diff --git a/src/app/Backends/LDAP.php b/src/app/Backends/LDAP.php
index 87814279..9266330b 100644
--- a/src/app/Backends/LDAP.php
+++ b/src/app/Backends/LDAP.php
@@ -1,984 +1,983 @@
 <?php
 
 namespace App\Backends;
 
 use App\Domain;
 use App\Group;
 use App\User;
 
 class LDAP
 {
     /** @const array UserSettings used by the backend */
     public const USER_SETTINGS = [
         'first_name',
         'last_name',
         'organization',
     ];
 
     /** @var ?\Net_LDAP3 LDAP connection object */
     protected static $ldap;
 
 
     /**
      * Starts a new LDAP connection that will be used by all methods
      * until you call self::disconnect() explicitely. Normally every
      * method uses a separate connection.
      *
      * @throws \Exception
      */
     public static function connect(): void
     {
         if (empty(self::$ldap)) {
             $config = self::getConfig('admin');
             self::$ldap = self::initLDAP($config);
         }
     }
 
     /**
      * Close the connection created by self::connect()
      */
     public static function disconnect(): void
     {
         if (!empty(self::$ldap)) {
             self::$ldap->close();
             self::$ldap = null;
         }
     }
 
     /**
      * Create a domain in LDAP.
      *
      * @param \App\Domain $domain The domain to create.
      *
      * @throws \Exception
      */
     public static function createDomain(Domain $domain): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $hostedRootDN = \config('ldap.hosted.root_dn');
         $mgmtRootDN = \config('ldap.admin.root_dn');
 
         $domainBaseDN = "ou={$domain->namespace},{$hostedRootDN}";
 
         $aci = [
             '(targetattr = "*")'
             . '(version 3.0; acl "Deny Unauthorized"; deny (all)'
             . '(userdn != "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN
             . ' || ldap:///ou=People,' . $domainBaseDN . '??sub?(objectclass=inetorgperson)") '
             . 'AND NOT roledn = "ldap:///cn=kolab-admin,' . $mgmtRootDN . '";)',
 
             '(targetattr != "userPassword")'
             . '(version 3.0;acl "Search Access";allow (read,compare,search)'
             . '(userdn = "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN
             . ' || ldap:///ou=People,' . $domainBaseDN . '??sub?(objectclass=inetorgperson)");)',
 
             '(targetattr = "*")'
             . '(version 3.0;acl "Kolab Administrators";allow (all)'
             . '(roledn = "ldap:///cn=kolab-admin,' . $domainBaseDN
             . ' || ldap:///cn=kolab-admin,' . $mgmtRootDN . '");)'
         ];
 
         $entry = [
             'aci' => $aci,
             'associateddomain' => $domain->namespace,
             'inetdomainbasedn' => $domainBaseDN,
             'objectclass' => [
                 'top',
                 'domainrelatedobject',
                 'inetdomain'
             ],
         ];
 
         $dn = "associateddomain={$domain->namespace},{$config['domain_base_dn']}";
 
         self::setDomainAttributes($domain, $entry);
 
         if (!$ldap->get_entry($dn)) {
             $result = $ldap->add_entry($dn, $entry);
 
             if (!$result) {
                 self::throwException(
                     $ldap,
                     "Failed to create domain {$domain->namespace} in LDAP (" . __LINE__ . ")"
                 );
             }
         }
 
         // create ou, roles, ous
         $entry = [
             'description' => $domain->namespace,
             'objectclass' => [
                 'top',
                 'organizationalunit'
             ],
             'ou' => $domain->namespace,
         ];
 
         $entry['aci'] = array(
             '(targetattr = "*")'
             . '(version 3.0;acl "Deny Unauthorized"; deny (all)'
             . '(userdn != "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN
             . ' || ldap:///ou=People,' . $domainBaseDN . '??sub?(objectclass=inetorgperson)") '
             . 'AND NOT roledn = "ldap:///cn=kolab-admin,' . $mgmtRootDN . '";)',
 
             '(targetattr != "userPassword")'
             . '(version 3.0;acl "Search Access";allow (read,compare,search,write)'
             . '(userdn = "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN
             . ' || ldap:///ou=People,' . $domainBaseDN . '??sub?(objectclass=inetorgperson)");)',
 
             '(targetattr = "*")'
             . '(version 3.0;acl "Kolab Administrators";allow (all)'
             . '(roledn = "ldap:///cn=kolab-admin,' . $domainBaseDN
             . ' || ldap:///cn=kolab-admin,' . $mgmtRootDN . '");)',
 
             '(target = "ldap:///ou=*,' . $domainBaseDN . '")'
             . '(targetattr="objectclass || aci || ou")'
             . '(version 3.0;acl "Allow Domain sub-OU Registration"; allow (add)'
             . '(userdn = "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN . '");)',
 
             '(target = "ldap:///uid=*,ou=People,' . $domainBaseDN . '")(targetattr="*")'
             . '(version 3.0;acl "Allow Domain First User Registration"; allow (add)'
             . '(userdn = "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN . '");)',
 
             '(target = "ldap:///cn=*,' . $domainBaseDN . '")(targetattr="objectclass || cn")'
             . '(version 3.0;acl "Allow Domain Role Registration"; allow (add)'
             . '(userdn = "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN . '");)',
         );
 
         if (!$ldap->get_entry($domainBaseDN)) {
             $result = $ldap->add_entry($domainBaseDN, $entry);
 
             if (!$result) {
                 self::throwException(
                     $ldap,
                     "Failed to create domain {$domain->namespace} in LDAP (" . __LINE__ . ")"
                 );
             }
         }
 
         foreach (['Groups', 'People', 'Resources', 'Shared Folders'] as $item) {
             if (!$ldap->get_entry("ou={$item},{$domainBaseDN}")) {
                 $result = $ldap->add_entry(
                     "ou={$item},{$domainBaseDN}",
                     [
                         'ou' => $item,
                         'description' => $item,
                         'objectclass' => [
                             'top',
                             'organizationalunit'
                         ]
                     ]
                 );
 
                 if (!$result) {
                     self::throwException(
                         $ldap,
                         "Failed to create domain {$domain->namespace} in LDAP (" . __LINE__ . ")"
                     );
                 }
             }
         }
 
         foreach (['kolab-admin'] as $item) {
             if (!$ldap->get_entry("cn={$item},{$domainBaseDN}")) {
                 $result = $ldap->add_entry(
                     "cn={$item},{$domainBaseDN}",
                     [
                         'cn' => $item,
                         'description' => "{$item} role",
                         'objectclass' => [
                             'top',
                             'ldapsubentry',
                             'nsmanagedroledefinition',
                             'nsroledefinition',
                             'nssimpleroledefinition'
                         ]
                     ]
                 );
 
                 if (!$result) {
                     self::throwException(
                         $ldap,
                         "Failed to create domain {$domain->namespace} in LDAP (" . __LINE__ . ")"
                     );
                 }
             }
         }
 
         // TODO: Assign kolab-admin role to the owner?
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Create a group in LDAP.
      *
      * @param \App\Group $group The group to create.
      *
      * @throws \Exception
      */
     public static function createGroup(Group $group): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         list($cn, $domainName) = explode('@', $group->email);
 
         $domain = $group->domain();
 
         if (empty($domain)) {
             self::throwException(
                 $ldap,
                 "Failed to create group {$group->email} in LDAP (" . __LINE__ . ")"
             );
         }
 
         $hostedRootDN = \config('ldap.hosted.root_dn');
 
         $domainBaseDN = "ou={$domain->namespace},{$hostedRootDN}";
 
         $groupBaseDN = "ou=Groups,{$domainBaseDN}";
 
         $dn = "cn={$cn},{$groupBaseDN}";
 
         $entry = [
             'cn' => $cn,
             'mail' => $group->email,
             'objectclass' => [
                 'top',
                 'groupofuniquenames',
                 'kolabgroupofuniquenames'
             ],
             'uniquemember' => []
         ];
 
         self::setGroupAttributes($ldap, $group, $entry);
 
         $result = $ldap->add_entry($dn, $entry);
 
         if (!$result) {
             self::throwException(
                 $ldap,
                 "Failed to create group {$group->email} in LDAP (" . __LINE__ . ")"
             );
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Create a user in LDAP.
      *
      * Only need to add user if in any of the local domains? Figure that out here for now. Should
      * have Context-Based Access Controls before the job is queued though, probably.
      *
      * Use one of three modes;
      *
      * 1) The authenticated user account.
      *
      *    * Only valid if the authenticated user is a domain admin.
      *    * We don't know the originating user here.
      *    * We certainly don't have its password anymore.
      *
      * 2) The hosted kolab account.
      *
      * 3) The Directory Manager account.
      *
      * @param \App\User $user The user account to create.
      *
      * @throws \Exception
      */
     public static function createUser(User $user): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $entry = [
             'objectclass' => [
                 'top',
                 'inetorgperson',
                 'inetuser',
                 'kolabinetorgperson',
                 'mailrecipient',
                 'person'
             ],
             'mail' => $user->email,
             'uid' => $user->email,
             'nsroledn' => []
         ];
 
         if (!self::getUserEntry($ldap, $user->email, $dn)) {
             if (empty($dn)) {
                 self::throwException($ldap, "Failed to create user {$user->email} in LDAP (" . __LINE__ . ")");
             }
 
             self::setUserAttributes($user, $entry);
 
             $result = $ldap->add_entry($dn, $entry);
 
             if (!$result) {
                 self::throwException(
                     $ldap,
                     "Failed to create user {$user->email} in LDAP (" . __LINE__ . ")"
                 );
             }
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Delete a domain from LDAP.
      *
      * @param \App\Domain $domain The domain to delete
      *
      * @throws \Exception
      */
     public static function deleteDomain(Domain $domain): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $hostedRootDN = \config('ldap.hosted.root_dn');
         $mgmtRootDN = \config('ldap.admin.root_dn');
 
         $domainBaseDN = "ou={$domain->namespace},{$hostedRootDN}";
 
         if ($ldap->get_entry($domainBaseDN)) {
             $result = $ldap->delete_entry_recursive($domainBaseDN);
 
             if (!$result) {
                 self::throwException(
                     $ldap,
                     "Failed to delete domain {$domain->namespace} from LDAP (" . __LINE__ . ")"
                 );
             }
         }
 
         if ($ldap_domain = $ldap->find_domain($domain->namespace)) {
             if ($ldap->get_entry($ldap_domain['dn'])) {
                 $result = $ldap->delete_entry($ldap_domain['dn']);
 
                 if (!$result) {
                     self::throwException(
                         $ldap,
                         "Failed to delete domain {$domain->namespace} from LDAP (" . __LINE__ . ")"
                     );
                 }
             }
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Delete a group from LDAP.
      *
      * @param \App\Group $group The group to delete.
      *
      * @throws \Exception
      */
     public static function deleteGroup(Group $group): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         if (self::getGroupEntry($ldap, $group->email, $dn)) {
             $result = $ldap->delete_entry($dn);
 
             if (!$result) {
                 self::throwException(
                     $ldap,
                     "Failed to delete group {$group->email} from LDAP (" . __LINE__ . ")"
                 );
             }
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Delete a user from LDAP.
      *
      * @param \App\User $user The user account to delete.
      *
      * @throws \Exception
      */
     public static function deleteUser(User $user): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         if (self::getUserEntry($ldap, $user->email, $dn)) {
             $result = $ldap->delete_entry($dn);
 
             if (!$result) {
                 self::throwException(
                     $ldap,
                     "Failed to delete user {$user->email} from LDAP (" . __LINE__ . ")"
                 );
             }
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Get a domain data from LDAP.
      *
      * @param string $namespace The domain name
      *
      * @return array|false|null
      * @throws \Exception
      */
     public static function getDomain(string $namespace)
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $ldapDomain = $ldap->find_domain($namespace);
 
         if ($ldapDomain) {
             $domain = $ldap->get_entry($ldapDomain['dn']);
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
 
         return $domain ?? null;
     }
 
     /**
      * Get a group data from LDAP.
      *
      * @param string $email The group email.
      *
      * @return array|false|null
      * @throws \Exception
      */
     public static function getGroup(string $email)
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $group = self::getGroupEntry($ldap, $email, $dn);
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
 
         return $group;
     }
 
     /**
      * Get a user data from LDAP.
      *
      * @param string $email The user email.
      *
      * @return array|false|null
      * @throws \Exception
      */
     public static function getUser(string $email)
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $user = self::getUserEntry($ldap, $email, $dn, true);
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
 
         return $user;
     }
 
     /**
      * Update a domain in LDAP.
      *
      * @param \App\Domain $domain The domain to update.
      *
      * @throws \Exception
      */
     public static function updateDomain(Domain $domain): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $ldapDomain = $ldap->find_domain($domain->namespace);
 
         if (!$ldapDomain) {
             self::throwException(
                 $ldap,
                 "Failed to update domain {$domain->namespace} in LDAP (domain not found)"
             );
         }
 
         $oldEntry = $ldap->get_entry($ldapDomain['dn']);
         $newEntry = $oldEntry;
 
         self::setDomainAttributes($domain, $newEntry);
 
         if (array_key_exists('inetdomainstatus', $newEntry)) {
             $newEntry['inetdomainstatus'] = (string) $newEntry['inetdomainstatus'];
         }
 
         $result = $ldap->modify_entry($ldapDomain['dn'], $oldEntry, $newEntry);
 
         if (!is_array($result)) {
             self::throwException(
                 $ldap,
                 "Failed to update domain {$domain->namespace} in LDAP (" . __LINE__ . ")"
             );
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Update a group in LDAP.
      *
      * @param \App\Group $group The group to update
      *
      * @throws \Exception
      */
     public static function updateGroup(Group $group): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         list($cn, $domainName) = explode('@', $group->email);
 
         $domain = $group->domain();
 
         if (empty($domain)) {
             self::throwException(
                 $ldap,
                 "Failed to update group {$group->email} in LDAP (" . __LINE__ . ")"
             );
         }
 
         $hostedRootDN = \config('ldap.hosted.root_dn');
 
         $domainBaseDN = "ou={$domain->namespace},{$hostedRootDN}";
 
         $groupBaseDN = "ou=Groups,{$domainBaseDN}";
 
         $dn = "cn={$cn},{$groupBaseDN}";
 
         $entry = [
             'cn' => $cn,
             'mail' => $group->email,
             'objectclass' => [
                 'top',
                 'groupofuniquenames',
                 'kolabgroupofuniquenames'
             ],
             'uniquemember' => []
         ];
 
         $oldEntry = $ldap->get_entry($dn);
 
         self::setGroupAttributes($ldap, $group, $entry);
 
         $result = $ldap->modify_entry($dn, $oldEntry, $entry);
 
         if (!is_array($result)) {
             self::throwException(
                 $ldap,
                 "Failed to update group {$group->email} in LDAP (" . __LINE__ . ")"
             );
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Update a user in LDAP.
      *
      * @param \App\User $user The user account to update.
      *
      * @throws \Exception
      */
     public static function updateUser(User $user): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $newEntry = $oldEntry = self::getUserEntry($ldap, $user->email, $dn, true);
 
         if (!$oldEntry) {
             self::throwException(
                 $ldap,
                 "Failed to update user {$user->email} in LDAP (user not found)"
             );
         }
 
         self::setUserAttributes($user, $newEntry);
 
         if (array_key_exists('objectclass', $newEntry)) {
             if (!in_array('inetuser', $newEntry['objectclass'])) {
                 $newEntry['objectclass'][] = 'inetuser';
             }
         }
 
         if (array_key_exists('inetuserstatus', $newEntry)) {
             $newEntry['inetuserstatus'] = (string) $newEntry['inetuserstatus'];
         }
 
         if (array_key_exists('mailquota', $newEntry)) {
             $newEntry['mailquota'] = (string) $newEntry['mailquota'];
         }
 
         $result = $ldap->modify_entry($dn, $oldEntry, $newEntry);
 
         if (!is_array($result)) {
             self::throwException(
                 $ldap,
                 "Failed to update user {$user->email} in LDAP (" . __LINE__ . ")"
             );
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Initialize connection to LDAP
      */
     private static function initLDAP(array $config, string $privilege = 'admin')
     {
         if (self::$ldap) {
             return self::$ldap;
         }
 
         $ldap = new \Net_LDAP3($config);
 
         $connected = $ldap->connect();
 
         if (!$connected) {
             throw new \Exception("Failed to connect to LDAP");
         }
 
         $bound = $ldap->bind(
             \config("ldap.{$privilege}.bind_dn"),
             \config("ldap.{$privilege}.bind_pw")
         );
 
         if (!$bound) {
             throw new \Exception("Failed to bind to LDAP");
         }
 
         return $ldap;
     }
 
     /**
      * Set domain attributes
      */
     private static function setDomainAttributes(Domain $domain, array &$entry)
     {
         $entry['inetdomainstatus'] = $domain->status;
     }
 
     /**
      * Convert group member addresses in to valid entries.
      */
     private static function setGroupAttributes($ldap, Group $group, &$entry)
     {
         $validMembers = [];
 
         $domain = $group->domain();
 
         $hostedRootDN = \config('ldap.hosted.root_dn');
 
         $domainBaseDN = "ou={$domain->namespace},{$hostedRootDN}";
 
         foreach ($group->members as $member) {
             list($local, $domainName) = explode('@', $member);
 
             $memberDN = "uid={$member},ou=People,{$domainBaseDN}";
+            $memberEntry = $ldap->get_entry($memberDN);
 
             // if the member is in the local domain but doesn't exist, drop it
-            if ($domainName == $domain->namespace) {
-                if (!$ldap->get_entry($memberDN)) {
-                    continue;
-                }
+            if ($domainName == $domain->namespace && !$memberEntry) {
+                continue;
             }
 
             // add the member if not in the local domain
-            if (!$ldap->get_entry($memberDN)) {
+            if (!$memberEntry) {
                 $memberEntry = [
                     'cn' => $member,
                     'mail' => $member,
                     'objectclass' => [
                         'top',
                         'inetorgperson',
                         'organizationalperson',
                         'person'
                     ],
                     'sn' => 'unknown'
                 ];
 
                 $ldap->add_entry($memberDN, $memberEntry);
             }
 
             $entry['uniquemember'][] = $memberDN;
             $validMembers[] = $member;
         }
 
         // Update members in sql (some might have been removed),
         // skip model events to not invoke another update job
         $group->members = $validMembers;
         Group::withoutEvents(function () use ($group) {
             $group->save();
         });
     }
 
     /**
      * Set common user attributes
      */
     private static function setUserAttributes(User $user, array &$entry)
     {
         $firstName = $user->getSetting('first_name');
         $lastName = $user->getSetting('last_name');
 
         $cn = "unknown";
         $displayname = "";
 
         if ($firstName) {
             if ($lastName) {
                 $cn = "{$firstName} {$lastName}";
                 $displayname = "{$lastName}, {$firstName}";
             } else {
                 $lastName = "unknown";
                 $cn = "{$firstName}";
                 $displayname = "{$firstName}";
             }
         } else {
             $firstName = "";
             if ($lastName) {
                 $cn = "{$lastName}";
                 $displayname = "{$lastName}";
             } else {
                 $lastName = "unknown";
             }
         }
 
         $entry['cn'] = $cn;
         $entry['displayname'] = $displayname;
         $entry['givenname'] = $firstName;
         $entry['sn'] = $lastName;
         $entry['userpassword'] = $user->password_ldap;
         $entry['inetuserstatus'] = $user->status;
         $entry['o'] = $user->getSetting('organization');
         $entry['mailquota'] = 0;
         $entry['alias'] = $user->aliases->pluck('alias')->toArray();
 
         $roles = [];
 
         foreach ($user->entitlements as $entitlement) {
             \Log::debug("Examining {$entitlement->sku->title}");
 
             switch ($entitlement->sku->title) {
                 case "mailbox":
                     break;
 
                 case "storage":
                     $entry['mailquota'] += 1048576;
                     break;
 
                 default:
                     $roles[] = $entitlement->sku->title;
                     break;
             }
         }
 
         $hostedRootDN = \config('ldap.hosted.root_dn');
 
         $entry['nsroledn'] = [];
 
         if (in_array("2fa", $roles)) {
             $entry['nsroledn'][] = "cn=2fa-user,{$hostedRootDN}";
         }
 
         if (in_array("activesync", $roles)) {
             $entry['nsroledn'][] = "cn=activesync-user,{$hostedRootDN}";
         }
 
         if (!in_array("groupware", $roles)) {
             $entry['nsroledn'][] = "cn=imap-user,{$hostedRootDN}";
         }
     }
 
     /**
      * Get LDAP configuration for specified access level
      */
     private static function getConfig(string $privilege)
     {
         $config = [
             'domain_base_dn' => \config('ldap.domain_base_dn'),
             'domain_filter' => \config('ldap.domain_filter'),
             'domain_name_attribute' => \config('ldap.domain_name_attribute'),
             'hosts' => \config('ldap.hosts'),
             'sort' => false,
             'vlv' => false,
             'log_hook' => 'App\Backends\LDAP::logHook',
         ];
 
         return $config;
     }
 
     /**
      * Get group entry from LDAP.
      *
      * @param \Net_LDAP3 $ldap  Ldap connection
      * @param string     $email Group email (mail)
      * @param string     $dn    Reference to group DN
      *
      * @return false|null|array Group entry, False on error, NULL if not found
      */
     private static function getGroupEntry($ldap, $email, &$dn = null)
     {
         list($_local, $_domain) = explode('@', $email, 2);
 
         $domain = $ldap->find_domain($_domain);
 
         if (!$domain) {
             return $domain;
         }
 
         $base_dn = $ldap->domain_root_dn($_domain);
         $dn = "cn={$_local},ou=Groups,{$base_dn}";
 
         $entry = $ldap->get_entry($dn);
 
         return $entry ?: null;
     }
 
     /**
      * Get user entry from LDAP.
      *
      * @param \Net_LDAP3 $ldap  Ldap connection
      * @param string     $email User email (uid)
      * @param string     $dn    Reference to user DN
      * @param bool       $full  Get extra attributes, e.g. nsroledn
      *
      * @return false|null|array User entry, False on error, NULL if not found
      */
     private static function getUserEntry($ldap, $email, &$dn = null, $full = false)
     {
         list($_local, $_domain) = explode('@', $email, 2);
 
         $domain = $ldap->find_domain($_domain);
 
         if (!$domain) {
             return $domain;
         }
 
         $base_dn = $ldap->domain_root_dn($_domain);
         $dn = "uid={$email},ou=People,{$base_dn}";
 
         $entry = $ldap->get_entry($dn);
 
         if ($entry && $full) {
             if (!array_key_exists('nsroledn', $entry)) {
                 $roles = $ldap->get_entry_attributes($dn, ['nsroledn']);
                 if (!empty($roles)) {
                     $entry['nsroledn'] = (array) $roles['nsroledn'];
                 }
             }
         }
 
         return $entry ?: null;
     }
 
     /**
      * Logging callback
      */
     public static function logHook($level, $msg): void
     {
         if (
             (
                 $level == LOG_INFO
                 || $level == LOG_DEBUG
                 || $level == LOG_NOTICE
             )
             && !\config('app.debug')
         ) {
             return;
         }
 
         switch ($level) {
             case LOG_CRIT:
                 $function = 'critical';
                 break;
             case LOG_EMERG:
                 $function = 'emergency';
                 break;
             case LOG_ERR:
                 $function = 'error';
                 break;
             case LOG_ALERT:
                 $function = 'alert';
                 break;
             case LOG_WARNING:
                 $function = 'warning';
                 break;
             case LOG_INFO:
                 $function = 'info';
                 break;
             case LOG_DEBUG:
                 $function = 'debug';
                 break;
             case LOG_NOTICE:
                 $function = 'notice';
                 break;
             default:
                 $function = 'info';
         }
 
         if (is_array($msg)) {
             $msg = implode("\n", $msg);
         }
 
         $msg = '[LDAP] ' . $msg;
 
         \Log::{$function}($msg);
     }
 
     /**
      * Throw exception and close the connection when needed
      *
      * @param \Net_LDAP3 $ldap    Ldap connection
      * @param string     $message Exception message
      *
      * @throws \Exception
      */
     private static function throwException($ldap, string $message): void
     {
         if (empty(self::$ldap) && !empty($ldap)) {
             $ldap->close();
         }
 
         throw new \Exception($message);
     }
 }
diff --git a/src/app/Console/Commands/Group/AddMemberCommand.php b/src/app/Console/Commands/Group/AddMemberCommand.php
index ebb61364..2e2255ca 100644
--- a/src/app/Console/Commands/Group/AddMemberCommand.php
+++ b/src/app/Console/Commands/Group/AddMemberCommand.php
@@ -1,53 +1,56 @@
 <?php
 
 namespace App\Console\Commands\Group;
 
 use App\Console\Command;
+use App\Http\Controllers\API\V4\GroupsController;
 
 class AddMemberCommand extends Command
 {
     /**
      * The name and signature of the console command.
      *
      * @var string
      */
     protected $signature = 'group:add-member {group} {member}';
 
     /**
      * The console command description.
      *
      * @var string
      */
     protected $description = "Add a member to a group.";
 
     /**
      * Execute the console command.
      *
      * @return mixed
      */
     public function handle()
     {
         $input = $this->argument('group');
         $member = \strtolower($this->argument('member'));
         $group = $this->getObject(\App\Group::class, $input, 'email');
 
         if (empty($group)) {
             $this->error("Group {$input} does not exist.");
             return 1;
         }
 
         if (in_array($member, $group->members)) {
             $this->error("{$member}: Already exists in the group.");
             return 1;
         }
 
-        if ($error = CreateCommand::validateMemberEmail($member)) {
+        $owner = $group->wallet()->owner;
+
+        if ($error = GroupsController::validateMemberEmail($member, $owner)) {
             $this->error("{$member}: $error");
             return 1;
         }
 
         // We can't modify the property indirectly, therefor array_merge()
         $group->members = array_merge($group->members, [$member]);
         $group->save();
     }
 }
diff --git a/src/app/Console/Commands/Group/CreateCommand.php b/src/app/Console/Commands/Group/CreateCommand.php
index f6d2d50d..6b3109eb 100644
--- a/src/app/Console/Commands/Group/CreateCommand.php
+++ b/src/app/Console/Commands/Group/CreateCommand.php
@@ -1,173 +1,84 @@
 <?php
 
 namespace App\Console\Commands\Group;
 
 use App\Console\Command;
-use App\Domain;
 use App\Group;
-use App\User;
+use App\Http\Controllers\API\V4\GroupsController;
 use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Validator;
 
 class CreateCommand extends Command
 {
     /**
      * The name and signature of the console command.
      *
      * @var string
      */
     protected $signature = 'group:create {email} {--member=*}';
 
     /**
      * The console command description.
      *
      * @var string
      */
     protected $description = "Create a group.";
 
     /**
      * Execute the console command.
      *
      * @return mixed
      */
     public function handle()
     {
         $email = $this->argument('email');
         $members = $this->option('member');
 
         list($local, $domainName) = explode('@', $email, 2);
 
         $domain = $this->getDomain($domainName);
 
         if (!$domain) {
             $this->error("No such domain {$domainName}.");
             return 1;
         }
 
         if ($domain->isPublic()) {
             $this->error("Domain {$domainName} is public.");
             return 1;
         }
 
         $owner = $domain->wallet()->owner;
 
-        // Validate group email address
+        // Validate members addresses
         foreach ($members as $i => $member) {
-            if ($error = $this->validateMemberEmail($member)) {
+            if ($error = GroupsController::validateMemberEmail($member, $owner)) {
                 $this->error("{$member}: $error");
                 return 1;
             }
             if (\strtolower($member) === \strtolower($email)) {
                 $this->error("{$member}: Cannot be the same as the group address.");
                 return 1;
             }
         }
 
-        // Validate members addresses
-        if ($error = $this->validateGroupEmail($email, $owner)) {
+        // Validate group email address
+        if ($error = GroupsController::validateGroupEmail($email, $owner)) {
             $this->error("{$email}: {$error}");
             return 1;
         }
 
         DB::beginTransaction();
 
         // Create the group
         $group = new Group();
         $group->email = $email;
         $group->members = $members;
         $group->save();
 
         $group->assignToWallet($owner->wallets->first());
 
         DB::commit();
 
