diff --git a/src/app/Console/Commands/Domain/SetWalletCommand.php b/src/app/Console/Commands/Domain/SetWalletCommand.php
index 54a26799..db426c2e 100644
--- a/src/app/Console/Commands/Domain/SetWalletCommand.php
+++ b/src/app/Console/Commands/Domain/SetWalletCommand.php
@@ -1,68 +1,68 @@
 <?php
 
 namespace App\Console\Commands\Domain;
 
 use App\Console\Command;
 use App\Entitlement;
 use App\Domain;
 use App\Sku;
 use Illuminate\Support\Facades\Queue;
 
 class SetWalletCommand extends Command
 {
     /**
      * The name and signature of the console command.
      *
      * @var string
      */
     protected $signature = 'domain:set-wallet {domain} {wallet}';
 
     /**
      * The console command description.
      *
      * @var string
      */
     protected $description = "Assign a domain to a wallet.";
 
     /**
      * Execute the console command.
      *
      * @return mixed
      */
     public function handle()
     {
         $domain = $this->getDomain($this->argument('domain'));
 
         if (!$domain) {
             $this->error("Domain not found.");
             return 1;
         }
 
         $wallet = $this->getWallet($this->argument('wallet'));
 
         if (!$wallet) {
             $this->error("Wallet not found.");
             return 1;
         }
 
-        if ($domain->entitlement) {
-            $this->error("Domain already assigned to a wallet: {$domain->entitlement->wallet->id}.");
+        if ($entitlement = $domain->entitlements()->first()) {
+            $this->error("Domain already assigned to a wallet: {$entitlement->wallet->id}.");
             return 1;
         }
 
         $sku = Sku::withObjectTenantContext($domain)->where('title', 'domain-hosting')->first();
 
         Queue::fake(); // ignore LDAP for now (note: adding entitlements updates the domain)
 
         Entitlement::create(
             [
                 'wallet_id' => $wallet->id,
                 'sku_id' => $sku->id,
                 'cost' => 0,
                 'fee' => 0,
                 'entitleable_id' => $domain->id,
                 'entitleable_type' => Domain::class,
             ]
         );
     }
 }
diff --git a/src/app/Domain.php b/src/app/Domain.php
index c428ac96..acb7d64b 100644
--- a/src/app/Domain.php
+++ b/src/app/Domain.php
@@ -1,542 +1,510 @@
 <?php
 
 namespace App;
 
 use App\Wallet;
-use App\Traits\UuidIntKeyTrait;
 use App\Traits\BelongsToTenantTrait;
 use App\Traits\DomainConfigTrait;
+use App\Traits\EntitleableTrait;
 use App\Traits\SettingsTrait;
+use App\Traits\UuidIntKeyTrait;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 /**
  * The eloquent definition of a Domain.
  *
  * @property string $namespace
  * @property int    $status
  * @property int    $tenant_id
  * @property int    $type
  */
 class Domain extends Model
 {
-    use UuidIntKeyTrait;
     use BelongsToTenantTrait;
     use DomainConfigTrait;
+    use EntitleableTrait;
     use SettingsTrait;
     use SoftDeletes;
+    use UuidIntKeyTrait;
 
     // we've simply never heard of this domain
     public const STATUS_NEW        = 1 << 0;
     // it's been activated
     public const STATUS_ACTIVE     = 1 << 1;
     // domain has been suspended.
     public const STATUS_SUSPENDED  = 1 << 2;
     // domain has been deleted
     public const STATUS_DELETED    = 1 << 3;
     // ownership of the domain has been confirmed
     public const STATUS_CONFIRMED  = 1 << 4;
     // domain has been verified that it exists in DNS
     public const STATUS_VERIFIED   = 1 << 5;
     // domain has been created in LDAP
     public const STATUS_LDAP_READY = 1 << 6;
 
     // open for public registration
     public const TYPE_PUBLIC       = 1 << 0;
     // zone hosted with us
     public const TYPE_HOSTED       = 1 << 1;
     // zone registered externally
     public const TYPE_EXTERNAL     = 1 << 2;
 
     public const HASH_CODE = 1;
     public const HASH_TEXT = 2;
     public const HASH_CNAME = 3;
 
     protected $fillable = [
         'namespace',
         'status',
         'type'
     ];
 
     /**
      * Assign a package to a domain. The domain should not belong to any existing entitlements.
      *
      * @param \App\Package $package The package to assign.
      * @param \App\User    $user    The wallet owner.
      *
      * @return \App\Domain Self
      */
     public function assignPackage($package, $user)
     {
         // If this domain is public it can not be assigned to a user.
         if ($this->isPublic()) {
             return $this;
         }
 
         // See if this domain is already owned by another user.
         $wallet = $this->wallet();
 
         if ($wallet) {
             \Log::error(
                 "Domain {$this->namespace} is already assigned to {$wallet->owner->email}"
             );
 
             return $this;
         }
 
         $wallet_id = $user->wallets()->first()->id;
 
         foreach ($package->skus as $sku) {
             for ($i = $sku->pivot->qty; $i > 0; $i--) {
                 \App\Entitlement::create(
                     [
                         'wallet_id' => $wallet_id,
                         'sku_id' => $sku->id,
                         'cost' => $sku->pivot->cost(),
                         'fee' => $sku->pivot->fee(),
                         'entitleable_id' => $this->id,
                         'entitleable_type' => Domain::class
                     ]
                 );
             }
         }
 
         return $this;
     }
 
-    /**
-     * The domain entitlement.
-     *
-     * @return \Illuminate\Database\Eloquent\Relations\MorphOne
-     */
-    public function entitlement()
-    {
-        return $this->morphOne('App\Entitlement', 'entitleable');
-    }
-
-    /**
-     * Entitlements for this domain.
-     *
-     * @return \Illuminate\Database\Eloquent\Relations\HasMany
-     */
-    public function entitlements()
-    {
-        return $this->hasMany('App\Entitlement', 'entitleable_id', 'id')
-            ->where('entitleable_type', Domain::class);
-    }
-
     /**
      * Return list of public+active domain names (for current tenant)
      */
     public static function getPublicDomains(): array
     {
         return self::withEnvTenantContext()
             ->whereRaw(sprintf('(type & %s)', Domain::TYPE_PUBLIC))
             ->get(['namespace'])->pluck('namespace')->toArray();
     }
 
     /**
      * Returns whether this domain is active.
      *
      * @return bool
      */
     public function isActive(): bool
     {
         return ($this->status & self::STATUS_ACTIVE) > 0;
     }
 
     /**
      * Returns whether this domain is confirmed the ownership of.
      *
      * @return bool
      */
     public function isConfirmed(): bool
     {
         return ($this->status & self::STATUS_CONFIRMED) > 0;
     }
 
     /**
      * Returns whether this domain is deleted.
      *
      * @return bool
      */
     public function isDeleted(): bool
     {
         return ($this->status & self::STATUS_DELETED) > 0;
     }
 
     /**
      * Returns whether this domain is registered with us.
      *
      * @return bool
      */
     public function isExternal(): bool
     {
         return ($this->type & self::TYPE_EXTERNAL) > 0;
     }
 
     /**
      * Returns whether this domain is hosted with us.
      *
      * @return bool
      */
     public function isHosted(): bool
     {
         return ($this->type & self::TYPE_HOSTED) > 0;
     }
 
     /**
      * Returns whether this domain is new.
      *
      * @return bool
      */
     public function isNew(): bool
     {
         return ($this->status & self::STATUS_NEW) > 0;
     }
 
     /**
      * Returns whether this domain is public.
      *
      * @return bool
      */
     public function isPublic(): bool
     {
         return ($this->type & self::TYPE_PUBLIC) > 0;
     }
 
     /**
      * Returns whether this domain is registered in LDAP.
      *
      * @return bool
      */
     public function isLdapReady(): bool
     {
         return ($this->status & self::STATUS_LDAP_READY) > 0;
     }
 
     /**
      * Returns whether this domain is suspended.
      *
      * @return bool
      */
     public function isSuspended(): bool
     {
         return ($this->status & self::STATUS_SUSPENDED) > 0;
     }
 
     /**
      * Returns whether this (external) domain has been verified
      * to exist in DNS.
      *
      * @return bool
      */
     public function isVerified(): bool
     {
         return ($this->status & self::STATUS_VERIFIED) > 0;
     }
 
     /**
      * Ensure the namespace is appropriately cased.
      */
     public function setNamespaceAttribute($namespace)
     {
         $this->attributes['namespace'] = strtolower($namespace);
     }
 
     /**
      * Domain status mutator
      *
      * @throws \Exception
      */
     public function setStatusAttribute($status)
     {
         $new_status = 0;
 
         $allowed_values = [
             self::STATUS_NEW,
             self::STATUS_ACTIVE,
             self::STATUS_SUSPENDED,
             self::STATUS_DELETED,
             self::STATUS_CONFIRMED,
             self::STATUS_VERIFIED,
             self::STATUS_LDAP_READY,
         ];
 
         foreach ($allowed_values as $value) {
             if ($status & $value) {
                 $new_status |= $value;
                 $status ^= $value;
             }
         }
 
         if ($status > 0) {
             throw new \Exception("Invalid domain status: {$status}");
         }
 
         if ($this->isPublic()) {
             $this->attributes['status'] = $new_status;
             return;
         }
 
         if ($new_status & self::STATUS_CONFIRMED) {
             // if we have confirmed ownership of or management access to the domain, then we have
             // also confirmed the domain exists in DNS.
             $new_status |= self::STATUS_VERIFIED;
             $new_status |= self::STATUS_ACTIVE;
         }
 
         if ($new_status & self::STATUS_DELETED && $new_status & self::STATUS_ACTIVE) {
             $new_status ^= self::STATUS_ACTIVE;
         }
 
         if ($new_status & self::STATUS_SUSPENDED && $new_status & self::STATUS_ACTIVE) {
             $new_status ^= self::STATUS_ACTIVE;
         }
 
