D2446.1775808321.diff
No OneTemporary
Actions

Authored By

Unknown

Size

359 KB

Referenced Files

None

Subscribers

None

D2446.1775808321.diff
View Options

This file is larger than 256 KB, so syntax highlighting was skipped.

	diff --git a/docker-compose.yml b/docker-compose.yml
	--- a/docker-compose.yml
	+++ b/docker-compose.yml
	@@ -59,6 +59,7 @@
	container_name: kolab-mariadb
	environment:
	MYSQL_ROOT_PASSWORD: Welcome2KolabSystems
	+ TZ: "+02:00"
	healthcheck:
	interval: 10s
	test: test -e /var/run/mysqld/mysqld.sock
	diff --git a/src/.env.example b/src/.env.example
	--- a/src/.env.example
	+++ b/src/.env.example
	@@ -6,6 +6,7 @@
	APP_PUBLIC_URL=
	APP_DOMAIN=kolabnow.com
	APP_THEME=default
	+APP_TENANT_ID=1
	APP_LOCALE=en
	APP_LOCALES=en,de

	diff --git a/src/app/Console/Command.php b/src/app/Console/Command.php
	--- a/src/app/Console/Command.php
	+++ b/src/app/Console/Command.php
	@@ -2,8 +2,24 @@

	namespace App\Console;

	-class Command extends \Illuminate\Console\Command
	+abstract class Command extends \Illuminate\Console\Command
	{
	+ /**
	+ * Annotate this command as being dangerous for any potential unintended consequences.
	+ *
	+ * Commands are considered dangerous if;
	+ *
	+ * * observers are deliberately not triggered, meaning that the deletion of an object model that requires the
	+ * associated observer to clean some things up, or charge a wallet or something, are deliberately not triggered,
	+ *
	+ * * deletion of objects and their relations rely on database foreign keys with obscure cascading,
	+ *
	+ * * a command will result in the permanent, irrecoverable loss of data.
	+ *
	+ * @var boolean
	+ */
	+ protected $dangerous = false;
	+
	/**
	* Find the domain.
	*
	@@ -25,7 +41,7 @@
	*
	* @return mixed
	*/
	- public function getObject($objectClass, $objectIdOrTitle, $objectTitle)
	+ public function getObject($objectClass, $objectIdOrTitle, $objectTitle = null)
	{
	if ($this->hasOption('with-deleted') && $this->option('with-deleted')) {
	$object = $objectClass::withTrashed()->find($objectIdOrTitle);
	@@ -68,6 +84,26 @@
	return $this->getObject(\App\Wallet::class, $wallet, null);
	}

	+ public function handle()
	+ {
	+ if ($this->dangerous) {
	+ $this->warn(
	+ "This command is a dangerous scalpel command with potentially significant unintended consequences"
	+ );
	+
	+ $confirmation = $this->confirm("Are you sure you understand what's about to happen?");
	+
	+ if (!$confirmation) {
	+ $this->info("Better safe than sorry.");
	+ return false;
	+ }
	+
	+ $this->info("Vámonos!");
	+ }
	+
	+ return true;
	+ }
	+
	/**
	* Return a string for output, with any additional attributes specified as well.
	*
	diff --git a/src/app/Console/Commands/DBPing.php b/src/app/Console/Commands/DB/PingCommand.php
	rename from src/app/Console/Commands/DBPing.php
	rename to src/app/Console/Commands/DB/PingCommand.php
	--- a/src/app/Console/Commands/DBPing.php
	+++ b/src/app/Console/Commands/DB/PingCommand.php
	@@ -1,11 +1,11 @@
	<?php

	-namespace App\Console\Commands;
	+namespace App\Console\Commands\DB;

	use Illuminate\Console\Command;
	use Illuminate\Support\Facades\DB;

	-class DBPing extends Command
	+class PingCommand extends Command
	{
	/**
	* The name and signature of the console command.
	diff --git a/src/app/Console/Commands/DB/VerifyTimezoneCommand.php b/src/app/Console/Commands/DB/VerifyTimezoneCommand.php
	new file mode 100644
	--- /dev/null
	+++ b/src/app/Console/Commands/DB/VerifyTimezoneCommand.php
	@@ -0,0 +1,57 @@
	+<?php
	+
	+namespace App\Console\Commands\DB;
	+
	+use Illuminate\Console\Command;
	+use Illuminate\Support\Facades\DB;
	+
	+class VerifyTimezoneCommand extends Command
	+{
	+ /**
	+ * The name and signature of the console command.
	+ *
	+ * @var string
	+ */
	+ protected $signature = 'db:verify-timezone';
	+
	+ /**
	+ * The console command description.
	+ *
	+ * @var string
	+ */
	+ protected $description = "Verify the application's timezone compared to the DB timezone";
	+
	+ /**
	+ * Create a new command instance.
	+ *
	+ * @return void
	+ */
	+ public function __construct()
	+ {
	+ parent::__construct();
	+ }
	+
	+ /**
	+ * Execute the console command.
	+ *
	+ * @return mixed
	+ */
	+ public function handle()
	+ {
	+ $result = \Illuminate\Support\Facades\DB::select("SHOW VARIABLES WHERE Variable_name = 'time_zone'");
	+
	+ $appTimezone = \config('app.timezone');
	+
	+ if ($appTimezone != "UTC") {
	+ $this->error("The application timezone is not configured to be UTC");
	+ return 1;
	+ }
	+
	+ if ($result[0]->{'Value'} != '+00:00' && $result[0]->{'Value'} != 'UTC') {
	+ $this->error("The database timezone is neither configured as '+00:00' nor 'UTC'");
	+ return 1;
	+ }
	+
	+ return 0;
	+ }
	+}
	diff --git a/src/app/Console/Commands/Discount/MergeCommand.php b/src/app/Console/Commands/Discount/MergeCommand.php
	new file mode 100644
	--- /dev/null
	+++ b/src/app/Console/Commands/Discount/MergeCommand.php
	@@ -0,0 +1,95 @@
	+<?php
	+
	+namespace App\Console\Commands\Discount;
	+
	+use Illuminate\Console\Command;
	+
	+/**
	+ * Merge one discount (source) with another discount (target), and delete the source discount.
	+ *
	+ * This command re-associates the wallets that are discounted with the source discount to become discounted with the
	+ * target discount.
	+ *
	+ * Optionally, update the description of the target discount.
	+ *
	+ * You are not allowed to merge discounts that have different discount rates.
	+ *
	+ * This command makes it feasible to merge existing discounts like the ones that are 100% and described as
	+ * "It's us..", "it's us", "This is us", etc.
	+ *
	+ * Example usage:
	+ *
	+ * ```
	+ * $ ./artisan scalpel:discount:merge \
	+ * > 158f660b-e992-4fb9-ac12-5173b5f33807 \
	+ * > 62af659f-17d8-4527-87c1-c69eaa26653c \
	+ * > --description="Employee discount"
	+ * ```
	+ */
	+class MergeCommand extends Command
	+{
	+ /**
	+ * The name and signature of the console command.
	+ *
	+ * @var string
	+ */
	+ protected $signature = 'discount:merge {source} {target} {--description*}';
	+
	+ /**
	+ * The console command description.
	+ *
	+ * @var string
	+ */
	+ protected $description = 'Merge one discount in to another discount, ' .
	+ 'optionally set the description, and delete the source discount';
	+
	+ /**
	+ * Create a new command instance.
	+ *
	+ * @return void
	+ */
	+ public function __construct()
	+ {
	+ parent::__construct();
	+ }
	+
	+ /**
	+ * Execute the console command.
	+ *
	+ * @return mixed
	+ */
	+ public function handle()
	+ {
	+ $source = \App\Discount::find($this->argument('source'));
	+
	+ if (!$source) {
	+ $this->error("No such source discount: {$source}");
	+ return 1;
	+ }
	+
	+ $target = \App\Discount::find($this->argument('target'));
	+
	+ if (!$target) {
	+ $this->error("No such target discount: {$target}");
	+ return 1;
	+ }
	+
	+ if ($source->discount !== $target->discount) {
	+ $this->error("Can't merge two discounts that have different rates");
	+ return 1;
	+ }
	+
	+ foreach ($source->wallets as $wallet) {
	+ $wallet->discount_id = $target->id;
	+ $wallet->timestamps = false;
	+ $wallet->save();
	+ }
	+
	+ if ($this->option('description')) {
	+ $target->description = $this->option('description');
	+ $target->save();
	+ }
	+
	+ $source->delete();
	+ }
	+}
	diff --git a/src/app/Console/Commands/DiscountList.php b/src/app/Console/Commands/DiscountList.php
	deleted file mode 100644
	--- a/src/app/Console/Commands/DiscountList.php
	+++ /dev/null
	@@ -1,61 +0,0 @@
	-<?php
	-
	-namespace App\Console\Commands;
	-
	-use App\Discount;
	-use Illuminate\Console\Command;
	-use Illuminate\Support\Facades\DB;
	-
	-class DiscountList extends Command
	-{
	- /**
	- * The name and signature of the console command.
	- *
	- * @var string
	- */
	- protected $signature = 'discount:list';
	-
	- /**
	- * The console command description.
	- *
	- * @var string
	- */
	- protected $description = 'List available (active) discounts';
	-
	- /**
	- * Create a new command instance.
	- *
	- * @return void
	- */
	- public function __construct()
	- {
	- parent::__construct();
	- }
	-
	- /**
	- * Execute the console command.
	- *
	- * @return mixed
	- */
	- public function handle()
	- {
	- Discount::where('active', true)->orderBy('discount')->get()->each(
	- function ($discount) {
	- $name = $discount->description;
	-
	- if ($discount->code) {
	- $name .= " [{$discount->code}]";
	- }
	-
	- $this->info(
	- sprintf(
	- "%s %3d%% %s",
	- $discount->id,
	- $discount->discount,
	- $name
	- )
	- );
	- }
	- );
	- }
	-}
	diff --git a/src/app/Console/Commands/DiscountsCommand.php b/src/app/Console/Commands/DiscountsCommand.php
	--- a/src/app/Console/Commands/DiscountsCommand.php
	+++ b/src/app/Console/Commands/DiscountsCommand.php
	@@ -4,6 +4,29 @@

	use App\Console\ObjectListCommand;

	+/**
	+ * List discounts.
	+ *
	+ * Example usage:
	+ *
	+ * ```
	+ * $ ./artisan discounts
	+ * 003f18e5-cbd2-4de8-9485-b0c966e4757d
	+ * 00603496-5c91-4347-b341-cd5022566210
	+ * 0076b174-f122-458a-8466-bd05c3cac35d
	+ * (...)
	+ * ```
	+ *
	+ * To include specific attributes, use `--attr` (allowed multiple times):
	+ *
	+ * ```
	+ * $ ./artisan discounts --attr=discount --attr=description
	+ * 003f18e5-cbd2-4de8-9485-b0c966e4757d 54 Custom volume discount
	+ * 00603496-5c91-4347-b341-cd5022566210 30 Developer Discount
	+ * 0076b174-f122-458a-8466-bd05c3cac35d 100 it's me
	+ * (...)
	+ * ```
	+ */
	class DiscountsCommand extends ObjectListCommand
	{
	protected $objectClass = \App\Discount::class;
	diff --git a/src/app/Console/Commands/DomainAdd.php b/src/app/Console/Commands/Domain/CreateCommand.php
	rename from src/app/Console/Commands/DomainAdd.php
	rename to src/app/Console/Commands/Domain/CreateCommand.php
	--- a/src/app/Console/Commands/DomainAdd.php
	+++ b/src/app/Console/Commands/Domain/CreateCommand.php
	@@ -1,20 +1,18 @@
	<?php

	-namespace App\Console\Commands;
	+namespace App\Console\Commands\Domain;

	-use App\Domain;
	-use App\Entitlement;
	-use Illuminate\Console\Command;
	+use App\Console\Command;
	use Illuminate\Support\Facades\Queue;

	-class DomainAdd extends Command
	+class CreateCommand extends Command
	{
	/**
	* The name and signature of the console command.
	*
	* @var string
	*/
	- protected $signature = 'domain:add {domain} {--force}';
	+ protected $signature = 'domain:create {domain} {--force}';

	/**
	* The console command description.
	@@ -33,24 +31,21 @@
	$namespace = \strtolower($this->argument('domain'));

	// must use withTrashed(), because unique constraint
	- $domain = Domain::withTrashed()->where('namespace', $namespace)->first();
	+ $domain = \App\Domain::withTrashed()->where('namespace', $namespace)->first();

	if ($domain && !$this->option('force')) {
	$this->error("Domain {$namespace} already exists.");
	return 1;
	}

	- Queue::fake(); // ignore LDAP for now
	-
	if ($domain) {
	if ($domain->deleted_at) {
	- // revive domain
	- $domain->deleted_at = null;
	- $domain->status = 0;
	+ // set the status back to new
	+ $domain->status = \App\Domain::STATUS_NEW;
	$domain->save();

	// remove existing entitlement
	- $entitlement = Entitlement::withTrashed()->where(
	+ $entitlement = \App\Entitlement::withTrashed()->where(
	[
	'entitleable_id' => $domain->id,
	'entitleable_type' => \App\Domain::class
	@@ -60,17 +55,36 @@
	if ($entitlement) {
	$entitlement->forceDelete();
	}
	+
	+ // restore the domain to allow for the observer to handle the create job
	+ $domain->restore();
	+
	+ $this->info(
	+ sprintf(
	+ "Domain %s with ID %d revived. Remember to assign it to a wallet with 'domain:set-wallet'",
	+ $domain->namespace,
	+ $domain->id
	+ )
	+ );
	} else {
	$this->error("Domain {$namespace} not marked as deleted... examine more closely");
	return 1;
	}
	} else {
	- $domain = Domain::create([
	+ $domain = \App\Domain::create(
	+ [
	'namespace' => $namespace,
	- 'type' => Domain::TYPE_EXTERNAL,
	- ]);
	- }
	+ 'type' => \App\Domain::TYPE_EXTERNAL,
	+ ]
	+ );

	- $this->info($domain->id);
	+ $this->info(
	+ sprintf(
	+ "Domain %s created with ID %d. Remember to assign it to a wallet with 'domain:set-wallet'",
	+ $domain->namespace,
	+ $domain->id
	+ )
	+ );
	+ }
	}
	}
	diff --git a/src/app/Console/Commands/DomainSetWallet.php b/src/app/Console/Commands/DomainSetWallet.php
	--- a/src/app/Console/Commands/DomainSetWallet.php
	+++ b/src/app/Console/Commands/DomainSetWallet.php
	@@ -60,6 +60,7 @@
	'wallet_id' => $wallet->id,
	'sku_id' => $sku->id,
	'cost' => 0,
	+ 'fee' => 0,
	'entitleable_id' => $domain->id,
	'entitleable_type' => Domain::class,
	]
	diff --git a/src/app/Console/Commands/Group/CreateCommand.php b/src/app/Console/Commands/Group/CreateCommand.php
	--- a/src/app/Console/Commands/Group/CreateCommand.php
	+++ b/src/app/Console/Commands/Group/CreateCommand.php
	@@ -7,6 +7,11 @@
	use App\Http\Controllers\API\V4\GroupsController;
	use Illuminate\Support\Facades\DB;

	+/**
	+ * Create a (mail-enabled) distribution group.
	+ *
	+ * @see \App\Console\Commands\Scalpel\Group\CreateCommand
	+ */
	class CreateCommand extends Command
	{
	/**
	diff --git a/src/app/Console/Commands/Scalpel/Discount/CreateCommand.php b/src/app/Console/Commands/Scalpel/Discount/CreateCommand.php
	--- a/src/app/Console/Commands/Scalpel/Discount/CreateCommand.php
	+++ b/src/app/Console/Commands/Scalpel/Discount/CreateCommand.php
	@@ -6,6 +6,8 @@

	class CreateCommand extends ObjectCreateCommand
	{
	+ protected $hidden = true;
	+
	protected $commandPrefix = 'scalpel';
	protected $objectClass = \App\Discount::class;
	protected $objectName = 'discount';
	diff --git a/src/app/Console/Commands/Scalpel/Discount/CreateCommand.php b/src/app/Console/Commands/Scalpel/Discount/DeleteCommand.php
	copy from src/app/Console/Commands/Scalpel/Discount/CreateCommand.php
	copy to src/app/Console/Commands/Scalpel/Discount/DeleteCommand.php
	--- a/src/app/Console/Commands/Scalpel/Discount/CreateCommand.php
	+++ b/src/app/Console/Commands/Scalpel/Discount/DeleteCommand.php
	@@ -2,10 +2,13 @@

	namespace App\Console\Commands\Scalpel\Discount;

	-use App\Console\ObjectCreateCommand;
	+use App\Console\ObjectDeleteCommand;

	-class CreateCommand extends ObjectCreateCommand
	+class DeleteCommand extends ObjectDeleteCommand
	{
	+ protected $dangerous = true;
	+ protected $hidden = true;
	+
	protected $commandPrefix = 'scalpel';
	protected $objectClass = \App\Discount::class;
	protected $objectName = 'discount';
	diff --git a/src/app/Console/Commands/Scalpel/Discount/ReadCommand.php b/src/app/Console/Commands/Scalpel/Discount/ReadCommand.php
	--- a/src/app/Console/Commands/Scalpel/Discount/ReadCommand.php
	+++ b/src/app/Console/Commands/Scalpel/Discount/ReadCommand.php
	@@ -6,6 +6,8 @@

	class ReadCommand extends ObjectReadCommand
	{
	+ protected $hidden = true;
	+
	protected $commandPrefix = 'scalpel';
	protected $objectClass = \App\Discount::class;
	protected $objectName = 'discount';
	diff --git a/src/app/Console/Commands/Scalpel/Discount/CreateCommand.php b/src/app/Console/Commands/Scalpel/Discount/UpdateCommand.php
	copy from src/app/Console/Commands/Scalpel/Discount/CreateCommand.php
	copy to src/app/Console/Commands/Scalpel/Discount/UpdateCommand.php
	--- a/src/app/Console/Commands/Scalpel/Discount/CreateCommand.php
	+++ b/src/app/Console/Commands/Scalpel/Discount/UpdateCommand.php
	@@ -2,10 +2,12 @@

	namespace App\Console\Commands\Scalpel\Discount;

	-use App\Console\ObjectCreateCommand;
	+use App\Console\ObjectUpdateCommand;

	-class CreateCommand extends ObjectCreateCommand
	+class UpdateCommand extends ObjectUpdateCommand
	{
	+ protected $hidden = true;
	+
	protected $commandPrefix = 'scalpel';
	protected $objectClass = \App\Discount::class;
	protected $objectName = 'discount';
	diff --git a/src/app/Console/Commands/Scalpel/Domain/CreateCommand.php b/src/app/Console/Commands/Scalpel/Domain/CreateCommand.php
	--- a/src/app/Console/Commands/Scalpel/Domain/CreateCommand.php
	+++ b/src/app/Console/Commands/Scalpel/Domain/CreateCommand.php
	@@ -6,6 +6,8 @@

	class CreateCommand extends ObjectCreateCommand
	{
	+ protected $hidden = true;
	+
	protected $commandPrefix = 'scalpel';
	protected $objectClass = \App\Domain::class;
	protected $objectName = 'domain';
	diff --git a/src/app/Console/Commands/Scalpel/Domain/ReadCommand.php b/src/app/Console/Commands/Scalpel/Domain/ReadCommand.php
	--- a/src/app/Console/Commands/Scalpel/Domain/ReadCommand.php
	+++ b/src/app/Console/Commands/Scalpel/Domain/ReadCommand.php
	@@ -6,6 +6,8 @@

	class ReadCommand extends ObjectReadCommand
	{
	+ protected $hidden = true;
	+
	protected $commandPrefix = 'scalpel';
	protected $objectClass = \App\Domain::class;
	protected $objectName = 'domain';
	diff --git a/src/app/Console/Commands/Scalpel/Domain/UpdateCommand.php b/src/app/Console/Commands/Scalpel/Domain/UpdateCommand.php
	--- a/src/app/Console/Commands/Scalpel/Domain/UpdateCommand.php
	+++ b/src/app/Console/Commands/Scalpel/Domain/UpdateCommand.php
	@@ -6,6 +6,8 @@

	class UpdateCommand extends ObjectUpdateCommand
	{
	+ protected $hidden = true;
	+
	protected $commandPrefix = 'scalpel';
	protected $objectClass = \App\Domain::class;
	protected $objectName = 'domain';
	diff --git a/src/app/Console/Commands/Scalpel/Entitlement/CreateCommand.php b/src/app/Console/Commands/Scalpel/Entitlement/CreateCommand.php
	--- a/src/app/Console/Commands/Scalpel/Entitlement/CreateCommand.php
	+++ b/src/app/Console/Commands/Scalpel/Entitlement/CreateCommand.php
	@@ -6,6 +6,8 @@

	class CreateCommand extends ObjectCreateCommand
	{
	+ protected $hidden = true;
	+
	protected $commandPrefix = 'scalpel';
	protected $objectClass = \App\Entitlement::class;
	protected $objectName = 'entitlement';
	diff --git a/src/app/Console/Commands/Scalpel/Entitlement/ReadCommand.php b/src/app/Console/Commands/Scalpel/Entitlement/ReadCommand.php
	--- a/src/app/Console/Commands/Scalpel/Entitlement/ReadCommand.php
	+++ b/src/app/Console/Commands/Scalpel/Entitlement/ReadCommand.php
	@@ -6,6 +6,8 @@

	class ReadCommand extends ObjectReadCommand
	{
	+ protected $hidden = true;
	+
	protected $commandPrefix = 'scalpel';
	protected $objectClass = \App\Entitlement::class;
	protected $objectName = 'entitlement';
	diff --git a/src/app/Console/Commands/Scalpel/Entitlement/UpdateCommand.php b/src/app/Console/Commands/Scalpel/Entitlement/UpdateCommand.php
	--- a/src/app/Console/Commands/Scalpel/Entitlement/UpdateCommand.php
	+++ b/src/app/Console/Commands/Scalpel/Entitlement/UpdateCommand.php
	@@ -6,6 +6,8 @@

	class UpdateCommand extends ObjectUpdateCommand
	{
	+ protected $hidden = true;
	+
	protected $commandPrefix = 'scalpel';
	protected $objectClass = \App\Entitlement::class;
	protected $objectName = 'entitlement';
	diff --git a/src/app/Console/Commands/Scalpel/Group/CreateCommand.php b/src/app/Console/Commands/Scalpel/Group/CreateCommand.php
	new file mode 100644
	--- /dev/null
	+++ b/src/app/Console/Commands/Scalpel/Group/CreateCommand.php
	@@ -0,0 +1,15 @@
	+<?php
	+
	+namespace App\Console\Commands\Scalpel\Group;
	+
	+use App\Console\ObjectCreateCommand;
	+
	+class CreateCommand extends ObjectCreateCommand
	+{
	+ protected $hidden = true;
	+
	+ protected $commandPrefix = 'scalpel';
	+ protected $objectClass = \App\Group::class;
	+ protected $objectName = 'group';
	+ protected $objectTitle = 'email';
	+}
	diff --git a/src/app/Console/Commands/Scalpel/User/ReadCommand.php b/src/app/Console/Commands/Scalpel/Group/ReadCommand.php
	copy from src/app/Console/Commands/Scalpel/User/ReadCommand.php
	copy to src/app/Console/Commands/Scalpel/Group/ReadCommand.php
	--- a/src/app/Console/Commands/Scalpel/User/ReadCommand.php
	+++ b/src/app/Console/Commands/Scalpel/Group/ReadCommand.php
	@@ -1,13 +1,15 @@
	<?php

	-namespace App\Console\Commands\Scalpel\User;
	+namespace App\Console\Commands\Scalpel\Group;

	use App\Console\ObjectReadCommand;

	class ReadCommand extends ObjectReadCommand
	{
	+ protected $hidden = true;
	+
	protected $commandPrefix = 'scalpel';
	- protected $objectClass = \App\User::class;
	- protected $objectName = 'user';
	+ protected $objectClass = \App\Group::class;
	+ protected $objectName = 'group';
	protected $objectTitle = 'email';
	}
	diff --git a/src/app/Console/Commands/Scalpel/Group/UpdateCommand.php b/src/app/Console/Commands/Scalpel/Group/UpdateCommand.php
	new file mode 100644
	--- /dev/null
	+++ b/src/app/Console/Commands/Scalpel/Group/UpdateCommand.php
	@@ -0,0 +1,15 @@
	+<?php
	+
	+namespace App\Console\Commands\Scalpel\Group;
	+
	+use App\Console\ObjectUpdateCommand;
	+
	+class UpdateCommand extends ObjectUpdateCommand
	+{
	+ protected $hidden = true;
	+
	+ protected $commandPrefix = 'scalpel';
	+ protected $objectClass = \App\Group::class;
	+ protected $objectName = 'group';
	+ protected $objectTitle = 'email';
	+}
	diff --git a/src/app/Console/Commands/Scalpel/Package/ReadCommand.php b/src/app/Console/Commands/Scalpel/Package/ReadCommand.php
	--- a/src/app/Console/Commands/Scalpel/Package/ReadCommand.php
	+++ b/src/app/Console/Commands/Scalpel/Package/ReadCommand.php
	@@ -6,6 +6,8 @@

	class ReadCommand extends ObjectReadCommand
	{
	+ protected $hidden = true;
	+
	protected $commandPrefix = 'scalpel';
	protected $objectClass = \App\Package::class;
	protected $objectName = 'package';
	diff --git a/src/app/Console/Commands/Scalpel/Plan/ReadCommand.php b/src/app/Console/Commands/Scalpel/Plan/ReadCommand.php
	--- a/src/app/Console/Commands/Scalpel/Plan/ReadCommand.php
	+++ b/src/app/Console/Commands/Scalpel/Plan/ReadCommand.php
	@@ -6,6 +6,8 @@

	class ReadCommand extends ObjectReadCommand
	{
	+ protected $hidden = true;
	+
	protected $commandPrefix = 'scalpel';
	protected $objectClass = \App\Plan::class;
	protected $objectName = 'plan';
	diff --git a/src/app/Console/Commands/Scalpel/Sku/ReadCommand.php b/src/app/Console/Commands/Scalpel/Sku/ReadCommand.php
	--- a/src/app/Console/Commands/Scalpel/Sku/ReadCommand.php
	+++ b/src/app/Console/Commands/Scalpel/Sku/ReadCommand.php
	@@ -6,6 +6,8 @@

	class ReadCommand extends ObjectReadCommand
	{
	+ protected $hidden = true;
	+
	protected $commandPrefix = 'scalpel';
	protected $objectClass = \App\Sku::class;
	protected $objectName = 'sku';
	diff --git a/src/app/Console/Commands/Scalpel/Transaction/ReadCommand.php b/src/app/Console/Commands/Scalpel/Transaction/ReadCommand.php
	--- a/src/app/Console/Commands/Scalpel/Transaction/ReadCommand.php
	+++ b/src/app/Console/Commands/Scalpel/Transaction/ReadCommand.php
	@@ -6,6 +6,8 @@

	class ReadCommand extends ObjectReadCommand
	{
	+ protected $hidden = true;
	+
	protected $commandPrefix = 'scalpel';
	protected $objectClass = \App\Transaction::class;
	protected $objectName = 'transaction';
	diff --git a/src/app/Console/Commands/Scalpel/User/CreateCommand.php b/src/app/Console/Commands/Scalpel/User/CreateCommand.php
	--- a/src/app/Console/Commands/Scalpel/User/CreateCommand.php
	+++ b/src/app/Console/Commands/Scalpel/User/CreateCommand.php
	@@ -19,6 +19,8 @@
	*/
	class CreateCommand extends ObjectCreateCommand
	{
	+ protected $hidden = true;
	+
	protected $commandPrefix = 'scalpel';
	protected $objectClass = \App\User::class;
	protected $objectName = 'user';
	diff --git a/src/app/Console/Commands/Scalpel/User/ReadCommand.php b/src/app/Console/Commands/Scalpel/User/ReadCommand.php
	--- a/src/app/Console/Commands/Scalpel/User/ReadCommand.php
	+++ b/src/app/Console/Commands/Scalpel/User/ReadCommand.php
	@@ -6,6 +6,8 @@

	class ReadCommand extends ObjectReadCommand
	{
	+ protected $hidden = true;
	+
	protected $commandPrefix = 'scalpel';
	protected $objectClass = \App\User::class;
	protected $objectName = 'user';
	diff --git a/src/app/Console/Commands/Scalpel/User/ReadCommand.php b/src/app/Console/Commands/Scalpel/User/UpdateCommand.php
	copy from src/app/Console/Commands/Scalpel/User/ReadCommand.php
	copy to src/app/Console/Commands/Scalpel/User/UpdateCommand.php
	--- a/src/app/Console/Commands/Scalpel/User/ReadCommand.php
	+++ b/src/app/Console/Commands/Scalpel/User/UpdateCommand.php
	@@ -2,10 +2,12 @@

	namespace App\Console\Commands\Scalpel\User;

	-use App\Console\ObjectReadCommand;
	+use App\Console\ObjectUpdateCommand;

	-class ReadCommand extends ObjectReadCommand
	+class UpdateCommand extends ObjectUpdateCommand
	{
	+ protected $hidden = true;
	+
	protected $commandPrefix = 'scalpel';
	protected $objectClass = \App\User::class;
	protected $objectName = 'user';
	diff --git a/src/app/Console/Commands/Scalpel/UserSetting/ReadCommand.php b/src/app/Console/Commands/Scalpel/UserSetting/ReadCommand.php
	--- a/src/app/Console/Commands/Scalpel/UserSetting/ReadCommand.php
	+++ b/src/app/Console/Commands/Scalpel/UserSetting/ReadCommand.php
	@@ -6,6 +6,8 @@

	class ReadCommand extends ObjectReadCommand
	{
	+ protected $hidden = true;
	+
	protected $commandPrefix = 'scalpel';
	protected $objectClass = \App\UserSetting::class;
	protected $objectName = 'user-setting';
	diff --git a/src/app/Console/Commands/Scalpel/Wallet/ReadCommand.php b/src/app/Console/Commands/Scalpel/Wallet/ReadCommand.php
	--- a/src/app/Console/Commands/Scalpel/Wallet/ReadCommand.php
	+++ b/src/app/Console/Commands/Scalpel/Wallet/ReadCommand.php
	@@ -6,6 +6,8 @@

	class ReadCommand extends ObjectReadCommand
	{
	+ protected $hidden = true;
	+
	protected $commandPrefix = 'scalpel';
	protected $objectClass = \App\Wallet::class;
	protected $objectName = 'wallet';
	diff --git a/src/app/Console/Commands/Scalpel/WalletSetting/ReadCommand.php b/src/app/Console/Commands/Scalpel/WalletSetting/ReadCommand.php
	--- a/src/app/Console/Commands/Scalpel/WalletSetting/ReadCommand.php
	+++ b/src/app/Console/Commands/Scalpel/WalletSetting/ReadCommand.php
	@@ -6,6 +6,8 @@

	class ReadCommand extends ObjectReadCommand
	{
	+ protected $hidden = true;
	+
	protected $commandPrefix = 'scalpel';
	protected $objectClass = \App\WalletSetting::class;
	protected $objectName = 'wallet-setting';
	diff --git a/src/app/Console/Commands/WalletCharge.php b/src/app/Console/Commands/WalletCharge.php
	--- a/src/app/Console/Commands/WalletCharge.php
	+++ b/src/app/Console/Commands/WalletCharge.php
	@@ -42,7 +42,7 @@
	// Find specified wallet by ID
	$wallet = Wallet::find($wallet);

	- if (!$wallet \|\| !$wallet->owner) {
	+ if (!$wallet \|\| !$wallet->owner \|\| $wallet->owner->tenant_id != \config('app.tenant_id')) {
	return 1;
	}

	@@ -51,6 +51,7 @@
	// Get all wallets, excluding deleted accounts
	$wallets = Wallet::select('wallets.*')
	->join('users', 'users.id', '=', 'wallets.user_id')
	+ ->withEnvTenant('users')
	->whereNull('users.deleted_at')
	->get();
	}
	diff --git a/src/app/Console/ObjectUpdateCommand.php b/src/app/Console/ObjectDeleteCommand.php
	copy from src/app/Console/ObjectUpdateCommand.php
	copy to src/app/Console/ObjectDeleteCommand.php
	--- a/src/app/Console/ObjectUpdateCommand.php
	+++ b/src/app/Console/ObjectDeleteCommand.php
	@@ -8,13 +8,13 @@
	/**
	* This abstract class provides a means to treat objects in our model using CRUD.
	*/
	-abstract class ObjectUpdateCommand extends ObjectCommand
	+abstract class ObjectDeleteCommand extends ObjectCommand
	{
	public function __construct()
	{
	- $this->description = "Update a {$this->objectName}";
	+ $this->description = "Delete a {$this->objectName}";
	$this->signature = sprintf(
	- "%s%s:update {%s}",
	+ "%s%s:delete {%s}",
	$this->commandPrefix ? $this->commandPrefix . ":" : "",
	$this->objectName,
	$this->objectName
	@@ -36,10 +36,6 @@

	$classes = class_uses_recursive($this->objectClass);

	- if (in_array(SoftDeletes::class, $classes)) {
	- $this->signature .= " {--with-deleted : Include deleted {$this->objectName}s}";
	- }
	-
	parent::__construct();
	}

	@@ -73,6 +69,12 @@
	*/
	public function handle()
	{
	+ $result = parent::handle();
	+
	+ if (!$result) {
	+ return 1;
	+ }
	+
	$argument = $this->argument($this->objectName);

	$object = $this->getObject($this->objectClass, $argument, $this->objectTitle);
	@@ -82,18 +84,12 @@
	return 1;
	}

	- foreach ($this->getProperties() as $property => $value) {
	- if ($property == "deleted_at" && $value == "null") {
	- $value = null;
	- }
	-
	- $object->{$property} = $value;
	+ if ($this->commandPrefix == 'scalpel') {
	+ $this->objectClass::withoutEvents(
	+ function () use ($object) {
	+ $object->delete();
	+ }
	+ );
	}
	-
	- $object->timestamps = false;
	-
	- $object->save(['timestamps' => false]);
	-
	- $this->cacheRefresh($object);
	}
	}
	diff --git a/src/app/Console/ObjectRelationListCommand.php b/src/app/Console/ObjectRelationListCommand.php
	--- a/src/app/Console/ObjectRelationListCommand.php
	+++ b/src/app/Console/ObjectRelationListCommand.php
	@@ -67,19 +67,16 @@
	return 1;
	}

	- if ($result instanceof \Illuminate\Database\Eloquent\Collection) {
	- $result->each(
	- function ($entry) {
	- $this->info($this->toString($entry));
	- }
	- );
	- } elseif ($result instanceof \Illuminate\Database\Eloquent\Relations\Relation) {
	- $result->each(
	- function ($entry) {
	- $this->info($this->toString($entry));
	- }
	- );
	- } elseif (is_array($result)) {
	+ // Convert query builder into a collection
	+ if ($result instanceof \Illuminate\Database\Eloquent\Relations\Relation) {
	+ $result = $result->get();
	+ }
	+
	+ // Print the result
	+ if (
	+ ($result instanceof \Illuminate\Database\Eloquent\Collection)
	+ \|\| is_array($result)
	+ ) {
	foreach ($result as $entry) {
	$this->info($this->toString($entry));
	}
	diff --git a/src/app/Console/ObjectUpdateCommand.php b/src/app/Console/ObjectUpdateCommand.php
	--- a/src/app/Console/ObjectUpdateCommand.php
	+++ b/src/app/Console/ObjectUpdateCommand.php
	@@ -92,7 +92,15 @@

	$object->timestamps = false;

	- $object->save(['timestamps' => false]);
	+ if ($this->commandPrefix == 'scalpel') {
	+ $this->objectClass::withoutEvents(
	+ function () use ($object) {
	+ $object->save();
	+ }
	+ );
	+ } else {
	+ $object->save();
	+ }

	$this->cacheRefresh($object);
	}
	diff --git a/src/app/Discount.php b/src/app/Discount.php
	--- a/src/app/Discount.php
	+++ b/src/app/Discount.php
	@@ -7,6 +7,12 @@

	/**
	* The eloquent definition of a Discount.
	+ *
	+ * @property bool $active
	+ * @property string $code
	+ * @property string $description
	+ * @property int $discount
	+ * @property int $tenant_id
	*/
	class Discount extends Model
	{
	diff --git a/src/app/Domain.php b/src/app/Domain.php
	--- a/src/app/Domain.php
	+++ b/src/app/Domain.php
	@@ -10,6 +10,9 @@
	* The eloquent definition of a Domain.
	*
	* @property string $namespace
	+ * @property int $status
	+ * @property int $tenant_id
	+ * @property int $type
	*/
	class Domain extends Model
	{
	@@ -86,6 +89,7 @@
	'wallet_id' => $wallet_id,
	'sku_id' => $sku->id,
	'cost' => $sku->pivot->cost(),
	+ 'fee' => $sku->fee,
	'entitleable_id' => $this->id,
	'entitleable_type' => Domain::class
	]
	diff --git a/src/app/Entitlement.php b/src/app/Entitlement.php
	--- a/src/app/Entitlement.php
	+++ b/src/app/Entitlement.php
	@@ -11,10 +11,18 @@
	*
	* Owned by a {@link \App\User}, billed to a {@link \App\Wallet}.
	*
	- * @property \App\User $owner The owner of this entitlement (subject).
	- * @property \App\Sku $sku The SKU to which this entitlement applies.
	- * @property \App\Wallet $wallet The wallet to which this entitlement is charged.
	- * @property \App\Domain\|\App\User $entitleable The entitled object (receiver of the entitlement).
	+ * @property int $cost
	+ * @property ?string $description
	+ * @property \App\Domain\|\App\User $entitleable The entitled object (receiver of the entitlement).
	+ * @property int $entitleable_id
	+ * @property string $entitleable_type
	+ * @property int $fee
	+ * @property string $id
	+ * @property \App\User $owner The owner of this entitlement (subject).
	+ * @property \App\Sku $sku The SKU to which this entitlement applies.
	+ * @property string $sku_id
	+ * @property \App\Wallet $wallet The wallet to which this entitlement is charged.
	+ * @property string $wallet_id
	*/
	class Entitlement extends Model
	{
	@@ -45,11 +53,13 @@
	'entitleable_id',
	'entitleable_type',
	'cost',
	- 'description'
	+ 'description',
	+ 'fee',
	];

	protected $casts = [
	'cost' => 'integer',
	+ 'fee' => 'integer'
	];

	/**
	diff --git a/src/app/Group.php b/src/app/Group.php
	--- a/src/app/Group.php
	+++ b/src/app/Group.php
	@@ -64,6 +64,7 @@
	'wallet_id' => $wallet->id,
	'sku_id' => $sku->id,
	'cost' => $exists >= $sku->units_free ? $sku->cost : 0,
	+ 'fee' => $exists >= $sku->units_free ? $sku->fee : 0,
	'entitleable_id' => $this->id,
	'entitleable_type' => Group::class
	]);
	diff --git a/src/app/Http/Controllers/API/SignupController.php b/src/app/Http/Controllers/API/SignupController.php
	--- a/src/app/Http/Controllers/API/SignupController.php
	+++ b/src/app/Http/Controllers/API/SignupController.php
	@@ -12,6 +12,7 @@
	use App\Rules\UserEmailDomain;
	use App\Rules\UserEmailLocal;
	use App\SignupCode;
	+use App\SignupInvitation;
	use App\User;
	use Illuminate\Http\Request;
	use Illuminate\Support\Facades\DB;
	@@ -111,6 +112,33 @@
	return response()->json(['status' => 'success', 'code' => $code->code]);
	}

	+ /**
	+ * Returns signup invitation information.
	+ *
	+ * @param string $id Signup invitation identifier
	+ *
	+ * @return \Illuminate\Http\JsonResponse\|void
	+ */
	+ public function invitation($id)
	+ {
	+ $invitation = SignupInvitation::withEnvTenant()->find($id);
	+
	+ if (empty($invitation) \|\| $invitation->isCompleted()) {
	+ return $this->errorResponse(404);
	+ }
	+
	+ $has_domain = $this->getPlan()->hasDomain();
	+
	+ $result = [
	+ 'id' => $id,
	+ 'is_domain' => $has_domain,
	+ 'domains' => $has_domain ? [] : Domain::getPublicDomains(),
	+ ];
	+
	+ return response()->json($result);
	+ }
	+
	+
	/**
	* Validation of the verification code.
	*
	@@ -188,10 +216,50 @@
	return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
	}

	- // Validate verification codes (again)
	- $v = $this->verify($request);
	- if ($v->status() !== 200) {
	- return $v;
	+ // Signup via invitation
	+ if ($request->invitation) {
	+ $invitation = SignupInvitation::withEnvTenant()->find($request->invitation);
	+
	+ if (empty($invitation) \|\| $invitation->isCompleted()) {
	+ return $this->errorResponse(404);
	+ }
	+
	+ // Check required fields
	+ $v = Validator::make(
	+ $request->all(),
	+ [
	+ 'first_name' => 'max:128',
	+ 'last_name' => 'max:128',
	+ 'voucher' => 'max:32',
	+ ]
	+ );
	+
	+ $errors = $v->fails() ? $v->errors()->toArray() : [];
	+
	+ if (!empty($errors)) {
	+ return response()->json(['status' => 'error', 'errors' => $errors], 422);
	+ }
	+
	+ $settings = [
	+ 'external_email' => $invitation->email,
	+ 'first_name' => $request->first_name,
	+ 'last_name' => $request->last_name,
	+ ];
	+ } else {
	+ // Validate verification codes (again)
	+ $v = $this->verify($request);
	+ if ($v->status() !== 200) {
	+ return $v;
	+ }
	+
	+ // Get user name/email from the verification code database
	+ $code_data = $v->getData();
	+
	+ $settings = [
	+ 'external_email' => $code_data->email,
	+ 'first_name' => $code_data->first_name,
	+ 'last_name' => $code_data->last_name,
	+ ];
	}

	// Find the voucher discount
	@@ -217,10 +285,6 @@
	return response()->json(['status' => 'error', 'errors' => $errors], 422);
	}

	- // Get user name/email from the verification code database
	- $code_data = $v->getData();
	- $user_email = $code_data->email;
	-
	// We allow only ASCII, so we can safely lower-case the email address
	$login = Str::lower($login);
	$domain_name = Str::lower($domain_name);
	@@ -252,14 +316,19 @@
	$user->assignPlan($plan, $domain);

	// Save the external email and plan in user settings
	- $user->setSettings([
	- 'external_email' => $user_email,
	- 'first_name' => $code_data->first_name,
	- 'last_name' => $code_data->last_name,
	- ]);
	+ $user->setSettings($settings);
	+
	+ // Update the invitation
	+ if (!empty($invitation)) {
	+ $invitation->status = SignupInvitation::STATUS_COMPLETED;
	+ $invitation->user_id = $user->id;
	+ $invitation->save();
	+ }

	// Remove the verification code
	- $this->code->delete();
	+ if ($this->code) {
	+ $this->code->delete();
	+ }

	DB::commit();

	diff --git a/src/app/Http/Controllers/API/V4/Admin/DiscountsController.php b/src/app/Http/Controllers/API/V4/Admin/DiscountsController.php
	--- a/src/app/Http/Controllers/API/V4/Admin/DiscountsController.php
	+++ b/src/app/Http/Controllers/API/V4/Admin/DiscountsController.php
	@@ -16,7 +16,10 @@
	{
	$discounts = [];

	- Discount::where('active', true)->orderBy('discount')->get()
	+ Discount::withEnvTenant()
	+ ->where('active', true)
	+ ->orderBy('discount')
	+ ->get()
	->map(function ($discount) use (&$discounts) {
	$label = $discount->discount . '% - ' . $discount->description;

	diff --git a/src/app/Http/Controllers/API/V4/Admin/DomainsController.php b/src/app/Http/Controllers/API/V4/Admin/DomainsController.php
	--- a/src/app/Http/Controllers/API/V4/Admin/DomainsController.php
	+++ b/src/app/Http/Controllers/API/V4/Admin/DomainsController.php
	@@ -20,7 +20,7 @@
	$result = collect([]);

	if ($owner) {
	- if ($owner = User::find($owner)) {
	+ if ($owner = User::withEnvTenant()->find($owner)) {
	foreach ($owner->wallets as $wallet) {
	$entitlements = $wallet->entitlements()->where('entitleable_type', Domain::class)->get();