         $this->info($group->id);
     }
-
-    /**
-     * Validate an email address for use as a group member
-     *
-     * @param string $email Email address
-     *
-     * @return ?string Error message on validation error
-     */
-    public static function validateMemberEmail(string $email): ?string
-    {
-        $v = Validator::make(
-            ['email' => $email],
-            ['email' => [new \App\Rules\ExternalEmail()]]
-        );
-
-        if ($v->fails()) {
-            return $v->errors()->toArray()['email'][0];
-        }
-
-        return null;
-    }
-
-    /**
-     * Validate an email address for use as a group email
-     *
-     * @param string    $email Email address
-     * @param \App\User $user  The group owner
-     *
-     * @return ?string Error message on validation error
-     */
-    public static function validateGroupEmail(string $email, \App\User $user): ?string
-    {
-        if (strpos($email, '@') === false) {
-            return \trans('validation.entryinvalid', ['attribute' => 'email']);
-        }
-
-        list($login, $domain) = explode('@', \strtolower($email));
-
-        if (strlen($login) === 0 || strlen($domain) === 0) {
-            return \trans('validation.entryinvalid', ['attribute' => 'email']);
-        }
-
-        // Check if domain exists
-        $domain = Domain::where('namespace', $domain)->first();
-/*
-        if (empty($domain)) {
-            return \trans('validation.domainnotavailable');
-        }
-
-        if ($domain->isPublic()) {
-            return \trans('validation.domainnotavailable');
-        }
-*/
-        // Validate login part alone
-        $v = Validator::make(
-            ['email' => $login],
-            ['email' => [new \App\Rules\UserEmailLocal(!$domain->isPublic())]]
-        );
-
-        if ($v->fails()) {
-            return $v->errors()->toArray()['email'][0];
-        }
-/*
-        // Check if it is one of domains available to the user
-        $domains = \collect($user->domains())->pluck('namespace')->all();
-
-        if (!in_array($domain->namespace, $domains)) {
-            // return \trans('validation.entryexists', ['attribute' => 'domain']);
-            return \trans('validation.domainnotavailable');
-        }
-*/
-        // Check if a user with specified address already exists
-        if (User::emailExists($email)) {
-            return \trans('validation.entryexists', ['attribute' => 'email']);
-        }
-
-        // Check if an alias with specified address already exists.
-        if (User::aliasExists($email)) {
-            return \trans('validation.entryexists', ['attribute' => 'email']);
-        }
-
-        if (Group::emailExists($email)) {
-            return \trans('validation.entryexists', ['attribute' => 'email']);
-        }
-
-        return null;
-    }
 }
diff --git a/src/app/Handlers/Distlist.php b/src/app/Handlers/Distlist.php
new file mode 100644
index 00000000..9cb9edc3
--- /dev/null
+++ b/src/app/Handlers/Distlist.php
@@ -0,0 +1,49 @@
+<?php
+
+namespace App\Handlers;
+
+class Distlist extends Beta\Base
+{
+    /**
+     * The entitleable class for this handler.
+     *
+     * @return string
+     */
+    public static function entitleableClass(): string
+    {
+        return \App\User::class;
+    }
+
+    /**
+     * Check if the SKU is available to the user.
+     *
+     * @param \App\Sku  $sku  The SKU object
+     * @param \App\User $user The user object
+     *
+     * @return bool
+     */
+    public static function isAvailable(\App\Sku $sku, \App\User $user): bool
+    {
+        // This SKU must be:
+        // - already assigned, or active and a 'beta' entitlement must exist
+        // - and this is a group account owner (custom domain)
+
+        if (parent::isAvailable($sku, $user)) {
+            return $user->wallet()->entitlements()
+                ->where('entitleable_type', \App\Domain::class)->count() > 0;
+        }
+
+        return false;
+    }
+
+    /**
+     * The priority that specifies the order of SKUs in UI.
+     * Higher number means higher on the list.
+     *
+     * @return int
+     */
+    public static function priority(): int
+    {
+        return 10;
+    }
+}
diff --git a/src/app/Http/Controllers/API/V4/GroupsController.php b/src/app/Http/Controllers/API/V4/GroupsController.php
new file mode 100644
index 00000000..e8c5265a
--- /dev/null
+++ b/src/app/Http/Controllers/API/V4/GroupsController.php
@@ -0,0 +1,507 @@
+<?php
+
+namespace App\Http\Controllers\API\V4;
+
+use App\Http\Controllers\Controller;
+use App\Domain;
+use App\Group;
+use App\User;
+use Carbon\Carbon;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Validator;
+
+class GroupsController extends Controller
+{
+    /**
+     * Show the form for creating a new group.
+     *
+     * @return \Illuminate\Http\JsonResponse
+     */
+    public function create()
+    {
+        return $this->errorResponse(404);
+    }
+
+    /**
+     * Delete a group.
+     *
+     * @param int $id Group identifier
+     *
+     * @return \Illuminate\Http\JsonResponse The response
+     */
+    public function destroy($id)
+    {
+        $group = Group::find($id);
+
+        if (empty($group)) {
+            return $this->errorResponse(404);
+        }
+
+        if (!$this->guard()->user()->canDelete($group)) {
+            return $this->errorResponse(403);
+        }
+
+        $group->delete();
+
+        return response()->json([
+                'status' => 'success',
+                'message' => __('app.distlist-delete-success'),
+        ]);
+    }
+
+    /**
+     * Show the form for editing the specified group.
+     *
+     * @param int $id Group identifier
+     *
+     * @return \Illuminate\Http\JsonResponse
+     */
+    public function edit($id)
+    {
+        return $this->errorResponse(404);
+    }
+
+    /**
+     * Listing of groups belonging to the authenticated user.
+     *
+     * The group-entitlements billed to the current user wallet(s)
+     *
+     * @return \Illuminate\Http\JsonResponse
+     */
+    public function index()
+    {
+        $user = $this->guard()->user();
+
+        $result = $user->groups()->orderBy('email')->get()
+            ->map(function (Group $group) {
+                $data = [
+                    'id' => $group->id,
+                    'email' => $group->email,
+                ];
+
+                $data = array_merge($data, self::groupStatuses($group));
+                return $data;
+            });
+
+        return response()->json($result);
+    }
+
+    /**
+     * Display information of a group specified by $id.
+     *
+     * @param int $id The group to show information for.
+     *
+     * @return \Illuminate\Http\JsonResponse
+     */
+    public function show($id)
+    {
+        $group = Group::find($id);
+
+        if (empty($group)) {
+            return $this->errorResponse(404);
+        }
+
+        if (!$this->guard()->user()->canRead($group)) {
+            return $this->errorResponse(403);
+        }
+
+        $response = $group->toArray();
+
+        $response = array_merge($response, self::groupStatuses($group));
+        $response['statusInfo'] = self::statusInfo($group);
+
+        return response()->json($response);
+    }
+
+    /**
+     * Fetch group status (and reload setup process)
+     *
+     * @param int $id Group identifier
+     *
+     * @return \Illuminate\Http\JsonResponse
+     */
+    public function status($id)
+    {
+        $group = Group::find($id);
+
+        if (empty($group)) {
+            return $this->errorResponse(404);
+        }
+
+        if (!$this->guard()->user()->canRead($group)) {
+            return $this->errorResponse(403);
+        }
+
+        $response = self::statusInfo($group);
+
+        if (!empty(request()->input('refresh'))) {
+            $updated = false;
+            $async = false;
+            $last_step = 'none';
+
+            foreach ($response['process'] as $idx => $step) {
+                $last_step = $step['label'];
+
+                if (!$step['state']) {
+                    $exec = $this->execProcessStep($group, $step['label']);
+
+                    if (!$exec) {
+                        if ($exec === null) {
+                            $async = true;
+                        }
+
+                        break;
+                    }
+
+                    $updated = true;
+                }
+            }
+
+            if ($updated) {
+                $response = self::statusInfo($group);
+            }
+
+            $success = $response['isReady'];
+            $suffix = $success ? 'success' : 'error-' . $last_step;
+
+            $response['status'] = $success ? 'success' : 'error';
+            $response['message'] = \trans('app.process-' . $suffix);
+
+            if ($async && !$success) {
+                $response['processState'] = 'waiting';
+                $response['status'] = 'success';
+                $response['message'] = \trans('app.process-async');
+            }
+        }
+
+        $response = array_merge($response, self::groupStatuses($group));
+
+        return response()->json($response);
+    }
+
+    /**
+     * Group status (extended) information
+     *
+     * @param \App\Group $group Group object
+     *
+     * @return array Status information
+     */
+    public static function statusInfo(Group $group): array
+    {
+        $process = [];
+        $steps = [
+            'distlist-new' => true,
+            'distlist-ldap-ready' => $group->isLdapReady(),
+        ];
+
+        // Create a process check list
+        foreach ($steps as $step_name => $state) {
+            $step = [
+                'label' => $step_name,
+                'title' => \trans("app.process-{$step_name}"),
+                'state' => $state,
+            ];
+
+            $process[] = $step;
+        }
+
+        $domain = $group->domain();
+
+        // If that is not a public domain, add domain specific steps
+        if ($domain && !$domain->isPublic()) {
+            $domain_status = DomainsController::statusInfo($domain);
+            $process = array_merge($process, $domain_status['process']);
+        }
+
+        $all = count($process);
+        $checked = count(array_filter($process, function ($v) {
+                return $v['state'];
+        }));
+
+        $state = $all === $checked ? 'done' : 'running';
+
+        // After 180 seconds assume the process is in failed state,
+        // this should unlock the Refresh button in the UI
+        if ($all !== $checked && $group->created_at->diffInSeconds(Carbon::now()) > 180) {
+            $state = 'failed';
+        }
+
+        return [
+            'process' => $process,
+            'processState' => $state,
+            'isReady' => $all === $checked,
+        ];
+    }
+
+    /**
+     * Create a new group record.
+     *
+     * @param \Illuminate\Http\Request $request The API request.
+     *
+     * @return \Illuminate\Http\JsonResponse The response
+     */
+    public function store(Request $request)
+    {
+        $current_user = $this->guard()->user();
+        $owner = $current_user->wallet()->owner;
+
+        if ($owner->id != $current_user->id) {
+            return $this->errorResponse(403);
+        }
+
+        $email = request()->input('email');
+        $members = request()->input('members');
+        $errors = [];
+
+        // Validate group address
+        if ($error = GroupsController::validateGroupEmail($email, $owner)) {
+            $errors['email'] = $error;
+        }
+
+        // Validate members' email addresses
+        if (empty($members) || !is_array($members)) {
+            $errors['members'] = \trans('validation.listmembersrequired');
+        } else {
+            foreach ($members as $i => $member) {
+                if (is_string($member) && !empty($member)) {
+                    if ($error = GroupsController::validateMemberEmail($member, $owner)) {
+                        $errors['members'][$i] = $error;
+                    } elseif (\strtolower($member) === \strtolower($email)) {
+                        $errors['members'][$i] = \trans('validation.memberislist');
+                    }
+                } else {
+                    unset($members[$i]);
+                }
+            }
+        }
+
+        if (!empty($errors)) {
+            return response()->json(['status' => 'error', 'errors' => $errors], 422);
+        }
+
+        DB::beginTransaction();
+
+        // Create the group
+        $group = new Group();
+        $group->email = $email;
+        $group->members = $members;
+        $group->save();
+
+        $group->assignToWallet($owner->wallets->first());
+
+        DB::commit();
+
+        return response()->json([
+                'status' => 'success',
+                'message' => __('app.distlist-create-success'),
+        ]);
+    }
+
+    /**
+     * Update a group.
+     *
+     * @param \Illuminate\Http\Request $request The API request.
+     * @param string                   $id      Group identifier
+     *
+     * @return \Illuminate\Http\JsonResponse The response
+     */
+    public function update(Request $request, $id)
+    {
+        $group = Group::find($id);
+
+        if (empty($group)) {
+            return $this->errorResponse(404);
+        }
+
+        $current_user = $this->guard()->user();
+
+        if (!$current_user->canUpdate($group)) {
+            return $this->errorResponse(403);
+        }
+
+        $owner = $group->wallet()->owner;
+
+        // It is possible to update members property only for now
+        $members = request()->input('members');
+        $errors = [];
+
+        // Validate members' email addresses
+        if (empty($members) || !is_array($members)) {
+            $errors['members'] = \trans('validation.listmembersrequired');
+        } else {
+            foreach ((array) $members as $i => $member) {
+                if (is_string($member) && !empty($member)) {
+                    if ($error = GroupsController::validateMemberEmail($member, $owner)) {
+                        $errors['members'][$i] = $error;
+                    } elseif (\strtolower($member) === $group->email) {
+                        $errors['members'][$i] = \trans('validation.memberislist');
+                    }
+                } else {
+                    unset($members[$i]);
+                }
+            }
+        }
+
+        if (!empty($errors)) {
+            return response()->json(['status' => 'error', 'errors' => $errors], 422);
+        }
+
+        $group->members = $members;
+        $group->save();
+
+        return response()->json([
+                'status' => 'success',
+                'message' => __('app.distlist-update-success'),
+        ]);
+    }
+
+    /**
+     * Execute (synchronously) specified step in a group setup process.
+     *
+     * @param \App\Group $group Group object
+     * @param string     $step  Step identifier (as in self::statusInfo())
+     *
+     * @return bool|null True if the execution succeeded, False if not, Null when
+     *                   the job has been sent to the worker (result unknown)
+     */
+    public static function execProcessStep(Group $group, string $step): ?bool
+    {
+        try {
+            if (strpos($step, 'domain-') === 0) {
+                return DomainsController::execProcessStep($group->domain(), $step);
+            }
+
+            switch ($step) {
+                case 'distlist-ldap-ready':
+                    // Group not in LDAP, create it
+                    $job = new \App\Jobs\Group\CreateJob($group->id);
+                    $job->handle();
+
+                    $group->refresh();
+
+                    return $group->isLdapReady();
+            }
+        } catch (\Exception $e) {
+            \Log::error($e);
+        }
+
+        return false;
+    }
+
+    /**
+     * Prepare group statuses for the UI
+     *
+     * @param \App\Group $group Group object
+     *
+     * @return array Statuses array
+     */
+    protected static function groupStatuses(Group $group): array
+    {
+        return [
+            'isLdapReady' => $group->isLdapReady(),
+            'isSuspended' => $group->isSuspended(),
+            'isActive' => $group->isActive(),
+            'isDeleted' => $group->isDeleted() || $group->trashed(),
+        ];
+    }
+
+    /**
+     * Validate an email address for use as a group email
+     *
+     * @param string    $email Email address
+     * @param \App\User $user  The group owner
+     *
+     * @return ?string Error message on validation error
+     */
+    public static function validateGroupEmail($email, \App\User $user): ?string
+    {
+        if (empty($email)) {
+            return \trans('validation.required', ['attribute' => 'email']);
+        }
+
+        if (strpos($email, '@') === false) {
+            return \trans('validation.entryinvalid', ['attribute' => 'email']);
+        }
+
+        list($login, $domain) = explode('@', \strtolower($email));
+
+        if (strlen($login) === 0 || strlen($domain) === 0) {
+            return \trans('validation.entryinvalid', ['attribute' => 'email']);
+        }
+
+        // Check if domain exists
+        $domain = Domain::where('namespace', $domain)->first();
+
+        if (empty($domain)) {
+            return \trans('validation.domaininvalid');
+        }
+
+        $wallet = $domain->wallet();
+
+        // The domain must be owned by the user
+        if (!$wallet || !$user->wallets()->find($wallet->id)) {
+            return \trans('validation.domainnotavailable');
+        }
+
+        // Validate login part alone
+        $v = Validator::make(
+            ['email' => $login],
+            ['email' => [new \App\Rules\UserEmailLocal(true)]]
+        );
+
+        if ($v->fails()) {
+            return $v->errors()->toArray()['email'][0];
+        }
+
+        // Check if a user with specified address already exists
+        if (User::emailExists($email)) {
+            return \trans('validation.entryexists', ['attribute' => 'email']);
+        }
+
+        // Check if an alias with specified address already exists.
+        if (User::aliasExists($email)) {
+            return \trans('validation.entryexists', ['attribute' => 'email']);
+        }
+
+        if (Group::emailExists($email)) {
+            return \trans('validation.entryexists', ['attribute' => 'email']);
+        }
+
+        return null;
+    }
+
+    /**
+     * Validate an email address for use as a group member
+     *
+     * @param string    $email Email address
+     * @param \App\User $user  The group owner
+     *
+     * @return ?string Error message on validation error
+     */
+    public static function validateMemberEmail($email, \App\User $user): ?string
+    {
+        $v = Validator::make(
+            ['email' => $email],
+            ['email' => [new \App\Rules\ExternalEmail()]]
+        );
+
+        if ($v->fails()) {
+            return $v->errors()->toArray()['email'][0];
+        }
+
+        // A local domain user must exist
+        if (!User::where('email', \strtolower($email))->first()) {
+            list($login, $domain) = explode('@', \strtolower($email));
+
+            $domain = Domain::where('namespace', $domain)->first();
+
+            // We return an error only if the domain belongs to the group owner
+            if ($domain && ($wallet = $domain->wallet()) && $user->wallets()->find($wallet->id)) {
+                return \trans('validation.notalocaluser');
+            }
+        }
+
+        return null;
+    }
+}
diff --git a/src/app/Http/Controllers/API/V4/OpenViduController.php b/src/app/Http/Controllers/API/V4/OpenViduController.php
index 99930635..ac21c63c 100644
--- a/src/app/Http/Controllers/API/V4/OpenViduController.php
+++ b/src/app/Http/Controllers/API/V4/OpenViduController.php
@@ -1,590 +1,590 @@
 <?php
 
 namespace App\Http\Controllers\API\V4;
 
 use App\Http\Controllers\Controller;
 use App\OpenVidu\Connection;
 use App\OpenVidu\Room;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Validator;
 
 class OpenViduController extends Controller
 {
     public const AUTH_HEADER = 'X-Meet-Auth-Token';
 
     /**
      * Accept the room join request.
      *
      * @param string $id    Room identifier (name)
      * @param string $reqid Request identifier
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function acceptJoinRequest($id, $reqid)
     {
         $room = Room::where('name', $id)->first();
 
         // This isn't a room, bye bye
         if (!$room) {
             return $this->errorResponse(404, \trans('meet.room-not-found'));
         }
 
         // Only the moderator can do it
         if (!$this->isModerator($room)) {
             return $this->errorResponse(403);
         }
 
         if (!$room->requestAccept($reqid)) {
             return $this->errorResponse(500, \trans('meet.session-request-accept-error'));
         }
 
         return response()->json(['status' => 'success']);
     }
 
     /**
      * Deny the room join request.
      *
      * @param string $id    Room identifier (name)
      * @param string $reqid Request identifier
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function denyJoinRequest($id, $reqid)
     {
         $room = Room::where('name', $id)->first();
 
         // This isn't a room, bye bye
         if (!$room) {
             return $this->errorResponse(404, \trans('meet.room-not-found'));
         }
 
         // Only the moderator can do it
         if (!$this->isModerator($room)) {
             return $this->errorResponse(403);
         }
 
         if (!$room->requestDeny($reqid)) {
             return $this->errorResponse(500, \trans('meet.session-request-deny-error'));
         }
 
         return response()->json(['status' => 'success']);
     }
 
     /**
      * Close the room session.
      *
      * @param string $id Room identifier (name)
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function closeRoom($id)
     {
         $room = Room::where('name', $id)->first();
 
         // This isn't a room, bye bye
         if (!$room) {
             return $this->errorResponse(404, \trans('meet.room-not-found'));
         }
 
         $user = Auth::guard()->user();
 
         // Only the room owner can do it
         if (!$user || $user->id != $room->user_id) {
             return $this->errorResponse(403);
         }
 
         if (!$room->deleteSession()) {
             return $this->errorResponse(500, \trans('meet.session-close-error'));
         }
 
         return response()->json([
                 'status' => 'success',
                 'message' => __('meet.session-close-success'),
         ]);
     }
 
     /**
      * Create a connection for screen sharing.
      *
      * @param string $id Room identifier (name)
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function createConnection($id)
     {
         $room = Room::where('name', $id)->first();
 
         // This isn't a room, bye bye
         if (!$room) {
             return $this->errorResponse(404, \trans('meet.room-not-found'));
         }
 
         $connection = $this->getConnectionFromRequest();
 
         if (
             !$connection
             || $connection->session_id != $room->session_id
             || ($connection->role & Room::ROLE_PUBLISHER) == 0
         ) {
             return $this->errorResponse(403);
         }
 
         $response = $room->getSessionToken(Room::ROLE_SCREEN);
 
         return response()->json(['status' => 'success', 'token' => $response['token']]);
     }
 
     /**
      * Dismiss the participant/connection from the session.
      *
      * @param string $id   Room identifier (name)
      * @param string $conn Connection identifier
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function dismissConnection($id, $conn)
     {
         $connection = Connection::where('id', $conn)->first();
 
         // There's no such connection, bye bye
         if (!$connection || $connection->room->name != $id) {
             return $this->errorResponse(404, \trans('meet.connection-not-found'));
         }
 
         // Only the moderator can do it
         if (!$this->isModerator($connection->room)) {
             return $this->errorResponse(403);
         }
 
         if (!$connection->dismiss()) {
             return $this->errorResponse(500, \trans('meet.connection-dismiss-error'));
         }
 
         return response()->json(['status' => 'success']);
     }
 
     /**
      * Listing of rooms that belong to the authenticated user.
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function index()
     {
         $user = Auth::guard()->user();
 
         $rooms = Room::where('user_id', $user->id)->orderBy('name')->get();
 
         if (count($rooms) == 0) {
             // Create a room for the user (with a random and unique name)
             while (true) {
                 $name = strtolower(\App\Utils::randStr(3, 3, '-'));
                 if (!Room::where('name', $name)->count()) {
                     break;
                 }
             }
 
             $room = Room::create([
                     'name' => $name,
                     'user_id' => $user->id
             ]);
 
             $rooms = collect([$room]);
         }
 
         $result = [
             'list' => $rooms,
             'count' => count($rooms),
         ];
 
         return response()->json($result);
     }
 
     /**
      * Join the room session. Each room has one owner, and the room isn't open until the owner
      * joins (and effectively creates the session).
      *
      * @param string $id Room identifier (name)
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function joinRoom($id)
     {
         $room = Room::where('name', $id)->first();
 
         // Room does not exist, or the owner is deleted
         if (!$room || !$room->owner) {
             return $this->errorResponse(404, \trans('meet.room-not-found'));
         }
 
-        // Check if there's still a valid beta entitlement for the room owner
+        // Check if there's still a valid meet entitlement for the room owner
         $sku = \App\Sku::where('title', 'meet')->first();
         if ($sku && !$room->owner->entitlements()->where('sku_id', $sku->id)->first()) {
             return $this->errorResponse(404, \trans('meet.room-not-found'));
         }
 
         $user = Auth::guard()->user();
         $isOwner = $user && $user->id == $room->user_id;
         $init = !empty(request()->input('init'));
 
         // There's no existing session
         if (!$room->hasSession()) {
             // Participants can't join the room until the session is created by the owner
             if (!$isOwner) {
                 return $this->errorResponse(422, \trans('meet.session-not-found'), ['code' => 323]);
             }
 
             // The room owner can create the session on request
             if (!$init) {
                 return $this->errorResponse(422, \trans('meet.session-not-found'), ['code' => 324]);
             }
 
             $session = $room->createSession();
 
             if (empty($session)) {
                 return $this->errorResponse(500, \trans('meet.session-create-error'));
             }
         }
 
         $password = (string) $room->getSetting('password');
 
         $config = [
             'locked' => $room->getSetting('locked') === 'true',
             'nomedia' => $room->getSetting('nomedia') === 'true',
             'password' => $isOwner ? $password : '',
             'requires_password' => !$isOwner && strlen($password),
         ];
 
         $response = ['config' => $config];
 
         // Validate room password
         if (!$isOwner && strlen($password)) {
             $request_password = request()->input('password');
             if ($request_password !== $password) {
                 return $this->errorResponse(422, \trans('meet.session-password-error'), $response + ['code' => 325]);
             }
         }
 
         // Handle locked room
         if (!$isOwner && $config['locked']) {
             $nickname = request()->input('nickname');
             $picture = request()->input('picture');
             $requestId = request()->input('requestId');
 
             $request = $requestId ? $room->requestGet($requestId) : null;
 
             $error = \trans('meet.session-room-locked-error');
 
             // Request already has been processed (not accepted yet, but it could be denied)
             if (empty($request['status']) || $request['status'] != Room::REQUEST_ACCEPTED) {
                 if (!$request) {
                     if (empty($nickname) || empty($requestId) || !preg_match('/^[a-z0-9]{8,32}$/i', $requestId)) {
                         return $this->errorResponse(422, $error, $response + ['code' => 326]);
                     }
 
                     if (empty($picture)) {
                         $svg = file_get_contents(resource_path('images/user.svg'));
                         $picture = 'data:image/svg+xml;base64,' . base64_encode($svg);
                     } elseif (!preg_match('|^data:image/png;base64,[a-zA-Z0-9=+/]+$|', $picture)) {
                         return $this->errorResponse(422, $error, $response + ['code' => 326]);
                     }
 
                     // TODO: Resize when big/make safe the user picture?
 
                     $request = ['nickname' => $nickname, 'requestId' => $requestId, 'picture' => $picture];
 
                     if (!$room->requestSave($requestId, $request)) {
                         // FIXME: should we use error code 500?
                         return $this->errorResponse(422, $error, $response + ['code' => 326]);
                     }
 
                     // Send the request (signal) to the owner
                     $result = $room->signal('joinRequest', $request, Room::ROLE_MODERATOR);
                 }
 
                 return $this->errorResponse(422, $error, $response + ['code' => 327]);
             }
         }
 
         // Initialize connection tokens
         if ($init) {
             // Choose the connection role
             $canPublish = !empty(request()->input('canPublish')) && (empty($config['nomedia']) || $isOwner);
             $role = $canPublish ? Room::ROLE_PUBLISHER : Room::ROLE_SUBSCRIBER;
             if ($isOwner) {
                 $role |= Room::ROLE_MODERATOR;
                 $role |= Room::ROLE_OWNER;
             }
 
             // Create session token for the current user/connection
             $response = $room->getSessionToken($role);
 
             if (empty($response)) {
                 return $this->errorResponse(500, \trans('meet.session-join-error'));
             }
 
             // Get up-to-date connections metadata
             $response['connections'] = $room->getSessionConnections();
 
             $response_code = 200;
             $response['role'] = $role;
             $response['config'] = $config;
         } else {
             $response_code = 422;
             $response['code'] = 322;
         }
 
         return response()->json($response, $response_code);
     }
 
     /**
      * Set the domain configuration.
      *
      * @param string $id Room identifier (name)
      *
      * @return \Illuminate\Http\JsonResponse|void
      */
     public function setRoomConfig($id)
     {
         $room = Room::where('name', $id)->first();
 
         // Room does not exist, or the owner is deleted
         if (!$room || !$room->owner) {
             return $this->errorResponse(404);
         }
 
         $user = Auth::guard()->user();
 
         // Only room owner can configure the room
         if ($user->id != $room->user_id) {
             return $this->errorResponse(403);
         }
 
         $input = request()->input();
         $errors = [];
 
         foreach ($input as $key => $value) {
             switch ($key) {
                 case 'password':
                     if ($value === null || $value === '') {
                         $input[$key] = null;
                     } else {
                         // TODO: Do we have to validate the password in any way?
                     }
                     break;
 
                 case 'locked':
                     $input[$key] = $value ? 'true' : null;
                     break;
 
                 case 'nomedia':
                     $input[$key] = $value ? 'true' : null;
                     break;
 
                 default:
                     $errors[$key] = \trans('meet.room-unsupported-option-error');
             }
         }
 
         if (!empty($errors)) {
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         if (!empty($input)) {
             $room->setSettings($input);
         }
 
         return response()->json([
                 'status' => 'success',
                 'message' => \trans('meet.room-setconfig-success'),
         ]);
     }
 
     /**
      * Update the participant/connection parameters (e.g. role).
      *
      * @param string $id   Room identifier (name)
      * @param string $conn Connection identifier
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function updateConnection($id, $conn)
     {
         $connection = Connection::where('id', $conn)->first();
 
         // There's no such connection, bye bye
         if (!$connection || $connection->room->name != $id) {
             return $this->errorResponse(404, \trans('meet.connection-not-found'));
         }
 
         foreach (request()->input() as $key => $value) {
             switch ($key) {
                 case 'hand':
                     // Only possible on user's own connection(s)
                     if (!$this->isSelfConnection($connection)) {
                         return $this->errorResponse(403);
                     }
 
                     if ($value) {
                         // Store current time, so we know the order in the queue
                         $connection->metadata = ['hand' => time()] + $connection->metadata;
                     } else {
                         $connection->metadata = array_diff_key($connection->metadata, ['hand' => 0]);
                     }
 
                     break;
 
                 case 'language':
                     // Only the moderator can do it
                     if (!$this->isModerator($connection->room)) {
                         return $this->errorResponse(403);
                     }
 
                     if ($value) {
                         if (preg_match('/^[a-z]{2}$/', $value)) {
                             $connection->metadata = ['language' => $value] + $connection->metadata;
                         }
                     } else {
                         $connection->metadata = array_diff_key($connection->metadata, ['language' => 0]);
                     }
 
                     break;
 
                 case 'role':
                     // Only the moderator can do it
                     if (!$this->isModerator($connection->room)) {
                         return $this->errorResponse(403);
                     }
 
                     // The 'owner' role is not assignable
                     if ($value & Room::ROLE_OWNER && !($connection->role & Room::ROLE_OWNER)) {
                         return $this->errorResponse(403);
                     } elseif (!($value & Room::ROLE_OWNER) && ($connection->role & Room::ROLE_OWNER)) {
                         return $this->errorResponse(403);
                     }
 
                     // The room owner has always a 'moderator' role
                     if (!($value & Room::ROLE_MODERATOR) && $connection->role & Room::ROLE_OWNER) {
                         $value |= Room::ROLE_MODERATOR;
                     }
 
                     // Promotion to publisher? Put the user hand down
                     if ($value & Room::ROLE_PUBLISHER && !($connection->role & Room::ROLE_PUBLISHER)) {
                         $connection->metadata = array_diff_key($connection->metadata, ['hand' => 0]);
                     }
 
                     // Non-publisher cannot be a language interpreter
                     if (!($value & Room::ROLE_PUBLISHER)) {
                         $connection->metadata = array_diff_key($connection->metadata, ['language' => 0]);
                     }
 
                     $connection->{$key} = $value;
                     break;
             }
         }
 
         // The connection observer will send a signal to everyone when needed
         $connection->save();
 
         return response()->json(['status' => 'success']);
     }
 
     /**
      * Webhook as triggered from OpenVidu server
      *
      * @param \Illuminate\Http\Request $request The API request.
      *
      * @return \Illuminate\Http\Response The response
      */
     public function webhook(Request $request)
     {
         \Log::debug($request->getContent());
 
         switch ((string) $request->input('event')) {
             case 'sessionDestroyed':
                 // When all participants left the room OpenVidu dispatches sessionDestroyed
                 // event. We'll remove the session reference from the database.
                 $sessionId = $request->input('sessionId');
                 $room = Room::where('session_id', $sessionId)->first();
 
                 if ($room) {
                     $room->session_id = null;
                     $room->save();
                 }
 
                 // Remove all connections
                 // Note: We could remove connections one-by-one via the 'participantLeft' event
                 // but that could create many INSERTs when the session (with many participants) ends
                 // So, it is better to remove them all in a single INSERT.
                 Connection::where('session_id', $sessionId)->delete();
 
                 break;
         }
 
         return response('Success', 200);
     }
 
     /**
      * Check if current user is a moderator for the specified room.
      *
      * @param \App\OpenVidu\Room $room The room
      *
      * @return bool True if the current user is the room moderator
      */
     protected function isModerator(Room $room): bool
     {
         $user = Auth::guard()->user();
 
         // The room owner is a moderator
         if ($user && $user->id == $room->user_id) {
             return true;
         }
 
         // Moderator's authentication via the extra request header
         if (
             ($connection = $this->getConnectionFromRequest())
             && $connection->session_id === $room->session_id
             && $connection->role & Room::ROLE_MODERATOR
         ) {
             return true;
         }
 
         return false;
     }
 
     /**
      * Check if current user "owns" the specified connection.
      *
      * @param \App\OpenVidu\Connection $connection The connection
      *
      * @return bool
      */
     protected function isSelfConnection(Connection $connection): bool
     {
         return ($conn = $this->getConnectionFromRequest())
             && $conn->id === $connection->id;
     }
 
     /**
      * Get the connection object for the token in current request headers.
      * It will also validate the token.
      *
      * @return \App\OpenVidu\Connection|null Connection (if exists and the token is valid)
      */
     protected function getConnectionFromRequest()
     {
         // Authenticate the user via the extra request header
         if ($token = request()->header(self::AUTH_HEADER)) {
             list($connId, ) = explode(':', base64_decode($token), 2);
 
             if (
                 ($connection = Connection::find($connId))
                 && $connection->metadata['authToken'] === $token
             ) {
                 return $connection;
             }
         }
 
         return null;
     }
 }
diff --git a/src/app/Http/Controllers/API/V4/UsersController.php b/src/app/Http/Controllers/API/V4/UsersController.php
index 8cc251b4..f60698a3 100644
--- a/src/app/Http/Controllers/API/V4/UsersController.php
+++ b/src/app/Http/Controllers/API/V4/UsersController.php
@@ -1,822 +1,813 @@
 <?php
 
 namespace App\Http\Controllers\API\V4;
 
 use App\Http\Controllers\Controller;
 use App\Domain;
 use App\Group;
 use App\Rules\UserEmailDomain;
 use App\Rules\UserEmailLocal;
 use App\Sku;
 use App\User;
 use Carbon\Carbon;
 use Illuminate\Http\Request;
-use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Support\Str;
 
 class UsersController extends Controller
 {
     /** @const array List of user setting keys available for modification in UI */
     public const USER_SETTINGS = [
         'billing_address',
         'country',
         'currency',
         'external_email',
         'first_name',
         'last_name',
         'organization',
         'phone',
     ];
 
     /**
      * On user create it is filled with a user or group object to force-delete
      * before the creation of a new user record is possible.
      *
      * @var \App\User|\App\Group|null
      */
     protected $deleteBeforeCreate;
 
 
     /**
      * Delete a user.
      *
      * @param int $id User identifier
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function destroy($id)
     {
         $user = User::find($id);
 
         if (empty($user)) {
             return $this->errorResponse(404);
         }
 
         // User can't remove himself until he's the controller
         if (!$this->guard()->user()->canDelete($user)) {
             return $this->errorResponse(403);
         }
 
         $user->delete();
 
         return response()->json([
                 'status' => 'success',
                 'message' => __('app.user-delete-success'),
         ]);
     }
 
     /**
      * Listing of users.
      *
      * The user-entitlements billed to the current user wallet(s)
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function index()
     {
         $user = $this->guard()->user();
 
         $result = $user->users()->orderBy('email')->get()->map(function ($user) {
             $data = $user->toArray();
             $data = array_merge($data, self::userStatuses($user));
             return $data;
         });
 
         return response()->json($result);
     }
 
     /**
      * Display information on the user account specified by $id.
      *
      * @param int $id The account to show information for.
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function show($id)
     {
         $user = User::find($id);
 
         if (empty($user)) {
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canRead($user)) {
             return $this->errorResponse(403);
         }
 
         $response = $this->userResponse($user);
 
         // Simplified Entitlement/SKU information,
         // TODO: I agree this format may need to be extended in future
         $response['skus'] = [];
         foreach ($user->entitlements as $ent) {
             $sku = $ent->sku;
             if (!isset($response['skus'][$sku->id])) {
                 $response['skus'][$sku->id] = ['costs' => [], 'count' => 0];
             }
             $response['skus'][$sku->id]['count']++;
             $response['skus'][$sku->id]['costs'][] = $ent->cost;
         }
 
         return response()->json($response);
     }
 
     /**
      * Fetch user status (and reload setup process)
      *
      * @param int $id User identifier
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function status($id)
     {
         $user = User::find($id);
 
         if (empty($user)) {
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canRead($user)) {
             return $this->errorResponse(403);
         }
 
         $response = self::statusInfo($user);
 
         if (!empty(request()->input('refresh'))) {
             $updated = false;
             $async = false;
             $last_step = 'none';
 
             foreach ($response['process'] as $idx => $step) {
                 $last_step = $step['label'];
 
                 if (!$step['state']) {
                     $exec = $this->execProcessStep($user, $step['label']);
 
                     if (!$exec) {
                         if ($exec === null) {
                             $async = true;
                         }
 
                         break;
                     }
 
                     $updated = true;
                 }
             }
 
             if ($updated) {
                 $response = self::statusInfo($user);
             }
 
             $success = $response['isReady'];
             $suffix = $success ? 'success' : 'error-' . $last_step;
 
             $response['status'] = $success ? 'success' : 'error';
             $response['message'] = \trans('app.process-' . $suffix);
 
             if ($async && !$success) {
                 $response['processState'] = 'waiting';
                 $response['status'] = 'success';
                 $response['message'] = \trans('app.process-async');
             }
         }
 
         $response = array_merge($response, self::userStatuses($user));
 
         return response()->json($response);
     }
 
     /**
      * User status (extended) information
      *
      * @param \App\User $user User object
      *
      * @return array Status information
      */
     public static function statusInfo(User $user): array
     {
         $process = [];
         $steps = [
             'user-new' => true,
             'user-ldap-ready' => $user->isLdapReady(),
             'user-imap-ready' => $user->isImapReady(),
         ];
 
         // Create a process check list
         foreach ($steps as $step_name => $state) {
             $step = [
                 'label' => $step_name,
                 'title' => \trans("app.process-{$step_name}"),
                 'state' => $state,
             ];
 
             $process[] = $step;
         }
 
         list ($local, $domain) = explode('@', $user->email);
         $domain = Domain::where('namespace', $domain)->first();
 
         // If that is not a public domain, add domain specific steps
         if ($domain && !$domain->isPublic()) {
             $domain_status = DomainsController::statusInfo($domain);
             $process = array_merge($process, $domain_status['process']);
         }
 
         $all = count($process);
         $checked = count(array_filter($process, function ($v) {
                 return $v['state'];
         }));
 
         $state = $all === $checked ? 'done' : 'running';
 
         // After 180 seconds assume the process is in failed state,
         // this should unlock the Refresh button in the UI
         if ($all !== $checked && $user->created_at->diffInSeconds(Carbon::now()) > 180) {
             $state = 'failed';
         }
 
         // Check if the user is a controller of his wallet
         $isController = $user->canDelete($user);
         $hasCustomDomain = $user->wallet()->entitlements()
             ->where('entitleable_type', Domain::class)
             ->count() > 0;
 
         // Get user's entitlements titles
         $skus = $user->entitlements()->select('skus.title')
             ->join('skus', 'skus.id', '=', 'entitlements.sku_id')
             ->get()
             ->pluck('title')
             ->sort()
             ->unique()
             ->values()
             ->all();
 
         return [
             'skus' => $skus,
             // TODO: This will change when we enable all users to create domains
             'enableDomains' => $isController && $hasCustomDomain,
+            // TODO: Make 'enableDistlists' working for wallet controllers that aren't account owners
+            'enableDistlists' => $isController && $hasCustomDomain && in_array('distlist', $skus),
             'enableUsers' => $isController,
             'enableWallets' => $isController,
             'process' => $process,
             'processState' => $state,
             'isReady' => $all === $checked,
         ];
     }
 
     /**
      * Create a new user record.
      *
      * @param \Illuminate\Http\Request $request The API request.
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function store(Request $request)
     {
         $current_user = $this->guard()->user();
         $owner = $current_user->wallet()->owner;
 
         if ($owner->id != $current_user->id) {
             return $this->errorResponse(403);
         }
 
         $this->deleteBeforeCreate = null;
 
         if ($error_response = $this->validateUserRequest($request, null, $settings)) {
             return $error_response;
         }
 
         if (empty($request->package) || !($package = \App\Package::find($request->package))) {
             $errors = ['package' => \trans('validation.packagerequired')];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         if ($package->isDomain()) {
             $errors = ['package' => \trans('validation.packageinvalid')];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         DB::beginTransaction();
 
         // @phpstan-ignore-next-line
         if ($this->deleteBeforeCreate) {
             $this->deleteBeforeCreate->forceDelete();
         }
 
         // Create user record
         $user = User::create([
                 'email' => $request->email,
                 'password' => $request->password,
         ]);
 
         $owner->assignPackage($package, $user);
 
         if (!empty($settings)) {
             $user->setSettings($settings);
         }
 
         if (!empty($request->aliases)) {
             $user->setAliases($request->aliases);
         }
 
         DB::commit();
 
         return response()->json([
                 'status' => 'success',
                 'message' => __('app.user-create-success'),
         ]);
     }
 
     /**
      * Update user data.
      *
      * @param \Illuminate\Http\Request $request The API request.
      * @param string                   $id      User identifier
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function update(Request $request, $id)
     {
         $user = User::find($id);
 
         if (empty($user)) {
             return $this->errorResponse(404);
         }
 
         $current_user = $this->guard()->user();
 
         // TODO: Decide what attributes a user can change on his own profile
         if (!$current_user->canUpdate($user)) {
             return $this->errorResponse(403);
         }
 
         if ($error_response = $this->validateUserRequest($request, $user, $settings)) {
             return $error_response;
         }
 
         // Entitlements, only controller can do that
         if ($request->skus !== null && !$current_user->canDelete($user)) {
             return $this->errorResponse(422, "You have no permission to change entitlements");
         }
 
         DB::beginTransaction();
 
         $this->updateEntitlements($user, $request->skus);
 
         if (!empty($settings)) {
             $user->setSettings($settings);
         }
 
         if (!empty($request->password)) {
             $user->password = $request->password;
             $user->save();
         }
 
         if (isset($request->aliases)) {
             $user->setAliases($request->aliases);
         }
 
         // TODO: Make sure that UserUpdate job is created in case of entitlements update
         //       and no password change. So, for example quota change is applied to LDAP
         // TODO: Review use of $user->save() in the above context
 
         DB::commit();
 
         $response = [
             'status' => 'success',
             'message' => __('app.user-update-success'),
         ];
 
         // For self-update refresh the statusInfo in the UI
         if ($user->id == $current_user->id) {
             $response['statusInfo'] = self::statusInfo($user);
         }
 
         return response()->json($response);
     }
 
-    /**
-     * Get the guard to be used during authentication.
-     *
-     * @return \Illuminate\Contracts\Auth\Guard
-     */
-    public function guard()
-    {
-        return Auth::guard();
-    }
-
     /**
      * Update user entitlements.
      *
      * @param \App\User $user  The user
      * @param array     $rSkus List of SKU IDs requested for the user in the form [id=>qty]
      */
     protected function updateEntitlements(User $user, $rSkus)
     {
         if (!is_array($rSkus)) {
             return;
         }
 
         // list of skus, [id=>obj]
         $skus = Sku::all()->mapWithKeys(
             function ($sku) {
                 return [$sku->id => $sku];
             }
         );
 
         // existing entitlement's SKUs
         $eSkus = [];
 
         $user->entitlements()->groupBy('sku_id')
             ->selectRaw('count(*) as total, sku_id')->each(
                 function ($e) use (&$eSkus) {
                     $eSkus[$e->sku_id] = $e->total;
                 }
             );
 
         foreach ($skus as $skuID => $sku) {
             $e = array_key_exists($skuID, $eSkus) ? $eSkus[$skuID] : 0;
             $r = array_key_exists($skuID, $rSkus) ? $rSkus[$skuID] : 0;
 
             if ($sku->handler_class == \App\Handlers\Mailbox::class) {
                 if ($r != 1) {
                     throw new \Exception("Invalid quantity of mailboxes");
                 }
             }
 
             if ($e > $r) {
                 // remove those entitled more than existing
                 $user->removeSku($sku, ($e - $r));
             } elseif ($e < $r) {
                 // add those requested more than entitled
                 $user->assignSku($sku, ($r - $e));
             }
         }
     }
 
     /**
      * Create a response data array for specified user.
      *
      * @param \App\User $user User object
      *
      * @return array Response data
      */
     public static function userResponse(User $user): array
     {
         $response = $user->toArray();
 
         // Settings
         $response['settings'] = [];
         foreach ($user->settings()->whereIn('key', self::USER_SETTINGS)->get() as $item) {
             $response['settings'][$item->key] = $item->value;
         }
 
         // Aliases
         $response['aliases'] = [];
         foreach ($user->aliases as $item) {
             $response['aliases'][] = $item->alias;
         }
 
         // Status info
         $response['statusInfo'] = self::statusInfo($user);
 
         $response = array_merge($response, self::userStatuses($user));
 
