first_name">
	<label for="first_name" class="col-sm-4 col-form-label">{{ $t('form.firstname') }}</label>
	<div class="col-sm-8">
	<span class="form-control-plaintext" id="first_name">{{ user.first_name }}</span>
	</div>
	</div>
	<div class="form-group row plaintext" v-if="user.last_name">
	<label for="last_name" class="col-sm-4 col-form-label">{{ $t('form.lastname') }}</label>
	<div class="col-sm-8">
	<span class="form-control-plaintext" id="last_name">{{ user.last_name }}</span>
	</div>
	</div>
	<div class="form-group row plaintext" v-if="user.organization">
	<label for="organization" class="col-sm-4 col-form-label">{{ $t('user.org') }}</label>
	<div class="col-sm-8">
	<span class="form-control-plaintext" id="organization">{{ user.organization }}</span>
	</div>
	</div>
	<div class="form-group row plaintext" v-if="user.phone">
	<label for="phone" class="col-sm-4 col-form-label">{{ $t('form.phone') }}</label>
	<div class="col-sm-8">
	<span class="form-control-plaintext" id="phone">{{ user.phone }}</span>
	</div>
	</div>
	<div class="form-group row plaintext">
	<label for="external_email" class="col-sm-4 col-form-label">{{ $t('user.ext-email') }}</label>
	<div class="col-sm-8">
	<span class="form-control-plaintext" id="external_email">
	<a v-if="user.external_email" :href="'mailto:' + user.external_email">{{ user.external_email }}</a>
	<button type="button" class="btn btn-secondary btn-sm" @click="emailEdit">{{ $t('btn.edit') }}</button>
	</span>
	</div>
	</div>
	<div class="form-group row plaintext" v-if="user.billing_address">
	<label for="billing_address" class="col-sm-4 col-form-label">{{ $t('user.address') }}</label>
	<div class="col-sm-8">
	<span class="form-control-plaintext" style="white-space:pre" id="billing_address">{{ user.billing_address }}</span>
	</div>
	</div>
	<div class="form-group row plaintext">
	<label for="country" class="col-sm-4 col-form-label">{{ $t('user.country') }}</label>
	<div class="col-sm-8">
	<span class="form-control-plaintext" id="country">{{ user.country }}</span>
	</div>
	</div>
	</form>
	<div class="mt-2">
	<button v-if="!user.isSuspended" id="button-suspend" class="btn btn-warning" type="button" @click="suspendUser">
	{{ $t('btn.suspend') }}
	</button>
	<button v-if="user.isSuspended" id="button-unsuspend" class="btn btn-warning" type="button" @click="unsuspendUser">
	{{ $t('btn.unsuspend') }}
	</button>
	</div>
	</div>
	</div>
	</div>
	<ul class="nav nav-tabs mt-3" role="tablist">
	<li class="nav-item">
	<a class="nav-link active" id="tab-finances" href="#user-finances" role="tab" aria-controls="user-finances" aria-selected="true">
	{{ $t('user.finances') }}
	</a>
	</li>
	<li class="nav-item">
	<a class="nav-link" id="tab-aliases" href="#user-aliases" role="tab" aria-controls="user-aliases" aria-selected="false">
	{{ $t('user.aliases') }} ({{ user.aliases.length }})
	</a>
	</li>
	<li class="nav-item">
	<a class="nav-link" id="tab-subscriptions" href="#user-subscriptions" role="tab" aria-controls="user-subscriptions" aria-selected="false">
	{{ $t('user.subscriptions') }} ({{ skus.length }})
	</a>
	</li>
	<li class="nav-item">
	<a class="nav-link" id="tab-domains" href="#user-domains" role="tab" aria-controls="user-domains" aria-selected="false">
	{{ $t('user.domains') }} ({{ domains.length }})
	</a>
	</li>
	<li class="nav-item">
	<a class="nav-link" id="tab-users" href="#user-users" role="tab" aria-controls="user-users" aria-selected="false">
	{{ $t('user.users') }} ({{ users.length }})
	</a>
	</li>
	<li class="nav-item">
	<a class="nav-link" id="tab-distlists" href="#user-distlists" role="tab" aria-controls="user-distlists" aria-selected="false">
	{{ $t('user.distlists') }} ({{ distlists.length }})
	</a>
	</li>
	</ul>
	<div class="tab-content">
	<div class="tab-pane show active" id="user-finances" role="tabpanel" aria-labelledby="tab-finances">
	<div class="card-body">
	<h2 class="card-title">
	{{ $t('wallet.title') }}
	<span :class="wallet.balance < 0 ? 'text-danger' : 'text-success'"><strong>{{ $root.price(wallet.balance) }}</strong></span>
	</h2>
	<div class="card-text">
	<form class="read-only short">
	<div class="form-group row">
	<label class="col-sm-4 col-form-label">{{ $t('user.discount') }}</label>
	<div class="col-sm-8">
	<span class="form-control-plaintext" id="discount">
	<span>{{ wallet.discount ? (wallet.discount + '% - ' + wallet.discount_description) : 'none' }}</span>
	<button type="button" class="btn btn-secondary btn-sm" @click="discountEdit">{{ $t('btn.edit') }}</button>
	</span>
	</div>
	</div>
	<div class="form-group row" v-if="wallet.mandate && wallet.mandate.id">
	<label class="col-sm-4 col-form-label">{{ $t('user.auto-payment') }}</label>
	<div class="col-sm-8">
	<span id="autopayment" :class="'form-control-plaintext' + (wallet.mandateState ? ' text-danger' : '')"
	v-html="$t('user.auto-payment-text', {
	amount: wallet.mandate.amount,
	balance: wallet.mandate.balance,
	method: wallet.mandate.method
	})"
	>
	<span v-if="wallet.mandateState">({{ wallet.mandateState }})</span>.
	</span>
	</div>
	</div>
	<div class="form-group row" v-if="wallet.providerLink">
	<label class="col-sm-4 col-form-label">{{ capitalize(wallet.provider) }} {{ $t('form.id') }}</label>
	<div class="col-sm-8">
	<span class="form-control-plaintext" v-html="wallet.providerLink"></span>
	</div>
	</div>
	</form>
	<div class="mt-2">
	<button id="button-award" class="btn btn-success" type="button" @click="awardDialog">{{ $t('user.add-bonus') }}</button>
	<button id="button-penalty" class="btn btn-danger" type="button" @click="penalizeDialog">{{ $t('user.add-penalty') }}</button>
	</div>
	</div>
	<h2 class="card-title mt-4">{{ $t('wallet.transactions') }}</h2>
	<transaction-log v-if="wallet.id && !walletReload" class="card-text" :wallet-id="wallet.id" :is-admin="true"></transaction-log>
	</div>
	</div>
	<div class="tab-pane" id="user-aliases" role="tabpanel" aria-labelledby="tab-aliases">
	<div class="card-body">
	<div class="card-text">
	<table class="table table-sm table-hover">
	<thead class="thead-light">
	<tr>
	<th scope="col">{{ $t('form.email') }}</th>
	</tr>
	</thead>
	<tbody>
	<tr v-for="(alias, index) in user.aliases" :id="'alias' + index" :key="index">
	<td>{{ alias }}</td>
	</tr>
	</tbody>
	<tfoot class="table-fake-body">
	<tr>
	<td>{{ $t('user.aliases-none') }}</td>
	</tr>
	</tfoot>
	</table>
	</div>
	</div>
	</div>
	<div class="tab-pane" id="user-subscriptions" role="tabpanel" aria-labelledby="tab-subscriptions">
	<div class="card-body">
	<div class="card-text">
	<table class="table table-sm table-hover mb-0">
	<thead class="thead-light">
	<tr>
	<th scope="col">{{ $t('user.subscription') }}</th>
	<th scope="col">{{ $t('user.price') }}</th>
	</tr>
	</thead>
	<tbody>
	<tr v-for="(sku, sku_id) in skus" :id="'sku' + sku.id" :key="sku_id">
	<td>{{ sku.name }}</td>
	<td>{{ sku.price }}</td>
	</tr>
	</tbody>
	<tfoot class="table-fake-body">
	<tr>
	<td colspan="2">{{ $t('user.subscriptions-none') }}</td>
	</tr>
	</tfoot>
	</table>
	<small v-if="discount > 0" class="hint">
	<hr class="m-0">
	¹ {{ $t('user.discount-hint') }}: {{ discount }}% - {{ discount_description }}
	</small>
	<div class="mt-2">
	<button type="button" class="btn btn-danger" id="reset2fa" v-if="has2FA" @click="reset2FADialog">
	{{ $t('user.reset-2fa') }}
	</button>
	</div>
	</div>
	</div>
	</div>
	<div class="tab-pane" id="user-domains" role="tabpanel" aria-labelledby="tab-domains">
	<div class="card-body">
	<div class="card-text">
	<table class="table table-sm table-hover">
	<thead class="thead-light">
	<tr>
	<th scope="col">{{ $t('domain.namespace') }}</th>
	</tr>
	</thead>
	<tbody>
	<tr v-for="domain in domains" :id="'domain' + domain.id" :key="domain.id" @click="$root.clickRecord">
	<td>
	<svg-icon icon="globe" :class="$root.domainStatusClass(domain)" :title="$root.domainStatusText(domain)"></svg-icon>
	<router-link :to="{ path: '/domain/' + domain.id }">{{ domain.namespace }}</router-link>
	</td>
	</tr>
	</tbody>
	<tfoot class="table-fake-body">
	<tr>
	<td>{{ $t('user.domains-none') }}</td>
	</tr>
	</tfoot>
	</table>
	</div>
	</div>
	</div>
	<div class="tab-pane" id="user-users" role="tabpanel" aria-labelledby="tab-users">
	<div class="card-body">
	<div class="card-text">
	<table class="table table-sm table-hover">
	<thead class="thead-light">
	<tr>
	<th scope="col">{{ $t('form.primary-email') }}</th>
	</tr>
	</thead>
	<tbody>
	<tr v-for="item in users" :id="'user' + item.id" :key="item.id" @click="$root.clickRecord">
	<td>
	<svg-icon icon="user" :class="$root.userStatusClass(item)" :title="$root.userStatusText(item)"></svg-icon>
	<router-link v-if="item.id != user.id" :to="{ path: '/user/' + item.id }">{{ item.email }}</router-link>
	<span v-else>{{ item.email }}</span>
	</td>
	</tr>
	</tbody>
	<tfoot class="table-fake-body">
	<tr>
	<td>{{ $t('user.users-none') }}</td>
	</tr>
	</tfoot>
	</table>
	</div>
	</div>
	</div>
	<div class="tab-pane" id="user-distlists" role="tabpanel" aria-labelledby="tab-distlists">
	<div class="card-body">
	<div class="card-text">
	<table class="table table-sm table-hover">
	<thead class="thead-light">
	<tr>
	<th scope="col">{{ $t('form.email') }}</th>
	</tr>
	</thead>
	<tbody>
	<tr v-for="list in distlists" :key="list.id" @click="$root.clickRecord">
	<td>
	<svg-icon icon="users" :class="$root.distlistStatusClass(list)" :title="$root.distlistStatusText(list)"></svg-icon>
	<router-link :to="{ path: '/distlist/' + list.id }">{{ list.email }}</router-link>
	</td>
	</tr>
	</tbody>
	<tfoot class="table-fake-body">
	<tr>
	<td>{{ $t('user.distlists-none') }}</td>
	</tr>
	</tfoot>
	</table>
	</div>
	</div>
	</div>
	</div>

	<div id="discount-dialog" class="modal" tabindex="-1" role="dialog">
	<div class="modal-dialog" role="document">
	<div class="modal-content">
	<div class="modal-header">
	<h5 class="modal-title">{{ $t('user.discount-title') }}</h5>
	<button type="button" class="close" data-dismiss="modal" :aria-label="$t('btn.close')">
	<span aria-hidden="true">×</span>
	</button>
	</div>
	<div class="modal-body">
	<p class="form-group">
	<select v-model="wallet.discount_id" class="custom-select">
	<option value="">- {{ $t('form.none') }} -</option>
	<option v-for="item in discounts" :value="item.id" :key="item.id">{{ item.label }}</option>
	</select>
	</p>
	</div>
	<div class="modal-footer">
	<button type="button" class="btn btn-secondary modal-cancel" data-dismiss="modal">{{ $t('btn.cancel') }}</button>
	<button type="button" class="btn btn-primary modal-action" @click="submitDiscount()">
	<svg-icon icon="check"></svg-icon> {{ $t('btn.submit') }}
	</button>
	</div>
	</div>
	</div>
	</div>

	<div id="email-dialog" class="modal" tabindex="-1" role="dialog">
	<div class="modal-dialog" role="document">
	<div class="modal-content">
	<div class="modal-header">
	<h5 class="modal-title">{{ $t('user.ext-email') }}</h5>
	<button type="button" class="close" data-dismiss="modal" :aria-label="$t('btn.close')">
	<span aria-hidden="true">×</span>
	</button>
	</div>
	<div class="modal-body">
	<p class="form-group">
	<input v-model="external_email" name="external_email" class="form-control">
	</p>
	</div>
	<div class="modal-footer">
	<button type="button" class="btn btn-secondary modal-cancel" data-dismiss="modal">{{ $t('btn.cancel') }}</button>
	<button type="button" class="btn btn-primary modal-action" @click="submitEmail()">
	<svg-icon icon="check"></svg-icon> {{ $t('btn.submit') }}
	</button>
	</div>
	</div>
	</div>
	</div>

	<div id="oneoff-dialog" class="modal" tabindex="-1" role="dialog">
	<div class="modal-dialog" role="document">
	<div class="modal-content">
	<div class="modal-header">
	<h5 class="modal-title">{{ $t(oneoff_negative ? 'user.add-penalty-title' : 'user.add-bonus-title') }}</h5>
	<button type="button" class="close" data-dismiss="modal" :aria-label="$t('btn.close')">
	<span aria-hidden="true">×</span>
	</button>
	</div>
	<div class="modal-body">
	<form data-validation-prefix="oneoff_">
	<div class="form-group">
	<label for="oneoff_amount" class="col-form-label">{{ $t('form.amount') }}</label>
	<div class="input-group">
	<input type="text" class="form-control" id="oneoff_amount" v-model="oneoff_amount" required>
	<span class="input-group-append">
	<span class="input-group-text">{{ oneoff_currency }}</span>
	</span>
	</div>
	</div>
	<div class="form-group">
	<label for="oneoff_description" class="col-form-label">{{ $t('form.description') }}</label>
	<input class="form-control" id="oneoff_description" v-model="oneoff_description" required>
	</div>
	</form>
	</div>
	<div class="modal-footer">
	<button type="button" class="btn btn-secondary modal-cancel" data-dismiss="modal">{{ $t('btn.cancel') }}</button>
	<button type="button" class="btn btn-primary modal-action" @click="submitOneOff()">
	<svg-icon icon="check"></svg-icon> {{ $t('btn.submit') }}
	</button>
	</div>
	</div>
	</div>
	</div>

	<div id="reset-2fa-dialog" class="modal" tabindex="-1" role="dialog">
	<div class="modal-dialog" role="document">
	<div class="modal-content">
	<div class="modal-header">
	<h5 class="modal-title">{{ $t('user.reset-2fa-title') }}</h5>
	<button type="button" class="close" data-dismiss="modal" :aria-label="$t('btn.close')">
	<span aria-hidden="true">×</span>
	</button>
	</div>
	<div class="modal-body">
	<p>{{ $t('user.2fa-hint1') }}</p>
	<p>{{ $t('user.2fa-hint2') }}</p>
	</div>
	<div class="modal-footer">
	<button type="button" class="btn btn-secondary modal-cancel" data-dismiss="modal">{{ $t('btn.cancel') }}</button>
	<button type="button" class="btn btn-danger modal-action" @click="reset2FA()">{{ $t('btn.reset') }}</button>
	</div>
	</div>
	</div>
	</div>
	</div>
	</template>

	<script>
	import TransactionLog from '../Widgets/TransactionLog'

	export default {
	components: {
	TransactionLog
	},
	beforeRouteUpdate (to, from, next) {
	// An event called when the route that renders this component has changed,
	// but this component is reused in the new route.
	// Required to handle links from /user/XXX to /user/YYY
	next()
	this.$parent.routerReload()
	},
	data() {
	return {
	oneoff_amount: '',
	oneoff_currency: 'CHF',
	oneoff_description: '',
	oneoff_negative: false,
	discount: 0,
	discount_description: '',
	discounts: [],
	external_email: '',
	has2FA: false,
	wallet: {},
	walletReload: false,
	distlists: [],
	domains: [],
	skus: [],
	sku2FA: null,
	users: [],
	user: {
	aliases: [],
	wallet: {},
	skus: {},
	}
	}
	},
	created() {
	const user_id = this.$route.params.user

	this.$root.startLoading()

	axios.get('/api/v4/users/' + user_id)
	.then(response => {
	this.$root.stopLoading()

	this.user = response.data

	const financesTab = '#user-finances'
	const keys = ['first_name', 'last_name', 'external_email', 'billing_address', 'phone', 'organization']

	let country = this.user.settings.country
	if (country && country in window.config.countries) {
	country = window.config.countries[country][1]
	}

	this.user.country = country

	keys.forEach(key => { this.user[key] = this.user.settings[key] })

	this.discount = this.user.wallet.discount
	this.discount_description = this.user.wallet.discount_description

	// TODO: currencies, multi-wallets, accounts
	// Get more info about the wallet (e.g. payment provider related)
	this.$root.addLoader(financesTab)
	axios.get('/api/v4/wallets/' + this.user.wallets[0].id)
	.then(response => {
	this.$root.removeLoader(financesTab)
	this.wallet = response.data
	this.setMandateState()
	})
	.catch(error => {
	this.$root.removeLoader(financesTab)
	})

	// Create subscriptions list
	axios.get('/api/v4/users/' + user_id + '/skus')
	.then(response => {
	// "merge" SKUs with user entitlement-SKUs
	response.data.forEach(sku => {
	const userSku = this.user.skus[sku.id]
	if (userSku) {
	let cost = userSku.costs.reduce((sum, current) => sum + current)
	let item = {
	id: sku.id,
	name: sku.name,
	cost: cost,
	price: this.$root.priceLabel(cost, this.discount)
	}

	if (sku.range) {
	item.name += ' ' + userSku.count + ' ' + sku.range.unit
	}

	this.skus.push(item)

	if (sku.handler == 'auth2f') {
	this.has2FA = true
	this.sku2FA = sku.id
	}
	}
	})
	})

	// Fetch users
	// TODO: Multiple wallets
	axios.get('/api/v4/users?owner=' + user_id)
	.then(response => {
	this.users = response.data.list;
	})

	// Fetch domains
	axios.get('/api/v4/domains?owner=' + user_id)
	.then(response => {
	this.domains = response.data.list
	})

	// Fetch distribution lists
	axios.get('/api/v4/groups?owner=' + user_id)
	.then(response => {
	this.distlists = response.data.list
	})
	})
	.catch(this.$root.errorHandler)
	},
	mounted() {
	$(this.$el).find('ul.nav-tabs a').on('click', e => {
	e.preventDefault()
	$(e.target).tab('show')
	})
	},
	methods: {
	capitalize(str) {
	return str.charAt(0).toUpperCase() + str.slice(1)
	},
	awardDialog() {
	this.oneOffDialog(false)
	},
	discountEdit() {
	$('#discount-dialog')
	.on('shown.bs.modal', e => {
	$(e.target).find('select').focus()
	// Note: Vue v-model is strict, convert null to a string
	this.wallet.discount_id = this.wallet_discount_id \|\| ''
	})
	.modal()

	if (!this.discounts.length) {
	// Fetch discounts
	- axios.get('/api/v4/discounts')
	+ axios.get('/api/v4/users/' + this.user.id + '/discounts')
	.then(response => {
	this.discounts = response.data.list
	})
	}
	},
	emailEdit() {
	this.external_email = this.user.external_email
	this.$root.clearFormValidation($('#email-dialog'))

	$('#email-dialog')
	.on('shown.bs.modal', e => {
	$(e.target).find('input').focus()
	})
	.modal()
	},
	setMandateState() {
	let mandate = this.wallet.mandate
	if (mandate && mandate.id) {
	if (!mandate.isValid) {
	this.wallet.mandateState = mandate.isPending ? 'pending' : 'invalid'
	} else if (mandate.isDisabled) {
	this.wallet.mandateState = 'disabled'
	}
	}
	},
	oneOffDialog(negative) {
	this.oneoff_negative = negative
	this.dialog = $('#oneoff-dialog').on('shown.bs.modal', event => {
	this.$root.clearFormValidation(event.target)
	$(event.target).find('#oneoff_amount').focus()
	}).modal()
	},
	penalizeDialog() {
	this.oneOffDialog(true)
	},
	reload() {
	// this is to reload transaction log
	this.walletReload = true
	this.$nextTick(() => { this.walletReload = false })
	},
	reset2FA() {
	$('#reset-2fa-dialog').modal('hide')
	axios.post('/api/v4/users/' + this.user.id + '/reset2FA')
	.then(response => {
	if (response.data.status == 'success') {
	this.$toast.success(response.data.message)
	this.skus = this.skus.filter(sku => sku.id != this.sku2FA)
	this.has2FA = false
	}
	})
	},
	reset2FADialog() {
	$('#reset-2fa-dialog').modal()
	},
	submitDiscount() {
	$('#discount-dialog').modal('hide')

	axios.put('/api/v4/wallets/' + this.user.wallets[0].id, { discount: this.wallet.discount_id })
	.then(response => {
	if (response.data.status == 'success') {
	this.$toast.success(response.data.message)
	this.wallet = Object.assign({}, this.wallet, response.data)

	// Update prices in Subscriptions tab
	if (this.user.wallet.id == response.data.id) {
	this.discount = this.wallet.discount
	this.discount_description = this.wallet.discount_description

	this.skus.forEach(sku => {
	sku.price = this.$root.priceLabel(sku.cost, this.discount)
	})
	}
	}
	})
	},
	submitEmail() {
	axios.put('/api/v4/users/' + this.user.id, { external_email: this.external_email })
	.then(response => {
	if (response.data.status == 'success') {
	$('#email-dialog').modal('hide')
	this.$toast.success(response.data.message)
	this.user.external_email = this.external_email
	this.external_email = null // required because of Vue
	}
	})
	},
	submitOneOff() {
	let wallet_id = this.user.wallets[0].id
	let post = {
	amount: this.oneoff_amount,
	description: this.oneoff_description
	}

	if (this.oneoff_negative && /^\d+(\.?\d+)?$/.test(post.amount)) {
	post.amount *= -1
	}

	// TODO: We maybe should use system currency not wallet currency,
	// or have a selector so the operator does not have to calculate
	// exchange rates

	this.$root.clearFormValidation(this.dialog)

	axios.post('/api/v4/wallets/' + wallet_id + '/one-off', post)
	.then(response => {
	if (response.data.status == 'success') {
	this.dialog.modal('hide')
	this.$toast.success(response.data.message)
	this.wallet = Object.assign({}, this.wallet, {balance: response.data.balance})
	this.oneoff_amount = ''
	this.oneoff_description = ''
	this.reload()
	}
	})
	},
	suspendUser() {
	axios.post('/api/v4/users/' + this.user.id + '/suspend', {})
	.then(response => {
	if (response.data.status == 'success') {
	this.$toast.success(response.data.message)
	this.user = Object.assign({}, this.user, { isSuspended: true })
	}
	})
	},
	unsuspendUser() {
	axios.post('/api/v4/users/' + this.user.id + '/unsuspend', {})
	.then(response => {
	if (response.data.status == 'success') {
	this.$toast.success(response.data.message)
	this.user = Object.assign({}, this.user, { isSuspended: false })
	}
	})
	}
	}
	}
	</script>
	diff --git a/src/routes/api.php b/src/routes/api.php
	index f23ff8d1..faa46877 100644
	--- a/src/routes/api.php
	+++ b/src/routes/api.php
	@@ -1,217 +1,215 @@
	<?php

	use Illuminate\Http\Request;

	/*
	\|--------------------------------------------------------------------------
	\| API Routes
	\|--------------------------------------------------------------------------
	\|
	\| Here is where you can register API routes for your application. These
	\| routes are loaded by the RouteServiceProvider within a group which
	\| is assigned the "api" middleware group. Enjoy building your API!
	\|
	*/

	$prefix = \trim(\parse_url(\config('app.url'), PHP_URL_PATH), '/') . '/';

	Route::group(
	[
	'middleware' => 'api',
	'prefix' => $prefix . 'api/auth'
	],
	function ($router) {
	Route::post('login', 'API\AuthController@login');

	Route::group(
	['middleware' => 'auth:api'],
	function ($router) {
	Route::get('info', 'API\AuthController@info');
	Route::post('logout', 'API\AuthController@logout');
	Route::post('refresh', 'API\AuthController@refresh');
	}
	);
	}
	);

	Route::group(
	[
	'domain' => \config('app.domain'),
	'middleware' => 'api',
	'prefix' => $prefix . 'api/auth'
	],
	function ($router) {
	Route::post('password-reset/init', 'API\PasswordResetController@init');
	Route::post('password-reset/verify', 'API\PasswordResetController@verify');
	Route::post('password-reset', 'API\PasswordResetController@reset');

	Route::post('signup/init', 'API\SignupController@init');
	Route::get('signup/invitations/{id}', 'API\SignupController@invitation');
	Route::get('signup/plans', 'API\SignupController@plans');
	Route::post('signup/verify', 'API\SignupController@verify');
	Route::post('signup', 'API\SignupController@signup');
	}
	);

	Route::group(
	[
	'domain' => \config('app.domain'),
	'middleware' => 'auth:api',
	'prefix' => $prefix . 'api/v4'
	],
	function () {
	Route::apiResource('domains', API\V4\DomainsController::class);
	Route::get('domains/{id}/confirm', 'API\V4\DomainsController@confirm');
	Route::get('domains/{id}/status', 'API\V4\DomainsController@status');

	Route::apiResource('groups', API\V4\GroupsController::class);
	Route::get('groups/{id}/status', 'API\V4\GroupsController@status');

	Route::apiResource('packages', API\V4\PackagesController::class);
	Route::apiResource('skus', API\V4\SkusController::class);

	Route::apiResource('users', API\V4\UsersController::class);
	Route::get('users/{id}/skus', 'API\V4\SkusController@userSkus');
	Route::get('users/{id}/status', 'API\V4\UsersController@status');

	Route::apiResource('wallets', API\V4\WalletsController::class);
	Route::get('wallets/{id}/transactions', 'API\V4\WalletsController@transactions');
	Route::get('wallets/{id}/receipts', 'API\V4\WalletsController@receipts');
	Route::get('wallets/{id}/receipts/{receipt}', 'API\V4\WalletsController@receiptDownload');

	Route::post('payments', 'API\V4\PaymentsController@store');
	//Route::delete('payments', 'API\V4\PaymentsController@cancel');
	Route::get('payments/mandate', 'API\V4\PaymentsController@mandate');
	Route::post('payments/mandate', 'API\V4\PaymentsController@mandateCreate');
	Route::put('payments/mandate', 'API\V4\PaymentsController@mandateUpdate');
	Route::delete('payments/mandate', 'API\V4\PaymentsController@mandateDelete');
	Route::get('payments/methods', 'API\V4\PaymentsController@paymentMethods');
	Route::get('payments/pending', 'API\V4\PaymentsController@payments');
	Route::get('payments/has-pending', 'API\V4\PaymentsController@hasPayments');

	Route::get('openvidu/rooms', 'API\V4\OpenViduController@index');
	Route::post('openvidu/rooms/{id}/close', 'API\V4\OpenViduController@closeRoom');
	Route::post('openvidu/rooms/{id}/config', 'API\V4\OpenViduController@setRoomConfig');

	// FIXME: I'm not sure about this one, should we use DELETE request maybe?
	Route::post('openvidu/rooms/{id}/connections/{conn}/dismiss', 'API\V4\OpenViduController@dismissConnection');
	Route::put('openvidu/rooms/{id}/connections/{conn}', 'API\V4\OpenViduController@updateConnection');
	Route::post('openvidu/rooms/{id}/request/{reqid}/accept', 'API\V4\OpenViduController@acceptJoinRequest');
	Route::post('openvidu/rooms/{id}/request/{reqid}/deny', 'API\V4\OpenViduController@denyJoinRequest');
	}
	);

	// Note: In Laravel 7.x we could just use withoutMiddleware() instead of a separate group
	Route::group(
	[
	'domain' => \config('app.domain'),
	'prefix' => $prefix . 'api/v4'
	],
	function () {
	Route::post('openvidu/rooms/{id}', 'API\V4\OpenViduController@joinRoom');
	Route::post('openvidu/rooms/{id}/connections', 'API\V4\OpenViduController@createConnection');
	// FIXME: I'm not sure about this one, should we use DELETE request maybe?
	Route::post('openvidu/rooms/{id}/connections/{conn}/dismiss', 'API\V4\OpenViduController@dismissConnection');
	Route::put('openvidu/rooms/{id}/connections/{conn}', 'API\V4\OpenViduController@updateConnection');
	Route::post('openvidu/rooms/{id}/request/{reqid}/accept', 'API\V4\OpenViduController@acceptJoinRequest');
	Route::post('openvidu/rooms/{id}/request/{reqid}/deny', 'API\V4\OpenViduController@denyJoinRequest');
	}
	);

	Route::group(
	[
	'domain' => \config('app.domain'),
	'middleware' => 'api',
	'prefix' => $prefix . 'api/v4'
	],
	function ($router) {
	Route::post('support/request', 'API\V4\SupportController@request');
	}
	);

	Route::group(
	[
	'domain' => \config('app.domain'),
	'prefix' => $prefix . 'api/webhooks',
	],
	function () {
	Route::post('payment/{provider}', 'API\V4\PaymentsController@webhook');
	Route::post('meet/openvidu', 'API\V4\OpenViduController@webhook');
	}
	);

	Route::group(
	[
	'domain' => 'admin.' . \config('app.domain'),
	'middleware' => ['auth:api', 'admin'],
	'prefix' => $prefix . 'api/v4',
	],
	function () {
	Route::apiResource('domains', API\V4\Admin\DomainsController::class);
	Route::post('domains/{id}/suspend', 'API\V4\Admin\DomainsController@suspend');
	Route::post('domains/{id}/unsuspend', 'API\V4\Admin\DomainsController@unsuspend');

	Route::apiResource('groups', API\V4\Admin\GroupsController::class);
	Route::post('groups/{id}/suspend', 'API\V4\Admin\GroupsController@suspend');
	Route::post('groups/{id}/unsuspend', 'API\V4\Admin\GroupsController@unsuspend');

	- Route::apiResource('packages', API\V4\Admin\PackagesController::class);
	Route::apiResource('skus', API\V4\Admin\SkusController::class);
	Route::apiResource('users', API\V4\Admin\UsersController::class);
	+ Route::get('users/{id}/discounts', 'API\V4\Reseller\DiscountsController@userDiscounts');
	Route::post('users/{id}/reset2FA', 'API\V4\Admin\UsersController@reset2FA');
	Route::get('users/{id}/skus', 'API\V4\Admin\SkusController@userSkus');
	Route::post('users/{id}/suspend', 'API\V4\Admin\UsersController@suspend');
	Route::post('users/{id}/unsuspend', 'API\V4\Admin\UsersController@unsuspend');
	Route::apiResource('wallets', API\V4\Admin\WalletsController::class);
	Route::post('wallets/{id}/one-off', 'API\V4\Admin\WalletsController@oneOff');
	Route::get('wallets/{id}/transactions', 'API\V4\Admin\WalletsController@transactions');
	- Route::apiResource('discounts', API\V4\Admin\DiscountsController::class);

	Route::get('stats/chart/{chart}', 'API\V4\Admin\StatsController@chart');
	}
	);

	Route::group(
	[
	'domain' => 'reseller.' . \config('app.domain'),
	'middleware' => ['auth:api', 'reseller'],
	'prefix' => $prefix . 'api/v4',
	],
	function () {
	Route::apiResource('domains', API\V4\Reseller\DomainsController::class);
	Route::post('domains/{id}/suspend', 'API\V4\Reseller\DomainsController@suspend');
	Route::post('domains/{id}/unsuspend', 'API\V4\Reseller\DomainsController@unsuspend');

	Route::apiResource('groups', API\V4\Reseller\GroupsController::class);
	Route::post('groups/{id}/suspend', 'API\V4\Reseller\GroupsController@suspend');
	Route::post('groups/{id}/unsuspend', 'API\V4\Reseller\GroupsController@unsuspend');

	Route::apiResource('invitations', API\V4\Reseller\InvitationsController::class);
	Route::post('invitations/{id}/resend', 'API\V4\Reseller\InvitationsController@resend');
	- Route::apiResource('packages', API\V4\Reseller\PackagesController::class);

	Route::post('payments', 'API\V4\Reseller\PaymentsController@store');
	Route::get('payments/mandate', 'API\V4\Reseller\PaymentsController@mandate');
	Route::post('payments/mandate', 'API\V4\Reseller\PaymentsController@mandateCreate');
	Route::put('payments/mandate', 'API\V4\Reseller\PaymentsController@mandateUpdate');
	Route::delete('payments/mandate', 'API\V4\Reseller\PaymentsController@mandateDelete');
	Route::get('payments/methods', 'API\V4\Reseller\PaymentsController@paymentMethods');
	Route::get('payments/pending', 'API\V4\Reseller\PaymentsController@payments');
	Route::get('payments/has-pending', 'API\V4\Reseller\PaymentsController@hasPayments');

	Route::apiResource('skus', API\V4\Reseller\SkusController::class);
	Route::apiResource('users', API\V4\Reseller\UsersController::class);
	+ Route::get('users/{id}/discounts', 'API\V4\Reseller\DiscountsController@userDiscounts');
	Route::post('users/{id}/reset2FA', 'API\V4\Reseller\UsersController@reset2FA');
	Route::get('users/{id}/skus', 'API\V4\Reseller\SkusController@userSkus');
	Route::post('users/{id}/suspend', 'API\V4\Reseller\UsersController@suspend');
	Route::post('users/{id}/unsuspend', 'API\V4\Reseller\UsersController@unsuspend');
	Route::apiResource('wallets', API\V4\Reseller\WalletsController::class);
	Route::post('wallets/{id}/one-off', 'API\V4\Reseller\WalletsController@oneOff');
	Route::get('wallets/{id}/receipts', 'API\V4\Reseller\WalletsController@receipts');
	Route::get('wallets/{id}/receipts/{receipt}', 'API\V4\Reseller\WalletsController@receiptDownload');
	Route::get('wallets/{id}/transactions', 'API\V4\Reseller\WalletsController@transactions');
	- Route::apiResource('discounts', API\V4\Reseller\DiscountsController::class);

	Route::get('stats/chart/{chart}', 'API\V4\Reseller\StatsController@chart');
	}
	);
	diff --git a/src/tests/Browser/Admin/DashboardTest.php b/src/tests/Browser/Admin/DashboardTest.php
	index a6077e53..1d52a591 100644
	--- a/src/tests/Browser/Admin/DashboardTest.php
	+++ b/src/tests/Browser/Admin/DashboardTest.php
	@@ -1,140 +1,140 @@
	<?php

	namespace Tests\Browser\Admin;

	use Illuminate\Support\Facades\Queue;
	use Tests\Browser;
	use Tests\Browser\Components\Toast;
	use Tests\Browser\Pages\Dashboard;
	use Tests\Browser\Pages\Home;
	use Tests\TestCaseDusk;

	class DashboardTest extends TestCaseDusk
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	self::useAdminUrl();

	$jack = $this->getTestUser('jack@kolab.org');
	$jack->setSetting('external_email', null);

	$this->deleteTestUser('test@testsearch.com');
	$this->deleteTestDomain('testsearch.com');
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	$jack = $this->getTestUser('jack@kolab.org');
	$jack->setSetting('external_email', null);

	$this->deleteTestUser('test@testsearch.com');
	$this->deleteTestDomain('testsearch.com');

	parent::tearDown();
	}

	/**
	* Test user search
	*/
	public function testSearch(): void
	{
	$this->browse(function (Browser $browser) {
	$browser->visit(new Home())
	- ->submitLogon('jeroen@jeroen.jeroen', 'jeroen', true)
	+ ->submitLogon('jeroen@jeroen.jeroen', \App\Utils::generatePassphrase(), true)
	->on(new Dashboard())
	->assertFocused('@search input')
	->assertMissing('@search table');

	// Test search with no results
	$browser->type('@search input', 'unknown')
	->click('@search form button')
	->assertToast(Toast::TYPE_INFO, '0 user accounts have been found.')
	->assertMissing('@search table');

	$john = $this->getTestUser('john@kolab.org');
	$jack = $this->getTestUser('jack@kolab.org');
	$jack->setSetting('external_email', 'john.doe.external@gmail.com');

	// Test search with multiple results
	$browser->type('@search input', 'john.doe.external@gmail.com')
	->click('@search form button')
	->assertToast(Toast::TYPE_INFO, '2 user accounts have been found.')
	->whenAvailable('@search table', function (Browser $browser) use ($john, $jack) {
	$browser->assertElementsCount('tbody tr', 2)
	->with('tbody tr:first-child', function (Browser $browser) use ($jack) {
	$browser->assertSeeIn('td:nth-child(1) a', $jack->email)
	->assertSeeIn('td:nth-child(2) a', $jack->id)
	->assertVisible('td:nth-child(3)')
	->assertTextRegExp('td:nth-child(3)', '/^[0-9]{4}-[0-9]{2}-[0-9]{2}$/')
	->assertVisible('td:nth-child(4)')
	->assertText('td:nth-child(4)', '');
	})
	->with('tbody tr:last-child', function (Browser $browser) use ($john) {
	$browser->assertSeeIn('td:nth-child(1) a', $john->email)
	->assertSeeIn('td:nth-child(2) a', $john->id)
	->assertVisible('td:nth-child(3)')
	->assertTextRegExp('td:nth-child(3)', '/^[0-9]{4}-[0-9]{2}-[0-9]{2}$/')
	->assertVisible('td:nth-child(4)')
	->assertText('td:nth-child(4)', '');
	});
	});

	// Test search with single record result -> redirect to user page
	$browser->type('@search input', 'kolab.org')
	->click('@search form button')
	->assertMissing('@search table')
	->waitForLocation('/user/' . $john->id)
	->waitUntilMissing('.app-loader')
	->whenAvailable('#user-info', function (Browser $browser) use ($john) {
	$browser->assertSeeIn('.card-title', $john->email);
	});
	});
	}

	/**
	* Test user search deleted user/domain
	*/
	public function testSearchDeleted(): void
	{
	$this->browse(function (Browser $browser) {
	$browser->visit(new Home())
	- ->submitLogon('jeroen@jeroen.jeroen', 'jeroen', true)
	+ ->submitLogon('jeroen@jeroen.jeroen', \App\Utils::generatePassphrase(), true)
	->on(new Dashboard())
	->assertFocused('@search input')
	->assertMissing('@search table');

	// Deleted users/domains
	$domain = $this->getTestDomain('testsearch.com', ['type' => \App\Domain::TYPE_EXTERNAL]);
	$user = $this->getTestUser('test@testsearch.com');
	$plan = \App\Plan::where('title', 'group')->first();
	$user->assignPlan($plan, $domain);
	$user->setAliases(['alias@testsearch.com']);
	Queue::fake();
	$user->delete();

	// Test search with multiple results
	$browser->type('@search input', 'testsearch.com')
	->click('@search form button')
	->assertToast(Toast::TYPE_INFO, '1 user accounts have been found.')
	->whenAvailable('@search table', function (Browser $browser) use ($user) {
	$browser->assertElementsCount('tbody tr', 1)
	->assertVisible('tbody tr:first-child.text-secondary')
	->with('tbody tr:first-child', function (Browser $browser) use ($user) {
	$browser->assertSeeIn('td:nth-child(1) span', $user->email)
	->assertSeeIn('td:nth-child(2) span', $user->id)
	->assertVisible('td:nth-child(3)')
	->assertTextRegExp('td:nth-child(3)', '/^[0-9]{4}-[0-9]{2}-[0-9]{2}$/')
	->assertVisible('td:nth-child(4)')
	->assertTextRegExp('td:nth-child(4)', '/^[0-9]{4}-[0-9]{2}-[0-9]{2}$/');
	});
	});
	});
	}
	}
	diff --git a/src/tests/Browser/Admin/DistlistTest.php b/src/tests/Browser/Admin/DistlistTest.php
	index e140bc49..69b31e72 100644
	--- a/src/tests/Browser/Admin/DistlistTest.php
	+++ b/src/tests/Browser/Admin/DistlistTest.php
	@@ -1,128 +1,128 @@
	<?php

	namespace Tests\Browser\Admin;

	use App\Group;
	use Illuminate\Support\Facades\Queue;
	use Tests\Browser;
	use Tests\Browser\Components\Toast;
	use Tests\Browser\Pages\Admin\Distlist as DistlistPage;
	use Tests\Browser\Pages\Admin\User as UserPage;
	use Tests\Browser\Pages\Dashboard;
	use Tests\Browser\Pages\Home;
	use Tests\TestCaseDusk;

	class DistlistTest extends TestCaseDusk
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	self::useAdminUrl();

	$this->deleteTestGroup('group-test@kolab.org');
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	$this->deleteTestGroup('group-test@kolab.org');

	parent::tearDown();
	}

	/**
	* Test distlist info page (unauthenticated)
	*/
	public function testDistlistUnauth(): void
	{
	// Test that the page requires authentication
	$this->browse(function (Browser $browser) {
	$user = $this->getTestUser('john@kolab.org');
	$group = $this->getTestGroup('group-test@kolab.org');
	$group->assignToWallet($user->wallets->first());

	$browser->visit('/distlist/' . $group->id)->on(new Home());
	});
	}

	/**
	* Test distribution list info page
	*/
	public function testInfo(): void
	{
	Queue::fake();

	$this->browse(function (Browser $browser) {
	$user = $this->getTestUser('john@kolab.org');
	$group = $this->getTestGroup('group-test@kolab.org');
	$group->assignToWallet($user->wallets->first());
	$group->members = ['test1@gmail.com', 'test2@gmail.com'];
	$group->save();

	$distlist_page = new DistlistPage($group->id);
	$user_page = new UserPage($user->id);

	// Goto the distlist page
	$browser->visit(new Home())
	- ->submitLogon('jeroen@jeroen.jeroen', 'jeroen', true)
	+ ->submitLogon('jeroen@jeroen.jeroen', \App\Utils::generatePassphrase(), true)
	->on(new Dashboard())
	->visit($user_page)
	->on($user_page)
	->click('@nav #tab-distlists')
	->pause(1000)
	->click('@user-distlists table tbody tr:first-child td a')
	->on($distlist_page)
	->assertSeeIn('@distlist-info .card-title', $group->email)
	->with('@distlist-info form', function (Browser $browser) use ($group) {
	$browser->assertElementsCount('.row', 3)
	->assertSeeIn('.row:nth-child(1) label', 'ID (Created)')
	->assertSeeIn('.row:nth-child(1) #distlistid', "{$group->id} ({$group->created_at})")
	->assertSeeIn('.row:nth-child(2) label', 'Status')
	->assertSeeIn('.row:nth-child(2) #status.text-danger', 'Not Ready')
	->assertSeeIn('.row:nth-child(3) label', 'Recipients')
	->assertSeeIn('.row:nth-child(3) #members', $group->members[0])
	->assertSeeIn('.row:nth-child(3) #members', $group->members[1]);
	});

	// Test invalid group identifier
	$browser->visit('/distlist/abc')->assertErrorPage(404);
	});
	}

	/**
	* Test suspending/unsuspending a distribution list
	*
	* @depends testInfo
	*/
	public function testSuspendAndUnsuspend(): void
	{
	Queue::fake();

	$this->browse(function (Browser $browser) {
	$user = $this->getTestUser('john@kolab.org');
	$group = $this->getTestGroup('group-test@kolab.org');
	$group->assignToWallet($user->wallets->first());
	$group->status = Group::STATUS_ACTIVE \| Group::STATUS_LDAP_READY;
	$group->save();

	$browser->visit(new DistlistPage($group->id))
	->assertVisible('@distlist-info #button-suspend')
	->assertMissing('@distlist-info #button-unsuspend')
	->assertSeeIn('@distlist-info #status.text-success', 'Active')
	->click('@distlist-info #button-suspend')
	->assertToast(Toast::TYPE_SUCCESS, 'Distribution list suspended successfully.')
	->assertSeeIn('@distlist-info #status.text-warning', 'Suspended')
	->assertMissing('@distlist-info #button-suspend')
	->click('@distlist-info #button-unsuspend')
	->assertToast(Toast::TYPE_SUCCESS, 'Distribution list unsuspended successfully.')
	->assertSeeIn('@distlist-info #status.text-success', 'Active')
	->assertVisible('@distlist-info #button-suspend')
	->assertMissing('@distlist-info #button-unsuspend');
	});
	}
	}
	diff --git a/src/tests/Browser/Admin/DomainTest.php b/src/tests/Browser/Admin/DomainTest.php
	index a13f86ce..620f8119 100644
	--- a/src/tests/Browser/Admin/DomainTest.php
	+++ b/src/tests/Browser/Admin/DomainTest.php
	@@ -1,119 +1,119 @@
	<?php

	namespace Tests\Browser\Admin;

	use App\Domain;
	use Tests\Browser;
	use Tests\Browser\Components\Toast;
	use Tests\Browser\Pages\Admin\Domain as DomainPage;
	use Tests\Browser\Pages\Admin\User as UserPage;
	use Tests\Browser\Pages\Dashboard;
	use Tests\Browser\Pages\Home;
	use Tests\TestCaseDusk;
	use Illuminate\Foundation\Testing\DatabaseMigrations;

	class DomainTest extends TestCaseDusk
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	self::useAdminUrl();
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	parent::tearDown();
	}

	/**
	* Test domain info page (unauthenticated)
	*/
	public function testDomainUnauth(): void
	{
	// Test that the page requires authentication
	$this->browse(function (Browser $browser) {
	$domain = $this->getTestDomain('kolab.org');
	$browser->visit('/domain/' . $domain->id)->on(new Home());
	});
	}

	/**
	* Test domain info page
	*/
	public function testDomainInfo(): void
	{
	$this->browse(function (Browser $browser) {
	$domain = $this->getTestDomain('kolab.org');
	$domain_page = new DomainPage($domain->id);
	$john = $this->getTestUser('john@kolab.org');
	$user_page = new UserPage($john->id);

	// Goto the domain page
	$browser->visit(new Home())
	- ->submitLogon('jeroen@jeroen.jeroen', 'jeroen', true)
	+ ->submitLogon('jeroen@jeroen.jeroen', \App\Utils::generatePassphrase(), true)
	->on(new Dashboard())
	->visit($user_page)
	->on($user_page)
	->click('@nav #tab-domains')
	->pause(1000)
	->click('@user-domains table tbody tr:first-child td a');

	$browser->on($domain_page)
	->assertSeeIn('@domain-info .card-title', 'kolab.org')
	->with('@domain-info form', function (Browser $browser) use ($domain) {
	$browser->assertElementsCount('.row', 2)
	->assertSeeIn('.row:nth-child(1) label', 'ID (Created)')
	->assertSeeIn('.row:nth-child(1) #domainid', "{$domain->id} ({$domain->created_at})")
	->assertSeeIn('.row:nth-child(2) label', 'Status')
	->assertSeeIn('.row:nth-child(2) #status span.text-success', 'Active');
	});

	// Some tabs are loaded in background, wait a second
	$browser->pause(500)
	->assertElementsCount('@nav a', 1);

	// Assert Configuration tab
	$browser->assertSeeIn('@nav #tab-config', 'Configuration')
	->with('@domain-config', function (Browser $browser) {
	$browser->assertSeeIn('pre#dns-verify', 'kolab-verify.kolab.org.')
	->assertSeeIn('pre#dns-config', 'kolab.org.');
	});
	});
	}

	/**
	* Test suspending/unsuspending a domain
	*
	* @depends testDomainInfo
	*/
	public function testSuspendAndUnsuspend(): void
	{
	$this->browse(function (Browser $browser) {
	$domain = $this->getTestDomain('domainscontroller.com', [
	'status' => Domain::STATUS_NEW \| Domain::STATUS_ACTIVE
	\| Domain::STATUS_LDAP_READY \| Domain::STATUS_CONFIRMED
	\| Domain::STATUS_VERIFIED,
	'type' => Domain::TYPE_EXTERNAL,
	]);

	$browser->visit(new DomainPage($domain->id))
	->assertVisible('@domain-info #button-suspend')
	->assertMissing('@domain-info #button-unsuspend')
	->click('@domain-info #button-suspend')
	->assertToast(Toast::TYPE_SUCCESS, 'Domain suspended successfully.')
	->assertSeeIn('@domain-info #status span.text-warning', 'Suspended')
	->assertMissing('@domain-info #button-suspend')
	->click('@domain-info #button-unsuspend')
	->assertToast(Toast::TYPE_SUCCESS, 'Domain unsuspended successfully.')
	->assertSeeIn('@domain-info #status span.text-success', 'Active')
	->assertVisible('@domain-info #button-suspend')
	->assertMissing('@domain-info #button-unsuspend');
	});
	}
	}
	diff --git a/src/tests/Browser/Admin/LogonTest.php b/src/tests/Browser/Admin/LogonTest.php
	index 1d0d11fb..69d7cbbf 100644
	--- a/src/tests/Browser/Admin/LogonTest.php
	+++ b/src/tests/Browser/Admin/LogonTest.php
	@@ -1,145 +1,145 @@
	<?php

	namespace Tests\Browser\Admin;

	use Tests\Browser;
	use Tests\Browser\Components\Menu;
	use Tests\Browser\Components\Toast;
	use Tests\Browser\Pages\Dashboard;
	use Tests\Browser\Pages\Home;
	use Tests\TestCaseDusk;
	use Illuminate\Foundation\Testing\DatabaseMigrations;

	class LogonTest extends TestCaseDusk
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	self::useAdminUrl();
	}

	/**
	* Test menu on logon page
	*/
	public function testLogonMenu(): void
	{
	$this->browse(function (Browser $browser) {
	$browser->visit(new Home())
	->with(new Menu(), function ($browser) {
	$browser->assertMenuItems(['explore', 'blog', 'support', 'login', 'lang']);
	})
	->assertMissing('@second-factor-input')
	->assertMissing('@forgot-password');
	});
	}

	/**
	* Test redirect to /login if user is unauthenticated
	*/
	public function testLogonRedirect(): void
	{
	$this->browse(function (Browser $browser) {
	$browser->visit('/dashboard');

	// Checks if we're really on the login page
	$browser->waitForLocation('/login')
	->on(new Home());
	});
	}

	/**
	* Logon with wrong password/user test
	*/
	public function testLogonWrongCredentials(): void
	{
	$this->browse(function (Browser $browser) {
	$browser->visit(new Home())
	->submitLogon('jeroen@jeroen.jeroen', 'wrong')
	// Error message
	->assertToast(Toast::TYPE_ERROR, 'Invalid username or password.')
	// Checks if we're still on the logon page
	->on(new Home());
	});
	}

	/**
	* Successful logon test
	*/
	public function testLogonSuccessful(): void
	{
	$this->browse(function (Browser $browser) {
	$browser->visit(new Home())
	- ->submitLogon('jeroen@jeroen.jeroen', 'jeroen', true);
	+ ->submitLogon('jeroen@jeroen.jeroen', \App\Utils::generatePassphrase(), true);

	// Checks if we're really on Dashboard page
	$browser->on(new Dashboard())
	->within(new Menu(), function ($browser) {
	$browser->assertMenuItems(['explore', 'blog', 'support', 'dashboard', 'logout', 'lang']);
	})
	->assertUser('jeroen@jeroen.jeroen');

	// Test that visiting '/' with logged in user does not open logon form
	// but "redirects" to the dashboard
	$browser->visit('/')->on(new Dashboard());
	});
	}

	/**
	* Logout test
	*
	* @depends testLogonSuccessful
	*/
	public function testLogout(): void
	{
	$this->browse(function (Browser $browser) {
	$browser->on(new Dashboard());

	// Click the Logout button
	$browser->within(new Menu(), function ($browser) {
	$browser->clickMenuItem('logout');
	});

	// We expect the logon page
	$browser->waitForLocation('/login')
	->on(new Home());

	// with default menu
	$browser->within(new Menu(), function ($browser) {
	$browser->assertMenuItems(['explore', 'blog', 'support', 'login', 'lang']);
	});

	// Success toast message
	$browser->assertToast(Toast::TYPE_SUCCESS, 'Successfully logged out');
	});
	}

	/**
	* Logout by URL test
	*/
	public function testLogoutByURL(): void
	{
	$this->browse(function (Browser $browser) {
	$browser->visit(new Home())
	- ->submitLogon('jeroen@jeroen.jeroen', 'jeroen', true);
	+ ->submitLogon('jeroen@jeroen.jeroen', \App\Utils::generatePassphrase(), true);

	// Checks if we're really on Dashboard page
	$browser->on(new Dashboard());

	// Use /logout url, and expect the logon page
	$browser->visit('/logout')
	->waitForLocation('/login')
	->on(new Home());

	// with default menu
	$browser->within(new Menu(), function ($browser) {
	$browser->assertMenuItems(['explore', 'blog', 'support', 'login', 'lang']);
	});

	// Success toast message
	$browser->assertToast(Toast::TYPE_SUCCESS, 'Successfully logged out');
	});
	}
	}
	diff --git a/src/tests/Browser/Admin/StatsTest.php b/src/tests/Browser/Admin/StatsTest.php
	index 4f524aff..629d6b4b 100644
	--- a/src/tests/Browser/Admin/StatsTest.php
	+++ b/src/tests/Browser/Admin/StatsTest.php
	@@ -1,45 +1,45 @@
	<?php

	namespace Tests\Browser\Admin;

	use Tests\Browser;
	use Tests\Browser\Pages\Admin\Stats;
	use Tests\Browser\Pages\Dashboard;
	use Tests\Browser\Pages\Home;
	use Tests\TestCaseDusk;

	class StatsTest extends TestCaseDusk
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	self::useAdminUrl();
	}

	/**
	* Test Stats page
	*/
	public function testStats(): void
	{
	$this->browse(function (Browser $browser) {
	$browser->visit(new Home())
	- ->submitLogon('jeroen@jeroen.jeroen', 'jeroen', true)
	+ ->submitLogon('jeroen@jeroen.jeroen', \App\Utils::generatePassphrase(), true)
	->on(new Dashboard())
	->assertSeeIn('@links .link-stats', 'Stats')
	->click('@links .link-stats')
	->on(new Stats())
	->assertElementsCount('@container > div', 4)
	->waitFor('@container #chart-users svg')
	->assertSeeIn('@container #chart-users svg .title', 'Users - last 8 weeks')
	->waitFor('@container #chart-users-all svg')
	->assertSeeIn('@container #chart-users-all svg .title', 'All Users - last year')
	->waitFor('@container #chart-income svg')
	->assertSeeIn('@container #chart-income svg .title', 'Income in CHF - last 8 weeks')
	->waitFor('@container #chart-discounts svg')
	->assertSeeIn('@container #chart-discounts svg .title', 'Discounts');
	});
	}
	}
	diff --git a/src/tests/Browser/Admin/UserFinancesTest.php b/src/tests/Browser/Admin/UserFinancesTest.php
	index 0ff4bd73..dcd662cc 100644
	--- a/src/tests/Browser/Admin/UserFinancesTest.php
	+++ b/src/tests/Browser/Admin/UserFinancesTest.php
	@@ -1,325 +1,325 @@
	<?php

	namespace Tests\Browser\Admin;

	use App\Discount;
	use App\Transaction;
	use App\User;
	use App\Wallet;
	use Carbon\Carbon;
	use Tests\Browser;
	use Tests\Browser\Components\Dialog;
	use Tests\Browser\Components\Toast;
	use Tests\Browser\Pages\Admin\User as UserPage;
	use Tests\Browser\Pages\Dashboard;
	use Tests\Browser\Pages\Home;
	use Tests\TestCaseDusk;

	class UserFinancesTest extends TestCaseDusk
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	self::useAdminUrl();

	$john = $this->getTestUser('john@kolab.org');
	$wallet = $john->wallets()->first();
	$wallet->discount()->dissociate();
	$wallet->balance = 0;
	$wallet->save();
	$wallet->setSettings(['mollie_id' => null, 'stripe_id' => null]);
	}

	/**
	* Test Finances tab (and transactions)
	*/
	public function testFinances(): void
	{
	// Assert Jack's Finances tab
	$this->browse(function (Browser $browser) {
	$jack = $this->getTestUser('jack@kolab.org');
	$wallet = $jack->wallets()->first();
	$wallet->transactions()->delete();
	$wallet->setSetting('stripe_id', 'abc');
	$page = new UserPage($jack->id);

	$browser->visit(new Home())
	- ->submitLogon('jeroen@jeroen.jeroen', 'jeroen', true)
	+ ->submitLogon('jeroen@jeroen.jeroen', \App\Utils::generatePassphrase(), true)
	->on(new Dashboard())
	->visit($page)
	->on($page)
	->assertSeeIn('@nav #tab-finances', 'Finances')
	->with('@user-finances', function (Browser $browser) {
	$browser->waitUntilMissing('.app-loader')
	->assertSeeIn('.card-title:first-child', 'Account balance')
	->assertSeeIn('.card-title:first-child .text-success', '0,00 CHF')
	->with('form', function (Browser $browser) {
	$browser->assertElementsCount('.row', 2)
	->assertSeeIn('.row:nth-child(1) label', 'Discount')
	->assertSeeIn('.row:nth-child(1) #discount span', 'none')
	->assertSeeIn('.row:nth-child(2) label', 'Stripe ID')
	->assertSeeIn('.row:nth-child(2) a', 'abc');
	})
	->assertSeeIn('h2:nth-of-type(2)', 'Transactions')
	->with('table', function (Browser $browser) {
	$browser->assertMissing('tbody')
	->assertSeeIn('tfoot td', "There are no transactions for this account.");
	})
	->assertMissing('table + button');
	});
	});

	// Assert John's Finances tab (with discount, and debit)
	$this->browse(function (Browser $browser) {
	$john = $this->getTestUser('john@kolab.org');
	$page = new UserPage($john->id);
	$discount = Discount::where('code', 'TEST')->first();
	$wallet = $john->wallet();
	$wallet->transactions()->delete();
	$wallet->discount()->associate($discount);
	$wallet->debit(2010);
	$wallet->save();

	// Create test transactions
	$transaction = Transaction::create([
	'user_email' => 'jeroen@jeroen.jeroen',
	'object_id' => $wallet->id,
	'object_type' => Wallet::class,
	'type' => Transaction::WALLET_CREDIT,
	'amount' => 100,
	'description' => 'Payment',
	]);
	$transaction->created_at = Carbon::now()->subMonth();
	$transaction->save();

	// Click the managed-by link on Jack's page
	$browser->click('@user-info #manager a')
	->on($page)
	->with('@user-finances', function (Browser $browser) {
	$browser->waitUntilMissing('.app-loader')
	->assertSeeIn('.card-title:first-child', 'Account balance')
	->assertSeeIn('.card-title:first-child .text-danger', '-20,10 CHF')
	->with('form', function (Browser $browser) {
	$browser->assertElementsCount('.row', 1)
	->assertSeeIn('.row:nth-child(1) label', 'Discount')
	->assertSeeIn('.row:nth-child(1) #discount span', '10% - Test voucher');
	})
	->assertSeeIn('h2:nth-of-type(2)', 'Transactions')
	->with('table', function (Browser $browser) {
	$browser->assertElementsCount('tbody tr', 2)
	->assertMissing('tfoot');

	if (!$browser->isPhone()) {
	$browser->assertSeeIn('tbody tr:last-child td.email', 'jeroen@jeroen.jeroen');
	}
	});
	});
	});

	// Now we go to Ned's info page, he's a controller on John's wallet
	$this->browse(function (Browser $browser) {
	$ned = $this->getTestUser('ned@kolab.org');
	$wallet = $ned->wallets()->first();
	$wallet->balance = 0;
	$wallet->save();
	$page = new UserPage($ned->id);

	$browser->click('@nav #tab-users')
	->click('@user-users tbody tr:nth-child(4) td:first-child a')
	->on($page)
	->with('@user-finances', function (Browser $browser) {
	$browser->waitUntilMissing('.app-loader')
	->assertSeeIn('.card-title:first-child', 'Account balance')
	->assertSeeIn('.card-title:first-child .text-success', '0,00 CHF')
	->with('form', function (Browser $browser) {
	$browser->assertElementsCount('.row', 1)
	->assertSeeIn('.row:nth-child(1) label', 'Discount')
	->assertSeeIn('.row:nth-child(1) #discount span', 'none');
	})
	->assertSeeIn('h2:nth-of-type(2)', 'Transactions')
	->with('table', function (Browser $browser) {
	$browser->assertMissing('tbody')
	->assertSeeIn('tfoot td', "There are no transactions for this account.");
	})
	->assertMissing('table + button');
	});
	});
	}

	/**
	* Test editing wallet discount
	*
	* @depends testFinances
	*/
	public function testWalletDiscount(): void
	{
	$this->browse(function (Browser $browser) {
	$john = $this->getTestUser('john@kolab.org');

	$browser->visit(new UserPage($john->id))
	->pause(100)
	->waitUntilMissing('@user-finances .app-loader')
	->click('@user-finances #discount button')
	// Test dialog content, and closing it with Cancel button
	->with(new Dialog('#discount-dialog'), function (Browser $browser) {
	$browser->assertSeeIn('@title', 'Account discount')
	->assertFocused('@body select')
	->assertSelected('@body select', '')
	->assertSeeIn('@button-cancel', 'Cancel')
	->assertSeeIn('@button-action', 'Submit')
	->click('@button-cancel');
	})
	->assertMissing('#discount-dialog')
	->click('@user-finances #discount button')
	// Change the discount
	->with(new Dialog('#discount-dialog'), function (Browser $browser) {
	$browser->click('@body select')
	->click('@body select option:nth-child(2)')
	->click('@button-action');
	})
	->assertToast(Toast::TYPE_SUCCESS, 'User wallet updated successfully.')
	->assertSeeIn('#discount span', '10% - Test voucher')
	->click('@nav #tab-subscriptions')
	->with('@user-subscriptions', function (Browser $browser) {
	- $browser->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '3,99 CHF/month¹')
	+ $browser->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '4,50 CHF/month¹')
	->assertSeeIn('table tbody tr:nth-child(2) td:last-child', '0,00 CHF/month¹')
	- ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '4,99 CHF/month¹')
	+ ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '4,41 CHF/month¹')
	->assertSeeIn('table + .hint', '¹ applied discount: 10% - Test voucher');
	})
	// Change back to 'none'
	->click('@nav #tab-finances')
	->click('@user-finances #discount button')
	->with(new Dialog('#discount-dialog'), function (Browser $browser) {
	$browser->click('@body select')
	->click('@body select option:nth-child(1)')
	->click('@button-action');
	})
	->assertToast(Toast::TYPE_SUCCESS, 'User wallet updated successfully.')
	->assertSeeIn('#discount span', 'none')
	->click('@nav #tab-subscriptions')
	->with('@user-subscriptions', function (Browser $browser) {
	- $browser->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '4,44 CHF/month')
	+ $browser->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '5,00 CHF/month')
	->assertSeeIn('table tbody tr:nth-child(2) td:last-child', '0,00 CHF/month')
	- ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '5,55 CHF/month')
	+ ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '4,90 CHF/month')
	->assertMissing('table + .hint');
	});
	});
	}

	/**
	* Test awarding/penalizing a wallet
	*
	* @depends testFinances
	*/
	public function testBonusPenalty(): void
	{
	$this->browse(function (Browser $browser) {
	$john = $this->getTestUser('john@kolab.org');

	$browser->visit(new UserPage($john->id))
	->waitFor('@user-finances #button-award')
	->click('@user-finances #button-award')
	// Test dialog content, and closing it with Cancel button
	->with(new Dialog('#oneoff-dialog'), function (Browser $browser) {
	$browser->assertSeeIn('@title', 'Add a bonus to the wallet')
	->assertFocused('@body input#oneoff_amount')
	->assertSeeIn('@body label[for="oneoff_amount"]', 'Amount')
	->assertvalue('@body input#oneoff_amount', '')
	->assertSeeIn('@body label[for="oneoff_description"]', 'Description')
	->assertvalue('@body input#oneoff_description', '')
	->assertSeeIn('@button-cancel', 'Cancel')
	->assertSeeIn('@button-action', 'Submit')
	->click('@button-cancel');
	})
	->assertMissing('#oneoff-dialog');

	// Test bonus
	$browser->click('@user-finances #button-award')
	->with(new Dialog('#oneoff-dialog'), function (Browser $browser) {
	// Test input validation for a bonus
	$browser->type('@body #oneoff_amount', 'aaa')
	->type('@body #oneoff_description', '')
	->click('@button-action')
	->assertToast(Toast::TYPE_ERROR, 'Form validation error')
	->assertVisible('@body #oneoff_amount.is-invalid')
	->assertVisible('@body #oneoff_description.is-invalid')
	->assertSeeIn(
	'@body #oneoff_amount + span + .invalid-feedback',
	'The amount must be a number.'
	)
	->assertSeeIn(
	'@body #oneoff_description + .invalid-feedback',
	'The description field is required.'
	);

	// Test adding a bonus
	$browser->type('@body #oneoff_amount', '12.34')
	->type('@body #oneoff_description', 'Test bonus')
	->click('@button-action')
	->assertToast(Toast::TYPE_SUCCESS, 'The bonus has been added to the wallet successfully.');
	})
	->assertMissing('#oneoff-dialog')
	->assertSeeIn('@user-finances .card-title span.text-success', '12,34 CHF')
	->waitUntilMissing('.app-loader')
	->with('table', function (Browser $browser) {
	$browser->assertElementsCount('tbody tr', 3)
	->assertMissing('tfoot')
	->assertSeeIn('tbody tr:first-child td.description', 'Bonus: Test bonus')
	->assertSeeIn('tbody tr:first-child td.price', '12,34 CHF');

	if (!$browser->isPhone()) {
	$browser->assertSeeIn('tbody tr:first-child td.email', 'jeroen@jeroen.jeroen');
	}
	});

	$this->assertSame(1234, $john->wallets()->first()->balance);

	// Test penalty
	$browser->click('@user-finances #button-penalty')
	// Test dialog content, and closing it with Cancel button
	->with(new Dialog('#oneoff-dialog'), function (Browser $browser) {
	$browser->assertSeeIn('@title', 'Add a penalty to the wallet')
	->assertFocused('@body input#oneoff_amount')
	->assertSeeIn('@body label[for="oneoff_amount"]', 'Amount')
	->assertvalue('@body input#oneoff_amount', '')
	->assertSeeIn('@body label[for="oneoff_description"]', 'Description')
	->assertvalue('@body input#oneoff_description', '')
	->assertSeeIn('@button-cancel', 'Cancel')
	->assertSeeIn('@button-action', 'Submit')
	->click('@button-cancel');
	})
	->assertMissing('#oneoff-dialog')
	->click('@user-finances #button-penalty')
	->with(new Dialog('#oneoff-dialog'), function (Browser $browser) {
	// Test input validation for a penalty
	$browser->type('@body #oneoff_amount', '')
	->type('@body #oneoff_description', '')
	->click('@button-action')
	->assertToast(Toast::TYPE_ERROR, 'Form validation error')
	->assertVisible('@body #oneoff_amount.is-invalid')
	->assertVisible('@body #oneoff_description.is-invalid')
	->assertSeeIn(
	'@body #oneoff_amount + span + .invalid-feedback',
	'The amount field is required.'
	)
	->assertSeeIn(
	'@body #oneoff_description + .invalid-feedback',
	'The description field is required.'
	);