         // if the domain is now active, it is not new anymore.
         if ($new_status & self::STATUS_ACTIVE && $new_status & self::STATUS_NEW) {
             $new_status ^= self::STATUS_NEW;
         }
 
         $this->attributes['status'] = $new_status;
     }
 
     /**
      * Ownership verification by checking for a TXT (or CNAME) record
      * in the domain's DNS (that matches the verification hash).
      *
      * @return bool True if verification was successful, false otherwise
      * @throws \Exception Throws exception on DNS or DB errors
      */
     public function confirm(): bool
     {
         if ($this->isConfirmed()) {
             return true;
         }
 
         $hash = $this->hash(self::HASH_TEXT);
         $confirmed = false;
 
         // Get DNS records and find a matching TXT entry
         $records = \dns_get_record($this->namespace, DNS_TXT);
 
         if ($records === false) {
             throw new \Exception("Failed to get DNS record for {$this->namespace}");
         }
 
         foreach ($records as $record) {
             if ($record['txt'] === $hash) {
                 $confirmed = true;
                 break;
             }
         }
 
         // Get DNS records and find a matching CNAME entry
         // Note: some servers resolve every non-existing name
         // so we need to define left and right side of the CNAME record
         // i.e.: kolab-verify IN CNAME <hash>.domain.tld.
         if (!$confirmed) {
             $cname = $this->hash(self::HASH_CODE) . '.' . $this->namespace;
             $records = \dns_get_record('kolab-verify.' . $this->namespace, DNS_CNAME);
 
             if ($records === false) {
                 throw new \Exception("Failed to get DNS record for {$this->namespace}");
             }
 
             foreach ($records as $records) {
                 if ($records['target'] === $cname) {
                     $confirmed = true;
                     break;
                 }
             }
         }
 
         if ($confirmed) {
             $this->status |= Domain::STATUS_CONFIRMED;
             $this->save();
         }
 
         return $confirmed;
     }
 
     /**
      * Generate a verification hash for this domain
      *
      * @param int $mod One of: HASH_CNAME, HASH_CODE (Default), HASH_TEXT
      *
      * @return string Verification hash
      */
     public function hash($mod = null): string
     {
         $cname = 'kolab-verify';
 
         if ($mod === self::HASH_CNAME) {
             return $cname;
         }
 
         $hash = \md5('hkccp-verify-' . $this->namespace);
 
         return $mod === self::HASH_TEXT ? "$cname=$hash" : $hash;
     }
 
     /**
      * Checks if there are any objects (users/aliases/groups) in a domain.
      * Note: Public domains are always reported not empty.
      *
      * @return bool True if there are no objects assigned, False otherwise
      */
     public function isEmpty(): bool
     {
         if ($this->isPublic()) {
             return false;
         }
 
         // FIXME: These queries will not use indexes, so maybe we should consider
         // wallet/entitlements to search in objects that belong to this domain account?
 
         $suffix = '@' . $this->namespace;
         $suffixLen = strlen($suffix);
 
         return !(
             \App\User::whereRaw('substr(email, ?) = ?', [-$suffixLen, $suffix])->exists()
             || \App\UserAlias::whereRaw('substr(alias, ?) = ?', [-$suffixLen, $suffix])->exists()
             || \App\Group::whereRaw('substr(email, ?) = ?', [-$suffixLen, $suffix])->exists()
         );
     }
 
     /**
      * Any (additional) properties of this domain.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function settings()
     {
         return $this->hasMany('App\DomainSetting', 'domain_id');
     }
 
     /**
      * Suspend this domain.
      *
      * @return void
      */
     public function suspend(): void
     {
         if ($this->isSuspended()) {
             return;
         }
 
         $this->status |= Domain::STATUS_SUSPENDED;
         $this->save();
     }
 
     /**
      * Unsuspend this domain.
      *
      * The domain is unsuspended through either of the following courses of actions;
      *
      *   * The account balance has been topped up, or
      *   * a suspected spammer has resolved their issues, or
      *   * the command-line is triggered.
      *
      * Therefore, we can also confidently set the domain status to 'active' should the ownership of or management
      * access to have been confirmed before.
      *
      * @return void
      */
     public function unsuspend(): void
     {
         if (!$this->isSuspended()) {
             return;
         }
 
         $this->status ^= Domain::STATUS_SUSPENDED;
 
         if ($this->isConfirmed() && $this->isVerified()) {
             $this->status |= Domain::STATUS_ACTIVE;
         }
 
         $this->save();
     }
 
     /**
      * List the users of a domain, so long as the domain is not a public registration domain.
      * Note: It returns only users with a mailbox.
      *
      * @return \App\User[] A list of users
      */
     public function users(): array
     {
         if ($this->isPublic()) {
             return [];
         }
 
         $wallet = $this->wallet();
 
         if (!$wallet) {
             return [];
         }
 
         $mailboxSKU = \App\Sku::withObjectTenantContext($this)->where('title', 'mailbox')->first();
 
         if (!$mailboxSKU) {
             \Log::error("No mailbox SKU available.");
             return [];
         }
 
         $entitlements = $wallet->entitlements()
             ->where('entitleable_type', \App\User::class)
             ->where('sku_id', $mailboxSKU->id)->get();
 
         $users = [];
 
         foreach ($entitlements as $entitlement) {
             $users[] = $entitlement->entitleable;
         }
 
         return $users;
     }
 
     /**
      * Verify if a domain exists in DNS
      *
      * @return bool True if registered, False otherwise
      * @throws \Exception Throws exception on DNS or DB errors
      */
     public function verify(): bool
     {
         if ($this->isVerified()) {
             return true;
         }
 
         $records = \dns_get_record($this->namespace, DNS_ANY);
 
         if ($records === false) {
             throw new \Exception("Failed to get DNS record for {$this->namespace}");
         }
 
         // It may happen that result contains other domains depending on the host DNS setup
         // that's why in_array() and not just !empty()
         if (in_array($this->namespace, array_column($records, 'host'))) {
             $this->status |= Domain::STATUS_VERIFIED;
             $this->save();
 
             return true;
         }
 
         return false;
     }
-
-    /**
-     * Returns the wallet by which the domain is controlled
-     *
-     * @return \App\Wallet A wallet object
-     */
-    public function wallet(): ?Wallet
-    {
-        // Note: Not all domains have a entitlement/wallet
-        $entitlement = $this->entitlement()->withTrashed()->orderBy('created_at', 'desc')->first();
-
-        return $entitlement ? $entitlement->wallet : null;
-    }
 }
diff --git a/src/app/Group.php b/src/app/Group.php
index 6a723053..cb2fbb07 100644
--- a/src/app/Group.php
+++ b/src/app/Group.php
@@ -1,282 +1,261 @@
 <?php
 
 namespace App;
 
 use App\Traits\BelongsToTenantTrait;
+use App\Traits\EntitleableTrait;
 use App\Traits\UuidIntKeyTrait;
 use App\Wallet;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 /**
  * The eloquent definition of a Group.
  *
  * @property int    $id        The group identifier
  * @property string $email     An email address
  * @property string $members   A comma-separated list of email addresses
  * @property int    $status    The group status
  * @property int    $tenant_id Tenant identifier
  */
 class Group extends Model
 {
     use BelongsToTenantTrait;
-    use UuidIntKeyTrait;
+    use EntitleableTrait;
     use SoftDeletes;
+    use UuidIntKeyTrait;
 
     // we've simply never heard of this domain
     public const STATUS_NEW        = 1 << 0;
     // it's been activated
     public const STATUS_ACTIVE     = 1 << 1;
     // domain has been suspended.
     public const STATUS_SUSPENDED  = 1 << 2;
     // domain has been deleted
     public const STATUS_DELETED    = 1 << 3;
     // domain has been created in LDAP
     public const STATUS_LDAP_READY = 1 << 4;
 
     protected $fillable = [
         'email',
         'status',
         'members'
     ];
 
     /**
      * Assign the group to a wallet.
      *
      * @param \App\Wallet $wallet The wallet
      *
      * @return \App\Group Self
      * @throws \Exception
      */
     public function assignToWallet(Wallet $wallet): Group
     {
         if (empty($this->id)) {
             throw new \Exception("Group not yet exists");
         }
 
-        if ($this->entitlement()->count()) {
+        if ($this->entitlements()->count()) {
             throw new \Exception("Group already assigned to a wallet");
         }
 
         $sku = \App\Sku::withObjectTenantContext($this)->where('title', 'group')->first();
         $exists = $wallet->entitlements()->where('sku_id', $sku->id)->count();
 
         \App\Entitlement::create([
             'wallet_id' => $wallet->id,
             'sku_id' => $sku->id,
             'cost' => $exists >= $sku->units_free ? $sku->cost : 0,
             'fee' => $exists >= $sku->units_free ? $sku->fee : 0,
             'entitleable_id' => $this->id,
             'entitleable_type' => Group::class
         ]);
 
         return $this;
     }
 
     /**
      * Returns group domain.
      *
      * @return ?\App\Domain The domain group belongs to, NULL if it does not exist
      */
     public function domain(): ?Domain
     {
         list($local, $domainName) = explode('@', $this->email);
 
         return Domain::where('namespace', $domainName)->first();
     }
 
     /**
      * Find whether an email address exists as a group (including deleted groups).
      *
      * @param string $email        Email address
      * @param bool   $return_group Return Group instance instead of boolean
      *
      * @return \App\Group|bool True or Group model object if found, False otherwise
      */
     public static function emailExists(string $email, bool $return_group = false)
     {
         if (strpos($email, '@') === false) {
             return false;
         }
 
         $email = \strtolower($email);
 