         // Add more info to the wallet object output
         $map_func = function ($wallet) use ($user) {
             $result = $wallet->toArray();
 
             if ($wallet->discount) {
                 $result['discount'] = $wallet->discount->discount;
                 $result['discount_description'] = $wallet->discount->description;
             }
 
             if ($wallet->user_id != $user->id) {
                 $result['user_email'] = $wallet->owner->email;
             }
 
             $provider = \App\Providers\PaymentProvider::factory($wallet);
             $result['provider'] = $provider->name();
 
             return $result;
         };
 
         // Information about wallets and accounts for access checks
         $response['wallets'] = $user->wallets->map($map_func)->toArray();
         $response['accounts'] = $user->accounts->map($map_func)->toArray();
         $response['wallet'] = $map_func($user->wallet());
 
         return $response;
     }
 
     /**
      * Prepare user statuses for the UI
      *
      * @param \App\User $user User object
      *
      * @return array Statuses array
      */
     protected static function userStatuses(User $user): array
     {
         return [
             'isImapReady' => $user->isImapReady(),
             'isLdapReady' => $user->isLdapReady(),
             'isSuspended' => $user->isSuspended(),
             'isActive' => $user->isActive(),
             'isDeleted' => $user->isDeleted() || $user->trashed(),
         ];
     }
 
     /**
      * Validate user input
      *
      * @param \Illuminate\Http\Request $request  The API request.
      * @param \App\User|null           $user     User identifier
      * @param array                    $settings User settings (from the request)
      *
      * @return \Illuminate\Http\JsonResponse|null The error response on error
      */
     protected function validateUserRequest(Request $request, $user, &$settings = [])
     {
         $rules = [
             'external_email' => 'nullable|email',
             'phone' => 'string|nullable|max:64|regex:/^[0-9+() -]+$/',
             'first_name' => 'string|nullable|max:128',
             'last_name' => 'string|nullable|max:128',
             'organization' => 'string|nullable|max:512',
             'billing_address' => 'string|nullable|max:1024',
             'country' => 'string|nullable|alpha|size:2',
             'currency' => 'string|nullable|alpha|size:3',
             'aliases' => 'array|nullable',
         ];
 
         if (empty($user) || !empty($request->password) || !empty($request->password_confirmation)) {
             $rules['password'] = 'required|min:4|max:2048|confirmed';
         }
 
         $errors = [];
 
         // Validate input
         $v = Validator::make($request->all(), $rules);
 
         if ($v->fails()) {
             $errors = $v->errors()->toArray();
         }
 
         $controller = $user ? $user->wallet()->owner : $this->guard()->user();
 
         // For new user validate email address
         if (empty($user)) {
             $email = $request->email;
 
             if (empty($email)) {
                 $errors['email'] = \trans('validation.required', ['attribute' => 'email']);
             } elseif ($error = self::validateEmail($email, $controller, $this->deleteBeforeCreate)) {
                 $errors['email'] = $error;
             }
         }
 
         // Validate aliases input
         if (isset($request->aliases)) {
             $aliases = [];
             $existing_aliases = $user ? $user->aliases()->get()->pluck('alias')->toArray() : [];
 
             foreach ($request->aliases as $idx => $alias) {
                 if (is_string($alias) && !empty($alias)) {
                     // Alias cannot be the same as the email address (new user)
                     if (!empty($email) && Str::lower($alias) == Str::lower($email)) {
                         continue;
                     }
 
                     // validate new aliases
                     if (
                         !in_array($alias, $existing_aliases)
                         && ($error = self::validateAlias($alias, $controller))
                     ) {
                         if (!isset($errors['aliases'])) {
                             $errors['aliases'] = [];
                         }
                         $errors['aliases'][$idx] = $error;
                         continue;
                     }
 
                     $aliases[] = $alias;
                 }
             }
 
             $request->aliases = $aliases;
         }
 
         if (!empty($errors)) {
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         // Update user settings
         $settings = $request->only(array_keys($rules));
         unset($settings['password'], $settings['aliases'], $settings['email']);
 
         return null;
     }
 
     /**
      * Execute (synchronously) specified step in a user setup process.
      *
      * @param \App\User $user User object
      * @param string    $step Step identifier (as in self::statusInfo())
      *
      * @return bool|null True if the execution succeeded, False if not, Null when
      *                   the job has been sent to the worker (result unknown)
      */
     public static function execProcessStep(User $user, string $step): ?bool
     {
         try {
             if (strpos($step, 'domain-') === 0) {
                 list ($local, $domain) = explode('@', $user->email);
                 $domain = Domain::where('namespace', $domain)->first();
 
                 return DomainsController::execProcessStep($domain, $step);
             }
 
             switch ($step) {
                 case 'user-ldap-ready':
                     // User not in LDAP, create it
                     $job = new \App\Jobs\User\CreateJob($user->id);
                     $job->handle();
 
                     $user->refresh();
 
                     return $user->isLdapReady();
 
                 case 'user-imap-ready':
                     // User not in IMAP? Verify again
                     // Do it synchronously if the imap admin credentials are available
                     // otherwise let the worker do the job
                     if (!\config('imap.admin_password')) {
                         \App\Jobs\User\VerifyJob::dispatch($user->id);
 
                         return null;
                     }
 
                     $job = new \App\Jobs\User\VerifyJob($user->id);
                     $job->handle();
 
                     $user->refresh();
 
                     return $user->isImapReady();
             }
         } catch (\Exception $e) {
             \Log::error($e);
         }
 
         return false;
     }
 
     /**
      * Email address validation for use as a user mailbox (login).
      *
      * @param string                    $email   Email address
      * @param \App\User                 $user    The account owner
      * @param null|\App\User|\App\Group $deleted Filled with an instance of a deleted user or group
      *                                           with the specified email address, if exists
      *
      * @return ?string Error message on validation error
      */
     public static function validateEmail(string $email, \App\User $user, &$deleted = null): ?string
     {
         $deleted = null;
 
         if (strpos($email, '@') === false) {
             return \trans('validation.entryinvalid', ['attribute' => 'email']);
         }
 
         list($login, $domain) = explode('@', Str::lower($email));
 
         if (strlen($login) === 0 || strlen($domain) === 0) {
             return \trans('validation.entryinvalid', ['attribute' => 'email']);
         }
 
         // Check if domain exists
         $domain = Domain::where('namespace', $domain)->first();
 
         if (empty($domain)) {
             return \trans('validation.domaininvalid');
         }
 
         // Validate login part alone
         $v = Validator::make(
             ['email' => $login],
             ['email' => ['required', new UserEmailLocal(!$domain->isPublic())]]
         );
 
         if ($v->fails()) {
             return $v->errors()->toArray()['email'][0];
         }
 
         // Check if it is one of domains available to the user
         $domains = \collect($user->domains())->pluck('namespace')->all();
 
         if (!in_array($domain->namespace, $domains)) {
             return \trans('validation.entryexists', ['attribute' => 'domain']);
         }
 
         // Check if a user with specified address already exists
         if ($existing_user = User::emailExists($email, true)) {
             // If this is a deleted user in the same custom domain
             // we'll force delete him before
             if (!$domain->isPublic() && $existing_user->trashed()) {
                 $deleted = $existing_user;
             } else {
                 return \trans('validation.entryexists', ['attribute' => 'email']);
             }
         }
 
         // Check if an alias with specified address already exists.
         if (User::aliasExists($email)) {
             return \trans('validation.entryexists', ['attribute' => 'email']);
         }
 
         // Check if a group with specified address already exists
         if ($existing_group = Group::emailExists($email, true)) {
             // If this is a deleted group in the same custom domain
             // we'll force delete it before
             if (!$domain->isPublic() && $existing_group->trashed()) {
                 $deleted = $existing_group;
             } else {
                 return \trans('validation.entryexists', ['attribute' => 'email']);
             }
         }
 
         return null;
     }
 
     /**
      * Email address validation for use as an alias.
      *
      * @param string    $email Email address
      * @param \App\User $user  The account owner
      *
      * @return ?string Error message on validation error
      */
     public static function validateAlias(string $email, \App\User $user): ?string
     {
         if (strpos($email, '@') === false) {
             return \trans('validation.entryinvalid', ['attribute' => 'alias']);
         }
 
         list($login, $domain) = explode('@', Str::lower($email));
 
         if (strlen($login) === 0 || strlen($domain) === 0) {
             return \trans('validation.entryinvalid', ['attribute' => 'alias']);
         }
 
         // Check if domain exists
         $domain = Domain::where('namespace', $domain)->first();
 
         if (empty($domain)) {
             return \trans('validation.domaininvalid');
         }
 
         // Validate login part alone
         $v = Validator::make(
             ['alias' => $login],
             ['alias' => ['required', new UserEmailLocal(!$domain->isPublic())]]
         );
 
         if ($v->fails()) {
             return $v->errors()->toArray()['alias'][0];
         }
 
         // Check if it is one of domains available to the user
         $domains = \collect($user->domains())->pluck('namespace')->all();
 
         if (!in_array($domain->namespace, $domains)) {
             return \trans('validation.entryexists', ['attribute' => 'domain']);
         }
 
         // Check if a user with specified address already exists
         if ($existing_user = User::emailExists($email, true)) {
             // Allow an alias in a custom domain to an address that was a user before
             if ($domain->isPublic() || !$existing_user->trashed()) {
                 return \trans('validation.entryexists', ['attribute' => 'alias']);
             }
         }
 
         // Check if an alias with specified address already exists
         if (User::aliasExists($email)) {
             // Allow assigning the same alias to a user in the same group account,
             // but only for non-public domains
             if ($domain->isPublic()) {
                 return \trans('validation.entryexists', ['attribute' => 'alias']);
             }
         }
 
         // Check if a group with specified address already exists
         if (Group::emailExists($email)) {
             return \trans('validation.entryexists', ['attribute' => 'alias']);
         }
 
         return null;
     }
 }
diff --git a/src/app/Http/Controllers/Controller.php b/src/app/Http/Controllers/Controller.php
index 846658d7..0c80b9b6 100644
--- a/src/app/Http/Controllers/Controller.php
+++ b/src/app/Http/Controllers/Controller.php
@@ -1,50 +1,61 @@
 <?php
 
 namespace App\Http\Controllers;
 
 use Illuminate\Foundation\Bus\DispatchesJobs;
 use Illuminate\Routing\Controller as BaseController;
 use Illuminate\Foundation\Validation\ValidatesRequests;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Facades\Auth;
 
 class Controller extends BaseController
 {
     use AuthorizesRequests;
     use DispatchesJobs;
     use ValidatesRequests;
 
 
     /**
      * Common error response builder for API (JSON) responses
      *
      * @param int    $code    Error code
      * @param string $message Error message
      * @param array  $data    Additional response data
      *
      * @return \Illuminate\Http\JsonResponse
      */
     protected function errorResponse(int $code, string $message = null, array $data = [])
     {
         $errors = [
             400 => "Bad request",
             401 => "Unauthorized",
             403 => "Access denied",
             404 => "Not found",
             405 => "Method not allowed",
             422 => "Input validation error",
             429 => "Too many requests",
             500 => "Internal server error",
         ];
 
         $response = [
             'status' => 'error',
             'message' => $message ?: (isset($errors[$code]) ? $errors[$code] : "Server error"),
         ];
 
         if (!empty($data)) {
             $response = $response + $data;
         }
 
         return response()->json($response, $code);
     }
+
+    /**
+     * Get the guard to be used during authentication.
+     *
+     * @return \Illuminate\Contracts\Auth\Guard
+     */
+    protected function guard()
+    {
+        return Auth::guard();
+    }
 }
diff --git a/src/app/User.php b/src/app/User.php
index 44f2ff0e..0b8c4685 100644
--- a/src/app/User.php
+++ b/src/app/User.php
@@ -1,721 +1,714 @@
 <?php
 
 namespace App;
 
 use App\Entitlement;
 use App\UserAlias;
 use App\Sku;
 use App\Traits\UserAliasesTrait;
 use App\Traits\SettingsTrait;
 use App\Wallet;
 use Illuminate\Database\Eloquent\SoftDeletes;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Iatstuti\Database\Support\NullableFields;
 use Tymon\JWTAuth\Contracts\JWTSubject;
 
 /**
  * The eloquent definition of a User.
  *
  * @property string $email
  * @property int    $id
  * @property string $password
  * @property int    $status
  */
 class User extends Authenticatable implements JWTSubject
 {
     use NullableFields;
     use UserAliasesTrait;
     use SettingsTrait;
     use SoftDeletes;
 
     // a new user, default on creation
     public const STATUS_NEW        = 1 << 0;
     // it's been activated
     public const STATUS_ACTIVE     = 1 << 1;
     // user has been suspended
     public const STATUS_SUSPENDED  = 1 << 2;
     // user has been deleted
     public const STATUS_DELETED    = 1 << 3;
     // user has been created in LDAP
     public const STATUS_LDAP_READY = 1 << 4;
     // user mailbox has been created in IMAP
     public const STATUS_IMAP_READY = 1 << 5;
 
 
     // change the default primary key type
     public $incrementing = false;
     protected $keyType = 'bigint';
 
     /**
      * The attributes that are mass assignable.
      *
      * @var array
      */
     protected $fillable = [
         'id',
         'email',
         'password',
         'password_ldap',
         'status'
     ];
 
     /**
      * The attributes that should be hidden for arrays.
      *
      * @var array
      */
     protected $hidden = [
         'password',
         'password_ldap',
         'role'
     ];
 
     protected $nullable = [
         'password',
         'password_ldap'
     ];
 
     /**
      * Any wallets on which this user is a controller.
      *
      * This does not include wallets owned by the user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
      */
     public function accounts()
     {
         return $this->belongsToMany(
             'App\Wallet',       // The foreign object definition
             'user_accounts',    // The table name
             'user_id',          // The local foreign key
             'wallet_id'         // The remote foreign key
         );
     }
 
     /**
      * Email aliases of this user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function aliases()
     {
         return $this->hasMany('App\UserAlias', 'user_id');
     }
 
     /**
      * Assign a package to a user. The user should not have any existing entitlements.
      *
      * @param \App\Package   $package The package to assign.
      * @param \App\User|null $user    Assign the package to another user.
      *
      * @return \App\User
      */
     public function assignPackage($package, $user = null)
     {
         if (!$user) {
             $user = $this;
         }
 
         $wallet_id = $this->wallets()->first()->id;
 
         foreach ($package->skus as $sku) {
             for ($i = $sku->pivot->qty; $i > 0; $i--) {
                 \App\Entitlement::create(
                     [
                         'wallet_id' => $wallet_id,
                         'sku_id' => $sku->id,
                         'cost' => $sku->pivot->cost(),
                         'entitleable_id' => $user->id,
                         'entitleable_type' => User::class
                     ]
                 );
             }
         }
 
         return $user;
     }
 
     /**
      * Assign a package plan to a user.
      *
      * @param \App\Plan   $plan   The plan to assign
      * @param \App\Domain $domain Optional domain object
      *
      * @return \App\User Self
      */
     public function assignPlan($plan, $domain = null): User
     {
         $this->setSetting('plan_id', $plan->id);
 
         foreach ($plan->packages as $package) {
             if ($package->isDomain()) {
                 $domain->assignPackage($package, $this);
             } else {
                 $this->assignPackage($package);
             }
         }
 
         return $this;
     }
 
     /**
      * Assign a Sku to a user.
      *
      * @param \App\Sku $sku   The sku to assign.
      * @param int      $count Count of entitlements to add
      *
      * @return \App\User Self
      * @throws \Exception
      */
     public function assignSku(Sku $sku, int $count = 1): User
     {
         // TODO: I guess wallet could be parametrized in future
         $wallet = $this->wallet();
         $exists = $this->entitlements()->where('sku_id', $sku->id)->count();
 
         while ($count > 0) {
             \App\Entitlement::create([
                 'wallet_id' => $wallet->id,
                 'sku_id' => $sku->id,
                 'cost' => $exists >= $sku->units_free ? $sku->cost : 0,
                 'entitleable_id' => $this->id,
                 'entitleable_type' => User::class
             ]);
 
             $exists++;
             $count--;
         }
 
         return $this;
     }
 
     /**
      * Check if current user can delete another object.
      *
      * @param \App\User|\App\Domain $object A user|domain object
      *
      * @return bool True if he can, False otherwise
      */
     public function canDelete($object): bool
     {
         if (!method_exists($object, 'wallet')) {
             return false;
         }
 
         $wallet = $object->wallet();
 
         // TODO: For now controller can delete/update the account owner,
         //       this may change in future, controllers are not 0-regression feature
 
         return $this->wallets->contains($wallet) || $this->accounts->contains($wallet);
     }
 
     /**
      * Check if current user can read data of another object.
      *
      * @param \App\User|\App\Domain|\App\Wallet $object A user|domain|wallet object
      *
      * @return bool True if he can, False otherwise
      */
     public function canRead($object): bool
     {
         if ($this->role == "admin") {
             return true;
         }
 
         if ($object instanceof User && $this->id == $object->id) {
             return true;
         }
 
         if ($object instanceof Wallet) {
             return $object->user_id == $this->id || $object->controllers->contains($this);
         }
 
         if (!method_exists($object, 'wallet')) {
             return false;
         }
 
         $wallet = $object->wallet();
 
         return $this->wallets->contains($wallet) || $this->accounts->contains($wallet);
     }
 
     /**
      * Check if current user can update data of another object.
      *
      * @param \App\User|\App\Domain $object A user|domain object
      *
      * @return bool True if he can, False otherwise
      */
     public function canUpdate($object): bool
     {
         if (!method_exists($object, 'wallet')) {
             return false;
         }
 
         if ($object instanceof User && $this->id == $object->id) {
             return true;
         }
 
         return $this->canDelete($object);
     }
 
     /**
      * Return the \App\Domain for this user.
      *
      * @return \App\Domain|null
      */
     public function domain()
     {
         list($local, $domainName) = explode('@', $this->email);
 
         $domain = \App\Domain::withTrashed()->where('namespace', $domainName)->first();
 
         return $domain;
     }
 
     /**
      * List the domains to which this user is entitled.
      *
      * @return Domain[]
      */
     public function domains()
     {
-        $dbdomains = Domain::whereRaw(
-            sprintf(
-                '(type & %s) AND (status & %s)',
-                Domain::TYPE_PUBLIC,
-                Domain::STATUS_ACTIVE
-            )
-        )->get();
-
-        $domains = [];
-
-        foreach ($dbdomains as $dbdomain) {
-            $domains[] = $dbdomain;
-        }
+        $domains = Domain::whereRaw(sprintf('(type & %s)', Domain::TYPE_PUBLIC))
+            ->whereRaw(sprintf('(status & %s)', Domain::STATUS_ACTIVE))
+            ->get()
+            ->all();
 
         foreach ($this->wallets as $wallet) {
             $entitlements = $wallet->entitlements()->where('entitleable_type', Domain::class)->get();
             foreach ($entitlements as $entitlement) {
-                $domain = $entitlement->entitleable;
-                \Log::info("Found domain for {$this->email}: {$domain->namespace} (owned)");
-                $domains[] = $domain;
+                $domains[] = $entitlement->entitleable;
             }
         }
 
         foreach ($this->accounts as $wallet) {
             $entitlements = $wallet->entitlements()->where('entitleable_type', Domain::class)->get();
             foreach ($entitlements as $entitlement) {
-                $domain = $entitlement->entitleable;
-                \Log::info("Found domain {$this->email}: {$domain->namespace} (charged)");
-                $domains[] = $domain;
+                $domains[] = $entitlement->entitleable;
             }
         }
 
         return $domains;
     }
 
     /**
      * The user entitlement.
      *
      * @return \Illuminate\Database\Eloquent\Relations\MorphOne
      */
     public function entitlement()
     {
         return $this->morphOne('App\Entitlement', 'entitleable');
     }
 
     /**
      * Entitlements for this user.
      *
      * Note that these are entitlements that apply to the user account, and not entitlements that
      * this user owns.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function entitlements()
     {
         return $this->hasMany('App\Entitlement', 'entitleable_id', 'id')
             ->where('entitleable_type', User::class);
     }
 
     /**
      * Find whether an email address exists as a user (including deleted users).
      *
      * @param string $email       Email address
      * @param bool   $return_user Return User instance instead of boolean
      *
      * @return \App\User|bool True or User model object if found, False otherwise
      */
     public static function emailExists(string $email, bool $return_user = false)
     {
         if (strpos($email, '@') === false) {
             return false;
         }
 
         $email = \strtolower($email);
 
         $user = self::withTrashed()->where('email', $email)->first();
 
         if ($user) {
             return $return_user ? $user : true;
         }
 
         return false;
     }
 
     /**
      * Helper to find user by email address, whether it is
      * main email address, alias or an external email.
      *
      * If there's more than one alias NULL will be returned.
      *
      * @param string $email    Email address
      * @param bool   $external Search also for an external email
      *
      * @return \App\User User model object if found
      */
     public static function findByEmail(string $email, bool $external = false): ?User
     {
         if (strpos($email, '@') === false) {
             return null;
         }
 
         $email = \strtolower($email);
 
         $user = self::where('email', $email)->first();
 
         if ($user) {
             return $user;
         }
 
         $aliases = UserAlias::where('alias', $email)->get();
 
         if (count($aliases) == 1) {
             return $aliases->first()->user;
         }
 
         // TODO: External email
 
         return null;
     }
 
     public function getJWTIdentifier()
     {
         return $this->getKey();
     }
 
     public function getJWTCustomClaims()
     {
         return [];
     }
 
     /**
      * Return groups controlled by the current user.
      *
+     * @param bool $with_accounts Include groups assigned to wallets
+     *                            the current user controls but not owns.
+     *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
-    public function groups()
+    public function groups($with_accounts = true)
     {
         $wallets = $this->wallets()->pluck('id')->all();
 
-        $groupIds = \App\Entitlement::whereIn('entitlements.wallet_id', $wallets)
-            ->where('entitlements.entitleable_type', Group::class)
-            ->pluck('entitleable_id')
-            ->all();
+        if ($with_accounts) {
+            $wallets = array_merge($wallets, $this->accounts()->pluck('wallet_id')->all());
+        }
 
-        return Group::whereIn('id', $groupIds);
+        return Group::select(['groups.*', 'entitlements.wallet_id'])
+            ->distinct()
+            ->join('entitlements', 'entitlements.entitleable_id', '=', 'groups.id')
+            ->whereIn('entitlements.wallet_id', $wallets)
+            ->where('entitlements.entitleable_type', Group::class);
     }
 
     /**
      * Check if user has an entitlement for the specified SKU.
      *
      * @param string $title The SKU title
      *
      * @return bool True if specified SKU entitlement exists
      */
     public function hasSku($title): bool
     {
         $sku = Sku::where('title', $title)->first();
 
         if (!$sku) {
             return false;
         }
 
         return $this->entitlements()->where('sku_id', $sku->id)->count() > 0;
     }
 
     /**
      * Returns whether this domain is active.
      *
      * @return bool
      */
     public function isActive(): bool
     {
         return ($this->status & self::STATUS_ACTIVE) > 0;
     }
 
     /**
      * Returns whether this domain is deleted.
      *
      * @return bool
      */
     public function isDeleted(): bool
     {
         return ($this->status & self::STATUS_DELETED) > 0;
     }
 
     /**
      * Returns whether this (external) domain has been verified
      * to exist in DNS.
      *
      * @return bool
      */
     public function isImapReady(): bool
     {
         return ($this->status & self::STATUS_IMAP_READY) > 0;
     }
 
     /**
      * Returns whether this user is registered in LDAP.
      *
      * @return bool
      */
     public function isLdapReady(): bool
     {
         return ($this->status & self::STATUS_LDAP_READY) > 0;
     }
 
     /**
      * Returns whether this user is new.
      *
      * @return bool
      */
     public function isNew(): bool
     {
         return ($this->status & self::STATUS_NEW) > 0;
     }
 
     /**
      * Returns whether this domain is suspended.
      *
      * @return bool
      */
     public function isSuspended(): bool
     {
         return ($this->status & self::STATUS_SUSPENDED) > 0;
     }
 
     /**
      * A shortcut to get the user name.
      *
      * @param bool $fallback Return "<aa.name> User" if there's no name
      *
      * @return string Full user name
      */
     public function name(bool $fallback = false): string
     {
         $firstname = $this->getSetting('first_name');
         $lastname = $this->getSetting('last_name');
 
         $name = trim($firstname . ' ' . $lastname);
 
         if (empty($name) && $fallback) {
             return \config('app.name') . ' User';
         }
 
         return $name;
     }
 
     /**
      * Remove a number of entitlements for the SKU.
      *
      * @param \App\Sku $sku   The SKU
      * @param int      $count The number of entitlements to remove
      *
      * @return User Self
      */
     public function removeSku(Sku $sku, int $count = 1): User
     {
         $entitlements = $this->entitlements()
             ->where('sku_id', $sku->id)
             ->orderBy('cost', 'desc')
             ->orderBy('created_at')
             ->get();
 
         $entitlements_count = count($entitlements);
 
         foreach ($entitlements as $entitlement) {
             if ($entitlements_count <= $sku->units_free) {
                 continue;
             }
 
             if ($count > 0) {
                 $entitlement->delete();
                 $entitlements_count--;
                 $count--;
             }
         }
 
         return $this;
     }
 
     /**
      * Any (additional) properties of this user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function settings()
     {
         return $this->hasMany('App\UserSetting', 'user_id');
     }
 
     /**
      * Suspend this domain.
      *
      * @return void
      */
     public function suspend(): void
     {
         if ($this->isSuspended()) {
             return;
         }
 
         $this->status |= User::STATUS_SUSPENDED;
         $this->save();
     }
 
     /**
      * Unsuspend this domain.
      *
      * @return void
      */
     public function unsuspend(): void
     {
         if (!$this->isSuspended()) {
             return;
         }
 
         $this->status ^= User::STATUS_SUSPENDED;
         $this->save();
     }
 
     /**
      * Return users controlled by the current user.
      *
      * @param bool $with_accounts Include users assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function users($with_accounts = true)
     {
         $wallets = $this->wallets()->pluck('id')->all();
 
         if ($with_accounts) {
             $wallets = array_merge($wallets, $this->accounts()->pluck('wallet_id')->all());
         }
 
         return $this->select(['users.*', 'entitlements.wallet_id'])
             ->distinct()
             ->leftJoin('entitlements', 'entitlements.entitleable_id', '=', 'users.id')
             ->whereIn('entitlements.wallet_id', $wallets)
             ->where('entitlements.entitleable_type', User::class);
     }
 
     /**
      * Verification codes for this user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function verificationcodes()
     {
         return $this->hasMany('App\VerificationCode', 'user_id', 'id');
     }
 
     /**
      * Returns the wallet by which the user is controlled
      *
      * @return ?\App\Wallet A wallet object
      */
     public function wallet(): ?Wallet
     {
         $entitlement = $this->entitlement()->withTrashed()->first();
 
         // TODO: No entitlement should not happen, but in tests we have
         //       such cases, so we fallback to the user's wallet in this case
         return $entitlement ? $entitlement->wallet : $this->wallets()->first();
     }
 
     /**
      * Wallets this user owns.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function wallets()
     {
         return $this->hasMany('App\Wallet');
     }
 
     /**
      * User password mutator
      *
      * @param string $password The password in plain text.
      *
      * @return void
      */
     public function setPasswordAttribute($password)
     {
         if (!empty($password)) {
             $this->attributes['password'] = bcrypt($password, [ "rounds" => 12 ]);
             $this->attributes['password_ldap'] = '{SSHA512}' . base64_encode(
                 pack('H*', hash('sha512', $password))
             );
         }
     }
 
     /**
      * User LDAP password mutator
      *
      * @param string $password The password in plain text.
      *
      * @return void
      */
     public function setPasswordLdapAttribute($password)
     {
         $this->setPasswordAttribute($password);
     }
 
     /**
      * User status mutator
      *
      * @throws \Exception
      */
     public function setStatusAttribute($status)
     {
         $new_status = 0;
 
         $allowed_values = [
             self::STATUS_NEW,
             self::STATUS_ACTIVE,
             self::STATUS_SUSPENDED,
             self::STATUS_DELETED,
             self::STATUS_LDAP_READY,
             self::STATUS_IMAP_READY,
         ];
 
         foreach ($allowed_values as $value) {
             if ($status & $value) {
                 $new_status |= $value;
                 $status ^= $value;
             }
         }
 
         if ($status > 0) {
             throw new \Exception("Invalid user status: {$status}");
         }
 
         $this->attributes['status'] = $new_status;
     }
 }
diff --git a/src/database/migrations/2021_04_22_120000_add_distlist_beta_sku.php b/src/database/migrations/2021_04_22_120000_add_distlist_beta_sku.php
new file mode 100644
index 00000000..e7ae98d3
--- /dev/null
+++ b/src/database/migrations/2021_04_22_120000_add_distlist_beta_sku.php
@@ -0,0 +1,40 @@
+<?php
+
+use Illuminate\Support\Facades\Schema;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Database\Migrations\Migration;
+
+// phpcs:ignore
+class AddDistlistBetaSku extends Migration
+{
+    /**
+     * Run the migrations.
+     *
+     * @return void
+     */
+    public function up()
+    {
+        if (!\App\Sku::where('title', 'distlist')->first()) {
+            \App\Sku::create([
+                'title' => 'distlist',
+                'name' => 'Distribution lists',
+                'description' => 'Access to mail distribution lists',
+                'cost' => 0,
+                'units_free' => 0,
+                'period' => 'monthly',
+                'handler_class' => 'App\Handlers\Distlist',
+                'active' => true,
+            ]);
+        }
+    }
+
+    /**
+     * Reverse the migrations.
+     *
+     * @return void
+     */
+    public function down()
+    {
+        // there's no need to remove this SKU
+    }
+}
diff --git a/src/database/seeds/local/SkuSeeder.php b/src/database/seeds/local/SkuSeeder.php
index 0b68202c..ce890425 100644
--- a/src/database/seeds/local/SkuSeeder.php
+++ b/src/database/seeds/local/SkuSeeder.php
@@ -1,203 +1,217 @@
 <?php
 
 namespace Database\Seeds\Local;
 
 use App\Sku;
 use Illuminate\Database\Seeder;
 
 class SkuSeeder extends Seeder
 {
     /**
      * Run the database seeds.
      *
      * @return void
      */
     public function run()
     {
         Sku::create(
             [
                 'title' => 'mailbox',
                 'name' => 'User Mailbox',
                 'description' => 'Just a mailbox',
                 'cost' => 444,
                 'units_free' => 0,
                 'period' => 'monthly',
                 'handler_class' => 'App\Handlers\Mailbox',
                 'active' => true,
             ]
         );
 
         Sku::create(
             [
                 'title' => 'domain',
                 'name' => 'Hosted Domain',
                 'description' => 'Somewhere to place a mailbox',
                 'cost' => 100,
                 'period' => 'monthly',
                 'handler_class' => 'App\Handlers\Domain',
                 'active' => false,
             ]
         );
 
         Sku::create(
             [
                 'title' => 'domain-registration',
                 'name' => 'Domain Registration',
                 'description' => 'Register a domain with us',
                 'cost' => 101,
                 'period' => 'yearly',
                 'handler_class' => 'App\Handlers\DomainRegistration',
                 'active' => false,
             ]
         );
 
         Sku::create(
             [
                 'title' => 'domain-hosting',
                 'name' => 'External Domain',
                 'description' => 'Host a domain that is externally registered',
                 'cost' => 100,
                 'units_free' => 1,
                 'period' => 'monthly',
                 'handler_class' => 'App\Handlers\DomainHosting',
                 'active' => true,
             ]
         );
 
         Sku::create(
             [
                 'title' => 'domain-relay',
                 'name' => 'Domain Relay',
                 'description' => 'A domain you host at home, for which we relay email',
                 'cost' => 103,
                 'period' => 'monthly',
                 'handler_class' => 'App\Handlers\DomainRelay',
                 'active' => false,
             ]
         );
 
         Sku::create(
             [
                 'title' => 'storage',
                 'name' => 'Storage Quota',
                 'description' => 'Some wiggle room',
                 'cost' => 25,
                 'units_free' => 2,
                 'period' => 'monthly',
                 'handler_class' => 'App\Handlers\Storage',
                 'active' => true,
             ]
         );
 
         Sku::create(
             [
                 'title' => 'groupware',
                 'name' => 'Groupware Features',
                 'description' => 'Groupware functions like Calendar, Tasks, Notes, etc.',
                 'cost' => 555,
                 'units_free' => 0,
                 'period' => 'monthly',
                 'handler_class' => 'App\Handlers\Groupware',
                 'active' => true,
             ]
         );
 
         Sku::create(
             [
                 'title' => 'resource',
                 'name' => 'Resource',
                 'description' => 'Reservation taker',
                 'cost' => 101,
                 'period' => 'monthly',
                 'handler_class' => 'App\Handlers\Resource',
                 'active' => false,
             ]
         );
 
         Sku::create(
             [
                 'title' => 'shared_folder',
                 'name' => 'Shared Folder',
                 'description' => 'A shared folder',
                 'cost' => 89,
                 'period' => 'monthly',
                 'handler_class' => 'App\Handlers\SharedFolder',
                 'active' => false,
             ]
         );
 
         Sku::create(
             [
                 'title' => '2fa',
                 'name' => '2-Factor Authentication',
                 'description' => 'Two factor authentication for webmail and administration panel',
                 'cost' => 0,
                 'units_free' => 0,
                 'period' => 'monthly',
                 'handler_class' => 'App\Handlers\Auth2F',
                 'active' => true,
             ]
         );
 
         Sku::create(
             [
                 'title' => 'activesync',
                 'name' => 'Activesync',
                 'description' => 'Mobile synchronization',
                 'cost' => 100,
                 'units_free' => 0,
                 'period' => 'monthly',
                 'handler_class' => 'App\Handlers\Activesync',
                 'active' => true,
             ]
         );
 
         // Check existence because migration might have added this already
         if (!\App\Sku::where('title', 'beta')->first()) {
             Sku::create(
                 [
                     'title' => 'beta',
                     'name' => 'Private Beta (invitation only)',
                     'description' => 'Access to the private beta program subscriptions',
                     'cost' => 0,
                     'units_free' => 0,
                     'period' => 'monthly',
                     'handler_class' => 'App\Handlers\Beta',
                     'active' => false,
                 ]
             );
         }
 
         // Check existence because migration might have added this already
         if (!\App\Sku::where('title', 'meet')->first()) {
             Sku::create(
                 [
                     'title' => 'meet',
                     'name' => 'Voice & Video Conferencing (public beta)',
                     'description' => 'Video conferencing tool',
                     'cost' => 0,
                     'units_free' => 0,
                     'period' => 'monthly',
                     'handler_class' => 'App\Handlers\Meet',
                     'active' => true,
                 ]
             );
         }
 
         // Check existence because migration might have added this already
         if (!\App\Sku::where('title', 'group')->first()) {
             Sku::create(
                 [
                     'title' => 'group',
                     'name' => 'Group',
                     'description' => 'Distribution list',
                     'cost' => 0,
                     'units_free' => 0,
                     'period' => 'monthly',
                     'handler_class' => 'App\Handlers\Group',
                     'active' => true,
                 ]
             );
         }
+
+        // Check existence because migration might have added this already
+        if (!\App\Sku::where('title', 'distlist')->first()) {
+            \App\Sku::create([
+                'title' => 'distlist',
+                'name' => 'Distribution lists',
+                'description' => 'Access to mail distribution lists',
+                'cost' => 0,
+                'units_free' => 0,
+                'period' => 'monthly',
+                'handler_class' => 'App\Handlers\Distlist',
+                'active' => true,
+            ]);
+        }
     }
 }
diff --git a/src/database/seeds/production/SkuSeeder.php b/src/database/seeds/production/SkuSeeder.php
index fe466fe0..0d524b9c 100644
--- a/src/database/seeds/production/SkuSeeder.php
+++ b/src/database/seeds/production/SkuSeeder.php
@@ -1,203 +1,217 @@
 <?php
 
 namespace Database\Seeds\Production;
 
 use App\Sku;
 use Illuminate\Database\Seeder;
 
 class SkuSeeder extends Seeder
 {
     /**
      * Run the database seeds.
      *
      * @return void
      */
     public function run()
     {
         Sku::create(
             [
                 'title' => 'mailbox',
                 'name' => 'User Mailbox',
                 'description' => 'Just a mailbox',
                 'cost' => 444,
                 'units_free' => 0,
                 'period' => 'monthly',
                 'handler_class' => 'App\Handlers\Mailbox',
                 'active' => true,
             ]
         );
 