	@@ -33,7 +33,7 @@
	$result = $result->sortBy('namespace')->values();
	}
	} elseif (!empty($search)) {
	- if ($domain = Domain::where('namespace', $search)->first()) {
	+ if ($domain = Domain::withEnvTenant()->where('namespace', $search)->first()) {
	$result->push($domain);
	}
	}
	@@ -64,7 +64,7 @@
	*/
	public function suspend(Request $request, $id)
	{
	- $domain = Domain::find($id);
	+ $domain = Domain::withEnvTenant()->find($id);

	if (empty($domain) \|\| $domain->isPublic()) {
	return $this->errorResponse(404);
	@@ -88,7 +88,7 @@
	*/
	public function unsuspend(Request $request, $id)
	{
	- $domain = Domain::find($id);
	+ $domain = Domain::withEnvTenant()->find($id);

	if (empty($domain) \|\| $domain->isPublic()) {
	return $this->errorResponse(404);
	diff --git a/src/app/Http/Controllers/API/V4/Admin/EntitlementsController.php b/src/app/Http/Controllers/API/V4/Admin/EntitlementsController.php
	deleted file mode 100644
	--- a/src/app/Http/Controllers/API/V4/Admin/EntitlementsController.php
	+++ /dev/null
	@@ -1,7 +0,0 @@
	-<?php
	-
	-namespace App\Http\Controllers\API\V4\Admin;
	-
	-class EntitlementsController extends \App\Http\Controllers\API\V4\EntitlementsController
	-{
	-}
	diff --git a/src/app/Http/Controllers/API/V4/Admin/GroupsController.php b/src/app/Http/Controllers/API/V4/Admin/GroupsController.php
	--- a/src/app/Http/Controllers/API/V4/Admin/GroupsController.php
	+++ b/src/app/Http/Controllers/API/V4/Admin/GroupsController.php
	@@ -20,7 +20,7 @@
	$result = collect([]);

	if ($owner) {
	- if ($owner = User::find($owner)) {
	+ if ($owner = User::withEnvTenant()->find($owner)) {
	foreach ($owner->wallets as $wallet) {
	$wallet->entitlements()->where('entitleable_type', Group::class)->get()
	->each(function ($entitlement) use ($result) {
	@@ -31,7 +31,7 @@
	$result = $result->sortBy('namespace')->values();
	}
	} elseif (!empty($search)) {
	- if ($group = Group::where('email', $search)->first()) {
	+ if ($group = Group::withEnvTenant()->where('email', $search)->first()) {
	$result->push($group);
	}
	}
	@@ -78,7 +78,7 @@
	*/
	public function suspend(Request $request, $id)
	{
	- $group = Group::find($id);
	+ $group = Group::withEnvTenant()->find($id);

	if (empty($group)) {
	return $this->errorResponse(404);
	@@ -102,7 +102,7 @@
	*/
	public function unsuspend(Request $request, $id)
	{
	- $group = Group::find($id);
	+ $group = Group::withEnvTenant()->find($id);

	if (empty($group)) {
	return $this->errorResponse(404);
	diff --git a/src/app/Http/Controllers/API/V4/Admin/StatsController.php b/src/app/Http/Controllers/API/V4/Admin/StatsController.php
	--- a/src/app/Http/Controllers/API/V4/Admin/StatsController.php
	+++ b/src/app/Http/Controllers/API/V4/Admin/StatsController.php
	@@ -6,6 +6,7 @@
	use App\User;
	use Carbon\Carbon;
	use Illuminate\Http\Request;
	+use Illuminate\Support\Facades\Auth;
	use Illuminate\Support\Facades\DB;

	class StatsController extends \App\Http\Controllers\Controller
	@@ -18,6 +19,14 @@
	public const COLOR_BLUE_DARK = '#0056b3';
	public const COLOR_ORANGE = '#f1a539';

	+ /** @var array List of enabled charts */
	+ protected $charts = [
	+ 'discounts',
	+ 'income',
	+ 'users',
	+ 'users-all',
	+ ];
	+
	/**
	* Fetch chart data
	*
	@@ -33,7 +42,7 @@

	$method = 'chart' . implode('', array_map('ucfirst', explode('-', $chart)));

	- if (!method_exists($this, $method)) {
	+ if (!in_array($chart, $this->charts) \|\| !method_exists($this, $method)) {
	return $this->errorResponse(404);
	}

	@@ -53,9 +62,14 @@
	->join('users', 'users.id', '=', 'wallets.user_id')
	->where('discount', '>', 0)
	->whereNull('users.deleted_at')
	- ->groupBy('discounts.discount')
	- ->pluck('cnt', 'discount')
	- ->all();
	+ ->groupBy('discounts.discount');
	+
	+ $addTenantScope = function ($builder, $tenantId) {
	+ return $builder->where('users.tenant_id', $tenantId);
	+ };
	+
	+ $discounts = $this->applyTenantScope($discounts, $addTenantScope)
	+ ->pluck('cnt', 'discount')->all();

	$labels = array_keys($discounts);
	$discounts = array_values($discounts);
	@@ -119,7 +133,20 @@
	->where('updated_at', '>=', $start->toDateString())
	->where('status', PaymentProvider::STATUS_PAID)
	->whereIn('type', [PaymentProvider::TYPE_ONEOFF, PaymentProvider::TYPE_RECURRING])
	- ->groupByRaw('1')
	+ ->groupByRaw('1');
	+
	+ $addTenantScope = function ($builder, $tenantId) {
	+ $where = '`wallet_id` IN ('
	+ . 'select `id` from `wallets` '
	+ . 'join `users` on (`wallets`.`user_id` = `users`.`id`) '
	+ . 'where `payments`.`wallet_id` = `wallets`.`id` '
	+ . 'and `users`.`tenant_id` = ' . intval($tenantId)
	+ . ')';
	+
	+ return $builder->whereRaw($where);
	+ };
	+
	+ $payments = $this->applyTenantScope($payments, $addTenantScope)
	->pluck('amount', 'period')
	->map(function ($amount) {
	return $amount / 100;
	@@ -185,14 +212,15 @@
	$created = DB::table('users')
	->selectRaw("date_format(created_at, '%Y-%v') as period, count(*) as cnt")
	->where('created_at', '>=', $start->toDateString())
	- ->groupByRaw('1')
	- ->get();
	+ ->groupByRaw('1');

	$deleted = DB::table('users')
	->selectRaw("date_format(deleted_at, '%Y-%v') as period, count(*) as cnt")
	->where('deleted_at', '>=', $start->toDateString())
	- ->groupByRaw('1')
	- ->get();
	+ ->groupByRaw('1');
	+
	+ $created = $this->applyTenantScope($created)->get();
	+ $deleted = $this->applyTenantScope($deleted)->get();

	$empty = array_fill_keys($labels, 0);
	$created = array_values(array_merge($empty, $created->pluck('cnt', 'period')->all()));
	@@ -260,16 +288,16 @@
	$created = DB::table('users')
	->selectRaw("date_format(created_at, '%Y-%v') as period, count(*) as cnt")
	->where('created_at', '>=', $start->toDateString())
	- ->groupByRaw('1')
	- ->get();
	+ ->groupByRaw('1');

	$deleted = DB::table('users')
	->selectRaw("date_format(deleted_at, '%Y-%v') as period, count(*) as cnt")
	->where('deleted_at', '>=', $start->toDateString())
	- ->groupByRaw('1')
	- ->get();
	+ ->groupByRaw('1');

	- $count = DB::table('users')->whereNull('deleted_at')->count();
	+ $created = $this->applyTenantScope($created)->get();
	+ $deleted = $this->applyTenantScope($deleted)->get();
	+ $count = $this->applyTenantScope(DB::table('users')->whereNull('deleted_at'))->count();

	$empty = array_fill_keys($labels, 0);
	$created = array_merge($empty, $created->pluck('cnt', 'period')->all());
	@@ -313,4 +341,29 @@
	]
	];
	}
	+
	+ /**
	+ * Add tenant scope to the queries when needed
	+ *
	+ * @param \Illuminate\Database\Query\Builder $query The query
	+ * @param callable $addQuery Additional tenant-scope query-modifier
	+ *
	+ * @return \Illuminate\Database\Query\Builder
	+ */
	+ protected function applyTenantScope($query, $addQuery = null)
	+ {
	+ $user = Auth::guard()->user();
	+
	+ if ($user->role == 'reseller') {
	+ if ($addQuery) {
	+ $query = $addQuery($query, \config('app.tenant_id'));
	+ } else {
	+ $query = $query->withEnvTenant();
	+ }
	+ }
	+
	+ // TODO: Tenant selector for admins
	+
	+ return $query;
	+ }
	}
	diff --git a/src/app/Http/Controllers/API/V4/Admin/UsersController.php b/src/app/Http/Controllers/API/V4/Admin/UsersController.php
	--- a/src/app/Http/Controllers/API/V4/Admin/UsersController.php
	+++ b/src/app/Http/Controllers/API/V4/Admin/UsersController.php
	@@ -13,6 +13,18 @@

	class UsersController extends \App\Http\Controllers\API\V4\UsersController
	{
	+ /**
	+ * Delete a user.
	+ *
	+ * @param int $id User identifier
	+ *
	+ * @return \Illuminate\Http\JsonResponse The response
	+ */
	+ public function destroy($id)
	+ {
	+ return $this->errorResponse(404);
	+ }
	+
	/**
	* Searching of user accounts.
	*
	@@ -25,13 +37,21 @@
	$result = collect([]);

	if ($owner) {
	- if ($owner = User::find($owner)) {
	- $result = $owner->users(false)->orderBy('email')->get();
	+ $owner = User::where('id', $owner)
	+ ->withEnvTenant()
	+ ->whereNull('role')
	+ ->first();
	+
	+ if ($owner) {
	+ $result = $owner->users(false)->whereNull('role')->orderBy('email')->get();
	}
	} elseif (strpos($search, '@')) {
	// Search by email
	$result = User::withTrashed()->where('email', $search)
	- ->orderBy('email')->get();
	+ ->withEnvTenant()
	+ ->whereNull('role')
	+ ->orderBy('email')
	+ ->get();

	if ($result->isEmpty()) {
	// Search by an alias
	@@ -39,7 +59,9 @@

	// Search by an external email
	$ext_user_ids = UserSetting::where('key', 'external_email')
	- ->where('value', $search)->get()->pluck('user_id');
	+ ->where('value', $search)
	+ ->get()
	+ ->pluck('user_id');

	$user_ids = $user_ids->merge($ext_user_ids)->unique();

	@@ -50,19 +72,35 @@

	if (!$user_ids->isEmpty()) {
	$result = User::withTrashed()->whereIn('id', $user_ids)
	- ->orderBy('email')->get();
	+ ->withEnvTenant()
	+ ->whereNull('role')
	+ ->orderBy('email')
	+ ->get();
	}
	}
	} elseif (is_numeric($search)) {
	// Search by user ID
	- if ($user = User::withTrashed()->find($search)) {
	+ $user = User::withTrashed()->where('id', $search)
	+ ->withEnvTenant()
	+ ->whereNull('role')
	+ ->first();
	+
	+ if ($user) {
	$result->push($user);
	}
	} elseif (!empty($search)) {
	// Search by domain
	- if ($domain = Domain::withTrashed()->where('namespace', $search)->first()) {
	- if ($wallet = $domain->wallet()) {
	- $result->push($wallet->owner()->withTrashed()->first());
	+ $domain = Domain::withTrashed()->where('namespace', $search)
	+ ->withEnvTenant()
	+ ->first();
	+
	+ if ($domain) {
	+ if (
	+ ($wallet = $domain->wallet())
	+ && ($owner = $wallet->owner()->withTrashed()->withEnvTenant()->first())
	+ && empty($owner->role)
	+ ) {
	+ $result->push($owner);
	}
	}
	}
	@@ -93,9 +131,9 @@
	*/
	public function reset2FA(Request $request, $id)
	{
	- $user = User::find($id);
	+ $user = User::withEnvTenant()->find($id);

	- if (empty($user)) {
	+ if (empty($user) \|\| !$this->guard()->user()->canUpdate($user)) {
	return $this->errorResponse(404);
	}

	@@ -113,6 +151,18 @@
	]);
	}

	+ /**
	+ * Create a new user record.
	+ *
	+ * @param \Illuminate\Http\Request $request The API request.
	+ *
	+ * @return \Illuminate\Http\JsonResponse The response
	+ */
	+ public function store(Request $request)
	+ {
	+ return $this->errorResponse(404);
	+ }
	+
	/**
	* Suspend the user
	*
	@@ -123,9 +173,9 @@
	*/
	public function suspend(Request $request, $id)
	{
	- $user = User::find($id);
	+ $user = User::withEnvTenant()->find($id);

	- if (empty($user)) {
	+ if (empty($user) \|\| !$this->guard()->user()->canUpdate($user)) {
	return $this->errorResponse(404);
	}

	@@ -147,9 +197,9 @@
	*/
	public function unsuspend(Request $request, $id)
	{
	- $user = User::find($id);
	+ $user = User::withEnvTenant()->find($id);

	- if (empty($user)) {
	+ if (empty($user) \|\| !$this->guard()->user()->canUpdate($user)) {
	return $this->errorResponse(404);
	}

	@@ -171,9 +221,9 @@
	*/
	public function update(Request $request, $id)
	{
	- $user = User::find($id);
	+ $user = User::withEnvTenant()->find($id);

	- if (empty($user)) {
	+ if (empty($user) \|\| !$this->guard()->user()->canUpdate($user)) {
	return $this->errorResponse(404);
	}

	diff --git a/src/app/Http/Controllers/API/V4/Admin/WalletsController.php b/src/app/Http/Controllers/API/V4/Admin/WalletsController.php
	--- a/src/app/Http/Controllers/API/V4/Admin/WalletsController.php
	+++ b/src/app/Http/Controllers/API/V4/Admin/WalletsController.php
	@@ -8,6 +8,7 @@
	use App\Transaction;
	use App\Wallet;
	use Illuminate\Http\Request;
	+use Illuminate\Support\Facades\Auth;
	use Illuminate\Support\Facades\DB;
	use Illuminate\Support\Facades\Validator;

	@@ -24,7 +25,7 @@
	{
	$wallet = Wallet::find($id);

	- if (empty($wallet)) {
	+ if (empty($wallet) \|\| !Auth::guard()->user()->canRead($wallet)) {
	return $this->errorResponse(404);
	}

	@@ -60,7 +61,7 @@
	{
	$wallet = Wallet::find($id);

	- if (empty($wallet)) {
	+ if (empty($wallet) \|\| !Auth::guard()->user()->canRead($wallet)) {
	return $this->errorResponse(404);
	}

	@@ -119,7 +120,7 @@
	{
	$wallet = Wallet::find($id);

	- if (empty($wallet)) {
	+ if (empty($wallet) \|\| !Auth::guard()->user()->canRead($wallet)) {
	return $this->errorResponse(404);
	}

	@@ -127,7 +128,7 @@
	if (empty($request->discount)) {
	$wallet->discount()->dissociate();
	$wallet->save();
	- } elseif ($discount = Discount::find($request->discount)) {
	+ } elseif ($discount = Discount::withEnvTenant()->find($request->discount)) {
	$wallet->discount()->associate($discount);
	$wallet->save();
	}
	diff --git a/src/app/Http/Controllers/API/V4/DomainsController.php b/src/app/Http/Controllers/API/V4/DomainsController.php
	--- a/src/app/Http/Controllers/API/V4/DomainsController.php
	+++ b/src/app/Http/Controllers/API/V4/DomainsController.php
	@@ -117,7 +117,7 @@
	*/
	public function show($id)
	{
	- $domain = Domain::findOrFail($id);
	+ $domain = Domain::withEnvTenant()->findOrFail($id);

	// Only owner (or admin) has access to the domain
	if (!Auth::guard()->user()->canRead($domain)) {
	diff --git a/src/app/Http/Controllers/API/V4/EntitlementsController.php b/src/app/Http/Controllers/API/V4/EntitlementsController.php
	deleted file mode 100644
	--- a/src/app/Http/Controllers/API/V4/EntitlementsController.php
	+++ /dev/null
	@@ -1,97 +0,0 @@
	-<?php
	-
	-namespace App\Http\Controllers\API\V4;
	-
	-use App\Http\Controllers\Controller;
	-use Illuminate\Http\Request;
	-
	-class EntitlementsController extends Controller
	-{
	- /**
	- * Show the form for creating a new resource.
	- *
	- * @return \Illuminate\Http\JsonResponse
	- */
	- public function create()
	- {
	- // TODO
	- return $this->errorResponse(404);
	- }
	-
	- /**
	- * Remove the specified resource from storage.
	- *
	- * @param int $id
	- *
	- * @return \Illuminate\Http\JsonResponse
	- */
	- public function destroy($id)
	- {
	- // TODO
	- return $this->errorResponse(404);
	- }
	-
	- /**
	- * Show the form for editing the specified resource.
	- *
	- * @param int $id
	- *
	- * @return \Illuminate\Http\JsonResponse
	- */
	- public function edit($id)
	- {
	- // TODO
	- return $this->errorResponse(404);
	- }
	-
	- /**
	- * Display a listing of the resource.
	- *
	- * @return \Illuminate\Http\JsonResponse
	- */
	- public function index()
	- {
	- // TODO
	- return $this->errorResponse(404);
	- }
	-
	- /**
	- * Store a newly created resource in storage.
	- *
	- * @param \Illuminate\Http\Request $request
	- *
	- * @return \Illuminate\Http\JsonResponse
	- */
	- public function store(Request $request)
	- {
	- // TODO
	- return $this->errorResponse(404);
	- }
	-
	- /**
	- * Display the specified resource.
	- *
	- * @param int $id
	- *
	- * @return \Illuminate\Http\JsonResponse
	- */
	- public function show($id)
	- {
	- // TODO
	- return $this->errorResponse(404);
	- }
	-
	- /**
	- * Update the specified resource in storage.
	- *
	- * @param \Illuminate\Http\Request $request
	- * @param int $id
	- *
	- * @return \Illuminate\Http\JsonResponse
	- */
	- public function update(Request $request, $id)
	- {
	- // TODO
	- return $this->errorResponse(404);
	- }
	-}
	diff --git a/src/app/Http/Controllers/API/V4/GroupsController.php b/src/app/Http/Controllers/API/V4/GroupsController.php
	--- a/src/app/Http/Controllers/API/V4/GroupsController.php
	+++ b/src/app/Http/Controllers/API/V4/GroupsController.php
	@@ -32,7 +32,7 @@
	*/
	public function destroy($id)
	{
	- $group = Group::find($id);
	+ $group = Group::withEnvTenant()->find($id);

	if (empty($group)) {
	return $this->errorResponse(404);
	@@ -96,7 +96,7 @@
	*/
	public function show($id)
	{
	- $group = Group::find($id);
	+ $group = Group::withEnvTenant()->find($id);

	if (empty($group)) {
	return $this->errorResponse(404);
	@@ -123,7 +123,7 @@
	*/
	public function status($id)
	{
	- $group = Group::find($id);
	+ $group = Group::withEnvTenant()->find($id);

	if (empty($group)) {
	return $this->errorResponse(404);
	@@ -308,7 +308,7 @@
	*/
	public function update(Request $request, $id)
	{
	- $group = Group::find($id);
	+ $group = Group::withEnvTenant()->find($id);

	if (empty($group)) {
	return $this->errorResponse(404);
	diff --git a/src/app/Http/Controllers/API/V4/Reseller/DiscountsController.php b/src/app/Http/Controllers/API/V4/Reseller/DiscountsController.php
	new file mode 100644
	--- /dev/null
	+++ b/src/app/Http/Controllers/API/V4/Reseller/DiscountsController.php
	@@ -0,0 +1,7 @@
	+<?php
	+
	+namespace App\Http\Controllers\API\V4\Reseller;
	+
	+class DiscountsController extends \App\Http\Controllers\API\V4\Admin\DiscountsController
	+{
	+}
	diff --git a/src/app/Http/Controllers/API/V4/Reseller/DomainsController.php b/src/app/Http/Controllers/API/V4/Reseller/DomainsController.php
	new file mode 100644
	--- /dev/null
	+++ b/src/app/Http/Controllers/API/V4/Reseller/DomainsController.php
	@@ -0,0 +1,7 @@
	+<?php
	+
	+namespace App\Http\Controllers\API\V4\Reseller;
	+
	+class DomainsController extends \App\Http\Controllers\API\V4\Admin\DomainsController
	+{
	+}
	diff --git a/src/app/Http/Controllers/API/V4/Reseller/GroupsController.php b/src/app/Http/Controllers/API/V4/Reseller/GroupsController.php
	new file mode 100644
	--- /dev/null
	+++ b/src/app/Http/Controllers/API/V4/Reseller/GroupsController.php
	@@ -0,0 +1,7 @@
	+<?php
	+
	+namespace App\Http\Controllers\API\V4\Reseller;
	+
	+class GroupsController extends \App\Http\Controllers\API\V4\Admin\GroupsController
	+{
	+}
	diff --git a/src/app/Http/Controllers/API/V4/Reseller/InvitationsController.php b/src/app/Http/Controllers/API/V4/Reseller/InvitationsController.php
	new file mode 100644
	--- /dev/null
	+++ b/src/app/Http/Controllers/API/V4/Reseller/InvitationsController.php
	@@ -0,0 +1,252 @@
	+<?php
	+
	+namespace App\Http\Controllers\API\V4\Reseller;
	+
	+use App\Http\Controllers\Controller;
	+use App\SignupInvitation;
	+use Illuminate\Http\Request;
	+use Illuminate\Support\Facades\Validator;
	+
	+class InvitationsController extends Controller
	+{
	+ /**
	+ * Show the form for creating a new resource.
	+ *
	+ * @return \Illuminate\Http\JsonResponse
	+ */
	+ public function create()
	+ {
	+ return $this->errorResponse(404);
	+ }
	+
	+ /**
	+ * Remove the specified invitation.
	+ *
	+ * @param int $id Invitation identifier
	+ *
	+ * @return \Illuminate\Http\JsonResponse
	+ */
	+ public function destroy($id)
	+ {
	+ $invitation = SignupInvitation::withUserTenant()->find($id);
	+
	+ if (empty($invitation)) {
	+ return $this->errorResponse(404);
	+ }
	+
	+ $invitation->delete();
	+
	+ return response()->json([
	+ 'status' => 'success',
	+ 'message' => trans('app.signup-invitation-delete-success'),
	+ ]);
	+ }
	+
	+ /**
	+ * Show the form for editing the specified resource.
	+ *
	+ * @param int $id Invitation identifier
	+ *
	+ * @return \Illuminate\Http\JsonResponse
	+ */
	+ public function edit($id)
	+ {
	+ return $this->errorResponse(404);
	+ }
	+
	+ /**
	+ * Display a listing of the resource.
	+ *
	+ * @return \Illuminate\Http\JsonResponse
	+ */
	+ public function index()
	+ {
	+ $pageSize = 10;
	+ $search = request()->input('search');
	+ $page = intval(request()->input('page')) ?: 1;
	+ $hasMore = false;
	+
	+ $result = SignupInvitation::withUserTenant()
	+ ->latest()
	+ ->limit($pageSize + 1)
	+ ->offset($pageSize * ($page - 1));
	+
	+ if ($search) {
	+ if (strpos($search, '@')) {
	+ $result->where('email', $search);
	+ } else {
	+ $result->whereLike('email', $search);
	+ }
	+ }
	+
	+ $result = $result->get();
	+
	+ if (count($result) > $pageSize) {
	+ $result->pop();
	+ $hasMore = true;
	+ }
	+
	+ $result = $result->map(function ($invitation) {
	+ return $this->invitationToArray($invitation);
	+ });
	+
	+ return response()->json([
	+ 'status' => 'success',
	+ 'list' => $result,
	+ 'count' => count($result),
	+ 'hasMore' => $hasMore,
	+ 'page' => $page,
	+ ]);
	+ }
	+
	+ /**
	+ * Resend the specified invitation.
	+ *
	+ * @param int $id Invitation identifier
	+ *
	+ * @return \Illuminate\Http\JsonResponse
	+ */
	+ public function resend($id)
	+ {
	+ $invitation = SignupInvitation::withUserTenant()->find($id);
	+
	+ if (empty($invitation)) {
	+ return $this->errorResponse(404);
	+ }
	+
	+ if ($invitation->isFailed() \|\| $invitation->isSent()) {
	+ // Note: The email sending job will be dispatched by the observer
	+ $invitation->status = SignupInvitation::STATUS_NEW;
	+ $invitation->save();
	+ }
	+
	+ return response()->json([
	+ 'status' => 'success',
	+ 'message' => trans('app.signup-invitation-resend-success'),
	+ 'invitation' => $this->invitationToArray($invitation),
	+ ]);
	+ }
	+
	+ /**
	+ * Store a newly created resource in storage.
	+ *
	+ * @param \Illuminate\Http\Request $request
	+ *
	+ * @return \Illuminate\Http\JsonResponse
	+ */
	+ public function store(Request $request)
	+ {
	+ $errors = [];
	+ $invitations = [];
	+
	+ if (!empty($request->file) && is_object($request->file)) {
	+ // Expected a text/csv file with multiple email addresses
	+ if (!$request->file->isValid()) {
	+ $errors = ['file' => [$request->file->getErrorMessage()]];
	+ } else {
	+ $fh = fopen($request->file->getPathname(), 'r');
	+ $line_number = 0;
	+ $error = null;
	+
	+ while ($line = fgetcsv($fh)) {
	+ $line_number++;
	+
	+ // @phpstan-ignore-next-line
	+ if (count($line) >= 1 && $line[0]) {
	+ $email = trim($line[0]);
	+
	+ if (strpos($email, '@')) {
	+ $v = Validator::make(['email' => $email], ['email' => 'email:filter\|required']);
	+
	+ if ($v->fails()) {
	+ $args = ['email' => $email, 'line' => $line_number];
	+ $error = trans('app.signup-invitations-csv-invalid-email', $args);
	+ break;
	+ }
	+
	+ $invitations[] = ['email' => $email];
	+ }
	+ }
	+ }
	+
	+ fclose($fh);
	+
	+ if ($error) {
	+ $errors = ['file' => $error];
	+ } elseif (empty($invitations)) {
	+ $errors = ['file' => trans('app.signup-invitations-csv-empty')];
	+ }
	+ }
	+ } else {
	+ // Expected 'email' field with an email address
	+ $v = Validator::make($request->all(), ['email' => 'email\|required']);
	+
	+ if ($v->fails()) {
	+ $errors = $v->errors()->toArray();
	+ } else {
	+ $invitations[] = ['email' => $request->email];
	+ }
	+ }
	+
	+ if (!empty($errors)) {
	+ return response()->json(['status' => 'error', 'errors' => $errors], 422);
	+ }
	+
	+ $count = 0;
	+ foreach ($invitations as $idx => $invitation) {
	+ SignupInvitation::create($invitation);
	+ $count++;
	+ }
	+
	+ return response()->json([
	+ 'status' => 'success',
	+ 'message' => \trans_choice('app.signup-invitations-created', $count, ['count' => $count]),
	+ 'count' => $count,
	+ ]);
	+ }
	+
	+ /**
	+ * Display the specified resource.
	+ *
	+ * @param int $id Invitation identifier
	+ *
	+ * @return \Illuminate\Http\JsonResponse
	+ */
	+ public function show($id)
	+ {
	+ return $this->errorResponse(404);
	+ }
	+
	+ /**
	+ * Update the specified resource in storage.
	+ *
	+ * @param \Illuminate\Http\Request $request
	+ * @param int $id
	+ *
	+ * @return \Illuminate\Http\JsonResponse
	+ */
	+ public function update(Request $request, $id)
	+ {
	+ return $this->errorResponse(404);
	+ }
	+
	+ /**
	+ * Convert an invitation object to an array for output
	+ *
	+ * @param \App\SignupInvitation $invitation The signup invitation object
	+ *
	+ * @return array
	+ */
	+ protected static function invitationToArray(SignupInvitation $invitation): array
	+ {
	+ return [
	+ 'id' => $invitation->id,
	+ 'email' => $invitation->email,
	+ 'isNew' => $invitation->isNew(),
	+ 'isSent' => $invitation->isSent(),
	+ 'isFailed' => $invitation->isFailed(),
	+ 'isCompleted' => $invitation->isCompleted(),
	+ 'created' => $invitation->created_at->toDateTimeString(),
	+ ];
	+ }
	+}
	diff --git a/src/app/Http/Controllers/API/V4/Reseller/PackagesController.php b/src/app/Http/Controllers/API/V4/Reseller/PackagesController.php
	new file mode 100644
	--- /dev/null
	+++ b/src/app/Http/Controllers/API/V4/Reseller/PackagesController.php
	@@ -0,0 +1,7 @@
	+<?php
	+
	+namespace App\Http\Controllers\API\V4\Reseller;
	+
	+class PackagesController extends \App\Http\Controllers\API\V4\PackagesController
	+{
	+}
	diff --git a/src/app/Http/Controllers/API/V4/Reseller/SkusController.php b/src/app/Http/Controllers/API/V4/Reseller/SkusController.php
	new file mode 100644
	--- /dev/null
	+++ b/src/app/Http/Controllers/API/V4/Reseller/SkusController.php
	@@ -0,0 +1,7 @@
	+<?php
	+
	+namespace App\Http\Controllers\API\V4\Reseller;
	+
	+class SkusController extends \App\Http\Controllers\API\V4\SkusController
	+{
	+}
	diff --git a/src/app/Http/Controllers/API/V4/Reseller/StatsController.php b/src/app/Http/Controllers/API/V4/Reseller/StatsController.php
	new file mode 100644
	--- /dev/null
	+++ b/src/app/Http/Controllers/API/V4/Reseller/StatsController.php
	@@ -0,0 +1,14 @@
	+<?php
	+
	+namespace App\Http\Controllers\API\V4\Reseller;
	+
	+class StatsController extends \App\Http\Controllers\API\V4\Admin\StatsController
	+{
	+ /** @var array List of enabled charts */
	+ protected $charts = [
	+ 'discounts',
	+ // 'income',
	+ 'users',
	+ 'users-all',
	+ ];
	+}
	diff --git a/src/app/Http/Controllers/API/V4/Reseller/UsersController.php b/src/app/Http/Controllers/API/V4/Reseller/UsersController.php
	new file mode 100644
	--- /dev/null
	+++ b/src/app/Http/Controllers/API/V4/Reseller/UsersController.php
	@@ -0,0 +1,7 @@
	+<?php
	+
	+namespace App\Http\Controllers\API\V4\Reseller;
	+
	+class UsersController extends \App\Http\Controllers\API\V4\Admin\UsersController
	+{
	+}
	diff --git a/src/app/Http/Controllers/API/V4/Reseller/WalletsController.php b/src/app/Http/Controllers/API/V4/Reseller/WalletsController.php
	new file mode 100644
	--- /dev/null
	+++ b/src/app/Http/Controllers/API/V4/Reseller/WalletsController.php
	@@ -0,0 +1,11 @@
	+<?php
	+
	+namespace App\Http\Controllers\API\V4\Reseller;
	+
	+use App\Discount;
	+use App\Wallet;
	+use Illuminate\Http\Request;
	+
	+class WalletsController extends \App\Http\Controllers\API\V4\Admin\WalletsController
	+{
	+}
	diff --git a/src/app/Http/Controllers/API/V4/SkusController.php b/src/app/Http/Controllers/API/V4/SkusController.php
	--- a/src/app/Http/Controllers/API/V4/SkusController.php
	+++ b/src/app/Http/Controllers/API/V4/SkusController.php
	@@ -120,7 +120,7 @@
	*/
	public function userSkus($id)
	{
	- $user = \App\User::find($id);
	+ $user = \App\User::withEnvTenant()->find($id);

	if (empty($user)) {
	return $this->errorResponse(404);
	diff --git a/src/app/Http/Controllers/Controller.php b/src/app/Http/Controllers/Controller.php
	--- a/src/app/Http/Controllers/Controller.php
	+++ b/src/app/Http/Controllers/Controller.php
	@@ -24,7 +24,7 @@
	*
	* @return \Illuminate\Http\JsonResponse
	*/
	- protected function errorResponse(int $code, string $message = null, array $data = [])
	+ public static function errorResponse(int $code, string $message = null, array $data = [])
	{
	$errors = [
	400 => "Bad request",
	diff --git a/src/app/Http/Kernel.php b/src/app/Http/Kernel.php
	--- a/src/app/Http/Kernel.php
	+++ b/src/app/Http/Kernel.php
	@@ -64,6 +64,7 @@
	'cache.headers' => \Illuminate\Http\Middleware\SetCacheHeaders::class,
	'can' => \Illuminate\Auth\Middleware\Authorize::class,
	'guest' => \App\Http\Middleware\RedirectIfAuthenticated::class,
	+ 'reseller' => \App\Http\Middleware\AuthenticateReseller::class,
	'signed' => \Illuminate\Routing\Middleware\ValidateSignature::class,
	'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
	'verified' => \Illuminate\Auth\Middleware\EnsureEmailIsVerified::class,
	@@ -80,11 +81,11 @@
	\Illuminate\Session\Middleware\StartSession::class,
	\Illuminate\View\Middleware\ShareErrorsFromSession::class,
	\App\Http\Middleware\AuthenticateAdmin::class,
	+ \App\Http\Middleware\AuthenticateReseller::class,
	\App\Http\Middleware\Authenticate::class,
	\Illuminate\Session\Middleware\AuthenticateSession::class,
	\Illuminate\Routing\Middleware\SubstituteBindings::class,
	\Illuminate\Auth\Middleware\Authorize::class,
	- \App\Http\Middleware\AuthenticateAdmin::class,
	];

	/**
	diff --git a/src/app/Http/Middleware/AuthenticateAdmin.php b/src/app/Http/Middleware/AuthenticateAdmin.php
	--- a/src/app/Http/Middleware/AuthenticateAdmin.php
	+++ b/src/app/Http/Middleware/AuthenticateAdmin.php
	@@ -18,7 +18,7 @@
	$user = auth()->user();

	if (!$user) {
	- abort(403, "Unauthorized");
	+ abort(401, "Unauthorized");
	}

	if ($user->role !== "admin") {
	diff --git a/src/app/Http/Middleware/AuthenticateAdmin.php b/src/app/Http/Middleware/AuthenticateReseller.php
	copy from src/app/Http/Middleware/AuthenticateAdmin.php
	copy to src/app/Http/Middleware/AuthenticateReseller.php
	--- a/src/app/Http/Middleware/AuthenticateAdmin.php
	+++ b/src/app/Http/Middleware/AuthenticateReseller.php
	@@ -4,7 +4,7 @@

	use Closure;

	-class AuthenticateAdmin
	+class AuthenticateReseller
	{
	/**
	* Handle an incoming request.
	@@ -18,10 +18,14 @@
	$user = auth()->user();

	if (!$user) {
	+ abort(401, "Unauthorized");
	+ }
	+
	+ if ($user->role !== "reseller") {
	abort(403, "Unauthorized");
	}

	- if ($user->role !== "admin") {
	+ if ($user->tenant_id != \config('app.tenant_id')) {
	abort(403, "Unauthorized");
	}

	diff --git a/src/app/Jobs/SignupInvitationEmail.php b/src/app/Jobs/SignupInvitationEmail.php
	new file mode 100644
	--- /dev/null
	+++ b/src/app/Jobs/SignupInvitationEmail.php
	@@ -0,0 +1,75 @@
	+<?php
	+
	+namespace App\Jobs;
	+
	+use App\SignupInvitation;
	+use App\Mail\SignupInvitation as SignupInvitationMail;
	+use Illuminate\Bus\Queueable;
	+use Illuminate\Contracts\Queue\ShouldQueue;
	+use Illuminate\Foundation\Bus\Dispatchable;
	+use Illuminate\Support\Facades\Mail;
	+use Illuminate\Queue\SerializesModels;
	+use Illuminate\Queue\InteractsWithQueue;
	+
	+class SignupInvitationEmail implements ShouldQueue
	+{
	+ use Dispatchable;
	+ use InteractsWithQueue;
	+ use Queueable;
	+ use SerializesModels;
	+
	+ /** @var int The number of times the job may be attempted. */
	+ public $tries = 3;
	+
	+ /** @var bool Delete the job if its models no longer exist. */
	+ public $deleteWhenMissingModels = true;
	+
	+ /** @var int The number of seconds to wait before retrying the job. */
	+ public $retryAfter = 10;
	+
	+ /** @var SignupInvitation Signup invitation object */
	+ protected $invitation;
	+
	+
	+ /**
	+ * Create a new job instance.
	+ *
	+ * @param SignupInvitation $invitation Invitation object
	+ *
	+ * @return void
	+ */
	+ public function __construct(SignupInvitation $invitation)
	+ {
	+ $this->invitation = $invitation;
	+ }
	+
	+ /**
	+ * Execute the job.
	+ *
	+ * @return void
	+ */
	+ public function handle()
	+ {
	+ Mail::to($this->invitation->email)->send(new SignupInvitationMail($this->invitation));
	+
	+ // Update invitation status
	+ $this->invitation->status = SignupInvitation::STATUS_SENT;
	+ $this->invitation->save();
	+ }
	+
	+ /**
	+ * The job failed to process.
	+ *
	+ * @param \Exception $exception
	+ *
	+ * @return void
	+ */
	+ public function failed(\Exception $exception)
	+ {
	+ if ($this->attempts() >= $this->tries) {
	+ // Update invitation status
	+ $this->invitation->status = SignupInvitation::STATUS_FAILED;
	+ $this->invitation->save();
	+ }
	+ }
	+}
	diff --git a/src/app/Mail/SignupInvitation.php b/src/app/Mail/SignupInvitation.php
	new file mode 100644
	--- /dev/null
	+++ b/src/app/Mail/SignupInvitation.php
	@@ -0,0 +1,72 @@
	+<?php
	+
	+namespace App\Mail;
	+
	+use App\SignupInvitation as SI;
	+use App\Utils;
	+use Illuminate\Bus\Queueable;
	+use Illuminate\Mail\Mailable;
	+use Illuminate\Queue\SerializesModels;
	+use Illuminate\Support\Str;
	+
	+class SignupInvitation extends Mailable
	+{
	+ use Queueable;
	+ use SerializesModels;
	+
	+ /** @var \App\SignupInvitation A signup invitation object */
	+ protected $invitation;
	+
	+
	+ /**
	+ * Create a new message instance.
	+ *
	+ * @param \App\SignupInvitation $invitation A signup invitation object
	+ *
	+ * @return void
	+ */
	+ public function __construct(SI $invitation)
	+ {
	+ $this->invitation = $invitation;
	+ }
	+
	+ /**
	+ * Build the message.
	+ *
	+ * @return $this
	+ */
	+ public function build()
	+ {
	+ $href = Utils::serviceUrl('/signup/invite/' . $this->invitation->id);
	+
	+ $this->view('emails.html.signup_invitation')
	+ ->text('emails.plain.signup_invitation')
	+ ->subject(__('mail.signupinvitation-subject', ['site' => \config('app.name')]))
	+ ->with([
	+ 'site' => \config('app.name'),
	+ 'href' => $href,
	+ ]);
	+
	+ return $this;
	+ }
	+
	+ /**
	+ * Render the mail template with fake data
	+ *
	+ * @param string $type Output format ('html' or 'text')
	+ *
	+ * @return string HTML or Plain Text output
	+ */
	+ public static function fakeRender(string $type = 'html'): string
	+ {
	+ $invitation = new SI([
	+ 'email' => 'test@external.org',
	+ ]);
	+
	+ $invitation->id = Utils::uuidStr();
	+
	+ $mail = new self($invitation);
	+
	+ return Helper::render($mail, $type);
	+ }
	+}
	diff --git a/src/app/Observers/DiscountObserver.php b/src/app/Observers/DiscountObserver.php
	--- a/src/app/Observers/DiscountObserver.php
	+++ b/src/app/Observers/DiscountObserver.php
	@@ -25,5 +25,7 @@
	break;
	}
	}
	+
	+ $discount->tenant_id = \config('app.tenant_id');
	}
	}
	diff --git a/src/app/Observers/DomainObserver.php b/src/app/Observers/DomainObserver.php
	--- a/src/app/Observers/DomainObserver.php
	+++ b/src/app/Observers/DomainObserver.php
	@@ -27,6 +27,8 @@
	$domain->namespace = \strtolower($domain->namespace);

	$domain->status \|= Domain::STATUS_NEW;
	+
	+ $domain->tenant_id = \config('app.tenant_id');
	}

	/**
	diff --git a/src/app/Observers/EntitlementObserver.php b/src/app/Observers/EntitlementObserver.php
	--- a/src/app/Observers/EntitlementObserver.php
	+++ b/src/app/Observers/EntitlementObserver.php
	@@ -123,6 +123,7 @@
	return;
	}

	+ $fee = 0;
	$cost = 0;
	$now = Carbon::now();

	@@ -132,6 +133,7 @@
	// just in case this had not been billed yet, ever
	$diffInMonths = $entitlement->updated_at->diffInMonths($now);
	$cost += (int) ($entitlement->cost * $discount * $diffInMonths);
	+ $fee += (int) ($entitlement->fee * $diffInMonths);

	// this moves the hypothetical updated at forward to however many months past the original
	$updatedAt = $entitlement->updated_at->copy()->addMonthsWithoutOverflow($diffInMonths);
	@@ -153,8 +155,18 @@
	}

	$pricePerDay = $entitlement->cost / $daysInMonth;
	+ $feePerDay = $entitlement->fee / $daysInMonth;

	$cost += (int) (round($pricePerDay * $discount * $diffInDays, 0));
	+ $fee += (int) (round($feePerDay * $diffInDays, 0));
	+
	+ $profit = $cost - $fee;
	+
	+ if ($profit != 0 && $owner->tenant && ($wallet = $owner->tenant->wallet()) {
	+ $desc = "Charged user {$this->owner->email}";
	+ $method = $profit > 0 ? 'credit' : 'debit';
	+ $wallet->{$method}(abs($profit), $desc);
	+ }

	if ($cost == 0) {
	return;
	diff --git a/src/app/Observers/GroupObserver.php b/src/app/Observers/GroupObserver.php
	--- a/src/app/Observers/GroupObserver.php
	+++ b/src/app/Observers/GroupObserver.php
	@@ -25,6 +25,8 @@
	}

	$group->status \|= Group::STATUS_NEW \| Group::STATUS_ACTIVE;
	+
	+ $group->tenant_id = \config('app.tenant_id');
	}

	/**
	diff --git a/src/app/Observers/PackageObserver.php b/src/app/Observers/PackageObserver.php
	--- a/src/app/Observers/PackageObserver.php
	+++ b/src/app/Observers/PackageObserver.php
	@@ -27,5 +27,7 @@
	break;
	}
	}
	+
	+ $package->tenant_id = \config('app.tenant_id');
	}
	}
	diff --git a/src/app/Observers/PackageSkuObserver.php b/src/app/Observers/PackageSkuObserver.php
	--- a/src/app/Observers/PackageSkuObserver.php
	+++ b/src/app/Observers/PackageSkuObserver.php
	@@ -6,6 +6,25 @@

	class PackageSkuObserver
	{
	+ /**
	+ * Handle the "creating" event on an PackageSku relation.
	+ *
	+ * Ensures that the entries belong to the same tenant.
	+ *
	+ * @param \App\PackageSku $packageSku The package-sku relation
	+ *
	+ * @return void
	+ */
	+ public function creating(PackageSku $packageSku)
	+ {
	+ $package = $packageSku->package;
	+ $sku = $packageSku->sku;
	+
	+ if ($package->tenant_id != $sku->tenant_id) {
	+ throw new \Exception("Package and SKU owned by different tenants");
	+ }
	+ }
	+
	/**
	* Handle the "created" event on an PackageSku relation
	*
	diff --git a/src/app/Observers/PlanObserver.php b/src/app/Observers/PlanObserver.php
	--- a/src/app/Observers/PlanObserver.php
	+++ b/src/app/Observers/PlanObserver.php
	@@ -27,5 +27,7 @@
	break;
	}
	}
	+
	+ $plan->tenant_id = \config('app.tenant_id');
	}
	}
	diff --git a/src/app/Observers/PlanPackageObserver.php b/src/app/Observers/PlanPackageObserver.php
	new file mode 100644
	--- /dev/null
	+++ b/src/app/Observers/PlanPackageObserver.php
	@@ -0,0 +1,27 @@
	+<?php
	+
	+namespace App\Observers;
	+
	+use App\PlanPackage;
	+
	+class PlanPackageObserver
	+{
	+ /**
	+ * Handle the "creating" event on an PlanPackage relation.
	+ *
	+ * Ensures that the entries belong to the same tenant.
	+ *
	+ * @param \App\PlanPackage $planPackage The plan-package relation
	+ *
	+ * @return void
	+ */
	+ public function creating(PlanPackage $planPackage)
	+ {
	+ $package = $planPackage->package;
	+ $plan = $planPackage->plan;
	+
	+ if ($package->tenant_id != $plan->tenant_id) {
	+ throw new \Exception("Package and Plan owned by different tenants");
	+ }
	+ }
	+}
	diff --git a/src/app/Observers/SignupInvitationObserver.php b/src/app/Observers/SignupInvitationObserver.php
	new file mode 100644
	--- /dev/null
	+++ b/src/app/Observers/SignupInvitationObserver.php
	@@ -0,0 +1,65 @@
	+<?php
	+
	+namespace App\Observers;
	+
	+use App\SignupInvitation as SI;
	+
	+/**
	+ * This is an observer for the SignupInvitation model definition.
	+ */
	+class SignupInvitationObserver
	+{
	+ /**
	+ * Ensure the invitation ID is a custom ID (uuid).
	+ *
	+ * @param \App\SignupInvitation $invitation The invitation object
	+ *
	+ * @return void
	+ */
	+ public function creating(SI $invitation)
	+ {
	+ while (true) {
	+ $allegedly_unique = \App\Utils::uuidStr();
	+ if (!SI::find($allegedly_unique)) {
	+ $invitation->{$invitation->getKeyName()} = $allegedly_unique;
	+ break;
	+ }
	+ }
	+
	+ $invitation->status = SI::STATUS_NEW;
	+
	+ $invitation->tenant_id = \config('app.tenant_id');
	+ }
	+
	+ /**
	+ * Handle the invitation "created" event.
	+ *
	+ * @param \App\SignupInvitation $invitation The invitation object
	+ *
	+ * @return void
	+ */
	+ public function created(SI $invitation)
	+ {
	+ \App\Jobs\SignupInvitationEmail::dispatch($invitation);
	+ }
	+
	+ /**
	+ * Handle the invitation "updated" event.
	+ *
	+ * @param \App\SignupInvitation $invitation The invitation object
	+ *
	+ * @return void
	+ */
	+ public function updated(SI $invitation)
	+ {
	+ $oldStatus = $invitation->getOriginal('status');
	+
	+ // Resend the invitation
	+ if (
	+ $invitation->status == SI::STATUS_NEW
	+ && ($oldStatus == SI::STATUS_FAILED \|\| $oldStatus == SI::STATUS_SENT)
	+ ) {
	+ \App\Jobs\SignupInvitationEmail::dispatch($invitation);
	+ }
	+ }
	+}
	diff --git a/src/app/Observers/SkuObserver.php b/src/app/Observers/SkuObserver.php
	--- a/src/app/Observers/SkuObserver.php
	+++ b/src/app/Observers/SkuObserver.php
	@@ -22,5 +22,9 @@
	break;
	}
	}
	+
	+ $sku->tenant_id = \config('app.tenant_id');
	+
	+ // TODO: We should make sure that tenant_id + title is unique
	}
	}
	diff --git a/src/app/Observers/UserObserver.php b/src/app/Observers/UserObserver.php
	--- a/src/app/Observers/UserObserver.php
	+++ b/src/app/Observers/UserObserver.php
	@@ -38,7 +38,7 @@
	// only users that are not imported get the benefit of the doubt.
	$user->status \|= User::STATUS_NEW \| User::STATUS_ACTIVE;