	// Test adding a penalty
	$browser->type('@body #oneoff_amount', '12.35')
	->type('@body #oneoff_description', 'Test penalty')
	->click('@button-action')
	->assertToast(Toast::TYPE_SUCCESS, 'The penalty has been added to the wallet successfully.');
	})
	->assertMissing('#oneoff-dialog')
	->assertSeeIn('@user-finances .card-title span.text-danger', '-0,01 CHF');

	$this->assertSame(-1, $john->wallets()->first()->balance);
	});
	}
	}
	diff --git a/src/tests/Browser/Admin/UserTest.php b/src/tests/Browser/Admin/UserTest.php
	index 771200f5..e0924ceb 100644
	--- a/src/tests/Browser/Admin/UserTest.php
	+++ b/src/tests/Browser/Admin/UserTest.php
	@@ -1,498 +1,498 @@
	<?php

	namespace Tests\Browser\Admin;

	use App\Auth\SecondFactor;
	use App\Discount;
	use App\Entitlement;
	use App\Sku;
	use App\User;
	use Tests\Browser;
	use Tests\Browser\Components\Dialog;
	use Tests\Browser\Components\Toast;
	use Tests\Browser\Pages\Admin\User as UserPage;
	use Tests\Browser\Pages\Dashboard;
	use Tests\Browser\Pages\Home;
	use Tests\TestCaseDusk;
	use Illuminate\Foundation\Testing\DatabaseMigrations;

	class UserTest extends TestCaseDusk
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	self::useAdminUrl();

	$john = $this->getTestUser('john@kolab.org');
	$john->setSettings([
	'phone' => '+48123123123',
	'external_email' => 'john.doe.external@gmail.com',
	]);
	if ($john->isSuspended()) {
	User::where('email', $john->email)->update(['status' => $john->status - User::STATUS_SUSPENDED]);
	}
	$wallet = $john->wallets()->first();
	$wallet->discount()->dissociate();
	$wallet->save();

	Entitlement::where('cost', '>=', 5000)->delete();
	$this->deleteTestGroup('group-test@kolab.org');
	$this->clearMeetEntitlements();
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	$john = $this->getTestUser('john@kolab.org');
	$john->setSettings([
	'phone' => null,
	'external_email' => 'john.doe.external@gmail.com',
	]);
	if ($john->isSuspended()) {
	User::where('email', $john->email)->update(['status' => $john->status - User::STATUS_SUSPENDED]);
	}
	$wallet = $john->wallets()->first();
	$wallet->discount()->dissociate();
	$wallet->save();

	Entitlement::where('cost', '>=', 5000)->delete();
	$this->deleteTestGroup('group-test@kolab.org');
	$this->clearMeetEntitlements();

	parent::tearDown();
	}

	/**
	* Test user info page (unauthenticated)
	*/
	public function testUserUnauth(): void
	{
	// Test that the page requires authentication
	$this->browse(function (Browser $browser) {
	$jack = $this->getTestUser('jack@kolab.org');
	$browser->visit('/user/' . $jack->id)->on(new Home());
	});
	}

	/**
	* Test user info page
	*/
	public function testUserInfo(): void
	{
	$this->browse(function (Browser $browser) {
	$jack = $this->getTestUser('jack@kolab.org');
	$page = new UserPage($jack->id);

	$browser->visit(new Home())
	- ->submitLogon('jeroen@jeroen.jeroen', 'jeroen', true)
	+ ->submitLogon('jeroen@jeroen.jeroen', \App\Utils::generatePassphrase(), true)
	->on(new Dashboard())
	->visit($page)
	->on($page);

	// Assert main info box content
	$browser->assertSeeIn('@user-info .card-title', $jack->email)
	->with('@user-info form', function (Browser $browser) use ($jack) {
	$browser->assertElementsCount('.row', 7)
	->assertSeeIn('.row:nth-child(1) label', 'Managed by')
	->assertSeeIn('.row:nth-child(1) #manager a', 'john@kolab.org')
	->assertSeeIn('.row:nth-child(2) label', 'ID (Created)')
	->assertSeeIn('.row:nth-child(2) #userid', "{$jack->id} ({$jack->created_at})")
	->assertSeeIn('.row:nth-child(3) label', 'Status')
	->assertSeeIn('.row:nth-child(3) #status span.text-success', 'Active')
	->assertSeeIn('.row:nth-child(4) label', 'First Name')
	->assertSeeIn('.row:nth-child(4) #first_name', 'Jack')
	->assertSeeIn('.row:nth-child(5) label', 'Last Name')
	->assertSeeIn('.row:nth-child(5) #last_name', 'Daniels')
	->assertSeeIn('.row:nth-child(6) label', 'External Email')
	->assertMissing('.row:nth-child(6) #external_email a')
	->assertSeeIn('.row:nth-child(7) label', 'Country')
	->assertSeeIn('.row:nth-child(7) #country', 'United States');
	});

	// Some tabs are loaded in background, wait a second
	$browser->pause(500)
	->assertElementsCount('@nav a', 6);

	// Note: Finances tab is tested in UserFinancesTest.php
	$browser->assertSeeIn('@nav #tab-finances', 'Finances');

	// Assert Aliases tab
	$browser->assertSeeIn('@nav #tab-aliases', 'Aliases (1)')
	->click('@nav #tab-aliases')
	->whenAvailable('@user-aliases', function (Browser $browser) {
	$browser->assertElementsCount('table tbody tr', 1)
	->assertSeeIn('table tbody tr:first-child td:first-child', 'jack.daniels@kolab.org')
	->assertMissing('table tfoot');
	});

	// Assert Subscriptions tab
	$browser->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (3)')
	->click('@nav #tab-subscriptions')
	->with('@user-subscriptions', function (Browser $browser) {
	$browser->assertElementsCount('table tbody tr', 3)
	->assertSeeIn('table tbody tr:nth-child(1) td:first-child', 'User Mailbox')
	- ->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '4,44 CHF')
	- ->assertSeeIn('table tbody tr:nth-child(2) td:first-child', 'Storage Quota 2 GB')
	+ ->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '5,00 CHF')
	+ ->assertSeeIn('table tbody tr:nth-child(2) td:first-child', 'Storage Quota 5 GB')
	->assertSeeIn('table tbody tr:nth-child(2) td:last-child', '0,00 CHF')
	->assertSeeIn('table tbody tr:nth-child(3) td:first-child', 'Groupware Features')
	- ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '5,55 CHF')
	+ ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '4,90 CHF')
	->assertMissing('table tfoot')
	->assertMissing('#reset2fa');
	});

	// Assert Domains tab
	$browser->assertSeeIn('@nav #tab-domains', 'Domains (0)')
	->click('@nav #tab-domains')
	->with('@user-domains', function (Browser $browser) {
	$browser->assertElementsCount('table tbody tr', 0)
	->assertSeeIn('table tfoot tr td', 'There are no domains in this account.');
	});

	// Assert Users tab
	$browser->assertSeeIn('@nav #tab-users', 'Users (0)')
	->click('@nav #tab-users')
	->with('@user-users', function (Browser $browser) {
	$browser->assertElementsCount('table tbody tr', 0)
	->assertSeeIn('table tfoot tr td', 'There are no users in this account.');
	});

	// Assert Distribution lists tab
	$browser->assertSeeIn('@nav #tab-distlists', 'Distribution lists (0)')
	->click('@nav #tab-distlists')
	->with('@user-distlists', function (Browser $browser) {
	$browser->assertElementsCount('table tbody tr', 0)
	->assertSeeIn('table tfoot tr td', 'There are no distribution lists in this account.');
	});
	});
	}

	/**
	* Test user info page (continue)
	*
	* @depends testUserInfo
	*/
	public function testUserInfo2(): void
	{
	$this->browse(function (Browser $browser) {
	$john = $this->getTestUser('john@kolab.org');
	$page = new UserPage($john->id);
	$discount = Discount::where('code', 'TEST')->first();
	$wallet = $john->wallet();
	$wallet->discount()->associate($discount);
	$wallet->debit(2010);
	$wallet->save();
	$group = $this->getTestGroup('group-test@kolab.org');
	$group->assignToWallet($john->wallets->first());

	// Click the managed-by link on Jack's page
	$browser->click('@user-info #manager a')
	->on($page);

	// Assert main info box content
	$browser->assertSeeIn('@user-info .card-title', $john->email)
	->with('@user-info form', function (Browser $browser) use ($john) {
	$ext_email = $john->getSetting('external_email');

	$browser->assertElementsCount('.row', 9)
	->assertSeeIn('.row:nth-child(1) label', 'ID (Created)')
	->assertSeeIn('.row:nth-child(1) #userid', "{$john->id} ({$john->created_at})")
	->assertSeeIn('.row:nth-child(2) label', 'Status')
	->assertSeeIn('.row:nth-child(2) #status span.text-success', 'Active')
	->assertSeeIn('.row:nth-child(3) label', 'First Name')
	->assertSeeIn('.row:nth-child(3) #first_name', 'John')
	->assertSeeIn('.row:nth-child(4) label', 'Last Name')
	->assertSeeIn('.row:nth-child(4) #last_name', 'Doe')
	->assertSeeIn('.row:nth-child(5) label', 'Organization')
	->assertSeeIn('.row:nth-child(5) #organization', 'Kolab Developers')
	->assertSeeIn('.row:nth-child(6) label', 'Phone')
	->assertSeeIn('.row:nth-child(6) #phone', $john->getSetting('phone'))
	->assertSeeIn('.row:nth-child(7) label', 'External Email')
	->assertSeeIn('.row:nth-child(7) #external_email a', $ext_email)
	->assertAttribute('.row:nth-child(7) #external_email a', 'href', "mailto:$ext_email")
	->assertSeeIn('.row:nth-child(8) label', 'Address')
	->assertSeeIn('.row:nth-child(8) #billing_address', $john->getSetting('billing_address'))
	->assertSeeIn('.row:nth-child(9) label', 'Country')
	->assertSeeIn('.row:nth-child(9) #country', 'United States');
	});

	// Some tabs are loaded in background, wait a second
	$browser->pause(500)
	->assertElementsCount('@nav a', 6);

	// Note: Finances tab is tested in UserFinancesTest.php
	$browser->assertSeeIn('@nav #tab-finances', 'Finances');

	// Assert Aliases tab
	$browser->assertSeeIn('@nav #tab-aliases', 'Aliases (1)')
	->click('@nav #tab-aliases')
	->whenAvailable('@user-aliases', function (Browser $browser) {
	$browser->assertElementsCount('table tbody tr', 1)
	->assertSeeIn('table tbody tr:first-child td:first-child', 'john.doe@kolab.org')
	->assertMissing('table tfoot');
	});

	// Assert Subscriptions tab
	$browser->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (3)')
	->click('@nav #tab-subscriptions')
	->with('@user-subscriptions', function (Browser $browser) {
	$browser->assertElementsCount('table tbody tr', 3)
	->assertSeeIn('table tbody tr:nth-child(1) td:first-child', 'User Mailbox')
	- ->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '3,99 CHF/month¹')
	- ->assertSeeIn('table tbody tr:nth-child(2) td:first-child', 'Storage Quota 2 GB')
	+ ->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '4,50 CHF/month¹')
	+ ->assertSeeIn('table tbody tr:nth-child(2) td:first-child', 'Storage Quota 5 GB')
	->assertSeeIn('table tbody tr:nth-child(2) td:last-child', '0,00 CHF/month¹')
	->assertSeeIn('table tbody tr:nth-child(3) td:first-child', 'Groupware Features')
	- ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '4,99 CHF/month¹')
	+ ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '4,41 CHF/month¹')
	->assertMissing('table tfoot')
	->assertSeeIn('table + .hint', '¹ applied discount: 10% - Test voucher');
	});

	// Assert Domains tab
	$browser->assertSeeIn('@nav #tab-domains', 'Domains (1)')
	->click('@nav #tab-domains')
	->with('@user-domains table', function (Browser $browser) {
	$browser->assertElementsCount('tbody tr', 1)
	->assertSeeIn('tbody tr:nth-child(1) td:first-child a', 'kolab.org')
	->assertVisible('tbody tr:nth-child(1) td:first-child svg.text-success')
	->assertMissing('tfoot');
	});

	// Assert Distribution lists tab
	$browser->assertSeeIn('@nav #tab-distlists', 'Distribution lists (1)')
	->click('@nav #tab-distlists')
	->with('@user-distlists table', function (Browser $browser) {
	$browser->assertElementsCount('tbody tr', 1)
	->assertSeeIn('tbody tr:nth-child(1) td:first-child a', 'group-test@kolab.org')
	->assertVisible('tbody tr:nth-child(1) td:first-child svg.text-danger')
	->assertMissing('tfoot');
	});

	// Assert Users tab
	$browser->assertSeeIn('@nav #tab-users', 'Users (4)')
	->click('@nav #tab-users')
	->with('@user-users table', function (Browser $browser) {
	$browser->assertElementsCount('tbody tr', 4)
	->assertSeeIn('tbody tr:nth-child(1) td:first-child a', 'jack@kolab.org')
	->assertVisible('tbody tr:nth-child(1) td:first-child svg.text-success')
	->assertSeeIn('tbody tr:nth-child(2) td:first-child a', 'joe@kolab.org')
	->assertVisible('tbody tr:nth-child(2) td:first-child svg.text-success')
	->assertSeeIn('tbody tr:nth-child(3) td:first-child span', 'john@kolab.org')
	->assertVisible('tbody tr:nth-child(3) td:first-child svg.text-success')
	->assertSeeIn('tbody tr:nth-child(4) td:first-child a', 'ned@kolab.org')
	->assertVisible('tbody tr:nth-child(4) td:first-child svg.text-success')
	->assertMissing('tfoot');
	});
	});

	// Now we go to Ned's info page, he's a controller on John's wallet
	$this->browse(function (Browser $browser) {
	$ned = $this->getTestUser('ned@kolab.org');
	- $beta_sku = Sku::where('title', 'beta')->first();
	- $storage_sku = Sku::where('title', 'storage')->first();
	+ $beta_sku = Sku::withEnvTenantContext()->where('title', 'beta')->first();
	+ $storage_sku = Sku::withEnvTenantContext()->where('title', 'storage')->first();
	$wallet = $ned->wallet();

	// Add an extra storage and beta entitlement with different prices
	Entitlement::create([
	'wallet_id' => $wallet->id,
	'sku_id' => $beta_sku->id,
	'cost' => 5010,
	'entitleable_id' => $ned->id,
	'entitleable_type' => User::class
	]);
	Entitlement::create([
	'wallet_id' => $wallet->id,
	'sku_id' => $storage_sku->id,
	'cost' => 5000,
	'entitleable_id' => $ned->id,
	'entitleable_type' => User::class
	]);

	$page = new UserPage($ned->id);

	$browser->click('@user-users tbody tr:nth-child(4) td:first-child a')
	->on($page);

	// Assert main info box content
	$browser->assertSeeIn('@user-info .card-title', $ned->email)
	->with('@user-info form', function (Browser $browser) use ($ned) {
	$browser->assertSeeIn('.row:nth-child(2) label', 'ID (Created)')
	->assertSeeIn('.row:nth-child(2) #userid', "{$ned->id} ({$ned->created_at})");
	});

	// Some tabs are loaded in background, wait a second
	$browser->pause(500)
	->assertElementsCount('@nav a', 6);

	// Note: Finances tab is tested in UserFinancesTest.php
	$browser->assertSeeIn('@nav #tab-finances', 'Finances');

	// Assert Aliases tab
	$browser->assertSeeIn('@nav #tab-aliases', 'Aliases (0)')
	->click('@nav #tab-aliases')
	->whenAvailable('@user-aliases', function (Browser $browser) {
	$browser->assertElementsCount('table tbody tr', 0)
	->assertSeeIn('table tfoot tr td', 'This user has no email aliases.');
	});

	// Assert Subscriptions tab, we expect John's discount here
	$browser->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (6)')
	->click('@nav #tab-subscriptions')
	->with('@user-subscriptions', function (Browser $browser) {
	$browser->assertElementsCount('table tbody tr', 6)
	->assertSeeIn('table tbody tr:nth-child(1) td:first-child', 'User Mailbox')
	- ->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '3,99 CHF/month¹')
	- ->assertSeeIn('table tbody tr:nth-child(2) td:first-child', 'Storage Quota 3 GB')
	+ ->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '4,50 CHF/month¹')
	+ ->assertSeeIn('table tbody tr:nth-child(2) td:first-child', 'Storage Quota 6 GB')
	->assertSeeIn('table tbody tr:nth-child(2) td:last-child', '45,00 CHF/month¹')
	->assertSeeIn('table tbody tr:nth-child(3) td:first-child', 'Groupware Features')
	- ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '4,99 CHF/month¹')
	+ ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '4,41 CHF/month¹')
	->assertSeeIn('table tbody tr:nth-child(4) td:first-child', 'Activesync')
	- ->assertSeeIn('table tbody tr:nth-child(4) td:last-child', '0,90 CHF/month¹')
	+ ->assertSeeIn('table tbody tr:nth-child(4) td:last-child', '0,00 CHF/month¹')
	->assertSeeIn('table tbody tr:nth-child(5) td:first-child', '2-Factor Authentication')
	->assertSeeIn('table tbody tr:nth-child(5) td:last-child', '0,00 CHF/month¹')
	->assertSeeIn('table tbody tr:nth-child(6) td:first-child', 'Private Beta (invitation only)')
	->assertSeeIn('table tbody tr:nth-child(6) td:last-child', '45,09 CHF/month¹')
	->assertMissing('table tfoot')
	->assertSeeIn('table + .hint', '¹ applied discount: 10% - Test voucher')
	->assertSeeIn('#reset2fa', 'Reset 2-Factor Auth');
	});

	// We don't expect John's domains here
	$browser->assertSeeIn('@nav #tab-domains', 'Domains (0)')
	->click('@nav #tab-domains')
	->with('@user-domains', function (Browser $browser) {
	$browser->assertElementsCount('table tbody tr', 0)
	->assertSeeIn('table tfoot tr td', 'There are no domains in this account.');
	});

	// We don't expect John's users here
	$browser->assertSeeIn('@nav #tab-users', 'Users (0)')
	->click('@nav #tab-users')
	->with('@user-users', function (Browser $browser) {
	$browser->assertElementsCount('table tbody tr', 0)
	->assertSeeIn('table tfoot tr td', 'There are no users in this account.');
	});

	// We don't expect John's distribution lists here
	$browser->assertSeeIn('@nav #tab-distlists', 'Distribution lists (0)')
	->click('@nav #tab-distlists')
	->with('@user-distlists', function (Browser $browser) {
	$browser->assertElementsCount('table tbody tr', 0)
	->assertSeeIn('table tfoot tr td', 'There are no distribution lists in this account.');
	});
	});
	}

	/**
	* Test editing an external email
	*
	* @depends testUserInfo2
	*/
	public function testExternalEmail(): void
	{
	$this->browse(function (Browser $browser) {
	$john = $this->getTestUser('john@kolab.org');

	$browser->visit(new UserPage($john->id))
	->waitFor('@user-info #external_email button')
	->click('@user-info #external_email button')
	// Test dialog content, and closing it with Cancel button
	->with(new Dialog('#email-dialog'), function (Browser $browser) {
	$browser->assertSeeIn('@title', 'External Email')
	->assertFocused('@body input')
	->assertValue('@body input', 'john.doe.external@gmail.com')
	->assertSeeIn('@button-cancel', 'Cancel')
	->assertSeeIn('@button-action', 'Submit')
	->click('@button-cancel');
	})
	->assertMissing('#email-dialog')
	->click('@user-info #external_email button')
	// Test email validation error handling, and email update
	->with(new Dialog('#email-dialog'), function (Browser $browser) {
	$browser->type('@body input', 'test')
	->click('@button-action')
	->waitFor('@body input.is-invalid')
	->assertSeeIn(
	'@body input + .invalid-feedback',
	'The external email must be a valid email address.'
	)
	->assertToast(Toast::TYPE_ERROR, 'Form validation error')
	->type('@body input', 'test@test.com')
	->click('@button-action');
	})
	->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.')
	->assertSeeIn('@user-info #external_email a', 'test@test.com')
	->click('@user-info #external_email button')
	->with(new Dialog('#email-dialog'), function (Browser $browser) {
	$browser->assertValue('@body input', 'test@test.com')
	->assertMissing('@body input.is-invalid')
	->assertMissing('@body input + .invalid-feedback')
	->click('@button-cancel');
	})
	->assertSeeIn('@user-info #external_email a', 'test@test.com');

	// $john->getSetting() may not work here as it uses internal cache
	// read the value form database
	$current_ext_email = $john->settings()->where('key', 'external_email')->first()->value;
	$this->assertSame('test@test.com', $current_ext_email);
	});
	}

	/**
	* Test suspending/unsuspending the user
	*/
	public function testSuspendAndUnsuspend(): void
	{
	$this->browse(function (Browser $browser) {
	$john = $this->getTestUser('john@kolab.org');

	$browser->visit(new UserPage($john->id))
	->assertVisible('@user-info #button-suspend')
	->assertMissing('@user-info #button-unsuspend')
	->click('@user-info #button-suspend')
	->assertToast(Toast::TYPE_SUCCESS, 'User suspended successfully.')
	->assertSeeIn('@user-info #status span.text-warning', 'Suspended')
	->assertMissing('@user-info #button-suspend')
	->click('@user-info #button-unsuspend')
	->assertToast(Toast::TYPE_SUCCESS, 'User unsuspended successfully.')
	->assertSeeIn('@user-info #status span.text-success', 'Active')
	->assertVisible('@user-info #button-suspend')
	->assertMissing('@user-info #button-unsuspend');
	});
	}

	/**
	* Test resetting 2FA for the user
	*/
	public function testReset2FA(): void
	{
	$this->browse(function (Browser $browser) {
	$this->deleteTestUser('userstest1@kolabnow.com');
	$user = $this->getTestUser('userstest1@kolabnow.com');
	- $sku2fa = Sku::firstOrCreate(['title' => '2fa']);
	+ $sku2fa = Sku::withEnvTenantContext()->where('title', '2fa')->first();
	$user->assignSku($sku2fa);
	SecondFactor::seed('userstest1@kolabnow.com');

	$browser->visit(new UserPage($user->id))
	->click('@nav #tab-subscriptions')
	->with('@user-subscriptions', function (Browser $browser) use ($sku2fa) {
	$browser->waitFor('#reset2fa')
	->assertVisible('#sku' . $sku2fa->id);
	})
	->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (1)')
	->click('#reset2fa')
	->with(new Dialog('#reset-2fa-dialog'), function (Browser $browser) {
	$browser->assertSeeIn('@title', '2-Factor Authentication Reset')
	->assertSeeIn('@button-cancel', 'Cancel')
	->assertSeeIn('@button-action', 'Reset')
	->click('@button-action');
	})
	->assertToast(Toast::TYPE_SUCCESS, '2-Factor authentication reset successfully.')
	->assertMissing('#sku' . $sku2fa->id)
	->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (0)');
	});
	}
	}
	diff --git a/src/tests/Browser/Components/QuotaInput.php b/src/tests/Browser/Components/QuotaInput.php
	index b65ab5d2..9ee63331 100644
	--- a/src/tests/Browser/Components/QuotaInput.php
	+++ b/src/tests/Browser/Components/QuotaInput.php
	@@ -1,88 +1,88 @@
	<?php

	namespace Tests\Browser\Components;

	use Laravel\Dusk\Component as BaseComponent;
	use PHPUnit\Framework\Assert as PHPUnit;

	class QuotaInput extends BaseComponent
	{
	protected $selector;


	public function __construct($selector)
	{
	$this->selector = trim($selector);
	}

	/**
	* Get the root selector for the component.
	*
	* @return string
	*/
	public function selector()
	{
	return $this->selector;
	}

	/**
	* Assert that the browser page contains the component.
	*
	* @param \Laravel\Dusk\Browser $browser
	*
	* @return void
	*/
	public function assert($browser)
	{
	$browser->waitFor($this->selector() . ' input[type=range]');
	}

	/**
	* Assert input value
	*
	* @param \Laravel\Dusk\Browser $browser The browser
	* @param int $value Value in GB
	*
	* @return void
	*/
	public function assertQuotaValue($browser, $value)
	{
	$browser->assertValue('@input', $value)
	->assertSeeIn('@label', "$value GB");
	}

	/**
	* Get the element shortcuts for the component.
	*
	* @return array
	*/
	public function elements()
	{
	return [
	'@label' => 'label',
	'@input' => 'input',
	];
	}

	/**
	* Set input value
	*
	* @param \Laravel\Dusk\Browser $browser The browser
	* @param int $value Value in GB
	*
	* @return void
	*/
	public function setQuotaValue($browser, $value)
	{
	// Use keyboard because ->value() does not work here
	$browser->click('@input')->keys('@input', '{home}');

	- $num = $value - 2;
	+ $num = $value - 5;
	while ($num > 0) {
	$browser->keys('@input', '{arrow_right}');
	$num--;
	}

	$browser->assertSeeIn('@label', "$value GB");
	}
	}
	diff --git a/src/tests/Browser/Reseller/DashboardTest.php b/src/tests/Browser/Reseller/DashboardTest.php
	index 4493c81e..c4e77a1e 100644
	--- a/src/tests/Browser/Reseller/DashboardTest.php
	+++ b/src/tests/Browser/Reseller/DashboardTest.php
	@@ -1,140 +1,140 @@
	<?php

	namespace Tests\Browser\Reseller;

	use Illuminate\Support\Facades\Queue;
	use Tests\Browser;
	use Tests\Browser\Components\Toast;
	use Tests\Browser\Pages\Dashboard;
	use Tests\Browser\Pages\Home;
	use Tests\TestCaseDusk;

	class DashboardTest extends TestCaseDusk
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	self::useResellerUrl();

	$jack = $this->getTestUser('jack@kolab.org');
	$jack->setSetting('external_email', null);

	$this->deleteTestUser('test@testsearch.com');
	$this->deleteTestDomain('testsearch.com');
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	$jack = $this->getTestUser('jack@kolab.org');
	$jack->setSetting('external_email', null);

	$this->deleteTestUser('test@testsearch.com');
	$this->deleteTestDomain('testsearch.com');

	parent::tearDown();
	}

	/**
	* Test user search
	*/
	public function testSearch(): void
	{
	$this->browse(function (Browser $browser) {
	$browser->visit(new Home())
	- ->submitLogon('reseller@kolabnow.com', 'reseller', true)
	+ ->submitLogon('reseller@' . \config('app.domain'), \App\Utils::generatePassphrase(), true)
	->on(new Dashboard())
	->assertFocused('@search input')
	->assertMissing('@search table');

	// Test search with no results
	$browser->type('@search input', 'unknown')
	->click('@search form button')
	->assertToast(Toast::TYPE_INFO, '0 user accounts have been found.')
	->assertMissing('@search table');

	$john = $this->getTestUser('john@kolab.org');
	$jack = $this->getTestUser('jack@kolab.org');
	$jack->setSetting('external_email', 'john.doe.external@gmail.com');

	// Test search with multiple results
	$browser->type('@search input', 'john.doe.external@gmail.com')
	->click('@search form button')
	->assertToast(Toast::TYPE_INFO, '2 user accounts have been found.')
	->whenAvailable('@search table', function (Browser $browser) use ($john, $jack) {
	$browser->assertElementsCount('tbody tr', 2)
	->with('tbody tr:first-child', function (Browser $browser) use ($jack) {
	$browser->assertSeeIn('td:nth-child(1) a', $jack->email)
	->assertSeeIn('td:nth-child(2) a', $jack->id)
	->assertVisible('td:nth-child(3)')
	->assertTextRegExp('td:nth-child(3)', '/^[0-9]{4}-[0-9]{2}-[0-9]{2}$/')
	->assertVisible('td:nth-child(4)')
	->assertText('td:nth-child(4)', '');
	})
	->with('tbody tr:last-child', function (Browser $browser) use ($john) {
	$browser->assertSeeIn('td:nth-child(1) a', $john->email)
	->assertSeeIn('td:nth-child(2) a', $john->id)
	->assertVisible('td:nth-child(3)')
	->assertTextRegExp('td:nth-child(3)', '/^[0-9]{4}-[0-9]{2}-[0-9]{2}$/')
	->assertVisible('td:nth-child(4)')
	->assertText('td:nth-child(4)', '');
	});
	});

	// Test search with single record result -> redirect to user page
	$browser->type('@search input', 'kolab.org')
	->click('@search form button')
	->assertMissing('@search table')
	->waitForLocation('/user/' . $john->id)
	->waitUntilMissing('.app-loader')
	->whenAvailable('#user-info', function (Browser $browser) use ($john) {
	$browser->assertSeeIn('.card-title', $john->email);
	});
	});
	}

	/**
	* Test user search deleted user/domain
	*/
	public function testSearchDeleted(): void
	{
	$this->browse(function (Browser $browser) {
	$browser->visit(new Home())
	- ->submitLogon('reseller@kolabnow.com', 'reseller', true)
	+ ->submitLogon('reseller@' . \config('app.domain'), \App\Utils::generatePassphrase(), true)
	->on(new Dashboard())
	->assertFocused('@search input')
	->assertMissing('@search table');

	// Deleted users/domains
	$domain = $this->getTestDomain('testsearch.com', ['type' => \App\Domain::TYPE_EXTERNAL]);
	$user = $this->getTestUser('test@testsearch.com');
	$plan = \App\Plan::where('title', 'group')->first();
	$user->assignPlan($plan, $domain);
	$user->setAliases(['alias@testsearch.com']);
	Queue::fake();
	$user->delete();

	// Test search with multiple results
	$browser->type('@search input', 'testsearch.com')
	->click('@search form button')
	->assertToast(Toast::TYPE_INFO, '1 user accounts have been found.')
	->whenAvailable('@search table', function (Browser $browser) use ($user) {
	$browser->assertElementsCount('tbody tr', 1)
	->assertVisible('tbody tr:first-child.text-secondary')
	->with('tbody tr:first-child', function (Browser $browser) use ($user) {
	$browser->assertSeeIn('td:nth-child(1) span', $user->email)
	->assertSeeIn('td:nth-child(2) span', $user->id)
	->assertVisible('td:nth-child(3)')
	->assertTextRegExp('td:nth-child(3)', '/^[0-9]{4}-[0-9]{2}-[0-9]{2}$/')
	->assertVisible('td:nth-child(4)')
	->assertTextRegExp('td:nth-child(4)', '/^[0-9]{4}-[0-9]{2}-[0-9]{2}$/');
	});
	});
	});
	}
	}
	diff --git a/src/tests/Browser/Reseller/DistlistTest.php b/src/tests/Browser/Reseller/DistlistTest.php
	index 637d8fd6..eda38300 100644
	--- a/src/tests/Browser/Reseller/DistlistTest.php
	+++ b/src/tests/Browser/Reseller/DistlistTest.php
	@@ -1,128 +1,128 @@
	<?php

	namespace Tests\Browser\Reseller;

	use App\Group;
	use Illuminate\Support\Facades\Queue;
	use Tests\Browser;
	use Tests\Browser\Components\Toast;
	use Tests\Browser\Pages\Admin\Distlist as DistlistPage;
	use Tests\Browser\Pages\Admin\User as UserPage;
	use Tests\Browser\Pages\Dashboard;
	use Tests\Browser\Pages\Home;
	use Tests\TestCaseDusk;

	class DistlistTest extends TestCaseDusk
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	self::useResellerUrl();

	$this->deleteTestGroup('group-test@kolab.org');
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	$this->deleteTestGroup('group-test@kolab.org');

	parent::tearDown();
	}

	/**
	* Test distlist info page (unauthenticated)
	*/
	public function testDistlistUnauth(): void
	{
	// Test that the page requires authentication
	$this->browse(function (Browser $browser) {
	$user = $this->getTestUser('john@kolab.org');
	$group = $this->getTestGroup('group-test@kolab.org');
	$group->assignToWallet($user->wallets->first());

	$browser->visit('/distlist/' . $group->id)->on(new Home());
	});
	}

	/**
	* Test distribution list info page
	*/
	public function testInfo(): void
	{
	Queue::fake();

	$this->browse(function (Browser $browser) {
	$user = $this->getTestUser('john@kolab.org');
	$group = $this->getTestGroup('group-test@kolab.org');
	$group->assignToWallet($user->wallets->first());
	$group->members = ['test1@gmail.com', 'test2@gmail.com'];
	$group->save();

	$distlist_page = new DistlistPage($group->id);
	$user_page = new UserPage($user->id);

	// Goto the distlist page
	$browser->visit(new Home())
	- ->submitLogon('reseller@kolabnow.com', 'reseller', true)
	+ ->submitLogon('reseller@' . \config('app.domain'), \App\Utils::generatePassphrase(), true)
	->on(new Dashboard())
	->visit($user_page)
	->on($user_page)
	->click('@nav #tab-distlists')
	->pause(1000)
	->click('@user-distlists table tbody tr:first-child td a')
	->on($distlist_page)
	->assertSeeIn('@distlist-info .card-title', $group->email)
	->with('@distlist-info form', function (Browser $browser) use ($group) {
	$browser->assertElementsCount('.row', 3)
	->assertSeeIn('.row:nth-child(1) label', 'ID (Created)')
	->assertSeeIn('.row:nth-child(1) #distlistid', "{$group->id} ({$group->created_at})")
	->assertSeeIn('.row:nth-child(2) label', 'Status')
	->assertSeeIn('.row:nth-child(2) #status.text-danger', 'Not Ready')
	->assertSeeIn('.row:nth-child(3) label', 'Recipients')
	->assertSeeIn('.row:nth-child(3) #members', $group->members[0])
	->assertSeeIn('.row:nth-child(3) #members', $group->members[1]);
	});

	// Test invalid group identifier
	$browser->visit('/distlist/abc')->assertErrorPage(404);
	});
	}

	/**
	* Test suspending/unsuspending a distribution list
	*
	* @depends testInfo
	*/
	public function testSuspendAndUnsuspend(): void
	{
	Queue::fake();

	$this->browse(function (Browser $browser) {
	$user = $this->getTestUser('john@kolab.org');
	$group = $this->getTestGroup('group-test@kolab.org');
	$group->assignToWallet($user->wallets->first());
	$group->status = Group::STATUS_ACTIVE \| Group::STATUS_LDAP_READY;
	$group->save();

	$browser->visit(new DistlistPage($group->id))
	->assertVisible('@distlist-info #button-suspend')
	->assertMissing('@distlist-info #button-unsuspend')
	->assertSeeIn('@distlist-info #status.text-success', 'Active')
	->click('@distlist-info #button-suspend')
	->assertToast(Toast::TYPE_SUCCESS, 'Distribution list suspended successfully.')
	->assertSeeIn('@distlist-info #status.text-warning', 'Suspended')
	->assertMissing('@distlist-info #button-suspend')
	->click('@distlist-info #button-unsuspend')
	->assertToast(Toast::TYPE_SUCCESS, 'Distribution list unsuspended successfully.')
	->assertSeeIn('@distlist-info #status.text-success', 'Active')
	->assertVisible('@distlist-info #button-suspend')
	->assertMissing('@distlist-info #button-unsuspend');
	});
	}
	}
	diff --git a/src/tests/Browser/Reseller/DomainTest.php b/src/tests/Browser/Reseller/DomainTest.php
	index 405456bc..2d6ea5ef 100644
	--- a/src/tests/Browser/Reseller/DomainTest.php
	+++ b/src/tests/Browser/Reseller/DomainTest.php
	@@ -1,120 +1,120 @@
	<?php

	namespace Tests\Browser\Reseller;

	use App\Domain;
	use Tests\Browser;
	use Tests\Browser\Components\Toast;
	use Tests\Browser\Pages\Admin\Domain as DomainPage;
	use Tests\Browser\Pages\Admin\User as UserPage;
	use Tests\Browser\Pages\Dashboard;
	use Tests\Browser\Pages\Home;
	use Tests\TestCaseDusk;
	use Illuminate\Foundation\Testing\DatabaseMigrations;

	class DomainTest extends TestCaseDusk
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	self::useResellerUrl();
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	parent::tearDown();
	}

	/**
	* Test domain info page (unauthenticated)
	*/
	public function testDomainUnauth(): void
	{
	// Test that the page requires authentication
	$this->browse(function (Browser $browser) {
	$domain = $this->getTestDomain('kolab.org');
	$browser->visit('/domain/' . $domain->id)->on(new Home());
	});
	}

	/**
	* Test domain info page
	*/
	public function testDomainInfo(): void
	{
	$this->browse(function (Browser $browser) {
	$domain = $this->getTestDomain('kolab.org');
	$domain_page = new DomainPage($domain->id);
	- $reseller = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller = $this->getTestUser('reseller@' . \config('app.domain'));
	$user = $this->getTestUser('john@kolab.org');
	$user_page = new UserPage($user->id);

	// Goto the domain page
	$browser->visit(new Home())
	- ->submitLogon('reseller@kolabnow.com', 'reseller', true)
	+ ->submitLogon('reseller@' . \config('app.domain'), \App\Utils::generatePassphrase(), true)
	->on(new Dashboard())
	->visit($user_page)
	->on($user_page)
	->click('@nav #tab-domains')
	->pause(1000)
	->click('@user-domains table tbody tr:first-child td a');

	$browser->on($domain_page)
	->assertSeeIn('@domain-info .card-title', 'kolab.org')
	->with('@domain-info form', function (Browser $browser) use ($domain) {
	$browser->assertElementsCount('.row', 2)
	->assertSeeIn('.row:nth-child(1) label', 'ID (Created)')
	->assertSeeIn('.row:nth-child(1) #domainid', "{$domain->id} ({$domain->created_at})")
	->assertSeeIn('.row:nth-child(2) label', 'Status')
	->assertSeeIn('.row:nth-child(2) #status span.text-success', 'Active');
	});

	// Some tabs are loaded in background, wait a second
	$browser->pause(500)
	->assertElementsCount('@nav a', 1);

	// Assert Configuration tab
	$browser->assertSeeIn('@nav #tab-config', 'Configuration')
	->with('@domain-config', function (Browser $browser) {
	$browser->assertSeeIn('pre#dns-verify', 'kolab-verify.kolab.org.')
	->assertSeeIn('pre#dns-config', 'kolab.org.');
	});
	});
	}

	/**
	* Test suspending/unsuspending a domain
	*
	* @depends testDomainInfo
	*/
	public function testSuspendAndUnsuspend(): void
	{
	$this->browse(function (Browser $browser) {
	$domain = $this->getTestDomain('domainscontroller.com', [
	'status' => Domain::STATUS_NEW \| Domain::STATUS_ACTIVE
	\| Domain::STATUS_LDAP_READY \| Domain::STATUS_CONFIRMED
	\| Domain::STATUS_VERIFIED,
	'type' => Domain::TYPE_EXTERNAL,
	]);

	$browser->visit(new DomainPage($domain->id))
	->assertVisible('@domain-info #button-suspend')
	->assertMissing('@domain-info #button-unsuspend')
	->click('@domain-info #button-suspend')
	->assertToast(Toast::TYPE_SUCCESS, 'Domain suspended successfully.')
	->assertSeeIn('@domain-info #status span.text-warning', 'Suspended')
	->assertMissing('@domain-info #button-suspend')
	->click('@domain-info #button-unsuspend')
	->assertToast(Toast::TYPE_SUCCESS, 'Domain unsuspended successfully.')
	->assertSeeIn('@domain-info #status span.text-success', 'Active')
	->assertVisible('@domain-info #button-suspend')
	->assertMissing('@domain-info #button-unsuspend');
	});
	}
	}
	diff --git a/src/tests/Browser/Reseller/InvitationsTest.php b/src/tests/Browser/Reseller/InvitationsTest.php
	index 8d43bb90..9b4e9000 100644
	--- a/src/tests/Browser/Reseller/InvitationsTest.php
	+++ b/src/tests/Browser/Reseller/InvitationsTest.php
	@@ -1,222 +1,222 @@
	<?php

	namespace Tests\Browser\Reseller;

	use App\SignupInvitation;
	use Illuminate\Support\Facades\Queue;
	use Tests\Browser;
	use Tests\Browser\Components\Dialog;
	use Tests\Browser\Components\Menu;
	use Tests\Browser\Components\Toast;
	use Tests\Browser\Pages\Dashboard;
	use Tests\Browser\Pages\Home;
	use Tests\Browser\Pages\Reseller\Invitations;
	use Tests\TestCaseDusk;

	class InvitationsTest extends TestCaseDusk
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	self::useResellerUrl();
	SignupInvitation::truncate();
	}

	/**
	* Test invitations page (unauthenticated)
	*/
	public function testInvitationsUnauth(): void
	{
	// Test that the page requires authentication
	$this->browse(function (Browser $browser) {
	$browser->visit('/invitations')->on(new Home());
	});
	}

	/**
	* Test Invitations creation
	*/
	public function testInvitationCreate(): void
	{
	$this->browse(function (Browser $browser) {
	$date_regexp = '/^20[0-9]{2}-/';

	$browser->visit(new Home())
	- ->submitLogon('reseller@kolabnow.com', 'reseller', true)
	+ ->submitLogon('reseller@' . \config('app.domain'), \App\Utils::generatePassphrase(), true)
	->on(new Dashboard())
	->assertSeeIn('@links .link-invitations', 'Invitations')
	->click('@links .link-invitations')
	->on(new Invitations())
	->assertElementsCount('@table tbody tr', 0)
	->assertMissing('#more-loader')
	->assertSeeIn('@table tfoot td', "There are no invitations in the database.")
	->assertSeeIn('@create-button', 'Create invite(s)');

	// Create a single invite with email address input
	$browser->click('@create-button')
	->with(new Dialog('#invite-create'), function (Browser $browser) {
	$browser->assertSeeIn('@title', 'Invite for a signup')
	->assertFocused('@body input#email')
	->assertValue('@body input#email', '')
	->type('@body input#email', 'test')
	->assertSeeIn('@button-action', 'Send invite(s)')
	->click('@button-action')
	->assertToast(Toast::TYPE_ERROR, "Form validation error")
	->waitFor('@body input#email.is-invalid')
	->assertSeeIn(
	'@body input#email.is-invalid + .invalid-feedback',
	"The email must be a valid email address."
	)
	->type('@body input#email', 'test@domain.tld')
	->click('@button-action');
	})
	->assertToast(Toast::TYPE_SUCCESS, "The invitation has been created.")
	->waitUntilMissing('#invite-create')
	->waitUntilMissing('@table .app-loader')
	->assertElementsCount('@table tbody tr', 1)
	->assertMissing('@table tfoot')
	->assertSeeIn('@table tbody tr td.email', 'test@domain.tld')
	->assertText('@table tbody tr td.email title', 'Not sent yet')
	->assertTextRegExp('@table tbody tr td.datetime', $date_regexp)
	->assertVisible('@table tbody tr td.buttons button.button-delete')
	->assertVisible('@table tbody tr td.buttons button.button-resend:disabled');

	sleep(1);

	// Create invites from a file
	$browser->click('@create-button')
	->with(new Dialog('#invite-create'), function (Browser $browser) {
	$browser->assertFocused('@body input#email')
	->assertValue('@body input#email', '')
	->assertMissing('@body input#email.is-invalid')
	// Submit an empty file
	->attach('@body input#file', __DIR__ . '/../../data/empty.csv')
	->assertSeeIn('@body input#file + label', 'empty.csv')
	->click('@button-action')
	->assertToast(Toast::TYPE_ERROR, "Form validation error")
	// ->waitFor('input#file.is-invalid')
	->assertSeeIn(
	'@body input#file.is-invalid + label + .invalid-feedback',
	"Failed to find any valid email addresses in the uploaded file."
	)
	// Submit non-empty file
	->attach('@body input#file', __DIR__ . '/../../data/email.csv')
	->click('@button-action');
	})
	->assertToast(Toast::TYPE_SUCCESS, "2 invitations has been created.")
	->waitUntilMissing('#invite-create')
	->waitUntilMissing('@table .app-loader')
	->assertElementsCount('@table tbody tr', 3)
	->assertTextRegExp('@table tbody tr:nth-child(1) td.email', '/email[12]@test\.com$/')
	->assertTextRegExp('@table tbody tr:nth-child(2) td.email', '/email[12]@test\.com$/');
	});
	}

	/**
	* Test Invitations deletion and resending
	*/
	public function testInvitationDeleteAndResend(): void
	{
	$this->browse(function (Browser $browser) {
	Queue::fake();
	$i1 = SignupInvitation::create(['email' => 'test1@domain.org']);
	$i2 = SignupInvitation::create(['email' => 'test2@domain.org']);
	SignupInvitation::where('id', $i2->id)
	->update(['created_at' => now()->subHours('2'), 'status' => SignupInvitation::STATUS_FAILED]);

	// Test deleting
	$browser->visit(new Invitations())
	- // ->submitLogon('reseller@kolabnow.com', 'reseller', true)
	+ // ->submitLogon('reseller@' . \config('app.domain'), \App\Utils::generatePassphrase(), true)
	->assertElementsCount('@table tbody tr', 2)
	->click('@table tbody tr:first-child button.button-delete')
	->assertToast(Toast::TYPE_SUCCESS, "Invitation deleted successfully.")
	->assertElementsCount('@table tbody tr', 1);

	// Test resending
	$browser->click('@table tbody tr:first-child button.button-resend')
	->assertToast(Toast::TYPE_SUCCESS, "Invitation added to the sending queue successfully.")
	->assertElementsCount('@table tbody tr', 1);
	});
	}

	/**
	* Test Invitations list (paging and searching)
	*/
	public function testInvitationsList(): void
	{
	$this->browse(function (Browser $browser) {
	Queue::fake();
	$i1 = SignupInvitation::create(['email' => 'email1@ext.com']);
	$i2 = SignupInvitation::create(['email' => 'email2@ext.com']);
	$i3 = SignupInvitation::create(['email' => 'email3@ext.com']);
	$i4 = SignupInvitation::create(['email' => 'email4@other.com']);
	$i5 = SignupInvitation::create(['email' => 'email5@other.com']);
	$i6 = SignupInvitation::create(['email' => 'email6@other.com']);
	$i7 = SignupInvitation::create(['email' => 'email7@other.com']);
	$i8 = SignupInvitation::create(['email' => 'email8@other.com']);
	$i9 = SignupInvitation::create(['email' => 'email9@other.com']);
	$i10 = SignupInvitation::create(['email' => 'email10@other.com']);
	$i11 = SignupInvitation::create(['email' => 'email11@other.com']);

	SignupInvitation::query()->update(['created_at' => now()->subDays('1')]);
	SignupInvitation::where('id', $i1->id)
	->update(['created_at' => now()->subHours('2'), 'status' => SignupInvitation::STATUS_FAILED]);
	SignupInvitation::where('id', $i2->id)
	->update(['created_at' => now()->subHours('3'), 'status' => SignupInvitation::STATUS_SENT]);
	SignupInvitation::where('id', $i3->id)
	->update(['created_at' => now()->subHours('4'), 'status' => SignupInvitation::STATUS_COMPLETED]);
	SignupInvitation::where('id', $i11->id)->update(['created_at' => now()->subDays('3')]);

	// Test paging (load more) feature
	$browser->visit(new Invitations())
	- // ->submitLogon('reseller@kolabnow.com', 'reseller', true)
	+ // ->submitLogon('reseller@' . \config('app.domain'), \App\Utils::generatePassphrase(), true)
	->assertElementsCount('@table tbody tr', 10)
	->assertSeeIn('#more-loader button', 'Load more')
	->with('@table tbody', function ($browser) use ($i1, $i2, $i3) {
	$browser->assertSeeIn('tr:nth-child(1) td.email', $i1->email)
	->assertText('tr:nth-child(1) td.email svg.text-danger title', 'Sending failed')
	->assertVisible('tr:nth-child(1) td.buttons button.button-delete')
	->assertVisible('tr:nth-child(1) td.buttons button.button-resend:not(:disabled)')
	->assertSeeIn('tr:nth-child(2) td.email', $i2->email)
	->assertText('tr:nth-child(2) td.email svg.text-primary title', 'Sent')
	->assertVisible('tr:nth-child(2) td.buttons button.button-delete')
	->assertVisible('tr:nth-child(2) td.buttons button.button-resend:not(:disabled)')
	->assertSeeIn('tr:nth-child(3) td.email', $i3->email)
	->assertText('tr:nth-child(3) td.email svg.text-success title', 'User signed up')
	->assertVisible('tr:nth-child(3) td.buttons button.button-delete')
	->assertVisible('tr:nth-child(3) td.buttons button.button-resend:disabled')
	->assertText('tr:nth-child(4) td.email svg title', 'Not sent yet')
	->assertVisible('tr:nth-child(4) td.buttons button.button-delete')
	->assertVisible('tr:nth-child(4) td.buttons button.button-resend:disabled');
	})
	->click('#more-loader button')
	->whenAvailable('@table tbody tr:nth-child(11)', function ($browser) use ($i11) {
	$browser->assertSeeIn('td.email', $i11->email);
	})
	->assertMissing('#more-loader button');

	// Test searching (by domain)
	$browser->type('@search-input', 'ext.com')
	->click('@search-button')
	->waitUntilMissing('@table .app-loader')
	->assertElementsCount('@table tbody tr', 3)
	->assertMissing('#more-loader button')
	// search by full email
	->type('@search-input', 'email7@other.com')
	->keys('@search-input', '{enter}')
	->waitUntilMissing('@table .app-loader')
	->assertElementsCount('@table tbody tr', 1)
	->assertSeeIn('@table tbody tr:nth-child(1) td.email', 'email7@other.com')
	->assertMissing('#more-loader button')
	// reset search
	->vueClear('#search-form input')
	->keys('@search-input', '{enter}')
	->waitUntilMissing('@table .app-loader')
	->assertElementsCount('@table tbody tr', 10)
	->assertVisible('#more-loader button');
	});
	}
	}
	diff --git a/src/tests/Browser/Reseller/LogonTest.php b/src/tests/Browser/Reseller/LogonTest.php
	index 656904e7..86ae87ac 100644
	--- a/src/tests/Browser/Reseller/LogonTest.php
	+++ b/src/tests/Browser/Reseller/LogonTest.php
	@@ -1,144 +1,144 @@
	<?php

	namespace Tests\Browser\Reseller;

	use Tests\Browser;
	use Tests\Browser\Components\Menu;
	use Tests\Browser\Components\Toast;
	use Tests\Browser\Pages\Dashboard;
	use Tests\Browser\Pages\Home;
	use Tests\TestCaseDusk;

	class LogonTest extends TestCaseDusk
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	self::useResellerUrl();
	}

	/**
	* Test menu on logon page
	*/
	public function testLogonMenu(): void
	{
	$this->browse(function (Browser $browser) {
	$browser->visit(new Home())
	->with(new Menu(), function ($browser) {
	$browser->assertMenuItems(['explore', 'blog', 'support', 'login', 'lang']);
	})
	->assertMissing('@second-factor-input')
	->assertMissing('@forgot-password');
	});
	}

	/**
	* Test redirect to /login if user is unauthenticated
	*/
	public function testLogonRedirect(): void
	{
	$this->browse(function (Browser $browser) {
	$browser->visit('/dashboard');

	// Checks if we're really on the login page
	$browser->waitForLocation('/login')
	->on(new Home());
	});
	}

	/**
	* Logon with wrong password/user test
	*/
	public function testLogonWrongCredentials(): void
	{
	$this->browse(function (Browser $browser) {
	$browser->visit(new Home())
	- ->submitLogon('reseller@reseller.com', 'wrong')
	+ ->submitLogon('reseller@' . \config('app.domain'), 'wrong')
	// Error message
	->assertToast(Toast::TYPE_ERROR, 'Invalid username or password.')
	// Checks if we're still on the logon page
	->on(new Home());
	});
	}

	/**
	* Successful logon test
	*/
	public function testLogonSuccessful(): void
	{
	$this->browse(function (Browser $browser) {
	$browser->visit(new Home())
	- ->submitLogon('reseller@reseller.com', 'reseller', true);
	+ ->submitLogon('reseller@' . \config('app.domain'), \App\Utils::generatePassphrase(), true);

	// Checks if we're really on Dashboard page
	$browser->on(new Dashboard())
	->within(new Menu(), function ($browser) {
	$browser->assertMenuItems(['explore', 'blog', 'support', 'dashboard', 'logout', 'lang']);
	})
	- ->assertUser('reseller@reseller.com');
	+ ->assertUser('reseller@' . \config('app.domain'));

	// Test that visiting '/' with logged in user does not open logon form
	// but "redirects" to the dashboard
	$browser->visit('/')->on(new Dashboard());
	});
	}

	/**
	* Logout test
	*
	* @depends testLogonSuccessful
	*/
	public function testLogout(): void
	{
	$this->browse(function (Browser $browser) {
	$browser->on(new Dashboard());

	// Click the Logout button
	$browser->within(new Menu(), function ($browser) {
	$browser->clickMenuItem('logout');
	});

	// We expect the logon page
	$browser->waitForLocation('/login')
	->on(new Home());

	// with default menu
	$browser->within(new Menu(), function ($browser) {
	$browser->assertMenuItems(['explore', 'blog', 'support', 'login', 'lang']);
	});

	// Success toast message
	$browser->assertToast(Toast::TYPE_SUCCESS, 'Successfully logged out');
	});
	}

	/**
	* Logout by URL test
	*/
	public function testLogoutByURL(): void
	{
	$this->browse(function (Browser $browser) {
	$browser->visit(new Home())
	- ->submitLogon('reseller@reseller.com', 'reseller', true);
	+ ->submitLogon('reseller@' . \config('app.domain'), \App\Utils::generatePassphrase(), true);

	// Checks if we're really on Dashboard page
	$browser->on(new Dashboard());

	// Use /logout url, and expect the logon page
	$browser->visit('/logout')
	->waitForLocation('/login')
	->on(new Home());

	// with default menu
	$browser->within(new Menu(), function ($browser) {
	$browser->assertMenuItems(['explore', 'blog', 'support', 'login', 'lang']);
	});

	// Success toast message
	$browser->assertToast(Toast::TYPE_SUCCESS, 'Successfully logged out');
	});
	}
	}
	diff --git a/src/tests/Browser/Reseller/PaymentMollieTest.php b/src/tests/Browser/Reseller/PaymentMollieTest.php
	index 7bb9ef29..b948502f 100644
	--- a/src/tests/Browser/Reseller/PaymentMollieTest.php
	+++ b/src/tests/Browser/Reseller/PaymentMollieTest.php
	@@ -1,116 +1,116 @@
	<?php

	namespace Tests\Browser\Reseller;

	use App\Providers\PaymentProvider;
	use App\Wallet;
	use Tests\Browser;
	use Tests\Browser\Components\Dialog;
	use Tests\Browser\Components\Toast;
	use Tests\Browser\Pages\Dashboard;
	use Tests\Browser\Pages\Home;
	use Tests\Browser\Pages\PaymentMollie;
	use Tests\Browser\Pages\Wallet as WalletPage;
	use Tests\TestCaseDusk;

	class PaymentMollieTest extends TestCaseDusk
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	self::useResellerUrl();
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	- $user = $this->getTestUser('reseller@kolabnow.com');
	+ $user = $this->getTestUser('reseller@' . \config('app.domain'));
	$wallet = $user->wallets()->first();
	$wallet->payments()->delete();
	$wallet->balance = 0;
	$wallet->save();

	parent::tearDown();
	}

	/**
	* Test the payment process
	*
	* @group mollie
	*/
	public function testPayment(): void
	{
	$this->browse(function (Browser $browser) {
	- $user = $this->getTestUser('reseller@kolabnow.com');
	+ $user = $this->getTestUser('reseller@' . \config('app.domain'));
	$wallet = $user->wallets()->first();
	$wallet->payments()->delete();
	$wallet->balance = 0;
	$wallet->save();

	$browser->visit(new Home())
	- ->submitLogon($user->email, 'reseller', true, ['paymentProvider' => 'mollie'])
	+ ->submitLogon($user->email, \App\Utils::generatePassphrase(), true, ['paymentProvider' => 'mollie'])
	->on(new Dashboard())
	->click('@links .link-wallet')
	->on(new WalletPage())
	->assertSeeIn('@main button', 'Add credit')
	->click('@main button')
	->with(new Dialog('@payment-dialog'), function (Browser $browser) {
	$browser->assertSeeIn('@title', 'Top up your wallet')
	->waitFor('#payment-method-selection #creditcard')
	->waitFor('#payment-method-selection #paypal')
	- ->assertMissing('#payment-method-selection #banktransfer')
	+ ->waitFor('#payment-method-selection #banktransfer')
	->click('#creditcard');
	})
	->with(new Dialog('@payment-dialog'), function (Browser $browser) {
	$browser->assertSeeIn('@title', 'Top up your wallet')
	->assertFocused('#amount')
	->assertSeeIn('@button-cancel', 'Cancel')
	->assertSeeIn('@button-action', 'Continue')
	// Test error handling
	->type('@body #amount', 'aaa')
	->click('@button-action')
	->assertToast(Toast::TYPE_ERROR, 'Form validation error')
	->assertSeeIn('#amount + span + .invalid-feedback', 'The amount must be a number.')
	// Submit valid data
	->type('@body #amount', '12.34')
	// Note we use double click to assert it does not create redundant requests
	->click('@button-action')
	->click('@button-action');
	})
	->on(new PaymentMollie())
	->assertSeeIn('@title', \config('app.name') . ' Payment')
	->assertSeeIn('@amount', 'CHF 12.34');

	$this->assertSame(1, $wallet->payments()->count());

	// Looks like the Mollie testing mode is limited.
	// We'll select credit card method and mark the payment as paid
	// We can't do much more, we have to trust Mollie their page works ;)

	// For some reason I don't get the method selection form, it
	// immediately jumps to the next step. Let's detect that
	if ($browser->element('@methods')) {
	$browser->click('@methods button.grid-button-creditcard')
	->waitFor('button.form__button');
	}

	$browser->click('@status-table input[value="paid"]')
	->click('button.form__button');

	// Now it should redirect back to wallet page and in background
	// use the webhook to update payment status (and balance).