         Sku::create(
             [
                 'title' => 'domain',
                 'name' => 'Hosted Domain',
                 'description' => 'Somewhere to place a mailbox',
                 'cost' => 100,
                 'period' => 'monthly',
                 'handler_class' => 'App\Handlers\Domain',
                 'active' => false,
             ]
         );
 
         Sku::create(
             [
                 'title' => 'domain-registration',
                 'name' => 'Domain Registration',
                 'description' => 'Register a domain with us',
                 'cost' => 101,
                 'period' => 'yearly',
                 'handler_class' => 'App\Handlers\DomainRegistration',
                 'active' => false,
             ]
         );
 
         Sku::create(
             [
                 'title' => 'domain-hosting',
                 'name' => 'External Domain',
                 'description' => 'Host a domain that is externally registered',
                 'cost' => 100,
                 'units_free' => 1,
                 'period' => 'monthly',
                 'handler_class' => 'App\Handlers\DomainHosting',
                 'active' => true,
             ]
         );
 
         Sku::create(
             [
                 'title' => 'domain-relay',
                 'name' => 'Domain Relay',
                 'description' => 'A domain you host at home, for which we relay email',
                 'cost' => 103,
                 'period' => 'monthly',
                 'handler_class' => 'App\Handlers\DomainRelay',
                 'active' => false,
             ]
         );
 
         Sku::create(
             [
                 'title' => 'storage',
                 'name' => 'Storage Quota',
                 'description' => 'Some wiggle room',
                 'cost' => 50,
                 'units_free' => 2,
                 'period' => 'monthly',
                 'handler_class' => 'App\Handlers\Storage',
                 'active' => true,
             ]
         );
 
         Sku::create(
             [
                 'title' => 'groupware',
                 'name' => 'Groupware Features',
                 'description' => 'Groupware functions like Calendar, Tasks, Notes, etc.',
                 'cost' => 555,
                 'units_free' => 0,
                 'period' => 'monthly',
                 'handler_class' => 'App\Handlers\Groupware',
                 'active' => true,
             ]
         );
 
         Sku::create(
             [
                 'title' => 'resource',
                 'name' => 'Resource',
                 'description' => 'Reservation taker',
                 'cost' => 101,
                 'period' => 'monthly',
                 'handler_class' => 'App\Handlers\Resource',
                 'active' => false,
             ]
         );
 
         Sku::create(
             [
                 'title' => 'shared_folder',
                 'name' => 'Shared Folder',
                 'description' => 'A shared folder',
                 'cost' => 89,
                 'period' => 'monthly',
                 'handler_class' => 'App\Handlers\SharedFolder',
                 'active' => false,
             ]
         );
 
         Sku::create(
             [
                 'title' => '2fa',
                 'name' => '2-Factor Authentication',
                 'description' => 'Two factor authentication for webmail and administration panel',
                 'cost' => 0,
                 'units_free' => 0,
                 'period' => 'monthly',
                 'handler_class' => 'App\Handlers\Auth2F',
                 'active' => true,
             ]
         );
 
         Sku::create(
             [
                 'title' => 'activesync',
                 'name' => 'Activesync',
                 'description' => 'Mobile synchronization',
                 'cost' => 100,
                 'units_free' => 0,
                 'period' => 'monthly',
                 'handler_class' => 'App\Handlers\Activesync',
                 'active' => true,
             ]
         );
 
         // Check existence because migration might have added this already
         if (!\App\Sku::where('title', 'beta')->first()) {
             Sku::create(
                 [
                     'title' => 'beta',
                     'name' => 'Private Beta (invitation only)',
                     'description' => 'Access to the private beta program subscriptions',
                     'cost' => 0,
                     'units_free' => 0,
                     'period' => 'monthly',
                     'handler_class' => 'App\Handlers\Beta',
                     'active' => false,
                 ]
             );
         }
 
         // Check existence because migration might have added this already
         if (!\App\Sku::where('title', 'meet')->first()) {
             Sku::create(
                 [
                     'title' => 'meet',
                     'name' => 'Voice & Video Conferencing (public beta)',
                     'description' => 'Video conferencing tool',
                     'cost' => 0,
                     'units_free' => 0,
                     'period' => 'monthly',
                     'handler_class' => 'App\Handlers\Meet',
                     'active' => true,
                 ]
             );
         }
 
         // Check existence because migration might have added this already
         if (!\App\Sku::where('title', 'group')->first()) {
             Sku::create(
                 [
                     'title' => 'group',
                     'name' => 'Group',
                     'description' => 'Distribution list',
                     'cost' => 0,
                     'units_free' => 0,
                     'period' => 'monthly',
                     'handler_class' => 'App\Handlers\Group',
                     'active' => true,
                 ]
             );
         }
+
+        // Check existence because migration might have added this already
+        if (!\App\Sku::where('title', 'distlist')->first()) {
+            \App\Sku::create([
+                'title' => 'distlist',
+                'name' => 'Distribution lists',
+                'description' => 'Access to mail distribution lists',
+                'cost' => 0,
+                'units_free' => 0,
+                'period' => 'monthly',
+                'handler_class' => 'App\Handlers\Distlist',
+                'active' => true,
+            ]);
+        }
     }
 }
diff --git a/src/resources/js/app.js b/src/resources/js/app.js
index cce4fa10..9eab6584 100644
--- a/src/resources/js/app.js
+++ b/src/resources/js/app.js
@@ -1,473 +1,515 @@
 /**
  * First we will load all of this project's JavaScript dependencies which
  * includes Vue and other libraries. It is a great starting point when
  * building robust, powerful web applications using Vue and Laravel.
  */
 
 require('./bootstrap')
 
 import AppComponent from '../vue/App'
 import MenuComponent from '../vue/Widgets/Menu'
 import SupportForm from '../vue/Widgets/SupportForm'
 import store from './store'
 
 const loader = '<div class="app-loader"><div class="spinner-border" role="status"><span class="sr-only">Loading</span></div></div>'
 
 let isLoading = 0
 
 // Lock the UI with the 'loading...' element
 const startLoading = () => {
     isLoading++
     let loading = $('#app > .app-loader').removeClass('fadeOut')
     if (!loading.length) {
         $('#app').append($(loader))
     }
 }
 
 // Hide "loading" overlay
 const stopLoading = () => {
     if (isLoading > 0) {
         $('#app > .app-loader').addClass('fadeOut')
         isLoading--;
     }
 }
 
 let loadingRoute
 
 // Note: This has to be before the app is created
 // Note: You cannot use app inside of the function
 window.router.beforeEach((to, from, next) => {
     // check if the route requires authentication and user is not logged in
-    if (to.matched.some(route => route.meta.requiresAuth) && !store.state.isLoggedIn) {
+    if (to.meta.requiresAuth && !store.state.isLoggedIn) {
         // remember the original request, to use after login
         store.state.afterLogin = to;
 
         // redirect to login page
         next({ name: 'login' })
 
         return
     }
 
     if (to.meta.loading) {
         startLoading()
         loadingRoute = to.name
     }
 
     next()
 })
 
 window.router.afterEach((to, from) => {
     if (to.name && loadingRoute === to.name) {
         stopLoading()
         loadingRoute = null
     }
 
     // When changing a page remove old:
     // - error page
     // - modal backdrop
     $('#error-page,.modal-backdrop.show').remove()
 })
 
 const app = new Vue({
     el: '#app',
     components: {
         AppComponent,
         MenuComponent,
     },
     store,
     router: window.router,
     data() {
         return {
             isAdmin: window.isAdmin,
             appName: window.config['app.name'],
             appUrl: window.config['app.url'],
             themeDir: '/themes/' + window.config['app.theme']
         }
     },
     methods: {
         // Clear (bootstrap) form validation state
         clearFormValidation(form) {
             $(form).find('.is-invalid').removeClass('is-invalid')
             $(form).find('.invalid-feedback').remove()
         },
+        hasPermission(type) {
+            const authInfo = store.state.authInfo
+            const key = 'enable' + type.charAt(0).toUpperCase() + type.slice(1)
+            return !!(authInfo && authInfo.statusInfo[key])
+        },
         hasRoute(name) {
             return this.$router.resolve({ name: name }).resolved.matched.length > 0
         },
         hasSKU(name) {
             const authInfo = store.state.authInfo
             return authInfo.statusInfo.skus && authInfo.statusInfo.skus.indexOf(name) != -1
         },
         isController(wallet_id) {
             if (wallet_id && store.state.authInfo) {
                 let i
                 for (i = 0; i < store.state.authInfo.wallets.length; i++) {
                     if (wallet_id == store.state.authInfo.wallets[i].id) {
                         return true
                     }
                 }
                 for (i = 0; i < store.state.authInfo.accounts.length; i++) {
                     if (wallet_id == store.state.authInfo.accounts[i].id) {
                         return true
                     }
                 }
             }
 
             return false
         },
         // Set user state to "logged in"
         loginUser(response, dashboard, update) {
             if (!update) {
                 store.commit('logoutUser') // destroy old state data
                 store.commit('loginUser')
             }
 
             localStorage.setItem('token', response.access_token)
             axios.defaults.headers.common.Authorization = 'Bearer ' + response.access_token
 
             if (response.email) {
                 store.state.authInfo = response
             }
 
             if (dashboard !== false) {
                 this.$router.push(store.state.afterLogin || { name: 'dashboard' })
             }
 
             store.state.afterLogin = null
 
             // Refresh the token before it expires
             let timeout = response.expires_in || 0
 
             // We'll refresh 60 seconds before the token expires
             if (timeout > 60) {
                 timeout -= 60
             }
 
             // TODO: We probably should try a few times in case of an error
             // TODO: We probably should prevent axios from doing any requests
             //       while the token is being refreshed
 
             this.refreshTimeout = setTimeout(() => {
                 axios.post('/api/auth/refresh').then(response => {
                     this.loginUser(response.data, false, true)
                 })
             }, timeout * 1000)
         },
         // Set user state to "not logged in"
         logoutUser(redirect) {
             store.commit('logoutUser')
             localStorage.setItem('token', '')
             delete axios.defaults.headers.common.Authorization
 
             if (redirect !== false) {
                 this.$router.push({ name: 'login' })
             }
 
             clearTimeout(this.refreshTimeout)
         },
         logo(mode) {
             let src = this.appUrl + this.themeDir + '/images/logo_' + (mode || 'header') + '.png'
 
             return `<img src="${src}" alt="${this.appName}">`
         },
         // Display "loading" overlay inside of the specified element
         addLoader(elem, small = true) {
             $(elem).css({position: 'relative'}).append(small ? $(loader).addClass('small') : $(loader))
         },
         // Remove loader element added in addLoader()
         removeLoader(elem) {
             $(elem).find('.app-loader').remove()
         },
         startLoading,
         stopLoading,
         isLoading() {
             return isLoading > 0
         },
         errorPage(code, msg) {
             // Until https://github.com/vuejs/vue-router/issues/977 is implemented
             // we can't really use router to display error page as it has two side
             // effects: it changes the URL and adds the error page to browser history.
             // For now we'll be replacing current view with error page "manually".
             const map = {
                 400: "Bad request",
                 401: "Unauthorized",
                 403: "Access denied",
                 404: "Not found",
                 405: "Method not allowed",
                 500: "Internal server error"
             }
 
             if (!msg) msg = map[code] || "Unknown Error"
 
             const error_page = `<div id="error-page" class="error-page"><div class="code">${code}</div><div class="message">${msg}</div></div>`
 
             $('#error-page').remove()
             $('#app').append(error_page)
 
             app.updateBodyClass('error')
         },
         errorHandler(error) {
             this.stopLoading()
 
             if (!error.response) {
                 // TODO: probably network connection error
             } else if (error.response.status === 401) {
                 // Remember requested route to come back to it after log in
                 if (this.$route.meta.requiresAuth) {
                     store.state.afterLogin = this.$route
                     this.logoutUser()
                 } else {
                     this.logoutUser(false)
                 }
             } else {
                 this.errorPage(error.response.status, error.response.statusText)
             }
         },
         downloadFile(url) {
             // TODO: This might not be a best way for big files as the content
             //       will be stored (temporarily) in browser memory
             // TODO: This method does not show the download progress in the browser
             //       but it could be implemented in the UI, axios has 'progress' property
             axios.get(url, { responseType: 'blob' })
                 .then(response => {
                     const link = document.createElement('a')
                     const contentDisposition = response.headers['content-disposition']
                     let filename = 'unknown'
 
                     if (contentDisposition) {
                         const match = contentDisposition.match(/filename="(.+)"/);
                         if (match.length === 2) {
                             filename = match[1];
                         }
                     }
 
                     link.href = window.URL.createObjectURL(response.data)
                     link.download = filename
                     link.click()
                 })
         },
         price(price, currency) {
             return ((price || 0) / 100).toLocaleString('de-DE', { style: 'currency', currency: currency || 'CHF' })
         },
         priceLabel(cost, discount) {
             let index = ''
 
             if (discount) {
                 cost = Math.floor(cost * ((100 - discount) / 100))
                 index = '\u00B9'
             }
 
             return this.price(cost) + '/month' + index
         },
         clickRecord(event) {
             if (!/^(a|button|svg|path)$/i.test(event.target.nodeName)) {
                 let link = $(event.target).closest('tr').find('a')[0]
                 if (link) {
                     link.click()
                 }
             }
         },
         domainStatusClass(domain) {
             if (domain.isDeleted) {
                 return 'text-muted'
             }
 
             if (domain.isSuspended) {
                 return 'text-warning'
             }
 
             if (!domain.isVerified || !domain.isLdapReady || !domain.isConfirmed) {
                 return 'text-danger'
             }
 
             return 'text-success'
         },
         domainStatusText(domain) {
             if (domain.isDeleted) {
                 return 'Deleted'
             }
 
             if (domain.isSuspended) {
                 return 'Suspended'
             }
 
             if (!domain.isVerified || !domain.isLdapReady || !domain.isConfirmed) {
                 return 'Not Ready'
             }
 
             return 'Active'
         },
+        distlistStatusClass(list) {
+            if (list.isDeleted) {
+                return 'text-muted'
+            }
+
+            if (list.isSuspended) {
+                return 'text-warning'
+            }
+
+            if (!list.isLdapReady) {
+                return 'text-danger'
+            }
+
+            return 'text-success'
+        },
+        distlistStatusText(list) {
+            if (list.isDeleted) {
+                return 'Deleted'
+            }
+
+            if (list.isSuspended) {
+                return 'Suspended'
+            }
+
+            if (!list.isLdapReady) {
+                return 'Not Ready'
+            }
+
+            return 'Active'
+        },
         pageName(path) {
             let page = this.$route.path
 
             // check if it is a "menu page", find the page name
             // otherwise we'll use the real path as page name
             window.config.menu.every(item => {
                 if (item.location == page && item.page) {
                     page = item.page
                     return false
                 }
             })
 
             page = page.replace(/^\//, '')
 
             return page ? page : '404'
         },
         supportDialog(container) {
             let dialog = $('#support-dialog')
 
             // FIXME: Find a nicer way of doing this
             if (!dialog.length) {
                 let form = new Vue(SupportForm)
                 form.$mount($('<div>').appendTo(container)[0])
                 form.$root = this
                 form.$toast = this.$toast
                 dialog = $(form.$el)
             }
 
             dialog.on('shown.bs.modal', () => {
                     dialog.find('input').first().focus()
                 }).modal()
         },
         userStatusClass(user) {
             if (user.isDeleted) {
                 return 'text-muted'
             }
 
             if (user.isSuspended) {
                 return 'text-warning'
             }
 
             if (!user.isImapReady || !user.isLdapReady) {
                 return 'text-danger'
             }
 
             return 'text-success'
         },
         userStatusText(user) {
             if (user.isDeleted) {
                 return 'Deleted'
             }
 
             if (user.isSuspended) {
                 return 'Suspended'
             }
 
             if (!user.isImapReady || !user.isLdapReady) {
                 return 'Not Ready'
             }
 
             return 'Active'
         },
         updateBodyClass(name) {
             // Add 'class' attribute to the body, different for each page
             // so, we can apply page-specific styles
-            let className = 'page-' + (name || this.pageName()).replace(/\/.*$/, '')
-            $(document.body).removeClass().addClass(className)
+            document.body.className = 'page-' + (name || this.pageName()).replace(/\/.*$/, '')
         }
     }
 })
 
 // Add a axios request interceptor
 window.axios.interceptors.request.use(
     config => {
         // This is the only way I found to change configuration options
         // on a running application. We need this for browser testing.
         config.headers['X-Test-Payment-Provider'] = window.config.paymentProvider
 
         return config
     },
     error => {
         // Do something with request error
         return Promise.reject(error)
     }
 )
 
 // Add a axios response interceptor for general/validation error handler
 window.axios.interceptors.response.use(
     response => {
         if (response.config.onFinish) {
             response.config.onFinish()
         }
 
         return response
     },
     error => {
         let error_msg
         let status = error.response ? error.response.status : 200
 
         // Do not display the error in a toast message, pass the error as-is
         if (error.config.ignoreErrors) {
             return Promise.reject(error)
         }
 
         if (error.config.onFinish) {
             error.config.onFinish()
         }
 
         if (error.response && status == 422) {
             error_msg = "Form validation error"
 
             const modal = $('div.modal.show')
 
             $(modal.length ? modal : 'form').each((i, form) => {
                 form = $(form)
 
                 $.each(error.response.data.errors || {}, (idx, msg) => {
                     const input_name = (form.data('validation-prefix') || form.find('form').first().data('validation-prefix') || '') + idx
                     let input = form.find('#' + input_name)
 
                     if (!input.length) {
                         input = form.find('[name="' + input_name + '"]');
                     }
 
                     if (input.length) {
                         // Create an error message\
                         // API responses can use a string, array or object
                         let msg_text = ''
                         if ($.type(msg) !== 'string') {
                             $.each(msg, (index, str) => {
                                 msg_text += str + ' '
                             })
                         }
                         else {
                             msg_text = msg
                         }
 
                         let feedback = $('<div class="invalid-feedback">').text(msg_text)
 
                         if (input.is('.list-input')) {
                             // List input widget
-                            input.children(':not(:first-child)').each((index, element) => {
-                                if (msg[index]) {
-                                    $(element).find('input').addClass('is-invalid')
-                                }
-                            })
+                            let controls = input.children(':not(:first-child)')
+
+                            if (!controls.length && typeof msg == 'string') {
+                                // this is an empty list (the main input only)
+                                // and the error message is not an array
+                                input.find('.main-input').addClass('is-invalid')
+                            } else {
+                                controls.each((index, element) => {
+                                    if (msg[index]) {
+                                        $(element).find('input').addClass('is-invalid')
+                                    }
+                                })
+                            }
 
                             input.addClass('is-invalid').next('.invalid-feedback').remove()
                             input.after(feedback)
                         }
                         else {
                             // Standard form element
                             input.addClass('is-invalid')
                             input.parent().find('.invalid-feedback').remove()
                             input.parent().append(feedback)
                         }
                     }
                 })
 
                 form.find('.is-invalid:not(.listinput-widget)').first().focus()
             })
         }
         else if (error.response && error.response.data) {
             error_msg = error.response.data.message
         }
         else {
             error_msg = error.request ? error.request.statusText : error.message
         }
 
         app.$toast.error(error_msg || "Server Error")
 
         // Pass the error as-is
         return Promise.reject(error)
     }
 )
diff --git a/src/resources/js/fontawesome.js b/src/resources/js/fontawesome.js
index 93297fa2..51559d0d 100644
--- a/src/resources/js/fontawesome.js
+++ b/src/resources/js/fontawesome.js
@@ -1,66 +1,68 @@
 
 import { library } from '@fortawesome/fontawesome-svg-core'
 import { FontAwesomeIcon } from '@fortawesome/vue-fontawesome'
 //import { } from '@fortawesome/free-brands-svg-icons'
 import {
     faCheckSquare,
     faCreditCard,
     faSquare,
 } from '@fortawesome/free-regular-svg-icons'
 
 import {
     faCheck,
     faCheckCircle,
     faComments,
     faDownload,
     faEnvelope,
     faGlobe,
     faUniversity,
     faExclamationCircle,
     faInfoCircle,
     faLock,
     faKey,
     faPlus,
     faSearch,
     faSignInAlt,
     faSyncAlt,
     faTrashAlt,
     faUser,
     faUserCog,
+    faUserFriends,
     faUsers,
     faWallet
 } from '@fortawesome/free-solid-svg-icons'
 
 import {
     faPaypal
 } from '@fortawesome/free-brands-svg-icons'
 
 // Register only these icons we need
 library.add(
     faCheck,
     faCheckCircle,
     faCheckSquare,
     faComments,
     faCreditCard,
     faPaypal,
     faUniversity,
     faDownload,
     faEnvelope,
     faExclamationCircle,
     faGlobe,
     faInfoCircle,
     faLock,
     faKey,
     faPlus,
     faSearch,
     faSignInAlt,
     faSquare,
     faSyncAlt,
     faTrashAlt,
     faUser,
     faUserCog,
+    faUserFriends,
     faUsers,
     faWallet
 )
 
 export default FontAwesomeIcon
diff --git a/src/resources/js/routes-user.js b/src/resources/js/routes-user.js
index 944812a4..b31a1204 100644
--- a/src/resources/js/routes-user.js
+++ b/src/resources/js/routes-user.js
@@ -1,110 +1,124 @@
 import DashboardComponent from '../vue/Dashboard'
+import DistlistInfoComponent from '../vue/Distlist/Info'
+import DistlistListComponent from '../vue/Distlist/List'
 import DomainInfoComponent from '../vue/Domain/Info'
 import DomainListComponent from '../vue/Domain/List'
 import LoginComponent from '../vue/Login'
 import LogoutComponent from '../vue/Logout'
 import MeetComponent from '../vue/Rooms'
 import PageComponent from '../vue/Page'
 import PasswordResetComponent from '../vue/PasswordReset'
 import SignupComponent from '../vue/Signup'
 import UserInfoComponent from '../vue/User/Info'
 import UserListComponent from '../vue/User/List'
 import UserProfileComponent from '../vue/User/Profile'
 import UserProfileDeleteComponent from '../vue/User/ProfileDelete'
 import WalletComponent from '../vue/Wallet'
 
 // Here's a list of lazy-loaded components
 // Note: you can pack multiple components into the same chunk, webpackChunkName
 // is also used to get a sensible file name instead of numbers
 const RoomComponent = () => import(/* webpackChunkName: "room" */ '../vue/Meet/Room.vue')
 
 const routes = [
     {
         path: '/dashboard',
         name: 'dashboard',
         component: DashboardComponent,
         meta: { requiresAuth: true }
     },
+    {
+        path: '/distlist/:list',
+        name: 'distlist',
+        component: DistlistInfoComponent,
+        meta: { requiresAuth: true }
+    },
+    {
+        path: '/distlists',
+        name: 'distlists',
+        component: DistlistListComponent,
+        meta: { requiresAuth: true }
+    },
     {
         path: '/domain/:domain',
         name: 'domain',
         component: DomainInfoComponent,
         meta: { requiresAuth: true }
     },
     {
         path: '/domains',
         name: 'domains',
         component: DomainListComponent,
         meta: { requiresAuth: true }
     },
     {
         path: '/login',
         name: 'login',
         component: LoginComponent
     },
     {
         path: '/logout',
         name: 'logout',
         component: LogoutComponent
     },
     {
         path: '/password-reset/:code?',
         name: 'password-reset',
         component: PasswordResetComponent
     },
     {
         path: '/profile',
         name: 'profile',
         component: UserProfileComponent,
         meta: { requiresAuth: true }
     },
     {
         path: '/profile/delete',
         name: 'profile-delete',
         component: UserProfileDeleteComponent,
         meta: { requiresAuth: true }
     },
     {
         component: RoomComponent,
         name: 'room',
         path: '/meet/:room',
         meta: { loading: true }
     },
     {
         path: '/rooms',
         name: 'rooms',
         component: MeetComponent,
         meta: { requiresAuth: true }
     },
     {
         path: '/signup/:param?',
         alias: '/signup/voucher/:param',
         name: 'signup',
         component: SignupComponent
     },
     {
         path: '/user/:user',
         name: 'user',
         component: UserInfoComponent,
         meta: { requiresAuth: true }
     },
     {
         path: '/users',
         name: 'users',
         component: UserListComponent,
         meta: { requiresAuth: true }
     },
     {
         path: '/wallet',
         name: 'wallet',
         component: WalletComponent,
         meta: { requiresAuth: true }
     },
     {
         name: '404',
         path: '*',
         component: PageComponent
     }
 ]
 
 export default routes
diff --git a/src/resources/lang/en/app.php b/src/resources/lang/en/app.php
index 70e3ccd2..59694ec8 100644
--- a/src/resources/lang/en/app.php
+++ b/src/resources/lang/en/app.php
@@ -1,60 +1,69 @@
 <?php
 
 return [
 
     /*
     |--------------------------------------------------------------------------
     | Application Language Lines
     |--------------------------------------------------------------------------
     |
     | The following language lines are used in the application.
     */
 
     'mandate-delete-success' => 'The auto-payment has been removed.',
     'mandate-update-success' => 'The auto-payment has been updated.',
 
     'planbutton' => 'Choose :plan',
 
     'process-async' => 'Setup process has been pushed. Please wait.',
     'process-user-new' => 'Registering a user...',
     'process-user-ldap-ready' => 'Creating a user...',
     'process-user-imap-ready' => 'Creating a mailbox...',
+    'process-distlist-new' => 'Registering a distribution list...',
+    'process-distlist-ldap-ready' => 'Creating a distribution list...',
     'process-domain-new' => 'Registering a custom domain...',
     'process-domain-ldap-ready' => 'Creating a custom domain...',
     'process-domain-verified' => 'Verifying a custom domain...',
     'process-domain-confirmed' => 'Verifying an ownership of a custom domain...',
     'process-success' => 'Setup process finished successfully.',
     'process-error-user-ldap-ready' => 'Failed to create a user.',
     'process-error-user-imap-ready' => 'Failed to verify that a mailbox exists.',
     'process-error-domain-ldap-ready' => 'Failed to create a domain.',
     'process-error-domain-verified' => 'Failed to verify a domain.',
     'process-error-domain-confirmed' => 'Failed to verify an ownership of a domain.',
+    'process-distlist-new' => 'Registering a distribution list...',
+    'process-distlist-ldap-ready' => 'Creating a distribution list...',
+    'process-error-distlist-ldap-ready' => 'Failed to create a distribution list.',
+
+    'distlist-update-success' => 'Distribution list updated successfully.',
+    'distlist-create-success' => 'Distribution list created successfully.',
+    'distlist-delete-success' => 'Distribution list deleted successfully.',
 
     'domain-verify-success' => 'Domain verified successfully.',
     'domain-verify-error' => 'Domain ownership verification failed.',
     'domain-suspend-success' => 'Domain suspended successfully.',
     'domain-unsuspend-success' => 'Domain unsuspended successfully.',
 
     'user-update-success' => 'User data updated successfully.',
     'user-create-success' => 'User created successfully.',
     'user-delete-success' => 'User deleted successfully.',
     'user-suspend-success' => 'User suspended successfully.',
     'user-unsuspend-success' => 'User unsuspended successfully.',
     'user-reset-2fa-success' => '2-Factor authentication reset successfully.',
 
     'search-foundxdomains' => ':x domains have been found.',
     'search-foundxusers' => ':x user accounts have been found.',
 
     'support-request-success' => 'Support request submitted successfully.',
     'support-request-error' => 'Failed to submit the support request.',
 
     'wallet-award-success' => 'The bonus has been added to the wallet successfully.',
     'wallet-penalty-success' => 'The penalty has been added to the wallet successfully.',
     'wallet-update-success' => 'User wallet updated successfully.',
 
     'wallet-notice-date' => 'With your current subscriptions your account balance will last until about :date (:days).',
     'wallet-notice-nocredit' => 'You are out of credit, top up your balance now.',
     'wallet-notice-today' => 'You will run out of credit today, top up your balance now.',
     'wallet-notice-trial' => 'You are in your free trial period.',
     'wallet-notice-trial-end' => 'Your free trial is about to end, top up to continue.',
 ];
diff --git a/src/resources/lang/en/validation.php b/src/resources/lang/en/validation.php
index d4c37c38..0e11d2d0 100644
--- a/src/resources/lang/en/validation.php
+++ b/src/resources/lang/en/validation.php
@@ -1,168 +1,171 @@
 <?php
 
 return [
 
     /*
     |--------------------------------------------------------------------------
     | Validation Language Lines
     |--------------------------------------------------------------------------
     |
     | The following language lines contain the default error messages used by
     | the validator class. Some of these rules have multiple versions such
     | as the size rules. Feel free to tweak each of these messages here.
     |
     */
 
     'accepted' => 'The :attribute must be accepted.',
     'active_url' => 'The :attribute is not a valid URL.',
     'after' => 'The :attribute must be a date after :date.',
     'after_or_equal' => 'The :attribute must be a date after or equal to :date.',
     'alpha' => 'The :attribute may only contain letters.',
     'alpha_dash' => 'The :attribute may only contain letters, numbers, dashes and underscores.',
     'alpha_num' => 'The :attribute may only contain letters and numbers.',
     'array' => 'The :attribute must be an array.',
     'before' => 'The :attribute must be a date before :date.',
     'before_or_equal' => 'The :attribute must be a date before or equal to :date.',
     'between' => [
         'numeric' => 'The :attribute must be between :min and :max.',
         'file' => 'The :attribute must be between :min and :max kilobytes.',
         'string' => 'The :attribute must be between :min and :max characters.',
         'array' => 'The :attribute must have between :min and :max items.',
     ],
     'boolean' => 'The :attribute field must be true or false.',
     'confirmed' => 'The :attribute confirmation does not match.',
     'date' => 'The :attribute is not a valid date.',
     'date_equals' => 'The :attribute must be a date equal to :date.',
     'date_format' => 'The :attribute does not match the format :format.',
     'different' => 'The :attribute and :other must be different.',
     'digits' => 'The :attribute must be :digits digits.',
     'digits_between' => 'The :attribute must be between :min and :max digits.',
     'dimensions' => 'The :attribute has invalid image dimensions.',
     'distinct' => 'The :attribute field has a duplicate value.',
     'email' => 'The :attribute must be a valid email address.',
     'ends_with' => 'The :attribute must end with one of the following: :values',
     'exists' => 'The selected :attribute is invalid.',
     'file' => 'The :attribute must be a file.',
     'filled' => 'The :attribute field must have a value.',
     'gt' => [
         'numeric' => 'The :attribute must be greater than :value.',
         'file' => 'The :attribute must be greater than :value kilobytes.',
         'string' => 'The :attribute must be greater than :value characters.',
         'array' => 'The :attribute must have more than :value items.',
     ],
     'gte' => [
         'numeric' => 'The :attribute must be greater than or equal :value.',
         'file' => 'The :attribute must be greater than or equal :value kilobytes.',
         'string' => 'The :attribute must be greater than or equal :value characters.',
         'array' => 'The :attribute must have :value items or more.',
     ],
     'image' => 'The :attribute must be an image.',
     'in' => 'The selected :attribute is invalid.',
     'in_array' => 'The :attribute field does not exist in :other.',
     'integer' => 'The :attribute must be an integer.',
     'ip' => 'The :attribute must be a valid IP address.',
     'ipv4' => 'The :attribute must be a valid IPv4 address.',
     'ipv6' => 'The :attribute must be a valid IPv6 address.',
     'json' => 'The :attribute must be a valid JSON string.',
     'lt' => [
         'numeric' => 'The :attribute must be less than :value.',
         'file' => 'The :attribute must be less than :value kilobytes.',
         'string' => 'The :attribute must be less than :value characters.',
         'array' => 'The :attribute must have less than :value items.',
     ],
     'lte' => [
         'numeric' => 'The :attribute must be less than or equal :value.',
         'file' => 'The :attribute must be less than or equal :value kilobytes.',
         'string' => 'The :attribute must be less than or equal :value characters.',
         'array' => 'The :attribute must not have more than :value items.',
     ],
     'max' => [
         'numeric' => 'The :attribute may not be greater than :max.',
         'file' => 'The :attribute may not be greater than :max kilobytes.',
         'string' => 'The :attribute may not be greater than :max characters.',
         'array' => 'The :attribute may not have more than :max items.',
     ],
     'mimes' => 'The :attribute must be a file of type: :values.',
     'mimetypes' => 'The :attribute must be a file of type: :values.',
     'min' => [
         'numeric' => 'The :attribute must be at least :min.',
         'file' => 'The :attribute must be at least :min kilobytes.',
         'string' => 'The :attribute must be at least :min characters.',
         'array' => 'The :attribute must have at least :min items.',
     ],
     'not_in' => 'The selected :attribute is invalid.',
     'not_regex' => 'The :attribute format is invalid.',
     'numeric' => 'The :attribute must be a number.',
     'present' => 'The :attribute field must be present.',
     'regex' => 'The :attribute format is invalid.',
     'required' => 'The :attribute field is required.',
     'required_if' => 'The :attribute field is required when :other is :value.',
     'required_unless' => 'The :attribute field is required unless :other is in :values.',
     'required_with' => 'The :attribute field is required when :values is present.',
     'required_with_all' => 'The :attribute field is required when :values are present.',
     'required_without' => 'The :attribute field is required when :values is not present.',
     'required_without_all' => 'The :attribute field is required when none of :values are present.',
     'same' => 'The :attribute and :other must match.',
     'size' => [
         'numeric' => 'The :attribute must be :size.',
         'file' => 'The :attribute must be :size kilobytes.',
         'string' => 'The :attribute must be :size characters.',
         'array' => 'The :attribute must contain :size items.',
     ],
     'starts_with' => 'The :attribute must start with one of the following: :values',
     'string' => 'The :attribute must be a string.',
     'timezone' => 'The :attribute must be a valid zone.',
     'unique' => 'The :attribute has already been taken.',
     'uploaded' => 'The :attribute failed to upload.',
     'url' => 'The :attribute format is invalid.',
     'uuid' => 'The :attribute must be a valid UUID.',
 
     '2fareq' => 'Second factor code is required.',
     '2fainvalid' => 'Second factor code is invalid.',
     'emailinvalid' => 'The specified email address is invalid.',
     'domaininvalid' => 'The specified domain is invalid.',
     'domainnotavailable' => 'The specified domain is not available.',
     'logininvalid' => 'The specified login is invalid.',
     'loginexists' => 'The specified login is not available.',
     'domainexists' => 'The specified domain is not available.',
     'noemailorphone' => 'The specified text is neither a valid email address nor a phone number.',
     'packageinvalid' => 'Invalid package selected.',
     'packagerequired' => 'Package is required.',
     'usernotexists' => 'Unable to find user.',
     'voucherinvalid' => 'The voucher code is invalid or expired.',
     'noextemail' => 'This user has no external email address.',
     'entryinvalid' => 'The specified :attribute is invalid.',
     'entryexists' => 'The specified :attribute is not available.',
     'minamount' => 'Minimum amount for a single payment is :amount.',
     'minamountdebt' => 'The specified amount does not cover the balance on the account.',
+    'notalocaluser' => 'The specified email address does not exist.',
+    'memberislist' => 'A recipient cannot be the same as the list address.',
+    'listmembersrequired' => 'At least one recipient is required.',
 
     /*
     |--------------------------------------------------------------------------
     | Custom Validation Language Lines
     |--------------------------------------------------------------------------
     |
     | Here you may specify custom validation messages for attributes using the
     | convention "attribute.rule" to name the lines. This makes it quick to
     | specify a specific custom language line for a given attribute rule.
     |
     */
 
     'custom' => [
         'attribute-name' => [
             'rule-name' => 'custom-message',
         ],
     ],
 
     /*
     |--------------------------------------------------------------------------
     | Custom Validation Attributes
     |--------------------------------------------------------------------------
     |
     | The following language lines are used to swap our attribute placeholder
     | with something more reader friendly such as "E-Mail Address" instead
     | of "email". This simply helps us make our message more expressive.
     |
     */
 
     'attributes' => [],
 ];
diff --git a/src/resources/vue/Dashboard.vue b/src/resources/vue/Dashboard.vue
index 1ec8db1f..bca3666c 100644
--- a/src/resources/vue/Dashboard.vue
+++ b/src/resources/vue/Dashboard.vue
@@ -1,63 +1,66 @@
 <template>
     <div class="container" dusk="dashboard-component">
         <status-component :status="status" @status-update="statusUpdate"></status-component>
 