	- // can't dispatch job here because it'll fail serialization
	+ $user->tenant_id = \config('app.tenant_id');
	}

	/**
	diff --git a/src/app/Package.php b/src/app/Package.php
	--- a/src/app/Package.php
	+++ b/src/app/Package.php
	@@ -21,6 +21,13 @@
	* * Free package: mailbox + quota.
	*
	* Selecting a package will therefore create a set of entitlments from SKUs.
	+ *
	+ * @property string $description
	+ * @property int $discount_rate
	+ * @property string $id
	+ * @property string $name
	+ * @property ?int $tenant_id
	+ * @property string $title
	*/
	class Package extends Model
	{
	@@ -69,7 +76,10 @@
	return $costs;
	}

	- public function isDomain()
	+ /**
	+ * Checks whether the package contains a domain SKU.
	+ */
	+ public function isDomain(): bool
	{
	foreach ($this->skus as $sku) {
	if ($sku->handler_class::entitleableClass() == \App\Domain::class) {
	@@ -94,4 +104,14 @@
	['qty']
	);
	}
	+
	+ /**
	+ * The tenant for this package.
	+ *
	+ * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
	+ */
	+ public function tenant()
	+ {
	+ return $this->belongsTo('App\Tenant', 'tenant_id', 'id');
	+ }
	}
	diff --git a/src/app/Plan.php b/src/app/Plan.php
	--- a/src/app/Plan.php
	+++ b/src/app/Plan.php
	@@ -13,7 +13,16 @@
	* A "Family Plan" as such may exist of "2 or more Kolab packages",
	* and apply a discount for the third and further Kolab packages.
	*
	+ * @property string $description
	+ * @property int $discount_qty
	+ * @property int $discount_rate
	+ * @property string $id
	+ * @property string $name
	* @property \App\Package[] $packages
	+ * @property datetime $promo_from
	+ * @property datetime $promo_to
	+ * @property ?int $tenant_id
	+ * @property string $title
	*/
	class Plan extends Model
	{
	@@ -105,4 +114,14 @@

	return false;
	}
	+
	+ /**
	+ * The tenant for this plan.
	+ *
	+ * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
	+ */
	+ public function tenant()
	+ {
	+ return $this->belongsTo('App\Tenant', 'tenant_id', 'id');
	+ }
	}
	diff --git a/src/app/PlanPackage.php b/src/app/PlanPackage.php
	--- a/src/app/PlanPackage.php
	+++ b/src/app/PlanPackage.php
	@@ -15,6 +15,7 @@
	* @property int $qty_max
	* @property int $qty_min
	* @property \App\Package $package
	+ * @property \App\Plan $plan
	*/
	class PlanPackage extends Pivot
	{
	@@ -54,8 +55,23 @@
	return $costs;
	}

	+ /**
	+ * The package in this relation.
	+ *
	+ * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
	+ */
	public function package()
	{
	return $this->belongsTo('App\Package');
	}
	+
	+ /**
	+ * The plan in this relation.
	+ *
	+ * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
	+ */
	+ public function plan()
	+ {
	+ return $this->belongsTo('App\Plan');
	+ }
	}
	diff --git a/src/app/Providers/AppServiceProvider.php b/src/app/Providers/AppServiceProvider.php
	--- a/src/app/Providers/AppServiceProvider.php
	+++ b/src/app/Providers/AppServiceProvider.php
	@@ -2,6 +2,7 @@

	namespace App\Providers;

	+use Illuminate\Database\Query\Builder;
	use Illuminate\Support\Facades\Blade;
	use Illuminate\Support\Facades\DB;
	use Illuminate\Support\Facades\Schema;
	@@ -34,7 +35,9 @@
	\App\Package::observe(\App\Observers\PackageObserver::class);
	\App\PackageSku::observe(\App\Observers\PackageSkuObserver::class);
	\App\Plan::observe(\App\Observers\PlanObserver::class);
	+ \App\PlanPackage::observe(\App\Observers\PlanPackageObserver::class);
	\App\SignupCode::observe(\App\Observers\SignupCodeObserver::class);
	+ \App\SignupInvitation::observe(\App\Observers\SignupInvitationObserver::class);
	\App\Sku::observe(\App\Observers\SkuObserver::class);
	\App\Transaction::observe(\App\Observers\TransactionObserver::class);
	\App\User::observe(\App\Observers\UserObserver::class);
	@@ -57,5 +60,50 @@
	$path = trim($path, '/\'"');
	return "<?php echo secure_asset('themes/' . \$env['app.theme'] . '/' . '$path'); ?>";
	});
	+
	+ // Query builder 'withEnvTenant' macro
	+ Builder::macro('withEnvTenant', function (string $table = null) {
	+ $tenant_id = \config('app.tenant_id');
	+
	+ if ($tenant_id) {
	+ /** @var Builder $this */
	+ return $this->where(($table ? "$table." : '') . 'tenant_id', $tenant_id);
	+ }
	+
	+ /** @var Builder $this */
	+ return $this->whereNull(($table ? "$table." : '') . 'tenant_id');
	+ });
	+
	+ // Query builder 'withUserTenant' macro
	+ Builder::macro('withUserTenant', function (string $table = null) {
	+ $tenant_id = auth()->user()->tenant_id;
	+
	+ if ($tenant_id) {
	+ /** @var Builder $this */
	+ return $this->where(($table ? "$table." : '') . 'tenant_id', $tenant_id);
	+ }
	+
	+ /** @var Builder $this */
	+ return $this->whereNull(($table ? "$table." : '') . 'tenant_id');
	+ });
	+
	+ // Query builder 'whereLike' mocro
	+ Builder::macro('whereLike', function (string $column, string $search, int $mode = 0) {
	+ $search = addcslashes($search, '%_');
	+
	+ switch ($mode) {
	+ case 2:
	+ $search .= '%';
	+ break;
	+ case 1:
	+ $search = '%' . $search;
	+ break;
	+ default:
	+ $search = '%' . $search . '%';
	+ }
	+
	+ /** @var Builder $this */
	+ return $this->where($column, 'like', $search);
	+ });
	}
	}
	diff --git a/src/app/Providers/PaymentProvider.php b/src/app/Providers/PaymentProvider.php
	--- a/src/app/Providers/PaymentProvider.php
	+++ b/src/app/Providers/PaymentProvider.php
	@@ -261,6 +261,8 @@
	$refund['status'] = self::STATUS_PAID;
	$refund['amount'] = -1 * $amount;

	+ // FIXME: Refunds/chargebacks are out of the reseller comissioning for now
	+
	$this->storePayment($refund, $wallet->id);
	}

	diff --git a/src/app/SignupInvitation.php b/src/app/SignupInvitation.php
	new file mode 100644
	--- /dev/null
	+++ b/src/app/SignupInvitation.php
	@@ -0,0 +1,109 @@
	+<?php
	+
	+namespace App;
	+
	+use Carbon\Carbon;
	+use Illuminate\Database\Eloquent\Model;
	+
	+/**
	+ * The eloquent definition of a signup invitation.
	+ *
	+ * @property string $email
	+ * @property string $id
	+ * @property ?int $tenant_id
	+ * @property ?\App\Tenant $tenant
	+ * @property ?\App\User $user
	+ */
	+class SignupInvitation extends Model
	+{
	+ // just created
	+ public const STATUS_NEW = 1 << 0;
	+ // it's been sent successfully
	+ public const STATUS_SENT = 1 << 1;
	+ // sending failed
	+ public const STATUS_FAILED = 1 << 2;
	+ // the user signed up
	+ public const STATUS_COMPLETED = 1 << 3;
	+
	+
	+ /**
	+ * Indicates if the IDs are auto-incrementing.
	+ *
	+ * @var bool
	+ */
	+ public $incrementing = false;
	+
	+ /**
	+ * The "type" of the auto-incrementing ID.
	+ *
	+ * @var string
	+ */
	+ protected $keyType = 'string';
	+
	+ /**
	+ * The attributes that are mass assignable.
	+ *
	+ * @var array
	+ */
	+ protected $fillable = ['email'];
	+
	+ /**
	+ * Returns whether this invitation process completed (user signed up)
	+ *
	+ * @return bool
	+ */
	+ public function isCompleted(): bool
	+ {
	+ return ($this->status & self::STATUS_COMPLETED) > 0;
	+ }
	+
	+ /**
	+ * Returns whether this invitation sending failed.
	+ *
	+ * @return bool
	+ */
	+ public function isFailed(): bool
	+ {
	+ return ($this->status & self::STATUS_FAILED) > 0;
	+ }
	+
	+ /**
	+ * Returns whether this invitation is new.
	+ *
	+ * @return bool
	+ */
	+ public function isNew(): bool
	+ {
	+ return ($this->status & self::STATUS_NEW) > 0;
	+ }
	+
	+ /**
	+ * Returns whether this invitation has been sent.
	+ *
	+ * @return bool
	+ */
	+ public function isSent(): bool
	+ {
	+ return ($this->status & self::STATUS_SENT) > 0;
	+ }
	+
	+ /**
	+ * The tenant for this invitation.
	+ *
	+ * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
	+ */
	+ public function tenant()
	+ {
	+ return $this->belongsTo('App\Tenant', 'tenant_id', 'id');
	+ }
	+
	+ /**
	+ * The account to which the invitation was used for.
	+ *
	+ * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
	+ */
	+ public function user()
	+ {
	+ return $this->belongsTo('App\User', 'user_id', 'id');
	+ }
	+}
	diff --git a/src/app/Sku.php b/src/app/Sku.php
	--- a/src/app/Sku.php
	+++ b/src/app/Sku.php
	@@ -7,6 +7,18 @@

	/**
	* The eloquent definition of a Stock Keeping Unit (SKU).
	+ *
	+ * @property bool $active
	+ * @property int $cost
	+ * @property string $description
	+ * @property int $fee The fee that the tenant pays to us
	+ * @property string $handler_class
	+ * @property string $id
	+ * @property string $name
	+ * @property string $period
	+ * @property ?int $tenant_id
	+ * @property string $title
	+ * @property int $units_free
	*/
	class Sku extends Model
	{
	@@ -23,6 +35,7 @@
	'active',
	'cost',
	'description',
	+ 'fee',
	'handler_class',
	'name',
	// persist for annual domain registration
	@@ -59,4 +72,14 @@
	'package_skus'
	)->using('App\PackageSku')->withPivot(['cost', 'qty']);
	}
	+
	+ /**
	+ * The tenant for this SKU.
	+ *
	+ * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
	+ */
	+ public function tenant()
	+ {
	+ return $this->belongsTo('App\Tenant', 'tenant_id', 'id');
	+ }
	}
	diff --git a/src/app/Tenant.php b/src/app/Tenant.php
	new file mode 100644
	--- /dev/null
	+++ b/src/app/Tenant.php
	@@ -0,0 +1,52 @@
	+<?php
	+
	+namespace App;
	+
	+use Illuminate\Database\Eloquent\Model;
	+
	+/**
	+ * The eloquent definition of a Tenant.
	+ *
	+ * @property int $id
	+ * @property string $title
	+ */
	+class Tenant extends Model
	+{
	+ protected $fillable = [
	+ 'title',
	+ ];
	+
	+ protected $keyType = 'bigint';
	+
	+ /**
	+ * Discounts assigned to this tenant.
	+ *
	+ * @return \Illuminate\Database\Eloquent\Relations\HasMany
	+ */
	+ public function discounts()
	+ {
	+ return $this->hasMany('App\Discount');
	+ }
	+
	+ /**
	+ * SignupInvitations assigned to this tenant.
	+ *
	+ * @return \Illuminate\Database\Eloquent\Relations\HasMany
	+ */
	+ public function signupInvitations()
	+ {
	+ return $this->hasMany('App\SignupInvitation');
	+ }
	+
	+ /*
	+ * Returns the wallet of the tanant (reseller's wallet).
	+ *
	+ * @return ?\App\Wallet A wallet object
	+ */
	+ public function wallet(): ?Wallet
	+ {
	+ \App\User::where('role', 'reseller')->where('tenant_id', $this->id)->first();
	+
	+ return $user ? $user->wallets->first() : null;
	+ }
	+}
	diff --git a/src/app/User.php b/src/app/User.php
	--- a/src/app/User.php
	+++ b/src/app/User.php
	@@ -20,6 +20,7 @@
	* @property int $id
	* @property string $password
	* @property int $status
	+ * @property int $tenant_id
	*/
	class User extends Authenticatable implements JWTSubject
	{
	@@ -56,7 +57,7 @@
	'email',
	'password',
	'password_ldap',
	- 'status'
	+ 'status',
	];

	/**
	@@ -125,6 +126,7 @@
	'wallet_id' => $wallet_id,
	'sku_id' => $sku->id,
	'cost' => $sku->pivot->cost(),
	+ 'fee' => $sku->fee,
	'entitleable_id' => $user->id,
	'entitleable_type' => User::class
	]
	@@ -178,6 +180,7 @@
	'wallet_id' => $wallet->id,
	'sku_id' => $sku->id,
	'cost' => $exists >= $sku->units_free ? $sku->cost : 0,
	+ 'fee' => $exists >= $sku->units_free ? $sku->fee : 0,
	'entitleable_id' => $this->id,
	'entitleable_type' => User::class
	]);
	@@ -192,7 +195,7 @@
	/**
	* Check if current user can delete another object.
	*
	- * @param \App\User\|\App\Domain $object A user\|domain object
	+ * @param mixed $object A user\|domain\|wallet\|group object
	*
	* @return bool True if he can, False otherwise
	*/
	@@ -213,13 +216,13 @@
	/**
	* Check if current user can read data of another object.
	*
	- * @param \App\User\|\App\Domain\|\App\Wallet $object A user\|domain\|wallet object
	+ * @param mixed $object A user\|domain\|wallet\|group object
	*
	* @return bool True if he can, False otherwise
	*/
	public function canRead($object): bool
	{
	- if ($this->role == "admin") {
	+ if ($this->role == 'admin') {
	return true;
	}

	@@ -227,6 +230,18 @@
	return true;
	}

	+ if ($this->role == 'reseller') {
	+ if ($object instanceof User && $object->role == 'admin') {
	+ return false;
	+ }
	+
	+ if ($object instanceof Wallet && !empty($object->owner)) {
	+ $object = $object->owner;
	+ }
	+
	+ return isset($object->tenant_id) && $object->tenant_id == $this->tenant_id;
	+ }
	+
	if ($object instanceof Wallet) {
	return $object->user_id == $this->id \|\| $object->controllers->contains($this);
	}
	@@ -237,26 +252,38 @@

	$wallet = $object->wallet();

	- return $this->wallets->contains($wallet) \|\| $this->accounts->contains($wallet);
	+ return $wallet && ($this->wallets->contains($wallet) \|\| $this->accounts->contains($wallet));
	}

	/**
	* Check if current user can update data of another object.
	*
	- * @param \App\User\|\App\Domain $object A user\|domain object
	+ * @param mixed $object A user\|domain\|wallet\|group object
	*
	* @return bool True if he can, False otherwise
	*/
	public function canUpdate($object): bool
	{
	- if (!method_exists($object, 'wallet')) {
	- return false;
	+ if ($object instanceof User && $this->id == $object->id) {
	+ return true;
	}

	- if ($object instanceof User && $this->id == $object->id) {
	+ if ($this->role == 'admin') {
	return true;
	}

	+ if ($this->role == 'reseller') {
	+ if ($object instanceof User && $object->role == 'admin') {
	+ return false;
	+ }
	+
	+ if ($object instanceof Wallet && !empty($object->owner)) {
	+ $object = $object->owner;
	+ }
	+
	+ return isset($object->tenant_id) && $object->tenant_id == $this->tenant_id;
	+ }
	+
	return $this->canDelete($object);
	}

	@@ -579,6 +606,16 @@
	$this->save();
	}

	+ /**
	+ * The tenant for this user account.
	+ *
	+ * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
	+ */
	+ public function tenant()
	+ {
	+ return $this->belongsTo('App\Tenant', 'tenant_id', 'id');
	+ }
	+
	/**
	* Unsuspend this domain.
	*
	diff --git a/src/app/Utils.php b/src/app/Utils.php
	--- a/src/app/Utils.php
	+++ b/src/app/Utils.php
	@@ -363,7 +363,6 @@
	$countries = include resource_path('countries.php');
	$req_domain = preg_replace('/:[0-9]+$/', '', request()->getHttpHost());
	$sys_domain = \config('app.domain');
	- $path = request()->path();
	$opts = [
	'app.name',
	'app.url',
	@@ -382,6 +381,8 @@

	if ($req_domain == "admin.$sys_domain") {
	$env['jsapp'] = 'admin.js';
	+ } elseif ($req_domain == "reseller.$sys_domain") {
	+ $env['jsapp'] = 'reseller.js';
	}

	$env['paymentProvider'] = \config('services.payment_provider');
	diff --git a/src/app/Wallet.php b/src/app/Wallet.php
	--- a/src/app/Wallet.php
	+++ b/src/app/Wallet.php
	@@ -76,6 +76,7 @@
	return 0;
	}

	+ $profit = 0;
	$charges = 0;
	$discount = $this->getDiscountRate();

	@@ -101,8 +102,10 @@
	$diff = $entitlement->updated_at->diffInMonths(Carbon::now());

	$cost = (int) ($entitlement->cost * $discount * $diff);
	+ $fee = (int) ($entitlement->fee * $diff);

	$charges += $cost;
	+ $profit += $cost - $fee;

	// if we're in dry-run, you know...
	if (!$apply) {
	@@ -127,6 +130,16 @@

	if ($apply) {
	$this->debit($charges, $entitlementTransactions);
	+
	+ // Credit/debit the reseller
	+ if ($profit != 0 && $this->owner->tenant) {
	+ // FIXME: Should we have a simpler way to skip this for non-reseller tenant(s)
	+ if ($wallet = $this->owner->tenant->wallet()) {
	+ $desc = "Charged user {$this->owner->email}";
	+ $method = $profit > 0 ? 'credit' : 'debit';
	+ $wallet->{$method}(abs($profit), $desc);
	+ }
	+ }
	}

	DB::commit();
	diff --git a/src/config/app.php b/src/config/app.php
	--- a/src/config/app.php
	+++ b/src/config/app.php
	@@ -65,6 +65,8 @@

	'theme' => env('APP_THEME', 'default'),

	+ 'tenant_id' => env('APP_TENANT_ID', null),
	+
	/*
	\|--------------------------------------------------------------------------
	\| Application Domain
	diff --git a/src/config/database.php b/src/config/database.php
	--- a/src/config/database.php
	+++ b/src/config/database.php
	@@ -62,6 +62,7 @@
	'prefix' => '',
	'prefix_indexes' => true,
	'strict' => true,
	+ 'timezone' => '+00:00',
	'engine' => null,
	'options' => extension_loaded('pdo_mysql') ? array_filter([
	PDO::MYSQL_ATTR_SSL_CA => env('MYSQL_ATTR_SSL_CA'),
	diff --git a/src/database/migrations/2020_05_05_095212_create_tenants_table.php b/src/database/migrations/2020_05_05_095212_create_tenants_table.php
	new file mode 100644
	--- /dev/null
	+++ b/src/database/migrations/2020_05_05_095212_create_tenants_table.php
	@@ -0,0 +1,53 @@
	+<?php
	+
	+use Illuminate\Database\Migrations\Migration;
	+use Illuminate\Database\Schema\Blueprint;
	+use Illuminate\Support\Facades\Schema;
	+
	+// phpcs:ignore
	+class CreateTenantsTable extends Migration
	+{
	+ /**
	+ * Run the migrations.
	+ *
	+ * @return void
	+ */
	+ public function up()
	+ {
	+ Schema::create(
	+ 'tenants',
	+ function (Blueprint $table) {
	+ $table->bigIncrements('id');
	+ $table->string('title', 32);
	+ $table->timestamps();
	+ }
	+ );
	+
	+ Schema::table(
	+ 'users',
	+ function (Blueprint $table) {
	+ $table->bigInteger('tenant_id')->unsigned()->nullable();
	+
	+ $table->foreign('tenant_id')->references('id')->on('tenants')->onDelete('set null');
	+ }
	+ );
	+ }
	+
	+ /**
	+ * Reverse the migrations.
	+ *
	+ * @return void
	+ */
	+ public function down()
	+ {
	+ Schema::table(
	+ 'users',
	+ function (Blueprint $table) {
	+ $table->dropForeign(['tenant_id']);
	+ $table->dropColumn('tenant_id');
	+ }
	+ );
	+
	+ Schema::dropIfExists('tenants');
	+ }
	+}
	diff --git a/src/database/migrations/2020_10_29_100000_add_beta_skus.php b/src/database/migrations/2020_10_29_100000_add_beta_skus.php
	--- a/src/database/migrations/2020_10_29_100000_add_beta_skus.php
	+++ b/src/database/migrations/2020_10_29_100000_add_beta_skus.php
	@@ -14,31 +14,7 @@
	*/
	public function up()
	{
	- if (!\App\Sku::where('title', 'beta')->first()) {
	- \App\Sku::create([
	- 'title' => 'beta',
	- 'name' => 'Beta program',
	- 'description' => 'Access to beta program subscriptions',
	- 'cost' => 0,
	- 'units_free' => 0,
	- 'period' => 'monthly',
	- 'handler_class' => 'App\Handlers\Beta',
	- 'active' => false,
	- ]);
	- }
	-
	- if (!\App\Sku::where('title', 'meet')->first()) {
	- \App\Sku::create([
	- 'title' => 'meet',
	- 'name' => 'Video chat',
	- 'description' => 'Video conferencing tool',
	- 'cost' => 0,
	- 'units_free' => 0,
	- 'period' => 'monthly',
	- 'handler_class' => 'App\Handlers\Beta\Meet',
	- 'active' => true,
	- ]);
	- }
	+ // empty
	}

	/**
	diff --git a/src/database/migrations/2020_12_28_140000_create_groups_table.php b/src/database/migrations/2020_12_28_140000_create_groups_table.php
	--- a/src/database/migrations/2020_12_28_140000_create_groups_table.php
	+++ b/src/database/migrations/2020_12_28_140000_create_groups_table.php
	@@ -28,19 +28,6 @@
	$table->primary('id');
	}
	);
	-
	- if (!\App\Sku::where('title', 'group')->first()) {
	- \App\Sku::create([
	- 'title' => 'group',
	- 'name' => 'Group',
	- 'description' => 'Distribution list',
	- 'cost' => 0,
	- 'units_free' => 0,
	- 'period' => 'monthly',
	- 'handler_class' => 'App\Handlers\Group',
	- 'active' => true,
	- ]);
	- }
	}

	/**
	diff --git a/src/database/migrations/2021_01_26_150000_change_sku_descriptions.php b/src/database/migrations/2021_01_26_150000_change_sku_descriptions.php
	--- a/src/database/migrations/2021_01_26_150000_change_sku_descriptions.php
	+++ b/src/database/migrations/2021_01_26_150000_change_sku_descriptions.php
	@@ -15,14 +15,20 @@
	public function up()
	{
	$beta_sku = \App\Sku::where('title', 'beta')->first();
	- $beta_sku->name = 'Private Beta (invitation only)';
	- $beta_sku->description = 'Access to the private beta program subscriptions';
	- $beta_sku->save();
	+
	+ if ($beta_sku) {
	+ $beta_sku->name = 'Private Beta (invitation only)';
	+ $beta_sku->description = 'Access to the private beta program subscriptions';
	+ $beta_sku->save();
	+ }

	$meet_sku = \App\Sku::where('title', 'meet')->first();
	- $meet_sku->name = 'Voice & Video Conferencing (public beta)';
	- $meet_sku->handler_class = 'App\Handlers\Meet';
	- $meet_sku->save();
	+
	+ if ($meet_sku) {
	+ $meet_sku->name = 'Voice & Video Conferencing (public beta)';
	+ $meet_sku->handler_class = 'App\Handlers\Meet';
	+ $meet_sku->save();
	+ }
	}

	/**
	diff --git a/src/database/migrations/2021_02_19_093832_discounts_add_tenant_id.php b/src/database/migrations/2021_02_19_093832_discounts_add_tenant_id.php
	new file mode 100644
	--- /dev/null
	+++ b/src/database/migrations/2021_02_19_093832_discounts_add_tenant_id.php
	@@ -0,0 +1,42 @@
	+<?php
	+
	+use Illuminate\Database\Migrations\Migration;
	+use Illuminate\Database\Schema\Blueprint;
	+use Illuminate\Support\Facades\Schema;
	+
	+// phpcs:ignore
	+class DiscountsAddTenantId extends Migration
	+{
	+ /**
	+ * Run the migrations.
	+ *
	+ * @return void
	+ */
	+ public function up()
	+ {
	+ Schema::table(
	+ 'discounts',
	+ function (Blueprint $table) {
	+ $table->bigInteger('tenant_id')->unsigned()->nullable();
	+
	+ $table->foreign('tenant_id')->references('id')->on('tenants')->onDelete('set null');
	+ }
	+ );
	+ }
	+
	+ /**
	+ * Reverse the migrations.
	+ *
	+ * @return void
	+ */
	+ public function down()
	+ {
	+ Schema::table(
	+ 'discounts',
	+ function (Blueprint $table) {
	+ $table->dropForeign(['tenant_id']);
	+ $table->dropColumn('tenant_id');
	+ }
	+ );
	+ }
	+}
	diff --git a/src/database/migrations/2021_02_19_093833_domains_add_tenant_id.php b/src/database/migrations/2021_02_19_093833_domains_add_tenant_id.php
	new file mode 100644
	--- /dev/null
	+++ b/src/database/migrations/2021_02_19_093833_domains_add_tenant_id.php
	@@ -0,0 +1,42 @@
	+<?php
	+
	+use Illuminate\Database\Migrations\Migration;
	+use Illuminate\Database\Schema\Blueprint;
	+use Illuminate\Support\Facades\Schema;
	+
	+// phpcs:ignore
	+class DomainsAddTenantId extends Migration
	+{
	+ /**
	+ * Run the migrations.
	+ *
	+ * @return void
	+ */
	+ public function up()
	+ {
	+ Schema::table(
	+ 'domains',
	+ function (Blueprint $table) {
	+ $table->bigInteger('tenant_id')->unsigned()->nullable();
	+
	+ $table->foreign('tenant_id')->references('id')->on('tenants')->onDelete('set null');
	+ }
	+ );
	+ }
	+
	+ /**
	+ * Reverse the migrations.
	+ *
	+ * @return void
	+ */
	+ public function down()
	+ {
	+ Schema::table(
	+ 'domains',
	+ function (Blueprint $table) {
	+ $table->dropForeign(['tenant_id']);
	+ $table->dropColumn('tenant_id');
	+ }
	+ );
	+ }
	+}
	diff --git a/src/database/migrations/2021_03_26_080000_create_signup_invitations_table.php b/src/database/migrations/2021_03_26_080000_create_signup_invitations_table.php
	new file mode 100644
	--- /dev/null
	+++ b/src/database/migrations/2021_03_26_080000_create_signup_invitations_table.php
	@@ -0,0 +1,49 @@
	+<?php
	+
	+use Illuminate\Support\Facades\Schema;
	+use Illuminate\Database\Schema\Blueprint;
	+use Illuminate\Database\Migrations\Migration;
	+
	+// phpcs:ignore
	+class CreateSignupInvitationsTable extends Migration
	+{
	+ /**
	+ * Run the migrations.
	+ *
	+ * @return void
	+ */
	+ public function up()
	+ {
	+ Schema::create(
	+ 'signup_invitations',
	+ function (Blueprint $table) {
	+ $table->string('id', 36);
	+ $table->string('email');
	+ $table->smallInteger('status');
	+ $table->bigInteger('user_id')->nullable();
	+ $table->bigInteger('tenant_id')->unsigned()->nullable();
	+ $table->timestamps();
	+
	+ $table->primary('id');
	+
	+ $table->index('email');
	+ $table->index('created_at');
	+
	+ $table->foreign('tenant_id')->references('id')->on('tenants')
	+ ->onUpdate('cascade')->onDelete('set null');
	+ $table->foreign('user_id')->references('id')->on('users')
	+ ->onUpdate('cascade')->onDelete('set null');
	+ }
	+ );
	+ }
	+
	+ /**
	+ * Reverse the migrations.
	+ *
	+ * @return void
	+ */
	+ public function down()
	+ {
	+ Schema::dropIfExists('signup_invitations');
	+ }
	+}
	diff --git a/src/database/migrations/2021_04_09_100000_tenant_comissioning.php b/src/database/migrations/2021_04_09_100000_tenant_comissioning.php
	new file mode 100644
	--- /dev/null
	+++ b/src/database/migrations/2021_04_09_100000_tenant_comissioning.php
	@@ -0,0 +1,71 @@
	+<?php
	+
	+use Illuminate\Database\Migrations\Migration;
	+use Illuminate\Database\Schema\Blueprint;
	+use Illuminate\Support\Facades\DB;
	+use Illuminate\Support\Facades\Schema;
	+
	+// phpcs:ignore
	+class TenantComissioning extends Migration
	+{
	+ /**
	+ * Run the migrations.
	+ *
	+ * @return void
	+ */
	+ public function up()
	+ {
	+ // Add tenant_id columns
	+ foreach (['plans', 'packages', 'skus'] as $table) {
	+ Schema::table(
	+ $table,
	+ function (Blueprint $table) {
	+ $table->bigInteger('tenant_id')->unsigned()->nullable();
	+
	+ $table->foreign('tenant_id')->references('id')->on('tenants')
	+ ->onDelete('cascade')->onUpdate('cascade');
	+ }
	+ );
	+ }
	+
	+ // Add fee column
	+ foreach (['entitlements', 'skus'] as $table) {
	+ Schema::table(
	+ $table,
	+ function (Blueprint $table) {
	+ $table->integer('fee')->nullable();
	+ }
	+ );
	+ }
	+
	+ // FIXME: Should we also have package_skus.fee ?
	+ // We have package_skus.cost, but I think it is not used anywhere.
	+ }
	+
	+ /**
	+ * Reverse the migrations.
	+ *
	+ * @return void
	+ */
	+ public function down()
	+ {
	+ foreach (['plans', 'packages', 'skus'] as $table) {
	+ Schema::table(
	+ $table,
	+ function (Blueprint $table) {
	+ $table->dropForeign(['tenant_id']);
	+ $table->dropColumn('tenant_id');
	+ }
	+ );
	+ }
	+
	+ foreach (['entitlements', 'skus'] as $table) {
	+ Schema::table(
	+ $table,
	+ function (Blueprint $table) {
	+ $table->dropColumn('fee');
	+ }
	+ );
	+ }
	+ }
	+}
	diff --git a/src/database/migrations/2021_05_07_150000_groups_add_tenant_id.php b/src/database/migrations/2021_05_07_150000_groups_add_tenant_id.php
	new file mode 100644
	--- /dev/null
	+++ b/src/database/migrations/2021_05_07_150000_groups_add_tenant_id.php
	@@ -0,0 +1,42 @@
	+<?php
	+
	+use Illuminate\Database\Migrations\Migration;
	+use Illuminate\Database\Schema\Blueprint;
	+use Illuminate\Support\Facades\Schema;
	+
	+// phpcs:ignore
	+class GroupsAddTenantId extends Migration
	+{
	+ /**
	+ * Run the migrations.
	+ *
	+ * @return void
	+ */
	+ public function up()
	+ {
	+ Schema::table(
	+ 'groups',
	+ function (Blueprint $table) {
	+ $table->bigInteger('tenant_id')->unsigned()->default(\config('app.tenant_id'))->nullable();
	+
	+ $table->foreign('tenant_id')->references('id')->on('tenants')->onDelete('set null');
	+ }
	+ );
	+ }
	+
	+ /**
	+ * Reverse the migrations.
	+ *
	+ * @return void
	+ */
	+ public function down()
	+ {
	+ Schema::table(
	+ 'groups',
	+ function (Blueprint $table) {
	+ $table->dropForeign(['tenant_id']);
	+ $table->dropColumn('tenant_id');
	+ }
	+ );
	+ }
	+}
	diff --git a/src/database/seeds/DatabaseSeeder.php b/src/database/seeds/DatabaseSeeder.php
	--- a/src/database/seeds/DatabaseSeeder.php
	+++ b/src/database/seeds/DatabaseSeeder.php
	@@ -14,6 +14,7 @@
	{
	// Define seeders order
	$seeders = [
	+ 'TenantSeeder',
	'DiscountSeeder',
	'DomainSeeder',
	'SkuSeeder',
	diff --git a/src/database/seeds/local/DomainSeeder.php b/src/database/seeds/local/DomainSeeder.php
	--- a/src/database/seeds/local/DomainSeeder.php
	+++ b/src/database/seeds/local/DomainSeeder.php
	@@ -63,5 +63,19 @@
	]
	);
	}
	+
	+ // example tenant domain, note that 'tenant_id' is not a fillable.
	+ $domain = Domain::create(
	+ [
	+ 'namespace' => 'example-tenant.dev-local',
	+ 'status' => Domain::STATUS_CONFIRMED + Domain::STATUS_ACTIVE,
	+ 'type' => Domain::TYPE_PUBLIC
	+ ]
	+ );
	+
	+ $tenant = \App\Tenant::where('title', 'Sample Tenant')->first();
	+
	+ $domain->tenant_id = $tenant->id;
	+ $domain->save();
	}
	}
	diff --git a/src/database/seeds/local/TenantSeeder.php b/src/database/seeds/local/TenantSeeder.php
	new file mode 100644
	--- /dev/null
	+++ b/src/database/seeds/local/TenantSeeder.php
	@@ -0,0 +1,29 @@
	+<?php
	+
	+namespace Database\Seeds\Local;
	+
	+use App\Tenant;
	+use Illuminate\Database\Seeder;
	+
	+class TenantSeeder extends Seeder
	+{
	+ /**
	+ * Run the database seeds.
	+ *
	+ * @return void
	+ */
	+ public function run()
	+ {
	+ Tenant::create(
	+ [
	+ 'title' => 'Kolab Now'
	+ ]
	+ );
	+
	+ Tenant::create(
	+ [
	+ 'title' => 'Sample Tenant'
	+ ]
	+ );
	+ }
	+}
	diff --git a/src/database/seeds/local/UserSeeder.php b/src/database/seeds/local/UserSeeder.php
	--- a/src/database/seeds/local/UserSeeder.php
	+++ b/src/database/seeds/local/UserSeeder.php
	@@ -145,5 +145,30 @@

	$jeroen->role = 'admin';
	$jeroen->save();
	+
	+ $tenant1 = \App\Tenant::where('title', 'Kolab Now')->first();
	+ $tenant2 = \App\Tenant::where('title', 'Sample Tenant')->first();
	+
	+ $reseller1 = User::create(
	+ [
	+ 'email' => 'reseller@kolabnow.com',
	+ 'password' => 'reseller',
	+ ]
	+ );
	+
	+ $reseller1->tenant_id = $tenant1->id;
	+ $reseller1->role = 'reseller';
	+ $reseller1->save();
	+
	+ $reseller2 = User::create(
	+ [
	+ 'email' => 'reseller@reseller.com',
	+ 'password' => 'reseller',
	+ ]
	+ );
	+
	+ $reseller2->tenant_id = $tenant2->id;
	+ $reseller2->role = 'reseller';
	+ $reseller2->save();
	}
	}
	diff --git a/src/phpstan.neon b/src/phpstan.neon
	--- a/src/phpstan.neon
	+++ b/src/phpstan.neon
	@@ -4,8 +4,12 @@
	ignoreErrors:
	- '#Access to an undefined property Illuminate\\Contracts\\Auth\\Authenticatable#'
	- '#Access to an undefined property [a-zA-Z\\]+::\$pivot#'
	+ - '#Call to an undefined [a-zA-Z0-9<>\\ ]+::withEnvTenant#'
	+ - '#Call to an undefined [a-zA-Z0-9<>\\ ]+::withUserTenant#'
	- '#Call to an undefined method Tests\\Browser::#'
	level: 4
	+ parallel:
	+ processTimeout: 300.0
	paths:
	- app/
	- tests/
	diff --git a/src/resources/js/admin.js b/src/resources/js/admin/app.js
	rename from src/resources/js/admin.js
	rename to src/resources/js/admin/app.js
	--- a/src/resources/js/admin.js
	+++ b/src/resources/js/admin/app.js
	@@ -2,9 +2,9 @@
	* Application code for the admin UI
	*/

	-import routes from './routes-admin.js'
	+import routes from './routes.js'

	window.routes = routes
	window.isAdmin = true

	-require('./app')
	+require('../app')
	diff --git a/src/resources/js/routes-admin.js b/src/resources/js/admin/routes.js
	rename from src/resources/js/routes-admin.js
	rename to src/resources/js/admin/routes.js
	--- a/src/resources/js/routes-admin.js
	+++ b/src/resources/js/admin/routes.js
	@@ -1,11 +1,11 @@
	-import DashboardComponent from '../vue/Admin/Dashboard'
	-import DistlistComponent from '../vue/Admin/Distlist'
	-import DomainComponent from '../vue/Admin/Domain'
	-import LoginComponent from '../vue/Login'
	-import LogoutComponent from '../vue/Logout'
	-import PageComponent from '../vue/Page'
	-import StatsComponent from '../vue/Admin/Stats'
	-import UserComponent from '../vue/Admin/User'
	+import DashboardComponent from '../../vue/Admin/Dashboard'
	+import DistlistComponent from '../../vue/Admin/Distlist'
	+import DomainComponent from '../../vue/Admin/Domain'
	+import LoginComponent from '../../vue/Login'
	+import LogoutComponent from '../../vue/Logout'
	+import PageComponent from '../../vue/Page'
	+import StatsComponent from '../../vue/Admin/Stats'
	+import UserComponent from '../../vue/Admin/User'

	const routes = [
	{
	diff --git a/src/resources/js/app.js b/src/resources/js/app.js
	--- a/src/resources/js/app.js
	+++ b/src/resources/js/app.js
	@@ -79,7 +79,7 @@
	router: window.router,
	data() {
	return {
	- isAdmin: window.isAdmin,
	+ isUser: !window.isAdmin && !window.isReseller,
	appName: window.config['app.name'],
	appUrl: window.config['app.url'],
	themeDir: '/themes/' + window.config['app.theme']
	@@ -459,7 +459,7 @@
	}

	if (input.length) {
	- // Create an error message\
	+ // Create an error message
	// API responses can use a string, array or object
	let msg_text = ''
	if ($.type(msg) !== 'string') {
	diff --git a/src/resources/js/reseller/app.js b/src/resources/js/reseller/app.js
	new file mode 100644
	--- /dev/null
	+++ b/src/resources/js/reseller/app.js
	@@ -0,0 +1,10 @@
	+/**
	+ * Application code for the reseller UI
	+ */
	+
	+import routes from './routes.js'
	+
	+window.routes = routes
	+window.isReseller = true
	+
	+require('../app')
	diff --git a/src/resources/js/routes-admin.js b/src/resources/js/reseller/routes.js
	rename from src/resources/js/routes-admin.js
	rename to src/resources/js/reseller/routes.js
	--- a/src/resources/js/routes-admin.js
	+++ b/src/resources/js/reseller/routes.js
	@@ -1,11 +1,12 @@
	-import DashboardComponent from '../vue/Admin/Dashboard'
	-import DistlistComponent from '../vue/Admin/Distlist'
	-import DomainComponent from '../vue/Admin/Domain'
	-import LoginComponent from '../vue/Login'
	-import LogoutComponent from '../vue/Logout'
	-import PageComponent from '../vue/Page'
	-import StatsComponent from '../vue/Admin/Stats'
	-import UserComponent from '../vue/Admin/User'
	+import DashboardComponent from '../../vue/Reseller/Dashboard'
	+import DistlistComponent from '../../vue/Admin/Distlist'
	+import DomainComponent from '../../vue/Admin/Domain'
	+import InvitationsComponent from '../../vue/Reseller/Invitations'
	+import LoginComponent from '../../vue/Login'
	+import LogoutComponent from '../../vue/Logout'
	+import PageComponent from '../../vue/Page'
	+import StatsComponent from '../../vue/Reseller/Stats'
	+import UserComponent from '../../vue/Admin/User'

	const routes = [
	{
	@@ -40,6 +41,12 @@
	name: 'logout',
	component: LogoutComponent
	},
	+ {
	+ path: '/invitations',
	+ name: 'invitations',
	+ component: InvitationsComponent,
	+ meta: { requiresAuth: true }
	+ },
	{
	path: '/stats',
	name: 'stats',
	diff --git a/src/resources/js/user.js b/src/resources/js/user/app.js
	rename from src/resources/js/user.js
	rename to src/resources/js/user/app.js
	--- a/src/resources/js/user.js
	+++ b/src/resources/js/user/app.js
	@@ -2,9 +2,10 @@
	* Application code for the user UI
	*/

	-import routes from './routes-user.js'
	+import routes from './routes.js'

	window.routes = routes
	window.isAdmin = false
	+window.isReseller = false

	-require('./app')
	+require('../app')
	diff --git a/src/resources/js/routes-user.js b/src/resources/js/user/routes.js
	rename from src/resources/js/routes-user.js
	rename to src/resources/js/user/routes.js
	--- a/src/resources/js/routes-user.js
	+++ b/src/resources/js/user/routes.js
	@@ -1,24 +1,24 @@
	-import DashboardComponent from '../vue/Dashboard'
	-import DistlistInfoComponent from '../vue/Distlist/Info'
	-import DistlistListComponent from '../vue/Distlist/List'
	-import DomainInfoComponent from '../vue/Domain/Info'
	-import DomainListComponent from '../vue/Domain/List'
	-import LoginComponent from '../vue/Login'
	-import LogoutComponent from '../vue/Logout'
	-import MeetComponent from '../vue/Rooms'
	-import PageComponent from '../vue/Page'
	-import PasswordResetComponent from '../vue/PasswordReset'
	-import SignupComponent from '../vue/Signup'
	-import UserInfoComponent from '../vue/User/Info'
	-import UserListComponent from '../vue/User/List'
	-import UserProfileComponent from '../vue/User/Profile'
	-import UserProfileDeleteComponent from '../vue/User/ProfileDelete'
	-import WalletComponent from '../vue/Wallet'
	+import DashboardComponent from '../../vue/Dashboard'
	+import DistlistInfoComponent from '../../vue/Distlist/Info'
	+import DistlistListComponent from '../../vue/Distlist/List'
	+import DomainInfoComponent from '../../vue/Domain/Info'
	+import DomainListComponent from '../../vue/Domain/List'
	+import LoginComponent from '../../vue/Login'
	+import LogoutComponent from '../../vue/Logout'
	+import MeetComponent from '../../vue/Rooms'
	+import PageComponent from '../../vue/Page'
	+import PasswordResetComponent from '../../vue/PasswordReset'
	+import SignupComponent from '../../vue/Signup'
	+import UserInfoComponent from '../../vue/User/Info'
	+import UserListComponent from '../../vue/User/List'
	+import UserProfileComponent from '../../vue/User/Profile'
	+import UserProfileDeleteComponent from '../../vue/User/ProfileDelete'
	+import WalletComponent from '../../vue/Wallet'