	// Looks like in test-mode the webhook is executed before redirect
	// so we can expect balance updated on the wallet page

	$browser->waitForLocation('/wallet')
	->on(new WalletPage())
	->assertSeeIn('@main .card-title', 'Account balance 12,34 CHF');
	});
	}
	}
	diff --git a/src/tests/Browser/Reseller/StatsTest.php b/src/tests/Browser/Reseller/StatsTest.php
	index 8a4830f8..3347ed6f 100644
	--- a/src/tests/Browser/Reseller/StatsTest.php
	+++ b/src/tests/Browser/Reseller/StatsTest.php
	@@ -1,54 +1,54 @@
	<?php

	namespace Tests\Browser\Reseller;

	use Tests\Browser;
	use Tests\Browser\Pages\Admin\Stats;
	use Tests\Browser\Pages\Dashboard;
	use Tests\Browser\Pages\Home;
	use Tests\TestCaseDusk;

	class StatsTest extends TestCaseDusk
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	self::useResellerUrl();
	}

	/**
	* Test Stats page (unauthenticated)
	*/
	public function testStatsUnauth(): void
	{
	// Test that the page requires authentication
	$this->browse(function (Browser $browser) {
	$browser->visit('/stats')->on(new Home());
	});
	}

	/**
	* Test Stats page
	*/
	public function testStats(): void
	{
	$this->browse(function (Browser $browser) {
	$browser->visit(new Home())
	- ->submitLogon('reseller@kolabnow.com', 'reseller', true)
	+ ->submitLogon('reseller@' . \config('app.domain'), \App\Utils::generatePassphrase(), true)
	->on(new Dashboard())
	->assertSeeIn('@links .link-stats', 'Stats')
	->click('@links .link-stats')
	->on(new Stats())
	->assertElementsCount('@container > div', 3)
	->waitFor('@container #chart-users svg')
	->assertSeeIn('@container #chart-users svg .title', 'Users - last 8 weeks')
	->waitFor('@container #chart-users-all svg')
	->assertSeeIn('@container #chart-users-all svg .title', 'All Users - last year')
	->waitFor('@container #chart-discounts svg')
	->assertSeeIn('@container #chart-discounts svg .title', 'Discounts');
	});
	}
	}
	diff --git a/src/tests/Browser/Reseller/UserFinancesTest.php b/src/tests/Browser/Reseller/UserFinancesTest.php
	index 81b3c2d7..f509cecd 100644
	--- a/src/tests/Browser/Reseller/UserFinancesTest.php
	+++ b/src/tests/Browser/Reseller/UserFinancesTest.php
	@@ -1,325 +1,325 @@
	<?php

	namespace Tests\Browser\Reseller;

	use App\Discount;
	use App\Transaction;
	use App\User;
	use App\Wallet;
	use Carbon\Carbon;
	use Tests\Browser;
	use Tests\Browser\Components\Dialog;
	use Tests\Browser\Components\Toast;
	use Tests\Browser\Pages\Admin\User as UserPage;
	use Tests\Browser\Pages\Dashboard;
	use Tests\Browser\Pages\Home;
	use Tests\TestCaseDusk;

	class UserFinancesTest extends TestCaseDusk
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	self::useResellerUrl();

	$john = $this->getTestUser('john@kolab.org');
	$wallet = $john->wallets()->first();
	$wallet->discount()->dissociate();
	$wallet->balance = 0;
	$wallet->save();
	$wallet->setSettings(['mollie_id' => null, 'stripe_id' => null]);
	}

	/**
	* Test Finances tab (and transactions)
	*/
	public function testFinances(): void
	{
	// Assert Jack's Finances tab
	$this->browse(function (Browser $browser) {
	$jack = $this->getTestUser('jack@kolab.org');
	$wallet = $jack->wallets()->first();
	$wallet->transactions()->delete();
	$wallet->setSetting('stripe_id', 'abc');
	$page = new UserPage($jack->id);

	$browser->visit(new Home())
	- ->submitLogon('reseller@kolabnow.com', 'reseller', true)
	+ ->submitLogon('reseller@' . \config('app.domain'), \App\Utils::generatePassphrase(), true)
	->on(new Dashboard())
	->visit($page)
	->on($page)
	->assertSeeIn('@nav #tab-finances', 'Finances')
	->with('@user-finances', function (Browser $browser) {
	$browser->waitUntilMissing('.app-loader')
	->assertSeeIn('.card-title:first-child', 'Account balance')
	->assertSeeIn('.card-title:first-child .text-success', '0,00 CHF')
	->with('form', function (Browser $browser) {
	$browser->assertElementsCount('.row', 2)
	->assertSeeIn('.row:nth-child(1) label', 'Discount')
	->assertSeeIn('.row:nth-child(1) #discount span', 'none')
	->assertSeeIn('.row:nth-child(2) label', 'Stripe ID')
	->assertSeeIn('.row:nth-child(2) a', 'abc');
	})
	->assertSeeIn('h2:nth-of-type(2)', 'Transactions')
	->with('table', function (Browser $browser) {
	$browser->assertMissing('tbody')
	->assertSeeIn('tfoot td', "There are no transactions for this account.");
	})
	->assertMissing('table + button');
	});
	});

	// Assert John's Finances tab (with discount, and debit)
	$this->browse(function (Browser $browser) {
	$john = $this->getTestUser('john@kolab.org');
	$page = new UserPage($john->id);
	$discount = Discount::where('code', 'TEST')->first();
	$wallet = $john->wallet();
	$wallet->transactions()->delete();
	$wallet->discount()->associate($discount);
	$wallet->debit(2010);
	$wallet->save();

	// Create test transactions
	$transaction = Transaction::create([
	'user_email' => 'jeroen@jeroen.jeroen',
	'object_id' => $wallet->id,
	'object_type' => Wallet::class,
	'type' => Transaction::WALLET_CREDIT,
	'amount' => 100,
	'description' => 'Payment',
	]);
	$transaction->created_at = Carbon::now()->subMonth();
	$transaction->save();

	// Click the managed-by link on Jack's page
	$browser->click('@user-info #manager a')
	->on($page)
	->with('@user-finances', function (Browser $browser) {
	$browser->waitUntilMissing('.app-loader')
	->assertSeeIn('.card-title:first-child', 'Account balance')
	->assertSeeIn('.card-title:first-child .text-danger', '-20,10 CHF')
	->with('form', function (Browser $browser) {
	$browser->assertElementsCount('.row', 1)
	->assertSeeIn('.row:nth-child(1) label', 'Discount')
	->assertSeeIn('.row:nth-child(1) #discount span', '10% - Test voucher');
	})
	->assertSeeIn('h2:nth-of-type(2)', 'Transactions')
	->with('table', function (Browser $browser) {
	$browser->assertElementsCount('tbody tr', 2)
	->assertMissing('tfoot');

	if (!$browser->isPhone()) {
	$browser->assertSeeIn('tbody tr:last-child td.email', 'jeroen@jeroen.jeroen');
	}
	});
	});
	});

	// Now we go to Ned's info page, he's a controller on John's wallet
	$this->browse(function (Browser $browser) {
	$ned = $this->getTestUser('ned@kolab.org');
	$wallet = $ned->wallets()->first();
	$wallet->balance = 0;
	$wallet->save();
	$page = new UserPage($ned->id);

	$browser->click('@nav #tab-users')
	->click('@user-users tbody tr:nth-child(4) td:first-child a')
	->on($page)
	->with('@user-finances', function (Browser $browser) {
	$browser->waitUntilMissing('.app-loader')
	->assertSeeIn('.card-title:first-child', 'Account balance')
	->assertSeeIn('.card-title:first-child .text-success', '0,00 CHF')
	->with('form', function (Browser $browser) {
	$browser->assertElementsCount('.row', 1)
	->assertSeeIn('.row:nth-child(1) label', 'Discount')
	->assertSeeIn('.row:nth-child(1) #discount span', 'none');
	})
	->assertSeeIn('h2:nth-of-type(2)', 'Transactions')
	->with('table', function (Browser $browser) {
	$browser->assertMissing('tbody')
	->assertSeeIn('tfoot td', "There are no transactions for this account.");
	})
	->assertMissing('table + button');
	});
	});
	}

	/**
	* Test editing wallet discount
	*
	* @depends testFinances
	*/
	public function testWalletDiscount(): void
	{
	$this->browse(function (Browser $browser) {
	$john = $this->getTestUser('john@kolab.org');

	$browser->visit(new UserPage($john->id))
	->pause(100)
	->waitUntilMissing('@user-finances .app-loader')
	->click('@user-finances #discount button')
	// Test dialog content, and closing it with Cancel button
	->with(new Dialog('#discount-dialog'), function (Browser $browser) {
	$browser->assertSeeIn('@title', 'Account discount')
	->assertFocused('@body select')
	->assertSelected('@body select', '')
	->assertSeeIn('@button-cancel', 'Cancel')
	->assertSeeIn('@button-action', 'Submit')
	->click('@button-cancel');
	})
	->assertMissing('#discount-dialog')
	->click('@user-finances #discount button')
	// Change the discount
	->with(new Dialog('#discount-dialog'), function (Browser $browser) {
	$browser->click('@body select')
	->click('@body select option:nth-child(2)')
	->click('@button-action');
	})
	->assertToast(Toast::TYPE_SUCCESS, 'User wallet updated successfully.')
	->assertSeeIn('#discount span', '10% - Test voucher')
	->click('@nav #tab-subscriptions')
	->with('@user-subscriptions', function (Browser $browser) {
	- $browser->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '3,99 CHF/month¹')
	+ $browser->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '4,50 CHF/month¹')
	->assertSeeIn('table tbody tr:nth-child(2) td:last-child', '0,00 CHF/month¹')
	- ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '4,99 CHF/month¹')
	+ ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '4,41 CHF/month¹')
	->assertSeeIn('table + .hint', '¹ applied discount: 10% - Test voucher');
	})
	// Change back to 'none'
	->click('@nav #tab-finances')
	->click('@user-finances #discount button')
	->with(new Dialog('#discount-dialog'), function (Browser $browser) {
	$browser->click('@body select')
	->click('@body select option:nth-child(1)')
	->click('@button-action');
	})
	->assertToast(Toast::TYPE_SUCCESS, 'User wallet updated successfully.')
	->assertSeeIn('#discount span', 'none')
	->click('@nav #tab-subscriptions')
	->with('@user-subscriptions', function (Browser $browser) {
	- $browser->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '4,44 CHF/month')
	+ $browser->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '5,00 CHF/month')
	->assertSeeIn('table tbody tr:nth-child(2) td:last-child', '0,00 CHF/month')
	- ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '5,55 CHF/month')
	+ ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '4,90 CHF/month')
	->assertMissing('table + .hint');
	});
	});
	}

	/**
	* Test awarding/penalizing a wallet
	*
	* @depends testFinances
	*/
	public function testBonusPenalty(): void
	{
	$this->browse(function (Browser $browser) {
	$john = $this->getTestUser('john@kolab.org');

	$browser->visit(new UserPage($john->id))
	->waitFor('@user-finances #button-award')
	->click('@user-finances #button-award')
	// Test dialog content, and closing it with Cancel button
	->with(new Dialog('#oneoff-dialog'), function (Browser $browser) {
	$browser->assertSeeIn('@title', 'Add a bonus to the wallet')
	->assertFocused('@body input#oneoff_amount')
	->assertSeeIn('@body label[for="oneoff_amount"]', 'Amount')
	->assertvalue('@body input#oneoff_amount', '')
	->assertSeeIn('@body label[for="oneoff_description"]', 'Description')
	->assertvalue('@body input#oneoff_description', '')
	->assertSeeIn('@button-cancel', 'Cancel')
	->assertSeeIn('@button-action', 'Submit')
	->click('@button-cancel');
	})
	->assertMissing('#oneoff-dialog');

	// Test bonus
	$browser->click('@user-finances #button-award')
	->with(new Dialog('#oneoff-dialog'), function (Browser $browser) {
	// Test input validation for a bonus
	$browser->type('@body #oneoff_amount', 'aaa')
	->type('@body #oneoff_description', '')
	->click('@button-action')
	->assertToast(Toast::TYPE_ERROR, 'Form validation error')
	->assertVisible('@body #oneoff_amount.is-invalid')
	->assertVisible('@body #oneoff_description.is-invalid')
	->assertSeeIn(
	'@body #oneoff_amount + span + .invalid-feedback',
	'The amount must be a number.'
	)
	->assertSeeIn(
	'@body #oneoff_description + .invalid-feedback',
	'The description field is required.'
	);

	// Test adding a bonus
	$browser->type('@body #oneoff_amount', '12.34')
	->type('@body #oneoff_description', 'Test bonus')
	->click('@button-action')
	->assertToast(Toast::TYPE_SUCCESS, 'The bonus has been added to the wallet successfully.');
	})
	->assertMissing('#oneoff-dialog')
	->assertSeeIn('@user-finances .card-title span.text-success', '12,34 CHF')
	->waitUntilMissing('.app-loader')
	->with('table', function (Browser $browser) {
	$browser->assertElementsCount('tbody tr', 3)
	->assertMissing('tfoot')
	->assertSeeIn('tbody tr:first-child td.description', 'Bonus: Test bonus')
	->assertSeeIn('tbody tr:first-child td.price', '12,34 CHF');

	if (!$browser->isPhone()) {
	- $browser->assertSeeIn('tbody tr:first-child td.email', 'reseller@kolabnow.com');
	+ $browser->assertSeeIn('tbody tr:first-child td.email', 'reseller@' . \config('app.domain'));
	}
	});

	$this->assertSame(1234, $john->wallets()->first()->balance);

	// Test penalty
	$browser->click('@user-finances #button-penalty')
	// Test dialog content, and closing it with Cancel button
	->with(new Dialog('#oneoff-dialog'), function (Browser $browser) {
	$browser->assertSeeIn('@title', 'Add a penalty to the wallet')
	->assertFocused('@body input#oneoff_amount')
	->assertSeeIn('@body label[for="oneoff_amount"]', 'Amount')
	->assertvalue('@body input#oneoff_amount', '')
	->assertSeeIn('@body label[for="oneoff_description"]', 'Description')
	->assertvalue('@body input#oneoff_description', '')
	->assertSeeIn('@button-cancel', 'Cancel')
	->assertSeeIn('@button-action', 'Submit')
	->click('@button-cancel');
	})
	->assertMissing('#oneoff-dialog')
	->click('@user-finances #button-penalty')
	->with(new Dialog('#oneoff-dialog'), function (Browser $browser) {
	// Test input validation for a penalty
	$browser->type('@body #oneoff_amount', '')
	->type('@body #oneoff_description', '')
	->click('@button-action')
	->assertToast(Toast::TYPE_ERROR, 'Form validation error')
	->assertVisible('@body #oneoff_amount.is-invalid')
	->assertVisible('@body #oneoff_description.is-invalid')
	->assertSeeIn(
	'@body #oneoff_amount + span + .invalid-feedback',
	'The amount field is required.'
	)
	->assertSeeIn(
	'@body #oneoff_description + .invalid-feedback',
	'The description field is required.'
	);

	// Test adding a penalty
	$browser->type('@body #oneoff_amount', '12.35')
	->type('@body #oneoff_description', 'Test penalty')
	->click('@button-action')
	->assertToast(Toast::TYPE_SUCCESS, 'The penalty has been added to the wallet successfully.');
	})
	->assertMissing('#oneoff-dialog')
	->assertSeeIn('@user-finances .card-title span.text-danger', '-0,01 CHF');

	$this->assertSame(-1, $john->wallets()->first()->balance);
	});
	}
	}
	diff --git a/src/tests/Browser/Reseller/UserTest.php b/src/tests/Browser/Reseller/UserTest.php
	index 6eb7b4f8..bb7f4d10 100644
	--- a/src/tests/Browser/Reseller/UserTest.php
	+++ b/src/tests/Browser/Reseller/UserTest.php
	@@ -1,473 +1,473 @@
	<?php

	namespace Tests\Browser\Reseller;

	use App\Auth\SecondFactor;
	use App\Discount;
	use App\Sku;
	use App\User;
	use Tests\Browser;
	use Tests\Browser\Components\Dialog;
	use Tests\Browser\Components\Toast;
	use Tests\Browser\Pages\Admin\User as UserPage;
	use Tests\Browser\Pages\Dashboard;
	use Tests\Browser\Pages\Home;
	use Tests\TestCaseDusk;
	use Illuminate\Foundation\Testing\DatabaseMigrations;

	class UserTest extends TestCaseDusk
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	self::useResellerUrl();

	$john = $this->getTestUser('john@kolab.org');
	$john->setSettings([
	'phone' => '+48123123123',
	'external_email' => 'john.doe.external@gmail.com',
	]);
	if ($john->isSuspended()) {
	User::where('email', $john->email)->update(['status' => $john->status - User::STATUS_SUSPENDED]);
	}
	$wallet = $john->wallets()->first();
	$wallet->discount()->dissociate();
	$wallet->save();

	$this->deleteTestGroup('group-test@kolab.org');
	$this->clearMeetEntitlements();
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	$john = $this->getTestUser('john@kolab.org');
	$john->setSettings([
	'phone' => null,
	'external_email' => 'john.doe.external@gmail.com',
	]);
	if ($john->isSuspended()) {
	User::where('email', $john->email)->update(['status' => $john->status - User::STATUS_SUSPENDED]);
	}
	$wallet = $john->wallets()->first();
	$wallet->discount()->dissociate();
	$wallet->save();

	$this->deleteTestGroup('group-test@kolab.org');
	$this->clearMeetEntitlements();

	parent::tearDown();
	}

	/**
	* Test user info page (unauthenticated)
	*/
	public function testUserUnauth(): void
	{
	// Test that the page requires authentication
	$this->browse(function (Browser $browser) {
	$jack = $this->getTestUser('jack@kolab.org');
	$browser->visit('/user/' . $jack->id)->on(new Home());
	});
	}

	/**
	* Test user info page
	*/
	public function testUserInfo(): void
	{
	$this->browse(function (Browser $browser) {
	$jack = $this->getTestUser('jack@kolab.org');
	$page = new UserPage($jack->id);

	$browser->visit(new Home())
	- ->submitLogon('reseller@kolabnow.com', 'reseller', true)
	+ ->submitLogon('reseller@' . \config('app.domain'), \App\Utils::generatePassphrase(), true)
	->on(new Dashboard())
	->visit($page)
	->on($page);

	// Assert main info box content
	$browser->assertSeeIn('@user-info .card-title', $jack->email)
	->with('@user-info form', function (Browser $browser) use ($jack) {
	$browser->assertElementsCount('.row', 7)
	->assertSeeIn('.row:nth-child(1) label', 'Managed by')
	->assertSeeIn('.row:nth-child(1) #manager a', 'john@kolab.org')
	->assertSeeIn('.row:nth-child(2) label', 'ID (Created)')
	->assertSeeIn('.row:nth-child(2) #userid', "{$jack->id} ({$jack->created_at})")
	->assertSeeIn('.row:nth-child(3) label', 'Status')
	->assertSeeIn('.row:nth-child(3) #status span.text-success', 'Active')
	->assertSeeIn('.row:nth-child(4) label', 'First Name')
	->assertSeeIn('.row:nth-child(4) #first_name', 'Jack')
	->assertSeeIn('.row:nth-child(5) label', 'Last Name')
	->assertSeeIn('.row:nth-child(5) #last_name', 'Daniels')
	->assertSeeIn('.row:nth-child(6) label', 'External Email')
	->assertMissing('.row:nth-child(6) #external_email a')
	->assertSeeIn('.row:nth-child(7) label', 'Country')
	->assertSeeIn('.row:nth-child(7) #country', 'United States');
	});

	// Some tabs are loaded in background, wait a second
	$browser->pause(500)
	->assertElementsCount('@nav a', 6);

	// Note: Finances tab is tested in UserFinancesTest.php
	$browser->assertSeeIn('@nav #tab-finances', 'Finances');

	// Assert Aliases tab
	$browser->assertSeeIn('@nav #tab-aliases', 'Aliases (1)')
	->click('@nav #tab-aliases')
	->whenAvailable('@user-aliases', function (Browser $browser) {
	$browser->assertElementsCount('table tbody tr', 1)
	->assertSeeIn('table tbody tr:first-child td:first-child', 'jack.daniels@kolab.org')
	->assertMissing('table tfoot');
	});

	// Assert Subscriptions tab
	$browser->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (3)')
	->click('@nav #tab-subscriptions')
	->with('@user-subscriptions', function (Browser $browser) {
	$browser->assertElementsCount('table tbody tr', 3)
	->assertSeeIn('table tbody tr:nth-child(1) td:first-child', 'User Mailbox')
	- ->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '4,44 CHF')
	- ->assertSeeIn('table tbody tr:nth-child(2) td:first-child', 'Storage Quota 2 GB')
	- ->assertSeeIn('table tbody tr:nth-child(2) td:last-child', '0,00 CHF')
	+ ->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '5,00 CHF/month')
	+ ->assertSeeIn('table tbody tr:nth-child(2) td:first-child', 'Storage Quota 5 GB')
	+ ->assertSeeIn('table tbody tr:nth-child(2) td:last-child', '0,00 CHF/month')
	->assertSeeIn('table tbody tr:nth-child(3) td:first-child', 'Groupware Features')
	- ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '5,55 CHF')
	+ ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '4,90 CHF/month')
	->assertMissing('table tfoot')
	->assertMissing('#reset2fa');
	});

	// Assert Domains tab
	$browser->assertSeeIn('@nav #tab-domains', 'Domains (0)')
	->click('@nav #tab-domains')
	->with('@user-domains', function (Browser $browser) {
	$browser->assertElementsCount('table tbody tr', 0)
	->assertSeeIn('table tfoot tr td', 'There are no domains in this account.');
	});

	// Assert Users tab
	$browser->assertSeeIn('@nav #tab-users', 'Users (0)')
	->click('@nav #tab-users')
	->with('@user-users', function (Browser $browser) {
	$browser->assertElementsCount('table tbody tr', 0)
	->assertSeeIn('table tfoot tr td', 'There are no users in this account.');
	});

	// Assert Distribution lists tab
	$browser->assertSeeIn('@nav #tab-distlists', 'Distribution lists (0)')
	->click('@nav #tab-distlists')
	->with('@user-distlists', function (Browser $browser) {
	$browser->assertElementsCount('table tbody tr', 0)
	->assertSeeIn('table tfoot tr td', 'There are no distribution lists in this account.');
	});
	});
	}

	/**
	* Test user info page (continue)
	*
	* @depends testUserInfo
	*/
	public function testUserInfo2(): void
	{
	$this->browse(function (Browser $browser) {
	$john = $this->getTestUser('john@kolab.org');
	$page = new UserPage($john->id);
	$discount = Discount::where('code', 'TEST')->first();
	$wallet = $john->wallet();
	$wallet->discount()->associate($discount);
	$wallet->debit(2010);
	$wallet->save();
	$group = $this->getTestGroup('group-test@kolab.org');
	$group->assignToWallet($john->wallets->first());

	// Click the managed-by link on Jack's page
	$browser->click('@user-info #manager a')
	->on($page);

	// Assert main info box content
	$browser->assertSeeIn('@user-info .card-title', $john->email)
	->with('@user-info form', function (Browser $browser) use ($john) {
	$ext_email = $john->getSetting('external_email');

	$browser->assertElementsCount('.row', 9)
	->assertSeeIn('.row:nth-child(1) label', 'ID (Created)')
	->assertSeeIn('.row:nth-child(1) #userid', "{$john->id} ({$john->created_at})")
	->assertSeeIn('.row:nth-child(2) label', 'Status')
	->assertSeeIn('.row:nth-child(2) #status span.text-success', 'Active')
	->assertSeeIn('.row:nth-child(3) label', 'First Name')
	->assertSeeIn('.row:nth-child(3) #first_name', 'John')
	->assertSeeIn('.row:nth-child(4) label', 'Last Name')
	->assertSeeIn('.row:nth-child(4) #last_name', 'Doe')
	->assertSeeIn('.row:nth-child(5) label', 'Organization')
	->assertSeeIn('.row:nth-child(5) #organization', 'Kolab Developers')
	->assertSeeIn('.row:nth-child(6) label', 'Phone')
	->assertSeeIn('.row:nth-child(6) #phone', $john->getSetting('phone'))
	->assertSeeIn('.row:nth-child(7) label', 'External Email')
	->assertSeeIn('.row:nth-child(7) #external_email a', $ext_email)
	->assertAttribute('.row:nth-child(7) #external_email a', 'href', "mailto:$ext_email")
	->assertSeeIn('.row:nth-child(8) label', 'Address')
	->assertSeeIn('.row:nth-child(8) #billing_address', $john->getSetting('billing_address'))
	->assertSeeIn('.row:nth-child(9) label', 'Country')
	->assertSeeIn('.row:nth-child(9) #country', 'United States');
	});

	// Some tabs are loaded in background, wait a second
	$browser->pause(500)
	->assertElementsCount('@nav a', 6);

	// Note: Finances tab is tested in UserFinancesTest.php
	$browser->assertSeeIn('@nav #tab-finances', 'Finances');

	// Assert Aliases tab
	$browser->assertSeeIn('@nav #tab-aliases', 'Aliases (1)')
	->click('@nav #tab-aliases')
	->whenAvailable('@user-aliases', function (Browser $browser) {
	$browser->assertElementsCount('table tbody tr', 1)
	->assertSeeIn('table tbody tr:first-child td:first-child', 'john.doe@kolab.org')
	->assertMissing('table tfoot');
	});

	// Assert Subscriptions tab
	$browser->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (3)')
	->click('@nav #tab-subscriptions')
	->with('@user-subscriptions', function (Browser $browser) {
	$browser->assertElementsCount('table tbody tr', 3)
	->assertSeeIn('table tbody tr:nth-child(1) td:first-child', 'User Mailbox')
	- ->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '3,99 CHF/month¹')
	- ->assertSeeIn('table tbody tr:nth-child(2) td:first-child', 'Storage Quota 2 GB')
	+ ->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '4,50 CHF/month¹')
	+ ->assertSeeIn('table tbody tr:nth-child(2) td:first-child', 'Storage Quota 5 GB')
	->assertSeeIn('table tbody tr:nth-child(2) td:last-child', '0,00 CHF/month¹')
	->assertSeeIn('table tbody tr:nth-child(3) td:first-child', 'Groupware Features')
	- ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '4,99 CHF/month¹')
	+ ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '4,41 CHF/month¹')
	->assertMissing('table tfoot')
	->assertSeeIn('table + .hint', '¹ applied discount: 10% - Test voucher');
	});

	// Assert Domains tab
	$browser->assertSeeIn('@nav #tab-domains', 'Domains (1)')
	->click('@nav #tab-domains')
	->with('@user-domains table', function (Browser $browser) {
	$browser->assertElementsCount('tbody tr', 1)
	->assertSeeIn('tbody tr:nth-child(1) td:first-child a', 'kolab.org')
	->assertVisible('tbody tr:nth-child(1) td:first-child svg.text-success')
	->assertMissing('tfoot');
	});

	// Assert Distribution lists tab
	$browser->assertSeeIn('@nav #tab-distlists', 'Distribution lists (1)')
	->click('@nav #tab-distlists')
	->with('@user-distlists table', function (Browser $browser) {
	$browser->assertElementsCount('tbody tr', 1)
	->assertSeeIn('tbody tr:nth-child(1) td:first-child a', 'group-test@kolab.org')
	->assertVisible('tbody tr:nth-child(1) td:first-child svg.text-danger')
	->assertMissing('tfoot');
	});

	// Assert Users tab
	$browser->assertSeeIn('@nav #tab-users', 'Users (4)')
	->click('@nav #tab-users')
	->with('@user-users table', function (Browser $browser) {
	$browser->assertElementsCount('tbody tr', 4)
	->assertSeeIn('tbody tr:nth-child(1) td:first-child a', 'jack@kolab.org')
	->assertVisible('tbody tr:nth-child(1) td:first-child svg.text-success')
	->assertSeeIn('tbody tr:nth-child(2) td:first-child a', 'joe@kolab.org')
	->assertVisible('tbody tr:nth-child(2) td:first-child svg.text-success')
	->assertSeeIn('tbody tr:nth-child(3) td:first-child span', 'john@kolab.org')
	->assertVisible('tbody tr:nth-child(3) td:first-child svg.text-success')
	->assertSeeIn('tbody tr:nth-child(4) td:first-child a', 'ned@kolab.org')
	->assertVisible('tbody tr:nth-child(4) td:first-child svg.text-success')
	->assertMissing('tfoot');
	});
	});

	// Now we go to Ned's info page, he's a controller on John's wallet
	$this->browse(function (Browser $browser) {
	$ned = $this->getTestUser('ned@kolab.org');
	$page = new UserPage($ned->id);

	$browser->click('@user-users tbody tr:nth-child(4) td:first-child a')
	->on($page);

	// Assert main info box content
	$browser->assertSeeIn('@user-info .card-title', $ned->email)
	->with('@user-info form', function (Browser $browser) use ($ned) {
	$browser->assertSeeIn('.row:nth-child(2) label', 'ID (Created)')
	->assertSeeIn('.row:nth-child(2) #userid', "{$ned->id} ({$ned->created_at})");
	});

	// Some tabs are loaded in background, wait a second
	$browser->pause(500)
	->assertElementsCount('@nav a', 6);

	// Note: Finances tab is tested in UserFinancesTest.php
	$browser->assertSeeIn('@nav #tab-finances', 'Finances');

	// Assert Aliases tab
	$browser->assertSeeIn('@nav #tab-aliases', 'Aliases (0)')
	->click('@nav #tab-aliases')
	->whenAvailable('@user-aliases', function (Browser $browser) {
	$browser->assertElementsCount('table tbody tr', 0)
	->assertSeeIn('table tfoot tr td', 'This user has no email aliases.');
	});

	// Assert Subscriptions tab, we expect John's discount here
	$browser->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (5)')
	->click('@nav #tab-subscriptions')
	->with('@user-subscriptions', function (Browser $browser) {
	$browser->assertElementsCount('table tbody tr', 5)
	->assertSeeIn('table tbody tr:nth-child(1) td:first-child', 'User Mailbox')
	- ->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '3,99 CHF/month¹')
	- ->assertSeeIn('table tbody tr:nth-child(2) td:first-child', 'Storage Quota 2 GB')
	+ ->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '4,50 CHF/month¹')
	+ ->assertSeeIn('table tbody tr:nth-child(2) td:first-child', 'Storage Quota 5 GB')
	->assertSeeIn('table tbody tr:nth-child(2) td:last-child', '0,00 CHF/month¹')
	->assertSeeIn('table tbody tr:nth-child(3) td:first-child', 'Groupware Features')
	- ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '4,99 CHF/month¹')
	+ ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '4,41 CHF/month¹')
	->assertSeeIn('table tbody tr:nth-child(4) td:first-child', 'Activesync')
	- ->assertSeeIn('table tbody tr:nth-child(4) td:last-child', '0,90 CHF/month¹')
	+ ->assertSeeIn('table tbody tr:nth-child(4) td:last-child', '0,00 CHF/month¹')
	->assertSeeIn('table tbody tr:nth-child(5) td:first-child', '2-Factor Authentication')
	->assertSeeIn('table tbody tr:nth-child(5) td:last-child', '0,00 CHF/month¹')
	->assertMissing('table tfoot')
	->assertSeeIn('table + .hint', '¹ applied discount: 10% - Test voucher')
	->assertSeeIn('#reset2fa', 'Reset 2-Factor Auth');
	});

	// We don't expect John's domains here
	$browser->assertSeeIn('@nav #tab-domains', 'Domains (0)')
	->click('@nav #tab-domains')
	->with('@user-domains', function (Browser $browser) {
	$browser->assertElementsCount('table tbody tr', 0)
	->assertSeeIn('table tfoot tr td', 'There are no domains in this account.');
	});

	// We don't expect John's users here
	$browser->assertSeeIn('@nav #tab-users', 'Users (0)')
	->click('@nav #tab-users')
	->with('@user-users', function (Browser $browser) {
	$browser->assertElementsCount('table tbody tr', 0)
	->assertSeeIn('table tfoot tr td', 'There are no users in this account.');
	});

	// We don't expect John's distribution lists here
	$browser->assertSeeIn('@nav #tab-distlists', 'Distribution lists (0)')
	->click('@nav #tab-distlists')
	->with('@user-distlists', function (Browser $browser) {
	$browser->assertElementsCount('table tbody tr', 0)
	->assertSeeIn('table tfoot tr td', 'There are no distribution lists in this account.');
	});
	});
	}

	/**
	* Test editing an external email
	*
	* @depends testUserInfo2
	*/
	public function testExternalEmail(): void
	{
	$this->browse(function (Browser $browser) {
	$john = $this->getTestUser('john@kolab.org');

	$browser->visit(new UserPage($john->id))
	->waitFor('@user-info #external_email button')
	->click('@user-info #external_email button')
	// Test dialog content, and closing it with Cancel button
	->with(new Dialog('#email-dialog'), function (Browser $browser) {
	$browser->assertSeeIn('@title', 'External Email')
	->assertFocused('@body input')
	->assertValue('@body input', 'john.doe.external@gmail.com')
	->assertSeeIn('@button-cancel', 'Cancel')
	->assertSeeIn('@button-action', 'Submit')
	->click('@button-cancel');
	})
	->assertMissing('#email-dialog')
	->click('@user-info #external_email button')
	// Test email validation error handling, and email update
	->with(new Dialog('#email-dialog'), function (Browser $browser) {
	$browser->type('@body input', 'test')
	->click('@button-action')
	->waitFor('@body input.is-invalid')
	->assertSeeIn(
	'@body input + .invalid-feedback',
	'The external email must be a valid email address.'
	)
	->assertToast(Toast::TYPE_ERROR, 'Form validation error')
	->type('@body input', 'test@test.com')
	->click('@button-action');
	})
	->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.')
	->assertSeeIn('@user-info #external_email a', 'test@test.com')
	->click('@user-info #external_email button')
	->with(new Dialog('#email-dialog'), function (Browser $browser) {
	$browser->assertValue('@body input', 'test@test.com')
	->assertMissing('@body input.is-invalid')
	->assertMissing('@body input + .invalid-feedback')
	->click('@button-cancel');
	})
	->assertSeeIn('@user-info #external_email a', 'test@test.com');

	// $john->getSetting() may not work here as it uses internal cache
	// read the value form database
	$current_ext_email = $john->settings()->where('key', 'external_email')->first()->value;
	$this->assertSame('test@test.com', $current_ext_email);
	});
	}

	/**
	* Test suspending/unsuspending the user
	*/
	public function testSuspendAndUnsuspend(): void
	{
	$this->browse(function (Browser $browser) {
	$john = $this->getTestUser('john@kolab.org');

	$browser->visit(new UserPage($john->id))
	->assertVisible('@user-info #button-suspend')
	->assertMissing('@user-info #button-unsuspend')
	->click('@user-info #button-suspend')
	->assertToast(Toast::TYPE_SUCCESS, 'User suspended successfully.')
	->assertSeeIn('@user-info #status span.text-warning', 'Suspended')
	->assertMissing('@user-info #button-suspend')
	->click('@user-info #button-unsuspend')
	->assertToast(Toast::TYPE_SUCCESS, 'User unsuspended successfully.')
	->assertSeeIn('@user-info #status span.text-success', 'Active')
	->assertVisible('@user-info #button-suspend')
	->assertMissing('@user-info #button-unsuspend');
	});
	}

	/**
	* Test resetting 2FA for the user
	*/
	public function testReset2FA(): void
	{
	$this->browse(function (Browser $browser) {
	$this->deleteTestUser('userstest1@kolabnow.com');
	$user = $this->getTestUser('userstest1@kolabnow.com');
	$sku2fa = Sku::firstOrCreate(['title' => '2fa']);
	$user->assignSku($sku2fa);
	SecondFactor::seed('userstest1@kolabnow.com');

	$browser->visit(new UserPage($user->id))
	->click('@nav #tab-subscriptions')
	->with('@user-subscriptions', function (Browser $browser) use ($sku2fa) {
	$browser->waitFor('#reset2fa')
	->assertVisible('#sku' . $sku2fa->id);
	})
	->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (1)')
	->click('#reset2fa')
	->with(new Dialog('#reset-2fa-dialog'), function (Browser $browser) {
	$browser->assertSeeIn('@title', '2-Factor Authentication Reset')
	->assertSeeIn('@button-cancel', 'Cancel')
	->assertSeeIn('@button-action', 'Reset')
	->click('@button-action');
	})
	->assertToast(Toast::TYPE_SUCCESS, '2-Factor authentication reset successfully.')
	->assertMissing('#sku' . $sku2fa->id)
	->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (0)');
	});
	}
	}
	diff --git a/src/tests/Browser/Reseller/WalletTest.php b/src/tests/Browser/Reseller/WalletTest.php
	index 4fc4f2ac..9478d913 100644
	--- a/src/tests/Browser/Reseller/WalletTest.php
	+++ b/src/tests/Browser/Reseller/WalletTest.php
	@@ -1,248 +1,248 @@
	<?php

	namespace Tests\Browser\Reseller;

	use App\Payment;
	use App\Providers\PaymentProvider;
	use App\Transaction;
	use App\Wallet;
	use Carbon\Carbon;
	use Tests\Browser;
	use Tests\Browser\Pages\Dashboard;
	use Tests\Browser\Pages\Home;
	use Tests\Browser\Pages\Wallet as WalletPage;
	use Tests\TestCaseDusk;

	class WalletTest extends TestCaseDusk
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	self::useResellerUrl();
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	- $reseller = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller = $this->getTestUser('reseller@' . \config('app.domain'));
	$wallet = $reseller->wallets()->first();
	$wallet->balance = 0;
	$wallet->save();
	$wallet->payments()->delete();
	$wallet->transactions()->delete();

	parent::tearDown();
	}

	/**
	* Test wallet page (unauthenticated)
	*/
	public function testWalletUnauth(): void
	{
	// Test that the page requires authentication
	$this->browse(function (Browser $browser) {
	$browser->visit('/wallet')->on(new Home());
	});
	}

	/**
	* Test wallet "box" on Dashboard
	*/
	public function testDashboard(): void
	{
	- $reseller = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller = $this->getTestUser('reseller@' . \config('app.domain'));
	Wallet::where('user_id', $reseller->id)->update(['balance' => 125]);

	// Positive balance
	$this->browse(function (Browser $browser) {
	$browser->visit(new Home())
	- ->submitLogon('reseller@kolabnow.com', 'reseller', true)
	+ ->submitLogon('reseller@' . \config('app.domain'), \App\Utils::generatePassphrase(), true)
	->on(new Dashboard())
	->assertSeeIn('@links .link-wallet .name', 'Wallet')
	->assertSeeIn('@links .link-wallet .badge-success', '1,25 CHF');
	});

	Wallet::where('user_id', $reseller->id)->update(['balance' => -1234]);

	// Negative balance
	$this->browse(function (Browser $browser) {
	$browser->visit(new Dashboard())
	->assertSeeIn('@links .link-wallet .name', 'Wallet')
	->assertSeeIn('@links .link-wallet .badge-danger', '-12,34 CHF');
	});
	}

	/**
	* Test wallet page
	*
	* @depends testDashboard
	*/
	public function testWallet(): void
	{
	- $reseller = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller = $this->getTestUser('reseller@' . \config('app.domain'));
	Wallet::where('user_id', $reseller->id)->update(['balance' => -1234]);

	$this->browse(function (Browser $browser) {
	$browser->click('@links .link-wallet')
	->on(new WalletPage())
	->assertSeeIn('#wallet .card-title', 'Account balance -12,34 CHF')
	->assertSeeIn('#wallet .card-title .text-danger', '-12,34 CHF')
	->assertSeeIn('#wallet .card-text', 'You are out of credit');
	});
	}

	/**
	* Test Receipts tab
	*
	* @depends testWallet
	*/
	public function testReceipts(): void
	{
	- $user = $this->getTestUser('reseller@kolabnow.com');
	+ $user = $this->getTestUser('reseller@' . \config('app.domain'));
	$wallet = $user->wallets()->first();
	$wallet->payments()->delete();

	// Assert Receipts tab content when there's no receipts available
	$this->browse(function (Browser $browser) {
	$browser->visit(new WalletPage())
	->assertSeeIn('#wallet .card-title', 'Account balance 0,00 CHF')
	->assertSeeIn('#wallet .card-title .text-success', '0,00 CHF')
	->assertSeeIn('#wallet .card-text', 'You are in your free trial period.') // TODO
	->assertSeeIn('@nav #tab-receipts', 'Receipts')
	->with('@receipts-tab', function (Browser $browser) {
	$browser->waitUntilMissing('.app-loader')
	->assertSeeIn('p', 'There are no receipts for payments')
	->assertDontSeeIn('p', 'Here you can download')
	->assertMissing('select')
	->assertMissing('button');
	});
	});

	// Create some sample payments
	$receipts = [];
	$date = Carbon::create(intval(date('Y')) - 1, 3, 30);
	$payment = Payment::create([
	'id' => 'AAA1',
	'status' => PaymentProvider::STATUS_PAID,
	'type' => PaymentProvider::TYPE_ONEOFF,
	'description' => 'Paid in March',
	'wallet_id' => $wallet->id,
	'provider' => 'stripe',
	'amount' => 1111,
	'currency_amount' => 1111,
	'currency' => 'CHF',
	]);
	$payment->updated_at = $date;
	$payment->save();
	$receipts[] = $date->format('Y-m');

	$date = Carbon::create(intval(date('Y')) - 1, 4, 30);
	$payment = Payment::create([
	'id' => 'AAA2',
	'status' => PaymentProvider::STATUS_PAID,
	'type' => PaymentProvider::TYPE_ONEOFF,
	'description' => 'Paid in April',
	'wallet_id' => $wallet->id,
	'provider' => 'stripe',
	'amount' => 1111,
	'currency_amount' => 1111,
	'currency' => 'CHF',
	]);
	$payment->updated_at = $date;
	$payment->save();
	$receipts[] = $date->format('Y-m');

	// Assert Receipts tab with receipts available
	$this->browse(function (Browser $browser) use ($receipts) {
	$browser->refresh()
	->on(new WalletPage())
	->assertSeeIn('@nav #tab-receipts', 'Receipts')
	->with('@receipts-tab', function (Browser $browser) use ($receipts) {
	$browser->waitUntilMissing('.app-loader')
	->assertDontSeeIn('p', 'There are no receipts for payments')
	->assertSeeIn('p', 'Here you can download')
	->assertSeeIn('button', 'Download')
	->assertElementsCount('select > option', 2)
	->assertSeeIn('select > option:nth-child(1)', $receipts[1])
	->assertSeeIn('select > option:nth-child(2)', $receipts[0]);

	// Download a receipt file
	$browser->select('select', $receipts[0])
	->click('button')
	->pause(2000);

	$files = glob(__DIR__ . '/../downloads/*.pdf');

	$filename = pathinfo($files[0], PATHINFO_BASENAME);
	$this->assertTrue(strpos($filename, $receipts[0]) !== false);

	$content = $browser->readDownloadedFile($filename, 0);
	$this->assertStringStartsWith("%PDF-1.", $content);

	$browser->removeDownloadedFile($filename);
	});
	});
	}

	/**
	* Test History tab
	*
	* @depends testWallet
	*/
	public function testHistory(): void
	{
	- $user = $this->getTestUser('reseller@kolabnow.com');
	+ $user = $this->getTestUser('reseller@' . \config('app.domain'));
	$wallet = $user->wallets()->first();
	$wallet->transactions()->delete();

	// Create some sample transactions
	$transactions = $this->createTestTransactions($wallet);
	$transactions = array_reverse($transactions);
	$pages = array_chunk($transactions, 10 /* page size*/);

	$this->browse(function (Browser $browser) use ($pages) {
	$browser->on(new WalletPage())
	->assertSeeIn('@nav #tab-history', 'History')
	->click('@nav #tab-history')
	->with('@history-tab', function (Browser $browser) use ($pages) {
	$browser->waitUntilMissing('.app-loader')
	->assertElementsCount('table tbody tr', 10)
	->assertMissing('table td.email')
	->assertSeeIn('#transactions-loader button', 'Load more');

	foreach ($pages[0] as $idx => $transaction) {
	$selector = 'table tbody tr:nth-child(' . ($idx + 1) . ')';
	$priceStyle = $transaction->type == Transaction::WALLET_AWARD ? 'text-success' : 'text-danger';
	$browser->assertSeeIn("$selector td.description", $transaction->shortDescription())
	->assertMissing("$selector td.selection button")
	->assertVisible("$selector td.price.{$priceStyle}");
	// TODO: Test more transaction details
	}

	// Load the next page
	$browser->click('#transactions-loader button')
	->waitUntilMissing('.app-loader')
	->assertElementsCount('table tbody tr', 12)
	->assertMissing('#transactions-loader button');

	$debitEntry = null;
	foreach ($pages[1] as $idx => $transaction) {
	$selector = 'table tbody tr:nth-child(' . ($idx + 1 + 10) . ')';
	$priceStyle = $transaction->type == Transaction::WALLET_CREDIT ? 'text-success' : 'text-danger';
	$browser->assertSeeIn("$selector td.description", $transaction->shortDescription());

	if ($transaction->type == Transaction::WALLET_DEBIT) {
	$debitEntry = $selector;
	} else {
	$browser->assertMissing("$selector td.selection button");
	}
	}
	});
	});
	}
	}
	diff --git a/src/tests/Browser/UsersTest.php b/src/tests/Browser/UsersTest.php
	index 7a8905c2..116f4bdb 100644
	--- a/src/tests/Browser/UsersTest.php
	+++ b/src/tests/Browser/UsersTest.php
	@@ -1,713 +1,734 @@
	<?php

	namespace Tests\Browser;

	use App\Discount;
	use App\Entitlement;
	use App\Sku;
	use App\User;
	use App\UserAlias;
	use Tests\Browser;
	use Tests\Browser\Components\Dialog;
	use Tests\Browser\Components\ListInput;
	use Tests\Browser\Components\QuotaInput;
	use Tests\Browser\Components\Toast;
	use Tests\Browser\Pages\Dashboard;
	use Tests\Browser\Pages\Home;
	use Tests\Browser\Pages\UserInfo;
	use Tests\Browser\Pages\UserList;
	use Tests\TestCaseDusk;
	use Illuminate\Foundation\Testing\DatabaseMigrations;

	class UsersTest extends TestCaseDusk
	{
	private $profile = [
	'first_name' => 'John',
	'last_name' => 'Doe',
	'organization' => 'Kolab Developers',
	];

	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();

	$this->deleteTestUser('julia.roberts@kolab.org');

	$john = User::where('email', 'john@kolab.org')->first();
	$john->setSettings($this->profile);
	UserAlias::where('user_id', $john->id)
	->where('alias', 'john.test@kolab.org')->delete();

	- Entitlement::where('entitleable_id', $john->id)->whereIn('cost', [25, 100])->delete();
	+ $activesync_sku = Sku::withEnvTenantContext()->where('title', 'activesync')->first();
	+ $storage_sku = Sku::withEnvTenantContext()->where('title', 'storage')->first();
	+
	+ Entitlement::where('entitleable_id', $john->id)->where('sku_id', $activesync_sku->id)->delete();
	Entitlement::where('cost', '>=', 5000)->delete();
	+ Entitlement::where('cost', '=', 25)->where('sku_id', $storage_sku->id)->delete();

	$wallet = $john->wallets()->first();
	$wallet->discount()->dissociate();
	$wallet->save();

	$this->clearBetaEntitlements();
	$this->clearMeetEntitlements();
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	$this->deleteTestUser('julia.roberts@kolab.org');

	$john = User::where('email', 'john@kolab.org')->first();
	$john->setSettings($this->profile);
	UserAlias::where('user_id', $john->id)
	->where('alias', 'john.test@kolab.org')->delete();

	- Entitlement::where('entitleable_id', $john->id)->whereIn('cost', [25, 100])->delete();
	+ $activesync_sku = Sku::withEnvTenantContext()->where('title', 'activesync')->first();
	+ $storage_sku = Sku::withEnvTenantContext()->where('title', 'storage')->first();
	+
	+ Entitlement::where('entitleable_id', $john->id)->where('sku_id', $activesync_sku->id)->delete();
	Entitlement::where('cost', '>=', 5000)->delete();
	+ Entitlement::where('cost', '=', 25)->where('sku_id', $storage_sku->id)->delete();

	$wallet = $john->wallets()->first();
	$wallet->discount()->dissociate();
	$wallet->save();

	$this->clearBetaEntitlements();
	$this->clearMeetEntitlements();

	parent::tearDown();
	}

	/**
	* Test user info page (unauthenticated)
	*/
	public function testInfoUnauth(): void
	{
	// Test that the page requires authentication
	$this->browse(function (Browser $browser) {
	$user = User::where('email', 'john@kolab.org')->first();

	$browser->visit('/user/' . $user->id)->on(new Home());
	});
	}

	/**
	* Test users list page (unauthenticated)
	*/
	public function testListUnauth(): void
	{
	// Test that the page requires authentication
	$this->browse(function (Browser $browser) {
	$browser->visit('/users')->on(new Home());
	});
	}

	/**
	* Test users list page
	*/
	public function testList(): void
	{
	// Test that the page requires authentication
	$this->browse(function (Browser $browser) {
	$browser->visit(new Home())
	->submitLogon('john@kolab.org', 'simple123', true)
	->on(new Dashboard())
	->assertSeeIn('@links .link-users', 'User accounts')
	->click('@links .link-users')
	->on(new UserList())
	->whenAvailable('@table', function (Browser $browser) {
	$browser->waitFor('tbody tr')
	->assertElementsCount('tbody tr', 4)
	->assertSeeIn('tbody tr:nth-child(1) a', 'jack@kolab.org')
	->assertSeeIn('tbody tr:nth-child(2) a', 'joe@kolab.org')
	->assertSeeIn('tbody tr:nth-child(3) a', 'john@kolab.org')
	->assertSeeIn('tbody tr:nth-child(4) a', 'ned@kolab.org')
	->assertMissing('tfoot');
	});
	});
	}

	/**
	* Test user account editing page (not profile page)
	*
	* @depends testList
	*/
	public function testInfo(): void
	{
	$this->browse(function (Browser $browser) {
	$browser->on(new UserList())
	->click('@table tr:nth-child(3) a')
	->on(new UserInfo())
	->assertSeeIn('#user-info .card-title', 'User account')
	->with('@form', function (Browser $browser) {
	// Assert form content
	$browser->assertSeeIn('div.row:nth-child(1) label', 'Status')
	->assertSeeIn('div.row:nth-child(1) #status', 'Active')
	->assertFocused('div.row:nth-child(2) input')
	->assertSeeIn('div.row:nth-child(2) label', 'First Name')
	->assertValue('div.row:nth-child(2) input[type=text]', $this->profile['first_name'])
	->assertSeeIn('div.row:nth-child(3) label', 'Last Name')
	->assertValue('div.row:nth-child(3) input[type=text]', $this->profile['last_name'])
	->assertSeeIn('div.row:nth-child(4) label', 'Organization')
	->assertValue('div.row:nth-child(4) input[type=text]', $this->profile['organization'])
	->assertSeeIn('div.row:nth-child(5) label', 'Email')
	->assertValue('div.row:nth-child(5) input[type=text]', 'john@kolab.org')
	->assertDisabled('div.row:nth-child(5) input[type=text]')
	->assertSeeIn('div.row:nth-child(6) label', 'Email Aliases')
	->assertVisible('div.row:nth-child(6) .list-input')
	->with(new ListInput('#aliases'), function (Browser $browser) {
	$browser->assertListInputValue(['john.doe@kolab.org'])
	->assertValue('@input', '');
	})
	->assertSeeIn('div.row:nth-child(7) label', 'Password')
	->assertValue('div.row:nth-child(7) input[type=password]', '')
	->assertSeeIn('div.row:nth-child(8) label', 'Confirm Password')
	->assertValue('div.row:nth-child(8) input[type=password]', '')
	->assertSeeIn('button[type=submit]', 'Submit')
	// Clear some fields and submit
	->vueClear('#first_name')
	->vueClear('#last_name')
	->click('button[type=submit]');
	})
	->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.')
	->on(new UserList())
	->click('@table tr:nth-child(3) a')
	->on(new UserInfo())
	->assertSeeIn('#user-info .card-title', 'User account')
	->with('@form', function (Browser $browser) {
	// Test error handling (password)
	$browser->type('#password', 'aaaaaa')
	->vueClear('#password_confirmation')
	->click('button[type=submit]')
	->waitFor('#password + .invalid-feedback')
	->assertSeeIn('#password + .invalid-feedback', 'The password confirmation does not match.')
	->assertFocused('#password')
	->assertToast(Toast::TYPE_ERROR, 'Form validation error');

	// TODO: Test password change

	// Test form error handling (aliases)
	$browser->vueClear('#password')
	->vueClear('#password_confirmation')
	->with(new ListInput('#aliases'), function (Browser $browser) {
	$browser->addListEntry('invalid address');
	})
	->click('button[type=submit]')
	->assertToast(Toast::TYPE_ERROR, 'Form validation error');

	$browser->with(new ListInput('#aliases'), function (Browser $browser) {
	$browser->assertFormError(2, 'The specified alias is invalid.', false);
	});

	// Test adding aliases
	$browser->with(new ListInput('#aliases'), function (Browser $browser) {
	$browser->removeListEntry(2)
	->addListEntry('john.test@kolab.org');
	})
	->click('button[type=submit]')
	->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');
	})
	->on(new UserList())
	->click('@table tr:nth-child(3) a')
	->on(new UserInfo());

	$john = User::where('email', 'john@kolab.org')->first();
	$alias = UserAlias::where('user_id', $john->id)->where('alias', 'john.test@kolab.org')->first();
	$this->assertTrue(!empty($alias));

	// Test subscriptions
	$browser->with('@form', function (Browser $browser) {
	$browser->assertSeeIn('div.row:nth-child(9) label', 'Subscriptions')
	->assertVisible('@skus.row:nth-child(9)')
	->with('@skus', function ($browser) {
	$browser->assertElementsCount('tbody tr', 6)
	// Mailbox SKU
	->assertSeeIn('tbody tr:nth-child(1) td.name', 'User Mailbox')
	- ->assertSeeIn('tbody tr:nth-child(1) td.price', '4,44 CHF/month')
	+ ->assertSeeIn('tbody tr:nth-child(1) td.price', '5,00 CHF/month')
	->assertChecked('tbody tr:nth-child(1) td.selection input')
	->assertDisabled('tbody tr:nth-child(1) td.selection input')
	->assertTip(
	'tbody tr:nth-child(1) td.buttons button',
	'Just a mailbox'
	)
	// Storage SKU
	->assertSeeIn('tbody tr:nth-child(2) td.name', 'Storage Quota')
	->assertSeeIn('tr:nth-child(2) td.price', '0,00 CHF/month')
	->assertChecked('tbody tr:nth-child(2) td.selection input')
	->assertDisabled('tbody tr:nth-child(2) td.selection input')
	->assertTip(
	'tbody tr:nth-child(2) td.buttons button',
	'Some wiggle room'
	)
	->with(new QuotaInput('tbody tr:nth-child(2) .range-input'), function ($browser) {
	- $browser->assertQuotaValue(2)->setQuotaValue(3);
	+ $browser->assertQuotaValue(5)->setQuotaValue(6);
	})
	->assertSeeIn('tr:nth-child(2) td.price', '0,25 CHF/month')
	// groupware SKU
	->assertSeeIn('tbody tr:nth-child(3) td.name', 'Groupware Features')
	- ->assertSeeIn('tbody tr:nth-child(3) td.price', '5,55 CHF/month')
	+ ->assertSeeIn('tbody tr:nth-child(3) td.price', '4,90 CHF/month')
	->assertChecked('tbody tr:nth-child(3) td.selection input')
	->assertEnabled('tbody tr:nth-child(3) td.selection input')
	->assertTip(
	'tbody tr:nth-child(3) td.buttons button',
	'Groupware functions like Calendar, Tasks, Notes, etc.'
	)
	// ActiveSync SKU
	->assertSeeIn('tbody tr:nth-child(4) td.name', 'Activesync')
	- ->assertSeeIn('tbody tr:nth-child(4) td.price', '1,00 CHF/month')
	+ ->assertSeeIn('tbody tr:nth-child(4) td.price', '0,00 CHF/month')
	->assertNotChecked('tbody tr:nth-child(4) td.selection input')
	->assertEnabled('tbody tr:nth-child(4) td.selection input')
	->assertTip(
	'tbody tr:nth-child(4) td.buttons button',
	'Mobile synchronization'
	)
	// 2FA SKU
	->assertSeeIn('tbody tr:nth-child(5) td.name', '2-Factor Authentication')
	->assertSeeIn('tbody tr:nth-child(5) td.price', '0,00 CHF/month')
	->assertNotChecked('tbody tr:nth-child(5) td.selection input')
	->assertEnabled('tbody tr:nth-child(5) td.selection input')
	->assertTip(
	'tbody tr:nth-child(5) td.buttons button',
	'Two factor authentication for webmail and administration panel'
	)
	// Meet SKU
	->assertSeeIn('tbody tr:nth-child(6) td.name', 'Voice & Video Conferencing (public beta)')
	->assertSeeIn('tbody tr:nth-child(6) td.price', '0,00 CHF/month')
	->assertNotChecked('tbody tr:nth-child(6) td.selection input')
	->assertEnabled('tbody tr:nth-child(6) td.selection input')
	->assertTip(
	'tbody tr:nth-child(6) td.buttons button',
	'Video conferencing tool'
	)
	->click('tbody tr:nth-child(4) td.selection input');
	})
	->assertMissing('@skus table + .hint')
	->click('button[type=submit]')
	->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');
	})
	->on(new UserList())
	->click('@table tr:nth-child(3) a')
	->on(new UserInfo());

	- $expected = ['activesync', 'groupware', 'mailbox', 'storage', 'storage', 'storage'];
	+ $expected = ['activesync', 'groupware', 'mailbox',
	+ 'storage', 'storage', 'storage', 'storage', 'storage', 'storage'];
	$this->assertUserEntitlements($john, $expected);

	// Test subscriptions interaction
	$browser->with('@form', function (Browser $browser) {
	$browser->with('@skus', function ($browser) {
	// Uncheck 'groupware', expect activesync unchecked
	$browser->click('#sku-input-groupware')
	->assertNotChecked('#sku-input-groupware')
	->assertNotChecked('#sku-input-activesync')
	->assertEnabled('#sku-input-activesync')
	->assertNotReadonly('#sku-input-activesync')
	// Check 'activesync', expect an alert
	->click('#sku-input-activesync')
	->assertDialogOpened('Activesync requires Groupware Features.')
	->acceptDialog()
	->assertNotChecked('#sku-input-activesync')
	// Check 'meet', expect an alert
	->click('#sku-input-meet')
	->assertDialogOpened('Voice & Video Conferencing (public beta) requires Groupware Features.')
	->acceptDialog()
	->assertNotChecked('#sku-input-meet')
	// Check '2FA', expect 'activesync' unchecked and readonly
	->click('#sku-input-2fa')
	->assertChecked('#sku-input-2fa')
	->assertNotChecked('#sku-input-activesync')
	->assertReadonly('#sku-input-activesync')
	// Uncheck '2FA'
	->click('#sku-input-2fa')
	->assertNotChecked('#sku-input-2fa')
	->assertNotReadonly('#sku-input-activesync');
	});
	});
	});
	}

	/**
	* Test user adding page
	*
	* @depends testList
	*/
	public function testNewUser(): void
	{
	$this->browse(function (Browser $browser) {
	$browser->visit(new UserList())
	->assertSeeIn('button.create-user', 'Create user')
	->click('button.create-user')
	->on(new UserInfo())
	->assertSeeIn('#user-info .card-title', 'New user account')
	->with('@form', function (Browser $browser) {
	// Assert form content
	$browser->assertFocused('div.row:nth-child(1) input')
	->assertSeeIn('div.row:nth-child(1) label', 'First Name')
	->assertValue('div.row:nth-child(1) input[type=text]', '')
	->assertSeeIn('div.row:nth-child(2) label', 'Last Name')
	->assertValue('div.row:nth-child(2) input[type=text]', '')
	->assertSeeIn('div.row:nth-child(3) label', 'Organization')
	->assertValue('div.row:nth-child(3) input[type=text]', '')
	->assertSeeIn('div.row:nth-child(4) label', 'Email')
	->assertValue('div.row:nth-child(4) input[type=text]', '')
	->assertEnabled('div.row:nth-child(4) input[type=text]')
	->assertSeeIn('div.row:nth-child(5) label', 'Email Aliases')
	->assertVisible('div.row:nth-child(5) .list-input')
	->with(new ListInput('#aliases'), function (Browser $browser) {
	$browser->assertListInputValue([])
	->assertValue('@input', '');
	})
	->assertSeeIn('div.row:nth-child(6) label', 'Password')
	->assertValue('div.row:nth-child(6) input[type=password]', '')
	->assertSeeIn('div.row:nth-child(7) label', 'Confirm Password')
	->assertValue('div.row:nth-child(7) input[type=password]', '')
	->assertSeeIn('div.row:nth-child(8) label', 'Package')
	// assert packages list widget, select "Lite Account"
	->with('@packages', function ($browser) {
	$browser->assertElementsCount('tbody tr', 2)
	->assertSeeIn('tbody tr:nth-child(1)', 'Groupware Account')
	->assertSeeIn('tbody tr:nth-child(2)', 'Lite Account')
	- ->assertSeeIn('tbody tr:nth-child(1) .price', '9,99 CHF/month')
	- ->assertSeeIn('tbody tr:nth-child(2) .price', '4,44 CHF/month')
	+ ->assertSeeIn('tbody tr:nth-child(1) .price', '9,90 CHF/month')
	+ ->assertSeeIn('tbody tr:nth-child(2) .price', '5,00 CHF/month')
	->assertChecked('tbody tr:nth-child(1) input')
	->click('tbody tr:nth-child(2) input')
	->assertNotChecked('tbody tr:nth-child(1) input')
	->assertChecked('tbody tr:nth-child(2) input');
	})
	->assertMissing('@packages table + .hint')
	->assertSeeIn('button[type=submit]', 'Submit');

	// Test browser-side required fields and error handling
	$browser->click('button[type=submit]')
	->assertFocused('#email')
	->type('#email', 'invalid email')
	->click('button[type=submit]')
	->assertFocused('#password')
	->type('#password', 'simple123')
	->click('button[type=submit]')
	->assertFocused('#password_confirmation')
	->type('#password_confirmation', 'simple')
	->click('button[type=submit]')
	->assertToast(Toast::TYPE_ERROR, 'Form validation error')
	->assertSeeIn('#email + .invalid-feedback', 'The specified email is invalid.')
	->assertSeeIn('#password + .invalid-feedback', 'The password confirmation does not match.');
	});

	// Test form error handling (aliases)
	$browser->with('@form', function (Browser $browser) {
	$browser->type('#email', 'julia.roberts@kolab.org')
	->type('#password_confirmation', 'simple123')
	->with(new ListInput('#aliases'), function (Browser $browser) {
	$browser->addListEntry('invalid address');
	})
	->click('button[type=submit]')
	->assertToast(Toast::TYPE_ERROR, 'Form validation error')
	->with(new ListInput('#aliases'), function (Browser $browser) {
	$browser->assertFormError(1, 'The specified alias is invalid.', false);
	});
	});

	// Successful account creation
	$browser->with('@form', function (Browser $browser) {
	$browser->type('#first_name', 'Julia')
	->type('#last_name', 'Roberts')
	->type('#organization', 'Test Org')
	->with(new ListInput('#aliases'), function (Browser $browser) {
	$browser->removeListEntry(1)
	->addListEntry('julia.roberts2@kolab.org');
	})
	->click('button[type=submit]');
	})
	->assertToast(Toast::TYPE_SUCCESS, 'User created successfully.')
	// check redirection to users list
	->on(new UserList())
	->whenAvailable('@table', function (Browser $browser) {
	$browser->assertElementsCount('tbody tr', 5)
	->assertSeeIn('tbody tr:nth-child(4) a', 'julia.roberts@kolab.org');
	});

	$julia = User::where('email', 'julia.roberts@kolab.org')->first();
	$alias = UserAlias::where('user_id', $julia->id)->where('alias', 'julia.roberts2@kolab.org')->first();
	$this->assertTrue(!empty($alias));
	- $this->assertUserEntitlements($julia, ['mailbox', 'storage', 'storage']);
	+ $this->assertUserEntitlements($julia, ['mailbox', 'storage', 'storage', 'storage', 'storage', 'storage']);
	$this->assertSame('Julia', $julia->getSetting('first_name'));
	$this->assertSame('Roberts', $julia->getSetting('last_name'));
	$this->assertSame('Test Org', $julia->getSetting('organization'));

	// Some additional tests for the list input widget
	$browser->click('tbody tr:nth-child(4) a')
	->on(new UserInfo())
	->with(new ListInput('#aliases'), function (Browser $browser) {
	$browser->assertListInputValue(['julia.roberts2@kolab.org'])
	->addListEntry('invalid address')
	->type('.input-group:nth-child(2) input', '@kolab.org');
	})
	->click('button[type=submit]')
	->assertToast(Toast::TYPE_ERROR, 'Form validation error')
	->with(new ListInput('#aliases'), function (Browser $browser) {
	$browser->assertVisible('.input-group:nth-child(2) input.is-invalid')
	->assertVisible('.input-group:nth-child(3) input.is-invalid')
	->type('.input-group:nth-child(2) input', 'julia.roberts3@kolab.org')
	->type('.input-group:nth-child(3) input', 'julia.roberts4@kolab.org');
	})
	->click('button[type=submit]')
	->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');

	$julia = User::where('email', 'julia.roberts@kolab.org')->first();
	$aliases = $julia->aliases()->orderBy('alias')->get()->pluck('alias')->all();
	$this->assertSame(['julia.roberts3@kolab.org', 'julia.roberts4@kolab.org'], $aliases);
	});
	}

	/**
	* Test user delete
	*
	* @depends testNewUser
	*/
	public function testDeleteUser(): void
	{
	// First create a new user
	$john = $this->getTestUser('john@kolab.org');
	$julia = $this->getTestUser('julia.roberts@kolab.org');
	$package_kolab = \App\Package::where('title', 'kolab')->first();
	$john->assignPackage($package_kolab, $julia);

	// Test deleting non-controller user
	$this->browse(function (Browser $browser) use ($julia) {
	$browser->visit('/user/' . $julia->id)
	->on(new UserInfo())
	->assertSeeIn('button.button-delete', 'Delete user')
	->click('button.button-delete')
	->with(new Dialog('#delete-warning'), function (Browser $browser) {
	$browser->assertSeeIn('@title', 'Delete julia.roberts@kolab.org')
	->assertFocused('@button-cancel')
	->assertSeeIn('@button-cancel', 'Cancel')
	->assertSeeIn('@button-action', 'Delete')
	->click('@button-cancel');
	})
	->waitUntilMissing('#delete-warning')
	->click('button.button-delete')
	->with(new Dialog('#delete-warning'), function (Browser $browser) {
	$browser->click('@button-action');
	})
	->waitUntilMissing('#delete-warning')
	->assertToast(Toast::TYPE_SUCCESS, 'User deleted successfully.')
	->on(new UserList())
	->with('@table', function (Browser $browser) {
	$browser->assertElementsCount('tbody tr', 4)
	->assertSeeIn('tbody tr:nth-child(1) a', 'jack@kolab.org')
	->assertSeeIn('tbody tr:nth-child(2) a', 'joe@kolab.org')
	->assertSeeIn('tbody tr:nth-child(3) a', 'john@kolab.org')
	->assertSeeIn('tbody tr:nth-child(4) a', 'ned@kolab.org');
	});

	$julia = User::where('email', 'julia.roberts@kolab.org')->first();
	$this->assertTrue(empty($julia));
	});

	// Test that non-controller user cannot see/delete himself on the users list
	$this->browse(function (Browser $browser) {
	$browser->visit('/logout')
	->on(new Home())
	->submitLogon('jack@kolab.org', 'simple123', true)
	->visit('/users')
	->assertErrorPage(403);
	});

	// Test that controller user (Ned) can see all the users
	$this->browse(function (Browser $browser) {
	$browser->visit('/logout')
	->on(new Home())
	->submitLogon('ned@kolab.org', 'simple123', true)
	->visit(new UserList())
	->whenAvailable('@table', function (Browser $browser) {
	$browser->assertElementsCount('tbody tr', 4);
	});

	// TODO: Test the delete action in details
	});

	// TODO: Test what happens with the logged in user session after he's been deleted by another user
	}

	/**
	* Test discounted sku/package prices in the UI
	*/
	public function testDiscountedPrices(): void
	{
	// Add 10% discount
	$discount = Discount::where('code', 'TEST')->first();
	$john = User::where('email', 'john@kolab.org')->first();
	$wallet = $john->wallet();
	$wallet->discount()->associate($discount);
	$wallet->save();

	// SKUs on user edit page
	$this->browse(function (Browser $browser) {
	$browser->visit('/logout')
	->on(new Home())
	->submitLogon('john@kolab.org', 'simple123', true)
	->visit(new UserList())
	->waitFor('@table tr:nth-child(2)')
	->click('@table tr:nth-child(2) a') // joe@kolab.org
	->on(new UserInfo())
	->with('@form', function (Browser $browser) {
	$browser->whenAvailable('@skus', function (Browser $browser) {
	$quota_input = new QuotaInput('tbody tr:nth-child(2) .range-input');
	$browser->waitFor('tbody tr')
	->assertElementsCount('tbody tr', 6)
	// Mailbox SKU
	- ->assertSeeIn('tbody tr:nth-child(1) td.price', '3,99 CHF/month¹')
	+ ->assertSeeIn('tbody tr:nth-child(1) td.price', '4,50 CHF/month¹')
	// Storage SKU
	->assertSeeIn('tr:nth-child(2) td.price', '0,00 CHF/month¹')
	->with($quota_input, function (Browser $browser) {
	$browser->setQuotaValue(100);
	})
	- ->assertSeeIn('tr:nth-child(2) td.price', '22,05 CHF/month¹')
	+ ->assertSeeIn('tr:nth-child(2) td.price', '21,37 CHF/month¹')
	// groupware SKU
	- ->assertSeeIn('tbody tr:nth-child(3) td.price', '4,99 CHF/month¹')
	+ ->assertSeeIn('tbody tr:nth-child(3) td.price', '4,41 CHF/month¹')
	// ActiveSync SKU
	- ->assertSeeIn('tbody tr:nth-child(4) td.price', '0,90 CHF/month¹')
	+ ->assertSeeIn('tbody tr:nth-child(4) td.price', '0,00 CHF/month¹')
	// 2FA SKU
	->assertSeeIn('tbody tr:nth-child(5) td.price', '0,00 CHF/month¹');
	})
	->assertSeeIn('@skus table + .hint', '¹ applied discount: 10% - Test voucher');
	});
	});

	// Packages on new user page
	$this->browse(function (Browser $browser) {
	$browser->visit(new UserList())
	->click('button.create-user')
	->on(new UserInfo())
	->with('@form', function (Browser $browser) {
	$browser->whenAvailable('@packages', function (Browser $browser) {
	$browser->assertElementsCount('tbody tr', 2)
	- ->assertSeeIn('tbody tr:nth-child(1) .price', '8,99 CHF/month¹') // Groupware
	- ->assertSeeIn('tbody tr:nth-child(2) .price', '3,99 CHF/month¹'); // Lite
	+ ->assertSeeIn('tbody tr:nth-child(1) .price', '8,91 CHF/month¹') // Groupware
	+ ->assertSeeIn('tbody tr:nth-child(2) .price', '4,50 CHF/month¹'); // Lite
	})
	->assertSeeIn('@packages table + .hint', '¹ applied discount: 10% - Test voucher');
	});
	});

	// Test using entitlement cost instead of the SKU cost
	$this->browse(function (Browser $browser) use ($wallet) {
	$joe = User::where('email', 'joe@kolab.org')->first();
	- $beta_sku = Sku::where('title', 'beta')->first();
	- $storage_sku = Sku::where('title', 'storage')->first();
	+ $beta_sku = Sku::withEnvTenantContext()->where('title', 'beta')->first();
	+ $storage_sku = Sku::withEnvTenantContext()->where('title', 'storage')->first();

	// Add an extra storage and beta entitlement with different prices
	Entitlement::create([
	'wallet_id' => $wallet->id,
	'sku_id' => $beta_sku->id,
	'cost' => 5010,
	'entitleable_id' => $joe->id,
	'entitleable_type' => User::class
	]);
	Entitlement::create([
	'wallet_id' => $wallet->id,
	'sku_id' => $storage_sku->id,
	'cost' => 5000,
	'entitleable_id' => $joe->id,
	'entitleable_type' => User::class
	]);

	$browser->visit('/user/' . $joe->id)
	->on(new UserInfo())
	->with('@form', function (Browser $browser) {
	$browser->whenAvailable('@skus', function (Browser $browser) {
	$quota_input = new QuotaInput('tbody tr:nth-child(2) .range-input');
	$browser->waitFor('tbody tr')
	// Beta SKU
	->assertSeeIn('tbody tr:nth-child(7) td.price', '45,09 CHF/month¹')
	// Storage SKU
	->assertSeeIn('tr:nth-child(2) td.price', '45,00 CHF/month¹')
	->with($quota_input, function (Browser $browser) {
	- $browser->setQuotaValue(4);
	+ $browser->setQuotaValue(7);
	})
	->assertSeeIn('tr:nth-child(2) td.price', '45,22 CHF/month¹')
	->with($quota_input, function (Browser $browser) {
	- $browser->setQuotaValue(2);
	+ $browser->setQuotaValue(5);
	})
	->assertSeeIn('tr:nth-child(2) td.price', '0,00 CHF/month¹');
	})
	->assertSeeIn('@skus table + .hint', '¹ applied discount: 10% - Test voucher');
	});
	});
	}

	/**
	* Test beta entitlements
	*
	* @depends testList
	*/
	public function testBetaEntitlements(): void
	{
	$this->browse(function (Browser $browser) {
	$john = User::where('email', 'john@kolab.org')->first();
	- $sku = Sku::where('title', 'beta')->first();
	+ $sku = Sku::withEnvTenantContext()->where('title', 'beta')->first();
	$john->assignSku($sku);

	$browser->visit('/user/' . $john->id)
	->on(new UserInfo())
	->with('@skus', function ($browser) {
	$browser->assertElementsCount('tbody tr', 8)
	// Meet SKU
	->assertSeeIn('tbody tr:nth-child(6) td.name', 'Voice & Video Conferencing (public beta)')
	->assertSeeIn('tr:nth-child(6) td.price', '0,00 CHF/month')
	->assertNotChecked('tbody tr:nth-child(6) td.selection input')
	->assertEnabled('tbody tr:nth-child(6) td.selection input')
	->assertTip(
	'tbody tr:nth-child(6) td.buttons button',
	'Video conferencing tool'
	)
	// Beta SKU
	->assertSeeIn('tbody tr:nth-child(7) td.name', 'Private Beta (invitation only)')
	->assertSeeIn('tbody tr:nth-child(7) td.price', '0,00 CHF/month')
	->assertChecked('tbody tr:nth-child(7) td.selection input')
	->assertEnabled('tbody tr:nth-child(7) td.selection input')
	->assertTip(
	'tbody tr:nth-child(7) td.buttons button',
	'Access to the private beta program subscriptions'
	)
	// Distlist SKU
	->assertSeeIn('tbody tr:nth-child(8) td.name', 'Distribution lists')
	->assertSeeIn('tr:nth-child(8) td.price', '0,00 CHF/month')
	->assertNotChecked('tbody tr:nth-child(8) td.selection input')
	->assertEnabled('tbody tr:nth-child(8) td.selection input')
	->assertTip(
	'tbody tr:nth-child(8) td.buttons button',
	'Access to mail distribution lists'
	)
	// Check Distlist, Uncheck Beta, expect Distlist unchecked
	->click('#sku-input-distlist')
	->click('#sku-input-beta')
	->assertNotChecked('#sku-input-beta')
	->assertNotChecked('#sku-input-distlist')
	// Click Distlist expect an alert
	->click('#sku-input-distlist')
	->assertDialogOpened('Distribution lists requires Private Beta (invitation only).')
	->acceptDialog()
	// Enable Beta and Distlist and submit
	->click('#sku-input-beta')
	->click('#sku-input-distlist');
	})
	->click('button[type=submit]')
	->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');

	- $expected = ['beta', 'distlist', 'groupware', 'mailbox', 'storage', 'storage'];
	+ $expected = [
	+ 'beta',
	+ 'distlist',
	+ 'groupware',
	+ 'mailbox',
	+ 'storage', 'storage', 'storage', 'storage', 'storage'
	+ ];
	+
	$this->assertUserEntitlements($john, $expected);

	$browser->visit('/user/' . $john->id)
	->on(new UserInfo())
	->click('#sku-input-beta')
	->click('button[type=submit]')
	->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');

	- $expected = ['groupware', 'mailbox', 'storage', 'storage'];
	+ $expected = [
	+ 'groupware',
	+ 'mailbox',
	+ 'storage', 'storage', 'storage', 'storage', 'storage'
	+ ];
	+
	$this->assertUserEntitlements($john, $expected);
	});

	// TODO: Test that the Distlist SKU is not available for users that aren't a group account owners
	// TODO: Test that entitlements change has immediate effect on the available items in dashboard
	// i.e. does not require a page reload nor re-login.
	}
	}
	diff --git a/src/tests/Feature/Backends/LDAPTest.php b/src/tests/Feature/Backends/LDAPTest.php
	index b5646656..4c4ffe17 100644
	--- a/src/tests/Feature/Backends/LDAPTest.php
	+++ b/src/tests/Feature/Backends/LDAPTest.php
	@@ -1,365 +1,365 @@
	<?php

	namespace Tests\Feature\Backends;

	use App\Backends\LDAP;
	use App\Domain;
	use App\Group;
	use App\Entitlement;
	use App\User;
	use Illuminate\Support\Facades\Queue;
	use Tests\TestCase;

	class LDAPTest extends TestCase
	{
	private $ldap_config = [];