         <div id="dashboard-nav">
             <router-link class="card link-profile" :to="{ name: 'profile' }">
                 <svg-icon icon="user-cog"></svg-icon><span class="name">Your profile</span>
             </router-link>
             <router-link v-if="status.enableDomains" class="card link-domains" :to="{ name: 'domains' }">
                 <svg-icon icon="globe"></svg-icon><span class="name">Domains</span>
             </router-link>
             <router-link v-if="status.enableUsers" class="card link-users" :to="{ name: 'users' }">
-                <svg-icon icon="users"></svg-icon><span class="name">User accounts</span>
+                <svg-icon icon="user-friends"></svg-icon><span class="name">User accounts</span>
+            </router-link>
+            <router-link v-if="status.enableDistlists" class="card link-distlists" :to="{ name: 'distlists' }">
+                <svg-icon icon="users"></svg-icon><span class="name">Distribution lists</span>
             </router-link>
             <router-link v-if="status.enableWallets" class="card link-wallet" :to="{ name: 'wallet' }">
                 <svg-icon icon="wallet"></svg-icon><span class="name">Wallet</span>
                 <span v-if="balance < 0" class="badge badge-danger">{{ $root.price(balance) }}</span>
             </router-link>
             <router-link v-if="$root.hasSKU('meet')" class="card link-chat" :to="{ name: 'rooms' }">
                 <svg-icon icon="comments"></svg-icon><span class="name">Video chat</span>
                 <span class="badge badge-primary">beta</span>
             </router-link>
             <a v-if="webmailURL" class="card link-webmail" :href="webmailURL">
                 <svg-icon icon="envelope"></svg-icon><span class="name">Webmail</span>
             </a>
         </div>
     </div>
 </template>
 
 <script>
     import StatusComponent from './Widgets/Status'
 
     export default {
         components: {
             StatusComponent
         },
         data() {
             return {
                 status: {},
                 balance: 0,
                 webmailURL: window.config['app.webmail_url']
             }
         },
         mounted() {
             const authInfo = this.$store.state.authInfo
             this.status = authInfo.statusInfo
             this.getBalance(authInfo)
         },
         methods: {
             getBalance(authInfo) {
                 this.balance = 0;
                 // TODO: currencies, multi-wallets, accounts
                 authInfo.wallets.forEach(wallet => {
                     this.balance += wallet.balance
                 })
             },
             statusUpdate(user) {
                 this.status = Object.assign({}, this.status, user)
                 this.$store.state.authInfo.statusInfo = this.status
             }
         }
     }
 </script>
diff --git a/src/resources/vue/Distlist/Info.vue b/src/resources/vue/Distlist/Info.vue
new file mode 100644
index 00000000..f9a91cd6
--- /dev/null
+++ b/src/resources/vue/Distlist/Info.vue
@@ -0,0 +1,110 @@
+<template>
+    <div class="container">
+        <status-component v-if="list_id !== 'new'" :status="status" @status-update="statusUpdate"></status-component>
+
+        <div class="card" id="distlist-info">
+            <div class="card-body">
+                <div class="card-title" v-if="list_id !== 'new'">
+                    Distribution list
+                    <button class="btn btn-outline-danger button-delete float-right" @click="deleteList()" tag="button">
+                        <svg-icon icon="trash-alt"></svg-icon> Delete list
+                    </button>
+                </div>
+                <div class="card-title" v-if="list_id === 'new'">New distribution list</div>
+                <div class="card-text">
+                    <form @submit.prevent="submit">
+                        <div v-if="list_id !== 'new'" class="form-group row plaintext">
+                            <label for="status" class="col-sm-4 col-form-label">Status</label>
+                            <div class="col-sm-8">
+                                <span :class="$root.distlistStatusClass(list) + ' form-control-plaintext'" id="status">{{ $root.distlistStatusText(list) }}</span>
+                            </div>
+                        </div>
+                        <div class="form-group row">
+                            <label for="email" class="col-sm-4 col-form-label">Email</label>
+                            <div class="col-sm-8">
+                                <input type="text" class="form-control" id="email" :disabled="list_id !== 'new'" required v-model="list.email">
+                            </div>
+                        </div>
+                        <div class="form-group row">
+                            <label for="members-input" class="col-sm-4 col-form-label">Recipients</label>
+                            <div class="col-sm-8">
+                                <list-input id="members" :list="list.members"></list-input>
+                            </div>
+                        </div>
+                        <button class="btn btn-primary" type="submit"><svg-icon icon="check"></svg-icon> Submit</button>
+                    </form>
+                </div>
+            </div>
+        </div>
+    </div>
+</template>
+
+<script>
+    import ListInput from '../Widgets/ListInput'
+    import StatusComponent from '../Widgets/Status'
+
+    export default {
+        components: {
+            ListInput,
+            StatusComponent
+        },
+        data() {
+            return {
+                list_id: null,
+                list: { members: [] },
+                status: {}
+            }
+        },
+        created() {
+            if (!this.$root.hasPermission('distlists')) {
+                this.$root.errorPage(404)
+                return
+            }
+
+            this.list_id = this.$route.params.list
+
+            if (this.list_id != 'new') {
+                this.$root.startLoading()
+
+                axios.get('/api/v4/groups/' + this.list_id)
+                    .then(response => {
+                        this.$root.stopLoading()
+                        this.list = response.data
+                        this.status = response.data.statusInfo
+                    })
+                    .catch(this.$root.errorHandler)
+            }
+        },
+        methods: {
+            deleteList() {
+                axios.delete('/api/v4/groups/' + this.list_id)
+                    .then(response => {
+                        if (response.data.status == 'success') {
+                            this.$toast.success(response.data.message)
+                            this.$router.push({ name: 'distlists' })
+                        }
+                    })
+            },
+            statusUpdate(list) {
+                this.list = Object.assign({}, this.list, list)
+            },
+            submit() {
+                this.$root.clearFormValidation($('#list-info form'))
+
+                let method = 'post'
+                let location = '/api/v4/groups'
+
+                if (this.list_id !== 'new') {
+                    method = 'put'
+                    location += '/' + this.list_id
+                }
+
+                axios[method](location, this.list)
+                    .then(response => {
+                        this.$toast.success(response.data.message)
+                        this.$router.push({ name: 'distlists' })
+                    })
+            }
+        }
+    }
+</script>
diff --git a/src/resources/vue/Distlist/List.vue b/src/resources/vue/Distlist/List.vue
new file mode 100644
index 00000000..8070dff6
--- /dev/null
+++ b/src/resources/vue/Distlist/List.vue
@@ -0,0 +1,63 @@
+<template>
+    <div class="container">
+        <div class="card" id="distlist-list">
+            <div class="card-body">
+                <div class="card-title">
+                    Distribution lists
+                    <router-link class="btn btn-success float-right create-list" :to="{ path: 'distlist/new' }" tag="button">
+                        <svg-icon icon="users"></svg-icon> Create list
+                    </router-link>
+                </div>
+                <div class="card-text">
+                    <table class="table table-sm table-hover">
+                        <thead class="thead-light">
+                            <tr>
+                                <th scope="col">Email</th>
+                            </tr>
+                        </thead>
+                        <tbody>
+                            <tr v-for="list in lists" :key="list.id" @click="$root.clickRecord">
+                                <td>
+                                    <svg-icon icon="users" :class="$root.distlistStatusClass(list)" :title="$root.distlistStatusText(list)"></svg-icon>
+                                    <router-link :to="{ path: 'distlist/' + list.id }">{{ list.email }}</router-link>
+                                </td>
+                            </tr>
+                        </tbody>
+                        <tfoot class="table-fake-body">
+                            <tr>
+                                <td>There are no distribution lists in this account.</td>
+                            </tr>
+                        </tfoot>
+                    </table>
+                </div>
+            </div>
+        </div>
+    </div>
+</template>
+
+<script>
+    export default {
+        data() {
+            return {
+                lists: []
+            }
+        },
+        created() {
+            // TODO: Find a way to do this in some more global way. Note that it cannot
+            //       be done in the vue-router, but maybe the app component?
+            if (!this.$root.hasPermission('distlists')) {
+                this.$root.errorPage(404)
+                return
+            }
+
+            this.$root.startLoading()
+
+            axios.get('/api/v4/groups')
+                .then(response => {
+                    this.$root.stopLoading()
+                    this.lists = response.data
+                })
+                .catch(this.$root.errorHandler)
+        }
+    }
+</script>
diff --git a/src/resources/vue/User/Info.vue b/src/resources/vue/User/Info.vue
index 2b7da988..c8bd8231 100644
--- a/src/resources/vue/User/Info.vue
+++ b/src/resources/vue/User/Info.vue
@@ -1,445 +1,445 @@
 <template>
     <div class="container">
         <status-component v-if="user_id !== 'new'" :status="status" @status-update="statusUpdate"></status-component>
 
         <div class="card" id="user-info">
             <div class="card-body">
                 <div class="card-title" v-if="user_id !== 'new'">User account
                     <button
                         class="btn btn-outline-danger button-delete float-right"
                         v-on:click="showDeleteConfirmation()" tag="button"
                     >
                         <svg-icon icon="trash-alt"></svg-icon> Delete user
                     </button>
                 </div>
                 <div class="card-title" v-if="user_id === 'new'">New user account</div>
                 <div class="card-text">
                     <form @submit.prevent="submit">
                         <div v-if="user_id !== 'new'" class="form-group row plaintext">
-                            <label for="first_name" class="col-sm-4 col-form-label">Status</label>
+                            <label for="status" class="col-sm-4 col-form-label">Status</label>
                             <div class="col-sm-8">
                                 <span :class="$root.userStatusClass(user) + ' form-control-plaintext'" id="status">{{ $root.userStatusText(user) }}</span>
                             </div>
                         </div>
                         <div class="form-group row">
                             <label for="first_name" class="col-sm-4 col-form-label">First name</label>
                             <div class="col-sm-8">
                                 <input type="text" class="form-control" id="first_name" v-model="user.first_name">
                             </div>
                         </div>
                         <div class="form-group row">
                             <label for="last_name" class="col-sm-4 col-form-label">Last name</label>
                             <div class="col-sm-8">
                                 <input type="text" class="form-control" id="last_name" v-model="user.last_name">
                             </div>
                         </div>
                         <div class="form-group row">
                             <label for="organization" class="col-sm-4 col-form-label">Organization</label>
                             <div class="col-sm-8">
                                 <input type="text" class="form-control" id="organization" v-model="user.organization">
                             </div>
                         </div>
                         <div class="form-group row">
                             <label for="email" class="col-sm-4 col-form-label">Email</label>
                             <div class="col-sm-8">
                                 <input type="text" class="form-control" id="email" :disabled="user_id !== 'new'" required v-model="user.email">
                             </div>
                         </div>
                         <div class="form-group row">
                             <label for="aliases-input" class="col-sm-4 col-form-label">Email aliases</label>
                             <div class="col-sm-8">
                                 <list-input id="aliases" :list="user.aliases"></list-input>
                             </div>
                         </div>
                         <div class="form-group row">
                             <label for="password" class="col-sm-4 col-form-label">Password</label>
                             <div class="col-sm-8">
                                 <input type="password" class="form-control" id="password" v-model="user.password" :required="user_id === 'new'">
                             </div>
                         </div>
                         <div class="form-group row">
                             <label for="password_confirmaton" class="col-sm-4 col-form-label">Confirm password</label>
                             <div class="col-sm-8">
                                 <input type="password" class="form-control" id="password_confirmation" v-model="user.password_confirmation" :required="user_id === 'new'">
                             </div>
                         </div>
                         <div v-if="user_id === 'new'" id="user-packages" class="form-group row">
                             <label class="col-sm-4 col-form-label">Package</label>
                             <div class="col-sm-8">
                                 <table class="table table-sm form-list">
                                     <thead class="thead-light sr-only">
                                         <tr>
                                             <th scope="col"></th>
                                             <th scope="col">Package</th>
                                             <th scope="col">Price</th>
                                             <th scope="col"></th>
                                         </tr>
                                     </thead>
                                     <tbody>
                                         <tr v-for="pkg in packages" :id="'p' + pkg.id" :key="pkg.id">
                                             <td class="selection">
                                                 <input type="checkbox" @click="selectPackage"
                                                        :value="pkg.id"
                                                        :checked="pkg.id == package_id"
                                                        :id="'pkg-input-' + pkg.id"
                                                 >
                                             </td>
                                             <td class="name">
                                                 <label :for="'pkg-input-' + pkg.id">{{ pkg.name }}</label>
                                             </td>
                                             <td class="price text-nowrap">
                                                 {{ $root.priceLabel(pkg.cost, discount) }}
                                             </td>
                                             <td class="buttons">
                                                 <button v-if="pkg.description" type="button" class="btn btn-link btn-lg p-0" v-tooltip.click="pkg.description">
                                                     <svg-icon icon="info-circle"></svg-icon>
                                                     <span class="sr-only">More information</span>
                                                 </button>
                                             </td>
                                         </tr>
                                     </tbody>
                                 </table>
                                 <small v-if="discount > 0" class="hint">
                                     <hr class="m-0">
                                     &sup1; applied discount: {{ discount }}% - {{ discount_description }}
                                 </small>
                             </div>
                         </div>
                         <div v-if="user_id !== 'new'" id="user-skus" class="form-group row">
                             <label class="col-sm-4 col-form-label">Subscriptions</label>
                             <div class="col-sm-8">
                                 <table class="table table-sm form-list">
                                     <thead class="thead-light sr-only">
                                         <tr>
                                             <th scope="col"></th>
                                             <th scope="col">Subscription</th>
                                             <th scope="col">Price</th>
                                             <th scope="col"></th>
                                         </tr>
                                     </thead>
                                     <tbody>
                                         <tr v-for="sku in skus" :id="'s' + sku.id" :key="sku.id">
                                             <td class="selection">
                                                 <input type="checkbox" @input="onInputSku"
                                                        :value="sku.id"
                                                        :disabled="sku.readonly"
                                                        :checked="sku.enabled"
                                                        :id="'sku-input-' + sku.title"
                                                 >
                                             </td>
                                             <td class="name">
                                                 <label :for="'sku-input-' + sku.title">{{ sku.name }}</label>
                                                 <div v-if="sku.range" class="range-input">
                                                     <label class="text-nowrap">{{ sku.range.min }} {{ sku.range.unit }}</label>
                                                     <input
                                                         type="range" class="custom-range" @input="rangeUpdate"
                                                         :value="sku.value || sku.range.min"
                                                         :min="sku.range.min"
                                                         :max="sku.range.max"
                                                     >
                                                 </div>
                                             </td>
                                             <td class="price text-nowrap">
                                                 {{ $root.priceLabel(sku.cost, discount) }}
                                             </td>
                                             <td class="buttons">
                                                 <button v-if="sku.description" type="button" class="btn btn-link btn-lg p-0" v-tooltip.click="sku.description">
                                                     <svg-icon icon="info-circle"></svg-icon>
                                                     <span class="sr-only">More information</span>
                                                 </button>
                                             </td>
                                         </tr>
                                     </tbody>
                                 </table>
                                 <small v-if="discount > 0" class="hint">
                                     <hr class="m-0">
                                     &sup1; applied discount: {{ discount }}% - {{ discount_description }}
                                 </small>
                             </div>
                         </div>
                         <button class="btn btn-primary" type="submit"><svg-icon icon="check"></svg-icon> Submit</button>
                     </form>
                 </div>
             </div>
         </div>
         <div id="delete-warning" class="modal" tabindex="-1" role="dialog">
             <div class="modal-dialog" role="document">
                 <div class="modal-content">
                     <div class="modal-header">
                         <h5 class="modal-title"></h5>
                         <button type="button" class="close" data-dismiss="modal" aria-label="Close">
                             <span aria-hidden="true">&times;</span>
                         </button>
                     </div>
                     <div class="modal-body">
                         <p>Do you really want to delete this user permanently?
                             This will delete all account data and withdraw the permission to access the email account.
                             Please note that this action cannot be undone.</p>
                     </div>
                     <div class="modal-footer">
                         <button type="button" class="btn btn-secondary modal-cancel" data-dismiss="modal">Cancel</button>
                         <button type="button" class="btn btn-danger modal-action" @click="deleteUser()">
                             <svg-icon icon="trash-alt"></svg-icon> Delete
                         </button>
                     </div>
                 </div>
             </div>
         </div>
     </div>
 </template>
 
 <script>
     import ListInput from '../Widgets/ListInput'
     import StatusComponent from '../Widgets/Status'
 
     export default {
         components: {
             ListInput,
             StatusComponent
         },
         data() {
             return {
                 discount: 0,
                 discount_description: '',
                 user_id: null,
                 user: { aliases: [] },
                 packages: [],
                 package_id: null,
                 skus: [],
                 status: {}
             }
         },
         created() {
             this.user_id = this.$route.params.user
 
             let wallet = this.$store.state.authInfo.accounts[0]
 
             if (!wallet) {
                 wallet = this.$store.state.authInfo.wallets[0]
             }
 
             if (wallet && wallet.discount) {
                 this.discount = wallet.discount
                 this.discount_description = wallet.discount_description
             }
 
             this.$root.startLoading()
 
             if (this.user_id === 'new') {
                 // do nothing (for now)
                 axios.get('/api/v4/packages')
                     .then(response => {
                         this.$root.stopLoading()
 
                         this.packages = response.data.filter(pkg => !pkg.isDomain)
                         this.package_id = this.packages[0].id
                     })
                     .catch(this.$root.errorHandler)
             }
             else {
                 axios.get('/api/v4/users/' + this.user_id)
                     .then(response => {
                         this.$root.stopLoading()
 
                         this.user = response.data
                         this.user.first_name = response.data.settings.first_name
                         this.user.last_name = response.data.settings.last_name
                         this.user.organization = response.data.settings.organization
                         this.discount = this.user.wallet.discount
                         this.discount_description = this.user.wallet.discount_description
                         this.status = response.data.statusInfo
 
                         axios.get('/api/v4/users/' + this.user_id + '/skus?type=user')
                             .then(response => {
                                 // "merge" SKUs with user entitlement-SKUs
                                 this.skus = response.data
                                     .map(sku => {
                                         const userSku = this.user.skus[sku.id]
                                         if (userSku) {
                                             sku.enabled = true
                                             sku.skuCost = sku.cost
                                             sku.cost = userSku.costs.reduce((sum, current) => sum + current)
                                             sku.value = userSku.count
                                             sku.costs = userSku.costs
                                         } else if (!sku.readonly) {
                                             sku.enabled = false
                                         }
 
                                         return sku
                                     })
 
                                 // Update all range inputs (and price)
                                 this.$nextTick(() => {
                                     $('#user-skus input[type=range]').each((idx, elem) => { this.rangeUpdate(elem) })
                                 })
                             })
                             .catch(this.$root.errorHandler)
                     })
                     .catch(this.$root.errorHandler)
             }
         },
         mounted() {
             $('#first_name').focus()
         },
         methods: {
             submit() {
                 this.$root.clearFormValidation($('#user-info form'))
 
                 let method = 'post'
                 let location = '/api/v4/users'
 
                 if (this.user_id !== 'new') {
                     method = 'put'
                     location += '/' + this.user_id
 
                     let skus = {}
                     $('#user-skus input[type=checkbox]:checked').each((idx, input) => {
                         let id = $(input).val()
                         let range = $(input).parents('tr').first().find('input[type=range]').val()
 
                         skus[id] = range || 1
                     })
                     this.user.skus = skus
                 } else {
                     this.user.package = this.package_id
                 }
 
                 axios[method](location, this.user)
                     .then(response => {
                         if (response.data.statusInfo) {
                             this.$store.state.authInfo.statusInfo = response.data.statusInfo
                         }
 
                         this.$toast.success(response.data.message)
                         this.$router.push({ name: 'users' })
                     })
             },
             onInputSku(e) {
                 let input = e.target
                 let sku = this.findSku(input.value)
                 let required = []
 
                 // We use 'readonly', not 'disabled', because we might want to handle
                 // input events. For example to display an error when someone clicks
                 // the locked input
                 if (input.readOnly) {
                     input.checked = !input.checked
                     // TODO: Display an alert explaining why it's locked
                     return
                 }
 
                 // TODO: Following code might not work if we change definition of forbidden/required
                 //       or we just need more sophisticated SKU dependency rules
 
                 if (input.checked) {
                     // Check if a required SKU is selected, alert the user if not
                     (sku.required || []).forEach(title => {
                         this.skus.forEach(item => {
                             let checkbox
                             if (item.handler == title && (checkbox = $('#s' + item.id).find('input[type=checkbox]')[0])) {
                                 if (!checkbox.checked) {
                                     required.push(item.name)
                                 }
                             }
                         })
                     })
 
                     if (required.length) {
                         input.checked = false
                         return alert(sku.name + ' requires ' + required.join(', ') + '.')
                     }
                 } else {
                     // Uncheck all dependent SKUs, e.g. when unchecking Groupware we also uncheck Activesync
                     // TODO: Should we display an alert instead?
                     this.skus.forEach(item => {
                         if (item.required && item.required.indexOf(sku.handler) > -1) {
                             $('#s' + item.id).find('input[type=checkbox]').prop('checked', false)
                         }
                     })
                 }
 
                 // Uncheck+lock/unlock conflicting SKUs
                 (sku.forbidden || []).forEach(title => {
                     this.skus.forEach(item => {
                         let checkbox
                         if (item.handler == title && (checkbox = $('#s' + item.id).find('input[type=checkbox]')[0])) {
                             if (input.checked) {
                                 checkbox.checked = false
                                 checkbox.readOnly = true
                             } else {
                                 checkbox.readOnly = false
                             }
                         }
                     })
                 })
             },
             selectPackage(e) {
                 // Make sure there always is only one package selected
                 $('#user-packages input').prop('checked', false)
                 this.package_id = $(e.target).prop('checked', false).val()
             },
             rangeUpdate(e) {
                 let input = $(e.target || e)
                 let value = input.val()
                 let record = input.parents('tr').first()
                 let sku_id = record.find('input[type=checkbox]').val()
                 let sku = this.findSku(sku_id)
                 let existing = sku.costs ? sku.costs.length : 0
                 let cost
 
                 // Calculate cost, considering both existing entitlement cost and sku cost
                 if (existing) {
                     cost = sku.costs
                         .sort((a, b) => a - b) // sort by cost ascending (free units first)
                         .slice(0, value)
                         .reduce((sum, current) => sum + current)
 
                     if (value > existing) {
                         cost += sku.skuCost * (value - existing)
                     }
                 } else {
                     cost = sku.cost * (value - sku.units_free)
                 }
 
                 // Update the label
                 input.prev().text(value + ' ' + sku.range.unit)
 
                 // Update the price
                 record.find('.price').text(this.$root.priceLabel(cost, this.discount))
             },
             findSku(id) {
                 for (let i = 0; i < this.skus.length; i++) {
                     if (this.skus[i].id == id) {
                         return this.skus[i];
                     }
                 }
             },
             statusUpdate(user) {
                 this.user = Object.assign({}, this.user, user)
             },
             deleteUser() {
                 // Delete the user from the confirm dialog
                 axios.delete('/api/v4/users/' + this.user_id)
                     .then(response => {
                         if (response.data.status == 'success') {
                            this.$toast.success(response.data.message)
                            this.$router.push({ name: 'users' })
                         }
                     })
             },
             showDeleteConfirmation() {
                 // Deleting self, redirect to /profile/delete page
                 if (this.user_id == this.$store.state.authInfo.id) {
                     this.$router.push({ name: 'profile-delete' })
                 } else {
                     // Display the warning
                     let dialog = $('#delete-warning')
                     dialog.find('.modal-title').text('Delete ' + this.user.email)
                     dialog.on('shown.bs.modal', () => {
                         dialog.find('button.modal-cancel').focus()
                     }).modal()
                 }
             }
         }
     }
 </script>
diff --git a/src/resources/vue/Widgets/ListInput.vue b/src/resources/vue/Widgets/ListInput.vue
index aff59bd2..3a473944 100644
--- a/src/resources/vue/Widgets/ListInput.vue
+++ b/src/resources/vue/Widgets/ListInput.vue
@@ -1,69 +1,75 @@
 <template>
     <div class="list-input" :id="id">
         <div class="input-group">
             <input :id="id + '-input'" type="text" class="form-control main-input" @keydown="keyDown">
             <div class="input-group-append">
                 <a href="#" class="btn btn-outline-secondary" @click.prevent="addItem">
                     <svg-icon icon="plus"></svg-icon>
                     <span class="sr-only">Add</span>
                 </a>
             </div>
         </div>
         <div class="input-group" v-for="(item, index) in list" :key="index">
             <input type="text" class="form-control" v-model="list[index]">
             <div class="input-group-append">
                 <a href="#" class="btn btn-outline-secondary" @click.prevent="deleteItem(index)">
                     <svg-icon icon="trash-alt"></svg-icon>
                     <span class="sr-only">Delete</span>
                 </a>
             </div>
         </div>
     </div>
 </template>
 
 <script>
     export default {
         props: {
             list: { type: Array, default: () => [] },
             id: { type: String, default: '' }
         },
         mounted() {
             this.input = $(this.$el).find('.main-input')[0]
 
             // On form submit add the text from main input to the list
             // Users tend to forget about pressing the "plus" button
             // Note: We can't use form.onsubmit (too late)
             // Note: Use of input.onblur has been proven to be problematic
             // TODO: What with forms that have no submit button?
             $(this.$el).closest('form').find('button[type=submit]').on('click', () => {
                 this.addItem(false)
             })
         },
         methods: {
             addItem(focus) {
                 let value = this.input.value
 
                 if (value) {
                     this.list.push(value)
                     this.input.value = ''
+                    this.input.classList.remove('is-invalid')
+
                     if (focus !== false) {
                         this.input.focus()
                     }
+
+                    if (this.list.length == 1) {
+                        this.$el.classList.remove('is-invalid')
+                    }
                 }
             },
             deleteItem(index) {
                 this.$delete(this.list, index)
 
-                if (this.list.length == 1) {
-                    $(this.$el).removeClass('is-invalid')
+                if (!this.list.length) {
+                    this.$el.classList.remove('is-invalid')
                 }
             },
             keyDown(e) {
                 if (e.which == 13 && e.target.value) {
                     this.addItem()
                     e.preventDefault()
                 }
             }
         }
     }
 </script>
diff --git a/src/resources/vue/Widgets/Status.vue b/src/resources/vue/Widgets/Status.vue
index dbf6a476..ed7d56bb 100644
--- a/src/resources/vue/Widgets/Status.vue
+++ b/src/resources/vue/Widgets/Status.vue
@@ -1,198 +1,203 @@
 <template>
     <div v-if="!state.isReady" id="status-box" :class="'p-4 mb-3 rounded process-' + className">
         <div v-if="state.step != 'domain-confirmed'" class="d-flex align-items-start">
             <p id="status-body" class="flex-grow-1">
                 <span v-if="scope == 'dashboard'">We are preparing your account.</span>
                 <span v-else-if="scope == 'domain'">We are preparing the domain.</span>
+                <span v-else-if="scope == 'distlist'">We are preparing the distribution list.</span>
                 <span v-else>We are preparing the user account.</span>
                 <br>
                 Some features may be missing or readonly at the moment.<br>
                 <span id="refresh-text" v-if="refresh">The process never ends? Press the "Refresh" button, please.</span>
             </p>
             <button v-if="refresh" id="status-refresh" href="#" class="btn btn-secondary" @click="statusRefresh">
                 <svg-icon icon="sync-alt"></svg-icon> Refresh
             </button>
         </div>
         <div v-else class="d-flex align-items-start">
             <p id="status-body" class="flex-grow-1">
                 <span v-if="scope == 'dashboard'">Your account is almost ready.</span>
                 <span v-else-if="scope == 'domain'">The domain is almost ready.</span>
+                <span v-else-if="scope == 'distlist'">The distribution list is almost ready.</span>
                 <span v-else>The user account is almost ready.</span>
                 <br>
                 Verify your domain to finish the setup process.
             </p>
             <div v-if="scope == 'domain'">
                 <button id="status-verify" class="btn btn-secondary text-nowrap" @click="confirmDomain">
                     <svg-icon icon="sync-alt"></svg-icon> Verify
                 </button>
             </div>
             <div v-else-if="state.link && scope != 'domain'">
                 <router-link id="status-link" class="btn btn-secondary" :to="{ path: state.link }">Verify domain</router-link>
             </div>
         </div>
 
         <div class="status-progress text-center">
             <div class="progress">
                 <div class="progress-bar" role="progressbar" aria-valuenow="0" aria-valuemin="0" aria-valuemax="100"></div>
             </div>
             <span class="progress-label">{{ state.title || 'Initializing...' }}</span>
         </div>
     </div>
 </template>
 
 <script>
     export default {
         props: {
             status: { type: Object, default: () => {} }
         },
         data() {
             return {
                 className: 'pending',
                 refresh: false,
                 delay: 5000,
                 scope: 'user',
                 state: { isReady: true },
                 waiting: 0,
             }
         },
         watch: {
             // We use property watcher because parent component
             // might set the property with a delay and we need to parse it
             // FIXME: Problem with this and update-status event is that whenever
             //        we emit the event a watcher function is executed, causing
             //        duplicate parseStatusInfo() calls. Fortunaltely this does not
             //        cause duplicate http requests.
             status: function (val, oldVal) {
                 this.parseStatusInfo(val)
             }
         },
         destroyed() {
             clearTimeout(window.infoRequest)
         },
         mounted() {
             this.scope = this.$route.name
         },
         methods: {
             // Displays account status information
             parseStatusInfo(info) {
                 if (info) {
                     if (!info.isReady) {
                         let failedCount = 0
                         let allCount = info.process.length
 
                         info.process.forEach((step, idx) => {
                             if (!step.state) {
                                 failedCount++
 
                                 if (!info.title) {
                                     info.title = step.title
                                     info.step = step.label
                                     info.link = step.link
                                 }
                             }
                         })
 
                         info.percent = Math.floor((allCount - failedCount) / allCount * 100);
                     }
 
                     this.state = info || {}
 
                     this.$nextTick(function() {
                         $(this.$el).find('.progress-bar')
                             .css('width', info.percent + '%')
                             .attr('aria-valuenow', info.percent)
                     })
 
                     // Unhide the Refresh button, the process is in failure state
                     this.refresh = info.processState == 'failed' && this.waiting == 0
 
                     if (this.refresh || info.step == 'domain-confirmed') {
                         this.className = 'failed'
                     }
 
                     // A async job has been dispatched, switch to a waiting mode where
                     // we hide the Refresh button and pull status for about a minute,
                     // after that we switch to normal mode, i.e. user can Refresh again (if still not ready)
                     if (info.processState == 'waiting') {
                         this.waiting = 10
                         this.delay = 5000
                     } else if (this.waiting > 0) {
                         this.waiting -= 1
                     }
                 }
 
                 // Update status process info every 5,6,7,8,9,... seconds
                 clearTimeout(window.infoRequest)
                 if ((!this.refresh || this.waiting > 0) && (!info || !info.isReady)) {
                     window.infoRequest = setTimeout(() => {
                         delete window.infoRequest
                         // Stop updates after user logged out
                         if (!this.$store.state.isLoggedIn) {
                             return;
                         }
 
                         axios.get(this.getUrl())
                             .then(response => {
                                 this.parseStatusInfo(response.data)
                                 this.emitEvent(response.data)
                             })
                             .catch(error => {
                                 this.parseStatusInfo(info)
                             })
                     }, this.delay);
 
                     this.delay += 1000;
                 }
             },
             statusRefresh() {
                 clearTimeout(window.infoRequest)
 
                 axios.get(this.getUrl() + '?refresh=1')
                     .then(response => {
                         this.$toast[response.data.status](response.data.message)
                         this.parseStatusInfo(response.data)
                         this.emitEvent(response.data)
                     })
                     .catch(error => {
                         this.parseStatusInfo(this.state)
                     })
             },
             confirmDomain() {
                 axios.get('/api/v4/domains/' + this.$route.params.domain + '/confirm')
                     .then(response => {
                         if (response.data.message) {
                             this.$toast[response.data.status](response.data.message)
                         }
 
                         if (response.data.status == 'success') {
                             this.parseStatusInfo(response.data.statusInfo)
                             response.data.isConfirmed = true
                             this.emitEvent(response.data)
                         }
                     })
             },
             emitEvent(data) {
                 // Remove useless data and emit the event (to parent components)
                 delete data.status
                 delete data.message
                 this.$emit('status-update', data)
             },
             getUrl() {
                 let url
 
                 switch (this.scope) {
                     case 'dashboard':
                         url = '/api/v4/users/' + this.$store.state.authInfo.id + '/status'
                         break
                     case 'domain':
                         url = '/api/v4/domains/' + this.$route.params.domain + '/status'
                         break
+                    case 'distlist':
+                        url = '/api/v4/groups/' + this.$route.params.list + '/status'
+                        break
                     default:
                         url = '/api/v4/users/' + this.$route.params.user + '/status'
                 }
 
                 return url
             }
         }
     }
 </script>
diff --git a/src/routes/api.php b/src/routes/api.php
index b9c906dc..32210bce 100644
--- a/src/routes/api.php
+++ b/src/routes/api.php
@@ -1,166 +1,170 @@
 <?php
 
 use Illuminate\Http\Request;
 
 /*
 |--------------------------------------------------------------------------
 | API Routes
 |--------------------------------------------------------------------------
 |
 | Here is where you can register API routes for your application. These
 | routes are loaded by the RouteServiceProvider within a group which
 | is assigned the "api" middleware group. Enjoy building your API!
 |
 */
 
 $prefix = \trim(\parse_url(\config('app.url'), PHP_URL_PATH), '/') . '/';
 
 Route::group(
     [
         'middleware' => 'api',
         'prefix' => $prefix . 'api/auth'
     ],
     function ($router) {
         Route::post('login', 'API\AuthController@login');
 
         Route::group(
             ['middleware' => 'auth:api'],
             function ($router) {
                 Route::get('info', 'API\AuthController@info');
                 Route::post('logout', 'API\AuthController@logout');
                 Route::post('refresh', 'API\AuthController@refresh');
             }
         );
     }
 );
 
 Route::group(
     [
         'domain' => \config('app.domain'),
         'middleware' => 'api',
         'prefix' => $prefix . 'api/auth'
     ],
     function ($router) {
         Route::post('password-reset/init', 'API\PasswordResetController@init');
         Route::post('password-reset/verify', 'API\PasswordResetController@verify');
         Route::post('password-reset', 'API\PasswordResetController@reset');
 
         Route::get('signup/plans', 'API\SignupController@plans');
         Route::post('signup/init', 'API\SignupController@init');
         Route::post('signup/verify', 'API\SignupController@verify');
         Route::post('signup', 'API\SignupController@signup');
     }
 );
 
 Route::group(
     [
         'domain' => \config('app.domain'),
         'middleware' => 'auth:api',
         'prefix' => $prefix . 'api/v4'
     ],
     function () {
         Route::apiResource('domains', API\V4\DomainsController::class);
         Route::get('domains/{id}/confirm', 'API\V4\DomainsController@confirm');
         Route::get('domains/{id}/status', 'API\V4\DomainsController@status');
 
+        Route::apiResource('groups', API\V4\GroupsController::class);
+        Route::get('groups/{id}/status', 'API\V4\GroupsController@status');
+
         Route::apiResource('entitlements', API\V4\EntitlementsController::class);
         Route::apiResource('packages', API\V4\PackagesController::class);
         Route::apiResource('skus', API\V4\SkusController::class);
+
         Route::apiResource('users', API\V4\UsersController::class);
         Route::get('users/{id}/skus', 'API\V4\SkusController@userSkus');
         Route::get('users/{id}/status', 'API\V4\UsersController@status');
 
         Route::apiResource('wallets', API\V4\WalletsController::class);
         Route::get('wallets/{id}/transactions', 'API\V4\WalletsController@transactions');
         Route::get('wallets/{id}/receipts', 'API\V4\WalletsController@receipts');
         Route::get('wallets/{id}/receipts/{receipt}', 'API\V4\WalletsController@receiptDownload');
 
         Route::post('payments', 'API\V4\PaymentsController@store');
         //Route::delete('payments', 'API\V4\PaymentsController@cancel');
         Route::get('payments/mandate', 'API\V4\PaymentsController@mandate');
         Route::post('payments/mandate', 'API\V4\PaymentsController@mandateCreate');
         Route::put('payments/mandate', 'API\V4\PaymentsController@mandateUpdate');
         Route::delete('payments/mandate', 'API\V4\PaymentsController@mandateDelete');
         Route::get('payments/methods', 'API\V4\PaymentsController@paymentMethods');
         Route::get('payments/pending', 'API\V4\PaymentsController@payments');
         Route::get('payments/has-pending', 'API\V4\PaymentsController@hasPayments');
 