	// Here's a list of lazy-loaded components
	// Note: you can pack multiple components into the same chunk, webpackChunkName
	// is also used to get a sensible file name instead of numbers
	-const RoomComponent = () => import(/* webpackChunkName: "room" */ '../vue/Meet/Room.vue')
	+const RoomComponent = () => import(/* webpackChunkName: "room" */ '../../vue/Meet/Room.vue')

	const routes = [
	{
	@@ -90,6 +90,11 @@
	component: MeetComponent,
	meta: { requiresAuth: true }
	},
	+ {
	+ path: '/signup/invite/:param',
	+ name: 'signup-invite',
	+ component: SignupComponent
	+ },
	{
	path: '/signup/:param?',
	alias: '/signup/voucher/:param',
	diff --git a/src/resources/lang/en/app.php b/src/resources/lang/en/app.php
	--- a/src/resources/lang/en/app.php
	+++ b/src/resources/lang/en/app.php
	@@ -57,6 +57,12 @@
	'search-foundxgroups' => ':x distribution lists have been found.',
	'search-foundxusers' => ':x user accounts have been found.',

	+ 'signup-invitations-created' => 'The invitation has been created.\|:count invitations has been created.',
	+ 'signup-invitations-csv-empty' => 'Failed to find any valid email addresses in the uploaded file.',
	+ 'signup-invitations-csv-invalid-email' => 'Found an invalid email address (:email) on line :line.',
	+ 'signup-invitation-delete-success' => 'Invitation deleted successfully.',
	+ 'signup-invitation-resend-success' => 'Invitation added to the sending queue successfully.',
	+
	'support-request-success' => 'Support request submitted successfully.',
	'support-request-error' => 'Failed to submit the support request.',

	diff --git a/src/resources/lang/en/mail.php b/src/resources/lang/en/mail.php
	--- a/src/resources/lang/en/mail.php
	+++ b/src/resources/lang/en/mail.php
	@@ -75,6 +75,11 @@
	'signupcode-body1' => "This is your verification code for the :site registration process:",
	'signupcode-body2' => "You can also click the link below to continue the registration process:",

	+ 'signupinvitation-subject' => ":site Invitation",
	+ 'signupinvitation-header' => "Hi,",
	+ 'signupinvitation-body1' => "You have been invited to join :site. Click the link below to sign up.",
	+ 'signupinvitation-body2' => "",
	+
	'suspendeddebtor-subject' => ":site Account Suspended",
	'suspendeddebtor-body' => "You have been behind on paying for your :site account "
	."for over :days days. Your account has been suspended.",
	diff --git a/src/resources/themes/app.scss b/src/resources/themes/app.scss
	--- a/src/resources/themes/app.scss
	+++ b/src/resources/themes/app.scss
	@@ -115,7 +115,10 @@
	}

	table {
	- td.buttons,
	+ th {
	+ white-space: nowrap;
	+ }
	+
	td.email,
	td.price,
	td.datetime,
	@@ -124,6 +127,7 @@
	white-space: nowrap;
	}

	+ td.buttons,
	th.price,
	td.price {
	width: 1%;
	@@ -279,6 +283,13 @@
	opacity: 0.6;
	}

	+ // Some icons are too big, scale them down
	+ &.link-invitations {
	+ svg {
	+ transform: scale(0.9);
	+ }
	+ }
	+
	.badge {
	position: absolute;
	top: 0.5rem;
	diff --git a/src/resources/themes/default/theme.json b/src/resources/themes/default/theme.json
	--- a/src/resources/themes/default/theme.json
	+++ b/src/resources/themes/default/theme.json
	@@ -3,23 +3,27 @@
	{
	"label": "explore",
	"location": "https://kolabnow.com/",
	- "admin": true
	+ "admin": true,
	+ "reseller": true
	},
	{
	"label": "blog",
	"location": "https://blogs.kolabnow.com/",
	- "admin": true
	+ "admin": true,
	+ "reseller": true
	},
	{
	"label": "support",
	"location": "/support",
	"page": "support",
	- "admin": true
	+ "admin": true,
	+ "reseller": true
	},
	{
	"label": "tos",
	"location": "https://kolabnow.com/tos",
	- "footer": true
	+ "footer": true,
	+ "reseller": true
	}
	],
	"faq": {
	diff --git a/src/resources/views/emails/html/signup_invitation.blade.php b/src/resources/views/emails/html/signup_invitation.blade.php
	new file mode 100644
	--- /dev/null
	+++ b/src/resources/views/emails/html/signup_invitation.blade.php
	@@ -0,0 +1,18 @@
	+<!DOCTYPE html>
	+<html lang="{{ str_replace('_', '-', app()->getLocale()) }}">
	+ <head>
	+ <meta charset="utf-8">
	+ </head>
	+ <body>
	+ <p>{{ __('mail.signupinvitation-header') }}</p>
	+
	+ <p>{{ __('mail.signupinvitation-body1', ['site' => $site]) }}</p>
	+
	+ <p><a href="{!! $href !!}">{!! $href !!}</a></p>
	+
	+ <p>{{ __('mail.signupinvitation-body2') }}</p>
	+
	+ <p>{{ __('mail.footer1') }}</p>
	+ <p>{{ __('mail.footer2', ['site' => $site]) }}</p>
	+ </body>
	+</html>
	diff --git a/src/resources/views/emails/plain/signup_invitation.blade.php b/src/resources/views/emails/plain/signup_invitation.blade.php
	new file mode 100644
	--- /dev/null
	+++ b/src/resources/views/emails/plain/signup_invitation.blade.php
	@@ -0,0 +1,11 @@
	+{!! __('mail.signupinvitation-header') !!}
	+
	+{!! __('mail.signupinvitation-body1', ['site' => $site]) !!}
	+
	+{!! $href !!}
	+
	+{!! __('mail.signupinvitation-body2') !!}
	+
	+--
	+{!! __('mail.footer1') !!}
	+{!! __('mail.footer2', ['site' => $site]) !!}
	diff --git a/src/resources/vue/Admin/Dashboard.vue b/src/resources/vue/Admin/Dashboard.vue
	--- a/src/resources/vue/Admin/Dashboard.vue
	+++ b/src/resources/vue/Admin/Dashboard.vue
	@@ -1,42 +1,6 @@
	<template>
	<div class="container" dusk="dashboard-component">
	- <div id="search-box" class="card">
	- <div class="card-body">
	- <form @submit.prevent="searchUser" class="row justify-content-center">
	- <div class="input-group col-sm-8">
	- <input class="form-control" type="text" placeholder="User ID, email or domain" v-model="search">
	- <div class="input-group-append">
	- <button type="submit" class="btn btn-primary"><svg-icon icon="search"></svg-icon> Search</button>
	- </div>
	- </div>
	- </form>
	- <table v-if="users.length" class="table table-sm table-hover mt-4">
	- <thead class="thead-light">
	- <tr>
	- <th scope="col">Primary Email</th>
	- <th scope="col">ID</th>
	- <th scope="col" class="d-none d-md-table-cell">Created</th>
	- <th scope="col" class="d-none d-md-table-cell">Deleted</th>
	- </tr>
	- </thead>
	- <tbody>
	- <tr v-for="user in users" :id="'user' + user.id" :key="user.id" :class="user.isDeleted ? 'text-secondary' : ''">
	- <td class="text-nowrap">
	- <svg-icon icon="user" :class="$root.userStatusClass(user)" :title="$root.userStatusText(user)"></svg-icon>
	- <router-link v-if="!user.isDeleted" :to="{ path: 'user/' + user.id }">{{ user.email }}</router-link>
	- <span v-if="user.isDeleted">{{ user.email }}</span>
	- </td>
	- <td>
	- <router-link v-if="!user.isDeleted" :to="{ path: 'user/' + user.id }">{{ user.id }}</router-link>
	- <span v-if="user.isDeleted">{{ user.id }}</span>
	- </td>
	- <td class="d-none d-md-table-cell">{{ toDate(user.created_at) }}</td>
	- <td class="d-none d-md-table-cell">{{ toDate(user.deleted_at) }}</td>
	- </tr>
	- </tbody>
	- </table>
	- </div>
	- </div>
	+ <user-search></user-search>
	<div id="dashboard-nav" class="mt-3">
	<router-link class="card link-stats" :to="{ name: 'stats' }">
	<svg-icon icon="chart-line"></svg-icon><span class="name">Stats</span>
	@@ -46,44 +10,15 @@
	</template>

	<script>
	+ import UserSearch from '../Widgets/UserSearch'
	import { library } from '@fortawesome/fontawesome-svg-core'
	import { faChartLine } from '@fortawesome/free-solid-svg-icons'
	+
	library.add(faChartLine)

	export default {
	- data() {
	- return {
	- search: '',
	- users: []
	- }
	- },
	- mounted() {
	- $('#search-box input').focus()
	- },
	- methods: {
	- searchUser() {
	- this.users = []
	-
	- axios.get('/api/v4/users', { params: { search: this.search } })
	- .then(response => {
	- if (response.data.count == 1 && !response.data.list[0].isDeleted) {
	- this.$router.push({ name: 'user', params: { user: response.data.list[0].id } })
	- return
	- }
	-
	- if (response.data.message) {
	- this.$toast.info(response.data.message)
	- }
	-
	- this.users = response.data.list
	- })
	- .catch(this.$root.errorHandler)
	- },
	- toDate(datetime) {
	- if (datetime) {
	- return datetime.split(' ')[0]
	- }
	- }
	+ components: {
	+ UserSearch
	}
	}
	</script>
	diff --git a/src/resources/vue/Admin/Stats.vue b/src/resources/vue/Admin/Stats.vue
	--- a/src/resources/vue/Admin/Stats.vue
	+++ b/src/resources/vue/Admin/Stats.vue
	@@ -9,11 +9,12 @@
	export default {
	data() {
	return {
	- charts: {}
	+ charts: {},
	+ chartTypes: ['users', 'users-all', 'income', 'discounts']
	}
	},
	mounted() {
	- ['users', 'users-all', 'income', 'discounts'].forEach(chart => this.loadChart(chart))
	+ this.chartTypes.forEach(chart => this.loadChart(chart))
	},
	methods: {
	drawChart(name, data) {
	diff --git a/src/resources/vue/Login.vue b/src/resources/vue/Login.vue
	--- a/src/resources/vue/Login.vue
	+++ b/src/resources/vue/Login.vue
	@@ -23,7 +23,7 @@
	<input type="password" id="inputPassword" class="form-control" :placeholder="$t('login.password')" required v-model="password">
	</div>
	</div>
	- <div class="form-group pt-3" v-if="!$root.isAdmin">
	+ <div class="form-group pt-3" v-if="$root.isUser">
	<label for="secondfactor" class="sr-only">{{ $t('login.2fa') }}</label>
	<div class="input-group">
	<span class="input-group-prepend">
	@@ -43,8 +43,8 @@
	</div>
	</div>
	<div id="logon-form-footer" class="mt-1">
	- <router-link v-if="!$root.isAdmin && $root.hasRoute('password-reset')" :to="{ name: 'password-reset' }" id="forgot-password">{{ $t('login.forgot_password') }}</router-link>
	- <a v-if="webmailURL && !$root.isAdmin" :href="webmailURL" id="webmail">{{ $t('login.webmail') }}</a>
	+ <router-link v-if="$root.isUser && $root.hasRoute('password-reset')" :to="{ name: 'password-reset' }" id="forgot-password">{{ $t('login.forgot_password') }}</router-link>
	+ <a v-if="webmailURL && $root.isUser" :href="webmailURL" id="webmail">{{ $t('login.webmail') }}</a>
	</div>
	</div>
	</template>
	diff --git a/src/resources/vue/Reseller/Dashboard.vue b/src/resources/vue/Reseller/Dashboard.vue
	new file mode 100644
	--- /dev/null
	+++ b/src/resources/vue/Reseller/Dashboard.vue
	@@ -0,0 +1,27 @@
	+<template>
	+ <div class="container" dusk="dashboard-component">
	+ <user-search></user-search>
	+ <div id="dashboard-nav" class="mt-3">
	+ <router-link class="card link-invitations" :to="{ name: 'invitations' }">
	+ <svg-icon icon="envelope-open-text"></svg-icon><span class="name">Invitations</span>
	+ </router-link>
	+ <router-link class="card link-stats" :to="{ name: 'stats' }">
	+ <svg-icon icon="chart-line"></svg-icon><span class="name">Stats</span>
	+ </router-link>
	+ </div>
	+ </div>
	+</template>
	+
	+<script>
	+ import UserSearch from '../Widgets/UserSearch'
	+ import { library } from '@fortawesome/fontawesome-svg-core'
	+ import { faChartLine,faEnvelopeOpenText } from '@fortawesome/free-solid-svg-icons'
	+
	+ library.add(faChartLine, faEnvelopeOpenText)
	+
	+ export default {
	+ components: {
	+ UserSearch
	+ }
	+ }
	+</script>
	diff --git a/src/resources/vue/Reseller/Invitations.vue b/src/resources/vue/Reseller/Invitations.vue
	new file mode 100644
	--- /dev/null
	+++ b/src/resources/vue/Reseller/Invitations.vue
	@@ -0,0 +1,283 @@
	+<template>
	+ <div class="container">
	+ <div class="card" id="invitations">
	+ <div class="card-body">
	+ <div class="card-title">
	+ Signup Invitations
	+ </div>
	+ <div class="card-text">
	+ <div class="mb-2 d-flex">
	+ <form @submit.prevent="searchInvitations" id="search-form" class="input-group" style="flex:1">
	+ <input class="form-control" type="text" placeholder="Email address or domain" v-model="search">
	+ <div class="input-group-append">
	+ <button type="submit" class="btn btn-primary"><svg-icon icon="search"></svg-icon> Search</button>
	+ </div>
	+ </form>
	+ <div>
	+ <button class="btn btn-success create-invite ml-1" @click="inviteUserDialog">
	+ <svg-icon icon="envelope-open-text"></svg-icon> Create invite(s)
	+ </button>
	+ </div>
	+ </div>
	+
	+ <table id="invitations-list" class="table table-sm table-hover">
	+ <thead class="thead-light">
	+ <tr>
	+ <th scope="col">External Email</th>
	+ <th scope="col">Created</th>
	+ <th scope="col"></th>
	+ </tr>
	+ </thead>
	+ <tbody>
	+ <tr v-for="inv in invitations" :id="'i' + inv.id" :key="inv.id">
	+ <td class="email">
	+ <svg-icon icon="envelope-open-text" :class="statusClass(inv)" :title="statusText(inv)"></svg-icon>
	+ <span>{{ inv.email }}</span>
	+ </td>
	+ <td class="datetime">
	+ {{ inv.created }}
	+ </td>
	+ <td class="buttons">
	+ <button class="btn text-danger button-delete p-0 ml-1" @click="deleteInvite(inv.id)">
	+ <svg-icon icon="trash-alt"></svg-icon>
	+ <span class="btn-label">Delete</span>
	+ </button>
	+ <button class="btn button-resend p-0 ml-1" :disabled="inv.isNew \|\| inv.isCompleted" @click="resendInvite(inv.id)">
	+ <svg-icon icon="redo"></svg-icon>
	+ <span class="btn-label">Resend</span>
	+ </button>
	+ </td>
	+ </tr>
	+ </tbody>
	+ <tfoot class="table-fake-body">
	+ <tr>
	+ <td colspan="3">There are no invitations in the database.</td>
	+ </tr>
	+ </tfoot>
	+ </table>
	+ <div class="text-center p-3" id="more-loader" v-if="hasMore">
	+ <button class="btn btn-secondary" @click="loadInvitations(true)">Load more</button>
	+ </div>
	+ </div>
	+ </div>
	+ </div>
	+
	+ <div id="invite-create" class="modal" tabindex="-1" role="dialog">
	+ <div class="modal-dialog" role="document">
	+ <div class="modal-content">
	+ <div class="modal-header">
	+ <h5 class="modal-title">Invite for a signup</h5>
	+ <button type="button" class="close" data-dismiss="modal" aria-label="Close">
	+ <span aria-hidden="true">×</span>
	+ </button>
	+ </div>
	+ <div class="modal-body">
	+ <form>
	+ <p>Enter an email address of the person you want to invite.</p>
	+ <div>
	+ <input id="email" type="text" class="form-control" name="email">
	+ </div>
	+ <div class="form-separator"><hr><span>or</span></div>
	+ <p>
	+ To send multiple invitations at once, provide a CSV (comma separated) file,
	+ or alternatively a plain-text file, containing one email address per line.
	+ </p>
	+ <div class="custom-file">
	+ <input id="file" type="file" class="custom-file-input" name="csv" @change="fileChange">
	+ <label class="custom-file-label" for="file">Choose file...</label>
	+ </div>
	+ </form>
	+ </div>
	+ <div class="modal-footer">
	+ <button type="button" class="btn btn-secondary modal-cancel" data-dismiss="modal">Cancel</button>
	+ <button type="button" class="btn btn-primary modal-action" @click="inviteUser()">
	+ <svg-icon icon="paper-plane"></svg-icon> Send invite(s)
	+ </button>
	+ </div>
	+ </div>
	+ </div>
	+ </div>
	+ </div>
	+</template>
	+
	+<script>
	+ import { library } from '@fortawesome/fontawesome-svg-core'
	+ import { faEnvelopeOpenText, faPaperPlane, faRedo } from '@fortawesome/free-solid-svg-icons'
	+
	+ library.add(faEnvelopeOpenText, faPaperPlane, faRedo)
	+
	+ export default {
	+ data() {
	+ return {
	+ invitations: [],
	+ hasMore: false,
	+ page: 1,
	+ search: ''
	+ }
	+ },
	+ mounted() {
	+ this.$root.startLoading()
	+ this.loadInvitations(null, () => this.$root.stopLoading())
	+ },
	+ methods: {
	+ deleteInvite(id) {
	+ axios.delete('/api/v4/invitations/' + id)
	+ .then(response => {
	+ if (response.data.status == 'success') {
	+ this.$toast.success(response.data.message)
	+
	+ // Remove the invitation record from the list
	+ const index = this.invitations.findIndex(item => item.id == id)
	+ this.invitations.splice(index, 1)
	+ }
	+ })
	+ },
	+ fileChange(e) {
	+ let label = 'Choose file...'
	+ let files = e.target.files
	+
	+ if (files.length) {
	+ label = files[0].name
	+ if (files.length > 1) {
	+ label += ', ...'
	+ }
	+ }
	+
	+ $(e.target).next().text(label)
	+ },
	+ inviteUser() {
	+ let dialog = $('#invite-create')
	+ let post = new FormData()
	+ let params = { headers: { 'Content-Type': 'multipart/form-data' } }
	+
	+ post.append('email', dialog.find('#email').val())
	+
	+ this.$root.clearFormValidation(dialog.find('form'))
	+
	+ // Append the file to POST data
	+ let files = dialog.find('#file').get(0).files
	+ if (files.length) {
	+ post.append('file', files[0])
	+ }
	+
	+ axios.post('/api/v4/invitations', post, params)
	+ .then(response => {
	+ if (response.data.status == 'success') {
	+ dialog.modal('hide')
	+ this.$toast.success(response.data.message)
	+ if (response.data.count) {
	+ this.loadInvitations({ reset: true })
	+ }
	+ }
	+ })
	+ },
	+ inviteUserDialog() {
	+ let dialog = $('#invite-create')
	+ let form = dialog.find('form')
	+
	+ form.get(0).reset()
	+ this.fileChange({ target: form.find('#file')[0] }) // resets file input label
	+ this.$root.clearFormValidation(form)
	+
	+ dialog.on('shown.bs.modal', () => {
	+ dialog.find('input').get(0).focus()
	+ }).modal()
	+ },
	+ loadInvitations(params, callback) {
	+ let loader
	+ let get = {}
	+
	+ if (params) {
	+ if (params.reset) {
	+ this.invitations = []
	+ this.page = 0
	+ }
	+
	+ get.page = params.page \|\| (this.page + 1)
	+
	+ if (typeof params === 'object' && 'search' in params) {
	+ get.search = params.search
	+ this.currentSearch = params.search
	+ } else {
	+ get.search = this.currentSearch
	+ }
	+
	+ loader = $(get.page > 1 ? '#more-loader' : '#invitations-list tfoot td')
	+ } else {
	+ this.currentSearch = null
	+ }
	+
	+ this.$root.addLoader(loader)
	+
	+ axios.get('/api/v4/invitations', { params: get })
	+ .then(response => {
	+ this.$root.removeLoader(loader)
	+
	+ // Note: In Vue we can't just use .concat()
	+ for (let i in response.data.list) {
	+ this.$set(this.invitations, this.invitations.length, response.data.list[i])
	+ }
	+ this.hasMore = response.data.hasMore
	+ this.page = response.data.page \|\| 1
	+
	+ if (callback) {
	+ callback()
	+ }
	+ })
	+ .catch(error => {
	+ this.$root.removeLoader(loader)
	+
	+ if (callback) {
	+ callback()
	+ }
	+ })
	+ },
	+ resendInvite(id) {
	+ axios.post('/api/v4/invitations/' + id + '/resend')
	+ .then(response => {
	+ if (response.data.status == 'success') {
	+ this.$toast.success(response.data.message)
	+
	+ // Update the invitation record
	+ const index = this.invitations.findIndex(item => item.id == id)
	+ this.invitations.splice(index, 1)
	+ this.$set(this.invitations, index, response.data.invitation)
	+ }
	+ })
	+ },
	+ searchInvitations() {
	+ this.loadInvitations({ reset: true, search: this.search })
	+ },
	+ statusClass(invitation) {
	+ if (invitation.isCompleted) {
	+ return 'text-success'
	+ }
	+
	+ if (invitation.isFailed) {
	+ return 'text-danger'
	+ }
	+
	+ if (invitation.isSent) {
	+ return 'text-primary'
	+ }
	+
	+ return ''
	+ },
	+ statusText(invitation) {
	+ if (invitation.isCompleted) {
	+ return 'User signed up'
	+ }
	+
	+ if (invitation.isFailed) {
	+ return 'Sending failed'
	+ }
	+
	+ if (invitation.isSent) {
	+ return 'Sent'
	+ }
	+
	+ return 'Not sent yet'
	+ }
	+ }
	+ }
	+</script>
	diff --git a/src/resources/vue/Reseller/Stats.vue b/src/resources/vue/Reseller/Stats.vue
	new file mode 100644
	--- /dev/null
	+++ b/src/resources/vue/Reseller/Stats.vue
	@@ -0,0 +1,18 @@
	+<template>
	+ <div id="stats-container" class="container">
	+ </div>
	+</template>
	+
	+<script>
	+ import Stats from '../Admin/Stats'
	+
	+ export default {
	+ mixins: [Stats],
	+ data() {
	+ return {
	+// charts: {},
	+ chartTypes: ['users', 'users-all', 'discounts']
	+ }
	+ }
	+ }
	+</script>
	diff --git a/src/resources/vue/Signup.vue b/src/resources/vue/Signup.vue
	--- a/src/resources/vue/Signup.vue
	+++ b/src/resources/vue/Signup.vue
	@@ -1,6 +1,6 @@
	<template>
	<div class="container">
	- <div id="step0">
	+ <div id="step0" v-if="!invitation">
	<div class="plan-selector card-deck">
	<div v-for="item in plans" :key="item.id" :class="'card bg-light plan-' + item.title">
	<div class="card-header plan-header">
	@@ -16,7 +16,7 @@
	</div>
	</div>

	- <div class="card d-none" id="step1">
	+ <div class="card d-none" id="step1" v-if="!invitation">
	<div class="card-body">
	<h4 class="card-title">Sign Up - Step 1/3</h4>
	<p class="card-text">
	@@ -39,7 +39,7 @@
	</div>
	</div>

	- <div class="card d-none" id="step2">
	+ <div class="card d-none" id="step2" v-if="!invitation">
	<div class="card-body">
	<h4 class="card-title">Sign Up - Step 2/3</h4>
	<p class="card-text">
	@@ -60,20 +60,28 @@

	<div class="card d-none" id="step3">
	<div class="card-body">
	- <h4 class="card-title">Sign Up - Step 3/3</h4>
	+ <h4 v-if="!invitation" class="card-title">Sign Up - Step 3/3</h4>
	<p class="card-text">
	Create your Kolab identity (you can choose additional addresses later).
	</p>
	<form @submit.prevent="submitStep3" data-validation-prefix="signup_">
	+ <div class="form-group" v-if="invitation">
	+ <div class="input-group">
	+ <input type="text" class="form-control" id="signup_first_name" placeholder="First Name" autofocus v-model="first_name">
	+ <input type="text" class="form-control rounded-right" id="signup_last_name" placeholder="Surname" v-model="last_name">
	+ </div>
	+ </div>
	<div class="form-group">
	<label for="signup_login" class="sr-only"></label>
	<div class="input-group">
	<input type="text" class="form-control" id="signup_login" required v-model="login" placeholder="Login">
	- <span class="input-group-append">
	+ <span class="input-group-append input-group-prepend">
	<span class="input-group-text">@</span>
	</span>
	<input v-if="is_domain" type="text" class="form-control rounded-right" id="signup_domain" required v-model="domain" placeholder="Domain">
	- <select v-else class="custom-select rounded-right" id="signup_domain" required v-model="domain"></select>
	+ <select v-else class="custom-select rounded-right" id="signup_domain" required v-model="domain">
	+ <option v-for="domain in domains" :key="domain" :value="domain">{{ domain }}</option>
	+ </select>
	</div>
	</div>
	<div class="form-group">
	@@ -88,8 +96,10 @@
	<label for="signup_voucher" class="sr-only">Voucher code</label>
	<input type="text" class="form-control" id="signup_voucher" placeholder="Voucher code" v-model="voucher">
	</div>
	- <button class="btn btn-secondary" type="button" @click="stepBack">Back</button>
	- <button class="btn btn-primary" type="submit"><svg-icon icon="check"></svg-icon> Submit</button>
	+ <button v-if="!invitation" class="btn btn-secondary" type="button" @click="stepBack">Back</button>
	+ <button class="btn btn-primary" type="submit">
	+ <svg-icon icon="check"></svg-icon> <span v-if="invitation">Sign Up</span><span v-else>Submit</span>
	+ </button>
	</form>
	</div>
	</div>
	@@ -109,8 +119,10 @@
	password: '',
	password_confirmation: '',
	domain: '',
	- plan: null,
	+ domains: [],
	+ invitation: null,
	is_domain: false,
	+ plan: null,
	plan_icons: {
	individual: 'user',
	group: 'users'
	@@ -122,7 +134,25 @@
	mounted() {
	let param = this.$route.params.param;

	- if (param) {
	+ if (this.$route.name == 'signup-invite') {
	+ this.$root.startLoading()
	+ axios.get('/api/auth/signup/invitations/' + param)
	+ .then(response => {
	+ this.invitation = response.data
	+ this.login = response.data.login
	+ this.voucher = response.data.voucher
	+ this.first_name = response.data.first_name
	+ this.last_name = response.data.last_name
	+ this.plan = response.data.plan
	+ this.is_domain = response.data.is_domain
	+ this.setDomain(response.data)
	+ this.$root.stopLoading()
	+ this.displayForm(3, true)
	+ })
	+ .catch(error => {
	+ this.$root.errorHandler(error)
	+ })
	+ } else if (param) {
	if (this.$route.path.indexOf('/signup/voucher/') === 0) {
	// Voucher (discount) code
	this.voucher = param
	@@ -199,13 +229,7 @@

	// Fill the domain selector with available domains
	if (!this.is_domain) {
	- let options = []
	- $('select#signup_domain').html('')
	- $.each(response.data.domains, (i, v) => {
	- options.push($('<option>').text(v).attr('value', v))
	- })
	- $('select#signup_domain').append(options)
	- this.domain = window.config['app.domain']
	+ this.setDomain(response.data)
	}
	}).catch(error => {
	if (bylink === true) {
	@@ -219,15 +243,25 @@
	submitStep3() {
	this.$root.clearFormValidation($('#step3 form'))

	- axios.post('/api/auth/signup', {
	- code: this.code,
	- short_code: this.short_code,
	+ let post = {
	login: this.login,
	domain: this.domain,
	password: this.password,
	password_confirmation: this.password_confirmation,
	voucher: this.voucher
	- }).then(response => {
	+ }
	+
	+ if (this.invitation) {
	+ post.invitation = this.invitation.id
	+ post.plan = this.plan
	+ post.first_name = this.first_name
	+ post.last_name = this.last_name
	+ } else {
	+ post.code = this.code
	+ post.short_code = this.short_code
	+ }
	+
	+ axios.post('/api/auth/signup', post).then(response => {
	// auto-login and goto dashboard
	this.$root.loginUser(response.data)
	})
	@@ -258,6 +292,13 @@
	if (focus) {
	$('#step' + step).find('input').first().focus()
	}
	+ },
	+ setDomain(response) {
	+ if (response.domains) {
	+ this.domains = response.domains
	+ }
	+
	+ this.domain = response.domain \|\| window.config['app.domain']
	}
	}
	}
	diff --git a/src/resources/vue/Widgets/Menu.vue b/src/resources/vue/Widgets/Menu.vue
	--- a/src/resources/vue/Widgets/Menu.vue
	+++ b/src/resources/vue/Widgets/Menu.vue
	@@ -21,7 +21,7 @@
	{{ item.title }}
	</router-link>
	</li>
	- <li class="nav-item" v-if="!loggedIn && !$root.isAdmin">
	+ <li class="nav-item" v-if="!loggedIn && $root.isUser">
	<router-link class="nav-link link-signup" active-class="active" :to="{name: 'signup'}">{{ $t('menu.signup') }}</router-link>
	</li>
	<li class="nav-item" v-if="loggedIn">
	diff --git a/src/resources/vue/Widgets/UserSearch.vue b/src/resources/vue/Widgets/UserSearch.vue
	new file mode 100644
	--- /dev/null
	+++ b/src/resources/vue/Widgets/UserSearch.vue
	@@ -0,0 +1,78 @@
	+<template>
	+ <div id="search-box" class="card">
	+ <div class="card-body">
	+ <form @submit.prevent="searchUser" class="row justify-content-center">
	+ <div class="input-group col-sm-8">
	+ <input class="form-control" type="text" placeholder="User ID, email or domain" v-model="search">
	+ <div class="input-group-append">
	+ <button type="submit" class="btn btn-primary"><svg-icon icon="search"></svg-icon> Search</button>
	+ </div>
	+ </div>
	+ </form>
	+ <table v-if="users.length" class="table table-sm table-hover mt-4">
	+ <thead class="thead-light">
	+ <tr>
	+ <th scope="col">Primary Email</th>
	+ <th scope="col">ID</th>
	+ <th scope="col" class="d-none d-md-table-cell">Created</th>
	+ <th scope="col" class="d-none d-md-table-cell">Deleted</th>
	+ </tr>
	+ </thead>
	+ <tbody>
	+ <tr v-for="user in users" :id="'user' + user.id" :key="user.id" :class="user.isDeleted ? 'text-secondary' : ''">
	+ <td class="text-nowrap">
	+ <svg-icon icon="user" :class="$root.userStatusClass(user)" :title="$root.userStatusText(user)"></svg-icon>
	+ <router-link v-if="!user.isDeleted" :to="{ path: 'user/' + user.id }">{{ user.email }}</router-link>
	+ <span v-if="user.isDeleted">{{ user.email }}</span>
	+ </td>
	+ <td>
	+ <router-link v-if="!user.isDeleted" :to="{ path: 'user/' + user.id }">{{ user.id }}</router-link>
	+ <span v-if="user.isDeleted">{{ user.id }}</span>
	+ </td>
	+ <td class="d-none d-md-table-cell">{{ toDate(user.created_at) }}</td>
	+ <td class="d-none d-md-table-cell">{{ toDate(user.deleted_at) }}</td>
	+ </tr>
	+ </tbody>
	+ </table>
	+ </div>
	+ </div>
	+</template>
	+
	+<script>
	+ export default {
	+ data() {
	+ return {
	+ search: '',
	+ users: []
	+ }
	+ },
	+ mounted() {
	+ $('#search-box input').focus()
	+ },
	+ methods: {
	+ searchUser() {
	+ this.users = []
	+
	+ axios.get('/api/v4/users', { params: { search: this.search } })
	+ .then(response => {
	+ if (response.data.count == 1 && !response.data.list[0].isDeleted) {
	+ this.$router.push({ name: 'user', params: { user: response.data.list[0].id } })
	+ return
	+ }
	+
	+ if (response.data.message) {
	+ this.$toast.info(response.data.message)
	+ }
	+
	+ this.users = response.data.list
	+ })
	+ .catch(this.$root.errorHandler)
	+ },
	+ toDate(datetime) {
	+ if (datetime) {
	+ return datetime.split(' ')[0]
	+ }
	+ }
	+ }
	+ }
	+</script>
	diff --git a/src/routes/api.php b/src/routes/api.php
	--- a/src/routes/api.php
	+++ b/src/routes/api.php
	@@ -45,8 +45,9 @@
	Route::post('password-reset/verify', 'API\PasswordResetController@verify');
	Route::post('password-reset', 'API\PasswordResetController@reset');

	- Route::get('signup/plans', 'API\SignupController@plans');
	Route::post('signup/init', 'API\SignupController@init');
	+ Route::get('signup/invitations/{id}', 'API\SignupController@invitation');
	+ Route::get('signup/plans', 'API\SignupController@plans');
	Route::post('signup/verify', 'API\SignupController@verify');
	Route::post('signup', 'API\SignupController@signup');
	}
	@@ -66,7 +67,6 @@
	Route::apiResource('groups', API\V4\GroupsController::class);
	Route::get('groups/{id}/status', 'API\V4\GroupsController@status');

	- Route::apiResource('entitlements', API\V4\EntitlementsController::class);
	Route::apiResource('packages', API\V4\PackagesController::class);
	Route::apiResource('skus', API\V4\SkusController::class);

	@@ -148,12 +148,9 @@
	],
	function () {
	Route::apiResource('domains', API\V4\Admin\DomainsController::class);
	- Route::get('domains/{id}/confirm', 'API\V4\Admin\DomainsController@confirm');
	Route::post('domains/{id}/suspend', 'API\V4\Admin\DomainsController@suspend');
	Route::post('domains/{id}/unsuspend', 'API\V4\Admin\DomainsController@unsuspend');

	- Route::apiResource('entitlements', API\V4\Admin\EntitlementsController::class);
	-
	Route::apiResource('groups', API\V4\Admin\GroupsController::class);
	Route::post('groups/{id}/suspend', 'API\V4\Admin\GroupsController@suspend');
	Route::post('groups/{id}/unsuspend', 'API\V4\Admin\GroupsController@unsuspend');
	@@ -173,3 +170,36 @@
	Route::get('stats/chart/{chart}', 'API\V4\Admin\StatsController@chart');
	}
	);
	+
	+Route::group(
	+ [
	+ 'domain' => 'reseller.' . \config('app.domain'),
	+ 'middleware' => ['auth:api', 'reseller'],
	+ 'prefix' => $prefix . 'api/v4',
	+ ],
	+ function () {
	+ Route::apiResource('domains', API\V4\Reseller\DomainsController::class);
	+ Route::post('domains/{id}/suspend', 'API\V4\Reseller\DomainsController@suspend');
	+ Route::post('domains/{id}/unsuspend', 'API\V4\Reseller\DomainsController@unsuspend');
	+
	+ Route::apiResource('groups', API\V4\Reseller\GroupsController::class);
	+ Route::post('groups/{id}/suspend', 'API\V4\Reseller\GroupsController@suspend');
	+ Route::post('groups/{id}/unsuspend', 'API\V4\Reseller\GroupsController@unsuspend');
	+
	+ Route::apiResource('invitations', API\V4\Reseller\InvitationsController::class);
	+ Route::post('invitations/{id}/resend', 'API\V4\Reseller\InvitationsController@resend');
	+ Route::apiResource('packages', API\V4\Reseller\PackagesController::class);
	+ Route::apiResource('skus', API\V4\Reseller\SkusController::class);
	+ Route::apiResource('users', API\V4\Reseller\UsersController::class);
	+ Route::post('users/{id}/reset2FA', 'API\V4\Reseller\UsersController@reset2FA');
	+ Route::get('users/{id}/skus', 'API\V4\Reseller\SkusController@userSkus');
	+ Route::post('users/{id}/suspend', 'API\V4\Reseller\UsersController@suspend');
	+ Route::post('users/{id}/unsuspend', 'API\V4\Reseller\UsersController@unsuspend');
	+ Route::apiResource('wallets', API\V4\Reseller\WalletsController::class);
	+ Route::post('wallets/{id}/one-off', 'API\V4\Reseller\WalletsController@oneOff');
	+ Route::get('wallets/{id}/transactions', 'API\V4\Reseller\WalletsController@transactions');
	+ Route::apiResource('discounts', API\V4\Reseller\DiscountsController::class);
	+
	+ Route::get('stats/chart/{chart}', 'API\V4\Reseller\StatsController@chart');
	+ }
	+);
	diff --git a/src/routes/web.php b/src/routes/web.php
	--- a/src/routes/web.php
	+++ b/src/routes/web.php
	@@ -15,6 +15,11 @@