	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();

	$this->ldap_config = [
	'ldap.hosts' => \config('ldap.hosts'),
	];

	$this->deleteTestUser('user-ldap-test@' . \config('app.domain'));
	$this->deleteTestDomain('testldap.com');
	$this->deleteTestGroup('group@kolab.org');
	// TODO: Remove group members
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	\config($this->ldap_config);

	$this->deleteTestUser('user-ldap-test@' . \config('app.domain'));
	$this->deleteTestDomain('testldap.com');
	$this->deleteTestGroup('group@kolab.org');
	// TODO: Remove group members

	parent::tearDown();
	}

	/**
	* Test handling connection errors
	*
	* @group ldap
	*/
	public function testConnectException(): void
	{
	\config(['ldap.hosts' => 'non-existing.host']);

	$this->expectException(\Exception::class);

	LDAP::connect();
	}

	/**
	* Test creating/updating/deleting a domain record
	*
	* @group ldap
	*/
	public function testDomain(): void
	{
	Queue::fake();

	$domain = $this->getTestDomain('testldap.com', [
	'type' => Domain::TYPE_EXTERNAL,
	'status' => Domain::STATUS_NEW \| Domain::STATUS_ACTIVE,
	]);

	// Create the domain
	LDAP::createDomain($domain);

	$ldap_domain = LDAP::getDomain($domain->namespace);

	$expected = [
	'associateddomain' => $domain->namespace,
	'inetdomainstatus' => $domain->status,
	'objectclass' => [
	'top',
	'domainrelatedobject',
	'inetdomain'
	],
	];

	foreach ($expected as $attr => $value) {
	$this->assertEquals($value, isset($ldap_domain[$attr]) ? $ldap_domain[$attr] : null);
	}

	// TODO: Test other attributes, aci, roles/ous

	// Update the domain
	$domain->status \|= User::STATUS_LDAP_READY;

	LDAP::updateDomain($domain);

	$expected['inetdomainstatus'] = $domain->status;

	$ldap_domain = LDAP::getDomain($domain->namespace);

	foreach ($expected as $attr => $value) {
	$this->assertEquals($value, isset($ldap_domain[$attr]) ? $ldap_domain[$attr] : null);
	}

	// Delete the domain
	LDAP::deleteDomain($domain);

	$this->assertSame(null, LDAP::getDomain($domain->namespace));
	}

	/**
	* Test creating/updating/deleting a group record
	*
	* @group ldap
	*/
	public function testGroup(): void
	{
	Queue::fake();

	$root_dn = \config('ldap.hosted.root_dn');
	$group = $this->getTestGroup('group@kolab.org', [
	'members' => ['member1@testldap.com', 'member2@testldap.com']
	]);

	// Create the group
	LDAP::createGroup($group);

	$ldap_group = LDAP::getGroup($group->email);

	$expected = [
	'cn' => 'group',
	'dn' => 'cn=group,ou=Groups,ou=kolab.org,' . $root_dn,
	'mail' => $group->email,
	'objectclass' => [
	'top',
	'groupofuniquenames',
	'kolabgroupofuniquenames'
	],
	'uniquemember' => [
	'uid=member1@testldap.com,ou=People,ou=kolab.org,' . $root_dn,
	'uid=member2@testldap.com,ou=People,ou=kolab.org,' . $root_dn,
	],
	];

	foreach ($expected as $attr => $value) {
	$this->assertEquals($value, isset($ldap_group[$attr]) ? $ldap_group[$attr] : null, "Group $attr attribute");
	}

	// Update members
	$group->members = ['member3@testldap.com'];
	$group->save();

	LDAP::updateGroup($group);

	// TODO: Should we force this to be always an array?
	$expected['uniquemember'] = 'uid=member3@testldap.com,ou=People,ou=kolab.org,' . $root_dn;

	$ldap_group = LDAP::getGroup($group->email);

	foreach ($expected as $attr => $value) {
	$this->assertEquals($value, isset($ldap_group[$attr]) ? $ldap_group[$attr] : null, "Group $attr attribute");
	}

	$this->assertSame(['member3@testldap.com'], $group->fresh()->members);

	// Update members (add non-existing local member, expect it to be aot-removed from the group)
	$group->members = ['member3@testldap.com', 'member-local@kolab.org'];
	$group->save();

	LDAP::updateGroup($group);

	// TODO: Should we force this to be always an array?
	$expected['uniquemember'] = 'uid=member3@testldap.com,ou=People,ou=kolab.org,' . $root_dn;

	$ldap_group = LDAP::getGroup($group->email);

	foreach ($expected as $attr => $value) {
	$this->assertEquals($value, isset($ldap_group[$attr]) ? $ldap_group[$attr] : null, "Group $attr attribute");
	}

	$this->assertSame(['member3@testldap.com'], $group->fresh()->members);

	// We called save() twice, so we expect two update obs, this is making sure
	// that there's no job executed by the LDAP backend
	Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 2);

	// Delete the domain
	LDAP::deleteGroup($group);

	$this->assertSame(null, LDAP::getGroup($group->email));
	}

	/**
	* Test creating/editing/deleting a user record
	*
	* @group ldap
	*/
	public function testUser(): void
	{
	Queue::fake();

	$user = $this->getTestUser('user-ldap-test@' . \config('app.domain'));

	LDAP::createUser($user);

	$ldap_user = LDAP::getUser($user->email);

	$expected = [
	'objectclass' => [
	'top',
	'inetorgperson',
	'inetuser',
	'kolabinetorgperson',
	'mailrecipient',
	'person',
	'organizationalPerson',
	],
	'mail' => $user->email,
	'uid' => $user->email,
	'nsroledn' => [
	'cn=imap-user,' . \config('ldap.hosted.root_dn')
	],
	'cn' => 'unknown',
	'displayname' => '',
	'givenname' => '',
	'sn' => 'unknown',
	'inetuserstatus' => $user->status,
	'mailquota' => null,
	'o' => '',
	'alias' => null,
	];

	foreach ($expected as $attr => $value) {
	$this->assertEquals($value, isset($ldap_user[$attr]) ? $ldap_user[$attr] : null);
	}

	// Add aliases, and change some user settings, and entitlements
	$user->setSettings([
	'first_name' => 'Firstname',
	'last_name' => 'Lastname',
	'organization' => 'Org',
	'country' => 'PL',
	]);
	$user->status \|= User::STATUS_IMAP_READY;
	$user->save();
	$aliases = ['t1-' . $user->email, 't2-' . $user->email];
	$user->setAliases($aliases);
	- $package_kolab = \App\Package::where('title', 'kolab')->first();
	+ $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
	$user->assignPackage($package_kolab);

	LDAP::updateUser($user->fresh());

	$expected['alias'] = $aliases;
	$expected['o'] = 'Org';
	$expected['displayname'] = 'Lastname, Firstname';
	$expected['givenname'] = 'Firstname';
	$expected['cn'] = 'Firstname Lastname';
	$expected['sn'] = 'Lastname';
	$expected['inetuserstatus'] = $user->status;
	- $expected['mailquota'] = 2097152;
	+ $expected['mailquota'] = 5242880;
	$expected['nsroledn'] = null;

	$ldap_user = LDAP::getUser($user->email);

	foreach ($expected as $attr => $value) {
	$this->assertEquals($value, isset($ldap_user[$attr]) ? $ldap_user[$attr] : null);
	}

	// Update entitlements
	- $sku_activesync = \App\Sku::where('title', 'activesync')->first();
	- $sku_groupware = \App\Sku::where('title', 'groupware')->first();
	+ $sku_activesync = \App\Sku::withEnvTenantContext()->where('title', 'activesync')->first();
	+ $sku_groupware = \App\Sku::withEnvTenantContext()->where('title', 'groupware')->first();
	$user->assignSku($sku_activesync, 1);
	Entitlement::where(['sku_id' => $sku_groupware->id, 'entitleable_id' => $user->id])->delete();

	LDAP::updateUser($user->fresh());

	$expected_roles = [
	'activesync-user',
	'imap-user'
	];

	$ldap_user = LDAP::getUser($user->email);

	$this->assertCount(2, $ldap_user['nsroledn']);

	$ldap_roles = array_map(
	function ($role) {
	if (preg_match('/^cn=([a-z0-9-]+)/', $role, $m)) {
	return $m[1];
	} else {
	return $role;
	}
	},
	$ldap_user['nsroledn']
	);

	$this->assertSame($expected_roles, $ldap_roles);

	// Delete the user
	LDAP::deleteUser($user);

	$this->assertSame(null, LDAP::getUser($user->email));
	}

	/**
	* Test handling errors on user creation
	*
	* @group ldap
	*/
	public function testCreateUserException(): void
	{
	$this->expectException(\Exception::class);
	$this->expectExceptionMessageMatches('/Failed to create user/');

	$user = new User([
	'email' => 'test-non-existing-ldap@non-existing.org',
	'status' => User::STATUS_ACTIVE,
	]);

	LDAP::createUser($user);
	}

	/**
	* Test handling update of a non-existing domain
	*
	* @group ldap
	*/
	public function testUpdateDomainException(): void
	{
	$this->expectException(\Exception::class);
	$this->expectExceptionMessageMatches('/domain not found/');

	$domain = new Domain([
	'namespace' => 'testldap.com',
	'type' => Domain::TYPE_EXTERNAL,
	'status' => Domain::STATUS_NEW \| Domain::STATUS_ACTIVE,
	]);

	LDAP::updateDomain($domain);
	}

	/**
	* Test handling update of a non-existing user
	*
	* @group ldap
	*/
	public function testUpdateUserException(): void
	{
	$this->expectException(\Exception::class);
	$this->expectExceptionMessageMatches('/user not found/');

	$user = new User([
	'email' => 'test-non-existing-ldap@kolab.org',
	'status' => User::STATUS_ACTIVE,
	]);

	LDAP::updateUser($user);
	}
	}
	diff --git a/src/tests/Feature/BillingTest.php b/src/tests/Feature/BillingTest.php
	index ff4249d0..6de67de2 100644
	--- a/src/tests/Feature/BillingTest.php
	+++ b/src/tests/Feature/BillingTest.php
	@@ -1,262 +1,262 @@
	<?php

	namespace Tests\Feature;

	use Carbon\Carbon;
	use Illuminate\Support\Facades\Queue;
	use Tests\TestCase;

	class BillingTest extends TestCase
	{
	/** @property \App\Package $package */
	private $package;

	/** @property \App\User $user */
	private $user;

	/** @property \App\Wallet $wallet */
	private $wallet;

	/** @property string $wallet_id */
	private $wallet_id;

	public function setUp(): void
	{
	parent::setUp();

	$this->deleteTestUser('jane@kolabnow.com');
	$this->deleteTestUser('jack@kolabnow.com');

	- \App\Package::where('title', 'kolab-kube')->delete();
	+ \App\Package::withEnvTenantContext()->where('title', 'kolab-kube')->delete();

	$this->user = $this->getTestUser('jane@kolabnow.com');
	- $this->package = \App\Package::where('title', 'kolab')->first();
	+ $this->package = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
	$this->user->assignPackage($this->package);

	$this->wallet = $this->user->wallets->first();

	$this->wallet_id = $this->wallet->id;
	}

	public function tearDown(): void
	{
	$this->deleteTestUser('jane@kolabnow.com');
	$this->deleteTestUser('jack@kolabnow.com');

	- \App\Package::where('title', 'kolab-kube')->delete();
	+ \App\Package::withEnvTenantContext()->where('title', 'kolab-kube')->delete();

	parent::tearDown();
	}

	/**
	* Test the expected results for a user that registers and is almost immediately gone.
	*/
	public function testTouchAndGo(): void
	{
	- $this->assertCount(4, $this->wallet->entitlements);
	+ $this->assertCount(7, $this->wallet->entitlements);

	$this->assertEquals(0, $this->wallet->expectedCharges());

	$this->user->delete();

	$this->assertCount(0, $this->wallet->fresh()->entitlements->where('deleted_at', null));

	- $this->assertCount(4, $this->wallet->entitlements);
	+ $this->assertCount(7, $this->wallet->entitlements);
	}

	/**
	* Verify the last day before the end of a full month's trial.
	*/
	public function testNearFullTrial(): void
	{
	$this->backdateEntitlements(
	$this->wallet->entitlements,
	Carbon::now()->subMonthsWithoutOverflow(1)->addDays(1)
	);

	$this->assertEquals(0, $this->wallet->expectedCharges());
	}

	/**
	* Verify the exact end of the month's trial.
	*/
	public function testFullTrial(): void
	{
	$this->backdateEntitlements(
	$this->wallet->entitlements,
	Carbon::now()->subMonthsWithoutOverflow(1)
	);

	- $this->assertEquals(999, $this->wallet->expectedCharges());
	+ $this->assertEquals(990, $this->wallet->expectedCharges());
	}

	/**
	* Verify that over-running the trial by a single day causes charges to be incurred.
	*/
	public function testOutRunTrial(): void
	{
	$this->backdateEntitlements(
	$this->wallet->entitlements,
	Carbon::now()->subMonthsWithoutOverflow(1)->subDays(1)
	);

	- $this->assertEquals(999, $this->wallet->expectedCharges());
	+ $this->assertEquals(990, $this->wallet->expectedCharges());
	}

	/**
	* Verify additional storage configuration entitlement created 'early' does incur additional
	* charges to the wallet.
	*/
	public function testAddtStorageEarly(): void
	{
	$this->backdateEntitlements(
	$this->wallet->entitlements,
	Carbon::now()->subMonthsWithoutOverflow(1)->subDays(1)
	);

	- $this->assertEquals(999, $this->wallet->expectedCharges());
	+ $this->assertEquals(990, $this->wallet->expectedCharges());

	- $sku = \App\Sku::where(['title' => 'storage'])->first();
	+ $sku = \App\Sku::withEnvTenantContext()->where('title', 'storage')->first();

	$entitlement = \App\Entitlement::create(
	[
	'wallet_id' => $this->wallet_id,
	'sku_id' => $sku->id,
	'cost' => $sku->cost,
	'entitleable_id' => $this->user->id,
	'entitleable_type' => \App\User::class
	]
	);

	$this->backdateEntitlements(
	[$entitlement],
	Carbon::now()->subMonthsWithoutOverflow(1)->subDays(1)
	);

	- $this->assertEquals(1024, $this->wallet->expectedCharges());
	+ $this->assertEquals(1015, $this->wallet->expectedCharges());
	}

	/**
	* Verify additional storage configuration entitlement created 'late' does not incur additional
	* charges to the wallet.
	*/
	public function testAddtStorageLate(): void
	{
	$this->backdateEntitlements($this->wallet->entitlements, Carbon::now()->subMonthsWithoutOverflow(1));

	- $this->assertEquals(999, $this->wallet->expectedCharges());
	+ $this->assertEquals(990, $this->wallet->expectedCharges());

	- $sku = \App\Sku::where(['title' => 'storage'])->first();
	+ $sku = \App\Sku::withEnvTenantContext()->where(['title' => 'storage'])->first();

	$entitlement = \App\Entitlement::create(
	[
	'wallet_id' => $this->wallet_id,
	'sku_id' => $sku->id,
	'cost' => $sku->cost,
	'entitleable_id' => $this->user->id,
	'entitleable_type' => \App\User::class
	]
	);

	$this->backdateEntitlements([$entitlement], Carbon::now()->subDays(14));

	- $this->assertEquals(999, $this->wallet->expectedCharges());
	+ $this->assertEquals(990, $this->wallet->expectedCharges());
	}

	public function testFifthWeek(): void
	{
	$targetDateA = Carbon::now()->subWeeks(5);
	$targetDateB = $targetDateA->copy()->addMonthsWithoutOverflow(1);

	$this->backdateEntitlements($this->wallet->entitlements, $targetDateA);

	- $this->assertEquals(999, $this->wallet->expectedCharges());
	+ $this->assertEquals(990, $this->wallet->expectedCharges());

	$this->wallet->chargeEntitlements();

	- $this->assertEquals(-999, $this->wallet->balance);
	+ $this->assertEquals(-990, $this->wallet->balance);

	foreach ($this->wallet->entitlements()->get() as $entitlement) {
	$this->assertTrue($entitlement->created_at->isSameSecond($targetDateA));
	$this->assertTrue($entitlement->updated_at->isSameSecond($targetDateB));
	}
	}

	public function testSecondMonth(): void
	{
	$this->backdateEntitlements($this->wallet->entitlements, Carbon::now()->subMonthsWithoutOverflow(2));

	- $this->assertCount(4, $this->wallet->entitlements);
	+ $this->assertCount(7, $this->wallet->entitlements);

	- $this->assertEquals(1998, $this->wallet->expectedCharges());
	+ $this->assertEquals(1980, $this->wallet->expectedCharges());

	- $sku = \App\Sku::where(['title' => 'storage'])->first();
	+ $sku = \App\Sku::withEnvTenantContext()->where('title', 'storage')->first();

	$entitlement = \App\Entitlement::create(
	[
	'entitleable_id' => $this->user->id,
	'entitleable_type' => \App\User::class,
	'cost' => $sku->cost,
	'sku_id' => $sku->id,
	'wallet_id' => $this->wallet_id
	]
	);

	$this->backdateEntitlements([$entitlement], Carbon::now()->subMonthsWithoutOverflow(1));

	- $this->assertEquals(2023, $this->wallet->expectedCharges());
	+ $this->assertEquals(2005, $this->wallet->expectedCharges());
	}

	public function testWithDiscountRate(): void
	{
	$package = \App\Package::create(
	[
	'title' => 'kolab-kube',
	'name' => 'Kolab for Kuba Fans',
	'description' => 'Kolab for Kube fans',
	'discount_rate' => 50
	]
	);

	$skus = [
	- \App\Sku::firstOrCreate(['title' => 'mailbox']),
	- \App\Sku::firstOrCreate(['title' => 'storage']),
	- \App\Sku::firstOrCreate(['title' => 'groupware'])
	+ \App\Sku::withEnvTenantContext()->where('title', 'mailbox')->first(),
	+ \App\Sku::withEnvTenantContext()->where('title', 'storage')->first(),
	+ \App\Sku::withEnvTenantContext()->where('title', 'groupware')->first()
	];

	$package->skus()->saveMany($skus);

	$package->skus()->updateExistingPivot(
	- \App\Sku::firstOrCreate(['title' => 'storage']),
	- ['qty' => 2],
	+ \App\Sku::withEnvTenantContext()->where('title', 'storage')->first(),
	+ ['qty' => 5],
	false
	);

	$user = $this->getTestUser('jack@kolabnow.com');

	$user->assignPackage($package);

	$wallet = $user->wallets->first();

	$wallet_id = $wallet->id;

	$this->backdateEntitlements($wallet->entitlements, Carbon::now()->subMonthsWithoutOverflow(1));

	- $this->assertEquals(500, $wallet->expectedCharges());
	+ $this->assertEquals(495, $wallet->expectedCharges());
	}

	/**
	* Test cost calculation with a wallet discount
	*/
	public function testWithWalletDiscount(): void
	{
	- $discount = \App\Discount::where('code', 'TEST')->first();
	+ $discount = \App\Discount::withEnvTenantContext()->where('code', 'TEST')->first();

	$wallet = $this->user->wallets()->first();
	$wallet->discount()->associate($discount);

	$this->backdateEntitlements($wallet->entitlements, Carbon::now()->subMonthsWithoutOverflow(1));

	- $this->assertEquals(898, $wallet->expectedCharges());
	+ $this->assertEquals(891, $wallet->expectedCharges());
	}
	}
	diff --git a/src/tests/Feature/Console/DomainRestoreTest.php b/src/tests/Feature/Console/DomainRestoreTest.php
	index 64d46a49..d3d49702 100644
	--- a/src/tests/Feature/Console/DomainRestoreTest.php
	+++ b/src/tests/Feature/Console/DomainRestoreTest.php
	@@ -1,91 +1,91 @@
	<?php

	namespace Tests\Feature\Console;

	use Illuminate\Support\Facades\Queue;
	use Tests\TestCase;

	class DomainRestoreTest extends TestCase
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();

	$this->deleteTestUser('user@force-delete.com');
	$this->deleteTestDomain('force-delete.com');
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	$this->deleteTestUser('user@force-delete.com');
	$this->deleteTestDomain('force-delete.com');

	parent::tearDown();
	}

	/**
	* Test the command
	*/
	public function testHandle(): void
	{
	Queue::fake();

	// Non-existing domain
	$code = \Artisan::call("domain:restore unknown.org");
	$output = trim(\Artisan::output());
	$this->assertSame(1, $code);
	$this->assertSame("Domain not found.", $output);

	// Create a user account for delete
	$user = $this->getTestUser('user@force-delete.com');
	$domain = $this->getTestDomain('force-delete.com', [
	'status' => \App\Domain::STATUS_NEW,
	'type' => \App\Domain::TYPE_HOSTED,
	]);
	$package_kolab = \App\Package::where('title', 'kolab')->first();
	$package_domain = \App\Package::where('title', 'domain-hosting')->first();
	$user->assignPackage($package_kolab);
	$domain->assignPackage($package_domain, $user);
	$wallet = $user->wallets()->first();
	$entitlements = $wallet->entitlements->pluck('id')->all();

	- $this->assertCount(5, $entitlements);
	+ $this->assertCount(8, $entitlements);

	// Non-deleted domain
	$code = \Artisan::call("domain:restore force-delete.com");
	$output = trim(\Artisan::output());
	$this->assertSame(1, $code);
	$this->assertSame("The domain is not yet deleted.", $output);

	$domain->delete();

	$this->assertTrue($domain->fresh()->trashed());

	// Deleted domain
	$code = \Artisan::call("domain:restore force-delete.com");
	$output = trim(\Artisan::output());
	$this->assertSame(0, $code);
	$this->assertSame("", $output);

	$this->assertFalse($domain->fresh()->trashed());

	$user->delete();

	$this->assertTrue($domain->fresh()->trashed());
	$this->assertTrue($user->fresh()->trashed());

	// Deleted domain, deleted owner
	$code = \Artisan::call("domain:restore force-delete.com");
	$output = trim(\Artisan::output());
	$this->assertSame(1, $code);
	$this->assertSame("The domain owner is deleted.", $output);

	$this->assertTrue($domain->fresh()->trashed());
	}
	}
	diff --git a/src/tests/Feature/Console/Sku/ListUsersTest.php b/src/tests/Feature/Console/Sku/ListUsersTest.php
	index abf54505..b5aaa1ed 100644
	--- a/src/tests/Feature/Console/Sku/ListUsersTest.php
	+++ b/src/tests/Feature/Console/Sku/ListUsersTest.php
	@@ -1,78 +1,87 @@
	<?php

	namespace Tests\Feature\Console\Sku;

	use Illuminate\Contracts\Console\Kernel;
	use Tests\TestCase;

	class ListUsersTest extends TestCase
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();

	$this->deleteTestUser('sku-list-users@kolabnow.com');
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	$this->deleteTestUser('sku-list-users@kolabnow.com');

	parent::tearDown();
	}

	/**
	* Test command runs
	*/
	public function testHandle(): void
	{
	// Warning: We're not using artisan() here, as this will not
	// allow us to test "empty output" cases
	$code = \Artisan::call('sku:list-users meet');
	$output = trim(\Artisan::output());
	$this->assertSame(0, $code);
	$this->assertSame('', $output);

	$code = \Artisan::call('sku:list-users unknown');
	$output = trim(\Artisan::output());
	$this->assertSame(1, $code);
	$this->assertSame("Unable to find the SKU.", $output);

	$code = \Artisan::call('sku:list-users 2fa');
	$output = trim(\Artisan::output());
	$this->assertSame(0, $code);
	$this->assertSame("ned@kolab.org", $output);

	$code = \Artisan::call('sku:list-users mailbox');
	$output = trim(\Artisan::output());
	$this->assertSame(0, $code);
	- $this->assertSame("jack@kolab.org\njoe@kolab.org\njohn@kolab.org\nned@kolab.org", $output);
	+
	+ $expected = [
	+ "jack@kolab.org",
	+ "joe@kolab.org",
	+ "john@kolab.org",
	+ "ned@kolab.org",
	+ "reseller@" . \config('app.domain')
	+ ];
	+
	+ $this->assertSame(implode("\n", $expected), $output);

	$code = \Artisan::call('sku:list-users domain-hosting');
	$output = trim(\Artisan::output());
	$this->assertSame(0, $code);
	$this->assertSame("john@kolab.org", $output);

	$sku = \App\Sku::where('title', 'meet')->first();
	$user = $this->getTestUser('sku-list-users@kolabnow.com');
	$user->assignSku($sku);

	$code = \Artisan::call('sku:list-users meet');
	$output = trim(\Artisan::output());
	$this->assertSame(0, $code);
	$this->assertSame($user->email, $output);

	$user->assignSku($sku);

	$code = \Artisan::call('sku:list-users meet');
	$output = trim(\Artisan::output());
	$this->assertSame(0, $code);
	$this->assertSame($user->email, $output);
	}
	}
	diff --git a/src/tests/Feature/Console/UserForceDeleteTest.php b/src/tests/Feature/Console/UserForceDeleteTest.php
	index 5e50718b..4b57ea5e 100644
	--- a/src/tests/Feature/Console/UserForceDeleteTest.php
	+++ b/src/tests/Feature/Console/UserForceDeleteTest.php
	@@ -1,98 +1,98 @@
	<?php

	namespace Tests\Feature\Console;

	use Illuminate\Support\Facades\Queue;
	use Tests\TestCase;

	class UserForceDeleteTest extends TestCase
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();

	$this->deleteTestUser('user@force-delete.com');
	$this->deleteTestDomain('force-delete.com');
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	$this->deleteTestUser('user@force-delete.com');
	$this->deleteTestDomain('force-delete.com');

	parent::tearDown();
	}

	/**
	* Test the command
	*/
	public function testHandle(): void
	{
	// Non-existing user
	$this->artisan('user:force-delete unknown@unknown.org')
	->assertExitCode(1);

	Queue::fake();
	$user = $this->getTestUser('user@force-delete.com');
	$domain = $this->getTestDomain('force-delete.com', [
	'status' => \App\Domain::STATUS_NEW,
	'type' => \App\Domain::TYPE_HOSTED,
	]);
	- $package_kolab = \App\Package::where('title', 'kolab')->first();
	- $package_domain = \App\Package::where('title', 'domain-hosting')->first();
	+ $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
	+ $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
	$user->assignPackage($package_kolab);
	$domain->assignPackage($package_domain, $user);
	$wallet = $user->wallets()->first();
	$entitlements = $wallet->entitlements->pluck('id')->all();

	- $this->assertCount(5, $entitlements);
	+ $this->assertCount(8, $entitlements);

	// Non-deleted user
	$this->artisan('user:force-delete user@force-delete.com')
	->assertExitCode(1);

	$user->delete();

	$this->assertTrue($user->trashed());
	$this->assertTrue($domain->fresh()->trashed());

	// Deleted user
	$this->artisan('user:force-delete user@force-delete.com')
	->assertExitCode(0);

	$this->assertCount(
	0,
	\App\User::withTrashed()->where('email', 'user@force-delete.com')->get()
	);
	$this->assertCount(
	0,
	\App\Domain::withTrashed()->where('namespace', 'force-delete.com')->get()
	);
	$this->assertCount(
	0,
	\App\Wallet::where('id', $wallet->id)->get()
	);
	$this->assertCount(
	0,
	\App\Entitlement::withTrashed()->where('wallet_id', $wallet->id)->get()
	);
	$this->assertCount(
	0,
	\App\Entitlement::withTrashed()->where('entitleable_id', $user->id)->get()
	);
	$this->assertCount(
	0,
	\App\Transaction::whereIn('object_id', $entitlements)
	->where('object_type', \App\Entitlement::class)
	->get()
	);

	// TODO: Test that it also deletes users in a group account
	}
	}
	diff --git a/src/tests/Feature/Console/UserRestoreTest.php b/src/tests/Feature/Console/UserRestoreTest.php
	index a57db9cf..662b0fbd 100644
	--- a/src/tests/Feature/Console/UserRestoreTest.php
	+++ b/src/tests/Feature/Console/UserRestoreTest.php
	@@ -1,80 +1,80 @@
	<?php

	namespace Tests\Feature\Console;

	use Illuminate\Support\Facades\Queue;
	use Tests\TestCase;

	class UserRestoreTest extends TestCase
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();

	$this->deleteTestUser('user@force-delete.com');
	$this->deleteTestDomain('force-delete.com');
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	$this->deleteTestUser('user@force-delete.com');
	$this->deleteTestDomain('force-delete.com');

	parent::tearDown();
	}

	/**
	* Test the command
	*/
	public function testHandle(): void
	{
	Queue::fake();

	// Non-existing user
	$code = \Artisan::call("user:restore unknown@unknown.org");
	$output = trim(\Artisan::output());
	$this->assertSame(1, $code);
	$this->assertSame("User not found.", $output);

	// Create a user account for delete
	$user = $this->getTestUser('user@force-delete.com');
	$domain = $this->getTestDomain('force-delete.com', [
	'status' => \App\Domain::STATUS_NEW,
	'type' => \App\Domain::TYPE_HOSTED,
	]);
	- $package_kolab = \App\Package::where('title', 'kolab')->first();
	- $package_domain = \App\Package::where('title', 'domain-hosting')->first();
	+ $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
	+ $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
	$user->assignPackage($package_kolab);
	$domain->assignPackage($package_domain, $user);
	$wallet = $user->wallets()->first();
	$entitlements = $wallet->entitlements->pluck('id')->all();

	- $this->assertCount(5, $entitlements);
	+ $this->assertCount(8, $entitlements);

	// Non-deleted user
	$code = \Artisan::call("user:restore {$user->email}");
	$output = trim(\Artisan::output());
	$this->assertSame(1, $code);
	$this->assertSame("The user is not yet deleted.", $output);

	$user->delete();

	$this->assertTrue($user->trashed());
	$this->assertTrue($domain->fresh()->trashed());

	// Deleted user
	$code = \Artisan::call("user:restore {$user->email}");
	$output = trim(\Artisan::output());
	$this->assertSame(0, $code);
	$this->assertSame("", $output);

	$this->assertFalse($user->fresh()->trashed());
	$this->assertFalse($domain->fresh()->trashed());
	}
	}
	diff --git a/src/tests/Feature/Controller/Admin/DiscountsTest.php b/src/tests/Feature/Controller/Admin/DiscountsTest.php
	index 3eac8d5e..dad9e3a6 100644
	--- a/src/tests/Feature/Controller/Admin/DiscountsTest.php
	+++ b/src/tests/Feature/Controller/Admin/DiscountsTest.php
	@@ -1,61 +1,77 @@
	<?php

	namespace Tests\Feature\Controller\Admin;

	use App\Discount;
	use Tests\TestCase;

	class DiscountsTest extends TestCase
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	self::useAdminUrl();
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	parent::tearDown();
	}

	/**
	- * Test listing discounts (/api/v4/discounts)
	+ * Test listing discounts (GET /api/v4/users/{user}/discounts)
	*/
	- public function testIndex(): void
	+ public function testuserDiscounts(): void
	{
	$user = $this->getTestUser('john@kolab.org');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');

	// Non-admin user
	- $response = $this->actingAs($user)->get("api/v4/discounts");
	+ $response = $this->actingAs($user)->get("api/v4/users/{$user->id}/discounts");
	$response->assertStatus(403);

	// Admin user
	- $response = $this->actingAs($admin)->get("api/v4/discounts");
	+ $response = $this->actingAs($admin)->get("api/v4/users/{$user->id}/discounts");
	$response->assertStatus(200);

	$json = $response->json();

	$discount_test = Discount::where('code', 'TEST')->first();
	$discount_free = Discount::where('discount', 100)->first();

	$this->assertSame(3, $json['count']);
	$this->assertSame($discount_test->id, $json['list'][0]['id']);
	$this->assertSame($discount_test->discount, $json['list'][0]['discount']);
	$this->assertSame($discount_test->code, $json['list'][0]['code']);
	$this->assertSame($discount_test->description, $json['list'][0]['description']);
	$this->assertSame('10% - Test voucher [TEST]', $json['list'][0]['label']);

	$this->assertSame($discount_free->id, $json['list'][2]['id']);
	$this->assertSame($discount_free->discount, $json['list'][2]['discount']);
	$this->assertSame($discount_free->code, $json['list'][2]['code']);
	$this->assertSame($discount_free->description, $json['list'][2]['description']);
	$this->assertSame('100% - Free Account', $json['list'][2]['label']);
	+
	+ // A user in another tenant
	+ $user = $this->getTestUser('user@sample-tenant.dev-local');
	+ $response = $this->actingAs($admin)->get("api/v4/users/{$user->id}/discounts");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $discount = Discount::withObjectTenantContext($user)->where('discount', 10)->first();
	+
	+ $this->assertSame(1, $json['count']);
	+ $this->assertSame($discount->id, $json['list'][0]['id']);
	+ $this->assertSame($discount->discount, $json['list'][0]['discount']);
	+ $this->assertSame($discount->code, $json['list'][0]['code']);
	+ $this->assertSame($discount->description, $json['list'][0]['description']);
	+ $this->assertSame('10% - ' . $discount->description, $json['list'][0]['label']);
	}
	}
	diff --git a/src/tests/Feature/Controller/Admin/SkusTest.php b/src/tests/Feature/Controller/Admin/SkusTest.php
	index 98d0ce84..ce3344c2 100644
	--- a/src/tests/Feature/Controller/Admin/SkusTest.php
	+++ b/src/tests/Feature/Controller/Admin/SkusTest.php
	@@ -1,94 +1,98 @@
	<?php

	namespace Tests\Feature\Controller\Admin;

	use App\Sku;
	use Tests\TestCase;

	class SkusTest extends TestCase
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	self::useAdminUrl();

	+ Sku::where('title', 'test')->delete();
	+
	$this->clearBetaEntitlements();
	$this->clearMeetEntitlements();
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	+ Sku::where('title', 'test')->delete();
	+
	$this->clearBetaEntitlements();
	$this->clearMeetEntitlements();

	parent::tearDown();
	}

	/**
	* Test fetching SKUs list
	*/
	public function testIndex(): void
	{
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	$user = $this->getTestUser('john@kolab.org');
	- $sku = Sku::where('title', 'mailbox')->first();
	+ $sku = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();

	// Unauth access not allowed
	$response = $this->get("api/v4/skus");
	$response->assertStatus(401);

	// User access not allowed on admin API
	$response = $this->actingAs($user)->get("api/v4/skus");
	$response->assertStatus(403);

	$response = $this->actingAs($admin)->get("api/v4/skus");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertCount(9, $json);

	$this->assertSame(100, $json[0]['prio']);
	$this->assertSame($sku->id, $json[0]['id']);
	$this->assertSame($sku->title, $json[0]['title']);
	$this->assertSame($sku->name, $json[0]['name']);
	$this->assertSame($sku->description, $json[0]['description']);
	$this->assertSame($sku->cost, $json[0]['cost']);
	$this->assertSame($sku->units_free, $json[0]['units_free']);
	$this->assertSame($sku->period, $json[0]['period']);
	$this->assertSame($sku->active, $json[0]['active']);
	$this->assertSame('user', $json[0]['type']);
	$this->assertSame('mailbox', $json[0]['handler']);
	}

	/**
	* Test fetching SKUs list for a user (GET /users/<id>/skus)
	*/
	public function testUserSkus(): void
	{
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	$user = $this->getTestUser('john@kolab.org');

	// Unauth access not allowed
	$response = $this->get("api/v4/users/{$user->id}/skus");
	$response->assertStatus(401);

	// Non-admin access not allowed
	$response = $this->actingAs($user)->get("api/v4/users/{$user->id}/skus");
	$response->assertStatus(403);

	$response = $this->actingAs($admin)->get("api/v4/users/{$user->id}/skus");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertCount(8, $json);
	// Note: Details are tested where we test API\V4\SkusController
	}
	}
	diff --git a/src/tests/Feature/Controller/Admin/WalletsTest.php b/src/tests/Feature/Controller/Admin/WalletsTest.php
	index b1a37af0..62d6ca40 100644
	--- a/src/tests/Feature/Controller/Admin/WalletsTest.php
	+++ b/src/tests/Feature/Controller/Admin/WalletsTest.php
	@@ -1,234 +1,234 @@
	<?php

	namespace Tests\Feature\Controller\Admin;

	use App\Discount;
	use App\Transaction;
	use Tests\TestCase;

	class WalletsTest extends TestCase
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	self::useAdminUrl();
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	parent::tearDown();
	}

	/**
	* Test fetching a wallet (GET /api/v4/wallets/:id)
	*
	* @group stripe
	*/
	public function testShow(): void
	{
	\config(['services.payment_provider' => 'stripe']);

	$user = $this->getTestUser('john@kolab.org');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	$wallet = $user->wallets()->first();
	$wallet->discount_id = null;
	$wallet->save();

	// Make sure there's no stripe/mollie identifiers
	$wallet->setSetting('stripe_id', null);
	$wallet->setSetting('stripe_mandate_id', null);
	$wallet->setSetting('mollie_id', null);
	$wallet->setSetting('mollie_mandate_id', null);

	// Non-admin user
	$response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}");
	$response->assertStatus(403);

	// Admin user
	$response = $this->actingAs($admin)->get("api/v4/wallets/{$wallet->id}");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame($wallet->id, $json['id']);
	$this->assertSame('CHF', $json['currency']);
	$this->assertSame($wallet->balance, $json['balance']);
	$this->assertSame(0, $json['discount']);
	$this->assertTrue(empty($json['description']));
	$this->assertTrue(empty($json['discount_description']));
	$this->assertTrue(!empty($json['provider']));
	$this->assertTrue(empty($json['providerLink']));
	$this->assertTrue(!empty($json['mandate']));
	}

	/**
	* Test awarding/penalizing a wallet (POST /api/v4/wallets/:id/one-off)
	*/
	public function testOneOff(): void
	{
	$user = $this->getTestUser('john@kolab.org');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	$wallet = $user->wallets()->first();
	$balance = $wallet->balance;
	- $reseller = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller = $this->getTestUser('reseller@' . \config('app.domain'));
	$wallet = $user->wallets()->first();
	$reseller_wallet = $reseller->wallets()->first();
	$reseller_balance = $reseller_wallet->balance;

	Transaction::where('object_id', $wallet->id)
	->whereIn('type', [Transaction::WALLET_AWARD, Transaction::WALLET_PENALTY])
	->delete();

	// Non-admin user
	$response = $this->actingAs($user)->post("api/v4/wallets/{$wallet->id}/one-off", []);
	$response->assertStatus(403);

	// Admin user - invalid input
	$post = ['amount' => 'aaaa'];
	$response = $this->actingAs($admin)->post("api/v4/wallets/{$wallet->id}/one-off", $post);
	$response->assertStatus(422);

	$json = $response->json();

	$this->assertSame('error', $json['status']);
	$this->assertSame('The amount must be a number.', $json['errors']['amount'][0]);
	$this->assertSame('The description field is required.', $json['errors']['description'][0]);
	$this->assertCount(2, $json);
	$this->assertCount(2, $json['errors']);

	// Admin user - a valid bonus
	$post = ['amount' => '50', 'description' => 'A bonus'];
	$response = $this->actingAs($admin)->post("api/v4/wallets/{$wallet->id}/one-off", $post);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame('The bonus has been added to the wallet successfully.', $json['message']);
	$this->assertSame($balance += 5000, $json['balance']);
	$this->assertSame($balance, $wallet->fresh()->balance);
	$this->assertSame($reseller_balance, $reseller_wallet->fresh()->balance);

	$transaction = Transaction::where('object_id', $wallet->id)
	->where('type', Transaction::WALLET_AWARD)->first();

	$this->assertSame($post['description'], $transaction->description);
	$this->assertSame(5000, $transaction->amount);
	$this->assertSame($admin->email, $transaction->user_email);

	// Admin user - a valid penalty
	$post = ['amount' => '-40', 'description' => 'A penalty'];
	$response = $this->actingAs($admin)->post("api/v4/wallets/{$wallet->id}/one-off", $post);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame('The penalty has been added to the wallet successfully.', $json['message']);
	$this->assertSame($balance -= 4000, $json['balance']);
	$this->assertSame($balance, $wallet->fresh()->balance);
	$this->assertSame($reseller_balance, $reseller_wallet->fresh()->balance);

	$transaction = Transaction::where('object_id', $wallet->id)
	->where('type', Transaction::WALLET_PENALTY)->first();

	$this->assertSame($post['description'], $transaction->description);
	$this->assertSame(-4000, $transaction->amount);
	$this->assertSame($admin->email, $transaction->user_email);
	}

	/**
	* Test fetching wallet transactions (GET /api/v4/wallets/:id/transactions)
	*/
	public function testTransactions(): void
	{
	// Note: Here we're testing only that the end-point works,
	// and admin can get the transaction log, response details
	// are tested in Feature/Controller/WalletsTest.php
	$this->deleteTestUser('wallets-controller@kolabnow.com');
	$user = $this->getTestUser('wallets-controller@kolabnow.com');
	$wallet = $user->wallets()->first();
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');

	// Non-admin
	$response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/transactions");
	$response->assertStatus(403);

	// Create some sample transactions
	$transactions = $this->createTestTransactions($wallet);
	$transactions = array_reverse($transactions);
	$pages = array_chunk($transactions, 10 /* page size*/);

	// Get the 2nd page
	$response = $this->actingAs($admin)->get("api/v4/wallets/{$wallet->id}/transactions?page=2");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertCount(5, $json);
	$this->assertSame('success', $json['status']);
	$this->assertSame(2, $json['page']);
	$this->assertSame(2, $json['count']);
	$this->assertSame(false, $json['hasMore']);
	$this->assertCount(2, $json['list']);
	foreach ($pages[1] as $idx => $transaction) {
	$this->assertSame($transaction->id, $json['list'][$idx]['id']);
	$this->assertSame($transaction->type, $json['list'][$idx]['type']);
	$this->assertSame($transaction->shortDescription(), $json['list'][$idx]['description']);
	$this->assertFalse($json['list'][$idx]['hasDetails']);
	}

	// The 'user' key is set only on the admin end-point
	$this->assertSame('jeroen@jeroen.jeroen', $json['list'][1]['user']);
	}

	/**
	* Test updating a wallet (PUT /api/v4/wallets/:id)
	*/
	public function testUpdate(): void
	{
	$user = $this->getTestUser('john@kolab.org');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	$wallet = $user->wallets()->first();
	$discount = Discount::where('code', 'TEST')->first();

	// Non-admin user
	$response = $this->actingAs($user)->put("api/v4/wallets/{$wallet->id}", []);
	$response->assertStatus(403);

	// Admin user - setting a discount
	$post = ['discount' => $discount->id];
	$response = $this->actingAs($admin)->put("api/v4/wallets/{$wallet->id}", $post);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame('User wallet updated successfully.', $json['message']);
	$this->assertSame($wallet->id, $json['id']);
	$this->assertSame($discount->discount, $json['discount']);
	$this->assertSame($discount->id, $json['discount_id']);
	$this->assertSame($discount->description, $json['discount_description']);
	$this->assertSame($discount->id, $wallet->fresh()->discount->id);

	// Admin user - removing a discount
	$post = ['discount' => null];
	$response = $this->actingAs($admin)->put("api/v4/wallets/{$wallet->id}", $post);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame('User wallet updated successfully.', $json['message']);
	$this->assertSame($wallet->id, $json['id']);
	$this->assertSame(null, $json['discount_id']);
	$this->assertTrue(empty($json['discount_description']));
	$this->assertSame(null, $wallet->fresh()->discount);
	}
	}
	diff --git a/src/tests/Feature/Controller/DomainsTest.php b/src/tests/Feature/Controller/DomainsTest.php
	index 05e3e8d0..ae480297 100644
	--- a/src/tests/Feature/Controller/DomainsTest.php
	+++ b/src/tests/Feature/Controller/DomainsTest.php
	@@ -1,242 +1,242 @@
	<?php

	namespace Tests\Feature\Controller;

	use App\Domain;
	use App\Entitlement;
	use App\Sku;
	use App\User;
	use App\Wallet;
	use Illuminate\Support\Str;
	use Tests\TestCase;

	class DomainsTest extends TestCase
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();

	$this->deleteTestUser('test1@domainscontroller.com');
	$this->deleteTestDomain('domainscontroller.com');
	}

	public function tearDown(): void
	{
	$this->deleteTestUser('test1@domainscontroller.com');
	$this->deleteTestDomain('domainscontroller.com');

	parent::tearDown();
	}

	/**
	* Test domain confirm request
	*/
	public function testConfirm(): void
	{
	- $sku_domain = Sku::where('title', 'domain-hosting')->first();
	+ $sku_domain = Sku::withEnvTenantContext()->where('title', 'domain-hosting')->first();
	$john = $this->getTestUser('john@kolab.org');
	$ned = $this->getTestUser('ned@kolab.org');
	$user = $this->getTestUser('test1@domainscontroller.com');
	$domain = $this->getTestDomain('domainscontroller.com', [
	'status' => Domain::STATUS_NEW,
	'type' => Domain::TYPE_EXTERNAL,
	]);

	Entitlement::create([
	'wallet_id' => $user->wallets()->first()->id,
	'sku_id' => $sku_domain->id,
	'entitleable_id' => $domain->id,
	'entitleable_type' => Domain::class
	]);

	$response = $this->actingAs($user)->get("api/v4/domains/{$domain->id}/confirm");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertCount(2, $json);
	$this->assertEquals('error', $json['status']);
	$this->assertEquals('Domain ownership verification failed.', $json['message']);

	$domain->status \|= Domain::STATUS_CONFIRMED;
	$domain->save();

	$response = $this->actingAs($user)->get("api/v4/domains/{$domain->id}/confirm");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertEquals('success', $json['status']);
	$this->assertEquals('Domain verified successfully.', $json['message']);
	$this->assertTrue(is_array($json['statusInfo']));

	// Not authorized access
	$response = $this->actingAs($john)->get("api/v4/domains/{$domain->id}/confirm");
	$response->assertStatus(403);

	// Authorized access by additional account controller
	$domain = $this->getTestDomain('kolab.org');
	$response = $this->actingAs($ned)->get("api/v4/domains/{$domain->id}/confirm");
	$response->assertStatus(200);
	}

	/**
	* Test fetching domains list
	*/
	public function testIndex(): void
	{
	// User with no domains
	$user = $this->getTestUser('test1@domainscontroller.com');
	$response = $this->actingAs($user)->get("api/v4/domains");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame([], $json);

	// User with custom domain(s)
	$john = $this->getTestUser('john@kolab.org');
	$ned = $this->getTestUser('ned@kolab.org');

	$response = $this->actingAs($john)->get("api/v4/domains");
	$response->assertStatus(200);

	$json = $response->json();
	$this->assertCount(1, $json);
	$this->assertSame('kolab.org', $json[0]['namespace']);
	// Values below are tested by Unit tests
	$this->assertArrayHasKey('isConfirmed', $json[0]);
	$this->assertArrayHasKey('isDeleted', $json[0]);
	$this->assertArrayHasKey('isVerified', $json[0]);
	$this->assertArrayHasKey('isSuspended', $json[0]);
	$this->assertArrayHasKey('isActive', $json[0]);
	$this->assertArrayHasKey('isLdapReady', $json[0]);

	$response = $this->actingAs($ned)->get("api/v4/domains");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertCount(1, $json);
	$this->assertSame('kolab.org', $json[0]['namespace']);
	}

	/**
	* Test fetching domain info
	*/
	public function testShow(): void
	{
	- $sku_domain = Sku::where('title', 'domain-hosting')->first();
	+ $sku_domain = Sku::withEnvTenantContext()->where('title', 'domain-hosting')->first();
	$user = $this->getTestUser('test1@domainscontroller.com');
	$domain = $this->getTestDomain('domainscontroller.com', [
	'status' => Domain::STATUS_NEW,
	'type' => Domain::TYPE_EXTERNAL,
	]);

	Entitlement::create([
	'wallet_id' => $user->wallets()->first()->id,
	'sku_id' => $sku_domain->id,
	'entitleable_id' => $domain->id,
	'entitleable_type' => Domain::class
	]);

	$response = $this->actingAs($user)->get("api/v4/domains/{$domain->id}");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertEquals($domain->id, $json['id']);
	$this->assertEquals($domain->namespace, $json['namespace']);
	$this->assertEquals($domain->status, $json['status']);
	$this->assertEquals($domain->type, $json['type']);
	$this->assertSame($domain->hash(Domain::HASH_TEXT), $json['hash_text']);
	$this->assertSame($domain->hash(Domain::HASH_CNAME), $json['hash_cname']);
	$this->assertSame($domain->hash(Domain::HASH_CODE), $json['hash_code']);
	$this->assertCount(4, $json['config']);
	$this->assertTrue(strpos(implode("\n", $json['config']), $domain->namespace) !== false);
	$this->assertCount(8, $json['dns']);
	$this->assertTrue(strpos(implode("\n", $json['dns']), $domain->namespace) !== false);
	$this->assertTrue(strpos(implode("\n", $json['dns']), $domain->hash()) !== false);
	$this->assertTrue(is_array($json['statusInfo']));
	// Values below are tested by Unit tests
	$this->assertArrayHasKey('isConfirmed', $json);
	$this->assertArrayHasKey('isDeleted', $json);
	$this->assertArrayHasKey('isVerified', $json);
	$this->assertArrayHasKey('isSuspended', $json);
	$this->assertArrayHasKey('isActive', $json);
	$this->assertArrayHasKey('isLdapReady', $json);

	$john = $this->getTestUser('john@kolab.org');
	$ned = $this->getTestUser('ned@kolab.org');
	$jack = $this->getTestUser('jack@kolab.org');

	// Not authorized - Other account domain
	$response = $this->actingAs($john)->get("api/v4/domains/{$domain->id}");
	$response->assertStatus(403);

	$domain = $this->getTestDomain('kolab.org');

	// Ned is an additional controller on kolab.org's wallet
	$response = $this->actingAs($ned)->get("api/v4/domains/{$domain->id}");
	$response->assertStatus(200);

	// Jack has no entitlement/control over kolab.org
	$response = $this->actingAs($jack)->get("api/v4/domains/{$domain->id}");
	$response->assertStatus(403);
	}

	/**
	* Test fetching domain status (GET /api/v4/domains/<domain-id>/status)
	* and forcing setup process update (?refresh=1)
	*
	* @group dns
	*/
	public function testStatus(): void
	{
	$john = $this->getTestUser('john@kolab.org');
	$jack = $this->getTestUser('jack@kolab.org');
	$domain = $this->getTestDomain('kolab.org');

	// Test unauthorized access
	$response = $this->actingAs($jack)->get("/api/v4/domains/{$domain->id}/status");
	$response->assertStatus(403);

	$domain->status = Domain::STATUS_NEW \| Domain::STATUS_ACTIVE \| Domain::STATUS_LDAP_READY;
	$domain->save();

	// Get domain status
	$response = $this->actingAs($john)->get("/api/v4/domains/{$domain->id}/status");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertFalse($json['isVerified']);
	$this->assertFalse($json['isReady']);
	$this->assertCount(4, $json['process']);
	$this->assertSame('domain-verified', $json['process'][2]['label']);
	$this->assertSame(false, $json['process'][2]['state']);
	$this->assertTrue(empty($json['status']));
	$this->assertTrue(empty($json['message']));

	// Now "reboot" the process and verify the domain
	$response = $this->actingAs($john)->get("/api/v4/domains/{$domain->id}/status?refresh=1");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertTrue($json['isVerified']);
	$this->assertTrue($json['isReady']);
	$this->assertCount(4, $json['process']);
	$this->assertSame('domain-verified', $json['process'][2]['label']);
	$this->assertSame(true, $json['process'][2]['state']);
	$this->assertSame('domain-confirmed', $json['process'][3]['label']);
	$this->assertSame(true, $json['process'][3]['state']);
	$this->assertSame('success', $json['status']);
	$this->assertSame('Setup process finished successfully.', $json['message']);

	// TODO: Test completing all process steps
	}
	}
	diff --git a/src/tests/Feature/Controller/PackagesTest.php b/src/tests/Feature/Controller/PackagesTest.php
	index 4435021e..66816e08 100644
	--- a/src/tests/Feature/Controller/PackagesTest.php
	+++ b/src/tests/Feature/Controller/PackagesTest.php
	@@ -1,52 +1,53 @@
	<?php

	namespace Tests\Feature\Controller;

	use App\Package;
	use Tests\TestCase;

	class PackagesTest extends TestCase
	{
	/**
	* Test fetching packages list
	*/
	public function testIndex(): void
	{
	// Unauth access not allowed
	$response = $this->get("api/v4/packages");
	$response->assertStatus(401);

	$user = $this->getTestUser('john@kolab.org');
	- $package_domain = Package::where('title', 'domain-hosting')->first();
	- $package_kolab = Package::where('title', 'kolab')->first();
	- $package_lite = Package::where('title', 'lite')->first();
	+
	+ $packageDomain = Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
	+ $packageKolab = Package::withEnvTenantContext()->where('title', 'kolab')->first();
	+ $packageLite = Package::withEnvTenantContext()->where('title', 'lite')->first();

	$response = $this->actingAs($user)->get("api/v4/packages");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertCount(3, $json);

	- $this->assertSame($package_domain->id, $json[0]['id']);
	- $this->assertSame($package_domain->title, $json[0]['title']);
	- $this->assertSame($package_domain->name, $json[0]['name']);
	- $this->assertSame($package_domain->description, $json[0]['description']);
	- $this->assertSame($package_domain->isDomain(), $json[0]['isDomain']);
	- $this->assertSame($package_domain->cost(), $json[0]['cost']);
	-
	- $this->assertSame($package_kolab->id, $json[1]['id']);
	- $this->assertSame($package_kolab->title, $json[1]['title']);
	- $this->assertSame($package_kolab->name, $json[1]['name']);
	- $this->assertSame($package_kolab->description, $json[1]['description']);
	- $this->assertSame($package_kolab->isDomain(), $json[1]['isDomain']);
	- $this->assertSame($package_kolab->cost(), $json[1]['cost']);
	-
	- $this->assertSame($package_lite->id, $json[2]['id']);
	- $this->assertSame($package_lite->title, $json[2]['title']);
	- $this->assertSame($package_lite->name, $json[2]['name']);
	- $this->assertSame($package_lite->description, $json[2]['description']);
	- $this->assertSame($package_lite->isDomain(), $json[2]['isDomain']);
	- $this->assertSame($package_lite->cost(), $json[2]['cost']);
	+ $this->assertSame($packageDomain->id, $json[0]['id']);
	+ $this->assertSame($packageDomain->title, $json[0]['title']);
	+ $this->assertSame($packageDomain->name, $json[0]['name']);
	+ $this->assertSame($packageDomain->description, $json[0]['description']);
	+ $this->assertSame($packageDomain->isDomain(), $json[0]['isDomain']);
	+ $this->assertSame($packageDomain->cost(), $json[0]['cost']);
	+
	+ $this->assertSame($packageKolab->id, $json[1]['id']);
	+ $this->assertSame($packageKolab->title, $json[1]['title']);
	+ $this->assertSame($packageKolab->name, $json[1]['name']);
	+ $this->assertSame($packageKolab->description, $json[1]['description']);
	+ $this->assertSame($packageKolab->isDomain(), $json[1]['isDomain']);
	+ $this->assertSame($packageKolab->cost(), $json[1]['cost']);
	+
	+ $this->assertSame($packageLite->id, $json[2]['id']);
	+ $this->assertSame($packageLite->title, $json[2]['title']);
	+ $this->assertSame($packageLite->name, $json[2]['name']);
	+ $this->assertSame($packageLite->description, $json[2]['description']);
	+ $this->assertSame($packageLite->isDomain(), $json[2]['isDomain']);
	+ $this->assertSame($packageLite->cost(), $json[2]['cost']);
	}
	}
	diff --git a/src/tests/Feature/Controller/PaymentsMollieTest.php b/src/tests/Feature/Controller/PaymentsMollieTest.php
	index bfdf2683..e1863865 100644
	--- a/src/tests/Feature/Controller/PaymentsMollieTest.php
	+++ b/src/tests/Feature/Controller/PaymentsMollieTest.php
	@@ -1,1060 +1,1062 @@
	<?php

	namespace Tests\Feature\Controller;

	use App\Http\Controllers\API\V4\PaymentsController;
	use App\Payment;
	use App\Providers\PaymentProvider;
	use App\Transaction;
	use App\Wallet;
	use App\WalletSetting;
	use GuzzleHttp\Psr7\Response;
	use Illuminate\Support\Facades\Bus;
	use Tests\TestCase;
	use Tests\BrowserAddonTrait;
	use Tests\MollieMocksTrait;

	class PaymentsMollieTest extends TestCase
	{
	use MollieMocksTrait;
	use BrowserAddonTrait;

	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();

	// All tests in this file use Mollie
	\config(['services.payment_provider' => 'mollie']);

	$john = $this->getTestUser('john@kolab.org');
	$wallet = $john->wallets()->first();
	Payment::where('wallet_id', $wallet->id)->delete();
	Wallet::where('id', $wallet->id)->update(['balance' => 0]);
	WalletSetting::where('wallet_id', $wallet->id)->delete();
	$types = [
	Transaction::WALLET_CREDIT,
	Transaction::WALLET_REFUND,
	Transaction::WALLET_CHARGEBACK,
	];
	Transaction::where('object_id', $wallet->id)->whereIn('type', $types)->delete();
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	$john = $this->getTestUser('john@kolab.org');
	$wallet = $john->wallets()->first();
	Payment::where('wallet_id', $wallet->id)->delete();
	Wallet::where('id', $wallet->id)->update(['balance' => 0]);
	WalletSetting::where('wallet_id', $wallet->id)->delete();
	$types = [
	Transaction::WALLET_CREDIT,
	Transaction::WALLET_REFUND,
	Transaction::WALLET_CHARGEBACK,
	];
	Transaction::where('object_id', $wallet->id)->whereIn('type', $types)->delete();

	parent::tearDown();
	}

	/**
	* Test creating/updating/deleting an outo-payment mandate
	*
	* @group mollie
	*/
	public function testMandates(): void
	{
	// Unauth access not allowed
	$response = $this->get("api/v4/payments/mandate");
	$response->assertStatus(401);
	$response = $this->post("api/v4/payments/mandate", []);
	$response->assertStatus(401);
	$response = $this->put("api/v4/payments/mandate", []);
	$response->assertStatus(401);
	$response = $this->delete("api/v4/payments/mandate");
	$response->assertStatus(401);

	$user = $this->getTestUser('john@kolab.org');
	$wallet = $user->wallets()->first();

	// Test creating a mandate (invalid input)
	$post = [];
	$response = $this->actingAs($user)->post("api/v4/payments/mandate", $post);
	$response->assertStatus(422);

	$json = $response->json();

	$this->assertSame('error', $json['status']);
	$this->assertCount(2, $json['errors']);
	$this->assertSame('The amount field is required.', $json['errors']['amount'][0]);
	$this->assertSame('The balance field is required.', $json['errors']['balance'][0]);

	// Test creating a mandate (invalid input)
	$post = ['amount' => 100, 'balance' => 'a'];
	$response = $this->actingAs($user)->post("api/v4/payments/mandate", $post);
	$response->assertStatus(422);

	$json = $response->json();

	$this->assertSame('error', $json['status']);
	$this->assertCount(1, $json['errors']);
	$this->assertSame('The balance must be a number.', $json['errors']['balance'][0]);

	// Test creating a mandate (amount smaller than the minimum value)
	$post = ['amount' => -100, 'balance' => 0];
	$response = $this->actingAs($user)->post("api/v4/payments/mandate", $post);
	$response->assertStatus(422);

	$json = $response->json();

	$this->assertSame('error', $json['status']);
	$this->assertCount(1, $json['errors']);
	$min = intval(PaymentProvider::MIN_AMOUNT / 100) . ' CHF';
	$this->assertSame("Minimum amount for a single payment is {$min}.", $json['errors']['amount']);

	// Test creating a mandate (negative balance, amount too small)
	Wallet::where('id', $wallet->id)->update(['balance' => -2000]);
	$post = ['amount' => PaymentProvider::MIN_AMOUNT / 100, 'balance' => 0];
	$response = $this->actingAs($user)->post("api/v4/payments/mandate", $post);
	$response->assertStatus(422);

	$json = $response->json();

	$this->assertSame('error', $json['status']);
	$this->assertCount(1, $json['errors']);
	$this->assertSame("The specified amount does not cover the balance on the account.", $json['errors']['amount']);

	// Test creating a mandate (valid input)
	$post = ['amount' => 20.10, 'balance' => 0];
	$response = $this->actingAs($user)->post("api/v4/payments/mandate", $post);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertRegExp('\|^https://www.mollie.com\|', $json['redirectUrl']);

	// Assert the proper payment amount has been used
	$payment = Payment::where('id', $json['id'])->first();
	$this->assertSame(2010, $payment->amount);
	$this->assertSame($wallet->id, $payment->wallet_id);
	$this->assertSame(\config('app.name') . " Auto-Payment Setup", $payment->description);
	$this->assertSame(PaymentProvider::TYPE_MANDATE, $payment->type);

	// Test fetching the mandate information
	$response = $this->actingAs($user)->get("api/v4/payments/mandate");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertEquals(20.10, $json['amount']);
	$this->assertEquals(0, $json['balance']);
	$this->assertEquals('Credit Card', $json['method']);
	$this->assertSame(true, $json['isPending']);
	$this->assertSame(false, $json['isValid']);
	$this->assertSame(false, $json['isDisabled']);

	$mandate_id = $json['id'];

	// We would have to invoke a browser to accept the "first payment" to make
	// the mandate validated/completed. Instead, we'll mock the mandate object.
	$mollie_response = [
	'resource' => 'mandate',
	'id' => $mandate_id,
	'status' => 'valid',
	'method' => 'creditcard',
	'details' => [
	'cardNumber' => '4242',
	'cardLabel' => 'Visa',
	],
	'customerId' => 'cst_GMfxGPt7Gj',
	'createdAt' => '2020-04-28T11:09:47+00:00',
	];

	$responseStack = $this->mockMollie();
	$responseStack->append(new Response(200, [], json_encode($mollie_response)));

	$wallet = $user->wallets()->first();
	$wallet->setSetting('mandate_disabled', 1);

	$response = $this->actingAs($user)->get("api/v4/payments/mandate");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertEquals(20.10, $json['amount']);
	$this->assertEquals(0, $json['balance']);
	$this->assertEquals('Visa (** ** 4242)', $json['method']);
	$this->assertSame(false, $json['isPending']);
	$this->assertSame(true, $json['isValid']);
	$this->assertSame(true, $json['isDisabled']);

	Bus::fake();
	$wallet->setSetting('mandate_disabled', null);
	$wallet->balance = 1000;
	$wallet->save();

	// Test updating mandate details (invalid input)
	$post = [];
	$response = $this->actingAs($user)->put("api/v4/payments/mandate", $post);
	$response->assertStatus(422);

	$json = $response->json();

	$this->assertSame('error', $json['status']);
	$this->assertCount(2, $json['errors']);
	$this->assertSame('The amount field is required.', $json['errors']['amount'][0]);
	$this->assertSame('The balance field is required.', $json['errors']['balance'][0]);

	$post = ['amount' => -100, 'balance' => 0];
	$response = $this->actingAs($user)->put("api/v4/payments/mandate", $post);
	$response->assertStatus(422);

	$json = $response->json();

	$this->assertSame('error', $json['status']);
	$this->assertCount(1, $json['errors']);
	$this->assertSame("Minimum amount for a single payment is {$min}.", $json['errors']['amount']);

	// Test updating a mandate (valid input)
	$responseStack->append(new Response(200, [], json_encode($mollie_response)));

	$post = ['amount' => 30.10, 'balance' => 10];
	$response = $this->actingAs($user)->put("api/v4/payments/mandate", $post);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame('The auto-payment has been updated.', $json['message']);
	$this->assertSame($mandate_id, $json['id']);
	$this->assertFalse($json['isDisabled']);

	$wallet->refresh();

	$this->assertEquals(30.10, $wallet->getSetting('mandate_amount'));
	$this->assertEquals(10, $wallet->getSetting('mandate_balance'));

	Bus::assertDispatchedTimes(\App\Jobs\WalletCharge::class, 0);

	// Test updating a disabled mandate (invalid input)
	$wallet->setSetting('mandate_disabled', 1);
	$wallet->balance = -2000;
	$wallet->save();
	$user->refresh(); // required so the controller sees the wallet update from above

	$post = ['amount' => 15.10, 'balance' => 1];
	$response = $this->actingAs($user)->put("api/v4/payments/mandate", $post);
	$response->assertStatus(422);

	$json = $response->json();

	$this->assertSame('error', $json['status']);
	$this->assertCount(1, $json['errors']);
	$this->assertSame('The specified amount does not cover the balance on the account.', $json['errors']['amount']);

	// Test updating a disabled mandate (valid input)
	$responseStack->append(new Response(200, [], json_encode($mollie_response)));

	$post = ['amount' => 30, 'balance' => 1];
	$response = $this->actingAs($user)->put("api/v4/payments/mandate", $post);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame('The auto-payment has been updated.', $json['message']);
	$this->assertSame($mandate_id, $json['id']);
	$this->assertFalse($json['isDisabled']);

	Bus::assertDispatchedTimes(\App\Jobs\WalletCharge::class, 1);
	Bus::assertDispatched(\App\Jobs\WalletCharge::class, function ($job) use ($wallet) {
	$job_wallet = $this->getObjectProperty($job, 'wallet');
	return $job_wallet->id === $wallet->id;
	});

	$this->unmockMollie();

	// Delete mandate
	$response = $this->actingAs($user)->delete("api/v4/payments/mandate");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame('The auto-payment has been removed.', $json['message']);

	// Confirm with Mollie the mandate does not exist
	$customer_id = $wallet->getSetting('mollie_id');
	$this->expectException(\Mollie\Api\Exceptions\ApiException::class);
	$this->expectExceptionMessageMatches('/410: Gone/');
	$mandate = mollie()->mandates()->getForId($customer_id, $mandate_id);

	$this->assertNull($wallet->fresh()->getSetting('mollie_mandate_id'));

	// Test Mollie's "410 Gone" response handling when fetching the mandate info
	// It is expected to remove the mandate reference
	$mollie_response = [
	'status' => 410,
	'title' => "Gone",
	'detail' => "You are trying to access an object, which has previously been deleted",
	'_links' => [
	'documentation' => [
	'href' => "https://docs.mollie.com/errors",
	'type' => "text/html"
	]
	]
	];

	$responseStack = $this->mockMollie();
	$responseStack->append(new Response(410, [], json_encode($mollie_response)));

	$wallet->fresh()->setSetting('mollie_mandate_id', '123');

	$response = $this->actingAs($user)->get("api/v4/payments/mandate");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertFalse(array_key_exists('id', $json));
	$this->assertFalse(array_key_exists('method', $json));
	$this->assertNull($wallet->fresh()->getSetting('mollie_mandate_id'));
	}

	/**
	* Test creating a payment and receiving a status via webhook
	*
	* @group mollie
	*/
	public function testStoreAndWebhook(): void
	{
	Bus::fake();

	// Unauth access not allowed
	$response = $this->post("api/v4/payments", []);
	$response->assertStatus(401);

	// Invalid amount
	$user = $this->getTestUser('john@kolab.org');

	$post = ['amount' => -1];
	$response = $this->actingAs($user)->post("api/v4/payments", $post);
	$response->assertStatus(422);

	$json = $response->json();