         Route::get('openvidu/rooms', 'API\V4\OpenViduController@index');
         Route::post('openvidu/rooms/{id}/close', 'API\V4\OpenViduController@closeRoom');
         Route::post('openvidu/rooms/{id}/config', 'API\V4\OpenViduController@setRoomConfig');
 
         // FIXME: I'm not sure about this one, should we use DELETE request maybe?
         Route::post('openvidu/rooms/{id}/connections/{conn}/dismiss', 'API\V4\OpenViduController@dismissConnection');
         Route::put('openvidu/rooms/{id}/connections/{conn}', 'API\V4\OpenViduController@updateConnection');
         Route::post('openvidu/rooms/{id}/request/{reqid}/accept', 'API\V4\OpenViduController@acceptJoinRequest');
         Route::post('openvidu/rooms/{id}/request/{reqid}/deny', 'API\V4\OpenViduController@denyJoinRequest');
     }
 );
 
 // Note: In Laravel 7.x we could just use withoutMiddleware() instead of a separate group
 Route::group(
     [
         'domain' => \config('app.domain'),
         'prefix' => $prefix . 'api/v4'
     ],
     function () {
         Route::post('openvidu/rooms/{id}', 'API\V4\OpenViduController@joinRoom');
         Route::post('openvidu/rooms/{id}/connections', 'API\V4\OpenViduController@createConnection');
         // FIXME: I'm not sure about this one, should we use DELETE request maybe?
         Route::post('openvidu/rooms/{id}/connections/{conn}/dismiss', 'API\V4\OpenViduController@dismissConnection');
         Route::put('openvidu/rooms/{id}/connections/{conn}', 'API\V4\OpenViduController@updateConnection');
         Route::post('openvidu/rooms/{id}/request/{reqid}/accept', 'API\V4\OpenViduController@acceptJoinRequest');
         Route::post('openvidu/rooms/{id}/request/{reqid}/deny', 'API\V4\OpenViduController@denyJoinRequest');
     }
 );
 
 Route::group(
     [
         'domain' => \config('app.domain'),
         'middleware' => 'api',
         'prefix' => $prefix . 'api/v4'
     ],
     function ($router) {
         Route::post('support/request', 'API\V4\SupportController@request');
     }
 );
 
 Route::group(
     [
         'domain' => \config('app.domain'),
         'prefix' => $prefix . 'api/webhooks',
     ],
     function () {
         Route::post('payment/{provider}', 'API\V4\PaymentsController@webhook');
         Route::post('meet/openvidu', 'API\V4\OpenViduController@webhook');
     }
 );
 
 Route::group(
     [
         'domain' => 'admin.' . \config('app.domain'),
         'middleware' => ['auth:api', 'admin'],
         'prefix' => $prefix . 'api/v4',
     ],
     function () {
         Route::apiResource('domains', API\V4\Admin\DomainsController::class);
         Route::get('domains/{id}/confirm', 'API\V4\Admin\DomainsController@confirm');
         Route::post('domains/{id}/suspend', 'API\V4\Admin\DomainsController@suspend');
         Route::post('domains/{id}/unsuspend', 'API\V4\Admin\DomainsController@unsuspend');
 
         Route::apiResource('entitlements', API\V4\Admin\EntitlementsController::class);
         Route::apiResource('packages', API\V4\Admin\PackagesController::class);
         Route::apiResource('skus', API\V4\Admin\SkusController::class);
         Route::apiResource('users', API\V4\Admin\UsersController::class);
         Route::post('users/{id}/reset2FA', 'API\V4\Admin\UsersController@reset2FA');
         Route::get('users/{id}/skus', 'API\V4\Admin\SkusController@userSkus');
         Route::post('users/{id}/suspend', 'API\V4\Admin\UsersController@suspend');
         Route::post('users/{id}/unsuspend', 'API\V4\Admin\UsersController@unsuspend');
         Route::apiResource('wallets', API\V4\Admin\WalletsController::class);
         Route::post('wallets/{id}/one-off', 'API\V4\Admin\WalletsController@oneOff');
         Route::get('wallets/{id}/transactions', 'API\V4\Admin\WalletsController@transactions');
         Route::apiResource('discounts', API\V4\Admin\DiscountsController::class);
 
         Route::get('stats/chart/{chart}', 'API\V4\Admin\StatsController@chart');
     }
 );
diff --git a/src/tests/Browser/DistlistTest.php b/src/tests/Browser/DistlistTest.php
new file mode 100644
index 00000000..2a83ff22
--- /dev/null
+++ b/src/tests/Browser/DistlistTest.php
@@ -0,0 +1,266 @@
+<?php
+
+namespace Tests\Browser;
+
+use App\Group;
+use App\Sku;
+use Tests\Browser;
+use Tests\Browser\Components\ListInput;
+use Tests\Browser\Components\Status;
+use Tests\Browser\Components\Toast;
+use Tests\Browser\Pages\Dashboard;
+use Tests\Browser\Pages\Home;
+use Tests\Browser\Pages\DistlistInfo;
+use Tests\Browser\Pages\DistlistList;
+use Tests\TestCaseDusk;
+
+class DistlistTest extends TestCaseDusk
+{
+    /**
+     * {@inheritDoc}
+     */
+    public function setUp(): void
+    {
+        parent::setUp();
+
+        $this->deleteTestGroup('group-test@kolab.org');
+        $this->clearBetaEntitlements();
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public function tearDown(): void
+    {
+        $this->deleteTestGroup('group-test@kolab.org');
+        $this->clearBetaEntitlements();
+
+        parent::tearDown();
+    }
+
+    /**
+     * Test distlist info page (unauthenticated)
+     */
+    public function testInfoUnauth(): void
+    {
+        // Test that the page requires authentication
+        $this->browse(function (Browser $browser) {
+            $browser->visit('/distlist/abc')->on(new Home());
+        });
+    }
+
+    /**
+     * Test distlist list page (unauthenticated)
+     */
+    public function testListUnauth(): void
+    {
+        // Test that the page requires authentication
+        $this->browse(function (Browser $browser) {
+            $browser->visit('/distlists')->on(new Home());
+        });
+    }
+
+    /**
+     * Test distlist list page
+     */
+    public function testList(): void
+    {
+        // Log on the user
+        $this->browse(function (Browser $browser) {
+            $browser->visit(new Home())
+                ->submitLogon('john@kolab.org', 'simple123', true)
+                ->on(new Dashboard())
+                ->assertMissing('@links .link-distlists');
+        });
+
+        // Test that Distribution lists page is not accessible without the 'distlist' entitlement
+        $this->browse(function (Browser $browser) {
+            $browser->visit('/distlists')
+                ->assertErrorPage(404);
+        });
+
+        // Create a single group, add beta+distlist entitlements
+        $john = $this->getTestUser('john@kolab.org');
+        $this->addDistlistEntitlement($john);
+        $group = $this->getTestGroup('group-test@kolab.org');
+        $group->assignToWallet($john->wallets->first());
+
+        // Test distribution lists page
+        $this->browse(function (Browser $browser) {
+            $browser->visit(new Dashboard())
+                ->assertSeeIn('@links .link-distlists', 'Distribution lists')
+                ->click('@links .link-distlists')
+                ->on(new DistlistList())
+                ->whenAvailable('@table', function (Browser $browser) {
+                    $browser->waitFor('tbody tr')
+                        ->assertElementsCount('tbody tr', 1)
+                        ->assertSeeIn('tbody tr:nth-child(1) a', 'group-test@kolab.org')
+                        ->assertText('tbody tr:nth-child(1) svg.text-danger title', 'Not Ready')
+                        ->assertMissing('tfoot');
+                });
+        });
+    }
+
+    /**
+     * Test distlist creation/editing/deleting
+     *
+     * @depends testList
+     */
+    public function testCreateUpdateDelete(): void
+    {
+        // Test that the page is not available accessible without the 'distlist' entitlement
+        $this->browse(function (Browser $browser) {
+            $browser->visit('/distlist/new')
+                ->assertErrorPage(404);
+        });
+
+        // Add beta+distlist entitlements
+        $john = $this->getTestUser('john@kolab.org');
+        $this->addDistlistEntitlement($john);
+
+        $this->browse(function (Browser $browser) {
+            // Create a group
+            $browser->visit(new DistlistList())
+                ->assertSeeIn('button.create-list', 'Create list')
+                ->click('button.create-list')
+                ->on(new DistlistInfo())
+                ->assertSeeIn('#distlist-info .card-title', 'New distribution list')
+                ->with('@form', function (Browser $browser) {
+                    // Assert form content
+                    $browser->assertMissing('#status')
+                        ->assertSeeIn('div.row:nth-child(1) label', 'Email')
+                        ->assertValue('div.row:nth-child(1) input[type=text]', '')
+                        ->assertSeeIn('div.row:nth-child(2) label', 'Recipients')
+                        ->assertVisible('div.row:nth-child(2) .list-input')
+                        ->with(new ListInput('#members'), function (Browser $browser) {
+                            $browser->assertListInputValue([])
+                                ->assertValue('@input', '');
+                        })
+                        ->assertSeeIn('button[type=submit]', 'Submit');
+                })
+                // Test error conditions
+                ->type('#email', 'group-test@kolabnow.com')
+                ->click('button[type=submit]')
+                ->waitFor('#email + .invalid-feedback')
+                ->assertSeeIn('#email + .invalid-feedback', 'The specified domain is not available.')
+                ->assertFocused('#email')
+                ->waitFor('#members + .invalid-feedback')
+                ->assertSeeIn('#members + .invalid-feedback', 'At least one recipient is required.')
+                ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
+                // Test successful group creation
+                ->type('#email', 'group-test@kolab.org')
+                ->with(new ListInput('#members'), function (Browser $browser) {
+                    $browser->addListEntry('test1@gmail.com')
+                        ->addListEntry('test2@gmail.com');
+                })
+                ->click('button[type=submit]')
+                ->assertToast(Toast::TYPE_SUCCESS, 'Distribution list created successfully.')
+                ->on(new DistlistList())
+                ->assertElementsCount('@table tbody tr', 1);
+
+            // Test group update
+            $browser->click('@table tr:nth-child(1) a')
+                ->on(new DistlistInfo())
+                ->assertSeeIn('#distlist-info .card-title', 'Distribution list')
+                ->with('@form', function (Browser $browser) {
+                    // Assert form content
+                    $browser->assertSeeIn('div.row:nth-child(1) label', 'Status')
+                        ->assertSeeIn('div.row:nth-child(1) span.text-danger', 'Not Ready')
+                        ->assertSeeIn('div.row:nth-child(2) label', 'Email')
+                        ->assertValue('div.row:nth-child(2) input[type=text]:disabled', 'group-test@kolab.org')
+                        ->assertSeeIn('div.row:nth-child(3) label', 'Recipients')
+                        ->assertVisible('div.row:nth-child(3) .list-input')
+                        ->with(new ListInput('#members'), function (Browser $browser) {
+                            $browser->assertListInputValue(['test1@gmail.com', 'test2@gmail.com'])
+                                ->assertValue('@input', '');
+                        })
+                        ->assertSeeIn('button[type=submit]', 'Submit');
+                })
+                // Test error handling
+                ->with(new ListInput('#members'), function (Browser $browser) {
+                    $browser->addListEntry('invalid address');
+                })
+                ->click('button[type=submit]')
+                ->waitFor('#members + .invalid-feedback')
+                ->assertSeeIn('#members + .invalid-feedback', 'The specified email address is invalid.')
+                ->assertVisible('#members .input-group:nth-child(4) input.is-invalid')
+                ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
+                // Test successful update
+                ->with(new ListInput('#members'), function (Browser $browser) {
+                    $browser->removeListEntry(3)->removeListEntry(2);
+                })
+                ->click('button[type=submit]')
+                ->assertToast(Toast::TYPE_SUCCESS, 'Distribution list updated successfully.')
+                ->assertMissing('.invalid-feedback')
+                ->on(new DistlistList())
+                ->assertElementsCount('@table tbody tr', 1);
+
+            $group = Group::where('email', 'group-test@kolab.org')->first();
+            $this->assertSame(['test1@gmail.com'], $group->members);
+
+            // Test group deletion
+            $browser->click('@table tr:nth-child(1) a')
+                ->on(new DistlistInfo())
+                ->assertSeeIn('button.button-delete', 'Delete list')
+                ->click('button.button-delete')
+                ->assertToast(Toast::TYPE_SUCCESS, 'Distribution list deleted successfully.')
+                ->on(new DistlistList())
+                ->assertElementsCount('@table tbody tr', 0)
+                ->assertVisible('@table tfoot');
+
+            $this->assertNull(Group::where('email', 'group-test@kolab.org')->first());
+        });
+    }
+
+    /**
+     * Test distribution list status
+     *
+     * @depends testList
+     */
+    public function testStatus(): void
+    {
+        $john = $this->getTestUser('john@kolab.org');
+        $this->addDistlistEntitlement($john);
+        $group = $this->getTestGroup('group-test@kolab.org');
+        $group->assignToWallet($john->wallets->first());
+        $group->status = Group::STATUS_NEW | Group::STATUS_ACTIVE;
+        $group->save();
+
+        $this->assertFalse($group->isLdapReady());
+
+        $this->browse(function ($browser) use ($group) {
+            // Test auto-refresh
+            $browser->visit('/distlist/' . $group->id)
+                ->on(new DistlistInfo())
+                ->with(new Status(), function ($browser) {
+                    $browser->assertSeeIn('@body', 'We are preparing the distribution list')
+                        ->assertProgress(83, 'Creating a distribution list...', 'pending')
+                        ->assertMissing('@refresh-button')
+                        ->assertMissing('@refresh-text')
+                        ->assertMissing('#status-link')
+                        ->assertMissing('#status-verify');
+                });
+
+            $group->status |= Group::STATUS_LDAP_READY;
+            $group->save();
+
+            // Test Verify button
+            $browser->waitUntilMissing('@status', 10);
+        });
+
+        // TODO: Test all group statuses on the list
+    }
+
+
+    /**
+     * Register the beta + distlist entitlements for the user
+     */
+    private function addDistlistEntitlement($user): void
+    {
+        // Add beta+distlist entitlements
+        $beta_sku = Sku::where('title', 'beta')->first();
+        $distlist_sku = Sku::where('title', 'distlist')->first();
+        $user->assignSku($beta_sku);
+        $user->assignSku($distlist_sku);
+    }
+}
diff --git a/src/tests/Browser/Pages/DistlistInfo.php b/src/tests/Browser/Pages/DistlistInfo.php
new file mode 100644
index 00000000..0e38643b
--- /dev/null
+++ b/src/tests/Browser/Pages/DistlistInfo.php
@@ -0,0 +1,45 @@
+<?php
+
+namespace Tests\Browser\Pages;
+
+use Laravel\Dusk\Page;
+
+class DistlistInfo extends Page
+{
+    /**
+     * Get the URL for the page.
+     *
+     * @return string
+     */
+    public function url(): string
+    {
+        return '';
+    }
+
+    /**
+     * Assert that the browser is on the page.
+     *
+     * @param \Laravel\Dusk\Browser $browser The browser object
+     *
+     * @return void
+     */
+    public function assert($browser)
+    {
+        $browser->waitFor('@form')
+            ->waitUntilMissing('.app-loader');
+    }
+
+    /**
+     * Get the element shortcuts for the page.
+     *
+     * @return array
+     */
+    public function elements(): array
+    {
+        return [
+            '@app' => '#app',
+            '@form' => '#distlist-info form',
+            '@status' => '#status-box',
+        ];
+    }
+}
diff --git a/src/tests/Browser/Pages/DistlistList.php b/src/tests/Browser/Pages/DistlistList.php
new file mode 100644
index 00000000..73c7a472
--- /dev/null
+++ b/src/tests/Browser/Pages/DistlistList.php
@@ -0,0 +1,45 @@
+<?php
+
+namespace Tests\Browser\Pages;
+
+use Laravel\Dusk\Page;
+
+class DistlistList extends Page
+{
+    /**
+     * Get the URL for the page.
+     *
+     * @return string
+     */
+    public function url(): string
+    {
+        return '/distlists';
+    }
+
+    /**
+     * Assert that the browser is on the page.
+     *
+     * @param \Laravel\Dusk\Browser $browser The browser object
+     *
+     * @return void
+     */
+    public function assert($browser)
+    {
+        $browser->assertPathIs($this->url())
+            ->waitUntilMissing('@app .app-loader')
+            ->assertSeeIn('#distlist-list .card-title', 'Distribution lists');
+    }
+
+    /**
+     * Get the element shortcuts for the page.
+     *
+     * @return array
+     */
+    public function elements(): array
+    {
+        return [
+            '@app' => '#app',
+            '@table' => '#distlist-list table',
+        ];
+    }
+}
diff --git a/src/tests/Browser/UsersTest.php b/src/tests/Browser/UsersTest.php
index a2d2cc32..86aff858 100644
--- a/src/tests/Browser/UsersTest.php
+++ b/src/tests/Browser/UsersTest.php
@@ -1,705 +1,716 @@
 <?php
 
 namespace Tests\Browser;
 
 use App\Discount;
 use App\Entitlement;
 use App\Sku;
 use App\User;
 use App\UserAlias;
 use Tests\Browser;
 use Tests\Browser\Components\Dialog;
 use Tests\Browser\Components\ListInput;
 use Tests\Browser\Components\QuotaInput;
 use Tests\Browser\Components\Toast;
 use Tests\Browser\Pages\Dashboard;
 use Tests\Browser\Pages\Home;
 use Tests\Browser\Pages\UserInfo;
 use Tests\Browser\Pages\UserList;
 use Tests\TestCaseDusk;
 use Illuminate\Foundation\Testing\DatabaseMigrations;
 
 class UsersTest extends TestCaseDusk
 {
     private $profile = [
         'first_name' => 'John',
         'last_name' => 'Doe',
         'organization' => 'Kolab Developers',
     ];
 
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('julia.roberts@kolab.org');
 
         $john = User::where('email', 'john@kolab.org')->first();
         $john->setSettings($this->profile);
         UserAlias::where('user_id', $john->id)
             ->where('alias', 'john.test@kolab.org')->delete();
 
         Entitlement::where('entitleable_id', $john->id)->whereIn('cost', [25, 100])->delete();
         Entitlement::where('cost', '>=', 5000)->delete();
 
         $wallet = $john->wallets()->first();
         $wallet->discount()->dissociate();
         $wallet->save();
 
         $this->clearBetaEntitlements();
         $this->clearMeetEntitlements();
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser('julia.roberts@kolab.org');
 
         $john = User::where('email', 'john@kolab.org')->first();
         $john->setSettings($this->profile);
         UserAlias::where('user_id', $john->id)
             ->where('alias', 'john.test@kolab.org')->delete();
 
         Entitlement::where('entitleable_id', $john->id)->whereIn('cost', [25, 100])->delete();
         Entitlement::where('cost', '>=', 5000)->delete();
 
         $wallet = $john->wallets()->first();
         $wallet->discount()->dissociate();
         $wallet->save();
 
         $this->clearBetaEntitlements();
         $this->clearMeetEntitlements();
 
         parent::tearDown();
     }
 
     /**
      * Test user info page (unauthenticated)
      */
     public function testInfoUnauth(): void
     {
         // Test that the page requires authentication
         $this->browse(function (Browser $browser) {
             $user = User::where('email', 'john@kolab.org')->first();
 
             $browser->visit('/user/' . $user->id)->on(new Home());
         });
     }
 
     /**
      * Test users list page (unauthenticated)
      */
     public function testListUnauth(): void
     {
         // Test that the page requires authentication
         $this->browse(function (Browser $browser) {
             $browser->visit('/users')->on(new Home());
         });
     }
 
     /**
      * Test users list page
      */
     public function testList(): void
     {
         // Test that the page requires authentication
         $this->browse(function (Browser $browser) {
             $browser->visit(new Home())
                 ->submitLogon('john@kolab.org', 'simple123', true)
                 ->on(new Dashboard())
                 ->assertSeeIn('@links .link-users', 'User accounts')
                 ->click('@links .link-users')
                 ->on(new UserList())
                 ->whenAvailable('@table', function (Browser $browser) {
                     $browser->waitFor('tbody tr')
                         ->assertElementsCount('tbody tr', 4)
                         ->assertSeeIn('tbody tr:nth-child(1) a', 'jack@kolab.org')
                         ->assertSeeIn('tbody tr:nth-child(2) a', 'joe@kolab.org')
                         ->assertSeeIn('tbody tr:nth-child(3) a', 'john@kolab.org')
                         ->assertSeeIn('tbody tr:nth-child(4) a', 'ned@kolab.org')
                         ->assertMissing('tfoot');
                 });
         });
     }
 
     /**
      * Test user account editing page (not profile page)
      *
      * @depends testList
      */
     public function testInfo(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->on(new UserList())
                 ->click('@table tr:nth-child(3) a')
                 ->on(new UserInfo())
                 ->assertSeeIn('#user-info .card-title', 'User account')
                 ->with('@form', function (Browser $browser) {
                     // Assert form content
                     $browser->assertSeeIn('div.row:nth-child(1) label', 'Status')
                         ->assertSeeIn('div.row:nth-child(1) #status', 'Active')
                         ->assertFocused('div.row:nth-child(2) input')
                         ->assertSeeIn('div.row:nth-child(2) label', 'First name')
                         ->assertValue('div.row:nth-child(2) input[type=text]', $this->profile['first_name'])
                         ->assertSeeIn('div.row:nth-child(3) label', 'Last name')
                         ->assertValue('div.row:nth-child(3) input[type=text]', $this->profile['last_name'])
                         ->assertSeeIn('div.row:nth-child(4) label', 'Organization')
                         ->assertValue('div.row:nth-child(4) input[type=text]', $this->profile['organization'])
                         ->assertSeeIn('div.row:nth-child(5) label', 'Email')
                         ->assertValue('div.row:nth-child(5) input[type=text]', 'john@kolab.org')
                         ->assertDisabled('div.row:nth-child(5) input[type=text]')
                         ->assertSeeIn('div.row:nth-child(6) label', 'Email aliases')
                         ->assertVisible('div.row:nth-child(6) .list-input')
                         ->with(new ListInput('#aliases'), function (Browser $browser) {
                             $browser->assertListInputValue(['john.doe@kolab.org'])
                                 ->assertValue('@input', '');
                         })
                         ->assertSeeIn('div.row:nth-child(7) label', 'Password')
                         ->assertValue('div.row:nth-child(7) input[type=password]', '')
                         ->assertSeeIn('div.row:nth-child(8) label', 'Confirm password')
                         ->assertValue('div.row:nth-child(8) input[type=password]', '')
                         ->assertSeeIn('button[type=submit]', 'Submit')
                         // Clear some fields and submit
                         ->vueClear('#first_name')
                         ->vueClear('#last_name')
                         ->click('button[type=submit]');
                 })
                 ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.')
                 ->on(new UserList())
                 ->click('@table tr:nth-child(3) a')
                 ->on(new UserInfo())
                 ->assertSeeIn('#user-info .card-title', 'User account')
                 ->with('@form', function (Browser $browser) {
                     // Test error handling (password)
                     $browser->type('#password', 'aaaaaa')
                         ->vueClear('#password_confirmation')
                         ->click('button[type=submit]')
                         ->waitFor('#password + .invalid-feedback')
                         ->assertSeeIn('#password + .invalid-feedback', 'The password confirmation does not match.')
                         ->assertFocused('#password')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
 
                     // TODO: Test password change
 
                     // Test form error handling (aliases)
                     $browser->vueClear('#password')
                         ->vueClear('#password_confirmation')
                         ->with(new ListInput('#aliases'), function (Browser $browser) {
                             $browser->addListEntry('invalid address');
                         })
                         ->click('button[type=submit]')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
 
                     $browser->with(new ListInput('#aliases'), function (Browser $browser) {
                         $browser->assertFormError(2, 'The specified alias is invalid.', false);
                     });
 
                     // Test adding aliases
                     $browser->with(new ListInput('#aliases'), function (Browser $browser) {
                         $browser->removeListEntry(2)
                             ->addListEntry('john.test@kolab.org');
                     })
                         ->click('button[type=submit]')
                         ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');
                 })
                 ->on(new UserList())
                 ->click('@table tr:nth-child(3) a')
                 ->on(new UserInfo());
 
             $john = User::where('email', 'john@kolab.org')->first();
             $alias = UserAlias::where('user_id', $john->id)->where('alias', 'john.test@kolab.org')->first();
             $this->assertTrue(!empty($alias));
 
             // Test subscriptions
             $browser->with('@form', function (Browser $browser) {
                 $browser->assertSeeIn('div.row:nth-child(9) label', 'Subscriptions')
                     ->assertVisible('@skus.row:nth-child(9)')
                     ->with('@skus', function ($browser) {
                         $browser->assertElementsCount('tbody tr', 6)
                             // Mailbox SKU
                             ->assertSeeIn('tbody tr:nth-child(1) td.name', 'User Mailbox')
                             ->assertSeeIn('tbody tr:nth-child(1) td.price', '4,44 CHF/month')
                             ->assertChecked('tbody tr:nth-child(1) td.selection input')
                             ->assertDisabled('tbody tr:nth-child(1) td.selection input')
                             ->assertTip(
                                 'tbody tr:nth-child(1) td.buttons button',
                                 'Just a mailbox'
                             )
                             // Storage SKU
                             ->assertSeeIn('tbody tr:nth-child(2) td.name', 'Storage Quota')
                             ->assertSeeIn('tr:nth-child(2) td.price', '0,00 CHF/month')
                             ->assertChecked('tbody tr:nth-child(2) td.selection input')
                             ->assertDisabled('tbody tr:nth-child(2) td.selection input')
                             ->assertTip(
                                 'tbody tr:nth-child(2) td.buttons button',
                                 'Some wiggle room'
                             )
                             ->with(new QuotaInput('tbody tr:nth-child(2) .range-input'), function ($browser) {
                                 $browser->assertQuotaValue(2)->setQuotaValue(3);
                             })
                             ->assertSeeIn('tr:nth-child(2) td.price', '0,25 CHF/month')
                             // groupware SKU
                             ->assertSeeIn('tbody tr:nth-child(3) td.name', 'Groupware Features')
                             ->assertSeeIn('tbody tr:nth-child(3) td.price', '5,55 CHF/month')
                             ->assertChecked('tbody tr:nth-child(3) td.selection input')
                             ->assertEnabled('tbody tr:nth-child(3) td.selection input')
                             ->assertTip(
                                 'tbody tr:nth-child(3) td.buttons button',
                                 'Groupware functions like Calendar, Tasks, Notes, etc.'
                             )
                             // ActiveSync SKU
                             ->assertSeeIn('tbody tr:nth-child(4) td.name', 'Activesync')
                             ->assertSeeIn('tbody tr:nth-child(4) td.price', '1,00 CHF/month')
                             ->assertNotChecked('tbody tr:nth-child(4) td.selection input')
                             ->assertEnabled('tbody tr:nth-child(4) td.selection input')
                             ->assertTip(
                                 'tbody tr:nth-child(4) td.buttons button',
                                 'Mobile synchronization'
                             )
                             // 2FA SKU
                             ->assertSeeIn('tbody tr:nth-child(5) td.name', '2-Factor Authentication')
                             ->assertSeeIn('tbody tr:nth-child(5) td.price', '0,00 CHF/month')
                             ->assertNotChecked('tbody tr:nth-child(5) td.selection input')
                             ->assertEnabled('tbody tr:nth-child(5) td.selection input')
                             ->assertTip(
                                 'tbody tr:nth-child(5) td.buttons button',
                                 'Two factor authentication for webmail and administration panel'
                             )
                             // Meet SKU
                             ->assertSeeIn('tbody tr:nth-child(6) td.name', 'Voice & Video Conferencing (public beta)')
                             ->assertSeeIn('tbody tr:nth-child(6) td.price', '0,00 CHF/month')
                             ->assertNotChecked('tbody tr:nth-child(6) td.selection input')
                             ->assertEnabled('tbody tr:nth-child(6) td.selection input')
                             ->assertTip(
                                 'tbody tr:nth-child(6) td.buttons button',
                                 'Video conferencing tool'
                             )
                             ->click('tbody tr:nth-child(4) td.selection input');
                     })
                     ->assertMissing('@skus table + .hint')
                     ->click('button[type=submit]')
                     ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');
             })
                 ->on(new UserList())
                 ->click('@table tr:nth-child(3) a')
                 ->on(new UserInfo());
 
             $expected = ['activesync', 'groupware', 'mailbox', 'storage', 'storage', 'storage'];
             $this->assertUserEntitlements($john, $expected);
 
             // Test subscriptions interaction
             $browser->with('@form', function (Browser $browser) {
                 $browser->with('@skus', function ($browser) {
                     // Uncheck 'groupware', expect activesync unchecked
                     $browser->click('#sku-input-groupware')
                         ->assertNotChecked('#sku-input-groupware')
                         ->assertNotChecked('#sku-input-activesync')
                         ->assertEnabled('#sku-input-activesync')
                         ->assertNotReadonly('#sku-input-activesync')
                         // Check 'activesync', expect an alert
                         ->click('#sku-input-activesync')
                         ->assertDialogOpened('Activesync requires Groupware Features.')
                         ->acceptDialog()
                         ->assertNotChecked('#sku-input-activesync')
                         // Check 'meet', expect an alert
                         ->click('#sku-input-meet')
                         ->assertDialogOpened('Voice & Video Conferencing (public beta) requires Groupware Features.')
                         ->acceptDialog()
                         ->assertNotChecked('#sku-input-meet')
                         // Check '2FA', expect 'activesync' unchecked and readonly
                         ->click('#sku-input-2fa')
                         ->assertChecked('#sku-input-2fa')
                         ->assertNotChecked('#sku-input-activesync')
                         ->assertReadonly('#sku-input-activesync')
                         // Uncheck '2FA'
                         ->click('#sku-input-2fa')
                         ->assertNotChecked('#sku-input-2fa')
                         ->assertNotReadonly('#sku-input-activesync');
                 });
             });
         });
     }
 
     /**
      * Test user adding page
      *
      * @depends testList
      */
     public function testNewUser(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->visit(new UserList())
                 ->assertSeeIn('button.create-user', 'Create user')
                 ->click('button.create-user')
                 ->on(new UserInfo())
                 ->assertSeeIn('#user-info .card-title', 'New user account')
                 ->with('@form', function (Browser $browser) {
                     // Assert form content
                     $browser->assertFocused('div.row:nth-child(1) input')
                         ->assertSeeIn('div.row:nth-child(1) label', 'First name')
                         ->assertValue('div.row:nth-child(1) input[type=text]', '')
                         ->assertSeeIn('div.row:nth-child(2) label', 'Last name')
                         ->assertValue('div.row:nth-child(2) input[type=text]', '')
                         ->assertSeeIn('div.row:nth-child(3) label', 'Organization')
                         ->assertValue('div.row:nth-child(3) input[type=text]', '')
                         ->assertSeeIn('div.row:nth-child(4) label', 'Email')
                         ->assertValue('div.row:nth-child(4) input[type=text]', '')
                         ->assertEnabled('div.row:nth-child(4) input[type=text]')
                         ->assertSeeIn('div.row:nth-child(5) label', 'Email aliases')
                         ->assertVisible('div.row:nth-child(5) .list-input')
                         ->with(new ListInput('#aliases'), function (Browser $browser) {
                             $browser->assertListInputValue([])
                                 ->assertValue('@input', '');
                         })
                         ->assertSeeIn('div.row:nth-child(6) label', 'Password')
                         ->assertValue('div.row:nth-child(6) input[type=password]', '')
                         ->assertSeeIn('div.row:nth-child(7) label', 'Confirm password')
                         ->assertValue('div.row:nth-child(7) input[type=password]', '')
                         ->assertSeeIn('div.row:nth-child(8) label', 'Package')
                         // assert packages list widget, select "Lite Account"
                         ->with('@packages', function ($browser) {
                             $browser->assertElementsCount('tbody tr', 2)
                                 ->assertSeeIn('tbody tr:nth-child(1)', 'Groupware Account')
                                 ->assertSeeIn('tbody tr:nth-child(2)', 'Lite Account')
                                 ->assertSeeIn('tbody tr:nth-child(1) .price', '9,99 CHF/month')
                                 ->assertSeeIn('tbody tr:nth-child(2) .price', '4,44 CHF/month')
                                 ->assertChecked('tbody tr:nth-child(1) input')
                                 ->click('tbody tr:nth-child(2) input')
                                 ->assertNotChecked('tbody tr:nth-child(1) input')
                                 ->assertChecked('tbody tr:nth-child(2) input');
                         })
                         ->assertMissing('@packages table + .hint')
                         ->assertSeeIn('button[type=submit]', 'Submit');
 
                     // Test browser-side required fields and error handling
                     $browser->click('button[type=submit]')
                         ->assertFocused('#email')
                         ->type('#email', 'invalid email')
                         ->click('button[type=submit]')
                         ->assertFocused('#password')
                         ->type('#password', 'simple123')
                         ->click('button[type=submit]')
                         ->assertFocused('#password_confirmation')
                         ->type('#password_confirmation', 'simple')
                         ->click('button[type=submit]')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                         ->assertSeeIn('#email + .invalid-feedback', 'The specified email is invalid.')
                         ->assertSeeIn('#password + .invalid-feedback', 'The password confirmation does not match.');
                 });
 
             // Test form error handling (aliases)
             $browser->with('@form', function (Browser $browser) {
                 $browser->type('#email', 'julia.roberts@kolab.org')
                     ->type('#password_confirmation', 'simple123')
                     ->with(new ListInput('#aliases'), function (Browser $browser) {
                         $browser->addListEntry('invalid address');
                     })
                     ->click('button[type=submit]')
                     ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                     ->with(new ListInput('#aliases'), function (Browser $browser) {
                         $browser->assertFormError(1, 'The specified alias is invalid.', false);
                     });
             });
 
             // Successful account creation
             $browser->with('@form', function (Browser $browser) {
                 $browser->type('#first_name', 'Julia')
                     ->type('#last_name', 'Roberts')
                     ->type('#organization', 'Test Org')
                     ->with(new ListInput('#aliases'), function (Browser $browser) {
                         $browser->removeListEntry(1)
                             ->addListEntry('julia.roberts2@kolab.org');
                     })
                     ->click('button[type=submit]');
             })
             ->assertToast(Toast::TYPE_SUCCESS, 'User created successfully.')
             // check redirection to users list
             ->on(new UserList())
                 ->whenAvailable('@table', function (Browser $browser) {
                     $browser->assertElementsCount('tbody tr', 5)
                         ->assertSeeIn('tbody tr:nth-child(4) a', 'julia.roberts@kolab.org');
                 });
 
             $julia = User::where('email', 'julia.roberts@kolab.org')->first();
             $alias = UserAlias::where('user_id', $julia->id)->where('alias', 'julia.roberts2@kolab.org')->first();
             $this->assertTrue(!empty($alias));
             $this->assertUserEntitlements($julia, ['mailbox', 'storage', 'storage']);
             $this->assertSame('Julia', $julia->getSetting('first_name'));
             $this->assertSame('Roberts', $julia->getSetting('last_name'));
             $this->assertSame('Test Org', $julia->getSetting('organization'));
 
             // Some additional tests for the list input widget
             $browser->click('tbody tr:nth-child(4) a')
                 ->on(new UserInfo())
                 ->with(new ListInput('#aliases'), function (Browser $browser) {
                     $browser->assertListInputValue(['julia.roberts2@kolab.org'])
                         ->addListEntry('invalid address')
                         ->type('.input-group:nth-child(2) input', '@kolab.org');
                 })
                 ->click('button[type=submit]')
                 ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                 ->with(new ListInput('#aliases'), function (Browser $browser) {
                     $browser->assertVisible('.input-group:nth-child(2) input.is-invalid')
                         ->assertVisible('.input-group:nth-child(3) input.is-invalid')
                         ->type('.input-group:nth-child(2) input', 'julia.roberts3@kolab.org')
                         ->type('.input-group:nth-child(3) input', 'julia.roberts4@kolab.org');
                 })
                 ->click('button[type=submit]')
                 ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');
 
             $julia = User::where('email', 'julia.roberts@kolab.org')->first();
             $aliases = $julia->aliases()->orderBy('alias')->get()->pluck('alias')->all();
             $this->assertSame(['julia.roberts3@kolab.org', 'julia.roberts4@kolab.org'], $aliases);
         });
     }
 
     /**
      * Test user delete
      *
      * @depends testNewUser
      */
     public function testDeleteUser(): void
     {
         // First create a new user
         $john = $this->getTestUser('john@kolab.org');
         $julia = $this->getTestUser('julia.roberts@kolab.org');
         $package_kolab = \App\Package::where('title', 'kolab')->first();
         $john->assignPackage($package_kolab, $julia);
 