	Route::fallback(
	function () {
	+ // Return 404 for requests to the API end-points that do not exist
	+ if (strpos(request()->path(), 'api/') === 0) {
	+ return \App\Http\Controllers\Controller::errorResponse(404);
	+ }
	+
	$env = \App\Utils::uiEnv();
	return view($env['view'])->with('env', $env);
	}
	diff --git a/src/tests/Browser/Pages/Reseller/Invitations.php b/src/tests/Browser/Pages/Reseller/Invitations.php
	new file mode 100644
	--- /dev/null
	+++ b/src/tests/Browser/Pages/Reseller/Invitations.php
	@@ -0,0 +1,49 @@
	+<?php
	+
	+namespace Tests\Browser\Pages\Reseller;
	+
	+use Laravel\Dusk\Page;
	+
	+class Invitations extends Page
	+{
	+ /**
	+ * Get the URL for the page.
	+ *
	+ * @return string
	+ */
	+ public function url(): string
	+ {
	+ return '/invitations';
	+ }
	+
	+ /**
	+ * Assert that the browser is on the page.
	+ *
	+ * @param \Laravel\Dusk\Browser $browser The browser object
	+ *
	+ * @return void
	+ */
	+ public function assert($browser)
	+ {
	+ $browser->assertPathIs($this->url())
	+ ->waitUntilMissing('@app .app-loader')
	+ ->assertSeeIn('#invitations .card-title', 'Signup Invitations');
	+ }
	+
	+ /**
	+ * Get the element shortcuts for the page.
	+ *
	+ * @return array
	+ */
	+ public function elements(): array
	+ {
	+ return [
	+ '@app' => '#app',
	+ '@create-button' => '.card-text button.create-invite',
	+ '@create-dialog' => '#invite-create',
	+ '@search-button' => '#search-form button',
	+ '@search-input' => '#search-form input',
	+ '@table' => '#invitations-list',
	+ ];
	+ }
	+}
	diff --git a/src/tests/Browser/Reseller/DashboardTest.php b/src/tests/Browser/Reseller/DashboardTest.php
	new file mode 100644
	--- /dev/null
	+++ b/src/tests/Browser/Reseller/DashboardTest.php
	@@ -0,0 +1,140 @@
	+<?php
	+
	+namespace Tests\Browser\Reseller;
	+
	+use Illuminate\Support\Facades\Queue;
	+use Tests\Browser;
	+use Tests\Browser\Components\Toast;
	+use Tests\Browser\Pages\Dashboard;
	+use Tests\Browser\Pages\Home;
	+use Tests\TestCaseDusk;
	+
	+class DashboardTest extends TestCaseDusk
	+{
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function setUp(): void
	+ {
	+ parent::setUp();
	+ self::useResellerUrl();
	+
	+ $jack = $this->getTestUser('jack@kolab.org');
	+ $jack->setSetting('external_email', null);
	+
	+ $this->deleteTestUser('test@testsearch.com');
	+ $this->deleteTestDomain('testsearch.com');
	+ }
	+
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function tearDown(): void
	+ {
	+ $jack = $this->getTestUser('jack@kolab.org');
	+ $jack->setSetting('external_email', null);
	+
	+ $this->deleteTestUser('test@testsearch.com');
	+ $this->deleteTestDomain('testsearch.com');
	+
	+ parent::tearDown();
	+ }
	+
	+ /**
	+ * Test user search
	+ */
	+ public function testSearch(): void
	+ {
	+ $this->browse(function (Browser $browser) {
	+ $browser->visit(new Home())
	+ ->submitLogon('reseller@kolabnow.com', 'reseller', true)
	+ ->on(new Dashboard())
	+ ->assertFocused('@search input')
	+ ->assertMissing('@search table');
	+
	+ // Test search with no results
	+ $browser->type('@search input', 'unknown')
	+ ->click('@search form button')
	+ ->assertToast(Toast::TYPE_INFO, '0 user accounts have been found.')
	+ ->assertMissing('@search table');
	+
	+ $john = $this->getTestUser('john@kolab.org');
	+ $jack = $this->getTestUser('jack@kolab.org');
	+ $jack->setSetting('external_email', 'john.doe.external@gmail.com');
	+
	+ // Test search with multiple results
	+ $browser->type('@search input', 'john.doe.external@gmail.com')
	+ ->click('@search form button')
	+ ->assertToast(Toast::TYPE_INFO, '2 user accounts have been found.')
	+ ->whenAvailable('@search table', function (Browser $browser) use ($john, $jack) {
	+ $browser->assertElementsCount('tbody tr', 2)
	+ ->with('tbody tr:first-child', function (Browser $browser) use ($jack) {
	+ $browser->assertSeeIn('td:nth-child(1) a', $jack->email)
	+ ->assertSeeIn('td:nth-child(2) a', $jack->id)
	+ ->assertVisible('td:nth-child(3)')
	+ ->assertTextRegExp('td:nth-child(3)', '/^[0-9]{4}-[0-9]{2}-[0-9]{2}$/')
	+ ->assertVisible('td:nth-child(4)')
	+ ->assertText('td:nth-child(4)', '');
	+ })
	+ ->with('tbody tr:last-child', function (Browser $browser) use ($john) {
	+ $browser->assertSeeIn('td:nth-child(1) a', $john->email)
	+ ->assertSeeIn('td:nth-child(2) a', $john->id)
	+ ->assertVisible('td:nth-child(3)')
	+ ->assertTextRegExp('td:nth-child(3)', '/^[0-9]{4}-[0-9]{2}-[0-9]{2}$/')
	+ ->assertVisible('td:nth-child(4)')
	+ ->assertText('td:nth-child(4)', '');
	+ });
	+ });
	+
	+ // Test search with single record result -> redirect to user page
	+ $browser->type('@search input', 'kolab.org')
	+ ->click('@search form button')
	+ ->assertMissing('@search table')
	+ ->waitForLocation('/user/' . $john->id)
	+ ->waitUntilMissing('.app-loader')
	+ ->whenAvailable('#user-info', function (Browser $browser) use ($john) {
	+ $browser->assertSeeIn('.card-title', $john->email);
	+ });
	+ });
	+ }
	+
	+ /**
	+ * Test user search deleted user/domain
	+ */
	+ public function testSearchDeleted(): void
	+ {
	+ $this->browse(function (Browser $browser) {
	+ $browser->visit(new Home())
	+ ->submitLogon('reseller@kolabnow.com', 'reseller', true)
	+ ->on(new Dashboard())
	+ ->assertFocused('@search input')
	+ ->assertMissing('@search table');
	+
	+ // Deleted users/domains
	+ $domain = $this->getTestDomain('testsearch.com', ['type' => \App\Domain::TYPE_EXTERNAL]);
	+ $user = $this->getTestUser('test@testsearch.com');
	+ $plan = \App\Plan::where('title', 'group')->first();
	+ $user->assignPlan($plan, $domain);
	+ $user->setAliases(['alias@testsearch.com']);
	+ Queue::fake();
	+ $user->delete();
	+
	+ // Test search with multiple results
	+ $browser->type('@search input', 'testsearch.com')
	+ ->click('@search form button')
	+ ->assertToast(Toast::TYPE_INFO, '1 user accounts have been found.')
	+ ->whenAvailable('@search table', function (Browser $browser) use ($user) {
	+ $browser->assertElementsCount('tbody tr', 1)
	+ ->assertVisible('tbody tr:first-child.text-secondary')
	+ ->with('tbody tr:first-child', function (Browser $browser) use ($user) {
	+ $browser->assertSeeIn('td:nth-child(1) span', $user->email)
	+ ->assertSeeIn('td:nth-child(2) span', $user->id)
	+ ->assertVisible('td:nth-child(3)')
	+ ->assertTextRegExp('td:nth-child(3)', '/^[0-9]{4}-[0-9]{2}-[0-9]{2}$/')
	+ ->assertVisible('td:nth-child(4)')
	+ ->assertTextRegExp('td:nth-child(4)', '/^[0-9]{4}-[0-9]{2}-[0-9]{2}$/');
	+ });
	+ });
	+ });
	+ }
	+}
	diff --git a/src/tests/Browser/Reseller/DistlistTest.php b/src/tests/Browser/Reseller/DistlistTest.php
	new file mode 100644
	--- /dev/null
	+++ b/src/tests/Browser/Reseller/DistlistTest.php
	@@ -0,0 +1,128 @@
	+<?php
	+
	+namespace Tests\Browser\Reseller;
	+
	+use App\Group;
	+use Illuminate\Support\Facades\Queue;
	+use Tests\Browser;
	+use Tests\Browser\Components\Toast;
	+use Tests\Browser\Pages\Admin\Distlist as DistlistPage;
	+use Tests\Browser\Pages\Admin\User as UserPage;
	+use Tests\Browser\Pages\Dashboard;
	+use Tests\Browser\Pages\Home;
	+use Tests\TestCaseDusk;
	+
	+class DistlistTest extends TestCaseDusk
	+{
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function setUp(): void
	+ {
	+ parent::setUp();
	+ self::useResellerUrl();
	+
	+ $this->deleteTestGroup('group-test@kolab.org');
	+ }
	+
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function tearDown(): void
	+ {
	+ $this->deleteTestGroup('group-test@kolab.org');
	+
	+ parent::tearDown();
	+ }
	+
	+ /**
	+ * Test distlist info page (unauthenticated)
	+ */
	+ public function testDistlistUnauth(): void
	+ {
	+ // Test that the page requires authentication
	+ $this->browse(function (Browser $browser) {
	+ $user = $this->getTestUser('john@kolab.org');
	+ $group = $this->getTestGroup('group-test@kolab.org');
	+ $group->assignToWallet($user->wallets->first());
	+
	+ $browser->visit('/distlist/' . $group->id)->on(new Home());
	+ });
	+ }
	+
	+ /**
	+ * Test distribution list info page
	+ */
	+ public function testInfo(): void
	+ {
	+ Queue::fake();
	+
	+ $this->browse(function (Browser $browser) {
	+ $user = $this->getTestUser('john@kolab.org');
	+ $group = $this->getTestGroup('group-test@kolab.org');
	+ $group->assignToWallet($user->wallets->first());
	+ $group->members = ['test1@gmail.com', 'test2@gmail.com'];
	+ $group->save();
	+
	+ $distlist_page = new DistlistPage($group->id);
	+ $user_page = new UserPage($user->id);
	+
	+ // Goto the distlist page
	+ $browser->visit(new Home())
	+ ->submitLogon('reseller@kolabnow.com', 'reseller', true)
	+ ->on(new Dashboard())
	+ ->visit($user_page)
	+ ->on($user_page)
	+ ->click('@nav #tab-distlists')
	+ ->pause(1000)
	+ ->click('@user-distlists table tbody tr:first-child td a')
	+ ->on($distlist_page)
	+ ->assertSeeIn('@distlist-info .card-title', $group->email)
	+ ->with('@distlist-info form', function (Browser $browser) use ($group) {
	+ $browser->assertElementsCount('.row', 3)
	+ ->assertSeeIn('.row:nth-child(1) label', 'ID (Created at)')
	+ ->assertSeeIn('.row:nth-child(1) #distlistid', "{$group->id} ({$group->created_at})")
	+ ->assertSeeIn('.row:nth-child(2) label', 'Status')
	+ ->assertSeeIn('.row:nth-child(2) #status.text-danger', 'Not Ready')
	+ ->assertSeeIn('.row:nth-child(3) label', 'Recipients')
	+ ->assertSeeIn('.row:nth-child(3) #members', $group->members[0])
	+ ->assertSeeIn('.row:nth-child(3) #members', $group->members[1]);
	+ });
	+
	+ // Test invalid group identifier
	+ $browser->visit('/distlist/abc')->assertErrorPage(404);
	+ });
	+ }
	+
	+ /**
	+ * Test suspending/unsuspending a distribution list
	+ *
	+ * @depends testInfo
	+ */
	+ public function testSuspendAndUnsuspend(): void
	+ {
	+ Queue::fake();
	+
	+ $this->browse(function (Browser $browser) {
	+ $user = $this->getTestUser('john@kolab.org');
	+ $group = $this->getTestGroup('group-test@kolab.org');
	+ $group->assignToWallet($user->wallets->first());
	+ $group->status = Group::STATUS_ACTIVE \| Group::STATUS_LDAP_READY;
	+ $group->save();
	+
	+ $browser->visit(new DistlistPage($group->id))
	+ ->assertVisible('@distlist-info #button-suspend')
	+ ->assertMissing('@distlist-info #button-unsuspend')
	+ ->assertSeeIn('@distlist-info #status.text-success', 'Active')
	+ ->click('@distlist-info #button-suspend')
	+ ->assertToast(Toast::TYPE_SUCCESS, 'Distribution list suspended successfully.')
	+ ->assertSeeIn('@distlist-info #status.text-warning', 'Suspended')
	+ ->assertMissing('@distlist-info #button-suspend')
	+ ->click('@distlist-info #button-unsuspend')
	+ ->assertToast(Toast::TYPE_SUCCESS, 'Distribution list unsuspended successfully.')
	+ ->assertSeeIn('@distlist-info #status.text-success', 'Active')
	+ ->assertVisible('@distlist-info #button-suspend')
	+ ->assertMissing('@distlist-info #button-unsuspend');
	+ });
	+ }
	+}
	diff --git a/src/tests/Browser/Reseller/DomainTest.php b/src/tests/Browser/Reseller/DomainTest.php
	new file mode 100644
	--- /dev/null
	+++ b/src/tests/Browser/Reseller/DomainTest.php
	@@ -0,0 +1,120 @@
	+<?php
	+
	+namespace Tests\Browser\Reseller;
	+
	+use App\Domain;
	+use Tests\Browser;
	+use Tests\Browser\Components\Toast;
	+use Tests\Browser\Pages\Admin\Domain as DomainPage;
	+use Tests\Browser\Pages\Admin\User as UserPage;
	+use Tests\Browser\Pages\Dashboard;
	+use Tests\Browser\Pages\Home;
	+use Tests\TestCaseDusk;
	+use Illuminate\Foundation\Testing\DatabaseMigrations;
	+
	+class DomainTest extends TestCaseDusk
	+{
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function setUp(): void
	+ {
	+ parent::setUp();
	+ self::useResellerUrl();
	+ }
	+
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function tearDown(): void
	+ {
	+ parent::tearDown();
	+ }
	+
	+ /**
	+ * Test domain info page (unauthenticated)
	+ */
	+ public function testDomainUnauth(): void
	+ {
	+ // Test that the page requires authentication
	+ $this->browse(function (Browser $browser) {
	+ $domain = $this->getTestDomain('kolab.org');
	+ $browser->visit('/domain/' . $domain->id)->on(new Home());
	+ });
	+ }
	+
	+ /**
	+ * Test domain info page
	+ */
	+ public function testDomainInfo(): void
	+ {
	+ $this->browse(function (Browser $browser) {
	+ $domain = $this->getTestDomain('kolab.org');
	+ $domain_page = new DomainPage($domain->id);
	+ $reseller = $this->getTestUser('reseller@kolabnow.com');
	+ $user = $this->getTestUser('john@kolab.org');
	+ $user_page = new UserPage($user->id);
	+
	+ // Goto the domain page
	+ $browser->visit(new Home())
	+ ->submitLogon('reseller@kolabnow.com', 'reseller', true)
	+ ->on(new Dashboard())
	+ ->visit($user_page)
	+ ->on($user_page)
	+ ->click('@nav #tab-domains')
	+ ->pause(1000)
	+ ->click('@user-domains table tbody tr:first-child td a');
	+
	+ $browser->on($domain_page)
	+ ->assertSeeIn('@domain-info .card-title', 'kolab.org')
	+ ->with('@domain-info form', function (Browser $browser) use ($domain) {
	+ $browser->assertElementsCount('.row', 2)
	+ ->assertSeeIn('.row:nth-child(1) label', 'ID (Created at)')
	+ ->assertSeeIn('.row:nth-child(1) #domainid', "{$domain->id} ({$domain->created_at})")
	+ ->assertSeeIn('.row:nth-child(2) label', 'Status')
	+ ->assertSeeIn('.row:nth-child(2) #status span.text-success', 'Active');
	+ });
	+
	+ // Some tabs are loaded in background, wait a second
	+ $browser->pause(500)
	+ ->assertElementsCount('@nav a', 1);
	+
	+ // Assert Configuration tab
	+ $browser->assertSeeIn('@nav #tab-config', 'Configuration')
	+ ->with('@domain-config', function (Browser $browser) {
	+ $browser->assertSeeIn('pre#dns-verify', 'kolab-verify.kolab.org.')
	+ ->assertSeeIn('pre#dns-config', 'kolab.org.');
	+ });
	+ });
	+ }
	+
	+ /**
	+ * Test suspending/unsuspending a domain
	+ *
	+ * @depends testDomainInfo
	+ */
	+ public function testSuspendAndUnsuspend(): void
	+ {
	+ $this->browse(function (Browser $browser) {
	+ $domain = $this->getTestDomain('domainscontroller.com', [
	+ 'status' => Domain::STATUS_NEW \| Domain::STATUS_ACTIVE
	+ \| Domain::STATUS_LDAP_READY \| Domain::STATUS_CONFIRMED
	+ \| Domain::STATUS_VERIFIED,
	+ 'type' => Domain::TYPE_EXTERNAL,
	+ ]);
	+
	+ $browser->visit(new DomainPage($domain->id))
	+ ->assertVisible('@domain-info #button-suspend')
	+ ->assertMissing('@domain-info #button-unsuspend')
	+ ->click('@domain-info #button-suspend')
	+ ->assertToast(Toast::TYPE_SUCCESS, 'Domain suspended successfully.')
	+ ->assertSeeIn('@domain-info #status span.text-warning', 'Suspended')
	+ ->assertMissing('@domain-info #button-suspend')
	+ ->click('@domain-info #button-unsuspend')
	+ ->assertToast(Toast::TYPE_SUCCESS, 'Domain unsuspended successfully.')
	+ ->assertSeeIn('@domain-info #status span.text-success', 'Active')
	+ ->assertVisible('@domain-info #button-suspend')
	+ ->assertMissing('@domain-info #button-unsuspend');
	+ });
	+ }
	+}
	diff --git a/src/tests/Browser/Reseller/InvitationsTest.php b/src/tests/Browser/Reseller/InvitationsTest.php
	new file mode 100644
	--- /dev/null
	+++ b/src/tests/Browser/Reseller/InvitationsTest.php
	@@ -0,0 +1,222 @@
	+<?php
	+
	+namespace Tests\Browser\Reseller;
	+
	+use App\SignupInvitation;
	+use Illuminate\Support\Facades\Queue;
	+use Tests\Browser;
	+use Tests\Browser\Components\Dialog;
	+use Tests\Browser\Components\Menu;
	+use Tests\Browser\Components\Toast;
	+use Tests\Browser\Pages\Dashboard;
	+use Tests\Browser\Pages\Home;
	+use Tests\Browser\Pages\Reseller\Invitations;
	+use Tests\TestCaseDusk;
	+
	+class InvitationsTest extends TestCaseDusk
	+{
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function setUp(): void
	+ {
	+ parent::setUp();
	+ self::useResellerUrl();
	+ SignupInvitation::truncate();
	+ }
	+
	+ /**
	+ * Test invitations page (unauthenticated)
	+ */
	+ public function testInvitationsUnauth(): void
	+ {
	+ // Test that the page requires authentication
	+ $this->browse(function (Browser $browser) {
	+ $browser->visit('/invitations')->on(new Home());
	+ });
	+ }
	+
	+ /**
	+ * Test Invitations creation
	+ */
	+ public function testInvitationCreate(): void
	+ {
	+ $this->browse(function (Browser $browser) {
	+ $date_regexp = '/^20[0-9]{2}-/';
	+
	+ $browser->visit(new Home())
	+ ->submitLogon('reseller@kolabnow.com', 'reseller', true)
	+ ->on(new Dashboard())
	+ ->assertSeeIn('@links .link-invitations', 'Invitations')
	+ ->click('@links .link-invitations')
	+ ->on(new Invitations())
	+ ->assertElementsCount('@table tbody tr', 0)
	+ ->assertMissing('#more-loader')
	+ ->assertSeeIn('@table tfoot td', "There are no invitations in the database.")
	+ ->assertSeeIn('@create-button', 'Create invite(s)');
	+
	+ // Create a single invite with email address input
	+ $browser->click('@create-button')
	+ ->with(new Dialog('#invite-create'), function (Browser $browser) {
	+ $browser->assertSeeIn('@title', 'Invite for a signup')
	+ ->assertFocused('@body input#email')
	+ ->assertValue('@body input#email', '')
	+ ->type('@body input#email', 'test')
	+ ->assertSeeIn('@button-action', 'Send invite(s)')
	+ ->click('@button-action')
	+ ->assertToast(Toast::TYPE_ERROR, "Form validation error")
	+ ->waitFor('@body input#email.is-invalid')
	+ ->assertSeeIn(
	+ '@body input#email.is-invalid + .invalid-feedback',
	+ "The email must be a valid email address."
	+ )
	+ ->type('@body input#email', 'test@domain.tld')
	+ ->click('@button-action');
	+ })
	+ ->assertToast(Toast::TYPE_SUCCESS, "The invitation has been created.")
	+ ->waitUntilMissing('#invite-create')
	+ ->waitUntilMissing('@table .app-loader')
	+ ->assertElementsCount('@table tbody tr', 1)
	+ ->assertMissing('@table tfoot')
	+ ->assertSeeIn('@table tbody tr td.email', 'test@domain.tld')
	+ ->assertText('@table tbody tr td.email title', 'Not sent yet')
	+ ->assertTextRegExp('@table tbody tr td.datetime', $date_regexp)
	+ ->assertVisible('@table tbody tr td.buttons button.button-delete')
	+ ->assertVisible('@table tbody tr td.buttons button.button-resend:disabled');
	+
	+ sleep(1);
	+
	+ // Create invites from a file
	+ $browser->click('@create-button')
	+ ->with(new Dialog('#invite-create'), function (Browser $browser) {
	+ $browser->assertFocused('@body input#email')
	+ ->assertValue('@body input#email', '')
	+ ->assertMissing('@body input#email.is-invalid')
	+ // Submit an empty file
	+ ->attach('@body input#file', __DIR__ . '/../../data/empty.csv')
	+ ->assertSeeIn('@body input#file + label', 'empty.csv')
	+ ->click('@button-action')
	+ ->assertToast(Toast::TYPE_ERROR, "Form validation error")
	+ // ->waitFor('input#file.is-invalid')
	+ ->assertSeeIn(
	+ '@body input#file.is-invalid + label + .invalid-feedback',
	+ "Failed to find any valid email addresses in the uploaded file."
	+ )
	+ // Submit non-empty file
	+ ->attach('@body input#file', __DIR__ . '/../../data/email.csv')
	+ ->click('@button-action');
	+ })
	+ ->assertToast(Toast::TYPE_SUCCESS, "2 invitations has been created.")
	+ ->waitUntilMissing('#invite-create')
	+ ->waitUntilMissing('@table .app-loader')
	+ ->assertElementsCount('@table tbody tr', 3)
	+ ->assertTextRegExp('@table tbody tr:nth-child(1) td.email', '/email[12]@test\.com$/')
	+ ->assertTextRegExp('@table tbody tr:nth-child(2) td.email', '/email[12]@test\.com$/');
	+ });
	+ }
	+
	+ /**
	+ * Test Invitations deletion and resending
	+ */
	+ public function testInvitationDeleteAndResend(): void
	+ {
	+ $this->browse(function (Browser $browser) {
	+ Queue::fake();
	+ $i1 = SignupInvitation::create(['email' => 'test1@domain.org']);
	+ $i2 = SignupInvitation::create(['email' => 'test2@domain.org']);
	+ SignupInvitation::where('id', $i2->id)
	+ ->update(['created_at' => now()->subHours('2'), 'status' => SignupInvitation::STATUS_FAILED]);
	+
	+ // Test deleting
	+ $browser->visit(new Invitations())
	+ // ->submitLogon('reseller@kolabnow.com', 'reseller', true)
	+ ->assertElementsCount('@table tbody tr', 2)
	+ ->click('@table tbody tr:first-child button.button-delete')
	+ ->assertToast(Toast::TYPE_SUCCESS, "Invitation deleted successfully.")
	+ ->assertElementsCount('@table tbody tr', 1);
	+
	+ // Test resending
	+ $browser->click('@table tbody tr:first-child button.button-resend')
	+ ->assertToast(Toast::TYPE_SUCCESS, "Invitation added to the sending queue successfully.")
	+ ->assertElementsCount('@table tbody tr', 1);
	+ });
	+ }
	+
	+ /**
	+ * Test Invitations list (paging and searching)
	+ */
	+ public function testInvitationsList(): void
	+ {
	+ $this->browse(function (Browser $browser) {
	+ Queue::fake();
	+ $i1 = SignupInvitation::create(['email' => 'email1@ext.com']);
	+ $i2 = SignupInvitation::create(['email' => 'email2@ext.com']);
	+ $i3 = SignupInvitation::create(['email' => 'email3@ext.com']);
	+ $i4 = SignupInvitation::create(['email' => 'email4@other.com']);
	+ $i5 = SignupInvitation::create(['email' => 'email5@other.com']);
	+ $i6 = SignupInvitation::create(['email' => 'email6@other.com']);
	+ $i7 = SignupInvitation::create(['email' => 'email7@other.com']);
	+ $i8 = SignupInvitation::create(['email' => 'email8@other.com']);
	+ $i9 = SignupInvitation::create(['email' => 'email9@other.com']);
	+ $i10 = SignupInvitation::create(['email' => 'email10@other.com']);
	+ $i11 = SignupInvitation::create(['email' => 'email11@other.com']);
	+
	+ SignupInvitation::query()->update(['created_at' => now()->subDays('1')]);
	+ SignupInvitation::where('id', $i1->id)
	+ ->update(['created_at' => now()->subHours('2'), 'status' => SignupInvitation::STATUS_FAILED]);
	+ SignupInvitation::where('id', $i2->id)
	+ ->update(['created_at' => now()->subHours('3'), 'status' => SignupInvitation::STATUS_SENT]);
	+ SignupInvitation::where('id', $i3->id)
	+ ->update(['created_at' => now()->subHours('4'), 'status' => SignupInvitation::STATUS_COMPLETED]);
	+ SignupInvitation::where('id', $i11->id)->update(['created_at' => now()->subDays('3')]);
	+
	+ // Test paging (load more) feature
	+ $browser->visit(new Invitations())
	+ // ->submitLogon('reseller@kolabnow.com', 'reseller', true)
	+ ->assertElementsCount('@table tbody tr', 10)
	+ ->assertSeeIn('#more-loader button', 'Load more')
	+ ->with('@table tbody', function ($browser) use ($i1, $i2, $i3) {
	+ $browser->assertSeeIn('tr:nth-child(1) td.email', $i1->email)
	+ ->assertText('tr:nth-child(1) td.email svg.text-danger title', 'Sending failed')
	+ ->assertVisible('tr:nth-child(1) td.buttons button.button-delete')
	+ ->assertVisible('tr:nth-child(1) td.buttons button.button-resend:not(:disabled)')
	+ ->assertSeeIn('tr:nth-child(2) td.email', $i2->email)
	+ ->assertText('tr:nth-child(2) td.email svg.text-primary title', 'Sent')
	+ ->assertVisible('tr:nth-child(2) td.buttons button.button-delete')
	+ ->assertVisible('tr:nth-child(2) td.buttons button.button-resend:not(:disabled)')
	+ ->assertSeeIn('tr:nth-child(3) td.email', $i3->email)
	+ ->assertText('tr:nth-child(3) td.email svg.text-success title', 'User signed up')
	+ ->assertVisible('tr:nth-child(3) td.buttons button.button-delete')
	+ ->assertVisible('tr:nth-child(3) td.buttons button.button-resend:disabled')
	+ ->assertText('tr:nth-child(4) td.email svg title', 'Not sent yet')
	+ ->assertVisible('tr:nth-child(4) td.buttons button.button-delete')
	+ ->assertVisible('tr:nth-child(4) td.buttons button.button-resend:disabled');
	+ })
	+ ->click('#more-loader button')
	+ ->whenAvailable('@table tbody tr:nth-child(11)', function ($browser) use ($i11) {
	+ $browser->assertSeeIn('td.email', $i11->email);
	+ })
	+ ->assertMissing('#more-loader button');
	+
	+ // Test searching (by domain)
	+ $browser->type('@search-input', 'ext.com')
	+ ->click('@search-button')
	+ ->waitUntilMissing('@table .app-loader')
	+ ->assertElementsCount('@table tbody tr', 3)
	+ ->assertMissing('#more-loader button')
	+ // search by full email
	+ ->type('@search-input', 'email7@other.com')
	+ ->keys('@search-input', '{enter}')
	+ ->waitUntilMissing('@table .app-loader')
	+ ->assertElementsCount('@table tbody tr', 1)
	+ ->assertSeeIn('@table tbody tr:nth-child(1) td.email', 'email7@other.com')
	+ ->assertMissing('#more-loader button')
	+ // reset search
	+ ->vueClear('#search-form input')
	+ ->keys('@search-input', '{enter}')
	+ ->waitUntilMissing('@table .app-loader')
	+ ->assertElementsCount('@table tbody tr', 10)
	+ ->assertVisible('#more-loader button');
	+ });
	+ }
	+}
	diff --git a/src/tests/Browser/Reseller/LogonTest.php b/src/tests/Browser/Reseller/LogonTest.php
	new file mode 100644
	--- /dev/null
	+++ b/src/tests/Browser/Reseller/LogonTest.php
	@@ -0,0 +1,144 @@
	+<?php
	+
	+namespace Tests\Browser\Reseller;
	+
	+use Tests\Browser;
	+use Tests\Browser\Components\Menu;
	+use Tests\Browser\Components\Toast;
	+use Tests\Browser\Pages\Dashboard;
	+use Tests\Browser\Pages\Home;
	+use Tests\TestCaseDusk;
	+
	+class LogonTest extends TestCaseDusk
	+{
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function setUp(): void
	+ {
	+ parent::setUp();
	+ self::useResellerUrl();
	+ }
	+
	+ /**
	+ * Test menu on logon page
	+ */
	+ public function testLogonMenu(): void
	+ {
	+ $this->browse(function (Browser $browser) {
	+ $browser->visit(new Home())
	+ ->with(new Menu(), function ($browser) {
	+ $browser->assertMenuItems(['explore', 'blog', 'support', 'login']);
	+ })
	+ ->assertMissing('@second-factor-input')
	+ ->assertMissing('@forgot-password');
	+ });
	+ }
	+
	+ /**
	+ * Test redirect to /login if user is unauthenticated
	+ */
	+ public function testLogonRedirect(): void
	+ {
	+ $this->browse(function (Browser $browser) {
	+ $browser->visit('/dashboard');
	+
	+ // Checks if we're really on the login page
	+ $browser->waitForLocation('/login')
	+ ->on(new Home());
	+ });
	+ }
	+
	+ /**
	+ * Logon with wrong password/user test
	+ */
	+ public function testLogonWrongCredentials(): void
	+ {
	+ $this->browse(function (Browser $browser) {
	+ $browser->visit(new Home())
	+ ->submitLogon('reseller@reseller.com', 'wrong')
	+ // Error message
	+ ->assertToast(Toast::TYPE_ERROR, 'Invalid username or password.')
	+ // Checks if we're still on the logon page
	+ ->on(new Home());
	+ });
	+ }
	+
	+ /**
	+ * Successful logon test
	+ */
	+ public function testLogonSuccessful(): void
	+ {
	+ $this->browse(function (Browser $browser) {
	+ $browser->visit(new Home())
	+ ->submitLogon('reseller@reseller.com', 'reseller', true);
	+
	+ // Checks if we're really on Dashboard page
	+ $browser->on(new Dashboard())
	+ ->within(new Menu(), function ($browser) {
	+ $browser->assertMenuItems(['explore', 'blog', 'support', 'dashboard', 'logout']);
	+ })
	+ ->assertUser('reseller@reseller.com');
	+
	+ // Test that visiting '/' with logged in user does not open logon form
	+ // but "redirects" to the dashboard
	+ $browser->visit('/')->on(new Dashboard());
	+ });
	+ }
	+
	+ /**
	+ * Logout test
	+ *
	+ * @depends testLogonSuccessful
	+ */
	+ public function testLogout(): void
	+ {
	+ $this->browse(function (Browser $browser) {
	+ $browser->on(new Dashboard());
	+
	+ // Click the Logout button
	+ $browser->within(new Menu(), function ($browser) {
	+ $browser->clickMenuItem('logout');
	+ });
	+
	+ // We expect the logon page
	+ $browser->waitForLocation('/login')
	+ ->on(new Home());
	+
	+ // with default menu
	+ $browser->within(new Menu(), function ($browser) {
	+ $browser->assertMenuItems(['explore', 'blog', 'support', 'login']);
	+ });
	+
	+ // Success toast message
	+ $browser->assertToast(Toast::TYPE_SUCCESS, 'Successfully logged out');
	+ });
	+ }
	+
	+ /**
	+ * Logout by URL test
	+ */
	+ public function testLogoutByURL(): void
	+ {
	+ $this->browse(function (Browser $browser) {
	+ $browser->visit(new Home())
	+ ->submitLogon('reseller@reseller.com', 'reseller', true);
	+
	+ // Checks if we're really on Dashboard page
	+ $browser->on(new Dashboard());
	+
	+ // Use /logout url, and expect the logon page
	+ $browser->visit('/logout')
	+ ->waitForLocation('/login')
	+ ->on(new Home());
	+
	+ // with default menu
	+ $browser->within(new Menu(), function ($browser) {
	+ $browser->assertMenuItems(['explore', 'blog', 'support', 'login']);
	+ });
	+
	+ // Success toast message
	+ $browser->assertToast(Toast::TYPE_SUCCESS, 'Successfully logged out');
	+ });
	+ }
	+}
	diff --git a/src/tests/Browser/Reseller/StatsTest.php b/src/tests/Browser/Reseller/StatsTest.php
	new file mode 100644
	--- /dev/null
	+++ b/src/tests/Browser/Reseller/StatsTest.php
	@@ -0,0 +1,54 @@
	+<?php
	+
	+namespace Tests\Browser\Reseller;
	+
	+use Tests\Browser;
	+use Tests\Browser\Pages\Admin\Stats;
	+use Tests\Browser\Pages\Dashboard;
	+use Tests\Browser\Pages\Home;
	+use Tests\TestCaseDusk;
	+
	+class StatsTest extends TestCaseDusk
	+{
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function setUp(): void
	+ {
	+ parent::setUp();
	+ self::useResellerUrl();
	+ }
	+
	+ /**
	+ * Test Stats page (unauthenticated)
	+ */
	+ public function testStatsUnauth(): void
	+ {
	+ // Test that the page requires authentication
	+ $this->browse(function (Browser $browser) {
	+ $browser->visit('/stats')->on(new Home());
	+ });
	+ }
	+
	+ /**
	+ * Test Stats page
	+ */
	+ public function testStats(): void
	+ {
	+ $this->browse(function (Browser $browser) {
	+ $browser->visit(new Home())
	+ ->submitLogon('reseller@kolabnow.com', 'reseller', true)
	+ ->on(new Dashboard())
	+ ->assertSeeIn('@links .link-stats', 'Stats')
	+ ->click('@links .link-stats')
	+ ->on(new Stats())
	+ ->assertElementsCount('@container > div', 3)
	+ ->waitFor('@container #chart-users svg')
	+ ->assertSeeIn('@container #chart-users svg .title', 'Users - last 8 weeks')
	+ ->waitFor('@container #chart-users-all svg')
	+ ->assertSeeIn('@container #chart-users-all svg .title', 'All Users - last year')
	+ ->waitFor('@container #chart-discounts svg')
	+ ->assertSeeIn('@container #chart-discounts svg .title', 'Discounts');
	+ });
	+ }
	+}
	diff --git a/src/tests/Browser/Reseller/UserFinancesTest.php b/src/tests/Browser/Reseller/UserFinancesTest.php
	new file mode 100644
	--- /dev/null
	+++ b/src/tests/Browser/Reseller/UserFinancesTest.php
	@@ -0,0 +1,325 @@
	+<?php
	+
	+namespace Tests\Browser\Reseller;
	+
	+use App\Discount;
	+use App\Transaction;
	+use App\User;
	+use App\Wallet;
	+use Carbon\Carbon;
	+use Tests\Browser;
	+use Tests\Browser\Components\Dialog;
	+use Tests\Browser\Components\Toast;
	+use Tests\Browser\Pages\Admin\User as UserPage;
	+use Tests\Browser\Pages\Dashboard;
	+use Tests\Browser\Pages\Home;
	+use Tests\TestCaseDusk;
	+
	+class UserFinancesTest extends TestCaseDusk
	+{
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function setUp(): void
	+ {
	+ parent::setUp();
	+ self::useResellerUrl();
	+
	+ $john = $this->getTestUser('john@kolab.org');
	+ $wallet = $john->wallets()->first();
	+ $wallet->discount()->dissociate();
	+ $wallet->balance = 0;
	+ $wallet->save();
	+ $wallet->setSettings(['mollie_id' => null, 'stripe_id' => null]);
	+ }
	+
	+ /**
	+ * Test Finances tab (and transactions)
	+ */
	+ public function testFinances(): void
	+ {
	+ // Assert Jack's Finances tab
	+ $this->browse(function (Browser $browser) {
	+ $jack = $this->getTestUser('jack@kolab.org');
	+ $wallet = $jack->wallets()->first();
	+ $wallet->transactions()->delete();
	+ $wallet->setSetting('stripe_id', 'abc');
	+ $page = new UserPage($jack->id);
	+
	+ $browser->visit(new Home())
	+ ->submitLogon('reseller@kolabnow.com', 'reseller', true)
	+ ->on(new Dashboard())
	+ ->visit($page)
	+ ->on($page)
	+ ->assertSeeIn('@nav #tab-finances', 'Finances')
	+ ->with('@user-finances', function (Browser $browser) {
	+ $browser->waitUntilMissing('.app-loader')
	+ ->assertSeeIn('.card-title:first-child', 'Account balance')
	+ ->assertSeeIn('.card-title:first-child .text-success', '0,00 CHF')
	+ ->with('form', function (Browser $browser) {
	+ $browser->assertElementsCount('.row', 2)
	+ ->assertSeeIn('.row:nth-child(1) label', 'Discount')
	+ ->assertSeeIn('.row:nth-child(1) #discount span', 'none')
	+ ->assertSeeIn('.row:nth-child(2) label', 'Stripe ID')
	+ ->assertSeeIn('.row:nth-child(2) a', 'abc');
	+ })
	+ ->assertSeeIn('h2:nth-of-type(2)', 'Transactions')
	+ ->with('table', function (Browser $browser) {
	+ $browser->assertMissing('tbody')
	+ ->assertSeeIn('tfoot td', "There are no transactions for this account.");
	+ })
	+ ->assertMissing('table + button');
	+ });
	+ });
	+
	+ // Assert John's Finances tab (with discount, and debit)
	+ $this->browse(function (Browser $browser) {
	+ $john = $this->getTestUser('john@kolab.org');
	+ $page = new UserPage($john->id);
	+ $discount = Discount::where('code', 'TEST')->first();
	+ $wallet = $john->wallet();
	+ $wallet->transactions()->delete();
	+ $wallet->discount()->associate($discount);
	+ $wallet->debit(2010);
	+ $wallet->save();
	+
	+ // Create test transactions
	+ $transaction = Transaction::create([
	+ 'user_email' => 'jeroen@jeroen.jeroen',
	+ 'object_id' => $wallet->id,
	+ 'object_type' => Wallet::class,
	+ 'type' => Transaction::WALLET_CREDIT,
	+ 'amount' => 100,
	+ 'description' => 'Payment',
	+ ]);
	+ $transaction->created_at = Carbon::now()->subMonth();
	+ $transaction->save();
	+
	+ // Click the managed-by link on Jack's page
	+ $browser->click('@user-info #manager a')
	+ ->on($page)
	+ ->with('@user-finances', function (Browser $browser) {
	+ $browser->waitUntilMissing('.app-loader')
	+ ->assertSeeIn('.card-title:first-child', 'Account balance')
	+ ->assertSeeIn('.card-title:first-child .text-danger', '-20,10 CHF')
	+ ->with('form', function (Browser $browser) {
	+ $browser->assertElementsCount('.row', 1)
	+ ->assertSeeIn('.row:nth-child(1) label', 'Discount')
	+ ->assertSeeIn('.row:nth-child(1) #discount span', '10% - Test voucher');
	+ })
	+ ->assertSeeIn('h2:nth-of-type(2)', 'Transactions')
	+ ->with('table', function (Browser $browser) {
	+ $browser->assertElementsCount('tbody tr', 2)
	+ ->assertMissing('tfoot');
	+
	+ if (!$browser->isPhone()) {
	+ $browser->assertSeeIn('tbody tr:last-child td.email', 'jeroen@jeroen.jeroen');
	+ }
	+ });
	+ });
	+ });
	+
	+ // Now we go to Ned's info page, he's a controller on John's wallet
	+ $this->browse(function (Browser $browser) {
	+ $ned = $this->getTestUser('ned@kolab.org');
	+ $wallet = $ned->wallets()->first();
	+ $wallet->balance = 0;
	+ $wallet->save();
	+ $page = new UserPage($ned->id);
	+
	+ $browser->click('@nav #tab-users')
	+ ->click('@user-users tbody tr:nth-child(4) td:first-child a')
	+ ->on($page)
	+ ->with('@user-finances', function (Browser $browser) {
	+ $browser->waitUntilMissing('.app-loader')
	+ ->assertSeeIn('.card-title:first-child', 'Account balance')
	+ ->assertSeeIn('.card-title:first-child .text-success', '0,00 CHF')
	+ ->with('form', function (Browser $browser) {
	+ $browser->assertElementsCount('.row', 1)
	+ ->assertSeeIn('.row:nth-child(1) label', 'Discount')
	+ ->assertSeeIn('.row:nth-child(1) #discount span', 'none');
	+ })
	+ ->assertSeeIn('h2:nth-of-type(2)', 'Transactions')
	+ ->with('table', function (Browser $browser) {
	+ $browser->assertMissing('tbody')
	+ ->assertSeeIn('tfoot td', "There are no transactions for this account.");
	+ })
	+ ->assertMissing('table + button');
	+ });
	+ });
	+ }
	+
	+ /**
	+ * Test editing wallet discount
	+ *
	+ * @depends testFinances
	+ */
	+ public function testWalletDiscount(): void
	+ {
	+ $this->browse(function (Browser $browser) {
	+ $john = $this->getTestUser('john@kolab.org');
	+
	+ $browser->visit(new UserPage($john->id))
	+ ->pause(100)
	+ ->waitUntilMissing('@user-finances .app-loader')
	+ ->click('@user-finances #discount button')
	+ // Test dialog content, and closing it with Cancel button
	+ ->with(new Dialog('#discount-dialog'), function (Browser $browser) {
	+ $browser->assertSeeIn('@title', 'Account discount')
	+ ->assertFocused('@body select')
	+ ->assertSelected('@body select', '')
	+ ->assertSeeIn('@button-cancel', 'Cancel')
	+ ->assertSeeIn('@button-action', 'Submit')
	+ ->click('@button-cancel');
	+ })
	+ ->assertMissing('#discount-dialog')
	+ ->click('@user-finances #discount button')
	+ // Change the discount
	+ ->with(new Dialog('#discount-dialog'), function (Browser $browser) {
	+ $browser->click('@body select')
	+ ->click('@body select option:nth-child(2)')
	+ ->click('@button-action');
	+ })
	+ ->assertToast(Toast::TYPE_SUCCESS, 'User wallet updated successfully.')
	+ ->assertSeeIn('#discount span', '10% - Test voucher')
	+ ->click('@nav #tab-subscriptions')
	+ ->with('@user-subscriptions', function (Browser $browser) {
	+ $browser->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '3,99 CHF/month¹')
	+ ->assertSeeIn('table tbody tr:nth-child(2) td:last-child', '0,00 CHF/month¹')
	+ ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '4,99 CHF/month¹')
	+ ->assertSeeIn('table + .hint', '¹ applied discount: 10% - Test voucher');
	+ })
	+ // Change back to 'none'
	+ ->click('@nav #tab-finances')
	+ ->click('@user-finances #discount button')
	+ ->with(new Dialog('#discount-dialog'), function (Browser $browser) {
	+ $browser->click('@body select')
	+ ->click('@body select option:nth-child(1)')
	+ ->click('@button-action');
	+ })
	+ ->assertToast(Toast::TYPE_SUCCESS, 'User wallet updated successfully.')
	+ ->assertSeeIn('#discount span', 'none')
	+ ->click('@nav #tab-subscriptions')
	+ ->with('@user-subscriptions', function (Browser $browser) {
	+ $browser->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '4,44 CHF/month')
	+ ->assertSeeIn('table tbody tr:nth-child(2) td:last-child', '0,00 CHF/month')
	+ ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '5,55 CHF/month')
	+ ->assertMissing('table + .hint');
	+ });
	+ });
	+ }
	+
	+ /**
	+ * Test awarding/penalizing a wallet
	+ *
	+ * @depends testFinances
	+ */
	+ public function testBonusPenalty(): void
	+ {
	+ $this->browse(function (Browser $browser) {
	+ $john = $this->getTestUser('john@kolab.org');
	+
	+ $browser->visit(new UserPage($john->id))
	+ ->waitFor('@user-finances #button-award')
	+ ->click('@user-finances #button-award')
	+ // Test dialog content, and closing it with Cancel button
	+ ->with(new Dialog('#oneoff-dialog'), function (Browser $browser) {
	+ $browser->assertSeeIn('@title', 'Add a bonus to the wallet')
	+ ->assertFocused('@body input#oneoff_amount')
	+ ->assertSeeIn('@body label[for="oneoff_amount"]', 'Amount')
	+ ->assertvalue('@body input#oneoff_amount', '')
	+ ->assertSeeIn('@body label[for="oneoff_description"]', 'Description')
	+ ->assertvalue('@body input#oneoff_description', '')
	+ ->assertSeeIn('@button-cancel', 'Cancel')
	+ ->assertSeeIn('@button-action', 'Submit')
	+ ->click('@button-cancel');
	+ })
	+ ->assertMissing('#oneoff-dialog');
	+
	+ // Test bonus
	+ $browser->click('@user-finances #button-award')
	+ ->with(new Dialog('#oneoff-dialog'), function (Browser $browser) {
	+ // Test input validation for a bonus
	+ $browser->type('@body #oneoff_amount', 'aaa')
	+ ->type('@body #oneoff_description', '')
	+ ->click('@button-action')
	+ ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
	+ ->assertVisible('@body #oneoff_amount.is-invalid')
	+ ->assertVisible('@body #oneoff_description.is-invalid')
	+ ->assertSeeIn(
	+ '@body #oneoff_amount + span + .invalid-feedback',
	+ 'The amount must be a number.'
	+ )
	+ ->assertSeeIn(
	+ '@body #oneoff_description + .invalid-feedback',
	+ 'The description field is required.'
	+ );
	+
	+ // Test adding a bonus
	+ $browser->type('@body #oneoff_amount', '12.34')
	+ ->type('@body #oneoff_description', 'Test bonus')
	+ ->click('@button-action')
	+ ->assertToast(Toast::TYPE_SUCCESS, 'The bonus has been added to the wallet successfully.');
	+ })
	+ ->assertMissing('#oneoff-dialog')
	+ ->assertSeeIn('@user-finances .card-title span.text-success', '12,34 CHF')
	+ ->waitUntilMissing('.app-loader')
	+ ->with('table', function (Browser $browser) {
	+ $browser->assertElementsCount('tbody tr', 3)
	+ ->assertMissing('tfoot')
	+ ->assertSeeIn('tbody tr:first-child td.description', 'Bonus: Test bonus')
	+ ->assertSeeIn('tbody tr:first-child td.price', '12,34 CHF');
	+
	+ if (!$browser->isPhone()) {
	+ $browser->assertSeeIn('tbody tr:first-child td.email', 'reseller@kolabnow.com');
	+ }
	+ });
	+
	+ $this->assertSame(1234, $john->wallets()->first()->balance);
	+
	+ // Test penalty
	+ $browser->click('@user-finances #button-penalty')
	+ // Test dialog content, and closing it with Cancel button
	+ ->with(new Dialog('#oneoff-dialog'), function (Browser $browser) {
	+ $browser->assertSeeIn('@title', 'Add a penalty to the wallet')
	+ ->assertFocused('@body input#oneoff_amount')
	+ ->assertSeeIn('@body label[for="oneoff_amount"]', 'Amount')
	+ ->assertvalue('@body input#oneoff_amount', '')
	+ ->assertSeeIn('@body label[for="oneoff_description"]', 'Description')
	+ ->assertvalue('@body input#oneoff_description', '')
	+ ->assertSeeIn('@button-cancel', 'Cancel')
	+ ->assertSeeIn('@button-action', 'Submit')
	+ ->click('@button-cancel');
	+ })
	+ ->assertMissing('#oneoff-dialog')
	+ ->click('@user-finances #button-penalty')
	+ ->with(new Dialog('#oneoff-dialog'), function (Browser $browser) {
	+ // Test input validation for a penalty
	+ $browser->type('@body #oneoff_amount', '')
	+ ->type('@body #oneoff_description', '')
	+ ->click('@button-action')
	+ ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
	+ ->assertVisible('@body #oneoff_amount.is-invalid')
	+ ->assertVisible('@body #oneoff_description.is-invalid')
	+ ->assertSeeIn(
	+ '@body #oneoff_amount + span + .invalid-feedback',
	+ 'The amount field is required.'
	+ )
	+ ->assertSeeIn(
	+ '@body #oneoff_description + .invalid-feedback',
	+ 'The description field is required.'
	+ );
	+
	+ // Test adding a penalty
	+ $browser->type('@body #oneoff_amount', '12.35')
	+ ->type('@body #oneoff_description', 'Test penalty')
	+ ->click('@button-action')
	+ ->assertToast(Toast::TYPE_SUCCESS, 'The penalty has been added to the wallet successfully.');
	+ })
	+ ->assertMissing('#oneoff-dialog')
	+ ->assertSeeIn('@user-finances .card-title span.text-danger', '-0,01 CHF');
	+
	+ $this->assertSame(-1, $john->wallets()->first()->balance);
	+ });
	+ }
	+}
	diff --git a/src/tests/Browser/Reseller/UserTest.php b/src/tests/Browser/Reseller/UserTest.php
	new file mode 100644
	--- /dev/null
	+++ b/src/tests/Browser/Reseller/UserTest.php
	@@ -0,0 +1,473 @@
	+<?php
	+
	+namespace Tests\Browser\Reseller;
	+
	+use App\Auth\SecondFactor;
	+use App\Discount;
	+use App\Sku;
	+use App\User;
	+use Tests\Browser;
	+use Tests\Browser\Components\Dialog;
	+use Tests\Browser\Components\Toast;
	+use Tests\Browser\Pages\Admin\User as UserPage;
	+use Tests\Browser\Pages\Dashboard;
	+use Tests\Browser\Pages\Home;
	+use Tests\TestCaseDusk;
	+use Illuminate\Foundation\Testing\DatabaseMigrations;
	+
	+class UserTest extends TestCaseDusk
	+{
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function setUp(): void
	+ {
	+ parent::setUp();
	+ self::useResellerUrl();
	+
	+ $john = $this->getTestUser('john@kolab.org');
	+ $john->setSettings([
	+ 'phone' => '+48123123123',
	+ 'external_email' => 'john.doe.external@gmail.com',
	+ ]);
	+ if ($john->isSuspended()) {
	+ User::where('email', $john->email)->update(['status' => $john->status - User::STATUS_SUSPENDED]);
	+ }
	+ $wallet = $john->wallets()->first();
	+ $wallet->discount()->dissociate();
	+ $wallet->save();
	+
	+ $this->deleteTestGroup('group-test@kolab.org');
	+ $this->clearMeetEntitlements();
	+ }
	+
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function tearDown(): void
	+ {
	+ $john = $this->getTestUser('john@kolab.org');
	+ $john->setSettings([
	+ 'phone' => null,
	+ 'external_email' => 'john.doe.external@gmail.com',
	+ ]);
	+ if ($john->isSuspended()) {
	+ User::where('email', $john->email)->update(['status' => $john->status - User::STATUS_SUSPENDED]);
	+ }
	+ $wallet = $john->wallets()->first();
	+ $wallet->discount()->dissociate();
	+ $wallet->save();
	+
	+ $this->deleteTestGroup('group-test@kolab.org');
	+ $this->clearMeetEntitlements();
	+
	+ parent::tearDown();
	+ }
	+
	+ /**
	+ * Test user info page (unauthenticated)
	+ */
	+ public function testUserUnauth(): void
	+ {
	+ // Test that the page requires authentication
	+ $this->browse(function (Browser $browser) {
	+ $jack = $this->getTestUser('jack@kolab.org');
	+ $browser->visit('/user/' . $jack->id)->on(new Home());
	+ });
	+ }
	+
	+ /**
	+ * Test user info page
	+ */
	+ public function testUserInfo(): void
	+ {
	+ $this->browse(function (Browser $browser) {
	+ $jack = $this->getTestUser('jack@kolab.org');
	+ $page = new UserPage($jack->id);
	+
	+ $browser->visit(new Home())
	+ ->submitLogon('reseller@kolabnow.com', 'reseller', true)
	+ ->on(new Dashboard())
	+ ->visit($page)
	+ ->on($page);
	+
	+ // Assert main info box content
	+ $browser->assertSeeIn('@user-info .card-title', $jack->email)
	+ ->with('@user-info form', function (Browser $browser) use ($jack) {
	+ $browser->assertElementsCount('.row', 7)
	+ ->assertSeeIn('.row:nth-child(1) label', 'Managed by')
	+ ->assertSeeIn('.row:nth-child(1) #manager a', 'john@kolab.org')
	+ ->assertSeeIn('.row:nth-child(2) label', 'ID (Created at)')
	+ ->assertSeeIn('.row:nth-child(2) #userid', "{$jack->id} ({$jack->created_at})")
	+ ->assertSeeIn('.row:nth-child(3) label', 'Status')
	+ ->assertSeeIn('.row:nth-child(3) #status span.text-success', 'Active')
	+ ->assertSeeIn('.row:nth-child(4) label', 'First name')
	+ ->assertSeeIn('.row:nth-child(4) #first_name', 'Jack')
	+ ->assertSeeIn('.row:nth-child(5) label', 'Last name')
	+ ->assertSeeIn('.row:nth-child(5) #last_name', 'Daniels')
	+ ->assertSeeIn('.row:nth-child(6) label', 'External email')
	+ ->assertMissing('.row:nth-child(6) #external_email a')
	+ ->assertSeeIn('.row:nth-child(7) label', 'Country')
	+ ->assertSeeIn('.row:nth-child(7) #country', 'United States');
	+ });
	+
	+ // Some tabs are loaded in background, wait a second
	+ $browser->pause(500)
	+ ->assertElementsCount('@nav a', 6);
	+
	+ // Note: Finances tab is tested in UserFinancesTest.php
	+ $browser->assertSeeIn('@nav #tab-finances', 'Finances');
	+
	+ // Assert Aliases tab
	+ $browser->assertSeeIn('@nav #tab-aliases', 'Aliases (1)')
	+ ->click('@nav #tab-aliases')
	+ ->whenAvailable('@user-aliases', function (Browser $browser) {
	+ $browser->assertElementsCount('table tbody tr', 1)
	+ ->assertSeeIn('table tbody tr:first-child td:first-child', 'jack.daniels@kolab.org')
	+ ->assertMissing('table tfoot');
	+ });
	+
	+ // Assert Subscriptions tab
	+ $browser->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (3)')
	+ ->click('@nav #tab-subscriptions')
	+ ->with('@user-subscriptions', function (Browser $browser) {
	+ $browser->assertElementsCount('table tbody tr', 3)
	+ ->assertSeeIn('table tbody tr:nth-child(1) td:first-child', 'User Mailbox')
	+ ->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '4,44 CHF')
	+ ->assertSeeIn('table tbody tr:nth-child(2) td:first-child', 'Storage Quota 2 GB')
	+ ->assertSeeIn('table tbody tr:nth-child(2) td:last-child', '0,00 CHF')
	+ ->assertSeeIn('table tbody tr:nth-child(3) td:first-child', 'Groupware Features')
	+ ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '5,55 CHF')
	+ ->assertMissing('table tfoot')
	+ ->assertMissing('#reset2fa');
	+ });
	+
	+ // Assert Domains tab
	+ $browser->assertSeeIn('@nav #tab-domains', 'Domains (0)')
	+ ->click('@nav #tab-domains')
	+ ->with('@user-domains', function (Browser $browser) {
	+ $browser->assertElementsCount('table tbody tr', 0)
	+ ->assertSeeIn('table tfoot tr td', 'There are no domains in this account.');
	+ });
	+
	+ // Assert Users tab
	+ $browser->assertSeeIn('@nav #tab-users', 'Users (0)')
	+ ->click('@nav #tab-users')
	+ ->with('@user-users', function (Browser $browser) {
	+ $browser->assertElementsCount('table tbody tr', 0)
	+ ->assertSeeIn('table tfoot tr td', 'There are no users in this account.');
	+ });
	+
	+ // Assert Distribution lists tab
	+ $browser->assertSeeIn('@nav #tab-distlists', 'Distribution lists (0)')
	+ ->click('@nav #tab-distlists')
	+ ->with('@user-distlists', function (Browser $browser) {
	+ $browser->assertElementsCount('table tbody tr', 0)
	+ ->assertSeeIn('table tfoot tr td', 'There are no distribution lists in this account.');
	+ });
	+ });
	+ }
	+
	+ /**
	+ * Test user info page (continue)
	+ *
	+ * @depends testUserInfo
	+ */
	+ public function testUserInfo2(): void
	+ {
	+ $this->browse(function (Browser $browser) {
	+ $john = $this->getTestUser('john@kolab.org');
	+ $page = new UserPage($john->id);
	+ $discount = Discount::where('code', 'TEST')->first();
	+ $wallet = $john->wallet();
	+ $wallet->discount()->associate($discount);
	+ $wallet->debit(2010);
	+ $wallet->save();
	+ $group = $this->getTestGroup('group-test@kolab.org');
	+ $group->assignToWallet($john->wallets->first());
	+
	+ // Click the managed-by link on Jack's page
	+ $browser->click('@user-info #manager a')
	+ ->on($page);
	+
	+ // Assert main info box content
	+ $browser->assertSeeIn('@user-info .card-title', $john->email)
	+ ->with('@user-info form', function (Browser $browser) use ($john) {
	+ $ext_email = $john->getSetting('external_email');
	+
	+ $browser->assertElementsCount('.row', 9)
	+ ->assertSeeIn('.row:nth-child(1) label', 'ID (Created at)')
	+ ->assertSeeIn('.row:nth-child(1) #userid', "{$john->id} ({$john->created_at})")
	+ ->assertSeeIn('.row:nth-child(2) label', 'Status')
	+ ->assertSeeIn('.row:nth-child(2) #status span.text-success', 'Active')
	+ ->assertSeeIn('.row:nth-child(3) label', 'First name')
	+ ->assertSeeIn('.row:nth-child(3) #first_name', 'John')
	+ ->assertSeeIn('.row:nth-child(4) label', 'Last name')
	+ ->assertSeeIn('.row:nth-child(4) #last_name', 'Doe')
	+ ->assertSeeIn('.row:nth-child(5) label', 'Organization')
	+ ->assertSeeIn('.row:nth-child(5) #organization', 'Kolab Developers')
	+ ->assertSeeIn('.row:nth-child(6) label', 'Phone')
	+ ->assertSeeIn('.row:nth-child(6) #phone', $john->getSetting('phone'))
	+ ->assertSeeIn('.row:nth-child(7) label', 'External email')
	+ ->assertSeeIn('.row:nth-child(7) #external_email a', $ext_email)
	+ ->assertAttribute('.row:nth-child(7) #external_email a', 'href', "mailto:$ext_email")
	+ ->assertSeeIn('.row:nth-child(8) label', 'Address')
	+ ->assertSeeIn('.row:nth-child(8) #billing_address', $john->getSetting('billing_address'))
	+ ->assertSeeIn('.row:nth-child(9) label', 'Country')
	+ ->assertSeeIn('.row:nth-child(9) #country', 'United States');
	+ });
	+
	+ // Some tabs are loaded in background, wait a second
	+ $browser->pause(500)
	+ ->assertElementsCount('@nav a', 6);
	+
	+ // Note: Finances tab is tested in UserFinancesTest.php
	+ $browser->assertSeeIn('@nav #tab-finances', 'Finances');
	+
	+ // Assert Aliases tab
	+ $browser->assertSeeIn('@nav #tab-aliases', 'Aliases (1)')
	+ ->click('@nav #tab-aliases')
	+ ->whenAvailable('@user-aliases', function (Browser $browser) {
	+ $browser->assertElementsCount('table tbody tr', 1)
	+ ->assertSeeIn('table tbody tr:first-child td:first-child', 'john.doe@kolab.org')
	+ ->assertMissing('table tfoot');
	+ });
	+
	+ // Assert Subscriptions tab
	+ $browser->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (3)')
	+ ->click('@nav #tab-subscriptions')
	+ ->with('@user-subscriptions', function (Browser $browser) {
	+ $browser->assertElementsCount('table tbody tr', 3)
	+ ->assertSeeIn('table tbody tr:nth-child(1) td:first-child', 'User Mailbox')
	+ ->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '3,99 CHF/month¹')
	+ ->assertSeeIn('table tbody tr:nth-child(2) td:first-child', 'Storage Quota 2 GB')
	+ ->assertSeeIn('table tbody tr:nth-child(2) td:last-child', '0,00 CHF/month¹')
	+ ->assertSeeIn('table tbody tr:nth-child(3) td:first-child', 'Groupware Features')
	+ ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '4,99 CHF/month¹')
	+ ->assertMissing('table tfoot')
	+ ->assertSeeIn('table + .hint', '¹ applied discount: 10% - Test voucher');
	+ });
	+
	+ // Assert Domains tab
	+ $browser->assertSeeIn('@nav #tab-domains', 'Domains (1)')
	+ ->click('@nav #tab-domains')
	+ ->with('@user-domains table', function (Browser $browser) {
	+ $browser->assertElementsCount('tbody tr', 1)
	+ ->assertSeeIn('tbody tr:nth-child(1) td:first-child a', 'kolab.org')
	+ ->assertVisible('tbody tr:nth-child(1) td:first-child svg.text-success')
	+ ->assertMissing('tfoot');
	+ });
	+
	+ // Assert Distribution lists tab
	+ $browser->assertSeeIn('@nav #tab-distlists', 'Distribution lists (1)')
	+ ->click('@nav #tab-distlists')
	+ ->with('@user-distlists table', function (Browser $browser) {
	+ $browser->assertElementsCount('tbody tr', 1)
	+ ->assertSeeIn('tbody tr:nth-child(1) td:first-child a', 'group-test@kolab.org')
	+ ->assertVisible('tbody tr:nth-child(1) td:first-child svg.text-danger')
	+ ->assertMissing('tfoot');
	+ });
	+
	+ // Assert Users tab
	+ $browser->assertSeeIn('@nav #tab-users', 'Users (4)')
	+ ->click('@nav #tab-users')
	+ ->with('@user-users table', function (Browser $browser) {
	+ $browser->assertElementsCount('tbody tr', 4)
	+ ->assertSeeIn('tbody tr:nth-child(1) td:first-child a', 'jack@kolab.org')
	+ ->assertVisible('tbody tr:nth-child(1) td:first-child svg.text-success')
	+ ->assertSeeIn('tbody tr:nth-child(2) td:first-child a', 'joe@kolab.org')
	+ ->assertVisible('tbody tr:nth-child(2) td:first-child svg.text-success')
	+ ->assertSeeIn('tbody tr:nth-child(3) td:first-child span', 'john@kolab.org')
	+ ->assertVisible('tbody tr:nth-child(3) td:first-child svg.text-success')
	+ ->assertSeeIn('tbody tr:nth-child(4) td:first-child a', 'ned@kolab.org')
	+ ->assertVisible('tbody tr:nth-child(4) td:first-child svg.text-success')
	+ ->assertMissing('tfoot');
	+ });
	+ });
	+
	+ // Now we go to Ned's info page, he's a controller on John's wallet
	+ $this->browse(function (Browser $browser) {
	+ $ned = $this->getTestUser('ned@kolab.org');
	+ $page = new UserPage($ned->id);
	+
	+ $browser->click('@user-users tbody tr:nth-child(4) td:first-child a')
	+ ->on($page);
	+
	+ // Assert main info box content
	+ $browser->assertSeeIn('@user-info .card-title', $ned->email)
	+ ->with('@user-info form', function (Browser $browser) use ($ned) {
	+ $browser->assertSeeIn('.row:nth-child(2) label', 'ID (Created at)')
	+ ->assertSeeIn('.row:nth-child(2) #userid', "{$ned->id} ({$ned->created_at})");
	+ });
	+
	+ // Some tabs are loaded in background, wait a second
	+ $browser->pause(500)
	+ ->assertElementsCount('@nav a', 6);
	+
	+ // Note: Finances tab is tested in UserFinancesTest.php
	+ $browser->assertSeeIn('@nav #tab-finances', 'Finances');
	+
	+ // Assert Aliases tab
	+ $browser->assertSeeIn('@nav #tab-aliases', 'Aliases (0)')
	+ ->click('@nav #tab-aliases')
	+ ->whenAvailable('@user-aliases', function (Browser $browser) {
	+ $browser->assertElementsCount('table tbody tr', 0)
	+ ->assertSeeIn('table tfoot tr td', 'This user has no email aliases.');
	+ });
	+
	+ // Assert Subscriptions tab, we expect John's discount here
	+ $browser->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (5)')
	+ ->click('@nav #tab-subscriptions')
	+ ->with('@user-subscriptions', function (Browser $browser) {
	+ $browser->assertElementsCount('table tbody tr', 5)
	+ ->assertSeeIn('table tbody tr:nth-child(1) td:first-child', 'User Mailbox')
	+ ->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '3,99 CHF/month¹')
	+ ->assertSeeIn('table tbody tr:nth-child(2) td:first-child', 'Storage Quota 2 GB')
	+ ->assertSeeIn('table tbody tr:nth-child(2) td:last-child', '0,00 CHF/month¹')
	+ ->assertSeeIn('table tbody tr:nth-child(3) td:first-child', 'Groupware Features')
	+ ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '4,99 CHF/month¹')
	+ ->assertSeeIn('table tbody tr:nth-child(4) td:first-child', 'Activesync')
	+ ->assertSeeIn('table tbody tr:nth-child(4) td:last-child', '0,90 CHF/month¹')
	+ ->assertSeeIn('table tbody tr:nth-child(5) td:first-child', '2-Factor Authentication')
	+ ->assertSeeIn('table tbody tr:nth-child(5) td:last-child', '0,00 CHF/month¹')
	+ ->assertMissing('table tfoot')
	+ ->assertSeeIn('table + .hint', '¹ applied discount: 10% - Test voucher')
	+ ->assertSeeIn('#reset2fa', 'Reset 2-Factor Auth');
	+ });
	+
	+ // We don't expect John's domains here
	+ $browser->assertSeeIn('@nav #tab-domains', 'Domains (0)')
	+ ->click('@nav #tab-domains')
	+ ->with('@user-domains', function (Browser $browser) {
	+ $browser->assertElementsCount('table tbody tr', 0)
	+ ->assertSeeIn('table tfoot tr td', 'There are no domains in this account.');
	+ });
	+
	+ // We don't expect John's users here
	+ $browser->assertSeeIn('@nav #tab-users', 'Users (0)')
	+ ->click('@nav #tab-users')
	+ ->with('@user-users', function (Browser $browser) {
	+ $browser->assertElementsCount('table tbody tr', 0)
	+ ->assertSeeIn('table tfoot tr td', 'There are no users in this account.');
	+ });
	+
	+ // We don't expect John's distribution lists here
	+ $browser->assertSeeIn('@nav #tab-distlists', 'Distribution lists (0)')
	+ ->click('@nav #tab-distlists')
	+ ->with('@user-distlists', function (Browser $browser) {
	+ $browser->assertElementsCount('table tbody tr', 0)
	+ ->assertSeeIn('table tfoot tr td', 'There are no distribution lists in this account.');
	+ });
	+ });
	+ }
	+
	+ /**
	+ * Test editing an external email
	+ *
	+ * @depends testUserInfo2
	+ */
	+ public function testExternalEmail(): void
	+ {
	+ $this->browse(function (Browser $browser) {
	+ $john = $this->getTestUser('john@kolab.org');
	+
	+ $browser->visit(new UserPage($john->id))
	+ ->waitFor('@user-info #external_email button')
	+ ->click('@user-info #external_email button')
	+ // Test dialog content, and closing it with Cancel button
	+ ->with(new Dialog('#email-dialog'), function (Browser $browser) {
	+ $browser->assertSeeIn('@title', 'External email')
	+ ->assertFocused('@body input')
	+ ->assertValue('@body input', 'john.doe.external@gmail.com')
	+ ->assertSeeIn('@button-cancel', 'Cancel')
	+ ->assertSeeIn('@button-action', 'Submit')
	+ ->click('@button-cancel');
	+ })
	+ ->assertMissing('#email-dialog')
	+ ->click('@user-info #external_email button')
	+ // Test email validation error handling, and email update
	+ ->with(new Dialog('#email-dialog'), function (Browser $browser) {
	+ $browser->type('@body input', 'test')
	+ ->click('@button-action')
	+ ->waitFor('@body input.is-invalid')
	+ ->assertSeeIn(
	+ '@body input + .invalid-feedback',
	+ 'The external email must be a valid email address.'
	+ )
	+ ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
	+ ->type('@body input', 'test@test.com')
	+ ->click('@button-action');
	+ })
	+ ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.')
	+ ->assertSeeIn('@user-info #external_email a', 'test@test.com')
	+ ->click('@user-info #external_email button')
	+ ->with(new Dialog('#email-dialog'), function (Browser $browser) {
	+ $browser->assertValue('@body input', 'test@test.com')
	+ ->assertMissing('@body input.is-invalid')
	+ ->assertMissing('@body input + .invalid-feedback')
	+ ->click('@button-cancel');
	+ })
	+ ->assertSeeIn('@user-info #external_email a', 'test@test.com');
	+
	+ // $john->getSetting() may not work here as it uses internal cache
	+ // read the value form database
	+ $current_ext_email = $john->settings()->where('key', 'external_email')->first()->value;
	+ $this->assertSame('test@test.com', $current_ext_email);
	+ });
	+ }
	+
	+ /**
	+ * Test suspending/unsuspending the user
	+ */
	+ public function testSuspendAndUnsuspend(): void
	+ {
	+ $this->browse(function (Browser $browser) {
	+ $john = $this->getTestUser('john@kolab.org');
	+
	+ $browser->visit(new UserPage($john->id))
	+ ->assertVisible('@user-info #button-suspend')
	+ ->assertMissing('@user-info #button-unsuspend')
	+ ->click('@user-info #button-suspend')
	+ ->assertToast(Toast::TYPE_SUCCESS, 'User suspended successfully.')
	+ ->assertSeeIn('@user-info #status span.text-warning', 'Suspended')
	+ ->assertMissing('@user-info #button-suspend')
	+ ->click('@user-info #button-unsuspend')
	+ ->assertToast(Toast::TYPE_SUCCESS, 'User unsuspended successfully.')
	+ ->assertSeeIn('@user-info #status span.text-success', 'Active')
	+ ->assertVisible('@user-info #button-suspend')
	+ ->assertMissing('@user-info #button-unsuspend');
	+ });
	+ }
	+
	+ /**
	+ * Test resetting 2FA for the user
	+ */
	+ public function testReset2FA(): void
	+ {
	+ $this->browse(function (Browser $browser) {
	+ $this->deleteTestUser('userstest1@kolabnow.com');
	+ $user = $this->getTestUser('userstest1@kolabnow.com');
	+ $sku2fa = Sku::firstOrCreate(['title' => '2fa']);
	+ $user->assignSku($sku2fa);
	+ SecondFactor::seed('userstest1@kolabnow.com');
	+
	+ $browser->visit(new UserPage($user->id))
	+ ->click('@nav #tab-subscriptions')
	+ ->with('@user-subscriptions', function (Browser $browser) use ($sku2fa) {
	+ $browser->waitFor('#reset2fa')
	+ ->assertVisible('#sku' . $sku2fa->id);
	+ })
	+ ->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (1)')
	+ ->click('#reset2fa')
	+ ->with(new Dialog('#reset-2fa-dialog'), function (Browser $browser) {
	+ $browser->assertSeeIn('@title', '2-Factor Authentication Reset')
	+ ->assertSeeIn('@button-cancel', 'Cancel')
	+ ->assertSeeIn('@button-action', 'Reset')
	+ ->click('@button-action');
	+ })
	+ ->assertToast(Toast::TYPE_SUCCESS, '2-Factor authentication reset successfully.')
	+ ->assertMissing('#sku' . $sku2fa->id)
	+ ->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (0)');
	+ });
	+ }
	+}
	diff --git a/src/tests/Browser/SignupTest.php b/src/tests/Browser/SignupTest.php
	--- a/src/tests/Browser/SignupTest.php
	+++ b/src/tests/Browser/SignupTest.php
	@@ -5,6 +5,7 @@
	use App\Discount;
	use App\Domain;
	use App\SignupCode;
	+use App\SignupInvitation;
	use App\User;
	use Tests\Browser;
	use Tests\Browser\Components\Menu;
	@@ -28,11 +29,15 @@
	$this->deleteTestDomain('user-domain-signup.com');
	}