         $group = self::withTrashed()->where('email', $email)->first();
 
         if ($group) {
             return $return_group ? $group : true;
         }
 
         return false;
     }
 
-    /**
-     * The group entitlement.
-     *
-     * @return \Illuminate\Database\Eloquent\Relations\MorphOne
-     */
-    public function entitlement()
-    {
-        return $this->morphOne('App\Entitlement', 'entitleable');
-    }
-
     /**
      * Group members propert accessor. Converts internal comma-separated list into an array
      *
      * @param string $members Comma-separated list of email addresses
      *
      * @return array Email addresses of the group members, as an array
      */
     public function getMembersAttribute($members): array
     {
         return $members ? explode(',', $members) : [];
     }
 
     /**
      * Returns whether this domain is active.
      *
      * @return bool
      */
     public function isActive(): bool
     {
         return ($this->status & self::STATUS_ACTIVE) > 0;
     }
 
     /**
      * Returns whether this domain is deleted.
      *
      * @return bool
      */
     public function isDeleted(): bool
     {
         return ($this->status & self::STATUS_DELETED) > 0;
     }
 
     /**
      * Returns whether this domain is new.
      *
      * @return bool
      */
     public function isNew(): bool
     {
         return ($this->status & self::STATUS_NEW) > 0;
     }
 
     /**
      * Returns whether this domain is registered in LDAP.
      *
      * @return bool
      */
     public function isLdapReady(): bool
     {
         return ($this->status & self::STATUS_LDAP_READY) > 0;
     }
 
     /**
      * Returns whether this domain is suspended.
      *
      * @return bool
      */
     public function isSuspended(): bool
     {
         return ($this->status & self::STATUS_SUSPENDED) > 0;
     }
 
     /**
      * Ensure the email is appropriately cased.
      *
      * @param string $email Group email address
      */
     public function setEmailAttribute(string $email)
     {
         $this->attributes['email'] = strtolower($email);
     }
 
     /**
      * Ensure the members are appropriately formatted.
      *
      * @param array $members Email addresses of the group members
      */
     public function setMembersAttribute(array $members): void
     {
         $members = array_unique(array_filter(array_map('strtolower', $members)));
 
         sort($members);
 
         $this->attributes['members'] = implode(',', $members);
     }
 
     /**
      * Group status mutator
      *
      * @throws \Exception
      */
     public function setStatusAttribute($status)
     {
         $new_status = 0;
 
         $allowed_values = [
             self::STATUS_NEW,
             self::STATUS_ACTIVE,
             self::STATUS_SUSPENDED,
             self::STATUS_DELETED,
             self::STATUS_LDAP_READY,
         ];
 
         foreach ($allowed_values as $value) {
             if ($status & $value) {
                 $new_status |= $value;
                 $status ^= $value;
             }
         }
 
         if ($status > 0) {
             throw new \Exception("Invalid group status: {$status}");
         }
 
         $this->attributes['status'] = $new_status;
     }
 
     /**
      * Suspend this group.
      *
      * @return void
      */
     public function suspend(): void
     {
         if ($this->isSuspended()) {
             return;
         }
 
         $this->status |= Group::STATUS_SUSPENDED;
         $this->save();
     }
 
     /**
      * Unsuspend this group.
      *
      * @return void
      */
     public function unsuspend(): void
     {
         if (!$this->isSuspended()) {
             return;
         }
 
         $this->status ^= Group::STATUS_SUSPENDED;
         $this->save();
     }
-
-    /**
-     * Returns the wallet by which the group is controlled
-     *
-     * @return \App\Wallet A wallet object
-     */
-    public function wallet(): ?Wallet
-    {
-        // Note: Not all domains have a entitlement/wallet
-        $entitlement = $this->entitlement()->withTrashed()->orderBy('created_at', 'desc')->first();
-
-        return $entitlement ? $entitlement->wallet : null;
-    }
 }
diff --git a/src/app/Traits/EntitleableTrait.php b/src/app/Traits/EntitleableTrait.php
new file mode 100644
index 00000000..52e0deae
--- /dev/null
+++ b/src/app/Traits/EntitleableTrait.php
@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Traits;
+
+trait EntitleableTrait
+{
+    /**
+     * Entitlements for this object.
+     *
+     * @return \Illuminate\Database\Eloquent\Relations\HasMany
+     */
+    public function entitlements()
+    {
+        return $this->hasMany(\App\Entitlement::class, 'entitleable_id', 'id')
+            ->where('entitleable_type', self::class);
+    }
+
+    /**
+     * Returns the wallet by which the object is controlled
+     *
+     * @return ?\App\Wallet A wallet object
+     */
+    public function wallet(): ?\App\Wallet
+    {
+        $entitlement = $this->entitlements()->withTrashed()->orderBy('created_at', 'desc')->first();
+
+        if ($entitlement) {
+            return $entitlement->wallet;
+        }
+
+        // TODO: No entitlement should not happen, but in tests we have
+        //       such cases, so we fallback to the user's wallet in this case
+        if ($this instanceof \App\User) {
+            return $this->wallets()->first();
+        }
+
+        return null;
+    }
+}
diff --git a/src/app/User.php b/src/app/User.php
index 27e07edb..c1cd9600 100644
--- a/src/app/User.php
+++ b/src/app/User.php
@@ -1,902 +1,866 @@
 <?php
 
 namespace App;
 
 use App\Entitlement;
 use App\UserAlias;
 use App\Sku;
-use App\Traits\UuidIntKeyTrait;
 use App\Traits\BelongsToTenantTrait;
-use App\Traits\UserConfigTrait;
+use App\Traits\EntitleableTrait;
 use App\Traits\UserAliasesTrait;
+use App\Traits\UserConfigTrait;
+use App\Traits\UuidIntKeyTrait;
 use App\Traits\SettingsTrait;
 use App\Wallet;
 use Illuminate\Database\Eloquent\SoftDeletes;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Iatstuti\Database\Support\NullableFields;
 use Laravel\Passport\HasApiTokens;
 use League\OAuth2\Server\Exception\OAuthServerException;
 
 /**
  * The eloquent definition of a User.
  *
  * @property string $email
  * @property int    $id
  * @property string $password
  * @property int    $status
  * @property int    $tenant_id
  */
 class User extends Authenticatable
 {
-    use UuidIntKeyTrait;
     use BelongsToTenantTrait;
+    use EntitleableTrait;
+    use HasApiTokens;
     use NullableFields;
     use UserConfigTrait;
     use UserAliasesTrait;
+    use UuidIntKeyTrait;
     use SettingsTrait;
     use SoftDeletes;
-    use HasApiTokens;
 
     // a new user, default on creation
     public const STATUS_NEW        = 1 << 0;
     // it's been activated
     public const STATUS_ACTIVE     = 1 << 1;
     // user has been suspended
     public const STATUS_SUSPENDED  = 1 << 2;
     // user has been deleted
     public const STATUS_DELETED    = 1 << 3;
     // user has been created in LDAP
     public const STATUS_LDAP_READY = 1 << 4;
     // user mailbox has been created in IMAP
     public const STATUS_IMAP_READY = 1 << 5;
 
     /**
      * The attributes that are mass assignable.
      *
      * @var array
      */
     protected $fillable = [
         'id',
         'email',
         'password',
         'password_ldap',
         'status',
     ];
 
     /**
      * The attributes that should be hidden for arrays.
      *
      * @var array
      */
     protected $hidden = [
         'password',
         'password_ldap',
         'role'
     ];
 
     protected $nullable = [
         'password',
         'password_ldap'
     ];
 
     /**
      * Any wallets on which this user is a controller.
      *
      * This does not include wallets owned by the user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
      */
     public function accounts()
     {
         return $this->belongsToMany(
             'App\Wallet',       // The foreign object definition
             'user_accounts',    // The table name
             'user_id',          // The local foreign key
             'wallet_id'         // The remote foreign key
         );
     }
 
     /**
      * Email aliases of this user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function aliases()
     {
         return $this->hasMany('App\UserAlias', 'user_id');
     }
 
     /**
      * Assign a package to a user. The user should not have any existing entitlements.
      *
      * @param \App\Package   $package The package to assign.
      * @param \App\User|null $user    Assign the package to another user.
      *
      * @return \App\User
      */
     public function assignPackage($package, $user = null)
     {
         if (!$user) {
             $user = $this;
         }
 
         $wallet_id = $this->wallets()->first()->id;
 
         foreach ($package->skus as $sku) {
             for ($i = $sku->pivot->qty; $i > 0; $i--) {
                 \App\Entitlement::create(
                     [
                         'wallet_id' => $wallet_id,
                         'sku_id' => $sku->id,
                         'cost' => $sku->pivot->cost(),
                         'fee' => $sku->pivot->fee(),
                         'entitleable_id' => $user->id,
                         'entitleable_type' => User::class
                     ]
                 );
             }
         }
 
         return $user;
     }
 
     /**
      * Assign a package plan to a user.
      *
      * @param \App\Plan   $plan   The plan to assign
      * @param \App\Domain $domain Optional domain object
      *
      * @return \App\User Self
      */
     public function assignPlan($plan, $domain = null): User
     {
         $this->setSetting('plan_id', $plan->id);
 
         foreach ($plan->packages as $package) {
             if ($package->isDomain()) {
                 $domain->assignPackage($package, $this);
             } else {
                 $this->assignPackage($package);
             }
         }
 
         return $this;
     }
 
     /**
      * Assign a Sku to a user.
      *
      * @param \App\Sku $sku   The sku to assign.
      * @param int      $count Count of entitlements to add
      *
      * @return \App\User Self
      * @throws \Exception
      */
     public function assignSku(Sku $sku, int $count = 1): User
     {
         // TODO: I guess wallet could be parametrized in future
         $wallet = $this->wallet();
         $exists = $this->entitlements()->where('sku_id', $sku->id)->count();
 
         while ($count > 0) {
             \App\Entitlement::create([
                 'wallet_id' => $wallet->id,
                 'sku_id' => $sku->id,
                 'cost' => $exists >= $sku->units_free ? $sku->cost : 0,
                 'fee' => $exists >= $sku->units_free ? $sku->fee : 0,
                 'entitleable_id' => $this->id,
                 'entitleable_type' => User::class
             ]);
 