         // Test deleting non-controller user
         $this->browse(function (Browser $browser) use ($julia) {
             $browser->visit('/user/' . $julia->id)
                 ->on(new UserInfo())
                 ->assertSeeIn('button.button-delete', 'Delete user')
                 ->click('button.button-delete')
                 ->with(new Dialog('#delete-warning'), function (Browser $browser) {
                     $browser->assertSeeIn('@title', 'Delete julia.roberts@kolab.org')
                         ->assertFocused('@button-cancel')
                         ->assertSeeIn('@button-cancel', 'Cancel')
                         ->assertSeeIn('@button-action', 'Delete')
                         ->click('@button-cancel');
                 })
                 ->waitUntilMissing('#delete-warning')
                 ->click('button.button-delete')
                 ->with(new Dialog('#delete-warning'), function (Browser $browser) {
                     $browser->click('@button-action');
                 })
                 ->waitUntilMissing('#delete-warning')
                 ->assertToast(Toast::TYPE_SUCCESS, 'User deleted successfully.')
                 ->on(new UserList())
                 ->with('@table', function (Browser $browser) {
                     $browser->assertElementsCount('tbody tr', 4)
                         ->assertSeeIn('tbody tr:nth-child(1) a', 'jack@kolab.org')
                         ->assertSeeIn('tbody tr:nth-child(2) a', 'joe@kolab.org')
                         ->assertSeeIn('tbody tr:nth-child(3) a', 'john@kolab.org')
                         ->assertSeeIn('tbody tr:nth-child(4) a', 'ned@kolab.org');
                 });
 
             $julia = User::where('email', 'julia.roberts@kolab.org')->first();
             $this->assertTrue(empty($julia));
         });
 
         // Test that non-controller user cannot see/delete himself on the users list
         $this->browse(function (Browser $browser) {
             $browser->visit('/logout')
                 ->on(new Home())
                 ->submitLogon('jack@kolab.org', 'simple123', true)
                 ->visit(new UserList())
                 ->whenAvailable('@table', function (Browser $browser) {
                     $browser->assertElementsCount('tbody tr', 0)
                         ->assertSeeIn('tfoot td', 'There are no users in this account.');
                 });
         });
 
         // Test that controller user (Ned) can see all the users
         $this->browse(function (Browser $browser) {
             $browser->visit('/logout')
                 ->on(new Home())
                 ->submitLogon('ned@kolab.org', 'simple123', true)
                 ->visit(new UserList())
                 ->whenAvailable('@table', function (Browser $browser) {
                     $browser->assertElementsCount('tbody tr', 4);
                 });
 
                 // TODO: Test the delete action in details
         });
 
         // TODO: Test what happens with the logged in user session after he's been deleted by another user
     }
 
     /**
      * Test discounted sku/package prices in the UI
      */
     public function testDiscountedPrices(): void
     {
         // Add 10% discount
         $discount = Discount::where('code', 'TEST')->first();
         $john = User::where('email', 'john@kolab.org')->first();
         $wallet = $john->wallet();
         $wallet->discount()->associate($discount);
         $wallet->save();
 
         // SKUs on user edit page
         $this->browse(function (Browser $browser) {
             $browser->visit('/logout')
                 ->on(new Home())
                 ->submitLogon('john@kolab.org', 'simple123', true)
                 ->visit(new UserList())
                 ->waitFor('@table tr:nth-child(2)')
                 ->click('@table tr:nth-child(2) a') // joe@kolab.org
                 ->on(new UserInfo())
                 ->with('@form', function (Browser $browser) {
                     $browser->whenAvailable('@skus', function (Browser $browser) {
                         $quota_input = new QuotaInput('tbody tr:nth-child(2) .range-input');
                         $browser->waitFor('tbody tr')
                             ->assertElementsCount('tbody tr', 6)
                             // Mailbox SKU
                             ->assertSeeIn('tbody tr:nth-child(1) td.price', '3,99 CHF/month¹')
                             // Storage SKU
                             ->assertSeeIn('tr:nth-child(2) td.price', '0,00 CHF/month¹')
                             ->with($quota_input, function (Browser $browser) {
                                 $browser->setQuotaValue(100);
                             })
                             ->assertSeeIn('tr:nth-child(2) td.price', '22,05 CHF/month¹')
                             // groupware SKU
                             ->assertSeeIn('tbody tr:nth-child(3) td.price', '4,99 CHF/month¹')
                             // ActiveSync SKU
                             ->assertSeeIn('tbody tr:nth-child(4) td.price', '0,90 CHF/month¹')
                             // 2FA SKU
                             ->assertSeeIn('tbody tr:nth-child(5) td.price', '0,00 CHF/month¹');
                     })
                     ->assertSeeIn('@skus table + .hint', '¹ applied discount: 10% - Test voucher');
                 });
         });
 
         // Packages on new user page
         $this->browse(function (Browser $browser) {
             $browser->visit(new UserList())
                 ->click('button.create-user')
                 ->on(new UserInfo())
                 ->with('@form', function (Browser $browser) {
                     $browser->whenAvailable('@packages', function (Browser $browser) {
                         $browser->assertElementsCount('tbody tr', 2)
                             ->assertSeeIn('tbody tr:nth-child(1) .price', '8,99 CHF/month¹') // Groupware
                             ->assertSeeIn('tbody tr:nth-child(2) .price', '3,99 CHF/month¹'); // Lite
                     })
                     ->assertSeeIn('@packages table + .hint', '¹ applied discount: 10% - Test voucher');
                 });
         });
 
         // Test using entitlement cost instead of the SKU cost
         $this->browse(function (Browser $browser) use ($wallet) {
             $joe = User::where('email', 'joe@kolab.org')->first();
             $beta_sku = Sku::where('title', 'beta')->first();
             $storage_sku = Sku::where('title', 'storage')->first();
 
             // Add an extra storage and beta entitlement with different prices
             Entitlement::create([
                     'wallet_id' => $wallet->id,
                     'sku_id' => $beta_sku->id,
                     'cost' => 5010,
                     'entitleable_id' => $joe->id,
                     'entitleable_type' => User::class
             ]);
             Entitlement::create([
                     'wallet_id' => $wallet->id,
                     'sku_id' => $storage_sku->id,
                     'cost' => 5000,
                     'entitleable_id' => $joe->id,
                     'entitleable_type' => User::class
             ]);
 
             $browser->visit('/user/' . $joe->id)
                 ->on(new UserInfo())
                 ->with('@form', function (Browser $browser) {
                     $browser->whenAvailable('@skus', function (Browser $browser) {
                         $quota_input = new QuotaInput('tbody tr:nth-child(2) .range-input');
                         $browser->waitFor('tbody tr')
                             // Beta SKU
                             ->assertSeeIn('tbody tr:nth-child(7) td.price', '45,09 CHF/month¹')
                             // Storage SKU
                             ->assertSeeIn('tr:nth-child(2) td.price', '45,00 CHF/month¹')
                             ->with($quota_input, function (Browser $browser) {
                                 $browser->setQuotaValue(4);
                             })
                             ->assertSeeIn('tr:nth-child(2) td.price', '45,22 CHF/month¹')
                             ->with($quota_input, function (Browser $browser) {
                                 $browser->setQuotaValue(2);
                             })
                             ->assertSeeIn('tr:nth-child(2) td.price', '0,00 CHF/month¹');
                     })
                     ->assertSeeIn('@skus table + .hint', '¹ applied discount: 10% - Test voucher');
                 });
         });
     }
 
     /**
      * Test beta entitlements
      *
      * @depends testList
      */
     public function testBetaEntitlements(): void
     {
         $this->browse(function (Browser $browser) {
             $john = User::where('email', 'john@kolab.org')->first();
             $sku = Sku::where('title', 'beta')->first();
             $john->assignSku($sku);
 
             $browser->visit('/user/' . $john->id)
                 ->on(new UserInfo())
                 ->with('@skus', function ($browser) {
-                    $browser->assertElementsCount('tbody tr', 7)
-                        // Beta/Meet SKU
+                    $browser->assertElementsCount('tbody tr', 8)
+                        // Meet SKU
                         ->assertSeeIn('tbody tr:nth-child(6) td.name', 'Voice & Video Conferencing (public beta)')
                         ->assertSeeIn('tr:nth-child(6) td.price', '0,00 CHF/month')
                         ->assertNotChecked('tbody tr:nth-child(6) td.selection input')
                         ->assertEnabled('tbody tr:nth-child(6) td.selection input')
                         ->assertTip(
                             'tbody tr:nth-child(6) td.buttons button',
                             'Video conferencing tool'
                         )
                         // Beta SKU
                         ->assertSeeIn('tbody tr:nth-child(7) td.name', 'Private Beta (invitation only)')
                         ->assertSeeIn('tbody tr:nth-child(7) td.price', '0,00 CHF/month')
                         ->assertChecked('tbody tr:nth-child(7) td.selection input')
                         ->assertEnabled('tbody tr:nth-child(7) td.selection input')
                         ->assertTip(
                             'tbody tr:nth-child(7) td.buttons button',
                             'Access to the private beta program subscriptions'
                         )
-/*
-                        // Check Meet, Uncheck Beta, expect Meet unchecked
-                        ->click('#sku-input-meet')
+                        // Distlist SKU
+                        ->assertSeeIn('tbody tr:nth-child(8) td.name', 'Distribution lists')
+                        ->assertSeeIn('tr:nth-child(8) td.price', '0,00 CHF/month')
+                        ->assertNotChecked('tbody tr:nth-child(8) td.selection input')
+                        ->assertEnabled('tbody tr:nth-child(8) td.selection input')
+                        ->assertTip(
+                            'tbody tr:nth-child(8) td.buttons button',
+                            'Access to mail distribution lists'
+                        )
+                        // Check Distlist, Uncheck Beta, expect Distlist unchecked
+                        ->click('#sku-input-distlist')
                         ->click('#sku-input-beta')
                         ->assertNotChecked('#sku-input-beta')
-                        ->assertNotChecked('#sku-input-meet')
-                        // Click Meet expect an alert
-                        ->click('#sku-input-meet')
-                        ->assertDialogOpened('Video chat requires Beta program.')
+                        ->assertNotChecked('#sku-input-distlist')
+                        // Click Distlist expect an alert
+                        ->click('#sku-input-distlist')
+                        ->assertDialogOpened('Distribution lists requires Private Beta (invitation only).')
                         ->acceptDialog()
-*/
-                        // Enable Meet and submit
-                        ->click('#sku-input-meet');
+                        // Enable Beta and Distlist and submit
+                        ->click('#sku-input-beta')
+                        ->click('#sku-input-distlist');
                 })
                 ->click('button[type=submit]')
                 ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');
 
-            $expected = ['beta', 'groupware', 'mailbox', 'meet', 'storage', 'storage'];
+            $expected = ['beta', 'distlist', 'groupware', 'mailbox', 'storage', 'storage'];
             $this->assertUserEntitlements($john, $expected);
 
             $browser->visit('/user/' . $john->id)
                 ->on(new UserInfo())
                 ->click('#sku-input-beta')
-                ->click('#sku-input-meet')
                 ->click('button[type=submit]')
                 ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');
 
             $expected = ['groupware', 'mailbox', 'storage', 'storage'];
             $this->assertUserEntitlements($john, $expected);
         });
+
+        // TODO: Test that the Distlist SKU is not available for users that aren't a group account owners
+        // TODO: Test that entitlements change has immediate effect on the available items in dashboard
+        //       i.e. does not require a page reload nor re-login.
     }
 }
diff --git a/src/tests/Feature/Controller/GroupsTest.php b/src/tests/Feature/Controller/GroupsTest.php
new file mode 100644
index 00000000..eaceab19
--- /dev/null
+++ b/src/tests/Feature/Controller/GroupsTest.php
@@ -0,0 +1,492 @@
+<?php
+
+namespace Tests\Feature\Controller;
+
+use App\Group;
+use App\Http\Controllers\API\V4\GroupsController;
+use Carbon\Carbon;
+use Illuminate\Support\Facades\Queue;
+use Tests\TestCase;
+
+class GroupsTest extends TestCase
+{
+    /**
+     * {@inheritDoc}
+     */
+    public function setUp(): void
+    {
+        parent::setUp();
+
+        $this->deleteTestGroup('group-test@kolab.org');
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public function tearDown(): void
+    {
+        $this->deleteTestGroup('group-test@kolab.org');
+
+        parent::tearDown();
+    }
+
+    /**
+     * Test group deleting (DELETE /api/v4/groups/<id>)
+     */
+    public function testDestroy(): void
+    {
+        // First create some groups to delete
+        $john = $this->getTestUser('john@kolab.org');
+        $jack = $this->getTestUser('jack@kolab.org');
+        $group = $this->getTestGroup('group-test@kolab.org');
+        $group->assignToWallet($john->wallets->first());
+
+        // Test unauth access
+        $response = $this->delete("api/v4/groups/{$group->id}");
+        $response->assertStatus(401);
+
+        // Test non-existing group
+        $response = $this->actingAs($john)->delete("api/v4/groups/abc");
+        $response->assertStatus(404);
+
+        // Test access to other user's group
+        $response = $this->actingAs($jack)->delete("api/v4/groups/{$group->id}");
+        $response->assertStatus(403);
+
+        $json = $response->json();
+
+        $this->assertSame('error', $json['status']);
+        $this->assertSame("Access denied", $json['message']);
+        $this->assertCount(2, $json);
+
+        // Test removing a group
+        $response = $this->actingAs($john)->delete("api/v4/groups/{$group->id}");
+        $response->assertStatus(200);
+
+        $json = $response->json();
+
+        $this->assertEquals('success', $json['status']);
+        $this->assertEquals("Distribution list deleted successfully.", $json['message']);
+    }
+
+    /**
+     * Test groups listing (GET /api/v4/groups)
+     */
+    public function testIndex(): void
+    {
+        $jack = $this->getTestUser('jack@kolab.org');
+        $john = $this->getTestUser('john@kolab.org');
+        $ned = $this->getTestUser('ned@kolab.org');
+
+        $group = $this->getTestGroup('group-test@kolab.org');
+        $group->assignToWallet($john->wallets->first());
+
+        // Test unauth access
+        $response = $this->get("api/v4/groups");
+        $response->assertStatus(401);
+
+        // Test a user with no groups
+        $response = $this->actingAs($jack)->get("/api/v4/groups");
+        $response->assertStatus(200);
+
+        $json = $response->json();
+
+        $this->assertCount(0, $json);
+
+        // Test a user with a single group
+        $response = $this->actingAs($john)->get("/api/v4/groups");
+        $response->assertStatus(200);
+
+        $json = $response->json();
+
+        $this->assertCount(1, $json);
+        $this->assertSame($group->id, $json[0]['id']);
+        $this->assertSame($group->email, $json[0]['email']);
+        $this->assertArrayHasKey('isDeleted', $json[0]);
+        $this->assertArrayHasKey('isSuspended', $json[0]);
+        $this->assertArrayHasKey('isActive', $json[0]);
+        $this->assertArrayHasKey('isLdapReady', $json[0]);
+
+        // Test that another wallet controller has access to groups
+        $response = $this->actingAs($ned)->get("/api/v4/groups");
+        $response->assertStatus(200);
+
+        $json = $response->json();
+
+        $this->assertCount(1, $json);
+        $this->assertSame($group->email, $json[0]['email']);
+    }
+
+    /**
+     * Test fetching group data/profile (GET /api/v4/groups/<group-id>)
+     */
+    public function testShow(): void
+    {
+        $jack = $this->getTestUser('jack@kolab.org');
+        $john = $this->getTestUser('john@kolab.org');
+        $ned = $this->getTestUser('ned@kolab.org');
+
+        $group = $this->getTestGroup('group-test@kolab.org');
+        $group->assignToWallet($john->wallets->first());
+
+        // Test unauthorized access to a profile of other user
+        $response = $this->get("/api/v4/groups/{$group->id}");
+        $response->assertStatus(401);
+
+        // Test unauthorized access to a group of another user
+        $response = $this->actingAs($jack)->get("/api/v4/groups/{$group->id}");
+        $response->assertStatus(403);
+
+        // John: Group owner - non-existing group
+        $response = $this->actingAs($john)->get("/api/v4/groups/abc");
+        $response->assertStatus(404);
+
+        // John: Group owner
+        $response = $this->actingAs($john)->get("/api/v4/groups/{$group->id}");
+        $response->assertStatus(200);
+
+        $json = $response->json();
+
+        $this->assertSame($group->id, $json['id']);
+        $this->assertSame($group->email, $json['email']);
+        $this->assertSame($group->members, $json['members']);
+        $this->assertTrue(!empty($json['statusInfo']));
+        $this->assertArrayHasKey('isDeleted', $json);
+        $this->assertArrayHasKey('isSuspended', $json);
+        $this->assertArrayHasKey('isActive', $json);
+        $this->assertArrayHasKey('isLdapReady', $json);
+    }
+
+    /**
+     * Test fetching group status (GET /api/v4/groups/<group-id>/status)
+     * and forcing setup process update (?refresh=1)
+     */
+    public function testStatus(): void
+    {
+        Queue::fake();
+
+        $john = $this->getTestUser('john@kolab.org');
+        $jack = $this->getTestUser('jack@kolab.org');
+
+        $group = $this->getTestGroup('group-test@kolab.org');
+        $group->assignToWallet($john->wallets->first());
+
+        // Test unauthorized access
+        $response = $this->get("/api/v4/groups/abc/status");
+        $response->assertStatus(401);
+
+        // Test unauthorized access
+        $response = $this->actingAs($jack)->get("/api/v4/groups/{$group->id}/status");
+        $response->assertStatus(403);
+
+        $group->status = Group::STATUS_NEW | Group::STATUS_ACTIVE;
+        $group->save();
+
+        // Get group status
+        $response = $this->actingAs($john)->get("/api/v4/groups/{$group->id}/status");
+        $response->assertStatus(200);
+
+        $json = $response->json();
+
+        $this->assertFalse($json['isLdapReady']);
+        $this->assertFalse($json['isReady']);
+        $this->assertFalse($json['isSuspended']);
+        $this->assertTrue($json['isActive']);
+        $this->assertFalse($json['isDeleted']);
+        $this->assertCount(6, $json['process']);
+        $this->assertSame('distlist-new', $json['process'][0]['label']);
+        $this->assertSame(true, $json['process'][0]['state']);
+        $this->assertSame('distlist-ldap-ready', $json['process'][1]['label']);
+        $this->assertSame(false, $json['process'][1]['state']);
+        $this->assertTrue(empty($json['status']));
+        $this->assertTrue(empty($json['message']));
+
+        // Make sure the domain is confirmed (other test might unset that status)
+        $domain = $this->getTestDomain('kolab.org');
+        $domain->status |= \App\Domain::STATUS_CONFIRMED;
+        $domain->save();
+
+        // Now "reboot" the process and  the group
+        $response = $this->actingAs($john)->get("/api/v4/groups/{$group->id}/status?refresh=1");
+        $response->assertStatus(200);
+
+        $json = $response->json();
+
+        $this->assertTrue($json['isLdapReady']);
+        $this->assertTrue($json['isReady']);
+        $this->assertCount(6, $json['process']);
+        $this->assertSame('distlist-ldap-ready', $json['process'][1]['label']);
+        $this->assertSame(true, $json['process'][1]['state']);
+        $this->assertSame('success', $json['status']);
+        $this->assertSame('Setup process finished successfully.', $json['message']);
+
+        // Test a case when a domain is not ready
+        $domain->status ^= \App\Domain::STATUS_CONFIRMED;
+        $domain->save();
+
+        $response = $this->actingAs($john)->get("/api/v4/groups/{$group->id}/status?refresh=1");
+        $response->assertStatus(200);
+
+        $json = $response->json();
+
+        $this->assertTrue($json['isLdapReady']);
+        $this->assertTrue($json['isReady']);
+        $this->assertCount(6, $json['process']);
+        $this->assertSame('distlist-ldap-ready', $json['process'][1]['label']);
+        $this->assertSame(true, $json['process'][1]['state']);
+        $this->assertSame('success', $json['status']);
+        $this->assertSame('Setup process finished successfully.', $json['message']);
+    }
+
+    /**
+     * Test GroupsController::statusInfo()
+     */
+    public function testStatusInfo(): void
+    {
+        $john = $this->getTestUser('john@kolab.org');
+        $group = $this->getTestGroup('group-test@kolab.org');
+        $group->assignToWallet($john->wallets->first());
+        $group->status = Group::STATUS_NEW | Group::STATUS_ACTIVE;
+        $group->save();
+
+        $result = GroupsController::statusInfo($group);
+
+        $this->assertFalse($result['isReady']);
+        $this->assertCount(6, $result['process']);
+        $this->assertSame('distlist-new', $result['process'][0]['label']);
+        $this->assertSame(true, $result['process'][0]['state']);
+        $this->assertSame('distlist-ldap-ready', $result['process'][1]['label']);
+        $this->assertSame(false, $result['process'][1]['state']);
+        $this->assertSame('running', $result['processState']);
+
+        $group->created_at = Carbon::now()->subSeconds(181);
+        $group->save();
+
+        $result = GroupsController::statusInfo($group);
+
+        $this->assertSame('failed', $result['processState']);
+
+        $group->status |= Group::STATUS_LDAP_READY;
+        $group->save();
+
+        $result = GroupsController::statusInfo($group);
+
+        $this->assertTrue($result['isReady']);
+        $this->assertCount(6, $result['process']);
+        $this->assertSame('distlist-new', $result['process'][0]['label']);
+        $this->assertSame(true, $result['process'][0]['state']);
+        $this->assertSame('distlist-ldap-ready', $result['process'][1]['label']);
+        $this->assertSame(true, $result['process'][2]['state']);
+        $this->assertSame('done', $result['processState']);
+    }
+
+    /**
+     * Test group creation (POST /api/v4/groups)
+     */
+    public function testStore(): void
+    {
+        Queue::fake();
+
+        $jack = $this->getTestUser('jack@kolab.org');
+        $john = $this->getTestUser('john@kolab.org');
+
+        // Test unauth request
+        $response = $this->post("/api/v4/groups", []);
+        $response->assertStatus(401);
+
+        // Test non-controller user
+        $response = $this->actingAs($jack)->post("/api/v4/groups", []);
+        $response->assertStatus(403);
+
+        // Test empty request
+        $response = $this->actingAs($john)->post("/api/v4/groups", []);
+        $response->assertStatus(422);
+
+        $json = $response->json();
+
+        $this->assertSame('error', $json['status']);
+        $this->assertSame("The email field is required.", $json['errors']['email']);
+        $this->assertCount(2, $json);
+
+        // Test missing members
+        $post = ['email' => 'group-test@kolab.org'];
+        $response = $this->actingAs($john)->post("/api/v4/groups", $post);
+        $json = $response->json();
+
+        $response->assertStatus(422);
+
+        $this->assertSame('error', $json['status']);
+        $this->assertSame("At least one recipient is required.", $json['errors']['members']);
+        $this->assertCount(2, $json);
+
+        // Test invalid email
+        $post = ['email' => 'invalid'];
+        $response = $this->actingAs($john)->post("/api/v4/groups", $post);
+        $response->assertStatus(422);
+
+        $json = $response->json();
+
+        $this->assertSame('error', $json['status']);
+        $this->assertCount(2, $json);
+        $this->assertSame('The specified email is invalid.', $json['errors']['email']);
+
+        // Test successful group creation
+        $post = [
+            'email' => 'group-test@kolab.org',
+            'members' => ['test1@domain.tld', 'test2@domain.tld']
+        ];
+
+        $response = $this->actingAs($john)->post("/api/v4/groups", $post);
+        $json = $response->json();
+
+        $response->assertStatus(200);
+
+        $this->assertSame('success', $json['status']);
+        $this->assertSame("Distribution list created successfully.", $json['message']);
+        $this->assertCount(2, $json);
+
+        $group = Group::where('email', 'group-test@kolab.org')->first();
+        $this->assertInstanceOf(Group::class, $group);
+        $this->assertSame($post['email'], $group->email);
+        $this->assertSame($post['members'], $group->members);
+        $this->assertTrue($john->groups()->get()->contains($group));
+    }
+
+    /**
+     * Test group update (PUT /api/v4/groups/<group-id>)
+     */
+    public function testUpdate(): void
+    {
+        Queue::fake();
+
+        $jack = $this->getTestUser('jack@kolab.org');
+        $john = $this->getTestUser('john@kolab.org');
+        $ned = $this->getTestUser('ned@kolab.org');
+
+        $group = $this->getTestGroup('group-test@kolab.org');
+        $group->assignToWallet($john->wallets->first());
+
+        // Test unauthorized update
+        $response = $this->get("/api/v4/groups/{$group->id}", []);
+        $response->assertStatus(401);
+
+        // Test unauthorized update
+        $response = $this->actingAs($jack)->get("/api/v4/groups/{$group->id}", []);
+        $response->assertStatus(403);
+
+        // Test updating - missing members
+        $response = $this->actingAs($john)->put("/api/v4/groups/{$group->id}", []);
+        $response->assertStatus(422);
+
+        $json = $response->json();
+
+        $this->assertSame('error', $json['status']);
+        $this->assertSame("At least one recipient is required.", $json['errors']['members']);
+        $this->assertCount(2, $json);
+
+        // Test some invalid data
+        $post = ['members' => ['test@domain.tld', 'invalid']];
+        $response = $this->actingAs($john)->put("/api/v4/groups/{$group->id}", $post);
+        $response->assertStatus(422);
+
+        $json = $response->json();
+
+        $this->assertSame('error', $json['status']);
+        $this->assertCount(2, $json);
+        $this->assertSame('The specified email address is invalid.', $json['errors']['members'][1]);
+
+        // Valid data - members changed
+        $post = [
+            'members' => ['member1@test.domain', 'member2@test.domain']
+        ];
+
+        $response = $this->actingAs($john)->put("/api/v4/groups/{$group->id}", $post);
+        $json = $response->json();
+
+        $response->assertStatus(200);
+
+        $this->assertSame('success', $json['status']);
+        $this->assertSame("Distribution list updated successfully.", $json['message']);
+        $this->assertCount(2, $json);
+        $this->assertSame($group->fresh()->members, $post['members']);
+    }
+
+    /**
+     * Group email address validation.
+     */
+    public function testValidateGroupEmail(): void
+    {
+        $john = $this->getTestUser('john@kolab.org');
+        $group = $this->getTestGroup('group-test@kolab.org');
+
+        // Invalid email
+        $result = GroupsController::validateGroupEmail('', $john);
+        $this->assertSame("The email field is required.", $result);
+
+        $result = GroupsController::validateGroupEmail('kolab.org', $john);
+        $this->assertSame("The specified email is invalid.", $result);
+
+        $result = GroupsController::validateGroupEmail('.@kolab.org', $john);
+        $this->assertSame("The specified email is invalid.", $result);
+
+        $result = GroupsController::validateGroupEmail('test123456@localhost', $john);
+        $this->assertSame("The specified domain is invalid.", $result);
+
+        $result = GroupsController::validateGroupEmail('test123456@unknown-domain.org', $john);
+        $this->assertSame("The specified domain is invalid.", $result);
+
+        // forbidden public domain
+        $result = GroupsController::validateGroupEmail('testtest@kolabnow.com', $john);
+        $this->assertSame("The specified domain is not available.", $result);
+
+        // existing alias
+        $result = GroupsController::validateGroupEmail('jack.daniels@kolab.org', $john);
+        $this->assertSame("The specified email is not available.", $result);
+
+        // existing user
+        $result = GroupsController::validateGroupEmail('ned@kolab.org', $john);
+        $this->assertSame("The specified email is not available.", $result);
+
+        // existing group
+        $result = GroupsController::validateGroupEmail('group-test@kolab.org', $john);
+        $this->assertSame("The specified email is not available.", $result);
+
+        // valid
+        $result = GroupsController::validateGroupEmail('admin@kolab.org', $john);
+        $this->assertSame(null, $result);
+    }
+
+    /**
+     * Group member email address validation.
+     */
+    public function testValidateMemberEmail(): void
+    {
+        $john = $this->getTestUser('john@kolab.org');
+
+        // Invalid format
+        $result = GroupsController::validateMemberEmail('kolab.org', $john);
+        $this->assertSame("The specified email address is invalid.", $result);
+
+        $result = GroupsController::validateMemberEmail('.@kolab.org', $john);
+        $this->assertSame("The specified email address is invalid.", $result);
+
+        $result = GroupsController::validateMemberEmail('test123456@localhost', $john);
+        $this->assertSame("The specified email address is invalid.", $result);
+
+        // Test local non-existing user
+        $result = GroupsController::validateMemberEmail('unknown@kolab.org', $john);
+        $this->assertSame("The specified email address does not exist.", $result);
+
+        // Test local existing user
+        $result = GroupsController::validateMemberEmail('ned@kolab.org', $john);
+        $this->assertSame(null, $result);
+
+        // Test existing user, but not in the same account
+        $result = GroupsController::validateMemberEmail('jeroen@jeroen.jeroen', $john);
+        $this->assertSame(null, $result);
+
+        // Valid address
+        $result = GroupsController::validateMemberEmail('test@google.com', $john);
+        $this->assertSame(null, $result);
+    }
+}
diff --git a/src/tests/Feature/Controller/UsersTest.php b/src/tests/Feature/Controller/UsersTest.php
index 12b872af..b434f5a0 100644
--- a/src/tests/Feature/Controller/UsersTest.php
+++ b/src/tests/Feature/Controller/UsersTest.php
@@ -1,1270 +1,1269 @@
 <?php
 
 namespace Tests\Feature\Controller;
 
 use App\Discount;
 use App\Domain;
 use App\Http\Controllers\API\V4\UsersController;
 use App\Package;
 use App\Sku;
 use App\User;
 use App\Wallet;
 use Carbon\Carbon;
 use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Str;
 use Tests\TestCase;
 
 class UsersTest extends TestCase
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('jane@kolabnow.com');
         $this->deleteTestUser('UsersControllerTest1@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest2@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest3@userscontroller.com');
         $this->deleteTestUser('UserEntitlement2A@UserEntitlement.com');
         $this->deleteTestUser('john2.doe2@kolab.org');
         $this->deleteTestUser('deleted@kolab.org');
         $this->deleteTestUser('deleted@kolabnow.com');
         $this->deleteTestDomain('userscontroller.com');
         $this->deleteTestGroup('group-test@kolabnow.com');
         $this->deleteTestGroup('group-test@kolab.org');
 
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
         $wallet->discount()->dissociate();
         $wallet->settings()->whereIn('key', ['mollie_id', 'stripe_id'])->delete();
         $wallet->save();
         $user->status |= User::STATUS_IMAP_READY;
         $user->save();
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser('jane@kolabnow.com');
         $this->deleteTestUser('UsersControllerTest1@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest2@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest3@userscontroller.com');
         $this->deleteTestUser('UserEntitlement2A@UserEntitlement.com');
         $this->deleteTestUser('john2.doe2@kolab.org');
         $this->deleteTestUser('deleted@kolab.org');
         $this->deleteTestUser('deleted@kolabnow.com');
         $this->deleteTestDomain('userscontroller.com');
         $this->deleteTestGroup('group-test@kolabnow.com');
         $this->deleteTestGroup('group-test@kolab.org');
 
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
         $wallet->discount()->dissociate();
         $wallet->settings()->whereIn('key', ['mollie_id', 'stripe_id'])->delete();
         $wallet->save();
         $user->status |= User::STATUS_IMAP_READY;
         $user->save();
 
         parent::tearDown();
     }
 
     /**
      * Test user deleting (DELETE /api/v4/users/<id>)
      */
     public function testDestroy(): void
     {
         // First create some users/accounts to delete
         $package_kolab = \App\Package::where('title', 'kolab')->first();
         $package_domain = \App\Package::where('title', 'domain-hosting')->first();
 
         $john = $this->getTestUser('john@kolab.org');
         $user1 = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $user2 = $this->getTestUser('UsersControllerTest2@userscontroller.com');
         $user3 = $this->getTestUser('UsersControllerTest3@userscontroller.com');
         $domain = $this->getTestDomain('userscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
         $user1->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $user1);
         $user1->assignPackage($package_kolab, $user2);
         $user1->assignPackage($package_kolab, $user3);
 
         // Test unauth access
         $response = $this->delete("api/v4/users/{$user2->id}");
         $response->assertStatus(401);
 
         // Test access to other user/account
         $response = $this->actingAs($john)->delete("api/v4/users/{$user2->id}");
         $response->assertStatus(403);
         $response = $this->actingAs($john)->delete("api/v4/users/{$user1->id}");
         $response->assertStatus(403);
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Access denied", $json['message']);
         $this->assertCount(2, $json);
 
         // Test that non-controller cannot remove himself
         $response = $this->actingAs($user3)->delete("api/v4/users/{$user3->id}");
         $response->assertStatus(403);
 
         // Test removing a non-controller user
         $response = $this->actingAs($user1)->delete("api/v4/users/{$user3->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals('success', $json['status']);
         $this->assertEquals('User deleted successfully.', $json['message']);
 
         // Test removing self (an account with users)
         $response = $this->actingAs($user1)->delete("api/v4/users/{$user1->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals('success', $json['status']);
         $this->assertEquals('User deleted successfully.', $json['message']);
     }
 
     /**
      * Test user deleting (DELETE /api/v4/users/<id>)
      */
     public function testDestroyByController(): void
     {
         // Create an account with additional controller - $user2
         $package_kolab = \App\Package::where('title', 'kolab')->first();
         $package_domain = \App\Package::where('title', 'domain-hosting')->first();
         $user1 = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $user2 = $this->getTestUser('UsersControllerTest2@userscontroller.com');
         $user3 = $this->getTestUser('UsersControllerTest3@userscontroller.com');
         $domain = $this->getTestDomain('userscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
         $user1->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $user1);
         $user1->assignPackage($package_kolab, $user2);
         $user1->assignPackage($package_kolab, $user3);
         $user1->wallets()->first()->addController($user2);
 
         // TODO/FIXME:
         //   For now controller can delete himself, as well as
         //   the whole account he has control to, including the owner
         //   Probably he should not be able to do none of those
         //   However, this is not 0-regression scenario as we
         //   do not fully support additional controllers.
 