	$this->assertSame('error', $json['status']);
	$this->assertCount(1, $json['errors']);
	$min = intval(PaymentProvider::MIN_AMOUNT / 100) . ' CHF';
	$this->assertSame("Minimum amount for a single payment is {$min}.", $json['errors']['amount']);

	// Invalid currency
	$post = ['amount' => '12.34', 'currency' => 'FOO', 'methodId' => 'creditcard'];
	$response = $this->actingAs($user)->post("api/v4/payments", $post);
	$response->assertStatus(500);

	// Successful payment
	$post = ['amount' => '12.34', 'currency' => 'CHF', 'methodId' => 'creditcard'];
	$response = $this->actingAs($user)->post("api/v4/payments", $post);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertRegExp('\|^https://www.mollie.com\|', $json['redirectUrl']);

	$wallet = $user->wallets()->first();
	$payments = Payment::where('wallet_id', $wallet->id)->get();

	$this->assertCount(1, $payments);
	$payment = $payments[0];
	$this->assertSame(1234, $payment->amount);
	$this->assertSame(1234, $payment->currency_amount);
	$this->assertSame('CHF', $payment->currency);
	$this->assertSame(\config('app.name') . ' Payment', $payment->description);
	$this->assertSame('open', $payment->status);
	$this->assertEquals(0, $wallet->balance);

	// Test the webhook
	// Note: Webhook end-point does not require authentication

	$mollie_response = [
	"resource" => "payment",
	"id" => $payment->id,
	"status" => "paid",
	// Status is not enough, paidAt is used to distinguish the state
	"paidAt" => date('c'),
	"mode" => "test",
	];

	// We'll trigger the webhook with payment id and use mocking for
	// a request to the Mollie payments API. We cannot force Mollie
	// to make the payment status change.
	$responseStack = $this->mockMollie();
	$responseStack->append(new Response(200, [], json_encode($mollie_response)));

	$post = ['id' => $payment->id];
	$response = $this->post("api/webhooks/payment/mollie", $post);
	$response->assertStatus(200);

	$this->assertSame(PaymentProvider::STATUS_PAID, $payment->fresh()->status);
	$this->assertEquals(1234, $wallet->fresh()->balance);

	$transaction = $wallet->transactions()
	->where('type', Transaction::WALLET_CREDIT)->get()->last();

	$this->assertSame(1234, $transaction->amount);
	$this->assertSame(
	"Payment transaction {$payment->id} using Mollie",
	$transaction->description
	);

	// Assert that email notification job wasn't dispatched,
	// it is expected only for recurring payments
	Bus::assertDispatchedTimes(\App\Jobs\PaymentEmail::class, 0);

	// Verify "paid -> open -> paid" scenario, assert that balance didn't change
	$mollie_response['status'] = 'open';
	unset($mollie_response['paidAt']);
	$responseStack->append(new Response(200, [], json_encode($mollie_response)));

	$response = $this->post("api/webhooks/payment/mollie", $post);
	$response->assertStatus(200);

	$this->assertSame(PaymentProvider::STATUS_PAID, $payment->fresh()->status);
	$this->assertEquals(1234, $wallet->fresh()->balance);

	$mollie_response['status'] = 'paid';
	$mollie_response['paidAt'] = date('c');
	$responseStack->append(new Response(200, [], json_encode($mollie_response)));

	$response = $this->post("api/webhooks/payment/mollie", $post);
	$response->assertStatus(200);

	$this->assertSame(PaymentProvider::STATUS_PAID, $payment->fresh()->status);
	$this->assertEquals(1234, $wallet->fresh()->balance);

	// Test for payment failure
	Bus::fake();

	$payment->refresh();
	$payment->status = PaymentProvider::STATUS_OPEN;
	$payment->save();

	$mollie_response = [
	"resource" => "payment",
	"id" => $payment->id,
	"status" => "failed",
	"mode" => "test",
	];

	// We'll trigger the webhook with payment id and use mocking for
	// a request to the Mollie payments API. We cannot force Mollie
	// to make the payment status change.
	$responseStack = $this->mockMollie();
	$responseStack->append(new Response(200, [], json_encode($mollie_response)));

	$response = $this->post("api/webhooks/payment/mollie", $post);
	$response->assertStatus(200);

	$this->assertSame('failed', $payment->fresh()->status);
	$this->assertEquals(1234, $wallet->fresh()->balance);

	// Assert that email notification job wasn't dispatched,
	// it is expected only for recurring payments
	Bus::assertDispatchedTimes(\App\Jobs\PaymentEmail::class, 0);
	}

	/**
	* Test creating a payment and receiving a status via webhook using a foreign currency
	*
	* @group mollie
	*/
	public function testStoreAndWebhookForeignCurrency(): void
	{
	Bus::fake();

	$user = $this->getTestUser('john@kolab.org');
	$wallet = $user->wallets()->first();

	// Successful payment in EUR
	$post = ['amount' => '12.34', 'currency' => 'EUR', 'methodId' => 'banktransfer'];
	$response = $this->actingAs($user)->post("api/v4/payments", $post);
	$response->assertStatus(200);

	$payment = $wallet->payments()
	->where('currency', 'EUR')->get()->last();

	$this->assertSame(1234, $payment->amount);
	$this->assertSame(1117, $payment->currency_amount);
	$this->assertSame('EUR', $payment->currency);
	$this->assertEquals(0, $wallet->balance);

	$mollie_response = [
	"resource" => "payment",
	"id" => $payment->id,
	"status" => "paid",
	// Status is not enough, paidAt is used to distinguish the state
	"paidAt" => date('c'),
	"mode" => "test",
	];

	$responseStack = $this->mockMollie();
	$responseStack->append(new Response(200, [], json_encode($mollie_response)));

	$post = ['id' => $payment->id];
	$response = $this->post("api/webhooks/payment/mollie", $post);
	$response->assertStatus(200);

	$this->assertSame(PaymentProvider::STATUS_PAID, $payment->fresh()->status);
	$this->assertEquals(1234, $wallet->fresh()->balance);
	}

	/**
	* Test automatic payment charges
	*
	* @group mollie
	*/
	public function testTopUp(): void
	{
	Bus::fake();

	$user = $this->getTestUser('john@kolab.org');
	$wallet = $user->wallets()->first();

	// Create a valid mandate first (balance=0, so there's no extra payment yet)
	$this->createMandate($wallet, ['amount' => 20.10, 'balance' => 0]);

	$wallet->setSetting('mandate_balance', 10);

	// Expect a recurring payment as we have a valid mandate at this point
	// and the balance is below the threshold
	$result = PaymentsController::topUpWallet($wallet);
	$this->assertTrue($result);

	// Check that the payments table contains a new record with proper amount.
	// There should be two records, one for the mandate payment and another for
	// the top-up payment
	$payments = $wallet->payments()->orderBy('amount')->get();
	$this->assertCount(2, $payments);
	$this->assertSame(0, $payments[0]->amount);
	$this->assertSame(0, $payments[0]->currency_amount);
	$this->assertSame(2010, $payments[1]->amount);
	$this->assertSame(2010, $payments[1]->currency_amount);
	$payment = $payments[1];

	// In mollie we don't have to wait for a webhook, the response to
	// PaymentIntent already sets the status to 'paid', so we can test
	// immediately the balance update
	// Assert that email notification job has been dispatched
	$this->assertSame(PaymentProvider::STATUS_PAID, $payment->status);
	$this->assertEquals(2010, $wallet->fresh()->balance);
	$transaction = $wallet->transactions()
	->where('type', Transaction::WALLET_CREDIT)->get()->last();

	$this->assertSame(2010, $transaction->amount);
	$this->assertSame(
	"Auto-payment transaction {$payment->id} using Mastercard (** ** 6787)",
	$transaction->description
	);

	Bus::assertDispatchedTimes(\App\Jobs\PaymentEmail::class, 1);
	Bus::assertDispatched(\App\Jobs\PaymentEmail::class, function ($job) use ($payment) {
	$job_payment = $this->getObjectProperty($job, 'payment');
	return $job_payment->id === $payment->id;
	});

	// Expect no payment if the mandate is disabled
	$wallet->setSetting('mandate_disabled', 1);
	$result = PaymentsController::topUpWallet($wallet);
	$this->assertFalse($result);
	$this->assertCount(2, $wallet->payments()->get());

	// Expect no payment if balance is ok
	$wallet->setSetting('mandate_disabled', null);
	$wallet->balance = 1000;
	$wallet->save();
	$result = PaymentsController::topUpWallet($wallet);
	$this->assertFalse($result);
	$this->assertCount(2, $wallet->payments()->get());

	// Expect no payment if the top-up amount is not enough
	$wallet->setSetting('mandate_disabled', null);
	$wallet->balance = -2050;
	$wallet->save();
	$result = PaymentsController::topUpWallet($wallet);
	$this->assertFalse($result);
	$this->assertCount(2, $wallet->payments()->get());

	Bus::assertDispatchedTimes(\App\Jobs\PaymentMandateDisabledEmail::class, 1);
	Bus::assertDispatched(\App\Jobs\PaymentMandateDisabledEmail::class, function ($job) use ($wallet) {
	$job_wallet = $this->getObjectProperty($job, 'wallet');
	return $job_wallet->id === $wallet->id;
	});

	// Expect no payment if there's no mandate
	$wallet->setSetting('mollie_mandate_id', null);
	$wallet->balance = 0;
	$wallet->save();
	$result = PaymentsController::topUpWallet($wallet);
	$this->assertFalse($result);
	$this->assertCount(2, $wallet->payments()->get());

	Bus::assertDispatchedTimes(\App\Jobs\PaymentMandateDisabledEmail::class, 1);

	// Test webhook for recurring payments

	$wallet->transactions()->delete();

	$responseStack = $this->mockMollie();
	Bus::fake();

	$payment->refresh();
	$payment->status = PaymentProvider::STATUS_OPEN;
	$payment->save();

	$mollie_response = [
	"resource" => "payment",
	"id" => $payment->id,
	"status" => "paid",
	// Status is not enough, paidAt is used to distinguish the state
	"paidAt" => date('c'),
	"mode" => "test",
	];

	// We'll trigger the webhook with payment id and use mocking for
	// a request to the Mollie payments API. We cannot force Mollie
	// to make the payment status change.
	$responseStack->append(new Response(200, [], json_encode($mollie_response)));

	$post = ['id' => $payment->id];
	$response = $this->post("api/webhooks/payment/mollie", $post);
	$response->assertStatus(200);

	$this->assertSame(PaymentProvider::STATUS_PAID, $payment->fresh()->status);
	$this->assertEquals(2010, $wallet->fresh()->balance);

	$transaction = $wallet->transactions()
	->where('type', Transaction::WALLET_CREDIT)->get()->last();

	$this->assertSame(2010, $transaction->amount);
	$this->assertSame(
	"Auto-payment transaction {$payment->id} using Mollie",
	$transaction->description
	);

	// Assert that email notification job has been dispatched
	Bus::assertDispatchedTimes(\App\Jobs\PaymentEmail::class, 1);
	Bus::assertDispatched(\App\Jobs\PaymentEmail::class, function ($job) use ($payment) {
	$job_payment = $this->getObjectProperty($job, 'payment');
	return $job_payment->id === $payment->id;
	});

	Bus::fake();

	// Test for payment failure
	$payment->refresh();
	$payment->status = PaymentProvider::STATUS_OPEN;
	$payment->save();

	$wallet->setSetting('mollie_mandate_id', 'xxx');
	$wallet->setSetting('mandate_disabled', null);

	$mollie_response = [
	"resource" => "payment",
	"id" => $payment->id,
	"status" => "failed",
	"mode" => "test",
	];

	$responseStack->append(new Response(200, [], json_encode($mollie_response)));

	$response = $this->post("api/webhooks/payment/mollie", $post);
	$response->assertStatus(200);

	$wallet->refresh();

	$this->assertSame(PaymentProvider::STATUS_FAILED, $payment->fresh()->status);
	$this->assertEquals(2010, $wallet->balance);
	$this->assertTrue(!empty($wallet->getSetting('mandate_disabled')));

	// Assert that email notification job has been dispatched
	Bus::assertDispatchedTimes(\App\Jobs\PaymentEmail::class, 1);
	Bus::assertDispatched(\App\Jobs\PaymentEmail::class, function ($job) use ($payment) {
	$job_payment = $this->getObjectProperty($job, 'payment');
	return $job_payment->id === $payment->id;
	});

	$this->unmockMollie();
	}

	/**
	* Test refund/chargeback handling by the webhook
	*
	* @group mollie
	*/
	public function testRefundAndChargeback(): void
	{
	Bus::fake();

	$user = $this->getTestUser('john@kolab.org');
	$wallet = $user->wallets()->first();
	$wallet->transactions()->delete();

	$mollie = PaymentProvider::factory('mollie');

	// Create a paid payment
	$payment = Payment::create([
	'id' => 'tr_123456',
	'status' => PaymentProvider::STATUS_PAID,
	'amount' => 123,
	'currency_amount' => 123,
	'currency' => 'CHF',
	'type' => PaymentProvider::TYPE_ONEOFF,
	'wallet_id' => $wallet->id,
	'provider' => 'mollie',
	'description' => 'test',
	]);

	// Test handling a refund by the webhook

	$mollie_response1 = [
	"resource" => "payment",
	"id" => $payment->id,
	"status" => "paid",
	// Status is not enough, paidAt is used to distinguish the state
	"paidAt" => date('c'),
	"mode" => "test",
	"_links" => [
	"refunds" => [
	"href" => "https://api.mollie.com/v2/payments/{$payment->id}/refunds",
	"type" => "application/hal+json"
	]
	]
	];

	$mollie_response2 = [
	"count" => 1,
	"_links" => [],
	"_embedded" => [
	"refunds" => [
	[
	"resource" => "refund",
	"id" => "re_123456",
	"status" => \Mollie\Api\Types\RefundStatus::STATUS_REFUNDED,
	"paymentId" => $payment->id,
	"description" => "refund desc",
	"amount" => [
	"currency" => "CHF",
	"value" => "1.01",
	],
	]
	]
	]
	];

	// We'll trigger the webhook with payment id and use mocking for
	// requests to the Mollie payments API.
	$responseStack = $this->mockMollie();
	$responseStack->append(new Response(200, [], json_encode($mollie_response1)));
	$responseStack->append(new Response(200, [], json_encode($mollie_response2)));

	$post = ['id' => $payment->id];
	$response = $this->post("api/webhooks/payment/mollie", $post);
	$response->assertStatus(200);

	$wallet->refresh();

	$this->assertEquals(-101, $wallet->balance);

	$transactions = $wallet->transactions()->where('type', Transaction::WALLET_REFUND)->get();

	$this->assertCount(1, $transactions);
	$this->assertSame(-101, $transactions[0]->amount);
	$this->assertSame(Transaction::WALLET_REFUND, $transactions[0]->type);
	$this->assertSame("refund desc", $transactions[0]->description);

	$payments = $wallet->payments()->where('id', 're_123456')->get();

	$this->assertCount(1, $payments);
	$this->assertSame(-101, $payments[0]->amount);
	$this->assertSame(-101, $payments[0]->currency_amount);
	$this->assertSame(PaymentProvider::STATUS_PAID, $payments[0]->status);
	$this->assertSame(PaymentProvider::TYPE_REFUND, $payments[0]->type);
	$this->assertSame("mollie", $payments[0]->provider);
	$this->assertSame("refund desc", $payments[0]->description);

	// Test handling a chargeback by the webhook

	$mollie_response1["_links"] = [
	"chargebacks" => [
	"href" => "https://api.mollie.com/v2/payments/{$payment->id}/chargebacks",
	"type" => "application/hal+json"
	]
	];

	$mollie_response2 = [
	"count" => 1,
	"_links" => [],
	"_embedded" => [
	"chargebacks" => [
	[
	"resource" => "chargeback",
	"id" => "chb_123456",
	"paymentId" => $payment->id,
	"amount" => [
	"currency" => "CHF",
	"value" => "0.15",
	],
	]
	]
	]
	];

	// We'll trigger the webhook with payment id and use mocking for
	// requests to the Mollie payments API.
	$responseStack = $this->mockMollie();
	$responseStack->append(new Response(200, [], json_encode($mollie_response1)));
	$responseStack->append(new Response(200, [], json_encode($mollie_response2)));

	$post = ['id' => $payment->id];
	$response = $this->post("api/webhooks/payment/mollie", $post);
	$response->assertStatus(200);

	$wallet->refresh();

	$this->assertEquals(-116, $wallet->balance);

	$transactions = $wallet->transactions()->where('type', Transaction::WALLET_CHARGEBACK)->get();

	$this->assertCount(1, $transactions);
	$this->assertSame(-15, $transactions[0]->amount);
	$this->assertSame(Transaction::WALLET_CHARGEBACK, $transactions[0]->type);
	$this->assertSame('', $transactions[0]->description);

	$payments = $wallet->payments()->where('id', 'chb_123456')->get();

	$this->assertCount(1, $payments);
	$this->assertSame(-15, $payments[0]->amount);
	$this->assertSame(PaymentProvider::STATUS_PAID, $payments[0]->status);
	$this->assertSame(PaymentProvider::TYPE_CHARGEBACK, $payments[0]->type);
	$this->assertSame("mollie", $payments[0]->provider);
	$this->assertSame('', $payments[0]->description);

	Bus::assertNotDispatched(\App\Jobs\PaymentEmail::class);

	$this->unmockMollie();
	}

	/**
	* Test refund/chargeback handling by the webhook in a foreign currency
	*
	* @group mollie
	*/
	public function testRefundAndChargebackForeignCurrency(): void
	{
	Bus::fake();

	$user = $this->getTestUser('john@kolab.org');
	$wallet = $user->wallets()->first();
	$wallet->transactions()->delete();

	$mollie = PaymentProvider::factory('mollie');

	// Create a paid payment
	$payment = Payment::create([
	'id' => 'tr_123456',
	'status' => PaymentProvider::STATUS_PAID,
	'amount' => 1234,
	'currency_amount' => 1117,
	'currency' => 'EUR',
	'type' => PaymentProvider::TYPE_ONEOFF,
	'wallet_id' => $wallet->id,
	'provider' => 'mollie',
	'description' => 'test',
	]);

	// Test handling a refund by the webhook

	$mollie_response1 = [
	"resource" => "payment",
	"id" => $payment->id,
	"status" => "paid",
	// Status is not enough, paidAt is used to distinguish the state
	"paidAt" => date('c'),
	"mode" => "test",
	"_links" => [
	"refunds" => [
	"href" => "https://api.mollie.com/v2/payments/{$payment->id}/refunds",
	"type" => "application/hal+json"
	]
	]
	];

	$mollie_response2 = [
	"count" => 1,
	"_links" => [],
	"_embedded" => [
	"refunds" => [
	[
	"resource" => "refund",
	"id" => "re_123456",
	"status" => \Mollie\Api\Types\RefundStatus::STATUS_REFUNDED,
	"paymentId" => $payment->id,
	"description" => "refund desc",
	"amount" => [
	"currency" => "EUR",
	"value" => "1.01",
	],
	]
	]
	]
	];

	// We'll trigger the webhook with payment id and use mocking for
	// requests to the Mollie payments API.
	$responseStack = $this->mockMollie();
	$responseStack->append(new Response(200, [], json_encode($mollie_response1)));
	$responseStack->append(new Response(200, [], json_encode($mollie_response2)));

	$post = ['id' => $payment->id];
	$response = $this->post("api/webhooks/payment/mollie", $post);
	$response->assertStatus(200);

	$wallet->refresh();

	- $this->assertEquals(-112, $wallet->balance);
	+ $this->assertTrue($wallet->balance <= -108);
	+ $this->assertTrue($wallet->balance >= -114);

	$payments = $wallet->payments()->where('id', 're_123456')->get();

	$this->assertCount(1, $payments);
	- $this->assertSame(-112, $payments[0]->amount);
	+ $this->assertTrue($payments[0]->amount <= -108);
	+ $this->assertTrue($payments[0]->amount >= -114);
	$this->assertSame(-101, $payments[0]->currency_amount);
	$this->assertSame('EUR', $payments[0]->currency);

	$this->unmockMollie();
	}

	/**
	* Create Mollie's auto-payment mandate using our API and Chrome browser
	*/
	protected function createMandate(Wallet $wallet, array $params)
	{
	// Use the API to create a first payment with a mandate
	$response = $this->actingAs($wallet->owner)->post("api/v4/payments/mandate", $params);
	$response->assertStatus(200);
	$json = $response->json();

	// There's no easy way to confirm a created mandate.
	// The only way seems to be to fire up Chrome on checkout page
	// and do actions with use of Dusk browser.
	$this->startBrowser()
	->visit($json['redirectUrl'])
	->click('input[value="paid"]')
	->click('button.form__button');

	$this->stopBrowser();
	}


	/**
	* Test listing a pending payment
	*
	* @group mollie
	*/
	public function testListingPayments(): void
	{
	Bus::fake();

	$user = $this->getTestUser('john@kolab.org');

	//Empty response
	$response = $this->actingAs($user)->get("api/v4/payments/pending");
	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame(0, $json['count']);
	$this->assertSame(1, $json['page']);
	$this->assertSame(false, $json['hasMore']);
	$this->assertCount(0, $json['list']);

	$response = $this->actingAs($user)->get("api/v4/payments/has-pending");
	$json = $response->json();
	$this->assertSame(false, $json['hasPending']);

	$wallet = $user->wallets()->first();

	// Successful payment
	$post = ['amount' => '12.34', 'currency' => 'CHF', 'methodId' => 'creditcard'];
	$response = $this->actingAs($user)->post("api/v4/payments", $post);
	$response->assertStatus(200);

	//A response
	$response = $this->actingAs($user)->get("api/v4/payments/pending");
	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame(1, $json['count']);
	$this->assertSame(1, $json['page']);
	$this->assertSame(false, $json['hasMore']);
	$this->assertCount(1, $json['list']);
	$this->assertSame(PaymentProvider::STATUS_OPEN, $json['list'][0]['status']);

	$response = $this->actingAs($user)->get("api/v4/payments/has-pending");
	$json = $response->json();
	$this->assertSame(true, $json['hasPending']);

	// Set the payment to paid
	$payments = Payment::where('wallet_id', $wallet->id)->get();

	$this->assertCount(1, $payments);
	$payment = $payments[0];

	$payment->status = PaymentProvider::STATUS_PAID;
	$payment->save();

	// They payment should be gone from the pending list now
	$response = $this->actingAs($user)->get("api/v4/payments/pending");
	$json = $response->json();
	$this->assertSame('success', $json['status']);
	$this->assertSame(0, $json['count']);
	$this->assertCount(0, $json['list']);

	$response = $this->actingAs($user)->get("api/v4/payments/has-pending");
	$json = $response->json();
	$this->assertSame(false, $json['hasPending']);
	}

	/**
	* Test listing payment methods
	*
	* @group mollie
	*/
	public function testListingPaymentMethods(): void
	{
	Bus::fake();

	$user = $this->getTestUser('john@kolab.org');

	$response = $this->actingAs($user)->get('api/v4/payments/methods?type=' . PaymentProvider::TYPE_ONEOFF);
	$response->assertStatus(200);
	$json = $response->json();

	$this->assertCount(3, $json);
	$this->assertSame('creditcard', $json[0]['id']);
	$this->assertSame('paypal', $json[1]['id']);
	$this->assertSame('banktransfer', $json[2]['id']);

	$response = $this->actingAs($user)->get('api/v4/payments/methods?type=' . PaymentProvider::TYPE_RECURRING);
	$response->assertStatus(200);
	$json = $response->json();

	$this->assertCount(1, $json);
	$this->assertSame('creditcard', $json[0]['id']);
	}
	}
	diff --git a/src/tests/Feature/Controller/Reseller/DiscountsTest.php b/src/tests/Feature/Controller/Reseller/DiscountsTest.php
	index b56f0f4b..3a6ed470 100644
	--- a/src/tests/Feature/Controller/Reseller/DiscountsTest.php
	+++ b/src/tests/Feature/Controller/Reseller/DiscountsTest.php
	@@ -1,107 +1,92 @@
	<?php

	namespace Tests\Feature\Controller\Reseller;

	use App\Discount;
	use App\Tenant;
	use Tests\TestCase;

	class DiscountsTest extends TestCase
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	-
	- $tenant = Tenant::where('title', 'Sample Tenant')->first();
	- $tenant->discounts()->delete();
	-
	self::useResellerUrl();
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	- \config(['app.tenant_id' => 1]);
	-
	- $tenant = Tenant::where('title', 'Sample Tenant')->first();
	- $tenant->discounts()->delete();
	-
	parent::tearDown();
	}

	/**
	- * Test listing discounts (/api/v4/discounts)
	+ * Test listing discounts (GET /api/v4/users/{id}/discounts)
	*/
	- public function testIndex(): void
	+ public function testUserDiscounts(): void
	{
	$user = $this->getTestUser('john@kolab.org');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	- $reseller = $this->getTestUser('reseller@reseller.com');
	- $reseller2 = $this->getTestUser('reseller@kolabnow.com');
	- $tenant = Tenant::where('title', 'Sample Tenant')->first();
	-
	- \config(['app.tenant_id' => $tenant->id]);
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
	+ $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');

	// Non-admin user
	- $response = $this->actingAs($user)->get("api/v4/discounts");
	+ $response = $this->actingAs($user)->get("api/v4/users/{$user->id}/discounts");
	$response->assertStatus(403);

	// Admin user
	- $response = $this->actingAs($admin)->get("api/v4/discounts");
	+ $response = $this->actingAs($admin)->get("api/v4/users/{$user->id}/discounts");
	$response->assertStatus(403);

	// Reseller user, but different tenant
	- $response = $this->actingAs($reseller2)->get("api/v4/discounts");
	- $response->assertStatus(403);
	+ $response = $this->actingAs($reseller2)->get("api/v4/users/{$user->id}/discounts");
	+ $response->assertStatus(404);

	- // Reseller (empty list)
	- $response = $this->actingAs($reseller)->get("api/v4/discounts");
	+ // Reseller
	+ $response = $this->actingAs($reseller1)->get("api/v4/users/{$user->id}/discounts");
	$response->assertStatus(200);

	$json = $response->json();

	- $this->assertSame(0, $json['count']);
	+ $discount_test = Discount::where('code', 'TEST')->first();
	+ $discount_free = Discount::where('discount', 100)->first();

	- // Add some discounts
	- $discount_test = Discount::create([
	- 'description' => 'Test reseller voucher',
	- 'code' => 'RESELLER-TEST',
	- 'discount' => 10,
	- 'active' => true,
	- ]);
	+ $this->assertSame(3, $json['count']);
	+ $this->assertSame($discount_test->id, $json['list'][0]['id']);
	+ $this->assertSame($discount_test->discount, $json['list'][0]['discount']);
	+ $this->assertSame($discount_test->code, $json['list'][0]['code']);
	+ $this->assertSame($discount_test->description, $json['list'][0]['description']);
	+ $this->assertSame('10% - Test voucher [TEST]', $json['list'][0]['label']);

	- $discount_free = Discount::create([
	- 'description' => 'Free account',
	- 'discount' => 100,
	- 'active' => true,
	- ]);
	+ $this->assertSame($discount_free->id, $json['list'][2]['id']);
	+ $this->assertSame($discount_free->discount, $json['list'][2]['discount']);
	+ $this->assertSame($discount_free->code, $json['list'][2]['code']);
	+ $this->assertSame($discount_free->description, $json['list'][2]['description']);
	+ $this->assertSame('100% - Free Account', $json['list'][2]['label']);

	- $discount_test->tenant_id = $tenant->id;
	- $discount_test->save();
	- $discount_free->tenant_id = $tenant->id;
	- $discount_free->save();
	+ // A user in another tenant's user
	+ $user = $this->getTestUser('user@sample-tenant.dev-local');

	- $response = $this->actingAs($reseller)->get("api/v4/discounts");
	+ $response = $this->actingAs($reseller1)->get("api/v4/users/{$user->id}/discounts");
	+ $response->assertStatus(404);
	+
	+ $response = $this->actingAs($reseller2)->get("api/v4/users/{$user->id}/discounts");
	$response->assertStatus(200);

	$json = $response->json();

	- $this->assertSame(2, $json['count']);
	- $this->assertSame($discount_test->id, $json['list'][0]['id']);
	- $this->assertSame($discount_test->discount, $json['list'][0]['discount']);
	- $this->assertSame($discount_test->code, $json['list'][0]['code']);
	- $this->assertSame($discount_test->description, $json['list'][0]['description']);
	- $this->assertSame('10% - Test reseller voucher [RESELLER-TEST]', $json['list'][0]['label']);
	+ $discount = Discount::withObjectTenantContext($user)->where('discount', 10)->first();

	- $this->assertSame($discount_free->id, $json['list'][1]['id']);
	- $this->assertSame($discount_free->discount, $json['list'][1]['discount']);
	- $this->assertSame($discount_free->code, $json['list'][1]['code']);
	- $this->assertSame($discount_free->description, $json['list'][1]['description']);
	- $this->assertSame('100% - Free account', $json['list'][1]['label']);
	+ $this->assertSame(1, $json['count']);
	+ $this->assertSame($discount->id, $json['list'][0]['id']);
	+ $this->assertSame($discount->discount, $json['list'][0]['discount']);
	+ $this->assertSame($discount->code, $json['list'][0]['code']);
	+ $this->assertSame($discount->description, $json['list'][0]['description']);
	+ $this->assertSame('10% - ' . $discount->description, $json['list'][0]['label']);
	}
	}
	diff --git a/src/tests/Feature/Controller/Reseller/DomainsTest.php b/src/tests/Feature/Controller/Reseller/DomainsTest.php
	index b5972346..0e483406 100644
	--- a/src/tests/Feature/Controller/Reseller/DomainsTest.php
	+++ b/src/tests/Feature/Controller/Reseller/DomainsTest.php
	@@ -1,310 +1,286 @@
	<?php

	namespace Tests\Feature\Controller\Reseller;

	use App\Domain;
	use App\Entitlement;
	use App\Sku;
	use App\Tenant;
	use Illuminate\Support\Facades\Queue;
	use Tests\TestCase;

	class DomainsTest extends TestCase
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	self::useResellerUrl();
	- \config(['app.tenant_id' => 1]);

	$this->deleteTestDomain('domainscontroller.com');
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	- \config(['app.tenant_id' => 1]);
	$this->deleteTestDomain('domainscontroller.com');

	parent::tearDown();
	}

	/**
	* Test domain confirm request
	*/
	public function testConfirm(): void
	{
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
	$domain = $this->getTestDomain('domainscontroller.com', [
	'status' => Domain::STATUS_NEW,
	'type' => Domain::TYPE_EXTERNAL,
	]);

	// THe end-point exists on the users controller, but not reseller's
	$response = $this->actingAs($reseller1)->get("api/v4/domains/{$domain->id}/confirm");
	$response->assertStatus(404);
	}

	/**
	* Test domains searching (/api/v4/domains)
	*/
	public function testIndex(): void
	{
	$user = $this->getTestUser('john@kolab.org');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	- $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
	+ $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');

	// Non-admin user
	$response = $this->actingAs($user)->get("api/v4/domains");
	$response->assertStatus(403);

	// Admin user
	$response = $this->actingAs($admin)->get("api/v4/domains");
	$response->assertStatus(403);

	- // Reseller from a different tenant
	- $response = $this->actingAs($reseller2)->get("api/v4/domains");
	- $response->assertStatus(403);
	-
	// Search with no matches expected
	$response = $this->actingAs($reseller1)->get("api/v4/domains?search=abcd12.org");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(0, $json['count']);
	$this->assertSame([], $json['list']);

	// Search by a domain name
	$response = $this->actingAs($reseller1)->get("api/v4/domains?search=kolab.org");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(1, $json['count']);
	$this->assertCount(1, $json['list']);
	$this->assertSame('kolab.org', $json['list'][0]['namespace']);

	// Search by owner
	-
	$response = $this->actingAs($reseller1)->get("api/v4/domains?owner={$user->id}");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(1, $json['count']);
	$this->assertCount(1, $json['list']);
	$this->assertSame('kolab.org', $json['list'][0]['namespace']);

	// Search by owner (Ned is a controller on John's wallets,
	// here we expect only domains assigned to Ned's wallet(s))
	$ned = $this->getTestUser('ned@kolab.org');

	$response = $this->actingAs($reseller1)->get("api/v4/domains?owner={$ned->id}");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(0, $json['count']);
	$this->assertCount(0, $json['list']);

	// Test unauth access to other tenant's domains
	- \config(['app.tenant_id' => 2]);
	-
	$response = $this->actingAs($reseller2)->get("api/v4/domains?search=kolab.org");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(0, $json['count']);
	$this->assertSame([], $json['list']);

	$response = $this->actingAs($reseller2)->get("api/v4/domains?owner={$user->id}");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(0, $json['count']);
	$this->assertSame([], $json['list']);
	}

	/**
	* Test fetching domain info
	*/
	public function testShow(): void
	{
	- $sku_domain = Sku::where('title', 'domain-hosting')->first();
	+ $sku_domain = Sku::withEnvTenantContext()->where('title', 'domain-hosting')->first();
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	$user = $this->getTestUser('test1@domainscontroller.com');
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	- $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
	+ $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');
	$domain = $this->getTestDomain('domainscontroller.com', [
	'status' => Domain::STATUS_NEW,
	'type' => Domain::TYPE_EXTERNAL,
	]);

	Entitlement::create([
	'wallet_id' => $user->wallets()->first()->id,
	'sku_id' => $sku_domain->id,
	'entitleable_id' => $domain->id,
	'entitleable_type' => Domain::class
	]);

	// Unauthorized access (user)
	$response = $this->actingAs($user)->get("api/v4/domains/{$domain->id}");
	$response->assertStatus(403);

	// Unauthorized access (admin)
	$response = $this->actingAs($admin)->get("api/v4/domains/{$domain->id}");
	$response->assertStatus(403);

	// Unauthorized access (tenant != env-tenant)
	$response = $this->actingAs($reseller2)->get("api/v4/domains/{$domain->id}");
	- $response->assertStatus(403);
	+ $response->assertStatus(404);

	$response = $this->actingAs($reseller1)->get("api/v4/domains/{$domain->id}");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertEquals($domain->id, $json['id']);
	$this->assertEquals($domain->namespace, $json['namespace']);
	$this->assertEquals($domain->status, $json['status']);
	$this->assertEquals($domain->type, $json['type']);
	// Note: Other properties are being tested in the user controller tests
	-
	- // Unauthorized access (other domain's tenant)
	- \config(['app.tenant_id' => 2]);
	- $response = $this->actingAs($reseller2)->get("api/v4/domains/{$domain->id}");
	- $response->assertStatus(404);
	}

	/**
	* Test fetching domain status (GET /api/v4/domains/<domain-id>/status)
	*/
	public function testStatus(): void
	{
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
	$domain = $this->getTestDomain('kolab.org');

	// This end-point does not exist for resellers
	$response = $this->actingAs($reseller1)->get("/api/v4/domains/{$domain->id}/status");
	$response->assertStatus(404);
	}

	/**
	* Test domain suspending (POST /api/v4/domains/<domain-id>/suspend)
	*/
	public function testSuspend(): void
	{
	Queue::fake(); // disable jobs

	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	- $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
	+ $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');

	\config(['app.tenant_id' => 2]);

	$domain = $this->getTestDomain('domainscontroller.com', [
	'status' => Domain::STATUS_NEW,
	'type' => Domain::TYPE_EXTERNAL,
	]);
	$user = $this->getTestUser('test@domainscontroller.com');

	// Test unauthorized access to the reseller API (user)
	$response = $this->actingAs($user)->post("/api/v4/domains/{$domain->id}/suspend", []);
	$response->assertStatus(403);

	$this->assertFalse($domain->fresh()->isSuspended());

	// Test unauthorized access to the reseller API (admin)
	$response = $this->actingAs($admin)->post("/api/v4/domains/{$domain->id}/suspend", []);
	$response->assertStatus(403);

	$this->assertFalse($domain->fresh()->isSuspended());

	// Test unauthorized access to the reseller API (reseller in another tenant)
	$response = $this->actingAs($reseller1)->post("/api/v4/domains/{$domain->id}/suspend", []);
	- $response->assertStatus(403);
	+ $response->assertStatus(404);

	$this->assertFalse($domain->fresh()->isSuspended());

	// Test suspending the domain
	$response = $this->actingAs($reseller2)->post("/api/v4/domains/{$domain->id}/suspend", []);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame("Domain suspended successfully.", $json['message']);
	$this->assertCount(2, $json);

	$this->assertTrue($domain->fresh()->isSuspended());
	-
	- // Test authenticated reseller, but domain belongs to another tenant
	- \config(['app.tenant_id' => 1]);
	- $response = $this->actingAs($reseller1)->post("/api/v4/domains/{$domain->id}/suspend", []);
	- $response->assertStatus(404);
	}

	/**
	* Test user un-suspending (POST /api/v4/users/<user-id>/unsuspend)
	*/
	public function testUnsuspend(): void
	{
	Queue::fake(); // disable jobs

	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	- $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
	+ $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');

	\config(['app.tenant_id' => 2]);

	$domain = $this->getTestDomain('domainscontroller.com', [
	'status' => Domain::STATUS_NEW \| Domain::STATUS_SUSPENDED,
	'type' => Domain::TYPE_EXTERNAL,
	]);
	$user = $this->getTestUser('test@domainscontroller.com');

	// Test unauthorized access to reseller API (user)
	$response = $this->actingAs($user)->post("/api/v4/domains/{$domain->id}/unsuspend", []);
	$response->assertStatus(403);

	$this->assertTrue($domain->fresh()->isSuspended());

	// Test unauthorized access to reseller API (admin)
	$response = $this->actingAs($admin)->post("/api/v4/domains/{$domain->id}/unsuspend", []);
	$response->assertStatus(403);

	$this->assertTrue($domain->fresh()->isSuspended());

	// Test unauthorized access to reseller API (another tenant)
	$response = $this->actingAs($reseller1)->post("/api/v4/domains/{$domain->id}/unsuspend", []);
	- $response->assertStatus(403);
	+ $response->assertStatus(404);

	$this->assertTrue($domain->fresh()->isSuspended());

	// Test suspending the user
	$response = $this->actingAs($reseller2)->post("/api/v4/domains/{$domain->id}/unsuspend", []);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame("Domain unsuspended successfully.", $json['message']);
	$this->assertCount(2, $json);

	$this->assertFalse($domain->fresh()->isSuspended());
	-
	- // Test unauthorized access to reseller API (another tenant)
	- \config(['app.tenant_id' => 1]);
	- $response = $this->actingAs($reseller1)->post("/api/v4/domains/{$domain->id}/unsuspend", []);
	- $response->assertStatus(404);
	}
	}
	diff --git a/src/tests/Feature/Controller/Reseller/GroupsTest.php b/src/tests/Feature/Controller/Reseller/GroupsTest.php
	index f3103f04..981967f5 100644
	--- a/src/tests/Feature/Controller/Reseller/GroupsTest.php
	+++ b/src/tests/Feature/Controller/Reseller/GroupsTest.php
	@@ -1,291 +1,278 @@
	<?php

	namespace Tests\Feature\Controller\Reseller;

	use App\Group;
	use Illuminate\Support\Facades\Queue;
	use Tests\TestCase;

	class GroupsTest extends TestCase
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	self::useResellerUrl();

	$this->deleteTestGroup('group-test@kolab.org');
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	$this->deleteTestGroup('group-test@kolab.org');

	parent::tearDown();
	}

	/**
	* Test groups searching (/api/v4/groups)
	*/
	public function testIndex(): void
	{
	$user = $this->getTestUser('john@kolab.org');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	- $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
	+ $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');
	$group = $this->getTestGroup('group-test@kolab.org');
	$group->assignToWallet($user->wallets->first());

	// Non-admin user
	$response = $this->actingAs($user)->get("api/v4/groups");
	$response->assertStatus(403);

	// Admin user
	$response = $this->actingAs($admin)->get("api/v4/groups");
	$response->assertStatus(403);

	- // Reseller from a different tenant
	- $response = $this->actingAs($reseller2)->get("api/v4/groups");
	- $response->assertStatus(403);
	-
	// Search with no search criteria
	$response = $this->actingAs($reseller1)->get("api/v4/groups");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(0, $json['count']);
	$this->assertSame([], $json['list']);

	// Search with no matches expected
	$response = $this->actingAs($reseller1)->get("api/v4/groups?search=john@kolab.org");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(0, $json['count']);
	$this->assertSame([], $json['list']);

	// Search by email
	$response = $this->actingAs($reseller1)->get("api/v4/groups?search={$group->email}");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(1, $json['count']);
	$this->assertCount(1, $json['list']);
	$this->assertSame($group->email, $json['list'][0]['email']);

	// Search by owner
	$response = $this->actingAs($reseller1)->get("api/v4/groups?owner={$user->id}");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(1, $json['count']);
	$this->assertCount(1, $json['list']);
	$this->assertSame($group->email, $json['list'][0]['email']);

	// Search by owner (Ned is a controller on John's wallets,
	// here we expect only domains assigned to Ned's wallet(s))
	$ned = $this->getTestUser('ned@kolab.org');
	$response = $this->actingAs($reseller1)->get("api/v4/groups?owner={$ned->id}");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(0, $json['count']);
	$this->assertCount(0, $json['list']);

	- // Test unauth access to other tenant's groups
	- \config(['app.tenant_id' => 2]);
	-
	$response = $this->actingAs($reseller2)->get("api/v4/groups?search=kolab.org");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(0, $json['count']);
	$this->assertSame([], $json['list']);

	$response = $this->actingAs($reseller2)->get("api/v4/groups?owner={$user->id}");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(0, $json['count']);
	$this->assertSame([], $json['list']);
	}

	/**
	* Test fetching group info
	*/
	public function testShow(): void
	{
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	$user = $this->getTestUser('test1@domainscontroller.com');
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	- $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
	+ $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');
	$group = $this->getTestGroup('group-test@kolab.org');
	$group->assignToWallet($user->wallets->first());

	// Only resellers can access it
	$response = $this->actingAs($user)->get("api/v4/groups/{$group->id}");
	$response->assertStatus(403);

	$response = $this->actingAs($admin)->get("api/v4/groups/{$group->id}");
	$response->assertStatus(403);

	$response = $this->actingAs($reseller2)->get("api/v4/groups/{$group->id}");
	- $response->assertStatus(403);
	+ $response->assertStatus(404);

	$response = $this->actingAs($reseller1)->get("api/v4/groups/{$group->id}");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertEquals($group->id, $json['id']);
	$this->assertEquals($group->email, $json['email']);
	$this->assertEquals($group->status, $json['status']);
	}

	/**
	* Test fetching group status (GET /api/v4/domains/<domain-id>/status)
	*/
	public function testStatus(): void
	{
	Queue::fake(); // disable jobs

	$user = $this->getTestUser('john@kolab.org');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
	$group = $this->getTestGroup('group-test@kolab.org');
	$group->assignToWallet($user->wallets->first());

	// This end-point does not exist for admins
	$response = $this->actingAs($reseller1)->get("/api/v4/groups/{$group->id}/status");
	$response->assertStatus(404);
	}

	/**
	* Test group creating (POST /api/v4/groups)
	*/
	public function testStore(): void
	{
	$user = $this->getTestUser('john@kolab.org');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));

	// Test unauthorized access to reseller API
	$response = $this->actingAs($user)->post("/api/v4/groups", []);
	$response->assertStatus(403);

	// Reseller or admin can't create groups
	$response = $this->actingAs($admin)->post("/api/v4/groups", []);
	$response->assertStatus(403);

	$response = $this->actingAs($reseller1)->post("/api/v4/groups", []);
	$response->assertStatus(404);
	}

	/**
	* Test group suspending (POST /api/v4/groups/<group-id>/suspend)
	*/
	public function testSuspend(): void
	{
	Queue::fake(); // disable jobs

	$user = $this->getTestUser('john@kolab.org');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	- $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
	+ $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');
	$group = $this->getTestGroup('group-test@kolab.org');
	$group->assignToWallet($user->wallets->first());

	// Test unauthorized access to reseller API
	$response = $this->actingAs($user)->post("/api/v4/groups/{$group->id}/suspend", []);
	$response->assertStatus(403);

	// Test unauthorized access to reseller API
	$response = $this->actingAs($admin)->post("/api/v4/groups/{$group->id}/suspend", []);
	$response->assertStatus(403);

	// Test non-existing group ID
	$response = $this->actingAs($reseller1)->post("/api/v4/groups/abc/suspend", []);
	$response->assertStatus(404);

	$this->assertFalse($group->fresh()->isSuspended());

	// Test suspending the group
	$response = $this->actingAs($reseller1)->post("/api/v4/groups/{$group->id}/suspend", []);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame("Distribution list suspended successfully.", $json['message']);
	$this->assertCount(2, $json);

	$this->assertTrue($group->fresh()->isSuspended());

	- // Test unauth access to other tenant's groups
	- \config(['app.tenant_id' => 2]);
	-
	$response = $this->actingAs($reseller2)->post("/api/v4/groups/{$group->id}/suspend", []);
	$response->assertStatus(404);
	}

	/**
	* Test user un-suspending (POST /api/v4/users/<user-id>/unsuspend)
	*/
	public function testUnsuspend(): void
	{
	Queue::fake(); // disable jobs

	$user = $this->getTestUser('john@kolab.org');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	- $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
	+ $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');
	$group = $this->getTestGroup('group-test@kolab.org');
	$group->assignToWallet($user->wallets->first());
	$group->status \|= Group::STATUS_SUSPENDED;
	$group->save();

	// Test unauthorized access to reseller API
	$response = $this->actingAs($user)->post("/api/v4/groups/{$group->id}/unsuspend", []);
	$response->assertStatus(403);

	// Test unauthorized access to reseller API
	$response = $this->actingAs($admin)->post("/api/v4/groups/{$group->id}/unsuspend", []);
	$response->assertStatus(403);

	// Invalid group ID
	$response = $this->actingAs($reseller1)->post("/api/v4/groups/abc/unsuspend", []);
	$response->assertStatus(404);

	$this->assertTrue($group->fresh()->isSuspended());

	// Test suspending the group
	$response = $this->actingAs($reseller1)->post("/api/v4/groups/{$group->id}/unsuspend", []);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame("Distribution list unsuspended successfully.", $json['message']);
	$this->assertCount(2, $json);

	$this->assertFalse($group->fresh()->isSuspended());

	- // Test unauth access to other tenant's groups
	- \config(['app.tenant_id' => 2]);
	-
	$response = $this->actingAs($reseller2)->post("/api/v4/groups/{$group->id}/unsuspend", []);
	$response->assertStatus(404);
	}
	}
	diff --git a/src/tests/Feature/Controller/Reseller/InvitationsTest.php b/src/tests/Feature/Controller/Reseller/InvitationsTest.php
	index f3e88290..b25bb849 100644
	--- a/src/tests/Feature/Controller/Reseller/InvitationsTest.php
	+++ b/src/tests/Feature/Controller/Reseller/InvitationsTest.php
	@@ -1,350 +1,357 @@
	<?php

	namespace Tests\Feature\Controller\Reseller;

	use App\SignupInvitation;
	use App\Tenant;
	use Illuminate\Http\Testing\File;
	use Illuminate\Support\Facades\Queue;
	use Tests\TestCase;

	class InvitationsTest extends TestCase
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();

	SignupInvitation::truncate();

	- \config(['app.tenant_id' => 1]);
	-
	self::useResellerUrl();
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	SignupInvitation::truncate();

	- \config(['app.tenant_id' => 1]);
	-
	parent::tearDown();
	}

	/**
	* Test deleting invitations (DELETE /api/v4/invitations/<id>)
	*/
	public function testDestroy(): void
	{
	Queue::fake();

	$user = $this->getTestUser('john@kolab.org');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	- $reseller = $this->getTestUser('reseller@reseller.com');
	- $reseller2 = $this->getTestUser('reseller@kolabnow.com');
	- $tenant = Tenant::where('title', 'Sample Tenant')->first();
	-
	- \config(['app.tenant_id' => $tenant->id]);
	+ $reseller = $this->getTestUser('reseller@sample-tenant.dev-local');
	+ $reseller2 = $this->getTestUser('reseller@' . \config('app.domain'));

	$inv = SignupInvitation::create(['email' => 'email1@ext.com']);
	+ $inv->tenant_id = $reseller->tenant_id;
	+ $inv->save();

	// Non-admin user
	$response = $this->actingAs($user)->delete("api/v4/invitations/{$inv->id}");
	$response->assertStatus(403);

	// Admin user
	$response = $this->actingAs($admin)->delete("api/v4/invitations/{$inv->id}");
	$response->assertStatus(403);

	// Reseller user, but different tenant
	$response = $this->actingAs($reseller2)->delete("api/v4/invitations/{$inv->id}");
	- $response->assertStatus(403);
	+ $response->assertStatus(404);

	// Reseller - non-existing invitation identifier
	$response = $this->actingAs($reseller)->delete("api/v4/invitations/abd");
	$response->assertStatus(404);

	// Reseller - existing invitation
	$response = $this->actingAs($reseller)->delete("api/v4/invitations/{$inv->id}");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame("Invitation deleted successfully.", $json['message']);
	$this->assertSame(null, SignupInvitation::find($inv->id));
	}

	/**
	* Test listing invitations (GET /api/v4/invitations)
	*/
	public function testIndex(): void
	{
	Queue::fake();

	$user = $this->getTestUser('john@kolab.org');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	- $reseller = $this->getTestUser('reseller@reseller.com');
	- $reseller2 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller = $this->getTestUser('reseller@' . \config('app.domain'));
	+ $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');
	$tenant = Tenant::where('title', 'Sample Tenant')->first();

	- \config(['app.tenant_id' => $tenant->id]);
	-
	// Non-admin user
	$response = $this->actingAs($user)->get("api/v4/invitations");
	$response->assertStatus(403);

	// Admin user
	$response = $this->actingAs($admin)->get("api/v4/invitations");
	$response->assertStatus(403);

	- // Reseller user, but different tenant
	- $response = $this->actingAs($reseller2)->get("api/v4/invitations");
	- $response->assertStatus(403);
	-
	// Reseller (empty list)
	$response = $this->actingAs($reseller)->get("api/v4/invitations");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(0, $json['count']);
	$this->assertSame([], $json['list']);
	$this->assertSame(1, $json['page']);
	$this->assertFalse($json['hasMore']);

	// Add some invitations
	$i1 = SignupInvitation::create(['email' => 'email1@ext.com']);
	$i2 = SignupInvitation::create(['email' => 'email2@ext.com']);
	$i3 = SignupInvitation::create(['email' => 'email3@ext.com']);
	$i4 = SignupInvitation::create(['email' => 'email4@other.com']);
	$i5 = SignupInvitation::create(['email' => 'email5@other.com']);
	$i6 = SignupInvitation::create(['email' => 'email6@other.com']);
	$i7 = SignupInvitation::create(['email' => 'email7@other.com']);
	$i8 = SignupInvitation::create(['email' => 'email8@other.com']);
	$i9 = SignupInvitation::create(['email' => 'email9@other.com']);
	$i10 = SignupInvitation::create(['email' => 'email10@other.com']);
	$i11 = SignupInvitation::create(['email' => 'email11@other.com']);
	$i12 = SignupInvitation::create(['email' => 'email12@test.com']);
	$i13 = SignupInvitation::create(['email' => 'email13@ext.com']);

	SignupInvitation::query()->update(['created_at' => now()->subDays('1')]);
	+
	SignupInvitation::where('id', $i1->id)
	->update(['created_at' => now()->subHours('2'), 'status' => SignupInvitation::STATUS_FAILED]);
	+
	SignupInvitation::where('id', $i2->id)
	->update(['created_at' => now()->subHours('3'), 'status' => SignupInvitation::STATUS_SENT]);
	+
	SignupInvitation::where('id', $i11->id)->update(['created_at' => now()->subDays('3')]);
	- SignupInvitation::where('id', $i12->id)->update(['tenant_id' => 1]);
	- SignupInvitation::where('id', $i13->id)->update(['tenant_id' => 1]);
	+ SignupInvitation::where('id', $i12->id)->update(['tenant_id' => $reseller2->tenant_id]);
	+ SignupInvitation::where('id', $i13->id)->update(['tenant_id' => $reseller2->tenant_id]);

	$response = $this->actingAs($reseller)->get("api/v4/invitations");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(10, $json['count']);
	$this->assertSame(1, $json['page']);
	$this->assertTrue($json['hasMore']);
	$this->assertSame($i1->id, $json['list'][0]['id']);
	$this->assertSame($i1->email, $json['list'][0]['email']);
	$this->assertSame(true, $json['list'][0]['isFailed']);
	$this->assertSame(false, $json['list'][0]['isNew']);
	$this->assertSame(false, $json['list'][0]['isSent']);
	$this->assertSame(false, $json['list'][0]['isCompleted']);
	$this->assertSame($i2->id, $json['list'][1]['id']);
	$this->assertSame($i2->email, $json['list'][1]['email']);
	$this->assertFalse(in_array($i12->email, array_column($json['list'], 'email')));
	$this->assertFalse(in_array($i13->email, array_column($json['list'], 'email')));

	$response = $this->actingAs($reseller)->get("api/v4/invitations?page=2");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(1, $json['count']);
	$this->assertSame(2, $json['page']);
	$this->assertFalse($json['hasMore']);
	$this->assertSame($i11->id, $json['list'][0]['id']);

	// Test searching (email address)
	$response = $this->actingAs($reseller)->get("api/v4/invitations?search=email3@ext.com");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(1, $json['count']);
	$this->assertSame(1, $json['page']);
	$this->assertFalse($json['hasMore']);
	$this->assertSame($i3->id, $json['list'][0]['id']);

	// Test searching (domain)
	$response = $this->actingAs($reseller)->get("api/v4/invitations?search=ext.com");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(3, $json['count']);
	$this->assertSame(1, $json['page']);
	$this->assertFalse($json['hasMore']);
	$this->assertSame($i1->id, $json['list'][0]['id']);
	+
	+ // Reseller user, but different tenant
	+ $response = $this->actingAs($reseller2)->get("api/v4/invitations");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame(2, $json['count']);
	}

	/**
	* Test resending invitations (POST /api/v4/invitations/<id>/resend)
	*/
	public function testResend(): void
	{
	Queue::fake();

	$user = $this->getTestUser('john@kolab.org');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	- $reseller = $this->getTestUser('reseller@reseller.com');
	- $reseller2 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller = $this->getTestUser('reseller@sample-tenant.dev-local');
	+ $reseller2 = $this->getTestUser('reseller@' . \config('app.domain'));
	$tenant = Tenant::where('title', 'Sample Tenant')->first();

	- \config(['app.tenant_id' => $tenant->id]);
	-
	$inv = SignupInvitation::create(['email' => 'email1@ext.com']);
	+ $inv->tenant_id = $reseller->tenant_id;
	+ $inv->save();
	+
	SignupInvitation::where('id', $inv->id)->update(['status' => SignupInvitation::STATUS_FAILED]);

	// Non-admin user
	$response = $this->actingAs($user)->post("api/v4/invitations/{$inv->id}/resend");
	$response->assertStatus(403);

	// Admin user
	$response = $this->actingAs($admin)->post("api/v4/invitations/{$inv->id}/resend");
	$response->assertStatus(403);

	// Reseller user, but different tenant
	$response = $this->actingAs($reseller2)->post("api/v4/invitations/{$inv->id}/resend");
	- $response->assertStatus(403);
	+ $response->assertStatus(404);

	// Reseller - non-existing invitation identifier
	$response = $this->actingAs($reseller)->post("api/v4/invitations/abd/resend");
	$response->assertStatus(404);

	// Reseller - existing invitation
	$response = $this->actingAs($reseller)->post("api/v4/invitations/{$inv->id}/resend");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame("Invitation added to the sending queue successfully.", $json['message']);
	$this->assertTrue($inv->fresh()->isNew());
	}

	/**
	* Test creating invitations (POST /api/v4/invitations)
	*/
	public function testStore(): void
	{
	Queue::fake();

	$user = $this->getTestUser('john@kolab.org');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	- $reseller = $this->getTestUser('reseller@reseller.com');
	- $reseller2 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller = $this->getTestUser('reseller@sample-tenant.dev-local');
	+ $reseller2 = $this->getTestUser('reseller@' . \config('app.domain'));
	$tenant = Tenant::where('title', 'Sample Tenant')->first();

	- \config(['app.tenant_id' => $tenant->id]);
	-
	// Non-admin user
	$response = $this->actingAs($user)->post("api/v4/invitations", []);
	$response->assertStatus(403);

	// Admin user
	$response = $this->actingAs($admin)->post("api/v4/invitations", []);
	$response->assertStatus(403);

	- // Reseller user, but different tenant
	- $response = $this->actingAs($reseller2)->post("api/v4/invitations", []);
	- $response->assertStatus(403);
	-
	// Reseller (empty post)
	$response = $this->actingAs($reseller)->post("api/v4/invitations", []);
	$response->assertStatus(422);

	$json = $response->json();

	$this->assertSame('error', $json['status']);
	$this->assertCount(1, $json['errors']);
	$this->assertSame("The email field is required.", $json['errors']['email'][0]);

	// Invalid email address
	$post = ['email' => 'test'];
	$response = $this->actingAs($reseller)->post("api/v4/invitations", $post);
	$response->assertStatus(422);

	$json = $response->json();

	$this->assertSame('error', $json['status']);
	$this->assertCount(1, $json['errors']);
	$this->assertSame("The email must be a valid email address.", $json['errors']['email'][0]);

	// Valid email address
	$post = ['email' => 'test@external.org'];
	$response = $this->actingAs($reseller)->post("api/v4/invitations", $post);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame("The invitation has been created.", $json['message']);
	$this->assertSame(1, $json['count']);
	$this->assertSame(1, SignupInvitation::count());

	+ $invitation = SignupInvitation::first();
	+ $this->assertSame($reseller->tenant_id, $invitation->tenant_id);
	+ $this->assertSame($post['email'], $invitation->email);
	+
	// Test file input (empty file)
	$tmpfile = tmpfile();
	fwrite($tmpfile, "");
	$file = new File('test.csv', $tmpfile);
	$post = ['file' => $file];
	$response = $this->actingAs($reseller)->post("api/v4/invitations", $post);

	fclose($tmpfile);

	$response->assertStatus(422);
	$json = $response->json();

	$this->assertSame('error', $json['status']);
	$this->assertSame("Failed to find any valid email addresses in the uploaded file.", $json['errors']['file']);

	// Test file input with an invalid email address
	$tmpfile = tmpfile();
	fwrite($tmpfile, "t1@domain.tld\r\nt2@domain");
	$file = new File('test.csv', $tmpfile);
	$post = ['file' => $file];
	$response = $this->actingAs($reseller)->post("api/v4/invitations", $post);

	fclose($tmpfile);

	$response->assertStatus(422);
	$json = $response->json();

	$this->assertSame('error', $json['status']);
	$this->assertSame("Found an invalid email address (t2@domain) on line 2.", $json['errors']['file']);

	// Test file input (two addresses)
	$tmpfile = tmpfile();
	fwrite($tmpfile, "t1@domain.tld\r\nt2@domain.tld");
	$file = new File('test.csv', $tmpfile);
	$post = ['file' => $file];
	$response = $this->actingAs($reseller)->post("api/v4/invitations", $post);

	fclose($tmpfile);

	$response->assertStatus(200);
	$json = $response->json();

	$this->assertSame(1, SignupInvitation::where('email', 't1@domain.tld')->count());
	$this->assertSame(1, SignupInvitation::where('email', 't2@domain.tld')->count());
	$this->assertSame('success', $json['status']);
	$this->assertSame("2 invitations has been created.", $json['message']);
	$this->assertSame(2, $json['count']);
	+
	+ // Reseller user, but different tenant
	+ $post = ['email' => 'test-reseller2@external.org'];
	+ $response = $this->actingAs($reseller2)->post("api/v4/invitations", $post);
	+ $response->assertStatus(200);
	+
	+ $invitation = SignupInvitation::where('email', $post['email'])->first();
	+ $this->assertSame($reseller2->tenant_id, $invitation->tenant_id);
	}
	}
	diff --git a/src/tests/Feature/Controller/Reseller/PaymentsMollieTest.php b/src/tests/Feature/Controller/Reseller/PaymentsMollieTest.php
	index 8488de99..2a976976 100644
	--- a/src/tests/Feature/Controller/Reseller/PaymentsMollieTest.php
	+++ b/src/tests/Feature/Controller/Reseller/PaymentsMollieTest.php
	@@ -1,257 +1,258 @@
	<?php

	namespace Tests\Feature\Controller\Reseller;

	use App\Http\Controllers\API\V4\Reseller\PaymentsController;
	use App\Payment;
	use App\Providers\PaymentProvider;
	use App\Transaction;
	use App\Wallet;
	use App\WalletSetting;
	use GuzzleHttp\Psr7\Response;
	use Illuminate\Support\Facades\Bus;
	use Tests\TestCase;
	use Tests\BrowserAddonTrait;
	use Tests\MollieMocksTrait;

	class PaymentsMollieTest extends TestCase
	{
	use MollieMocksTrait;
	use BrowserAddonTrait;

	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();

	// All tests in this file use Mollie
	\config(['services.payment_provider' => 'mollie']);

	- $reseller = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller = $this->getTestUser('reseller@' . \config('app.domain'));
	$wallet = $reseller->wallets()->first();
	Payment::where('wallet_id', $wallet->id)->delete();
	Wallet::where('id', $wallet->id)->update(['balance' => 0]);
	WalletSetting::where('wallet_id', $wallet->id)->delete();
	Transaction::where('object_id', $wallet->id)->delete();
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	- $reseller = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller = $this->getTestUser('reseller@' . \config('app.domain'));
	$wallet = $reseller->wallets()->first();
	Payment::where('wallet_id', $wallet->id)->delete();
	Wallet::where('id', $wallet->id)->update(['balance' => 0]);
	WalletSetting::where('wallet_id', $wallet->id)->delete();
	Transaction::where('object_id', $wallet->id)->delete();

	parent::tearDown();
	}

	/**
	* Test creating/updating/deleting an outo-payment mandate
	*
	* @group mollie
	*/
	public function testMandates(): void
	{
	// Unauth access not allowed
	$response = $this->get("api/v4/payments/mandate");
	$response->assertStatus(401);
	$response = $this->post("api/v4/payments/mandate", []);
	$response->assertStatus(401);
	$response = $this->put("api/v4/payments/mandate", []);
	$response->assertStatus(401);
	$response = $this->delete("api/v4/payments/mandate");
	$response->assertStatus(401);

	- $reseller = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller = $this->getTestUser('reseller@' . \config('app.domain'));
	$wallet = $reseller->wallets()->first();
	$wallet->balance = -10;
	$wallet->save();

	// Test creating a mandate (valid input)
	$post = ['amount' => 20.10, 'balance' => 0];
	$response = $this->actingAs($reseller)->post("api/v4/payments/mandate", $post);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertRegExp('\|^https://www.mollie.com\|', $json['redirectUrl']);

	// Assert the proper payment amount has been used
	$payment = Payment::where('id', $json['id'])->first();

	$this->assertSame(2010, $payment->amount);
	$this->assertSame($wallet->id, $payment->wallet_id);
	$this->assertSame(\config('app.name') . " Auto-Payment Setup", $payment->description);
	$this->assertSame(PaymentProvider::TYPE_MANDATE, $payment->type);

	// Test fetching the mandate information
	$response = $this->actingAs($reseller)->get("api/v4/payments/mandate");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertEquals(20.10, $json['amount']);
	$this->assertEquals(0, $json['balance']);
	$this->assertEquals('Credit Card', $json['method']);
	$this->assertSame(true, $json['isPending']);
	$this->assertSame(false, $json['isValid']);
	$this->assertSame(false, $json['isDisabled']);

	$mandate_id = $json['id'];

	// We would have to invoke a browser to accept the "first payment" to make
	// the mandate validated/completed. Instead, we'll mock the mandate object.
	$mollie_response = [
	'resource' => 'mandate',
	'id' => $mandate_id,
	'status' => 'valid',
	'method' => 'creditcard',
	'details' => [
	'cardNumber' => '4242',
	'cardLabel' => 'Visa',
	],
	'customerId' => 'cst_GMfxGPt7Gj',
	'createdAt' => '2020-04-28T11:09:47+00:00',
	];

	$responseStack = $this->mockMollie();
	$responseStack->append(new Response(200, [], json_encode($mollie_response)));

	$wallet = $reseller->wallets()->first();
	$wallet->setSetting('mandate_disabled', 1);

	$response = $this->actingAs($reseller)->get("api/v4/payments/mandate");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertEquals(20.10, $json['amount']);
	$this->assertEquals(0, $json['balance']);
	$this->assertEquals('Visa (** ** 4242)', $json['method']);
	$this->assertSame(false, $json['isPending']);
	$this->assertSame(true, $json['isValid']);
	$this->assertSame(true, $json['isDisabled']);

	Bus::fake();
	$wallet->setSetting('mandate_disabled', null);
	$wallet->balance = 1000;
	$wallet->save();

	// Test updating a mandate (valid input)
	$responseStack->append(new Response(200, [], json_encode($mollie_response)));

	$post = ['amount' => 30.10, 'balance' => 10];
	$response = $this->actingAs($reseller)->put("api/v4/payments/mandate", $post);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame('The auto-payment has been updated.', $json['message']);
	$this->assertSame($mandate_id, $json['id']);
	$this->assertFalse($json['isDisabled']);

	$wallet->refresh();

	$this->assertEquals(30.10, $wallet->getSetting('mandate_amount'));
	$this->assertEquals(10, $wallet->getSetting('mandate_balance'));

	Bus::assertDispatchedTimes(\App\Jobs\WalletCharge::class, 0);

	$this->unmockMollie();

	// Delete mandate
	$response = $this->actingAs($reseller)->delete("api/v4/payments/mandate");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame('The auto-payment has been removed.', $json['message']);
	}

	/**
	* Test creating a payment
	*
	* @group mollie
	*/
	public function testStore(): void
	{
	Bus::fake();

	// Unauth access not allowed
	$response = $this->post("api/v4/payments", []);
	$response->assertStatus(401);

	- $reseller = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller = $this->getTestUser('reseller@' . \config('app.domain'));

	// Successful payment
	$post = ['amount' => '12.34', 'currency' => 'CHF', 'methodId' => 'creditcard'];
	$response = $this->actingAs($reseller)->post("api/v4/payments", $post);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertRegExp('\|^https://www.mollie.com\|', $json['redirectUrl']);
	}

	/**
	* Test listing a pending payment
	*
	* @group mollie
	*/
	public function testListingPayments(): void
	{
	Bus::fake();

	- $reseller = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller = $this->getTestUser('reseller@' . \config('app.domain'));

	// Empty response
	$response = $this->actingAs($reseller)->get("api/v4/payments/pending");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame(0, $json['count']);
	$this->assertSame(1, $json['page']);
	$this->assertSame(false, $json['hasMore']);
	$this->assertCount(0, $json['list']);

	$response = $this->actingAs($reseller)->get("api/v4/payments/has-pending");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(false, $json['hasPending']);
	}

	/**
	* Test listing payment methods
	*
	* @group mollie
	*/
	public function testListingPaymentMethods(): void
	{
	Bus::fake();

	- $reseller = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller = $this->getTestUser('reseller@' . \config('app.domain'));

	$response = $this->actingAs($reseller)->get('api/v4/payments/methods?type=' . PaymentProvider::TYPE_ONEOFF);
	$response->assertStatus(200);
	$json = $response->json();

