diff --git a/bin/phpstan b/bin/phpstan
index 3143812f..d7df8160 100755
--- a/bin/phpstan
+++ b/bin/phpstan
@@ -1,11 +1,11 @@
 #!/bin/bash
 
 cwd=$(dirname $0)
 
 pushd ${cwd}/../src/
 
-php -dmemory_limit=400M \
+php -dmemory_limit=500M \
     vendor/bin/phpstan \
     analyse
 
 popd
diff --git a/src/app/Console/Commands/DomainSetWallet.php b/src/app/Console/Commands/DomainSetWallet.php
index 9c528411..80ff84f2 100644
--- a/src/app/Console/Commands/DomainSetWallet.php
+++ b/src/app/Console/Commands/DomainSetWallet.php
@@ -1,68 +1,69 @@
 <?php
 
 namespace App\Console\Commands;
 
 use App\Entitlement;
 use App\Domain;
 use App\Sku;
 use App\Wallet;
 use Illuminate\Console\Command;
 use Illuminate\Support\Facades\Queue;
 
 class DomainSetWallet extends Command
 {
     /**
      * The name and signature of the console command.
      *
      * @var string
      */
     protected $signature = 'domain:set-wallet {domain} {wallet}';
 
     /**
      * The console command description.
      *
      * @var string
      */
     protected $description = "Assign a domain to a wallet.";
 
     /**
      * Execute the console command.
      *
      * @return mixed
      */
     public function handle()
     {
         $domain = Domain::where('namespace', $this->argument('domain'))->first();
 
         if (!$domain) {
             $this->error("Domain not found.");
             return 1;
         }
 
         $wallet = Wallet::find($this->argument('wallet'));
 
         if (!$wallet) {
             $this->error("Wallet not found.");
             return 1;
         }
 
         if ($domain->entitlement) {
             $this->error("Domain already assigned to a wallet: {$domain->entitlement->wallet->id}.");
             return 1;
         }
 
         $sku = Sku::where('title', 'domain-hosting')->first();
 
         Queue::fake(); // ignore LDAP for now (note: adding entitlements updates the domain)
 
         Entitlement::create(
             [
                 'wallet_id' => $wallet->id,
                 'sku_id' => $sku->id,
                 'cost' => 0,
+                'fee' => 0,
                 'entitleable_id' => $domain->id,
                 'entitleable_type' => Domain::class,
             ]
         );
     }
 }
diff --git a/src/app/Domain.php b/src/app/Domain.php
index 04fe820a..b71bc149 100644
--- a/src/app/Domain.php
+++ b/src/app/Domain.php
@@ -1,453 +1,454 @@
 <?php
 
 namespace App;
 
 use App\Wallet;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 /**
  * The eloquent definition of a Domain.
  *
  * @property string $namespace
  * @property int    $status
  * @property int    $tenant_id
  * @property int    $type
  */
 class Domain extends Model
 {
     use SoftDeletes;
 
     // we've simply never heard of this domain
     public const STATUS_NEW        = 1 << 0;
     // it's been activated
     public const STATUS_ACTIVE     = 1 << 1;
     // domain has been suspended.
     public const STATUS_SUSPENDED  = 1 << 2;
     // domain has been deleted
     public const STATUS_DELETED    = 1 << 3;
     // ownership of the domain has been confirmed
     public const STATUS_CONFIRMED  = 1 << 4;
     // domain has been verified that it exists in DNS
     public const STATUS_VERIFIED   = 1 << 5;
     // domain has been created in LDAP
     public const STATUS_LDAP_READY = 1 << 6;
 
     // open for public registration
     public const TYPE_PUBLIC       = 1 << 0;
     // zone hosted with us
     public const TYPE_HOSTED       = 1 << 1;
     // zone registered externally
     public const TYPE_EXTERNAL     = 1 << 2;
 
     public const HASH_CODE = 1;
     public const HASH_TEXT = 2;
     public const HASH_CNAME = 3;
 
     public $incrementing = false;
 
     protected $keyType = 'bigint';
 
     protected $fillable = [
         'namespace',
         'status',
         'type'
     ];
 
     /**
      * Assign a package to a domain. The domain should not belong to any existing entitlements.
      *
      * @param \App\Package $package The package to assign.
      * @param \App\User    $user    The wallet owner.
      *
      * @return \App\Domain Self
      */
     public function assignPackage($package, $user)
     {
         // If this domain is public it can not be assigned to a user.
         if ($this->isPublic()) {
             return $this;
         }
 
         // See if this domain is already owned by another user.
         $wallet = $this->wallet();
 
         if ($wallet) {
             \Log::error(
                 "Domain {$this->namespace} is already assigned to {$wallet->owner->email}"
             );
 
             return $this;
         }
 
         $wallet_id = $user->wallets()->first()->id;
 
         foreach ($package->skus as $sku) {
             for ($i = $sku->pivot->qty; $i > 0; $i--) {
                 \App\Entitlement::create(
                     [
                         'wallet_id' => $wallet_id,
                         'sku_id' => $sku->id,
                         'cost' => $sku->pivot->cost(),
+                        'fee' => $sku->pivot->fee(),
                         'entitleable_id' => $this->id,
                         'entitleable_type' => Domain::class
                     ]
                 );
             }
         }
 
         return $this;
     }
 
     /**
      * The domain entitlement.
      *
      * @return \Illuminate\Database\Eloquent\Relations\MorphOne
      */
     public function entitlement()
     {
         return $this->morphOne('App\Entitlement', 'entitleable');
     }
 
     /**
      * Return list of public+active domain names
      */
     public static function getPublicDomains(): array
     {
         $where = sprintf('(type & %s)', Domain::TYPE_PUBLIC);
 
         return self::whereRaw($where)->get(['namespace'])->pluck('namespace')->toArray();
     }
 
     /**
      * Returns whether this domain is active.
      *
      * @return bool
      */
     public function isActive(): bool
     {
         return ($this->status & self::STATUS_ACTIVE) > 0;
     }
 
     /**
      * Returns whether this domain is confirmed the ownership of.
      *
      * @return bool
      */
     public function isConfirmed(): bool
     {
         return ($this->status & self::STATUS_CONFIRMED) > 0;
     }
 
     /**
      * Returns whether this domain is deleted.
      *
      * @return bool
      */
     public function isDeleted(): bool
     {
         return ($this->status & self::STATUS_DELETED) > 0;
     }
 
     /**
      * Returns whether this domain is registered with us.
      *
      * @return bool
      */
     public function isExternal(): bool
     {
         return ($this->type & self::TYPE_EXTERNAL) > 0;
     }
 
     /**
      * Returns whether this domain is hosted with us.
      *
      * @return bool
      */
     public function isHosted(): bool
     {
         return ($this->type & self::TYPE_HOSTED) > 0;
     }
 
     /**
      * Returns whether this domain is new.
      *
      * @return bool
      */
     public function isNew(): bool
     {
         return ($this->status & self::STATUS_NEW) > 0;
     }
 
     /**
      * Returns whether this domain is public.
      *
      * @return bool
      */
     public function isPublic(): bool
     {
         return ($this->type & self::TYPE_PUBLIC) > 0;
     }
 
     /**
      * Returns whether this domain is registered in LDAP.
      *
      * @return bool
      */
     public function isLdapReady(): bool
     {
         return ($this->status & self::STATUS_LDAP_READY) > 0;
     }
 
     /**
      * Returns whether this domain is suspended.
      *
      * @return bool
      */
     public function isSuspended(): bool
     {
         return ($this->status & self::STATUS_SUSPENDED) > 0;
     }
 
     /**
      * Returns whether this (external) domain has been verified
      * to exist in DNS.
      *
      * @return bool
      */
     public function isVerified(): bool
     {
         return ($this->status & self::STATUS_VERIFIED) > 0;
     }
 
     /**
      * Ensure the namespace is appropriately cased.
      */
     public function setNamespaceAttribute($namespace)
     {
         $this->attributes['namespace'] = strtolower($namespace);
     }
 
     /**
      * Domain status mutator
      *
      * @throws \Exception
      */
     public function setStatusAttribute($status)
     {
         $new_status = 0;
 
         $allowed_values = [
             self::STATUS_NEW,
             self::STATUS_ACTIVE,
             self::STATUS_SUSPENDED,
             self::STATUS_DELETED,
             self::STATUS_CONFIRMED,
             self::STATUS_VERIFIED,
             self::STATUS_LDAP_READY,
         ];
 
         foreach ($allowed_values as $value) {
             if ($status & $value) {
                 $new_status |= $value;
                 $status ^= $value;
             }
         }
 
         if ($status > 0) {
             throw new \Exception("Invalid domain status: {$status}");
         }
 
         if ($this->isPublic()) {
             $this->attributes['status'] = $new_status;
             return;
         }
 
         if ($new_status & self::STATUS_CONFIRMED) {
             // if we have confirmed ownership of or management access to the domain, then we have
             // also confirmed the domain exists in DNS.
             $new_status |= self::STATUS_VERIFIED;
             $new_status |= self::STATUS_ACTIVE;
         }
 
         if ($new_status & self::STATUS_DELETED && $new_status & self::STATUS_ACTIVE) {
             $new_status ^= self::STATUS_ACTIVE;
         }
 
         if ($new_status & self::STATUS_SUSPENDED && $new_status & self::STATUS_ACTIVE) {
             $new_status ^= self::STATUS_ACTIVE;
         }
 
         // if the domain is now active, it is not new anymore.
         if ($new_status & self::STATUS_ACTIVE && $new_status & self::STATUS_NEW) {
             $new_status ^= self::STATUS_NEW;
         }
 
         $this->attributes['status'] = $new_status;
     }
 
     /**
      * Ownership verification by checking for a TXT (or CNAME) record
      * in the domain's DNS (that matches the verification hash).
      *
      * @return bool True if verification was successful, false otherwise
      * @throws \Exception Throws exception on DNS or DB errors
      */
     public function confirm(): bool
     {
         if ($this->isConfirmed()) {
             return true;
         }
 
         $hash = $this->hash(self::HASH_TEXT);
         $confirmed = false;
 
         // Get DNS records and find a matching TXT entry
         $records = \dns_get_record($this->namespace, DNS_TXT);
 
         if ($records === false) {
             throw new \Exception("Failed to get DNS record for {$this->namespace}");
         }
 
         foreach ($records as $record) {
             if ($record['txt'] === $hash) {
                 $confirmed = true;
                 break;
             }
         }
 
         // Get DNS records and find a matching CNAME entry
         // Note: some servers resolve every non-existing name
         // so we need to define left and right side of the CNAME record
         // i.e.: kolab-verify IN CNAME <hash>.domain.tld.
         if (!$confirmed) {
             $cname = $this->hash(self::HASH_CODE) . '.' . $this->namespace;
             $records = \dns_get_record('kolab-verify.' . $this->namespace, DNS_CNAME);
 
             if ($records === false) {
                 throw new \Exception("Failed to get DNS record for {$this->namespace}");
             }
 
             foreach ($records as $records) {
                 if ($records['target'] === $cname) {
                     $confirmed = true;
                     break;
                 }
             }
         }
 
         if ($confirmed) {
             $this->status |= Domain::STATUS_CONFIRMED;
             $this->save();
         }
 
         return $confirmed;
     }
 
     /**
      * Generate a verification hash for this domain
      *
      * @param int $mod One of: HASH_CNAME, HASH_CODE (Default), HASH_TEXT
      *
      * @return string Verification hash
      */
     public function hash($mod = null): string
     {
         $cname = 'kolab-verify';
 
         if ($mod === self::HASH_CNAME) {
             return $cname;
         }
 
         $hash = \md5('hkccp-verify-' . $this->namespace);
 
         return $mod === self::HASH_TEXT ? "$cname=$hash" : $hash;
     }
 
     /**
      * Suspend this domain.
      *
      * @return void
      */
     public function suspend(): void
     {
         if ($this->isSuspended()) {
             return;
         }
 
         $this->status |= Domain::STATUS_SUSPENDED;
         $this->save();
     }
 
     /**
      * Unsuspend this domain.
      *
      * The domain is unsuspended through either of the following courses of actions;
      *
      *   * The account balance has been topped up, or
      *   * a suspected spammer has resolved their issues, or
      *   * the command-line is triggered.
      *
      * Therefore, we can also confidently set the domain status to 'active' should the ownership of or management
      * access to have been confirmed before.
      *
      * @return void
      */
     public function unsuspend(): void
     {
         if (!$this->isSuspended()) {
             return;
         }
 
         $this->status ^= Domain::STATUS_SUSPENDED;
 
         if ($this->isConfirmed() && $this->isVerified()) {
             $this->status |= Domain::STATUS_ACTIVE;
         }
 
         $this->save();
     }
 
     /**
      * Verify if a domain exists in DNS
      *
      * @return bool True if registered, False otherwise
      * @throws \Exception Throws exception on DNS or DB errors
      */
     public function verify(): bool
     {
         if ($this->isVerified()) {
             return true;
         }
 
         $records = \dns_get_record($this->namespace, DNS_ANY);
 
         if ($records === false) {
             throw new \Exception("Failed to get DNS record for {$this->namespace}");
         }
 
         // It may happen that result contains other domains depending on the host DNS setup
         // that's why in_array() and not just !empty()
         if (in_array($this->namespace, array_column($records, 'host'))) {
             $this->status |= Domain::STATUS_VERIFIED;
             $this->save();
 
             return true;
         }
 
         return false;
     }
 
     /**
      * Returns the wallet by which the domain is controlled
      *
      * @return \App\Wallet A wallet object
      */
     public function wallet(): ?Wallet
     {
         // Note: Not all domains have a entitlement/wallet
         $entitlement = $this->entitlement()->withTrashed()->first();
 
         return $entitlement ? $entitlement->wallet : null;
     }
 }
diff --git a/src/app/Entitlement.php b/src/app/Entitlement.php
index 3ab2834b..494b7f2f 100644
--- a/src/app/Entitlement.php
+++ b/src/app/Entitlement.php
@@ -1,151 +1,161 @@
 <?php
 
 namespace App;
 
 use Carbon\Carbon;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 /**
  * The eloquent definition of an Entitlement.
  *
  * Owned by a {@link \App\User}, billed to a {@link \App\Wallet}.
  *
- * @property \App\User $owner                   The owner of this entitlement (subject).
- * @property \App\Sku $sku                      The SKU to which this entitlement applies.
- * @property \App\Wallet $wallet                The wallet to which this entitlement is charged.
- * @property \App\Domain|\App\User $entitleable The entitled object (receiver of the entitlement).
+ * @property int                   $cost
+ * @property ?string               $description
+ * @property \App\Domain|\App\User $entitleable      The entitled object (receiver of the entitlement).
+ * @property int                   $entitleable_id
+ * @property string                $entitleable_type
+ * @property int                   $fee
+ * @property string                $id
+ * @property \App\User             $owner            The owner of this entitlement (subject).
+ * @property \App\Sku              $sku              The SKU to which this entitlement applies.
+ * @property string                $sku_id
+ * @property \App\Wallet           $wallet           The wallet to which this entitlement is charged.
+ * @property string                $wallet_id
  */
 class Entitlement extends Model
 {
     use SoftDeletes;
 
     /**
      * This table does not use auto-increment.
      *
      * @var boolean
      */
     public $incrementing = false;
 
     /**
      * The key type is actually a string.
      *
      * @var string
      */
     protected $keyType = 'string';
 
     /**
      * The fillable columns for this Entitlement
      *
      * @var array
      */
     protected $fillable = [
         'sku_id',
         'wallet_id',
         'entitleable_id',
         'entitleable_type',
         'cost',
-        'description'
+        'description',
+        'fee',
     ];
 
     protected $casts = [
         'cost' => 'integer',
+        'fee' => 'integer'
     ];
 
     /**
      * Return the costs per day for this entitlement.
      *
      * @return float
      */
     public function costsPerDay()
     {
         if ($this->cost == 0) {
             return (float) 0;
         }
 
         $discount = $this->wallet->getDiscountRate();
 
         $daysInLastMonth = \App\Utils::daysInLastMonth();
 
         $costsPerDay = (float) ($this->cost * $discount) / $daysInLastMonth;
 
         return $costsPerDay;
     }
 
     /**
      * Create a transaction record for this entitlement.
      *
      * @param string $type The type of transaction ('created', 'billed', 'deleted'), but use the
      *                     \App\Transaction constants.
      * @param int $amount  The amount involved in cents
      *
      * @return string The transaction ID
      */
     public function createTransaction($type, $amount = null)
     {
         $transaction = \App\Transaction::create(
             [
                 'object_id' => $this->id,
                 'object_type' => \App\Entitlement::class,
                 'type' => $type,
                 'amount' => $amount
             ]
         );
 
         return $transaction->id;
     }
 
     /**
      * Principally entitleable objects such as 'Domain' or 'User'.
      *
      * @return mixed
      */
     public function entitleable()
     {
         return $this->morphTo();
     }
 
     /**
      * Returns entitleable object title (e.g. email or domain name).
      *
      * @return string|null An object title/name
      */
     public function entitleableTitle(): ?string
     {
         if ($this->entitleable instanceof \App\User) {
             return $this->entitleable->email;
         }
 
         if ($this->entitleable instanceof \App\Domain) {
             return $this->entitleable->namespace;
         }
     }
 
     /**
      * The SKU concerned.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function sku()
     {
         return $this->belongsTo('App\Sku');
     }
 
     /**
      * The wallet this entitlement is being billed to
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function wallet()
     {
         return $this->belongsTo('App\Wallet');
     }
 
     /**
      * Cost mutator. Make sure cost is integer.
      */
     public function setCostAttribute($cost): void
     {
         $this->attributes['cost'] = round($cost);
     }
 }
diff --git a/src/app/Group.php b/src/app/Group.php
index 5661f232..77115c3e 100644
--- a/src/app/Group.php
+++ b/src/app/Group.php
@@ -1,280 +1,281 @@
 <?php
 
 namespace App;
 
 use App\Wallet;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 /**
  * The eloquent definition of a Group.
  *
  * @property int    $id      The group identifier
  * @property string $email   An email address
  * @property string $members A comma-separated list of email addresses
  * @property int    $status  The group status
  */
 class Group extends Model
 {
     use SoftDeletes;
 
     // we've simply never heard of this domain
     public const STATUS_NEW        = 1 << 0;
     // it's been activated
     public const STATUS_ACTIVE     = 1 << 1;
     // domain has been suspended.
     public const STATUS_SUSPENDED  = 1 << 2;
     // domain has been deleted
     public const STATUS_DELETED    = 1 << 3;
     // domain has been created in LDAP
     public const STATUS_LDAP_READY = 1 << 4;
 
     public $incrementing = false;
 
     protected $keyType = 'bigint';
 
     protected $fillable = [
         'email',
         'status',
         'members'
     ];
 
     /**
      * Assign the group to a wallet.
      *
      * @param \App\Wallet $wallet The wallet
      *
      * @return \App\Group Self
      * @throws \Exception
      */
     public function assignToWallet(Wallet $wallet): Group
     {
         if (empty($this->id)) {
             throw new \Exception("Group not yet exists");
         }
 
         if ($this->entitlement()->count()) {
             throw new \Exception("Group already assigned to a wallet");
         }
 
         $sku = \App\Sku::where('title', 'group')->first();
         $exists = $wallet->entitlements()->where('sku_id', $sku->id)->count();
 
         \App\Entitlement::create([
             'wallet_id' => $wallet->id,
             'sku_id' => $sku->id,
             'cost' => $exists >= $sku->units_free ? $sku->cost : 0,
+            'fee' => $exists >= $sku->units_free ? $sku->fee : 0,
             'entitleable_id' => $this->id,
             'entitleable_type' => Group::class
         ]);
 
         return $this;
     }
 
     /**
      * Returns group domain.
      *
      * @return ?\App\Domain The domain group belongs to, NULL if it does not exist
      */
     public function domain(): ?Domain
     {
         list($local, $domainName) = explode('@', $this->email);
 
         return Domain::where('namespace', $domainName)->first();
     }
 
     /**
      * Find whether an email address exists as a group (including deleted groups).
      *
      * @param string $email        Email address
      * @param bool   $return_group Return Group instance instead of boolean
      *
      * @return \App\Group|bool True or Group model object if found, False otherwise
      */
     public static function emailExists(string $email, bool $return_group = false)
     {
         if (strpos($email, '@') === false) {
             return false;
         }
 
         $email = \strtolower($email);
 
         $group = self::withTrashed()->where('email', $email)->first();
 
         if ($group) {
             return $return_group ? $group : true;
         }
 
         return false;
     }
 
     /**
      * The group entitlement.
      *
      * @return \Illuminate\Database\Eloquent\Relations\MorphOne
      */
     public function entitlement()
     {
         return $this->morphOne('App\Entitlement', 'entitleable');
     }
 
     /**
      * Group members propert accessor. Converts internal comma-separated list into an array
      *
      * @param string $members Comma-separated list of email addresses
      *
      * @return array Email addresses of the group members, as an array
      */
     public function getMembersAttribute($members): array
     {
         return $members ? explode(',', $members) : [];
     }
 
     /**
      * Returns whether this domain is active.
      *
      * @return bool
      */
     public function isActive(): bool
     {
         return ($this->status & self::STATUS_ACTIVE) > 0;
     }
 
     /**
      * Returns whether this domain is deleted.
      *
      * @return bool
      */
     public function isDeleted(): bool
     {
         return ($this->status & self::STATUS_DELETED) > 0;
     }
 
     /**
      * Returns whether this domain is new.
      *
      * @return bool
      */
     public function isNew(): bool
     {
         return ($this->status & self::STATUS_NEW) > 0;
     }
 
     /**
      * Returns whether this domain is registered in LDAP.
      *
      * @return bool
      */
     public function isLdapReady(): bool
     {
         return ($this->status & self::STATUS_LDAP_READY) > 0;
     }
 
     /**
      * Returns whether this domain is suspended.
      *
      * @return bool
      */
     public function isSuspended(): bool
     {
         return ($this->status & self::STATUS_SUSPENDED) > 0;
     }
 
     /**
      * Ensure the email is appropriately cased.
      *
      * @param string $email Group email address
      */
     public function setEmailAttribute(string $email)
     {
         $this->attributes['email'] = strtolower($email);
     }
 
     /**
      * Ensure the members are appropriately formatted.
      *
      * @param array $members Email addresses of the group members
      */
     public function setMembersAttribute(array $members): void
     {
         $members = array_unique(array_filter(array_map('strtolower', $members)));
 
         sort($members);
 
         $this->attributes['members'] = implode(',', $members);
     }
 
     /**
      * Group status mutator
      *
      * @throws \Exception
      */
     public function setStatusAttribute($status)
     {
         $new_status = 0;
 
         $allowed_values = [
             self::STATUS_NEW,
             self::STATUS_ACTIVE,
             self::STATUS_SUSPENDED,
             self::STATUS_DELETED,
             self::STATUS_LDAP_READY,
         ];
 
         foreach ($allowed_values as $value) {
             if ($status & $value) {
                 $new_status |= $value;
                 $status ^= $value;
             }
         }
 
         if ($status > 0) {
             throw new \Exception("Invalid group status: {$status}");
         }
 
         $this->attributes['status'] = $new_status;
     }
 
     /**
      * Suspend this group.
      *
      * @return void
      */
     public function suspend(): void
     {
         if ($this->isSuspended()) {
             return;
         }
 
         $this->status |= Group::STATUS_SUSPENDED;
         $this->save();
     }
 
     /**
      * Unsuspend this group.
      *
      * @return void
      */
     public function unsuspend(): void
     {
         if (!$this->isSuspended()) {
             return;
         }
 
         $this->status ^= Group::STATUS_SUSPENDED;
         $this->save();
     }
 
     /**
      * Returns the wallet by which the group is controlled
      *
      * @return \App\Wallet A wallet object
      */
     public function wallet(): ?Wallet
     {
         // Note: Not all domains have a entitlement/wallet
         $entitlement = $this->entitlement()->withTrashed()->first();
 
         return $entitlement ? $entitlement->wallet : null;
     }
 }
diff --git a/src/app/Http/Controllers/API/V4/Admin/WalletsController.php b/src/app/Http/Controllers/API/V4/Admin/WalletsController.php
index 70e3cfae..10164a85 100644
--- a/src/app/Http/Controllers/API/V4/Admin/WalletsController.php
+++ b/src/app/Http/Controllers/API/V4/Admin/WalletsController.php
@@ -1,149 +1,158 @@
 <?php
 
 namespace App\Http\Controllers\API\V4\Admin;
 
 use App\Discount;
 use App\Http\Controllers\API\V4\PaymentsController;
 use App\Providers\PaymentProvider;
 use App\Transaction;
 use App\Wallet;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Validator;
 
 class WalletsController extends \App\Http\Controllers\API\V4\WalletsController
 {
     /**
      * Return data of the specified wallet.
      *
      * @param string $id A wallet identifier
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function show($id)
     {
         $wallet = Wallet::find($id);
 
         if (empty($wallet) || !Auth::guard()->user()->canRead($wallet)) {
             return $this->errorResponse(404);
         }
 