	+ /**
	+ * {@inheritDoc}
	+ */
	public function tearDown(): void
	{
	$this->deleteTestUser('signuptestdusk@' . \config('app.domain'));
	$this->deleteTestUser('admin@user-domain-signup.com');
	$this->deleteTestDomain('user-domain-signup.com');
	+ SignupInvitation::truncate();

	parent::tearDown();
	}
	@@ -292,17 +297,22 @@

	// Here we expect 3 text inputs, Back and Continue buttons
	$browser->with('@step3', function ($step) {
	- $step->assertVisible('#signup_login');
	- $step->assertVisible('#signup_password');
	- $step->assertVisible('#signup_confirm');
	- $step->assertVisible('select#signup_domain');
	- $step->assertVisible('[type=button]');
	- $step->assertVisible('[type=submit]');
	- $step->assertFocused('#signup_login');
	- $step->assertValue('select#signup_domain', \config('app.domain'));
	- $step->assertValue('#signup_login', '');
	- $step->assertValue('#signup_password', '');
	- $step->assertValue('#signup_confirm', '');
	+ $step->assertSeeIn('.card-title', 'Sign Up - Step 3/3')
	+ ->assertMissing('#signup_last_name')
	+ ->assertMissing('#signup_first_name')
	+ ->assertVisible('#signup_login')
	+ ->assertVisible('#signup_password')
	+ ->assertVisible('#signup_confirm')
	+ ->assertVisible('select#signup_domain')
	+ ->assertElementsCount('select#signup_domain option', 13, false)
	+ ->assertVisible('[type=button]')
	+ ->assertVisible('[type=submit]')
	+ ->assertSeeIn('[type=submit]', 'Submit')
	+ ->assertFocused('#signup_login')
	+ ->assertValue('select#signup_domain', \config('app.domain'))
	+ ->assertValue('#signup_login', '')
	+ ->assertValue('#signup_password', '')
	+ ->assertValue('#signup_confirm', '');

	// TODO: Test domain selector
	});
	@@ -540,4 +550,83 @@
	$discount = Discount::where('code', 'TEST')->first();
	$this->assertSame($discount->id, $user->wallets()->first()->discount_id);
	}
	+
	+ /**
	+ * Test signup via invitation link
	+ */
	+ public function testSignupInvitation(): void
	+ {
	+ // Test non-existing invitation
	+ $this->browse(function (Browser $browser) {
	+ $browser->visit('/signup/invite/TEST')
	+ ->onWithoutAssert(new Signup())
	+ ->waitFor('#app > #error-page')
	+ ->assertErrorPage(404);
	+ });
	+
	+ $invitation = SignupInvitation::create(['email' => 'test@domain.org']);
	+
	+ $this->browse(function (Browser $browser) use ($invitation) {
	+ $browser->visit('/signup/invite/' . $invitation->id)
	+ ->onWithoutAssert(new Signup())
	+ ->waitUntilMissing('.app-loader')
	+ ->with('@step3', function ($step) {
	+ $step->assertMissing('.card-title')
	+ ->assertVisible('#signup_last_name')
	+ ->assertVisible('#signup_first_name')
	+ ->assertVisible('#signup_login')
	+ ->assertVisible('#signup_password')
	+ ->assertVisible('#signup_confirm')
	+ ->assertVisible('select#signup_domain')
	+ ->assertElementsCount('select#signup_domain option', 13, false)
	+ ->assertVisible('[type=submit]')
	+ ->assertMissing('[type=button]') // Back button
	+ ->assertSeeIn('[type=submit]', 'Sign Up')
	+ ->assertFocused('#signup_first_name')
	+ ->assertValue('select#signup_domain', \config('app.domain'))
	+ ->assertValue('#signup_first_name', '')
	+ ->assertValue('#signup_last_name', '')
	+ ->assertValue('#signup_login', '')
	+ ->assertValue('#signup_password', '')
	+ ->assertValue('#signup_confirm', '');
	+
	+ // Submit invalid data
	+ $step->type('#signup_login', '*')
	+ ->type('#signup_password', '12345678')
	+ ->type('#signup_confirm', '123456789')
	+ ->click('[type=submit]')
	+ ->waitFor('#signup_login.is-invalid')
	+ ->assertVisible('#signup_domain + .invalid-feedback')
	+ ->assertVisible('#signup_password.is-invalid')
	+ ->assertVisible('#signup_password + .invalid-feedback')
	+ ->assertFocused('#signup_login')
	+ ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
	+
	+ // Submit valid data
	+ $step->type('#signup_confirm', '12345678')
	+ ->type('#signup_login', 'signuptestdusk')
	+ ->type('#signup_first_name', 'First')
	+ ->type('#signup_last_name', 'Last')
	+ ->click('[type=submit]');
	+ })
	+ // At this point we should be auto-logged-in to dashboard
	+ ->waitUntilMissing('@step3')
	+ ->waitUntilMissing('.app-loader')
	+ ->on(new Dashboard())
	+ ->assertUser('signuptestdusk@' . \config('app.domain'))
	+ // Logout the user
	+ ->within(new Menu(), function ($browser) {
	+ $browser->clickMenuItem('logout');
	+ });
	+ });
	+
	+ $invitation->refresh();
	+ $user = User::where('email', 'signuptestdusk@' . \config('app.domain'))->first();
	+
	+ $this->assertTrue($invitation->isCompleted());
	+ $this->assertSame($user->id, $invitation->user_id);
	+ $this->assertSame('First', $user->getSetting('first_name'));
	+ $this->assertSame('Last', $user->getSetting('last_name'));
	+ $this->assertSame($invitation->email, $user->getSetting('external_email'));
	+ }
	}
	diff --git a/src/tests/Feature/Console/DiscountListTest.php b/src/tests/Feature/Console/DiscountsTest.php
	rename from src/tests/Feature/Console/DiscountListTest.php
	rename to src/tests/Feature/Console/DiscountsTest.php
	--- a/src/tests/Feature/Console/DiscountListTest.php
	+++ b/src/tests/Feature/Console/DiscountsTest.php
	@@ -4,11 +4,11 @@

	use Tests\TestCase;

	-class DiscountListTest extends TestCase
	+class DiscountsTest extends TestCase
	{
	public function testHandle(): void
	{
	- $this->artisan('discount:list')
	+ $this->artisan('discounts')
	->assertExitCode(0);

	$this->markTestIncomplete();
	diff --git a/src/tests/Feature/Controller/Admin/DomainsTest.php b/src/tests/Feature/Controller/Admin/DomainsTest.php
	--- a/src/tests/Feature/Controller/Admin/DomainsTest.php
	+++ b/src/tests/Feature/Controller/Admin/DomainsTest.php
	@@ -3,6 +3,8 @@
	namespace Tests\Feature\Controller\Admin;

	use App\Domain;
	+use App\Entitlement;
	+use App\Sku;
	use Illuminate\Support\Facades\Queue;
	use Tests\TestCase;

	@@ -29,6 +31,19 @@
	parent::tearDown();
	}

	+ /**
	+ * Test domains confirming (not implemented)
	+ */
	+ public function testConfirm(): void
	+ {
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $domain = $this->getTestDomain('kolab.org');
	+
	+ // This end-point does not exist for admins
	+ $response = $this->actingAs($admin)->get("api/v4/domains/{$domain->id}/confirm");
	+ $response->assertStatus(404);
	+ }
	+
	/**
	* Test domains searching (/api/v4/domains)
	*/
	@@ -91,6 +106,55 @@
	$this->assertCount(0, $json['list']);
	}

	+ /**
	+ * Test fetching domain info
	+ */
	+ public function testShow(): void
	+ {
	+ $sku_domain = Sku::where('title', 'domain-hosting')->first();
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $user = $this->getTestUser('test1@domainscontroller.com');
	+ $domain = $this->getTestDomain('domainscontroller.com', [
	+ 'status' => Domain::STATUS_NEW,
	+ 'type' => Domain::TYPE_EXTERNAL,
	+ ]);
	+
	+ Entitlement::create([
	+ 'wallet_id' => $user->wallets()->first()->id,
	+ 'sku_id' => $sku_domain->id,
	+ 'entitleable_id' => $domain->id,
	+ 'entitleable_type' => Domain::class
	+ ]);
	+
	+ // Only admins can access it
	+ $response = $this->actingAs($user)->get("api/v4/domains/{$domain->id}");
	+ $response->assertStatus(403);
	+
	+ $response = $this->actingAs($admin)->get("api/v4/domains/{$domain->id}");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertEquals($domain->id, $json['id']);
	+ $this->assertEquals($domain->namespace, $json['namespace']);
	+ $this->assertEquals($domain->status, $json['status']);
	+ $this->assertEquals($domain->type, $json['type']);
	+ // Note: Other properties are being tested in the user controller tests
	+ }
	+
	+ /**
	+ * Test fetching domain status (GET /api/v4/domains/<domain-id>/status)
	+ */
	+ public function testStatus(): void
	+ {
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $domain = $this->getTestDomain('kolab.org');
	+
	+ // This end-point does not exist for admins
	+ $response = $this->actingAs($admin)->get("/api/v4/domains/{$domain->id}/status");
	+ $response->assertStatus(404);
	+ }
	+
	/**
	* Test domain suspending (POST /api/v4/domains/<domain-id>/suspend)
	*/
	diff --git a/src/tests/Feature/Controller/Admin/GroupsTest.php b/src/tests/Feature/Controller/Admin/GroupsTest.php
	--- a/src/tests/Feature/Controller/Admin/GroupsTest.php
	+++ b/src/tests/Feature/Controller/Admin/GroupsTest.php
	@@ -93,6 +93,47 @@
	$this->assertCount(0, $json['list']);
	}

	+ /**
	+ * Test fetching group info
	+ */
	+ public function testShow(): void
	+ {
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $user = $this->getTestUser('test1@domainscontroller.com');
	+ $group = $this->getTestGroup('group-test@kolab.org');
	+ $group->assignToWallet($user->wallets->first());
	+
	+ // Only admins can access it
	+ $response = $this->actingAs($user)->get("api/v4/groups/{$group->id}");
	+ $response->assertStatus(403);
	+
	+ $response = $this->actingAs($admin)->get("api/v4/groups/{$group->id}");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertEquals($group->id, $json['id']);
	+ $this->assertEquals($group->email, $json['email']);
	+ $this->assertEquals($group->status, $json['status']);
	+ }
	+
	+ /**
	+ * Test fetching domain status (GET /api/v4/domains/<domain-id>/status)
	+ */
	+ public function testStatus(): void
	+ {
	+ Queue::fake(); // disable jobs
	+
	+ $user = $this->getTestUser('john@kolab.org');
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $group = $this->getTestGroup('group-test@kolab.org');
	+ $group->assignToWallet($user->wallets->first());
	+
	+ // This end-point does not exist for admins
	+ $response = $this->actingAs($admin)->get("/api/v4/groups/{$group->id}/status");
	+ $response->assertStatus(404);
	+ }
	+
	/**
	* Test group creating (POST /api/v4/groups)
	*/
	diff --git a/src/tests/Feature/Controller/Admin/SkusTest.php b/src/tests/Feature/Controller/Admin/SkusTest.php
	new file mode 100644
	--- /dev/null
	+++ b/src/tests/Feature/Controller/Admin/SkusTest.php
	@@ -0,0 +1,94 @@
	+<?php
	+
	+namespace Tests\Feature\Controller\Admin;
	+
	+use App\Sku;
	+use Tests\TestCase;
	+
	+class SkusTest extends TestCase
	+{
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function setUp(): void
	+ {
	+ parent::setUp();
	+ self::useAdminUrl();
	+
	+ $this->clearBetaEntitlements();
	+ $this->clearMeetEntitlements();
	+ }
	+
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function tearDown(): void
	+ {
	+ $this->clearBetaEntitlements();
	+ $this->clearMeetEntitlements();
	+
	+ parent::tearDown();
	+ }
	+
	+ /**
	+ * Test fetching SKUs list
	+ */
	+ public function testIndex(): void
	+ {
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $user = $this->getTestUser('john@kolab.org');
	+ $sku = Sku::where('title', 'mailbox')->first();
	+
	+ // Unauth access not allowed
	+ $response = $this->get("api/v4/skus");
	+ $response->assertStatus(401);
	+
	+ // User access not allowed on admin API
	+ $response = $this->actingAs($user)->get("api/v4/skus");
	+ $response->assertStatus(403);
	+
	+ $response = $this->actingAs($admin)->get("api/v4/skus");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertCount(9, $json);
	+
	+ $this->assertSame(100, $json[0]['prio']);
	+ $this->assertSame($sku->id, $json[0]['id']);
	+ $this->assertSame($sku->title, $json[0]['title']);
	+ $this->assertSame($sku->name, $json[0]['name']);
	+ $this->assertSame($sku->description, $json[0]['description']);
	+ $this->assertSame($sku->cost, $json[0]['cost']);
	+ $this->assertSame($sku->units_free, $json[0]['units_free']);
	+ $this->assertSame($sku->period, $json[0]['period']);
	+ $this->assertSame($sku->active, $json[0]['active']);
	+ $this->assertSame('user', $json[0]['type']);
	+ $this->assertSame('mailbox', $json[0]['handler']);
	+ }
	+
	+ /**
	+ * Test fetching SKUs list for a user (GET /users/<id>/skus)
	+ */
	+ public function testUserSkus(): void
	+ {
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $user = $this->getTestUser('john@kolab.org');
	+
	+ // Unauth access not allowed
	+ $response = $this->get("api/v4/users/{$user->id}/skus");
	+ $response->assertStatus(401);
	+
	+ // Non-admin access not allowed
	+ $response = $this->actingAs($user)->get("api/v4/users/{$user->id}/skus");
	+ $response->assertStatus(403);
	+
	+ $response = $this->actingAs($admin)->get("api/v4/users/{$user->id}/skus");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertCount(8, $json);
	+ // Note: Details are tested where we test API\V4\SkusController
	+ }
	+}
	diff --git a/src/tests/Feature/Controller/Admin/UsersTest.php b/src/tests/Feature/Controller/Admin/UsersTest.php
	--- a/src/tests/Feature/Controller/Admin/UsersTest.php
	+++ b/src/tests/Feature/Controller/Admin/UsersTest.php
	@@ -41,6 +41,24 @@
	parent::tearDown();
	}

	+ /**
	+ * Test user deleting (DELETE /api/v4/users/<id>)
	+ */
	+ public function testDestroy(): void
	+ {
	+ $john = $this->getTestUser('john@kolab.org');
	+ $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+
	+ // Test unauth access
	+ $response = $this->delete("api/v4/users/{$user->id}");
	+ $response->assertStatus(401);
	+
	+ // The end-point does not exist
	+ $response = $this->actingAs($admin)->delete("api/v4/users/{$user->id}");
	+ $response->assertStatus(404);
	+ }
	+
	/**
	* Test users searching (/api/v4/users)
	*/
	@@ -247,6 +265,18 @@
	$this->assertCount(0, $sf->factors());
	}

	+ /**
	+ * Test user creation (POST /api/v4/users)
	+ */
	+ public function testStore(): void
	+ {
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+
	+ // The end-point does not exist
	+ $response = $this->actingAs($admin)->post("/api/v4/users", []);
	+ $response->assertStatus(404);
	+ }
	+
	/**
	* Test user suspending (POST /api/v4/users/<user-id>/suspend)
	*/
	diff --git a/src/tests/Feature/Controller/Reseller/DiscountsTest.php b/src/tests/Feature/Controller/Reseller/DiscountsTest.php
	new file mode 100644
	--- /dev/null
	+++ b/src/tests/Feature/Controller/Reseller/DiscountsTest.php
	@@ -0,0 +1,107 @@
	+<?php
	+
	+namespace Tests\Feature\Controller\Reseller;
	+
	+use App\Discount;
	+use App\Tenant;
	+use Tests\TestCase;
	+
	+class DiscountsTest extends TestCase
	+{
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function setUp(): void
	+ {
	+ parent::setUp();
	+
	+ $tenant = Tenant::where('title', 'Sample Tenant')->first();
	+ $tenant->discounts()->delete();
	+
	+ self::useResellerUrl();
	+ }
	+
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function tearDown(): void
	+ {
	+ \config(['app.tenant_id' => 1]);
	+
	+ $tenant = Tenant::where('title', 'Sample Tenant')->first();
	+ $tenant->discounts()->delete();
	+
	+ parent::tearDown();
	+ }
	+
	+ /**
	+ * Test listing discounts (/api/v4/discounts)
	+ */
	+ public function testIndex(): void
	+ {
	+ $user = $this->getTestUser('john@kolab.org');
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $reseller = $this->getTestUser('reseller@reseller.com');
	+ $reseller2 = $this->getTestUser('reseller@kolabnow.com');
	+ $tenant = Tenant::where('title', 'Sample Tenant')->first();
	+
	+ \config(['app.tenant_id' => $tenant->id]);
	+
	+ // Non-admin user
	+ $response = $this->actingAs($user)->get("api/v4/discounts");
	+ $response->assertStatus(403);
	+
	+ // Admin user
	+ $response = $this->actingAs($admin)->get("api/v4/discounts");
	+ $response->assertStatus(403);
	+
	+ // Reseller user, but different tenant
	+ $response = $this->actingAs($reseller2)->get("api/v4/discounts");
	+ $response->assertStatus(403);
	+
	+ // Reseller (empty list)
	+ $response = $this->actingAs($reseller)->get("api/v4/discounts");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame(0, $json['count']);
	+
	+ // Add some discounts
	+ $discount_test = Discount::create([
	+ 'description' => 'Test reseller voucher',
	+ 'code' => 'RESELLER-TEST',
	+ 'discount' => 10,
	+ 'active' => true,
	+ ]);
	+
	+ $discount_free = Discount::create([
	+ 'description' => 'Free account',
	+ 'discount' => 100,
	+ 'active' => true,
	+ ]);
	+
	+ $discount_test->tenant_id = $tenant->id;
	+ $discount_test->save();
	+ $discount_free->tenant_id = $tenant->id;
	+ $discount_free->save();
	+
	+ $response = $this->actingAs($reseller)->get("api/v4/discounts");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame(2, $json['count']);
	+ $this->assertSame($discount_test->id, $json['list'][0]['id']);
	+ $this->assertSame($discount_test->discount, $json['list'][0]['discount']);
	+ $this->assertSame($discount_test->code, $json['list'][0]['code']);
	+ $this->assertSame($discount_test->description, $json['list'][0]['description']);
	+ $this->assertSame('10% - Test reseller voucher [RESELLER-TEST]', $json['list'][0]['label']);
	+
	+ $this->assertSame($discount_free->id, $json['list'][1]['id']);
	+ $this->assertSame($discount_free->discount, $json['list'][1]['discount']);
	+ $this->assertSame($discount_free->code, $json['list'][1]['code']);
	+ $this->assertSame($discount_free->description, $json['list'][1]['description']);
	+ $this->assertSame('100% - Free account', $json['list'][1]['label']);
	+ }
	+}
	diff --git a/src/tests/Feature/Controller/Reseller/DomainsTest.php b/src/tests/Feature/Controller/Reseller/DomainsTest.php
	new file mode 100644
	--- /dev/null
	+++ b/src/tests/Feature/Controller/Reseller/DomainsTest.php
	@@ -0,0 +1,310 @@
	+<?php
	+
	+namespace Tests\Feature\Controller\Reseller;
	+
	+use App\Domain;
	+use App\Entitlement;
	+use App\Sku;
	+use App\Tenant;
	+use Illuminate\Support\Facades\Queue;
	+use Tests\TestCase;
	+
	+class DomainsTest extends TestCase
	+{
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function setUp(): void
	+ {
	+ parent::setUp();
	+ self::useResellerUrl();
	+ \config(['app.tenant_id' => 1]);
	+
	+ $this->deleteTestDomain('domainscontroller.com');
	+ }
	+
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function tearDown(): void
	+ {
	+ \config(['app.tenant_id' => 1]);
	+ $this->deleteTestDomain('domainscontroller.com');
	+
	+ parent::tearDown();
	+ }
	+
	+ /**
	+ * Test domain confirm request
	+ */
	+ public function testConfirm(): void
	+ {
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $domain = $this->getTestDomain('domainscontroller.com', [
	+ 'status' => Domain::STATUS_NEW,
	+ 'type' => Domain::TYPE_EXTERNAL,
	+ ]);
	+
	+ // THe end-point exists on the users controller, but not reseller's
	+ $response = $this->actingAs($reseller1)->get("api/v4/domains/{$domain->id}/confirm");
	+ $response->assertStatus(404);
	+ }
	+
	+ /**
	+ * Test domains searching (/api/v4/domains)
	+ */
	+ public function testIndex(): void
	+ {
	+ $user = $this->getTestUser('john@kolab.org');
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller2 = $this->getTestUser('reseller@reseller.com');
	+
	+ // Non-admin user
	+ $response = $this->actingAs($user)->get("api/v4/domains");
	+ $response->assertStatus(403);
	+
	+ // Admin user
	+ $response = $this->actingAs($admin)->get("api/v4/domains");
	+ $response->assertStatus(403);
	+
	+ // Reseller from a different tenant
	+ $response = $this->actingAs($reseller2)->get("api/v4/domains");
	+ $response->assertStatus(403);
	+
	+ // Search with no matches expected
	+ $response = $this->actingAs($reseller1)->get("api/v4/domains?search=abcd12.org");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame(0, $json['count']);
	+ $this->assertSame([], $json['list']);
	+
	+ // Search by a domain name
	+ $response = $this->actingAs($reseller1)->get("api/v4/domains?search=kolab.org");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame(1, $json['count']);
	+ $this->assertCount(1, $json['list']);
	+ $this->assertSame('kolab.org', $json['list'][0]['namespace']);
	+
	+ // Search by owner
	+
	+ $response = $this->actingAs($reseller1)->get("api/v4/domains?owner={$user->id}");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame(1, $json['count']);
	+ $this->assertCount(1, $json['list']);
	+ $this->assertSame('kolab.org', $json['list'][0]['namespace']);
	+
	+ // Search by owner (Ned is a controller on John's wallets,
	+ // here we expect only domains assigned to Ned's wallet(s))
	+ $ned = $this->getTestUser('ned@kolab.org');
	+
	+ $response = $this->actingAs($reseller1)->get("api/v4/domains?owner={$ned->id}");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame(0, $json['count']);
	+ $this->assertCount(0, $json['list']);
	+
	+ // Test unauth access to other tenant's domains
	+ \config(['app.tenant_id' => 2]);
	+
	+ $response = $this->actingAs($reseller2)->get("api/v4/domains?search=kolab.org");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame(0, $json['count']);
	+ $this->assertSame([], $json['list']);
	+
	+ $response = $this->actingAs($reseller2)->get("api/v4/domains?owner={$user->id}");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame(0, $json['count']);
	+ $this->assertSame([], $json['list']);
	+ }
	+
	+ /**
	+ * Test fetching domain info
	+ */
	+ public function testShow(): void
	+ {
	+ $sku_domain = Sku::where('title', 'domain-hosting')->first();
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $user = $this->getTestUser('test1@domainscontroller.com');
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $domain = $this->getTestDomain('domainscontroller.com', [
	+ 'status' => Domain::STATUS_NEW,
	+ 'type' => Domain::TYPE_EXTERNAL,
	+ ]);
	+
	+ Entitlement::create([
	+ 'wallet_id' => $user->wallets()->first()->id,
	+ 'sku_id' => $sku_domain->id,
	+ 'entitleable_id' => $domain->id,
	+ 'entitleable_type' => Domain::class
	+ ]);
	+
	+ // Unauthorized access (user)
	+ $response = $this->actingAs($user)->get("api/v4/domains/{$domain->id}");
	+ $response->assertStatus(403);
	+
	+ // Unauthorized access (admin)
	+ $response = $this->actingAs($admin)->get("api/v4/domains/{$domain->id}");
	+ $response->assertStatus(403);
	+
	+ // Unauthorized access (tenant != env-tenant)
	+ $response = $this->actingAs($reseller2)->get("api/v4/domains/{$domain->id}");
	+ $response->assertStatus(403);
	+
	+ $response = $this->actingAs($reseller1)->get("api/v4/domains/{$domain->id}");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertEquals($domain->id, $json['id']);
	+ $this->assertEquals($domain->namespace, $json['namespace']);
	+ $this->assertEquals($domain->status, $json['status']);
	+ $this->assertEquals($domain->type, $json['type']);
	+ // Note: Other properties are being tested in the user controller tests
	+
	+ // Unauthorized access (other domain's tenant)
	+ \config(['app.tenant_id' => 2]);
	+ $response = $this->actingAs($reseller2)->get("api/v4/domains/{$domain->id}");
	+ $response->assertStatus(404);
	+ }
	+
	+ /**
	+ * Test fetching domain status (GET /api/v4/domains/<domain-id>/status)
	+ */
	+ public function testStatus(): void
	+ {
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $domain = $this->getTestDomain('kolab.org');
	+
	+ // This end-point does not exist for resellers
	+ $response = $this->actingAs($reseller1)->get("/api/v4/domains/{$domain->id}/status");
	+ $response->assertStatus(404);
	+ }
	+
	+ /**
	+ * Test domain suspending (POST /api/v4/domains/<domain-id>/suspend)
	+ */
	+ public function testSuspend(): void
	+ {
	+ Queue::fake(); // disable jobs
	+
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller2 = $this->getTestUser('reseller@reseller.com');
	+
	+ \config(['app.tenant_id' => 2]);
	+
	+ $domain = $this->getTestDomain('domainscontroller.com', [
	+ 'status' => Domain::STATUS_NEW,
	+ 'type' => Domain::TYPE_EXTERNAL,
	+ ]);
	+ $user = $this->getTestUser('test@domainscontroller.com');
	+
	+ // Test unauthorized access to the reseller API (user)
	+ $response = $this->actingAs($user)->post("/api/v4/domains/{$domain->id}/suspend", []);
	+ $response->assertStatus(403);
	+
	+ $this->assertFalse($domain->fresh()->isSuspended());
	+
	+ // Test unauthorized access to the reseller API (admin)
	+ $response = $this->actingAs($admin)->post("/api/v4/domains/{$domain->id}/suspend", []);
	+ $response->assertStatus(403);
	+
	+ $this->assertFalse($domain->fresh()->isSuspended());
	+
	+ // Test unauthorized access to the reseller API (reseller in another tenant)
	+ $response = $this->actingAs($reseller1)->post("/api/v4/domains/{$domain->id}/suspend", []);
	+ $response->assertStatus(403);
	+
	+ $this->assertFalse($domain->fresh()->isSuspended());
	+
	+ // Test suspending the domain
	+ $response = $this->actingAs($reseller2)->post("/api/v4/domains/{$domain->id}/suspend", []);
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame('success', $json['status']);
	+ $this->assertSame("Domain suspended successfully.", $json['message']);
	+ $this->assertCount(2, $json);
	+
	+ $this->assertTrue($domain->fresh()->isSuspended());
	+
	+ // Test authenticated reseller, but domain belongs to another tenant
	+ \config(['app.tenant_id' => 1]);
	+ $response = $this->actingAs($reseller1)->post("/api/v4/domains/{$domain->id}/suspend", []);
	+ $response->assertStatus(404);
	+ }
	+
	+ /**
	+ * Test user un-suspending (POST /api/v4/users/<user-id>/unsuspend)
	+ */
	+ public function testUnsuspend(): void
	+ {
	+ Queue::fake(); // disable jobs
	+
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller2 = $this->getTestUser('reseller@reseller.com');
	+
	+ \config(['app.tenant_id' => 2]);
	+
	+ $domain = $this->getTestDomain('domainscontroller.com', [
	+ 'status' => Domain::STATUS_NEW \| Domain::STATUS_SUSPENDED,
	+ 'type' => Domain::TYPE_EXTERNAL,
	+ ]);
	+ $user = $this->getTestUser('test@domainscontroller.com');
	+
	+ // Test unauthorized access to reseller API (user)
	+ $response = $this->actingAs($user)->post("/api/v4/domains/{$domain->id}/unsuspend", []);
	+ $response->assertStatus(403);
	+
	+ $this->assertTrue($domain->fresh()->isSuspended());
	+
	+ // Test unauthorized access to reseller API (admin)
	+ $response = $this->actingAs($admin)->post("/api/v4/domains/{$domain->id}/unsuspend", []);
	+ $response->assertStatus(403);
	+
	+ $this->assertTrue($domain->fresh()->isSuspended());
	+
	+ // Test unauthorized access to reseller API (another tenant)
	+ $response = $this->actingAs($reseller1)->post("/api/v4/domains/{$domain->id}/unsuspend", []);
	+ $response->assertStatus(403);
	+
	+ $this->assertTrue($domain->fresh()->isSuspended());
	+
	+ // Test suspending the user
	+ $response = $this->actingAs($reseller2)->post("/api/v4/domains/{$domain->id}/unsuspend", []);
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame('success', $json['status']);
	+ $this->assertSame("Domain unsuspended successfully.", $json['message']);
	+ $this->assertCount(2, $json);
	+
	+ $this->assertFalse($domain->fresh()->isSuspended());
	+
	+ // Test unauthorized access to reseller API (another tenant)
	+ \config(['app.tenant_id' => 1]);
	+ $response = $this->actingAs($reseller1)->post("/api/v4/domains/{$domain->id}/unsuspend", []);
	+ $response->assertStatus(404);
	+ }
	+}
	diff --git a/src/tests/Feature/Controller/Admin/GroupsTest.php b/src/tests/Feature/Controller/Reseller/GroupsTest.php
	copy from src/tests/Feature/Controller/Admin/GroupsTest.php
	copy to src/tests/Feature/Controller/Reseller/GroupsTest.php
	--- a/src/tests/Feature/Controller/Admin/GroupsTest.php
	+++ b/src/tests/Feature/Controller/Reseller/GroupsTest.php
	@@ -1,6 +1,6 @@
	<?php