         //$response = $this->actingAs($user2)->delete("api/v4/users/{$user2->id}");
         //$response->assertStatus(403);
 
         $response = $this->actingAs($user2)->delete("api/v4/users/{$user3->id}");
         $response->assertStatus(200);
 
         $response = $this->actingAs($user2)->delete("api/v4/users/{$user1->id}");
         $response->assertStatus(200);
 
         // Note: More detailed assertions in testDestroy() above
 
         $this->assertTrue($user1->fresh()->trashed());
         $this->assertTrue($user2->fresh()->trashed());
         $this->assertTrue($user3->fresh()->trashed());
     }
 
     /**
      * Test user listing (GET /api/v4/users)
      */
     public function testIndex(): void
     {
         // Test unauth access
         $response = $this->get("api/v4/users");
         $response->assertStatus(401);
 
         $jack = $this->getTestUser('jack@kolab.org');
         $joe = $this->getTestUser('joe@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         $response = $this->actingAs($jack)->get("/api/v4/users");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(0, $json);
 
         $response = $this->actingAs($john)->get("/api/v4/users");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(4, $json);
         $this->assertSame($jack->email, $json[0]['email']);
         $this->assertSame($joe->email, $json[1]['email']);
         $this->assertSame($john->email, $json[2]['email']);
         $this->assertSame($ned->email, $json[3]['email']);
         // Values below are tested by Unit tests
         $this->assertArrayHasKey('isDeleted', $json[0]);
         $this->assertArrayHasKey('isSuspended', $json[0]);
         $this->assertArrayHasKey('isActive', $json[0]);
         $this->assertArrayHasKey('isLdapReady', $json[0]);
         $this->assertArrayHasKey('isImapReady', $json[0]);
 
         $response = $this->actingAs($ned)->get("/api/v4/users");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(4, $json);
         $this->assertSame($jack->email, $json[0]['email']);
         $this->assertSame($joe->email, $json[1]['email']);
         $this->assertSame($john->email, $json[2]['email']);
         $this->assertSame($ned->email, $json[3]['email']);
     }
 
     /**
      * Test fetching user data/profile (GET /api/v4/users/<user-id>)
      */
     public function testShow(): void
     {
         $userA = $this->getTestUser('UserEntitlement2A@UserEntitlement.com');
 
         // Test getting profile of self
         $response = $this->actingAs($userA)->get("/api/v4/users/{$userA->id}");
 
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertEquals($userA->id, $json['id']);
         $this->assertEquals($userA->email, $json['email']);
         $this->assertTrue(is_array($json['statusInfo']));
         $this->assertTrue(is_array($json['settings']));
         $this->assertTrue(is_array($json['aliases']));
         $this->assertSame([], $json['skus']);
         // Values below are tested by Unit tests
         $this->assertArrayHasKey('isDeleted', $json);
         $this->assertArrayHasKey('isSuspended', $json);
         $this->assertArrayHasKey('isActive', $json);
         $this->assertArrayHasKey('isLdapReady', $json);
         $this->assertArrayHasKey('isImapReady', $json);
 
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         // Test unauthorized access to a profile of other user
         $response = $this->actingAs($jack)->get("/api/v4/users/{$userA->id}");
         $response->assertStatus(403);
 
         // Test authorized access to a profile of other user
         // Ned: Additional account controller
         $response = $this->actingAs($ned)->get("/api/v4/users/{$john->id}");
         $response->assertStatus(200);
         $response = $this->actingAs($ned)->get("/api/v4/users/{$jack->id}");
         $response->assertStatus(200);
 
         // John: Account owner
         $response = $this->actingAs($john)->get("/api/v4/users/{$jack->id}");
         $response->assertStatus(200);
         $response = $this->actingAs($john)->get("/api/v4/users/{$ned->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $storage_sku = Sku::where('title', 'storage')->first();
         $groupware_sku = Sku::where('title', 'groupware')->first();
         $mailbox_sku = Sku::where('title', 'mailbox')->first();
         $secondfactor_sku = Sku::where('title', '2fa')->first();
 
         $this->assertCount(5, $json['skus']);
 
         $this->assertSame(2, $json['skus'][$storage_sku->id]['count']);
         $this->assertSame([0,0], $json['skus'][$storage_sku->id]['costs']);
         $this->assertSame(1, $json['skus'][$groupware_sku->id]['count']);
         $this->assertSame([555], $json['skus'][$groupware_sku->id]['costs']);
         $this->assertSame(1, $json['skus'][$mailbox_sku->id]['count']);
         $this->assertSame([444], $json['skus'][$mailbox_sku->id]['costs']);
         $this->assertSame(1, $json['skus'][$secondfactor_sku->id]['count']);
         $this->assertSame([0], $json['skus'][$secondfactor_sku->id]['costs']);
     }
 
     /**
      * Test fetching user status (GET /api/v4/users/<user-id>/status)
      * and forcing setup process update (?refresh=1)
      *
      * @group imap
      * @group dns
      */
     public function testStatus(): void
     {
         Queue::fake();
 
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
 
         // Test unauthorized access
         $response = $this->actingAs($jack)->get("/api/v4/users/{$john->id}/status");
         $response->assertStatus(403);
 
         if ($john->isImapReady()) {
             $john->status ^= User::STATUS_IMAP_READY;
             $john->save();
         }
 
         // Get user status
         $response = $this->actingAs($john)->get("/api/v4/users/{$john->id}/status");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertFalse($json['isImapReady']);
         $this->assertFalse($json['isReady']);
         $this->assertCount(7, $json['process']);
         $this->assertSame('user-imap-ready', $json['process'][2]['label']);
         $this->assertSame(false, $json['process'][2]['state']);
         $this->assertTrue(empty($json['status']));
         $this->assertTrue(empty($json['message']));
 
         // Make sure the domain is confirmed (other test might unset that status)
         $domain = $this->getTestDomain('kolab.org');
         $domain->status |= Domain::STATUS_CONFIRMED;
         $domain->save();
 
         // Now "reboot" the process and verify the user in imap synchronously
         $response = $this->actingAs($john)->get("/api/v4/users/{$john->id}/status?refresh=1");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertTrue($json['isImapReady']);
         $this->assertTrue($json['isReady']);
         $this->assertCount(7, $json['process']);
         $this->assertSame('user-imap-ready', $json['process'][2]['label']);
         $this->assertSame(true, $json['process'][2]['state']);
         $this->assertSame('success', $json['status']);
         $this->assertSame('Setup process finished successfully.', $json['message']);
 
         Queue::size(1);
 
         // Test case for when the verify job is dispatched to the worker
         $john->refresh();
         $john->status ^= User::STATUS_IMAP_READY;
         $john->save();
 
         \config(['imap.admin_password' => null]);
 
         $response = $this->actingAs($john)->get("/api/v4/users/{$john->id}/status?refresh=1");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertFalse($json['isImapReady']);
         $this->assertFalse($json['isReady']);
         $this->assertSame('success', $json['status']);
         $this->assertSame('waiting', $json['processState']);
         $this->assertSame('Setup process has been pushed. Please wait.', $json['message']);
 
         Queue::assertPushed(\App\Jobs\User\VerifyJob::class, 1);
     }
 
     /**
      * Test UsersController::statusInfo()
      */
     public function testStatusInfo(): void
     {
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $domain = $this->getTestDomain('userscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
 
         $user->created_at = Carbon::now();
         $user->status = User::STATUS_NEW;
         $user->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertFalse($result['isReady']);
         $this->assertSame([], $result['skus']);
         $this->assertCount(3, $result['process']);
         $this->assertSame('user-new', $result['process'][0]['label']);
         $this->assertSame(true, $result['process'][0]['state']);
         $this->assertSame('user-ldap-ready', $result['process'][1]['label']);
         $this->assertSame(false, $result['process'][1]['state']);
         $this->assertSame('user-imap-ready', $result['process'][2]['label']);
         $this->assertSame(false, $result['process'][2]['state']);
         $this->assertSame('running', $result['processState']);
 
         $user->created_at = Carbon::now()->subSeconds(181);
         $user->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertSame('failed', $result['processState']);
 
         $user->status |= User::STATUS_LDAP_READY | User::STATUS_IMAP_READY;
         $user->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertTrue($result['isReady']);
         $this->assertCount(3, $result['process']);
         $this->assertSame('user-new', $result['process'][0]['label']);
         $this->assertSame(true, $result['process'][0]['state']);
         $this->assertSame('user-ldap-ready', $result['process'][1]['label']);
         $this->assertSame(true, $result['process'][1]['state']);
         $this->assertSame('user-imap-ready', $result['process'][2]['label']);
         $this->assertSame(true, $result['process'][2]['state']);
         $this->assertSame('done', $result['processState']);
 
         $domain->status |= Domain::STATUS_VERIFIED;
         $domain->type = Domain::TYPE_EXTERNAL;
         $domain->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertFalse($result['isReady']);
         $this->assertSame([], $result['skus']);
         $this->assertCount(7, $result['process']);
         $this->assertSame('user-new', $result['process'][0]['label']);
         $this->assertSame(true, $result['process'][0]['state']);
         $this->assertSame('user-ldap-ready', $result['process'][1]['label']);
         $this->assertSame(true, $result['process'][1]['state']);
         $this->assertSame('user-imap-ready', $result['process'][2]['label']);
         $this->assertSame(true, $result['process'][2]['state']);
         $this->assertSame('domain-new', $result['process'][3]['label']);
         $this->assertSame(true, $result['process'][3]['state']);
         $this->assertSame('domain-ldap-ready', $result['process'][4]['label']);
         $this->assertSame(false, $result['process'][4]['state']);
         $this->assertSame('domain-verified', $result['process'][5]['label']);
         $this->assertSame(true, $result['process'][5]['state']);
         $this->assertSame('domain-confirmed', $result['process'][6]['label']);
         $this->assertSame(false, $result['process'][6]['state']);
 
         // Test 'skus' property
         $user->assignSku(Sku::where('title', 'beta')->first());
 
         $result = UsersController::statusInfo($user);
 
         $this->assertSame(['beta'], $result['skus']);
 
         $user->assignSku(Sku::where('title', 'meet')->first());
 
         $result = UsersController::statusInfo($user);
 
         $this->assertSame(['beta', 'meet'], $result['skus']);
 
         $user->assignSku(Sku::where('title', 'meet')->first());
 
         $result = UsersController::statusInfo($user);
 
         $this->assertSame(['beta', 'meet'], $result['skus']);
     }
 
     /**
      * Test user creation (POST /api/v4/users)
      */
     public function testStore(): void
     {
         Queue::fake();
 
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $deleted_priv = $this->getTestUser('deleted@kolab.org');
         $deleted_priv->delete();
 
         // Test empty request
         $response = $this->actingAs($john)->post("/api/v4/users", []);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("The email field is required.", $json['errors']['email']);
         $this->assertSame("The password field is required.", $json['errors']['password'][0]);
         $this->assertCount(2, $json);
 
         // Test access by user not being a wallet controller
         $post = ['first_name' => 'Test'];
         $response = $this->actingAs($jack)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(403);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Access denied", $json['message']);
         $this->assertCount(2, $json);
 
         // Test some invalid data
         $post = ['password' => '12345678', 'email' => 'invalid'];
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertSame('The password confirmation does not match.', $json['errors']['password'][0]);
         $this->assertSame('The specified email is invalid.', $json['errors']['email']);
 
         // Test existing user email
         $post = [
             'password' => 'simple',
             'password_confirmation' => 'simple',
             'first_name' => 'John2',
             'last_name' => 'Doe2',
             'email' => 'jack.daniels@kolab.org',
         ];
 
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertSame('The specified email is not available.', $json['errors']['email']);
 
         $package_kolab = \App\Package::where('title', 'kolab')->first();
         $package_domain = \App\Package::where('title', 'domain-hosting')->first();
 
         $post = [
             'password' => 'simple',
             'password_confirmation' => 'simple',
             'first_name' => 'John2',
             'last_name' => 'Doe2',
             'email' => 'john2.doe2@kolab.org',
             'organization' => 'TestOrg',
             'aliases' => ['useralias1@kolab.org', 'deleted@kolab.org'],
         ];
 
         // Missing package
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Package is required.", $json['errors']['package']);
         $this->assertCount(2, $json);
 
         // Invalid package
         $post['package'] = $package_domain->id;
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Invalid package selected.", $json['errors']['package']);
         $this->assertCount(2, $json);
 
         // Test full and valid data
         $post['package'] = $package_kolab->id;
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User created successfully.", $json['message']);
         $this->assertCount(2, $json);
 
         $user = User::where('email', 'john2.doe2@kolab.org')->first();
         $this->assertInstanceOf(User::class, $user);
         $this->assertSame('John2', $user->getSetting('first_name'));
         $this->assertSame('Doe2', $user->getSetting('last_name'));
         $this->assertSame('TestOrg', $user->getSetting('organization'));
         $aliases = $user->aliases()->orderBy('alias')->get();
         $this->assertCount(2, $aliases);
         $this->assertSame('deleted@kolab.org', $aliases[0]->alias);
         $this->assertSame('useralias1@kolab.org', $aliases[1]->alias);
         // Assert the new user entitlements
         $this->assertUserEntitlements($user, ['groupware', 'mailbox', 'storage', 'storage']);
         // Assert the wallet to which the new user should be assigned to
         $wallet = $user->wallet();
         $this->assertSame($john->wallets()->first()->id, $wallet->id);
 
         // Attempt to create a user previously deleted
         $user->delete();
 
         $post['package'] = $package_kolab->id;
         $post['aliases'] = [];
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User created successfully.", $json['message']);
         $this->assertCount(2, $json);
 
         $user = User::where('email', 'john2.doe2@kolab.org')->first();
         $this->assertInstanceOf(User::class, $user);
         $this->assertSame('John2', $user->getSetting('first_name'));
         $this->assertSame('Doe2', $user->getSetting('last_name'));
         $this->assertSame('TestOrg', $user->getSetting('organization'));
         $this->assertCount(0, $user->aliases()->get());
         $this->assertUserEntitlements($user, ['groupware', 'mailbox', 'storage', 'storage']);
 
         // Test acting as account controller (not owner)
 
         $this->markTestIncomplete();
     }
 
     /**
      * Test user update (PUT /api/v4/users/<user-id>)
      */
     public function testUpdate(): void
     {
         $userA = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $domain = $this->getTestDomain(
             'userscontroller.com',
             ['status' => Domain::STATUS_NEW, 'type' => Domain::TYPE_EXTERNAL]
         );
 
         // Test unauthorized update of other user profile
         $response = $this->actingAs($jack)->get("/api/v4/users/{$userA->id}", []);
         $response->assertStatus(403);
 
         // Test authorized update of account owner by account controller
         $response = $this->actingAs($ned)->get("/api/v4/users/{$john->id}", []);
         $response->assertStatus(200);
 
         // Test updating of self (empty request)
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", []);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User data updated successfully.", $json['message']);
         $this->assertTrue(!empty($json['statusInfo']));
         $this->assertCount(3, $json);
 
         // Test some invalid data
         $post = ['password' => '12345678', 'currency' => 'invalid'];
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertSame('The password confirmation does not match.', $json['errors']['password'][0]);
         $this->assertSame('The currency must be 3 characters.', $json['errors']['currency'][0]);
 
         // Test full profile update including password
         $post = [
             'password' => 'simple',
             'password_confirmation' => 'simple',
             'first_name' => 'John2',
             'last_name' => 'Doe2',
             'organization' => 'TestOrg',
             'phone' => '+123 123 123',
             'external_email' => 'external@gmail.com',
             'billing_address' => 'billing',
             'country' => 'CH',
             'currency' => 'CHF',
             'aliases' => ['useralias1@' . \config('app.domain'), 'useralias2@' . \config('app.domain')]
         ];
 
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User data updated successfully.", $json['message']);
         $this->assertTrue(!empty($json['statusInfo']));
         $this->assertCount(3, $json);
         $this->assertTrue($userA->password != $userA->fresh()->password);
         unset($post['password'], $post['password_confirmation'], $post['aliases']);
         foreach ($post as $key => $value) {
             $this->assertSame($value, $userA->getSetting($key));
         }
         $aliases = $userA->aliases()->orderBy('alias')->get();
         $this->assertCount(2, $aliases);
         $this->assertSame('useralias1@' . \config('app.domain'), $aliases[0]->alias);
         $this->assertSame('useralias2@' . \config('app.domain'), $aliases[1]->alias);
 
         // Test unsetting values
         $post = [
             'first_name' => '',
             'last_name' => '',
             'organization' => '',
             'phone' => '',
             'external_email' => '',
             'billing_address' => '',
             'country' => '',
             'currency' => '',
             'aliases' => ['useralias2@' . \config('app.domain')]
         ];
 
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User data updated successfully.", $json['message']);
         $this->assertTrue(!empty($json['statusInfo']));
         $this->assertCount(3, $json);
         unset($post['aliases']);
         foreach ($post as $key => $value) {
             $this->assertNull($userA->getSetting($key));
         }
         $aliases = $userA->aliases()->get();
         $this->assertCount(1, $aliases);
         $this->assertSame('useralias2@' . \config('app.domain'), $aliases[0]->alias);
 
         // Test error on some invalid aliases missing password confirmation
         $post = [
             'password' => 'simple123',
             'aliases' => [
                 'useralias2@' . \config('app.domain'),
                 'useralias1@kolab.org',
                 '@kolab.org',
             ]
         ];
 
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertCount(2, $json['errors']['aliases']);
         $this->assertSame("The specified domain is not available.", $json['errors']['aliases'][1]);
         $this->assertSame("The specified alias is invalid.", $json['errors']['aliases'][2]);
         $this->assertSame("The password confirmation does not match.", $json['errors']['password'][0]);
 
         // Test authorized update of other user
         $response = $this->actingAs($ned)->put("/api/v4/users/{$jack->id}", []);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertTrue(empty($json['statusInfo']));
 
         // TODO: Test error on aliases with invalid/non-existing/other-user's domain
 
         // Create entitlements and additional user for following tests
         $owner = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $user = $this->getTestUser('UsersControllerTest2@userscontroller.com');
         $package_domain = Package::where('title', 'domain-hosting')->first();
         $package_kolab = Package::where('title', 'kolab')->first();
         $package_lite = Package::where('title', 'lite')->first();
         $sku_mailbox = Sku::where('title', 'mailbox')->first();
         $sku_storage = Sku::where('title', 'storage')->first();
         $sku_groupware = Sku::where('title', 'groupware')->first();
 
         $domain = $this->getTestDomain(
             'userscontroller.com',
             [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_EXTERNAL,
             ]
         );
 
         $domain->assignPackage($package_domain, $owner);
         $owner->assignPackage($package_kolab);
         $owner->assignPackage($package_lite, $user);
 
         // Non-controller cannot update his own entitlements
         $post = ['skus' => []];
         $response = $this->actingAs($user)->put("/api/v4/users/{$user->id}", $post);
         $response->assertStatus(422);
 
         // Test updating entitlements
         $post = [
             'skus' => [
                 $sku_mailbox->id => 1,
                 $sku_storage->id => 3,
                 $sku_groupware->id => 1,
             ],
         ];
 
         $response = $this->actingAs($owner)->put("/api/v4/users/{$user->id}", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $storage_cost = $user->entitlements()
             ->where('sku_id', $sku_storage->id)
             ->orderBy('cost')
             ->pluck('cost')->all();
 
         $this->assertUserEntitlements(
             $user,
             ['groupware', 'mailbox', 'storage', 'storage', 'storage']
         );
 
         $this->assertSame([0, 0, 25], $storage_cost);
         $this->assertTrue(empty($json['statusInfo']));
     }
 
     /**
      * Test UsersController::updateEntitlements()
      */
     public function testUpdateEntitlements(): void
     {
         $jane = $this->getTestUser('jane@kolabnow.com');
 
         $kolab = \App\Package::where('title', 'kolab')->first();
         $storage = \App\Sku::where('title', 'storage')->first();
         $activesync = \App\Sku::where('title', 'activesync')->first();
         $groupware = \App\Sku::where('title', 'groupware')->first();
         $mailbox = \App\Sku::where('title', 'mailbox')->first();
 
         // standard package, 1 mailbox, 1 groupware, 2 storage
         $jane->assignPackage($kolab);
 
         // add 2 storage, 1 activesync
         $post = [
             'skus' => [
                 $mailbox->id => 1,
                 $groupware->id => 1,
                 $storage->id => 4,
                 $activesync->id => 1
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(200);
 
         $this->assertUserEntitlements(
             $jane,
             [
                 'activesync',
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
 
         // add 2 storage, remove 1 activesync
         $post = [
             'skus' => [
                 $mailbox->id => 1,
                 $groupware->id => 1,
                 $storage->id => 6,
                 $activesync->id => 0
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(200);
 
         $this->assertUserEntitlements(
             $jane,
             [
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
 
         // add mailbox
         $post = [
             'skus' => [
                 $mailbox->id => 2,
                 $groupware->id => 1,
                 $storage->id => 6,
                 $activesync->id => 0
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(500);
 
         $this->assertUserEntitlements(
             $jane,
             [
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
 
         // remove mailbox
         $post = [
             'skus' => [
                 $mailbox->id => 0,
                 $groupware->id => 1,
                 $storage->id => 6,
                 $activesync->id => 0
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(500);
 
         $this->assertUserEntitlements(
             $jane,
             [
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
 
         // less than free storage
         $post = [
             'skus' => [
                 $mailbox->id => 1,
                 $groupware->id => 1,
                 $storage->id => 1,
                 $activesync->id => 0
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(200);
 
         $this->assertUserEntitlements(
             $jane,
             [
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage'
             ]
         );
     }
 
     /**
      * Test user data response used in show and info actions
      */
     public function testUserResponse(): void
     {
         $provider = \config('services.payment_provider') ?: 'mollie';
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
         $wallet->setSettings(['mollie_id' => null, 'stripe_id' => null]);
         $result = $this->invokeMethod(new UsersController(), 'userResponse', [$user]);
 
         $this->assertEquals($user->id, $result['id']);
         $this->assertEquals($user->email, $result['email']);
         $this->assertEquals($user->status, $result['status']);
         $this->assertTrue(is_array($result['statusInfo']));
 
         $this->assertTrue(is_array($result['aliases']));
         $this->assertCount(1, $result['aliases']);
         $this->assertSame('john.doe@kolab.org', $result['aliases'][0]);
 
         $this->assertTrue(is_array($result['settings']));
         $this->assertSame('US', $result['settings']['country']);
         $this->assertSame('USD', $result['settings']['currency']);
 
         $this->assertTrue(is_array($result['accounts']));
         $this->assertTrue(is_array($result['wallets']));
         $this->assertCount(0, $result['accounts']);
         $this->assertCount(1, $result['wallets']);
         $this->assertSame($wallet->id, $result['wallet']['id']);
         $this->assertArrayNotHasKey('discount', $result['wallet']);
 
         $this->assertTrue($result['statusInfo']['enableDomains']);
         $this->assertTrue($result['statusInfo']['enableWallets']);
         $this->assertTrue($result['statusInfo']['enableUsers']);
 
         // Ned is John's wallet controller
         $ned = $this->getTestUser('ned@kolab.org');
         $ned_wallet = $ned->wallets()->first();
         $result = $this->invokeMethod(new UsersController(), 'userResponse', [$ned]);
 
         $this->assertEquals($ned->id, $result['id']);
         $this->assertEquals($ned->email, $result['email']);
         $this->assertTrue(is_array($result['accounts']));
         $this->assertTrue(is_array($result['wallets']));
         $this->assertCount(1, $result['accounts']);
         $this->assertCount(1, $result['wallets']);
         $this->assertSame($wallet->id, $result['wallet']['id']);
         $this->assertSame($wallet->id, $result['accounts'][0]['id']);
         $this->assertSame($ned_wallet->id, $result['wallets'][0]['id']);
         $this->assertSame($provider, $result['wallet']['provider']);
         $this->assertSame($provider, $result['wallets'][0]['provider']);
 
         $this->assertTrue($result['statusInfo']['enableDomains']);
         $this->assertTrue($result['statusInfo']['enableWallets']);
         $this->assertTrue($result['statusInfo']['enableUsers']);
 
         // Test discount in a response
         $discount = Discount::where('code', 'TEST')->first();
         $wallet->discount()->associate($discount);
         $wallet->save();
         $mod_provider = $provider == 'mollie' ? 'stripe' : 'mollie';
         $wallet->setSetting($mod_provider . '_id', 123);
         $user->refresh();
 
         $result = $this->invokeMethod(new UsersController(), 'userResponse', [$user]);
 
         $this->assertEquals($user->id, $result['id']);
         $this->assertSame($discount->id, $result['wallet']['discount_id']);
         $this->assertSame($discount->discount, $result['wallet']['discount']);
         $this->assertSame($discount->description, $result['wallet']['discount_description']);
         $this->assertSame($mod_provider, $result['wallet']['provider']);
         $this->assertSame($discount->id, $result['wallets'][0]['discount_id']);
         $this->assertSame($discount->discount, $result['wallets'][0]['discount']);
         $this->assertSame($discount->description, $result['wallets'][0]['discount_description']);
         $this->assertSame($mod_provider, $result['wallets'][0]['provider']);
 
         // Jack is not a John's wallet controller
         $jack = $this->getTestUser('jack@kolab.org');
         $result = $this->invokeMethod(new UsersController(), 'userResponse', [$jack]);
 
         $this->assertFalse($result['statusInfo']['enableDomains']);
         $this->assertFalse($result['statusInfo']['enableWallets']);
         $this->assertFalse($result['statusInfo']['enableUsers']);
     }
 
     /**
      * List of email address validation cases for testValidateEmail()
      *
      * @return array Arguments for testValidateEmail()
      */
     public function dataValidateEmail(): array
     {
         $this->refreshApplication();
         $public_domains = Domain::getPublicDomains();
         $domain = reset($public_domains);
 
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
 
         return [
             // Invalid format
             ["$domain", $john, 'The specified email is invalid.'],
             [".@$domain", $john, 'The specified email is invalid.'],
             ["test123456@localhost", $john, 'The specified domain is invalid.'],
             ["test123456@unknown-domain.org", $john, 'The specified domain is invalid.'],
 
             ["$domain", $john, 'The specified email is invalid.'],
             [".@$domain", $john, 'The specified email is invalid.'],
 
             // forbidden local part on public domains
             ["admin@$domain", $john, 'The specified email is not available.'],
             ["administrator@$domain", $john, 'The specified email is not available.'],
 
             // forbidden (other user's domain)
             ["testtest@kolab.org", $user, 'The specified domain is not available.'],
 
             // existing alias of other user, to be a user email
             ["jack.daniels@kolab.org", $john, 'The specified email is not available.'],
 
             // valid (user domain)
             ["admin@kolab.org", $john, null],
 
             // valid (public domain)
             ["test.test@$domain", $john, null],
         ];
     }
 
     /**
      * User email address validation.
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      *
      * @dataProvider dataValidateEmail
      */
     public function testValidateEmail($email, $user, $expected_result): void
     {
         $result = UsersController::validateEmail($email, $user);
         $this->assertSame($expected_result, $result);
     }
 
     /**
      * User email validation - tests for $deleted argument
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      */
     public function testValidateEmailDeleted(): void
     {
         Queue::fake();
 
         $john = $this->getTestUser('john@kolab.org');
         $deleted_priv = $this->getTestUser('deleted@kolab.org');
         $deleted_priv->delete();
         $deleted_pub = $this->getTestUser('deleted@kolabnow.com');
         $deleted_pub->delete();
 
         $result = UsersController::validateEmail('deleted@kolab.org', $john, $deleted);
         $this->assertSame(null, $result);
         $this->assertSame($deleted_priv->id, $deleted->id);
 
         $result = UsersController::validateEmail('deleted@kolabnow.com', $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertSame(null, $deleted);
 
         $result = UsersController::validateEmail('jack@kolab.org', $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertSame(null, $deleted);
     }
 
     /**
      * User email validation - tests for an address being a group email address
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      */
     public function testValidateEmailGroup(): void
     {
         Queue::fake();
 
         $john = $this->getTestUser('john@kolab.org');
         $pub_group = $this->getTestGroup('group-test@kolabnow.com');
         $priv_group = $this->getTestGroup('group-test@kolab.org');
 
         // A group in a public domain, existing
         $result = UsersController::validateEmail($pub_group->email, $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertNull($deleted);
 
         $pub_group->delete();
 
         // A group in a public domain, deleted
         $result = UsersController::validateEmail($pub_group->email, $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertNull($deleted);
 
         // A group in a private domain, existing
         $result = UsersController::validateEmail($priv_group->email, $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertNull($deleted);
 
         $priv_group->delete();
 
         // A group in a private domain, deleted
         $result = UsersController::validateEmail($priv_group->email, $john, $deleted);
         $this->assertSame(null, $result);
         $this->assertSame($priv_group->id, $deleted->id);
     }
 
     /**
      * List of alias validation cases for testValidateAlias()
      *
      * @return array Arguments for testValidateAlias()
      */
     public function dataValidateAlias(): array
     {
         $this->refreshApplication();
         $public_domains = Domain::getPublicDomains();
         $domain = reset($public_domains);
 
         $john = $this->getTestUser('john@kolab.org');
-        $jack = $this->getTestUser('jack@kolab.org');
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
 
         return [
             // Invalid format
             ["$domain", $john, 'The specified alias is invalid.'],
             [".@$domain", $john, 'The specified alias is invalid.'],
             ["test123456@localhost", $john, 'The specified domain is invalid.'],
             ["test123456@unknown-domain.org", $john, 'The specified domain is invalid.'],
 
             ["$domain", $john, 'The specified alias is invalid.'],
             [".@$domain", $john, 'The specified alias is invalid.'],
 
             // forbidden local part on public domains
             ["admin@$domain", $john, 'The specified alias is not available.'],
             ["administrator@$domain", $john, 'The specified alias is not available.'],
 
             // forbidden (other user's domain)
             ["testtest@kolab.org", $user, 'The specified domain is not available.'],
 
             // existing alias of other user, to be an alias, user in the same group account
             ["jack.daniels@kolab.org", $john, null],
 
             // existing user
             ["jack@kolab.org", $john, 'The specified alias is not available.'],
 
             // valid (user domain)
             ["admin@kolab.org", $john, null],
 
             // valid (public domain)
             ["test.test@$domain", $john, null],
         ];
     }
 
     /**
      * User email alias validation.
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      *
      * @dataProvider dataValidateAlias
      */
     public function testValidateAlias($alias, $user, $expected_result): void
     {
         $result = UsersController::validateAlias($alias, $user);
         $this->assertSame($expected_result, $result);
     }
 
     /**
      * User alias validation - more cases.
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      */
     public function testValidateAlias2(): void
     {
         Queue::fake();
 
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $deleted_priv = $this->getTestUser('deleted@kolab.org');
         $deleted_priv->setAliases(['deleted-alias@kolab.org']);
         $deleted_priv->delete();
         $deleted_pub = $this->getTestUser('deleted@kolabnow.com');
         $deleted_pub->setAliases(['deleted-alias@kolabnow.com']);
         $deleted_pub->delete();
         $group = $this->getTestGroup('group-test@kolabnow.com');
 
         // An alias that was a user email before is allowed, but only for custom domains
         $result = UsersController::validateAlias('deleted@kolab.org', $john);
         $this->assertSame(null, $result);
 
         $result = UsersController::validateAlias('deleted-alias@kolab.org', $john);
         $this->assertSame(null, $result);
 
         $result = UsersController::validateAlias('deleted@kolabnow.com', $john);
         $this->assertSame('The specified alias is not available.', $result);
 
         $result = UsersController::validateAlias('deleted-alias@kolabnow.com', $john);
         $this->assertSame('The specified alias is not available.', $result);
 
         // A grpoup with the same email address exists
         $result = UsersController::validateAlias($group->email, $john);
         $this->assertSame('The specified alias is not available.', $result);
     }
 }
diff --git a/src/tests/TestCaseTrait.php b/src/tests/TestCaseTrait.php
index e27166f4..d88cbe72 100644
--- a/src/tests/TestCaseTrait.php
+++ b/src/tests/TestCaseTrait.php
@@ -1,245 +1,248 @@
 <?php
 
 namespace Tests;
 
 use App\Domain;
 use App\Group;
 use App\Transaction;
 use App\User;
 use Carbon\Carbon;
 use Illuminate\Contracts\Console\Kernel;
 use Illuminate\Support\Facades\Queue;
 use PHPUnit\Framework\Assert;
 
 trait TestCaseTrait
 {
     /**
      * Assert user entitlements state
      */
     protected function assertUserEntitlements($user, $expected)
     {
         // Assert the user entitlements
         $skus = $user->entitlements()->get()
             ->map(function ($ent) {
                 return $ent->sku->title;
             })
             ->toArray();
 
         sort($skus);
 
         Assert::assertSame($expected, $skus);
     }
 
     /**
      * Removes all beta entitlements from the database
      */
     protected function clearBetaEntitlements(): void
     {
-        $betas = \App\Sku::where('handler_class', 'like', 'App\\Handlers\\Beta\\%')
-            ->orWhere('handler_class', 'App\Handlers\Beta')
-            ->pluck('id')->all();
+        $beta_handlers = [
+            'App\Handlers\Beta',
+            'App\Handlers\Distlist',
+        ];
+
+        $betas = \App\Sku::whereIn('handler_class', $beta_handlers)->pluck('id')->all();
 
         \App\Entitlement::whereIn('sku_id', $betas)->delete();
     }
 
     /**
      * Creates the application.
      *
      * @return \Illuminate\Foundation\Application
      */
     public function createApplication()
     {
         $app = require __DIR__ . '/../bootstrap/app.php';
 
         $app->make(Kernel::class)->bootstrap();
 
         return $app;
     }
 
     /**
      * Create a set of transaction log entries for a wallet
      */
     protected function createTestTransactions($wallet)
     {
         $result = [];
         $date = Carbon::now();
         $debit = 0;
         $entitlementTransactions = [];
         foreach ($wallet->entitlements as $entitlement) {
             if ($entitlement->cost) {
                 $debit += $entitlement->cost;
                 $entitlementTransactions[] = $entitlement->createTransaction(
                     Transaction::ENTITLEMENT_BILLED,
                     $entitlement->cost
                 );
             }
         }
 
         $transaction = Transaction::create([
                 'user_email' => 'jeroen@jeroen.jeroen',
                 'object_id' => $wallet->id,
                 'object_type' => \App\Wallet::class,
                 'type' => Transaction::WALLET_DEBIT,
                 'amount' => $debit * -1,
                 'description' => 'Payment',
         ]);
         $result[] = $transaction;
 
         Transaction::whereIn('id', $entitlementTransactions)->update(['transaction_id' => $transaction->id]);
 
         $transaction = Transaction::create([
                 'user_email' => null,
                 'object_id' => $wallet->id,
                 'object_type' => \App\Wallet::class,
                 'type' => Transaction::WALLET_CREDIT,
                 'amount' => 2000,
                 'description' => 'Payment',
         ]);
         $transaction->created_at = $date->next(Carbon::MONDAY);
         $transaction->save();
         $result[] = $transaction;
 
         $types = [
             Transaction::WALLET_AWARD,
             Transaction::WALLET_PENALTY,
         ];
 
         // The page size is 10, so we generate so many to have at least two pages
         $loops = 10;
         while ($loops-- > 0) {
             $type = $types[count($result) % count($types)];
             $transaction = Transaction::create([
                 'user_email' => 'jeroen.@jeroen.jeroen',
                 'object_id' => $wallet->id,
                 'object_type' => \App\Wallet::class,
                 'type' => $type,
                 'amount' => 11 * (count($result) + 1) * ($type == Transaction::WALLET_PENALTY ? -1 : 1),
                 'description' => 'TRANS' . $loops,
             ]);
             $transaction->created_at = $date->next(Carbon::MONDAY);
             $transaction->save();
             $result[] = $transaction;
         }
 
         return $result;
     }
 
     protected function deleteTestDomain($name)
     {
         Queue::fake();
 
         $domain = Domain::withTrashed()->where('namespace', $name)->first();
 
         if (!$domain) {
             return;
         }
 
         $job = new \App\Jobs\Domain\DeleteJob($domain->id);
         $job->handle();
 
         $domain->forceDelete();
     }
 
     protected function deleteTestGroup($email)
     {
         Queue::fake();
 
         $group = Group::withTrashed()->where('email', $email)->first();
 
         if (!$group) {
             return;
         }
 
         $job = new \App\Jobs\Group\DeleteJob($group->id);
         $job->handle();
 
         $group->forceDelete();
     }
 
     protected function deleteTestUser($email)
     {
         Queue::fake();
 
         $user = User::withTrashed()->where('email', $email)->first();
 
         if (!$user) {
             return;
         }
 
         $job = new \App\Jobs\User\DeleteJob($user->id);
         $job->handle();
 
         $user->forceDelete();
     }
 
     /**
      * Get Domain object by namespace, create it if needed.
      * Skip LDAP jobs.
      */
     protected function getTestDomain($name, $attrib = [])
     {
         // Disable jobs (i.e. skip LDAP oprations)
         Queue::fake();
         return Domain::firstOrCreate(['namespace' => $name], $attrib);
     }
 
     /**
      * Get Group object by email, create it if needed.
      * Skip LDAP jobs.
      */
     protected function getTestGroup($email, $attrib = [])
     {
         // Disable jobs (i.e. skip LDAP oprations)
         Queue::fake();
         return Group::firstOrCreate(['email' => $email], $attrib);
     }
 
     /**
      * Get User object by email, create it if needed.
      * Skip LDAP jobs.
      */
     protected function getTestUser($email, $attrib = [])
     {
         // Disable jobs (i.e. skip LDAP oprations)
         Queue::fake();
         $user = User::firstOrCreate(['email' => $email], $attrib);
 
         if ($user->trashed()) {
             // Note: we do not want to use user restore here
             User::where('id', $user->id)->forceDelete();
             $user = User::create(['email' => $email] + $attrib);
         }
 
         return $user;
     }
 
     /**
      * Helper to access protected property of an object
      */
     protected static function getObjectProperty($object, $property_name)
     {
         $reflection = new \ReflectionClass($object);
         $property = $reflection->getProperty($property_name);
         $property->setAccessible(true);
 
         return $property->getValue($object);
     }
 
     /**
      * Call protected/private method of a class.
      *
      * @param object $object     Instantiated object that we will run method on.
      * @param string $methodName Method name to call
      * @param array  $parameters Array of parameters to pass into method.
      *
      * @return mixed Method return.
      */
     protected function invokeMethod($object, $methodName, array $parameters = array())
     {
         $reflection = new \ReflectionClass(get_class($object));
         $method = $reflection->getMethod($methodName);
         $method->setAccessible(true);
 
         return $method->invokeArgs($object, $parameters);
     }
 }