         $result = $wallet->toArray();
 
         $result['discount'] = 0;
         $result['discount_description'] = '';
 
         if ($wallet->discount) {
             $result['discount'] = $wallet->discount->discount;
             $result['discount_description'] = $wallet->discount->description;
         }
 
         $result['mandate'] = PaymentsController::walletMandate($wallet);
 
         $provider = PaymentProvider::factory($wallet);
 
         $result['provider'] = $provider->name();
         $result['providerLink'] = $provider->customerLink($wallet);
 
         return response()->json($result);
     }
 
     /**
      * Award/penalize a wallet.
      *
      * @param \Illuminate\Http\Request $request The API request.
      * @param string                   $id      Wallet identifier
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function oneOff(Request $request, $id)
     {
         $wallet = Wallet::find($id);
+        $user = Auth::guard()->user();
 
-        if (empty($wallet) || !Auth::guard()->user()->canRead($wallet)) {
+        if (empty($wallet) || !$user->canRead($wallet)) {
             return $this->errorResponse(404);
         }
 
         // Check required fields
         $v = Validator::make(
             $request->all(),
             [
                 'amount' => 'required|numeric',
                 'description' => 'required|string|max:1024',
             ]
         );
 
         if ($v->fails()) {
             return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
         }
 
         $amount = (int) ($request->amount * 100);
         $type = $amount > 0 ? Transaction::WALLET_AWARD : Transaction::WALLET_PENALTY;
 
         DB::beginTransaction();
 
         $wallet->balance += $amount;
         $wallet->save();
 
         Transaction::create(
             [
                 'user_email' => \App\Utils::userEmailOrNull(),
                 'object_id' => $wallet->id,
                 'object_type' => Wallet::class,
                 'type' => $type,
                 'amount' => $amount,
                 'description' => $request->description
             ]
         );
 
+        if ($user->role == 'reseller') {
+            if ($user->tenant && ($tenant_wallet = $user->tenant->wallet())) {
+                $desc = ($amount > 0 ? 'Awarded' : 'Penalized') . " user {$wallet->owner->email}";
+                $method = $amount > 0 ? 'debit' : 'credit';
+                $tenant_wallet->{$method}(abs($amount), $desc);
+            }
+        }
+
         DB::commit();
 
         $response = [
             'status' => 'success',
             'message' => \trans("app.wallet-{$type}-success"),
             'balance' => $wallet->balance
         ];
 
         return response()->json($response);
     }
 
     /**
      * Update wallet data.
      *
      * @param \Illuminate\Http\Request $request The API request.
      * @param string                   $id      Wallet identifier
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function update(Request $request, $id)
     {
         $wallet = Wallet::find($id);
 
         if (empty($wallet) || !Auth::guard()->user()->canRead($wallet)) {
             return $this->errorResponse(404);
         }
 
         if (array_key_exists('discount', $request->input())) {
             if (empty($request->discount)) {
                 $wallet->discount()->dissociate();
                 $wallet->save();
             } elseif ($discount = Discount::withEnvTenant()->find($request->discount)) {
                 $wallet->discount()->associate($discount);
                 $wallet->save();
             }
         }
 
         $response = $wallet->toArray();
 
         if ($wallet->discount) {
             $response['discount'] = $wallet->discount->discount;
             $response['discount_description'] = $wallet->discount->description;
         }
 
         $response['status'] = 'success';
         $response['message'] = \trans('app.wallet-update-success');
 
         return response()->json($response);
     }
 }
diff --git a/src/app/Http/Controllers/API/V4/SkusController.php b/src/app/Http/Controllers/API/V4/SkusController.php
index a4b2f54f..940b34c4 100644
--- a/src/app/Http/Controllers/API/V4/SkusController.php
+++ b/src/app/Http/Controllers/API/V4/SkusController.php
@@ -1,193 +1,193 @@
 <?php
 
 namespace App\Http\Controllers\API\V4;
 
 use App\Http\Controllers\Controller;
 use App\Sku;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
 
 class SkusController extends Controller
 {
     /**
      * Show the form for creating a new sku.
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function create()
     {
         // TODO
         return $this->errorResponse(404);
     }
 
     /**
      * Remove the specified sku from storage.
      *
      * @param int $id SKU identifier
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function destroy($id)
     {
         // TODO
         return $this->errorResponse(404);
     }
 
     /**
      * Show the form for editing the specified sku.
      *
      * @param int $id SKU identifier
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function edit($id)
     {
         // TODO
         return $this->errorResponse(404);
     }
 
     /**
      * Get a list of active SKUs.
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function index()
     {
         // Note: Order by title for consistent ordering in tests
         $skus = Sku::where('active', true)->orderBy('title')->get();
 
         $response = [];
 
         foreach ($skus as $sku) {
             if ($data = $this->skuElement($sku)) {
                 $response[] = $data;
             }
         }
 
         usort($response, function ($a, $b) {
             return ($b['prio'] <=> $a['prio']);
         });
 
         return response()->json($response);
     }
 
     /**
      * Store a newly created sku in storage.
      *
      * @param \Illuminate\Http\Request $request
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function store(Request $request)
     {
         // TODO
         return $this->errorResponse(404);
     }
 
     /**
      * Display the specified sku.
      *
      * @param int $id SKU identifier
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function show($id)
     {
         // TODO
         return $this->errorResponse(404);
     }
 
     /**
      * Update the specified sku in storage.
      *
      * @param \Illuminate\Http\Request $request Request object
      * @param int                      $id      SKU identifier
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function update(Request $request, $id)
     {
         // TODO
         return $this->errorResponse(404);
     }
 
     /**
      * Get a list of SKUs available to the user.
      *
      * @param int $id User identifier
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function userSkus($id)
     {
         $user = \App\User::withEnvTenant()->find($id);
 
         if (empty($user)) {
             return $this->errorResponse(404);
         }
 
         if (!Auth::guard()->user()->canRead($user)) {
             return $this->errorResponse(403);
         }
 
         $type = request()->input('type');
         $response = [];
 
         // Note: Order by title for consistent ordering in tests
         $skus = Sku::orderBy('title')->get();
 
         foreach ($skus as $sku) {
             if (!class_exists($sku->handler_class)) {
                 continue;
             }
 
             if (!$sku->handler_class::isAvailable($sku, $user)) {
                 continue;
             }
 
             if ($data = $this->skuElement($sku)) {
                 if ($type && $type != $data['type']) {
                     continue;
                 }
 
                 $response[] = $data;
             }
         }
 
         usort($response, function ($a, $b) {
             return ($b['prio'] <=> $a['prio']);
         });
 
         return response()->json($response);
     }
 
     /**
      * Convert SKU information to metadata used by UI to
      * display the form control
      *
      * @param \App\Sku $sku SKU object
      *
      * @return array|null Metadata
      */
     protected function skuElement($sku): ?array
     {
         if (!class_exists($sku->handler_class)) {
             return null;
         }
 
         $data = array_merge($sku->toArray(), $sku->handler_class::metadata($sku));
 
         // ignore incomplete handlers
         if (empty($data['type'])) {
             return null;
         }
 
         // Use localized value, toArray() does not get them right
         $data['name'] = $sku->name;
         $data['description'] = $sku->description;
 
-        unset($data['handler_class'], $data['created_at'], $data['updated_at']);
+        unset($data['handler_class'], $data['created_at'], $data['updated_at'], $data['fee'], $data['tenant_id']);
 
         return $data;
     }
 }
diff --git a/src/app/Observers/EntitlementObserver.php b/src/app/Observers/EntitlementObserver.php
index 6b62498a..6f8cf0e7 100644
--- a/src/app/Observers/EntitlementObserver.php
+++ b/src/app/Observers/EntitlementObserver.php
@@ -1,165 +1,175 @@
 <?php
 
 namespace App\Observers;
 
 use App\Entitlement;
 use Carbon\Carbon;
 
 /**
  * This is an observer for the Entitlement model definition.
  */
 class EntitlementObserver
 {
     /**
      * Handle the "creating" event on an Entitlement.
      *
      * Ensures that the entry uses a custom ID (uuid).
      *
      * Ensures that the {@link \App\Wallet} to which it is to be billed is owned or controlled by
      * the {@link \App\User} entitled.
      *
      * @param Entitlement $entitlement The entitlement being created.
      *
      * @return bool
      */
     public function creating(Entitlement $entitlement): bool
     {
         // can't dispatch job here because it'll fail serialization
 
         // Make sure the owner is at least a controller on the wallet
         $wallet = \App\Wallet::find($entitlement->wallet_id);
 
         if (!$wallet || !$wallet->owner) {
             return false;
         }
 
         $sku = \App\Sku::find($entitlement->sku_id);
 
         if (!$sku) {
             return false;
         }
 
         $result = $sku->handler_class::preReq($entitlement, $wallet->owner);
 
         if (!$result) {
             return false;
         }
 
         while (true) {
             $allegedly_unique = \App\Utils::uuidStr();
             if (!Entitlement::withTrashed()->find($allegedly_unique)) {
                 $entitlement->{$entitlement->getKeyName()} = $allegedly_unique;
                 break;
             }
         }
 
         return true;
     }
 
     /**
      * Handle the entitlement "created" event.
      *
      * @param \App\Entitlement $entitlement The entitlement.
      *
      * @return void
      */
     public function created(Entitlement $entitlement)
     {
         $entitlement->entitleable->updated_at = Carbon::now();
         $entitlement->entitleable->save();
 
         $entitlement->createTransaction(\App\Transaction::ENTITLEMENT_CREATED);
     }
 
     /**
      * Handle the entitlement "deleted" event.
      *
      * @param \App\Entitlement $entitlement The entitlement.
      *
      * @return void
      */
     public function deleted(Entitlement $entitlement)
     {
         // Remove all configured 2FA methods from Roundcube database
         if ($entitlement->sku->title == '2fa') {
             // FIXME: Should that be an async job?
             $sf = new \App\Auth\SecondFactor($entitlement->entitleable);
             $sf->removeFactors();
         }
 
         $entitlement->entitleable->updated_at = Carbon::now();
         $entitlement->entitleable->save();
 
         $entitlement->createTransaction(\App\Transaction::ENTITLEMENT_DELETED);
     }
 
     /**
      * Handle the entitlement "deleting" event.
      *
      * @param \App\Entitlement $entitlement The entitlement.
      *
      * @return void
      */
     public function deleting(Entitlement $entitlement)
     {
         if ($entitlement->trashed()) {
             return;
         }
 
         // Start calculating the costs for the consumption of this entitlement if the
         // existing consumption spans >= 14 days.
         //
         // Effect is that anything's free for the first 14 days
         if ($entitlement->created_at >= Carbon::now()->subDays(14)) {
             return;
         }
 
         $owner = $entitlement->wallet->owner;
 
         // Determine if we're still within the free first month
         $freeMonthEnds = $owner->created_at->copy()->addMonthsWithoutOverflow(1);
 
         if ($freeMonthEnds >= Carbon::now()) {
             return;
         }
 
-        $cost = 0;
         $now = Carbon::now();
 
         // get the discount rate applied to the wallet.
         $discount = $entitlement->wallet->getDiscountRate();
 
         // just in case this had not been billed yet, ever
         $diffInMonths = $entitlement->updated_at->diffInMonths($now);
-        $cost += (int) ($entitlement->cost * $discount * $diffInMonths);
+        $cost = (int) ($entitlement->cost * $discount * $diffInMonths);
+        $fee = (int) ($entitlement->fee * $diffInMonths);
 
         // this moves the hypothetical updated at forward to however many months past the original
         $updatedAt = $entitlement->updated_at->copy()->addMonthsWithoutOverflow($diffInMonths);
 
         // now we have the diff in days since the last "billed" period end.
         // This may be an entitlement paid up until February 28th, 2020, with today being March
         // 12th 2020. Calculating the costs for the entitlement is based on the daily price
 
         // the price per day is based on the number of days in the last month
         // or the current month if the period does not overlap with the previous month
         // FIXME: This really should be simplified to $daysInMonth=30
 
         $diffInDays = $updatedAt->diffInDays($now);
 
         if ($now->day >= $diffInDays) {
             $daysInMonth = $now->daysInMonth;
         } else {
             $daysInMonth = \App\Utils::daysInLastMonth();
         }
 
         $pricePerDay = $entitlement->cost / $daysInMonth;
+        $feePerDay = $entitlement->fee / $daysInMonth;
 
         $cost += (int) (round($pricePerDay * $discount * $diffInDays, 0));
+        $fee += (int) (round($feePerDay * $diffInDays, 0));
+
+        $profit = $cost - $fee;
+
+        if ($profit != 0 && $owner->tenant && ($wallet = $owner->tenant->wallet())) {
+            $desc = "Charged user {$owner->email}";
+            $method = $profit > 0 ? 'credit' : 'debit';
+            $wallet->{$method}(abs($profit), $desc);
+        }
 
         if ($cost == 0) {
             return;
         }
 
         $entitlement->wallet->debit($cost);
     }
 }
diff --git a/src/app/Observers/PackageObserver.php b/src/app/Observers/PackageObserver.php
index b967ba2d..e567a44d 100644
--- a/src/app/Observers/PackageObserver.php
+++ b/src/app/Observers/PackageObserver.php
@@ -1,31 +1,33 @@
 <?php
 
 namespace App\Observers;
 
 use App\Package;
 
 /**
  * This is an observer for the Package model definition.
  */
 class PackageObserver
 {
     /**
      * Handle the "creating" event on an Package.
      *
      * Ensures that the entry uses a custom ID (uuid).
      *
      * @param Package $package The Package being created.
      *
      * @return void
      */
     public function creating(Package $package)
     {
         while (true) {
             $allegedly_unique = \App\Utils::uuidStr();
             if (!Package::find($allegedly_unique)) {
                 $package->{$package->getKeyName()} = $allegedly_unique;
                 break;
             }
         }
+
+        $package->tenant_id = \config('app.tenant_id');
     }
 }
diff --git a/src/app/Observers/PackageSkuObserver.php b/src/app/Observers/PackageSkuObserver.php
index e15a5862..eecc2925 100644
--- a/src/app/Observers/PackageSkuObserver.php
+++ b/src/app/Observers/PackageSkuObserver.php
@@ -1,28 +1,47 @@
 <?php
 
 namespace App\Observers;
 
 use App\PackageSku;
 
 class PackageSkuObserver
 {
+    /**
+     * Handle the "creating" event on an PackageSku relation.
+     *
+     * Ensures that the entries belong to the same tenant.
+     *
+     * @param \App\PackageSku $packageSku The package-sku relation
+     *
+     * @return void
+     */
+    public function creating(PackageSku $packageSku)
+    {
+        $package = $packageSku->package;
+        $sku = $packageSku->sku;
+
+        if ($package->tenant_id != $sku->tenant_id) {
+            throw new \Exception("Package and SKU owned by different tenants");
+        }
+    }
+
     /**
      * Handle the "created" event on an PackageSku relation
      *
      * @param \App\PackageSku $packageSku The package-sku relation
      *
      * @return void
      */
     public function created(PackageSku $packageSku)
     {
         // TODO: free units...
         $package = $packageSku->package;
         $sku = $packageSku->sku;
 
         $package->skus()->updateExistingPivot(
             $sku,
             ['cost' => ($sku->cost * (100 - $package->discount_rate)) / 100],
             false
         );
     }
 }
diff --git a/src/app/Observers/PlanObserver.php b/src/app/Observers/PlanObserver.php
index 47b56ed2..aa501f62 100644
--- a/src/app/Observers/PlanObserver.php
+++ b/src/app/Observers/PlanObserver.php
@@ -1,31 +1,33 @@
 <?php
 
 namespace App\Observers;
 
 use App\Plan;
 
 /**
  * This is an observer for the Plan model definition.
  */
 class PlanObserver
 {
     /**
      * Handle the "creating" event on an Plan.
      *
      * Ensures that the entry uses a custom ID (uuid).
      *
      * @param Plan $plan The Plan being created.
      *
      * @return void
      */
     public function creating(Plan $plan)
     {
         while (true) {
             $allegedly_unique = \App\Utils::uuidStr();
             if (!Plan::find($allegedly_unique)) {
                 $plan->{$plan->getKeyName()} = $allegedly_unique;
                 break;
             }
         }
+
+        $plan->tenant_id = \config('app.tenant_id');
     }
 }
diff --git a/src/app/Observers/PlanPackageObserver.php b/src/app/Observers/PlanPackageObserver.php
new file mode 100644
index 00000000..9140abdd
--- /dev/null
+++ b/src/app/Observers/PlanPackageObserver.php
@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Observers;
+
+use App\PlanPackage;
+
+class PlanPackageObserver
+{
+    /**
+     * Handle the "creating" event on an PlanPackage relation.
+     *
+     * Ensures that the entries belong to the same tenant.
+     *
+     * @param \App\PlanPackage $planPackage The plan-package relation
+     *
+     * @return void
+     */
+    public function creating(PlanPackage $planPackage)
+    {
+        $package = $planPackage->package;
+        $plan = $planPackage->plan;
+
+        if ($package->tenant_id != $plan->tenant_id) {
+            throw new \Exception("Package and Plan owned by different tenants");
+        }
+    }
+}
diff --git a/src/app/Observers/SkuObserver.php b/src/app/Observers/SkuObserver.php
index e41d5750..dca338f8 100644
--- a/src/app/Observers/SkuObserver.php
+++ b/src/app/Observers/SkuObserver.php
@@ -1,26 +1,30 @@
 <?php
 
 namespace App\Observers;
 
 use App\Sku;
 
 class SkuObserver
 {
     /**
      * Ensure the SKU ID is a custom ID (uuid).
      *
      * @param Sku $sku The SKU object
      *
      * @return void
      */
     public function creating(Sku $sku)
     {
         while (true) {
             $allegedly_unique = \App\Utils::uuidStr();
             if (!Sku::find($allegedly_unique)) {
                 $sku->{$sku->getKeyName()} = $allegedly_unique;
                 break;
             }
         }
+
+        $sku->tenant_id = \config('app.tenant_id');
+
+        // TODO: We should make sure that tenant_id + title is unique
     }
 }
diff --git a/src/app/Observers/UserObserver.php b/src/app/Observers/UserObserver.php
index 46804259..7e3c86f9 100644
--- a/src/app/Observers/UserObserver.php
+++ b/src/app/Observers/UserObserver.php
@@ -1,362 +1,374 @@
 <?php
 
 namespace App\Observers;
 
 use App\Entitlement;
 use App\Domain;
 use App\Group;
 use App\Transaction;
 use App\User;
 use App\Wallet;
 use Illuminate\Support\Facades\DB;
 
 class UserObserver
 {
     /**
      * Handle the "creating" event.
      *
      * Ensure that the user is created with a random, large integer.
      *
      * @param \App\User $user The user being created.
      *
      * @return void
      */
     public function creating(User $user)
     {
         if (!$user->id) {
             while (true) {
                 $allegedly_unique = \App\Utils::uuidInt();
                 if (!User::withTrashed()->find($allegedly_unique)) {
                     $user->{$user->getKeyName()} = $allegedly_unique;
                     break;
                 }
             }
         }
 
         $user->email = \strtolower($user->email);
 
         // only users that are not imported get the benefit of the doubt.
         $user->status |= User::STATUS_NEW | User::STATUS_ACTIVE;
 
         $user->tenant_id = \config('app.tenant_id');
     }
 
     /**
      * Handle the "created" event.
      *
      * Ensures the user has at least one wallet.
      *
      * Should ensure some basic settings are available as well.
      *
      * @param \App\User $user The user created.
      *
      * @return void
      */
     public function created(User $user)
     {
         $settings = [
             'country' => \App\Utils::countryForRequest(),
             'currency' => 'CHF',
             /*
             'first_name' => '',
             'last_name' => '',
             'billing_address' => '',
             'organization' => '',
             'phone' => '',
             'external_email' => '',
             */
         ];
 
         foreach ($settings as $key => $value) {
             $settings[$key] = [
                 'key' => $key,
                 'value' => $value,
                 'user_id' => $user->id,
             ];
         }
 
         // Note: Don't use setSettings() here to bypass UserSetting observers
         // Note: This is a single multi-insert query
         $user->settings()->insert(array_values($settings));
 
         $user->wallets()->create();
 
         // Create user record in LDAP, then check if the account is created in IMAP
         $chain = [
             new \App\Jobs\User\VerifyJob($user->id),
         ];
 
         \App\Jobs\User\CreateJob::withChain($chain)->dispatch($user->id);
     }
 
     /**
      * Handle the "deleted" event.
      *
      * @param \App\User $user The user deleted.
      *
      * @return void
      */
     public function deleted(User $user)
     {
         // Remove the user from existing groups
         $wallet = $user->wallet();
         if ($wallet && $wallet->owner) {
             $wallet->owner->groups()->each(function ($group) use ($user) {
                 if (in_array($user->email, $group->members)) {
                     $group->members = array_diff($group->members, [$user->email]);
                     $group->save();
                 }
             });
         }
+
+        // Debit the reseller's wallet with the user negative balance
+        $balance = 0;
+        foreach ($user->wallets as $wallet) {
+            // Note: here we assume all user wallets are using the same currency.
+            //       It might get changed in the future
+            $balance += $wallet->balance;
+        }
+
+        if ($balance < 0 && $user->tenant && ($wallet = $user->tenant->wallet())) {
+            $wallet->debit($balance * -1, "Deleted user {$user->email}");
+        }
     }
 
     /**
      * Handle the "deleting" event.
      *
      * @param User $user The user that is being deleted.
      *
      * @return void
      */
     public function deleting(User $user)
     {
         if ($user->isForceDeleting()) {
             $this->forceDeleting($user);
             return;
         }
 
         // TODO: Especially in tests we're doing delete() on a already deleted user.
         //       Should we escape here - for performance reasons?
         // TODO: I think all of this should use database transactions
 
         // Entitlements do not have referential integrity on the entitled object, so this is our
         // way of doing an onDelete('cascade') without the foreign key.
         $entitlements = Entitlement::where('entitleable_id', $user->id)
             ->where('entitleable_type', User::class)->get();
 
         foreach ($entitlements as $entitlement) {
             $entitlement->delete();
         }
 
         // Remove owned users/domains
         $wallets = $user->wallets()->pluck('id')->all();
         $assignments = Entitlement::whereIn('wallet_id', $wallets)->get();
         $users = [];
         $domains = [];
         $groups = [];
         $entitlements = [];
 
         foreach ($assignments as $entitlement) {
             if ($entitlement->entitleable_type == Domain::class) {
                 $domains[] = $entitlement->entitleable_id;
             } elseif ($entitlement->entitleable_type == User::class && $entitlement->entitleable_id != $user->id) {
                 $users[] = $entitlement->entitleable_id;
             } elseif ($entitlement->entitleable_type == Group::class) {
                 $groups[] = $entitlement->entitleable_id;
             } else {
                 $entitlements[] = $entitlement;
             }
         }
 
         // Domains/users/entitlements need to be deleted one by one to make sure
         // events are fired and observers can do the proper cleanup.
         if (!empty($users)) {
             foreach (User::whereIn('id', array_unique($users))->get() as $_user) {
                 $_user->delete();
             }
         }
 
         if (!empty($domains)) {
             foreach (Domain::whereIn('id', array_unique($domains))->get() as $_domain) {
                 $_domain->delete();
             }
         }
 
         if (!empty($groups)) {
             foreach (Group::whereIn('id', array_unique($groups))->get() as $_group) {
                 $_group->delete();
             }
         }
 
         foreach ($entitlements as $entitlement) {
             $entitlement->delete();
         }
 
         // FIXME: What do we do with user wallets?
 
         \App\Jobs\User\DeleteJob::dispatch($user->id);
     }
 
     /**
      * Handle the "deleting" event on forceDelete() call.
      *
      * @param User $user The user that is being deleted.
      *
      * @return void
      */
     public function forceDeleting(User $user)
     {
         // TODO: We assume that at this moment all belongings are already soft-deleted.
 