             $exists++;
             $count--;
         }
 
         return $this;
     }
 
     /**
      * Check if current user can delete another object.
      *
      * @param mixed $object A user|domain|wallet|group object
      *
      * @return bool True if he can, False otherwise
      */
     public function canDelete($object): bool
     {
         if (!method_exists($object, 'wallet')) {
             return false;
         }
 
         $wallet = $object->wallet();
 
         // TODO: For now controller can delete/update the account owner,
         //       this may change in future, controllers are not 0-regression feature
 
-        return $this->wallets->contains($wallet) || $this->accounts->contains($wallet);
+        return $wallet && ($wallet->user_id == $this->id || $this->accounts->contains($wallet));
     }
 
     /**
      * Check if current user can read data of another object.
      *
      * @param mixed $object A user|domain|wallet|group object
      *
      * @return bool True if he can, False otherwise
      */
     public function canRead($object): bool
     {
         if ($this->role == 'admin') {
             return true;
         }
 
         if ($object instanceof User && $this->id == $object->id) {
             return true;
         }
 
         if ($this->role == 'reseller') {
             if ($object instanceof User && $object->role == 'admin') {
                 return false;
             }
 
             if ($object instanceof Wallet && !empty($object->owner)) {
                 $object = $object->owner;
             }
 
             return isset($object->tenant_id) && $object->tenant_id == $this->tenant_id;
         }
 
         if ($object instanceof Wallet) {
             return $object->user_id == $this->id || $object->controllers->contains($this);
         }
 
         if (!method_exists($object, 'wallet')) {
             return false;
         }
 
         $wallet = $object->wallet();
 
-        return $wallet && ($this->wallets->contains($wallet) || $this->accounts->contains($wallet));
+        return $wallet && ($wallet->user_id == $this->id || $this->accounts->contains($wallet));
     }
 
     /**
      * Check if current user can update data of another object.
      *
      * @param mixed $object A user|domain|wallet|group object
      *
      * @return bool True if he can, False otherwise
      */
     public function canUpdate($object): bool
     {
         if ($object instanceof User && $this->id == $object->id) {
             return true;
         }
 
         if ($this->role == 'admin') {
             return true;
         }
 
         if ($this->role == 'reseller') {
             if ($object instanceof User && $object->role == 'admin') {
                 return false;
             }
 
             if ($object instanceof Wallet && !empty($object->owner)) {
                 $object = $object->owner;
             }
 
             return isset($object->tenant_id) && $object->tenant_id == $this->tenant_id;
         }
 
         return $this->canDelete($object);
     }
 
     /**
      * Return the \App\Domain for this user.
      *
      * @return \App\Domain|null
      */
     public function domain()
     {
         list($local, $domainName) = explode('@', $this->email);
 
         $domain = \App\Domain::withTrashed()->where('namespace', $domainName)->first();
 
         return $domain;
     }
 
     /**
      * List the domains to which this user is entitled.
      * Note: Active public domains are also returned (for the user tenant).
      *
      * @return Domain[] List of Domain objects
      */
     public function domains(): array
     {
         if ($this->tenant_id) {
             $domains = Domain::where('tenant_id', $this->tenant_id);
         } else {
             $domains = Domain::withEnvTenantContext();
         }
 
         $domains = $domains->whereRaw(sprintf('(type & %s)', Domain::TYPE_PUBLIC))
             ->whereRaw(sprintf('(status & %s)', Domain::STATUS_ACTIVE))
             ->get()
             ->all();
 
         foreach ($this->wallets as $wallet) {
             $entitlements = $wallet->entitlements()->where('entitleable_type', Domain::class)->get();
             foreach ($entitlements as $entitlement) {
                 $domains[] = $entitlement->entitleable;
             }
         }
 
         foreach ($this->accounts as $wallet) {
             $entitlements = $wallet->entitlements()->where('entitleable_type', Domain::class)->get();
             foreach ($entitlements as $entitlement) {
                 $domains[] = $entitlement->entitleable;
             }
         }
 
         return $domains;
     }
 
-    /**
-     * The user entitlement.
-     *
-     * @return \Illuminate\Database\Eloquent\Relations\MorphOne
-     */
-    public function entitlement()
-    {
-        return $this->morphOne('App\Entitlement', 'entitleable');
-    }
-
-    /**
-     * Entitlements for this user.
-     *
-     * Note that these are entitlements that apply to the user account, and not entitlements that
-     * this user owns.
-     *
-     * @return \Illuminate\Database\Eloquent\Relations\HasMany
-     */
-    public function entitlements()
-    {
-        return $this->hasMany('App\Entitlement', 'entitleable_id', 'id')
-            ->where('entitleable_type', User::class);
-    }
-
     /**
      * Find whether an email address exists as a user (including deleted users).
      *
      * @param string $email       Email address
      * @param bool   $return_user Return User instance instead of boolean
      *
      * @return \App\User|bool True or User model object if found, False otherwise
      */
     public static function emailExists(string $email, bool $return_user = false)
     {
         if (strpos($email, '@') === false) {
             return false;
         }
 
         $email = \strtolower($email);
 
         $user = self::withTrashed()->where('email', $email)->first();
 
         if ($user) {
             return $return_user ? $user : true;
         }
 
         return false;
     }
 
     /**
      * Helper to find user by email address, whether it is
      * main email address, alias or an external email.
      *
      * If there's more than one alias NULL will be returned.
      *
      * @param string $email    Email address
      * @param bool   $external Search also for an external email
      *
      * @return \App\User|null User model object if found
      */
     public static function findByEmail(string $email, bool $external = false): ?User
     {
         if (strpos($email, '@') === false) {
             return null;
         }
 
         $email = \strtolower($email);
 
         $user = self::where('email', $email)->first();
 
         if ($user) {
             return $user;
         }
 
         $aliases = UserAlias::where('alias', $email)->get();
 
         if (count($aliases) == 1) {
             return $aliases->first()->user;
         }
 
         // TODO: External email
 
         return null;
     }
 
 
 
     /**
      * Return groups controlled by the current user.
      *
      * @param bool $with_accounts Include groups assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function groups($with_accounts = true)
     {
         $wallets = $this->wallets()->pluck('id')->all();
 
         if ($with_accounts) {
             $wallets = array_merge($wallets, $this->accounts()->pluck('wallet_id')->all());
         }
 
         return Group::select(['groups.*', 'entitlements.wallet_id'])
             ->distinct()
             ->join('entitlements', 'entitlements.entitleable_id', '=', 'groups.id')
             ->whereIn('entitlements.wallet_id', $wallets)
             ->where('entitlements.entitleable_type', Group::class);
     }
 
     /**
      * Check if user has an entitlement for the specified SKU.
      *
      * @param string $title The SKU title
      *
      * @return bool True if specified SKU entitlement exists
      */
     public function hasSku(string $title): bool
     {
         $sku = Sku::withObjectTenantContext($this)->where('title', $title)->first();
 
         if (!$sku) {
             return false;
         }
 
         return $this->entitlements()->where('sku_id', $sku->id)->count() > 0;
     }
 
     /**
      * Returns whether this domain is active.
      *
      * @return bool
      */
     public function isActive(): bool
     {
         return ($this->status & self::STATUS_ACTIVE) > 0;
     }
 
     /**
      * Returns whether this domain is deleted.
      *
      * @return bool
      */
     public function isDeleted(): bool
     {
         return ($this->status & self::STATUS_DELETED) > 0;
     }
 
     /**
      * Returns whether this (external) domain has been verified
      * to exist in DNS.
      *
      * @return bool
      */
     public function isImapReady(): bool
     {
         return ($this->status & self::STATUS_IMAP_READY) > 0;
     }
 
     /**
      * Returns whether this user is registered in LDAP.
      *
      * @return bool
      */
     public function isLdapReady(): bool
     {
         return ($this->status & self::STATUS_LDAP_READY) > 0;
     }
 
     /**
      * Returns whether this user is new.
      *
      * @return bool
      */
     public function isNew(): bool
     {
         return ($this->status & self::STATUS_NEW) > 0;
     }
 
     /**
      * Returns whether this domain is suspended.
      *
      * @return bool
      */
     public function isSuspended(): bool
     {
         return ($this->status & self::STATUS_SUSPENDED) > 0;
     }
 
     /**
      * A shortcut to get the user name.
      *
      * @param bool $fallback Return "<aa.name> User" if there's no name
      *
      * @return string Full user name
      */
     public function name(bool $fallback = false): string
     {
         $settings = $this->getSettings(['first_name', 'last_name']);
 
         $name = trim($settings['first_name'] . ' ' . $settings['last_name']);
 
         if (empty($name) && $fallback) {
             return trim(\trans('app.siteuser', ['site' => \App\Tenant::getConfig($this->tenant_id, 'app.name')]));
         }
 
         return $name;
     }
 
     /**
      * Remove a number of entitlements for the SKU.
      *
      * @param \App\Sku $sku   The SKU
      * @param int      $count The number of entitlements to remove
      *
      * @return User Self
      */
     public function removeSku(Sku $sku, int $count = 1): User
     {
         $entitlements = $this->entitlements()
             ->where('sku_id', $sku->id)
             ->orderBy('cost', 'desc')
             ->orderBy('created_at')
             ->get();
 
         $entitlements_count = count($entitlements);
 
         foreach ($entitlements as $entitlement) {
             if ($entitlements_count <= $sku->units_free) {
                 continue;
             }
 
             if ($count > 0) {
                 $entitlement->delete();
                 $entitlements_count--;
                 $count--;
             }
         }
 
         return $this;
     }
 
     public function senderPolicyFrameworkWhitelist($clientName)
     {
         $setting = $this->getSetting('spf_whitelist');
 
         if (!$setting) {
             return false;
         }
 
         $whitelist = json_decode($setting);
 