	-namespace Tests\Feature\Controller\Admin;
	+namespace Tests\Feature\Controller\Reseller;

	use App\Group;
	use Illuminate\Support\Facades\Queue;
	@@ -14,7 +14,7 @@
	public function setUp(): void
	{
	parent::setUp();
	- self::useAdminUrl();
	+ self::useResellerUrl();

	$this->deleteTestGroup('group-test@kolab.org');
	}
	@@ -36,6 +36,8 @@
	{
	$user = $this->getTestUser('john@kolab.org');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller2 = $this->getTestUser('reseller@reseller.com');
	$group = $this->getTestGroup('group-test@kolab.org');
	$group->assignToWallet($user->wallets->first());

	@@ -43,8 +45,16 @@
	$response = $this->actingAs($user)->get("api/v4/groups");
	$response->assertStatus(403);

	- // Search with no search criteria
	+ // Admin user
	$response = $this->actingAs($admin)->get("api/v4/groups");
	+ $response->assertStatus(403);
	+
	+ // Reseller from a different tenant
	+ $response = $this->actingAs($reseller2)->get("api/v4/groups");
	+ $response->assertStatus(403);
	+
	+ // Search with no search criteria
	+ $response = $this->actingAs($reseller1)->get("api/v4/groups");
	$response->assertStatus(200);

	$json = $response->json();
	@@ -53,7 +63,7 @@
	$this->assertSame([], $json['list']);

	// Search with no matches expected
	- $response = $this->actingAs($admin)->get("api/v4/groups?search=john@kolab.org");
	+ $response = $this->actingAs($reseller1)->get("api/v4/groups?search=john@kolab.org");
	$response->assertStatus(200);

	$json = $response->json();
	@@ -62,7 +72,7 @@
	$this->assertSame([], $json['list']);

	// Search by email
	- $response = $this->actingAs($admin)->get("api/v4/groups?search={$group->email}");
	+ $response = $this->actingAs($reseller1)->get("api/v4/groups?search={$group->email}");
	$response->assertStatus(200);

	$json = $response->json();
	@@ -72,7 +82,7 @@
	$this->assertSame($group->email, $json['list'][0]['email']);

	// Search by owner
	- $response = $this->actingAs($admin)->get("api/v4/groups?owner={$user->id}");
	+ $response = $this->actingAs($reseller1)->get("api/v4/groups?owner={$user->id}");
	$response->assertStatus(200);

	$json = $response->json();
	@@ -84,13 +94,82 @@
	// Search by owner (Ned is a controller on John's wallets,
	// here we expect only domains assigned to Ned's wallet(s))
	$ned = $this->getTestUser('ned@kolab.org');
	- $response = $this->actingAs($admin)->get("api/v4/groups?owner={$ned->id}");
	+ $response = $this->actingAs($reseller1)->get("api/v4/groups?owner={$ned->id}");
	$response->assertStatus(200);

	$json = $response->json();

	$this->assertSame(0, $json['count']);
	$this->assertCount(0, $json['list']);
	+
	+ // Test unauth access to other tenant's groups
	+ \config(['app.tenant_id' => 2]);
	+
	+ $response = $this->actingAs($reseller2)->get("api/v4/groups?search=kolab.org");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame(0, $json['count']);
	+ $this->assertSame([], $json['list']);
	+
	+ $response = $this->actingAs($reseller2)->get("api/v4/groups?owner={$user->id}");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame(0, $json['count']);
	+ $this->assertSame([], $json['list']);
	+ }
	+
	+ /**
	+ * Test fetching group info
	+ */
	+ public function testShow(): void
	+ {
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $user = $this->getTestUser('test1@domainscontroller.com');
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $group = $this->getTestGroup('group-test@kolab.org');
	+ $group->assignToWallet($user->wallets->first());
	+
	+ // Only resellers can access it
	+ $response = $this->actingAs($user)->get("api/v4/groups/{$group->id}");
	+ $response->assertStatus(403);
	+
	+ $response = $this->actingAs($admin)->get("api/v4/groups/{$group->id}");
	+ $response->assertStatus(403);
	+
	+ $response = $this->actingAs($reseller2)->get("api/v4/groups/{$group->id}");
	+ $response->assertStatus(403);
	+
	+ $response = $this->actingAs($reseller1)->get("api/v4/groups/{$group->id}");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertEquals($group->id, $json['id']);
	+ $this->assertEquals($group->email, $json['email']);
	+ $this->assertEquals($group->status, $json['status']);
	+ }
	+
	+ /**
	+ * Test fetching group status (GET /api/v4/domains/<domain-id>/status)
	+ */
	+ public function testStatus(): void
	+ {
	+ Queue::fake(); // disable jobs
	+
	+ $user = $this->getTestUser('john@kolab.org');
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $group = $this->getTestGroup('group-test@kolab.org');
	+ $group->assignToWallet($user->wallets->first());
	+
	+ // This end-point does not exist for admins
	+ $response = $this->actingAs($reseller1)->get("/api/v4/groups/{$group->id}/status");
	+ $response->assertStatus(404);
	}

	/**
	@@ -100,13 +179,17 @@
	{
	$user = $this->getTestUser('john@kolab.org');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');

	- // Test unauthorized access to admin API
	+ // Test unauthorized access to reseller API
	$response = $this->actingAs($user)->post("/api/v4/groups", []);
	$response->assertStatus(403);

	- // Admin can't create groups
	+ // Reseller or admin can't create groups
	$response = $this->actingAs($admin)->post("/api/v4/groups", []);
	+ $response->assertStatus(403);
	+
	+ $response = $this->actingAs($reseller1)->post("/api/v4/groups", []);
	$response->assertStatus(404);
	}

	@@ -119,21 +202,27 @@

	$user = $this->getTestUser('john@kolab.org');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller2 = $this->getTestUser('reseller@reseller.com');
	$group = $this->getTestGroup('group-test@kolab.org');
	$group->assignToWallet($user->wallets->first());

	- // Test unauthorized access to admin API
	+ // Test unauthorized access to reseller API
	$response = $this->actingAs($user)->post("/api/v4/groups/{$group->id}/suspend", []);
	$response->assertStatus(403);

	+ // Test unauthorized access to reseller API
	+ $response = $this->actingAs($admin)->post("/api/v4/groups/{$group->id}/suspend", []);
	+ $response->assertStatus(403);
	+
	// Test non-existing group ID
	- $response = $this->actingAs($admin)->post("/api/v4/groups/abc/suspend", []);
	+ $response = $this->actingAs($reseller1)->post("/api/v4/groups/abc/suspend", []);
	$response->assertStatus(404);

	$this->assertFalse($group->fresh()->isSuspended());

	// Test suspending the group
	- $response = $this->actingAs($admin)->post("/api/v4/groups/{$group->id}/suspend", []);
	+ $response = $this->actingAs($reseller1)->post("/api/v4/groups/{$group->id}/suspend", []);
	$response->assertStatus(200);

	$json = $response->json();
	@@ -143,6 +232,12 @@
	$this->assertCount(2, $json);

	$this->assertTrue($group->fresh()->isSuspended());
	+
	+ // Test unauth access to other tenant's groups
	+ \config(['app.tenant_id' => 2]);
	+
	+ $response = $this->actingAs($reseller2)->post("/api/v4/groups/{$group->id}/suspend", []);
	+ $response->assertStatus(404);
	}

	/**
	@@ -154,23 +249,29 @@

	$user = $this->getTestUser('john@kolab.org');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller2 = $this->getTestUser('reseller@reseller.com');
	$group = $this->getTestGroup('group-test@kolab.org');
	$group->assignToWallet($user->wallets->first());
	$group->status \|= Group::STATUS_SUSPENDED;
	$group->save();

	- // Test unauthorized access to admin API
	+ // Test unauthorized access to reseller API
	$response = $this->actingAs($user)->post("/api/v4/groups/{$group->id}/unsuspend", []);
	$response->assertStatus(403);

	+ // Test unauthorized access to reseller API
	+ $response = $this->actingAs($admin)->post("/api/v4/groups/{$group->id}/unsuspend", []);
	+ $response->assertStatus(403);
	+
	// Invalid group ID
	- $response = $this->actingAs($admin)->post("/api/v4/groups/abc/unsuspend", []);
	+ $response = $this->actingAs($reseller1)->post("/api/v4/groups/abc/unsuspend", []);
	$response->assertStatus(404);

	$this->assertTrue($group->fresh()->isSuspended());

	// Test suspending the group
	- $response = $this->actingAs($admin)->post("/api/v4/groups/{$group->id}/unsuspend", []);
	+ $response = $this->actingAs($reseller1)->post("/api/v4/groups/{$group->id}/unsuspend", []);
	$response->assertStatus(200);

	$json = $response->json();
	@@ -180,5 +281,11 @@
	$this->assertCount(2, $json);

	$this->assertFalse($group->fresh()->isSuspended());
	+
	+ // Test unauth access to other tenant's groups
	+ \config(['app.tenant_id' => 2]);
	+
	+ $response = $this->actingAs($reseller2)->post("/api/v4/groups/{$group->id}/unsuspend", []);
	+ $response->assertStatus(404);
	}
	}
	diff --git a/src/tests/Feature/Controller/Reseller/InvitationsTest.php b/src/tests/Feature/Controller/Reseller/InvitationsTest.php
	new file mode 100644
	--- /dev/null
	+++ b/src/tests/Feature/Controller/Reseller/InvitationsTest.php
	@@ -0,0 +1,350 @@
	+<?php
	+
	+namespace Tests\Feature\Controller\Reseller;
	+
	+use App\SignupInvitation;
	+use App\Tenant;
	+use Illuminate\Http\Testing\File;
	+use Illuminate\Support\Facades\Queue;
	+use Tests\TestCase;
	+
	+class InvitationsTest extends TestCase
	+{
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function setUp(): void
	+ {
	+ parent::setUp();
	+
	+ SignupInvitation::truncate();
	+
	+ \config(['app.tenant_id' => 1]);
	+
	+ self::useResellerUrl();
	+ }
	+
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function tearDown(): void
	+ {
	+ SignupInvitation::truncate();
	+
	+ \config(['app.tenant_id' => 1]);
	+
	+ parent::tearDown();
	+ }
	+
	+ /**
	+ * Test deleting invitations (DELETE /api/v4/invitations/<id>)
	+ */
	+ public function testDestroy(): void
	+ {
	+ Queue::fake();
	+
	+ $user = $this->getTestUser('john@kolab.org');
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $reseller = $this->getTestUser('reseller@reseller.com');
	+ $reseller2 = $this->getTestUser('reseller@kolabnow.com');
	+ $tenant = Tenant::where('title', 'Sample Tenant')->first();
	+
	+ \config(['app.tenant_id' => $tenant->id]);
	+
	+ $inv = SignupInvitation::create(['email' => 'email1@ext.com']);
	+
	+ // Non-admin user
	+ $response = $this->actingAs($user)->delete("api/v4/invitations/{$inv->id}");
	+ $response->assertStatus(403);
	+
	+ // Admin user
	+ $response = $this->actingAs($admin)->delete("api/v4/invitations/{$inv->id}");
	+ $response->assertStatus(403);
	+
	+ // Reseller user, but different tenant
	+ $response = $this->actingAs($reseller2)->delete("api/v4/invitations/{$inv->id}");
	+ $response->assertStatus(403);
	+
	+ // Reseller - non-existing invitation identifier
	+ $response = $this->actingAs($reseller)->delete("api/v4/invitations/abd");
	+ $response->assertStatus(404);
	+
	+ // Reseller - existing invitation
	+ $response = $this->actingAs($reseller)->delete("api/v4/invitations/{$inv->id}");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame('success', $json['status']);
	+ $this->assertSame("Invitation deleted successfully.", $json['message']);
	+ $this->assertSame(null, SignupInvitation::find($inv->id));
	+ }
	+
	+ /**
	+ * Test listing invitations (GET /api/v4/invitations)
	+ */
	+ public function testIndex(): void
	+ {
	+ Queue::fake();
	+
	+ $user = $this->getTestUser('john@kolab.org');
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $reseller = $this->getTestUser('reseller@reseller.com');
	+ $reseller2 = $this->getTestUser('reseller@kolabnow.com');
	+ $tenant = Tenant::where('title', 'Sample Tenant')->first();
	+
	+ \config(['app.tenant_id' => $tenant->id]);
	+
	+ // Non-admin user
	+ $response = $this->actingAs($user)->get("api/v4/invitations");
	+ $response->assertStatus(403);
	+
	+ // Admin user
	+ $response = $this->actingAs($admin)->get("api/v4/invitations");
	+ $response->assertStatus(403);
	+
	+ // Reseller user, but different tenant
	+ $response = $this->actingAs($reseller2)->get("api/v4/invitations");
	+ $response->assertStatus(403);
	+
	+ // Reseller (empty list)
	+ $response = $this->actingAs($reseller)->get("api/v4/invitations");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame(0, $json['count']);
	+ $this->assertSame([], $json['list']);
	+ $this->assertSame(1, $json['page']);
	+ $this->assertFalse($json['hasMore']);
	+
	+ // Add some invitations
	+ $i1 = SignupInvitation::create(['email' => 'email1@ext.com']);
	+ $i2 = SignupInvitation::create(['email' => 'email2@ext.com']);
	+ $i3 = SignupInvitation::create(['email' => 'email3@ext.com']);
	+ $i4 = SignupInvitation::create(['email' => 'email4@other.com']);
	+ $i5 = SignupInvitation::create(['email' => 'email5@other.com']);
	+ $i6 = SignupInvitation::create(['email' => 'email6@other.com']);
	+ $i7 = SignupInvitation::create(['email' => 'email7@other.com']);
	+ $i8 = SignupInvitation::create(['email' => 'email8@other.com']);
	+ $i9 = SignupInvitation::create(['email' => 'email9@other.com']);
	+ $i10 = SignupInvitation::create(['email' => 'email10@other.com']);
	+ $i11 = SignupInvitation::create(['email' => 'email11@other.com']);
	+ $i12 = SignupInvitation::create(['email' => 'email12@test.com']);
	+ $i13 = SignupInvitation::create(['email' => 'email13@ext.com']);
	+
	+ SignupInvitation::query()->update(['created_at' => now()->subDays('1')]);
	+ SignupInvitation::where('id', $i1->id)
	+ ->update(['created_at' => now()->subHours('2'), 'status' => SignupInvitation::STATUS_FAILED]);
	+ SignupInvitation::where('id', $i2->id)
	+ ->update(['created_at' => now()->subHours('3'), 'status' => SignupInvitation::STATUS_SENT]);
	+ SignupInvitation::where('id', $i11->id)->update(['created_at' => now()->subDays('3')]);
	+ SignupInvitation::where('id', $i12->id)->update(['tenant_id' => 1]);
	+ SignupInvitation::where('id', $i13->id)->update(['tenant_id' => 1]);
	+
	+ $response = $this->actingAs($reseller)->get("api/v4/invitations");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame(10, $json['count']);
	+ $this->assertSame(1, $json['page']);
	+ $this->assertTrue($json['hasMore']);
	+ $this->assertSame($i1->id, $json['list'][0]['id']);
	+ $this->assertSame($i1->email, $json['list'][0]['email']);
	+ $this->assertSame(true, $json['list'][0]['isFailed']);
	+ $this->assertSame(false, $json['list'][0]['isNew']);
	+ $this->assertSame(false, $json['list'][0]['isSent']);
	+ $this->assertSame(false, $json['list'][0]['isCompleted']);
	+ $this->assertSame($i2->id, $json['list'][1]['id']);
	+ $this->assertSame($i2->email, $json['list'][1]['email']);
	+ $this->assertFalse(in_array($i12->email, array_column($json['list'], 'email')));
	+ $this->assertFalse(in_array($i13->email, array_column($json['list'], 'email')));
	+
	+ $response = $this->actingAs($reseller)->get("api/v4/invitations?page=2");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame(1, $json['count']);
	+ $this->assertSame(2, $json['page']);
	+ $this->assertFalse($json['hasMore']);
	+ $this->assertSame($i11->id, $json['list'][0]['id']);
	+
	+ // Test searching (email address)
	+ $response = $this->actingAs($reseller)->get("api/v4/invitations?search=email3@ext.com");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame(1, $json['count']);
	+ $this->assertSame(1, $json['page']);
	+ $this->assertFalse($json['hasMore']);
	+ $this->assertSame($i3->id, $json['list'][0]['id']);
	+
	+ // Test searching (domain)
	+ $response = $this->actingAs($reseller)->get("api/v4/invitations?search=ext.com");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame(3, $json['count']);
	+ $this->assertSame(1, $json['page']);
	+ $this->assertFalse($json['hasMore']);
	+ $this->assertSame($i1->id, $json['list'][0]['id']);
	+ }
	+
	+ /**
	+ * Test resending invitations (POST /api/v4/invitations/<id>/resend)
	+ */
	+ public function testResend(): void
	+ {
	+ Queue::fake();
	+
	+ $user = $this->getTestUser('john@kolab.org');
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $reseller = $this->getTestUser('reseller@reseller.com');
	+ $reseller2 = $this->getTestUser('reseller@kolabnow.com');
	+ $tenant = Tenant::where('title', 'Sample Tenant')->first();
	+
	+ \config(['app.tenant_id' => $tenant->id]);
	+
	+ $inv = SignupInvitation::create(['email' => 'email1@ext.com']);
	+ SignupInvitation::where('id', $inv->id)->update(['status' => SignupInvitation::STATUS_FAILED]);
	+
	+ // Non-admin user
	+ $response = $this->actingAs($user)->post("api/v4/invitations/{$inv->id}/resend");
	+ $response->assertStatus(403);
	+
	+ // Admin user
	+ $response = $this->actingAs($admin)->post("api/v4/invitations/{$inv->id}/resend");
	+ $response->assertStatus(403);
	+
	+ // Reseller user, but different tenant
	+ $response = $this->actingAs($reseller2)->post("api/v4/invitations/{$inv->id}/resend");
	+ $response->assertStatus(403);
	+
	+ // Reseller - non-existing invitation identifier
	+ $response = $this->actingAs($reseller)->post("api/v4/invitations/abd/resend");
	+ $response->assertStatus(404);
	+
	+ // Reseller - existing invitation
	+ $response = $this->actingAs($reseller)->post("api/v4/invitations/{$inv->id}/resend");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame('success', $json['status']);
	+ $this->assertSame("Invitation added to the sending queue successfully.", $json['message']);
	+ $this->assertTrue($inv->fresh()->isNew());
	+ }
	+
	+ /**
	+ * Test creating invitations (POST /api/v4/invitations)
	+ */
	+ public function testStore(): void
	+ {
	+ Queue::fake();
	+
	+ $user = $this->getTestUser('john@kolab.org');
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $reseller = $this->getTestUser('reseller@reseller.com');
	+ $reseller2 = $this->getTestUser('reseller@kolabnow.com');
	+ $tenant = Tenant::where('title', 'Sample Tenant')->first();
	+
	+ \config(['app.tenant_id' => $tenant->id]);
	+
	+ // Non-admin user
	+ $response = $this->actingAs($user)->post("api/v4/invitations", []);
	+ $response->assertStatus(403);
	+
	+ // Admin user
	+ $response = $this->actingAs($admin)->post("api/v4/invitations", []);
	+ $response->assertStatus(403);
	+
	+ // Reseller user, but different tenant
	+ $response = $this->actingAs($reseller2)->post("api/v4/invitations", []);
	+ $response->assertStatus(403);
	+
	+ // Reseller (empty post)
	+ $response = $this->actingAs($reseller)->post("api/v4/invitations", []);
	+ $response->assertStatus(422);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame('error', $json['status']);
	+ $this->assertCount(1, $json['errors']);
	+ $this->assertSame("The email field is required.", $json['errors']['email'][0]);
	+
	+ // Invalid email address
	+ $post = ['email' => 'test'];
	+ $response = $this->actingAs($reseller)->post("api/v4/invitations", $post);
	+ $response->assertStatus(422);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame('error', $json['status']);
	+ $this->assertCount(1, $json['errors']);
	+ $this->assertSame("The email must be a valid email address.", $json['errors']['email'][0]);
	+
	+ // Valid email address
	+ $post = ['email' => 'test@external.org'];
	+ $response = $this->actingAs($reseller)->post("api/v4/invitations", $post);
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame('success', $json['status']);
	+ $this->assertSame("The invitation has been created.", $json['message']);
	+ $this->assertSame(1, $json['count']);
	+ $this->assertSame(1, SignupInvitation::count());
	+
	+ // Test file input (empty file)
	+ $tmpfile = tmpfile();
	+ fwrite($tmpfile, "");
	+ $file = new File('test.csv', $tmpfile);
	+ $post = ['file' => $file];
	+ $response = $this->actingAs($reseller)->post("api/v4/invitations", $post);
	+
	+ fclose($tmpfile);
	+
	+ $response->assertStatus(422);
	+ $json = $response->json();
	+
	+ $this->assertSame('error', $json['status']);
	+ $this->assertSame("Failed to find any valid email addresses in the uploaded file.", $json['errors']['file']);
	+
	+ // Test file input with an invalid email address
	+ $tmpfile = tmpfile();
	+ fwrite($tmpfile, "t1@domain.tld\r\nt2@domain");
	+ $file = new File('test.csv', $tmpfile);
	+ $post = ['file' => $file];
	+ $response = $this->actingAs($reseller)->post("api/v4/invitations", $post);
	+
	+ fclose($tmpfile);
	+
	+ $response->assertStatus(422);
	+ $json = $response->json();
	+
	+ $this->assertSame('error', $json['status']);
	+ $this->assertSame("Found an invalid email address (t2@domain) on line 2.", $json['errors']['file']);
	+
	+ // Test file input (two addresses)
	+ $tmpfile = tmpfile();
	+ fwrite($tmpfile, "t1@domain.tld\r\nt2@domain.tld");
	+ $file = new File('test.csv', $tmpfile);
	+ $post = ['file' => $file];
	+ $response = $this->actingAs($reseller)->post("api/v4/invitations", $post);
	+
	+ fclose($tmpfile);
	+
	+ $response->assertStatus(200);
	+ $json = $response->json();
	+
	+ $this->assertSame(1, SignupInvitation::where('email', 't1@domain.tld')->count());
	+ $this->assertSame(1, SignupInvitation::where('email', 't2@domain.tld')->count());
	+ $this->assertSame('success', $json['status']);
	+ $this->assertSame("2 invitations has been created.", $json['message']);
	+ $this->assertSame(2, $json['count']);
	+ }
	+}
	diff --git a/src/tests/Feature/Controller/Reseller/SkusTest.php b/src/tests/Feature/Controller/Reseller/SkusTest.php
	new file mode 100644
	--- /dev/null
	+++ b/src/tests/Feature/Controller/Reseller/SkusTest.php
	@@ -0,0 +1,122 @@
	+<?php
	+
	+namespace Tests\Feature\Controller\Reseller;
	+
	+use App\Sku;
	+use Tests\TestCase;
	+
	+class SkusTest extends TestCase
	+{
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function setUp(): void
	+ {
	+ parent::setUp();
	+ self::useResellerUrl();
	+
	+ \config(['app.tenant_id' => 1]);
	+
	+ $this->clearBetaEntitlements();
	+ $this->clearMeetEntitlements();
	+ }
	+
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function tearDown(): void
	+ {
	+ \config(['app.tenant_id' => 1]);
	+
	+ $this->clearBetaEntitlements();
	+ $this->clearMeetEntitlements();
	+
	+ parent::tearDown();
	+ }
	+
	+ /**
	+ * Test fetching SKUs list
	+ */
	+ public function testIndex(): void
	+ {
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $user = $this->getTestUser('john@kolab.org');
	+ $sku = Sku::where('title', 'mailbox')->first();
	+
	+ // Unauth access not allowed
	+ $response = $this->get("api/v4/skus");
	+ $response->assertStatus(401);
	+
	+ // User access not allowed on admin API
	+ $response = $this->actingAs($user)->get("api/v4/skus");
	+ $response->assertStatus(403);
	+
	+ // Admin access not allowed
	+ $response = $this->actingAs($admin)->get("api/v4/skus");
	+ $response->assertStatus(403);
	+
	+ $response = $this->actingAs($reseller1)->get("api/v4/skus");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertCount(9, $json);
	+
	+ $this->assertSame(100, $json[0]['prio']);
	+ $this->assertSame($sku->id, $json[0]['id']);
	+ $this->assertSame($sku->title, $json[0]['title']);
	+ $this->assertSame($sku->name, $json[0]['name']);
	+ $this->assertSame($sku->description, $json[0]['description']);
	+ $this->assertSame($sku->cost, $json[0]['cost']);
	+ $this->assertSame($sku->units_free, $json[0]['units_free']);
	+ $this->assertSame($sku->period, $json[0]['period']);
	+ $this->assertSame($sku->active, $json[0]['active']);
	+ $this->assertSame('user', $json[0]['type']);
	+ $this->assertSame('mailbox', $json[0]['handler']);
	+
	+ // TODO: Test limiting SKUs to the tenant's SKUs
	+ }
	+
	+ /**
	+ * Test fetching SKUs list for a user (GET /users/<id>/skus)
	+ */
	+ public function testUserSkus(): void
	+ {
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $user = $this->getTestUser('john@kolab.org');
	+
	+ // Unauth access not allowed
	+ $response = $this->get("api/v4/users/{$user->id}/skus");
	+ $response->assertStatus(401);
	+
	+ // User access not allowed
	+ $response = $this->actingAs($user)->get("api/v4/users/{$user->id}/skus");
	+ $response->assertStatus(403);
	+
	+ // Admin access not allowed
	+ $response = $this->actingAs($admin)->get("api/v4/users/{$user->id}/skus");
	+ $response->assertStatus(403);
	+
	+ // Reseller from another tenant not allowed
	+ $response = $this->actingAs($reseller2)->get("api/v4/users/{$user->id}/skus");
	+ $response->assertStatus(403);
	+
	+ // Reseller access
	+ $response = $this->actingAs($reseller1)->get("api/v4/users/{$user->id}/skus");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertCount(8, $json);
	+ // Note: Details are tested where we test API\V4\SkusController
	+
	+ // Reseller from another tenant not allowed
	+ \config(['app.tenant_id' => 2]);
	+ $response = $this->actingAs($reseller2)->get("api/v4/users/{$user->id}/skus");
	+ $response->assertStatus(404);
	+ }
	+}
	diff --git a/src/tests/Feature/Controller/Reseller/StatsTest.php b/src/tests/Feature/Controller/Reseller/StatsTest.php
	new file mode 100644
	--- /dev/null
	+++ b/src/tests/Feature/Controller/Reseller/StatsTest.php
	@@ -0,0 +1,89 @@
	+<?php
	+
	+namespace Tests\Feature\Controller\Reseller;
	+
	+use Tests\TestCase;
	+
	+class StatsTest extends TestCase
	+{
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function setUp(): void
	+ {
	+ parent::setUp();
	+ self::useResellerUrl();
	+ }
	+
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function tearDown(): void
	+ {
	+ parent::tearDown();
	+ }
	+
	+ /**
	+ * Test charts (GET /api/v4/stats/chart/<chart>)
	+ */
	+ public function testChart(): void
	+ {
	+ $user = $this->getTestUser('john@kolab.org');
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $reseller = $this->getTestUser('reseller@kolabnow.com');
	+
	+ // Unauth access
	+ $response = $this->get("api/v4/stats/chart/discounts");
	+ $response->assertStatus(401);
	+
	+ // Normal user
	+ $response = $this->actingAs($user)->get("api/v4/stats/chart/discounts");
	+ $response->assertStatus(403);
	+
	+ // Admin user
	+ $response = $this->actingAs($admin)->get("api/v4/stats/chart/discounts");
	+ $response->assertStatus(403);
	+
	+ // Unknown chart name
	+ $response = $this->actingAs($reseller)->get("api/v4/stats/chart/unknown");
	+ $response->assertStatus(404);
	+
	+ // 'income' chart
	+ $response = $this->actingAs($reseller)->get("api/v4/stats/chart/income");
	+ $response->assertStatus(404);
	+
	+ // 'discounts' chart
	+ $response = $this->actingAs($reseller)->get("api/v4/stats/chart/discounts");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame('Discounts', $json['title']);
	+ $this->assertSame('donut', $json['type']);
	+ $this->assertSame([], $json['data']['labels']);
	+ $this->assertSame([['values' => []]], $json['data']['datasets']);
	+
	+ // 'users' chart
	+ $response = $this->actingAs($reseller)->get("api/v4/stats/chart/users");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame('Users - last 8 weeks', $json['title']);
	+ $this->assertCount(8, $json['data']['labels']);
	+ $this->assertSame(date('Y-W'), $json['data']['labels'][7]);
	+ $this->assertCount(2, $json['data']['datasets']);
	+ $this->assertSame('Created', $json['data']['datasets'][0]['name']);
	+ $this->assertSame('Deleted', $json['data']['datasets'][1]['name']);
	+
	+ // 'users-all' chart
	+ $response = $this->actingAs($reseller)->get("api/v4/stats/chart/users-all");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame('All Users - last year', $json['title']);
	+ $this->assertCount(54, $json['data']['labels']);
	+ $this->assertCount(1, $json['data']['datasets']);
	+ }
	+}
	diff --git a/src/tests/Feature/Controller/Admin/UsersTest.php b/src/tests/Feature/Controller/Reseller/UsersTest.php
	copy from src/tests/Feature/Controller/Admin/UsersTest.php
	copy to src/tests/Feature/Controller/Reseller/UsersTest.php
	--- a/src/tests/Feature/Controller/Admin/UsersTest.php
	+++ b/src/tests/Feature/Controller/Reseller/UsersTest.php
	@@ -1,9 +1,10 @@
	<?php

	-namespace Tests\Feature\Controller\Admin;
	+namespace Tests\Feature\Controller\Reseller;

	-use App\Auth\SecondFactor;
	+use App\Tenant;
	use App\Sku;
	+use App\User;
	use Illuminate\Support\Facades\Queue;
	use Tests\TestCase;

	@@ -15,15 +16,12 @@
	public function setUp(): void
	{
	parent::setUp();
	- self::useAdminUrl();
	+ self::useResellerUrl();
	+ \config(['app.tenant_id' => 1]);

	$this->deleteTestUser('UsersControllerTest1@userscontroller.com');
	$this->deleteTestUser('test@testsearch.com');
	$this->deleteTestDomain('testsearch.com');
	- $this->deleteTestGroup('group-test@kolab.org');
	-
	- $jack = $this->getTestUser('jack@kolab.org');
	- $jack->setSetting('external_email', null);
	}

	/**
	@@ -35,28 +33,60 @@
	$this->deleteTestUser('test@testsearch.com');
	$this->deleteTestDomain('testsearch.com');

	- $jack = $this->getTestUser('jack@kolab.org');
	- $jack->setSetting('external_email', null);
	+ \config(['app.tenant_id' => 1]);

	parent::tearDown();
	}

	+ /**
	+ * Test user deleting (DELETE /api/v4/users/<id>)
	+ */
	+ public function testDestroy(): void
	+ {
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
	+
	+ // Test unauth access
	+ $response = $this->delete("api/v4/users/{$user->id}");
	+ $response->assertStatus(401);
	+
	+ // The end-point does not exist
	+ $response = $this->actingAs($reseller1)->delete("api/v4/users/{$user->id}");
	+ $response->assertStatus(404);
	+ }
	+
	/**
	* Test users searching (/api/v4/users)
	*/
	public function testIndex(): void
	{
	+ Queue::fake();
	+
	$user = $this->getTestUser('john@kolab.org');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	- $group = $this->getTestGroup('group-test@kolab.org');
	- $group->assignToWallet($user->wallets->first());
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller2 = $this->getTestUser('reseller@reseller.com');
	+
	+ \config(['app.tenant_id' => 2]);

	- // Non-admin user
	+ // Guess access
	+ $response = $this->get("api/v4/users");
	+ $response->assertStatus(401);
	+
	+ // Normal user
	$response = $this->actingAs($user)->get("api/v4/users");
	$response->assertStatus(403);

	- // Search with no search criteria
	+ // Admin user
	$response = $this->actingAs($admin)->get("api/v4/users");
	+ $response->assertStatus(403);
	+
	+ // Reseller from another tenant
	+ $response = $this->actingAs($reseller1)->get("api/v4/users");
	+ $response->assertStatus(403);
	+
	+ // Search with no search criteria
	+ $response = $this->actingAs($reseller2)->get("api/v4/users");
	$response->assertStatus(200);

	$json = $response->json();
	@@ -65,7 +95,7 @@
	$this->assertSame([], $json['list']);

	// Search with no matches expected
	- $response = $this->actingAs($admin)->get("api/v4/users?search=abcd1234efgh5678");
	+ $response = $this->actingAs($reseller2)->get("api/v4/users?search=abcd1234efgh5678");
	$response->assertStatus(200);

	$json = $response->json();
	@@ -73,8 +103,56 @@
	$this->assertSame(0, $json['count']);
	$this->assertSame([], $json['list']);

	+ // Search by domain in another tenant
	+ $response = $this->actingAs($reseller2)->get("api/v4/users?search=kolab.org");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame(0, $json['count']);
	+ $this->assertSame([], $json['list']);
	+
	+ // Search by user ID in another tenant
	+ $response = $this->actingAs($reseller2)->get("api/v4/users?search={$user->id}");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame(0, $json['count']);
	+ $this->assertSame([], $json['list']);
	+
	+ // Search by email (primary) - existing user in another tenant
	+ $response = $this->actingAs($reseller2)->get("api/v4/users?search=john@kolab.org");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame(0, $json['count']);
	+ $this->assertSame([], $json['list']);
	+
	+ // Search by owner - existing user in another tenant
	+ $response = $this->actingAs($reseller2)->get("api/v4/users?owner={$user->id}");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame(0, $json['count']);
	+ $this->assertSame([], $json['list']);
	+
	+ // Create a domain with some users in the Sample Tenant so we have anything to search for
	+ $domain = $this->getTestDomain('testsearch.com', ['type' => \App\Domain::TYPE_EXTERNAL]);
	+ $domain->tenant_id = 2;
	+ $domain->save();
	+ $user = $this->getTestUser('test@testsearch.com');
	+ $user->tenant_id = 2;
	+ $user->save();
	+ $plan = \App\Plan::where('title', 'group')->first();
	+ $user->assignPlan($plan, $domain);
	+ $user->setAliases(['alias@testsearch.com']);
	+ $user->setSetting('external_email', 'john.doe.external@gmail.com');
	+
	// Search by domain
	- $response = $this->actingAs($admin)->get("api/v4/users?search=kolab.org");
	+ $response = $this->actingAs($reseller2)->get("api/v4/users?search=testsearch.com");
	$response->assertStatus(200);

	$json = $response->json();
	@@ -85,7 +163,7 @@
	$this->assertSame($user->email, $json['list'][0]['email']);

	// Search by user ID
	- $response = $this->actingAs($admin)->get("api/v4/users?search={$user->id}");
	+ $response = $this->actingAs($reseller2)->get("api/v4/users?search={$user->id}");
	$response->assertStatus(200);

	$json = $response->json();
	@@ -95,8 +173,8 @@
	$this->assertSame($user->id, $json['list'][0]['id']);
	$this->assertSame($user->email, $json['list'][0]['email']);

	- // Search by email (primary)
	- $response = $this->actingAs($admin)->get("api/v4/users?search=john@kolab.org");
	+ // Search by email (primary) - existing user in reseller's tenant
	+ $response = $this->actingAs($reseller2)->get("api/v4/users?search=test@testsearch.com");
	$response->assertStatus(200);

	$json = $response->json();
	@@ -107,7 +185,7 @@
	$this->assertSame($user->email, $json['list'][0]['email']);

	// Search by email (alias)
	- $response = $this->actingAs($admin)->get("api/v4/users?search=john.doe@kolab.org");
	+ $response = $this->actingAs($reseller2)->get("api/v4/users?search=alias@testsearch.com");
	$response->assertStatus(200);

	$json = $response->json();
	@@ -117,45 +195,20 @@
	$this->assertSame($user->id, $json['list'][0]['id']);
	$this->assertSame($user->email, $json['list'][0]['email']);

	- // Search by email (external), expect two users in a result
	- $jack = $this->getTestUser('jack@kolab.org');
	- $jack->setSetting('external_email', 'john.doe.external@gmail.com');
	-
	- $response = $this->actingAs($admin)->get("api/v4/users?search=john.doe.external@gmail.com");
	+ // Search by email (external), there are two users with this email, but only one
	+ // in the reseller's tenant
	+ $response = $this->actingAs($reseller2)->get("api/v4/users?search=john.doe.external@gmail.com");
	$response->assertStatus(200);

	$json = $response->json();

	- $this->assertSame(2, $json['count']);
	- $this->assertCount(2, $json['list']);
	-
	- $emails = array_column($json['list'], 'email');
	-
	- $this->assertContains($user->email, $emails);
	- $this->assertContains($jack->email, $emails);
	+ $this->assertSame(1, $json['count']);
	+ $this->assertCount(1, $json['list']);
	+ $this->assertSame($user->id, $json['list'][0]['id']);
	+ $this->assertSame($user->email, $json['list'][0]['email']);

	// Search by owner
	- $response = $this->actingAs($admin)->get("api/v4/users?owner={$user->id}");
	- $response->assertStatus(200);
	-
	- $json = $response->json();
	-
	- $this->assertSame(4, $json['count']);
	- $this->assertCount(4, $json['list']);
	-
	- // Search by owner (Ned is a controller on John's wallets,
	- // here we expect only users assigned to Ned's wallet(s))
	- $ned = $this->getTestUser('ned@kolab.org');
	- $response = $this->actingAs($admin)->get("api/v4/users?owner={$ned->id}");
	- $response->assertStatus(200);
	-
	- $json = $response->json();
	-
	- $this->assertSame(0, $json['count']);
	- $this->assertCount(0, $json['list']);
	-
	- // Search by distribution list email
	- $response = $this->actingAs($admin)->get("api/v4/users?search=group-test@kolab.org");
	+ $response = $this->actingAs($reseller2)->get("api/v4/users?owner={$user->id}");
	$response->assertStatus(200);

	$json = $response->json();
	@@ -166,15 +219,9 @@
	$this->assertSame($user->email, $json['list'][0]['email']);

	// Deleted users/domains
	- $domain = $this->getTestDomain('testsearch.com', ['type' => \App\Domain::TYPE_EXTERNAL]);
	- $user = $this->getTestUser('test@testsearch.com');
	- $plan = \App\Plan::where('title', 'group')->first();
	- $user->assignPlan($plan, $domain);
	- $user->setAliases(['alias@testsearch.com']);
	- Queue::fake();
	$user->delete();

	- $response = $this->actingAs($admin)->get("api/v4/users?search=test@testsearch.com");
	+ $response = $this->actingAs($reseller2)->get("api/v4/users?search=test@testsearch.com");
	$response->assertStatus(200);

	$json = $response->json();
	@@ -185,7 +232,7 @@
	$this->assertSame($user->email, $json['list'][0]['email']);
	$this->assertTrue($json['list'][0]['isDeleted']);

	- $response = $this->actingAs($admin)->get("api/v4/users?search=alias@testsearch.com");
	+ $response = $this->actingAs($reseller2)->get("api/v4/users?search=alias@testsearch.com");
	$response->assertStatus(200);

	$json = $response->json();
	@@ -196,7 +243,7 @@
	$this->assertSame($user->email, $json['list'][0]['email']);
	$this->assertTrue($json['list'][0]['isDeleted']);

	- $response = $this->actingAs($admin)->get("api/v4/users?search=testsearch.com");
	+ $response = $this->actingAs($reseller2)->get("api/v4/users?search=testsearch.com");
	$response->assertStatus(200);

	$json = $response->json();
	@@ -215,23 +262,35 @@
	{
	$user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller2 = $this->getTestUser('reseller@reseller.com');