         // Remove owned users/domains
         $wallets = $user->wallets()->pluck('id')->all();
         $assignments = Entitlement::withTrashed()->whereIn('wallet_id', $wallets)->get();
         $entitlements = [];
         $domains = [];
         $groups = [];
         $users = [];
 
         foreach ($assignments as $entitlement) {
             $entitlements[] = $entitlement->id;
 
             if ($entitlement->entitleable_type == Domain::class) {
                 $domains[] = $entitlement->entitleable_id;
             } elseif (
                 $entitlement->entitleable_type == User::class
                 && $entitlement->entitleable_id != $user->id
             ) {
                 $users[] = $entitlement->entitleable_id;
             } elseif ($entitlement->entitleable_type == Group::class) {
                 $groups[] = $entitlement->entitleable_id;
             }
         }
 
         // Remove the user "direct" entitlements explicitely, if they belong to another
         // user's wallet they will not be removed by the wallets foreign key cascade
         Entitlement::withTrashed()
             ->where('entitleable_id', $user->id)
             ->where('entitleable_type', User::class)
             ->forceDelete();
 
         // Users need to be deleted one by one to make sure observers can do the proper cleanup.
         if (!empty($users)) {
             foreach (User::withTrashed()->whereIn('id', array_unique($users))->get() as $_user) {
                 $_user->forceDelete();
             }
         }
 
         // Domains can be just removed
         if (!empty($domains)) {
             Domain::withTrashed()->whereIn('id', array_unique($domains))->forceDelete();
         }
 
         // Groups can be just removed
         if (!empty($groups)) {
             Group::withTrashed()->whereIn('id', array_unique($groups))->forceDelete();
         }
 
         // Remove transactions, they also have no foreign key constraint
         Transaction::where('object_type', Entitlement::class)
             ->whereIn('object_id', $entitlements)
             ->delete();
 
         Transaction::where('object_type', Wallet::class)
             ->whereIn('object_id', $wallets)
             ->delete();
     }
 
     /**
      * Handle the user "restoring" event.
      *
      * @param \App\User $user The user
      *
      * @return void
      */
     public function restoring(User $user)
     {
         // Make sure it's not DELETED/LDAP_READY/IMAP_READY/SUSPENDED anymore
         if ($user->isDeleted()) {
             $user->status ^= User::STATUS_DELETED;
         }
         if ($user->isLdapReady()) {
             $user->status ^= User::STATUS_LDAP_READY;
         }
         if ($user->isImapReady()) {
             $user->status ^= User::STATUS_IMAP_READY;
         }
         if ($user->isSuspended()) {
             $user->status ^= User::STATUS_SUSPENDED;
         }
 
         $user->status |= User::STATUS_ACTIVE;
 
         // Note: $user->save() is invoked between 'restoring' and 'restored' events
     }
 
     /**
      * Handle the user "restored" event.
      *
      * @param \App\User $user The user
      *
      * @return void
      */
     public function restored(User $user)
     {
         $wallets = $user->wallets()->pluck('id')->all();
 
         // Restore user entitlements
         // We'll restore only these that were deleted last. So, first we get
         // the maximum deleted_at timestamp and then use it to select
         // entitlements for restore
         $deleted_at = \App\Entitlement::withTrashed()
             ->where('entitleable_id', $user->id)
             ->where('entitleable_type', User::class)
             ->max('deleted_at');
 
         if ($deleted_at) {
             $threshold = (new \Carbon\Carbon($deleted_at))->subMinute();
 
             // We need at least the user domain so it can be created in ldap.
             // FIXME: What if the domain is owned by someone else?
             $domain = $user->domain();
             if ($domain->trashed() && !$domain->isPublic()) {
                 // Note: Domain entitlements will be restored by the DomainObserver
                 $domain->restore();
             }
 
             // Restore user entitlements
             \App\Entitlement::withTrashed()
                 ->where('entitleable_id', $user->id)
                 ->where('entitleable_type', User::class)
                 ->where('deleted_at', '>=', $threshold)
                 ->update(['updated_at' => now(), 'deleted_at' => null]);
 
             // Note: We're assuming that cost of entitlements was correct
             // on user deletion, so we don't have to re-calculate it again.
         }
 
         // FIXME: Should we reset user aliases? or re-validate them in any way?
 
         // Create user record in LDAP, then run the verification process
         $chain = [
             new \App\Jobs\User\VerifyJob($user->id),
         ];
 
         \App\Jobs\User\CreateJob::withChain($chain)->dispatch($user->id);
     }
 
     /**
      * Handle the "retrieving" event.
      *
      * @param User $user The user that is being retrieved.
      *
      * @todo This is useful for audit.
      *
      * @return void
      */
     public function retrieving(User $user)
     {
         // TODO   \App\Jobs\User\ReadJob::dispatch($user->id);
     }
 
     /**
      * Handle the "updating" event.
      *
      * @param User $user The user that is being updated.
      *
      * @return void
      */
     public function updating(User $user)
     {
         \App\Jobs\User\UpdateJob::dispatch($user->id);
     }
 }
diff --git a/src/app/Package.php b/src/app/Package.php
index c7b5775b..1d58ab88 100644
--- a/src/app/Package.php
+++ b/src/app/Package.php
@@ -1,97 +1,117 @@
 <?php
 
 namespace App;
 
 use Illuminate\Database\Eloquent\Model;
 use Spatie\Translatable\HasTranslations;
 
 /**
  * The eloquent definition of a Package.
  *
  * A package is a set of SKUs that a user can select, so that instead of;
  *
  * * Create a mailbox entitlement,
  * * Create a quota entitlement,
  * * Create a groupware entitlement,
  * * ...
  *
  * users can simply select a 'package';
  *
  * * Kolab package: mailbox + quota + groupware,
  * * Free package: mailbox + quota.
  *
  * Selecting a package will therefore create a set of entitlments from SKUs.
+ *
+ * @property string  $description
+ * @property int     $discount_rate
+ * @property string  $id
+ * @property string  $name
+ * @property ?int    $tenant_id
+ * @property string  $title
  */
 class Package extends Model
 {
     use HasTranslations;
 
     public $incrementing = false;
     protected $keyType = 'string';
 
     public $timestamps = false;
 
     protected $fillable = [
         'description',
         'discount_rate',
         'name',
         'title',
     ];
 
     /** @var array Translatable properties */
     public $translatable = [
         'name',
         'description',
     ];
 
     /**
      * The costs of this package at its pre-defined, existing configuration.
      *
      * @return int The costs in cents.
      */
     public function cost()
     {
         $costs = 0;
 
         foreach ($this->skus as $sku) {
             $units = $sku->pivot->qty - $sku->units_free;
 
             if ($units < 0) {
                 \Log::debug("Package {$this->id} is misconfigured for more free units than qty.");
                 $units = 0;
             }
 
             $ppu = $sku->cost * ((100 - $this->discount_rate) / 100);
 
             $costs += $units * $ppu;
         }
 
         return $costs;
     }
 
-    public function isDomain()
+    /**
+     * Checks whether the package contains a domain SKU.
+     */
+    public function isDomain(): bool
     {
         foreach ($this->skus as $sku) {
             if ($sku->handler_class::entitleableClass() == \App\Domain::class) {
                 return true;
             }
         }
 
         return false;
     }
 
     /**
      * SKUs of this package.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
      */
     public function skus()
     {
         return $this->belongsToMany(
             'App\Sku',
             'package_skus'
         )->using('App\PackageSku')->withPivot(
             ['qty']
         );
     }
+
+    /**
+     * The tenant for this package.
+     *
+     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
+     */
+    public function tenant()
+    {
+        return $this->belongsTo('App\Tenant', 'tenant_id', 'id');
+    }
 }
diff --git a/src/app/PackageSku.php b/src/app/PackageSku.php
index 57d03c94..f52c1ecd 100644
--- a/src/app/PackageSku.php
+++ b/src/app/PackageSku.php
@@ -1,66 +1,86 @@
 <?php
 
 namespace App;
 
 use Illuminate\Database\Eloquent\Relations\Pivot;
 
 /**
  * Link SKUs to Packages.
  *
  * @property int          $cost
  * @property string       $package_id
  * @property \App\Package $package
  * @property int          $qty
  * @property \App\Sku     $sku
  * @property string       $sku_id
  */
 class PackageSku extends Pivot
 {
     protected $fillable = [
         'package_id',
         'sku_id',
         'cost',
         'qty'
     ];
 
     protected $casts = [
         'cost' => 'integer',
         'qty' => 'integer'
     ];
 
     /**
      * Under this package, how much does this SKU cost?
      *
      * @return int The costs of this SKU under this package in cents.
      */
     public function cost()
     {
-        $costs = 0;
-
         $units = $this->qty - $this->sku->units_free;
 
         if ($units < 0) {
-            \Log::debug(
-                "Package {$this->package_id} is misconfigured for more free units than qty."
-            );
-
             $units = 0;
         }
 
+        // FIXME: Why package_skus.cost value is not used anywhere?
+
         $ppu = $this->sku->cost * ((100 - $this->package->discount_rate) / 100);
 
-        $costs += $units * $ppu;
+        return $units * $ppu;
+    }
+
+    /**
+     * Under this package, what fee this SKU has?
+     *
+     * @return int The fee for this SKU under this package in cents.
+     */
+    public function fee()
+    {
+        $units = $this->qty - $this->sku->units_free;
+
+        if ($units < 0) {
+            $units = 0;
+        }
 
-        return $costs;
+        return $this->sku->fee * $units;
     }
 
+    /**
+     * The package for this relation.
+     *
+     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
+     */
     public function package()
     {
         return $this->belongsTo('App\Package');
     }
 
+    /**
+     * The SKU for this relation.
+     *
+     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
+     */
     public function sku()
     {
         return $this->belongsTo('App\Sku');
     }
 }
diff --git a/src/app/Plan.php b/src/app/Plan.php
index 4bc0caf3..c6b222de 100644
--- a/src/app/Plan.php
+++ b/src/app/Plan.php
@@ -1,108 +1,127 @@
 <?php
 
 namespace App;
 
 use Illuminate\Database\Eloquent\Model;
 use Spatie\Translatable\HasTranslations;
 
 /**
  * The eloquent definition of a Plan.
  *
  * A Plan is a grouping of packages, such as a "Family Plan".
  *
  * A "Family Plan" as such may exist of "2 or more Kolab packages",
  * and apply a discount for the third and further Kolab packages.
  *
+ * @property string         $description
+ * @property int            $discount_qty
+ * @property int            $discount_rate
+ * @property string         $id
+ * @property string         $name
  * @property \App\Package[] $packages
+ * @property datetime       $promo_from
+ * @property datetime       $promo_to
+ * @property ?int           $tenant_id
+ * @property string         $title
  */
 class Plan extends Model
 {
     use HasTranslations;
 
     public $incrementing = false;
     protected $keyType = 'string';
     public $timestamps = false;
 
     protected $fillable = [
         'title',
         'name',
         'description',
         // a start and end datetime for this promotion
         'promo_from',
         'promo_to',
         // discounts start at this quantity
         'discount_qty',
         // the rate of the discount for this plan
         'discount_rate',
     ];
 
     protected $casts = [
         'promo_from' => 'datetime',
         'promo_to' => 'datetime',
         'discount_qty' => 'integer',
         'discount_rate' => 'integer'
     ];
 
     /** @var array Translatable properties */
     public $translatable = [
         'name',
         'description',
     ];
 
     /**
      * The list price for this package at the minimum configuration.
      *
      * @return int The costs in cents.
      */
     public function cost()
     {
         $costs = 0;
 
         foreach ($this->packages as $package) {
             $costs += $package->pivot->cost();
         }
 
         return $costs;
     }
 
     /**
      * The relationship to packages.
      *
      * The plan contains one or more packages. Each package may have its minimum number (for
      * billing) or its maximum (to allow topping out "enterprise" customers on a "small business"
      * plan).
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
      */
     public function packages()
     {
         return $this->belongsToMany(
             'App\Package',
             'plan_packages'
         )->using('App\PlanPackage')->withPivot(
             [
                 'qty',
                 'qty_min',
                 'qty_max',
                 'discount_qty',
                 'discount_rate'
             ]
         );
     }
 
     /**
      * Checks if the plan has any type of domain SKU assigned.
      *
      * @return bool
      */
     public function hasDomain(): bool
     {
         foreach ($this->packages as $package) {
             if ($package->isDomain()) {
                 return true;
             }
         }
 
         return false;
     }
+
+    /**
+     * The tenant for this plan.
+     *
+     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
+     */
+    public function tenant()
+    {
+        return $this->belongsTo('App\Tenant', 'tenant_id', 'id');
+    }
 }
diff --git a/src/app/PlanPackage.php b/src/app/PlanPackage.php
index 0b8a1aba..484a48b5 100644
--- a/src/app/PlanPackage.php
+++ b/src/app/PlanPackage.php
@@ -1,61 +1,77 @@
 <?php
 
 namespace App;
 
 use Illuminate\Database\Eloquent\Relations\Pivot;
 
 /**
  * Link Packages to Plans.
  *
  * @property int          $discount_qty
  * @property int          $discount_rate
  * @property string       $plan_id
  * @property string       $package_id
  * @property int          $qty
  * @property int          $qty_max
  * @property int          $qty_min
  * @property \App\Package $package
+ * @property \App\Plan    $plan
  */
 class PlanPackage extends Pivot
 {
     protected $fillable = [
         'plan_id',
         'package_id',
         'qty',
         'qty_max',
         'qty_min',
         'discount_qty',
         'discount_rate'
     ];
 
     protected $casts = [
         'qty' => 'integer',
         'qty_max' => 'integer',
         'qty_min' => 'integer',
         'discount_qty' => 'integer',
         'discount_rate' => 'integer'
     ];
 
     /**
      * Calculate the costs for this plan.
      *
      * @return integer
      */
     public function cost()
     {
         $costs = 0;
 
         if ($this->qty_min > 0) {
             $costs += $this->package->cost() * $this->qty_min;
         } elseif ($this->qty > 0) {
             $costs += $this->package->cost() * $this->qty;
         }
 
         return $costs;
     }
 
+    /**
+     * The package in this relation.
+     *
+     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
+     */
     public function package()
     {
         return $this->belongsTo('App\Package');
     }
+
+    /**
+     * The plan in this relation.
+     *
+     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
+     */
+    public function plan()
+    {
+        return $this->belongsTo('App\Plan');
+    }
 }
diff --git a/src/app/Providers/AppServiceProvider.php b/src/app/Providers/AppServiceProvider.php
index c2d01d03..0c010ec2 100644
--- a/src/app/Providers/AppServiceProvider.php
+++ b/src/app/Providers/AppServiceProvider.php
@@ -1,108 +1,109 @@
 <?php
 
 namespace App\Providers;
 
 use Illuminate\Database\Query\Builder;
 use Illuminate\Support\Facades\Blade;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Schema;
 use Illuminate\Support\ServiceProvider;
 
 class AppServiceProvider extends ServiceProvider
 {
     /**
      * Register any application services.
      *
      * @return void
      */
     public function register()
     {
         //
     }
 
     /**
      * Bootstrap any application services.
      *
      * @return void
      */
     public function boot()
     {
         \App\Discount::observe(\App\Observers\DiscountObserver::class);
         \App\Domain::observe(\App\Observers\DomainObserver::class);
         \App\Entitlement::observe(\App\Observers\EntitlementObserver::class);
         \App\Group::observe(\App\Observers\GroupObserver::class);
         \App\OpenVidu\Connection::observe(\App\Observers\OpenVidu\ConnectionObserver::class);
         \App\Package::observe(\App\Observers\PackageObserver::class);
         \App\PackageSku::observe(\App\Observers\PackageSkuObserver::class);
         \App\Plan::observe(\App\Observers\PlanObserver::class);
+        \App\PlanPackage::observe(\App\Observers\PlanPackageObserver::class);
         \App\SignupCode::observe(\App\Observers\SignupCodeObserver::class);
         \App\SignupInvitation::observe(\App\Observers\SignupInvitationObserver::class);
         \App\Sku::observe(\App\Observers\SkuObserver::class);
         \App\Transaction::observe(\App\Observers\TransactionObserver::class);
         \App\User::observe(\App\Observers\UserObserver::class);
         \App\UserAlias::observe(\App\Observers\UserAliasObserver::class);
         \App\UserSetting::observe(\App\Observers\UserSettingObserver::class);
         \App\VerificationCode::observe(\App\Observers\VerificationCodeObserver::class);
         \App\Wallet::observe(\App\Observers\WalletObserver::class);
 
         Schema::defaultStringLength(191);
 
         // Log SQL queries in debug mode
         if (\config('app.debug')) {
             DB::listen(function ($query) {
                 \Log::debug(sprintf('[SQL] %s [%s]', $query->sql, implode(', ', $query->bindings)));
             });
         }
 
         // Register some template helpers
         Blade::directive('theme_asset', function ($path) {
             $path = trim($path, '/\'"');
             return "<?php echo secure_asset('themes/' . \$env['app.theme'] . '/' . '$path'); ?>";
         });
 
         // Query builder 'withEnvTenant' macro
         Builder::macro('withEnvTenant', function (string $table = null) {
             $tenant_id = \config('app.tenant_id');
 
             if ($tenant_id) {
                 /** @var Builder $this */
                 return $this->where(($table ? "$table." : '') . 'tenant_id', $tenant_id);
             }
 
             /** @var Builder $this */
             return $this->whereNull(($table ? "$table." : '') . 'tenant_id');
         });
 
         // Query builder 'withUserTenant' macro
         Builder::macro('withUserTenant', function (string $table = null) {
             $tenant_id = auth()->user()->tenant_id;
 
             if ($tenant_id) {
                 /** @var Builder $this */
                 return $this->where(($table ? "$table." : '') . 'tenant_id', $tenant_id);
             }
 
             /** @var Builder $this */
             return $this->whereNull(($table ? "$table." : '') . 'tenant_id');
         });
 
         // Query builder 'whereLike' mocro
         Builder::macro('whereLike', function (string $column, string $search, int $mode = 0) {
             $search = addcslashes($search, '%_');
 
             switch ($mode) {
                 case 2:
                     $search .= '%';
                     break;
                 case 1:
                     $search = '%' . $search;
                     break;
                 default:
                     $search = '%' . $search . '%';
             }
 
             /** @var Builder $this */
             return $this->where($column, 'like', $search);
         });
     }
 }
diff --git a/src/app/Providers/PaymentProvider.php b/src/app/Providers/PaymentProvider.php
index 30d41a8e..188c3811 100644
--- a/src/app/Providers/PaymentProvider.php
+++ b/src/app/Providers/PaymentProvider.php
@@ -1,388 +1,390 @@
 <?php
 
 namespace App\Providers;
 
 use App\Transaction;
 use App\Payment;
 use App\Wallet;
 use Illuminate\Support\Facades\Cache;
 
 abstract class PaymentProvider
 {
     public const STATUS_OPEN = 'open';
     public const STATUS_CANCELED = 'canceled';
     public const STATUS_PENDING = 'pending';
     public const STATUS_AUTHORIZED = 'authorized';
     public const STATUS_EXPIRED = 'expired';
     public const STATUS_FAILED = 'failed';
     public const STATUS_PAID = 'paid';
 
     public const TYPE_ONEOFF = 'oneoff';
     public const TYPE_RECURRING = 'recurring';
     public const TYPE_MANDATE = 'mandate';
     public const TYPE_REFUND = 'refund';
     public const TYPE_CHARGEBACK = 'chargeback';
 
     public const METHOD_CREDITCARD = 'creditcard';
     public const METHOD_PAYPAL = 'paypal';
     public const METHOD_BANKTRANSFER = 'banktransfer';
     public const METHOD_DIRECTDEBIT = 'directdebit';
 
     public const PROVIDER_MOLLIE = 'mollie';
     public const PROVIDER_STRIPE = 'stripe';
 
     /** const int Minimum amount of money in a single payment (in cents) */
     public const MIN_AMOUNT = 1000;
 
     private static $paymentMethodIcons = [
         self::METHOD_CREDITCARD => ['prefix' => 'far', 'name' => 'credit-card'],
         self::METHOD_PAYPAL => ['prefix' => 'fab', 'name' => 'paypal'],
         self::METHOD_BANKTRANSFER => ['prefix' => 'fas', 'name' => 'university']
     ];
 
     /**
      * Detect the name of the provider
      *
      * @param \App\Wallet|string|null $provider_or_wallet
      * @return string The name of the provider
      */
     private static function providerName($provider_or_wallet = null): string
     {
         if ($provider_or_wallet instanceof Wallet) {
             if ($provider_or_wallet->getSetting('stripe_id')) {
                 $provider = self::PROVIDER_STRIPE;
             } elseif ($provider_or_wallet->getSetting('mollie_id')) {
                 $provider = self::PROVIDER_MOLLIE;
             }
         } else {
             $provider = $provider_or_wallet;
         }
 
         if (empty($provider)) {
             $provider = \config('services.payment_provider') ?: self::PROVIDER_MOLLIE;
         }
 
         return \strtolower($provider);
     }
 
     /**
      * Factory method
      *
      * @param \App\Wallet|string|null $provider_or_wallet
      */
     public static function factory($provider_or_wallet = null)
     {
         switch (self::providerName($provider_or_wallet)) {
             case self::PROVIDER_STRIPE:
                 return new \App\Providers\Payment\Stripe();
 
             case self::PROVIDER_MOLLIE:
                 return new \App\Providers\Payment\Mollie();
 
             default:
                 throw new \Exception("Invalid payment provider: {$provider_or_wallet}");
         }
     }
 
     /**
      * Create a new auto-payment mandate for a wallet.
      *
      * @param \App\Wallet $wallet  The wallet
      * @param array       $payment Payment data:
      *                             - amount: Value in cents
      *                             - currency: The operation currency
      *                             - description: Operation desc.
      *                             - methodId: Payment method
      *
      * @return array Provider payment data:
      *               - id: Operation identifier
      *               - redirectUrl: the location to redirect to
      */
     abstract public function createMandate(Wallet $wallet, array $payment): ?array;
 
     /**
      * Revoke the auto-payment mandate for a wallet.
      *
      * @param \App\Wallet $wallet The wallet
      *
      * @return bool True on success, False on failure
      */
     abstract public function deleteMandate(Wallet $wallet): bool;
 
     /**
      * Get a auto-payment mandate for a wallet.
      *
      * @param \App\Wallet $wallet The wallet
      *
      * @return array|null Mandate information:
      *                    - id: Mandate identifier
      *                    - method: user-friendly payment method desc.
      *                    - methodId: Payment method
      *                    - isPending: the process didn't complete yet
      *                    - isValid: the mandate is valid
      */
     abstract public function getMandate(Wallet $wallet): ?array;
 
     /**
      * Get a link to the customer in the provider's control panel
      *
      * @param \App\Wallet $wallet The wallet
      *
      * @return string|null The string representing <a> tag
      */
     abstract public function customerLink(Wallet $wallet): ?string;
 
     /**
      * Get a provider name
      *
      * @return string Provider name
      */
     abstract public function name(): string;
 
     /**
      * Create a new payment.
      *
      * @param \App\Wallet $wallet  The wallet
      * @param array       $payment Payment data:
      *                             - amount: Value in cents
      *                             - currency: The operation currency
      *                             - type: first/oneoff/recurring
      *                             - description: Operation description
      *                             - methodId: Payment method
      *
      * @return array Provider payment/session data:
      *               - id: Operation identifier
      *               - redirectUrl
      */
     abstract public function payment(Wallet $wallet, array $payment): ?array;
 
     /**
      * Update payment status (and balance).
      *
      * @return int HTTP response code
      */
     abstract public function webhook(): int;
 
     /**
      * Create a payment record in DB
      *
      * @param array  $payment   Payment information
      * @param string $wallet_id Wallet ID
      *
      * @return \App\Payment Payment object
      */
     protected function storePayment(array $payment, $wallet_id): Payment
     {
         $db_payment = new Payment();
         $db_payment->id = $payment['id'];
         $db_payment->description = $payment['description'] ?? '';
         $db_payment->status = $payment['status'] ?? self::STATUS_OPEN;
         $db_payment->amount = $payment['amount'] ?? 0;
         $db_payment->type = $payment['type'];
         $db_payment->wallet_id = $wallet_id;
         $db_payment->provider = $this->name();
         $db_payment->currency = $payment['currency'];
         $db_payment->currency_amount = $payment['currency_amount'];
         $db_payment->save();
 
         return $db_payment;
     }
 
     /**
      * Retrieve an exchange rate.
      *
      * @param string $sourceCurrency Currency from which to convert
      * @param string $targetCurrency Currency to convert to
      *
      * @return float Exchange rate
      */
     protected function exchangeRate(string $sourceCurrency, string $targetCurrency): float
     {
         if (strcasecmp($sourceCurrency, $targetCurrency)) {
             throw new \Exception("Currency conversion is not yet implemented.");
             //FIXME Not yet implemented
         }
         return 1.0;
     }
 
     /**
      * Convert a value from $sourceCurrency to $targetCurrency
      *
      * @param int    $amount         Amount in cents of $sourceCurrency
      * @param string $sourceCurrency Currency from which to convert
      * @param string $targetCurrency Currency to convert to
      *
      * @return int Exchanged amount in cents of $targetCurrency
      */
     protected function exchange(int $amount, string $sourceCurrency, string $targetCurrency): int
     {
         return intval(round($amount * $this->exchangeRate($sourceCurrency, $targetCurrency)));
     }
 