         $matchFound = false;
 
         foreach ($whitelist as $entry) {
             if (substr($entry, 0, 1) == '/') {
                 $match = preg_match($entry, $clientName);
 
                 if ($match) {
                     $matchFound = true;
                 }
 
                 continue;
             }
 
             if (substr($entry, 0, 1) == '.') {
                 if (substr($clientName, (-1 * strlen($entry))) == $entry) {
                     $matchFound = true;
                 }
 
                 continue;
             }
 
             if ($entry == $clientName) {
                 $matchFound = true;
                 continue;
             }
         }
 
         return $matchFound;
     }
 
     /**
      * Any (additional) properties of this user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function settings()
     {
         return $this->hasMany('App\UserSetting', 'user_id');
     }
 
     /**
      * Suspend this domain.
      *
      * @return void
      */
     public function suspend(): void
     {
         if ($this->isSuspended()) {
             return;
         }
 
         $this->status |= User::STATUS_SUSPENDED;
         $this->save();
     }
 
     /**
      * Unsuspend this domain.
      *
      * @return void
      */
     public function unsuspend(): void
     {
         if (!$this->isSuspended()) {
             return;
         }
 
         $this->status ^= User::STATUS_SUSPENDED;
         $this->save();
     }
 
     /**
      * Return users controlled by the current user.
      *
      * @param bool $with_accounts Include users assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function users($with_accounts = true)
     {
         $wallets = $this->wallets()->pluck('id')->all();
 
         if ($with_accounts) {
             $wallets = array_merge($wallets, $this->accounts()->pluck('wallet_id')->all());
         }
 
         return $this->select(['users.*', 'entitlements.wallet_id'])
             ->distinct()
             ->leftJoin('entitlements', 'entitlements.entitleable_id', '=', 'users.id')
             ->whereIn('entitlements.wallet_id', $wallets)
             ->where('entitlements.entitleable_type', User::class);
     }
 
     /**
      * Verification codes for this user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function verificationcodes()
     {
         return $this->hasMany('App\VerificationCode', 'user_id', 'id');
     }
 
-    /**
-     * Returns the wallet by which the user is controlled
-     *
-     * @return ?\App\Wallet A wallet object
-     */
-    public function wallet(): ?Wallet
-    {
-        $entitlement = $this->entitlement()->withTrashed()->orderBy('created_at', 'desc')->first();
-
-        // TODO: No entitlement should not happen, but in tests we have
-        //       such cases, so we fallback to the user's wallet in this case
-        return $entitlement ? $entitlement->wallet : $this->wallets()->first();
-    }
-
     /**
      * Wallets this user owns.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function wallets()
     {
         return $this->hasMany('App\Wallet');
     }
 
     /**
      * User password mutator
      *
      * @param string $password The password in plain text.
      *
      * @return void
      */
     public function setPasswordAttribute($password)
     {
         if (!empty($password)) {
             $this->attributes['password'] = bcrypt($password, [ "rounds" => 12 ]);
             $this->attributes['password_ldap'] = '{SSHA512}' . base64_encode(
                 pack('H*', hash('sha512', $password))
             );
         }
     }
 
     /**
      * User LDAP password mutator
      *
      * @param string $password The password in plain text.
      *
      * @return void
      */
     public function setPasswordLdapAttribute($password)
     {
         $this->setPasswordAttribute($password);
     }
 
     /**
      * User status mutator
      *
      * @throws \Exception
      */
     public function setStatusAttribute($status)
     {
         $new_status = 0;
 
         $allowed_values = [
             self::STATUS_NEW,
             self::STATUS_ACTIVE,
             self::STATUS_SUSPENDED,
             self::STATUS_DELETED,
             self::STATUS_LDAP_READY,
             self::STATUS_IMAP_READY,
         ];
 
         foreach ($allowed_values as $value) {
             if ($status & $value) {
                 $new_status |= $value;
                 $status ^= $value;
             }
         }
 
         if ($status > 0) {
             throw new \Exception("Invalid user status: {$status}");
         }
 
         $this->attributes['status'] = $new_status;
     }
 
     /**
      * Validate the user credentials
      *
      * @param string $username       The username.
      * @param string $password       The password in plain text.
      * @param bool   $updatePassword Store the password if currently empty
      *
      * @return bool true on success
      */
     public function validateCredentials(string $username, string $password, bool $updatePassword = true): bool
     {
         $authenticated = false;
 
         if ($this->email === \strtolower($username)) {
             if (!empty($this->password)) {
                 if (Hash::check($password, $this->password)) {
                     $authenticated = true;
                 }
             } elseif (!empty($this->password_ldap)) {
                 if (substr($this->password_ldap, 0, 6) == "{SSHA}") {
                     $salt = substr(base64_decode(substr($this->password_ldap, 6)), 20);
 
                     $hash = '{SSHA}' . base64_encode(
                         sha1($password . $salt, true) . $salt
                     );
 
                     if ($hash == $this->password_ldap) {
                         $authenticated = true;
                     }
                 } elseif (substr($this->password_ldap, 0, 9) == "{SSHA512}") {
                     $salt = substr(base64_decode(substr($this->password_ldap, 9)), 64);
 
                     $hash = '{SSHA512}' . base64_encode(
                         pack('H*', hash('sha512', $password . $salt)) . $salt
                     );
 
                     if ($hash == $this->password_ldap) {
                         $authenticated = true;
                     }
                 }
             } else {
                 \Log::error("Incomplete credentials for {$this->email}");
             }
         }
 
         if ($authenticated) {
             \Log::info("Successful authentication for {$this->email}");
 
             // TODO: update last login time
             if ($updatePassword && (empty($this->password) || empty($this->password_ldap))) {
                 $this->password = $password;
                 $this->save();
             }
         } else {
             // TODO: Try actual LDAP?
             \Log::info("Authentication failed for {$this->email}");
         }
 
         return $authenticated;
     }
 
     /**
      * Retrieve and authenticate a user
      *
      * @param string $username     The username.
      * @param string $password     The password in plain text.
      * @param string $secondFactor The second factor (secondfactor from current request is used as fallback).
      *
      * @return array ['user', 'reason', 'errorMessage']
      */
     public static function findAndAuthenticate($username, $password, $secondFactor = null): ?array
     {
         $user = User::where('email', $username)->first();
         if (!$user) {
             return ['reason' => 'notfound', 'errorMessage' => "User not found."];
         }
 
         if (!$user->validateCredentials($username, $password)) {
             return ['reason' => 'credentials', 'errorMessage' => "Invalid password."];
         }
 
 
 
         if (!$secondFactor) {
             // Check the request if there is a second factor provided
             // as fallback.
             $secondFactor = request()->secondfactor;
         }
 
         try {
             (new \App\Auth\SecondFactor($user))->validate($secondFactor);
         } catch (\Exception $e) {
             return ['reason' => 'secondfactor', 'errorMessage' => $e->getMessage()];
         }
 
         return ['user' => $user];
     }
 
     /**
      * Hook for passport
      *
      * @throws \Throwable
      *
      * @return \App\User User model object if found
      */
     public function findAndValidateForPassport($username, $password): User
     {
         $result = self::findAndAuthenticate($username, $password);
 
         if (isset($result['reason'])) {
             if ($result['reason'] == 'secondfactor') {
                 // This results in a json response of {'error': 'secondfactor', 'error_description': '$errorMessage'}
                 throw new OAuthServerException($result['errorMessage'], 6, 'secondfactor', 401);
             }
             throw OAuthServerException::invalidCredentials();
         }
         return $result['user'];
     }
 }
diff --git a/src/tests/Feature/Console/Domain/SetWalletTest.php b/src/tests/Feature/Console/Domain/SetWalletTest.php
index a7abc27f..36073d61 100644
--- a/src/tests/Feature/Console/Domain/SetWalletTest.php
+++ b/src/tests/Feature/Console/Domain/SetWalletTest.php
@@ -1,75 +1,75 @@
 <?php
 
 namespace Tests\Feature\Console\Domain;
 
 use Illuminate\Support\Facades\Queue;
 use Tests\TestCase;
 
 class SetWalletTest extends TestCase
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestDomain('domain-delete.com');
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestDomain('domain-delete.com');
 
         parent::tearDown();
     }
 
     /**
      * Test the command
      */
     public function testHandle(): void
     {
         Queue::fake();
 
         // Non-existing domain
         $code = \Artisan::call("domain:set-wallet unknown.org 12345");
         $output = trim(\Artisan::output());
         $this->assertSame(1, $code);
         $this->assertSame("Domain not found.", $output);
 
         $domain = $this->getTestDomain('domain-delete.com', [
                 'status' => \App\Domain::STATUS_NEW,
                 'type' => \App\Domain::TYPE_HOSTED,
         ]);
 
         // Non-existing wallet
         $code = \Artisan::call("domain:set-wallet domain-delete.com 12345");
         $output = trim(\Artisan::output());
         $this->assertSame(1, $code);
         $this->assertSame("Wallet not found.", $output);
 
         $john = $this->getTestUser('john@kolab.org');
         $wallet = $john->wallets->first();
 
         $code = \Artisan::call("domain:set-wallet domain-delete.com " . $wallet->id);
         $output = trim(\Artisan::output());
         $this->assertSame(0, $code);
         $this->assertSame('', $output);
 
         $domain->refresh();
-        $sku = \App\Sku::withObjectTenantContext($domain)
-            ->where('title', 'domain-hosting')->first();
+        $sku = \App\Sku::withObjectTenantContext($domain)->where('title', 'domain-hosting')->first();
+        $entitlement = $domain->entitlements()->first();
 
-        $this->assertSame($sku->id, $domain->entitlement->sku_id);
-        $this->assertSame($wallet->id, $domain->entitlement->wallet_id);
+        $this->assertSame($sku->id, $entitlement->sku_id);
+        $this->assertSame($wallet->id, $entitlement->wallet_id);
 
         // Already assigned to a wallet
         $code = \Artisan::call("domain:set-wallet domain-delete.com " . $wallet->id);
         $output = trim(\Artisan::output());
         $this->assertSame(1, $code);
         $this->assertSame("Domain already assigned to a wallet: {$wallet->id}.", $output);
     }
 }
diff --git a/src/tests/Feature/Console/OwnerSwapTest.php b/src/tests/Feature/Console/OwnerSwapTest.php
index 7b0b6bec..b9125850 100644
--- a/src/tests/Feature/Console/OwnerSwapTest.php
+++ b/src/tests/Feature/Console/OwnerSwapTest.php
@@ -1,142 +1,142 @@
 <?php
 
 namespace Tests\Feature\Console;
 
 use Illuminate\Support\Facades\Queue;
 use Tests\TestCase;
 
 class OwnerSwapTest extends TestCase
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('user1@owner-swap.com');
         $this->deleteTestUser('user2@owner-swap.com');
         $this->deleteTestDomain('owner-swap.com');
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser('user1@owner-swap.com');
         $this->deleteTestUser('user2@owner-swap.com');
         $this->deleteTestDomain('owner-swap.com');
 
         parent::tearDown();
     }
 
     /**
      * Test the command
      *
      * @group mollie
      */
     public function testHandle(): void
     {
         Queue::fake();
 
         // Create some sample account
         $owner = $this->getTestUser('user1@owner-swap.com');
         $user = $this->getTestUser('user2@owner-swap.com');
         $domain = $this->getTestDomain('owner-swap.com', [
                 'status' => \App\Domain::STATUS_NEW,
                 'type' => \App\Domain::TYPE_HOSTED,
         ]);
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $owner->assignPackage($package_kolab);
         $owner->assignPackage($package_kolab, $user);
         $domain->assignPackage($package_domain, $owner);
         $wallet = $owner->wallets()->first();
         $wallet->currency = 'USD';
         $wallet->balance = 100;
         $wallet->save();
         $wallet->setSetting('test', 'test');
         $target_wallet = $user->wallets()->first();
         $owner->created_at = \now()->subMonths(1);
         $owner->save();
 
         $entitlements = $wallet->entitlements()->orderBy('id')->pluck('id')->all();
         $this->assertCount(15, $entitlements);
         $this->assertSame(0, $target_wallet->entitlements()->count());
 
         $customer = $this->createMollieCustomer($wallet);
 
         // Non-existing target user
         $code = \Artisan::call("owner:swap user1@owner-swap.com unknown@unknown.org");
         $output = trim(\Artisan::output());
         $this->assertSame(1, $code);
         $this->assertSame("User not found.", $output);
 
         // The same user
         $code = \Artisan::call("owner:swap user1@owner-swap.com user1@owner-swap.com");
         $output = trim(\Artisan::output());
         $this->assertSame(1, $code);
         $this->assertSame("Users cannot be the same.", $output);
 
         // Success
         $code = \Artisan::call("owner:swap user1@owner-swap.com user2@owner-swap.com");
         $output = trim(\Artisan::output());
         $this->assertSame(0, $code);
         $this->assertSame("", $output);
 
         $user->refresh();
         $target_wallet->refresh();
         $target_entitlements = $target_wallet->entitlements()->orderBy('id')->pluck('id')->all();
 
         $this->assertSame($target_entitlements, $entitlements);
         $this->assertSame(0, $wallet->entitlements()->count());
         $this->assertSame($wallet->balance, $target_wallet->balance);
         $this->assertSame($wallet->currency, $target_wallet->currency);
         $this->assertTrue($user->created_at->toDateTimeString() === $owner->created_at->toDateTimeString());
         $this->assertSame('test', $target_wallet->getSetting('test'));
 
         $wallet->refresh();
         $this->assertSame(null, $wallet->getSetting('test'));
         $this->assertSame(0, $wallet->balance);
 
         $target_customer = $this->getMollieCustomer($target_wallet->getSetting('mollie_id'));
         $this->assertSame($customer->id, $target_customer->id);
         $this->assertTrue($customer->email != $target_customer->email);
         $this->assertSame($target_wallet->id . '@private.' . \config('app.domain'), $target_customer->email);
 
         // Test case when the target user does not belong to the same account
         $john = $this->getTestUser('john@kolab.org');
-        $owner->entitlement()->update(['wallet_id' => $john->wallets->first()->id]);
+        $owner->entitlements()->update(['wallet_id' => $john->wallets->first()->id]);
 
         $code = \Artisan::call("owner:swap user2@owner-swap.com user1@owner-swap.com");
         $output = trim(\Artisan::output());
         $this->assertSame(1, $code);
         $this->assertSame("The target user does not belong to the same account.", $output);
     }
 
     /**
      * Create a Mollie customer
      */
     private function createMollieCustomer($wallet)
     {
         $customer = mollie()->customers()->create([
                 'name'  => $wallet->owner->name(),
                 'email' => $wallet->id . '@private.' . \config('app.domain'),
         ]);
 
         $customer_id = $customer->id;
 
         $wallet->setSetting('mollie_id', $customer->id);
 
         return $customer;
     }
 
     /**
      * Get a Mollie customer
      */
     private function getMollieCustomer(string $mollie_id)
     {
         return mollie()->customers()->get($mollie_id);
     }
 }
diff --git a/src/tests/Feature/Controller/DomainsTest.php b/src/tests/Feature/Controller/DomainsTest.php
index bfc0ab10..82a9e824 100644
--- a/src/tests/Feature/Controller/DomainsTest.php
+++ b/src/tests/Feature/Controller/DomainsTest.php
@@ -1,555 +1,555 @@
 <?php
 
 namespace Tests\Feature\Controller;
 
 use App\Domain;
 use App\Entitlement;
 use App\Sku;
 use App\User;
 use App\Wallet;
 use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Str;
 use Tests\TestCase;
 
 class DomainsTest extends TestCase
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('test1@' . \config('app.domain'));
         $this->deleteTestUser('test2@' . \config('app.domain'));
         $this->deleteTestUser('test1@domainscontroller.com');
         $this->deleteTestDomain('domainscontroller.com');
     }
 
     public function tearDown(): void
     {
         $this->deleteTestUser('test1@' . \config('app.domain'));
         $this->deleteTestUser('test2@' . \config('app.domain'));
         $this->deleteTestUser('test1@domainscontroller.com');
         $this->deleteTestDomain('domainscontroller.com');
 
         $domain = $this->getTestDomain('kolab.org');
         $domain->settings()->whereIn('key', ['spf_whitelist'])->delete();
 
         parent::tearDown();
     }
 
     /**
      * Test domain confirm request
      */
     public function testConfirm(): void
     {
         Queue::fake();
 
         $sku_domain = Sku::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $user = $this->getTestUser('test1@domainscontroller.com');
         $domain = $this->getTestDomain('domainscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_EXTERNAL,
         ]);
 
         Entitlement::create([
                 'wallet_id' => $user->wallets()->first()->id,
                 'sku_id' => $sku_domain->id,
                 'entitleable_id' => $domain->id,
                 'entitleable_type' => Domain::class
         ]);
 
         $response = $this->actingAs($user)->get("api/v4/domains/{$domain->id}/confirm");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(2, $json);
         $this->assertEquals('error', $json['status']);
         $this->assertEquals('Domain ownership verification failed.', $json['message']);
 
         $domain->status |= Domain::STATUS_CONFIRMED;
         $domain->save();
 
         $response = $this->actingAs($user)->get("api/v4/domains/{$domain->id}/confirm");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals('success', $json['status']);
         $this->assertEquals('Domain verified successfully.', $json['message']);
         $this->assertTrue(is_array($json['statusInfo']));
 
         // Not authorized access
         $response = $this->actingAs($john)->get("api/v4/domains/{$domain->id}/confirm");
         $response->assertStatus(403);
 
         // Authorized access by additional account controller
         $domain = $this->getTestDomain('kolab.org');
         $response = $this->actingAs($ned)->get("api/v4/domains/{$domain->id}/confirm");
         $response->assertStatus(200);
     }
 
     /**
      * Test domain delete request (DELETE /api/v4/domains/<id>)
      */
     public function testDestroy(): void
     {
         Queue::fake();
 
         $sku_domain = Sku::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $john = $this->getTestUser('john@kolab.org');
         $johns_domain = $this->getTestDomain('kolab.org');
         $user1 = $this->getTestUser('test1@' . \config('app.domain'));
         $user2 = $this->getTestUser('test2@' . \config('app.domain'));
         $domain = $this->getTestDomain('domainscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_EXTERNAL,
         ]);
 
         Entitlement::create([
                 'wallet_id' => $user1->wallets()->first()->id,
                 'sku_id' => $sku_domain->id,
                 'entitleable_id' => $domain->id,
                 'entitleable_type' => Domain::class
         ]);
 
         // Not authorized access
         $response = $this->actingAs($john)->delete("api/v4/domains/{$domain->id}");
         $response->assertStatus(403);
 
         // Can't delete non-empty domain
         $response = $this->actingAs($john)->delete("api/v4/domains/{$johns_domain->id}");
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertCount(2, $json);
         $this->assertEquals('error', $json['status']);
         $this->assertEquals('Unable to delete a domain with assigned users or other objects.', $json['message']);
 
         // Successful deletion
         $response = $this->actingAs($user1)->delete("api/v4/domains/{$domain->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(2, $json);
         $this->assertEquals('success', $json['status']);
         $this->assertEquals('Domain deleted successfully.', $json['message']);
         $this->assertTrue($domain->fresh()->trashed());
 
         // Authorized access by additional account controller
         $this->deleteTestDomain('domainscontroller.com');
         $domain = $this->getTestDomain('domainscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_EXTERNAL,
         ]);
 
         Entitlement::create([
                 'wallet_id' => $user1->wallets()->first()->id,
                 'sku_id' => $sku_domain->id,
                 'entitleable_id' => $domain->id,
                 'entitleable_type' => Domain::class
         ]);
 
         $user1->wallets()->first()->addController($user2);
 
         $response = $this->actingAs($user2)->delete("api/v4/domains/{$domain->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
         $this->assertCount(2, $json);
         $this->assertEquals('success', $json['status']);
         $this->assertEquals('Domain deleted successfully.', $json['message']);
         $this->assertTrue($domain->fresh()->trashed());
     }
 
     /**
      * Test fetching domains list
      */
     public function testIndex(): void
     {
         // User with no domains
         $user = $this->getTestUser('test1@domainscontroller.com');
         $response = $this->actingAs($user)->get("api/v4/domains");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame([], $json);
 
         // User with custom domain(s)
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         $response = $this->actingAs($john)->get("api/v4/domains");
         $response->assertStatus(200);
 
         $json = $response->json();
         $this->assertCount(1, $json);
         $this->assertSame('kolab.org', $json[0]['namespace']);
         // Values below are tested by Unit tests
         $this->assertArrayHasKey('isConfirmed', $json[0]);
         $this->assertArrayHasKey('isDeleted', $json[0]);
         $this->assertArrayHasKey('isVerified', $json[0]);
         $this->assertArrayHasKey('isSuspended', $json[0]);
         $this->assertArrayHasKey('isActive', $json[0]);
         $this->assertArrayHasKey('isLdapReady', $json[0]);
 
         $response = $this->actingAs($ned)->get("api/v4/domains");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(1, $json);
         $this->assertSame('kolab.org', $json[0]['namespace']);
     }
 
     /**
      * Test domain config update (POST /api/v4/domains/<domain>/config)
      */
     public function testSetConfig(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $domain = $this->getTestDomain('kolab.org');
         $domain->setSetting('spf_whitelist', null);
 
         // Test unknown domain id
         $post = ['spf_whitelist' => []];
         $response = $this->actingAs($john)->post("/api/v4/domains/123/config", $post);
         $json = $response->json();
 
         $response->assertStatus(404);
 
         // Test access by user not being a wallet controller
         $post = ['spf_whitelist' => []];
         $response = $this->actingAs($jack)->post("/api/v4/domains/{$domain->id}/config", $post);
         $json = $response->json();
 
         $response->assertStatus(403);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Access denied", $json['message']);
         $this->assertCount(2, $json);
 
         // Test some invalid data
         $post = ['grey' => 1];
         $response = $this->actingAs($john)->post("/api/v4/domains/{$domain->id}/config", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertCount(1, $json['errors']);
         $this->assertSame('The requested configuration parameter is not supported.', $json['errors']['grey']);
 
         $this->assertNull($domain->fresh()->getSetting('spf_whitelist'));
 
         // Test some valid data
         $post = ['spf_whitelist' => ['.test.domain.com']];
         $response = $this->actingAs($john)->post("/api/v4/domains/{$domain->id}/config", $post);
 
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(2, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame('Domain settings updated successfully.', $json['message']);
 
         $expected = \json_encode($post['spf_whitelist']);
         $this->assertSame($expected, $domain->fresh()->getSetting('spf_whitelist'));
 
         // Test input validation
         $post = ['spf_whitelist' => ['aaa']];
         $response = $this->actingAs($john)->post("/api/v4/domains/{$domain->id}/config", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertCount(2, $json);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertSame(
             'The entry format is invalid. Expected a domain name starting with a dot.',
             $json['errors']['spf_whitelist'][0]
         );
 
         $this->assertSame($expected, $domain->fresh()->getSetting('spf_whitelist'));
     }
 
     /**
      * Test fetching domain info
      */
     public function testShow(): void
     {
         $sku_domain = Sku::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $user = $this->getTestUser('test1@domainscontroller.com');
         $domain = $this->getTestDomain('domainscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_EXTERNAL,
         ]);
 
         $discount = \App\Discount::withEnvTenantContext()->where('code', 'TEST')->first();
         $wallet = $user->wallet();
         $wallet->discount()->associate($discount);
         $wallet->save();
 
         Entitlement::create([
                 'wallet_id' => $user->wallets()->first()->id,
                 'sku_id' => $sku_domain->id,
                 'entitleable_id' => $domain->id,
                 'entitleable_type' => Domain::class
         ]);
 
         $response = $this->actingAs($user)->get("api/v4/domains/{$domain->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals($domain->id, $json['id']);
         $this->assertEquals($domain->namespace, $json['namespace']);
         $this->assertEquals($domain->status, $json['status']);
         $this->assertEquals($domain->type, $json['type']);
         $this->assertSame($domain->hash(Domain::HASH_TEXT), $json['hash_text']);
         $this->assertSame($domain->hash(Domain::HASH_CNAME), $json['hash_cname']);
         $this->assertSame($domain->hash(Domain::HASH_CODE), $json['hash_code']);
         $this->assertSame([], $json['config']['spf_whitelist']);
         $this->assertCount(4, $json['mx']);
         $this->assertTrue(strpos(implode("\n", $json['mx']), $domain->namespace) !== false);
         $this->assertCount(8, $json['dns']);
         $this->assertTrue(strpos(implode("\n", $json['dns']), $domain->namespace) !== false);
         $this->assertTrue(strpos(implode("\n", $json['dns']), $domain->hash()) !== false);
         $this->assertTrue(is_array($json['statusInfo']));
         // Values below are tested by Unit tests
         $this->assertArrayHasKey('isConfirmed', $json);
         $this->assertArrayHasKey('isDeleted', $json);
         $this->assertArrayHasKey('isVerified', $json);
         $this->assertArrayHasKey('isSuspended', $json);
         $this->assertArrayHasKey('isActive', $json);
         $this->assertArrayHasKey('isLdapReady', $json);
         $this->assertCount(1, $json['skus']);
         $this->assertSame(1, $json['skus'][$sku_domain->id]['count']);
         $this->assertSame([0], $json['skus'][$sku_domain->id]['costs']);
         $this->assertSame($wallet->id, $json['wallet']['id']);
         $this->assertSame($wallet->balance, $json['wallet']['balance']);
         $this->assertSame($wallet->currency, $json['wallet']['currency']);
         $this->assertSame($discount->discount, $json['wallet']['discount']);
         $this->assertSame($discount->description, $json['wallet']['discount_description']);
 
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
 
         // Not authorized - Other account domain
         $response = $this->actingAs($john)->get("api/v4/domains/{$domain->id}");
         $response->assertStatus(403);
 
         $domain = $this->getTestDomain('kolab.org');
 
         // Ned is an additional controller on kolab.org's wallet
         $response = $this->actingAs($ned)->get("api/v4/domains/{$domain->id}");
         $response->assertStatus(200);
 
         // Jack has no entitlement/control over kolab.org
         $response = $this->actingAs($jack)->get("api/v4/domains/{$domain->id}");
         $response->assertStatus(403);
     }
 
     /**
      * Test fetching domain status (GET /api/v4/domains/<domain-id>/status)
      * and forcing setup process update (?refresh=1)
      *
      * @group dns
      */
     public function testStatus(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $domain = $this->getTestDomain('kolab.org');
 
         // Test unauthorized access
         $response = $this->actingAs($jack)->get("/api/v4/domains/{$domain->id}/status");
         $response->assertStatus(403);
 
         $domain->status = Domain::STATUS_NEW | Domain::STATUS_ACTIVE | Domain::STATUS_LDAP_READY;
         $domain->save();
 
         // Get domain status
         $response = $this->actingAs($john)->get("/api/v4/domains/{$domain->id}/status");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertFalse($json['isVerified']);
         $this->assertFalse($json['isReady']);
         $this->assertCount(4, $json['process']);
         $this->assertSame('domain-verified', $json['process'][2]['label']);
         $this->assertSame(false, $json['process'][2]['state']);
         $this->assertTrue(empty($json['status']));
         $this->assertTrue(empty($json['message']));
 
         // Now "reboot" the process and verify the domain
         $response = $this->actingAs($john)->get("/api/v4/domains/{$domain->id}/status?refresh=1");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertTrue($json['isVerified']);
         $this->assertTrue($json['isReady']);
         $this->assertCount(4, $json['process']);
         $this->assertSame('domain-verified', $json['process'][2]['label']);
         $this->assertSame(true, $json['process'][2]['state']);
         $this->assertSame('domain-confirmed', $json['process'][3]['label']);
         $this->assertSame(true, $json['process'][3]['state']);
         $this->assertSame('success', $json['status']);
         $this->assertSame('Setup process finished successfully.', $json['message']);
 
         // TODO: Test completing all process steps
     }
 
     /**
      * Test domain creation (POST /api/v4/domains)
      */
     public function testStore(): void
     {
         Queue::fake();
 
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
 
         // Test empty request
         $response = $this->actingAs($john)->post("/api/v4/domains", []);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("The namespace field is required.", $json['errors']['namespace'][0]);
         $this->assertCount(1, $json['errors']);
         $this->assertCount(1, $json['errors']['namespace']);
         $this->assertCount(2, $json);
 
         // Test access by user not being a wallet controller
         $post = ['namespace' => 'domainscontroller.com'];
         $response = $this->actingAs($jack)->post("/api/v4/domains", $post);
         $json = $response->json();
 
         $response->assertStatus(403);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Access denied", $json['message']);
         $this->assertCount(2, $json);
 
         // Test some invalid data
         $post = ['namespace' => '--'];
         $response = $this->actingAs($john)->post("/api/v4/domains", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertSame('The specified domain is invalid.', $json['errors']['namespace'][0]);
         $this->assertCount(1, $json['errors']);
         $this->assertCount(1, $json['errors']['namespace']);
 
         // Test an existing domain
         $post = ['namespace' => 'kolab.org'];
         $response = $this->actingAs($john)->post("/api/v4/domains", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertSame('The specified domain is not available.', $json['errors']['namespace']);
 
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
 
         // Missing package
         $post = ['namespace' => 'domainscontroller.com'];
         $response = $this->actingAs($john)->post("/api/v4/domains", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Package is required.", $json['errors']['package']);
         $this->assertCount(2, $json);
 
         // Invalid package
         $post['package'] = $package_kolab->id;
         $response = $this->actingAs($john)->post("/api/v4/domains", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Invalid package selected.", $json['errors']['package']);
         $this->assertCount(2, $json);
 
         // Test full and valid data
         $post['package'] = $package_domain->id;
         $response = $this->actingAs($john)->post("/api/v4/domains", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("Domain created successfully.", $json['message']);
         $this->assertCount(2, $json);
 
         $domain = Domain::where('namespace', $post['namespace'])->first();
         $this->assertInstanceOf(Domain::class, $domain);
 
         // Assert the new domain entitlements
         $this->assertEntitlements($domain, ['domain-hosting']);
 
         // Assert the wallet to which the new domain should be assigned to
         $wallet = $domain->wallet();
         $this->assertSame($john->wallets->first()->id, $wallet->id);
 
         // Test re-creating a domain
         $domain->delete();
 
         $response = $this->actingAs($john)->post("/api/v4/domains", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("Domain created successfully.", $json['message']);
         $this->assertCount(2, $json);
 
         $domain = Domain::where('namespace', $post['namespace'])->first();
         $this->assertInstanceOf(Domain::class, $domain);
         $this->assertEntitlements($domain, ['domain-hosting']);
         $wallet = $domain->wallet();
         $this->assertSame($john->wallets->first()->id, $wallet->id);
 
         // Test creating a domain that is soft-deleted and belongs to another user
         $domain->delete();
-        $domain->entitlement()->withTrashed()->update(['wallet_id' => $jack->wallets->first()->id]);
+        $domain->entitlements()->withTrashed()->update(['wallet_id' => $jack->wallets->first()->id]);
 
         $response = $this->actingAs($john)->post("/api/v4/domains", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertSame('The specified domain is not available.', $json['errors']['namespace']);
 
         // Test acting as account controller (not owner)
 
         $this->markTestIncomplete();
     }
 }
diff --git a/src/tests/Feature/GroupTest.php b/src/tests/Feature/GroupTest.php
index dedf830e..9415eb85 100644
--- a/src/tests/Feature/GroupTest.php
+++ b/src/tests/Feature/GroupTest.php
@@ -1,266 +1,266 @@
 <?php
 
 namespace Tests\Feature;
 
 use App\Group;
 use Illuminate\Support\Facades\Queue;
 use Tests\TestCase;
 
 class GroupTest extends TestCase
 {
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('user-test@kolabnow.com');
         $this->deleteTestGroup('group-test@kolabnow.com');
     }
 
     public function tearDown(): void
     {
         $this->deleteTestUser('user-test@kolabnow.com');
         $this->deleteTestGroup('group-test@kolabnow.com');
 
         parent::tearDown();
     }
 
     /**
      * Tests for Group::assignToWallet()
      */
     public function testAssignToWallet(): void
     {
         $user = $this->getTestUser('user-test@kolabnow.com');
         $group = $this->getTestGroup('group-test@kolabnow.com');
 
         $result = $group->assignToWallet($user->wallets->first());
 
         $this->assertSame($group, $result);
-        $this->assertSame(1, $group->entitlement()->count());
+        $this->assertSame(1, $group->entitlements()->count());
 
         // Can't be done twice on the same group
         $this->expectException(\Exception::class);
         $result->assignToWallet($user->wallets->first());
     }
 
     /**
      * Test group status assignment and is*() methods
      */
     public function testStatus(): void
     {
         $group = new Group();
 
         $this->assertSame(false, $group->isNew());
         $this->assertSame(false, $group->isActive());
         $this->assertSame(false, $group->isDeleted());
         $this->assertSame(false, $group->isLdapReady());
         $this->assertSame(false, $group->isSuspended());
 
         $group->status = Group::STATUS_NEW;
 
         $this->assertSame(true, $group->isNew());
         $this->assertSame(false, $group->isActive());
         $this->assertSame(false, $group->isDeleted());
         $this->assertSame(false, $group->isLdapReady());
         $this->assertSame(false, $group->isSuspended());
 
         $group->status |= Group::STATUS_ACTIVE;
 
         $this->assertSame(true, $group->isNew());
         $this->assertSame(true, $group->isActive());
         $this->assertSame(false, $group->isDeleted());
         $this->assertSame(false, $group->isLdapReady());
         $this->assertSame(false, $group->isSuspended());
 
         $group->status |= Group::STATUS_LDAP_READY;
 
         $this->assertSame(true, $group->isNew());
         $this->assertSame(true, $group->isActive());
         $this->assertSame(false, $group->isDeleted());
         $this->assertSame(true, $group->isLdapReady());
         $this->assertSame(false, $group->isSuspended());
 
         $group->status |= Group::STATUS_DELETED;
 
         $this->assertSame(true, $group->isNew());
         $this->assertSame(true, $group->isActive());
         $this->assertSame(true, $group->isDeleted());
         $this->assertSame(true, $group->isLdapReady());
         $this->assertSame(false, $group->isSuspended());
 
         $group->status |= Group::STATUS_SUSPENDED;
 
         $this->assertSame(true, $group->isNew());
         $this->assertSame(true, $group->isActive());
         $this->assertSame(true, $group->isDeleted());
         $this->assertSame(true, $group->isLdapReady());
         $this->assertSame(true, $group->isSuspended());
 
         // Unknown status value
         $this->expectException(\Exception::class);
         $group->status = 111;
     }
 
     /**
      * Test creating a group
      */
     public function testCreate(): void
     {
         Queue::fake();
 
         $group = Group::create(['email' => 'GROUP-test@kolabnow.com']);
 
         $this->assertSame('group-test@kolabnow.com', $group->email);
         $this->assertMatchesRegularExpression('/^[0-9]{1,20}$/', $group->id);
         $this->assertSame([], $group->members);
         $this->assertTrue($group->isNew());
         $this->assertTrue($group->isActive());
 
         Queue::assertPushed(
             \App\Jobs\Group\CreateJob::class,
             function ($job) use ($group) {
                 $groupEmail = TestCase::getObjectProperty($job, 'groupEmail');
                 $groupId = TestCase::getObjectProperty($job, 'groupId');
 
                 return $groupEmail === $group->email
                     && $groupId === $group->id;
             }
         );
     }
 
     /**
      * Test group deletion and force-deletion
      */
     public function testDelete(): void
     {
         Queue::fake();
 
         $user = $this->getTestUser('user-test@kolabnow.com');
         $group = $this->getTestGroup('group-test@kolabnow.com');
         $group->assignToWallet($user->wallets->first());
 
         $entitlements = \App\Entitlement::where('entitleable_id', $group->id);
 
         $this->assertSame(1, $entitlements->count());
 
         $group->delete();
 
         $this->assertTrue($group->fresh()->trashed());
         $this->assertSame(0, $entitlements->count());
         $this->assertSame(1, $entitlements->withTrashed()->count());
 
         $group->forceDelete();
 
         $this->assertSame(0, $entitlements->withTrashed()->count());
         $this->assertCount(0, Group::withTrashed()->where('id', $group->id)->get());
 
         Queue::assertPushed(\App\Jobs\Group\DeleteJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\Group\DeleteJob::class,
             function ($job) use ($group) {
                 $groupEmail = TestCase::getObjectProperty($job, 'groupEmail');
                 $groupId = TestCase::getObjectProperty($job, 'groupId');
 
                 return $groupEmail === $group->email
                     && $groupId === $group->id;
             }
         );
     }
 
     /**
      * Tests for Group::emailExists()
      */
     public function testEmailExists(): void
     {
         Queue::fake();
 
         $group = $this->getTestGroup('group-test@kolabnow.com');
 
         $this->assertFalse(Group::emailExists('unknown@domain.tld'));
         $this->assertTrue(Group::emailExists($group->email));
 
         $result = Group::emailExists($group->email, true);
         $this->assertSame($result->id, $group->id);
 
         $group->delete();
 
         $this->assertTrue(Group::emailExists($group->email));
 
         $result = Group::emailExists($group->email, true);
         $this->assertSame($result->id, $group->id);
     }
 
     /**
      * Tests for Group::suspend()
      */
     public function testSuspend(): void
     {
         Queue::fake();
 
         $group = $this->getTestGroup('group-test@kolabnow.com');
         $group->suspend();
 
         $this->assertTrue($group->isSuspended());
 
         Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\Group\UpdateJob::class,
             function ($job) use ($group) {
                 $groupEmail = TestCase::getObjectProperty($job, 'groupEmail');
                 $groupId = TestCase::getObjectProperty($job, 'groupId');
 
                 return $groupEmail === $group->email
                     && $groupId === $group->id;
             }
         );
     }
 
     /**
      * Test updating a group
      */
     public function testUpdate(): void
     {
         Queue::fake();
 
         $group = $this->getTestGroup('group-test@kolabnow.com');
         $group->status |= Group::STATUS_DELETED;
         $group->save();
 
         Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\Group\UpdateJob::class,
             function ($job) use ($group) {
                 $groupEmail = TestCase::getObjectProperty($job, 'groupEmail');
                 $groupId = TestCase::getObjectProperty($job, 'groupId');
 
                 return $groupEmail === $group->email
                     && $groupId === $group->id;
             }
         );
     }
 
     /**
      * Tests for Group::unsuspend()
      */
     public function testUnsuspend(): void
     {
         Queue::fake();
 
         $group = $this->getTestGroup('group-test@kolabnow.com');
         $group->status = Group::STATUS_SUSPENDED;
         $group->unsuspend();
 
         $this->assertFalse($group->isSuspended());
 
         Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\Group\UpdateJob::class,
             function ($job) use ($group) {
                 $groupEmail = TestCase::getObjectProperty($job, 'groupEmail');
                 $groupId = TestCase::getObjectProperty($job, 'groupId');
 
                 return $groupEmail === $group->email
                     && $groupId === $group->id;
             }
         );
     }
 }