	- $this->assertCount(2, $json);
	+ $this->assertCount(3, $json);
	$this->assertSame('creditcard', $json[0]['id']);
	$this->assertSame('paypal', $json[1]['id']);
	+ $this->assertSame('banktransfer', $json[2]['id']);
	}
	}
	diff --git a/src/tests/Feature/Controller/Reseller/SkusTest.php b/src/tests/Feature/Controller/Reseller/SkusTest.php
	index 693ba5c5..f841c64e 100644
	--- a/src/tests/Feature/Controller/Reseller/SkusTest.php
	+++ b/src/tests/Feature/Controller/Reseller/SkusTest.php
	@@ -1,122 +1,136 @@
	<?php

	namespace Tests\Feature\Controller\Reseller;

	use App\Sku;
	use Tests\TestCase;

	class SkusTest extends TestCase
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	self::useResellerUrl();

	- \config(['app.tenant_id' => 1]);
	+ Sku::where('title', 'test')->delete();

	$this->clearBetaEntitlements();
	$this->clearMeetEntitlements();
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	- \config(['app.tenant_id' => 1]);
	+ Sku::where('title', 'test')->delete();

	$this->clearBetaEntitlements();
	$this->clearMeetEntitlements();

	parent::tearDown();
	}

	/**
	* Test fetching SKUs list
	*/
	public function testIndex(): void
	{
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	- $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
	+ $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	$user = $this->getTestUser('john@kolab.org');
	- $sku = Sku::where('title', 'mailbox')->first();
	+ $sku = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();

	// Unauth access not allowed
	$response = $this->get("api/v4/skus");
	$response->assertStatus(401);

	- // User access not allowed on admin API
	+ // User access not allowed
	$response = $this->actingAs($user)->get("api/v4/skus");
	$response->assertStatus(403);

	// Admin access not allowed
	$response = $this->actingAs($admin)->get("api/v4/skus");
	$response->assertStatus(403);

	$response = $this->actingAs($reseller1)->get("api/v4/skus");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertCount(9, $json);

	$this->assertSame(100, $json[0]['prio']);
	$this->assertSame($sku->id, $json[0]['id']);
	$this->assertSame($sku->title, $json[0]['title']);
	$this->assertSame($sku->name, $json[0]['name']);
	$this->assertSame($sku->description, $json[0]['description']);
	$this->assertSame($sku->cost, $json[0]['cost']);
	$this->assertSame($sku->units_free, $json[0]['units_free']);
	$this->assertSame($sku->period, $json[0]['period']);
	$this->assertSame($sku->active, $json[0]['active']);
	$this->assertSame('user', $json[0]['type']);
	$this->assertSame('mailbox', $json[0]['handler']);

	- // TODO: Test limiting SKUs to the tenant's SKUs
	+ // Test with another tenant
	+ $sku = Sku::where('title', 'mailbox')->where('tenant_id', $reseller2->tenant_id)->first();
	+ $response = $this->actingAs($reseller2)->get("api/v4/skus");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertCount(6, $json);
	+
	+ $this->assertSame(100, $json[0]['prio']);
	+ $this->assertSame($sku->id, $json[0]['id']);
	+ $this->assertSame($sku->title, $json[0]['title']);
	+ $this->assertSame($sku->name, $json[0]['name']);
	+ $this->assertSame($sku->description, $json[0]['description']);
	+ $this->assertSame($sku->cost, $json[0]['cost']);
	+ $this->assertSame($sku->units_free, $json[0]['units_free']);
	+ $this->assertSame($sku->period, $json[0]['period']);
	+ $this->assertSame($sku->active, $json[0]['active']);
	+ $this->assertSame('user', $json[0]['type']);
	+ $this->assertSame('mailbox', $json[0]['handler']);
	}

	/**
	* Test fetching SKUs list for a user (GET /users/<id>/skus)
	*/
	public function testUserSkus(): void
	{
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	- $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
	+ $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	$user = $this->getTestUser('john@kolab.org');

	// Unauth access not allowed
	$response = $this->get("api/v4/users/{$user->id}/skus");
	$response->assertStatus(401);

	// User access not allowed
	$response = $this->actingAs($user)->get("api/v4/users/{$user->id}/skus");
	$response->assertStatus(403);

	// Admin access not allowed
	$response = $this->actingAs($admin)->get("api/v4/users/{$user->id}/skus");
	$response->assertStatus(403);

	- // Reseller from another tenant not allowed
	+ // Reseller from another tenant
	$response = $this->actingAs($reseller2)->get("api/v4/users/{$user->id}/skus");
	- $response->assertStatus(403);
	+ $response->assertStatus(404);

	// Reseller access
	$response = $this->actingAs($reseller1)->get("api/v4/users/{$user->id}/skus");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertCount(8, $json);
	// Note: Details are tested where we test API\V4\SkusController
	-
	- // Reseller from another tenant not allowed
	- \config(['app.tenant_id' => 2]);
	- $response = $this->actingAs($reseller2)->get("api/v4/users/{$user->id}/skus");
	- $response->assertStatus(404);
	}
	}
	diff --git a/src/tests/Feature/Controller/Reseller/StatsTest.php b/src/tests/Feature/Controller/Reseller/StatsTest.php
	index 36039681..0dbd9e4b 100644
	--- a/src/tests/Feature/Controller/Reseller/StatsTest.php
	+++ b/src/tests/Feature/Controller/Reseller/StatsTest.php
	@@ -1,89 +1,89 @@
	<?php

	namespace Tests\Feature\Controller\Reseller;

	use Tests\TestCase;

	class StatsTest extends TestCase
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	self::useResellerUrl();
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	parent::tearDown();
	}

	/**
	* Test charts (GET /api/v4/stats/chart/<chart>)
	*/
	public function testChart(): void
	{
	$user = $this->getTestUser('john@kolab.org');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	- $reseller = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller = $this->getTestUser('reseller@' . \config('app.domain'));

	// Unauth access
	$response = $this->get("api/v4/stats/chart/discounts");
	$response->assertStatus(401);

	// Normal user
	$response = $this->actingAs($user)->get("api/v4/stats/chart/discounts");
	$response->assertStatus(403);

	// Admin user
	$response = $this->actingAs($admin)->get("api/v4/stats/chart/discounts");
	$response->assertStatus(403);

	// Unknown chart name
	$response = $this->actingAs($reseller)->get("api/v4/stats/chart/unknown");
	$response->assertStatus(404);

	// 'income' chart
	$response = $this->actingAs($reseller)->get("api/v4/stats/chart/income");
	$response->assertStatus(404);

	// 'discounts' chart
	$response = $this->actingAs($reseller)->get("api/v4/stats/chart/discounts");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('Discounts', $json['title']);
	$this->assertSame('donut', $json['type']);
	$this->assertSame([], $json['data']['labels']);
	$this->assertSame([['values' => []]], $json['data']['datasets']);

	// 'users' chart
	$response = $this->actingAs($reseller)->get("api/v4/stats/chart/users");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('Users - last 8 weeks', $json['title']);
	$this->assertCount(8, $json['data']['labels']);
	$this->assertSame(date('Y-W'), $json['data']['labels'][7]);
	$this->assertCount(2, $json['data']['datasets']);
	$this->assertSame('Created', $json['data']['datasets'][0]['name']);
	$this->assertSame('Deleted', $json['data']['datasets'][1]['name']);

	// 'users-all' chart
	$response = $this->actingAs($reseller)->get("api/v4/stats/chart/users-all");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('All Users - last year', $json['title']);
	$this->assertCount(54, $json['data']['labels']);
	$this->assertCount(1, $json['data']['datasets']);
	}
	}
	diff --git a/src/tests/Feature/Controller/Reseller/UsersTest.php b/src/tests/Feature/Controller/Reseller/UsersTest.php
	index c7e7665f..43117323 100644
	--- a/src/tests/Feature/Controller/Reseller/UsersTest.php
	+++ b/src/tests/Feature/Controller/Reseller/UsersTest.php
	@@ -1,479 +1,452 @@
	<?php

	namespace Tests\Feature\Controller\Reseller;

	use App\Tenant;
	use App\Sku;
	use App\User;
	use Illuminate\Support\Facades\Queue;
	use Tests\TestCase;

	class UsersTest extends TestCase
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	self::useResellerUrl();
	- \config(['app.tenant_id' => 1]);

	$this->deleteTestUser('UsersControllerTest1@userscontroller.com');
	$this->deleteTestUser('test@testsearch.com');
	$this->deleteTestDomain('testsearch.com');
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	$this->deleteTestUser('UsersControllerTest1@userscontroller.com');
	$this->deleteTestUser('test@testsearch.com');
	$this->deleteTestDomain('testsearch.com');

	- \config(['app.tenant_id' => 1]);
	-
	parent::tearDown();
	}

	/**
	* Test user deleting (DELETE /api/v4/users/<id>)
	*/
	public function testDestroy(): void
	{
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
	$user = $this->getTestUser('UsersControllerTest1@userscontroller.com');

	// Test unauth access
	$response = $this->delete("api/v4/users/{$user->id}");
	$response->assertStatus(401);

	// The end-point does not exist
	$response = $this->actingAs($reseller1)->delete("api/v4/users/{$user->id}");
	$response->assertStatus(404);
	}

	/**
	* Test users searching (/api/v4/users)
	*/
	public function testIndex(): void
	{
	Queue::fake();

	$user = $this->getTestUser('john@kolab.org');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	- $reseller2 = $this->getTestUser('reseller@reseller.com');
	-
	- \config(['app.tenant_id' => 2]);
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
	+ $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');

	// Guess access
	$response = $this->get("api/v4/users");
	$response->assertStatus(401);

	// Normal user
	$response = $this->actingAs($user)->get("api/v4/users");
	$response->assertStatus(403);

	// Admin user
	$response = $this->actingAs($admin)->get("api/v4/users");
	$response->assertStatus(403);

	- // Reseller from another tenant
	- $response = $this->actingAs($reseller1)->get("api/v4/users");
	- $response->assertStatus(403);
	-
	// Search with no search criteria
	$response = $this->actingAs($reseller2)->get("api/v4/users");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(0, $json['count']);
	$this->assertSame([], $json['list']);

	// Search with no matches expected
	$response = $this->actingAs($reseller2)->get("api/v4/users?search=abcd1234efgh5678");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(0, $json['count']);
	$this->assertSame([], $json['list']);

	// Search by domain in another tenant
	$response = $this->actingAs($reseller2)->get("api/v4/users?search=kolab.org");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(0, $json['count']);
	$this->assertSame([], $json['list']);

	// Search by user ID in another tenant
	$response = $this->actingAs($reseller2)->get("api/v4/users?search={$user->id}");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(0, $json['count']);
	$this->assertSame([], $json['list']);

	// Search by email (primary) - existing user in another tenant
	$response = $this->actingAs($reseller2)->get("api/v4/users?search=john@kolab.org");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(0, $json['count']);
	$this->assertSame([], $json['list']);

	// Search by owner - existing user in another tenant
	$response = $this->actingAs($reseller2)->get("api/v4/users?owner={$user->id}");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(0, $json['count']);
	$this->assertSame([], $json['list']);

	// Create a domain with some users in the Sample Tenant so we have anything to search for
	$domain = $this->getTestDomain('testsearch.com', ['type' => \App\Domain::TYPE_EXTERNAL]);
	- $domain->tenant_id = 2;
	+ $domain->tenant_id = $reseller2->tenant_id;
	$domain->save();
	$user = $this->getTestUser('test@testsearch.com');
	- $user->tenant_id = 2;
	+ $user->tenant_id = $reseller2->tenant_id;
	$user->save();
	$plan = \App\Plan::where('title', 'group')->first();
	$user->assignPlan($plan, $domain);
	$user->setAliases(['alias@testsearch.com']);
	$user->setSetting('external_email', 'john.doe.external@gmail.com');

	// Search by domain
	$response = $this->actingAs($reseller2)->get("api/v4/users?search=testsearch.com");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(1, $json['count']);
	$this->assertCount(1, $json['list']);
	$this->assertSame($user->id, $json['list'][0]['id']);
	$this->assertSame($user->email, $json['list'][0]['email']);

	// Search by user ID
	$response = $this->actingAs($reseller2)->get("api/v4/users?search={$user->id}");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(1, $json['count']);
	$this->assertCount(1, $json['list']);
	$this->assertSame($user->id, $json['list'][0]['id']);
	$this->assertSame($user->email, $json['list'][0]['email']);

	// Search by email (primary) - existing user in reseller's tenant
	$response = $this->actingAs($reseller2)->get("api/v4/users?search=test@testsearch.com");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(1, $json['count']);
	$this->assertCount(1, $json['list']);
	$this->assertSame($user->id, $json['list'][0]['id']);
	$this->assertSame($user->email, $json['list'][0]['email']);

	// Search by email (alias)
	$response = $this->actingAs($reseller2)->get("api/v4/users?search=alias@testsearch.com");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(1, $json['count']);
	$this->assertCount(1, $json['list']);
	$this->assertSame($user->id, $json['list'][0]['id']);
	$this->assertSame($user->email, $json['list'][0]['email']);

	// Search by email (external), there are two users with this email, but only one
	// in the reseller's tenant
	$response = $this->actingAs($reseller2)->get("api/v4/users?search=john.doe.external@gmail.com");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(1, $json['count']);
	$this->assertCount(1, $json['list']);
	$this->assertSame($user->id, $json['list'][0]['id']);
	$this->assertSame($user->email, $json['list'][0]['email']);

	// Search by owner
	$response = $this->actingAs($reseller2)->get("api/v4/users?owner={$user->id}");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(1, $json['count']);
	$this->assertCount(1, $json['list']);
	$this->assertSame($user->id, $json['list'][0]['id']);
	$this->assertSame($user->email, $json['list'][0]['email']);

	// Deleted users/domains
	$user->delete();

	$response = $this->actingAs($reseller2)->get("api/v4/users?search=test@testsearch.com");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(1, $json['count']);
	$this->assertCount(1, $json['list']);
	$this->assertSame($user->id, $json['list'][0]['id']);
	$this->assertSame($user->email, $json['list'][0]['email']);
	$this->assertTrue($json['list'][0]['isDeleted']);

	$response = $this->actingAs($reseller2)->get("api/v4/users?search=alias@testsearch.com");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(1, $json['count']);
	$this->assertCount(1, $json['list']);
	$this->assertSame($user->id, $json['list'][0]['id']);
	$this->assertSame($user->email, $json['list'][0]['email']);
	$this->assertTrue($json['list'][0]['isDeleted']);

	$response = $this->actingAs($reseller2)->get("api/v4/users?search=testsearch.com");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(1, $json['count']);
	$this->assertCount(1, $json['list']);
	$this->assertSame($user->id, $json['list'][0]['id']);
	$this->assertSame($user->email, $json['list'][0]['email']);
	$this->assertTrue($json['list'][0]['isDeleted']);
	}

	/**
	* Test reseting 2FA (POST /api/v4/users/<user-id>/reset2FA)
	*/
	public function testReset2FA(): void
	{
	+ Queue::fake(); // disable jobs
	+
	$user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	- $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
	+ $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');

	- $sku2fa = \App\Sku::firstOrCreate(['title' => '2fa']);
	+ $sku2fa = \App\Sku::withEnvTenantContext()->where('title', '2fa')->first();
	$user->assignSku($sku2fa);
	\App\Auth\SecondFactor::seed('userscontrollertest1@userscontroller.com');

	// Test unauthorized access
	$response = $this->actingAs($user)->post("/api/v4/users/{$user->id}/reset2FA", []);
	$response->assertStatus(403);

	$response = $this->actingAs($admin)->post("/api/v4/users/{$user->id}/reset2FA", []);
	$response->assertStatus(403);

	$response = $this->actingAs($reseller2)->post("/api/v4/users/{$user->id}/reset2FA", []);
	- $response->assertStatus(403);
	+ $response->assertStatus(404);

	// Touching admins is forbidden
	$response = $this->actingAs($reseller1)->post("/api/v4/users/{$admin->id}/reset2FA", []);
	- $response->assertStatus(404);
	+ $response->assertStatus(403);

	$entitlements = $user->fresh()->entitlements()->where('sku_id', $sku2fa->id)->get();
	$this->assertCount(1, $entitlements);

	$sf = new \App\Auth\SecondFactor($user);
	$this->assertCount(1, $sf->factors());

	// Test reseting 2FA
	$response = $this->actingAs($reseller1)->post("/api/v4/users/{$user->id}/reset2FA", []);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame("2-Factor authentication reset successfully.", $json['message']);
	$this->assertCount(2, $json);

	$entitlements = $user->fresh()->entitlements()->where('sku_id', $sku2fa->id)->get();
	$this->assertCount(0, $entitlements);

	$sf = new \App\Auth\SecondFactor($user);
	$this->assertCount(0, $sf->factors());
	-
	- // Other tenant's user
	- \config(['app.tenant_id' => 2]);
	- $response = $this->actingAs($reseller2)->post("/api/v4/users/{$user->id}/reset2FA", []);
	- $response->assertStatus(404);
	}

	/**
	* Test user creation (POST /api/v4/users)
	*/
	public function testStore(): void
	{
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));

	// The end-point does not exist
	$response = $this->actingAs($reseller1)->post("/api/v4/users", []);
	$response->assertStatus(404);
	}

	/**
	* Test user suspending (POST /api/v4/users/<user-id>/suspend)
	*/
	public function testSuspend(): void
	{
	Queue::fake(); // disable jobs

	$user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	- $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
	+ $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');

	// Test unauthorized access
	$response = $this->actingAs($user)->post("/api/v4/users/{$user->id}/suspend", []);
	$response->assertStatus(403);

	$response = $this->actingAs($admin)->post("/api/v4/users/{$user->id}/suspend", []);
	$response->assertStatus(403);

	$response = $this->actingAs($reseller2)->post("/api/v4/users/{$user->id}/suspend", []);
	- $response->assertStatus(403);
	+ $response->assertStatus(404);

	$response = $this->actingAs($reseller1)->post("/api/v4/users/{$admin->id}/suspend", []);
	- $response->assertStatus(404);
	+ $response->assertStatus(403);

	$this->assertFalse($user->isSuspended());

	// Test suspending the user
	$response = $this->actingAs($reseller1)->post("/api/v4/users/{$user->id}/suspend", []);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame("User suspended successfully.", $json['message']);
	$this->assertCount(2, $json);

	$this->assertTrue($user->fresh()->isSuspended());
	-
	- // Access to other tenant's users
	- \config(['app.tenant_id' => 2]);
	- $response = $this->actingAs($reseller2)->post("/api/v4/users/{$user->id}/suspend", []);
	- $response->assertStatus(404);
	}

	/**
	* Test user un-suspending (POST /api/v4/users/<user-id>/unsuspend)
	*/
	public function testUnsuspend(): void
	{
	Queue::fake(); // disable jobs

	$user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	- $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
	+ $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');

	// Test unauthorized access to admin API
	$response = $this->actingAs($user)->post("/api/v4/users/{$user->id}/unsuspend", []);
	$response->assertStatus(403);

	$response = $this->actingAs($admin)->post("/api/v4/users/{$user->id}/unsuspend", []);
	$response->assertStatus(403);

	$response = $this->actingAs($reseller2)->post("/api/v4/users/{$user->id}/unsuspend", []);
	- $response->assertStatus(403);
	+ $response->assertStatus(404);

	$response = $this->actingAs($reseller1)->post("/api/v4/users/{$admin->id}/unsuspend", []);
	- $response->assertStatus(404);
	+ $response->assertStatus(403);

	$this->assertFalse($user->isSuspended());
	$user->suspend();
	$this->assertTrue($user->isSuspended());

	// Test suspending the user
	$response = $this->actingAs($reseller1)->post("/api/v4/users/{$user->id}/unsuspend", []);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame("User unsuspended successfully.", $json['message']);
	$this->assertCount(2, $json);

	$this->assertFalse($user->fresh()->isSuspended());
	-
	- // Access to other tenant's users
	- \config(['app.tenant_id' => 2]);
	- $response = $this->actingAs($reseller2)->post("/api/v4/users/{$user->id}/unsuspend", []);
	- $response->assertStatus(404);
	}

	/**
	* Test user update (PUT /api/v4/users/<user-id>)
	*/
	public function testUpdate(): void
	{
	$user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	- $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
	+ $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');

	// Test unauthorized access
	$response = $this->actingAs($user)->put("/api/v4/users/{$user->id}", []);
	$response->assertStatus(403);

	$response = $this->actingAs($admin)->put("/api/v4/users/{$user->id}", []);
	$response->assertStatus(403);

	$response = $this->actingAs($reseller2)->put("/api/v4/users/{$user->id}", []);
	- $response->assertStatus(403);
	+ $response->assertStatus(404);

	$response = $this->actingAs($reseller1)->put("/api/v4/users/{$admin->id}", []);
	- $response->assertStatus(404);
	+ $response->assertStatus(403);

	// Test updatig the user data (empty data)
	$response = $this->actingAs($reseller1)->put("/api/v4/users/{$user->id}", []);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame("User data updated successfully.", $json['message']);
	$this->assertCount(2, $json);

	// Test error handling
	$post = ['external_email' => 'aaa'];
	$response = $this->actingAs($reseller1)->put("/api/v4/users/{$user->id}", $post);
	$response->assertStatus(422);

	$json = $response->json();

	$this->assertSame('error', $json['status']);
	$this->assertSame("The external email must be a valid email address.", $json['errors']['external_email'][0]);
	$this->assertCount(2, $json);

	// Test real update
	$post = ['external_email' => 'modified@test.com'];
	$response = $this->actingAs($reseller1)->put("/api/v4/users/{$user->id}", $post);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame("User data updated successfully.", $json['message']);
	$this->assertCount(2, $json);
	$this->assertSame('modified@test.com', $user->getSetting('external_email'));
	-
	- // Access to other tenant's users
	- \config(['app.tenant_id' => 2]);
	- $response = $this->actingAs($reseller2)->put("/api/v4/users/{$user->id}", $post);
	- $response->assertStatus(404);
	}
	}
	diff --git a/src/tests/Feature/Controller/Reseller/WalletsTest.php b/src/tests/Feature/Controller/Reseller/WalletsTest.php
	index 202fe7bf..2bd16f09 100644
	--- a/src/tests/Feature/Controller/Reseller/WalletsTest.php
	+++ b/src/tests/Feature/Controller/Reseller/WalletsTest.php
	@@ -1,312 +1,307 @@
	<?php

	namespace Tests\Feature\Controller\Reseller;

	use App\Discount;
	use App\Transaction;
	use Tests\TestCase;

	class WalletsTest extends TestCase
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	self::useResellerUrl();
	- \config(['app.tenant_id' => 1]);
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	- \config(['app.tenant_id' => 1]);
	parent::tearDown();
	}

	/**
	* Test fetching a wallet (GET /api/v4/wallets/:id)
	*
	* @group stripe
	*/
	public function testShow(): void
	{
	\config(['services.payment_provider' => 'stripe']);

	$user = $this->getTestUser('john@kolab.org');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	- $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
	+ $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');
	$wallet = $user->wallets()->first();
	$wallet->discount_id = null;
	$wallet->save();

	// Make sure there's no stripe/mollie identifiers
	$wallet->setSetting('stripe_id', null);
	$wallet->setSetting('stripe_mandate_id', null);
	$wallet->setSetting('mollie_id', null);
	$wallet->setSetting('mollie_mandate_id', null);

	// Non-admin user
	$response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}");
	$response->assertStatus(403);

	// Admin user
	$response = $this->actingAs($admin)->get("api/v4/wallets/{$wallet->id}");
	$response->assertStatus(403);

	// Reseller from a different tenant
	$response = $this->actingAs($reseller2)->get("api/v4/wallets/{$wallet->id}");
	- $response->assertStatus(403);
	+ $response->assertStatus(404);

	// Reseller
	$response = $this->actingAs($reseller1)->get("api/v4/wallets/{$wallet->id}");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame($wallet->id, $json['id']);
	$this->assertSame('CHF', $json['currency']);
	$this->assertSame($wallet->balance, $json['balance']);
	$this->assertSame(0, $json['discount']);
	$this->assertTrue(empty($json['description']));
	$this->assertTrue(empty($json['discount_description']));
	$this->assertTrue(!empty($json['provider']));
	$this->assertTrue(empty($json['providerLink']));
	$this->assertTrue(!empty($json['mandate']));
	$this->assertTrue(!empty($json['notice']));

	// Reseller from a different tenant
	- \config(['app.tenant_id' => 2]);
	- $response = $this->actingAs($reseller2)->get("api/v4/wallets/{$wallet->id}");
	- $response->assertStatus(404);
	+ $user2 = $this->getTestUser('user@sample-tenant.dev-local');
	+ $wallet2 = $user2->wallets()->first();
	+ $response = $this->actingAs($reseller2)->get("api/v4/wallets/{$wallet2->id}");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame($wallet2->id, $json['id']);
	}

	/**
	* Test awarding/penalizing a wallet (POST /api/v4/wallets/:id/one-off)
	*/
	public function testOneOff(): void
	{
	$user = $this->getTestUser('john@kolab.org');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	- $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
	+ $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');
	$wallet = $user->wallets()->first();
	$reseller1_wallet = $reseller1->wallets()->first();
	$balance = $wallet->balance;
	$reseller1_balance = $reseller1_wallet->balance;

	Transaction::where('object_id', $wallet->id)
	->whereIn('type', [Transaction::WALLET_AWARD, Transaction::WALLET_PENALTY])
	->delete();
	Transaction::where('object_id', $reseller1_wallet->id)->delete();

	// Non-admin user
	$response = $this->actingAs($user)->post("api/v4/wallets/{$wallet->id}/one-off", []);
	$response->assertStatus(403);

	// Admin user
	$response = $this->actingAs($admin)->post("api/v4/wallets/{$wallet->id}/one-off", []);
	$response->assertStatus(403);

	// Reseller from a different tenant
	$response = $this->actingAs($reseller2)->post("api/v4/wallets/{$wallet->id}/one-off", []);
	- $response->assertStatus(403);
	+ $response->assertStatus(404);

	// Admin user - invalid input
	$post = ['amount' => 'aaaa'];
	$response = $this->actingAs($reseller1)->post("api/v4/wallets/{$wallet->id}/one-off", $post);
	$response->assertStatus(422);

	$json = $response->json();

	$this->assertSame('error', $json['status']);
	$this->assertSame('The amount must be a number.', $json['errors']['amount'][0]);
	$this->assertSame('The description field is required.', $json['errors']['description'][0]);
	$this->assertCount(2, $json);
	$this->assertCount(2, $json['errors']);

	// A valid bonus
	$post = ['amount' => '50', 'description' => 'A bonus'];
	$response = $this->actingAs($reseller1)->post("api/v4/wallets/{$wallet->id}/one-off", $post);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame('The bonus has been added to the wallet successfully.', $json['message']);
	$this->assertSame($balance += 5000, $json['balance']);
	$this->assertSame($balance, $wallet->fresh()->balance);
	$this->assertSame($reseller1_balance -= 5000, $reseller1_wallet->fresh()->balance);

	$transaction = Transaction::where('object_id', $wallet->id)
	->where('type', Transaction::WALLET_AWARD)->first();

	$this->assertSame($post['description'], $transaction->description);
	$this->assertSame(5000, $transaction->amount);
	$this->assertSame($reseller1->email, $transaction->user_email);

	$transaction = Transaction::where('object_id', $reseller1_wallet->id)
	->where('type', Transaction::WALLET_DEBIT)->first();

	$this->assertSame("Awarded user {$user->email}", $transaction->description);
	$this->assertSame(-5000, $transaction->amount);
	$this->assertSame($reseller1->email, $transaction->user_email);

	// A valid penalty
	$post = ['amount' => '-40', 'description' => 'A penalty'];
	$response = $this->actingAs($reseller1)->post("api/v4/wallets/{$wallet->id}/one-off", $post);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame('The penalty has been added to the wallet successfully.', $json['message']);
	$this->assertSame($balance -= 4000, $json['balance']);
	$this->assertSame($balance, $wallet->fresh()->balance);
	$this->assertSame($reseller1_balance += 4000, $reseller1_wallet->fresh()->balance);

	$transaction = Transaction::where('object_id', $wallet->id)
	->where('type', Transaction::WALLET_PENALTY)->first();

	$this->assertSame($post['description'], $transaction->description);
	$this->assertSame(-4000, $transaction->amount);
	$this->assertSame($reseller1->email, $transaction->user_email);

	$transaction = Transaction::where('object_id', $reseller1_wallet->id)
	->where('type', Transaction::WALLET_CREDIT)->first();

	$this->assertSame("Penalized user {$user->email}", $transaction->description);
	$this->assertSame(4000, $transaction->amount);
	$this->assertSame($reseller1->email, $transaction->user_email);
	-
	- // Reseller from a different tenant
	- \config(['app.tenant_id' => 2]);
	- $response = $this->actingAs($reseller2)->post("api/v4/wallets/{$wallet->id}/one-off", []);
	- $response->assertStatus(404);
	}

	/**
	* Test fetching wallet transactions (GET /api/v4/wallets/:id/transactions)
	*/
	public function testTransactions(): void
	{
	// Note: Here we're testing only that the end-point works,
	// and admin can get the transaction log, response details
	// are tested in Feature/Controller/WalletsTest.php

	$this->deleteTestUser('wallets-controller@kolabnow.com');
	$user = $this->getTestUser('wallets-controller@kolabnow.com');
	$wallet = $user->wallets()->first();
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	- $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
	+ $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');

	// Non-admin
	$response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/transactions");
	$response->assertStatus(403);

	// Admin
	$response = $this->actingAs($admin)->get("api/v4/wallets/{$wallet->id}/transactions");
	$response->assertStatus(403);

	// Reseller from a different tenant
	$response = $this->actingAs($reseller2)->get("api/v4/wallets/{$wallet->id}/transactions");
	- $response->assertStatus(403);
	+ $response->assertStatus(404);

	// Create some sample transactions
	$transactions = $this->createTestTransactions($wallet);
	$transactions = array_reverse($transactions);
	$pages = array_chunk($transactions, 10 /* page size*/);

	// Get the 2nd page
	$response = $this->actingAs($reseller1)->get("api/v4/wallets/{$wallet->id}/transactions?page=2");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertCount(5, $json);
	$this->assertSame('success', $json['status']);
	$this->assertSame(2, $json['page']);
	$this->assertSame(2, $json['count']);
	$this->assertSame(false, $json['hasMore']);
	$this->assertCount(2, $json['list']);
	foreach ($pages[1] as $idx => $transaction) {
	$this->assertSame($transaction->id, $json['list'][$idx]['id']);
	$this->assertSame($transaction->type, $json['list'][$idx]['type']);
	$this->assertSame($transaction->shortDescription(), $json['list'][$idx]['description']);
	$this->assertFalse($json['list'][$idx]['hasDetails']);
	}

	// The 'user' key is set only on the admin/reseller end-point
	// FIXME: Should we hide this for resellers?
	$this->assertSame('jeroen@jeroen.jeroen', $json['list'][1]['user']);

	- // Reseller from a different tenant
	- \config(['app.tenant_id' => 2]);
	- $response = $this->actingAs($reseller2)->get("api/v4/wallets/{$wallet->id}/transactions");
	- $response->assertStatus(403);
	+ // Test another tenant
	+ $user2 = $this->getTestUser('user@sample-tenant.dev-local');
	+ $wallet2 = $user2->wallets()->first();
	+
	+ $response = $this->actingAs($reseller2)->get("api/v4/wallets/{$wallet2->id}/transactions");
	+ $response->assertStatus(200);
	}

	/**
	* Test updating a wallet (PUT /api/v4/wallets/:id)
	*/
	public function testUpdate(): void
	{
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	- $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
	+ $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');
	$user = $this->getTestUser('john@kolab.org');
	$wallet = $user->wallets()->first();
	$discount = Discount::where('code', 'TEST')->first();

	// Non-admin user
	$response = $this->actingAs($user)->put("api/v4/wallets/{$wallet->id}", []);
	$response->assertStatus(403);

	// Admin
	$response = $this->actingAs($admin)->put("api/v4/wallets/{$wallet->id}", []);
	$response->assertStatus(403);

	// Reseller from another tenant
	$response = $this->actingAs($reseller2)->put("api/v4/wallets/{$wallet->id}", []);
	- $response->assertStatus(403);
	+ $response->assertStatus(404);

	- // Admin user - setting a discount
	+ // Setting a discount
	$post = ['discount' => $discount->id];
	$response = $this->actingAs($reseller1)->put("api/v4/wallets/{$wallet->id}", $post);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame('User wallet updated successfully.', $json['message']);
	$this->assertSame($wallet->id, $json['id']);
	$this->assertSame($discount->discount, $json['discount']);
	$this->assertSame($discount->id, $json['discount_id']);
	$this->assertSame($discount->description, $json['discount_description']);
	$this->assertSame($discount->id, $wallet->fresh()->discount->id);

	- // Admin user - removing a discount
	+ // Removing a discount
	$post = ['discount' => null];
	$response = $this->actingAs($reseller1)->put("api/v4/wallets/{$wallet->id}", $post);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame('User wallet updated successfully.', $json['message']);
	$this->assertSame($wallet->id, $json['id']);
	$this->assertSame(null, $json['discount_id']);
	$this->assertTrue(empty($json['discount_description']));
	$this->assertSame(null, $wallet->fresh()->discount);
	-
	- // Reseller from a different tenant
	- \config(['app.tenant_id' => 2]);
	- $response = $this->actingAs($reseller2)->put("api/v4/wallets/{$wallet->id}", []);
	- $response->assertStatus(404);
	}
	}
	diff --git a/src/tests/Feature/Controller/SkusTest.php b/src/tests/Feature/Controller/SkusTest.php
	index b994877f..d63d4006 100644
	--- a/src/tests/Feature/Controller/SkusTest.php
	+++ b/src/tests/Feature/Controller/SkusTest.php
	@@ -1,246 +1,246 @@
	<?php

	namespace Tests\Feature\Controller;

	use App\Entitlement;
	use App\Http\Controllers\API\V4\SkusController;
	use App\Sku;
	use Tests\TestCase;

	class SkusTest extends TestCase
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();

	$this->clearBetaEntitlements();
	$this->clearMeetEntitlements();
	Sku::where('title', 'test')->delete();
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	$this->clearBetaEntitlements();
	$this->clearMeetEntitlements();
	Sku::where('title', 'test')->delete();

	parent::tearDown();
	}


	/**
	* Test fetching SKUs list
	*/
	public function testIndex(): void
	{
	// Unauth access not allowed
	$response = $this->get("api/v4/skus");
	$response->assertStatus(401);

	$user = $this->getTestUser('john@kolab.org');
	- $sku = Sku::where('title', 'mailbox')->first();
	+ $sku = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();

	// Create an sku for another tenant, to make sure it is not included in the result
	$nsku = Sku::create([
	'title' => 'test',
	'name' => 'Test',
	'description' => '',
	'active' => true,
	'cost' => 100,
	'handler_class' => 'App\Handlers\Mailbox',
	]);
	$nsku->tenant_id = 2;
	$nsku->save();

	$response = $this->actingAs($user)->get("api/v4/skus");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertCount(9, $json);

	$this->assertSame(100, $json[0]['prio']);
	$this->assertSame($sku->id, $json[0]['id']);
	$this->assertSame($sku->title, $json[0]['title']);
	$this->assertSame($sku->name, $json[0]['name']);
	$this->assertSame($sku->description, $json[0]['description']);
	$this->assertSame($sku->cost, $json[0]['cost']);
	$this->assertSame($sku->units_free, $json[0]['units_free']);
	$this->assertSame($sku->period, $json[0]['period']);
	$this->assertSame($sku->active, $json[0]['active']);
	$this->assertSame('user', $json[0]['type']);
	$this->assertSame('mailbox', $json[0]['handler']);
	}

	/**
	* Test fetching SKUs list for a user (GET /users/<id>/skus)
	*/
	public function testUserSkus(): void
	{
	$user = $this->getTestUser('john@kolab.org');

	// Unauth access not allowed
	$response = $this->get("api/v4/users/{$user->id}/skus");
	$response->assertStatus(401);

	// Create an sku for another tenant, to make sure it is not included in the result
	$nsku = Sku::create([
	'title' => 'test',
	'name' => 'Test',
	'description' => '',
	'active' => true,
	'cost' => 100,
	'handler_class' => 'App\Handlers\Mailbox',
	]);
	$nsku->tenant_id = 2;
	$nsku->save();

	$response = $this->actingAs($user)->get("api/v4/users/{$user->id}/skus");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertCount(8, $json);

	$this->assertSkuElement('mailbox', $json[0], [
	'prio' => 100,
	'type' => 'user',
	'handler' => 'mailbox',
	'enabled' => true,
	'readonly' => true,
	]);

	$this->assertSkuElement('storage', $json[1], [
	'prio' => 90,
	'type' => 'user',
	'handler' => 'storage',
	'enabled' => true,
	'readonly' => true,
	'range' => [
	- 'min' => 2,
	+ 'min' => 5,
	'max' => 100,
	'unit' => 'GB',
	]
	]);

	$this->assertSkuElement('groupware', $json[2], [
	'prio' => 80,
	'type' => 'user',
	'handler' => 'groupware',
	'enabled' => false,
	'readonly' => false,
	]);

	$this->assertSkuElement('activesync', $json[3], [
	'prio' => 70,
	'type' => 'user',
	'handler' => 'activesync',
	'enabled' => false,
	'readonly' => false,
	'required' => ['groupware'],
	]);

	$this->assertSkuElement('2fa', $json[4], [
	'prio' => 60,
	'type' => 'user',
	'handler' => 'auth2f',
	'enabled' => false,
	'readonly' => false,
	'forbidden' => ['activesync'],
	]);

	$this->assertSkuElement('meet', $json[5], [
	'prio' => 50,
	'type' => 'user',
	'handler' => 'meet',
	'enabled' => false,
	'readonly' => false,
	'required' => ['groupware'],
	]);

	$this->assertSkuElement('domain-hosting', $json[6], [
	'prio' => 0,
	'type' => 'domain',
	'handler' => 'domainhosting',
	'enabled' => false,
	'readonly' => false,
	]);

	$this->assertSkuElement('group', $json[7], [
	'prio' => 0,
	'type' => 'group',
	'handler' => 'group',
	'enabled' => false,
	'readonly' => false,
	]);

	// Test filter by type
	$response = $this->actingAs($user)->get("api/v4/users/{$user->id}/skus?type=domain");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertCount(1, $json);
	$this->assertSame('domain', $json[0]['type']);

	// Test inclusion of beta SKUs
	- $sku = Sku::where('title', 'beta')->first();
	+ $sku = Sku::withEnvTenantContext()->where('title', 'beta')->first();
	$user->assignSku($sku);
	$response = $this->actingAs($user)->get("api/v4/users/{$user->id}/skus?type=user");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertCount(8, $json);

	$this->assertSkuElement('meet', $json[5], [
	'prio' => 50,
	'type' => 'user',
	'handler' => 'meet',
	'enabled' => false,
	'readonly' => false,
	'required' => ['groupware'],
	]);

	$this->assertSkuElement('beta', $json[6], [
	'prio' => 10,
	'type' => 'user',
	'handler' => 'beta',
	'enabled' => false,
	'readonly' => false,
	]);
	}

	/**
	* Assert content of the SKU element in an API response
	*
	* @param string $sku_title The SKU title
	* @param array $result The result to assert
	* @param array $other Other items the SKU itself does not include
	*/
	protected function assertSkuElement($sku_title, $result, $other = []): void
	{
	- $sku = Sku::where('title', $sku_title)->first();
	+ $sku = Sku::withEnvTenantContext()->where('title', $sku_title)->first();

	$this->assertSame($sku->id, $result['id']);
	$this->assertSame($sku->title, $result['title']);
	$this->assertSame($sku->name, $result['name']);
	$this->assertSame($sku->description, $result['description']);
	$this->assertSame($sku->cost, $result['cost']);
	$this->assertSame($sku->units_free, $result['units_free']);
	$this->assertSame($sku->period, $result['period']);
	$this->assertSame($sku->active, $result['active']);

	foreach ($other as $key => $value) {
	$this->assertSame($value, $result[$key]);
	}

	$this->assertCount(8 + count($other), $result);
	}
	}
	diff --git a/src/tests/Feature/Controller/UsersTest.php b/src/tests/Feature/Controller/UsersTest.php
	index b434f5a0..09f7673b 100644
	--- a/src/tests/Feature/Controller/UsersTest.php
	+++ b/src/tests/Feature/Controller/UsersTest.php
	@@ -1,1269 +1,1286 @@
	<?php

	namespace Tests\Feature\Controller;

	use App\Discount;
	use App\Domain;
	use App\Http\Controllers\API\V4\UsersController;
	use App\Package;
	use App\Sku;
	use App\User;
	use App\Wallet;
	use Carbon\Carbon;
	use Illuminate\Support\Facades\Queue;
	use Illuminate\Support\Str;
	use Tests\TestCase;

	class UsersTest extends TestCase
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();

	$this->deleteTestUser('jane@kolabnow.com');
	$this->deleteTestUser('UsersControllerTest1@userscontroller.com');
	$this->deleteTestUser('UsersControllerTest2@userscontroller.com');
	$this->deleteTestUser('UsersControllerTest3@userscontroller.com');
	$this->deleteTestUser('UserEntitlement2A@UserEntitlement.com');
	$this->deleteTestUser('john2.doe2@kolab.org');
	$this->deleteTestUser('deleted@kolab.org');
	$this->deleteTestUser('deleted@kolabnow.com');
	$this->deleteTestDomain('userscontroller.com');
	$this->deleteTestGroup('group-test@kolabnow.com');
	$this->deleteTestGroup('group-test@kolab.org');

	$user = $this->getTestUser('john@kolab.org');
	$wallet = $user->wallets()->first();
	$wallet->discount()->dissociate();
	$wallet->settings()->whereIn('key', ['mollie_id', 'stripe_id'])->delete();
	$wallet->save();
	$user->status \|= User::STATUS_IMAP_READY;
	$user->save();
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	$this->deleteTestUser('jane@kolabnow.com');
	$this->deleteTestUser('UsersControllerTest1@userscontroller.com');
	$this->deleteTestUser('UsersControllerTest2@userscontroller.com');
	$this->deleteTestUser('UsersControllerTest3@userscontroller.com');
	$this->deleteTestUser('UserEntitlement2A@UserEntitlement.com');
	$this->deleteTestUser('john2.doe2@kolab.org');
	$this->deleteTestUser('deleted@kolab.org');
	$this->deleteTestUser('deleted@kolabnow.com');
	$this->deleteTestDomain('userscontroller.com');
	$this->deleteTestGroup('group-test@kolabnow.com');
	$this->deleteTestGroup('group-test@kolab.org');

	$user = $this->getTestUser('john@kolab.org');
	$wallet = $user->wallets()->first();
	$wallet->discount()->dissociate();
	$wallet->settings()->whereIn('key', ['mollie_id', 'stripe_id'])->delete();
	$wallet->save();
	$user->status \|= User::STATUS_IMAP_READY;
	$user->save();

	parent::tearDown();
	}

	/**
	* Test user deleting (DELETE /api/v4/users/<id>)
	*/
	public function testDestroy(): void
	{
	// First create some users/accounts to delete
	$package_kolab = \App\Package::where('title', 'kolab')->first();
	$package_domain = \App\Package::where('title', 'domain-hosting')->first();

	$john = $this->getTestUser('john@kolab.org');
	$user1 = $this->getTestUser('UsersControllerTest1@userscontroller.com');
	$user2 = $this->getTestUser('UsersControllerTest2@userscontroller.com');
	$user3 = $this->getTestUser('UsersControllerTest3@userscontroller.com');
	$domain = $this->getTestDomain('userscontroller.com', [
	'status' => Domain::STATUS_NEW,
	'type' => Domain::TYPE_PUBLIC,
	]);
	$user1->assignPackage($package_kolab);
	$domain->assignPackage($package_domain, $user1);
	$user1->assignPackage($package_kolab, $user2);
	$user1->assignPackage($package_kolab, $user3);

	// Test unauth access
	$response = $this->delete("api/v4/users/{$user2->id}");
	$response->assertStatus(401);

	// Test access to other user/account
	$response = $this->actingAs($john)->delete("api/v4/users/{$user2->id}");
	$response->assertStatus(403);
	$response = $this->actingAs($john)->delete("api/v4/users/{$user1->id}");
	$response->assertStatus(403);
	$json = $response->json();

	$this->assertSame('error', $json['status']);
	$this->assertSame("Access denied", $json['message']);
	$this->assertCount(2, $json);

	// Test that non-controller cannot remove himself
	$response = $this->actingAs($user3)->delete("api/v4/users/{$user3->id}");
	$response->assertStatus(403);

	// Test removing a non-controller user
	$response = $this->actingAs($user1)->delete("api/v4/users/{$user3->id}");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertEquals('success', $json['status']);
	$this->assertEquals('User deleted successfully.', $json['message']);

	// Test removing self (an account with users)
	$response = $this->actingAs($user1)->delete("api/v4/users/{$user1->id}");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertEquals('success', $json['status']);
	$this->assertEquals('User deleted successfully.', $json['message']);
	}

	/**
	* Test user deleting (DELETE /api/v4/users/<id>)
	*/
	public function testDestroyByController(): void
	{
	// Create an account with additional controller - $user2
	$package_kolab = \App\Package::where('title', 'kolab')->first();
	$package_domain = \App\Package::where('title', 'domain-hosting')->first();
	$user1 = $this->getTestUser('UsersControllerTest1@userscontroller.com');
	$user2 = $this->getTestUser('UsersControllerTest2@userscontroller.com');
	$user3 = $this->getTestUser('UsersControllerTest3@userscontroller.com');
	$domain = $this->getTestDomain('userscontroller.com', [
	'status' => Domain::STATUS_NEW,
	'type' => Domain::TYPE_PUBLIC,
	]);
	$user1->assignPackage($package_kolab);
	$domain->assignPackage($package_domain, $user1);
	$user1->assignPackage($package_kolab, $user2);
	$user1->assignPackage($package_kolab, $user3);
	$user1->wallets()->first()->addController($user2);

	// TODO/FIXME:
	// For now controller can delete himself, as well as
	// the whole account he has control to, including the owner
	// Probably he should not be able to do none of those
	// However, this is not 0-regression scenario as we
	// do not fully support additional controllers.

	//$response = $this->actingAs($user2)->delete("api/v4/users/{$user2->id}");
	//$response->assertStatus(403);

	$response = $this->actingAs($user2)->delete("api/v4/users/{$user3->id}");
	$response->assertStatus(200);

	$response = $this->actingAs($user2)->delete("api/v4/users/{$user1->id}");
	$response->assertStatus(200);

	// Note: More detailed assertions in testDestroy() above

	$this->assertTrue($user1->fresh()->trashed());
	$this->assertTrue($user2->fresh()->trashed());
	$this->assertTrue($user3->fresh()->trashed());
	}

	/**
	* Test user listing (GET /api/v4/users)
	*/
	public function testIndex(): void
	{
	// Test unauth access
	$response = $this->get("api/v4/users");
	$response->assertStatus(401);

	$jack = $this->getTestUser('jack@kolab.org');
	$joe = $this->getTestUser('joe@kolab.org');
	$john = $this->getTestUser('john@kolab.org');
	$ned = $this->getTestUser('ned@kolab.org');

	$response = $this->actingAs($jack)->get("/api/v4/users");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertCount(0, $json);

	$response = $this->actingAs($john)->get("/api/v4/users");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertCount(4, $json);
	$this->assertSame($jack->email, $json[0]['email']);
	$this->assertSame($joe->email, $json[1]['email']);
	$this->assertSame($john->email, $json[2]['email']);
	$this->assertSame($ned->email, $json[3]['email']);
	// Values below are tested by Unit tests
	$this->assertArrayHasKey('isDeleted', $json[0]);
	$this->assertArrayHasKey('isSuspended', $json[0]);
	$this->assertArrayHasKey('isActive', $json[0]);
	$this->assertArrayHasKey('isLdapReady', $json[0]);
	$this->assertArrayHasKey('isImapReady', $json[0]);

	$response = $this->actingAs($ned)->get("/api/v4/users");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertCount(4, $json);
	$this->assertSame($jack->email, $json[0]['email']);
	$this->assertSame($joe->email, $json[1]['email']);
	$this->assertSame($john->email, $json[2]['email']);
	$this->assertSame($ned->email, $json[3]['email']);
	}

	/**
	* Test fetching user data/profile (GET /api/v4/users/<user-id>)
	*/
	public function testShow(): void
	{
	$userA = $this->getTestUser('UserEntitlement2A@UserEntitlement.com');

	// Test getting profile of self
	$response = $this->actingAs($userA)->get("/api/v4/users/{$userA->id}");

	$json = $response->json();

	$response->assertStatus(200);
	$this->assertEquals($userA->id, $json['id']);
	$this->assertEquals($userA->email, $json['email']);
	$this->assertTrue(is_array($json['statusInfo']));
	$this->assertTrue(is_array($json['settings']));
	$this->assertTrue(is_array($json['aliases']));
	$this->assertSame([], $json['skus']);
	// Values below are tested by Unit tests
	$this->assertArrayHasKey('isDeleted', $json);
	$this->assertArrayHasKey('isSuspended', $json);
	$this->assertArrayHasKey('isActive', $json);
	$this->assertArrayHasKey('isLdapReady', $json);
	$this->assertArrayHasKey('isImapReady', $json);

	$john = $this->getTestUser('john@kolab.org');
	$jack = $this->getTestUser('jack@kolab.org');
	$ned = $this->getTestUser('ned@kolab.org');

	// Test unauthorized access to a profile of other user
	$response = $this->actingAs($jack)->get("/api/v4/users/{$userA->id}");
	$response->assertStatus(403);

	// Test authorized access to a profile of other user
	// Ned: Additional account controller
	$response = $this->actingAs($ned)->get("/api/v4/users/{$john->id}");
	$response->assertStatus(200);
	$response = $this->actingAs($ned)->get("/api/v4/users/{$jack->id}");
	$response->assertStatus(200);

	// John: Account owner
	$response = $this->actingAs($john)->get("/api/v4/users/{$jack->id}");
	$response->assertStatus(200);
	$response = $this->actingAs($john)->get("/api/v4/users/{$ned->id}");
	$response->assertStatus(200);

	$json = $response->json();

	- $storage_sku = Sku::where('title', 'storage')->first();
	- $groupware_sku = Sku::where('title', 'groupware')->first();
	- $mailbox_sku = Sku::where('title', 'mailbox')->first();
	- $secondfactor_sku = Sku::where('title', '2fa')->first();
	+ $storage_sku = Sku::withEnvTenantContext()->where('title', 'storage')->first();
	+ $groupware_sku = Sku::withEnvTenantContext()->where('title', 'groupware')->first();
	+ $mailbox_sku = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();
	+ $secondfactor_sku = Sku::withEnvTenantContext()->where('title', '2fa')->first();

	$this->assertCount(5, $json['skus']);

	- $this->assertSame(2, $json['skus'][$storage_sku->id]['count']);
	- $this->assertSame([0,0], $json['skus'][$storage_sku->id]['costs']);
	+ $this->assertSame(5, $json['skus'][$storage_sku->id]['count']);
	+ $this->assertSame([0,0,0,0,0], $json['skus'][$storage_sku->id]['costs']);
	$this->assertSame(1, $json['skus'][$groupware_sku->id]['count']);
	- $this->assertSame([555], $json['skus'][$groupware_sku->id]['costs']);
	+ $this->assertSame([490], $json['skus'][$groupware_sku->id]['costs']);
	$this->assertSame(1, $json['skus'][$mailbox_sku->id]['count']);
	- $this->assertSame([444], $json['skus'][$mailbox_sku->id]['costs']);
	+ $this->assertSame([500], $json['skus'][$mailbox_sku->id]['costs']);
	$this->assertSame(1, $json['skus'][$secondfactor_sku->id]['count']);
	$this->assertSame([0], $json['skus'][$secondfactor_sku->id]['costs']);
	}

	/**
	* Test fetching user status (GET /api/v4/users/<user-id>/status)
	* and forcing setup process update (?refresh=1)
	*
	* @group imap
	* @group dns
	*/
	public function testStatus(): void
	{
	Queue::fake();

	$john = $this->getTestUser('john@kolab.org');
	$jack = $this->getTestUser('jack@kolab.org');

	// Test unauthorized access
	$response = $this->actingAs($jack)->get("/api/v4/users/{$john->id}/status");
	$response->assertStatus(403);

	if ($john->isImapReady()) {
	$john->status ^= User::STATUS_IMAP_READY;
	$john->save();
	}

	// Get user status
	$response = $this->actingAs($john)->get("/api/v4/users/{$john->id}/status");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertFalse($json['isImapReady']);
	$this->assertFalse($json['isReady']);
	$this->assertCount(7, $json['process']);
	$this->assertSame('user-imap-ready', $json['process'][2]['label']);
	$this->assertSame(false, $json['process'][2]['state']);
	$this->assertTrue(empty($json['status']));
	$this->assertTrue(empty($json['message']));

	// Make sure the domain is confirmed (other test might unset that status)
	$domain = $this->getTestDomain('kolab.org');
	$domain->status \|= Domain::STATUS_CONFIRMED;
	$domain->save();

	// Now "reboot" the process and verify the user in imap synchronously
	$response = $this->actingAs($john)->get("/api/v4/users/{$john->id}/status?refresh=1");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertTrue($json['isImapReady']);
	$this->assertTrue($json['isReady']);
	$this->assertCount(7, $json['process']);
	$this->assertSame('user-imap-ready', $json['process'][2]['label']);
	$this->assertSame(true, $json['process'][2]['state']);
	$this->assertSame('success', $json['status']);
	$this->assertSame('Setup process finished successfully.', $json['message']);

	Queue::size(1);

	// Test case for when the verify job is dispatched to the worker
	$john->refresh();
	$john->status ^= User::STATUS_IMAP_READY;
	$john->save();

	\config(['imap.admin_password' => null]);

	$response = $this->actingAs($john)->get("/api/v4/users/{$john->id}/status?refresh=1");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertFalse($json['isImapReady']);
	$this->assertFalse($json['isReady']);
	$this->assertSame('success', $json['status']);
	$this->assertSame('waiting', $json['processState']);
	$this->assertSame('Setup process has been pushed. Please wait.', $json['message']);

	Queue::assertPushed(\App\Jobs\User\VerifyJob::class, 1);
	}

	/**
	* Test UsersController::statusInfo()
	*/
	public function testStatusInfo(): void
	{
	$user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
	$domain = $this->getTestDomain('userscontroller.com', [
	'status' => Domain::STATUS_NEW,
	'type' => Domain::TYPE_PUBLIC,
	]);

	$user->created_at = Carbon::now();
	$user->status = User::STATUS_NEW;
	$user->save();

	$result = UsersController::statusInfo($user);

	$this->assertFalse($result['isReady']);
	$this->assertSame([], $result['skus']);
	$this->assertCount(3, $result['process']);
	$this->assertSame('user-new', $result['process'][0]['label']);
	$this->assertSame(true, $result['process'][0]['state']);
	$this->assertSame('user-ldap-ready', $result['process'][1]['label']);
	$this->assertSame(false, $result['process'][1]['state']);
	$this->assertSame('user-imap-ready', $result['process'][2]['label']);
	$this->assertSame(false, $result['process'][2]['state']);
	$this->assertSame('running', $result['processState']);

	$user->created_at = Carbon::now()->subSeconds(181);
	$user->save();

	$result = UsersController::statusInfo($user);

	$this->assertSame('failed', $result['processState']);

	$user->status \|= User::STATUS_LDAP_READY \| User::STATUS_IMAP_READY;
	$user->save();

	$result = UsersController::statusInfo($user);

	$this->assertTrue($result['isReady']);
	$this->assertCount(3, $result['process']);
	$this->assertSame('user-new', $result['process'][0]['label']);
	$this->assertSame(true, $result['process'][0]['state']);
	$this->assertSame('user-ldap-ready', $result['process'][1]['label']);
	$this->assertSame(true, $result['process'][1]['state']);
	$this->assertSame('user-imap-ready', $result['process'][2]['label']);
	$this->assertSame(true, $result['process'][2]['state']);
	$this->assertSame('done', $result['processState']);

	$domain->status \|= Domain::STATUS_VERIFIED;
	$domain->type = Domain::TYPE_EXTERNAL;
	$domain->save();

	$result = UsersController::statusInfo($user);

	$this->assertFalse($result['isReady']);
	$this->assertSame([], $result['skus']);
	$this->assertCount(7, $result['process']);
	$this->assertSame('user-new', $result['process'][0]['label']);
	$this->assertSame(true, $result['process'][0]['state']);
	$this->assertSame('user-ldap-ready', $result['process'][1]['label']);
	$this->assertSame(true, $result['process'][1]['state']);
	$this->assertSame('user-imap-ready', $result['process'][2]['label']);
	$this->assertSame(true, $result['process'][2]['state']);
	$this->assertSame('domain-new', $result['process'][3]['label']);
	$this->assertSame(true, $result['process'][3]['state']);
	$this->assertSame('domain-ldap-ready', $result['process'][4]['label']);
	$this->assertSame(false, $result['process'][4]['state']);
	$this->assertSame('domain-verified', $result['process'][5]['label']);
	$this->assertSame(true, $result['process'][5]['state']);
	$this->assertSame('domain-confirmed', $result['process'][6]['label']);
	$this->assertSame(false, $result['process'][6]['state']);

	// Test 'skus' property
	- $user->assignSku(Sku::where('title', 'beta')->first());
	+ $user->assignSku(Sku::withEnvTenantContext()->where('title', 'beta')->first());

	$result = UsersController::statusInfo($user);

	$this->assertSame(['beta'], $result['skus']);

	- $user->assignSku(Sku::where('title', 'meet')->first());
	+ $user->assignSku(Sku::withEnvTenantContext()->where('title', 'meet')->first());

	$result = UsersController::statusInfo($user);

	$this->assertSame(['beta', 'meet'], $result['skus']);

	- $user->assignSku(Sku::where('title', 'meet')->first());
	+ $user->assignSku(Sku::withEnvTenantContext()->where('title', 'meet')->first());

	$result = UsersController::statusInfo($user);

	$this->assertSame(['beta', 'meet'], $result['skus']);
	}

	/**
	* Test user creation (POST /api/v4/users)
	*/
	public function testStore(): void
	{
	Queue::fake();

	$jack = $this->getTestUser('jack@kolab.org');
	$john = $this->getTestUser('john@kolab.org');
	$deleted_priv = $this->getTestUser('deleted@kolab.org');
	$deleted_priv->delete();

	// Test empty request
	$response = $this->actingAs($john)->post("/api/v4/users", []);
	$response->assertStatus(422);

	$json = $response->json();

	$this->assertSame('error', $json['status']);
	$this->assertSame("The email field is required.", $json['errors']['email']);
	$this->assertSame("The password field is required.", $json['errors']['password'][0]);
	$this->assertCount(2, $json);

	// Test access by user not being a wallet controller
	$post = ['first_name' => 'Test'];
	$response = $this->actingAs($jack)->post("/api/v4/users", $post);
	$json = $response->json();

	$response->assertStatus(403);

	$this->assertSame('error', $json['status']);
	$this->assertSame("Access denied", $json['message']);
	$this->assertCount(2, $json);

	// Test some invalid data
	$post = ['password' => '12345678', 'email' => 'invalid'];
	$response = $this->actingAs($john)->post("/api/v4/users", $post);
	$response->assertStatus(422);

	$json = $response->json();

	$this->assertSame('error', $json['status']);
	$this->assertCount(2, $json);
	$this->assertSame('The password confirmation does not match.', $json['errors']['password'][0]);
	$this->assertSame('The specified email is invalid.', $json['errors']['email']);

	// Test existing user email
	$post = [
	'password' => 'simple',
	'password_confirmation' => 'simple',
	'first_name' => 'John2',
	'last_name' => 'Doe2',
	'email' => 'jack.daniels@kolab.org',
	];

	$response = $this->actingAs($john)->post("/api/v4/users", $post);
	$response->assertStatus(422);

	$json = $response->json();

	$this->assertSame('error', $json['status']);
	$this->assertCount(2, $json);
	$this->assertSame('The specified email is not available.', $json['errors']['email']);

	- $package_kolab = \App\Package::where('title', 'kolab')->first();
	- $package_domain = \App\Package::where('title', 'domain-hosting')->first();
	+ $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
	+ $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();

	$post = [
	'password' => 'simple',
	'password_confirmation' => 'simple',
	'first_name' => 'John2',
	'last_name' => 'Doe2',
	'email' => 'john2.doe2@kolab.org',
	'organization' => 'TestOrg',
	'aliases' => ['useralias1@kolab.org', 'deleted@kolab.org'],
	];

	// Missing package
	$response = $this->actingAs($john)->post("/api/v4/users", $post);
	$json = $response->json();

	$response->assertStatus(422);

	$this->assertSame('error', $json['status']);
	$this->assertSame("Package is required.", $json['errors']['package']);
	$this->assertCount(2, $json);

	// Invalid package
	$post['package'] = $package_domain->id;
	$response = $this->actingAs($john)->post("/api/v4/users", $post);
	$json = $response->json();

	$response->assertStatus(422);

	$this->assertSame('error', $json['status']);
	$this->assertSame("Invalid package selected.", $json['errors']['package']);
	$this->assertCount(2, $json);

	// Test full and valid data
	$post['package'] = $package_kolab->id;
	$response = $this->actingAs($john)->post("/api/v4/users", $post);
	$json = $response->json();

	$response->assertStatus(200);

	$this->assertSame('success', $json['status']);
	$this->assertSame("User created successfully.", $json['message']);
	$this->assertCount(2, $json);

	$user = User::where('email', 'john2.doe2@kolab.org')->first();
	$this->assertInstanceOf(User::class, $user);
	$this->assertSame('John2', $user->getSetting('first_name'));
	$this->assertSame('Doe2', $user->getSetting('last_name'));
	$this->assertSame('TestOrg', $user->getSetting('organization'));
	$aliases = $user->aliases()->orderBy('alias')->get();
	$this->assertCount(2, $aliases);
	$this->assertSame('deleted@kolab.org', $aliases[0]->alias);
	$this->assertSame('useralias1@kolab.org', $aliases[1]->alias);
	// Assert the new user entitlements
	- $this->assertUserEntitlements($user, ['groupware', 'mailbox', 'storage', 'storage']);
	+ $this->assertUserEntitlements($user, ['groupware', 'mailbox',
	+ 'storage', 'storage', 'storage', 'storage', 'storage']);
	// Assert the wallet to which the new user should be assigned to
	$wallet = $user->wallet();
	$this->assertSame($john->wallets()->first()->id, $wallet->id);

	// Attempt to create a user previously deleted
	$user->delete();

	$post['package'] = $package_kolab->id;
	$post['aliases'] = [];
	$response = $this->actingAs($john)->post("/api/v4/users", $post);
	$json = $response->json();

	$response->assertStatus(200);

	$this->assertSame('success', $json['status']);
	$this->assertSame("User created successfully.", $json['message']);
	$this->assertCount(2, $json);

	$user = User::where('email', 'john2.doe2@kolab.org')->first();
	$this->assertInstanceOf(User::class, $user);
	$this->assertSame('John2', $user->getSetting('first_name'));
	$this->assertSame('Doe2', $user->getSetting('last_name'));
	$this->assertSame('TestOrg', $user->getSetting('organization'));
	$this->assertCount(0, $user->aliases()->get());
	- $this->assertUserEntitlements($user, ['groupware', 'mailbox', 'storage', 'storage']);
	+ $this->assertUserEntitlements($user, ['groupware', 'mailbox',
	+ 'storage', 'storage', 'storage', 'storage', 'storage']);

	// Test acting as account controller (not owner)

	$this->markTestIncomplete();
	}

	/**
	* Test user update (PUT /api/v4/users/<user-id>)
	*/
	public function testUpdate(): void
	{
	$userA = $this->getTestUser('UsersControllerTest1@userscontroller.com');
	$jack = $this->getTestUser('jack@kolab.org');
	$john = $this->getTestUser('john@kolab.org');
	$ned = $this->getTestUser('ned@kolab.org');
	$domain = $this->getTestDomain(
	'userscontroller.com',
	['status' => Domain::STATUS_NEW, 'type' => Domain::TYPE_EXTERNAL]
	);

	// Test unauthorized update of other user profile
	$response = $this->actingAs($jack)->get("/api/v4/users/{$userA->id}", []);
	$response->assertStatus(403);

	// Test authorized update of account owner by account controller
	$response = $this->actingAs($ned)->get("/api/v4/users/{$john->id}", []);
	$response->assertStatus(200);

	// Test updating of self (empty request)
	$response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", []);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame('success', $json['status']);
	$this->assertSame("User data updated successfully.", $json['message']);
	$this->assertTrue(!empty($json['statusInfo']));
	$this->assertCount(3, $json);

	// Test some invalid data
	$post = ['password' => '12345678', 'currency' => 'invalid'];
	$response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
	$response->assertStatus(422);

	$json = $response->json();

	$this->assertSame('error', $json['status']);
	$this->assertCount(2, $json);
	$this->assertSame('The password confirmation does not match.', $json['errors']['password'][0]);
	$this->assertSame('The currency must be 3 characters.', $json['errors']['currency'][0]);

	// Test full profile update including password
	$post = [
	'password' => 'simple',
	'password_confirmation' => 'simple',
	'first_name' => 'John2',
	'last_name' => 'Doe2',
	'organization' => 'TestOrg',
	'phone' => '+123 123 123',
	'external_email' => 'external@gmail.com',
	'billing_address' => 'billing',
	'country' => 'CH',
	'currency' => 'CHF',
	'aliases' => ['useralias1@' . \config('app.domain'), 'useralias2@' . \config('app.domain')]
	];

	$response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
	$json = $response->json();

	$response->assertStatus(200);

	$this->assertSame('success', $json['status']);
	$this->assertSame("User data updated successfully.", $json['message']);
	$this->assertTrue(!empty($json['statusInfo']));
	$this->assertCount(3, $json);
	$this->assertTrue($userA->password != $userA->fresh()->password);
	unset($post['password'], $post['password_confirmation'], $post['aliases']);
	foreach ($post as $key => $value) {
	$this->assertSame($value, $userA->getSetting($key));
	}
	$aliases = $userA->aliases()->orderBy('alias')->get();
	$this->assertCount(2, $aliases);
	$this->assertSame('useralias1@' . \config('app.domain'), $aliases[0]->alias);
	$this->assertSame('useralias2@' . \config('app.domain'), $aliases[1]->alias);

	// Test unsetting values
	$post = [
	'first_name' => '',
	'last_name' => '',
	'organization' => '',
	'phone' => '',
	'external_email' => '',
	'billing_address' => '',
	'country' => '',
	'currency' => '',
	'aliases' => ['useralias2@' . \config('app.domain')]
	];

	$response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
	$json = $response->json();

	$response->assertStatus(200);

	$this->assertSame('success', $json['status']);
	$this->assertSame("User data updated successfully.", $json['message']);
	$this->assertTrue(!empty($json['statusInfo']));
	$this->assertCount(3, $json);
	unset($post['aliases']);
	foreach ($post as $key => $value) {
	$this->assertNull($userA->getSetting($key));
	}
	$aliases = $userA->aliases()->get();
	$this->assertCount(1, $aliases);
	$this->assertSame('useralias2@' . \config('app.domain'), $aliases[0]->alias);

	// Test error on some invalid aliases missing password confirmation
	$post = [
	'password' => 'simple123',
	'aliases' => [
	'useralias2@' . \config('app.domain'),
	'useralias1@kolab.org',
	'@kolab.org',
	]
	];

	$response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
	$json = $response->json();

	$response->assertStatus(422);

	$this->assertSame('error', $json['status']);
	$this->assertCount(2, $json['errors']);
	$this->assertCount(2, $json['errors']['aliases']);
	$this->assertSame("The specified domain is not available.", $json['errors']['aliases'][1]);
	$this->assertSame("The specified alias is invalid.", $json['errors']['aliases'][2]);
	$this->assertSame("The password confirmation does not match.", $json['errors']['password'][0]);