     /**
      * Deduct an amount of pecunia from the wallet.
      * Creates a payment and transaction records for the refund/chargeback operation.
      *
      * @param \App\Wallet $wallet A wallet object
      * @param array       $refund A refund or chargeback data (id, type, amount, description)
      *
      * @return void
      */
     protected function storeRefund(Wallet $wallet, array $refund): void
     {
         if (empty($refund) || empty($refund['amount'])) {
             return;
         }
 
         // Preserve originally refunded amount
         $refund['currency_amount'] = $refund['amount'];
 
         // Convert amount to wallet currency
         // TODO We should possibly be using the same exchange rate as for the original payment?
         $amount = $this->exchange($refund['amount'], $refund['currency'], $wallet->currency);
 
         $wallet->balance -= $amount;
         $wallet->save();
 
         if ($refund['type'] == self::TYPE_CHARGEBACK) {
             $transaction_type = Transaction::WALLET_CHARGEBACK;
         } else {
             $transaction_type = Transaction::WALLET_REFUND;
         }
 
         Transaction::create([
                 'object_id' => $wallet->id,
                 'object_type' => Wallet::class,
                 'type' => $transaction_type,
                 'amount' => $amount * -1,
                 'description' => $refund['description'] ?? '',
         ]);
 
         $refund['status'] = self::STATUS_PAID;
         $refund['amount'] = -1 * $amount;
 
+        // FIXME: Refunds/chargebacks are out of the reseller comissioning for now
+
         $this->storePayment($refund, $wallet->id);
     }
 
     /**
      * List supported payment methods from this provider
      *
      * @param string $type The payment type for which we require a method (oneoff/recurring).
      *
      * @return array Array of array with available payment methods:
      *               - id: id of the method
      *               - name: User readable name of the payment method
      *               - minimumAmount: Minimum amount to be charged in cents
      *               - currency: Currency used for the method
      *               - exchangeRate: The projected exchange rate (actual rate is determined during payment)
      *               - icon: An icon (icon name) representing the method
      */
     abstract public function providerPaymentMethods($type): array;
 
     /**
      * Get a payment.
      *
      * @param string $paymentId Payment identifier
      *
      * @return array Payment information:
      *                    - id: Payment identifier
      *                    - status: Payment status
      *                    - isCancelable: The payment can be canceled
      *                    - checkoutUrl: The checkout url to complete the payment or null if none
      */
     abstract public function getPayment($paymentId): array;
 
     /**
      * Return an array of whitelisted payment methods with override values.
      *
      * @param string $type The payment type for which we require a method.
      *
      * @return array Array of methods
      */
     protected static function paymentMethodsWhitelist($type): array
     {
         switch ($type) {
             case self::TYPE_ONEOFF:
                 return [
                     self::METHOD_CREDITCARD => [
                         'id' => self::METHOD_CREDITCARD,
                         'icon' => self::$paymentMethodIcons[self::METHOD_CREDITCARD]
                     ],
                     self::METHOD_PAYPAL => [
                         'id' => self::METHOD_PAYPAL,
                         'icon' => self::$paymentMethodIcons[self::METHOD_PAYPAL]
                     ],
                     // TODO Enable once we're ready to offer them
                     // self::METHOD_BANKTRANSFER => [
                     //     'id' => self::METHOD_BANKTRANSFER,
                     //     'icon' => self::$paymentMethodIcons[self::METHOD_BANKTRANSFER]
                     // ]
                 ];
             case PaymentProvider::TYPE_RECURRING:
                 return [
                     self::METHOD_CREDITCARD => [
                         'id' => self::METHOD_CREDITCARD,
                         'icon' => self::$paymentMethodIcons[self::METHOD_CREDITCARD]
                     ]
                 ];
         }
 
         \Log::error("Unknown payment type: " . $type);
         return [];
     }
 
     /**
      * Return an array of whitelisted payment methods with override values.
      *
      * @param string $type The payment type for which we require a method.
      *
      * @return array Array of methods
      */
     private static function applyMethodWhitelist($type, $availableMethods): array
     {
         $methods = [];
 
         // Use only whitelisted methods, and apply values from whitelist (overriding the backend)
         $whitelistMethods = self::paymentMethodsWhitelist($type);
         foreach ($whitelistMethods as $id => $whitelistMethod) {
             if (array_key_exists($id, $availableMethods)) {
                 $methods[] = array_merge($availableMethods[$id], $whitelistMethod);
             }
         }
 
         return $methods;
     }
 
     /**
      * List supported payment methods for $wallet
      *
      * @param \App\Wallet $wallet The wallet
      * @param string      $type   The payment type for which we require a method (oneoff/recurring).
      *
      * @return array Array of array with available payment methods:
      *               - id: id of the method
      *               - name: User readable name of the payment method
      *               - minimumAmount: Minimum amount to be charged in cents
      *               - currency: Currency used for the method
      *               - exchangeRate: The projected exchange rate (actual rate is determined during payment)
      *               - icon: An icon (icon name) representing the method
      */
     public static function paymentMethods(Wallet $wallet, $type): array
     {
         $providerName = self::providerName($wallet);
 
         $cacheKey = "methods-" . $providerName . '-' . $type;
 
         if ($methods = Cache::get($cacheKey)) {
             \Log::debug("Using payment method cache" . var_export($methods, true));
             return $methods;
         }
 
         $provider = PaymentProvider::factory($providerName);
         $methods = self::applyMethodWhitelist($type, $provider->providerPaymentMethods($type));
 
         Cache::put($cacheKey, $methods, now()->addHours(1));
 
         return $methods;
     }
 }
diff --git a/src/app/Sku.php b/src/app/Sku.php
index ee451e86..2e1a90ee 100644
--- a/src/app/Sku.php
+++ b/src/app/Sku.php
@@ -1,62 +1,85 @@
 <?php
 
 namespace App;
 
 use Illuminate\Database\Eloquent\Model;
 use Spatie\Translatable\HasTranslations;
 
 /**
  * The eloquent definition of a Stock Keeping Unit (SKU).
+ *
+ * @property bool    $active
+ * @property int     $cost
+ * @property string  $description
+ * @property int     $fee           The fee that the tenant pays to us
+ * @property string  $handler_class
+ * @property string  $id
+ * @property string  $name
+ * @property string  $period
+ * @property ?int    $tenant_id
+ * @property string  $title
+ * @property int     $units_free
  */
 class Sku extends Model
 {
     use HasTranslations;
 
     public $incrementing = false;
     protected $keyType = 'string';
 
     protected $casts = [
         'units_free' => 'integer'
     ];
 
     protected $fillable = [
         'active',
         'cost',
         'description',
+        'fee',
         'handler_class',
         'name',
         // persist for annual domain registration
         'period',
         'title',
         'units_free',
     ];
 
     /** @var array Translatable properties */
     public $translatable = [
         'name',
         'description',
     ];
 
     /**
      * List the entitlements that consume this SKU.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function entitlements()
     {
         return $this->hasMany('App\Entitlement');
     }
 
     /**
      * List of packages that use this SKU.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
      */
     public function packages()
     {
         return $this->belongsToMany(
             'App\Package',
             'package_skus'
         )->using('App\PackageSku')->withPivot(['cost', 'qty']);
     }
+
+    /**
+     * The tenant for this SKU.
+     *
+     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
+     */
+    public function tenant()
+    {
+        return $this->belongsTo('App\Tenant', 'tenant_id', 'id');
+    }
 }
diff --git a/src/app/Tenant.php b/src/app/Tenant.php
index d67212fb..608b1897 100644
--- a/src/app/Tenant.php
+++ b/src/app/Tenant.php
@@ -1,40 +1,52 @@
 <?php
 
 namespace App;
 
 use Illuminate\Database\Eloquent\Model;
 
 /**
  * The eloquent definition of a Tenant.
  *
  * @property int    $id
  * @property string $title
  */
 class Tenant extends Model
 {
     protected $fillable = [
         'title',
     ];
 
     protected $keyType = 'bigint';
 
     /**
      * Discounts assigned to this tenant.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function discounts()
     {
         return $this->hasMany('App\Discount');
     }
 
     /**
      * SignupInvitations assigned to this tenant.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function signupInvitations()
     {
         return $this->hasMany('App\SignupInvitation');
     }
+
+    /*
+     * Returns the wallet of the tanant (reseller's wallet).
+     *
+     * @return ?\App\Wallet A wallet object
+     */
+    public function wallet(): ?Wallet
+    {
+        $user = \App\User::where('role', 'reseller')->where('tenant_id', $this->id)->first();
+
+        return $user ? $user->wallets->first() : null;
+    }
 }
diff --git a/src/app/User.php b/src/app/User.php
index 71ec3b69..7810548d 100644
--- a/src/app/User.php
+++ b/src/app/User.php
@@ -1,749 +1,751 @@
 <?php
 
 namespace App;
 
 use App\Entitlement;
 use App\UserAlias;
 use App\Sku;
 use App\Traits\UserAliasesTrait;
 use App\Traits\SettingsTrait;
 use App\Wallet;
 use Illuminate\Database\Eloquent\SoftDeletes;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Iatstuti\Database\Support\NullableFields;
 use Tymon\JWTAuth\Contracts\JWTSubject;
 
 /**
  * The eloquent definition of a User.
  *
  * @property string $email
  * @property int    $id
  * @property string $password
  * @property int    $status
  * @property int    $tenant_id
  */
 class User extends Authenticatable implements JWTSubject
 {
     use NullableFields;
     use UserAliasesTrait;
     use SettingsTrait;
     use SoftDeletes;
 
     // a new user, default on creation
     public const STATUS_NEW        = 1 << 0;
     // it's been activated
     public const STATUS_ACTIVE     = 1 << 1;
     // user has been suspended
     public const STATUS_SUSPENDED  = 1 << 2;
     // user has been deleted
     public const STATUS_DELETED    = 1 << 3;
     // user has been created in LDAP
     public const STATUS_LDAP_READY = 1 << 4;
     // user mailbox has been created in IMAP
     public const STATUS_IMAP_READY = 1 << 5;
 
 
     // change the default primary key type
     public $incrementing = false;
     protected $keyType = 'bigint';
 
     /**
      * The attributes that are mass assignable.
      *
      * @var array
      */
     protected $fillable = [
         'id',
         'email',
         'password',
         'password_ldap',
         'status',
     ];
 
     /**
      * The attributes that should be hidden for arrays.
      *
      * @var array
      */
     protected $hidden = [
         'password',
         'password_ldap',
         'role'
     ];
 
     protected $nullable = [
         'password',
         'password_ldap'
     ];
 
     /**
      * Any wallets on which this user is a controller.
      *
      * This does not include wallets owned by the user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
      */
     public function accounts()
     {
         return $this->belongsToMany(
             'App\Wallet',       // The foreign object definition
             'user_accounts',    // The table name
             'user_id',          // The local foreign key
             'wallet_id'         // The remote foreign key
         );
     }
 
     /**
      * Email aliases of this user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function aliases()
     {
         return $this->hasMany('App\UserAlias', 'user_id');
     }
 
     /**
      * Assign a package to a user. The user should not have any existing entitlements.
      *
      * @param \App\Package   $package The package to assign.
      * @param \App\User|null $user    Assign the package to another user.
      *
      * @return \App\User
      */
     public function assignPackage($package, $user = null)
     {
         if (!$user) {
             $user = $this;
         }
 
         $wallet_id = $this->wallets()->first()->id;
 
         foreach ($package->skus as $sku) {
             for ($i = $sku->pivot->qty; $i > 0; $i--) {
                 \App\Entitlement::create(
                     [
                         'wallet_id' => $wallet_id,
                         'sku_id' => $sku->id,
                         'cost' => $sku->pivot->cost(),
+                        'fee' => $sku->pivot->fee(),
                         'entitleable_id' => $user->id,
                         'entitleable_type' => User::class
                     ]
                 );
             }
         }
 
         return $user;
     }
 
     /**
      * Assign a package plan to a user.
      *
      * @param \App\Plan   $plan   The plan to assign
      * @param \App\Domain $domain Optional domain object
      *
      * @return \App\User Self
      */
     public function assignPlan($plan, $domain = null): User
     {
         $this->setSetting('plan_id', $plan->id);
 
         foreach ($plan->packages as $package) {
             if ($package->isDomain()) {
                 $domain->assignPackage($package, $this);
             } else {
                 $this->assignPackage($package);
             }
         }
 
         return $this;
     }
 
     /**
      * Assign a Sku to a user.
      *
      * @param \App\Sku $sku   The sku to assign.
      * @param int      $count Count of entitlements to add
      *
      * @return \App\User Self
      * @throws \Exception
      */
     public function assignSku(Sku $sku, int $count = 1): User
     {
         // TODO: I guess wallet could be parametrized in future
         $wallet = $this->wallet();
         $exists = $this->entitlements()->where('sku_id', $sku->id)->count();
 
         while ($count > 0) {
             \App\Entitlement::create([
                 'wallet_id' => $wallet->id,
                 'sku_id' => $sku->id,
                 'cost' => $exists >= $sku->units_free ? $sku->cost : 0,
+                'fee' => $exists >= $sku->units_free ? $sku->fee : 0,
                 'entitleable_id' => $this->id,
                 'entitleable_type' => User::class
             ]);
 
             $exists++;
             $count--;
         }
 
         return $this;
     }
 
     /**
      * Check if current user can delete another object.
      *
      * @param mixed $object A user|domain|wallet|group object
      *
      * @return bool True if he can, False otherwise
      */
     public function canDelete($object): bool
     {
         if (!method_exists($object, 'wallet')) {
             return false;
         }
 
         $wallet = $object->wallet();
 
         // TODO: For now controller can delete/update the account owner,
         //       this may change in future, controllers are not 0-regression feature
 
         return $this->wallets->contains($wallet) || $this->accounts->contains($wallet);
     }
 
     /**
      * Check if current user can read data of another object.
      *
      * @param mixed $object A user|domain|wallet|group object
      *
      * @return bool True if he can, False otherwise
      */
     public function canRead($object): bool
     {
         if ($this->role == 'admin') {
             return true;
         }
 
         if ($object instanceof User && $this->id == $object->id) {
             return true;
         }
 
         if ($this->role == 'reseller') {
             if ($object instanceof User && $object->role == 'admin') {
                 return false;
             }
 
             if ($object instanceof Wallet && !empty($object->owner)) {
                 $object = $object->owner;
             }
 
             return isset($object->tenant_id) && $object->tenant_id == $this->tenant_id;
         }
 
         if ($object instanceof Wallet) {
             return $object->user_id == $this->id || $object->controllers->contains($this);
         }
 
         if (!method_exists($object, 'wallet')) {
             return false;
         }
 
         $wallet = $object->wallet();
 
         return $wallet && ($this->wallets->contains($wallet) || $this->accounts->contains($wallet));
     }
 
     /**
      * Check if current user can update data of another object.
      *
      * @param mixed $object A user|domain|wallet|group object
      *
      * @return bool True if he can, False otherwise
      */
     public function canUpdate($object): bool
     {
         if ($object instanceof User && $this->id == $object->id) {
             return true;
         }
 
         if ($this->role == 'admin') {
             return true;
         }
 
         if ($this->role == 'reseller') {
             if ($object instanceof User && $object->role == 'admin') {
                 return false;
             }
 
             if ($object instanceof Wallet && !empty($object->owner)) {
                 $object = $object->owner;
             }
 
             return isset($object->tenant_id) && $object->tenant_id == $this->tenant_id;
         }
 
         return $this->canDelete($object);
     }
 
     /**
      * Return the \App\Domain for this user.
      *
      * @return \App\Domain|null
      */
     public function domain()
     {
         list($local, $domainName) = explode('@', $this->email);
 
         $domain = \App\Domain::withTrashed()->where('namespace', $domainName)->first();
 
         return $domain;
     }
 
     /**
      * List the domains to which this user is entitled.
      *
      * @return Domain[]
      */
     public function domains()
     {
         $domains = Domain::whereRaw(sprintf('(type & %s)', Domain::TYPE_PUBLIC))
             ->whereRaw(sprintf('(status & %s)', Domain::STATUS_ACTIVE))
             ->get()
             ->all();
 
         foreach ($this->wallets as $wallet) {
             $entitlements = $wallet->entitlements()->where('entitleable_type', Domain::class)->get();
             foreach ($entitlements as $entitlement) {
                 $domains[] = $entitlement->entitleable;
             }
         }
 
         foreach ($this->accounts as $wallet) {
             $entitlements = $wallet->entitlements()->where('entitleable_type', Domain::class)->get();
             foreach ($entitlements as $entitlement) {
                 $domains[] = $entitlement->entitleable;
             }
         }
 
         return $domains;
     }
 
     /**
      * The user entitlement.
      *
      * @return \Illuminate\Database\Eloquent\Relations\MorphOne
      */
     public function entitlement()
     {
         return $this->morphOne('App\Entitlement', 'entitleable');
     }
 
     /**
      * Entitlements for this user.
      *
      * Note that these are entitlements that apply to the user account, and not entitlements that
      * this user owns.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function entitlements()
     {
         return $this->hasMany('App\Entitlement', 'entitleable_id', 'id')
             ->where('entitleable_type', User::class);
     }
 
     /**
      * Find whether an email address exists as a user (including deleted users).
      *
      * @param string $email       Email address
      * @param bool   $return_user Return User instance instead of boolean
      *
      * @return \App\User|bool True or User model object if found, False otherwise
      */
     public static function emailExists(string $email, bool $return_user = false)
     {
         if (strpos($email, '@') === false) {
             return false;
         }
 
         $email = \strtolower($email);
 
         $user = self::withTrashed()->where('email', $email)->first();
 
         if ($user) {
             return $return_user ? $user : true;
         }
 
         return false;
     }
 
     /**
      * Helper to find user by email address, whether it is
      * main email address, alias or an external email.
      *
      * If there's more than one alias NULL will be returned.
      *
      * @param string $email    Email address
      * @param bool   $external Search also for an external email
      *
      * @return \App\User User model object if found
      */
     public static function findByEmail(string $email, bool $external = false): ?User
     {
         if (strpos($email, '@') === false) {
             return null;
         }
 
         $email = \strtolower($email);
 
         $user = self::where('email', $email)->first();
 
         if ($user) {
             return $user;
         }
 
         $aliases = UserAlias::where('alias', $email)->get();
 
         if (count($aliases) == 1) {
             return $aliases->first()->user;
         }
 
         // TODO: External email
 
         return null;
     }
 
     public function getJWTIdentifier()
     {
         return $this->getKey();
     }
 
     public function getJWTCustomClaims()
     {
         return [];
     }
 
     /**
      * Return groups controlled by the current user.
      *
      * @param bool $with_accounts Include groups assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function groups($with_accounts = true)
     {
         $wallets = $this->wallets()->pluck('id')->all();
 
         if ($with_accounts) {
             $wallets = array_merge($wallets, $this->accounts()->pluck('wallet_id')->all());
         }
 
         return Group::select(['groups.*', 'entitlements.wallet_id'])
             ->distinct()
             ->join('entitlements', 'entitlements.entitleable_id', '=', 'groups.id')
             ->whereIn('entitlements.wallet_id', $wallets)
             ->where('entitlements.entitleable_type', Group::class);
     }
 
     /**
      * Check if user has an entitlement for the specified SKU.
      *
      * @param string $title The SKU title
      *
      * @return bool True if specified SKU entitlement exists
      */
     public function hasSku($title): bool
     {
         $sku = Sku::where('title', $title)->first();
 
         if (!$sku) {
             return false;
         }
 
         return $this->entitlements()->where('sku_id', $sku->id)->count() > 0;
     }
 
     /**
      * Returns whether this domain is active.
      *
      * @return bool
      */
     public function isActive(): bool
     {
         return ($this->status & self::STATUS_ACTIVE) > 0;
     }
 
     /**
      * Returns whether this domain is deleted.
      *
      * @return bool
      */
     public function isDeleted(): bool
     {
         return ($this->status & self::STATUS_DELETED) > 0;
     }
 
     /**
      * Returns whether this (external) domain has been verified
      * to exist in DNS.
      *
      * @return bool
      */
     public function isImapReady(): bool
     {
         return ($this->status & self::STATUS_IMAP_READY) > 0;
     }
 
     /**
      * Returns whether this user is registered in LDAP.
      *
      * @return bool
      */
     public function isLdapReady(): bool
     {
         return ($this->status & self::STATUS_LDAP_READY) > 0;
     }
 
     /**
      * Returns whether this user is new.
      *
      * @return bool
      */
     public function isNew(): bool
     {
         return ($this->status & self::STATUS_NEW) > 0;
     }
 
     /**
      * Returns whether this domain is suspended.
      *
      * @return bool
      */
     public function isSuspended(): bool
     {
         return ($this->status & self::STATUS_SUSPENDED) > 0;
     }
 
     /**
      * A shortcut to get the user name.
      *
      * @param bool $fallback Return "<aa.name> User" if there's no name
      *
      * @return string Full user name
      */
     public function name(bool $fallback = false): string
     {
         $firstname = $this->getSetting('first_name');
         $lastname = $this->getSetting('last_name');
 
         $name = trim($firstname . ' ' . $lastname);
 
         if (empty($name) && $fallback) {
             return \config('app.name') . ' User';
         }
 
         return $name;
     }
 
     /**
      * Remove a number of entitlements for the SKU.
      *
      * @param \App\Sku $sku   The SKU
      * @param int      $count The number of entitlements to remove
      *
      * @return User Self
      */
     public function removeSku(Sku $sku, int $count = 1): User
     {
         $entitlements = $this->entitlements()
             ->where('sku_id', $sku->id)
             ->orderBy('cost', 'desc')
             ->orderBy('created_at')
             ->get();
 
         $entitlements_count = count($entitlements);
 
         foreach ($entitlements as $entitlement) {
             if ($entitlements_count <= $sku->units_free) {
                 continue;
             }
 
             if ($count > 0) {
                 $entitlement->delete();
                 $entitlements_count--;
                 $count--;
             }
         }
 
         return $this;
     }
 
     /**
      * Any (additional) properties of this user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function settings()
     {
         return $this->hasMany('App\UserSetting', 'user_id');
     }
 
     /**
      * Suspend this domain.
      *
      * @return void
      */
     public function suspend(): void
     {
         if ($this->isSuspended()) {
             return;
         }
 
         $this->status |= User::STATUS_SUSPENDED;
         $this->save();
     }
 
     /**
      * The tenant for this user account.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function tenant()
     {
         return $this->belongsTo('App\Tenant', 'tenant_id', 'id');
     }
 
     /**
      * Unsuspend this domain.
      *
      * @return void
      */
     public function unsuspend(): void
     {
         if (!$this->isSuspended()) {
             return;
         }
 
         $this->status ^= User::STATUS_SUSPENDED;
         $this->save();
     }
 
     /**
      * Return users controlled by the current user.
      *
      * @param bool $with_accounts Include users assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function users($with_accounts = true)
     {
         $wallets = $this->wallets()->pluck('id')->all();
 
         if ($with_accounts) {
             $wallets = array_merge($wallets, $this->accounts()->pluck('wallet_id')->all());
         }
 
         return $this->select(['users.*', 'entitlements.wallet_id'])
             ->distinct()
             ->leftJoin('entitlements', 'entitlements.entitleable_id', '=', 'users.id')
             ->whereIn('entitlements.wallet_id', $wallets)
             ->where('entitlements.entitleable_type', User::class);
     }
 
     /**
      * Verification codes for this user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function verificationcodes()
     {
         return $this->hasMany('App\VerificationCode', 'user_id', 'id');
     }
 
     /**
      * Returns the wallet by which the user is controlled
      *
      * @return ?\App\Wallet A wallet object
      */
     public function wallet(): ?Wallet
     {
         $entitlement = $this->entitlement()->withTrashed()->first();
 
         // TODO: No entitlement should not happen, but in tests we have
         //       such cases, so we fallback to the user's wallet in this case
         return $entitlement ? $entitlement->wallet : $this->wallets()->first();
     }
 
     /**
      * Wallets this user owns.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function wallets()
     {
         return $this->hasMany('App\Wallet');
     }
 
     /**
      * User password mutator
      *
      * @param string $password The password in plain text.
      *
      * @return void
      */
     public function setPasswordAttribute($password)
     {
         if (!empty($password)) {
             $this->attributes['password'] = bcrypt($password, [ "rounds" => 12 ]);
             $this->attributes['password_ldap'] = '{SSHA512}' . base64_encode(
                 pack('H*', hash('sha512', $password))
             );
         }
     }
 
     /**
      * User LDAP password mutator
      *
      * @param string $password The password in plain text.
      *
      * @return void
      */
     public function setPasswordLdapAttribute($password)
     {
         $this->setPasswordAttribute($password);
     }
 