	- $sku2fa = Sku::firstOrCreate(['title' => '2fa']);
	+ $sku2fa = \App\Sku::firstOrCreate(['title' => '2fa']);
	$user->assignSku($sku2fa);
	- SecondFactor::seed('userscontrollertest1@userscontroller.com');
	+ \App\Auth\SecondFactor::seed('userscontrollertest1@userscontroller.com');

	- // Test unauthorized access to admin API
	+ // Test unauthorized access
	$response = $this->actingAs($user)->post("/api/v4/users/{$user->id}/reset2FA", []);
	$response->assertStatus(403);

	+ $response = $this->actingAs($admin)->post("/api/v4/users/{$user->id}/reset2FA", []);
	+ $response->assertStatus(403);
	+
	+ $response = $this->actingAs($reseller2)->post("/api/v4/users/{$user->id}/reset2FA", []);
	+ $response->assertStatus(403);
	+
	+ // Touching admins is forbidden
	+ $response = $this->actingAs($reseller1)->post("/api/v4/users/{$admin->id}/reset2FA", []);
	+ $response->assertStatus(404);
	+
	$entitlements = $user->fresh()->entitlements()->where('sku_id', $sku2fa->id)->get();
	$this->assertCount(1, $entitlements);

	- $sf = new SecondFactor($user);
	+ $sf = new \App\Auth\SecondFactor($user);
	$this->assertCount(1, $sf->factors());

	// Test reseting 2FA
	- $response = $this->actingAs($admin)->post("/api/v4/users/{$user->id}/reset2FA", []);
	+ $response = $this->actingAs($reseller1)->post("/api/v4/users/{$user->id}/reset2FA", []);
	$response->assertStatus(200);

	$json = $response->json();
	@@ -243,8 +302,25 @@
	$entitlements = $user->fresh()->entitlements()->where('sku_id', $sku2fa->id)->get();
	$this->assertCount(0, $entitlements);

	- $sf = new SecondFactor($user);
	+ $sf = new \App\Auth\SecondFactor($user);
	$this->assertCount(0, $sf->factors());
	+
	+ // Other tenant's user
	+ \config(['app.tenant_id' => 2]);
	+ $response = $this->actingAs($reseller2)->post("/api/v4/users/{$user->id}/reset2FA", []);
	+ $response->assertStatus(404);
	+ }
	+
	+ /**
	+ * Test user creation (POST /api/v4/users)
	+ */
	+ public function testStore(): void
	+ {
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+
	+ // The end-point does not exist
	+ $response = $this->actingAs($reseller1)->post("/api/v4/users", []);
	+ $response->assertStatus(404);
	}

	/**
	@@ -256,15 +332,26 @@

	$user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller2 = $this->getTestUser('reseller@reseller.com');

	- // Test unauthorized access to admin API
	+ // Test unauthorized access
	$response = $this->actingAs($user)->post("/api/v4/users/{$user->id}/suspend", []);
	$response->assertStatus(403);

	+ $response = $this->actingAs($admin)->post("/api/v4/users/{$user->id}/suspend", []);
	+ $response->assertStatus(403);
	+
	+ $response = $this->actingAs($reseller2)->post("/api/v4/users/{$user->id}/suspend", []);
	+ $response->assertStatus(403);
	+
	+ $response = $this->actingAs($reseller1)->post("/api/v4/users/{$admin->id}/suspend", []);
	+ $response->assertStatus(404);
	+
	$this->assertFalse($user->isSuspended());

	// Test suspending the user
	- $response = $this->actingAs($admin)->post("/api/v4/users/{$user->id}/suspend", []);
	+ $response = $this->actingAs($reseller1)->post("/api/v4/users/{$user->id}/suspend", []);
	$response->assertStatus(200);

	$json = $response->json();
	@@ -274,6 +361,11 @@
	$this->assertCount(2, $json);

	$this->assertTrue($user->fresh()->isSuspended());
	+
	+ // Access to other tenant's users
	+ \config(['app.tenant_id' => 2]);
	+ $response = $this->actingAs($reseller2)->post("/api/v4/users/{$user->id}/suspend", []);
	+ $response->assertStatus(404);
	}

	/**
	@@ -285,17 +377,28 @@

	$user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller2 = $this->getTestUser('reseller@reseller.com');

	// Test unauthorized access to admin API
	$response = $this->actingAs($user)->post("/api/v4/users/{$user->id}/unsuspend", []);
	$response->assertStatus(403);

	+ $response = $this->actingAs($admin)->post("/api/v4/users/{$user->id}/unsuspend", []);
	+ $response->assertStatus(403);
	+
	+ $response = $this->actingAs($reseller2)->post("/api/v4/users/{$user->id}/unsuspend", []);
	+ $response->assertStatus(403);
	+
	+ $response = $this->actingAs($reseller1)->post("/api/v4/users/{$admin->id}/unsuspend", []);
	+ $response->assertStatus(404);
	+
	$this->assertFalse($user->isSuspended());
	$user->suspend();
	$this->assertTrue($user->isSuspended());

	// Test suspending the user
	- $response = $this->actingAs($admin)->post("/api/v4/users/{$user->id}/unsuspend", []);
	+ $response = $this->actingAs($reseller1)->post("/api/v4/users/{$user->id}/unsuspend", []);
	$response->assertStatus(200);

	$json = $response->json();
	@@ -305,6 +408,11 @@
	$this->assertCount(2, $json);

	$this->assertFalse($user->fresh()->isSuspended());
	+
	+ // Access to other tenant's users
	+ \config(['app.tenant_id' => 2]);
	+ $response = $this->actingAs($reseller2)->post("/api/v4/users/{$user->id}/unsuspend", []);
	+ $response->assertStatus(404);
	}

	/**
	@@ -314,13 +422,24 @@
	{
	$user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
	$admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller2 = $this->getTestUser('reseller@reseller.com');

	- // Test unauthorized access to admin API
	+ // Test unauthorized access
	$response = $this->actingAs($user)->put("/api/v4/users/{$user->id}", []);
	$response->assertStatus(403);

	- // Test updatig the user data (empty data)
	$response = $this->actingAs($admin)->put("/api/v4/users/{$user->id}", []);
	+ $response->assertStatus(403);
	+
	+ $response = $this->actingAs($reseller2)->put("/api/v4/users/{$user->id}", []);
	+ $response->assertStatus(403);
	+
	+ $response = $this->actingAs($reseller1)->put("/api/v4/users/{$admin->id}", []);
	+ $response->assertStatus(404);
	+
	+ // Test updatig the user data (empty data)
	+ $response = $this->actingAs($reseller1)->put("/api/v4/users/{$user->id}", []);
	$response->assertStatus(200);

	$json = $response->json();
	@@ -331,7 +450,7 @@

	// Test error handling
	$post = ['external_email' => 'aaa'];
	- $response = $this->actingAs($admin)->put("/api/v4/users/{$user->id}", $post);
	+ $response = $this->actingAs($reseller1)->put("/api/v4/users/{$user->id}", $post);
	$response->assertStatus(422);

	$json = $response->json();
	@@ -342,7 +461,7 @@

	// Test real update
	$post = ['external_email' => 'modified@test.com'];
	- $response = $this->actingAs($admin)->put("/api/v4/users/{$user->id}", $post);
	+ $response = $this->actingAs($reseller1)->put("/api/v4/users/{$user->id}", $post);
	$response->assertStatus(200);

	$json = $response->json();
	@@ -351,5 +470,10 @@
	$this->assertSame("User data updated successfully.", $json['message']);
	$this->assertCount(2, $json);
	$this->assertSame('modified@test.com', $user->getSetting('external_email'));
	+
	+ // Access to other tenant's users
	+ \config(['app.tenant_id' => 2]);
	+ $response = $this->actingAs($reseller2)->put("/api/v4/users/{$user->id}", $post);
	+ $response->assertStatus(404);
	}
	}
	diff --git a/src/tests/Feature/Controller/Reseller/WalletsTest.php b/src/tests/Feature/Controller/Reseller/WalletsTest.php
	new file mode 100644
	--- /dev/null
	+++ b/src/tests/Feature/Controller/Reseller/WalletsTest.php
	@@ -0,0 +1,292 @@
	+<?php
	+
	+namespace Tests\Feature\Controller\Reseller;
	+
	+use App\Discount;
	+use App\Transaction;
	+use Tests\TestCase;
	+
	+class WalletsTest extends TestCase
	+{
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function setUp(): void
	+ {
	+ parent::setUp();
	+ self::useResellerUrl();
	+ \config(['app.tenant_id' => 1]);
	+ }
	+
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function tearDown(): void
	+ {
	+ \config(['app.tenant_id' => 1]);
	+ parent::tearDown();
	+ }
	+
	+ /**
	+ * Test fetching a wallet (GET /api/v4/wallets/:id)
	+ *
	+ * @group stripe
	+ */
	+ public function testShow(): void
	+ {
	+ \config(['services.payment_provider' => 'stripe']);
	+
	+ $user = $this->getTestUser('john@kolab.org');
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $wallet = $user->wallets()->first();
	+ $wallet->discount_id = null;
	+ $wallet->save();
	+
	+ // Make sure there's no stripe/mollie identifiers
	+ $wallet->setSetting('stripe_id', null);
	+ $wallet->setSetting('stripe_mandate_id', null);
	+ $wallet->setSetting('mollie_id', null);
	+ $wallet->setSetting('mollie_mandate_id', null);
	+
	+ // Non-admin user
	+ $response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}");
	+ $response->assertStatus(403);
	+
	+ // Admin user
	+ $response = $this->actingAs($admin)->get("api/v4/wallets/{$wallet->id}");
	+ $response->assertStatus(403);
	+
	+ // Reseller from a different tenant
	+ $response = $this->actingAs($reseller2)->get("api/v4/wallets/{$wallet->id}");
	+ $response->assertStatus(403);
	+
	+ // Reseller
	+ $response = $this->actingAs($reseller1)->get("api/v4/wallets/{$wallet->id}");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame($wallet->id, $json['id']);
	+ $this->assertSame('CHF', $json['currency']);
	+ $this->assertSame($wallet->balance, $json['balance']);
	+ $this->assertSame(0, $json['discount']);
	+ $this->assertTrue(empty($json['description']));
	+ $this->assertTrue(empty($json['discount_description']));
	+ $this->assertTrue(!empty($json['provider']));
	+ $this->assertTrue(empty($json['providerLink']));
	+ $this->assertTrue(!empty($json['mandate']));
	+
	+ // Reseller from a different tenant
	+ \config(['app.tenant_id' => 2]);
	+ $response = $this->actingAs($reseller2)->get("api/v4/wallets/{$wallet->id}");
	+ $response->assertStatus(404);
	+ }
	+
	+ /**
	+ * Test awarding/penalizing a wallet (POST /api/v4/wallets/:id/one-off)
	+ */
	+ public function testOneOff(): void
	+ {
	+ $user = $this->getTestUser('john@kolab.org');
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $wallet = $user->wallets()->first();
	+ $balance = $wallet->balance;
	+
	+ Transaction::where('object_id', $wallet->id)
	+ ->whereIn('type', [Transaction::WALLET_AWARD, Transaction::WALLET_PENALTY])
	+ ->delete();
	+
	+ // Non-admin user
	+ $response = $this->actingAs($user)->post("api/v4/wallets/{$wallet->id}/one-off", []);
	+ $response->assertStatus(403);
	+
	+ // Admin user
	+ $response = $this->actingAs($admin)->post("api/v4/wallets/{$wallet->id}/one-off", []);
	+ $response->assertStatus(403);
	+
	+ // Reseller from a different tenant
	+ $response = $this->actingAs($reseller2)->post("api/v4/wallets/{$wallet->id}/one-off", []);
	+ $response->assertStatus(403);
	+
	+ // Admin user - invalid input
	+ $post = ['amount' => 'aaaa'];
	+ $response = $this->actingAs($reseller1)->post("api/v4/wallets/{$wallet->id}/one-off", $post);
	+ $response->assertStatus(422);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame('error', $json['status']);
	+ $this->assertSame('The amount must be a number.', $json['errors']['amount'][0]);
	+ $this->assertSame('The description field is required.', $json['errors']['description'][0]);
	+ $this->assertCount(2, $json);
	+ $this->assertCount(2, $json['errors']);
	+
	+ // Admin user - a valid bonus
	+ $post = ['amount' => '50', 'description' => 'A bonus'];
	+ $response = $this->actingAs($reseller1)->post("api/v4/wallets/{$wallet->id}/one-off", $post);
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame('success', $json['status']);
	+ $this->assertSame('The bonus has been added to the wallet successfully.', $json['message']);
	+ $this->assertSame($balance += 5000, $json['balance']);
	+ $this->assertSame($balance, $wallet->fresh()->balance);
	+
	+ $transaction = Transaction::where('object_id', $wallet->id)
	+ ->where('type', Transaction::WALLET_AWARD)->first();
	+
	+ $this->assertSame($post['description'], $transaction->description);
	+ $this->assertSame(5000, $transaction->amount);
	+ $this->assertSame($reseller1->email, $transaction->user_email);
	+
	+ // Admin user - a valid penalty
	+ $post = ['amount' => '-40', 'description' => 'A penalty'];
	+ $response = $this->actingAs($reseller1)->post("api/v4/wallets/{$wallet->id}/one-off", $post);
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame('success', $json['status']);
	+ $this->assertSame('The penalty has been added to the wallet successfully.', $json['message']);
	+ $this->assertSame($balance -= 4000, $json['balance']);
	+ $this->assertSame($balance, $wallet->fresh()->balance);
	+
	+ $transaction = Transaction::where('object_id', $wallet->id)
	+ ->where('type', Transaction::WALLET_PENALTY)->first();
	+
	+ $this->assertSame($post['description'], $transaction->description);
	+ $this->assertSame(-4000, $transaction->amount);
	+ $this->assertSame($reseller1->email, $transaction->user_email);
	+
	+ // Reseller from a different tenant
	+ \config(['app.tenant_id' => 2]);
	+ $response = $this->actingAs($reseller2)->post("api/v4/wallets/{$wallet->id}/one-off", []);
	+ $response->assertStatus(404);
	+ }
	+
	+ /**
	+ * Test fetching wallet transactions (GET /api/v4/wallets/:id/transactions)
	+ */
	+ public function testTransactions(): void
	+ {
	+ // Note: Here we're testing only that the end-point works,
	+ // and admin can get the transaction log, response details
	+ // are tested in Feature/Controller/WalletsTest.php
	+
	+ $this->deleteTestUser('wallets-controller@kolabnow.com');
	+ $user = $this->getTestUser('wallets-controller@kolabnow.com');
	+ $wallet = $user->wallets()->first();
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller2 = $this->getTestUser('reseller@reseller.com');
	+
	+ // Non-admin
	+ $response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/transactions");
	+ $response->assertStatus(403);
	+
	+ // Admin
	+ $response = $this->actingAs($admin)->get("api/v4/wallets/{$wallet->id}/transactions");
	+ $response->assertStatus(403);
	+
	+ // Reseller from a different tenant
	+ $response = $this->actingAs($reseller2)->get("api/v4/wallets/{$wallet->id}/transactions");
	+ $response->assertStatus(403);
	+
	+ // Create some sample transactions
	+ $transactions = $this->createTestTransactions($wallet);
	+ $transactions = array_reverse($transactions);
	+ $pages = array_chunk($transactions, 10 /* page size*/);
	+
	+ // Get the 2nd page
	+ $response = $this->actingAs($reseller1)->get("api/v4/wallets/{$wallet->id}/transactions?page=2");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertCount(5, $json);
	+ $this->assertSame('success', $json['status']);
	+ $this->assertSame(2, $json['page']);
	+ $this->assertSame(2, $json['count']);
	+ $this->assertSame(false, $json['hasMore']);
	+ $this->assertCount(2, $json['list']);
	+ foreach ($pages[1] as $idx => $transaction) {
	+ $this->assertSame($transaction->id, $json['list'][$idx]['id']);
	+ $this->assertSame($transaction->type, $json['list'][$idx]['type']);
	+ $this->assertSame($transaction->shortDescription(), $json['list'][$idx]['description']);
	+ $this->assertFalse($json['list'][$idx]['hasDetails']);
	+ }
	+
	+ // The 'user' key is set only on the admin/reseller end-point
	+ // FIXME: Should we hide this for resellers?
	+ $this->assertSame('jeroen@jeroen.jeroen', $json['list'][1]['user']);
	+
	+ // Reseller from a different tenant
	+ \config(['app.tenant_id' => 2]);
	+ $response = $this->actingAs($reseller2)->get("api/v4/wallets/{$wallet->id}/transactions");
	+ $response->assertStatus(403);
	+ }
	+
	+ /**
	+ * Test updating a wallet (PUT /api/v4/wallets/:id)
	+ */
	+ public function testUpdate(): void
	+ {
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $user = $this->getTestUser('john@kolab.org');
	+ $wallet = $user->wallets()->first();
	+ $discount = Discount::where('code', 'TEST')->first();
	+
	+ // Non-admin user
	+ $response = $this->actingAs($user)->put("api/v4/wallets/{$wallet->id}", []);
	+ $response->assertStatus(403);
	+
	+ // Admin
	+ $response = $this->actingAs($admin)->put("api/v4/wallets/{$wallet->id}", []);
	+ $response->assertStatus(403);
	+
	+ // Reseller from another tenant
	+ $response = $this->actingAs($reseller2)->put("api/v4/wallets/{$wallet->id}", []);
	+ $response->assertStatus(403);
	+
	+ // Admin user - setting a discount
	+ $post = ['discount' => $discount->id];
	+ $response = $this->actingAs($reseller1)->put("api/v4/wallets/{$wallet->id}", $post);
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame('success', $json['status']);
	+ $this->assertSame('User wallet updated successfully.', $json['message']);
	+ $this->assertSame($wallet->id, $json['id']);
	+ $this->assertSame($discount->discount, $json['discount']);
	+ $this->assertSame($discount->id, $json['discount_id']);
	+ $this->assertSame($discount->description, $json['discount_description']);
	+ $this->assertSame($discount->id, $wallet->fresh()->discount->id);
	+
	+ // Admin user - removing a discount
	+ $post = ['discount' => null];
	+ $response = $this->actingAs($reseller1)->put("api/v4/wallets/{$wallet->id}", $post);
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame('success', $json['status']);
	+ $this->assertSame('User wallet updated successfully.', $json['message']);
	+ $this->assertSame($wallet->id, $json['id']);
	+ $this->assertSame(null, $json['discount_id']);
	+ $this->assertTrue(empty($json['discount_description']));
	+ $this->assertSame(null, $wallet->fresh()->discount);
	+
	+ // Reseller from a different tenant
	+ \config(['app.tenant_id' => 2]);
	+ $response = $this->actingAs($reseller2)->put("api/v4/wallets/{$wallet->id}", []);
	+ $response->assertStatus(404);
	+ }
	+}
	diff --git a/src/tests/Feature/Controller/SignupTest.php b/src/tests/Feature/Controller/SignupTest.php
	--- a/src/tests/Feature/Controller/SignupTest.php
	+++ b/src/tests/Feature/Controller/SignupTest.php
	@@ -6,6 +6,7 @@
	use App\Discount;
	use App\Domain;
	use App\SignupCode;
	+use App\SignupInvitation as SI;
	use App\User;
	use Illuminate\Support\Facades\Queue;
	use Tests\TestCase;
	@@ -28,11 +29,13 @@
	$this->deleteTestUser("SignupControllerTest1@$this->domain");
	$this->deleteTestUser("signuplogin@$this->domain");
	$this->deleteTestUser("admin@external.com");
	+ $this->deleteTestUser("test-inv@kolabnow.com");

	$this->deleteTestDomain('external.com');
	$this->deleteTestDomain('signup-domain.com');

	$this->deleteTestGroup('group-test@kolabnow.com');
	+ SI::truncate();
	}

	/**
	@@ -43,11 +46,13 @@
	$this->deleteTestUser("SignupControllerTest1@$this->domain");
	$this->deleteTestUser("signuplogin@$this->domain");
	$this->deleteTestUser("admin@external.com");
	+ $this->deleteTestUser("test-inv@kolabnow.com");

	$this->deleteTestDomain('external.com');
	$this->deleteTestDomain('signup-domain.com');

	$this->deleteTestGroup('group-test@kolabnow.com');
	+ SI::truncate();

	parent::tearDown();
	}
	@@ -77,10 +82,8 @@

	/**
	* Test fetching plans for signup
	- *
	- * @return void
	*/
	- public function testSignupPlans()
	+ public function testSignupPlans(): void
	{
	$response = $this->get('/api/auth/signup/plans');
	$json = $response->json();
	@@ -95,12 +98,37 @@
	$this->assertArrayHasKey('button', $json['plans'][0]);
	}

	+ /**
	+ * Test fetching invitation
	+ */
	+ public function testSignupInvitations(): void
	+ {
	+ Queue::fake();
	+
	+ $invitation = SI::create(['email' => 'email1@ext.com']);
	+
	+ // Test existing invitation
	+ $response = $this->get("/api/auth/signup/invitations/{$invitation->id}");
	+ $response->assertStatus(200);
	+
	+ $json = $response->json();
	+
	+ $this->assertSame($invitation->id, $json['id']);
	+
	+ // Test non-existing invitation
	+ $response = $this->get("/api/auth/signup/invitations/abc");
	+ $response->assertStatus(404);
	+
	+ // Test completed invitation
	+ SI::where('id', $invitation->id)->update(['status' => SI::STATUS_COMPLETED]);
	+ $response = $this->get("/api/auth/signup/invitations/{$invitation->id}");
	+ $response->assertStatus(404);
	+ }
	+
	/**
	* Test signup initialization with invalid input
	- *
	- * @return void
	*/
	- public function testSignupInitInvalidInput()
	+ public function testSignupInitInvalidInput(): void
	{
	// Empty input data
	$data = [];
	@@ -167,10 +195,8 @@

	/**
	* Test signup initialization with valid input
	- *
	- * @return array
	*/
	- public function testSignupInitValidInput()
	+ public function testSignupInitValidInput(): array
	{
	Queue::fake();

	@@ -243,9 +269,8 @@
	* Test signup code verification with invalid input
	*
	* @depends testSignupInitValidInput
	- * @return void
	*/
	- public function testSignupVerifyInvalidInput(array $result)
	+ public function testSignupVerifyInvalidInput(array $result): void
	{
	// Empty data
	$data = [];
	@@ -293,10 +318,8 @@
	* Test signup code verification with valid input
	*
	* @depends testSignupInitValidInput
	- *
	- * @return array
	*/
	- public function testSignupVerifyValidInput(array $result)
	+ public function testSignupVerifyValidInput(array $result): array
	{
	$code = SignupCode::find($result['code']);
	$data = [
	@@ -324,9 +347,8 @@
	* Test last signup step with invalid input
	*
	* @depends testSignupVerifyValidInput
	- * @return void
	*/
	- public function testSignupInvalidInput(array $result)
	+ public function testSignupInvalidInput(array $result): void
	{
	// Empty data
	$data = [];
	@@ -456,9 +478,8 @@
	* Test last signup step with valid input (user creation)
	*
	* @depends testSignupVerifyValidInput
	- * @return void
	*/
	- public function testSignupValidInput(array $result)
	+ public function testSignupValidInput(array $result): void
	{
	$queue = Queue::fake();

	@@ -520,10 +541,8 @@

	/**
	* Test signup for a group (custom domain) account
	- *
	- * @return void
	*/
	- public function testSignupGroupAccount()
	+ public function testSignupGroupAccount(): void
	{
	Queue::fake();

	@@ -641,6 +660,59 @@
	// TODO: Check if the access token works
	}

	+ /**
	+ * Test signup via invitation
	+ */
	+ public function testSignupViaInvitation(): void
	+ {
	+ Queue::fake();
	+
	+ $invitation = SI::create(['email' => 'email1@ext.com']);
	+
	+ $post = [
	+ 'invitation' => 'abc',
	+ 'first_name' => 'Signup',
	+ 'last_name' => 'User',
	+ 'login' => 'test-inv',
	+ 'domain' => 'kolabnow.com',
	+ 'password' => 'test',
	+ 'password_confirmation' => 'test',
	+ ];
	+
	+ // Test invalid invitation identifier
	+ $response = $this->post('/api/auth/signup', $post);
	+ $response->assertStatus(404);
	+
	+ // Test valid input
	+ $post['invitation'] = $invitation->id;
	+ $response = $this->post('/api/auth/signup', $post);
	+ $result = $response->json();
	+
	+ $response->assertStatus(200);
	+ $this->assertSame('success', $result['status']);
	+ $this->assertSame('bearer', $result['token_type']);
	+ $this->assertTrue(!empty($result['expires_in']) && is_int($result['expires_in']) && $result['expires_in'] > 0);
	+ $this->assertNotEmpty($result['access_token']);
	+ $this->assertSame('test-inv@kolabnow.com', $result['email']);
	+
	+ // Check if the user has been created
	+ $user = User::where('email', 'test-inv@kolabnow.com')->first();
	+
	+ $this->assertNotEmpty($user);
	+
	+ // Check user settings
	+ $this->assertSame($invitation->email, $user->getSetting('external_email'));
	+ $this->assertSame($post['first_name'], $user->getSetting('first_name'));
	+ $this->assertSame($post['last_name'], $user->getSetting('last_name'));
	+
	+ $invitation->refresh();
	+
	+ $this->assertSame($user->id, $invitation->user_id);
	+ $this->assertTrue($invitation->isCompleted());
	+
	+ // TODO: Test POST params validation
	+ }
	+
	/**
	* List of login/domain validation cases for testValidateLogin()
	*
	diff --git a/src/tests/Feature/Jobs/SignupInvitationEmailTest.php b/src/tests/Feature/Jobs/SignupInvitationEmailTest.php
	new file mode 100644
	--- /dev/null
	+++ b/src/tests/Feature/Jobs/SignupInvitationEmailTest.php
	@@ -0,0 +1,68 @@
	+<?php
	+
	+namespace Tests\Feature\Jobs;
	+
	+use App\Jobs\SignupInvitationEmail;
	+use App\Mail\SignupInvitation;
	+use App\SignupInvitation as SI;
	+use Illuminate\Queue\Events\JobFailed;
	+use Illuminate\Support\Facades\Mail;
	+use Illuminate\Support\Facades\Queue;
	+use Tests\TestCase;
	+
	+class SignupInvitationEmailTest extends TestCase
	+{
	+ private $invitation;
	+
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function setUp(): void
	+ {
	+ parent::setUp();
	+
	+ Queue::fake();
	+
	+ $this->invitation = SI::create(['email' => 'SignupInvitationEmailTest@external.com']);
	+ }
	+
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function tearDown(): void
	+ {
	+ $this->invitation->delete();
	+ }
	+
	+ /**
	+ * Test job handle
	+ */
	+ public function testSignupInvitationEmailHandle(): void
	+ {
	+ Mail::fake();
	+
	+ // Assert that no jobs were pushed...
	+ Mail::assertNothingSent();
	+
	+ $job = new SignupInvitationEmail($this->invitation);
	+ $job->handle();
	+
	+ // Assert the email sending job was pushed once
	+ Mail::assertSent(SignupInvitation::class, 1);
	+
	+ // Assert the mail was sent to the code's email
	+ Mail::assertSent(SignupInvitation::class, function ($mail) {
	+ return $mail->hasTo($this->invitation->email);
	+ });
	+
	+ $this->assertTrue($this->invitation->isSent());
	+ }
	+
	+ /**
	+ * Test job failure handling
	+ */
	+ public function testSignupInvitationEmailFailure(): void
	+ {
	+ $this->markTestIncomplete();
	+ }
	+}
	diff --git a/src/tests/Feature/SignupInvitationTest.php b/src/tests/Feature/SignupInvitationTest.php
	new file mode 100644
	--- /dev/null
	+++ b/src/tests/Feature/SignupInvitationTest.php
	@@ -0,0 +1,118 @@
	+<?php
	+
	+namespace Tests\Feature;
	+
	+use App\SignupInvitation as SI;
	+use Illuminate\Support\Facades\Queue;
	+use Tests\TestCase;
	+
	+class SignupInvitationTest extends TestCase
	+{
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function setUp(): void
	+ {
	+ parent::setUp();
	+
	+ SI::truncate();
	+ }
	+
	+ /**
	+ * {@inheritDoc}
	+ */
	+ public function tearDown(): void
	+ {
	+ SI::truncate();
	+
	+ parent::tearDown();
	+ }
	+
	+ /**
	+ * Test SignupInvitation creation
	+ */
	+ public function testCreate(): void
	+ {
	+ Queue::fake();
	+
	+ $invitation = SI::create(['email' => 'test@domain.org']);
	+
	+ $this->assertSame('test@domain.org', $invitation->email);
	+ $this->assertSame(SI::STATUS_NEW, $invitation->status);
	+ $this->assertSame(\config('app.tenant_id'), $invitation->tenant_id);
	+ $this->assertTrue(preg_match('/^[a-f0-9-]{36}$/', $invitation->id) > 0);
	+
	+ Queue::assertPushed(\App\Jobs\SignupInvitationEmail::class, 1);
	+
	+ Queue::assertPushed(
	+ \App\Jobs\SignupInvitationEmail::class,
	+ function ($job) use ($invitation) {
	+ $inv = TestCase::getObjectProperty($job, 'invitation');
	+
	+ return $inv->id === $invitation->id && $inv->email === $invitation->email;
	+ }
	+ );
	+
	+ $inst = SI::find($invitation->id);
	+
	+ $this->assertInstanceOf(SI::class, $inst);
	+ $this->assertSame($inst->id, $invitation->id);
	+ $this->assertSame($inst->email, $invitation->email);
	+ }
	+
	+ /**
	+ * Test SignupInvitation update
	+ */
	+ public function testUpdate(): void
	+ {
	+ Queue::fake();
	+
	+ $invitation = SI::create(['email' => 'test@domain.org']);
	+
	+ Queue::fake();
	+
	+ // Test that these status changes do not dispatch the email sending job
	+ foreach ([SI::STATUS_FAILED, SI::STATUS_SENT, SI::STATUS_COMPLETED, SI::STATUS_NEW] as $status) {
	+ $invitation->status = $status;
	+ $invitation->save();
	+ }
	+
	+ Queue::assertNothingPushed();
	+
	+ // SENT -> NEW should resend the invitation
	+ SI::where('id', $invitation->id)->update(['status' => SI::STATUS_SENT]);
	+ $invitation->refresh();
	+ $invitation->status = SI::STATUS_NEW;
	+ $invitation->save();
	+
	+ Queue::assertPushed(\App\Jobs\SignupInvitationEmail::class, 1);
	+
	+ Queue::assertPushed(
	+ \App\Jobs\SignupInvitationEmail::class,
	+ function ($job) use ($invitation) {
	+ $inv = TestCase::getObjectProperty($job, 'invitation');
	+
	+ return $inv->id === $invitation->id && $inv->email === $invitation->email;
	+ }
	+ );
	+
	+ Queue::fake();
	+
	+ // FAILED -> NEW should resend the invitation
	+ SI::where('id', $invitation->id)->update(['status' => SI::STATUS_FAILED]);
	+ $invitation->refresh();
	+ $invitation->status = SI::STATUS_NEW;
	+ $invitation->save();
	+
	+ Queue::assertPushed(\App\Jobs\SignupInvitationEmail::class, 1);
	+
	+ Queue::assertPushed(
	+ \App\Jobs\SignupInvitationEmail::class,
	+ function ($job) use ($invitation) {
	+ $inv = TestCase::getObjectProperty($job, 'invitation');
	+
	+ return $inv->id === $invitation->id && $inv->email === $invitation->email;
	+ }
	+ );
	+ }
	+}
	diff --git a/src/tests/Feature/UserTest.php b/src/tests/Feature/UserTest.php
	--- a/src/tests/Feature/UserTest.php
	+++ b/src/tests/Feature/UserTest.php
	@@ -84,14 +84,144 @@
	$this->markTestIncomplete();
	}

	+ /**
	+ * Test User::canRead() method
	+ */
	public function testCanRead(): void
	{
	- $this->markTestIncomplete();
	+ $john = $this->getTestUser('john@kolab.org');
	+ $ned = $this->getTestUser('ned@kolab.org');
	+ $jack = $this->getTestUser('jack@kolab.org');
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $domain = $this->getTestDomain('kolab.org');
	+
	+ // Admin
	+ $this->assertTrue($admin->canRead($admin));
	+ $this->assertTrue($admin->canRead($john));
	+ $this->assertTrue($admin->canRead($jack));
	+ $this->assertTrue($admin->canRead($reseller1));
	+ $this->assertTrue($admin->canRead($reseller2));
	+ $this->assertTrue($admin->canRead($domain));
	+ $this->assertTrue($admin->canRead($domain->wallet()));
	+
	+ // Reseller - kolabnow
	+ $this->assertTrue($reseller1->canRead($john));
	+ $this->assertTrue($reseller1->canRead($jack));
	+ $this->assertTrue($reseller1->canRead($reseller1));
	+ $this->assertTrue($reseller1->canRead($domain));
	+ $this->assertTrue($reseller1->canRead($domain->wallet()));
	+ $this->assertFalse($reseller1->canRead($reseller2));
	+ $this->assertFalse($reseller1->canRead($admin));
	+
	+ // Reseller - different tenant
	+ $this->assertTrue($reseller2->canRead($reseller2));
	+ $this->assertFalse($reseller2->canRead($john));
	+ $this->assertFalse($reseller2->canRead($jack));
	+ $this->assertFalse($reseller2->canRead($reseller1));
	+ $this->assertFalse($reseller2->canRead($domain));
	+ $this->assertFalse($reseller2->canRead($domain->wallet()));
	+ $this->assertFalse($reseller2->canRead($admin));
	+
	+ // Normal user - account owner
	+ $this->assertTrue($john->canRead($john));
	+ $this->assertTrue($john->canRead($ned));
	+ $this->assertTrue($john->canRead($jack));
	+ $this->assertTrue($john->canRead($domain));
	+ $this->assertTrue($john->canRead($domain->wallet()));
	+ $this->assertFalse($john->canRead($reseller1));
	+ $this->assertFalse($john->canRead($reseller2));
	+ $this->assertFalse($john->canRead($admin));
	+
	+ // Normal user - a non-owner and non-controller
	+ $this->assertTrue($jack->canRead($jack));
	+ $this->assertFalse($jack->canRead($john));
	+ $this->assertFalse($jack->canRead($domain));
	+ $this->assertFalse($jack->canRead($domain->wallet()));
	+ $this->assertFalse($jack->canRead($reseller1));
	+ $this->assertFalse($jack->canRead($reseller2));
	+ $this->assertFalse($jack->canRead($admin));
	+
	+ // Normal user - John's wallet controller
	+ $this->assertTrue($ned->canRead($ned));
	+ $this->assertTrue($ned->canRead($john));
	+ $this->assertTrue($ned->canRead($jack));
	+ $this->assertTrue($ned->canRead($domain));
	+ $this->assertTrue($ned->canRead($domain->wallet()));
	+ $this->assertFalse($ned->canRead($reseller1));
	+ $this->assertFalse($ned->canRead($reseller2));
	+ $this->assertFalse($ned->canRead($admin));
	}

	+ /**
	+ * Test User::canUpdate() method
	+ */
	public function testCanUpdate(): void
	{
	- $this->markTestIncomplete();
	+ $john = $this->getTestUser('john@kolab.org');
	+ $ned = $this->getTestUser('ned@kolab.org');
	+ $jack = $this->getTestUser('jack@kolab.org');
	+ $reseller1 = $this->getTestUser('reseller@kolabnow.com');
	+ $reseller2 = $this->getTestUser('reseller@reseller.com');
	+ $admin = $this->getTestUser('jeroen@jeroen.jeroen');
	+ $domain = $this->getTestDomain('kolab.org');
	+
	+ // Admin
	+ $this->assertTrue($admin->canUpdate($admin));
	+ $this->assertTrue($admin->canUpdate($john));
	+ $this->assertTrue($admin->canUpdate($jack));
	+ $this->assertTrue($admin->canUpdate($reseller1));
	+ $this->assertTrue($admin->canUpdate($reseller2));
	+ $this->assertTrue($admin->canUpdate($domain));
	+ $this->assertTrue($admin->canUpdate($domain->wallet()));
	+
	+ // Reseller - kolabnow
	+ $this->assertTrue($reseller1->canUpdate($john));
	+ $this->assertTrue($reseller1->canUpdate($jack));
	+ $this->assertTrue($reseller1->canUpdate($reseller1));
	+ $this->assertTrue($reseller1->canUpdate($domain));
	+ $this->assertTrue($reseller1->canUpdate($domain->wallet()));
	+ $this->assertFalse($reseller1->canUpdate($reseller2));
	+ $this->assertFalse($reseller1->canUpdate($admin));
	+
	+ // Reseller - different tenant
	+ $this->assertTrue($reseller2->canUpdate($reseller2));
	+ $this->assertFalse($reseller2->canUpdate($john));
	+ $this->assertFalse($reseller2->canUpdate($jack));
	+ $this->assertFalse($reseller2->canUpdate($reseller1));
	+ $this->assertFalse($reseller2->canUpdate($domain));
	+ $this->assertFalse($reseller2->canUpdate($domain->wallet()));
	+ $this->assertFalse($reseller2->canUpdate($admin));
	+
	+ // Normal user - account owner
	+ $this->assertTrue($john->canUpdate($john));
	+ $this->assertTrue($john->canUpdate($ned));
	+ $this->assertTrue($john->canUpdate($jack));
	+ $this->assertTrue($john->canUpdate($domain));
	+ $this->assertFalse($john->canUpdate($domain->wallet()));
	+ $this->assertFalse($john->canUpdate($reseller1));
	+ $this->assertFalse($john->canUpdate($reseller2));
	+ $this->assertFalse($john->canUpdate($admin));
	+
	+ // Normal user - a non-owner and non-controller
	+ $this->assertTrue($jack->canUpdate($jack));
	+ $this->assertFalse($jack->canUpdate($john));
	+ $this->assertFalse($jack->canUpdate($domain));
	+ $this->assertFalse($jack->canUpdate($domain->wallet()));
	+ $this->assertFalse($jack->canUpdate($reseller1));
	+ $this->assertFalse($jack->canUpdate($reseller2));
	+ $this->assertFalse($jack->canUpdate($admin));
	+
	+ // Normal user - John's wallet controller
	+ $this->assertTrue($ned->canUpdate($ned));
	+ $this->assertTrue($ned->canUpdate($john));
	+ $this->assertTrue($ned->canUpdate($jack));
	+ $this->assertTrue($ned->canUpdate($domain));
	+ $this->assertFalse($ned->canUpdate($domain->wallet()));
	+ $this->assertFalse($ned->canUpdate($reseller1));
	+ $this->assertFalse($ned->canUpdate($reseller2));
	+ $this->assertFalse($ned->canUpdate($admin));
	}

	/**
	diff --git a/src/tests/TestCase.php b/src/tests/TestCase.php
	--- a/src/tests/TestCase.php
	+++ b/src/tests/TestCase.php
	@@ -33,4 +33,16 @@
	\config(['app.url' => str_replace('//', '//admin.', \config('app.url'))]);
	url()->forceRootUrl(config('app.url'));
	}
	+
	+ /**
	+ * Set baseURL to the reseller UI location
	+ */
	+ protected static function useResellerUrl(): void
	+ {
	+ // This will set base URL for all tests in a file.
	+ // If we wanted to access both user and admin in one test
	+ // we can also just call post/get/whatever with full url
	+ \config(['app.url' => str_replace('//', '//reseller.', \config('app.url'))]);
	+ url()->forceRootUrl(config('app.url'));
	+ }
	}
	diff --git a/src/tests/TestCaseDusk.php b/src/tests/TestCaseDusk.php
	--- a/src/tests/TestCaseDusk.php
	+++ b/src/tests/TestCaseDusk.php
	@@ -102,4 +102,15 @@
	// we can also just call visit() with full url
	Browser::$baseUrl = str_replace('//', '//admin.', \config('app.url'));
	}
	+
	+ /**
	+ * Set baseURL to the reseller UI location
	+ */
	+ protected static function useResellerUrl(): void
	+ {
	+ // This will set baseURL for all tests in this file
	+ // If we wanted to visit both user and admin in one test
	+ // we can also just call visit() with full url
	+ Browser::$baseUrl = str_replace('//', '//reseller.', \config('app.url'));
	+ }
	}
	diff --git a/src/tests/Unit/Mail/SignupInvitationTest.php b/src/tests/Unit/Mail/SignupInvitationTest.php
	new file mode 100644
	--- /dev/null
	+++ b/src/tests/Unit/Mail/SignupInvitationTest.php
	@@ -0,0 +1,44 @@
	+<?php
	+
	+namespace Tests\Unit\Mail;
	+
	+use App\Mail\SignupInvitation;
	+use App\SignupInvitation as SI;
	+use App\Utils;
	+use Tests\MailInterceptTrait;
	+use Tests\TestCase;
	+
	+class SignupInvitationTest extends TestCase
	+{
	+ use MailInterceptTrait;
	+
	+ /**
	+ * Test email content
	+ */
	+ public function testBuild(): void
	+ {
	+ $invitation = new SI([
	+ 'id' => 'abc',
	+ 'email' => 'test@email',
	+ ]);
	+
	+ $mail = $this->fakeMail(new SignupInvitation($invitation));
	+
	+ $html = $mail['html'];
	+ $plain = $mail['plain'];
	+
	+ $url = Utils::serviceUrl('/signup/invite/' . $invitation->id);
	+ $link = "<a href=\"$url\">$url</a>";
	+ $appName = \config('app.name');
	+
	+ $this->assertMailSubject("$appName Invitation", $mail['message']);
	+
	+ $this->assertStringStartsWith('<!DOCTYPE html>', $html);
	+ $this->assertTrue(strpos($html, $link) > 0);
	+ $this->assertTrue(strpos($html, "invited to join $appName") > 0);
	+
	+ $this->assertStringStartsWith("Hi,", $plain);
	+ $this->assertTrue(strpos($plain, "invited to join $appName") > 0);
	+ $this->assertTrue(strpos($plain, $url) > 0);
	+ }
	+}
	diff --git a/src/tests/Unit/SignupInvitationTest.php b/src/tests/Unit/SignupInvitationTest.php
	new file mode 100644
	--- /dev/null
	+++ b/src/tests/Unit/SignupInvitationTest.php
	@@ -0,0 +1,35 @@
	+<?php
	+
	+namespace Tests\Unit;
	+
	+use App\SignupInvitation;
	+use Tests\TestCase;
	+
	+class SignupInvitationTest extends TestCase
	+{
	+ /**
	+ * Test is*() methods
	+ *
	+ * @return void
	+ */
	+ public function testStatus()
	+ {
	+ $invitation = new SignupInvitation();
	+
	+ $statuses = [
	+ SignupInvitation::STATUS_NEW,
	+ SignupInvitation::STATUS_SENT,
	+ SignupInvitation::STATUS_FAILED,
	+ SignupInvitation::STATUS_COMPLETED,
	+ ];
	+
	+ foreach ($statuses as $status) {
	+ $invitation->status = $status;
	+
	+ $this->assertSame($status === SignupInvitation::STATUS_NEW, $invitation->isNew());
	+ $this->assertSame($status === SignupInvitation::STATUS_SENT, $invitation->isSent());
	+ $this->assertSame($status === SignupInvitation::STATUS_FAILED, $invitation->isFailed());
	+ $this->assertSame($status === SignupInvitation::STATUS_COMPLETED, $invitation->isCompleted());
	+ }
	+ }
	+}
	diff --git a/src/tests/data/email.csv b/src/tests/data/email.csv
	new file mode 100644
	--- /dev/null
	+++ b/src/tests/data/email.csv
	@@ -0,0 +1,2 @@
	+email1@test.com
	+email2@test.com
	diff --git a/src/tests/data/empty.csv b/src/tests/data/empty.csv
	new file mode 100644
	diff --git a/src/webpack.mix.js b/src/webpack.mix.js
	--- a/src/webpack.mix.js
	+++ b/src/webpack.mix.js
	@@ -22,13 +22,14 @@
	}
	})

	+mix.js('resources/js/user/app.js', 'public/js/user.js').vue()
	+ .js('resources/js/admin/app.js', 'public/js/admin.js').vue()
	+ .js('resources/js/reseller/app.js', 'public/js/reseller.js').vue()
	+
	mix.before(() => {
	spawn('php', ['resources/build/before.php'], { stdio: 'inherit' })
	})

	-mix.js('resources/js/user.js', 'public/js').vue()
	- .js('resources/js/admin.js', 'public/js').vue()
	-
	glob.sync('resources/themes/*/', {}).forEach(fromDir => {
	const toDir = fromDir.replace('resources/themes/', 'public/themes/')

File Metadata

Mime Type: text/plain
Expires: Fri, Apr 10, 8:05 AM (2 w, 6 d ago)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 18836514
Default Alt Text: D2446.1775808321.diff (359 KB)

D2446.1775808321.diffNo OneTemporaryActions

D2446.1775808321.diffView Options

File Metadata

Event Timeline

D2446.1775808321.diff
No OneTemporary
Actions

D2446.1775808321.diff
View Options