	// Test authorized update of other user
	$response = $this->actingAs($ned)->put("/api/v4/users/{$jack->id}", []);
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertTrue(empty($json['statusInfo']));

	// TODO: Test error on aliases with invalid/non-existing/other-user's domain

	// Create entitlements and additional user for following tests
	$owner = $this->getTestUser('UsersControllerTest1@userscontroller.com');
	$user = $this->getTestUser('UsersControllerTest2@userscontroller.com');
	- $package_domain = Package::where('title', 'domain-hosting')->first();
	- $package_kolab = Package::where('title', 'kolab')->first();
	- $package_lite = Package::where('title', 'lite')->first();
	- $sku_mailbox = Sku::where('title', 'mailbox')->first();
	- $sku_storage = Sku::where('title', 'storage')->first();
	- $sku_groupware = Sku::where('title', 'groupware')->first();
	+ $package_domain = Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
	+ $package_kolab = Package::withEnvTenantContext()->where('title', 'kolab')->first();
	+ $package_lite = Package::withEnvTenantContext()->where('title', 'lite')->first();
	+ $sku_mailbox = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();
	+ $sku_storage = Sku::withEnvTenantContext()->where('title', 'storage')->first();
	+ $sku_groupware = Sku::withEnvTenantContext()->where('title', 'groupware')->first();

	$domain = $this->getTestDomain(
	'userscontroller.com',
	[
	'status' => Domain::STATUS_NEW,
	'type' => Domain::TYPE_EXTERNAL,
	]
	);

	$domain->assignPackage($package_domain, $owner);
	$owner->assignPackage($package_kolab);
	$owner->assignPackage($package_lite, $user);

	// Non-controller cannot update his own entitlements
	$post = ['skus' => []];
	$response = $this->actingAs($user)->put("/api/v4/users/{$user->id}", $post);
	$response->assertStatus(422);

	// Test updating entitlements
	$post = [
	'skus' => [
	$sku_mailbox->id => 1,
	- $sku_storage->id => 3,
	+ $sku_storage->id => 6,
	$sku_groupware->id => 1,
	],
	];

	$response = $this->actingAs($owner)->put("/api/v4/users/{$user->id}", $post);
	$response->assertStatus(200);

	$json = $response->json();

	$storage_cost = $user->entitlements()
	->where('sku_id', $sku_storage->id)
	->orderBy('cost')
	->pluck('cost')->all();

	$this->assertUserEntitlements(
	$user,
	- ['groupware', 'mailbox', 'storage', 'storage', 'storage']
	+ ['groupware', 'mailbox', 'storage', 'storage', 'storage', 'storage', 'storage', 'storage']
	);

	- $this->assertSame([0, 0, 25], $storage_cost);
	+ $this->assertSame([0, 0, 0, 0, 0, 25], $storage_cost);
	$this->assertTrue(empty($json['statusInfo']));
	}

	/**
	* Test UsersController::updateEntitlements()
	*/
	public function testUpdateEntitlements(): void
	{
	$jane = $this->getTestUser('jane@kolabnow.com');

	- $kolab = \App\Package::where('title', 'kolab')->first();
	- $storage = \App\Sku::where('title', 'storage')->first();
	- $activesync = \App\Sku::where('title', 'activesync')->first();
	- $groupware = \App\Sku::where('title', 'groupware')->first();
	- $mailbox = \App\Sku::where('title', 'mailbox')->first();
	+ $kolab = Package::withEnvTenantContext()->where('title', 'kolab')->first();
	+ $storage = Sku::withEnvTenantContext()->where('title', 'storage')->first();
	+ $activesync = Sku::withEnvTenantContext()->where('title', 'activesync')->first();
	+ $groupware = Sku::withEnvTenantContext()->where('title', 'groupware')->first();
	+ $mailbox = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();

	// standard package, 1 mailbox, 1 groupware, 2 storage
	$jane->assignPackage($kolab);

	// add 2 storage, 1 activesync
	$post = [
	'skus' => [
	$mailbox->id => 1,
	$groupware->id => 1,
	- $storage->id => 4,
	+ $storage->id => 7,
	$activesync->id => 1
	]
	];

	$response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
	$response->assertStatus(200);

	$this->assertUserEntitlements(
	$jane,
	[
	'activesync',
	'groupware',
	'mailbox',
	'storage',
	'storage',
	'storage',
	+ 'storage',
	+ 'storage',
	+ 'storage',
	'storage'
	]
	);

	// add 2 storage, remove 1 activesync
	$post = [
	'skus' => [
	$mailbox->id => 1,
	$groupware->id => 1,
	- $storage->id => 6,
	+ $storage->id => 9,
	$activesync->id => 0
	]
	];

	$response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
	$response->assertStatus(200);

	$this->assertUserEntitlements(
	$jane,
	[
	'groupware',
	'mailbox',
	'storage',
	'storage',
	'storage',
	'storage',
	'storage',
	+ 'storage',
	+ 'storage',
	+ 'storage',
	'storage'
	]
	);

	// add mailbox
	$post = [
	'skus' => [
	$mailbox->id => 2,
	$groupware->id => 1,
	- $storage->id => 6,
	+ $storage->id => 9,
	$activesync->id => 0
	]
	];

	$response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
	$response->assertStatus(500);

	$this->assertUserEntitlements(
	$jane,
	[
	'groupware',
	'mailbox',
	'storage',
	'storage',
	'storage',
	'storage',
	'storage',
	+ 'storage',
	+ 'storage',
	+ 'storage',
	'storage'
	]
	);

	// remove mailbox
	$post = [
	'skus' => [
	$mailbox->id => 0,
	$groupware->id => 1,
	- $storage->id => 6,
	+ $storage->id => 9,
	$activesync->id => 0
	]
	];

	$response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
	$response->assertStatus(500);

	$this->assertUserEntitlements(
	$jane,
	[
	'groupware',
	'mailbox',
	'storage',
	'storage',
	'storage',
	'storage',
	'storage',
	+ 'storage',
	+ 'storage',
	+ 'storage',
	'storage'
	]
	);

	// less than free storage
	$post = [
	'skus' => [
	$mailbox->id => 1,
	$groupware->id => 1,
	$storage->id => 1,
	$activesync->id => 0
	]
	];

	$response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
	$response->assertStatus(200);

	$this->assertUserEntitlements(
	$jane,
	[
	'groupware',
	'mailbox',
	'storage',
	+ 'storage',
	+ 'storage',
	+ 'storage',
	'storage'
	]
	);
	}

	/**
	* Test user data response used in show and info actions
	*/
	public function testUserResponse(): void
	{
	$provider = \config('services.payment_provider') ?: 'mollie';
	$user = $this->getTestUser('john@kolab.org');
	$wallet = $user->wallets()->first();
	$wallet->setSettings(['mollie_id' => null, 'stripe_id' => null]);
	$result = $this->invokeMethod(new UsersController(), 'userResponse', [$user]);

	$this->assertEquals($user->id, $result['id']);
	$this->assertEquals($user->email, $result['email']);
	$this->assertEquals($user->status, $result['status']);
	$this->assertTrue(is_array($result['statusInfo']));

	$this->assertTrue(is_array($result['aliases']));
	$this->assertCount(1, $result['aliases']);
	$this->assertSame('john.doe@kolab.org', $result['aliases'][0]);

	$this->assertTrue(is_array($result['settings']));
	$this->assertSame('US', $result['settings']['country']);
	$this->assertSame('USD', $result['settings']['currency']);

	$this->assertTrue(is_array($result['accounts']));
	$this->assertTrue(is_array($result['wallets']));
	$this->assertCount(0, $result['accounts']);
	$this->assertCount(1, $result['wallets']);
	$this->assertSame($wallet->id, $result['wallet']['id']);
	$this->assertArrayNotHasKey('discount', $result['wallet']);

	$this->assertTrue($result['statusInfo']['enableDomains']);
	$this->assertTrue($result['statusInfo']['enableWallets']);
	$this->assertTrue($result['statusInfo']['enableUsers']);

	// Ned is John's wallet controller
	$ned = $this->getTestUser('ned@kolab.org');
	$ned_wallet = $ned->wallets()->first();
	$result = $this->invokeMethod(new UsersController(), 'userResponse', [$ned]);

	$this->assertEquals($ned->id, $result['id']);
	$this->assertEquals($ned->email, $result['email']);
	$this->assertTrue(is_array($result['accounts']));
	$this->assertTrue(is_array($result['wallets']));
	$this->assertCount(1, $result['accounts']);
	$this->assertCount(1, $result['wallets']);
	$this->assertSame($wallet->id, $result['wallet']['id']);
	$this->assertSame($wallet->id, $result['accounts'][0]['id']);
	$this->assertSame($ned_wallet->id, $result['wallets'][0]['id']);
	$this->assertSame($provider, $result['wallet']['provider']);
	$this->assertSame($provider, $result['wallets'][0]['provider']);

	$this->assertTrue($result['statusInfo']['enableDomains']);
	$this->assertTrue($result['statusInfo']['enableWallets']);
	$this->assertTrue($result['statusInfo']['enableUsers']);

	// Test discount in a response
	$discount = Discount::where('code', 'TEST')->first();
	$wallet->discount()->associate($discount);
	$wallet->save();
	$mod_provider = $provider == 'mollie' ? 'stripe' : 'mollie';
	$wallet->setSetting($mod_provider . '_id', 123);
	$user->refresh();

	$result = $this->invokeMethod(new UsersController(), 'userResponse', [$user]);

	$this->assertEquals($user->id, $result['id']);
	$this->assertSame($discount->id, $result['wallet']['discount_id']);
	$this->assertSame($discount->discount, $result['wallet']['discount']);
	$this->assertSame($discount->description, $result['wallet']['discount_description']);
	$this->assertSame($mod_provider, $result['wallet']['provider']);
	$this->assertSame($discount->id, $result['wallets'][0]['discount_id']);
	$this->assertSame($discount->discount, $result['wallets'][0]['discount']);
	$this->assertSame($discount->description, $result['wallets'][0]['discount_description']);
	$this->assertSame($mod_provider, $result['wallets'][0]['provider']);

	// Jack is not a John's wallet controller
	$jack = $this->getTestUser('jack@kolab.org');
	$result = $this->invokeMethod(new UsersController(), 'userResponse', [$jack]);

	$this->assertFalse($result['statusInfo']['enableDomains']);
	$this->assertFalse($result['statusInfo']['enableWallets']);
	$this->assertFalse($result['statusInfo']['enableUsers']);
	}

	/**
	* List of email address validation cases for testValidateEmail()
	*
	* @return array Arguments for testValidateEmail()
	*/
	public function dataValidateEmail(): array
	{
	$this->refreshApplication();
	$public_domains = Domain::getPublicDomains();
	$domain = reset($public_domains);

	$john = $this->getTestUser('john@kolab.org');
	$jack = $this->getTestUser('jack@kolab.org');
	$user = $this->getTestUser('UsersControllerTest1@userscontroller.com');

	return [
	// Invalid format
	["$domain", $john, 'The specified email is invalid.'],
	[".@$domain", $john, 'The specified email is invalid.'],
	["test123456@localhost", $john, 'The specified domain is invalid.'],
	["test123456@unknown-domain.org", $john, 'The specified domain is invalid.'],

	["$domain", $john, 'The specified email is invalid.'],
	[".@$domain", $john, 'The specified email is invalid.'],

	// forbidden local part on public domains
	["admin@$domain", $john, 'The specified email is not available.'],
	["administrator@$domain", $john, 'The specified email is not available.'],

	// forbidden (other user's domain)
	["testtest@kolab.org", $user, 'The specified domain is not available.'],

	// existing alias of other user, to be a user email
	["jack.daniels@kolab.org", $john, 'The specified email is not available.'],

	// valid (user domain)
	["admin@kolab.org", $john, null],

	// valid (public domain)
	["test.test@$domain", $john, null],
	];
	}

	/**
	* User email address validation.
	*
	* Note: Technically these include unit tests, but let's keep it here for now.
	* FIXME: Shall we do a http request for each case?
	*
	* @dataProvider dataValidateEmail
	*/
	public function testValidateEmail($email, $user, $expected_result): void
	{
	$result = UsersController::validateEmail($email, $user);
	$this->assertSame($expected_result, $result);
	}

	/**
	* User email validation - tests for $deleted argument
	*
	* Note: Technically these include unit tests, but let's keep it here for now.
	* FIXME: Shall we do a http request for each case?
	*/
	public function testValidateEmailDeleted(): void
	{
	Queue::fake();

	$john = $this->getTestUser('john@kolab.org');
	$deleted_priv = $this->getTestUser('deleted@kolab.org');
	$deleted_priv->delete();
	$deleted_pub = $this->getTestUser('deleted@kolabnow.com');
	$deleted_pub->delete();

	$result = UsersController::validateEmail('deleted@kolab.org', $john, $deleted);
	$this->assertSame(null, $result);
	$this->assertSame($deleted_priv->id, $deleted->id);

	$result = UsersController::validateEmail('deleted@kolabnow.com', $john, $deleted);
	$this->assertSame('The specified email is not available.', $result);
	$this->assertSame(null, $deleted);

	$result = UsersController::validateEmail('jack@kolab.org', $john, $deleted);
	$this->assertSame('The specified email is not available.', $result);
	$this->assertSame(null, $deleted);
	}

	/**
	* User email validation - tests for an address being a group email address
	*
	* Note: Technically these include unit tests, but let's keep it here for now.
	* FIXME: Shall we do a http request for each case?
	*/
	public function testValidateEmailGroup(): void
	{
	Queue::fake();

	$john = $this->getTestUser('john@kolab.org');
	$pub_group = $this->getTestGroup('group-test@kolabnow.com');
	$priv_group = $this->getTestGroup('group-test@kolab.org');

	// A group in a public domain, existing
	$result = UsersController::validateEmail($pub_group->email, $john, $deleted);
	$this->assertSame('The specified email is not available.', $result);
	$this->assertNull($deleted);

	$pub_group->delete();

	// A group in a public domain, deleted
	$result = UsersController::validateEmail($pub_group->email, $john, $deleted);
	$this->assertSame('The specified email is not available.', $result);
	$this->assertNull($deleted);

	// A group in a private domain, existing
	$result = UsersController::validateEmail($priv_group->email, $john, $deleted);
	$this->assertSame('The specified email is not available.', $result);
	$this->assertNull($deleted);

	$priv_group->delete();

	// A group in a private domain, deleted
	$result = UsersController::validateEmail($priv_group->email, $john, $deleted);
	$this->assertSame(null, $result);
	$this->assertSame($priv_group->id, $deleted->id);
	}

	/**
	* List of alias validation cases for testValidateAlias()
	*
	* @return array Arguments for testValidateAlias()
	*/
	public function dataValidateAlias(): array
	{
	$this->refreshApplication();
	$public_domains = Domain::getPublicDomains();
	$domain = reset($public_domains);

	$john = $this->getTestUser('john@kolab.org');
	$user = $this->getTestUser('UsersControllerTest1@userscontroller.com');

	return [
	// Invalid format
	["$domain", $john, 'The specified alias is invalid.'],
	[".@$domain", $john, 'The specified alias is invalid.'],
	["test123456@localhost", $john, 'The specified domain is invalid.'],
	["test123456@unknown-domain.org", $john, 'The specified domain is invalid.'],

	["$domain", $john, 'The specified alias is invalid.'],
	[".@$domain", $john, 'The specified alias is invalid.'],

	// forbidden local part on public domains
	["admin@$domain", $john, 'The specified alias is not available.'],
	["administrator@$domain", $john, 'The specified alias is not available.'],

	// forbidden (other user's domain)
	["testtest@kolab.org", $user, 'The specified domain is not available.'],

	// existing alias of other user, to be an alias, user in the same group account
	["jack.daniels@kolab.org", $john, null],

	// existing user
	["jack@kolab.org", $john, 'The specified alias is not available.'],

	// valid (user domain)
	["admin@kolab.org", $john, null],

	// valid (public domain)
	["test.test@$domain", $john, null],
	];
	}

	/**
	* User email alias validation.
	*
	* Note: Technically these include unit tests, but let's keep it here for now.
	* FIXME: Shall we do a http request for each case?
	*
	* @dataProvider dataValidateAlias
	*/
	public function testValidateAlias($alias, $user, $expected_result): void
	{
	$result = UsersController::validateAlias($alias, $user);
	$this->assertSame($expected_result, $result);
	}

	/**
	* User alias validation - more cases.
	*
	* Note: Technically these include unit tests, but let's keep it here for now.
	* FIXME: Shall we do a http request for each case?
	*/
	public function testValidateAlias2(): void
	{
	Queue::fake();

	$john = $this->getTestUser('john@kolab.org');
	$jack = $this->getTestUser('jack@kolab.org');
	$user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
	$deleted_priv = $this->getTestUser('deleted@kolab.org');
	$deleted_priv->setAliases(['deleted-alias@kolab.org']);
	$deleted_priv->delete();
	$deleted_pub = $this->getTestUser('deleted@kolabnow.com');
	$deleted_pub->setAliases(['deleted-alias@kolabnow.com']);
	$deleted_pub->delete();
	$group = $this->getTestGroup('group-test@kolabnow.com');

	// An alias that was a user email before is allowed, but only for custom domains
	$result = UsersController::validateAlias('deleted@kolab.org', $john);
	$this->assertSame(null, $result);

	$result = UsersController::validateAlias('deleted-alias@kolab.org', $john);
	$this->assertSame(null, $result);

	$result = UsersController::validateAlias('deleted@kolabnow.com', $john);
	$this->assertSame('The specified alias is not available.', $result);

	$result = UsersController::validateAlias('deleted-alias@kolabnow.com', $john);
	$this->assertSame('The specified alias is not available.', $result);

	// A grpoup with the same email address exists
	$result = UsersController::validateAlias($group->email, $john);
	$this->assertSame('The specified alias is not available.', $result);
	}
	}
	diff --git a/src/tests/Feature/Controller/WalletsTest.php b/src/tests/Feature/Controller/WalletsTest.php
	index 8b8e84bf..962716ce 100644
	--- a/src/tests/Feature/Controller/WalletsTest.php
	+++ b/src/tests/Feature/Controller/WalletsTest.php
	@@ -1,356 +1,355 @@
	<?php

	namespace Tests\Feature\Controller;

	use App\Http\Controllers\API\V4\WalletsController;
	use App\Payment;
	use App\Providers\PaymentProvider;
	use App\Transaction;
	use Carbon\Carbon;
	use Tests\TestCase;

	class WalletsTest extends TestCase
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();

	$this->deleteTestUser('wallets-controller@kolabnow.com');
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	$this->deleteTestUser('wallets-controller@kolabnow.com');

	parent::tearDown();
	}

	-
	/**
	* Test for getWalletNotice() method
	*/
	public function testGetWalletNotice(): void
	{
	$user = $this->getTestUser('wallets-controller@kolabnow.com');
	$package = \App\Package::where('title', 'kolab')->first();
	$user->assignPackage($package);
	$wallet = $user->wallets()->first();

	$controller = new WalletsController();
	$method = new \ReflectionMethod($controller, 'getWalletNotice');
	$method->setAccessible(true);

	// User/entitlements created today, balance=0
	$notice = $method->invoke($controller, $wallet);

	$this->assertSame('You are in your free trial period.', $notice);

	$wallet->owner->created_at = Carbon::now()->subDays(15);
	$wallet->owner->save();

	$notice = $method->invoke($controller, $wallet);

	$this->assertSame('Your free trial is about to end, top up to continue.', $notice);

	// User/entitlements created today, balance=-10 CHF
	$wallet->balance = -1000;
	$notice = $method->invoke($controller, $wallet);

	$this->assertSame('You are out of credit, top up your balance now.', $notice);

	// User/entitlements created slightly more than a month ago, balance=9,99 CHF (monthly)
	$wallet->owner->created_at = Carbon::now()->subMonthsWithoutOverflow(1)->subDays(1);
	$wallet->owner->save();

	// test "1 month"
	- $wallet->balance = 999;
	+ $wallet->balance = 990;
	$notice = $method->invoke($controller, $wallet);

	$this->assertRegExp('/$(1 month\|4 weeks)$/', $notice);

	// test "2 months"
	- $wallet->balance = 999 * 2.6;
	+ $wallet->balance = 990 * 2.6;
	$notice = $method->invoke($controller, $wallet);

	$this->assertRegExp('/$2 months 2 weeks$/', $notice);

	// Change locale to make sure the text is localized by Carbon
	\app()->setLocale('de');

	// test "almost 2 years"
	- $wallet->balance = 999 * 23.5;
	+ $wallet->balance = 990 * 23.5;
	$notice = $method->invoke($controller, $wallet);

	$this->assertRegExp('/$1 Jahr 11 Monate$/', $notice);

	// Old entitlements, 100% discount
	$this->backdateEntitlements($wallet->entitlements, Carbon::now()->subDays(40));
	$discount = \App\Discount::where('discount', 100)->first();
	$wallet->discount()->associate($discount);

	$notice = $method->invoke($controller, $wallet->refresh());

	$this->assertSame(null, $notice);
	}

	/**
	* Test fetching pdf receipt
	*/
	public function testReceiptDownload(): void
	{
	$user = $this->getTestUser('wallets-controller@kolabnow.com');
	$john = $this->getTestUser('john@kolab.org');
	$wallet = $user->wallets()->first();

	// Unauth access not allowed
	$response = $this->get("api/v4/wallets/{$wallet->id}/receipts/2020-05");
	$response->assertStatus(401);
	$response = $this->actingAs($john)->get("api/v4/wallets/{$wallet->id}/receipts/2020-05");
	$response->assertStatus(403);

	// Invalid receipt id (current month)
	$receiptId = date('Y-m');
	$response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/receipts/{$receiptId}");
	$response->assertStatus(404);

	// Invalid receipt id
	$receiptId = '1000-03';
	$response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/receipts/{$receiptId}");
	$response->assertStatus(404);

	// Valid receipt id
	$year = intval(date('Y')) - 1;
	$receiptId = "$year-12";
	$filename = \config('app.name') . " Receipt for $year-12";

	$response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/receipts/{$receiptId}");

	$response->assertStatus(200);
	$response->assertHeader('content-type', 'application/pdf');
	$response->assertHeader('content-disposition', 'attachment; filename="' . $filename . '"');
	$response->assertHeader('content-length');

	$length = $response->headers->get('content-length');
	$content = $response->content();
	$this->assertStringStartsWith("%PDF-1.", $content);
	$this->assertEquals(strlen($content), $length);
	}

	/**
	* Test fetching list of receipts
	*/
	public function testReceipts(): void
	{
	$user = $this->getTestUser('wallets-controller@kolabnow.com');
	$john = $this->getTestUser('john@kolab.org');
	$wallet = $user->wallets()->first();
	$wallet->payments()->delete();

	// Unauth access not allowed
	$response = $this->get("api/v4/wallets/{$wallet->id}/receipts");
	$response->assertStatus(401);
	$response = $this->actingAs($john)->get("api/v4/wallets/{$wallet->id}/receipts");
	$response->assertStatus(403);

	// Empty list expected
	$response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/receipts");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertCount(5, $json);
	$this->assertSame('success', $json['status']);
	$this->assertSame([], $json['list']);
	$this->assertSame(1, $json['page']);
	$this->assertSame(0, $json['count']);
	$this->assertSame(false, $json['hasMore']);

	// Insert a payment to the database
	$date = Carbon::create(intval(date('Y')) - 1, 4, 30);
	$payment = Payment::create([
	'id' => 'AAA1',
	'status' => PaymentProvider::STATUS_PAID,
	'type' => PaymentProvider::TYPE_ONEOFF,
	'description' => 'Paid in April',
	'wallet_id' => $wallet->id,
	'provider' => 'stripe',
	'amount' => 1111,
	'currency' => 'CHF',
	'currency_amount' => 1111,
	]);
	$payment->updated_at = $date;
	$payment->save();

	$response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/receipts");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertCount(5, $json);
	$this->assertSame('success', $json['status']);
	$this->assertSame([$date->format('Y-m')], $json['list']);
	$this->assertSame(1, $json['page']);
	$this->assertSame(1, $json['count']);
	$this->assertSame(false, $json['hasMore']);
	}

	/**
	* Test fetching a wallet (GET /api/v4/wallets/:id)
	*/
	public function testShow(): void
	{
	$john = $this->getTestUser('john@kolab.org');
	$jack = $this->getTestUser('jack@kolab.org');
	$wallet = $john->wallets()->first();
	$wallet->balance = -100;
	$wallet->save();

	// Accessing a wallet of someone else
	$response = $this->actingAs($jack)->get("api/v4/wallets/{$wallet->id}");
	$response->assertStatus(403);

	// Accessing non-existing wallet
	$response = $this->actingAs($jack)->get("api/v4/wallets/aaa");
	$response->assertStatus(404);

	// Wallet owner
	$response = $this->actingAs($john)->get("api/v4/wallets/{$wallet->id}");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame($wallet->id, $json['id']);
	$this->assertSame('CHF', $json['currency']);
	$this->assertSame($wallet->balance, $json['balance']);
	$this->assertTrue(empty($json['description']));
	$this->assertTrue(!empty($json['notice']));
	}

	/**
	* Test fetching wallet transactions
	*/
	public function testTransactions(): void
	{
	$package_kolab = \App\Package::where('title', 'kolab')->first();
	$user = $this->getTestUser('wallets-controller@kolabnow.com');
	$user->assignPackage($package_kolab);
	$john = $this->getTestUser('john@kolab.org');
	$wallet = $user->wallets()->first();

	// Unauth access not allowed
	$response = $this->get("api/v4/wallets/{$wallet->id}/transactions");
	$response->assertStatus(401);
	$response = $this->actingAs($john)->get("api/v4/wallets/{$wallet->id}/transactions");
	$response->assertStatus(403);

	// Expect empty list
	$response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/transactions");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertCount(5, $json);
	$this->assertSame('success', $json['status']);
	$this->assertSame([], $json['list']);
	$this->assertSame(1, $json['page']);
	$this->assertSame(0, $json['count']);
	$this->assertSame(false, $json['hasMore']);

	// Create some sample transactions
	$transactions = $this->createTestTransactions($wallet);
	$transactions = array_reverse($transactions);
	$pages = array_chunk($transactions, 10 /* page size*/);

	// Get the first page
	$response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/transactions");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertCount(5, $json);
	$this->assertSame('success', $json['status']);
	$this->assertSame(1, $json['page']);
	$this->assertSame(10, $json['count']);
	$this->assertSame(true, $json['hasMore']);
	$this->assertCount(10, $json['list']);
	foreach ($pages[0] as $idx => $transaction) {
	$this->assertSame($transaction->id, $json['list'][$idx]['id']);
	$this->assertSame($transaction->type, $json['list'][$idx]['type']);
	$this->assertSame($transaction->shortDescription(), $json['list'][$idx]['description']);
	$this->assertFalse($json['list'][$idx]['hasDetails']);
	$this->assertFalse(array_key_exists('user', $json['list'][$idx]));
	}

	$search = null;

	// Get the second page
	$response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/transactions?page=2");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertCount(5, $json);
	$this->assertSame('success', $json['status']);
	$this->assertSame(2, $json['page']);
	$this->assertSame(2, $json['count']);
	$this->assertSame(false, $json['hasMore']);
	$this->assertCount(2, $json['list']);
	foreach ($pages[1] as $idx => $transaction) {
	$this->assertSame($transaction->id, $json['list'][$idx]['id']);
	$this->assertSame($transaction->type, $json['list'][$idx]['type']);
	$this->assertSame($transaction->shortDescription(), $json['list'][$idx]['description']);
	$this->assertSame(
	$transaction->type == Transaction::WALLET_DEBIT,
	$json['list'][$idx]['hasDetails']
	);
	$this->assertFalse(array_key_exists('user', $json['list'][$idx]));

	if ($transaction->type == Transaction::WALLET_DEBIT) {
	$search = $transaction->id;
	}
	}

	// Get a non-existing page
	$response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/transactions?page=3");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertCount(5, $json);
	$this->assertSame('success', $json['status']);
	$this->assertSame(3, $json['page']);
	$this->assertSame(0, $json['count']);
	$this->assertSame(false, $json['hasMore']);
	$this->assertCount(0, $json['list']);

	// Sub-transaction searching
	$response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/transactions?transaction=123");
	$response->assertStatus(404);

	$response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/transactions?transaction={$search}");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertCount(5, $json);
	$this->assertSame('success', $json['status']);
	$this->assertSame(1, $json['page']);
	$this->assertSame(2, $json['count']);
	$this->assertSame(false, $json['hasMore']);
	$this->assertCount(2, $json['list']);
	$this->assertSame(Transaction::ENTITLEMENT_BILLED, $json['list'][0]['type']);
	$this->assertSame(Transaction::ENTITLEMENT_BILLED, $json['list'][1]['type']);

	// Test that John gets 404 if he tries to access
	// someone else's transaction ID on his wallet's endpoint
	$wallet = $john->wallets()->first();
	$response = $this->actingAs($john)->get("api/v4/wallets/{$wallet->id}/transactions?transaction={$search}");
	$response->assertStatus(404);
	}
	}
	diff --git a/src/tests/Feature/Documents/ReceiptTest.php b/src/tests/Feature/Documents/ReceiptTest.php
	index 356151bb..cb0f4d8d 100644
	--- a/src/tests/Feature/Documents/ReceiptTest.php
	+++ b/src/tests/Feature/Documents/ReceiptTest.php
	@@ -1,385 +1,385 @@
	<?php

	namespace Tests\Feature\Documents;

	use App\Documents\Receipt;
	use App\Payment;
	use App\Providers\PaymentProvider;
	use App\User;
	use App\Wallet;
	use Carbon\Carbon;
	use Illuminate\Support\Facades\Bus;
	use Tests\TestCase;

	class ReceiptTest extends TestCase
	{
	private $paymentIDs = ['AAA1', 'AAA2', 'AAA3', 'AAA4', 'AAA5', 'AAA6', 'AAA7'];

	public function setUp(): void
	{
	parent::setUp();

	Payment::whereIn('id', $this->paymentIDs)->delete();
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	$this->deleteTestUser('receipt-test@kolabnow.com');

	Payment::whereIn('id', $this->paymentIDs)->delete();

	parent::tearDown();
	}

	/**
	* Test receipt HTML output (without VAT)
	*/
	public function testHtmlOutput(): void
	{
	$appName = \config('app.name');
	$wallet = $this->getTestData();
	$receipt = new Receipt($wallet, 2020, 5);
	$html = $receipt->htmlOutput();

	$this->assertStringStartsWith('<!DOCTYPE html>', $html);

	$dom = new \DOMDocument('1.0', 'UTF-8');
	$dom->loadHTML($html);

	// Title
	$title = $dom->getElementById('title');
	$this->assertSame("Receipt for May 2020", $title->textContent);

	// Company name/address
	$header = $dom->getElementById('header');
	$companyOutput = $this->getNodeContent($header->getElementsByTagName('td')[0]);
	$companyExpected = \config('app.company.name') . "\n" . \config('app.company.address');
	$this->assertSame($companyExpected, $companyOutput);

	// The main table content
	$content = $dom->getElementById('content');
	$records = $content->getElementsByTagName('tr');
	$this->assertCount(7, $records);

	$headerCells = $records[0]->getElementsByTagName('th');
	$this->assertCount(3, $headerCells);
	$this->assertSame('Date', $this->getNodeContent($headerCells[0]));
	$this->assertSame('Description', $this->getNodeContent($headerCells[1]));
	$this->assertSame('Amount', $this->getNodeContent($headerCells[2]));
	$cells = $records[1]->getElementsByTagName('td');
	$this->assertCount(3, $cells);
	$this->assertSame('2020-05-01', $this->getNodeContent($cells[0]));
	$this->assertSame("$appName Services", $this->getNodeContent($cells[1]));
	$this->assertSame('12,34 CHF', $this->getNodeContent($cells[2]));
	$cells = $records[2]->getElementsByTagName('td');
	$this->assertCount(3, $cells);
	$this->assertSame('2020-05-10', $this->getNodeContent($cells[0]));
	$this->assertSame("$appName Services", $this->getNodeContent($cells[1]));
	$this->assertSame('0,01 CHF', $this->getNodeContent($cells[2]));
	$cells = $records[3]->getElementsByTagName('td');
	$this->assertCount(3, $cells);
	$this->assertSame('2020-05-21', $this->getNodeContent($cells[0]));
	$this->assertSame("$appName Services", $this->getNodeContent($cells[1]));
	$this->assertSame('1,00 CHF', $this->getNodeContent($cells[2]));
	$cells = $records[4]->getElementsByTagName('td');
	$this->assertCount(3, $cells);
	$this->assertSame('2020-05-30', $this->getNodeContent($cells[0]));
	$this->assertSame("Refund", $this->getNodeContent($cells[1]));
	$this->assertSame('-1,00 CHF', $this->getNodeContent($cells[2]));
	$cells = $records[5]->getElementsByTagName('td');
	$this->assertCount(3, $cells);
	$this->assertSame('2020-05-31', $this->getNodeContent($cells[0]));
	$this->assertSame("Chargeback", $this->getNodeContent($cells[1]));
	$this->assertSame('-0,10 CHF', $this->getNodeContent($cells[2]));
	$summaryCells = $records[6]->getElementsByTagName('td');
	$this->assertCount(2, $summaryCells);
	$this->assertSame('Total', $this->getNodeContent($summaryCells[0]));
	$this->assertSame('12,25 CHF', $this->getNodeContent($summaryCells[1]));

	// Customer data
	$customer = $dom->getElementById('customer');
	$customerCells = $customer->getElementsByTagName('td');
	$customerOutput = $this->getNodeContent($customerCells[0]);
	$customerExpected = "Firstname Lastname\nTest Unicode Straße 150\n10115 Berlin";
	$this->assertSame($customerExpected, $this->getNodeContent($customerCells[0]));
	$customerIdents = $this->getNodeContent($customerCells[1]);
	//$this->assertTrue(strpos($customerIdents, "Account ID {$wallet->id}") !== false);
	$this->assertTrue(strpos($customerIdents, "Customer No. {$wallet->owner->id}") !== false);

	// Company details in the footer
	$footer = $dom->getElementById('footer');
	$footerOutput = $footer->textContent;
	$this->assertStringStartsWith(\config('app.company.details'), $footerOutput);
	$this->assertTrue(strpos($footerOutput, \config('app.company.email')) !== false);
	}

	/**
	* Test receipt HTML output (with VAT)
	*/
	public function testHtmlOutputVat(): void
	{
	\config(['app.vat.rate' => 7.7]);
	\config(['app.vat.countries' => 'ch']);

	$appName = \config('app.name');
	$wallet = $this->getTestData('CH');
	$receipt = new Receipt($wallet, 2020, 5);
	$html = $receipt->htmlOutput();

	$this->assertStringStartsWith('<!DOCTYPE html>', $html);

	$dom = new \DOMDocument('1.0', 'UTF-8');
	$dom->loadHTML($html);

	// The main table content
	$content = $dom->getElementById('content');
	$records = $content->getElementsByTagName('tr');
	$this->assertCount(9, $records);

	$cells = $records[1]->getElementsByTagName('td');
	$this->assertCount(3, $cells);
	$this->assertSame('2020-05-01', $this->getNodeContent($cells[0]));
	$this->assertSame("$appName Services", $this->getNodeContent($cells[1]));
	$this->assertSame('11,39 CHF', $this->getNodeContent($cells[2]));
	$cells = $records[2]->getElementsByTagName('td');
	$this->assertCount(3, $cells);
	$this->assertSame('2020-05-10', $this->getNodeContent($cells[0]));
	$this->assertSame("$appName Services", $this->getNodeContent($cells[1]));
	$this->assertSame('0,01 CHF', $this->getNodeContent($cells[2]));
	$cells = $records[3]->getElementsByTagName('td');
	$this->assertCount(3, $cells);
	$this->assertSame('2020-05-21', $this->getNodeContent($cells[0]));
	$this->assertSame("$appName Services", $this->getNodeContent($cells[1]));
	$this->assertSame('0,92 CHF', $this->getNodeContent($cells[2]));
	$cells = $records[4]->getElementsByTagName('td');
	$this->assertCount(3, $cells);
	$this->assertSame('2020-05-30', $this->getNodeContent($cells[0]));
	$this->assertSame("Refund", $this->getNodeContent($cells[1]));
	$this->assertSame('-0,92 CHF', $this->getNodeContent($cells[2]));
	$cells = $records[5]->getElementsByTagName('td');
	$this->assertCount(3, $cells);
	$this->assertSame('2020-05-31', $this->getNodeContent($cells[0]));
	$this->assertSame("Chargeback", $this->getNodeContent($cells[1]));
	$this->assertSame('-0,09 CHF', $this->getNodeContent($cells[2]));
	$subtotalCells = $records[6]->getElementsByTagName('td');
	$this->assertCount(2, $subtotalCells);
	$this->assertSame('Subtotal', $this->getNodeContent($subtotalCells[0]));
	$this->assertSame('11,31 CHF', $this->getNodeContent($subtotalCells[1]));
	$vatCells = $records[7]->getElementsByTagName('td');
	$this->assertCount(2, $vatCells);
	$this->assertSame('VAT (7.7%)', $this->getNodeContent($vatCells[0]));
	$this->assertSame('0,94 CHF', $this->getNodeContent($vatCells[1]));
	$totalCells = $records[8]->getElementsByTagName('td');
	$this->assertCount(2, $totalCells);
	$this->assertSame('Total', $this->getNodeContent($totalCells[0]));
	$this->assertSame('12,25 CHF', $this->getNodeContent($totalCells[1]));
	}

	/**
	* Test receipt PDF output
	*/
	public function testPdfOutput(): void
	{
	$wallet = $this->getTestData();
	$receipt = new Receipt($wallet, 2020, 5);
	$pdf = $receipt->PdfOutput();

	$this->assertStringStartsWith("%PDF-1.", $pdf);
	$this->assertTrue(strlen($pdf) > 5000);

	// TODO: Test the content somehow
	}

	/**
	* Prepare data for a test
	*
	* @param string $country User country code
	*
	* @return \App\Wallet
	*/
	protected function getTestData(string $country = null): Wallet
	{
	Bus::fake();

	$user = $this->getTestUser('receipt-test@kolabnow.com');
	$user->setSettings([
	'first_name' => 'Firstname',
	'last_name' => 'Lastname',
	'billing_address' => "Test Unicode Straße 150\n10115 Berlin",
	'country' => $country
	]);

	$wallet = $user->wallets()->first();

	// Create two payments out of the 2020-05 period
	// and three in it, plus one in the period but unpaid,
	// and one with amount 0, and an extra refund and chanrgeback

	$payment = Payment::create([
	'id' => 'AAA1',
	'status' => PaymentProvider::STATUS_PAID,
	'type' => PaymentProvider::TYPE_ONEOFF,
	'description' => 'Paid in April',
	'wallet_id' => $wallet->id,
	'provider' => 'stripe',
	'amount' => 1111,
	'currency' => 'CHF',
	'currency_amount' => 1111,
	]);
	$payment->updated_at = Carbon::create(2020, 4, 30, 12, 0, 0);
	$payment->save();

	$payment = Payment::create([
	'id' => 'AAA2',
	'status' => PaymentProvider::STATUS_PAID,
	'type' => PaymentProvider::TYPE_ONEOFF,
	'description' => 'Paid in June',
	'wallet_id' => $wallet->id,
	'provider' => 'stripe',
	'amount' => 2222,
	'currency' => 'CHF',
	'currency_amount' => 2222,
	]);
	$payment->updated_at = Carbon::create(2020, 6, 1, 0, 0, 0);
	$payment->save();

	$payment = Payment::create([
	'id' => 'AAA3',
	'status' => PaymentProvider::STATUS_PAID,
	'type' => PaymentProvider::TYPE_ONEOFF,
	'description' => 'Auto-Payment Setup',
	'wallet_id' => $wallet->id,
	'provider' => 'stripe',
	'amount' => 0,
	'currency' => 'CHF',
	'currency_amount' => 0,
	]);
	$payment->updated_at = Carbon::create(2020, 5, 1, 0, 0, 0);
	$payment->save();

	$payment = Payment::create([
	'id' => 'AAA4',
	'status' => PaymentProvider::STATUS_OPEN,
	'type' => PaymentProvider::TYPE_ONEOFF,
	'description' => 'Payment not yet paid',
	'wallet_id' => $wallet->id,
	'provider' => 'stripe',
	- 'amount' => 999,
	+ 'amount' => 990,
	'currency' => 'CHF',
	- 'currency_amount' => 999,
	+ 'currency_amount' => 990,
	]);
	$payment->updated_at = Carbon::create(2020, 5, 1, 0, 0, 0);
	$payment->save();

	// ... so we expect the five three on the receipt
	$payment = Payment::create([
	'id' => 'AAA5',
	'status' => PaymentProvider::STATUS_PAID,
	'type' => PaymentProvider::TYPE_ONEOFF,
	'description' => 'Payment OK',
	'wallet_id' => $wallet->id,
	'provider' => 'stripe',
	'amount' => 1234,
	'currency' => 'CHF',
	'currency_amount' => 1234,
	]);
	$payment->updated_at = Carbon::create(2020, 5, 1, 0, 0, 0);
	$payment->save();

	$payment = Payment::create([
	'id' => 'AAA6',
	'status' => PaymentProvider::STATUS_PAID,
	'type' => PaymentProvider::TYPE_ONEOFF,
	'description' => 'Payment OK',
	'wallet_id' => $wallet->id,
	'provider' => 'stripe',
	'amount' => 1,
	'currency' => 'CHF',
	'currency_amount' => 1,
	]);
	$payment->updated_at = Carbon::create(2020, 5, 10, 0, 0, 0);
	$payment->save();

	$payment = Payment::create([
	'id' => 'AAA7',
	'status' => PaymentProvider::STATUS_PAID,
	'type' => PaymentProvider::TYPE_RECURRING,
	'description' => 'Payment OK',
	'wallet_id' => $wallet->id,
	'provider' => 'stripe',
	'amount' => 100,
	'currency' => 'CHF',
	'currency_amount' => 100,
	]);
	$payment->updated_at = Carbon::create(2020, 5, 21, 23, 59, 0);
	$payment->save();

	$payment = Payment::create([
	'id' => 'ref1',
	'status' => PaymentProvider::STATUS_PAID,
	'type' => PaymentProvider::TYPE_REFUND,
	'description' => 'refund desc',
	'wallet_id' => $wallet->id,
	'provider' => 'stripe',
	'amount' => -100,
	'currency' => 'CHF',
	'currency_amount' => -100,
	]);
	$payment->updated_at = Carbon::create(2020, 5, 30, 23, 59, 0);
	$payment->save();

	$payment = Payment::create([
	'id' => 'chback1',
	'status' => PaymentProvider::STATUS_PAID,
	'type' => PaymentProvider::TYPE_CHARGEBACK,
	'description' => '',
	'wallet_id' => $wallet->id,
	'provider' => 'stripe',
	'amount' => -10,
	'currency' => 'CHF',
	'currency_amount' => -10,
	]);
	$payment->updated_at = Carbon::create(2020, 5, 31, 23, 59, 0);
	$payment->save();

	// Make sure some config is set so we can test it's put into the receipt
	if (empty(\config('app.company.name'))) {
	\config(['app.company.name' => 'Company Co.']);
	}
	if (empty(\config('app.company.email'))) {
	\config(['app.company.email' => 'email@domina.tld']);
	}
	if (empty(\config('app.company.details'))) {
	\config(['app.company.details' => 'VAT No. 123456789']);
	}
	if (empty(\config('app.company.address'))) {
	\config(['app.company.address' => "Test Street 12\n12345 Some Place"]);
	}

	return $wallet;
	}

	/**
	* Extract text from a HTML element replacing <br> with \n
	*
	* @param \DOMElement $node The HTML element
	*
	* @return string The content
	*/
	protected function getNodeContent(\DOMElement $node)
	{
	$content = [];
	foreach ($node->childNodes as $child) {
	if ($child->nodeName == 'br') {
	$content[] = "\n";
	} else {
	$content[] = $child->textContent;
	}
	}

	return trim(implode($content));
	}
	}
	diff --git a/src/tests/Feature/DomainOwnerTest.php b/src/tests/Feature/DomainOwnerTest.php
	index 42d5d556..b54ac28f 100644
	--- a/src/tests/Feature/DomainOwnerTest.php
	+++ b/src/tests/Feature/DomainOwnerTest.php
	@@ -1,52 +1,53 @@
	<?php

	namespace Tests\Feature;

	-use App\Package;
	use App\User;
	use Illuminate\Support\Facades\Queue;
	use Tests\TestCase;

	class DomainOwnerTest extends TestCase
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();

	$this->deleteTestUser('jane@kolab.org');
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	$this->deleteTestUser('jane@kolab.org');

	parent::tearDown();
	}

	public function testJohnCreateJane(): void
	{
	$john = User::where('email', 'john@kolab.org')->first();

	$jane = User::create(
	[
	'name' => 'Jane Doe',
	'email' => 'jane@kolab.org',
	'password' => 'simple123',
	'email_verified_at' => now()
	]
	);

	- $package = Package::where('title', 'kolab')->first();
	+ $package = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
	+ $mailbox_sku = \App\Sku::withEnvTenantContext()->where('title', 'mailbox')->first();

	$john->assignPackage($package, $jane);

	// assert jane has a mailbox entitlement
	- $this->assertTrue($jane->entitlements->count() == 4);
	+ $this->assertCount(7, $jane->entitlements);
	+ $this->assertCount(1, $jane->entitlements()->where('sku_id', $mailbox_sku->id)->get());
	}
	}
	diff --git a/src/tests/Feature/EntitlementTest.php b/src/tests/Feature/EntitlementTest.php
	index 4ddd7293..5ba4c4f4 100644
	--- a/src/tests/Feature/EntitlementTest.php
	+++ b/src/tests/Feature/EntitlementTest.php
	@@ -1,175 +1,175 @@
	<?php

	namespace Tests\Feature;

	use App\Domain;
	use App\Entitlement;
	use App\Package;
	use App\Sku;
	use App\User;
	use Carbon\Carbon;
	use Tests\TestCase;

	class EntitlementTest extends TestCase
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();

	$this->deleteTestUser('entitlement-test@kolabnow.com');
	$this->deleteTestUser('entitled-user@custom-domain.com');
	$this->deleteTestGroup('test-group@custom-domain.com');
	$this->deleteTestDomain('custom-domain.com');
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	$this->deleteTestUser('entitlement-test@kolabnow.com');
	$this->deleteTestUser('entitled-user@custom-domain.com');
	$this->deleteTestGroup('test-group@custom-domain.com');
	$this->deleteTestDomain('custom-domain.com');

	parent::tearDown();
	}

	/**
	* Test for Entitlement::costsPerDay()
	*/
	public function testCostsPerDay(): void
	{
	- // 444
	- // 28 days: 15.86
	- // 31 days: 14.32
	+ // 500
	+ // 28 days: 17.86
	+ // 31 days: 16.13
	$user = $this->getTestUser('entitlement-test@kolabnow.com');
	- $package = Package::where('title', 'kolab')->first();
	- $mailbox = Sku::where('title', 'mailbox')->first();
	+ $package = Package::withEnvTenantContext()->where('title', 'kolab')->first();
	+ $mailbox = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();

	$user->assignPackage($package);

	$entitlement = $user->entitlements->where('sku_id', $mailbox->id)->first();

	$costsPerDay = $entitlement->costsPerDay();

	- $this->assertTrue($costsPerDay < 15.86);
	- $this->assertTrue($costsPerDay > 14.32);
	+ $this->assertTrue($costsPerDay < 17.86);
	+ $this->assertTrue($costsPerDay > 16.31);
	}

	/**
	* Tests for entitlements
	* @todo This really should be in User or Wallet tests file
	*/
	public function testEntitlements(): void
	{
	- $packageDomain = Package::where('title', 'domain-hosting')->first();
	- $packageKolab = Package::where('title', 'kolab')->first();
	+ $packageDomain = Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
	+ $packageKolab = Package::withEnvTenantContext()->where('title', 'kolab')->first();

	- $skuDomain = Sku::where('title', 'domain-hosting')->first();
	- $skuMailbox = Sku::where('title', 'mailbox')->first();
	+ $skuDomain = Sku::withEnvTenantContext()->where('title', 'domain-hosting')->first();
	+ $skuMailbox = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();

	$owner = $this->getTestUser('entitlement-test@kolabnow.com');
	$user = $this->getTestUser('entitled-user@custom-domain.com');

	$domain = $this->getTestDomain(
	'custom-domain.com',
	[
	'status' => Domain::STATUS_NEW,
	'type' => Domain::TYPE_EXTERNAL,
	]
	);

	$domain->assignPackage($packageDomain, $owner);
	$owner->assignPackage($packageKolab);
	$owner->assignPackage($packageKolab, $user);

	$wallet = $owner->wallets->first();

	- $this->assertCount(4, $owner->entitlements()->get());
	+ $this->assertCount(7, $owner->entitlements()->get());
	$this->assertCount(1, $skuDomain->entitlements()->where('wallet_id', $wallet->id)->get());
	$this->assertCount(2, $skuMailbox->entitlements()->where('wallet_id', $wallet->id)->get());
	- $this->assertCount(9, $wallet->entitlements);
	+ $this->assertCount(15, $wallet->entitlements);

	$this->backdateEntitlements(
	$owner->entitlements,
	Carbon::now()->subMonthsWithoutOverflow(1)
	);

	$wallet->chargeEntitlements();

	$this->assertTrue($wallet->fresh()->balance < 0);
	}

	/**
	* @todo This really should be in User tests file
	*/
	public function testEntitlementFunctions(): void
	{
	$user = $this->getTestUser('entitlement-test@kolabnow.com');

	- $package = \App\Package::where('title', 'kolab')->first();
	+ $package = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();

	$user->assignPackage($package);

	$wallet = $user->wallets()->first();
	$this->assertNotNull($wallet);

	- $sku = \App\Sku::where('title', 'mailbox')->first();
	+ $sku = \App\Sku::withEnvTenantContext()->where('title', 'mailbox')->first();

	$entitlement = Entitlement::where('wallet_id', $wallet->id)
	->where('sku_id', $sku->id)->first();

	$this->assertNotNull($entitlement);
	$this->assertSame($sku->id, $entitlement->sku->id);
	$this->assertSame($wallet->id, $entitlement->wallet->id);
	$this->assertEquals($user->id, $entitlement->entitleable->id);
	$this->assertTrue($entitlement->entitleable instanceof \App\User);
	}

	/**
	* Test Entitlement::entitlementTitle()
	*/
	public function testEntitlementTitle(): void
	{
	- $packageDomain = Package::where('title', 'domain-hosting')->first();
	- $packageKolab = Package::where('title', 'kolab')->first();
	+ $packageDomain = Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
	+ $packageKolab = Package::withEnvTenantContext()->where('title', 'kolab')->first();
	$user = $this->getTestUser('entitled-user@custom-domain.com');
	$group = $this->getTestGroup('test-group@custom-domain.com');

	$domain = $this->getTestDomain(
	'custom-domain.com',
	[
	'status' => Domain::STATUS_NEW,
	'type' => Domain::TYPE_EXTERNAL,
	]
	);

	$wallet = $user->wallets->first();
	$domain->assignPackage($packageDomain, $user);
	$user->assignPackage($packageKolab);
	$group->assignToWallet($wallet);

	- $sku_mailbox = \App\Sku::where('title', 'mailbox')->first();
	- $sku_group = \App\Sku::where('title', 'group')->first();
	- $sku_domain = \App\Sku::where('title', 'domain-hosting')->first();
	+ $sku_mailbox = \App\Sku::withEnvTenantContext()->where('title', 'mailbox')->first();
	+ $sku_group = \App\Sku::withEnvTenantContext()->where('title', 'group')->first();
	+ $sku_domain = \App\Sku::withEnvTenantContext()->where('title', 'domain-hosting')->first();

	$entitlement = Entitlement::where('wallet_id', $wallet->id)
	->where('sku_id', $sku_mailbox->id)->first();

	$this->assertSame($user->email, $entitlement->entitleableTitle());

	$entitlement = Entitlement::where('wallet_id', $wallet->id)
	->where('sku_id', $sku_group->id)->first();

	$this->assertSame($group->email, $entitlement->entitleableTitle());

	$entitlement = Entitlement::where('wallet_id', $wallet->id)
	->where('sku_id', $sku_domain->id)->first();

	$this->assertSame($domain->namespace, $entitlement->entitleableTitle());
	}
	}
	diff --git a/src/tests/Feature/Jobs/WalletCheckTest.php b/src/tests/Feature/Jobs/WalletCheckTest.php
	index a58778b3..b627431c 100644
	--- a/src/tests/Feature/Jobs/WalletCheckTest.php
	+++ b/src/tests/Feature/Jobs/WalletCheckTest.php
	@@ -1,328 +1,328 @@
	<?php

	namespace Tests\Feature\Jobs;

	use App\Jobs\WalletCheck;
	use App\User;
	use Carbon\Carbon;
	use Illuminate\Support\Facades\Mail;
	use Tests\TestCase;

	class WalletCheckTest extends TestCase
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();

	$ned = $this->getTestUser('ned@kolab.org');
	if ($ned->isSuspended()) {
	$ned->status -= User::STATUS_SUSPENDED;
	$ned->save();
	}

	$this->deleteTestUser('wallet-check@kolabnow.com');
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	$ned = $this->getTestUser('ned@kolab.org');
	if ($ned->isSuspended()) {
	$ned->status -= User::STATUS_SUSPENDED;
	$ned->save();
	}

	$this->deleteTestUser('wallet-check@kolabnow.com');

	parent::tearDown();
	}

	/**
	* Test job handle, initial negative-balance notification
	*/
	public function testHandleInitial(): void
	{
	Mail::fake();

	$user = $this->getTestUser('ned@kolab.org');
	$user->setSetting('external_email', 'external@test.com');
	$wallet = $user->wallets()->first();
	$now = Carbon::now();

	// Balance is not negative, double-update+save for proper resetting of the state
	$wallet->balance = -100;
	$wallet->save();
	$wallet->balance = 0;
	$wallet->save();

	$job = new WalletCheck($wallet);
	$job->handle();

	Mail::assertNothingSent();

	// Balance is negative now
	$wallet->balance = -100;
	$wallet->save();

	$job = new WalletCheck($wallet);
	$job->handle();

	Mail::assertNothingSent();

	// Balance turned negative 2 hours ago, expect mail sent
	$wallet->setSetting('balance_negative_since', $now->subHours(2)->toDateTimeString());
	$wallet->setSetting('balance_warning_initial', null);

	$job = new WalletCheck($wallet);
	$job->handle();

	// Assert the mail was sent to the user's email, but not to his external email
	Mail::assertSent(\App\Mail\NegativeBalance::class, 1);
	Mail::assertSent(\App\Mail\NegativeBalance::class, function ($mail) use ($user) {
	return $mail->hasTo($user->email) && !$mail->hasCc('external@test.com');
	});

	// Run the job again to make sure the notification is not sent again
	Mail::fake();
	$job = new WalletCheck($wallet);
	$job->handle();

	Mail::assertNothingSent();

	// Test the migration scenario where a negative wallet has no balance_negative_since set yet
	Mail::fake();
	$wallet->setSetting('balance_negative_since', null);
	$wallet->setSetting('balance_warning_initial', null);

	$job = new WalletCheck($wallet);
	$job->handle();

	// Assert the mail was sent to the user's email, but not to his external email
	Mail::assertSent(\App\Mail\NegativeBalance::class, 1);
	Mail::assertSent(\App\Mail\NegativeBalance::class, function ($mail) use ($user) {
	return $mail->hasTo($user->email) && !$mail->hasCc('external@test.com');
	});

	$wallet->refresh();
	$today_regexp = '/' . Carbon::now()->toDateString() . ' [0-9]{2}:[0-9]{2}:[0-9]{2}/';
	$this->assertRegExp($today_regexp, $wallet->getSetting('balance_negative_since'));
	$this->assertRegExp($today_regexp, $wallet->getSetting('balance_warning_initial'));
	}

	/**
	* Test job handle, top-up before reminder notification
	*
	* @depends testHandleInitial
	*/
	public function testHandleBeforeReminder(): void
	{
	Mail::fake();

	$user = $this->getTestUser('ned@kolab.org');
	$wallet = $user->wallets()->first();
	$now = Carbon::now();

	// Balance turned negative 7-1 days ago
	$wallet->setSetting('balance_negative_since', $now->subDays(7 - 1)->toDateTimeString());

	$job = new WalletCheck($wallet);
	$res = $job->handle();

	Mail::assertNothingSent();

	// TODO: Test that it actually executed the topUpWallet()
	$this->assertSame(WalletCheck::THRESHOLD_BEFORE_REMINDER, $res);
	$this->assertFalse($user->fresh()->isSuspended());
	}

	/**
	* Test job handle, reminder notification
	*
	* @depends testHandleBeforeReminder
	*/
	public function testHandleReminder(): void
	{
	Mail::fake();

	$user = $this->getTestUser('ned@kolab.org');
	$user->setSetting('external_email', 'external@test.com');
	$wallet = $user->wallets()->first();
	$now = Carbon::now();

	// Balance turned negative 7+1 days ago, expect mail sent
	$wallet->setSetting('balance_negative_since', $now->subDays(7 + 1)->toDateTimeString());

	$job = new WalletCheck($wallet);
	$job->handle();

	// Assert the mail was sent to the user's email, but not to his external email
	Mail::assertSent(\App\Mail\NegativeBalanceReminder::class, 1);
	Mail::assertSent(\App\Mail\NegativeBalanceReminder::class, function ($mail) use ($user) {
	return $mail->hasTo($user->email) && !$mail->hasCc('external@test.com');
	});

	// Run the job again to make sure the notification is not sent again
	Mail::fake();
	$job = new WalletCheck($wallet);
	$job->handle();

	Mail::assertNothingSent();
	}

	/**
	* Test job handle, top-up wallet before account suspending
	*
	* @depends testHandleReminder
	*/
	public function testHandleBeforeSuspended(): void
	{
	Mail::fake();

	$user = $this->getTestUser('ned@kolab.org');
	$wallet = $user->wallets()->first();
	$now = Carbon::now();

	// Balance turned negative 7+14-1 days ago
	$days = 7 + 14 - 1;
	$wallet->setSetting('balance_negative_since', $now->subDays($days)->toDateTimeString());

	$job = new WalletCheck($wallet);
	$res = $job->handle();

	Mail::assertNothingSent();

	// TODO: Test that it actually executed the topUpWallet()
	$this->assertSame(WalletCheck::THRESHOLD_BEFORE_SUSPEND, $res);
	$this->assertFalse($user->fresh()->isSuspended());
	}

	/**
	* Test job handle, account suspending
	*
	* @depends testHandleBeforeSuspended
	*/
	public function testHandleSuspended(): void
	{
	Mail::fake();

	$user = $this->getTestUser('ned@kolab.org');
	$user->setSetting('external_email', 'external@test.com');
	$wallet = $user->wallets()->first();
	$now = Carbon::now();

	// Balance turned negative 7+14+1 days ago, expect mail sent
	$days = 7 + 14 + 1;
	$wallet->setSetting('balance_negative_since', $now->subDays($days)->toDateTimeString());

	$job = new WalletCheck($wallet);
	$job->handle();

	// Assert the mail was sent to the user's email, but not to his external email
	Mail::assertSent(\App\Mail\NegativeBalanceSuspended::class, 1);
	Mail::assertSent(\App\Mail\NegativeBalanceSuspended::class, function ($mail) use ($user) {
	return $mail->hasTo($user->email) && $mail->hasCc('external@test.com');
	});

	// Check that it has been suspended
	$this->assertTrue($user->fresh()->isSuspended());

	// TODO: Test that group account members/domain are also being suspended
	/*
	foreach ($wallet->entitlements()->fresh()->get() as $entitlement) {
	if (
	$entitlement->entitleable_type == \App\Domain::class
	\|\| $entitlement->entitleable_type == \App\User::class
	) {
	$this->assertTrue($entitlement->entitleable->isSuspended());
	}
	}
	*/

	// Run the job again to make sure the notification is not sent again
	Mail::fake();
	$job = new WalletCheck($wallet);
	$job->handle();

	Mail::assertNothingSent();
	}

	/**
	* Test job handle, final warning before delete
	*
	* @depends testHandleSuspended
	*/
	public function testHandleBeforeDelete(): void
	{
	Mail::fake();

	$user = $this->getTestUser('ned@kolab.org');
	$user->setSetting('external_email', 'external@test.com');
	$wallet = $user->wallets()->first();
	$now = Carbon::now();

	// Balance turned negative 7+14+21-3+1 days ago, expect mail sent
	$days = 7 + 14 + 21 - 3 + 1;
	$wallet->setSetting('balance_negative_since', $now->subDays($days)->toDateTimeString());

	$job = new WalletCheck($wallet);
	$job->handle();

	// Assert the mail was sent to the user's email, and his external email
	Mail::assertSent(\App\Mail\NegativeBalanceBeforeDelete::class, 1);
	Mail::assertSent(\App\Mail\NegativeBalanceBeforeDelete::class, function ($mail) use ($user) {
	return $mail->hasTo($user->email) && $mail->hasCc('external@test.com');
	});

	// Check that it has not been deleted yet
	$this->assertFalse($user->fresh()->isDeleted());

	// Run the job again to make sure the notification is not sent again
	Mail::fake();
	$job = new WalletCheck($wallet);
	$job->handle();

	Mail::assertNothingSent();
	}

	/**
	* Test job handle, account delete
	*
	* @depends testHandleBeforeDelete
	*/
	public function testHandleDelete(): void
	{
	Mail::fake();

	$user = $this->getTestUser('wallet-check@kolabnow.com');
	$wallet = $user->wallets()->first();
	$wallet->balance = -100;
	$wallet->save();
	$now = Carbon::now();

	- $package = \App\Package::where('title', 'kolab')->first();
	+ $package = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
	$user->assignPackage($package);

	$this->assertFalse($user->isDeleted());
	- $this->assertCount(4, $user->entitlements()->get());
	+ $this->assertCount(7, $user->entitlements()->get());

	// Balance turned negative 7+14+21+1 days ago, expect mail sent
	$days = 7 + 14 + 21 + 1;
	$wallet->setSetting('balance_negative_since', $now->subDays($days)->toDateTimeString());

	$job = new WalletCheck($wallet);
	$job->handle();

	Mail::assertNothingSent();

	// Check that it has not been deleted
	$this->assertTrue($user->fresh()->trashed());
	$this->assertCount(0, $user->entitlements()->get());

	// TODO: Test it deletes all members of the group account
	}
	}
	diff --git a/src/tests/Feature/PlanTest.php b/src/tests/Feature/PlanTest.php
	index 704a2788..feac294b 100644
	--- a/src/tests/Feature/PlanTest.php
	+++ b/src/tests/Feature/PlanTest.php
	@@ -1,124 +1,124 @@
	<?php

	namespace Tests\Feature;

	use App\Entitlement;
	use App\Plan;
	use App\Sku;
	use Tests\TestCase;

	class PlanTest extends TestCase
	{
	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();

	Plan::where('title', 'test-plan')->delete();
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	Plan::where('title', 'test-plan')->delete();

	parent::tearDown();
	}

	/**
	* Tests for plan attributes localization
	*/
	public function testPlanLocalization(): void
	{
	$plan = Plan::create([
	'title' => 'test-plan',
	'description' => [
	'en' => 'Plan-EN',
	'de' => 'Plan-DE',
	],
	'name' => 'Test',
	]);

	$this->assertSame('Plan-EN', $plan->description);
	$this->assertSame('Test', $plan->name);

	$plan->save();
	$plan = Plan::where('title', 'test-plan')->first();

	$this->assertSame('Plan-EN', $plan->description);
	$this->assertSame('Test', $plan->name);
	$this->assertSame('Plan-DE', $plan->getTranslation('description', 'de'));
	$this->assertSame('Test', $plan->getTranslation('name', 'de'));

	$plan->setTranslation('name', 'de', 'Prüfung')->save();

	$this->assertSame('Prüfung', $plan->getTranslation('name', 'de'));
	$this->assertSame('Test', $plan->getTranslation('name', 'en'));

	$plan = Plan::where('title', 'test-plan')->first();

	$this->assertSame('Prüfung', $plan->getTranslation('name', 'de'));
	$this->assertSame('Test', $plan->getTranslation('name', 'en'));

	// TODO: Test system locale change
	}

	/**
	* Tests for Plan::hasDomain()
	*/
	public function testHasDomain(): void
	{
	$plan = Plan::where('title', 'individual')->first();

	$this->assertTrue($plan->hasDomain() === false);

	$plan = Plan::where('title', 'group')->first();

	$this->assertTrue($plan->hasDomain() === true);
	}

	/**
	* Test for a plan's cost.
	*/
	public function testCost(): void
	{
	$plan = Plan::where('title', 'individual')->first();

	$package_costs = 0;

	foreach ($plan->packages as $package) {
	$package_costs += $package->cost();
	}

	$this->assertTrue(
	- $package_costs == 999,
	- "The total costs of all packages for this plan is not 9.99"
	+ $package_costs == 990,
	+ "The total costs of all packages for this plan is not 9.90"
	);

	$this->assertTrue(
	- $plan->cost() == 999,
	- "The total costs for this plan is not 9.99"
	+ $plan->cost() == 990,
	+ "The total costs for this plan is not 9.90"
	);

	$this->assertTrue($plan->cost() == $package_costs);
	}

	public function testTenant(): void
	{
	- $plan = Plan::where('title', 'individual')->first();
	+ $plan = Plan::withEnvTenantContext()->where('title', 'individual')->first();

	$tenant = $plan->tenant()->first();

	$this->assertInstanceof(\App\Tenant::class, $tenant);
	- $this->assertSame(1, $tenant->id);
	+ $this->assertSame((int) \config('app.tenant_id'), $tenant->id);

	$tenant = $plan->tenant;

	$this->assertInstanceof(\App\Tenant::class, $tenant);
	- $this->assertSame(1, $tenant->id);
	+ $this->assertSame((int) \config('app.tenant_id'), $tenant->id);
	}
	}
	diff --git a/src/tests/Feature/SkuTest.php b/src/tests/Feature/SkuTest.php
	index 88d0cdfd..87635aa3 100644
	--- a/src/tests/Feature/SkuTest.php
	+++ b/src/tests/Feature/SkuTest.php
	@@ -1,109 +1,104 @@
	<?php

	namespace Tests\Feature;

	use App\Entitlement;
	use App\Handlers;
	use App\Package;
	use App\Sku;
	use Carbon\Carbon;
	use Tests\TestCase;

	class SkuTest extends TestCase
	{

	public function setUp(): void
	{
	parent::setUp();

	$this->deleteTestUser('jane@kolabnow.com');
	}

	public function tearDown(): void
	{
	$this->deleteTestUser('jane@kolabnow.com');

	parent::tearDown();
	}

	public function testPackageEntitlements(): void
	{
	$user = $this->getTestUser('jane@kolabnow.com');

	$wallet = $user->wallets()->first();

	- $package = Package::where('title', 'lite')->first();
	-
	- $sku_mailbox = Sku::where('title', 'mailbox')->first();
	- $sku_storage = Sku::where('title', 'storage')->first();
	+ $package = Package::withEnvTenantContext()->where('title', 'lite')->first();

	$user = $user->assignPackage($package);

	$this->backdateEntitlements($user->fresh()->entitlements, Carbon::now()->subMonthsWithoutOverflow(1));

	$wallet->chargeEntitlements();