     /**
      * User status mutator
      *
      * @throws \Exception
      */
     public function setStatusAttribute($status)
     {
         $new_status = 0;
 
         $allowed_values = [
             self::STATUS_NEW,
             self::STATUS_ACTIVE,
             self::STATUS_SUSPENDED,
             self::STATUS_DELETED,
             self::STATUS_LDAP_READY,
             self::STATUS_IMAP_READY,
         ];
 
         foreach ($allowed_values as $value) {
             if ($status & $value) {
                 $new_status |= $value;
                 $status ^= $value;
             }
         }
 
         if ($status > 0) {
             throw new \Exception("Invalid user status: {$status}");
         }
 
         $this->attributes['status'] = $new_status;
     }
 }
diff --git a/src/app/Wallet.php b/src/app/Wallet.php
index 8c0a77ec..882dedec 100644
--- a/src/app/Wallet.php
+++ b/src/app/Wallet.php
@@ -1,400 +1,417 @@
 <?php
 
 namespace App;
 
 use App\User;
 use App\Traits\SettingsTrait;
 use Carbon\Carbon;
 use Iatstuti\Database\Support\NullableFields;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Facades\DB;
 
 /**
  * The eloquent definition of a wallet -- a container with a chunk of change.
  *
  * A wallet is owned by an {@link \App\User}.
  *
  * @property integer $balance
  */
 class Wallet extends Model
 {
     use NullableFields;
     use SettingsTrait;
 
     public $incrementing = false;
     protected $keyType = 'string';
 
     public $timestamps = false;
 
     protected $attributes = [
         'balance' => 0,
         'currency' => 'CHF'
     ];
 
     protected $fillable = [
         'currency'
     ];
 
     protected $nullable = [
         'description',
     ];
 
     protected $casts = [
         'balance' => 'integer',
     ];
 
 
     /**
      * Add a controller to this wallet.
      *
      * @param \App\User $user The user to add as a controller to this wallet.
      *
      * @return void
      */
     public function addController(User $user)
     {
         if (!$this->controllers->contains($user)) {
             $this->controllers()->save($user);
         }
     }
 
     public function chargeEntitlements($apply = true)
     {
         // This wallet has been created less than a month ago, this is the trial period
         if ($this->owner->created_at >= Carbon::now()->subMonthsWithoutOverflow(1)) {
             // Move all the current entitlement's updated_at timestamps forward to one month after
             // this wallet was created.
             $freeMonthEnds = $this->owner->created_at->copy()->addMonthsWithoutOverflow(1);
 
             foreach ($this->entitlements()->get()->fresh() as $entitlement) {
                 if ($entitlement->updated_at < $freeMonthEnds) {
                     $entitlement->updated_at = $freeMonthEnds;
                     $entitlement->save();
                 }
             }
 
             return 0;
         }
 
+        $profit = 0;
         $charges = 0;
         $discount = $this->getDiscountRate();
 
         DB::beginTransaction();
 
         // used to parent individual entitlement billings to the wallet debit.
         $entitlementTransactions = [];
 
         foreach ($this->entitlements()->get()->fresh() as $entitlement) {
             // This entitlement has been created less than or equal to 14 days ago (this is at
             // maximum the fourteenth 24-hour period).
             if ($entitlement->created_at > Carbon::now()->subDays(14)) {
                 continue;
             }
 
             // This entitlement was created, or billed last, less than a month ago.
             if ($entitlement->updated_at > Carbon::now()->subMonthsWithoutOverflow(1)) {
                 continue;
             }
 
             // updated last more than a month ago -- was it billed?
             if ($entitlement->updated_at <= Carbon::now()->subMonthsWithoutOverflow(1)) {
                 $diff = $entitlement->updated_at->diffInMonths(Carbon::now());
 
                 $cost = (int) ($entitlement->cost * $discount * $diff);
+                $fee = (int) ($entitlement->fee * $diff);
 
                 $charges += $cost;
+                $profit += $cost - $fee;
 
                 // if we're in dry-run, you know...
                 if (!$apply) {
                     continue;
                 }
 
                 $entitlement->updated_at = $entitlement->updated_at->copy()
                     ->addMonthsWithoutOverflow($diff);
 
                 $entitlement->save();
 
                 if ($cost == 0) {
                     continue;
                 }
 
                 $entitlementTransactions[] = $entitlement->createTransaction(
                     \App\Transaction::ENTITLEMENT_BILLED,
                     $cost
                 );
             }
         }
 
         if ($apply) {
-            $this->debit($charges, $entitlementTransactions);
+            $this->debit($charges, '', $entitlementTransactions);
+
+            // Credit/debit the reseller
+            if ($profit != 0 && $this->owner->tenant) {
+                // FIXME: Should we have a simpler way to skip this for non-reseller tenant(s)
+                if ($wallet = $this->owner->tenant->wallet()) {
+                    $desc = "Charged user {$this->owner->email}";
+                    $method = $profit > 0 ? 'credit' : 'debit';
+                    $wallet->{$method}(abs($profit), $desc);
+                }
+            }
         }
 
         DB::commit();
 
         return $charges;
     }
 
     /**
      * Calculate for how long the current balance will last.
      *
      * Returns NULL for balance < 0 or discount = 100% or on a fresh account
      *
      * @return \Carbon\Carbon|null Date
      */
     public function balanceLastsUntil()
     {
         if ($this->balance < 0 || $this->getDiscount() == 100) {
             return null;
         }
 
         // retrieve any expected charges
         $expectedCharge = $this->expectedCharges();
 
         // get the costs per day for all entitlements billed against this wallet
         $costsPerDay = $this->costsPerDay();
 
         if (!$costsPerDay) {
             return null;
         }
 
         // the number of days this balance, minus the expected charges, would last
         $daysDelta = ($this->balance - $expectedCharge) / $costsPerDay;
 
         // calculate from the last entitlement billed
         $entitlement = $this->entitlements()->orderBy('updated_at', 'desc')->first();
 
         $until = $entitlement->updated_at->copy()->addDays($daysDelta);
 
         // Don't return dates from the past
         if ($until < Carbon::now() && !$until->isToday()) {
             return null;
         }
 
         return $until;
     }
 
     /**
      * Controllers of this wallet.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
      */
     public function controllers()
     {
         return $this->belongsToMany(
             'App\User',         // The foreign object definition
             'user_accounts',    // The table name
             'wallet_id',      // The local foreign key
             'user_id'         // The remote foreign key
         );
     }
 
     /**
      * Retrieve the costs per day of everything charged to this wallet.
      *
      * @return float
      */
     public function costsPerDay()
     {
         $costs = (float) 0;
 
         foreach ($this->entitlements as $entitlement) {
             $costs += $entitlement->costsPerDay();
         }
 
         return $costs;
     }
 
     /**
      * Add an amount of pecunia to this wallet's balance.
      *
      * @param int    $amount      The amount of pecunia to add (in cents).
      * @param string $description The transaction description
      *
      * @return Wallet Self
      */
     public function credit(int $amount, string $description = ''): Wallet
     {
         $this->balance += $amount;
 
         $this->save();
 
         \App\Transaction::create(
             [
                 'object_id' => $this->id,
                 'object_type' => \App\Wallet::class,
                 'type' => \App\Transaction::WALLET_CREDIT,
                 'amount' => $amount,
                 'description' => $description
             ]
         );
 
         return $this;
     }
 
     /**
      * Deduct an amount of pecunia from this wallet's balance.
      *
-     * @param int   $amount The amount of pecunia to deduct (in cents).
-     * @param array $eTIDs  List of transaction IDs for the individual entitlements that make up
-     *                      this debit record, if any.
+     * @param int    $amount      The amount of pecunia to deduct (in cents).
+     * @param string $description The transaction description
+     * @param array  $eTIDs       List of transaction IDs for the individual entitlements
+     *                            that make up this debit record, if any.
      * @return Wallet Self
      */
-    public function debit(int $amount, array $eTIDs = []): Wallet
+    public function debit(int $amount, string $description = '', array $eTIDs = []): Wallet
     {
         if ($amount == 0) {
             return $this;
         }
 
         $this->balance -= $amount;
 
         $this->save();
 
         $transaction = \App\Transaction::create(
             [
                 'object_id' => $this->id,
                 'object_type' => \App\Wallet::class,
                 'type' => \App\Transaction::WALLET_DEBIT,
-                'amount' => $amount * -1
+                'amount' => $amount * -1,
+                'description' => $description
             ]
         );
 
-        \App\Transaction::whereIn('id', $eTIDs)->update(['transaction_id' => $transaction->id]);
+        if (!empty($eTIDs)) {
+            \App\Transaction::whereIn('id', $eTIDs)->update(['transaction_id' => $transaction->id]);
+        }
 
         return $this;
     }
 
     /**
      * The discount assigned to the wallet.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function discount()
     {
         return $this->belongsTo('App\Discount', 'discount_id', 'id');
     }
 
     /**
      * Entitlements billed to this wallet.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function entitlements()
     {
         return $this->hasMany('App\Entitlement');
     }
 
     /**
      * Calculate the expected charges to this wallet.
      *
      * @return int
      */
     public function expectedCharges()
     {
         return $this->chargeEntitlements(false);
     }
 
     /**
      * Return the exact, numeric version of the discount to be applied.
      *
      * Ranges from 0 - 100.
      *
      * @return int
      */
     public function getDiscount()
     {
         return $this->discount ? $this->discount->discount : 0;
     }
 
     /**
      * The actual discount rate for use in multiplication
      *
      * Ranges from 0.00 to 1.00.
      */
     public function getDiscountRate()
     {
         return (100 - $this->getDiscount()) / 100;
     }
 
     /**
      * A helper to display human-readable amount of money using
      * the wallet currency and specified locale.
      *
      * @param int    $amount A amount of money (in cents)
      * @param string $locale A locale for the output
      *
      * @return string String representation, e.g. "9.99 CHF"
      */
     public function money(int $amount, $locale = 'de_DE')
     {
         $amount = round($amount / 100, 2);
 
         // Prefer intl extension's number formatter
         if (class_exists('NumberFormatter')) {
             $nf = new \NumberFormatter($locale, \NumberFormatter::CURRENCY);
             $result = $nf->formatCurrency($amount, $this->currency);
             // Replace non-breaking space
             return str_replace("\xC2\xA0", " ", $result);
         }
 
         return sprintf('%.2f %s', $amount, $this->currency);
     }
 
     /**
      * The owner of the wallet -- the wallet is in his/her back pocket.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function owner()
     {
         return $this->belongsTo('App\User', 'user_id', 'id');
     }
 
     /**
      * Payments on this wallet.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function payments()
     {
         return $this->hasMany('App\Payment');
     }
 
     /**
      * Remove a controller from this wallet.
      *
      * @param \App\User $user The user to remove as a controller from this wallet.
      *
      * @return void
      */
     public function removeController(User $user)
     {
         if ($this->controllers->contains($user)) {
             $this->controllers()->detach($user);
         }
     }
 
     /**
      * Any (additional) properties of this wallet.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function settings()
     {
         return $this->hasMany('App\WalletSetting');
     }
 
     /**
      * Retrieve the transactions against this wallet.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function transactions()
     {
         return \App\Transaction::where(
             [
                 'object_id' => $this->id,
                 'object_type' => \App\Wallet::class
             ]
         );
     }
 }
diff --git a/src/database/migrations/2019_12_10_100355_create_package_skus_table.php b/src/database/migrations/2019_12_10_100355_create_package_skus_table.php
index 1dee1e15..cdb96ef9 100644
--- a/src/database/migrations/2019_12_10_100355_create_package_skus_table.php
+++ b/src/database/migrations/2019_12_10_100355_create_package_skus_table.php
@@ -1,45 +1,44 @@
 <?php
 
 use Illuminate\Support\Facades\Schema;
 use Illuminate\Database\Schema\Blueprint;
 use Illuminate\Database\Migrations\Migration;
 
 // phpcs:ignore
 class CreatePackageSkusTable extends Migration
 {
     /**
      * Run the migrations.
      *
      * @return void
      */
     public function up()
     {
         Schema::create(
             'package_skus',
             function (Blueprint $table) {
                 $table->bigIncrements('id');
                 $table->string('package_id', 36);
                 $table->string('sku_id', 36);
                 $table->integer('qty')->default(1);
-
                 $table->integer('cost')->default(0)->nullable();
 
                 $table->foreign('package_id')->references('id')->on('packages')
                     ->onDelete('cascade')->onUpdate('cascade');
 
                 $table->foreign('sku_id')->references('id')->on('skus')
                     ->onDelete('cascade')->onUpdate('cascade');
             }
         );
     }
 
     /**
      * Reverse the migrations.
      *
      * @return void
      */
     public function down()
     {
         Schema::dropIfExists('package_skus');
     }
 }
diff --git a/src/database/migrations/2020_05_05_095212_create_tenants_table.php b/src/database/migrations/2020_05_05_095212_create_tenants_table.php
index 23f50cbf..8a1a463a 100644
--- a/src/database/migrations/2020_05_05_095212_create_tenants_table.php
+++ b/src/database/migrations/2020_05_05_095212_create_tenants_table.php
@@ -1,53 +1,84 @@
 <?php
 
 use Illuminate\Database\Migrations\Migration;
 use Illuminate\Database\Schema\Blueprint;
 use Illuminate\Support\Facades\Schema;
 
 // phpcs:ignore
 class CreateTenantsTable extends Migration
 {
     /**
      * Run the migrations.
      *
      * @return void
      */
     public function up()
     {
         Schema::create(
             'tenants',
             function (Blueprint $table) {
                 $table->bigIncrements('id');
                 $table->string('title', 32);
                 $table->timestamps();
             }
         );
 
-        Schema::table(
-            'users',
-            function (Blueprint $table) {
-                $table->bigInteger('tenant_id')->unsigned()->nullable();
+        \App\Tenant::create(['title' => 'Kolab Now']);
+
+        foreach (['users', 'discounts', 'domains', 'plans', 'packages', 'skus'] as $table_name) {
+            Schema::table(
+                $table_name,
+                function (Blueprint $table) {
+                    $table->bigInteger('tenant_id')->unsigned()->nullable();
+                    $table->foreign('tenant_id')->references('id')->on('tenants')->onDelete('set null');
+                }
+            );
 
-                $table->foreign('tenant_id')->references('id')->on('tenants')->onDelete('set null');
+            if ($tenant_id = \config('app.tenant_id')) {
+                DB::statement("UPDATE `{$table_name}` SET `tenant_id` = {$tenant_id}");
             }
-        );
+        }
+
+        // Add fee column
+        foreach (['entitlements', 'skus'] as $table) {
+            Schema::table(
+                $table,
+                function (Blueprint $table) {
+                    $table->integer('fee')->nullable();
+                }
+            );
+        }
+
+        // FIXME: Should we also have package_skus.fee ?
+        //        We have package_skus.cost, but I think it is not used anywhere.
     }
 
     /**
      * Reverse the migrations.
      *
      * @return void
      */
     public function down()
     {
-        Schema::table(
-            'users',
-            function (Blueprint $table) {
-                $table->dropForeign(['tenant_id']);
-                $table->dropColumn('tenant_id');
-            }
-        );
+        foreach (['users', 'discounts', 'domains', 'plans', 'packages', 'skus'] as $table_name) {
+            Schema::table(
+                $table_name,
+                function (Blueprint $table) {
+                    $table->dropForeign(['tenant_id']);
+                    $table->dropColumn('tenant_id');
+                }
+            );
+        }
+
+        foreach (['entitlements', 'skus'] as $table) {
+            Schema::table(
+                $table,
+                function (Blueprint $table) {
+                    $table->dropColumn('fee');
+                }
+            );
+        }
 
         Schema::dropIfExists('tenants');
     }
 }
diff --git a/src/database/migrations/2021_01_26_150000_change_sku_descriptions.php b/src/database/migrations/2021_01_26_150000_change_sku_descriptions.php
index 7af011e5..4896bd01 100644
--- a/src/database/migrations/2021_01_26_150000_change_sku_descriptions.php
+++ b/src/database/migrations/2021_01_26_150000_change_sku_descriptions.php
@@ -1,36 +1,42 @@
 <?php
 
 use Illuminate\Support\Facades\Schema;
 use Illuminate\Database\Schema\Blueprint;
 use Illuminate\Database\Migrations\Migration;
 
 // phpcs:ignore
 class ChangeSkuDescriptions extends Migration
 {
     /**
      * Run the migrations.
      *
      * @return void
      */
     public function up()
     {
         $beta_sku = \App\Sku::where('title', 'beta')->first();
-        $beta_sku->name = 'Private Beta (invitation only)';
-        $beta_sku->description = 'Access to the private beta program subscriptions';
-        $beta_sku->save();
+
+        if ($beta_sku) {
+            $beta_sku->name = 'Private Beta (invitation only)';
+            $beta_sku->description = 'Access to the private beta program subscriptions';
+            $beta_sku->save();
+        }
 
         $meet_sku = \App\Sku::where('title', 'meet')->first();
-        $meet_sku->name = 'Voice & Video Conferencing (public beta)';
-        $meet_sku->handler_class = 'App\Handlers\Meet';
-        $meet_sku->save();
+
+        if ($meet_sku) {
+            $meet_sku->name = 'Voice & Video Conferencing (public beta)';
+            $meet_sku->handler_class = 'App\Handlers\Meet';
+            $meet_sku->save();
+        }
     }
 
     /**
      * Reverse the migrations.
      *
      * @return void
      */
     public function down()
     {
     }
 }
diff --git a/src/database/migrations/2021_02_19_093832_discounts_add_tenant_id.php b/src/database/migrations/2021_02_19_093832_discounts_add_tenant_id.php
deleted file mode 100644
index 99b274be..00000000
--- a/src/database/migrations/2021_02_19_093832_discounts_add_tenant_id.php
+++ /dev/null
@@ -1,42 +0,0 @@
-<?php
-
-use Illuminate\Database\Migrations\Migration;
-use Illuminate\Database\Schema\Blueprint;
-use Illuminate\Support\Facades\Schema;
-
-// phpcs:ignore
-class DiscountsAddTenantId extends Migration
-{
-    /**
-     * Run the migrations.
-     *
-     * @return void
-     */
-    public function up()
-    {
-        Schema::table(
-            'discounts',
-            function (Blueprint $table) {
-                $table->bigInteger('tenant_id')->unsigned()->default(\config('app.tenant_id'))->nullable();
-
-                $table->foreign('tenant_id')->references('id')->on('tenants')->onDelete('set null');
-            }
-        );
-    }
-
-    /**
-     * Reverse the migrations.
-     *
-     * @return void
-     */
-    public function down()
-    {
-        Schema::table(
-            'discounts',
-            function (Blueprint $table) {
-                $table->dropForeign(['tenant_id']);
-                $table->dropColumn('tenant_id');
-            }
-        );
-    }
-}
diff --git a/src/database/migrations/2021_02_19_093833_domains_add_tenant_id.php b/src/database/migrations/2021_02_19_093833_domains_add_tenant_id.php
deleted file mode 100644
index 34be8e3b..00000000
--- a/src/database/migrations/2021_02_19_093833_domains_add_tenant_id.php
+++ /dev/null
@@ -1,42 +0,0 @@
-<?php
-
-use Illuminate\Database\Migrations\Migration;
-use Illuminate\Database\Schema\Blueprint;
-use Illuminate\Support\Facades\Schema;
-
-// phpcs:ignore
-class DomainsAddTenantId extends Migration
-{
-    /**
-     * Run the migrations.
-     *
-     * @return void
-     */
-    public function up()
-    {
-        Schema::table(
-            'domains',
-            function (Blueprint $table) {
-                $table->bigInteger('tenant_id')->unsigned()->default(\config('app.tenant_id'))->nullable();
-
-                $table->foreign('tenant_id')->references('id')->on('tenants')->onDelete('set null');
-            }
-        );
-    }
-
-    /**
-     * Reverse the migrations.
-     *
-     * @return void
-     */
-    public function down()
-    {
-        Schema::table(
-            'domains',
-            function (Blueprint $table) {
-                $table->dropForeign(['tenant_id']);
-                $table->dropColumn('tenant_id');
-            }
-        );
-    }
-}
diff --git a/src/database/migrations/2021_05_07_150000_groups_add_tenant_id.php b/src/database/migrations/2021_05_12_150000_groups_add_tenant_id.php
similarity index 77%
rename from src/database/migrations/2021_05_07_150000_groups_add_tenant_id.php
rename to src/database/migrations/2021_05_12_150000_groups_add_tenant_id.php
index ae31b4c6..07882992 100644
--- a/src/database/migrations/2021_05_07_150000_groups_add_tenant_id.php
+++ b/src/database/migrations/2021_05_12_150000_groups_add_tenant_id.php
@@ -1,42 +1,46 @@
 <?php
 
 use Illuminate\Database\Migrations\Migration;
 use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Schema;
 
 // phpcs:ignore
 class GroupsAddTenantId extends Migration
 {
     /**
      * Run the migrations.
      *
      * @return void
      */
     public function up()
     {
         Schema::table(
             'groups',
             function (Blueprint $table) {
-                $table->bigInteger('tenant_id')->unsigned()->default(\config('app.tenant_id'))->nullable();
-
+                $table->bigInteger('tenant_id')->unsigned()->nullable();
                 $table->foreign('tenant_id')->references('id')->on('tenants')->onDelete('set null');
             }
         );
+
+        if ($tenant_id = \config('app.tenant_id')) {
+            DB::statement("UPDATE `groups` SET `tenant_id` = {$tenant_id}");
+        }
     }
 
     /**
      * Reverse the migrations.
      *
      * @return void
      */
     public function down()
     {
         Schema::table(
             'groups',
             function (Blueprint $table) {
                 $table->dropForeign(['tenant_id']);
                 $table->dropColumn('tenant_id');
             }
         );
     }
 }
diff --git a/src/database/seeds/local/TenantSeeder.php b/src/database/seeds/local/TenantSeeder.php
index c4c95598..1f6c10c5 100644
--- a/src/database/seeds/local/TenantSeeder.php
+++ b/src/database/seeds/local/TenantSeeder.php
@@ -1,29 +1,29 @@
 <?php
 
 namespace Database\Seeds\Local;
 
 use App\Tenant;
 use Illuminate\Database\Seeder;
 
 class TenantSeeder extends Seeder
 {
     /**
      * Run the database seeds.
      *
      * @return void
      */
     public function run()
     {
-        Tenant::create(
-            [
-                'title' => 'Kolab Now'
-            ]
-        );
+        if (!Tenant::find(1)) {
+            Tenant::create([
+                    'title' => 'Kolab Now'
+            ]);
+        }
 
-        Tenant::create(
-            [
-                'title' => 'Sample Tenant'
-            ]
-        );
+        if (!Tenant::find(2)) {
+            Tenant::create([
+                    'title' => 'Sample Tenant'
+            ]);
+        }
     }
 }
diff --git a/src/tests/Feature/Controller/Admin/WalletsTest.php b/src/tests/Feature/Controller/Admin/WalletsTest.php
index 5b8c4fb6..b1a37af0 100644
--- a/src/tests/Feature/Controller/Admin/WalletsTest.php
+++ b/src/tests/Feature/Controller/Admin/WalletsTest.php
@@ -1,228 +1,234 @@
 <?php
 
 namespace Tests\Feature\Controller\Admin;
 
 use App\Discount;
 use App\Transaction;
 use Tests\TestCase;
 
 class WalletsTest extends TestCase
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
         self::useAdminUrl();
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         parent::tearDown();
     }
 
     /**
      * Test fetching a wallet (GET /api/v4/wallets/:id)
      *
      * @group stripe
      */
     public function testShow(): void
     {
         \config(['services.payment_provider' => 'stripe']);
 
         $user = $this->getTestUser('john@kolab.org');
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
         $wallet = $user->wallets()->first();
         $wallet->discount_id = null;
         $wallet->save();
 
         // Make sure there's no stripe/mollie identifiers
         $wallet->setSetting('stripe_id', null);
         $wallet->setSetting('stripe_mandate_id', null);
         $wallet->setSetting('mollie_id', null);
         $wallet->setSetting('mollie_mandate_id', null);
 
         // Non-admin user
         $response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}");
         $response->assertStatus(403);
 
         // Admin user
         $response = $this->actingAs($admin)->get("api/v4/wallets/{$wallet->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame($wallet->id, $json['id']);
         $this->assertSame('CHF', $json['currency']);
         $this->assertSame($wallet->balance, $json['balance']);
         $this->assertSame(0, $json['discount']);
         $this->assertTrue(empty($json['description']));
         $this->assertTrue(empty($json['discount_description']));
         $this->assertTrue(!empty($json['provider']));
         $this->assertTrue(empty($json['providerLink']));
         $this->assertTrue(!empty($json['mandate']));
     }
 
     /**
      * Test awarding/penalizing a wallet (POST /api/v4/wallets/:id/one-off)
      */
     public function testOneOff(): void
     {
         $user = $this->getTestUser('john@kolab.org');
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
         $wallet = $user->wallets()->first();
         $balance = $wallet->balance;
+        $reseller = $this->getTestUser('reseller@kolabnow.com');
+        $wallet = $user->wallets()->first();
+        $reseller_wallet = $reseller->wallets()->first();
+        $reseller_balance = $reseller_wallet->balance;
 
         Transaction::where('object_id', $wallet->id)
             ->whereIn('type', [Transaction::WALLET_AWARD, Transaction::WALLET_PENALTY])
             ->delete();
 
         // Non-admin user
         $response = $this->actingAs($user)->post("api/v4/wallets/{$wallet->id}/one-off", []);
         $response->assertStatus(403);
 
         // Admin user - invalid input
         $post = ['amount' => 'aaaa'];
         $response = $this->actingAs($admin)->post("api/v4/wallets/{$wallet->id}/one-off", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertSame('The amount must be a number.', $json['errors']['amount'][0]);
         $this->assertSame('The description field is required.', $json['errors']['description'][0]);
         $this->assertCount(2, $json);
         $this->assertCount(2, $json['errors']);
 
         // Admin user - a valid bonus
         $post = ['amount' => '50', 'description' => 'A bonus'];
         $response = $this->actingAs($admin)->post("api/v4/wallets/{$wallet->id}/one-off", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame('The bonus has been added to the wallet successfully.', $json['message']);
         $this->assertSame($balance += 5000, $json['balance']);
         $this->assertSame($balance, $wallet->fresh()->balance);
+        $this->assertSame($reseller_balance, $reseller_wallet->fresh()->balance);
 
         $transaction = Transaction::where('object_id', $wallet->id)
             ->where('type', Transaction::WALLET_AWARD)->first();
 
         $this->assertSame($post['description'], $transaction->description);
         $this->assertSame(5000, $transaction->amount);
         $this->assertSame($admin->email, $transaction->user_email);
 
         // Admin user - a valid penalty
         $post = ['amount' => '-40', 'description' => 'A penalty'];
         $response = $this->actingAs($admin)->post("api/v4/wallets/{$wallet->id}/one-off", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame('The penalty has been added to the wallet successfully.', $json['message']);
         $this->assertSame($balance -= 4000, $json['balance']);
         $this->assertSame($balance, $wallet->fresh()->balance);
+        $this->assertSame($reseller_balance, $reseller_wallet->fresh()->balance);
 
         $transaction = Transaction::where('object_id', $wallet->id)
             ->where('type', Transaction::WALLET_PENALTY)->first();
 
         $this->assertSame($post['description'], $transaction->description);
         $this->assertSame(-4000, $transaction->amount);
         $this->assertSame($admin->email, $transaction->user_email);
     }
 
     /**
      * Test fetching wallet transactions (GET /api/v4/wallets/:id/transactions)
      */
     public function testTransactions(): void
     {
         // Note: Here we're testing only that the end-point works,
         // and admin can get the transaction log, response details
         // are tested in Feature/Controller/WalletsTest.php
         $this->deleteTestUser('wallets-controller@kolabnow.com');
         $user = $this->getTestUser('wallets-controller@kolabnow.com');
         $wallet = $user->wallets()->first();
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
 
         // Non-admin
         $response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/transactions");
         $response->assertStatus(403);
 
         // Create some sample transactions
         $transactions = $this->createTestTransactions($wallet);
         $transactions = array_reverse($transactions);
         $pages = array_chunk($transactions, 10 /* page size*/);
 
         // Get the 2nd page
         $response = $this->actingAs($admin)->get("api/v4/wallets/{$wallet->id}/transactions?page=2");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(5, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame(2, $json['page']);
         $this->assertSame(2, $json['count']);
         $this->assertSame(false, $json['hasMore']);
         $this->assertCount(2, $json['list']);
         foreach ($pages[1] as $idx => $transaction) {
             $this->assertSame($transaction->id, $json['list'][$idx]['id']);
             $this->assertSame($transaction->type, $json['list'][$idx]['type']);
             $this->assertSame($transaction->shortDescription(), $json['list'][$idx]['description']);
             $this->assertFalse($json['list'][$idx]['hasDetails']);
         }
 
         // The 'user' key is set only on the admin end-point
         $this->assertSame('jeroen@jeroen.jeroen', $json['list'][1]['user']);
     }
 
     /**
      * Test updating a wallet (PUT /api/v4/wallets/:id)
      */
     public function testUpdate(): void
     {
         $user = $this->getTestUser('john@kolab.org');
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
         $wallet = $user->wallets()->first();
         $discount = Discount::where('code', 'TEST')->first();
 
         // Non-admin user
         $response = $this->actingAs($user)->put("api/v4/wallets/{$wallet->id}", []);
         $response->assertStatus(403);
 
         // Admin user - setting a discount
         $post = ['discount' => $discount->id];
         $response = $this->actingAs($admin)->put("api/v4/wallets/{$wallet->id}", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame('User wallet updated successfully.', $json['message']);
         $this->assertSame($wallet->id, $json['id']);
         $this->assertSame($discount->discount, $json['discount']);
         $this->assertSame($discount->id, $json['discount_id']);
         $this->assertSame($discount->description, $json['discount_description']);
         $this->assertSame($discount->id, $wallet->fresh()->discount->id);
 
         // Admin user - removing a discount
         $post = ['discount' => null];
         $response = $this->actingAs($admin)->put("api/v4/wallets/{$wallet->id}", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame('User wallet updated successfully.', $json['message']);
         $this->assertSame($wallet->id, $json['id']);
         $this->assertSame(null, $json['discount_id']);
         $this->assertTrue(empty($json['discount_description']));
         $this->assertSame(null, $wallet->fresh()->discount);
     }
 }
diff --git a/src/tests/Feature/Controller/Reseller/WalletsTest.php b/src/tests/Feature/Controller/Reseller/WalletsTest.php
index 2469f5c1..a48bd408 100644
--- a/src/tests/Feature/Controller/Reseller/WalletsTest.php
+++ b/src/tests/Feature/Controller/Reseller/WalletsTest.php
@@ -1,292 +1,311 @@
 <?php
 
 namespace Tests\Feature\Controller\Reseller;
 
 use App\Discount;
 use App\Transaction;
 use Tests\TestCase;
 
 class WalletsTest extends TestCase
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
         self::useResellerUrl();
         \config(['app.tenant_id' => 1]);
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         \config(['app.tenant_id' => 1]);
         parent::tearDown();
     }
 
     /**
      * Test fetching a wallet (GET /api/v4/wallets/:id)
      *
      * @group stripe
      */
     public function testShow(): void
     {
         \config(['services.payment_provider' => 'stripe']);
 
         $user = $this->getTestUser('john@kolab.org');
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
         $reseller1 = $this->getTestUser('reseller@kolabnow.com');
         $reseller2 = $this->getTestUser('reseller@reseller.com');
         $wallet = $user->wallets()->first();
         $wallet->discount_id = null;
         $wallet->save();
 
         // Make sure there's no stripe/mollie identifiers
         $wallet->setSetting('stripe_id', null);
         $wallet->setSetting('stripe_mandate_id', null);
         $wallet->setSetting('mollie_id', null);
         $wallet->setSetting('mollie_mandate_id', null);
 
         // Non-admin user
         $response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}");
         $response->assertStatus(403);
 
         // Admin user
         $response = $this->actingAs($admin)->get("api/v4/wallets/{$wallet->id}");
         $response->assertStatus(403);
 
         // Reseller from a different tenant
         $response = $this->actingAs($reseller2)->get("api/v4/wallets/{$wallet->id}");
         $response->assertStatus(403);
 
         // Reseller
         $response = $this->actingAs($reseller1)->get("api/v4/wallets/{$wallet->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame($wallet->id, $json['id']);
         $this->assertSame('CHF', $json['currency']);
         $this->assertSame($wallet->balance, $json['balance']);
         $this->assertSame(0, $json['discount']);
         $this->assertTrue(empty($json['description']));
         $this->assertTrue(empty($json['discount_description']));
         $this->assertTrue(!empty($json['provider']));
         $this->assertTrue(empty($json['providerLink']));
         $this->assertTrue(!empty($json['mandate']));
 
         // Reseller from a different tenant
         \config(['app.tenant_id' => 2]);
         $response = $this->actingAs($reseller2)->get("api/v4/wallets/{$wallet->id}");
         $response->assertStatus(404);
     }
 
     /**
      * Test awarding/penalizing a wallet (POST /api/v4/wallets/:id/one-off)
      */
     public function testOneOff(): void
     {
         $user = $this->getTestUser('john@kolab.org');
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
         $reseller1 = $this->getTestUser('reseller@kolabnow.com');
         $reseller2 = $this->getTestUser('reseller@reseller.com');
         $wallet = $user->wallets()->first();
+        $reseller1_wallet = $reseller1->wallets()->first();
         $balance = $wallet->balance;
+        $reseller1_balance = $reseller1_wallet->balance;
 
         Transaction::where('object_id', $wallet->id)
             ->whereIn('type', [Transaction::WALLET_AWARD, Transaction::WALLET_PENALTY])
             ->delete();
+        Transaction::where('object_id', $reseller1_wallet->id)->delete();
 
         // Non-admin user
         $response = $this->actingAs($user)->post("api/v4/wallets/{$wallet->id}/one-off", []);
         $response->assertStatus(403);
 
         // Admin user
         $response = $this->actingAs($admin)->post("api/v4/wallets/{$wallet->id}/one-off", []);
         $response->assertStatus(403);
 
         // Reseller from a different tenant
         $response = $this->actingAs($reseller2)->post("api/v4/wallets/{$wallet->id}/one-off", []);
         $response->assertStatus(403);
 
         // Admin user - invalid input
         $post = ['amount' => 'aaaa'];
         $response = $this->actingAs($reseller1)->post("api/v4/wallets/{$wallet->id}/one-off", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertSame('The amount must be a number.', $json['errors']['amount'][0]);
         $this->assertSame('The description field is required.', $json['errors']['description'][0]);
         $this->assertCount(2, $json);
         $this->assertCount(2, $json['errors']);
 
-        // Admin user - a valid bonus
+        // A valid bonus
         $post = ['amount' => '50', 'description' => 'A bonus'];
         $response = $this->actingAs($reseller1)->post("api/v4/wallets/{$wallet->id}/one-off", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame('The bonus has been added to the wallet successfully.', $json['message']);
         $this->assertSame($balance += 5000, $json['balance']);
         $this->assertSame($balance, $wallet->fresh()->balance);
+        $this->assertSame($reseller1_balance -= 5000, $reseller1_wallet->fresh()->balance);
 
         $transaction = Transaction::where('object_id', $wallet->id)
             ->where('type', Transaction::WALLET_AWARD)->first();
 
         $this->assertSame($post['description'], $transaction->description);
         $this->assertSame(5000, $transaction->amount);
         $this->assertSame($reseller1->email, $transaction->user_email);
 
-        // Admin user - a valid penalty
+        $transaction = Transaction::where('object_id', $reseller1_wallet->id)
+            ->where('type', Transaction::WALLET_DEBIT)->first();
+
+        $this->assertSame("Awarded user {$user->email}", $transaction->description);
+        $this->assertSame(-5000, $transaction->amount);
+        $this->assertSame($reseller1->email, $transaction->user_email);
+
+        // A valid penalty
         $post = ['amount' => '-40', 'description' => 'A penalty'];
         $response = $this->actingAs($reseller1)->post("api/v4/wallets/{$wallet->id}/one-off", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame('The penalty has been added to the wallet successfully.', $json['message']);
         $this->assertSame($balance -= 4000, $json['balance']);
         $this->assertSame($balance, $wallet->fresh()->balance);
+        $this->assertSame($reseller1_balance += 4000, $reseller1_wallet->fresh()->balance);
 
         $transaction = Transaction::where('object_id', $wallet->id)
             ->where('type', Transaction::WALLET_PENALTY)->first();
 
         $this->assertSame($post['description'], $transaction->description);
         $this->assertSame(-4000, $transaction->amount);
         $this->assertSame($reseller1->email, $transaction->user_email);
 
+        $transaction = Transaction::where('object_id', $reseller1_wallet->id)
+            ->where('type', Transaction::WALLET_CREDIT)->first();
+
+        $this->assertSame("Penalized user {$user->email}", $transaction->description);
+        $this->assertSame(4000, $transaction->amount);
+        $this->assertSame($reseller1->email, $transaction->user_email);
+
         // Reseller from a different tenant
         \config(['app.tenant_id' => 2]);
         $response = $this->actingAs($reseller2)->post("api/v4/wallets/{$wallet->id}/one-off", []);
         $response->assertStatus(404);
     }
 
     /**
      * Test fetching wallet transactions (GET /api/v4/wallets/:id/transactions)
      */
     public function testTransactions(): void
     {
         // Note: Here we're testing only that the end-point works,
         // and admin can get the transaction log, response details
         // are tested in Feature/Controller/WalletsTest.php
 
         $this->deleteTestUser('wallets-controller@kolabnow.com');
         $user = $this->getTestUser('wallets-controller@kolabnow.com');
         $wallet = $user->wallets()->first();
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
         $reseller1 = $this->getTestUser('reseller@kolabnow.com');
         $reseller2 = $this->getTestUser('reseller@reseller.com');
 
         // Non-admin
         $response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/transactions");
         $response->assertStatus(403);
 
         // Admin
         $response = $this->actingAs($admin)->get("api/v4/wallets/{$wallet->id}/transactions");
         $response->assertStatus(403);
 
         // Reseller from a different tenant
         $response = $this->actingAs($reseller2)->get("api/v4/wallets/{$wallet->id}/transactions");
         $response->assertStatus(403);
 
         // Create some sample transactions
         $transactions = $this->createTestTransactions($wallet);
         $transactions = array_reverse($transactions);
         $pages = array_chunk($transactions, 10 /* page size*/);
 
         // Get the 2nd page
         $response = $this->actingAs($reseller1)->get("api/v4/wallets/{$wallet->id}/transactions?page=2");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(5, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame(2, $json['page']);
         $this->assertSame(2, $json['count']);
         $this->assertSame(false, $json['hasMore']);
         $this->assertCount(2, $json['list']);
         foreach ($pages[1] as $idx => $transaction) {
             $this->assertSame($transaction->id, $json['list'][$idx]['id']);
             $this->assertSame($transaction->type, $json['list'][$idx]['type']);
             $this->assertSame($transaction->shortDescription(), $json['list'][$idx]['description']);
             $this->assertFalse($json['list'][$idx]['hasDetails']);
         }
 
         // The 'user' key is set only on the admin/reseller end-point
         // FIXME: Should we hide this for resellers?
         $this->assertSame('jeroen@jeroen.jeroen', $json['list'][1]['user']);
 
         // Reseller from a different tenant
         \config(['app.tenant_id' => 2]);
         $response = $this->actingAs($reseller2)->get("api/v4/wallets/{$wallet->id}/transactions");
         $response->assertStatus(403);
     }
 
     /**
      * Test updating a wallet (PUT /api/v4/wallets/:id)
      */
     public function testUpdate(): void
     {
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
         $reseller1 = $this->getTestUser('reseller@kolabnow.com');
         $reseller2 = $this->getTestUser('reseller@reseller.com');
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
         $discount = Discount::where('code', 'TEST')->first();
 
         // Non-admin user
         $response = $this->actingAs($user)->put("api/v4/wallets/{$wallet->id}", []);
         $response->assertStatus(403);
 
         // Admin
         $response = $this->actingAs($admin)->put("api/v4/wallets/{$wallet->id}", []);
         $response->assertStatus(403);
 
         // Reseller from another tenant
         $response = $this->actingAs($reseller2)->put("api/v4/wallets/{$wallet->id}", []);
         $response->assertStatus(403);
 
         // Admin user - setting a discount
         $post = ['discount' => $discount->id];
         $response = $this->actingAs($reseller1)->put("api/v4/wallets/{$wallet->id}", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame('User wallet updated successfully.', $json['message']);
         $this->assertSame($wallet->id, $json['id']);
         $this->assertSame($discount->discount, $json['discount']);
         $this->assertSame($discount->id, $json['discount_id']);
         $this->assertSame($discount->description, $json['discount_description']);
         $this->assertSame($discount->id, $wallet->fresh()->discount->id);
 
         // Admin user - removing a discount
         $post = ['discount' => null];
         $response = $this->actingAs($reseller1)->put("api/v4/wallets/{$wallet->id}", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame('User wallet updated successfully.', $json['message']);
         $this->assertSame($wallet->id, $json['id']);
         $this->assertSame(null, $json['discount_id']);
         $this->assertTrue(empty($json['discount_description']));
         $this->assertSame(null, $wallet->fresh()->discount);
 
         // Reseller from a different tenant
         \config(['app.tenant_id' => 2]);
         $response = $this->actingAs($reseller2)->put("api/v4/wallets/{$wallet->id}", []);
         $response->assertStatus(404);
     }
 }
diff --git a/src/tests/Feature/EntitlementTest.php b/src/tests/Feature/EntitlementTest.php
index a18f673b..e6f03802 100644
--- a/src/tests/Feature/EntitlementTest.php
+++ b/src/tests/Feature/EntitlementTest.php
@@ -1,184 +1,130 @@
 <?php
 
 namespace Tests\Feature;
 
 use App\Domain;
 use App\Entitlement;
 use App\Package;
 use App\Sku;
 use App\User;
 use Carbon\Carbon;
 use Tests\TestCase;
 
 class EntitlementTest extends TestCase
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('entitlement-test@kolabnow.com');
         $this->deleteTestUser('entitled-user@custom-domain.com');
         $this->deleteTestDomain('custom-domain.com');
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser('entitlement-test@kolabnow.com');
         $this->deleteTestUser('entitled-user@custom-domain.com');
         $this->deleteTestDomain('custom-domain.com');
 
         parent::tearDown();
     }
 
     /**
      * Test for Entitlement::costsPerDay()
      */
     public function testCostsPerDay(): void
     {
         // 444
         // 28 days: 15.86
         // 31 days: 14.32
         $user = $this->getTestUser('entitlement-test@kolabnow.com');
         $package = Package::where('title', 'kolab')->first();
         $mailbox = Sku::where('title', 'mailbox')->first();
 
         $user->assignPackage($package);
 
         $entitlement = $user->entitlements->where('sku_id', $mailbox->id)->first();
 
         $costsPerDay = $entitlement->costsPerDay();
 
         $this->assertTrue($costsPerDay < 15.86);
         $this->assertTrue($costsPerDay > 14.32);
     }
 
     /**
      * Tests for entitlements
      * @todo This really should be in User or Wallet tests file
      */
     public function testEntitlements(): void
     {
         $packageDomain = Package::where('title', 'domain-hosting')->first();
         $packageKolab = Package::where('title', 'kolab')->first();
 
         $skuDomain = Sku::where('title', 'domain-hosting')->first();
         $skuMailbox = Sku::where('title', 'mailbox')->first();
 
         $owner = $this->getTestUser('entitlement-test@kolabnow.com');
         $user = $this->getTestUser('entitled-user@custom-domain.com');
 
         $domain = $this->getTestDomain(
             'custom-domain.com',
             [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_EXTERNAL,
             ]
         );
 
         $domain->assignPackage($packageDomain, $owner);
-
         $owner->assignPackage($packageKolab);
         $owner->assignPackage($packageKolab, $user);
 
         $wallet = $owner->wallets->first();
 
         $this->assertCount(4, $owner->entitlements()->get());
         $this->assertCount(1, $skuDomain->entitlements()->where('wallet_id', $wallet->id)->get());
         $this->assertCount(2, $skuMailbox->entitlements()->where('wallet_id', $wallet->id)->get());
         $this->assertCount(9, $wallet->entitlements);
 
         $this->backdateEntitlements(
             $owner->entitlements,
             Carbon::now()->subMonthsWithoutOverflow(1)
         );
 
         $wallet->chargeEntitlements();
 
         $this->assertTrue($wallet->fresh()->balance < 0);
     }
 
     /**
      * @todo This really should be in User tests file
      */
     public function testEntitlementFunctions(): void
     {
         $user = $this->getTestUser('entitlement-test@kolabnow.com');
 
         $package = \App\Package::where('title', 'kolab')->first();
 
         $user->assignPackage($package);
 
         $wallet = $user->wallets()->first();
         $this->assertNotNull($wallet);
 
         $sku = \App\Sku::where('title', 'mailbox')->first();
 
         $entitlement = Entitlement::where('wallet_id', $wallet->id)
             ->where('sku_id', $sku->id)->first();
 
         $this->assertNotNull($entitlement);
         $this->assertSame($sku->id, $entitlement->sku->id);
         $this->assertSame($wallet->id, $entitlement->wallet->id);
         $this->assertEquals($user->id, $entitlement->entitleable->id);
         $this->assertTrue($entitlement->entitleable instanceof \App\User);
     }
-
-    /**
-     * @todo This really should be in User or Wallet tests file
-     */
-    public function testBillDeletedEntitlement(): void
-    {
-        $user = $this->getTestUser('entitlement-test@kolabnow.com');
-        $package = \App\Package::where('title', 'kolab')->first();
-
-        $storage = \App\Sku::where('title', 'storage')->first();
-
-        $user->assignPackage($package);
-        // some additional SKUs so we have something to delete.
-        $user->assignSku($storage, 4);
-
-        // the mailbox, the groupware, the 2 original storage and the additional 4
-        $this->assertCount(8, $user->fresh()->entitlements);
-
-        $wallet = $user->wallets()->first();
-
-        $backdate = Carbon::now()->subWeeks(7);
-        $this->backdateEntitlements($user->entitlements, $backdate);
-
-        $charge = $wallet->chargeEntitlements();
-
-        $this->assertSame(-1099, $wallet->balance);
-
-        $balance = $wallet->balance;
-        $discount = \App\Discount::where('discount', 30)->first();
-        $wallet->discount()->associate($discount);
-        $wallet->save();
-
-        $user->removeSku($storage, 4);
-
-        // we expect the wallet to have been charged for ~3 weeks of use of
-        // 4 deleted storage entitlements, it should also take discount into account
-        $backdate->addMonthsWithoutOverflow(1);
-        $diffInDays = $backdate->diffInDays(Carbon::now());
-
-        // entitlements-num * cost * discount * days-in-month
-        $max = intval(4 * 25 * 0.7 * $diffInDays / 28);
-        $min = intval(4 * 25 * 0.7 * $diffInDays / 31);
-
-        $wallet->refresh();
-        $this->assertTrue($wallet->balance >= $balance - $max);
-        $this->assertTrue($wallet->balance <= $balance - $min);
-
-        $transactions = \App\Transaction::where('object_id', $wallet->id)
-            ->where('object_type', \App\Wallet::class)->get();
-
-        // one round of the monthly invoicing, four sku deletions getting invoiced
-        $this->assertCount(5, $transactions);
-    }
 }
diff --git a/src/tests/Feature/PlanTest.php b/src/tests/Feature/PlanTest.php
index b3a0dd0d..704a2788 100644
--- a/src/tests/Feature/PlanTest.php
+++ b/src/tests/Feature/PlanTest.php
@@ -1,109 +1,124 @@
 <?php
 
 namespace Tests\Feature;
 
 use App\Entitlement;
 use App\Plan;
 use App\Sku;
 use Tests\TestCase;
 
 class PlanTest extends TestCase
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         Plan::where('title', 'test-plan')->delete();
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         Plan::where('title', 'test-plan')->delete();
 
         parent::tearDown();
     }
 
     /**
      * Tests for plan attributes localization
      */
     public function testPlanLocalization(): void
     {
         $plan = Plan::create([
             'title' => 'test-plan',
             'description' => [
                 'en' => 'Plan-EN',
                 'de' => 'Plan-DE',
             ],
             'name' => 'Test',
         ]);
 
         $this->assertSame('Plan-EN', $plan->description);
         $this->assertSame('Test', $plan->name);
 
         $plan->save();
         $plan = Plan::where('title', 'test-plan')->first();
 
         $this->assertSame('Plan-EN', $plan->description);
         $this->assertSame('Test', $plan->name);
         $this->assertSame('Plan-DE', $plan->getTranslation('description', 'de'));
         $this->assertSame('Test', $plan->getTranslation('name', 'de'));
 
         $plan->setTranslation('name', 'de', 'Prüfung')->save();
 
         $this->assertSame('Prüfung', $plan->getTranslation('name', 'de'));
         $this->assertSame('Test', $plan->getTranslation('name', 'en'));
 
         $plan = Plan::where('title', 'test-plan')->first();
 
         $this->assertSame('Prüfung', $plan->getTranslation('name', 'de'));
         $this->assertSame('Test', $plan->getTranslation('name', 'en'));
 
         // TODO: Test system locale change
     }
 
     /**
      * Tests for Plan::hasDomain()
      */
     public function testHasDomain(): void
     {
         $plan = Plan::where('title', 'individual')->first();
 
         $this->assertTrue($plan->hasDomain() === false);
 
         $plan = Plan::where('title', 'group')->first();
 
         $this->assertTrue($plan->hasDomain() === true);
     }
 
     /**
      * Test for a plan's cost.
      */
     public function testCost(): void
     {
         $plan = Plan::where('title', 'individual')->first();
 
         $package_costs = 0;
 
         foreach ($plan->packages as $package) {
             $package_costs += $package->cost();
         }
 
         $this->assertTrue(
             $package_costs == 999,
             "The total costs of all packages for this plan is not 9.99"
         );
 
         $this->assertTrue(
             $plan->cost() == 999,
             "The total costs for this plan is not 9.99"
         );
 
         $this->assertTrue($plan->cost() == $package_costs);
     }
+
+    public function testTenant(): void
+    {
+        $plan = Plan::where('title', 'individual')->first();
+
+        $tenant = $plan->tenant()->first();
+
+        $this->assertInstanceof(\App\Tenant::class, $tenant);
+        $this->assertSame(1, $tenant->id);
+
+        $tenant = $plan->tenant;
+
+        $this->assertInstanceof(\App\Tenant::class, $tenant);
+        $this->assertSame(1, $tenant->id);
+    }
 }
diff --git a/src/tests/Feature/SkuTest.php b/src/tests/Feature/SkuTest.php
index 406ed56b..88d0cdfd 100644
--- a/src/tests/Feature/SkuTest.php
+++ b/src/tests/Feature/SkuTest.php
@@ -1,94 +1,109 @@
 <?php
 
 namespace Tests\Feature;
 
 use App\Entitlement;
 use App\Handlers;
 use App\Package;
 use App\Sku;
 use Carbon\Carbon;
 use Tests\TestCase;
 
 class SkuTest extends TestCase
 {
 
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('jane@kolabnow.com');
     }
 
     public function tearDown(): void
     {
         $this->deleteTestUser('jane@kolabnow.com');
 
         parent::tearDown();
     }
 
     public function testPackageEntitlements(): void
     {
         $user = $this->getTestUser('jane@kolabnow.com');
 
         $wallet = $user->wallets()->first();
 
         $package = Package::where('title', 'lite')->first();
 
         $sku_mailbox = Sku::where('title', 'mailbox')->first();
         $sku_storage = Sku::where('title', 'storage')->first();
 
         $user = $user->assignPackage($package);
 
         $this->backdateEntitlements($user->fresh()->entitlements, Carbon::now()->subMonthsWithoutOverflow(1));
 
         $wallet->chargeEntitlements();
 
         $this->assertTrue($wallet->balance < 0);
     }
 
     public function testSkuEntitlements(): void
     {
         $this->assertCount(4, Sku::where('title', 'mailbox')->first()->entitlements);
     }
 
     public function testSkuPackages(): void
     {
         $this->assertCount(2, Sku::where('title', 'mailbox')->first()->packages);
     }
 
     public function testSkuHandlerDomainHosting(): void
     {
         $sku = Sku::where('title', 'domain-hosting')->first();
 
         $entitlement = $sku->entitlements->first();
 
         $this->assertSame(
             Handlers\DomainHosting::entitleableClass(),
             $entitlement->entitleable_type
         );
     }
 
     public function testSkuHandlerMailbox(): void
     {
         $sku = Sku::where('title', 'mailbox')->first();
 
         $entitlement = $sku->entitlements->first();
 
         $this->assertSame(
             Handlers\Mailbox::entitleableClass(),
             $entitlement->entitleable_type
         );
     }
 
     public function testSkuHandlerStorage(): void
     {
         $sku = Sku::where('title', 'storage')->first();
 
         $entitlement = $sku->entitlements->first();
 
         $this->assertSame(
             Handlers\Storage::entitleableClass(),
             $entitlement->entitleable_type
         );
     }
+
+    public function testSkuTenant(): void
+    {
+        $sku = Sku::where('title', 'storage')->first();
+
+        $tenant = $sku->tenant()->first();
+
+        $this->assertInstanceof(\App\Tenant::class, $tenant);
+        $this->assertSame(1, $tenant->id);
+
+        $tenant = $sku->tenant;
+
+        $this->assertInstanceof(\App\Tenant::class, $tenant);
+        $this->assertSame(1, $tenant->id);
+    }
 }
diff --git a/src/tests/Feature/TenantTest.php b/src/tests/Feature/TenantTest.php
new file mode 100644
index 00000000..02a395b8
--- /dev/null
+++ b/src/tests/Feature/TenantTest.php
@@ -0,0 +1,40 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Tenant;
+use Tests\TestCase;
+
+class TenantTest extends TestCase
+{
+
+    /**
+     * {@inheritDoc}
+     */
+    public function setUp(): void
+    {
+        parent::setUp();
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public function tearDown(): void
+    {
+        parent::tearDown();
+    }
+
+    /**
+     * Test Tenant::wallet() method
+     */
+    public function testWallet(): void
+    {
+        $tenant = Tenant::find(1);
+        $user = \App\User::where('email', 'reseller@kolabnow.com')->first();
+
+        $wallet = $tenant->wallet();
+
+        $this->assertInstanceof(\App\Wallet::class, $wallet);
+        $this->assertSame($user->wallets->first()->id, $wallet->id);
+    }
+}
diff --git a/src/tests/Feature/UserTest.php b/src/tests/Feature/UserTest.php
index 28e2f356..f4fa41ff 100644
--- a/src/tests/Feature/UserTest.php
+++ b/src/tests/Feature/UserTest.php
@@ -1,833 +1,878 @@
 <?php
 
 namespace Tests\Feature;
 
 use App\Domain;
 use App\Group;
 use App\User;
 use Illuminate\Support\Facades\Queue;
 use Tests\TestCase;
 
 class UserTest extends TestCase
 {
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('user-test@' . \config('app.domain'));
         $this->deleteTestUser('UserAccountA@UserAccount.com');
         $this->deleteTestUser('UserAccountB@UserAccount.com');
         $this->deleteTestUser('UserAccountC@UserAccount.com');
         $this->deleteTestGroup('test-group@UserAccount.com');
         $this->deleteTestDomain('UserAccount.com');
         $this->deleteTestDomain('UserAccountAdd.com');
     }
 
     public function tearDown(): void
     {
         $this->deleteTestUser('user-test@' . \config('app.domain'));
         $this->deleteTestUser('UserAccountA@UserAccount.com');
         $this->deleteTestUser('UserAccountB@UserAccount.com');
         $this->deleteTestUser('UserAccountC@UserAccount.com');
         $this->deleteTestGroup('test-group@UserAccount.com');
         $this->deleteTestDomain('UserAccount.com');
         $this->deleteTestDomain('UserAccountAdd.com');
 
         parent::tearDown();
     }
 
     /**
      * Tests for User::assignPackage()
      */
     public function testAssignPackage(): void
     {
         $this->markTestIncomplete();
     }
 
     /**
      * Tests for User::assignPlan()
      */
     public function testAssignPlan(): void
     {
         $this->markTestIncomplete();
     }
 
     /**
      * Tests for User::assignSku()
      */
     public function testAssignSku(): void
     {
         $this->markTestIncomplete();
     }
 
     /**
      * Verify a wallet assigned a controller is among the accounts of the assignee.
      */
     public function testAccounts(): void
     {
         $userA = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
 
         $this->assertTrue($userA->wallets()->count() == 1);
 
         $userA->wallets()->each(
             function ($wallet) use ($userB) {
                 $wallet->addController($userB);
             }
         );
 
         $this->assertTrue($userB->accounts()->get()[0]->id === $userA->wallets()->get()[0]->id);
     }
 
     public function testCanDelete(): void
     {
         $this->markTestIncomplete();
     }
 
     /**
      * Test User::canRead() method
      */
     public function testCanRead(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $reseller1 = $this->getTestUser('reseller@kolabnow.com');
         $reseller2 = $this->getTestUser('reseller@reseller.com');
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
         $domain = $this->getTestDomain('kolab.org');
 
         // Admin
         $this->assertTrue($admin->canRead($admin));
         $this->assertTrue($admin->canRead($john));
         $this->assertTrue($admin->canRead($jack));
         $this->assertTrue($admin->canRead($reseller1));
         $this->assertTrue($admin->canRead($reseller2));
         $this->assertTrue($admin->canRead($domain));
         $this->assertTrue($admin->canRead($domain->wallet()));
 
         // Reseller - kolabnow
         $this->assertTrue($reseller1->canRead($john));
         $this->assertTrue($reseller1->canRead($jack));
         $this->assertTrue($reseller1->canRead($reseller1));
         $this->assertTrue($reseller1->canRead($domain));
         $this->assertTrue($reseller1->canRead($domain->wallet()));
         $this->assertFalse($reseller1->canRead($reseller2));
         $this->assertFalse($reseller1->canRead($admin));
 
         // Reseller - different tenant
         $this->assertTrue($reseller2->canRead($reseller2));
         $this->assertFalse($reseller2->canRead($john));
         $this->assertFalse($reseller2->canRead($jack));
         $this->assertFalse($reseller2->canRead($reseller1));
         $this->assertFalse($reseller2->canRead($domain));
         $this->assertFalse($reseller2->canRead($domain->wallet()));
         $this->assertFalse($reseller2->canRead($admin));
 
         // Normal user - account owner
         $this->assertTrue($john->canRead($john));
         $this->assertTrue($john->canRead($ned));
         $this->assertTrue($john->canRead($jack));
         $this->assertTrue($john->canRead($domain));
         $this->assertTrue($john->canRead($domain->wallet()));
         $this->assertFalse($john->canRead($reseller1));
         $this->assertFalse($john->canRead($reseller2));
         $this->assertFalse($john->canRead($admin));
 
         // Normal user - a non-owner and non-controller
         $this->assertTrue($jack->canRead($jack));
         $this->assertFalse($jack->canRead($john));
         $this->assertFalse($jack->canRead($domain));
         $this->assertFalse($jack->canRead($domain->wallet()));
         $this->assertFalse($jack->canRead($reseller1));
         $this->assertFalse($jack->canRead($reseller2));
         $this->assertFalse($jack->canRead($admin));
 
         // Normal user - John's wallet controller
         $this->assertTrue($ned->canRead($ned));
         $this->assertTrue($ned->canRead($john));
         $this->assertTrue($ned->canRead($jack));
         $this->assertTrue($ned->canRead($domain));
         $this->assertTrue($ned->canRead($domain->wallet()));
         $this->assertFalse($ned->canRead($reseller1));
         $this->assertFalse($ned->canRead($reseller2));
         $this->assertFalse($ned->canRead($admin));
     }
 
     /**
      * Test User::canUpdate() method
      */
     public function testCanUpdate(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $reseller1 = $this->getTestUser('reseller@kolabnow.com');
         $reseller2 = $this->getTestUser('reseller@reseller.com');
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
         $domain = $this->getTestDomain('kolab.org');
 
         // Admin
         $this->assertTrue($admin->canUpdate($admin));
         $this->assertTrue($admin->canUpdate($john));
         $this->assertTrue($admin->canUpdate($jack));
         $this->assertTrue($admin->canUpdate($reseller1));
         $this->assertTrue($admin->canUpdate($reseller2));
         $this->assertTrue($admin->canUpdate($domain));
         $this->assertTrue($admin->canUpdate($domain->wallet()));
 
         // Reseller - kolabnow
         $this->assertTrue($reseller1->canUpdate($john));
         $this->assertTrue($reseller1->canUpdate($jack));
         $this->assertTrue($reseller1->canUpdate($reseller1));
         $this->assertTrue($reseller1->canUpdate($domain));
         $this->assertTrue($reseller1->canUpdate($domain->wallet()));
         $this->assertFalse($reseller1->canUpdate($reseller2));
         $this->assertFalse($reseller1->canUpdate($admin));
 
         // Reseller - different tenant
         $this->assertTrue($reseller2->canUpdate($reseller2));
         $this->assertFalse($reseller2->canUpdate($john));
         $this->assertFalse($reseller2->canUpdate($jack));
         $this->assertFalse($reseller2->canUpdate($reseller1));
         $this->assertFalse($reseller2->canUpdate($domain));
         $this->assertFalse($reseller2->canUpdate($domain->wallet()));
         $this->assertFalse($reseller2->canUpdate($admin));
 
         // Normal user - account owner
         $this->assertTrue($john->canUpdate($john));
         $this->assertTrue($john->canUpdate($ned));
         $this->assertTrue($john->canUpdate($jack));
         $this->assertTrue($john->canUpdate($domain));
         $this->assertFalse($john->canUpdate($domain->wallet()));
         $this->assertFalse($john->canUpdate($reseller1));
         $this->assertFalse($john->canUpdate($reseller2));
         $this->assertFalse($john->canUpdate($admin));
 
         // Normal user - a non-owner and non-controller
         $this->assertTrue($jack->canUpdate($jack));
         $this->assertFalse($jack->canUpdate($john));
         $this->assertFalse($jack->canUpdate($domain));
         $this->assertFalse($jack->canUpdate($domain->wallet()));
         $this->assertFalse($jack->canUpdate($reseller1));
         $this->assertFalse($jack->canUpdate($reseller2));
         $this->assertFalse($jack->canUpdate($admin));
 
         // Normal user - John's wallet controller
         $this->assertTrue($ned->canUpdate($ned));
         $this->assertTrue($ned->canUpdate($john));
         $this->assertTrue($ned->canUpdate($jack));
         $this->assertTrue($ned->canUpdate($domain));
         $this->assertFalse($ned->canUpdate($domain->wallet()));
         $this->assertFalse($ned->canUpdate($reseller1));
         $this->assertFalse($ned->canUpdate($reseller2));
         $this->assertFalse($ned->canUpdate($admin));
     }
 
     /**
      * Test user create/creating observer
      */
     public function testCreate(): void
     {
         Queue::fake();
 
         $domain = \config('app.domain');
 
         $user = User::create(['email' => 'USER-test@' . \strtoupper($domain)]);
 
         $result = User::where('email', 'user-test@' . $domain)->first();
 
         $this->assertSame('user-test@' . $domain, $result->email);
         $this->assertSame($user->id, $result->id);
         $this->assertSame(User::STATUS_NEW | User::STATUS_ACTIVE, $result->status);
     }
 
     /**
      * Verify user creation process
      */
     public function testCreateJobs(): void
     {
         // Fake the queue, assert that no jobs were pushed...
         Queue::fake();
         Queue::assertNothingPushed();
 
         $user = User::create([
                 'email' => 'user-test@' . \config('app.domain')
         ]);
 
         Queue::assertPushed(\App\Jobs\User\CreateJob::class, 1);
 
         Queue::assertPushed(
             \App\Jobs\User\CreateJob::class,
             function ($job) use ($user) {
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 $userId = TestCase::getObjectProperty($job, 'userId');
 
                 return $userEmail === $user->email
                     && $userId === $user->id;
             }
         );
 
         Queue::assertPushedWithChain(
             \App\Jobs\User\CreateJob::class,
             [
                 \App\Jobs\User\VerifyJob::class,
             ]
         );
 /*
         FIXME: Looks like we can't really do detailed assertions on chained jobs
                Another thing to consider is if we maybe should run these jobs
                independently (not chained) and make sure there's no race-condition
                in status update
 
         Queue::assertPushed(\App\Jobs\User\VerifyJob::class, 1);
         Queue::assertPushed(\App\Jobs\User\VerifyJob::class, function ($job) use ($user) {
             $userEmail = TestCase::getObjectProperty($job, 'userEmail');
             $userId = TestCase::getObjectProperty($job, 'userId');
 
             return $userEmail === $user->email
                 && $userId === $user->id;
         });
 */
     }
 
     /**
      * Tests for User::domains()
      */
     public function testDomains(): void
     {
         $user = $this->getTestUser('john@kolab.org');
         $domains = [];
 
         foreach ($user->domains() as $domain) {
             $domains[] = $domain->namespace;
         }
 
         $this->assertContains(\config('app.domain'), $domains);
         $this->assertContains('kolab.org', $domains);
 
         // Jack is not the wallet controller, so for him the list should not
         // include John's domains, kolab.org specifically
         $user = $this->getTestUser('jack@kolab.org');
         $domains = [];
 
         foreach ($user->domains() as $domain) {
             $domains[] = $domain->namespace;
         }
 
         $this->assertContains(\config('app.domain'), $domains);
         $this->assertNotContains('kolab.org', $domains);
     }
 
     public function testUserQuota(): void
     {
         // TODO: This test does not test much, probably could be removed
         //       or moved to somewhere else, or extended with
         //       other entitlements() related cases.
 
         $user = $this->getTestUser('john@kolab.org');
         $storage_sku = \App\Sku::where('title', 'storage')->first();
 
         $count = 0;
 
         foreach ($user->entitlements()->get() as $entitlement) {
             if ($entitlement->sku_id == $storage_sku->id) {
                 $count += 1;
             }
         }
 
         $this->assertTrue($count == 2);
     }
 
     /**
      * Test user deletion
      */
     public function testDelete(): void
     {
         Queue::fake();
 
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
         $package = \App\Package::where('title', 'kolab')->first();
         $user->assignPackage($package);
 
         $id = $user->id;
 
         $this->assertCount(4, $user->entitlements()->get());
 
         $user->delete();
 
         $this->assertCount(0, $user->entitlements()->get());
         $this->assertTrue($user->fresh()->trashed());
         $this->assertFalse($user->fresh()->isDeleted());
 
         // Delete the user for real
         $job = new \App\Jobs\User\DeleteJob($id);
         $job->handle();
 
         $this->assertTrue(User::withTrashed()->where('id', $id)->first()->isDeleted());
 
         $user->forceDelete();
 
         $this->assertCount(0, User::withTrashed()->where('id', $id)->get());
 
         // Test an account with users, domain, and group
         $userA = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $userC = $this->getTestUser('UserAccountC@UserAccount.com');
         $package_kolab = \App\Package::where('title', 'kolab')->first();
         $package_domain = \App\Package::where('title', 'domain-hosting')->first();
         $domain = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $userA->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $userA);
         $userA->assignPackage($package_kolab, $userB);
         $userA->assignPackage($package_kolab, $userC);
         $group = $this->getTestGroup('test-group@UserAccount.com');
         $group->assignToWallet($userA->wallets->first());
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
         $entitlementsC = \App\Entitlement::where('entitleable_id', $userC->id);
         $entitlementsDomain = \App\Entitlement::where('entitleable_id', $domain->id);
         $entitlementsGroup = \App\Entitlement::where('entitleable_id', $group->id);
 
         $this->assertSame(4, $entitlementsA->count());
         $this->assertSame(4, $entitlementsB->count());
         $this->assertSame(4, $entitlementsC->count());
         $this->assertSame(1, $entitlementsDomain->count());
         $this->assertSame(1, $entitlementsGroup->count());
 
         // Delete non-controller user
         $userC->delete();
 
         $this->assertTrue($userC->fresh()->trashed());
         $this->assertFalse($userC->fresh()->isDeleted());
         $this->assertSame(0, $entitlementsC->count());
 
         // Delete the controller (and expect "sub"-users to be deleted too)
         $userA->delete();
 
         $this->assertSame(0, $entitlementsA->count());
         $this->assertSame(0, $entitlementsB->count());
         $this->assertSame(0, $entitlementsDomain->count());
         $this->assertSame(0, $entitlementsGroup->count());
         $this->assertTrue($userA->fresh()->trashed());
         $this->assertTrue($userB->fresh()->trashed());
         $this->assertTrue($domain->fresh()->trashed());
         $this->assertTrue($group->fresh()->trashed());
         $this->assertFalse($userA->isDeleted());
         $this->assertFalse($userB->isDeleted());
         $this->assertFalse($domain->isDeleted());
         $this->assertFalse($group->isDeleted());
 
         $userA->forceDelete();
 
         $all_entitlements = \App\Entitlement::where('wallet_id', $userA->wallets->first()->id);
 
         $this->assertSame(0, $all_entitlements->withTrashed()->count());
         $this->assertCount(0, User::withTrashed()->where('id', $userA->id)->get());
         $this->assertCount(0, User::withTrashed()->where('id', $userB->id)->get());
         $this->assertCount(0, User::withTrashed()->where('id', $userC->id)->get());
         $this->assertCount(0, Domain::withTrashed()->where('id', $domain->id)->get());
         $this->assertCount(0, Group::withTrashed()->where('id', $group->id)->get());
     }
 
     /**
      * Test user deletion vs. group membership
      */
     public function testDeleteAndGroups(): void
     {
         Queue::fake();
 
         $package_kolab = \App\Package::where('title', 'kolab')->first();
         $userA = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $userA->assignPackage($package_kolab, $userB);
         $group = $this->getTestGroup('test-group@UserAccount.com');
         $group->members = ['test@gmail.com', $userB->email];
         $group->assignToWallet($userA->wallets->first());
         $group->save();
 
         Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 1);
 
         $userGroups = $userA->groups()->get();
         $this->assertSame(1, $userGroups->count());
         $this->assertSame($group->id, $userGroups->first()->id);
 
         $userB->delete();
 
         $this->assertSame(['test@gmail.com'], $group->fresh()->members);
 
         // Twice, one for save() and one for delete() above
         Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 2);
     }
 
+    /**
+     * Test handling negative balance on user deletion
+     */
+    public function testDeleteWithNegativeBalance(): void
+    {
+        $user = $this->getTestUser('user-test@' . \config('app.domain'));
+        $wallet = $user->wallets()->first();
+        $wallet->balance = -1000;
+        $wallet->save();
+        $reseller_wallet = $user->tenant->wallet();
+        $reseller_wallet->balance = 0;
+        $reseller_wallet->save();
+        \App\Transaction::where('object_id', $reseller_wallet->id)->where('object_type', \App\Wallet::class)->delete();
+
+        $user->delete();
+
+        $reseller_transactions = \App\Transaction::where('object_id', $reseller_wallet->id)
+            ->where('object_type', \App\Wallet::class)->get();
+
+        $this->assertSame(-1000, $reseller_wallet->fresh()->balance);
+        $this->assertCount(1, $reseller_transactions);
+        $trans = $reseller_transactions[0];
+        $this->assertSame("Deleted user {$user->email}", $trans->description);
+        $this->assertSame(-1000, $trans->amount);
+        $this->assertSame(\App\Transaction::WALLET_DEBIT, $trans->type);
+    }
+
+    /**
+     * Test handling positive balance on user deletion
+     */
+    public function testDeleteWithPositiveBalance(): void
+    {
+        $user = $this->getTestUser('user-test@' . \config('app.domain'));
+        $wallet = $user->wallets()->first();
+        $wallet->balance = 1000;
+        $wallet->save();
+        $reseller_wallet = $user->tenant->wallet();
+        $reseller_wallet->balance = 0;
+        $reseller_wallet->save();
+
+        $user->delete();
+
+        $this->assertSame(0, $reseller_wallet->fresh()->balance);
+    }
+
     /**
      * Tests for User::aliasExists()
      */
     public function testAliasExists(): void
     {
         $this->assertTrue(User::aliasExists('jack.daniels@kolab.org'));
 
         $this->assertFalse(User::aliasExists('j.daniels@kolab.org'));
         $this->assertFalse(User::aliasExists('john@kolab.org'));
     }
 
     /**
      * Tests for User::emailExists()
      */
     public function testEmailExists(): void
     {
         $this->assertFalse(User::emailExists('jack.daniels@kolab.org'));
         $this->assertFalse(User::emailExists('j.daniels@kolab.org'));
 
         $this->assertTrue(User::emailExists('john@kolab.org'));
         $user = User::emailExists('john@kolab.org', true);
         $this->assertSame('john@kolab.org', $user->email);
     }
 
     /**
      * Tests for User::findByEmail()
      */
     public function testFindByEmail(): void
     {
         $user = $this->getTestUser('john@kolab.org');
 
         $result = User::findByEmail('john');
         $this->assertNull($result);
 
         $result = User::findByEmail('non-existing@email.com');
         $this->assertNull($result);
 
         $result = User::findByEmail('john@kolab.org');
         $this->assertInstanceOf(User::class, $result);
         $this->assertSame($user->id, $result->id);
 
         // Use an alias
         $result = User::findByEmail('john.doe@kolab.org');
         $this->assertInstanceOf(User::class, $result);
         $this->assertSame($user->id, $result->id);
 
         // A case where two users have the same alias
         $ned = $this->getTestUser('ned@kolab.org');
         $ned->setAliases(['joe.monster@kolab.org']);
         $result = User::findByEmail('joe.monster@kolab.org');
         $this->assertNull($result);
         $ned->setAliases([]);
 
         // TODO: searching by external email (setting)
         $this->markTestIncomplete();
     }
 
     /**
      * Test User::name()
      */
     public function testName(): void
     {
         Queue::fake();
 
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
 
         $this->assertSame('', $user->name());
         $this->assertSame(\config('app.name') . ' User', $user->name(true));
 
         $user->setSetting('first_name', 'First');
 
         $this->assertSame('First', $user->name());
         $this->assertSame('First', $user->name(true));
 
         $user->setSetting('last_name', 'Last');
 
         $this->assertSame('First Last', $user->name());
         $this->assertSame('First Last', $user->name(true));
     }
 
     /**
      * Test user restoring
      */
     public function testRestore(): void
     {
         Queue::fake();
 
         // Test an account with users and domain
         $userA = $this->getTestUser('UserAccountA@UserAccount.com', [
                 'status' => User::STATUS_LDAP_READY | User::STATUS_IMAP_READY | User::STATUS_SUSPENDED,
         ]);
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $package_kolab = \App\Package::where('title', 'kolab')->first();
         $package_domain = \App\Package::where('title', 'domain-hosting')->first();
         $domainA = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $domainB = $this->getTestDomain('UserAccountAdd.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $userA->assignPackage($package_kolab);
         $domainA->assignPackage($package_domain, $userA);
         $domainB->assignPackage($package_domain, $userA);
         $userA->assignPackage($package_kolab, $userB);
 
         $storage_sku = \App\Sku::where('title', 'storage')->first();
         $now = \Carbon\Carbon::now();
         $wallet_id = $userA->wallets->first()->id;
 
         // add an extra storage entitlement
         $ent1 = \App\Entitlement::create([
                 'wallet_id' => $wallet_id,
                 'sku_id' => $storage_sku->id,
                 'cost' => 0,
                 'entitleable_id' => $userA->id,
                 'entitleable_type' => User::class,
         ]);
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
         $entitlementsDomain = \App\Entitlement::where('entitleable_id', $domainA->id);
 
         // First delete the user
         $userA->delete();
 
         $this->assertSame(0, $entitlementsA->count());
         $this->assertSame(0, $entitlementsB->count());
         $this->assertSame(0, $entitlementsDomain->count());
         $this->assertTrue($userA->fresh()->trashed());
         $this->assertTrue($userB->fresh()->trashed());
         $this->assertTrue($domainA->fresh()->trashed());
         $this->assertTrue($domainB->fresh()->trashed());
         $this->assertFalse($userA->isDeleted());
         $this->assertFalse($userB->isDeleted());
         $this->assertFalse($domainA->isDeleted());
 
         // Backdate one storage entitlement (it's not expected to be restored)
         \App\Entitlement::withTrashed()->where('id', $ent1->id)
             ->update(['deleted_at' => $now->copy()->subMinutes(2)]);
 
         // Backdate entitlements to assert that they were restored with proper updated_at timestamp
         \App\Entitlement::withTrashed()->where('wallet_id', $wallet_id)
             ->update(['updated_at' => $now->subMinutes(10)]);
 
         Queue::fake();
 
         // Then restore it
         $userA->restore();
         $userA->refresh();
 
         $this->assertFalse($userA->trashed());
         $this->assertFalse($userA->isDeleted());
         $this->assertFalse($userA->isSuspended());
         $this->assertFalse($userA->isLdapReady());
         $this->assertFalse($userA->isImapReady());
         $this->assertTrue($userA->isActive());
 
         $this->assertTrue($userB->fresh()->trashed());
         $this->assertTrue($domainB->fresh()->trashed());
         $this->assertFalse($domainA->fresh()->trashed());
 
         // Assert entitlements
         $this->assertSame(4, $entitlementsA->count()); // mailbox + groupware + 2 x storage
         $this->assertTrue($ent1->fresh()->trashed());
         $entitlementsA->get()->each(function ($ent) {
             $this->assertTrue($ent->updated_at->greaterThan(\Carbon\Carbon::now()->subSeconds(5)));
         });
 
         // We expect only CreateJob + UpdateJob pair for both user and domain.
         // Because how Illuminate/Database/Eloquent/SoftDeletes::restore() method
         // is implemented we cannot skip the UpdateJob in any way.
         // I don't want to overwrite this method, the extra job shouldn't do any harm.
         $this->assertCount(4, Queue::pushedJobs()); // @phpstan-ignore-line
         Queue::assertPushed(\App\Jobs\Domain\UpdateJob::class, 1);
         Queue::assertPushed(\App\Jobs\Domain\CreateJob::class, 1);
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
         Queue::assertPushed(\App\Jobs\User\CreateJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\User\CreateJob::class,
             function ($job) use ($userA) {
                 return $userA->id === TestCase::getObjectProperty($job, 'userId');
             }
         );
         Queue::assertPushedWithChain(
             \App\Jobs\User\CreateJob::class,
             [
                 \App\Jobs\User\VerifyJob::class,
             ]
         );
     }
 
     /**
      * Tests for UserAliasesTrait::setAliases()
      */
     public function testSetAliases(): void
     {
         Queue::fake();
         Queue::assertNothingPushed();
 
         $user = $this->getTestUser('UserAccountA@UserAccount.com');
         $domain = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
 
         $this->assertCount(0, $user->aliases->all());
 
         // Add an alias
         $user->setAliases(['UserAlias1@UserAccount.com']);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
 
         $aliases = $user->aliases()->get();
         $this->assertCount(1, $aliases);
         $this->assertSame('useralias1@useraccount.com', $aliases[0]['alias']);
 
         // Add another alias
         $user->setAliases(['UserAlias1@UserAccount.com', 'UserAlias2@UserAccount.com']);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 2);
 
         $aliases = $user->aliases()->orderBy('alias')->get();
         $this->assertCount(2, $aliases);
         $this->assertSame('useralias1@useraccount.com', $aliases[0]->alias);
         $this->assertSame('useralias2@useraccount.com', $aliases[1]->alias);
 
         // Remove an alias
         $user->setAliases(['UserAlias1@UserAccount.com']);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 3);
 
         $aliases = $user->aliases()->get();
         $this->assertCount(1, $aliases);
         $this->assertSame('useralias1@useraccount.com', $aliases[0]['alias']);
 
         // Remove all aliases
         $user->setAliases([]);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 4);
 
         $this->assertCount(0, $user->aliases()->get());
     }
 
     /**
      * Tests for UserSettingsTrait::setSettings() and getSetting()
      */
     public function testUserSettings(): void
     {
         Queue::fake();
         Queue::assertNothingPushed();
 
         $user = $this->getTestUser('UserAccountA@UserAccount.com');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 0);
 
         // Test default settings
         // Note: Technicly this tests UserObserver::created() behavior
         $all_settings = $user->settings()->orderBy('key')->get();
         $this->assertCount(2, $all_settings);
         $this->assertSame('country', $all_settings[0]->key);
         $this->assertSame('CH', $all_settings[0]->value);
         $this->assertSame('currency', $all_settings[1]->key);
         $this->assertSame('CHF', $all_settings[1]->value);
 
         // Add a setting
         $user->setSetting('first_name', 'Firstname');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame('Firstname', $user->getSetting('first_name'));
         $this->assertSame('Firstname', $user->fresh()->getSetting('first_name'));
 
         // Update a setting
         $user->setSetting('first_name', 'Firstname1');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 2);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame('Firstname1', $user->getSetting('first_name'));
         $this->assertSame('Firstname1', $user->fresh()->getSetting('first_name'));
 
         // Delete a setting (null)
         $user->setSetting('first_name', null);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 3);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame(null, $user->getSetting('first_name'));
         $this->assertSame(null, $user->fresh()->getSetting('first_name'));
 
         // Delete a setting (empty string)
         $user->setSetting('first_name', 'Firstname1');
         $user->setSetting('first_name', '');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 5);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame(null, $user->getSetting('first_name'));
         $this->assertSame(null, $user->fresh()->getSetting('first_name'));
 
         // Set multiple settings at once
         $user->setSettings([
                 'first_name' => 'Firstname2',
                 'last_name' => 'Lastname2',
                 'country' => null,
         ]);
 
         // TODO: This really should create a single UserUpdate job, not 3
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 7);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame('Firstname2', $user->getSetting('first_name'));
         $this->assertSame('Firstname2', $user->fresh()->getSetting('first_name'));
         $this->assertSame('Lastname2', $user->getSetting('last_name'));
         $this->assertSame('Lastname2', $user->fresh()->getSetting('last_name'));
         $this->assertSame(null, $user->getSetting('country'));
         $this->assertSame(null, $user->fresh()->getSetting('country'));
 
         $all_settings = $user->settings()->orderBy('key')->get();
         $this->assertCount(3, $all_settings);
     }
 
     /**
      * Tests for User::users()
      */
     public function testUsers(): void
     {
         $jack = $this->getTestUser('jack@kolab.org');
         $joe = $this->getTestUser('joe@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $wallet = $john->wallets()->first();
 
         $users = $john->users()->orderBy('email')->get();
 
         $this->assertCount(4, $users);
         $this->assertEquals($jack->id, $users[0]->id);
         $this->assertEquals($joe->id, $users[1]->id);
         $this->assertEquals($john->id, $users[2]->id);
         $this->assertEquals($ned->id, $users[3]->id);
         $this->assertSame($wallet->id, $users[0]->wallet_id);
         $this->assertSame($wallet->id, $users[1]->wallet_id);
         $this->assertSame($wallet->id, $users[2]->wallet_id);
         $this->assertSame($wallet->id, $users[3]->wallet_id);
 
         $users = $jack->users()->orderBy('email')->get();
 
         $this->assertCount(0, $users);
 
         $users = $ned->users()->orderBy('email')->get();
 
         $this->assertCount(4, $users);
     }
 
     public function testWallets(): void
     {
         $this->markTestIncomplete();
     }
 }
diff --git a/src/tests/Feature/WalletTest.php b/src/tests/Feature/WalletTest.php
index 36d13983..f83b584d 100644
--- a/src/tests/Feature/WalletTest.php
+++ b/src/tests/Feature/WalletTest.php
@@ -1,282 +1,398 @@
 <?php
 
 namespace Tests\Feature;
 
 use App\Package;
 use App\User;
 use App\Sku;
+use App\Transaction;
 use App\Wallet;
 use Carbon\Carbon;
+use Illuminate\Support\Facades\DB;
 use Tests\TestCase;
 
 class WalletTest extends TestCase
 {
     private $users = [
         'UserWallet1@UserWallet.com',
         'UserWallet2@UserWallet.com',
         'UserWallet3@UserWallet.com',
         'UserWallet4@UserWallet.com',
         'UserWallet5@UserWallet.com',
         'WalletControllerA@WalletController.com',
         'WalletControllerB@WalletController.com',
         'WalletController2A@WalletController.com',
         'WalletController2B@WalletController.com',
         'jane@kolabnow.com'
     ];
 
     public function setUp(): void
     {
         parent::setUp();
 
         foreach ($this->users as $user) {
             $this->deleteTestUser($user);
         }
     }
 
     public function tearDown(): void
     {
         foreach ($this->users as $user) {
             $this->deleteTestUser($user);
         }
 
+        Sku::select()->update(['fee' => 0]);
+
         parent::tearDown();
     }
 
     /**
      * Test that turning wallet balance from negative to positive
      * unsuspends the account
      */
     public function testBalancePositiveUnsuspend(): void
     {
         $user = $this->getTestUser('UserWallet1@UserWallet.com');
         $user->suspend();
 
         $wallet = $user->wallets()->first();
         $wallet->balance = -100;
         $wallet->save();
 
         $this->assertTrue($user->isSuspended());
         $this->assertNotNull($wallet->getSetting('balance_negative_since'));
 
         $wallet->balance = 100;
         $wallet->save();
 
         $this->assertFalse($user->fresh()->isSuspended());
         $this->assertNull($wallet->getSetting('balance_negative_since'));
 
         // TODO: Test group account and unsuspending domain/members
     }
 
     /**
      * Test for Wallet::balanceLastsUntil()
      */
     public function testBalanceLastsUntil(): void
     {
         // Monthly cost of all entitlements: 999
         // 28 days: 35.68 per day
         // 31 days: 32.22 per day
 
         $user = $this->getTestUser('jane@kolabnow.com');
         $package = Package::where('title', 'kolab')->first();
         $user->assignPackage($package);
         $wallet = $user->wallets()->first();
 
         // User/entitlements created today, balance=0
         $until = $wallet->balanceLastsUntil();
 
         $this->assertSame(
             Carbon::now()->addMonthsWithoutOverflow(1)->toDateString(),
             $until->toDateString()
         );
 
         // User/entitlements created today, balance=-10 CHF
         $wallet->balance = -1000;
         $until = $wallet->balanceLastsUntil();
 
         $this->assertSame(null, $until);
 
         // User/entitlements created today, balance=-9,99 CHF (monthly cost)
         $wallet->balance = 999;
         $until = $wallet->balanceLastsUntil();
 
         $daysInLastMonth = \App\Utils::daysInLastMonth();
 
         $this->assertSame(
             Carbon::now()->addMonthsWithoutOverflow(1)->addDays($daysInLastMonth)->toDateString(),
             $until->toDateString()
         );
 
         // Old entitlements, 100% discount
         $this->backdateEntitlements($wallet->entitlements, Carbon::now()->subDays(40));
         $discount = \App\Discount::where('discount', 100)->first();
         $wallet->discount()->associate($discount);
 
         $until = $wallet->refresh()->balanceLastsUntil();
 
         $this->assertSame(null, $until);
 
         // User with no entitlements
         $wallet->discount()->dissociate($discount);
         $wallet->entitlements()->delete();
 
         $until = $wallet->refresh()->balanceLastsUntil();
 
         $this->assertSame(null, $until);
     }
 
     /**
      * Test for Wallet::costsPerDay()
      */
     public function testCostsPerDay(): void
     {
         // 999
         // 28 days: 35.68
         // 31 days: 32.22
         $user = $this->getTestUser('jane@kolabnow.com');
 
         $package = Package::where('title', 'kolab')->first();
         $mailbox = Sku::where('title', 'mailbox')->first();
 
         $user->assignPackage($package);
 
         $wallet = $user->wallets()->first();
 
         $costsPerDay = $wallet->costsPerDay();
 
         $this->assertTrue($costsPerDay < 35.68);
         $this->assertTrue($costsPerDay > 32.22);
     }
 
     /**
      * Verify a wallet is created, when a user is created.
      */
     public function testCreateUserCreatesWallet(): void
     {
         $user = $this->getTestUser('UserWallet1@UserWallet.com');
 
         $this->assertCount(1, $user->wallets);
     }
 
     /**
      * Verify a user can haz more wallets.
      */
     public function testAddWallet(): void
     {
         $user = $this->getTestUser('UserWallet2@UserWallet.com');
 
         $user->wallets()->save(
             new Wallet(['currency' => 'USD'])
         );
 
         $this->assertCount(2, $user->wallets);
 
         $user->wallets()->each(
             function ($wallet) {
                 $this->assertEquals(0, $wallet->balance);
             }
         );
     }
 
     /**
      * Verify we can not delete a user wallet that holds balance.
      */
     public function testDeleteWalletWithCredit(): void
     {
         $user = $this->getTestUser('UserWallet3@UserWallet.com');
 
         $user->wallets()->each(
             function ($wallet) {
                 $wallet->credit(100)->save();
             }
         );
 
         $user->wallets()->each(
             function ($wallet) {
                 $this->assertFalse($wallet->delete());
             }
         );
     }
 
     /**
      * Verify we can not delete a wallet that is the last wallet.
      */
     public function testDeleteLastWallet(): void
     {
         $user = $this->getTestUser('UserWallet4@UserWallet.com');
 
         $this->assertCount(1, $user->wallets);
 
         $user->wallets()->each(
             function ($wallet) {
                 $this->assertFalse($wallet->delete());
             }
         );
     }
 
     /**
      * Verify we can remove a wallet that is an additional wallet.
      */
     public function testDeleteAddtWallet(): void
     {
         $user = $this->getTestUser('UserWallet5@UserWallet.com');
 
         $user->wallets()->save(
             new Wallet(['currency' => 'USD'])
         );
 
         $user->wallets()->each(
             function ($wallet) {
                 if ($wallet->currency == 'USD') {
                     $this->assertNotFalse($wallet->delete());
                 }
             }
         );
     }
 
     /**
      * Verify a wallet can be assigned a controller.
      */
     public function testAddWalletController(): void
     {
         $userA = $this->getTestUser('WalletControllerA@WalletController.com');
         $userB = $this->getTestUser('WalletControllerB@WalletController.com');
 
         $userA->wallets()->each(
             function ($wallet) use ($userB) {
                 $wallet->addController($userB);
             }
         );
 
         $this->assertCount(1, $userB->accounts);
 
         $aWallet = $userA->wallets()->first();
         $bAccount = $userB->accounts()->first();
 
         $this->assertTrue($bAccount->id === $aWallet->id);
     }
 
     /**
      * Verify controllers can also be removed from wallets.
      */
     public function testRemoveWalletController(): void
     {
         $userA = $this->getTestUser('WalletController2A@WalletController.com');
         $userB = $this->getTestUser('WalletController2B@WalletController.com');
 
         $userA->wallets()->each(
             function ($wallet) use ($userB) {
                 $wallet->addController($userB);
             }
         );
 
         $userB->refresh();
 
         $userB->accounts()->each(
             function ($wallet) use ($userB) {
                 $wallet->removeController($userB);
             }
         );
 
         $this->assertCount(0, $userB->accounts);
     }
+
+    /**
+     * Test for charging and removing entitlements (including tenant commission calculations)
+     */
+    public function testChargeAndDeleteEntitlements(): void
+    {
+        $user = $this->getTestUser('jane@kolabnow.com');
+        $wallet = $user->wallets()->first();
+        $discount = \App\Discount::where('discount', 30)->first();
+        $wallet->discount()->associate($discount);
+        $wallet->save();
+
+        // Add 40% fee to all SKUs
+        Sku::select()->update(['fee' => DB::raw("`cost` * 0.4")]);
+
+        $package = Package::where('title', 'kolab')->first();
+        $storage = Sku::where('title', 'storage')->first();
+        $user->assignPackage($package);
+        $user->assignSku($storage, 2);
+        $user->refresh();
+
+        // Reset reseller's wallet balance and transactions
+        $reseller_wallet = $user->tenant->wallet();
+        $reseller_wallet->balance = 0;
+        $reseller_wallet->save();
+        Transaction::where('object_id', $reseller_wallet->id)->where('object_type', \App\Wallet::class)->delete();
+
+        // ------------------------------------
+        // Test normal charging of entitlements
+        // ------------------------------------
+
+        // Backdate and chanrge entitlements, we're expecting one month to be charged
+        // Set fake NOW date to make simpler asserting results that depend on number of days in current/last month
+        Carbon::setTestNow(Carbon::create(2021, 5, 21, 12));
+        $backdate = Carbon::now()->subWeeks(7);
+        $this->backdateEntitlements($user->entitlements, $backdate);
+        $charge = $wallet->chargeEntitlements();
+        $wallet->refresh();
+        $reseller_wallet->refresh();
+
+        // 388 + 310 + 17 + 17 = 732
+        $this->assertSame(-732, $wallet->balance);
+        // 388 - 555 x 40% + 310 - 444 x 40% + 34 - 50 x 40% = 312
+        $this->assertSame(312, $reseller_wallet->balance);
+
+        $transactions = Transaction::where('object_id', $wallet->id)
+            ->where('object_type', \App\Wallet::class)->get();
+        $reseller_transactions = Transaction::where('object_id', $reseller_wallet->id)
+            ->where('object_type', \App\Wallet::class)->get();
+
+        $this->assertCount(1, $reseller_transactions);
+        $trans = $reseller_transactions[0];
+        $this->assertSame("Charged user jane@kolabnow.com", $trans->description);
+        $this->assertSame(312, $trans->amount);
+        $this->assertSame(Transaction::WALLET_CREDIT, $trans->type);
+
+        $this->assertCount(1, $transactions);
+        $trans = $transactions[0];
+        $this->assertSame('', $trans->description);
+        $this->assertSame(-732, $trans->amount);
+        $this->assertSame(Transaction::WALLET_DEBIT, $trans->type);
+
+        // TODO: Test entitlement transaction records
+
+        // -----------------------------------
+        // Test charging on entitlement delete
+        // -----------------------------------
+
+        $transactions = Transaction::where('object_id', $wallet->id)
+            ->where('object_type', \App\Wallet::class)->delete();
+        $reseller_transactions = Transaction::where('object_id', $reseller_wallet->id)
+            ->where('object_type', \App\Wallet::class)->delete();
+
+        $user->removeSku($storage, 2);
+
+        // we expect the wallet to have been charged for 19 days of use of
+        // 2 deleted storage entitlements
+        $wallet->refresh();
+        $reseller_wallet->refresh();
+
+        // 2 x round(25 / 31 * 19 * 0.7) = 22
+        $this->assertSame(-(732 + 22), $wallet->balance);
+        // 22 - 2 x round(25 * 0.4 / 31 * 19) = 10
+        $this->assertSame(312 + 10, $reseller_wallet->balance);
+
+        $transactions = Transaction::where('object_id', $wallet->id)
+            ->where('object_type', \App\Wallet::class)->get();
+        $reseller_transactions = Transaction::where('object_id', $reseller_wallet->id)
+            ->where('object_type', \App\Wallet::class)->get();
+
+        $this->assertCount(2, $reseller_transactions);
+        $trans = $reseller_transactions[0];
+        $this->assertSame("Charged user jane@kolabnow.com", $trans->description);
+        $this->assertSame(5, $trans->amount);
+        $this->assertSame(Transaction::WALLET_CREDIT, $trans->type);
+        $trans = $reseller_transactions[1];
+        $this->assertSame("Charged user jane@kolabnow.com", $trans->description);
+        $this->assertSame(5, $trans->amount);
+        $this->assertSame(Transaction::WALLET_CREDIT, $trans->type);
+
+        $this->assertCount(2, $transactions);
+        $trans = $transactions[0];
+        $this->assertSame('', $trans->description);
+        $this->assertSame(-11, $trans->amount);
+        $this->assertSame(Transaction::WALLET_DEBIT, $trans->type);
+        $trans = $transactions[1];
+        $this->assertSame('', $trans->description);
+        $this->assertSame(-11, $trans->amount);
+        $this->assertSame(Transaction::WALLET_DEBIT, $trans->type);
+
+        // TODO: Test entitlement transaction records
+    }
 }
diff --git a/src/tests/TestCase.php b/src/tests/TestCase.php
index a6a7f5e4..269e7d43 100644
--- a/src/tests/TestCase.php
+++ b/src/tests/TestCase.php
@@ -1,48 +1,58 @@
 <?php
 
 namespace Tests;
 
 use Illuminate\Foundation\Testing\TestCase as BaseTestCase;
 
 abstract class TestCase extends BaseTestCase
 {
     use TestCaseTrait;
     use TestCaseMeetTrait;
 
     protected function backdateEntitlements($entitlements, $targetDate)
     {
+        $wallets = [];
+        $ids = [];
+
         foreach ($entitlements as $entitlement) {
-            $entitlement->created_at = $targetDate;
-            $entitlement->updated_at = $targetDate;
-            $entitlement->save();
+            $ids[] = $entitlement->id;
+            $wallets[] = $entitlement->wallet_id;
+        }
+
+        \App\Entitlement::whereIn('id', $ids)->update([
+                'created_at' => $targetDate,
+                'updated_at' => $targetDate,
+        ]);
+
+        if (!empty($wallets)) {
+            $wallets = array_unique($wallets);
+            $owners = \App\Wallet::whereIn('id', $wallets)->pluck('user_id')->all();
 
-            $owner = $entitlement->wallet->owner;
-            $owner->created_at = $targetDate;
-            $owner->save();
+            \App\User::whereIn('id', $owners)->update(['created_at' => $targetDate]);
         }
     }
 
     /**
      * Set baseURL to the admin UI location
      */
     protected static function useAdminUrl(): void
     {
         // This will set base URL for all tests in a file.
         // If we wanted to access both user and admin in one test
         // we can also just call post/get/whatever with full url
         \config(['app.url' => str_replace('//', '//admin.', \config('app.url'))]);
         url()->forceRootUrl(config('app.url'));
     }
 
     /**
      * Set baseURL to the reseller UI location
      */
     protected static function useResellerUrl(): void
     {
         // This will set base URL for all tests in a file.
         // If we wanted to access both user and admin in one test
         // we can also just call post/get/whatever with full url
         \config(['app.url' => str_replace('//', '//reseller.', \config('app.url'))]);
         url()->forceRootUrl(config('app.url'));
     }
 }