	$this->assertTrue($wallet->balance < 0);
	}

	public function testSkuEntitlements(): void
	{
	- $this->assertCount(4, Sku::where('title', 'mailbox')->first()->entitlements);
	+ $this->assertCount(5, Sku::withEnvTenantContext()->where('title', 'mailbox')->first()->entitlements);
	}

	public function testSkuPackages(): void
	{
	- $this->assertCount(2, Sku::where('title', 'mailbox')->first()->packages);
	+ $this->assertCount(2, Sku::withEnvTenantContext()->where('title', 'mailbox')->first()->packages);
	}

	public function testSkuHandlerDomainHosting(): void
	{
	- $sku = Sku::where('title', 'domain-hosting')->first();
	+ $sku = Sku::withEnvTenantContext()->where('title', 'domain-hosting')->first();

	$entitlement = $sku->entitlements->first();

	$this->assertSame(
	Handlers\DomainHosting::entitleableClass(),
	$entitlement->entitleable_type
	);
	}

	public function testSkuHandlerMailbox(): void
	{
	- $sku = Sku::where('title', 'mailbox')->first();
	+ $sku = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();

	$entitlement = $sku->entitlements->first();

	$this->assertSame(
	Handlers\Mailbox::entitleableClass(),
	$entitlement->entitleable_type
	);
	}

	public function testSkuHandlerStorage(): void
	{
	- $sku = Sku::where('title', 'storage')->first();
	+ $sku = Sku::withEnvTenantContext()->where('title', 'storage')->first();

	$entitlement = $sku->entitlements->first();

	$this->assertSame(
	Handlers\Storage::entitleableClass(),
	$entitlement->entitleable_type
	);
	}

	public function testSkuTenant(): void
	{
	- $sku = Sku::where('title', 'storage')->first();
	+ $sku = Sku::withEnvTenantContext()->where('title', 'storage')->first();

	$tenant = $sku->tenant()->first();

	$this->assertInstanceof(\App\Tenant::class, $tenant);
	- $this->assertSame(1, $tenant->id);

	$tenant = $sku->tenant;

	$this->assertInstanceof(\App\Tenant::class, $tenant);
	- $this->assertSame(1, $tenant->id);
	}
	}
	diff --git a/src/tests/Feature/TenantTest.php b/src/tests/Feature/TenantTest.php
	index 02a395b8..b7b274b5 100644
	--- a/src/tests/Feature/TenantTest.php
	+++ b/src/tests/Feature/TenantTest.php
	@@ -1,40 +1,40 @@
	<?php

	namespace Tests\Feature;

	use App\Tenant;
	use Tests\TestCase;

	class TenantTest extends TestCase
	{

	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();
	}

	/**
	* {@inheritDoc}
	*/
	public function tearDown(): void
	{
	parent::tearDown();
	}

	/**
	* Test Tenant::wallet() method
	*/
	public function testWallet(): void
	{
	$tenant = Tenant::find(1);
	- $user = \App\User::where('email', 'reseller@kolabnow.com')->first();
	+ $user = \App\User::where('email', 'reseller@' . \config('app.domain'))->first();

	$wallet = $tenant->wallet();

	$this->assertInstanceof(\App\Wallet::class, $wallet);
	$this->assertSame($user->wallets->first()->id, $wallet->id);
	}
	}
	diff --git a/src/tests/Feature/UserTest.php b/src/tests/Feature/UserTest.php
	index 62d1c0ca..6fdf9efb 100644
	--- a/src/tests/Feature/UserTest.php
	+++ b/src/tests/Feature/UserTest.php
	@@ -1,884 +1,899 @@
	<?php

	namespace Tests\Feature;

	use App\Domain;
	use App\Group;
	use App\User;
	use Illuminate\Support\Facades\Queue;
	use Tests\TestCase;

	class UserTest extends TestCase
	{
	public function setUp(): void
	{
	parent::setUp();

	$this->deleteTestUser('user-test@' . \config('app.domain'));
	$this->deleteTestUser('UserAccountA@UserAccount.com');
	$this->deleteTestUser('UserAccountB@UserAccount.com');
	$this->deleteTestUser('UserAccountC@UserAccount.com');
	$this->deleteTestGroup('test-group@UserAccount.com');
	$this->deleteTestDomain('UserAccount.com');
	$this->deleteTestDomain('UserAccountAdd.com');
	}

	public function tearDown(): void
	{
	$this->deleteTestUser('user-test@' . \config('app.domain'));
	$this->deleteTestUser('UserAccountA@UserAccount.com');
	$this->deleteTestUser('UserAccountB@UserAccount.com');
	$this->deleteTestUser('UserAccountC@UserAccount.com');
	$this->deleteTestGroup('test-group@UserAccount.com');
	$this->deleteTestDomain('UserAccount.com');
	$this->deleteTestDomain('UserAccountAdd.com');

	parent::tearDown();
	}

	/**
	* Tests for User::assignPackage()
	*/
	public function testAssignPackage(): void
	{
	$this->markTestIncomplete();
	}

	/**
	* Tests for User::assignPlan()
	*/
	public function testAssignPlan(): void
	{
	$this->markTestIncomplete();
	}

	/**
	* Tests for User::assignSku()
	*/
	public function testAssignSku(): void
	{
	$this->markTestIncomplete();
	}

	/**
	* Verify a wallet assigned a controller is among the accounts of the assignee.
	*/
	public function testAccounts(): void
	{
	$userA = $this->getTestUser('UserAccountA@UserAccount.com');
	$userB = $this->getTestUser('UserAccountB@UserAccount.com');

	$this->assertTrue($userA->wallets()->count() == 1);

	$userA->wallets()->each(
	function ($wallet) use ($userB) {
	$wallet->addController($userB);
	}
	);

	$this->assertTrue($userB->accounts()->get()[0]->id === $userA->wallets()->get()[0]->id);
	}

	public function testCanDelete(): void
	{
	$this->markTestIncomplete();
	}

	/**
	* Test User::canRead() method
	*/
	public function testCanRead(): void
	{
	$john = $this->getTestUser('john@kolab.org');
	$ned = $this->getTestUser('ned@kolab.org');
	$jack = $this->getTestUser('jack@kolab.org');
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	- $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
	+ $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	$domain = $this->getTestDomain('kolab.org');

	// Admin
	$this->assertTrue($admin->canRead($admin));
	$this->assertTrue($admin->canRead($john));
	$this->assertTrue($admin->canRead($jack));
	$this->assertTrue($admin->canRead($reseller1));
	$this->assertTrue($admin->canRead($reseller2));
	$this->assertTrue($admin->canRead($domain));
	$this->assertTrue($admin->canRead($domain->wallet()));

	// Reseller - kolabnow
	$this->assertTrue($reseller1->canRead($john));
	$this->assertTrue($reseller1->canRead($jack));
	$this->assertTrue($reseller1->canRead($reseller1));
	$this->assertTrue($reseller1->canRead($domain));
	$this->assertTrue($reseller1->canRead($domain->wallet()));
	$this->assertFalse($reseller1->canRead($reseller2));
	$this->assertFalse($reseller1->canRead($admin));

	// Reseller - different tenant
	$this->assertTrue($reseller2->canRead($reseller2));
	$this->assertFalse($reseller2->canRead($john));
	$this->assertFalse($reseller2->canRead($jack));
	$this->assertFalse($reseller2->canRead($reseller1));
	$this->assertFalse($reseller2->canRead($domain));
	$this->assertFalse($reseller2->canRead($domain->wallet()));
	$this->assertFalse($reseller2->canRead($admin));

	// Normal user - account owner
	$this->assertTrue($john->canRead($john));
	$this->assertTrue($john->canRead($ned));
	$this->assertTrue($john->canRead($jack));
	$this->assertTrue($john->canRead($domain));
	$this->assertTrue($john->canRead($domain->wallet()));
	$this->assertFalse($john->canRead($reseller1));
	$this->assertFalse($john->canRead($reseller2));
	$this->assertFalse($john->canRead($admin));

	// Normal user - a non-owner and non-controller
	$this->assertTrue($jack->canRead($jack));
	$this->assertFalse($jack->canRead($john));
	$this->assertFalse($jack->canRead($domain));
	$this->assertFalse($jack->canRead($domain->wallet()));
	$this->assertFalse($jack->canRead($reseller1));
	$this->assertFalse($jack->canRead($reseller2));
	$this->assertFalse($jack->canRead($admin));

	// Normal user - John's wallet controller
	$this->assertTrue($ned->canRead($ned));
	$this->assertTrue($ned->canRead($john));
	$this->assertTrue($ned->canRead($jack));
	$this->assertTrue($ned->canRead($domain));
	$this->assertTrue($ned->canRead($domain->wallet()));
	$this->assertFalse($ned->canRead($reseller1));
	$this->assertFalse($ned->canRead($reseller2));
	$this->assertFalse($ned->canRead($admin));
	}

	/**
	* Test User::canUpdate() method
	*/
	public function testCanUpdate(): void
	{
	$john = $this->getTestUser('john@kolab.org');
	$ned = $this->getTestUser('ned@kolab.org');
	$jack = $this->getTestUser('jack@kolab.org');
	- $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	- $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
	+ $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	$domain = $this->getTestDomain('kolab.org');

	// Admin
	$this->assertTrue($admin->canUpdate($admin));
	$this->assertTrue($admin->canUpdate($john));
	$this->assertTrue($admin->canUpdate($jack));
	$this->assertTrue($admin->canUpdate($reseller1));
	$this->assertTrue($admin->canUpdate($reseller2));
	$this->assertTrue($admin->canUpdate($domain));
	$this->assertTrue($admin->canUpdate($domain->wallet()));

	// Reseller - kolabnow
	$this->assertTrue($reseller1->canUpdate($john));
	$this->assertTrue($reseller1->canUpdate($jack));
	$this->assertTrue($reseller1->canUpdate($reseller1));
	$this->assertTrue($reseller1->canUpdate($domain));
	$this->assertTrue($reseller1->canUpdate($domain->wallet()));
	$this->assertFalse($reseller1->canUpdate($reseller2));
	$this->assertFalse($reseller1->canUpdate($admin));

	// Reseller - different tenant
	$this->assertTrue($reseller2->canUpdate($reseller2));
	$this->assertFalse($reseller2->canUpdate($john));
	$this->assertFalse($reseller2->canUpdate($jack));
	$this->assertFalse($reseller2->canUpdate($reseller1));
	$this->assertFalse($reseller2->canUpdate($domain));
	$this->assertFalse($reseller2->canUpdate($domain->wallet()));
	$this->assertFalse($reseller2->canUpdate($admin));

	// Normal user - account owner
	$this->assertTrue($john->canUpdate($john));
	$this->assertTrue($john->canUpdate($ned));
	$this->assertTrue($john->canUpdate($jack));
	$this->assertTrue($john->canUpdate($domain));
	$this->assertFalse($john->canUpdate($domain->wallet()));
	$this->assertFalse($john->canUpdate($reseller1));
	$this->assertFalse($john->canUpdate($reseller2));
	$this->assertFalse($john->canUpdate($admin));

	// Normal user - a non-owner and non-controller
	$this->assertTrue($jack->canUpdate($jack));
	$this->assertFalse($jack->canUpdate($john));
	$this->assertFalse($jack->canUpdate($domain));
	$this->assertFalse($jack->canUpdate($domain->wallet()));
	$this->assertFalse($jack->canUpdate($reseller1));
	$this->assertFalse($jack->canUpdate($reseller2));
	$this->assertFalse($jack->canUpdate($admin));

	// Normal user - John's wallet controller
	$this->assertTrue($ned->canUpdate($ned));
	$this->assertTrue($ned->canUpdate($john));
	$this->assertTrue($ned->canUpdate($jack));
	$this->assertTrue($ned->canUpdate($domain));
	$this->assertFalse($ned->canUpdate($domain->wallet()));
	$this->assertFalse($ned->canUpdate($reseller1));
	$this->assertFalse($ned->canUpdate($reseller2));
	$this->assertFalse($ned->canUpdate($admin));
	}

	/**
	* Test user create/creating observer
	*/
	public function testCreate(): void
	{
	Queue::fake();

	$domain = \config('app.domain');

	$user = User::create(['email' => 'USER-test@' . \strtoupper($domain)]);

	$result = User::where('email', 'user-test@' . $domain)->first();

	$this->assertSame('user-test@' . $domain, $result->email);
	$this->assertSame($user->id, $result->id);
	$this->assertSame(User::STATUS_NEW \| User::STATUS_ACTIVE, $result->status);
	}

	/**
	* Verify user creation process
	*/
	public function testCreateJobs(): void
	{
	// Fake the queue, assert that no jobs were pushed...
	Queue::fake();
	Queue::assertNothingPushed();

	$user = User::create([
	'email' => 'user-test@' . \config('app.domain')
	]);

	Queue::assertPushed(\App\Jobs\User\CreateJob::class, 1);

	Queue::assertPushed(
	\App\Jobs\User\CreateJob::class,
	function ($job) use ($user) {
	$userEmail = TestCase::getObjectProperty($job, 'userEmail');
	$userId = TestCase::getObjectProperty($job, 'userId');

	return $userEmail === $user->email
	&& $userId === $user->id;
	}
	);

	Queue::assertPushedWithChain(
	\App\Jobs\User\CreateJob::class,
	[
	\App\Jobs\User\VerifyJob::class,
	]
	);
	/*
	FIXME: Looks like we can't really do detailed assertions on chained jobs
	Another thing to consider is if we maybe should run these jobs
	independently (not chained) and make sure there's no race-condition
	in status update

	Queue::assertPushed(\App\Jobs\User\VerifyJob::class, 1);
	Queue::assertPushed(\App\Jobs\User\VerifyJob::class, function ($job) use ($user) {
	$userEmail = TestCase::getObjectProperty($job, 'userEmail');
	$userId = TestCase::getObjectProperty($job, 'userId');

	return $userEmail === $user->email
	&& $userId === $user->id;
	});
	*/
	}

	/**
	* Tests for User::domains()
	*/
	public function testDomains(): void
	{
	$user = $this->getTestUser('john@kolab.org');
	+
	$domain = $this->getTestDomain('useraccount.com', [
	'status' => Domain::STATUS_NEW \| Domain::STATUS_ACTIVE,
	'type' => Domain::TYPE_PUBLIC,
	]);

	$domains = collect($user->domains())->pluck('namespace')->all();

	$this->assertContains($domain->namespace, $domains);
	$this->assertContains('kolab.org', $domains);

	// Jack is not the wallet controller, so for him the list should not
	// include John's domains, kolab.org specifically
	$user = $this->getTestUser('jack@kolab.org');

	$domains = collect($user->domains())->pluck('namespace')->all();

	$this->assertContains($domain->namespace, $domains);
	$this->assertNotContains('kolab.org', $domains);

	// Public domains of other tenants should not be returned
	- $domain->tenant_id = 2;
	+ $tenant = \App\Tenant::where('id', '!=', \config('app.tenant_id'))->first();
	+ $domain->tenant_id = $tenant->id;
	$domain->save();

	$domains = collect($user->domains())->pluck('namespace')->all();

	$this->assertNotContains($domain->namespace, $domains);
	}

	+ /**
	+ * Test User::hasSku() method
	+ */
	+ public function testHasSku(): void
	+ {
	+ $john = $this->getTestUser('john@kolab.org');
	+
	+ $this->assertTrue($john->hasSku('mailbox'));
	+ $this->assertTrue($john->hasSku('storage'));
	+ $this->assertFalse($john->hasSku('beta'));
	+ $this->assertFalse($john->hasSku('unknown'));
	+ }
	+
	public function testUserQuota(): void
	{
	// TODO: This test does not test much, probably could be removed
	// or moved to somewhere else, or extended with
	// other entitlements() related cases.

	$user = $this->getTestUser('john@kolab.org');
	- $storage_sku = \App\Sku::where('title', 'storage')->first();
	+ $storage_sku = \App\Sku::withEnvTenantContext()->where('title', 'storage')->first();

	$count = 0;

	foreach ($user->entitlements()->get() as $entitlement) {
	if ($entitlement->sku_id == $storage_sku->id) {
	$count += 1;
	}
	}

	- $this->assertTrue($count == 2);
	+ $this->assertTrue($count == 5);
	}

	/**
	* Test user deletion
	*/
	public function testDelete(): void
	{
	Queue::fake();

	$user = $this->getTestUser('user-test@' . \config('app.domain'));
	- $package = \App\Package::where('title', 'kolab')->first();
	+ $package = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
	$user->assignPackage($package);

	$id = $user->id;

	- $this->assertCount(4, $user->entitlements()->get());
	+ $this->assertCount(7, $user->entitlements()->get());

	$user->delete();

	$this->assertCount(0, $user->entitlements()->get());
	$this->assertTrue($user->fresh()->trashed());
	$this->assertFalse($user->fresh()->isDeleted());

	// Delete the user for real
	$job = new \App\Jobs\User\DeleteJob($id);
	$job->handle();

	$this->assertTrue(User::withTrashed()->where('id', $id)->first()->isDeleted());

	$user->forceDelete();

	$this->assertCount(0, User::withTrashed()->where('id', $id)->get());

	// Test an account with users, domain, and group
	$userA = $this->getTestUser('UserAccountA@UserAccount.com');
	$userB = $this->getTestUser('UserAccountB@UserAccount.com');
	$userC = $this->getTestUser('UserAccountC@UserAccount.com');
	- $package_kolab = \App\Package::where('title', 'kolab')->first();
	- $package_domain = \App\Package::where('title', 'domain-hosting')->first();
	+ $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
	+ $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
	$domain = $this->getTestDomain('UserAccount.com', [
	'status' => Domain::STATUS_NEW,
	'type' => Domain::TYPE_HOSTED,
	]);
	$userA->assignPackage($package_kolab);
	$domain->assignPackage($package_domain, $userA);
	$userA->assignPackage($package_kolab, $userB);
	$userA->assignPackage($package_kolab, $userC);
	$group = $this->getTestGroup('test-group@UserAccount.com');
	$group->assignToWallet($userA->wallets->first());

	$entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
	$entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
	$entitlementsC = \App\Entitlement::where('entitleable_id', $userC->id);
	$entitlementsDomain = \App\Entitlement::where('entitleable_id', $domain->id);
	$entitlementsGroup = \App\Entitlement::where('entitleable_id', $group->id);

	- $this->assertSame(4, $entitlementsA->count());
	- $this->assertSame(4, $entitlementsB->count());
	- $this->assertSame(4, $entitlementsC->count());
	+ $this->assertSame(7, $entitlementsA->count());
	+ $this->assertSame(7, $entitlementsB->count());
	+ $this->assertSame(7, $entitlementsC->count());
	$this->assertSame(1, $entitlementsDomain->count());
	$this->assertSame(1, $entitlementsGroup->count());

	// Delete non-controller user
	$userC->delete();

	$this->assertTrue($userC->fresh()->trashed());
	$this->assertFalse($userC->fresh()->isDeleted());
	$this->assertSame(0, $entitlementsC->count());

	// Delete the controller (and expect "sub"-users to be deleted too)
	$userA->delete();

	$this->assertSame(0, $entitlementsA->count());
	$this->assertSame(0, $entitlementsB->count());
	$this->assertSame(0, $entitlementsDomain->count());
	$this->assertSame(0, $entitlementsGroup->count());
	$this->assertTrue($userA->fresh()->trashed());
	$this->assertTrue($userB->fresh()->trashed());
	$this->assertTrue($domain->fresh()->trashed());
	$this->assertTrue($group->fresh()->trashed());
	$this->assertFalse($userA->isDeleted());
	$this->assertFalse($userB->isDeleted());
	$this->assertFalse($domain->isDeleted());
	$this->assertFalse($group->isDeleted());

	$userA->forceDelete();

	$all_entitlements = \App\Entitlement::where('wallet_id', $userA->wallets->first()->id);

	$this->assertSame(0, $all_entitlements->withTrashed()->count());
	$this->assertCount(0, User::withTrashed()->where('id', $userA->id)->get());
	$this->assertCount(0, User::withTrashed()->where('id', $userB->id)->get());
	$this->assertCount(0, User::withTrashed()->where('id', $userC->id)->get());
	$this->assertCount(0, Domain::withTrashed()->where('id', $domain->id)->get());
	$this->assertCount(0, Group::withTrashed()->where('id', $group->id)->get());
	}

	/**
	* Test user deletion vs. group membership
	*/
	public function testDeleteAndGroups(): void
	{
	Queue::fake();

	- $package_kolab = \App\Package::where('title', 'kolab')->first();
	+ $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
	$userA = $this->getTestUser('UserAccountA@UserAccount.com');
	$userB = $this->getTestUser('UserAccountB@UserAccount.com');
	$userA->assignPackage($package_kolab, $userB);
	$group = $this->getTestGroup('test-group@UserAccount.com');
	$group->members = ['test@gmail.com', $userB->email];
	$group->assignToWallet($userA->wallets->first());
	$group->save();

	Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 1);

	$userGroups = $userA->groups()->get();
	$this->assertSame(1, $userGroups->count());
	$this->assertSame($group->id, $userGroups->first()->id);

	$userB->delete();

	$this->assertSame(['test@gmail.com'], $group->fresh()->members);

	// Twice, one for save() and one for delete() above
	Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 2);
	}

	/**
	* Test handling negative balance on user deletion
	*/
	public function testDeleteWithNegativeBalance(): void
	{
	$user = $this->getTestUser('user-test@' . \config('app.domain'));
	$wallet = $user->wallets()->first();
	$wallet->balance = -1000;
	$wallet->save();
	$reseller_wallet = $user->tenant->wallet();
	$reseller_wallet->balance = 0;
	$reseller_wallet->save();
	\App\Transaction::where('object_id', $reseller_wallet->id)->where('object_type', \App\Wallet::class)->delete();

	$user->delete();

	$reseller_transactions = \App\Transaction::where('object_id', $reseller_wallet->id)
	->where('object_type', \App\Wallet::class)->get();

	$this->assertSame(-1000, $reseller_wallet->fresh()->balance);
	$this->assertCount(1, $reseller_transactions);
	$trans = $reseller_transactions[0];
	$this->assertSame("Deleted user {$user->email}", $trans->description);
	$this->assertSame(-1000, $trans->amount);
	$this->assertSame(\App\Transaction::WALLET_DEBIT, $trans->type);
	}

	/**
	* Test handling positive balance on user deletion
	*/
	public function testDeleteWithPositiveBalance(): void
	{
	$user = $this->getTestUser('user-test@' . \config('app.domain'));
	$wallet = $user->wallets()->first();
	$wallet->balance = 1000;
	$wallet->save();
	$reseller_wallet = $user->tenant->wallet();
	$reseller_wallet->balance = 0;
	$reseller_wallet->save();

	$user->delete();

	$this->assertSame(0, $reseller_wallet->fresh()->balance);
	}

	/**
	* Tests for User::aliasExists()
	*/
	public function testAliasExists(): void
	{
	$this->assertTrue(User::aliasExists('jack.daniels@kolab.org'));

	$this->assertFalse(User::aliasExists('j.daniels@kolab.org'));
	$this->assertFalse(User::aliasExists('john@kolab.org'));
	}

	/**
	* Tests for User::emailExists()
	*/
	public function testEmailExists(): void
	{
	$this->assertFalse(User::emailExists('jack.daniels@kolab.org'));
	$this->assertFalse(User::emailExists('j.daniels@kolab.org'));

	$this->assertTrue(User::emailExists('john@kolab.org'));
	$user = User::emailExists('john@kolab.org', true);
	$this->assertSame('john@kolab.org', $user->email);
	}

	/**
	* Tests for User::findByEmail()
	*/
	public function testFindByEmail(): void
	{
	$user = $this->getTestUser('john@kolab.org');

	$result = User::findByEmail('john');
	$this->assertNull($result);

	$result = User::findByEmail('non-existing@email.com');
	$this->assertNull($result);

	$result = User::findByEmail('john@kolab.org');
	$this->assertInstanceOf(User::class, $result);
	$this->assertSame($user->id, $result->id);

	// Use an alias
	$result = User::findByEmail('john.doe@kolab.org');
	$this->assertInstanceOf(User::class, $result);
	$this->assertSame($user->id, $result->id);

	// A case where two users have the same alias
	$ned = $this->getTestUser('ned@kolab.org');
	$ned->setAliases(['joe.monster@kolab.org']);
	$result = User::findByEmail('joe.monster@kolab.org');
	$this->assertNull($result);
	$ned->setAliases([]);

	// TODO: searching by external email (setting)
	$this->markTestIncomplete();
	}

	/**
	* Test User::name()
	*/
	public function testName(): void
	{
	Queue::fake();

	$user = $this->getTestUser('user-test@' . \config('app.domain'));

	$this->assertSame('', $user->name());
	$this->assertSame(\config('app.name') . ' User', $user->name(true));

	$user->setSetting('first_name', 'First');

	$this->assertSame('First', $user->name());
	$this->assertSame('First', $user->name(true));

	$user->setSetting('last_name', 'Last');

	$this->assertSame('First Last', $user->name());
	$this->assertSame('First Last', $user->name(true));
	}

	/**
	* Test user restoring
	*/
	public function testRestore(): void
	{
	Queue::fake();

	// Test an account with users and domain
	$userA = $this->getTestUser('UserAccountA@UserAccount.com', [
	'status' => User::STATUS_LDAP_READY \| User::STATUS_IMAP_READY \| User::STATUS_SUSPENDED,
	]);
	$userB = $this->getTestUser('UserAccountB@UserAccount.com');
	- $package_kolab = \App\Package::where('title', 'kolab')->first();
	- $package_domain = \App\Package::where('title', 'domain-hosting')->first();
	+ $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
	+ $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
	$domainA = $this->getTestDomain('UserAccount.com', [
	'status' => Domain::STATUS_NEW,
	'type' => Domain::TYPE_HOSTED,
	]);
	$domainB = $this->getTestDomain('UserAccountAdd.com', [
	'status' => Domain::STATUS_NEW,
	'type' => Domain::TYPE_HOSTED,
	]);
	$userA->assignPackage($package_kolab);
	$domainA->assignPackage($package_domain, $userA);
	$domainB->assignPackage($package_domain, $userA);
	$userA->assignPackage($package_kolab, $userB);

	- $storage_sku = \App\Sku::where('title', 'storage')->first();
	+ $storage_sku = \App\Sku::withEnvTenantContext()->where('title', 'storage')->first();
	$now = \Carbon\Carbon::now();
	$wallet_id = $userA->wallets->first()->id;

	// add an extra storage entitlement
	$ent1 = \App\Entitlement::create([
	'wallet_id' => $wallet_id,
	'sku_id' => $storage_sku->id,
	'cost' => 0,
	'entitleable_id' => $userA->id,
	'entitleable_type' => User::class,
	]);

	$entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
	$entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
	$entitlementsDomain = \App\Entitlement::where('entitleable_id', $domainA->id);

	// First delete the user
	$userA->delete();

	$this->assertSame(0, $entitlementsA->count());
	$this->assertSame(0, $entitlementsB->count());
	$this->assertSame(0, $entitlementsDomain->count());
	$this->assertTrue($userA->fresh()->trashed());
	$this->assertTrue($userB->fresh()->trashed());
	$this->assertTrue($domainA->fresh()->trashed());
	$this->assertTrue($domainB->fresh()->trashed());
	$this->assertFalse($userA->isDeleted());
	$this->assertFalse($userB->isDeleted());
	$this->assertFalse($domainA->isDeleted());

	// Backdate one storage entitlement (it's not expected to be restored)
	\App\Entitlement::withTrashed()->where('id', $ent1->id)
	->update(['deleted_at' => $now->copy()->subMinutes(2)]);

	// Backdate entitlements to assert that they were restored with proper updated_at timestamp
	\App\Entitlement::withTrashed()->where('wallet_id', $wallet_id)
	->update(['updated_at' => $now->subMinutes(10)]);

	Queue::fake();

	// Then restore it
	$userA->restore();
	$userA->refresh();

	$this->assertFalse($userA->trashed());
	$this->assertFalse($userA->isDeleted());
	$this->assertFalse($userA->isSuspended());
	$this->assertFalse($userA->isLdapReady());
	$this->assertFalse($userA->isImapReady());
	$this->assertTrue($userA->isActive());

	$this->assertTrue($userB->fresh()->trashed());
	$this->assertTrue($domainB->fresh()->trashed());
	$this->assertFalse($domainA->fresh()->trashed());

	// Assert entitlements
	- $this->assertSame(4, $entitlementsA->count()); // mailbox + groupware + 2 x storage
	+ $this->assertSame(7, $entitlementsA->count()); // mailbox + groupware + 5 x storage
	$this->assertTrue($ent1->fresh()->trashed());
	$entitlementsA->get()->each(function ($ent) {
	$this->assertTrue($ent->updated_at->greaterThan(\Carbon\Carbon::now()->subSeconds(5)));
	});

	// We expect only CreateJob + UpdateJob pair for both user and domain.
	// Because how Illuminate/Database/Eloquent/SoftDeletes::restore() method
	// is implemented we cannot skip the UpdateJob in any way.
	// I don't want to overwrite this method, the extra job shouldn't do any harm.
	$this->assertCount(4, Queue::pushedJobs()); // @phpstan-ignore-line
	Queue::assertPushed(\App\Jobs\Domain\UpdateJob::class, 1);
	Queue::assertPushed(\App\Jobs\Domain\CreateJob::class, 1);
	Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
	Queue::assertPushed(\App\Jobs\User\CreateJob::class, 1);
	Queue::assertPushed(
	\App\Jobs\User\CreateJob::class,
	function ($job) use ($userA) {
	return $userA->id === TestCase::getObjectProperty($job, 'userId');
	}
	);
	Queue::assertPushedWithChain(
	\App\Jobs\User\CreateJob::class,
	[
	\App\Jobs\User\VerifyJob::class,
	]
	);
	}

	/**
	* Tests for UserAliasesTrait::setAliases()
	*/
	public function testSetAliases(): void
	{
	Queue::fake();
	Queue::assertNothingPushed();

	$user = $this->getTestUser('UserAccountA@UserAccount.com');
	$domain = $this->getTestDomain('UserAccount.com', [
	'status' => Domain::STATUS_NEW,
	'type' => Domain::TYPE_HOSTED,
	]);

	$this->assertCount(0, $user->aliases->all());

	// Add an alias
	$user->setAliases(['UserAlias1@UserAccount.com']);

	Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);

	$aliases = $user->aliases()->get();
	$this->assertCount(1, $aliases);
	$this->assertSame('useralias1@useraccount.com', $aliases[0]['alias']);

	// Add another alias
	$user->setAliases(['UserAlias1@UserAccount.com', 'UserAlias2@UserAccount.com']);

	Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 2);

	$aliases = $user->aliases()->orderBy('alias')->get();
	$this->assertCount(2, $aliases);
	$this->assertSame('useralias1@useraccount.com', $aliases[0]->alias);
	$this->assertSame('useralias2@useraccount.com', $aliases[1]->alias);

	// Remove an alias
	$user->setAliases(['UserAlias1@UserAccount.com']);

	Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 3);

	$aliases = $user->aliases()->get();
	$this->assertCount(1, $aliases);
	$this->assertSame('useralias1@useraccount.com', $aliases[0]['alias']);

	// Remove all aliases
	$user->setAliases([]);

	Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 4);

	$this->assertCount(0, $user->aliases()->get());
	}

	/**
	* Tests for UserSettingsTrait::setSettings() and getSetting()
	*/
	public function testUserSettings(): void
	{
	Queue::fake();
	Queue::assertNothingPushed();

	$user = $this->getTestUser('UserAccountA@UserAccount.com');

	Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 0);

	// Test default settings
	// Note: Technicly this tests UserObserver::created() behavior
	$all_settings = $user->settings()->orderBy('key')->get();
	$this->assertCount(2, $all_settings);
	$this->assertSame('country', $all_settings[0]->key);
	$this->assertSame('CH', $all_settings[0]->value);
	$this->assertSame('currency', $all_settings[1]->key);
	$this->assertSame('CHF', $all_settings[1]->value);

	// Add a setting
	$user->setSetting('first_name', 'Firstname');

	Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);

	// Note: We test both current user as well as fresh user object
	// to make sure cache works as expected
	$this->assertSame('Firstname', $user->getSetting('first_name'));
	$this->assertSame('Firstname', $user->fresh()->getSetting('first_name'));

	// Update a setting
	$user->setSetting('first_name', 'Firstname1');

	Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 2);

	// Note: We test both current user as well as fresh user object
	// to make sure cache works as expected
	$this->assertSame('Firstname1', $user->getSetting('first_name'));
	$this->assertSame('Firstname1', $user->fresh()->getSetting('first_name'));

	// Delete a setting (null)
	$user->setSetting('first_name', null);

	Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 3);

	// Note: We test both current user as well as fresh user object
	// to make sure cache works as expected
	$this->assertSame(null, $user->getSetting('first_name'));
	$this->assertSame(null, $user->fresh()->getSetting('first_name'));

	// Delete a setting (empty string)
	$user->setSetting('first_name', 'Firstname1');
	$user->setSetting('first_name', '');

	Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 5);

	// Note: We test both current user as well as fresh user object
	// to make sure cache works as expected
	$this->assertSame(null, $user->getSetting('first_name'));
	$this->assertSame(null, $user->fresh()->getSetting('first_name'));

	// Set multiple settings at once
	$user->setSettings([
	'first_name' => 'Firstname2',
	'last_name' => 'Lastname2',
	'country' => null,
	]);

	// TODO: This really should create a single UserUpdate job, not 3
	Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 7);

	// Note: We test both current user as well as fresh user object
	// to make sure cache works as expected
	$this->assertSame('Firstname2', $user->getSetting('first_name'));
	$this->assertSame('Firstname2', $user->fresh()->getSetting('first_name'));
	$this->assertSame('Lastname2', $user->getSetting('last_name'));
	$this->assertSame('Lastname2', $user->fresh()->getSetting('last_name'));
	$this->assertSame(null, $user->getSetting('country'));
	$this->assertSame(null, $user->fresh()->getSetting('country'));

	$all_settings = $user->settings()->orderBy('key')->get();
	$this->assertCount(3, $all_settings);
	}

	/**
	* Tests for User::users()
	*/
	public function testUsers(): void
	{
	$jack = $this->getTestUser('jack@kolab.org');
	$joe = $this->getTestUser('joe@kolab.org');
	$john = $this->getTestUser('john@kolab.org');
	$ned = $this->getTestUser('ned@kolab.org');
	$wallet = $john->wallets()->first();

	$users = $john->users()->orderBy('email')->get();

	$this->assertCount(4, $users);
	$this->assertEquals($jack->id, $users[0]->id);
	$this->assertEquals($joe->id, $users[1]->id);
	$this->assertEquals($john->id, $users[2]->id);
	$this->assertEquals($ned->id, $users[3]->id);
	$this->assertSame($wallet->id, $users[0]->wallet_id);
	$this->assertSame($wallet->id, $users[1]->wallet_id);
	$this->assertSame($wallet->id, $users[2]->wallet_id);
	$this->assertSame($wallet->id, $users[3]->wallet_id);

	$users = $jack->users()->orderBy('email')->get();

	$this->assertCount(0, $users);

	$users = $ned->users()->orderBy('email')->get();

	$this->assertCount(4, $users);
	}

	public function testWallets(): void
	{
	$this->markTestIncomplete();
	}
	}
	diff --git a/src/tests/Feature/WalletTest.php b/src/tests/Feature/WalletTest.php
	index f83b584d..119977f4 100644
	--- a/src/tests/Feature/WalletTest.php
	+++ b/src/tests/Feature/WalletTest.php
	@@ -1,398 +1,406 @@
	<?php

	namespace Tests\Feature;

	use App\Package;
	use App\User;
	use App\Sku;
	use App\Transaction;
	use App\Wallet;
	use Carbon\Carbon;
	use Illuminate\Support\Facades\DB;
	use Tests\TestCase;

	class WalletTest extends TestCase
	{
	private $users = [
	'UserWallet1@UserWallet.com',
	'UserWallet2@UserWallet.com',
	'UserWallet3@UserWallet.com',
	'UserWallet4@UserWallet.com',
	'UserWallet5@UserWallet.com',
	'WalletControllerA@WalletController.com',
	'WalletControllerB@WalletController.com',
	'WalletController2A@WalletController.com',
	'WalletController2B@WalletController.com',
	'jane@kolabnow.com'
	];

	public function setUp(): void
	{
	parent::setUp();

	foreach ($this->users as $user) {
	$this->deleteTestUser($user);
	}
	}

	public function tearDown(): void
	{
	foreach ($this->users as $user) {
	$this->deleteTestUser($user);
	}

	Sku::select()->update(['fee' => 0]);

	parent::tearDown();
	}

	/**
	* Test that turning wallet balance from negative to positive
	* unsuspends the account
	*/
	public function testBalancePositiveUnsuspend(): void
	{
	$user = $this->getTestUser('UserWallet1@UserWallet.com');
	$user->suspend();

	$wallet = $user->wallets()->first();
	$wallet->balance = -100;
	$wallet->save();

	$this->assertTrue($user->isSuspended());
	$this->assertNotNull($wallet->getSetting('balance_negative_since'));

	$wallet->balance = 100;
	$wallet->save();

	$this->assertFalse($user->fresh()->isSuspended());
	$this->assertNull($wallet->getSetting('balance_negative_since'));

	// TODO: Test group account and unsuspending domain/members
	}

	/**
	* Test for Wallet::balanceLastsUntil()
	*/
	public function testBalanceLastsUntil(): void
	{
	- // Monthly cost of all entitlements: 999
	- // 28 days: 35.68 per day
	- // 31 days: 32.22 per day
	+ // Monthly cost of all entitlements: 990
	+ // 28 days: 35.36 per day
	+ // 31 days: 31.93 per day

	$user = $this->getTestUser('jane@kolabnow.com');
	- $package = Package::where('title', 'kolab')->first();
	+ $package = Package::withEnvTenantContext()->where('title', 'kolab')->first();
	$user->assignPackage($package);
	$wallet = $user->wallets()->first();

	// User/entitlements created today, balance=0
	$until = $wallet->balanceLastsUntil();

	$this->assertSame(
	Carbon::now()->addMonthsWithoutOverflow(1)->toDateString(),
	$until->toDateString()
	);

	// User/entitlements created today, balance=-10 CHF
	$wallet->balance = -1000;
	$until = $wallet->balanceLastsUntil();

	$this->assertSame(null, $until);

	// User/entitlements created today, balance=-9,99 CHF (monthly cost)
	- $wallet->balance = 999;
	+ $wallet->balance = 990;
	$until = $wallet->balanceLastsUntil();

	$daysInLastMonth = \App\Utils::daysInLastMonth();

	- $this->assertSame(
	- Carbon::now()->addMonthsWithoutOverflow(1)->addDays($daysInLastMonth)->toDateString(),
	- $until->toDateString()
	- );
	+ $delta = Carbon::now()->addMonthsWithoutOverflow(1)->addDays($daysInLastMonth)->diff($until)->days;
	+
	+ $this->assertTrue($delta <= 1);
	+ $this->assertTrue($delta >= -1);

	// Old entitlements, 100% discount
	$this->backdateEntitlements($wallet->entitlements, Carbon::now()->subDays(40));
	- $discount = \App\Discount::where('discount', 100)->first();
	+ $discount = \App\Discount::withEnvTenantContext()->where('discount', 100)->first();
	$wallet->discount()->associate($discount);

	$until = $wallet->refresh()->balanceLastsUntil();

	$this->assertSame(null, $until);

	// User with no entitlements
	$wallet->discount()->dissociate($discount);
	$wallet->entitlements()->delete();

	$until = $wallet->refresh()->balanceLastsUntil();

	$this->assertSame(null, $until);
	}

	/**
	* Test for Wallet::costsPerDay()
	*/
	public function testCostsPerDay(): void
	{
	- // 999
	- // 28 days: 35.68
	- // 31 days: 32.22
	+ // 990
	+ // 28 days: 35.36
	+ // 31 days: 31.93
	$user = $this->getTestUser('jane@kolabnow.com');

	- $package = Package::where('title', 'kolab')->first();
	- $mailbox = Sku::where('title', 'mailbox')->first();
	+ $package = Package::withEnvTenantContext()->where('title', 'kolab')->first();
	+ $mailbox = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();

	$user->assignPackage($package);

	$wallet = $user->wallets()->first();

	$costsPerDay = $wallet->costsPerDay();

	- $this->assertTrue($costsPerDay < 35.68);
	- $this->assertTrue($costsPerDay > 32.22);
	+ $this->assertTrue($costsPerDay < 35.38);
	+ $this->assertTrue($costsPerDay > 31.93);
	}

	/**
	* Verify a wallet is created, when a user is created.
	*/
	public function testCreateUserCreatesWallet(): void
	{
	$user = $this->getTestUser('UserWallet1@UserWallet.com');

	$this->assertCount(1, $user->wallets);
	}

	/**
	* Verify a user can haz more wallets.
	*/
	public function testAddWallet(): void
	{
	$user = $this->getTestUser('UserWallet2@UserWallet.com');

	$user->wallets()->save(
	new Wallet(['currency' => 'USD'])
	);

	$this->assertCount(2, $user->wallets);

	$user->wallets()->each(
	function ($wallet) {
	$this->assertEquals(0, $wallet->balance);
	}
	);
	}

	/**
	* Verify we can not delete a user wallet that holds balance.
	*/
	public function testDeleteWalletWithCredit(): void
	{
	$user = $this->getTestUser('UserWallet3@UserWallet.com');

	$user->wallets()->each(
	function ($wallet) {
	$wallet->credit(100)->save();
	}
	);

	$user->wallets()->each(
	function ($wallet) {
	$this->assertFalse($wallet->delete());
	}
	);
	}

	/**
	* Verify we can not delete a wallet that is the last wallet.
	*/
	public function testDeleteLastWallet(): void
	{
	$user = $this->getTestUser('UserWallet4@UserWallet.com');

	$this->assertCount(1, $user->wallets);

	$user->wallets()->each(
	function ($wallet) {
	$this->assertFalse($wallet->delete());
	}
	);
	}

	/**
	* Verify we can remove a wallet that is an additional wallet.
	*/
	public function testDeleteAddtWallet(): void
	{
	$user = $this->getTestUser('UserWallet5@UserWallet.com');

	$user->wallets()->save(
	new Wallet(['currency' => 'USD'])
	);

	$user->wallets()->each(
	function ($wallet) {
	if ($wallet->currency == 'USD') {
	$this->assertNotFalse($wallet->delete());
	}
	}
	);
	}

	/**
	* Verify a wallet can be assigned a controller.
	*/
	public function testAddWalletController(): void
	{
	$userA = $this->getTestUser('WalletControllerA@WalletController.com');
	$userB = $this->getTestUser('WalletControllerB@WalletController.com');

	$userA->wallets()->each(
	function ($wallet) use ($userB) {
	$wallet->addController($userB);
	}
	);

	$this->assertCount(1, $userB->accounts);

	$aWallet = $userA->wallets()->first();
	$bAccount = $userB->accounts()->first();

	$this->assertTrue($bAccount->id === $aWallet->id);
	}

	/**
	* Verify controllers can also be removed from wallets.
	*/
	public function testRemoveWalletController(): void
	{
	$userA = $this->getTestUser('WalletController2A@WalletController.com');
	$userB = $this->getTestUser('WalletController2B@WalletController.com');

	$userA->wallets()->each(
	function ($wallet) use ($userB) {
	$wallet->addController($userB);
	}
	);

	$userB->refresh();

	$userB->accounts()->each(
	function ($wallet) use ($userB) {
	$wallet->removeController($userB);
	}
	);

	$this->assertCount(0, $userB->accounts);
	}

	/**
	* Test for charging and removing entitlements (including tenant commission calculations)
	*/
	public function testChargeAndDeleteEntitlements(): void
	{
	$user = $this->getTestUser('jane@kolabnow.com');
	$wallet = $user->wallets()->first();
	- $discount = \App\Discount::where('discount', 30)->first();
	+ $discount = \App\Discount::withEnvTenantContext()->where('discount', 30)->first();
	$wallet->discount()->associate($discount);
	$wallet->save();

	// Add 40% fee to all SKUs
	Sku::select()->update(['fee' => DB::raw("`cost` * 0.4")]);

	- $package = Package::where('title', 'kolab')->first();
	- $storage = Sku::where('title', 'storage')->first();
	+ $package = Package::withEnvTenantContext()->where('title', 'kolab')->first();
	+ $storage = Sku::withEnvTenantContext()->where('title', 'storage')->first();
	$user->assignPackage($package);
	- $user->assignSku($storage, 2);
	+ $user->assignSku($storage, 5);
	$user->refresh();

	// Reset reseller's wallet balance and transactions
	$reseller_wallet = $user->tenant->wallet();
	$reseller_wallet->balance = 0;
	$reseller_wallet->save();
	Transaction::where('object_id', $reseller_wallet->id)->where('object_type', \App\Wallet::class)->delete();

	// ------------------------------------
	// Test normal charging of entitlements
	// ------------------------------------

	- // Backdate and chanrge entitlements, we're expecting one month to be charged
	+ // Backdate and charge entitlements, we're expecting one month to be charged
	// Set fake NOW date to make simpler asserting results that depend on number of days in current/last month
	Carbon::setTestNow(Carbon::create(2021, 5, 21, 12));
	$backdate = Carbon::now()->subWeeks(7);
	$this->backdateEntitlements($user->entitlements, $backdate);
	$charge = $wallet->chargeEntitlements();
	$wallet->refresh();
	$reseller_wallet->refresh();

	+ // TODO: Update these comments with what is actually being used to calculate these numbers
	// 388 + 310 + 17 + 17 = 732
	- $this->assertSame(-732, $wallet->balance);
	+ $this->assertSame(-778, $wallet->balance);
	// 388 - 555 x 40% + 310 - 444 x 40% + 34 - 50 x 40% = 312
	- $this->assertSame(312, $reseller_wallet->balance);
	+ $this->assertSame(332, $reseller_wallet->balance);

	$transactions = Transaction::where('object_id', $wallet->id)
	->where('object_type', \App\Wallet::class)->get();
	+
	$reseller_transactions = Transaction::where('object_id', $reseller_wallet->id)
	->where('object_type', \App\Wallet::class)->get();

	$this->assertCount(1, $reseller_transactions);
	$trans = $reseller_transactions[0];
	$this->assertSame("Charged user jane@kolabnow.com", $trans->description);
	- $this->assertSame(312, $trans->amount);
	+ $this->assertSame(332, $trans->amount);
	$this->assertSame(Transaction::WALLET_CREDIT, $trans->type);

	$this->assertCount(1, $transactions);
	$trans = $transactions[0];
	$this->assertSame('', $trans->description);
	- $this->assertSame(-732, $trans->amount);
	+ $this->assertSame(-778, $trans->amount);
	$this->assertSame(Transaction::WALLET_DEBIT, $trans->type);

	// TODO: Test entitlement transaction records

	// -----------------------------------
	// Test charging on entitlement delete
	// -----------------------------------

	+ $reseller_wallet->balance = 0;
	+ $reseller_wallet->save();
	+
	$transactions = Transaction::where('object_id', $wallet->id)
	->where('object_type', \App\Wallet::class)->delete();
	+
	$reseller_transactions = Transaction::where('object_id', $reseller_wallet->id)
	->where('object_type', \App\Wallet::class)->delete();

	$user->removeSku($storage, 2);

	// we expect the wallet to have been charged for 19 days of use of
	// 2 deleted storage entitlements
	$wallet->refresh();
	$reseller_wallet->refresh();

	// 2 x round(25 / 31 * 19 * 0.7) = 22
	- $this->assertSame(-(732 + 22), $wallet->balance);
	+ $this->assertSame(-(778 + 22), $wallet->balance);
	// 22 - 2 x round(25 * 0.4 / 31 * 19) = 10
	- $this->assertSame(312 + 10, $reseller_wallet->balance);
	+ $this->assertSame(10, $reseller_wallet->balance);

	$transactions = Transaction::where('object_id', $wallet->id)
	->where('object_type', \App\Wallet::class)->get();
	+
	$reseller_transactions = Transaction::where('object_id', $reseller_wallet->id)
	->where('object_type', \App\Wallet::class)->get();

	$this->assertCount(2, $reseller_transactions);
	$trans = $reseller_transactions[0];
	$this->assertSame("Charged user jane@kolabnow.com", $trans->description);
	$this->assertSame(5, $trans->amount);
	$this->assertSame(Transaction::WALLET_CREDIT, $trans->type);
	+
	$trans = $reseller_transactions[1];
	$this->assertSame("Charged user jane@kolabnow.com", $trans->description);
	$this->assertSame(5, $trans->amount);
	$this->assertSame(Transaction::WALLET_CREDIT, $trans->type);

	$this->assertCount(2, $transactions);
	$trans = $transactions[0];
	$this->assertSame('', $trans->description);
	$this->assertSame(-11, $trans->amount);
	$this->assertSame(Transaction::WALLET_DEBIT, $trans->type);
	$trans = $transactions[1];
	$this->assertSame('', $trans->description);
	$this->assertSame(-11, $trans->amount);
	$this->assertSame(Transaction::WALLET_DEBIT, $trans->type);

	// TODO: Test entitlement transaction records
	}
	}
	diff --git a/src/tests/Functional/HorizonTest.php b/src/tests/Functional/HorizonTest.php
	index 4372b55c..a42b8890 100644
	--- a/src/tests/Functional/HorizonTest.php
	+++ b/src/tests/Functional/HorizonTest.php
	@@ -1,24 +1,28 @@
	<?php

	namespace Tests\Functional;

	use Tests\TestCase;

	class HorizonTest extends TestCase
	{
	public function testAdminAccess()
	{
	$this->useAdminUrl();

	$response = $this->get('horizon/dashboard');

	$response->assertStatus(200);
	}

	+ /*
	public function testRegularAccess()
	{
	+ $this->useRegularUrl();
	+
	$response = $this->get('horizon/dashboard');

	$response->assertStatus(404);
	}
	+ */
	}
	diff --git a/src/tests/Functional/Methods/DomainTest.php b/src/tests/Functional/Methods/DomainTest.php
	index b52ea0b3..13307065 100644
	--- a/src/tests/Functional/Methods/DomainTest.php
	+++ b/src/tests/Functional/Methods/DomainTest.php
	@@ -1,115 +1,117 @@
	<?php

	namespace Tests\Functional\Methods;

	use Illuminate\Support\Facades\Queue;
	use Tests\TestCase;

	class DomainTest extends TestCase
	{
	protected $domain;

	public function setUp(): void
	{
	parent::setUp();

	+ $this->deleteTestDomain('test.domain');
	+
	$this->domain = $this->getTestDomain(
	'test.domain',
	[
	'status' => \App\Domain::STATUS_CONFIRMED \| \App\Domain::STATUS_VERIFIED,
	'type' => \App\Domain::TYPE_EXTERNAL
	]
	);
	}

	public function tearDown(): void
	{
	$this->deleteTestDomain('test.domain');

	parent::tearDown();
	}

	/**
	* Verify we can suspend an active domain.
	*/
	public function testSuspendForActiveDomain()
	{
	Queue::fake();

	$this->domain->status \|= \App\Domain::STATUS_ACTIVE;

	$this->assertFalse($this->domain->isSuspended());
	$this->assertTrue($this->domain->isActive());

	$this->domain->suspend();

	$this->assertTrue($this->domain->isSuspended());
	$this->assertFalse($this->domain->isActive());
	}

	/**
	* Verify we can unsuspend a suspended domain
	*/
	public function testUnsuspendForSuspendedDomain()
	{
	Queue::fake();

	$this->domain->status \|= \App\Domain::STATUS_SUSPENDED;

	$this->assertTrue($this->domain->isSuspended());
	$this->assertFalse($this->domain->isActive());

	$this->domain->unsuspend();

	$this->assertFalse($this->domain->isSuspended());
	$this->assertTrue($this->domain->isActive());
	}

	/**
	* Verify we can unsuspend a suspended domain that wasn't confirmed
	*/
	public function testUnsuspendForSuspendedUnconfirmedDomain()
	{
	Queue::fake();

	$this->domain->status = \App\Domain::STATUS_NEW \| \App\Domain::STATUS_SUSPENDED;

	$this->assertTrue($this->domain->isNew());
	$this->assertTrue($this->domain->isSuspended());
	$this->assertFalse($this->domain->isActive());
	$this->assertFalse($this->domain->isConfirmed());
	$this->assertFalse($this->domain->isVerified());

	$this->domain->unsuspend();

	$this->assertTrue($this->domain->isNew());
	$this->assertFalse($this->domain->isSuspended());
	$this->assertFalse($this->domain->isActive());
	$this->assertFalse($this->domain->isConfirmed());
	$this->assertFalse($this->domain->isVerified());
	}

	/**
	* Verify we can unsuspend a suspended domain that was verified but not confirmed
	*/
	public function testUnsuspendForSuspendedVerifiedUnconfirmedDomain()
	{
	Queue::fake();

	$this->domain->status = \App\Domain::STATUS_NEW \| \App\Domain::STATUS_SUSPENDED \| \App\Domain::STATUS_VERIFIED;

	$this->assertTrue($this->domain->isNew());
	$this->assertTrue($this->domain->isSuspended());
	$this->assertFalse($this->domain->isActive());
	$this->assertFalse($this->domain->isConfirmed());
	$this->assertTrue($this->domain->isVerified());

	$this->domain->unsuspend();

	$this->assertTrue($this->domain->isNew());
	$this->assertFalse($this->domain->isSuspended());
	$this->assertFalse($this->domain->isActive());
	$this->assertFalse($this->domain->isConfirmed());
	$this->assertTrue($this->domain->isVerified());
	}
	}
	diff --git a/src/tests/TestCase.php b/src/tests/TestCase.php
	index e9f933c6..31a179b7 100644
	--- a/src/tests/TestCase.php
	+++ b/src/tests/TestCase.php
	@@ -1,70 +1,91 @@
	<?php

	namespace Tests;

	use Illuminate\Foundation\Testing\TestCase as BaseTestCase;
	use Illuminate\Routing\Middleware\ThrottleRequests;

	abstract class TestCase extends BaseTestCase
	{
	use TestCaseTrait;
	use TestCaseMeetTrait;

	/**
	* {@inheritDoc}
	*/
	public function setUp(): void
	{
	parent::setUp();

	// Disable throttling
	$this->withoutMiddleware(ThrottleRequests::class);
	}

	protected function backdateEntitlements($entitlements, $targetDate)
	{
	$wallets = [];
	$ids = [];

	foreach ($entitlements as $entitlement) {
	$ids[] = $entitlement->id;
	$wallets[] = $entitlement->wallet_id;
	}

	\App\Entitlement::whereIn('id', $ids)->update([
	'created_at' => $targetDate,
	'updated_at' => $targetDate,
	]);

	if (!empty($wallets)) {
	$wallets = array_unique($wallets);
	$owners = \App\Wallet::whereIn('id', $wallets)->pluck('user_id')->all();

	\App\User::whereIn('id', $owners)->update(['created_at' => $targetDate]);
	}
	}

	+ /**
	+ * Set baseURL to the regular UI location
	+ */
	+ protected static function useRegularUrl(): void
	+ {
	+ // This will set base URL for all tests in a file.
	+ // If we wanted to access both user and admin in one test
	+ // we can also just call post/get/whatever with full url
	+ \config(
	+ [
	+ 'app.url' => str_replace(
	+ ['//admin.', '//reseller.'],
	+ ['//', '//'],
	+ \config('app.url')
	+ )
	+ ]
	+ );
	+
	+ url()->forceRootUrl(config('app.url'));
	+ }
	+
	/**
	* Set baseURL to the admin UI location
	*/
	protected static function useAdminUrl(): void
	{
	// This will set base URL for all tests in a file.
	// If we wanted to access both user and admin in one test
	// we can also just call post/get/whatever with full url
	\config(['app.url' => str_replace('//', '//admin.', \config('app.url'))]);
	url()->forceRootUrl(config('app.url'));
	}

	/**
	* Set baseURL to the reseller UI location
	*/
	protected static function useResellerUrl(): void
	{
	// This will set base URL for all tests in a file.
	// If we wanted to access both user and admin in one test
	// we can also just call post/get/whatever with full url
	\config(['app.url' => str_replace('//', '//reseller.', \config('app.url'))]);
	url()->forceRootUrl(config('app.url'));
	}
	}
	diff --git a/src/tests/Unit/TransactionTest.php b/src/tests/Unit/TransactionTest.php
	index 89898ba2..c0318809 100644
	--- a/src/tests/Unit/TransactionTest.php
	+++ b/src/tests/Unit/TransactionTest.php
	@@ -1,205 +1,205 @@
	<?php

	namespace Tests\Unit;

	use App\Entitlement;
	use App\Sku;
	use App\Transaction;
	use App\Wallet;
	use Tests\TestCase;

	class TransactionTest extends TestCase
	{
	/**
	* Test transaction short and long labels
	*/
	public function testLabels(): void
	{
	// Prepare test environment
	Transaction::where('amount', '<', 20)->delete();
	$user = $this->getTestUser('jane@kolabnow.com');
	$wallet = $user->wallets()->first();

	// Create transactions

	$transaction = Transaction::create([
	'object_id' => $wallet->id,
	'object_type' => Wallet::class,
	'type' => Transaction::WALLET_PENALTY,
	'amount' => -10,
	'description' => "A test penalty"
	]);

	$transaction = Transaction::create([
	'object_id' => $wallet->id,
	'object_type' => Wallet::class,
	'type' => Transaction::WALLET_DEBIT,
	'amount' => -9
	]);

	$transaction = Transaction::create([
	'object_id' => $wallet->id,
	'object_type' => Wallet::class,
	'type' => Transaction::WALLET_CREDIT,
	'amount' => 11
	]);

	$transaction = Transaction::create([
	'object_id' => $wallet->id,
	'object_type' => Wallet::class,
	'type' => Transaction::WALLET_AWARD,
	'amount' => 12,
	'description' => "A test award"
	]);

	- $sku = Sku::where('title', 'mailbox')->first();
	+ $sku = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();
	$entitlement = Entitlement::where('sku_id', $sku->id)->first();
	$transaction = Transaction::create([
	'user_email' => 'test@test.com',
	'object_id' => $entitlement->id,
	'object_type' => Entitlement::class,
	'type' => Transaction::ENTITLEMENT_CREATED,
	'amount' => 13
	]);

	- $sku = Sku::where('title', 'domain-hosting')->first();
	+ $sku = Sku::withEnvTenantContext()->where('title', 'domain-hosting')->first();
	$entitlement = Entitlement::where('sku_id', $sku->id)->first();
	$transaction = Transaction::create([
	'user_email' => 'test@test.com',
	'object_id' => $entitlement->id,
	'object_type' => Entitlement::class,
	'type' => Transaction::ENTITLEMENT_BILLED,
	'amount' => 14
	]);

	- $sku = Sku::where('title', 'storage')->first();
	+ $sku = Sku::withEnvTenantContext()->where('title', 'storage')->first();
	$entitlement = Entitlement::where('sku_id', $sku->id)->first();
	$transaction = Transaction::create([
	'user_email' => 'test@test.com',
	'object_id' => $entitlement->id,
	'object_type' => Entitlement::class,
	'type' => Transaction::ENTITLEMENT_DELETED,
	'amount' => 15
	]);

	$transactions = Transaction::where('amount', '<', 20)->orderBy('amount')->get();

	$this->assertSame(-10, $transactions[0]->amount);
	$this->assertSame(Transaction::WALLET_PENALTY, $transactions[0]->type);
	$this->assertSame(
	"The balance of Default wallet was reduced by 0,10 CHF; A test penalty",
	$transactions[0]->toString()
	);
	$this->assertSame(
	"Charge: A test penalty",
	$transactions[0]->shortDescription()
	);

	$this->assertSame(-9, $transactions[1]->amount);
	$this->assertSame(Transaction::WALLET_DEBIT, $transactions[1]->type);
	$this->assertSame(
	"0,09 CHF was deducted from the balance of Default wallet",
	$transactions[1]->toString()
	);
	$this->assertSame(
	"Deduction",
	$transactions[1]->shortDescription()
	);

	$this->assertSame(11, $transactions[2]->amount);
	$this->assertSame(Transaction::WALLET_CREDIT, $transactions[2]->type);
	$this->assertSame(
	"0,11 CHF was added to the balance of Default wallet",
	$transactions[2]->toString()
	);
	$this->assertSame(
	"Payment",
	$transactions[2]->shortDescription()
	);

	$this->assertSame(12, $transactions[3]->amount);
	$this->assertSame(Transaction::WALLET_AWARD, $transactions[3]->type);
	$this->assertSame(
	"Bonus of 0,12 CHF awarded to Default wallet; A test award",
	$transactions[3]->toString()
	);
	$this->assertSame(
	"Bonus: A test award",
	$transactions[3]->shortDescription()
	);

	$ent = $transactions[4]->entitlement();
	$this->assertSame(13, $transactions[4]->amount);
	$this->assertSame(Transaction::ENTITLEMENT_CREATED, $transactions[4]->type);
	$this->assertSame(
	"test@test.com created mailbox for " . $ent->entitleableTitle(),
	$transactions[4]->toString()
	);
	$this->assertSame(
	"Added mailbox for " . $ent->entitleableTitle(),
	$transactions[4]->shortDescription()
	);

	$ent = $transactions[5]->entitlement();
	$this->assertSame(14, $transactions[5]->amount);
	$this->assertSame(Transaction::ENTITLEMENT_BILLED, $transactions[5]->type);
	$this->assertSame(
	sprintf("%s for %s is billed at 0,14 CHF", $ent->sku->title, $ent->entitleableTitle()),
	$transactions[5]->toString()
	);
	$this->assertSame(
	sprintf("Billed %s for %s", $ent->sku->title, $ent->entitleableTitle()),
	$transactions[5]->shortDescription()
	);

	$ent = $transactions[6]->entitlement();
	$this->assertSame(15, $transactions[6]->amount);
	$this->assertSame(Transaction::ENTITLEMENT_DELETED, $transactions[6]->type);
	$this->assertSame(
	sprintf("test@test.com deleted %s for %s", $ent->sku->title, $ent->entitleableTitle()),
	$transactions[6]->toString()
	);
	$this->assertSame(
	sprintf("Deleted %s for %s", $ent->sku->title, $ent->entitleableTitle()),
	$transactions[6]->shortDescription()
	);
	}

	/**
	* Test that an exception is being thrown on invalid type
	*/
	public function testInvalidType(): void
	{
	$this->expectException(\Exception::class);

	$transaction = Transaction::create(
	[
	'object_id' => 'fake-id',
	'object_type' => Wallet::class,
	'type' => 'invalid',
	'amount' => 9
	]
	);
	}

	public function testEntitlementForWallet(): void
	{
	$transaction = \App\Transaction::where('object_type', \App\Wallet::class)
	->whereIn('object_id', \App\Wallet::pluck('id'))->first();

	$entitlement = $transaction->entitlement();
	$this->assertNull($entitlement);
	$this->assertNotNull($transaction->wallet());
	}

	public function testWalletForEntitlement(): void
	{
	$transaction = \App\Transaction::where('object_type', \App\Entitlement::class)
	->whereIn('object_id', \App\Entitlement::pluck('id'))->first();

	$wallet = $transaction->wallet();
	$this->assertNull($wallet);

	$this->assertNotNull($transaction->entitlement());
	}
	}
	diff --git a/src/tests/Unit/UtilsTest.php b/src/tests/Unit/UtilsTest.php
	index a32f29d0..21acde70 100644
	--- a/src/tests/Unit/UtilsTest.php
	+++ b/src/tests/Unit/UtilsTest.php
	@@ -1,118 +1,125 @@
	<?php

	namespace Tests\Unit;

	use App\Utils;
	use Tests\TestCase;

	class UtilsTest extends TestCase
	{
	/**
	* Test for Utils::powerSet()
	*/
	public function testPowerSet(): void
	{
	$set = [];

	$result = \App\Utils::powerSet($set);

	$this->assertIsArray($result);
	$this->assertCount(0, $result);

	$set = ["a1"];

	$result = \App\Utils::powerSet($set);

	$this->assertIsArray($result);
	$this->assertCount(1, $result);
	$this->assertTrue(in_array(["a1"], $result));

	$set = ["a1", "a2"];

	$result = \App\Utils::powerSet($set);

	$this->assertIsArray($result);
	$this->assertCount(3, $result);
	$this->assertTrue(in_array(["a1"], $result));
	$this->assertTrue(in_array(["a2"], $result));
	$this->assertTrue(in_array(["a1", "a2"], $result));

	$set = ["a1", "a2", "a3"];

	$result = \App\Utils::powerSet($set);

	$this->assertIsArray($result);
	$this->assertCount(7, $result);
	$this->assertTrue(in_array(["a1"], $result));
	$this->assertTrue(in_array(["a2"], $result));
	$this->assertTrue(in_array(["a3"], $result));
	$this->assertTrue(in_array(["a1", "a2"], $result));
	$this->assertTrue(in_array(["a1", "a3"], $result));
	$this->assertTrue(in_array(["a2", "a3"], $result));
	$this->assertTrue(in_array(["a1", "a2", "a3"], $result));
	}

	/**
	* Test for Utils::serviceUrl()
	*/
	public function testServiceUrl(): void
	{
	$public_href = 'https://public.url/cockpit';
	$local_href = 'https://local.url/cockpit';

	\config([
	'app.url' => $local_href,
	'app.public_url' => '',
	]);

	$this->assertSame($local_href, Utils::serviceUrl(''));
	$this->assertSame($local_href . '/unknown', Utils::serviceUrl('unknown'));
	$this->assertSame($local_href . '/unknown', Utils::serviceUrl('/unknown'));

	\config([
	'app.url' => $local_href,
	'app.public_url' => $public_href,
	]);

	$this->assertSame($public_href, Utils::serviceUrl(''));
	$this->assertSame($public_href . '/unknown', Utils::serviceUrl('unknown'));
	$this->assertSame($public_href . '/unknown', Utils::serviceUrl('/unknown'));
	}

	/**
	* Test for Utils::uuidInt()
	*/
	public function testUuidInt(): void
	{
	$result = Utils::uuidInt();

	$this->assertTrue(is_int($result));
	$this->assertTrue($result > 0);
	}

	/**
	* Test for Utils::uuidStr()
	*/
	public function testUuidStr(): void
	{
	$result = Utils::uuidStr();

	$this->assertTrue(is_string($result));
	$this->assertTrue(strlen($result) === 36);
	$this->assertTrue(preg_match('/[^a-f0-9-]/i', $result) === 0);
	}

	/**
	* Test for Utils::exchangeRate()
	*/
	public function testExchangeRate(): void
	{
	$this->assertSame(1.0, Utils::exchangeRate("DUMMY", "dummy"));
	- $this->assertEqualsWithDelta(0.90503424978382, Utils::exchangeRate("CHF", "EUR"), PHP_FLOAT_EPSILON);
	- $this->assertEqualsWithDelta(1.1049305595217682, Utils::exchangeRate("EUR", "CHF"), PHP_FLOAT_EPSILON);
	+
	+ // Exchange rates are volatile, can't test with high accuracy.
	+
	+ $this->assertTrue(Utils::exchangeRate("CHF", "EUR") >= 0.88);
	+ //$this->assertEqualsWithDelta(0.90503424978382, Utils::exchangeRate("CHF", "EUR"), PHP_FLOAT_EPSILON);
	+
	+ $this->assertTrue(Utils::exchangeRate("EUR", "CHF") <= 1.12);
	+ //$this->assertEqualsWithDelta(1.1049305595217682, Utils::exchangeRate("EUR", "CHF"), PHP_FLOAT_EPSILON);
	+
	$this->expectException(\Exception::class);
	$this->assertSame(1.0, Utils::exchangeRate("CHF", "FOO"));
	$this->expectException(\Exception::class);
	$this->assertSame(1.0, Utils::exchangeRate("FOO", "CHF"));
	}
	}

File Metadata

Mime Type: text/x-diff
Expires: Sat, Jan 31, 4:18 AM (17 h, 46 m)
Storage Engine: local-disk
Storage Format: Raw Data
Storage Handle: 8b/ab/a0fc37413fff4b94532bb94461e0
Default Alt Text: (1015 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions