diff --git a/src/app/Http/Controllers/API/SignupController.php b/src/app/Http/Controllers/API/SignupController.php
index 3e4ec0a7..9a6193ce 100644
--- a/src/app/Http/Controllers/API/SignupController.php
+++ b/src/app/Http/Controllers/API/SignupController.php
@@ -1,440 +1,474 @@
 <?php
 
 namespace App\Http\Controllers\API;
 
 use App\Http\Controllers\Controller;
 use App\Jobs\SignupVerificationEmail;
 use App\Discount;
 use App\Domain;
 use App\Plan;
 use App\Rules\SignupExternalEmail;
 use App\Rules\SignupToken;
 use App\Rules\Password;
 use App\Rules\UserEmailDomain;
 use App\Rules\UserEmailLocal;
 use App\SignupCode;
 use App\SignupInvitation;
 use App\User;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Support\Str;
 
 /**
  * Signup process API
  */
 class SignupController extends Controller
 {
     /**
      * Returns plans definitions for signup.
      *
      * @param \Illuminate\Http\Request $request HTTP request
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function plans(Request $request)
     {
         $plans = [];
 
         // Use reverse order just to have individual on left, group on right ;)
-        Plan::withEnvTenantContext()->orderByDesc('title')->get()
+        // But prefer monthly on left, yearly on right
+        Plan::withEnvTenantContext()->orderBy('months')->orderByDesc('title')->get()
             ->map(function ($plan) use (&$plans) {
                 // Allow themes to set custom button label
                 $button = \trans('theme::app.planbutton-' . $plan->title);
                 if ($button == 'theme::app.planbutton-' . $plan->title) {
                     $button = \trans('app.planbutton', ['plan' => $plan->name]);
                 }
 
                 $plans[] = [
                     'title' => $plan->title,
                     'name' => $plan->name,
                     'button' => $button,
                     'description' => $plan->description,
                     'mode' => $plan->mode ?: 'email',
+                    'isDomain' => $plan->hasDomain(),
                 ];
             });
 
         return response()->json(['status' => 'success', 'plans' => $plans]);
     }
 
+    /**
+     * Returns list of public domains for signup.
+     *
+     * @param \Illuminate\Http\Request $request HTTP request
+     *
+     * @return \Illuminate\Http\JsonResponse JSON response
+     */
+    public function domains(Request $request)
+    {
+        return response()->json(['status' => 'success', 'domains' => Domain::getPublicDomains()]);
+    }
+
     /**
      * Starts signup process.
      *
      * Verifies user name and email/phone, sends verification email/sms message.
      * Returns the verification code.
      *
      * @param \Illuminate\Http\Request $request HTTP request
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function init(Request $request)
     {
         $rules = [
             'first_name' => 'max:128',
             'last_name' => 'max:128',
             'voucher' => 'max:32',
         ];
 
         $plan = $this->getPlan();
 
         if ($plan->mode == 'token') {
             $rules['token'] = ['required', 'string', new SignupToken()];
         } else {
             $rules['email'] = ['required', 'string', new SignupExternalEmail()];
         }
 
         // Check required fields, validate input
         $v = Validator::make($request->all(), $rules);
 
         if ($v->fails()) {
             return response()->json(['status' => 'error', 'errors' => $v->errors()->toArray()], 422);
         }
 
         // Generate the verification code
         $code = SignupCode::create([
                 'email' => $plan->mode == 'token' ? $request->token : $request->email,
                 'first_name' => $request->first_name,
                 'last_name' => $request->last_name,
                 'plan' => $plan->title,
                 'voucher' => $request->voucher,
         ]);
 
         $response = [
             'status' => 'success',
             'code' => $code->code,
             'mode' => $plan->mode ?: 'email',
         ];
 
         if ($plan->mode == 'token') {
             // Token verification, jump to the last step
             $has_domain = $plan->hasDomain();
 
             $response['short_code'] = $code->short_code;
             $response['is_domain'] = $has_domain;
             $response['domains'] = $has_domain ? [] : Domain::getPublicDomains();
         } else {
             // External email verification, send an email message
             SignupVerificationEmail::dispatch($code);
         }
 
         return response()->json($response);
     }
 
     /**
      * Returns signup invitation information.
      *
      * @param string $id Signup invitation identifier
      *
      * @return \Illuminate\Http\JsonResponse|void
      */
     public function invitation($id)
     {
         $invitation = SignupInvitation::withEnvTenantContext()->find($id);
 
         if (empty($invitation) || $invitation->isCompleted()) {
             return $this->errorResponse(404);
         }
 
         $has_domain = $this->getPlan()->hasDomain();
 
         $result = [
             'id' => $id,
             'is_domain' => $has_domain,
             'domains' => $has_domain ? [] : Domain::getPublicDomains(),
         ];
 
         return response()->json($result);
     }
 
 
     /**
      * Validation of the verification code.
      *
      * @param \Illuminate\Http\Request $request HTTP request
      * @param bool                     $update  Update the signup code record
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function verify(Request $request, $update = true)
     {
         // Validate the request args
         $v = Validator::make(
             $request->all(),
             [
                 'code' => 'required',
                 'short_code' => 'required',
             ]
         );
 
         if ($v->fails()) {
             return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
         }
 
         // Validate the verification code
         $code = SignupCode::find($request->code);
 
         if (
             empty($code)
             || $code->isExpired()
             || Str::upper($request->short_code) !== Str::upper($code->short_code)
         ) {
             $errors = ['short_code' => "The code is invalid or expired."];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         // For signup last-step mode remember the code object, so we can delete it
         // with single SQL query (->delete()) instead of two
         $request->code = $code;
 
         if ($update) {
             $code->verify_ip_address = $request->ip();
             $code->save();
         }
 
         $has_domain = $this->getPlan()->hasDomain();
 
         // Return user name and email/phone/voucher from the codes database,
         // domains list for selection and "plan type" flag
         return response()->json([
                 'status' => 'success',
                 'email' => $code->email,
                 'first_name' => $code->first_name,
                 'last_name' => $code->last_name,
                 'voucher' => $code->voucher,
                 'is_domain' => $has_domain,
                 'domains' => $has_domain ? [] : Domain::getPublicDomains(),
         ]);
     }
 
     /**
      * Finishes the signup process by creating the user account.
      *
      * @param \Illuminate\Http\Request $request HTTP request
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function signup(Request $request)
     {
         // Validate input
         $v = Validator::make(
             $request->all(),
             [
                 'login' => 'required|min:2',
                 'password' => ['required', 'confirmed', new Password()],
                 'domain' => 'required',
                 'voucher' => 'max:32',
             ]
         );
 
         if ($v->fails()) {
             return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
         }
 
-        // Signup via invitation
-        if ($request->invitation) {
+
+        $settings = [];
+
+        // Plan parameter is required/allowed in mandate mode
+        if (!empty($request->plan) && empty($request->code) && empty($request->invitation)) {
+            $plan = Plan::withEnvTenantContext()->where('title', $request->plan)->first();
+
+            if (!$plan || $plan->mode != 'mandate') {
+                $msg = \trans('validation.exists', ['attribute' => 'plan']);
+                return response()->json(['status' => 'error', 'errors' => ['plan' => $msg]], 422);
+            }
+        } elseif ($request->invitation) {
+            // Signup via invitation
             $invitation = SignupInvitation::withEnvTenantContext()->find($request->invitation);
 
             if (empty($invitation) || $invitation->isCompleted()) {
                 return $this->errorResponse(404);
             }
 
             // Check required fields
             $v = Validator::make(
                 $request->all(),
                 [
                     'first_name' => 'max:128',
                     'last_name' => 'max:128',
-                    'voucher' => 'max:32',
                 ]
             );
 
             $errors = $v->fails() ? $v->errors()->toArray() : [];
 
             if (!empty($errors)) {
                 return response()->json(['status' => 'error', 'errors' => $errors], 422);
             }
 
             $settings = [
                 'external_email' => $invitation->email,
                 'first_name' => $request->first_name,
                 'last_name' => $request->last_name,
             ];
         } else {
             // Validate verification codes (again)
             $v = $this->verify($request, false);
             if ($v->status() !== 200) {
                 return $v;
             }
 
+            $plan = $this->getPlan();
+
             // Get user name/email from the verification code database
             $code_data = $v->getData();
 
             $settings = [
                 'first_name' => $code_data->first_name,
                 'last_name' => $code_data->last_name,
             ];
 
-            if ($this->getPlan()->mode == 'token') {
+            if ($plan->mode == 'token') {
                 $settings['signup_token'] = $code_data->email;
             } else {
                 $settings['external_email'] = $code_data->email;
             }
         }
 
         // Find the voucher discount
         if ($request->voucher) {
             $discount = Discount::where('code', \strtoupper($request->voucher))
                 ->where('active', true)->first();
 
             if (!$discount) {
                 $errors = ['voucher' => \trans('validation.voucherinvalid')];
                 return response()->json(['status' => 'error', 'errors' => $errors], 422);
             }
         }
 
-        // Get the plan
-        $plan = $this->getPlan();
-        $is_domain = $plan->hasDomain();
+        if (empty($plan)) {
+            $plan = $this->getPlan();
+        }
 
+        $is_domain = $plan->hasDomain();
         $login = $request->login;
         $domain_name = $request->domain;
 
         // Validate login
         if ($errors = self::validateLogin($login, $domain_name, $is_domain)) {
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         // We allow only ASCII, so we can safely lower-case the email address
         $login = Str::lower($login);
         $domain_name = Str::lower($domain_name);
         $domain = null;
 
         DB::beginTransaction();
 
         // Create domain record
         if ($is_domain) {
             $domain = Domain::create([
                     'namespace' => $domain_name,
                     'type' => Domain::TYPE_EXTERNAL,
             ]);
         }
 
         // Create user record
         $user = User::create([
                 'email' => $login . '@' . $domain_name,
                 'password' => $request->password,
                 'status' => User::STATUS_RESTRICTED,
         ]);
 
         if (!empty($discount)) {
             $wallet = $user->wallets()->first();
             $wallet->discount()->associate($discount);
             $wallet->save();
         }
 
         $user->assignPlan($plan, $domain);
 
         // Save the external email and plan in user settings
         $user->setSettings($settings);
 
         // Update the invitation
         if (!empty($invitation)) {
             $invitation->status = SignupInvitation::STATUS_COMPLETED;
             $invitation->user_id = $user->id;
             $invitation->save();
         }
 
         // Soft-delete the verification code, and store some more info with it
         if ($request->code) {
             $request->code->user_id = $user->id;
             $request->code->submit_ip_address = $request->ip();
             $request->code->deleted_at = \now();
             $request->code->timestamps = false;
             $request->code->save();
         }
 
         DB::commit();
 
-        return AuthController::logonResponse($user, $request->password);
+        $response = AuthController::logonResponse($user, $request->password);
+
+        // Redirect the user to the specified page
+        // $data = $response->getData(true);
+        // $data['redirect'] = 'wallet';
+        // $response->setData($data);
+
+        return $response;
     }
 
     /**
      * Returns plan for the signup process
      *
      * @returns \App\Plan Plan object selected for current signup process
      */
     protected function getPlan()
     {
         $request = request();
 
         if (!$request->plan || !$request->plan instanceof Plan) {
             // Get the plan if specified and exists...
-            if ($request->code && $request->code->plan) {
+            if (($request->code instanceof SignupCode) && $request->code->plan) {
                 $plan = Plan::withEnvTenantContext()->where('title', $request->code->plan)->first();
             } elseif ($request->plan) {
                 $plan = Plan::withEnvTenantContext()->where('title', $request->plan)->first();
             }
 
             // ...otherwise use the default plan
             if (empty($plan)) {
                 // TODO: Get default plan title from config
                 $plan = Plan::withEnvTenantContext()->where('title', 'individual')->first();
             }
 
             $request->plan = $plan;
         }
 
         return $request->plan;
     }
 
     /**
      * Login (kolab identity) validation
      *
      * @param string $login    Login (local part of an email address)
      * @param string $domain   Domain name
      * @param bool   $external Enables additional checks for domain part
      *
      * @return array Error messages on validation error
      */
     protected static function validateLogin($login, $domain, $external = false): ?array
     {
         // Validate login part alone
         $v = Validator::make(
             ['login' => $login],
             ['login' => ['required', 'string', new UserEmailLocal($external)]]
         );
 
         if ($v->fails()) {
             return ['login' => $v->errors()->toArray()['login'][0]];
         }
 
         $domains = $external ? null : Domain::getPublicDomains();
 
         // Validate the domain
         $v = Validator::make(
             ['domain' => $domain],
             ['domain' => ['required', 'string', new UserEmailDomain($domains)]]
         );
 
         if ($v->fails()) {
             return ['domain' => $v->errors()->toArray()['domain'][0]];
         }
 
         $domain = Str::lower($domain);
 
         // Check if domain is already registered with us
         if ($external) {
             if (Domain::withTrashed()->where('namespace', $domain)->exists()) {
                 return ['domain' => \trans('validation.domainexists')];
             }
         }
 
         // Check if user with specified login already exists
         $email = $login . '@' . $domain;
         if (User::emailExists($email) || User::aliasExists($email) || \App\Group::emailExists($email)) {
             return ['login' => \trans('validation.loginexists')];
         }
 
         return null;
     }
 }
diff --git a/src/app/Http/Controllers/API/V4/PaymentsController.php b/src/app/Http/Controllers/API/V4/PaymentsController.php
index 17d6638d..9eab311b 100644
--- a/src/app/Http/Controllers/API/V4/PaymentsController.php
+++ b/src/app/Http/Controllers/API/V4/PaymentsController.php
@@ -1,519 +1,540 @@
 <?php
 
 namespace App\Http\Controllers\API\V4;
 
 use App\Http\Controllers\Controller;
 use App\Payment;
 use App\Providers\PaymentProvider;
 use App\Tenant;
 use App\Wallet;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Validator;
 
 class PaymentsController extends Controller
 {
     /**
      * Get the auto-payment mandate info.
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function mandate()
     {
         $user = $this->guard()->user();
 
         // TODO: Wallet selection
         $wallet = $user->wallets()->first();
 
         $mandate = self::walletMandate($wallet);
 
         return response()->json($mandate);
     }
 
     /**
      * Create a new auto-payment mandate.
      *
      * @param \Illuminate\Http\Request $request The API request.
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function mandateCreate(Request $request)
     {
         $user = $this->guard()->user();
 
         // TODO: Wallet selection
         $wallet = $user->wallets()->first();
 
         // Input validation
         if ($errors = self::mandateValidate($request, $wallet)) {
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         $wallet->setSettings([
                 'mandate_amount' => $request->amount,
                 'mandate_balance' => $request->balance,
         ]);
 
         $mandate = [
             'currency' => $wallet->currency,
             'description' => Tenant::getConfig($user->tenant_id, 'app.name') . ' Auto-Payment Setup',
             'methodId' => $request->methodId ?: PaymentProvider::METHOD_CREDITCARD,
         ];
 
         // Normally the auto-payment setup operation is 0, if the balance is below the threshold
         // we'll top-up the wallet with the configured auto-payment amount
         if ($wallet->balance < intval($request->balance * 100)) {
             $mandate['amount'] = intval($request->amount * 100);
 
             self::addTax($wallet, $mandate);
         }
 
         $provider = PaymentProvider::factory($wallet);
 
         $result = $provider->createMandate($wallet, $mandate);
 
         $result['status'] = 'success';
 
         return response()->json($result);
     }
 
     /**
      * Revoke the auto-payment mandate.
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function mandateDelete()
     {
         $user = $this->guard()->user();
 
         // TODO: Wallet selection
         $wallet = $user->wallets()->first();
 
         $provider = PaymentProvider::factory($wallet);
 
         $provider->deleteMandate($wallet);
 
         $wallet->setSetting('mandate_disabled', null);
 
         return response()->json([
                 'status' => 'success',
                 'message' => \trans('app.mandate-delete-success'),
         ]);
     }
 
     /**
      * Update a new auto-payment mandate.
      *
      * @param \Illuminate\Http\Request $request The API request.
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function mandateUpdate(Request $request)
     {
         $user = $this->guard()->user();
 
         // TODO: Wallet selection
         $wallet = $user->wallets()->first();
 
         // Input validation
         if ($errors = self::mandateValidate($request, $wallet)) {
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         $wallet->setSettings([
                 'mandate_amount' => $request->amount,
                 'mandate_balance' => $request->balance,
                 // Re-enable the mandate to give it a chance to charge again
                 // after it has been disabled (e.g. because the mandate amount was too small)
                 'mandate_disabled' => null,
         ]);
 
         // Trigger auto-payment if the balance is below the threshold
         if ($wallet->balance < intval($request->balance * 100)) {
             \App\Jobs\WalletCharge::dispatch($wallet);
         }
 
         $result = self::walletMandate($wallet);
         $result['status'] = 'success';
         $result['message'] = \trans('app.mandate-update-success');
 
         return response()->json($result);
     }
 
     /**
      * Validate an auto-payment mandate request.
      *
      * @param \Illuminate\Http\Request $request The API request.
      * @param \App\Wallet              $wallet  The wallet
      *
      * @return array|null List of errors on error or Null on success
      */
     protected static function mandateValidate(Request $request, Wallet $wallet)
     {
         $rules = [
             'amount' => 'required|numeric',
             'balance' => 'required|numeric|min:0',
         ];
 
         // Check required fields
         $v = Validator::make($request->all(), $rules);
 
         // TODO: allow comma as a decimal point?
 
         if ($v->fails()) {
             return $v->errors()->toArray();
         }
 
         $amount = (int) ($request->amount * 100);
 
         // Validate the minimum value
-        // It has to be at least minimum payment amount and must cover current debt
-        if (
-            $wallet->balance < 0
-            && $wallet->balance <= Payment::MIN_AMOUNT * -1
-            && $wallet->balance + $amount < 0
-        ) {
-            return ['amount' => \trans('validation.minamountdebt')];
+        // It has to be at least minimum payment amount and must cover current debt,
+        // and must be more than a yearly/monthly payment (according to the plan)
+        $min = Payment::MIN_AMOUNT;
+        $label = 'minamount';
+
+        if (($plan = $wallet->plan()) && $plan->months >= 1) {
+            $planCost = (int) ceil($plan->cost() * $plan->months);
+            if ($planCost > $min) {
+                $min = $planCost;
+            }
         }
 
-        if ($amount < Payment::MIN_AMOUNT) {
-            $min = $wallet->money(Payment::MIN_AMOUNT);
-            return ['amount' => \trans('validation.minamount', ['amount' => $min])];
+        if ($wallet->balance < 0 && $wallet->balance < $min * -1) {
+            $min = $wallet->balance * -1;
+            $label = 'minamountdebt';
+        }
+
+        if ($amount < $min) {
+            return ['amount' => \trans("validation.{$label}", ['amount' => $wallet->money($min)])];
         }
 
         return null;
     }
 
     /**
      * Create a new payment.
      *
      * @param \Illuminate\Http\Request $request The API request.
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function store(Request $request)
     {
         $user = $this->guard()->user();
 
         // TODO: Wallet selection
         $wallet = $user->wallets()->first();
 
         $rules = [
             'amount' => 'required|numeric',
         ];
 
         // Check required fields
         $v = Validator::make($request->all(), $rules);
 
         // TODO: allow comma as a decimal point?
 
         if ($v->fails()) {
             return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
         }
 
         $amount = (int) ($request->amount * 100);
 
         // Validate the minimum value
         if ($amount < Payment::MIN_AMOUNT) {
             $min = $wallet->money(Payment::MIN_AMOUNT);
             $errors = ['amount' => \trans('validation.minamount', ['amount' => $min])];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         $currency = $request->currency;
 
         $request = [
             'type' => Payment::TYPE_ONEOFF,
             'currency' => $currency,
             'amount' => $amount,
             'methodId' => $request->methodId ?: PaymentProvider::METHOD_CREDITCARD,
             'description' => Tenant::getConfig($user->tenant_id, 'app.name') . ' Payment',
         ];
 
         self::addTax($wallet, $request);
 
         $provider = PaymentProvider::factory($wallet, $currency);
 
         $result = $provider->payment($wallet, $request);
 
         $result['status'] = 'success';
 
         return response()->json($result);
     }
 
     /**
      * Delete a pending payment.
      *
      * @param \Illuminate\Http\Request $request The API request.
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     // TODO currently unused
     // public function cancel(Request $request)
     // {
     //     $user = $this->guard()->user();
 
     //     // TODO: Wallet selection
     //     $wallet = $user->wallets()->first();
 
     //     $paymentId = $request->payment;
 
     //     $user_owns_payment = Payment::where('id', $paymentId)
     //         ->where('wallet_id', $wallet->id)
     //         ->exists();
 
     //     if (!$user_owns_payment) {
     //         return $this->errorResponse(404);
     //     }
 
     //     $provider = PaymentProvider::factory($wallet);
     //     if ($provider->cancel($wallet, $paymentId)) {
     //         $result = ['status' => 'success'];
     //         return response()->json($result);
     //     }
 
     //     return $this->errorResponse(404);
     // }
 
     /**
      * Update payment status (and balance).
      *
      * @param string $provider Provider name
      *
      * @return \Illuminate\Http\Response The response
      */
     public function webhook($provider)
     {
         $code = 200;
 
         if ($provider = PaymentProvider::factory($provider)) {
             $code = $provider->webhook();
         }
 
         return response($code < 400 ? 'Success' : 'Server error', $code);
     }
 
     /**
      * Top up a wallet with a "recurring" payment.
      *
      * @param \App\Wallet $wallet The wallet to charge
      *
      * @return bool True if the payment has been initialized
      */
     public static function topUpWallet(Wallet $wallet): bool
     {
         $settings = $wallet->getSettings(['mandate_disabled', 'mandate_balance', 'mandate_amount']);
 
         \Log::debug("Requested top-up for wallet {$wallet->id}");
 
         if (!empty($settings['mandate_disabled'])) {
             \Log::debug("Top-up for wallet {$wallet->id}: mandate disabled");
             return false;
         }
 
         $min_balance = (int) (floatval($settings['mandate_balance']) * 100);
         $amount = (int) (floatval($settings['mandate_amount']) * 100);
 
         // The wallet balance is greater than the auto-payment threshold
         if ($wallet->balance >= $min_balance) {
             // Do nothing
             return false;
         }
 
         $provider = PaymentProvider::factory($wallet);
         $mandate = (array) $provider->getMandate($wallet);
 
         if (empty($mandate['isValid'])) {
             \Log::debug("Top-up for wallet {$wallet->id}: mandate invalid");
             return false;
         }
 
         // The defined top-up amount is not enough
         // Disable auto-payment and notify the user
         if ($wallet->balance + $amount < 0) {
             // Disable (not remove) the mandate
             $wallet->setSetting('mandate_disabled', 1);
             \App\Jobs\PaymentMandateDisabledEmail::dispatch($wallet);
             return false;
         }
 
         $request = [
             'type' => Payment::TYPE_RECURRING,
             'currency' => $wallet->currency,
             'amount' => $amount,
             'methodId' => PaymentProvider::METHOD_CREDITCARD,
             'description' => Tenant::getConfig($wallet->owner->tenant_id, 'app.name') . ' Recurring Payment',
         ];
 
         self::addTax($wallet, $request);
 
         $result = $provider->payment($wallet, $request);
 
         return !empty($result);
     }
 
     /**
      * Returns auto-payment mandate info for the specified wallet
      *
      * @param \App\Wallet $wallet A wallet object
      *
      * @return array A mandate metadata
      */
     public static function walletMandate(Wallet $wallet): array
     {
         $provider = PaymentProvider::factory($wallet);
         $settings = $wallet->getSettings(['mandate_disabled', 'mandate_balance', 'mandate_amount']);
 
         // Get the Mandate info
         $mandate = (array) $provider->getMandate($wallet);
 
-        $mandate['amount'] = (int) (Payment::MIN_AMOUNT / 100);
+        $mandate['amount'] = $mandate['minAmount'] = (int) ceil(Payment::MIN_AMOUNT / 100);
         $mandate['balance'] = 0;
         $mandate['isDisabled'] = !empty($mandate['id']) && $settings['mandate_disabled'];
+        $mandate['isValid'] = !empty($mandate['isValid']);
 
         foreach (['amount', 'balance'] as $key) {
             if (($value = $settings["mandate_{$key}"]) !== null) {
                 $mandate[$key] = $value;
             }
         }
 
+        // If this is a multi-month plan, we calculate the expected amount to be payed.
+        if (($plan = $wallet->plan()) && $plan->months >= 1) {
+            $planCost = (int) ceil(($plan->cost() * $plan->months) / 100);
+            if ($planCost > $mandate['minAmount']) {
+                $mandate['minAmount'] = $planCost;
+            }
+        }
+
+        // Unrestrict the wallet owner if mandate is valid
+        if (!empty($mandate['isValid']) && $wallet->owner->isRestricted()) {
+            $wallet->owner->unrestrict();
+        }
+
         return $mandate;
     }
 
     /**
      * List supported payment methods.
      *
      * @param \Illuminate\Http\Request $request The API request.
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function paymentMethods(Request $request)
     {
         $user = $this->guard()->user();
 
         // TODO: Wallet selection
         $wallet = $user->wallets()->first();
 
         $methods = PaymentProvider::paymentMethods($wallet, $request->type);
 
         \Log::debug("Provider methods" . var_export(json_encode($methods), true));
 
         return response()->json($methods);
     }
 
     /**
      * Check for pending payments.
      *
      * @param \Illuminate\Http\Request $request The API request.
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function hasPayments(Request $request)
     {
         $user = $this->guard()->user();
 
         // TODO: Wallet selection
         $wallet = $user->wallets()->first();
 
         $exists = Payment::where('wallet_id', $wallet->id)
             ->where('type', Payment::TYPE_ONEOFF)
             ->whereIn('status', [
                     Payment::STATUS_OPEN,
                     Payment::STATUS_PENDING,
                     Payment::STATUS_AUTHORIZED
             ])
             ->exists();
 
         return response()->json([
             'status' => 'success',
             'hasPending' => $exists
         ]);
     }
 
     /**
      * List pending payments.
      *
      * @param \Illuminate\Http\Request $request The API request.
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function payments(Request $request)
     {
         $user = $this->guard()->user();
 
         // TODO: Wallet selection
         $wallet = $user->wallets()->first();
 
         $pageSize = 10;
         $page = intval(request()->input('page')) ?: 1;
         $hasMore = false;
         $result = Payment::where('wallet_id', $wallet->id)
             ->where('type', Payment::TYPE_ONEOFF)
             ->whereIn('status', [
                     Payment::STATUS_OPEN,
                     Payment::STATUS_PENDING,
                     Payment::STATUS_AUTHORIZED
             ])
             ->orderBy('created_at', 'desc')
             ->limit($pageSize + 1)
             ->offset($pageSize * ($page - 1))
             ->get();
 
         if (count($result) > $pageSize) {
             $result->pop();
             $hasMore = true;
         }
 
         $result = $result->map(function ($item) use ($wallet) {
             $provider = PaymentProvider::factory($item->provider);
             $payment = $provider->getPayment($item->id);
             $entry = [
                 'id' => $item->id,
                 'createdAt' => $item->created_at->format('Y-m-d H:i'),
                 'type' => $item->type,
                 'description' => $item->description,
                 'amount' => $item->amount,
                 'currency' => $wallet->currency,
                 // note: $item->currency/$item->currency_amount might be different
                 'status' => $item->status,
                 'isCancelable' => $payment['isCancelable'],
                 'checkoutUrl' => $payment['checkoutUrl']
             ];
 
             return $entry;
         });
 
         return response()->json([
             'status' => 'success',
             'list' => $result,
             'count' => count($result),
             'hasMore' => $hasMore,
             'page' => $page,
         ]);
     }
 
     /**
      * Calculates tax for the payment, fills the request with additional properties
      */
     protected static function addTax(Wallet $wallet, array &$request): void
     {
         $request['vat_rate_id'] = null;
         $request['credit_amount'] = $request['amount'];
 
         if ($rate = $wallet->vatRate()) {
             $request['vat_rate_id'] = $rate->id;
 
             switch (\config('app.vat.mode')) {
                 case 1:
                     // In this mode tax is added on top of the payment. The amount
                     // to pay grows, but we keep wallet balance without tax.
                     $request['amount'] = $request['amount'] + round($request['amount'] * $rate->rate / 100);
                     break;
 
                 default:
                     // In this mode tax is "swallowed" by the vendor. The payment
                     // amount does not change
                     break;
             }
         }
     }
 }
diff --git a/src/app/Http/Controllers/API/V4/UsersController.php b/src/app/Http/Controllers/API/V4/UsersController.php
index ee6e32aa..d63917de 100644
--- a/src/app/Http/Controllers/API/V4/UsersController.php
+++ b/src/app/Http/Controllers/API/V4/UsersController.php
@@ -1,700 +1,709 @@
 <?php
 
 namespace App\Http\Controllers\API\V4;
 
 use App\Http\Controllers\RelationController;
 use App\Domain;
 use App\Rules\Password;
 use App\Rules\UserEmailDomain;
 use App\Rules\UserEmailLocal;
 use App\Sku;
 use App\User;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Support\Str;
 
 class UsersController extends RelationController
 {
     /** @const array List of user setting keys available for modification in UI */
     public const USER_SETTINGS = [
         'billing_address',
         'country',
         'currency',
         'external_email',
         'first_name',
         'last_name',
         'organization',
         'phone',
     ];
 
     /**
      * On user create it is filled with a user or group object to force-delete
      * before the creation of a new user record is possible.
      *
      * @var \App\User|\App\Group|null
      */
     protected $deleteBeforeCreate;
 
     /** @var string Resource localization label */
     protected $label = 'user';
 
     /** @var string Resource model name */
     protected $model = User::class;
 
     /** @var array Common object properties in the API response */
     protected $objectProps = ['email'];
 
     /** @var ?\App\VerificationCode Password reset code to activate on user create/update */
     protected $passCode;
 
     /**
      * Listing of users.
      *
      * The user-entitlements billed to the current user wallet(s)
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function index()
     {
         $user = $this->guard()->user();
         $search = trim(request()->input('search'));
         $page = intval(request()->input('page')) ?: 1;
         $pageSize = 20;
         $hasMore = false;
 
         $result = $user->users();
 
         // Search by user email, alias or name
         if (strlen($search) > 0) {
             // thanks to cloning we skip some extra queries in $user->users()
             $allUsers1 = clone $result;
             $allUsers2 = clone $result;
 
             $result->whereLike('email', $search)
                 ->union(
                     $allUsers1->join('user_aliases', 'users.id', '=', 'user_aliases.user_id')
                         ->whereLike('alias', $search)
                 )
                 ->union(
                     $allUsers2->join('user_settings', 'users.id', '=', 'user_settings.user_id')
                         ->whereLike('value', $search)
                         ->whereIn('key', ['first_name', 'last_name'])
                 );
         }
 
         $result = $result->orderBy('email')
             ->limit($pageSize + 1)
             ->offset($pageSize * ($page - 1))
             ->get();
 
         if (count($result) > $pageSize) {
             $result->pop();
             $hasMore = true;
         }
 
         // Process the result
         $result = $result->map(
             function ($user) {
                 return $this->objectToClient($user);
             }
         );
 
         $result = [
             'list' => $result,
             'count' => count($result),
             'hasMore' => $hasMore,
         ];
 
         return response()->json($result);
     }
 
     /**
      * Display information on the user account specified by $id.
      *
      * @param string $id The account to show information for.
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function show($id)
     {
         $user = User::find($id);
 
         if (!$this->checkTenant($user)) {
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canRead($user)) {
             return $this->errorResponse(403);
         }
 
         $response = $this->userResponse($user);
 
         $response['skus'] = \App\Entitlement::objectEntitlementsSummary($user);
         $response['config'] = $user->getConfig();
         $response['aliases'] = $user->aliases()->pluck('alias')->all();
 
         $code = $user->verificationcodes()->where('active', true)
             ->where('expires_at', '>', \Carbon\Carbon::now())
             ->first();
 
         if ($code) {
             $response['passwordLinkCode'] = $code->short_code . '-' . $code->code;
         }
 
         return response()->json($response);
     }
 
     /**
      * User status (extended) information
      *
      * @param \App\User $user User object
      *
      * @return array Status information
      */
     public static function statusInfo($user): array
     {
         $process = self::processStateInfo(
             $user,
             [
                 'user-new' => true,
                 'user-ldap-ready' => $user->isLdapReady(),
                 'user-imap-ready' => $user->isImapReady(),
             ]
         );
 
         // Check if the user is a controller of his wallet
         $isController = $user->canDelete($user);
 
         $isDegraded = $user->isDegraded();
         $hasMeet = !$isDegraded && Sku::withObjectTenantContext($user)->where('title', 'room')->exists();
         $hasCustomDomain = $user->wallet()->entitlements()
             ->where('entitleable_type', Domain::class)
             ->count() > 0;
 
         // Get user's entitlements titles
         $skus = $user->entitlements()->select('skus.title')
             ->join('skus', 'skus.id', '=', 'entitlements.sku_id')
             ->get()
             ->pluck('title')
             ->sort()
             ->unique()
             ->values()
             ->all();
 
         $hasBeta = in_array('beta', $skus);
 
+        $plan = $isController ? $user->wallet()->plan() : null;
+
         $result = [
             'skus' => $skus,
             'enableBeta' => in_array('beta', $skus),
             // TODO: This will change when we enable all users to create domains
             'enableDomains' => $isController && $hasCustomDomain,
             // TODO: Make 'enableDistlists' working for wallet controllers that aren't account owners
             'enableDistlists' => $isController && $hasCustomDomain && $hasBeta,
             'enableFiles' => !$isDegraded && $hasBeta && \config('app.with_files'),
             // TODO: Make 'enableFolders' working for wallet controllers that aren't account owners
             'enableFolders' => $isController && $hasCustomDomain && $hasBeta,
             // TODO: Make 'enableResources' working for wallet controllers that aren't account owners
             'enableResources' => $isController && $hasCustomDomain && $hasBeta,
             'enableRooms' => $hasMeet,
             'enableSettings' => $isController,
             'enableUsers' => $isController,
             'enableWallets' => $isController,
+            'enableWalletMandates' => $isController,
+            'enableWalletPayments' => $isController && (!$plan || $plan->mode != 'mandate'),
             'enableCompanionapps' => $hasBeta,
         ];
 
         return array_merge($process, $result);
     }
 
     /**
      * Create a new user record.
      *
      * @param \Illuminate\Http\Request $request The API request.
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function store(Request $request)
     {
         $current_user = $this->guard()->user();
         $owner = $current_user->walletOwner();
 
         if ($owner->id != $current_user->id) {
             return $this->errorResponse(403);
         }
 
         $this->deleteBeforeCreate = null;
 
         if ($error_response = $this->validateUserRequest($request, null, $settings)) {
             return $error_response;
         }
 
         if (empty($request->package) || !($package = \App\Package::withEnvTenantContext()->find($request->package))) {
             $errors = ['package' => \trans('validation.packagerequired')];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         if ($package->isDomain()) {
             $errors = ['package' => \trans('validation.packageinvalid')];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         DB::beginTransaction();
 
         // @phpstan-ignore-next-line
         if ($this->deleteBeforeCreate) {
             $this->deleteBeforeCreate->forceDelete();
         }
 
         // Create user record
         $user = User::create([
                 'email' => $request->email,
                 'password' => $request->password,
                 'status' => $owner->isRestricted() ? User::STATUS_RESTRICTED : 0,
         ]);
 
         $this->activatePassCode($user);
 
         $owner->assignPackage($package, $user);
 
         if (!empty($settings)) {
             $user->setSettings($settings);
         }
 
         if (!empty($request->aliases)) {
             $user->setAliases($request->aliases);
         }
 
         DB::commit();
 
         return response()->json([
                 'status' => 'success',
                 'message' => \trans('app.user-create-success'),
         ]);
     }
 
     /**
      * Update user data.
      *
      * @param \Illuminate\Http\Request $request The API request.
      * @param string                   $id      User identifier
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function update(Request $request, $id)
     {
         $user = User::withEnvTenantContext()->find($id);
 
         if (empty($user)) {
             return $this->errorResponse(404);
         }
 
         $current_user = $this->guard()->user();
 
         // TODO: Decide what attributes a user can change on his own profile
         if (!$current_user->canUpdate($user)) {
             return $this->errorResponse(403);
         }
 
         if ($error_response = $this->validateUserRequest($request, $user, $settings)) {
             return $error_response;
         }
 
         // Entitlements, only controller can do that
         if ($request->skus !== null && !$current_user->canDelete($user)) {
             return $this->errorResponse(422, "You have no permission to change entitlements");
         }
 
         DB::beginTransaction();
 
         SkusController::updateEntitlements($user, $request->skus);
 
         if (!empty($settings)) {
             $user->setSettings($settings);
         }
 
         if (!empty($request->password)) {
             $user->password = $request->password;
             $user->save();
         }
 
         $this->activatePassCode($user);
 
         if (isset($request->aliases)) {
             $user->setAliases($request->aliases);
         }
 
         DB::commit();
 
         $response = [
             'status' => 'success',
             'message' => \trans('app.user-update-success'),
         ];
 
         // For self-update refresh the statusInfo in the UI
         if ($user->id == $current_user->id) {
             $response['statusInfo'] = self::statusInfo($user);
         }
 
         return response()->json($response);
     }
 
     /**
      * Create a response data array for specified user.
      *
      * @param \App\User $user User object
      *
      * @return array Response data
      */
     public static function userResponse(User $user): array
     {
         $response = array_merge($user->toArray(), self::objectState($user));
 
+        $wallet = $user->wallet();
+
+        // IsLocked flag to lock the user to the Wallet page only
+        $response['isLocked'] = ($user->isRestricted() && ($plan = $wallet->plan()) && $plan->mode == 'mandate');
+
         // Settings
         $response['settings'] = [];
         foreach ($user->settings()->whereIn('key', self::USER_SETTINGS)->get() as $item) {
             $response['settings'][$item->key] = $item->value;
         }
 
         // Status info
         $response['statusInfo'] = self::statusInfo($user);
 
         // Add more info to the wallet object output
         $map_func = function ($wallet) use ($user) {
             $result = $wallet->toArray();
 
             if ($wallet->discount) {
                 $result['discount'] = $wallet->discount->discount;
                 $result['discount_description'] = $wallet->discount->description;
             }
 
             if ($wallet->user_id != $user->id) {
                 $result['user_email'] = $wallet->owner->email;
             }
 
             $provider = \App\Providers\PaymentProvider::factory($wallet);
             $result['provider'] = $provider->name();
 
             return $result;
         };
 
         // Information about wallets and accounts for access checks
         $response['wallets'] = $user->wallets->map($map_func)->toArray();
         $response['accounts'] = $user->accounts->map($map_func)->toArray();
-        $response['wallet'] = $map_func($user->wallet());
+        $response['wallet'] = $map_func($wallet);
 
         return $response;
     }
 
     /**
      * Prepare user statuses for the UI
      *
      * @param \App\User $user User object
      *
      * @return array Statuses array
      */
     protected static function objectState($user): array
     {
         $state = parent::objectState($user);
 
         $state['isAccountDegraded'] = $user->isDegraded(true);
 
         return $state;
     }
 
     /**
      * Validate user input
      *
      * @param \Illuminate\Http\Request $request  The API request.
      * @param \App\User|null           $user     User identifier
      * @param array                    $settings User settings (from the request)
      *
      * @return \Illuminate\Http\JsonResponse|null The error response on error
      */
     protected function validateUserRequest(Request $request, $user, &$settings = [])
     {
         $rules = [
             'external_email' => 'nullable|email',
             'phone' => 'string|nullable|max:64|regex:/^[0-9+() -]+$/',
             'first_name' => 'string|nullable|max:128',
             'last_name' => 'string|nullable|max:128',
             'organization' => 'string|nullable|max:512',
             'billing_address' => 'string|nullable|max:1024',
             'country' => 'string|nullable|alpha|size:2',
             'currency' => 'string|nullable|alpha|size:3',
             'aliases' => 'array|nullable',
         ];
 
         $controller = ($user ?: $this->guard()->user())->walletOwner();
 
         // Handle generated password reset code
         if ($code = $request->input('passwordLinkCode')) {
             // Accept <short-code>-<code> input
             if (strpos($code, '-')) {
                 $code = explode('-', $code)[1];
             }
 
             $this->passCode = $this->guard()->user()->verificationcodes()
                 ->where('code', $code)->where('active', false)->first();
 
             // Generate a password for a new user with password reset link
             // FIXME: Should/can we have a user with no password set?
             if ($this->passCode && empty($user)) {
                 $request->password = $request->password_confirmation = Str::random(16);
                 $ignorePassword = true;
             }
         }
 
         if (empty($user) || !empty($request->password) || !empty($request->password_confirmation)) {
             if (empty($ignorePassword)) {
                 $rules['password'] = ['required', 'confirmed', new Password($controller)];
             }
         }
 
         $errors = [];
 
         // Validate input
         $v = Validator::make($request->all(), $rules);
 
         if ($v->fails()) {
             $errors = $v->errors()->toArray();
         }
 
         // For new user validate email address
         if (empty($user)) {
             $email = $request->email;
 
             if (empty($email)) {
                 $errors['email'] = \trans('validation.required', ['attribute' => 'email']);
             } elseif ($error = self::validateEmail($email, $controller, $this->deleteBeforeCreate)) {
                 $errors['email'] = $error;
             }
         }
 
         // Validate aliases input
         if (isset($request->aliases)) {
             $aliases = [];
             $existing_aliases = $user ? $user->aliases()->get()->pluck('alias')->toArray() : [];
 
             foreach ($request->aliases as $idx => $alias) {
                 if (is_string($alias) && !empty($alias)) {
                     // Alias cannot be the same as the email address (new user)
                     if (!empty($email) && Str::lower($alias) == Str::lower($email)) {
                         continue;
                     }
 
                     // validate new aliases
                     if (
                         !in_array($alias, $existing_aliases)
                         && ($error = self::validateAlias($alias, $controller))
                     ) {
                         if (!isset($errors['aliases'])) {
                             $errors['aliases'] = [];
                         }
                         $errors['aliases'][$idx] = $error;
                         continue;
                     }
 
                     $aliases[] = $alias;
                 }
             }
 
             $request->aliases = $aliases;
         }
 
         if (!empty($errors)) {
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         // Update user settings
         $settings = $request->only(array_keys($rules));
         unset($settings['password'], $settings['aliases'], $settings['email']);
 
         return null;
     }
 
     /**
      * Execute (synchronously) specified step in a user setup process.
      *
      * @param \App\User $user User object
      * @param string    $step Step identifier (as in self::statusInfo())
      *
      * @return bool|null True if the execution succeeded, False if not, Null when
      *                   the job has been sent to the worker (result unknown)
      */
     public static function execProcessStep(User $user, string $step): ?bool
     {
         try {
             if (strpos($step, 'domain-') === 0) {
                 return DomainsController::execProcessStep($user->domain(), $step);
             }
 
             switch ($step) {
                 case 'user-ldap-ready':
                 case 'user-imap-ready':
                     // Use worker to do the job, frontend might not have the IMAP admin credentials
                     \App\Jobs\User\CreateJob::dispatch($user->id);
                     return null;
             }
         } catch (\Exception $e) {
             \Log::error($e);
         }
 
         return false;
     }
 
     /**
      * Email address validation for use as a user mailbox (login).
      *
      * @param string                    $email   Email address
      * @param \App\User                 $user    The account owner
      * @param null|\App\User|\App\Group $deleted Filled with an instance of a deleted user or group
      *                                           with the specified email address, if exists
      *
      * @return ?string Error message on validation error
      */
     public static function validateEmail(string $email, \App\User $user, &$deleted = null): ?string
     {
         $deleted = null;
 
         if (strpos($email, '@') === false) {
             return \trans('validation.entryinvalid', ['attribute' => 'email']);
         }
 
         list($login, $domain) = explode('@', Str::lower($email));
 
         if (strlen($login) === 0 || strlen($domain) === 0) {
             return \trans('validation.entryinvalid', ['attribute' => 'email']);
         }
 
         // Check if domain exists
         $domain = Domain::withObjectTenantContext($user)->where('namespace', $domain)->first();
 
         if (empty($domain)) {
             return \trans('validation.domaininvalid');
         }
 
         // Validate login part alone
         $v = Validator::make(
             ['email' => $login],
             ['email' => ['required', new UserEmailLocal(!$domain->isPublic())]]
         );
 
         if ($v->fails()) {
             return $v->errors()->toArray()['email'][0];
         }
 
         // Check if it is one of domains available to the user
         if (!$domain->isPublic() && $user->id != $domain->walletOwner()->id) {
             return \trans('validation.entryexists', ['attribute' => 'domain']);
         }
 
         // Check if a user/group/resource/shared folder with specified address already exists
         if (
             ($existing = User::emailExists($email, true))
             || ($existing = \App\Group::emailExists($email, true))
             || ($existing = \App\Resource::emailExists($email, true))
             || ($existing = \App\SharedFolder::emailExists($email, true))
         ) {
             // If this is a deleted user/group/resource/folder in the same custom domain
             // we'll force delete it before creating the target user
             if (!$domain->isPublic() && $existing->trashed()) {
                 $deleted = $existing;
             } else {
                 return \trans('validation.entryexists', ['attribute' => 'email']);
             }
         }
 
         // Check if an alias with specified address already exists.
         if (User::aliasExists($email) || \App\SharedFolder::aliasExists($email)) {
             return \trans('validation.entryexists', ['attribute' => 'email']);
         }
 
         return null;
     }
 
     /**
      * Email address validation for use as an alias.
      *
      * @param string    $email Email address
      * @param \App\User $user  The account owner
      *
      * @return ?string Error message on validation error
      */
     public static function validateAlias(string $email, \App\User $user): ?string
     {
         if (strpos($email, '@') === false) {
             return \trans('validation.entryinvalid', ['attribute' => 'alias']);
         }
 
         list($login, $domain) = explode('@', Str::lower($email));
 
         if (strlen($login) === 0 || strlen($domain) === 0) {
             return \trans('validation.entryinvalid', ['attribute' => 'alias']);
         }
 
         // Check if domain exists
         $domain = Domain::withObjectTenantContext($user)->where('namespace', $domain)->first();
 
         if (empty($domain)) {
             return \trans('validation.domaininvalid');
         }
 
         // Validate login part alone
         $v = Validator::make(
             ['alias' => $login],
             ['alias' => ['required', new UserEmailLocal(!$domain->isPublic())]]
         );
 
         if ($v->fails()) {
             return $v->errors()->toArray()['alias'][0];
         }
 
         // Check if it is one of domains available to the user
         if (!$domain->isPublic() && $user->id != $domain->walletOwner()->id) {
             return \trans('validation.entryexists', ['attribute' => 'domain']);
         }
 
         // Check if a user with specified address already exists
         if ($existing_user = User::emailExists($email, true)) {
             // Allow an alias in a custom domain to an address that was a user before
             if ($domain->isPublic() || !$existing_user->trashed()) {
                 return \trans('validation.entryexists', ['attribute' => 'alias']);
             }
         }
 
         // Check if a group/resource/shared folder with specified address already exists
         if (
             \App\Group::emailExists($email)
             || \App\Resource::emailExists($email)
             || \App\SharedFolder::emailExists($email)
         ) {
             return \trans('validation.entryexists', ['attribute' => 'alias']);
         }
 
         // Check if an alias with specified address already exists
         if (User::aliasExists($email) || \App\SharedFolder::aliasExists($email)) {
             // Allow assigning the same alias to a user in the same group account,
             // but only for non-public domains
             if ($domain->isPublic()) {
                 return \trans('validation.entryexists', ['attribute' => 'alias']);
             }
         }
 
         return null;
     }
 
     /**
      * Activate password reset code (if set), and assign it to a user.
      *
      * @param \App\User $user The user
      */
     protected function activatePassCode(User $user): void
     {
         // Activate the password reset code
         if ($this->passCode) {
             $this->passCode->user_id = $user->id;
             $this->passCode->active = true;
             $this->passCode->save();
         }
     }
 }
diff --git a/src/app/Http/Controllers/ContentController.php b/src/app/Http/Controllers/ContentController.php
index e626e9b4..5ebe95d9 100644
--- a/src/app/Http/Controllers/ContentController.php
+++ b/src/app/Http/Controllers/ContentController.php
@@ -1,157 +1,157 @@
 <?php
 
 namespace App\Http\Controllers;
 
 class ContentController extends Controller
 {
     /**
      * Get the HTML content for the specified page
      *
      * @param string $page Page template identifier
      *
      * @return \Illuminate\View\View
      */
     public function pageContent(string $page)
     {
         if (empty($page) || !preg_match('/^[a-z\/]+$/', $page)) {
             abort(404);
         }
 
         $theme = \config('app.theme');
         $page = str_replace('/', '.', $page);
 
         $file = "themes/{$theme}/pages/{$page}.blade.php";
         $view = "{$theme}.pages.{$page}";
 
         if (!file_exists(resource_path($file))) {
             abort(404);
         }
 
         return view($view)->with('env', \App\Utils::uiEnv());
     }
 
     /**
      * Get the list of FAQ entries for the specified page
      *
      * @param string $page Page path
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function faqContent(string $page)
     {
         if (empty($page)) {
             return $this->errorResponse(404);
         }
 
         $faq = [];
 
         $theme_name = \config('app.theme');
         $theme_file = resource_path("themes/{$theme_name}/theme.json");
 
         if (file_exists($theme_file)) {
             $theme = json_decode(file_get_contents($theme_file), true);
             if (json_last_error() != JSON_ERROR_NONE) {
                 \Log::error("Failed to parse $theme_file: " . json_last_error_msg());
             } elseif (!empty($theme['faq']) && !empty($theme['faq'][$page])) {
                 $faq = $theme['faq'][$page];
             }
 
             // TODO: Support pages with variables, e.g. users/<user-id>
         }
 
         // Localization
         if (!empty($faq)) {
             foreach ($faq as $idx => $item) {
                 if (!empty($item['label'])) {
                     $faq[$idx]['title'] = \trans('theme::faq.' . $item['label']);
                 }
             }
         }
 
         return response()->json(['status' => 'success', 'faq' => $faq]);
     }
 
     /**
      * Returns list of enabled locales
      *
      * @return array List of two-letter language codes
      */
     public static function locales(): array
     {
         if ($locales = \env('APP_LOCALES')) {
             return preg_split('/\s*,\s*/', strtolower(trim($locales)));
         }
 
         return ['en', 'de', 'fr'];
     }
 
     /**
      * Get menu definition from the theme
      *
      * @return array
      */
     public static function menu(): array
     {
         $theme_name = \config('app.theme');
         $theme_file = resource_path("themes/{$theme_name}/theme.json");
         $menu = [];
 
         if (file_exists($theme_file)) {
             $theme = json_decode(file_get_contents($theme_file), true);
 
             if (json_last_error() != JSON_ERROR_NONE) {
                 \Log::error("Failed to parse $theme_file: " . json_last_error_msg());
             } elseif (!empty($theme['menu'])) {
                 $menu = $theme['menu'];
             }
         }
 
         // TODO: These 2-3 lines could become a utility function somewhere
         $req_domain = preg_replace('/:[0-9]+$/', '', request()->getHttpHost());
         $sys_domain = \config('app.domain');
         $isAdmin = $req_domain == "admin.$sys_domain";
 
         $filter = function ($item) use ($isAdmin) {
             if ($isAdmin && empty($item['admin'])) {
                 return false;
             }
             if (!$isAdmin && !empty($item['admin']) && $item['admin'] === 'only') {
                 return false;
             }
 
             return true;
         };
 
         $menu = array_values(array_filter($menu, $filter));
 
         // Load localization files for all supported languages
         $lang_path = resource_path("themes/{$theme_name}/lang");
         $locales = [];
         foreach (self::locales() as $lang) {
             $file = "{$lang_path}/{$lang}/menu.php";
             if (file_exists($file)) {
                 $locales[$lang] = include $file;
             }
         }
 
         foreach ($menu as $idx => $item) {
             // Handle menu localization
             if (!empty($item['label'])) {
                 $label = $item['label'];
 
                 foreach ($locales as $lang => $labels) {
                     if (!empty($labels[$label])) {
                         $item["title-{$lang}"] = $labels[$label];
                     }
                 }
             }
 
             // Unset properties that we don't need on the client side
-            unset($item['admin'], $item['label']);
+            unset($item['admin']);
 
             $menu[$idx] = $item;
         }
 
         return $menu;
     }
 }
diff --git a/src/app/Observers/WalletObserver.php b/src/app/Observers/WalletObserver.php
index 5327d154..280e1757 100644
--- a/src/app/Observers/WalletObserver.php
+++ b/src/app/Observers/WalletObserver.php
@@ -1,124 +1,117 @@
 <?php
 
 namespace App\Observers;
 
 use App\User;
 use App\Wallet;
 
 /**
  * This is an observer for the Wallet model definition.
  */
 class WalletObserver
 {
     /**
      * Ensure the wallet ID is a custom ID (uuid).
      *
      * @param Wallet $wallet
      *
      * @return void
      */
     public function creating(Wallet $wallet)
     {
         $wallet->currency = \config('app.currency');
     }
 
     /**
      * Handle the wallet "deleting" event.
      *
      * Ensures that a wallet with a non-zero balance can not be deleted.
      *
      * Ensures that the wallet being deleted is not the last wallet for the user.
      *
      * Ensures that no entitlements are being billed to the wallet currently.
      *
      * @param Wallet $wallet The wallet being deleted.
      *
      * @return bool
      */
     public function deleting(Wallet $wallet): bool
     {
         // can't delete a wallet that has any balance on it (positive and negative).
         if ($wallet->balance != 0.00) {
             return false;
         }
 
         if (!$wallet->owner) {
             throw new \Exception("Wallet: " . var_export($wallet, true));
         }
 
         // can't remove the last wallet for the owner.
         if ($wallet->owner->wallets()->count() <= 1) {
             return false;
         }
 
         // can't remove a wallet that has billable entitlements attached.
         if ($wallet->entitlements()->count() > 0) {
             return false;
         }
 /*
         // can't remove a wallet that has payments attached.
         if ($wallet->payments()->count() > 0) {
             return false;
         }
 */
 
         return true;
     }
 
     /**
      * Handle the wallet "updated" event.
      *
      * @param \App\Wallet $wallet The wallet.
      *
      * @return void
      */
     public function updated(Wallet $wallet)
     {
         $negative_since = $wallet->getSetting('balance_negative_since');
 
         if ($wallet->balance < 0) {
             if (!$negative_since) {
                 $now = \Carbon\Carbon::now()->toDateTimeString();
                 $wallet->setSetting('balance_negative_since', $now);
             }
         } elseif ($negative_since) {
             $wallet->setSettings([
                     'balance_negative_since' => null,
                     'balance_warning_initial' => null,
                     'balance_warning_reminder' => null,
                     'balance_warning_suspended' => null,
                     'balance_warning_before_delete' => null,
             ]);
 
             // FIXME: Since we use account degradation, should we leave suspended state untouched?
 
             // Un-suspend and un-degrade the account owner
             if ($wallet->owner) {
                 $wallet->owner->unsuspend();
                 $wallet->owner->undegrade();
             }
 
             // Un-suspend domains/users
             foreach ($wallet->entitlements as $entitlement) {
                 if (
                     method_exists($entitlement->entitleable_type, 'unsuspend')
                     && !empty($entitlement->entitleable)
                 ) {
                     $entitlement->entitleable->unsuspend();
                 }
             }
         }
 
         // Remove RESTRICTED flag from the wallet owner and all users in the wallet
         if ($wallet->balance > $wallet->getOriginal('balance') && $wallet->owner && $wallet->owner->isRestricted()) {
-            $wallet->owner->unrestrict();
-
-            User::whereIn(
-                'id',
-                $wallet->entitlements()->select('entitleable_id')->where('entitleable_type', User::class)
-            )->each(function ($user) {
-                $user->unrestrict();
-            });
+            $wallet->owner->unrestrict(true);
         }
     }
 }
diff --git a/src/app/Package.php b/src/app/Package.php
index df90dd74..a97de3db 100644
--- a/src/app/Package.php
+++ b/src/app/Package.php
@@ -1,107 +1,107 @@
 <?php
 
 namespace App;
 
 use App\Traits\BelongsToTenantTrait;
 use App\Traits\UuidStrKeyTrait;
 use Illuminate\Database\Eloquent\Model;
 use Spatie\Translatable\HasTranslations;
 
 /**
  * The eloquent definition of a Package.
  *
  * A package is a set of SKUs that a user can select, so that instead of;
  *
  * * Create a mailbox entitlement,
  * * Create a quota entitlement,
  * * Create a groupware entitlement,
  * * ...
  *
  * users can simply select a 'package';
  *
  * * Kolab package: mailbox + quota + groupware,
  * * Free package: mailbox + quota.
  *
  * Selecting a package will therefore create a set of entitlments from SKUs.
  *
  * @property string  $description
  * @property int     $discount_rate
  * @property string  $id
  * @property string  $name
  * @property ?int    $tenant_id
  * @property string  $title
  */
 class Package extends Model
 {
     use BelongsToTenantTrait;
     use HasTranslations;
     use UuidStrKeyTrait;
 
     /** @var bool Indicates if the model should be timestamped. */
     public $timestamps = false;
 
     /** @var array<int, string> The attributes that are mass assignable */
     protected $fillable = [
         'description',
         'discount_rate',
         'name',
         'title',
     ];
 
     /** @var array<int, string> Translatable properties */
     public $translatable = [
         'name',
         'description',
     ];
 
     /**
      * The costs of this package at its pre-defined, existing configuration.
      *
      * @return int The costs in cents.
      */
     public function cost()
     {
         $costs = 0;
 
         foreach ($this->skus as $sku) {
             $units = $sku->pivot->qty - $sku->units_free;
 
             if ($units < 0) {
-                \Log::debug("Package {$this->id} is misconfigured for more free units than qty.");
+                \Log::warning("Package {$this->id} is misconfigured for more free units than qty.");
                 $units = 0;
             }
 
             $ppu = $sku->cost * ((100 - $this->discount_rate) / 100);
 
             $costs += $units * $ppu;
         }
 
         return $costs;
     }
 
     /**
      * Checks whether the package contains a domain SKU.
      */
     public function isDomain(): bool
     {
         foreach ($this->skus as $sku) {
             if ($sku->handler_class::entitleableClass() == Domain::class) {
                 return true;
             }
         }
 
         return false;
     }
 
     /**
      * SKUs of this package.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
      */
     public function skus()
     {
         return $this->belongsToMany(Sku::class, 'package_skus')
             ->using(PackageSku::class)
             ->withPivot(['qty']);
     }
 }
diff --git a/src/app/Payment.php b/src/app/Payment.php
index b926140a..56f3fc4f 100644
--- a/src/app/Payment.php
+++ b/src/app/Payment.php
@@ -1,192 +1,205 @@
 <?php
 
 namespace App;
 
 use Dyrynda\Database\Support\NullableFields;
 use Illuminate\Database\Eloquent\Model;
 
 /**
  * A payment operation on a wallet.
  *
  * @property int         $amount            Amount of money in cents of system currency (payment provider)
  * @property int         $credit_amount     Amount of money in cents of system currency (wallet balance)
  * @property string      $description       Payment description
  * @property string      $id                Mollie's Payment ID
  * @property ?string     $vat_rate_id       VAT rate identifier
  * @property \App\Wallet $wallet            The wallet
  * @property string      $wallet_id         The ID of the wallet
  * @property string      $currency          Currency of this payment
  * @property int         $currency_amount   Amount of money in cents of $currency
  */
 class Payment extends Model
 {
     use NullableFields;
 
     public const STATUS_OPEN = 'open';
     public const STATUS_CANCELED = 'canceled';
     public const STATUS_PENDING = 'pending';
     public const STATUS_AUTHORIZED = 'authorized';
     public const STATUS_EXPIRED = 'expired';
     public const STATUS_FAILED = 'failed';
     public const STATUS_PAID = 'paid';
 
     public const TYPE_ONEOFF = 'oneoff';
     public const TYPE_RECURRING = 'recurring';
     public const TYPE_MANDATE = 'mandate';
     public const TYPE_REFUND = 'refund';
     public const TYPE_CHARGEBACK = 'chargeback';
 
     /** const int Minimum amount of money in a single payment (in cents) */
     public const MIN_AMOUNT = 1000;
 
     /** @var bool Indicates that the model should be timestamped or not */
     public $incrementing = false;
 
     /** @var string The "type" of the auto-incrementing ID */
     protected $keyType = 'string';
 
     /** @var array<string, string> The attributes that should be cast */
     protected $casts = [
         'amount' => 'integer',
         'credit_amount' => 'integer',
         'currency_amount' => 'integer',
     ];
 
     /** @var array<int,string> The attributes that are mass assignable */
     protected $fillable = [
         'id',
         'wallet_id',
         'amount',
         'credit_amount',
         'description',
         'provider',
         'status',
         'vat_rate_id',
         'type',
         'currency',
         'currency_amount',
     ];
 
     /** @var array<int, string> The attributes that can be not set */
     protected $nullable = [
         'vat_rate_id',
     ];
 
 
     /**
      * Create a payment record in DB from array.
      *
      * @param array $payment Payment information (required: id, type, wallet_id, currency, amount, currency_amount)
      *
      * @return \App\Payment Payment object
      */
     public static function createFromArray(array $payment): Payment
     {
         $db_payment = new Payment();
         $db_payment->id = $payment['id'];
         $db_payment->description = $payment['description'] ?? '';
         $db_payment->status = $payment['status'] ?? self::STATUS_OPEN;
         $db_payment->amount = $payment['amount'] ?? 0;
         $db_payment->credit_amount = $payment['credit_amount'] ?? ($payment['amount'] ?? 0);
         $db_payment->vat_rate_id = $payment['vat_rate_id'] ?? null;
         $db_payment->type = $payment['type'];
         $db_payment->wallet_id = $payment['wallet_id'];
         $db_payment->provider = $payment['provider'] ?? '';
         $db_payment->currency = $payment['currency'];
         $db_payment->currency_amount = $payment['currency_amount'];
         $db_payment->save();
 
         return $db_payment;
     }
 
     /**
      * Apply the successful payment's pecunia to the wallet
      *
      * @param string $method Payment method name
      */
     public function credit($method): void
     {
-        // TODO: Possibly we should sanity check that payment is paid, and not negative?
+        if (empty($this->wallet)) {
+            throw new \Exception("Cannot credit a payment not assigned to a wallet");
+        }
+
+        if ($this->credit_amount < 0) {
+            throw new \Exception("Cannot credit a payment with negative amount");
+        }
+
+        // TODO: Possibly we should sanity check that payment is paid?
         // TODO: Localization?
         $description = $this->type == self::TYPE_RECURRING ? 'Auto-payment' : 'Payment';
         $description .= " transaction {$this->id} using {$method}";
 
         $this->wallet->credit($this, $description);
 
         // Unlock the disabled auto-payment mandate
         if ($this->wallet->balance >= 0) {
             $this->wallet->setSetting('mandate_disabled', null);
         }
+
+        // Remove RESTRICTED flag from the wallet owner and all users in the wallet
+        if ($this->wallet->owner && $this->wallet->owner->isRestricted()) {
+            $this->wallet->owner->unrestrict(true);
+        }
     }
 
     /**
      * Creates a payment and transaction records for the refund/chargeback operation.
      * Deducts an amount of pecunia from the wallet.
      *
      * @param array $refund A refund or chargeback data (id, type, amount, currency, description)
      *
      * @return ?\App\Payment A payment object for the refund
      */
     public function refund(array $refund): ?Payment
     {
         if (empty($refund) || empty($refund['amount'])) {
             return null;
         }
 
         // Convert amount to wallet currency (use the same exchange rate as for the original payment)
         // Note: We assume a refund is always using the same currency
         $exchange_rate = $this->amount / $this->currency_amount;
         $credit_amount = $amount = (int) round($refund['amount'] * $exchange_rate);
 
         // Set appropriate credit_amount if original credit_amount != original amount
         if ($this->amount != $this->credit_amount) {
             $credit_amount = (int) round($amount * ($this->credit_amount / $this->amount));
         }
 
         // Apply the refund to the wallet balance
         $method = $refund['type'] == self::TYPE_CHARGEBACK ? 'chargeback' : 'refund';
 
         $this->wallet->{$method}($credit_amount, $refund['description'] ?? '');
 
         $refund['amount'] = $amount * -1;
         $refund['credit_amount'] = $credit_amount * -1;
         $refund['currency_amount'] = round($amount * -1 / $exchange_rate);
         $refund['currency'] = $this->currency;
         $refund['wallet_id'] = $this->wallet_id;
         $refund['provider'] = $this->provider;
         $refund['vat_rate_id'] = $this->vat_rate_id;
         $refund['status'] = self::STATUS_PAID;
 
         // FIXME: Refunds/chargebacks are out of the reseller comissioning for now
 
         return self::createFromArray($refund);
     }
 
     /**
      * Ensure the currency is appropriately cased.
      */
     public function setCurrencyAttribute($currency)
     {
         $this->attributes['currency'] = strtoupper($currency);
     }
 
     /**
      * The wallet to which this payment belongs.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function wallet()
     {
         return $this->belongsTo(Wallet::class, 'wallet_id', 'id');
     }
 
     /**
      * The VAT rate assigned to this payment.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function vatRate()
     {
         return $this->belongsTo(VatRate::class, 'vat_rate_id', 'id');
     }
 }
diff --git a/src/app/Plan.php b/src/app/Plan.php
index d1f9b440..6455235b 100644
--- a/src/app/Plan.php
+++ b/src/app/Plan.php
@@ -1,124 +1,127 @@
 <?php
 
 namespace App;
 
 use App\Traits\BelongsToTenantTrait;
 use App\Traits\UuidStrKeyTrait;
 use Illuminate\Database\Eloquent\Model;
 use Spatie\Translatable\HasTranslations;
 
 /**
  * The eloquent definition of a Plan.
  *
  * A Plan is a grouping of packages, such as a "Family Plan".
  *
  * A "Family Plan" as such may exist of "2 or more Kolab packages",
  * and apply a discount for the third and further Kolab packages.
  *
  * @property string         $description
  * @property int            $discount_qty
  * @property int            $discount_rate
  * @property int            $free_months
  * @property string         $id
  * @property string         $mode           Plan signup mode (email|token)
  * @property string         $name
  * @property \App\Package[] $packages
  * @property datetime       $promo_from
  * @property datetime       $promo_to
  * @property ?int           $tenant_id
  * @property string         $title
  */
 class Plan extends Model
 {
     use BelongsToTenantTrait;
     use HasTranslations;
     use UuidStrKeyTrait;
 
     public $timestamps = false;
 
     /** @var array<int, string> The attributes that are mass assignable */
     protected $fillable = [
         'title',
         'mode',
         'name',
         'description',
         // a start and end datetime for this promotion
         'promo_from',
         'promo_to',
         // discounts start at this quantity
         'discount_qty',
         // the rate of the discount for this plan
         'discount_rate',
+        // minimum number of months this plan is for
+        'months',
         // number of free months (trial)
         'free_months',
     ];
 
     /** @var array<string, string> The attributes that should be cast */
     protected $casts = [
         'promo_from' => 'datetime:Y-m-d H:i:s',
         'promo_to' => 'datetime:Y-m-d H:i:s',
         'discount_qty' => 'integer',
         'discount_rate' => 'integer',
+        'months' => 'integer',
         'free_months' => 'integer'
     ];
 
     /** @var array<int, string> Translatable properties */
     public $translatable = [
         'name',
         'description',
     ];
 
     /**
      * The list price for this package at the minimum configuration.
      *
      * @return int The costs in cents.
      */
     public function cost()
     {
         $costs = 0;
 
         foreach ($this->packages as $package) {
             $costs += $package->pivot->cost();
         }
 
         return $costs;
     }
 
     /**
      * The relationship to packages.
      *
      * The plan contains one or more packages. Each package may have its minimum number (for
      * billing) or its maximum (to allow topping out "enterprise" customers on a "small business"
      * plan).
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
      */
     public function packages()
     {
         return $this->belongsToMany(Package::class, 'plan_packages')
             ->using(PlanPackage::class)
             ->withPivot([
                     'qty',
                     'qty_min',
                     'qty_max',
                     'discount_qty',
                     'discount_rate'
             ]);
     }
 
     /**
      * Checks if the plan has any type of domain SKU assigned.
      *
      * @return bool
      */
     public function hasDomain(): bool
     {
         foreach ($this->packages as $package) {
             if ($package->isDomain()) {
                 return true;
             }
         }
 
         return false;
     }
 }
diff --git a/src/app/Providers/Payment/Mollie.php b/src/app/Providers/Payment/Mollie.php
index 4d957ba4..fba98278 100644
--- a/src/app/Providers/Payment/Mollie.php
+++ b/src/app/Providers/Payment/Mollie.php
@@ -1,629 +1,629 @@
 <?php
 
 namespace App\Providers\Payment;
 
 use App\Payment;
 use App\Utils;
 use App\Wallet;
 use Illuminate\Support\Facades\DB;
 use Mollie\Api\Exceptions\ApiException;
 use Mollie\Api\Types;
 
 class Mollie extends \App\Providers\PaymentProvider
 {
     /**
      * Get a link to the customer in the provider's control panel
      *
      * @param \App\Wallet $wallet The wallet
      *
      * @return string|null The string representing <a> tag
      */
     public function customerLink(Wallet $wallet): ?string
     {
         $customer_id = self::mollieCustomerId($wallet, false);
 
         if (!$customer_id) {
             return null;
         }
 
         return sprintf(
             '<a href="https://www.mollie.com/dashboard/customers/%s" target="_blank">%s</a>',
             $customer_id,
             $customer_id
         );
     }
 
     /**
     * Validates that mollie available.
     *
     * @throws \Mollie\Api\Exceptions\ApiException on failure
     * @return bool true on success
     */
     public static function healthcheck()
     {
         mollie()->methods()->allActive();
         return true;
     }
 
     /**
      * Create a new auto-payment mandate for a wallet.
      *
      * @param \App\Wallet $wallet  The wallet
      * @param array       $payment Payment data:
      *                             - amount: Value in cents (optional)
      *                             - currency: The operation currency
      *                             - description: Operation desc.
      *                             - methodId: Payment method
      *
      * @return array Provider payment data:
      *               - id: Operation identifier
      *               - redirectUrl: the location to redirect to
      */
     public function createMandate(Wallet $wallet, array $payment): ?array
     {
         // Register the user in Mollie, if not yet done
         $customer_id = self::mollieCustomerId($wallet, true);
 
         if (!isset($payment['amount'])) {
             $payment['amount'] = 0;
         }
 
         $amount = $this->exchange($payment['amount'], $wallet->currency, $payment['currency']);
         $payment['currency_amount'] = $amount;
 
         $request = [
             'amount' => [
                 'currency' => $payment['currency'],
                 'value' => sprintf('%.2f', $amount / 100),
             ],
             'customerId' => $customer_id,
             'sequenceType' => 'first',
             'description' => $payment['description'],
             'webhookUrl' => Utils::serviceUrl('/api/webhooks/payment/mollie'),
             'redirectUrl' => self::redirectUrl(),
             'locale' => 'en_US',
             'method' => $payment['methodId']
         ];
 
         // Create the payment in Mollie
         $response = mollie()->payments()->create($request);
 
         if ($response->mandateId) {
             $wallet->setSetting('mollie_mandate_id', $response->mandateId);
         }
 
         // Store the payment reference in database
         $payment['status'] = $response->status;
         $payment['id'] = $response->id;
         $payment['type'] = Payment::TYPE_MANDATE;
 
         $this->storePayment($payment, $wallet->id);
 
         return [
             'id' => $response->id,
             'redirectUrl' => $response->getCheckoutUrl(),
         ];
     }
 
     /**
      * Revoke the auto-payment mandate for the wallet.
      *
      * @param \App\Wallet $wallet The wallet
      *
      * @return bool True on success, False on failure
      */
     public function deleteMandate(Wallet $wallet): bool
     {
         // Get the Mandate info
         $mandate = self::mollieMandate($wallet);
 
         // Revoke the mandate on Mollie
         if ($mandate) {
             $mandate->revoke();
 
             $wallet->setSetting('mollie_mandate_id', null);
         }
 
         return true;
     }
 
     /**
      * Get a auto-payment mandate for the wallet.
      *
      * @param \App\Wallet $wallet The wallet
      *
      * @return array|null Mandate information:
      *                    - id: Mandate identifier
      *                    - method: user-friendly payment method desc.
      *                    - methodId: Payment method
      *                    - isPending: the process didn't complete yet
      *                    - isValid: the mandate is valid
      */
     public function getMandate(Wallet $wallet): ?array
     {
         // Get the Mandate info
         $mandate = self::mollieMandate($wallet);
 
         if (empty($mandate)) {
             return null;
         }
 
         $result = [
             'id' => $mandate->id,
             'isPending' => $mandate->isPending(),
             'isValid' => $mandate->isValid(),
             'method' => self::paymentMethod($mandate, 'Unknown method'),
             'methodId' => $mandate->method
         ];
 
         return $result;
     }
 
     /**
      * Get a provider name
      *
      * @return string Provider name
      */
     public function name(): string
     {
         return 'mollie';
     }
 
     /**
      * Create a new payment.
      *
      * @param \App\Wallet $wallet  The wallet
      * @param array       $payment Payment data:
      *                             - amount: Value in cents
      *                             - currency: The operation currency
      *                             - type: oneoff/recurring
      *                             - description: Operation desc.
      *                             - methodId: Payment method
      *
      * @return array Provider payment data:
      *               - id: Operation identifier
      *               - redirectUrl: the location to redirect to
      */
     public function payment(Wallet $wallet, array $payment): ?array
     {
         if ($payment['type'] == Payment::TYPE_RECURRING) {
             return $this->paymentRecurring($wallet, $payment);
         }
 
         // Register the user in Mollie, if not yet done
         $customer_id = self::mollieCustomerId($wallet, true);
 
         $amount = $this->exchange($payment['amount'], $wallet->currency, $payment['currency']);
         $payment['currency_amount'] = $amount;
 
         // Note: Required fields: description, amount/currency, amount/value
         $request = [
             'amount' => [
                 'currency' => $payment['currency'],
                 // a number with two decimals is required (note that JPK and ISK don't require decimals,
                 // but we're not using them currently)
                 'value' => sprintf('%.2f', $amount / 100),
             ],
             'customerId' => $customer_id,
             'sequenceType' => $payment['type'],
             'description' => $payment['description'],
             'webhookUrl' => Utils::serviceUrl('/api/webhooks/payment/mollie'),
             'locale' => 'en_US',
             'method' => $payment['methodId'],
             'redirectUrl' => self::redirectUrl() // required for non-recurring payments
         ];
 
         // TODO: Additional payment parameters for better fraud protection:
         //   billingEmail - for bank transfers, Przelewy24, but not creditcard
         //   billingAddress (it is a structured field not just text)
 
         // Create the payment in Mollie
         $response = mollie()->payments()->create($request);
 
         // Store the payment reference in database
         $payment['status'] = $response->status;
         $payment['id'] = $response->id;
 
         $this->storePayment($payment, $wallet->id);
 
         return [
             'id' => $payment['id'],
             'redirectUrl' => $response->getCheckoutUrl(),
         ];
     }
 
     /**
      * Cancel a pending payment.
      *
      * @param \App\Wallet $wallet  The wallet
      * @param string      $paymentId Payment Id
      *
      * @return bool True on success, False on failure
      */
     public function cancel(Wallet $wallet, $paymentId): bool
     {
         $response = mollie()->payments()->delete($paymentId);
 
         $db_payment = Payment::find($paymentId);
         $db_payment->status = $response->status;
         $db_payment->save();
 
         return true;
     }
 
     /**
      * Create a new automatic payment operation.
      *
      * @param \App\Wallet $wallet  The wallet
      * @param array       $payment Payment data (see self::payment())
      *
      * @return array Provider payment/session data:
      *               - id: Operation identifier
      */
     protected function paymentRecurring(Wallet $wallet, array $payment): ?array
     {
         // Check if there's a valid mandate
         $mandate = self::mollieMandate($wallet);
 
         if (empty($mandate) || !$mandate->isValid() || $mandate->isPending()) {
             \Log::debug("Recurring payment for {$wallet->id}: no valid Mollie mandate");
             return null;
         }
 
         $customer_id = self::mollieCustomerId($wallet, true);
 
         // Note: Required fields: description, amount/currency, amount/value
         $amount = $this->exchange($payment['amount'], $wallet->currency, $payment['currency']);
         $payment['currency_amount'] = $amount;
 
         $request = [
             'amount' => [
                 'currency' => $payment['currency'],
                 // a number with two decimals is required
                 'value' => sprintf('%.2f', $amount / 100),
             ],
             'customerId' => $customer_id,
             'sequenceType' => $payment['type'],
             'description' => $payment['description'],
             'webhookUrl' => Utils::serviceUrl('/api/webhooks/payment/mollie'),
             'locale' => 'en_US',
             'method' => $payment['methodId'],
             'mandateId' => $mandate->id
         ];
 
         \Log::debug("Recurring payment for {$wallet->id}: " . json_encode($request));
 
         // Create the payment in Mollie
         $response = mollie()->payments()->create($request);
 
         // Store the payment reference in database
         $payment['status'] = $response->status;
         $payment['id'] = $response->id;
 
         DB::beginTransaction();
 
         $payment = $this->storePayment($payment, $wallet->id);
 
         // Mollie can return 'paid' status immediately, so we don't
         // have to wait for the webhook. What's more, the webhook would ignore
         // the payment because it will be marked as paid before the webhook.
         // Let's handle paid status here too.
         if ($response->isPaid()) {
             self::creditPayment($payment, $response);
             $notify = true;
         } elseif ($response->isFailed()) {
             // Note: I didn't find a way to get any description of the problem with a payment
             \Log::info(sprintf('Mollie payment failed (%s)', $response->id));
 
             // Disable the mandate
             $wallet->setSetting('mandate_disabled', 1);
             $notify = true;
         }
 
         DB::commit();
 
         if (!empty($notify)) {
             \App\Jobs\PaymentEmail::dispatch($payment);
         }
 
         return [
             'id' => $payment['id'],
         ];
     }
 
     /**
      * Update payment status (and balance).
      *
      * @return int HTTP response code
      */
     public function webhook(): int
     {
         $payment_id = \request()->input('id');
 
         if (empty($payment_id)) {
             return 200;
         }
 
         $payment = Payment::find($payment_id);
 
         if (empty($payment)) {
             // Mollie recommends to return "200 OK" even if the payment does not exist
             return 200;
         }
 
         try {
             // Get the payment details from Mollie
             // TODO: Consider https://github.com/mollie/mollie-api-php/issues/502 when it's fixed
             $mollie_payment = mollie()->payments()->get($payment_id);
 
             $refunds = [];
 
             if ($mollie_payment->isPaid()) {
                 // The payment is paid. Update the balance, and notify the user
-                if ($payment->status != Payment::STATUS_PAID && $payment->amount > 0) {
+                if ($payment->status != Payment::STATUS_PAID && $payment->amount >= 0) {
                     $credit = true;
                     $notify = $payment->type == Payment::TYPE_RECURRING;
                 }
 
                 // The payment has been (partially) refunded.
                 // Let's process refunds with status "refunded".
                 if ($mollie_payment->hasRefunds()) {
                     foreach ($mollie_payment->refunds() as $refund) {
                         if ($refund->isTransferred() && $refund->amount->value) {
                             $refunds[] = [
                                 'id' => $refund->id,
                                 'description' => $refund->description,
                                 'amount' => round(floatval($refund->amount->value) * 100),
                                 'type' => Payment::TYPE_REFUND,
                                 'currency' => $refund->amount->currency
                             ];
                         }
                     }
                 }
 
                 // The payment has been (partially) charged back.
                 // Let's process chargebacks (they have no states as refunds)
                 if ($mollie_payment->hasChargebacks()) {
                     foreach ($mollie_payment->chargebacks() as $chargeback) {
                         if ($chargeback->amount->value) {
                             $refunds[] = [
                                 'id' => $chargeback->id,
                                 'amount' => round(floatval($chargeback->amount->value) * 100),
                                 'type' => Payment::TYPE_CHARGEBACK,
                                 'currency' => $chargeback->amount->currency
                             ];
                         }
                     }
                 }
 
                 // In case there were multiple auto-payment setup requests (e.g. caused by a double
                 // form submission) we end up with multiple payment records and mollie_mandate_id
                 // pointing to the one from the last payment not the successful one.
                 // We make sure to use mandate id from the successful "first" payment.
                 if (
                     $payment->type == Payment::TYPE_MANDATE
                     && $mollie_payment->mandateId
                     && $mollie_payment->sequenceType == Types\SequenceType::SEQUENCETYPE_FIRST
                 ) {
                     $payment->wallet->setSetting('mollie_mandate_id', $mollie_payment->mandateId);
                 }
             } elseif ($mollie_payment->isFailed()) {
                 // Note: I didn't find a way to get any description of the problem with a payment
                 \Log::info(sprintf('Mollie payment failed (%s)', $payment->id));
 
                 // Disable the mandate
                 if ($payment->type == Payment::TYPE_RECURRING) {
                     $notify = true;
                     $payment->wallet->setSetting('mandate_disabled', 1);
                 }
             }
 
             DB::beginTransaction();
 
             // This is a sanity check, just in case the payment provider api
             // sent us open -> paid -> open -> paid. So, we lock the payment after
             // recivied a "final" state.
             $pending_states = [Payment::STATUS_OPEN, Payment::STATUS_PENDING, Payment::STATUS_AUTHORIZED];
             if (in_array($payment->status, $pending_states)) {
                 $payment->status = $mollie_payment->status;
                 $payment->save();
             }
 
             if (!empty($credit)) {
                 self::creditPayment($payment, $mollie_payment);
             }
 
             foreach ($refunds as $refund) {
                 $payment->refund($refund);
             }
 
             DB::commit();
 
             if (!empty($notify)) {
                 \App\Jobs\PaymentEmail::dispatch($payment);
             }
         } catch (\Mollie\Api\Exceptions\ApiException $e) {
             \Log::warning(sprintf('Mollie api call failed (%s)', $e->getMessage()));
         }
 
         return 200;
     }
 
     /**
      * Get Mollie customer identifier for specified wallet.
      * Create one if does not exist yet.
      *
      * @param \App\Wallet $wallet The wallet
      * @param bool        $create Create the customer if does not exist yet
      *
      * @return ?string Mollie customer identifier
      */
     protected static function mollieCustomerId(Wallet $wallet, bool $create = false): ?string
     {
         $customer_id = $wallet->getSetting('mollie_id');
 
         // Register the user in Mollie
         if (empty($customer_id) && $create) {
             $customer = mollie()->customers()->create([
                     'name'  => $wallet->owner->name(),
                     'email' => $wallet->id . '@private.' . \config('app.domain'),
             ]);
 
             $customer_id = $customer->id;
 
             $wallet->setSetting('mollie_id', $customer->id);
         }
 
         return $customer_id;
     }
 
     /**
      * Get the active Mollie auto-payment mandate
      */
     protected static function mollieMandate(Wallet $wallet)
     {
         $settings = $wallet->getSettings(['mollie_id', 'mollie_mandate_id']);
 
         // Get the manadate reference we already have
         if ($settings['mollie_id'] && $settings['mollie_mandate_id']) {
             try {
                 return mollie()->mandates()->getForId($settings['mollie_id'], $settings['mollie_mandate_id']);
             } catch (ApiException $e) {
                 // FIXME: What about 404?
                 if ($e->getCode() == 410) {
                     // The mandate is gone, remove the reference
                     $wallet->setSetting('mollie_mandate_id', null);
                     return null;
                 }
 
                 // TODO: Maybe we shouldn't always throw? It make sense in the job
                 //       but for example when we're just fetching wallet info...
                 throw $e;
             }
         }
     }
 
     /**
      * Apply the successful payment's pecunia to the wallet
      */
     protected static function creditPayment($payment, $mollie_payment)
     {
         // Extract the payment method for transaction description
         $method = self::paymentMethod($mollie_payment, 'Mollie');
 
         $payment->credit($method);
     }
 
     /**
      * Extract payment method description from Mollie payment/mandate details
      */
     protected static function paymentMethod($object, $default = ''): string
     {
         $details = $object->details;
 
         // Mollie supports 3 methods here
         switch ($object->method) {
             case self::METHOD_CREDITCARD:
                 // If the customer started, but never finished the 'first' payment
                 // card details will be empty, and mandate will be 'pending'.
                 if (empty($details->cardNumber)) {
                     return 'Credit Card';
                 }
 
                 return sprintf(
                     '%s (**** **** **** %s)',
                     $details->cardLabel ?: 'Card', // @phpstan-ignore-line
                     $details->cardNumber
                 );
 
             case self::METHOD_DIRECTDEBIT:
                 return sprintf('Direct Debit (%s)', $details->customerAccount);
 
             case self::METHOD_PAYPAL:
                 return sprintf('PayPal (%s)', $details->consumerAccount);
         }
 
         return $default;
     }
 
     /**
      * List supported payment methods.
      *
      * @param string $type The payment type for which we require a method (oneoff/recurring).
      * @param string $currency Currency code
      *
      * @return array Array of array with available payment methods:
      *               - id: id of the method
      *               - name: User readable name of the payment method
      *               - minimumAmount: Minimum amount to be charged in cents
      *               - currency: Currency used for the method
      *               - exchangeRate: The projected exchange rate (actual rate is determined during payment)
      *               - icon: An icon (icon name) representing the method
      */
     public function providerPaymentMethods(string $type, string $currency): array
     {
         // Prefer methods in the system currency
         $providerMethods = (array) mollie()->methods()->allActive(
             [
                 'sequenceType' => $type,
                 'amount' => [
                     'value' => '1.00',
                     'currency' => $currency
                 ]
             ]
         );
 
         // Get EUR methods (e.g. bank transfers are in EUR only)
         if ($currency != 'EUR') {
             $eurMethods = (array) mollie()->methods()->allActive(
                 [
                     'sequenceType' => $type,
                     'amount' => [
                         'value' => '1.00',
                         'currency' => 'EUR'
                     ]
                 ]
             );
 
             // Later provider methods will override earlier ones
             $providerMethods = array_merge($eurMethods, $providerMethods);
         }
 
         $availableMethods = [];
 
         foreach ($providerMethods as $method) {
             $availableMethods[$method->id] = [
                 'id' => $method->id,
                 'name' => $method->description,
                 'minimumAmount' => round(floatval($method->minimumAmount->value) * 100), // Converted to cents
                 'currency' => $method->minimumAmount->currency,
                 'exchangeRate' => \App\Utils::exchangeRate($currency, $method->minimumAmount->currency)
             ];
         }
 
         return $availableMethods;
     }
 
     /**
      * Get a payment.
      *
      * @param string $paymentId Payment identifier
      *
      * @return array Payment information:
      *                    - id: Payment identifier
      *                    - status: Payment status
      *                    - isCancelable: The payment can be canceled
      *                    - checkoutUrl: The checkout url to complete the payment or null if none
      */
     public function getPayment($paymentId): array
     {
         $payment = mollie()->payments()->get($paymentId);
 
         return [
             'id' => $payment->id,
             'status' => $payment->status,
             'isCancelable' => $payment->isCancelable,
             'checkoutUrl' => $payment->getCheckoutUrl()
         ];
     }
 }
diff --git a/src/app/Providers/Payment/Stripe.php b/src/app/Providers/Payment/Stripe.php
index 76bc47aa..19ba14c1 100644
--- a/src/app/Providers/Payment/Stripe.php
+++ b/src/app/Providers/Payment/Stripe.php
@@ -1,551 +1,554 @@
 <?php
 
 namespace App\Providers\Payment;
 
 use App\Payment;
 use App\Utils;
 use App\Wallet;
 use App\WalletSetting;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Request;
 use Stripe as StripeAPI;
 
 class Stripe extends \App\Providers\PaymentProvider
 {
     /**
      * Class constructor.
      */
     public function __construct()
     {
         StripeAPI\Stripe::setApiKey(\config('services.stripe.key'));
     }
 
     /**
      * Get a link to the customer in the provider's control panel
      *
      * @param \App\Wallet $wallet The wallet
      *
      * @return string|null The string representing <a> tag
      */
     public function customerLink(Wallet $wallet): ?string
     {
         $customer_id = self::stripeCustomerId($wallet, false);
 
         if (!$customer_id) {
             return null;
         }
 
         $location = 'https://dashboard.stripe.com';
 
         $key = \config('services.stripe.key');
 
         if (strpos($key, 'sk_test_') === 0) {
             $location .= '/test';
         }
 
         return sprintf(
             '<a href="%s/customers/%s" target="_blank">%s</a>',
             $location,
             $customer_id,
             $customer_id
         );
     }
 
     /**
      * Create a new auto-payment mandate for a wallet.
      *
      * @param \App\Wallet $wallet  The wallet
      * @param array       $payment Payment data:
      *                             - amount: Value in cents (not used)
      *                             - currency: The operation currency
      *                             - description: Operation desc.
      *
      * @return array Provider payment/session data:
      *               - id: Session identifier
      */
     public function createMandate(Wallet $wallet, array $payment): ?array
     {
         // Register the user in Stripe, if not yet done
         $customer_id = self::stripeCustomerId($wallet, true);
 
         $request = [
             'customer' => $customer_id,
             'cancel_url' => self::redirectUrl(), // required
             'success_url' => self::redirectUrl(), // required
             'payment_method_types' => ['card'], // required
             'locale' => 'en',
             'mode' => 'setup',
         ];
 
         // Note: Stripe does not allow to set amount for 'setup' operation
         // We'll dispatch WalletCharge job when we receive a webhook request
 
         $session = StripeAPI\Checkout\Session::create($request);
 
         $payment['amount'] = 0;
         $payment['credit_amount'] = 0;
         $payment['currency_amount'] = 0;
         $payment['vat_rate_id'] = null;
         $payment['id'] = $session->setup_intent;
         $payment['type'] = Payment::TYPE_MANDATE;
 
         $this->storePayment($payment, $wallet->id);
 
         return [
             'id' => $session->id,
         ];
     }
 
     /**
      * Revoke the auto-payment mandate.
      *
      * @param \App\Wallet $wallet The wallet
      *
      * @return bool True on success, False on failure
      */
     public function deleteMandate(Wallet $wallet): bool
     {
         // Get the Mandate info
         $mandate = self::stripeMandate($wallet);
 
         if ($mandate) {
             // Remove the reference
             $wallet->setSetting('stripe_mandate_id', null);
 
             // Detach the payment method on Stripe
             $pm = StripeAPI\PaymentMethod::retrieve($mandate->payment_method);
             $pm->detach();
         }
 
         return true;
     }
 
     /**
      * Get a auto-payment mandate for a wallet.
      *
      * @param \App\Wallet $wallet The wallet
      *
      * @return array|null Mandate information:
      *                    - id: Mandate identifier
      *                    - method: user-friendly payment method desc.
      *                    - isPending: the process didn't complete yet
      *                    - isValid: the mandate is valid
      */
     public function getMandate(Wallet $wallet): ?array
     {
         // Get the Mandate info
         $mandate = self::stripeMandate($wallet);
 
         if (empty($mandate)) {
             return null;
         }
 
         $pm = StripeAPI\PaymentMethod::retrieve($mandate->payment_method);
 
         $result = [
             'id' => $mandate->id,
             'isPending' => $mandate->status != 'succeeded' && $mandate->status != 'canceled',
             'isValid' => $mandate->status == 'succeeded',
             'method' => self::paymentMethod($pm, 'Unknown method')
         ];
 
         return $result;
     }
 
     /**
      * Get a provider name
      *
      * @return string Provider name
      */
     public function name(): string
     {
         return 'stripe';
     }
 
     /**
      * Create a new payment.
      *
      * @param \App\Wallet $wallet  The wallet
      * @param array       $payment Payment data:
      *                             - amount: Value in cents
      *                             - currency: The operation currency
      *                             - type: first/oneoff/recurring
      *                             - description: Operation desc.
      *
      * @return array Provider payment/session data:
      *               - id: Session identifier
      */
     public function payment(Wallet $wallet, array $payment): ?array
     {
         if ($payment['type'] == Payment::TYPE_RECURRING) {
             return $this->paymentRecurring($wallet, $payment);
         }
 
         // Register the user in Stripe, if not yet done
         $customer_id = self::stripeCustomerId($wallet, true);
 
         $amount = $this->exchange($payment['amount'], $wallet->currency, $payment['currency']);
         $payment['currency_amount'] = $amount;
 
         $request = [
             'customer' => $customer_id,
             'cancel_url' => self::redirectUrl(), // required
             'success_url' => self::redirectUrl(), // required
             'payment_method_types' => ['card'], // required
             'locale' => 'en',
             'line_items' => [
                 [
                     'name' => $payment['description'],
                     'amount' => $amount,
                     'currency' => \strtolower($payment['currency']),
                     'quantity' => 1,
                 ]
             ]
         ];
 
         $session = StripeAPI\Checkout\Session::create($request);
 
         // Store the payment reference in database
         $payment['id'] = $session->payment_intent;
 
         $this->storePayment($payment, $wallet->id);
 
         return [
             'id' => $session->id,
         ];
     }
 
     /**
      * Create a new automatic payment operation.
      *
      * @param \App\Wallet $wallet  The wallet
      * @param array       $payment Payment data (see self::payment())
      *
      * @return array Provider payment/session data:
      *               - id: Session identifier
      */
     protected function paymentRecurring(Wallet $wallet, array $payment): ?array
     {
         // Check if there's a valid mandate
         $mandate = self::stripeMandate($wallet);
 
         if (empty($mandate)) {
             return null;
         }
 
         $amount = $this->exchange($payment['amount'], $wallet->currency, $payment['currency']);
         $payment['currency_amount'] = $amount;
 
         $request = [
             'amount' => $amount,
             'currency' => \strtolower($payment['currency']),
             'description' => $payment['description'],
             'receipt_email' => $wallet->owner->email,
             'customer' => $mandate->customer,
             'payment_method' => $mandate->payment_method,
             'off_session' => true,
             'confirm' => true,
         ];
 
         $intent = StripeAPI\PaymentIntent::create($request);
 
         // Store the payment reference in database
         $payment['id'] = $intent->id;
 
         $this->storePayment($payment, $wallet->id);
 
         return [
             'id' => $payment['id'],
         ];
     }
 
     /**
      * Update payment status (and balance).
      *
      * @return int HTTP response code
      */
     public function webhook(): int
     {
         // We cannot just use php://input as it's already "emptied" by the framework
         // $payload = file_get_contents('php://input');
         $request = Request::instance();
         $payload = $request->getContent();
         $sig_header = $request->header('Stripe-Signature');
 
         // Parse and validate the input
         try {
             $event = StripeAPI\Webhook::constructEvent(
                 $payload,
                 $sig_header,
                 \config('services.stripe.webhook_secret')
             );
         } catch (\Exception $e) {
             \Log::error("Invalid payload: " . $e->getMessage());
             // Invalid payload
             return 400;
         }
 
         switch ($event->type) {
             case StripeAPI\Event::PAYMENT_INTENT_CANCELED:
             case StripeAPI\Event::PAYMENT_INTENT_PAYMENT_FAILED:
             case StripeAPI\Event::PAYMENT_INTENT_SUCCEEDED:
                 $intent = $event->data->object; // @phpstan-ignore-line
                 $payment = Payment::find($intent->id);
 
                 if (empty($payment) || $payment->type == Payment::TYPE_MANDATE) {
                     return 404;
                 }
 
                 switch ($intent->status) {
                     case StripeAPI\PaymentIntent::STATUS_CANCELED:
                         $status = Payment::STATUS_CANCELED;
                         break;
                     case StripeAPI\PaymentIntent::STATUS_SUCCEEDED:
                         $status = Payment::STATUS_PAID;
                         break;
                     default:
                         $status = Payment::STATUS_FAILED;
                 }
 
                 DB::beginTransaction();
 
                 if ($status == Payment::STATUS_PAID) {
                     // Update the balance, if it wasn't already
                     if ($payment->status != Payment::STATUS_PAID) {
                         $this->creditPayment($payment, $intent);
                     }
                 } else {
                     if (!empty($intent->last_payment_error)) {
                         // See https://stripe.com/docs/error-codes for more info
                         \Log::info(sprintf(
                             'Stripe payment failed (%s): %s',
                             $payment->id,
                             json_encode($intent->last_payment_error)
                         ));
                     }
                 }
 
                 if ($payment->status != Payment::STATUS_PAID) {
                     $payment->status = $status;
                     $payment->save();
 
                     if ($status != Payment::STATUS_CANCELED && $payment->type == Payment::TYPE_RECURRING) {
                         // Disable the mandate
                         if ($status == Payment::STATUS_FAILED) {
                             $payment->wallet->setSetting('mandate_disabled', 1);
                         }
 
                         // Notify the user
                         \App\Jobs\PaymentEmail::dispatch($payment);
                     }
                 }
 
                 DB::commit();
 
                 break;
 
             case StripeAPI\Event::SETUP_INTENT_SUCCEEDED:
             case StripeAPI\Event::SETUP_INTENT_SETUP_FAILED:
             case StripeAPI\Event::SETUP_INTENT_CANCELED:
                 $intent = $event->data->object; // @phpstan-ignore-line
                 $payment = Payment::find($intent->id);
 
                 if (empty($payment) || $payment->type != Payment::TYPE_MANDATE) {
                     return 404;
                 }
 
                 switch ($intent->status) {
                     case StripeAPI\SetupIntent::STATUS_CANCELED:
                         $status = Payment::STATUS_CANCELED;
                         break;
                     case StripeAPI\SetupIntent::STATUS_SUCCEEDED:
                         $status = Payment::STATUS_PAID;
                         break;
                     default:
                         $status = Payment::STATUS_FAILED;
                 }
 
                 if ($status == Payment::STATUS_PAID) {
                     $payment->wallet->setSetting('stripe_mandate_id', $intent->id);
                     $threshold = intval((float) $payment->wallet->getSetting('mandate_balance') * 100);
 
+                    // Call credit() so wallet/account state is updated
+                    $this->creditPayment($payment, $intent);
+
                     // Top-up the wallet if balance is below the threshold
                     if ($payment->wallet->balance < $threshold && $payment->status != Payment::STATUS_PAID) {
                         \App\Jobs\WalletCharge::dispatch($payment->wallet);
                     }
                 }
 
                 $payment->status = $status;
                 $payment->save();
 
                 break;
 
             default:
                 \Log::debug("Unhandled Stripe event: " . var_export($payload, true));
                 break;
         }
 
         return 200;
     }
 
     /**
      * Get Stripe customer identifier for specified wallet.
      * Create one if does not exist yet.
      *
      * @param \App\Wallet $wallet The wallet
      * @param bool        $create Create the customer if does not exist yet
      *
      * @return string|null Stripe customer identifier
      */
     protected static function stripeCustomerId(Wallet $wallet, bool $create = false): ?string
     {
         $customer_id = $wallet->getSetting('stripe_id');
 
         // Register the user in Stripe
         if (empty($customer_id) && $create) {
             $customer = StripeAPI\Customer::create([
                     'name'  => $wallet->owner->name(),
                     // Stripe will display the email on Checkout page, editable,
                     // and use it to send the receipt (?), use the user email here
                     // 'email' => $wallet->id . '@private.' . \config('app.domain'),
                     'email' => $wallet->owner->email,
             ]);
 
             $customer_id = $customer->id;
 
             $wallet->setSetting('stripe_id', $customer->id);
         }
 
         return $customer_id;
     }
 
     /**
      * Get the active Stripe auto-payment mandate (Setup Intent)
      */
     protected static function stripeMandate(Wallet $wallet)
     {
         // Note: Stripe also has 'Mandate' objects, but we do not use these
 
         if ($mandate_id = $wallet->getSetting('stripe_mandate_id')) {
             $mandate = StripeAPI\SetupIntent::retrieve($mandate_id);
             // @phpstan-ignore-next-line
             if ($mandate && $mandate->status != 'canceled') {
                 return $mandate;
             }
         }
     }
 
     /**
      * Apply the successful payment's pecunia to the wallet
      */
     protected static function creditPayment(Payment $payment, $intent)
     {
         $method = 'Stripe';
 
         // Extract the payment method for transaction description
         if (
             !empty($intent->charges)
             && ($charge = $intent->charges->data[0])
             && ($pm = $charge->payment_method_details)
         ) {
             $method = self::paymentMethod($pm);
         }
 
         $payment->credit($method);
     }
 
     /**
      * Extract payment method description from Stripe payment details
      */
     protected static function paymentMethod($details, $default = ''): string
     {
         switch ($details->type) {
             case 'card':
                 // TODO: card number
                 return \sprintf(
                     '%s (**** **** **** %s)',
                     \ucfirst($details->card->brand) ?: 'Card',
                     $details->card->last4
                 );
         }
 
         return $default;
     }
 
     /**
      * List supported payment methods.
      *
      * @param string $type     The payment type for which we require a method (oneoff/recurring).
      * @param string $currency Currency code
      *
      * @return array Array of array with available payment methods:
      *               - id: id of the method
      *               - name: User readable name of the payment method
      *               - minimumAmount: Minimum amount to be charged in cents
      *               - currency: Currency used for the method
      *               - exchangeRate: The projected exchange rate (actual rate is determined during payment)
      *               - icon: An icon (icon name) representing the method
      */
     public function providerPaymentMethods(string $type, string $currency): array
     {
         //TODO get this from the stripe API?
         $availableMethods = [];
         switch ($type) {
             case Payment::TYPE_ONEOFF:
                 $availableMethods = [
                     self::METHOD_CREDITCARD => [
                         'id' => self::METHOD_CREDITCARD,
                         'name' => "Credit Card",
                         'minimumAmount' => Payment::MIN_AMOUNT,
                         'currency' => $currency,
                         'exchangeRate' => 1.0
                     ],
                     self::METHOD_PAYPAL => [
                         'id' => self::METHOD_PAYPAL,
                         'name' => "PayPal",
                         'minimumAmount' => Payment::MIN_AMOUNT,
                         'currency' => $currency,
                         'exchangeRate' => 1.0
                     ]
                 ];
                 break;
             case Payment::TYPE_RECURRING:
                 $availableMethods = [
                     self::METHOD_CREDITCARD => [
                         'id' => self::METHOD_CREDITCARD,
                         'name' => "Credit Card",
                         'minimumAmount' => Payment::MIN_AMOUNT, // Converted to cents,
                         'currency' => $currency,
                         'exchangeRate' => 1.0
                     ]
                 ];
                 break;
         }
 
         return $availableMethods;
     }
 
     /**
      * Get a payment.
      *
      * @param string $paymentId Payment identifier
      *
      * @return array Payment information:
      *                    - id: Payment identifier
      *                    - status: Payment status
      *                    - isCancelable: The payment can be canceled
      *                    - checkoutUrl: The checkout url to complete the payment or null if none
      */
     public function getPayment($paymentId): array
     {
         \Log::info("Stripe::getPayment does not yet retrieve a checkoutUrl.");
 
         $payment = StripeAPI\PaymentIntent::retrieve($paymentId);
         return [
             'id' => $payment->id,
             'status' => $payment->status,
             'isCancelable' => false,
             'checkoutUrl' => null
         ];
     }
 }
diff --git a/src/app/User.php b/src/app/User.php
index b58b9547..3272ec5c 100644
--- a/src/app/User.php
+++ b/src/app/User.php
@@ -1,826 +1,837 @@
 <?php
 
 namespace App;
 
 use App\AuthAttempt;
 use App\Traits\AliasesTrait;
 use App\Traits\BelongsToTenantTrait;
 use App\Traits\EntitleableTrait;
 use App\Traits\EmailPropertyTrait;
 use App\Traits\UserConfigTrait;
 use App\Traits\UuidIntKeyTrait;
 use App\Traits\SettingsTrait;
 use App\Traits\StatusPropertyTrait;
 use Dyrynda\Database\Support\NullableFields;
 use Illuminate\Database\Eloquent\SoftDeletes;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Laravel\Passport\HasApiTokens;
 use League\OAuth2\Server\Exception\OAuthServerException;
 
 /**
  * The eloquent definition of a User.
  *
  * @property string $email
  * @property int    $id
  * @property string $password
  * @property string $password_ldap
  * @property string $role
  * @property int    $status
  * @property int    $tenant_id
  */
 class User extends Authenticatable
 {
     use AliasesTrait;
     use BelongsToTenantTrait;
     use EntitleableTrait;
     use EmailPropertyTrait;
     use HasApiTokens;
     use NullableFields;
     use UserConfigTrait;
     use UuidIntKeyTrait;
     use SettingsTrait;
     use SoftDeletes;
     use StatusPropertyTrait;
 
     // a new user, default on creation
     public const STATUS_NEW        = 1 << 0;
     // it's been activated
     public const STATUS_ACTIVE     = 1 << 1;
     // user has been suspended
     public const STATUS_SUSPENDED  = 1 << 2;
     // user has been deleted
     public const STATUS_DELETED    = 1 << 3;
     // user has been created in LDAP
     public const STATUS_LDAP_READY = 1 << 4;
     // user mailbox has been created in IMAP
     public const STATUS_IMAP_READY = 1 << 5;
     // user in "limited feature-set" state
     public const STATUS_DEGRADED   = 1 << 6;
     // a restricted user
     public const STATUS_RESTRICTED = 1 << 7;
 
     /** @var int The allowed states for this object used in StatusPropertyTrait */
     private int $allowed_states = self::STATUS_NEW |
         self::STATUS_ACTIVE |
         self::STATUS_SUSPENDED |
         self::STATUS_DELETED |
         self::STATUS_LDAP_READY |
         self::STATUS_IMAP_READY |
         self::STATUS_DEGRADED |
         self::STATUS_RESTRICTED;
 
     /** @var array<int, string> The attributes that are mass assignable */
     protected $fillable = [
         'id',
         'email',
         'password',
         'password_ldap',
         'status',
     ];
 
     /** @var array<int, string> The attributes that should be hidden for arrays */
     protected $hidden = [
         'password',
         'password_ldap',
         'role'
     ];
 
     /** @var array<int, string> The attributes that can be null */
     protected $nullable = [
         'password',
         'password_ldap'
     ];
 
     /** @var array<string, string> The attributes that should be cast */
     protected $casts = [
         'created_at' => 'datetime:Y-m-d H:i:s',
         'deleted_at' => 'datetime:Y-m-d H:i:s',
         'updated_at' => 'datetime:Y-m-d H:i:s',
     ];
 
     /**
      * Any wallets on which this user is a controller.
      *
      * This does not include wallets owned by the user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
      */
     public function accounts()
     {
         return $this->belongsToMany(
             Wallet::class,      // The foreign object definition
             'user_accounts',    // The table name
             'user_id',          // The local foreign key
             'wallet_id'         // The remote foreign key
         );
     }
 
     /**
      * Assign a package to a user. The user should not have any existing entitlements.
      *
      * @param \App\Package   $package The package to assign.
      * @param \App\User|null $user    Assign the package to another user.
      *
      * @return \App\User
      */
     public function assignPackage($package, $user = null)
     {
         if (!$user) {
             $user = $this;
         }
 
         return $user->assignPackageAndWallet($package, $this->wallets()->first());
     }
 
     /**
      * Assign a package plan to a user.
      *
      * @param \App\Plan   $plan   The plan to assign
      * @param \App\Domain $domain Optional domain object
      *
      * @return \App\User Self
      */
     public function assignPlan($plan, $domain = null): User
     {
         $this->setSetting('plan_id', $plan->id);
 
         foreach ($plan->packages as $package) {
             if ($package->isDomain()) {
                 $domain->assignPackage($package, $this);
             } else {
                 $this->assignPackage($package);
             }
         }
 
         return $this;
     }
 
     /**
      * Check if current user can delete another object.
      *
      * @param mixed $object A user|domain|wallet|group object
      *
      * @return bool True if he can, False otherwise
      */
     public function canDelete($object): bool
     {
         if (!is_object($object) || !method_exists($object, 'wallet')) {
             return false;
         }
 
         $wallet = $object->wallet();
 
         // TODO: For now controller can delete/update the account owner,
         //       this may change in future, controllers are not 0-regression feature
 
         return $wallet && ($wallet->user_id == $this->id || $this->accounts->contains($wallet));
     }
 
     /**
      * Check if current user can read data of another object.
      *
      * @param mixed $object A user|domain|wallet|group object
      *
      * @return bool True if he can, False otherwise
      */
     public function canRead($object): bool
     {
         if ($this->role == 'admin') {
             return true;
         }
 
         if ($object instanceof User && $this->id == $object->id) {
             return true;
         }
 
         if ($this->role == 'reseller') {
             if ($object instanceof User && $object->role == 'admin') {
                 return false;
             }
 
             if ($object instanceof Wallet && !empty($object->owner)) {
                 $object = $object->owner;
             }
 
             return isset($object->tenant_id) && $object->tenant_id == $this->tenant_id;
         }
 
         if ($object instanceof Wallet) {
             return $object->user_id == $this->id || $object->controllers->contains($this);
         }
 
         if (!method_exists($object, 'wallet')) {
             return false;
         }
 
         $wallet = $object->wallet();
 
         return $wallet && ($wallet->user_id == $this->id || $this->accounts->contains($wallet));
     }
 
     /**
      * Check if current user can update data of another object.
      *
      * @param mixed $object A user|domain|wallet|group object
      *
      * @return bool True if he can, False otherwise
      */
     public function canUpdate($object): bool
     {
         if ($object instanceof User && $this->id == $object->id) {
             return true;
         }
 
         if ($this->role == 'admin') {
             return true;
         }
 
         if ($this->role == 'reseller') {
             if ($object instanceof User && $object->role == 'admin') {
                 return false;
             }
 
             if ($object instanceof Wallet && !empty($object->owner)) {
                 $object = $object->owner;
             }
 
             return isset($object->tenant_id) && $object->tenant_id == $this->tenant_id;
         }
 
         return $this->canDelete($object);
     }
 
     /**
      * Degrade the user
      *
      * @return void
      */
     public function degrade(): void
     {
         if ($this->isDegraded()) {
             return;
         }
 
         $this->status |= User::STATUS_DEGRADED;
         $this->save();
     }
 
     /**
      * List the domains to which this user is entitled.
      *
      * @param bool $with_accounts Include domains assigned to wallets
      *                            the current user controls but not owns.
      * @param bool $with_public   Include active public domains (for the user tenant).
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function domains($with_accounts = true, $with_public = true)
     {
         $domains = $this->entitleables(Domain::class, $with_accounts);
 
         if ($with_public) {
             $domains->orWhere(function ($query) {
                 if (!$this->tenant_id) {
                     $query->where('tenant_id', $this->tenant_id);
                 } else {
                     $query->withEnvTenantContext();
                 }
 
                 $query->where('domains.type', '&', Domain::TYPE_PUBLIC)
                     ->where('domains.status', '&', Domain::STATUS_ACTIVE);
             });
         }
 
         return $domains;
     }
 
     /**
      * Return entitleable objects of a specified type controlled by the current user.
      *
      * @param string $class         Object class
      * @param bool   $with_accounts Include objects assigned to wallets
      *                              the current user controls, but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     private function entitleables(string $class, bool $with_accounts = true)
     {
         $wallets = $this->wallets()->pluck('id')->all();
 
         if ($with_accounts) {
             $wallets = array_merge($wallets, $this->accounts()->pluck('wallet_id')->all());
         }
 
         $object = new $class();
         $table = $object->getTable();
 
         return $object->select("{$table}.*")
             ->whereExists(function ($query) use ($table, $wallets, $class) {
                 $query->select(DB::raw(1))
                     ->from('entitlements')
                     ->whereColumn('entitleable_id', "{$table}.id")
                     ->whereIn('entitlements.wallet_id', $wallets)
                     ->where('entitlements.entitleable_type', $class);
             });
     }
 
     /**
      * Helper to find user by email address, whether it is
      * main email address, alias or an external email.
      *
      * If there's more than one alias NULL will be returned.
      *
      * @param string $email    Email address
      * @param bool   $external Search also for an external email
      *
      * @return \App\User|null User model object if found
      */
     public static function findByEmail(string $email, bool $external = false): ?User
     {
         if (strpos($email, '@') === false) {
             return null;
         }
 
         $email = \strtolower($email);
 
         $user = self::where('email', $email)->first();
 
         if ($user) {
             return $user;
         }
 
         $aliases = UserAlias::where('alias', $email)->get();
 
         if (count($aliases) == 1) {
             return $aliases->first()->user;
         }
 
         // TODO: External email
 
         return null;
     }
 
     /**
      * Storage items for this user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function fsItems()
     {
         return $this->hasMany(Fs\Item::class);
     }
 
     /**
      * Return groups controlled by the current user.
      *
      * @param bool $with_accounts Include groups assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function groups($with_accounts = true)
     {
         return $this->entitleables(Group::class, $with_accounts);
     }
 
     /**
      * Returns whether this user (or its wallet owner) is degraded.
      *
      * @param bool $owner Check also the wallet owner instead just the user himself
      *
      * @return bool
      */
     public function isDegraded(bool $owner = false): bool
     {
         if ($this->status & self::STATUS_DEGRADED) {
             return true;
         }
 
         if ($owner && ($wallet = $this->wallet())) {
             return $wallet->owner && $wallet->owner->isDegraded();
         }
 
         return false;
     }
 
     /**
      * Returns whether this user is restricted.
      *
      * @return bool
      */
     public function isRestricted(): bool
     {
         return ($this->status & self::STATUS_RESTRICTED) > 0;
     }
 
     /**
      * A shortcut to get the user name.
      *
      * @param bool $fallback Return "<aa.name> User" if there's no name
      *
      * @return string Full user name
      */
     public function name(bool $fallback = false): string
     {
         $settings = $this->getSettings(['first_name', 'last_name']);
 
         $name = trim($settings['first_name'] . ' ' . $settings['last_name']);
 
         if (empty($name) && $fallback) {
             return trim(\trans('app.siteuser', ['site' => Tenant::getConfig($this->tenant_id, 'app.name')]));
         }
 
         return $name;
     }
 
     /**
      * Old passwords for this user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function passwords()
     {
         return $this->hasMany(UserPassword::class);
     }
 
     /**
      * Restrict this user.
      *
      * @return void
      */
     public function restrict(): void
     {
         if ($this->isRestricted()) {
             return;
         }
 
         $this->status |= User::STATUS_RESTRICTED;
         $this->save();
     }
 
     /**
      * Return resources controlled by the current user.
      *
      * @param bool $with_accounts Include resources assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function resources($with_accounts = true)
     {
         return $this->entitleables(Resource::class, $with_accounts);
     }
 
     /**
      * Return rooms controlled by the current user.
      *
      * @param bool $with_accounts Include rooms assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function rooms($with_accounts = true)
     {
         return $this->entitleables(Meet\Room::class, $with_accounts);
     }
 
     /**
      * Return shared folders controlled by the current user.
      *
      * @param bool $with_accounts Include folders assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function sharedFolders($with_accounts = true)
     {
         return $this->entitleables(SharedFolder::class, $with_accounts);
     }
 
     public function senderPolicyFrameworkWhitelist($clientName)
     {
         $setting = $this->getSetting('spf_whitelist');
 
         if (!$setting) {
             return false;
         }
 
         $whitelist = json_decode($setting);
 
         $matchFound = false;
 
         foreach ($whitelist as $entry) {
             if (substr($entry, 0, 1) == '/') {
                 $match = preg_match($entry, $clientName);
 
                 if ($match) {
                     $matchFound = true;
                 }
 
                 continue;
             }
 
             if (substr($entry, 0, 1) == '.') {
                 if (substr($clientName, (-1 * strlen($entry))) == $entry) {
                     $matchFound = true;
                 }
 
                 continue;
             }
 
             if ($entry == $clientName) {
                 $matchFound = true;
                 continue;
             }
         }
 
         return $matchFound;
     }
 
     /**
      * Un-degrade this user.
      *
      * @return void
      */
     public function undegrade(): void
     {
         if (!$this->isDegraded()) {
             return;
         }
 
         $this->status ^= User::STATUS_DEGRADED;
         $this->save();
     }
 
     /**
      * Un-restrict this user.
      *
+     * @param bool $deep Unrestrict also all users in the account
+     *
      * @return void
      */
-    public function unrestrict(): void
+    public function unrestrict(bool $deep = false): void
     {
-        if (!$this->isRestricted()) {
-            return;
+        if ($this->isRestricted()) {
+            $this->status ^= User::STATUS_RESTRICTED;
+            $this->save();
+        }
+
+        // Remove the flag from all users in the user's wallets
+        if ($deep) {
+            $this->wallets->each(function ($wallet) {
+                User::whereIn('id', $wallet->entitlements()->select('entitleable_id')
+                    ->where('entitleable_type', User::class))
+                    ->each(function ($user) {
+                        $user->unrestrict();
+                    });
+            });
         }
-
-        $this->status ^= User::STATUS_RESTRICTED;
-        $this->save();
     }
 
     /**
      * Return users controlled by the current user.
      *
      * @param bool $with_accounts Include users assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function users($with_accounts = true)
     {
         return $this->entitleables(User::class, $with_accounts);
     }
 
     /**
      * Verification codes for this user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function verificationcodes()
     {
         return $this->hasMany(VerificationCode::class, 'user_id', 'id');
     }
 
     /**
      * Wallets this user owns.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function wallets()
     {
         return $this->hasMany(Wallet::class);
     }
 
     /**
      * User password mutator
      *
      * @param string $password The password in plain text.
      *
      * @return void
      */
     public function setPasswordAttribute($password)
     {
         if (!empty($password)) {
             $this->attributes['password'] = Hash::make($password);
             $this->attributes['password_ldap'] = '{SSHA512}' . base64_encode(
                 pack('H*', hash('sha512', $password))
             );
         }
     }
 
     /**
      * User LDAP password mutator
      *
      * @param string $password The password in plain text.
      *
      * @return void
      */
     public function setPasswordLdapAttribute($password)
     {
         $this->setPasswordAttribute($password);
     }
 
     /**
      * Validate the user credentials
      *
      * @param string $username       The username.
      * @param string $password       The password in plain text.
      * @param bool   $updatePassword Store the password if currently empty
      *
      * @return bool true on success
      */
     public function validateCredentials(string $username, string $password, bool $updatePassword = true): bool
     {
         $authenticated = false;
 
         if ($this->email === \strtolower($username)) {
             if (!empty($this->password)) {
                 if (Hash::check($password, $this->password)) {
                     $authenticated = true;
                 }
             } elseif (!empty($this->password_ldap)) {
                 if (substr($this->password_ldap, 0, 6) == "{SSHA}") {
                     $salt = substr(base64_decode(substr($this->password_ldap, 6)), 20);
 
                     $hash = '{SSHA}' . base64_encode(
                         sha1($password . $salt, true) . $salt
                     );
 
                     if ($hash == $this->password_ldap) {
                         $authenticated = true;
                     }
                 } elseif (substr($this->password_ldap, 0, 9) == "{SSHA512}") {
                     $salt = substr(base64_decode(substr($this->password_ldap, 9)), 64);
 
                     $hash = '{SSHA512}' . base64_encode(
                         pack('H*', hash('sha512', $password . $salt)) . $salt
                     );
 
                     if ($hash == $this->password_ldap) {
                         $authenticated = true;
                     }
                 }
             } else {
                 \Log::error("Incomplete credentials for {$this->email}");
             }
         }
 
         if ($authenticated) {
             // TODO: update last login time
             if ($updatePassword && (empty($this->password) || empty($this->password_ldap))) {
                 $this->password = $password;
                 $this->save();
             }
         }
 
         return $authenticated;
     }
 
     /**
      * Validate request location regarding geo-lockin
      *
      * @param string $ip IP address to check, usually request()->ip()
      *
      * @return bool
      */
     public function validateLocation($ip): bool
     {
         $countryCodes = json_decode($this->getSetting('limit_geo', "[]"));
 
         if (empty($countryCodes)) {
             return true;
         }
 
         return in_array(\App\Utils::countryForIP($ip), $countryCodes);
     }
 
     /**
      * Check if multi factor verification is enabled
      *
      * @return bool
      */
     public function mfaEnabled(): bool
     {
         return \App\CompanionApp::where('user_id', $this->id)
             ->where('mfa_enabled', true)
             ->exists();
     }
 
     /**
      * Retrieve and authenticate a user
      *
      * @param string  $username The username
      * @param string  $password The password in plain text
      * @param ?string $clientIP The IP address of the client
      *
      * @return array ['user', 'reason', 'errorMessage']
      */
     public static function findAndAuthenticate($username, $password, $clientIP = null, $verifyMFA = true): array
     {
         $error = null;
 
         if (!$clientIP) {
             $clientIP = request()->ip();
         }
 
         $user = User::where('email', $username)->first();
 
         if (!$user) {
             $error = AuthAttempt::REASON_NOTFOUND;
         }
 
         // Check user password
         if (!$error && !$user->validateCredentials($username, $password)) {
             $error = AuthAttempt::REASON_PASSWORD;
         }
 
         if ($verifyMFA) {
             // Check user (request) location
             if (!$error && !$user->validateLocation($clientIP)) {
                 $error = AuthAttempt::REASON_GEOLOCATION;
             }
 
             // Check 2FA
             if (!$error) {
                 try {
                     (new \App\Auth\SecondFactor($user))->validate(request()->secondfactor);
                 } catch (\Exception $e) {
                     $error = AuthAttempt::REASON_2FA_GENERIC;
                     $message = $e->getMessage();
                 }
             }
 
             // Check 2FA - Companion App
             if (!$error && $user->mfaEnabled()) {
                 $attempt = AuthAttempt::recordAuthAttempt($user, $clientIP);
                 if (!$attempt->waitFor2FA()) {
                     $error = AuthAttempt::REASON_2FA;
                 }
             }
         }
 
         if ($error) {
             if ($user && empty($attempt)) {
                 $attempt = AuthAttempt::recordAuthAttempt($user, $clientIP);
                 if (!$attempt->isAccepted()) {
                     $attempt->deny($error);
                     $attempt->save();
                     $attempt->notify();
                 }
             }
 
             if ($user) {
                 \Log::info("Authentication failed for {$user->email}");
             }
 
             return ['reason' => $error, 'errorMessage' => $message ?? \trans("auth.error.{$error}")];
         }
 
         \Log::info("Successful authentication for {$user->email}");
 
         return ['user' => $user];
     }
 
     /**
      * Hook for passport
      *
      * @throws \Throwable
      *
      * @return \App\User User model object if found
      */
     public static function findAndValidateForPassport($username, $password): User
     {
         $verifyMFA = true;
         if (request()->scope == "mfa") {
             \Log::info("Not validating MFA because this is a request for an mfa scope.");
             // Don't verify MFA if this is only an mfa token.
             // If we didn't do this, we couldn't pair backup devices.
             $verifyMFA = false;
         }
         $result = self::findAndAuthenticate($username, $password, null, $verifyMFA);
 
         if (isset($result['reason'])) {
             if ($result['reason'] == AuthAttempt::REASON_2FA_GENERIC) {
                 // This results in a json response of {'error': 'secondfactor', 'error_description': '$errorMessage'}
                 throw new OAuthServerException($result['errorMessage'], 6, 'secondfactor', 401);
             }
 
             // TODO: Display specific error message if 2FA via Companion App was expected?
 
             throw OAuthServerException::invalidCredentials();
         }
 
         return $result['user'];
     }
 }
diff --git a/src/database/migrations/2023_02_17_100000_vat_rates_table.php b/src/database/migrations/2023_02_17_100000_vat_rates_table.php
index 2c034ba2..e58de7e2 100644
--- a/src/database/migrations/2023_02_17_100000_vat_rates_table.php
+++ b/src/database/migrations/2023_02_17_100000_vat_rates_table.php
@@ -1,88 +1,89 @@
 <?php
 
 use Illuminate\Support\Facades\Schema;
 use Illuminate\Database\Schema\Blueprint;
 use Illuminate\Database\Migrations\Migration;
 use Illuminate\Support\Facades\DB;
 
 return new class extends Migration
 {
     /**
      * Run the migrations.
      *
      * @return void
      */
     public function up()
     {
         Schema::create('vat_rates', function (Blueprint $table) {
             $table->string('id', 36)->primary();
             $table->string('country', 2);
             $table->timestamp('start')->useCurrent();
             $table->double('rate', 5, 2);
 
             $table->unique(['country', 'start']);
         });
 
         Schema::table(
             'payments',
             function (Blueprint $table) {
                 $table->string('vat_rate_id', 36)->nullable();
                 $table->integer('credit_amount')->nullable(); // temporarily allow null
 
                 $table->foreign('vat_rate_id')->references('id')->on('vat_rates')->onUpdate('cascade');
             }
         );
 
         DB::table('payments')->update(['credit_amount' => DB::raw("`amount`")]);
 
         Schema::table(
             'payments',
             function (Blueprint $table) {
                 $table->integer('credit_amount')->nullable(false)->change(); // remove nullable
             }
         );
 
         // Migrate old tax rates (and existing payments)
         if (($countries = \env('VAT_COUNTRIES')) && ($rate = \env('VAT_RATE'))) {
             $countries = explode(',', strtoupper(trim($countries)));
 
             foreach ($countries as $country) {
                 $vatRate = \App\VatRate::create([
                         'start' => new DateTime('2010-01-01 00:00:00'),
                         'rate' => $rate,
                         'country' => $country,
                 ]);
 
                 DB::table('payments')->whereIn('wallet_id', function ($query) use ($country) {
                     $query->select('id')
                         ->from('wallets')
                         ->whereIn('user_id', function ($query) use ($country) {
                             $query->select('user_id')
                                 ->from('user_settings')
                                 ->where('key', 'country')
                                 ->where('value', $country);
                         });
                 })
                 ->update(['vat_rate_id' => $vatRate->id]);
             }
         }
     }
 
     /**
      * Reverse the migrations.
      *
      * @return void
      */
     public function down()
     {
         Schema::table(
             'payments',
             function (Blueprint $table) {
+                $table->dropForeign(['vat_rate_id']);
                 $table->dropColumn('vat_rate_id');
                 $table->dropColumn('credit_amount');
             }
         );
 
         Schema::dropIfExists('vat_rates');
     }
 };
diff --git a/src/database/migrations/2023_03_01_100000_plans_months.php b/src/database/migrations/2023_03_01_100000_plans_months.php
new file mode 100644
index 00000000..300c7f58
--- /dev/null
+++ b/src/database/migrations/2023_03_01_100000_plans_months.php
@@ -0,0 +1,38 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     *
+     * @return void
+     */
+    public function up()
+    {
+        Schema::table(
+            'plans',
+            function (Blueprint $table) {
+                $table->tinyInteger('months')->unsigned()->default(1);
+            }
+        );
+    }
+
+    /**
+     * Reverse the migrations.
+     *
+     * @return void
+     */
+    public function down()
+    {
+        Schema::table(
+            'plans',
+            function (Blueprint $table) {
+                $table->dropColumn('months');
+            }
+        );
+    }
+};
diff --git a/src/resources/build/before.php b/src/resources/build/before.php
index 21b32849..13b55571 100644
--- a/src/resources/build/before.php
+++ b/src/resources/build/before.php
@@ -1,68 +1,87 @@
 <?php
 
 $rootDir = __DIR__ . '/../..';
 
 // Create build directory for js resources
 echo "Build directory... ";
 
 if (!file_exists("{$rootDir}/resources/build/js")) {
     mkdir("{$rootDir}/resources/build/js");
 }
 
 echo "OK\n";
 
 // Write build timestamp to a file that is then included by the vue components
 echo "Build timestamp... ";
 
 file_put_contents(
     "{$rootDir}/resources/build/js/ts.js",
     sprintf("export default new Date('%s')", date('c'))
 );
 
 echo "OK\n";
 
 // Convert UI localization into vue-i18n-compatible json format
 echo "Client localization... ";
 
 foreach (glob("{$rootDir}/resources/lang/*/ui.php") as $file) {
     $content = include $file;
 
     if (is_array($content)) {
         preg_match('|([a-z]+)/ui\.php$|', $file, $matches);
 
         $file = "{$rootDir}/resources/build/js/{$matches[1]}.json";
         $opts =  JSON_PRETTY_PRINT | JSON_INVALID_UTF8_SUBSTITUTE | JSON_UNESCAPED_UNICODE;
 
         file_put_contents($file, json_encode($content, $opts));
     }
 }
 
+foreach (glob("{$rootDir}/resources/themes/*/lang/*/ui.php") as $file) {
+    $content = include $file;
+
+    if (is_array($content)) {
+        preg_match('|([a-zA-Z]+)/lang/([a-z]+)/ui\.php$|', $file, $matches);
+
+        $theme = $matches[1];
+        $file = "{$rootDir}/resources/build/js/{$theme}-{$matches[2]}.json";
+        $opts = JSON_PRETTY_PRINT | JSON_INVALID_UTF8_SUBSTITUTE | JSON_UNESCAPED_UNICODE;
+
+        file_put_contents($file, json_encode($content, $opts));
+    }
+}
+
 echo "OK\n";
 
 // Move some theme-specific resources from resources/themes/ to public/themes/
 echo "Theme resources... ";
 
 if (!file_exists("{$rootDir}/public/themes")) {
     mkdir("{$rootDir}/public/themes");
 }
 
 foreach (glob("{$rootDir}/resources/themes/*", GLOB_ONLYDIR) as $file) {
     $path = explode('/', $file);
     $theme = $path[count($path)-1];
 
     if (!file_exists("{$rootDir}/public/themes/{$theme}")) {
         mkdir("{$rootDir}/public/themes/{$theme}");
     }
 
-    if (!file_exists("{$rootDir}/public/themes/{$theme}/images")) {
-        mkdir("{$rootDir}/public/themes/{$theme}/images");
-    }
+    // TODO: Public dirs (glob patterns) should be in theme's meta.json
+
+    foreach (['images', 'fonts'] as $subDir) {
+        if (file_exists("{$rootDir}/resources/themes/{$theme}/{$subDir}")) {
+            if (!file_exists("{$rootDir}/public/themes/{$theme}/{$subDir}")) {
+                mkdir("{$rootDir}/public/themes/{$theme}/{$subDir}");
+            }
 
-    foreach (glob("{$file}/images/*") as $file) {
-        $path = explode('/', $file);
-        $image = $path[count($path)-1];
-        copy($file, "{$rootDir}/public/themes/{$theme}/images/{$image}");
+            foreach (glob("{$rootDir}/resources/themes/{$theme}/{$subDir}/*") as $file) {
+                $filename = pathinfo($file, PATHINFO_BASENAME);
+                copy($file, "{$rootDir}/public/themes/{$theme}/{$subDir}/{$filename}");
+            }
+        }
     }
 }
 
 echo "OK\n";
diff --git a/src/resources/js/app.js b/src/resources/js/app.js
index 530e8049..114e1379 100644
--- a/src/resources/js/app.js
+++ b/src/resources/js/app.js
@@ -1,490 +1,505 @@
 /**
  * First we will load all of this project's JavaScript dependencies which
  * includes Vue and other libraries. It is a great starting point when
  * building robust, powerful web applications using Vue and Laravel.
  */
 
 require('./bootstrap')
 
 import AppComponent from '../vue/App'
 import MenuComponent from '../vue/Widgets/Menu'
 import SupportForm from '../vue/Widgets/SupportForm'
 import { loadLangAsync, i18n } from './locale'
 import { clearFormValidation, pick, startLoading, stopLoading } from './utils'
 
 const routerState = {
     afterLogin: null,
-    isLoggedIn: !!localStorage.getItem('token')
+    isLoggedIn: !!localStorage.getItem('token'),
+    isLocked: false
 }
 
 let loadingRoute
 
 // Note: This has to be before the app is created
 // Note: You cannot use app inside of the function
 window.router.beforeEach((to, from, next) => {
     // check if the route requires authentication and user is not logged in
     if (to.meta.requiresAuth && !routerState.isLoggedIn) {
         // remember the original request, to use after login
         routerState.afterLogin = to;
 
         // redirect to login page
         next({ name: 'login' })
+        return
+    }
 
+    if (routerState.isLocked && to.meta.requiresAuth && !['login', 'wallet'].includes(to.name)) {
+        // redirect to the wallet page
+        next({ name: 'wallet' })
         return
     }
 
     if (to.meta.loading) {
         startLoading()
         loadingRoute = to.name
     }
 
     next()
 })
 
 window.router.afterEach((to, from) => {
     if (to.name && loadingRoute === to.name) {
         stopLoading()
         loadingRoute = null
     }
 
     // When changing a page remove old:
     // - error page
     // - modal backdrop
     $('#error-page,.modal-backdrop.show').remove()
     $('body').css('padding', 0) // remove padding added by unclosed modal
 
     // Close the mobile menu
     if ($('#header-menu .navbar-collapse.show').length) {
         $('#header-menu .navbar-toggler').click();
     }
 })
 
 const app = new Vue({
     components: {
         AppComponent,
         MenuComponent,
     },
     i18n,
     router: window.router,
     data() {
         return {
             authInfo: null,
             isUser: !window.isAdmin && !window.isReseller,
             appName: window.config['app.name'],
             appUrl: window.config['app.url'],
             themeDir: '/themes/' + window.config['app.theme']
         }
     },
     methods: {
         clearFormValidation,
         countriesText(list) {
             if (list && list.length) {
                 let result = []
 
                 list.forEach(code => {
                     let country = window.config.countries[code]
                     if (country) {
                         result.push(country[1])
                     } else {
                         console.warn(`Unknown country code: ${code}`)
                     }
                 })
 
                 return result.join(', ')
             }
 
             return this.$t('form.norestrictions')
         },
         hasPermission(type) {
             const key = 'enable' + type.charAt(0).toUpperCase() + type.slice(1)
             return !!(this.authInfo && this.authInfo.statusInfo[key])
         },
         hasRoute(name) {
             return this.$router.resolve({ name: name }).resolved.matched.length > 0
         },
         hasSKU(name) {
             return this.authInfo.statusInfo.skus && this.authInfo.statusInfo.skus.indexOf(name) != -1
         },
         isController(wallet_id) {
             if (wallet_id && this.authInfo) {
                 let i
                 for (i = 0; i < this.authInfo.wallets.length; i++) {
                     if (wallet_id == this.authInfo.wallets[i].id) {
                         return true
                     }
                 }
                 for (i = 0; i < this.authInfo.accounts.length; i++) {
                     if (wallet_id == this.authInfo.accounts[i].id) {
                         return true
                     }
                 }
             }
 
             return false
         },
         isDegraded() {
             return this.authInfo && this.authInfo.isAccountDegraded
         },
         // Set user state to "logged in"
         loginUser(response, dashboard, update) {
             if (!update) {
                 routerState.isLoggedIn = true
                 this.authInfo = null
             }
 
             localStorage.setItem('token', response.access_token)
             localStorage.setItem('refreshToken', response.refresh_token)
 
             if (response.email) {
                 this.authInfo = response
             }
 
+            routerState.isLocked = this.authInfo && this.authInfo.isLocked
+
             if (dashboard !== false) {
-                this.$router.push(routerState.afterLogin || { name: 'dashboard' })
+                this.$router.push(routerState.afterLogin || { name: response.redirect || 'dashboard' })
+            } else if (routerState.isLocked && this.$route.name != 'wallet' && this.$route.meta.requiresAuth) {
+                // Always redirect locked user, here we can be after router's beforeEach handler
+                this.$router.push({ name: 'wallet' })
             }
 
             routerState.afterLogin = null
 
             // Refresh the token before it expires
             let timeout = response.expires_in || 0
 
             // We'll refresh 60 seconds before the token expires
             if (timeout > 60) {
                 timeout -= 60
             }
 
             // TODO: We probably should try a few times in case of an error
             // TODO: We probably should prevent axios from doing any requests
             //       while the token is being refreshed
 
             this.refreshTimeout = setTimeout(() => {
                 axios.post('api/auth/refresh', { refresh_token: localStorage.getItem('refreshToken') }).then(response => {
                     this.loginUser(response.data, false, true)
                 })
             }, timeout * 1000)
         },
         // Set user state to "not logged in"
         logoutUser(redirect) {
             routerState.isLoggedIn = true
             this.authInfo = null
             localStorage.removeItem('token')
             localStorage.removeItem('refreshToken')
 
             if (redirect !== false) {
                 this.$router.push({ name: 'login' })
             }
 
             clearTimeout(this.refreshTimeout)
         },
         logo(mode) {
             let src = this.appUrl + this.themeDir + '/images/logo_' + (mode || 'header') + '.png'
 
             return `<img src="${src}" alt="${this.appName}">`
         },
         pick,
         startLoading,
         stopLoading,
         errorPage(code, msg, hint) {
             // Until https://github.com/vuejs/vue-router/issues/977 is implemented
             // we can't really use router to display error page as it has two side
             // effects: it changes the URL and adds the error page to browser history.
             // For now we'll be replacing current view with error page "manually".
 
             if (!msg) msg = this.$te('error.' + code) ? this.$t('error.' + code) : this.$t('error.unknown')
             if (!hint) hint = ''
 
             const error_page = '<div id="error-page" class="error-page">'
                 + `<div class="code">${code}</div><div class="message">${msg}</div><div class="hint">${hint}</div>`
                 + '</div>'
 
             $('#error-page').remove()
             $('#app').append(error_page)
 
             app.updateBodyClass('error')
         },
         errorHandler(error) {
             stopLoading()
 
             const status = error.response ? error.response.status : 500
             const message = error.response ? error.response.statusText : ''
 
             if (status == 401) {
                 // Remember requested route to come back to it after log in
                 if (this.$route.meta.requiresAuth) {
                     routerState.afterLogin = this.$route
                     this.logoutUser()
                 } else {
                     this.logoutUser(false)
                 }
             } else {
                 if (!error.response) {
                     console.error(error)
                 }
 
                 this.errorPage(status, message)
             }
         },
         price(price, currency) {
             if (!currency) {
                 currency = 'CHF'
             } else {
                 currency = currency.toUpperCase()
             }
 
             let args = { style: 'currency', currency }
 
             if (currency == 'BTC') {
                 args.minimumFractionDigits = 6
                 args.maximumFractionDigits = 9
             }
 
             // TODO: Set locale argument according to the currently used locale
             return ((price || 0) / 100).toLocaleString('de-DE', args)
         },
         priceLabel(cost, discount, currency) {
             let index = ''
 
             if (discount) {
                 cost = Math.floor(cost * ((100 - discount) / 100))
                 index = '\u00B9'
             }
 
             return this.price(cost, currency) + '/' + this.$t('wallet.month') + index
         },
         clickRecord(event) {
             if (!/^(a|button|svg|path)$/i.test(event.target.nodeName)) {
                 $(event.target).closest('tr').find('a').trigger('click')
             }
         },
         pageName(path) {
             let page = this.$route.path
 
             // check if it is a "menu page", find the page name
             // otherwise we'll use the real path as page name
             window.config.menu.every(item => {
                 if (item.location == page && item.page) {
                     page = item.page
                     return false
                 }
             })
 
             page = page.replace(/^\//, '')
 
             return page ? page : '404'
         },
         supportDialog(container) {
             let dialog = $('#support-dialog')[0]
 
             if (!dialog) {
                 // FIXME: Find a nicer way of doing this
                 SupportForm.i18n = i18n
                 let form = new Vue(SupportForm)
                 form.$mount($('<div>').appendTo(container)[0])
                 form.$root = this
                 form.$toast = this.$toast
                 dialog = form.$el
             }
 
             dialog.__vue__.show()
         },
         statusClass(obj) {
             if (obj.isDeleted) {
                 return 'text-muted'
             }
 
             if (obj.isDegraded || obj.isAccountDegraded || obj.isSuspended) {
                 return 'text-warning'
             }
 
             if (!obj.isReady) {
                 return 'text-danger'
             }
 
             return 'text-success'
         },
         statusText(obj) {
             if (obj.isDeleted) {
                 return this.$t('status.deleted')
             }
 
             if (obj.isDegraded || obj.isAccountDegraded) {
                 return this.$t('status.degraded')
             }
 
             if (obj.isSuspended) {
                 return this.$t('status.suspended')
             }
 
             if (!obj.isReady) {
                 return this.$t('status.notready')
             }
 
             return this.$t('status.active')
         },
+        unlock() {
+            routerState.isLocked = this.authInfo.isLocked = false
+            this.$router.push({ name: 'dashboard' })
+        },
         // Append some wallet properties to the object
         userWalletProps(object) {
             let wallet = this.authInfo.accounts[0]
 
             if (!wallet) {
                 wallet = this.authInfo.wallets[0]
             }
 
             if (wallet) {
                 object.currency = wallet.currency
                 if (wallet.discount) {
                     object.discount = wallet.discount
                     object.discount_description = wallet.discount_description
                 }
             }
         },
         updateBodyClass(name) {
             // Add 'class' attribute to the body, different for each page
             // so, we can apply page-specific styles
             document.body.className = 'page-' + (name || this.pageName()).replace(/\/.*$/, '')
         }
     }
 })
 
 // Fetch the locale file and the start the app
 loadLangAsync().then(() => app.$mount('#app'))
 
 // Add a axios request interceptor
 axios.interceptors.request.use(
     config => {
         // This is the only way I found to change configuration options
         // on a running application. We need this for browser testing.
         config.headers['X-Test-Payment-Provider'] = window.config.paymentProvider
 
         // Set the Authorization header. Note that some request might force
         // empty Authorization header therefore we check if the header is already set,
         // not whether it's empty
         const token = localStorage.getItem('token')
         if (token && !('Authorization' in config.headers)) {
             config.headers.Authorization = 'Bearer ' + token
         }
 
         let loader = config.loader
         if (loader) {
             startLoading(loader)
         }
 
         return config
     },
     error => {
         // Do something with request error
         return Promise.reject(error)
     }
 )
 
 // Add a axios response interceptor for general/validation error handler
 axios.interceptors.response.use(
     response => {
         if (response.config.onFinish) {
             response.config.onFinish()
         }
 
         let loader = response.config.loader
         if (loader) {
             stopLoading(loader)
         }
 
         return response
     },
     error => {
         if (error.config && error.config.loader) {
             stopLoading(error.config.loader)
         }
 
         // Do not display the error in a toast message, pass the error as-is
         if (axios.isCancel(error) || (error.config && error.config.ignoreErrors)) {
             return Promise.reject(error)
         }
 
         if (error.config && error.config.onFinish) {
             error.config.onFinish()
         }
 
         let error_msg
 
         const status = error.response ? error.response.status : 200
         const data = error.response ? error.response.data : {}
 
         if (status == 422 && data.errors) {
             error_msg = app.$t('error.form')
 
             const modal = $('div.modal.show')
 
             $(modal.length ? modal : 'form').each((i, form) => {
                 form = $(form)
 
                 $.each(data.errors, (idx, msg) => {
                     const input_name = (form.data('validation-prefix') || form.find('form').first().data('validation-prefix') || '') + idx
                     let input = form.find('#' + input_name)
 
                     if (!input.length) {
                         input = form.find('[name="' + input_name + '"]');
                     }
 
                     if (input.length) {
                         // Create an error message
                         // API responses can use a string, array or object
                         let msg_text = ''
                         if (typeof(msg) !== 'string') {
                             $.each(msg, (index, str) => {
                                 msg_text += str + ' '
                             })
                         }
                         else {
                             msg_text = msg
                         }
 
                         let feedback = $('<div class="invalid-feedback">').text(msg_text)
 
                         if (input.is('.list-input')) {
                             // List input widget
                             let controls = input.children(':not(:first-child)')
 
                             if (!controls.length && typeof msg == 'string') {
                                 // this is an empty list (the main input only)
                                 // and the error message is not an array
                                 input.find('.main-input').addClass('is-invalid')
                             } else {
                                 controls.each((index, element) => {
                                     if (msg[index]) {
                                         $(element).find('input').addClass('is-invalid')
                                     }
                                 })
                             }
 
                             input.addClass('is-invalid').next('.invalid-feedback').remove()
                             input.after(feedback)
                         } else {
                             // a special case, e.g. the invitation policy widget
                             if (input.is('select') && input.parent().is('.input-group-select.selected')) {
                                 input = input.next()
                             }
 
                             // Standard form element
                             input.addClass('is-invalid')
                             input.parent().find('.invalid-feedback').remove()
                             input.parent().append(feedback)
                         }
                     }
                 })
 
                 form.find('.is-invalid:not(.list-input)').first().focus()
             })
         }
         else if (data.status == 'error') {
             error_msg = data.message
         }
         else {
             error_msg = error.request ? error.request.statusText : error.message
         }
 
         app.$toast.error(error_msg || app.$t('error.server'))
 
         // Pass the error as-is
         return Promise.reject(error)
     }
 )
diff --git a/src/resources/js/locale.js b/src/resources/js/locale.js
index fedff4c9..d5131a34 100644
--- a/src/resources/js/locale.js
+++ b/src/resources/js/locale.js
@@ -1,66 +1,85 @@
 import Vue from 'vue'
 import VueI18n from 'vue-i18n'
 
 // We do pre-load English localization as this is possible
 // the only one that is complete and used as a fallback.
 import messages from '../build/js/en.json'
 
 Vue.use(VueI18n)
 
 export const i18n = new VueI18n({
     locale: 'en',
     fallbackLocale: 'en',
     messages: { en: messages },
     silentFallbackWarn: true
 })
 
 let currentLanguage
 
 const loadedLanguages = ['en'] // our default language that is preloaded
+const loadedThemeLanguages = []
 
 const setI18nLanguage = (lang) => {
     i18n.locale = lang
 
     document.querySelector('html').setAttribute('lang', lang)
 
     // Set language for API requests
     // Note, it's kinda redundant as we support the cookie
     window.axios.defaults.headers.common['Accept-Language'] = lang
 
     // Save the selected language in a cookie, so it can be used server-side
     // after page reload. Make the cookie valid for 10 years
     const age = 10 * 60 * 60 * 24 * 365
     document.cookie = 'language=' + lang + '; max-age=' + age + '; path=/; secure'
 
-    return lang
+    // Load additional localization from the theme
+    return loadThemeLang(lang)
+}
+
+const loadThemeLang = (lang) => {
+    if (loadedThemeLanguages.includes(lang)) {
+        return
+    }
+
+    const theme = window.config['app.theme']
+
+    if (theme && theme != 'default') {
+        return import(/* webpackChunkName: "locale/[request]" */ `../build/js/${theme}-${lang}.json`)
+            .then(messages => {
+                i18n.mergeLocaleMessage(lang, messages.default)
+                loadedThemeLanguages.push(lang)
+            })
+            .catch(error => { /* ignore errors */ })
+    }
 }
 
 export const getLang = () => {
     if (!currentLanguage) {
         currentLanguage = document.querySelector('html').getAttribute('lang') || 'en'
     }
 
     return currentLanguage
 }
 
 export const setLang = lang => {
     currentLanguage = lang
     loadLangAsync()
 }
 
 export function loadLangAsync() {
     const lang = getLang()
 
     // If the language was already loaded
     if (loadedLanguages.includes(lang)) {
         return Promise.resolve(setI18nLanguage(lang))
     }
 
     // If the language hasn't been loaded yet
     return import(/* webpackChunkName: "locale/[request]" */ `../build/js/${lang}.json`)
         .then(messages => {
             i18n.setLocaleMessage(lang, messages.default)
             loadedLanguages.push(lang)
-            return setI18nLanguage(lang)
+            return Promise.resolve(setI18nLanguage(lang))
         })
 }
diff --git a/src/resources/lang/en/ui.php b/src/resources/lang/en/ui.php
index 23a10ca4..9b84e79c 100644
--- a/src/resources/lang/en/ui.php
+++ b/src/resources/lang/en/ui.php
@@ -1,560 +1,561 @@
 <?php
 
 /**
  * This file will be converted to a Vue-i18n compatible JSON format on build time
  *
  * Note: The Laravel localization features do not work here. Vue-i18n rules are different
  */
 
 return [
 
     'app' => [
         'faq' => "FAQ",
     ],
 
     'btn' => [
         'add' => "Add",
         'accept' => "Accept",
         'back' => "Back",
         'cancel' => "Cancel",
         'close' => "Close",
         'continue' => "Continue",
         'copy' => "Copy",
         'delete' => "Delete",
         'deny' => "Deny",
         'download' => "Download",
         'edit' => "Edit",
         'file' => "Choose file...",
         'moreinfo' => "More information",
         'refresh' => "Refresh",
         'reset' => "Reset",
         'resend' => "Resend",
         'save' => "Save",
         'search' => "Search",
         'share' => "Share",
         'signup' => "Sign Up",
         'submit' => "Submit",
         'suspend' => "Suspend",
         'unsuspend' => "Unsuspend",
         'verify' => "Verify",
     ],
 
     'companion' => [
         'title' => "Companion Apps",
         'companion' => "Companion App",
         'name' => "Name",
         'create' => "Pair new device",
         'create-recovery-device' => "Prepare recovery code",
         'description' => "Use the Companion App on your mobile phone as multi-factor authentication device.",
         'download-description' => "You may download the Companion App for Android here: "
             . "<a href=\"{href}\">Download</a>",
         'description-detailed' => "Here is how this works: " .
             "Pairing a device will automatically enable multi-factor autentication for all login attempts. " .
             "This includes not only the Cockpit, but also logins via Webmail, IMAP, SMPT, DAV and ActiveSync. " .
             "Any authentication attempt will result in a notification on your device, " .
             "that you can use to confirm if it was you, or deny otherwise. " .
             "Once confirmed, the same username + IP address combination will be whitelisted for 8 hours. " .
             "Unpair all your active devices to disable multi-factor authentication again.",
         'description-warning' => "Warning: Loosing access to all your multi-factor authentication devices, " .
             "will permanently lock you out of your account with no course for recovery. " .
             "Always make sure you have a recovery QR-Code printed to pair a recovery device.",
         'new' => "Pair new device",
         'recovery' => "Prepare recovery device",
         'paired' => "Paired devices",
         'print' => "Print for backup",
         'pairing-instructions' => "Pair your device using the following QR-Code.",
         'recovery-device' => "Recovery Device",
         'deviceid' => "Device ID",
         'list-empty' => "There are currently no devices",
         'delete' => "Delete/Unpair",
         'delete-companion' => "Delete/Unpair",
         'delete-text' => "You are about to delete this entry and unpair any paired companion app. " .
             "This cannot be undone, but you can pair the device again.",
         'pairing-successful' => "Your companion app is paired and ready to be used " .
             "as a multi-factor authentication device.",
     ],
 
     'dashboard' => [
         'beta' => "beta",
         'distlists' => "Distribution lists",
         'chat' => "Video chat",
         'companion' => "Companion app",
         'domains' => "Domains",
         'files' => "Files",
         'invitations' => "Invitations",
         'profile' => "Your profile",
         'resources' => "Resources",
         'settings' => "Settings",
         'shared-folders' => "Shared folders",
         'users' => "User accounts",
         'wallet' => "Wallet",
         'webmail' => "Webmail",
         'stats' => "Stats",
     ],
 
     'distlist' => [
         'list-title' => "Distribution list | Distribution lists",
         'create' => "Create list",
         'delete' => "Delete list",
         'email' => "Email",
         'list-empty' => "There are no distribution lists in this account.",
         'name' => "Name",
         'new' => "New distribution list",
         'recipients' => "Recipients",
         'sender-policy' => "Sender Access List",
         'sender-policy-text' => "With this list you can specify who can send mail to the distribution list."
             . " You can put a complete email address (jane@kolab.org), domain (kolab.org) or suffix (.org) that the sender email address is compared to."
             . " If the list is empty, mail from anyone is allowed.",
     ],
 
     'domain' => [
         'delete' => "Delete domain",
         'delete-domain' => "Delete {domain}",
         'delete-text' => "Do you really want to delete this domain permanently?"
             . " This is only possible if there are no users, aliases or other objects in this domain."
             . " Please note that this action cannot be undone.",
         'dns-verify' => "Domain DNS verification sample:",
         'dns-config' => "Domain DNS configuration sample:",
         'list-empty' => "There are no domains in this account.",
         'namespace' => "Namespace",
         'spf-whitelist' => "SPF Whitelist",
         'spf-whitelist-text' => "The Sender Policy Framework allows a sender domain to disclose, through DNS, "
             . "which systems are allowed to send emails with an envelope sender address within said domain.",
         'spf-whitelist-ex' => "Here you can specify a list of allowed servers, for example: <var>.ess.barracuda.com</var>.",
         'verify' => "Domain verification",
         'verify-intro' => "In order to confirm that you're the actual holder of the domain, we need to run a verification process before finally activating it for email delivery.",
         'verify-dns' => "The domain <b>must have one of the following entries</b> in DNS:",
         'verify-dns-txt' => "TXT entry with value:",
         'verify-dns-cname' => "or CNAME entry:",
         'verify-outro' => "When this is done press the button below to start the verification.",
         'verify-sample' => "Here's a sample zone file for your domain:",
         'config' => "Domain configuration",
         'config-intro' => "In order to let {app} receive email traffic for your domain you need to adjust the DNS settings, more precisely the MX entries, accordingly.",
         'config-sample' => "Edit your domain's zone file and replace existing MX entries with the following values:",
         'config-hint' => "If you don't know how to set DNS entries for your domain, please contact the registration service where you registered the domain or your web hosting provider.",
         'create' => "Create domain",
         'new' => "New domain",
     ],
 
     'error' => [
         '400' => "Bad request",
         '401' => "Unauthorized",
         '403' => "Access denied",
         '404' => "Not found",
         '405' => "Method not allowed",
         '500' => "Internal server error",
         'unknown' => "Unknown Error",
         'server' => "Server Error",
         'form' => "Form validation error",
     ],
 
     'file' => [
         'create' => "Create file",
         'delete' => "Delete file",
         'list-empty' => "There are no files in this account.",
         'mimetype' => "Mimetype",
         'mtime' => "Modified",
         'new' => "New file",
         'search' => "File name",
         'sharing' => "Sharing",
         'sharing-links-text' => "You can share the file with other users by giving them read-only access "
             . "to the file via a unique link.",
     ],
 
     'form' => [
         'acl' => "Access rights",
         'acl-full' => "All",
         'acl-read-only' => "Read-only",
         'acl-read-write' => "Read-write",
         'amount' => "Amount",
         'anyone' => "Anyone",
         'code' => "Confirmation Code",
         'config' => "Configuration",
         'companion' => "Companion App",
         'date' => "Date",
         'description' => "Description",
         'details' => "Details",
         'disabled' => "disabled",
         'domain' => "Domain",
         'email' => "Email Address",
         'emails' => "Email Addresses",
         'enabled' => "enabled",
         'firstname' => "First Name",
         'general' => "General",
         'geolocation' => "Your current location: {location}",
         'lastname' => "Last Name",
         'name' => "Name",
         'months' => "months",
         'none' => "none",
         'norestrictions' => "No restrictions",
         'or' => "or",
         'password' => "Password",
         'password-confirm' => "Confirm Password",
         'phone' => "Phone",
         'selectcountries' => "Select countries",
         'settings' => "Settings",
         'shared-folder' => "Shared Folder",
         'size' => "Size",
         'status' => "Status",
         'subscriptions' => "Subscriptions",
         'surname' => "Surname",
         'type' => "Type",
         'unknown' => "unknown",
         'user' => "User",
         'primary-email' => "Primary Email",
         'id' => "ID",
         'created' => "Created",
         'deleted' => "Deleted",
     ],
 
     'invitation' => [
         'create' => "Create invite(s)",
         'create-title' => "Invite for a signup",
         'create-email' => "Enter an email address of the person you want to invite.",
         'create-csv' => "To send multiple invitations at once, provide a CSV (comma separated) file, or alternatively a plain-text file, containing one email address per line.",
         'list-empty' => "There are no invitations in the database.",
         'title' => "Signup invitations",
         'search' => "Email address or domain",
         'send' => "Send invite(s)",
         'status-completed' => "User signed up",
         'status-failed' => "Sending failed",
         'status-sent' => "Sent",
         'status-new' => "Not sent yet",
     ],
 
     'lang' => [
         'en' => "English",
         'de' => "German",
         'fr' => "French",
         'it' => "Italian",
     ],
 
     'login' => [
         '2fa' => "Second factor code",
         '2fa_desc' => "Second factor code is optional for users with no 2-Factor Authentication setup.",
         'forgot_password' => "Forgot password?",
         'header' => "Please sign in",
         'sign_in' => "Sign in",
         'signing_in' => "Signing in...",
         'webmail' => "Webmail"
     ],
 
     'meet' => [
         // Room options dialog
         'options' => "Room options",
         'password' => "Password",
         'password-none' => "none",
         'password-clear' => "Clear password",
         'password-set' => "Set password",
         'password-text' => "You can add a password to your meeting. Participants will have to provide the password before they are allowed to join the meeting.",
         'lock' => "Locked room",
         'lock-text' => "When the room is locked participants have to be approved by a moderator before they could join the meeting.",
         'nomedia' => "Subscribers only",
         'nomedia-text' => "Forces all participants to join as subscribers (with camera and microphone turned off)."
             . " Moderators will be able to promote them to publishers throughout the session.",
 
         // Room menu
         'partcnt' => "Number of participants",
         'menu-audio-mute' => "Mute audio",
         'menu-audio-unmute' => "Unmute audio",
         'menu-video-mute' => "Mute video",
         'menu-video-unmute' => "Unmute video",
         'menu-screen' => "Share screen",
         'menu-hand-lower' => "Lower hand",
         'menu-hand-raise' => "Raise hand",
         'menu-channel' => "Interpreted language channel",
         'menu-chat' => "Chat",
         'menu-fullscreen' => "Full screen",
         'menu-fullscreen-exit' => "Exit full screen",
         'menu-leave' => "Leave session",
 
         // Room setup screen
         'setup-title' => "Set up your session",
         'mic' => "Microphone",
         'cam' => "Camera",
         'nick' => "Nickname",
         'nick-placeholder' => "Your name",
         'join' => "JOIN",
         'joinnow' => "JOIN NOW",
         'imaowner' => "I'm the owner",
 
         // Room
         'qa' => "Q & A",
         'leave-title' => "Room closed",
         'leave-body' => "The session has been closed by the room owner.",
         'media-title' => "Media setup",
         'join-request' => "Join request",
         'join-requested' => "{user} requested to join.",
 
         // Status messages
         'status-init' => "Checking the room...",
         'status-323' => "The room is closed. Please, wait for the owner to start the session.",
         'status-324' => "The room is closed. It will be open for others after you join.",
         'status-325' => "The room is ready. Please, provide a valid password.",
         'status-326' => "The room is locked. Please, enter your name and try again.",
         'status-327' => "Waiting for permission to join the room.",
         'status-404' => "The room does not exist.",
         'status-429' => "Too many requests. Please, wait.",
         'status-500' => "Failed to connect to the room. Server error.",
 
         // Other menus
         'media-setup' => "Media setup",
         'perm' => "Permissions",
         'perm-av' => "Audio &amp; Video publishing",
         'perm-mod' => "Moderation",
         'lang-int' => "Language interpreter",
         'menu-options' => "Options",
     ],
 
     'menu' => [
         'cockpit' => "Cockpit",
         'login' => "Login",
         'logout' => "Logout",
         'signup' => "Signup",
         'toggle' => "Toggle navigation",
     ],
 
     'msg' => [
         'initializing' => "Initializing...",
         'loading' => "Loading...",
         'loading-failed' => "Failed to load data.",
         'notfound' => "Resource not found.",
         'info' => "Information",
         'error' => "Error",
         'uploading' => "Uploading...",
         'warning' => "Warning",
         'success' => "Success",
     ],
 
     'nav' => [
         'more' => "Load more",
         'step' => "Step {i}/{n}",
     ],
 
     'password' => [
         'link-invalid' => "The password reset code is expired or invalid.",
         'reset' => "Password Reset",
         'reset-step1' => "Enter your email address to reset your password.",
         'reset-step1-hint' => "You may need to check your spam folder or unblock {email}.",
         'reset-step2' => "We sent out a confirmation code to your external email address."
             . " Enter the code we sent you, or click the link in the message.",
     ],
 
     'resource' => [
         'create' => "Create resource",
         'delete' => "Delete resource",
         'invitation-policy' => "Invitation policy",
         'invitation-policy-text' => "Event invitations for a resource are normally accepted automatically"
             . " if there is no conflicting event on the requested time slot. Invitation policy allows"
             . " for rejecting such requests or to require a manual acceptance from a specified user.",
         'ipolicy-manual' => "Manual (tentative)",
         'ipolicy-accept' => "Accept",
         'ipolicy-reject' => "Reject",
         'list-title' => "Resource | Resources",
         'list-empty' => "There are no resources in this account.",
         'new' => "New resource",
     ],
 
     'room' => [
         'create' => "Create room",
         'delete' => "Delete room",
         'copy-location' => "Copy room location",
         'description-hint' => "This is an optional short description for the room, so you can find it more easily on the list.",
         'goto' => "Enter the room",
         'list-empty' => "There are no conference rooms in this account.",
         'list-empty-nocontroller' => "Do you need a room? Ask your account owner to create one and share it with you.",
         'list-title' => "Voice & video conferencing rooms",
         'moderators' => "Moderators",
         'moderators-text' => "You can share your room with other users. They will become the room moderators with all moderator powers and ability to open the room without your presence.",
         'new' => "New room",
         'new-hint' => "We'll generate a unique name for the room that will then allow you to access the room.",
         'title' => "Room: {name}",
         'url' => "You can access the room at the URL below. Use this URL to invite people to join you. This room is only open when you (or another room moderator) is in attendance.",
     ],
 
     'settings' => [
         'password-policy' => "Password Policy",
         'password-retention' => "Password Retention",
         'password-max-age' => "Require a password change every",
     ],
 
     'shf' => [
         'aliases-none' => "This shared folder has no email aliases.",
         'create' => "Create folder",
         'delete' => "Delete folder",
         'acl-text' => "Defines user permissions to access the shared folder.",
         'list-title' => "Shared folder | Shared folders",
         'list-empty' => "There are no shared folders in this account.",
         'new' => "New shared folder",
         'type-mail' => "Mail",
         'type-event' => "Calendar",
         'type-contact' => "Address Book",
         'type-task' => "Tasks",
         'type-note' => "Notes",
         'type-file' => "Files",
     ],
 
     'signup' => [
         'email' => "Existing Email Address",
         'login' => "Login",
         'title' => "Sign Up",
         'step1' => "Sign up to start your free month.",
         'step2' => "We sent out a confirmation code to your email address. Enter the code we sent you, or click the link in the message.",
         'step3' => "Create your {app} identity (you can choose additional addresses later).",
         'token' => "Signup authorization token",
         'voucher' => "Voucher Code",
     ],
 
     'status' => [
         'prepare-account' => "We are preparing your account.",
         'prepare-domain' => "We are preparing the domain.",
         'prepare-distlist' => "We are preparing the distribution list.",
         'prepare-resource' => "We are preparing the resource.",
         'prepare-shared-folder' => "We are preparing the shared folder.",
         'prepare-user' => "We are preparing the user account.",
         'prepare-hint' => "Some features may be missing or readonly at the moment.",
         'prepare-refresh' => "The process never ends? Press the \"Refresh\" button, please.",
         'ready-account' => "Your account is almost ready.",
         'ready-domain' => "The domain is almost ready.",
         'ready-distlist' => "The distribution list is almost ready.",
         'ready-resource' => "The resource is almost ready.",
         'ready-shared-folder' => "The shared-folder is almost ready.",
         'ready-user' => "The user account is almost ready.",
         'verify' => "Verify your domain to finish the setup process.",
         'verify-domain' => "Verify domain",
         'degraded' => "Degraded",
         'deleted' => "Deleted",
         'restricted' => "Restricted",
         'suspended' => "Suspended",
         'notready' => "Not Ready",
         'active' => "Active",
     ],
 
     'support' => [
         'title' => "Contact Support",
         'id' => "Customer number or email address you have with us",
         'id-pl' => "e.g. 12345678 or the affected email address",
         'id-hint' => "Leave blank if you are not a customer yet",
         'name' => "Name",
         'name-pl' => "how we should call you in our reply",
         'email' => "Working email address",
         'email-pl' => "make sure we can reach you at this address",
         'summary' => "Issue Summary",
         'summary-pl' => "one sentence that summarizes your issue",
         'expl' => "Issue Explanation",
     ],
 
     'user' => [
         '2fa-hint1' => "This will remove 2-Factor Authentication entitlement as well as the user-configured factors.",
         '2fa-hint2' => "Please, make sure to confirm the user identity properly.",
         'add-beta' => "Enable beta program",
         'address' => "Address",
         'aliases' => "Aliases",
         'aliases-none' => "This user has no email aliases.",
         'add-bonus' => "Add bonus",
         'add-bonus-title' => "Add a bonus to the wallet",
         'add-penalty' => "Add penalty",
         'add-penalty-title' => "Add a penalty to the wallet",
         'auto-payment' => "Auto-payment",
         'auto-payment-text' => "Fill up by <b>{amount}</b> when under <b>{balance}</b> using {method}",
         'country' => "Country",
         'create' => "Create user",
         'custno' => "Customer No.",
         'degraded-warning' => "The account is degraded. Some features have been disabled.",
         'degraded-hint' => "Please, make a payment.",
         'delete' => "Delete user",
         'delete-account' => "Delete this account?",
         'delete-email' => "Delete {email}",
         'delete-text' => "Do you really want to delete this user permanently?"
             . " This will delete all account data and withdraw the permission to access the email account."
             . " Please note that this action cannot be undone.",
         'discount' => "Discount",
         'discount-hint' => "applied discount",
         'discount-title' => "Account discount",
         'distlists' => "Distribution lists",
         'domains' => "Domains",
         'ext-email' => "External Email",
         'email-aliases' => "Email Aliases",
         'finances' => "Finances",
         'geolimit' => "Geo-lockin",
         'geolimit-text' => "Defines a list of locations that are allowed for logon. You will not be able to login from a country that is not listed here.",
         'greylisting' => "Greylisting",
         'greylisting-text' => "Greylisting is a method of defending users against spam. Any incoming mail from an unrecognized sender "
             . "is temporarily rejected. The originating server should try again after a delay. "
             . "This time the email will be accepted. Spammers usually do not reattempt mail delivery.",
         'imapproxy' => "IMAP proxy",
         'imapproxy-text' => "Enables IMAP proxy that filters out non-mail groupware folders, so your IMAP clients do not see them.",
         'list-title' => "User accounts",
         'list-empty' => "There are no users in this account.",
         'managed-by' => "Managed by",
         'new' => "New user account",
         'org' => "Organization",
         'package' => "Package",
         'pass-input' => "Enter password",
         'pass-link' => "Set via link",
         'pass-link-label' => "Link:",
         'pass-link-hint' => "Press Submit to activate the link",
         'passwordpolicy' => "Password Policy",
         'price' => "Price",
         'profile-title' => "Your profile",
         'profile-delete' => "Delete account",
         'profile-delete-title' => "Delete this account?",
         'profile-delete-text1' => "This will delete the account as well as all domains, users and aliases associated with this account.",
         'profile-delete-warning' => "This operation is irreversible",
         'profile-delete-text2' => "As you will not be able to recover anything after this point, please make sure that you have migrated all data before proceeding.",
         'profile-delete-support' => "As we always strive to improve, we would like to ask for 2 minutes of your time. "
             . "The best tool for improvement is feedback from users, and we would like to ask "
             . "for a few words about your reasons for leaving our service. Please send your feedback to <a href=\"{href}\">{email}</a>.",
         'profile-delete-contact' => "Also feel free to contact {app} Support with any questions or concerns that you may have in this context.",
         'reset-2fa' => "Reset 2-Factor Auth",
         'reset-2fa-title' => "2-Factor Authentication Reset",
         'resources' => "Resources",
         'title' => "User account",
         'search' => "User email address or name",
         'search-pl' => "User ID, email or domain",
         'skureq' => "{sku} requires {list}.",
         'subscription' => "Subscription",
         'subscriptions-none' => "This user has no subscriptions.",
         'users' => "Users",
     ],
 
     'wallet' => [
         'add-credit' => "Add credit",
         'auto-payment-cancel' => "Cancel auto-payment",
         'auto-payment-change' => "Change auto-payment",
         'auto-payment-failed' => "The setup of automatic payments failed. Restart the process to enable automatic top-ups.",
         'auto-payment-hint' => "Here is how it works: Every time your account runs low, we will charge your preferred payment method for an amount you choose."
             . " You can cancel or change the auto-payment option at any time.",
         'auto-payment-setup' => "Set up auto-payment",
         'auto-payment-disabled' => "The configured auto-payment has been disabled. Top up your wallet or raise the auto-payment amount.",
         'auto-payment-info' => "Auto-payment is <b>set</b> to fill up your account by <b>{amount}</b> every time your account balance gets under <b>{balance}</b>.",
         'auto-payment-inprogress' => "The setup of the automatic payment is still in progress.",
         'auto-payment-next' => "Next, you will be redirected to the checkout page, where you can provide your credit card details.",
         'auto-payment-disabled-next' => "The auto-payment is disabled. Immediately after you submit new settings we'll enable it and attempt to top up your wallet.",
         'auto-payment-update' => "Update auto-payment",
         'banktransfer-hint' => "Please note that a bank transfer can take several days to complete.",
         'coinbase-hint' => "Here is how it works: You specify the amount by which you want to top up your wallet in {wc}."
             . " We will then create a charge on Coinbase for the specified amount that you can pay using Bitcoin.",
         'currency-conv' => "Here is how it works: You specify the amount by which you want to top up your wallet in {wc}."
             . " We will then convert this to {pc}, and on the next page you will be provided with the bank-details to transfer the amount in {pc}.",
         'fill-up' => "Fill up by",
         'history' => "History",
+        'locked-text' => "The account is locked until you set up auto-payment successfully.",
         'month' => "month",
         'noperm' => "Only account owners can access a wallet.",
         'norefund' => "The money in your wallet is non-refundable.",
         'payment-amount-hint' => "Choose the amount by which you want to top up your wallet.",
         'payment-method' => "Method of payment: {method}",
         'payment-warning' => "You will be charged for {price}.",
         'pending-payments' => "Pending Payments",
         'pending-payments-warning' => "You have payments that are still in progress. See the \"Pending Payments\" tab below.",
         'pending-payments-none' => "There are no pending payments for this account.",
         'receipts' => "Receipts",
         'receipts-hint' => "Here you can download receipts (in PDF format) for payments in specified period. Select the period and press the Download button.",
         'receipts-none' => "There are no receipts for payments in this account. Please, note that you can download receipts after the month ends.",
         'title' => "Account balance",
         'top-up' => "Top up your wallet",
         'transactions' => "Transactions",
         'transactions-none' => "There are no transactions for this account.",
         'when-below' => "when account balance is below",
     ],
 ];
diff --git a/src/resources/vue/Signup.vue b/src/resources/vue/Signup.vue
index dfbf2da8..818ce41e 100644
--- a/src/resources/vue/Signup.vue
+++ b/src/resources/vue/Signup.vue
@@ -1,338 +1,373 @@
 <template>
     <div class="container">
         <div id="step0" v-if="!invitation">
             <div class="plan-selector row row-cols-sm-2 g-3">
-                <div v-for="item in plans" :key="item.id">
+                <div v-for="item in plans" :key="item.id" :id="'plan-' + item.title">
                     <div :class="'card bg-light plan-' + item.title">
                         <div class="card-header plan-header">
                             <div class="plan-ico text-center">
-                                <svg-icon :icon="plan_icons[item.title]"></svg-icon>
+                                <svg-icon :icon="plan_icons[item.title] || 'user'"></svg-icon>
                             </div>
                         </div>
                         <div class="card-body text-center">
                             <btn class="btn-primary" :data-title="item.title" @click="selectPlan(item.title)" v-html="item.button"></btn>
                             <div class="plan-description text-start mt-3" v-html="item.description"></div>
                         </div>
                     </div>
                 </div>
             </div>
         </div>
 
         <div class="card d-none" id="step1" v-if="!invitation">
             <div class="card-body">
                 <h4 class="card-title">{{ $t('signup.title') }} - {{ $t('nav.step', { i: 1, n: steps }) }}</h4>
                 <p class="card-text">
                     {{ $t('signup.step1') }}
                 </p>
                 <form @submit.prevent="submitStep1" data-validation-prefix="signup_">
                     <div class="mb-3">
                         <div class="input-group">
                             <input type="text" class="form-control" id="signup_first_name" :placeholder="$t('form.firstname')" autofocus v-model="first_name">
                             <input type="text" class="form-control rounded-end" id="signup_last_name" :placeholder="$t('form.surname')" v-model="last_name">
                         </div>
                     </div>
                     <div v-if="mode == 'token'" class="mb-3">
                         <label for="signup_token" class="visually-hidden">{{ $t('signup.token') }}</label>
                         <input type="text" class="form-control" id="signup_token" :placeholder="$t('signup.token')" required v-model="token">
                     </div>
                     <div v-else class="mb-3">
                         <label for="signup_email" class="visually-hidden">{{ $t('signup.email') }}</label>
                         <input type="text" class="form-control" id="signup_email" :placeholder="$t('signup.email')" required v-model="email">
                     </div>
                     <btn class="btn-secondary" @click="stepBack">{{ $t('btn.back') }}</btn>
                     <btn class="btn-primary ms-2" type="submit" icon="check">{{ $t('btn.continue') }}</btn>
                 </form>
             </div>
         </div>
 
         <div class="card d-none" id="step2" v-if="!invitation">
             <div class="card-body">
                 <h4 class="card-title">{{ $t('signup.title') }} - {{ $t('nav.step', { i: 2, n: steps }) }}</h4>
                 <p class="card-text">
                     {{ $t('signup.step2') }}
                 </p>
                 <form @submit.prevent="submitStep2" data-validation-prefix="signup_">
                     <div class="mb-3">
                         <label for="signup_short_code" class="visually-hidden">{{ $t('form.code') }}</label>
                         <input type="text" class="form-control" id="signup_short_code" :placeholder="$t('form.code')" required v-model="short_code">
                     </div>
                     <btn class="btn-secondary" @click="stepBack">{{ $t('btn.back') }}</btn>
                     <btn class="btn-primary ms-2" type="submit" icon="check">{{ $t('btn.continue') }}</btn>
                     <input type="hidden" id="signup_code" v-model="code" />
                 </form>
             </div>
         </div>
 
         <div class="card d-none" id="step3">
             <div class="card-body">
-                <h4 v-if="!invitation" class="card-title">{{ $t('signup.title') }} - {{ $t('nav.step', { i: steps, n: steps }) }}</h4>
+                <h4 v-if="!invitation && steps > 1" class="card-title">{{ $t('signup.title') }} - {{ $t('nav.step', { i: steps, n: steps }) }}</h4>
                 <p class="card-text">
                     {{ $t('signup.step3', { app: $root.appName }) }}
                 </p>
                 <form @submit.prevent="submitStep3" data-validation-prefix="signup_">
                     <div class="mb-3" v-if="invitation">
                         <div class="input-group">
                             <input type="text" class="form-control" id="signup_first_name" :placeholder="$t('form.firstname')" autofocus v-model="first_name">
                             <input type="text" class="form-control rounded-end" id="signup_last_name" :placeholder="$t('form.surname')" v-model="last_name">
                         </div>
                     </div>
                     <div class="mb-3">
                         <label for="signup_login" class="visually-hidden"></label>
                         <div class="input-group">
                             <input type="text" class="form-control" id="signup_login" required v-model="login" :placeholder="$t('signup.login')">
                             <span class="input-group-text">@</span>
                             <input v-if="is_domain" type="text" class="form-control rounded-end" id="signup_domain" required v-model="domain" :placeholder="$t('form.domain')">
                             <select v-else class="form-select rounded-end" id="signup_domain" required v-model="domain">
                                 <option v-for="_domain in domains" :key="_domain" :value="_domain">{{ _domain }}</option>
                             </select>
                         </div>
                     </div>
                     <password-input class="mb-3" v-model="pass"></password-input>
                     <div class="mb-3">
                         <label for="signup_voucher" class="visually-hidden">{{ $t('signup.voucher') }}</label>
                         <input type="text" class="form-control" id="signup_voucher" :placeholder="$t('signup.voucher')" v-model="voucher">
                     </div>
                     <btn v-if="!invitation" class="btn-secondary me-2" @click="stepBack">{{ $t('btn.back') }}</btn>
                     <btn class="btn-primary" type="submit" icon="check">
                         <span v-if="invitation">{{ $t('btn.signup') }}</span>
                         <span v-else>{{ $t('btn.submit') }}</span>
                     </btn>
                 </form>
             </div>
         </div>
     </div>
 </template>
 
 <script>
     import PasswordInput from './Widgets/PasswordInput'
 
     import { library } from '@fortawesome/fontawesome-svg-core'
 
     library.add(
         require('@fortawesome/free-solid-svg-icons/faMobileRetro').definition,
         require('@fortawesome/free-solid-svg-icons/faUsers').definition
     )
 
     export default {
         components: {
             PasswordInput
         },
         data() {
             return {
                 email: '',
                 first_name: '',
                 last_name: '',
                 code: '',
                 short_code: '',
                 login: '',
                 pass: {},
                 domain: '',
                 domains: [],
                 invitation: null,
                 is_domain: false,
                 mode: 'email',
                 plan: null,
                 plan_icons: {
                     individual: 'user',
                     group: 'users',
                     phone: 'mobile-retro'
                 },
                 plans: [],
                 token: '',
                 voucher: ''
             }
         },
         computed: {
             steps() {
-                return this.mode == 'token' ? 2 : 3
+                switch (this.mode) {
+                    case 'token':
+                        return 2
+                    case 'mandate':
+                        return 1
+                    case 'email':
+                    default:
+                        return 3
+                }
             }
         },
         mounted() {
             let param = this.$route.params.param;
 
             if (this.$route.name == 'signup-invite') {
                 axios.get('/api/auth/signup/invitations/' + param, { loader: true })
                     .then(response => {
                         this.invitation = response.data
                         this.login = response.data.login
                         this.voucher = response.data.voucher
                         this.first_name = response.data.first_name
                         this.last_name = response.data.last_name
                         this.plan = response.data.plan
                         this.is_domain = response.data.is_domain
                         this.setDomain(response.data)
                         this.displayForm(3, true)
                     })
                     .catch(error => {
                         this.$root.errorHandler(error)
                     })
             } else if (param) {
                 if (this.$route.path.indexOf('/signup/voucher/') === 0) {
                     // Voucher (discount) code
                     this.voucher = param
                     this.displayForm(0)
                 } else if (/^([A-Z0-9]+)-([a-zA-Z0-9]+)$/.test(param)) {
                     // Verification code provided, auto-submit Step 2
                     this.short_code = RegExp.$1
                     this.code = RegExp.$2
                     this.submitStep2(true)
                 } else if (/^([a-zA-Z_]+)$/.test(param)) {
                     // Plan title provided, save it and display Step 1
                     this.step0(param)
                 } else {
                     this.$root.errorPage(404)
                 }
             } else {
                 this.displayForm(0)
             }
         },
         methods: {
             selectPlan(plan) {
                 this.$router.push({path: '/signup/' + plan})
                 this.selectPlanByTitle(plan)
             },
             // Composes plan selection page
             selectPlanByTitle(title) {
                 const plan = this.plans.filter(plan => plan.title == title)[0]
                 if (plan) {
                     this.plan = title
                     this.mode = plan.mode
-                    this.displayForm(1, true)
+                    this.is_domain = plan.isDomain
+                    this.domain = ''
+
+                    let step = 1
+
+                    if (plan.mode == 'mandate') {
+                        step = 3
+                        if (!plan.isDomain || !this.domains.length) {
+                            axios.get('/api/auth/signup/domains')
+                                .then(response => {
+                                    this.displayForm(step, true)
+                                    this.setDomain(response.data)
+                                })
+                            return
+                        }
+                    }
+
+                    this.displayForm(step, true)
                 }
             },
             step0(plan) {
                 if (!this.plans.length) {
                     axios.get('/api/auth/signup/plans', { loader: true }).then(response => {
                         this.plans = response.data.plans
                         this.selectPlanByTitle(plan)
                     })
                     .catch(error => {
                         this.$root.errorHandler(error)
                     })
                 } else {
                     this.selectPlanByTitle(plan)
                 }
             },
             // Submits data to the API, validates and gets verification code
             submitStep1() {
                 this.$root.clearFormValidation($('#step1 form'))
 
                 const post = this.$root.pick(this, ['email', 'last_name', 'first_name', 'plan', 'token', 'voucher'])
 
                 axios.post('/api/auth/signup/init', post)
                     .then(response => {
                         this.code = response.data.code
                         this.short_code = response.data.short_code
                         this.mode = response.data.mode
                         this.is_domain = response.data.is_domain
                         this.displayForm(this.mode == 'token' ? 3 : 2, true)
 
                         // Fill the domain selector with available domains
                         if (!this.is_domain) {
                             this.setDomain(response.data)
                         }
                     })
             },
             // Submits the code to the API for verification
             submitStep2(bylink) {
                 if (bylink === true) {
                     this.displayForm(2, false)
                 }
 
                 this.$root.clearFormValidation($('#step2 form'))
 
                 const post = this.$root.pick(this, ['code', 'short_code'])
 
                 axios.post('/api/auth/signup/verify', post)
                     .then(response => {
                         this.displayForm(3, true)
                         // Reset user name/email/plan, we don't have them if user used a verification link
                         this.first_name = response.data.first_name
                         this.last_name = response.data.last_name
                         this.email = response.data.email
                         this.is_domain = response.data.is_domain
                         this.voucher = response.data.voucher
                         this.domain = ''
 
                         // Fill the domain selector with available domains
                         if (!this.is_domain) {
                             this.setDomain(response.data)
                         }
                     })
                     .catch(error => {
                         if (bylink === true) {
                             // FIXME: display step 1, user can do nothing about it anyway
                             //        Maybe we should display 404 error page?
                             this.displayForm(1, true)
                         }
                     })
             },
             // Submits the data to the API to create the user account
             submitStep3() {
                 this.$root.clearFormValidation($('#step3 form'))
 
                 let post = {
-                    ...this.$root.pick(this, ['login', 'domain', 'voucher']),
+                    ...this.$root.pick(this, ['login', 'domain', 'voucher', 'plan']),
                     ...this.pass
                 }
 
                 if (this.invitation) {
                     post.invitation = this.invitation.id
-                    post.plan = this.plan
                     post.first_name = this.first_name
                     post.last_name = this.last_name
                 } else {
                     post.code = this.code
                     post.short_code = this.short_code
                 }
 
                 axios.post('/api/auth/signup', post).then(response => {
                     // auto-login and goto dashboard
                     this.$root.loginUser(response.data)
                 })
             },
             // Moves the user a step back in registration form
             stepBack(e) {
                 const card = $(e.target).closest('.card')
                 let step = card.attr('id').replace('step', '')
 
                 card.addClass('d-none').find('form')[0].reset()
 
                 step -= 1
 
                 if (step == 2 && this.mode == 'token') {
                     step = 1
                 }
 
+                if (this.mode == 'mandate') {
+                    step = 0
+                }
+
                 $('#step' + step).removeClass('d-none').find('input').first().focus()
 
                 if (!step) {
                     this.step0()
                     this.$router.replace({path: '/signup'})
                 }
             },
             displayForm(step, focus) {
                 [0, 1, 2, 3].filter(value => value != step).forEach(value => {
                     $('#step' + value).addClass('d-none')
                 })
 
                 if (!step) {
                     return this.step0()
                 }
 
                 $('#step' + step).removeClass('d-none').find('form')[0].reset()
 
                 if (focus) {
                     $('#step' + step).find('input').first().focus()
                 }
             },
             setDomain(response) {
                 if (response.domains) {
                     this.domains = response.domains
                 }
 
-                this.domain = response.domain || window.config['app.domain']
+                this.domain = response.domain
+
+                if (!this.domain) {
+                    this.domain = window.config['app.domain']
+                    if (this.domains.length && !this.domains.includes(this.domain)) {
+                        this.domain = this.domains[0]
+                    }
+                }
             }
         }
     }
 </script>
diff --git a/src/resources/vue/Wallet.vue b/src/resources/vue/Wallet.vue
index bf028746..c6a5691e 100644
--- a/src/resources/vue/Wallet.vue
+++ b/src/resources/vue/Wallet.vue
@@ -1,424 +1,449 @@
 <template>
     <div class="container" dusk="wallet-component">
+        <p v-if="$root.authInfo.isLocked" id="lock-alert" class="alert alert-warning">
+            {{ $t('wallet.locked-text') }}
+        </p>
         <div v-if="wallet.id" id="wallet" class="card">
             <div class="card-body">
                 <div class="card-title">{{ $t('wallet.title') }} <span :class="wallet.balance < 0 ? 'text-danger' : 'text-success'">{{ $root.price(wallet.balance, wallet.currency) }}</span></div>
                 <div class="card-text">
                     <p v-if="wallet.notice" id="wallet-notice">{{ wallet.notice }}</p>
 
                     <div v-if="showPendingPayments" class="alert alert-warning">
                         {{ $t('wallet.pending-payments-warning') }}
                     </div>
-                    <p>
+                    <p v-if="$root.hasPermission('walletPayments')">
                         <btn class="btn-primary" @click="paymentMethodForm('manual')">{{ $t('wallet.add-credit') }}</btn>
                     </p>
-                    <div id="mandate-form" v-if="!mandate.isValid && !mandate.isPending">
+                    <div id="mandate-form" v-if="!mandate.isValid && !mandate.isPending && $root.hasPermission('walletMandates')">
                         <template v-if="mandate.id && !mandate.isValid">
                             <div class="alert alert-danger">
                                 {{ $t('wallet.auto-payment-failed') }}
                             </div>
                             <btn class="btn-danger" @click="autoPaymentDelete">{{ $t('wallet.auto-payment-cancel') }}</btn>
                         </template>
                         <btn class="btn-primary" @click="paymentMethodForm('auto')">{{ $t('wallet.auto-payment-setup') }}</btn>
                     </div>
-                    <div id="mandate-info" v-else>
+                    <div id="mandate-info" v-else-if="$root.hasPermission('walletMandates')">
                         <div v-if="mandate.isDisabled" class="disabled-mandate alert alert-danger">
                             {{ $t('wallet.auto-payment-disabled') }}
                         </div>
                         <template v-else>
                             <p v-html="$t('wallet.auto-payment-info', { amount: mandate.amount + ' ' + wallet.currency, balance: mandate.balance + ' ' + wallet.currency})"></p>
                             <p>{{ $t('wallet.payment-method', { method: mandate.method }) }}</p>
                         </template>
                         <div v-if="mandate.isPending" class="alert alert-warning">
                             {{ $t('wallet.auto-payment-inprogress') }}
                         </div>
                         <p class="buttons">
                             <btn class="btn-danger" @click="autoPaymentDelete">{{ $t('wallet.auto-payment-cancel') }}</btn>
                             <btn class="btn-primary" @click="autoPaymentChange">{{ $t('wallet.auto-payment-change') }}</btn>
                         </p>
                     </div>
                 </div>
             </div>
         </div>
 
         <tabs class="mt-3" ref="tabs" :tabs="tabs"></tabs>
 
         <div class="tab-content">
             <div class="tab-pane active" id="receipts" role="tabpanel" aria-labelledby="tab-receipts">
                 <div class="card-body">
                     <div class="card-text">
                         <p v-if="receipts.length">
                             {{ $t('wallet.receipts-hint') }}
                         </p>
                         <div v-if="receipts.length" class="input-group">
                             <select id="receipt-id" class="form-control">
                                 <option v-for="(receipt, index) in receipts" :key="index" :value="receipt">{{ receipt }}</option>
                             </select>
                             <btn class="btn-secondary" @click="receiptDownload" icon="download">{{ $t('btn.download') }}</btn>
                         </div>
                         <p v-if="!receipts.length">
                             {{ $t('wallet.receipts-none') }}
                         </p>
                     </div>
                 </div>
             </div>
             <div class="tab-pane" id="history" role="tabpanel" aria-labelledby="tab-history">
                 <div class="card-body">
                     <transaction-log v-if="walletId && loadTransactions" class="card-text" :wallet-id="walletId"></transaction-log>
                 </div>
             </div>
             <div class="tab-pane" id="payments" role="tabpanel" aria-labelledby="tab-payments">
                 <div class="card-body">
                     <payment-log v-if="walletId && loadPayments" class="card-text" :wallet-id="walletId"></payment-log>
                 </div>
             </div>
         </div>
 
         <modal-dialog id="payment-dialog" ref="paymentDialog" :title="paymentDialogTitle" @click="payment" :buttons="dialogButtons">
             <div id="payment-method" v-if="paymentForm == 'method'">
                 <form data-validation-prefix="mandate_">
                     <div id="payment-method-selection">
                         <a v-for="method in paymentMethods" :key="method.id" @click="selectPaymentMethod(method)" href="#" :class="'card link-' + method.id">
                             <svg-icon v-if="method.icon" :icon="[method.icon.prefix, method.icon.name]" />
                             <img v-if="method.image" :src="method.image" />
                             <span class="name">{{ method.name }}</span>
                         </a>
                     </div>
                 </form>
             </div>
             <div id="manual-payment" v-if="paymentForm == 'manual'">
                 <p v-if="wallet.currency != selectedPaymentMethod.currency && selectedPaymentMethod.id != 'bitcoin'">
                     {{ $t('wallet.currency-conv', { wc: wallet.currency, pc: selectedPaymentMethod.currency }) }}
                 </p>
                 <p v-if="selectedPaymentMethod.id == 'bitcoin'">
                     {{ $t('wallet.coinbase-hint', { wc: wallet.currency }) }}
                 </p>
                 <p v-if="selectedPaymentMethod.id == 'banktransfer'">
                     {{ $t('wallet.banktransfer-hint') }}
                 </p>
                 <p>
                     {{ $t('wallet.payment-amount-hint') }}
                 </p>
                 <form id="payment-form" @submit.prevent="payment">
                     <div class="input-group">
                         <input type="text" class="form-control" id="amount" v-model="amount" required>
                         <span class="input-group-text">{{ wallet.currency }}</span>
                     </div>
                     <div v-if="wallet.currency != selectedPaymentMethod.currency && !isNaN(amount) && selectedPaymentMethod.exchangeRate" class="alert alert-warning m-0 mt-3">
                         {{ $t('wallet.payment-warning', { price: $root.price(amount * selectedPaymentMethod.exchangeRate * 100, selectedPaymentMethod.currency) }) }}
                     </div>
                 </form>
                 <div class="alert alert-warning m-0 mt-3">
                     {{ $t('wallet.norefund') }}
                 </div>
             </div>
             <div id="auto-payment" v-if="paymentForm == 'auto'">
                 <form data-validation-prefix="mandate_">
                     <p>
                         {{ $t('wallet.auto-payment-hint') }}
                     </p>
                     <div class="row mb-3">
                         <label for="mandate_amount" class="col-sm-6 col-form-label">{{ $t('wallet.fill-up') }}</label>
                         <div class="col-sm-6">
                             <div class="input-group">
                                 <input type="text" class="form-control" id="mandate_amount" v-model="mandate.amount" required>
                                 <span class="input-group-text">{{ wallet.currency }}</span>
                             </div>
                         </div>
                     </div>
                     <div class="row mb-3">
                         <label for="mandate_balance" class="col-sm-6 col-form-label">{{ $t('wallet.when-below') }}</label>
                         <div class="col-sm-6">
                             <div class="input-group">
                                 <input type="text" class="form-control" id="mandate_balance" v-model="mandate.balance" required>
                                 <span class="input-group-text">{{ wallet.currency }}</span>
                             </div>
                         </div>
                     </div>
                     <p v-if="!mandate.isValid">
                         {{ $t('wallet.auto-payment-next') }}
                     </p>
                     <div v-if="mandate.isValid && mandate.isDisabled" class="disabled-mandate alert alert-danger m-0">
                         {{ $t('wallet.auto-payment-disabled-next') }}
                     </div>
                 </form>
                 <div class="alert alert-warning m-0 mt-3">
                     {{ $t('wallet.norefund') }}
                 </div>
             </div>
         </modal-dialog>
     </div>
 </template>
 
 <script>
     import ModalDialog from './Widgets/ModalDialog'
     import TransactionLog from './Widgets/TransactionLog'
     import PaymentLog from './Widgets/PaymentLog'
     import { downloadFile } from '../js/utils'
 
     import { library } from '@fortawesome/fontawesome-svg-core'
 
     library.add(
         require('@fortawesome/free-brands-svg-icons/faBitcoin').definition,
         require('@fortawesome/free-solid-svg-icons/faBuildingColumns').definition,
         require('@fortawesome/free-regular-svg-icons/faCreditCard').definition,
         require('@fortawesome/free-solid-svg-icons/faDownload').definition,
         require('@fortawesome/free-brands-svg-icons/faPaypal').definition
     )
 
     export default {
         components: {
             ModalDialog,
             TransactionLog,
             PaymentLog
         },
         data() {
             return {
                 amount: '',
                 mandate: { amount: 10, balance: 0, method: null },
                 paymentDialogTitle: null,
                 paymentForm: null,
                 nextForm: null,
                 receipts: [],
                 stripe: null,
                 loadTransactions: false,
                 loadPayments: false,
                 showPendingPayments: false,
                 wallet: {},
                 walletId: null,
                 paymentMethods: [],
                 selectedPaymentMethod: null
             }
         },
         computed: {
             dialogButtons() {
                 if (this.paymentForm == 'method') {
                     return []
                 }
 
                 const button = {
                     className: 'btn-primary modal-action',
                     icon: 'check',
                     label: 'btn.submit'
                 }
 
                 if (this.paymentForm == 'manual'
                     || (this.paymentForm == 'auto' && !this.mandate.isValid && !this.mandate.isPending)
                 ) {
                     button.label = 'btn.continue'
                 }
 
                 return [ button ]
             },
             tabs() {
                 let tabs = [ 'wallet.receipts', 'wallet.history' ]
                 if (this.showPendingPayments) {
                     tabs.push('wallet.pending-payments')
                 }
                 return tabs
             }
         },
+        beforeDestroyed() {
+            clearTimeout(this.refreshRequest)
+        },
         mounted() {
             $('#wallet button').focus()
 
             this.walletId = this.$root.authInfo.wallets[0].id
 
             axios.get('/api/v4/wallets/' + this.walletId, { loader: true })
                 .then(response => {
                     this.wallet = response.data
 
                     axios.get('/api/v4/wallets/' + this.walletId + '/receipts', { loader: '#receipts' })
                         .then(response => {
                             this.receipts = response.data.list
                         })
 
                     if (this.wallet.provider == 'stripe') {
                         this.stripeInit()
                     }
                 })
                 .catch(this.$root.errorHandler)
 
             this.loadMandate()
 
             axios.get('/api/v4/payments/has-pending')
                 .then(response => {
                     this.showPendingPayments = response.data.hasPending
                 })
 
             this.$refs.tabs.clickHandler('history', () => { this.loadTransactions = true })
             this.$refs.tabs.clickHandler('payments', () => { this.loadPayments = true })
         },
         methods: {
-            loadMandate() {
+            loadMandate(refresh) {
                 const loader = '#mandate-form'
 
                 this.$root.stopLoading(loader)
 
-                if (!this.mandate.id || this.mandate.isPending) {
-                    axios.get('/api/v4/payments/mandate', { loader })
+                if (!this.mandate.id || this.mandate.isPending || refresh) {
+                    axios.get('/api/v4/payments/mandate', refresh ? {} : { loader })
                         .then(response => {
                             this.mandate = response.data
+
+                            if (this.mandate.minAmount) {
+                                if (this.mandate.minAmount > this.mandate.amount) {
+                                    this.mandate.amount = this.mandate.minAmount
+                                }
+                            }
+
+                            if (this.$root.authInfo.isLocked) {
+                                if (this.mandate.isValid) {
+                                    this.$root.unlock()
+                                } else {
+                                    clearTimeout(this.refreshRequest)
+                                    this.refreshRequest = setTimeout(() => { this.loadMandate(true) }, 10 * 1000)
+                                }
+                            }
                         })
                 }
             },
             selectPaymentMethod(method) {
                 this.formLock = false
                 this.selectedPaymentMethod = method
                 this.paymentForm = this.nextForm
 
                 setTimeout(() => { $('#payment-dialog').find('#amount,#mandate_amount').focus() }, 10)
             },
             payment() {
                 if (this.paymentForm == 'auto') {
                     return this.autoPayment()
                 }
 
                 if (this.formLock) {
                     return
                 }
 
                 // Lock the form to prevent from double submission
                 this.formLock = true
                 let onFinish = () => { this.formLock = false }
 
                 this.$root.clearFormValidation($('#payment-form'))
 
                 const post =  {
                     amount: this.amount,
                     methodId: this.selectedPaymentMethod.id,
                     currency: this.selectedPaymentMethod.currency
                 }
 
                 axios.post('/api/v4/payments', post, { onFinish })
                     .then(response => {
                         if (response.data.redirectUrl) {
                             location.href = response.data.redirectUrl
                         } else if (response.data.newWindowUrl) {
                             window.open(response.data.newWindowUrl, '_blank')
                             this.$refs.paymentDialog.hide();
                         } else {
                             this.stripeCheckout(response.data)
                         }
                     })
             },
             autoPayment() {
                 if (this.formLock) {
                     return
                 }
 
                 // Lock the form to prevent from double submission
                 this.formLock = true
                 let onFinish = () => { this.formLock = false }
 
                 const method = this.mandate.id && (this.mandate.isValid || this.mandate.isPending) ? 'put' : 'post'
                 let post = {
                     amount: this.mandate.amount,
                     balance: this.mandate.balance,
                 }
 
                 // Modifications can't change the method of payment
                 if (this.selectedPaymentMethod) {
                     post.methodId = this.selectedPaymentMethod.id
                     post.currency = this.selectedPaymentMethod.currency
                 }
 
                 this.$root.clearFormValidation($('#auto-payment form'))
 
                 axios[method]('/api/v4/payments/mandate', post, { onFinish })
                     .then(response => {
                         if (method == 'post') {
                             this.mandate.id = null
                             // a new mandate, redirect to the chackout page
                             if (response.data.redirectUrl) {
                                 location.href = response.data.redirectUrl
                             } else if (response.data.id) {
                                 this.stripeCheckout(response.data)
                             }
                         } else {
                             // an update
                             if (response.data.status == 'success') {
                                 this.$refs.paymentDialog.hide();
                                 this.mandate = response.data
                                 this.$toast.success(response.data.message)
                             }
                         }
                     })
             },
             autoPaymentChange(event) {
                 this.autoPaymentForm(event, this.$t('wallet.auto-payment-update'))
             },
             autoPaymentDelete() {
                 axios.delete('/api/v4/payments/mandate')
                     .then(response => {
                         this.mandate = { amount: 10, balance: 0 }
                         if (response.data.status == 'success') {
                             this.$toast.success(response.data.message)
                         }
                     })
             },
             paymentMethodForm(nextForm) {
                 this.formLock = false
                 this.paymentMethods = []
                 this.paymentForm = 'method'
                 this.nextForm = nextForm
                 this.paymentDialogTitle = this.$t(nextForm == 'auto' ? 'wallet.auto-payment-setup' : 'wallet.top-up')
 
                 this.$refs.paymentDialog.show()
 
                 this.$nextTick().then(() => {
                     const type = nextForm == 'manual' ? 'oneoff' : 'recurring'
                     const loader = ['#payment-method', { 'min-height': '10em', small: false }]
 
                     axios.get('/api/v4/payments/methods', { params: { type }, loader })
                         .then(response => {
                             this.paymentMethods = response.data
+                            if (this.paymentMethods.length == 1) {
+                                this.nextForm = 'auto';
+                                this.selectPaymentMethod(this.paymentMethods[0]);
+                            }
                         })
                 })
             },
             autoPaymentForm(event, title) {
                 this.paymentForm = 'auto'
                 this.paymentDialogTitle = title
                 this.formLock = false
 
                 this.$refs.paymentDialog.show()
             },
             receiptDownload() {
                 const receipt = $('#receipt-id').val()
                 downloadFile('/api/v4/wallets/' + this.walletId + '/receipts/' + receipt)
             },
             stripeInit() {
                 let script = $('#stripe-script')
 
                 if (!script.length) {
                     script = document.createElement('script')
 
                     script.onload = () => {
                         this.stripe = Stripe(window.config.stripePK)
                     }
 
                     script.id = 'stripe-script'
                     script.src = 'https://js.stripe.com/v3/'
 
                     document.getElementsByTagName('head')[0].appendChild(script)
                 } else {
                     this.stripe = Stripe(window.config.stripePK)
                 }
             },
             stripeCheckout(data) {
                 if (!this.stripe) {
                     return
                 }
 
                 this.stripe.redirectToCheckout({
                     sessionId: data.id
                 }).then(result => {
                     // If it fails due to a browser or network error,
                     // display the localized error message to the user
                     if (result.error) {
                         this.$toast.error(result.error.message)
                     }
                 })
             }
         }
     }
 </script>
diff --git a/src/resources/vue/Widgets/Menu.vue b/src/resources/vue/Widgets/Menu.vue
index 742ffcce..97c9191d 100644
--- a/src/resources/vue/Widgets/Menu.vue
+++ b/src/resources/vue/Widgets/Menu.vue
@@ -1,118 +1,124 @@
 <template>
     <nav :id="mode + '-menu'" :class="'navbar navbar-light navbar-expand-' + (mode == 'header' ? 'lg' : 'sm')">
         <div class="container p-0">
             <router-link class="navbar-brand" to="/" v-html="$root.logo(mode)"></router-link>
             <button v-if="mode == 'header'" class="navbar-toggler" type="button"
                     data-bs-toggle="collapse" data-bs-target="#header-menu-navbar"
                     aria-controls="header-menu-navbar" aria-expanded="false" :aria-label="$t('menu.toggle')"
             >
                 <span class="navbar-toggler-icon"></span>
             </button>
             <div :id="mode + '-menu-navbar'" :class="mode == 'header' ? 'collapse navbar-collapse justify-content-end' : ''">
                 <ul class="navbar-nav justify-content-end">
-                    <li class="nav-item" v-for="item in menu" :key="item.index">
-                        <a v-if="item.href" :class="'nav-link link-' + item.index" :href="item.href">{{ item.title }}</a>
+                    <li class="nav-item" v-for="item in menu" :key="item.label">
+                        <a v-if="item.href" :class="'nav-link link-' + item.label" :href="item.href">{{ menuItemTitle(item) }}</a>
                         <router-link v-if="item.to"
-                                     :class="'nav-link link-' + item.index"
+                                     :class="'nav-link link-' + item.label"
                                      active-class="active"
                                      :to="item.to"
                                      :exact="item.exact"
                         >
-                            {{ item.title }}
+                            {{ menuItemTitle(item) }}
                         </router-link>
                     </li>
-                    <li class="nav-item" v-if="!loggedIn && $root.isUser">
+                    <li class="nav-item" v-if="!loggedIn && $root.isUser && !hasMenuItem('signup')">
                         <router-link class="nav-link link-signup" active-class="active" :to="{name: 'signup'}">{{ $t('menu.signup') }}</router-link>
                     </li>
-                    <li class="nav-item" v-if="loggedIn">
+                    <li class="nav-item" v-if="loggedIn && !hasMenuItem('dashboard')">
                         <router-link class="nav-link link-dashboard" active-class="active" :to="{name: 'dashboard'}">{{ $t('menu.cockpit') }}</router-link>
                     </li>
                     <li class="nav-item" v-if="loggedIn">
                         <router-link class="nav-link menulogin link-logout" active-class="active" :to="{name: 'logout'}">{{ $t('menu.logout') }}</router-link>
                     </li>
                     <li class="nav-item" v-if="!loggedIn">
                         <router-link class="nav-link menulogin link-login" :to="{name: 'login'}">{{ $t('menu.login') }}</router-link>
                     </li>
                     <li v-if="languages.length > 1 && mode == 'header'" id="language-selector" class="nav-item dropdown">
                         <a href="#" class="nav-link link-lang dropdown-toggle" role="button" data-bs-toggle="dropdown">{{ getLang().toUpperCase() }}</a>
                         <div class="dropdown-menu dropdown-menu-end mb-2">
                             <a class="dropdown-item" href="#" v-for="lang in languages" :key="lang" @click="setLang(lang)">
                                 {{ lang.toUpperCase() }} - {{ $t('lang.' + lang) }}
                             </a>
                         </div>
                     </li>
                 </ul>
                 <div v-if="mode == 'footer'" class="footer">
                     <div id="footer-copyright">&copy; {{ copyright }}, {{ buildYear }}</div>
                     <div v-if="footer" id="footer-company">{{ footer }}</div>
                 </div>
             </div>
         </div>
     </nav>
 </template>
 
 <script>
     import buildDate from '../../build/js/ts'
     import { setLang, getLang } from '../../js/locale'
 
     export default {
         props: {
             mode: { type: String, default: 'header' },
             footer: { type: String, default: '' }
         },
         data() {
             return {
                 buildYear: buildDate.getFullYear(),
                 copyright: window.config['app.company.copyright'] || '',
                 languages: window.config['languages'] || [],
                 menuList: []
             }
         },
         computed: {
             loggedIn() { return !!this.$root.authInfo },
-            menu() { return this.menuList.filter(item => !item.footer || this.mode == 'footer') },
+            menu() {
+                // Filter menu by its position on the page, and user authentication state
+                return this.menuList.filter(item => {
+                    return (!item.footer || this.mode == 'footer')
+                        && (!('authenticated' in item) || this.loggedIn === item.authenticated)
+                })
+            },
             route() { return this.$route.name }
         },
         mounted() {
             this.menuList = this.loadMenu()
         },
         methods: {
             loadMenu() {
                 let menu = []
-                const lang = this.getLang()
                 const loggedIn = this.loggedIn
 
                 window.config.menu.forEach(item => {
-                    item.title = item['title-' + lang] || item['title-en'] || item.title
-
-                    if (!item.location || !item.title) {
+                    if (!item.location || !item.label) {
                         console.error("Invalid menu entry", item)
                         return
                     }
 
-                    // TODO: Different menu for different loggedIn state
-
                     if (item.location.match(/^https?:/)) {
                         item.href = item.location
                     } else {
                         item.to = { path: item.location }
                     }
 
                     item.exact = item.location == '/'
-                    item.index = item.page || item.title.toLowerCase().replace(/\s+/g, '')
 
                     menu.push(item)
                 })
 
                 return menu
             },
+            hasMenuItem(label) {
+                return this.menuList.find(item => item.label == label)
+            },
+            menuItemTitle(item) {
+                const lang = this.getLang()
+                return item['title-' + lang] || item['title-en'] || item.title || this.$t('menu.' + item.label)
+            },
             getLang() {
                 return getLang()
             },
             setLang(language) {
                 setLang(language)
-                this.menuList = this.loadMenu()
             }
         }
     }
 </script>
diff --git a/src/routes/api.php b/src/routes/api.php
index 8b2c2651..feaad88a 100644
--- a/src/routes/api.php
+++ b/src/routes/api.php
@@ -1,282 +1,283 @@
 <?php
 
 use App\Http\Controllers\API;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Route;
 
 /*
 |--------------------------------------------------------------------------
 | API Routes
 |--------------------------------------------------------------------------
 |
 | Here is where you can register API routes for your application. These
 | routes are loaded by the RouteServiceProvider within a group which
 | is assigned the "api" middleware group. Enjoy building your API!
 |
 */
 
 Route::group(
     [
         'middleware' => 'api',
         'prefix' => 'auth'
     ],
     function () {
         Route::post('login', [API\AuthController::class, 'login']);
 
         Route::group(
             ['middleware' => 'auth:api'],
             function () {
                 Route::get('info', [API\AuthController::class, 'info']);
                 Route::post('info', [API\AuthController::class, 'info']);
                 Route::get('location', [API\AuthController::class, 'location']);
                 Route::post('logout', [API\AuthController::class, 'logout']);
                 Route::post('refresh', [API\AuthController::class, 'refresh']);
             }
         );
     }
 );
 
 Route::group(
     [
         'domain' => \config('app.website_domain'),
         'middleware' => 'api',
         'prefix' => 'auth'
     ],
     function () {
         Route::post('password-policy/check', [API\PasswordPolicyController::class, 'check']);
 
         Route::post('password-reset/init', [API\PasswordResetController::class, 'init']);
         Route::post('password-reset/verify', [API\PasswordResetController::class, 'verify']);
         Route::post('password-reset', [API\PasswordResetController::class, 'reset']);
 
+        Route::get('signup/domains', [API\SignupController::class, 'domains']);
         Route::post('signup/init', [API\SignupController::class, 'init']);
         Route::get('signup/invitations/{id}', [API\SignupController::class, 'invitation']);
         Route::get('signup/plans', [API\SignupController::class, 'plans']);
         Route::post('signup/verify', [API\SignupController::class, 'verify']);
         Route::post('signup', [API\SignupController::class, 'signup']);
     }
 );
 
 Route::group(
     [
         'domain' => \config('app.website_domain'),
         'middleware' => ['auth:api', 'scope:mfa,api'],
         'prefix' => 'v4'
     ],
     function () {
         Route::post('auth-attempts/{id}/confirm', [API\V4\AuthAttemptsController::class, 'confirm']);
         Route::post('auth-attempts/{id}/deny', [API\V4\AuthAttemptsController::class, 'deny']);
         Route::get('auth-attempts/{id}/details', [API\V4\AuthAttemptsController::class, 'details']);
         Route::get('auth-attempts', [API\V4\AuthAttemptsController::class, 'index']);
 
         Route::post('companion/register', [API\V4\CompanionAppsController::class, 'register']);
     }
 );
 
 Route::group(
     [
         'domain' => \config('app.website_domain'),
         'middleware' => ['auth:api', 'scope:api'],
         'prefix' => 'v4'
     ],
     function () {
         Route::apiResource('companions', API\V4\CompanionAppsController::class);
         // This must not be accessible with the 2fa token,
         // to prevent an attacker from pairing a new device with a stolen token.
         Route::get('companions/{id}/pairing', [API\V4\CompanionAppsController::class, 'pairing']);
 
         Route::apiResource('domains', API\V4\DomainsController::class);
         Route::get('domains/{id}/confirm', [API\V4\DomainsController::class, 'confirm']);
         Route::get('domains/{id}/skus', [API\V4\DomainsController::class, 'skus']);
         Route::get('domains/{id}/status', [API\V4\DomainsController::class, 'status']);
         Route::post('domains/{id}/config', [API\V4\DomainsController::class, 'setConfig']);
 
         if (\config('app.with_files')) {
             Route::apiResource('files', API\V4\FilesController::class);
             Route::get('files/{fileId}/permissions', [API\V4\FilesController::class, 'getPermissions']);
             Route::post('files/{fileId}/permissions', [API\V4\FilesController::class, 'createPermission']);
             Route::put('files/{fileId}/permissions/{id}', [API\V4\FilesController::class, 'updatePermission']);
             Route::delete('files/{fileId}/permissions/{id}', [API\V4\FilesController::class, 'deletePermission']);
             Route::post('files/uploads/{id}', [API\V4\FilesController::class, 'upload'])
                 ->withoutMiddleware(['auth:api', 'scope:api'])
                 ->middleware(['api']);
             Route::get('files/downloads/{id}', [API\V4\FilesController::class, 'download'])
                 ->withoutMiddleware(['auth:api', 'scope:api']);
         }
 
         Route::apiResource('groups', API\V4\GroupsController::class);
         Route::get('groups/{id}/skus', [API\V4\GroupsController::class, 'skus']);
         Route::get('groups/{id}/status', [API\V4\GroupsController::class, 'status']);
         Route::post('groups/{id}/config', [API\V4\GroupsController::class, 'setConfig']);
 
         Route::apiResource('packages', API\V4\PackagesController::class);
 
         Route::apiResource('rooms', API\V4\RoomsController::class);
         Route::post('rooms/{id}/config', [API\V4\RoomsController::class, 'setConfig']);
         Route::get('rooms/{id}/skus', [API\V4\RoomsController::class, 'skus']);
 
         Route::post('meet/rooms/{id}', [API\V4\MeetController::class, 'joinRoom'])
             ->withoutMiddleware(['auth:api', 'scope:api']);
 
         Route::apiResource('resources', API\V4\ResourcesController::class);
         Route::get('resources/{id}/skus', [API\V4\ResourcesController::class, 'skus']);
         Route::get('resources/{id}/status', [API\V4\ResourcesController::class, 'status']);
         Route::post('resources/{id}/config', [API\V4\ResourcesController::class, 'setConfig']);
 
         Route::apiResource('shared-folders', API\V4\SharedFoldersController::class);
         Route::get('shared-folders/{id}/skus', [API\V4\SharedFoldersController::class, 'skus']);
         Route::get('shared-folders/{id}/status', [API\V4\SharedFoldersController::class, 'status']);
         Route::post('shared-folders/{id}/config', [API\V4\SharedFoldersController::class, 'setConfig']);
 
         Route::apiResource('skus', API\V4\SkusController::class);
 
         Route::apiResource('users', API\V4\UsersController::class);
         Route::post('users/{id}/config', [API\V4\UsersController::class, 'setConfig']);
         Route::get('users/{id}/skus', [API\V4\UsersController::class, 'skus']);
         Route::get('users/{id}/status', [API\V4\UsersController::class, 'status']);
 
         Route::apiResource('wallets', API\V4\WalletsController::class);
         Route::get('wallets/{id}/transactions', [API\V4\WalletsController::class, 'transactions']);
         Route::get('wallets/{id}/receipts', [API\V4\WalletsController::class, 'receipts']);
         Route::get('wallets/{id}/receipts/{receipt}', [API\V4\WalletsController::class, 'receiptDownload']);
 
         Route::get('password-policy', [API\PasswordPolicyController::class, 'index']);
         Route::post('password-reset/code', [API\PasswordResetController::class, 'codeCreate']);
         Route::delete('password-reset/code/{id}', [API\PasswordResetController::class, 'codeDelete']);
 
         Route::post('payments', [API\V4\PaymentsController::class, 'store']);
         //Route::delete('payments', [API\V4\PaymentsController::class, 'cancel']);
         Route::get('payments/mandate', [API\V4\PaymentsController::class, 'mandate']);
         Route::post('payments/mandate', [API\V4\PaymentsController::class, 'mandateCreate']);
         Route::put('payments/mandate', [API\V4\PaymentsController::class, 'mandateUpdate']);
         Route::delete('payments/mandate', [API\V4\PaymentsController::class, 'mandateDelete']);
         Route::get('payments/methods', [API\V4\PaymentsController::class, 'paymentMethods']);
         Route::get('payments/pending', [API\V4\PaymentsController::class, 'payments']);
         Route::get('payments/has-pending', [API\V4\PaymentsController::class, 'hasPayments']);
 
         Route::post('support/request', [API\V4\SupportController::class, 'request'])
             ->withoutMiddleware(['auth:api', 'scope:api'])
             ->middleware(['api']);
     }
 );
 
 Route::group(
     [
         'domain' => \config('app.website_domain'),
         'prefix' => 'webhooks'
     ],
     function () {
         Route::post('payment/{provider}', [API\V4\PaymentsController::class, 'webhook']);
         Route::post('meet', [API\V4\MeetController::class, 'webhook']);
     }
 );
 
 if (\config('app.with_services')) {
     Route::group(
         [
             'domain' => \config('app.services_domain'),
             'prefix' => 'webhooks'
         ],
         function () {
             Route::get('nginx', [API\V4\NGINXController::class, 'authenticate']);
             Route::get('nginx-roundcube', [API\V4\NGINXController::class, 'authenticateRoundcube']);
             Route::get('nginx-httpauth', [API\V4\NGINXController::class, 'httpauth']);
             Route::post('cyrus-sasl', [API\V4\NGINXController::class, 'cyrussasl']);
             Route::post('policy/greylist', [API\V4\PolicyController::class, 'greylist']);
             Route::post('policy/ratelimit', [API\V4\PolicyController::class, 'ratelimit']);
             Route::post('policy/spf', [API\V4\PolicyController::class, 'senderPolicyFramework']);
         }
     );
 }
 
 if (\config('app.with_admin')) {
     Route::group(
         [
             'domain' => 'admin.' . \config('app.website_domain'),
             'middleware' => ['auth:api', 'admin'],
             'prefix' => 'v4',
         ],
         function () {
             Route::apiResource('domains', API\V4\Admin\DomainsController::class);
             Route::get('domains/{id}/skus', [API\V4\Admin\DomainsController::class, 'skus']);
             Route::post('domains/{id}/suspend', [API\V4\Admin\DomainsController::class, 'suspend']);
             Route::post('domains/{id}/unsuspend', [API\V4\Admin\DomainsController::class, 'unsuspend']);
 
             Route::apiResource('groups', API\V4\Admin\GroupsController::class);
             Route::post('groups/{id}/suspend', [API\V4\Admin\GroupsController::class, 'suspend']);
             Route::post('groups/{id}/unsuspend', [API\V4\Admin\GroupsController::class, 'unsuspend']);
 
             Route::apiResource('resources', API\V4\Admin\ResourcesController::class);
             Route::apiResource('shared-folders', API\V4\Admin\SharedFoldersController::class);
             Route::apiResource('skus', API\V4\Admin\SkusController::class);
 
             Route::apiResource('users', API\V4\Admin\UsersController::class);
             Route::get('users/{id}/discounts', [API\V4\Reseller\DiscountsController::class, 'userDiscounts']);
             Route::post('users/{id}/reset2FA', [API\V4\Admin\UsersController::class, 'reset2FA']);
             Route::post('users/{id}/resetGeoLock', [API\V4\Admin\UsersController::class, 'resetGeoLock']);
             Route::get('users/{id}/skus', [API\V4\Admin\UsersController::class, 'skus']);
             Route::post('users/{id}/skus/{sku}', [API\V4\Admin\UsersController::class, 'setSku']);
             Route::post('users/{id}/suspend', [API\V4\Admin\UsersController::class, 'suspend']);
             Route::post('users/{id}/unsuspend', [API\V4\Admin\UsersController::class, 'unsuspend']);
 
             Route::apiResource('wallets', API\V4\Admin\WalletsController::class);
             Route::post('wallets/{id}/one-off', [API\V4\Admin\WalletsController::class, 'oneOff']);
             Route::get('wallets/{id}/transactions', [API\V4\Admin\WalletsController::class, 'transactions']);
 
             Route::get('stats/chart/{chart}', [API\V4\Admin\StatsController::class, 'chart']);
         }
     );
 }
 
 if (\config('app.with_reseller')) {
     Route::group(
         [
             'domain' => 'reseller.' . \config('app.website_domain'),
             'middleware' => ['auth:api', 'reseller'],
             'prefix' => 'v4',
         ],
         function () {
             Route::apiResource('domains', API\V4\Reseller\DomainsController::class);
             Route::get('domains/{id}/skus', [API\V4\Reseller\DomainsController::class, 'skus']);
             Route::post('domains/{id}/suspend', [API\V4\Reseller\DomainsController::class, 'suspend']);
             Route::post('domains/{id}/unsuspend', [API\V4\Reseller\DomainsController::class, 'unsuspend']);
 
             Route::apiResource('groups', API\V4\Reseller\GroupsController::class);
             Route::post('groups/{id}/suspend', [API\V4\Reseller\GroupsController::class, 'suspend']);
             Route::post('groups/{id}/unsuspend', [API\V4\Reseller\GroupsController::class, 'unsuspend']);
 
             Route::apiResource('invitations', API\V4\Reseller\InvitationsController::class);
             Route::post('invitations/{id}/resend', [API\V4\Reseller\InvitationsController::class, 'resend']);
 
             Route::post('payments', [API\V4\Reseller\PaymentsController::class, 'store']);
             Route::get('payments/mandate', [API\V4\Reseller\PaymentsController::class, 'mandate']);
             Route::post('payments/mandate', [API\V4\Reseller\PaymentsController::class, 'mandateCreate']);
             Route::put('payments/mandate', [API\V4\Reseller\PaymentsController::class, 'mandateUpdate']);
             Route::delete('payments/mandate', [API\V4\Reseller\PaymentsController::class, 'mandateDelete']);
             Route::get('payments/methods', [API\V4\Reseller\PaymentsController::class, 'paymentMethods']);
             Route::get('payments/pending', [API\V4\Reseller\PaymentsController::class, 'payments']);
             Route::get('payments/has-pending', [API\V4\Reseller\PaymentsController::class, 'hasPayments']);
 
             Route::apiResource('resources', API\V4\Reseller\ResourcesController::class);
             Route::apiResource('shared-folders', API\V4\Reseller\SharedFoldersController::class);
             Route::apiResource('skus', API\V4\Reseller\SkusController::class);
 
             Route::apiResource('users', API\V4\Reseller\UsersController::class);
             Route::get('users/{id}/discounts', [API\V4\Reseller\DiscountsController::class, 'userDiscounts']);
             Route::post('users/{id}/reset2FA', [API\V4\Reseller\UsersController::class, 'reset2FA']);
             Route::post('users/{id}/resetGeoLock', [API\V4\Reseller\UsersController::class, 'resetGeoLock']);
             Route::get('users/{id}/skus', [API\V4\Reseller\UsersController::class, 'skus']);
             Route::post('users/{id}/skus/{sku}', [API\V4\Admin\UsersController::class, 'setSku']);
             Route::post('users/{id}/suspend', [API\V4\Reseller\UsersController::class, 'suspend']);
             Route::post('users/{id}/unsuspend', [API\V4\Reseller\UsersController::class, 'unsuspend']);
 
             Route::apiResource('wallets', API\V4\Reseller\WalletsController::class);
             Route::post('wallets/{id}/one-off', [API\V4\Reseller\WalletsController::class, 'oneOff']);
             Route::get('wallets/{id}/receipts', [API\V4\Reseller\WalletsController::class, 'receipts']);
             Route::get('wallets/{id}/receipts/{receipt}', [API\V4\Reseller\WalletsController::class, 'receiptDownload']);
             Route::get('wallets/{id}/transactions', [API\V4\Reseller\WalletsController::class, 'transactions']);
 
             Route::get('stats/chart/{chart}', [API\V4\Reseller\StatsController::class, 'chart']);
         }
     );
 }
diff --git a/src/tests/Browser/Pages/PaymentMollie.php b/src/tests/Browser/Pages/PaymentMollie.php
index 537c2fcb..0c1321ce 100644
--- a/src/tests/Browser/Pages/PaymentMollie.php
+++ b/src/tests/Browser/Pages/PaymentMollie.php
@@ -1,76 +1,76 @@
 <?php
 
 namespace Tests\Browser\Pages;
 
 use Laravel\Dusk\Page;
 
 class PaymentMollie extends Page
 {
     /**
      * Get the URL for the page.
      *
      * @return string
      */
     public function url(): string
     {
         return '';
     }
 
     /**
      * Assert that the browser is on the page.
      *
      * @param \Laravel\Dusk\Browser $browser The browser object
      *
      * @return void
      */
     public function assert($browser)
     {
-        $browser->waitFor('form#body table, form#body iframe');
+        $browser->waitFor('form#body table, form#body iframe', 10);
     }
 
     /**
      * Get the element shortcuts for the page.
      *
      * @return array
      */
     public function elements(): array
     {
         return [
             '@title' => '#container .header__info',
             '@amount' => '#container .header__amount',
         ];
     }
 
     /**
      * Submit payment form.
      *
      * @param \Laravel\Dusk\Browser $browser The browser object
      * @param string                $status  Test payment status (paid, open, failed, expired)
      *
      * @return void
      */
     public function submitPayment($browser, $status = 'paid')
     {
         // https://docs.mollie.com/overview/testing
         // https://docs.mollie.com/components/testing
         if ($browser->element('form#body iframe')) {
             $browser->withinFrame('#card-number iframe', function ($browser) {
                 $browser->type('#cardNumber', '2223 0000 1047 9399'); // Mastercard
             })
             ->withinFrame('#card-holder-name iframe', function ($browser) {
                 $browser->type('#cardHolder', 'Test');
             })
             ->withinFrame('#expiry-date iframe', function ($browser) {
                 $browser->type('#expiryDate', '12/' . (date('y') + 1));
             })
             ->withinFrame('#cvv iframe', function ($browser) {
-                $browser->type('#verificationCode', '123');
+                $browser->click('#verificationCode')->type('#verificationCode', '123');
             })
             ->click('#submit-button');
         }
 
         $browser->waitFor('input[value="' . $status . '"]')
             ->click('input[value="' . $status . '"]')
             ->click('button.form__button');
     }
 }
diff --git a/src/tests/Browser/Pages/PaymentStripe.php b/src/tests/Browser/Pages/PaymentStripe.php
index f00067c0..4a063651 100644
--- a/src/tests/Browser/Pages/PaymentStripe.php
+++ b/src/tests/Browser/Pages/PaymentStripe.php
@@ -1,67 +1,67 @@
 <?php
 
 namespace Tests\Browser\Pages;
 
 use Laravel\Dusk\Page;
 
 class PaymentStripe extends Page
 {
     /**
      * Get the URL for the page.
      *
      * @return string
      */
     public function url(): string
     {
         return '';
     }
 
     /**
      * Assert that the browser is on the page.
      *
      * @param \Laravel\Dusk\Browser $browser The browser object
      *
      * @return void
      */
     public function assert($browser)
     {
         $browser->waitFor('.App-Payment');
     }
 
     /**
      * Get the element shortcuts for the page.
      *
      * @return array
      */
     public function elements(): array
     {
         return [
             '@form' => '.App-Payment > form',
             '@title' => '.App-Overview .ProductSummary',
             '@amount' => '#ProductSummary-totalAmount',
             '@description' => '#ProductSummary-Description',
-            '@email-input' => '.App-Payment #email',
+            '@email' => '.App-Payment .ReadOnlyFormField-email .ReadOnlyFormField-content',
             '@cardnumber-input' => '.App-Payment #cardNumber',
             '@cardexpiry-input' => '.App-Payment #cardExpiry',
             '@cardcvc-input' => '.App-Payment #cardCvc',
             '@name-input' => '.App-Payment #billingName',
             '@submit-button' => '.App-Payment form button.SubmitButton',
         ];
     }
 
     /**
      * Submit payment form.
      *
      * @param \Laravel\Dusk\Browser $browser  The browser object
      *
      * @return void
      */
     public function submitValidCreditCard($browser)
     {
         $browser->type('@name-input', 'Test')
             ->typeSlowly('@cardnumber-input', '4242424242424242', 50)
             ->type('@cardexpiry-input', '12/' . (intval(date('y')) + 1))
             ->type('@cardcvc-input', '123')
             ->press('@submit-button');
     }
 }
diff --git a/src/tests/Browser/PaymentMollieTest.php b/src/tests/Browser/PaymentMollieTest.php
index 5af5b3b5..822e04ea 100644
--- a/src/tests/Browser/PaymentMollieTest.php
+++ b/src/tests/Browser/PaymentMollieTest.php
@@ -1,293 +1,302 @@
 <?php
 
 namespace Tests\Browser;
 
 use App\Payment;
 use App\Wallet;
 use Tests\Browser;
 use Tests\Browser\Components\Dialog;
 use Tests\Browser\Components\Toast;
 use Tests\Browser\Pages\Dashboard;
 use Tests\Browser\Pages\Home;
 use Tests\Browser\Pages\PaymentMollie;
 use Tests\Browser\Pages\Wallet as WalletPage;
 use Tests\TestCaseDusk;
 
 class PaymentMollieTest extends TestCaseDusk
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('payment-test@kolabnow.com');
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser('payment-test@kolabnow.com');
 
         parent::tearDown();
     }
 
     /**
      * Test the payment process
      *
      * @group mollie
      */
     public function testPayment(): void
     {
         $user = $this->getTestUser('payment-test@kolabnow.com', [
                 'password' => 'simple123',
         ]);
 
         $this->browse(function (Browser $browser) use ($user) {
             $browser->visit(new Home())
                 ->submitLogon('payment-test@kolabnow.com', 'simple123', true, ['paymentProvider' => 'mollie'])
                 ->on(new Dashboard())
                 ->click('@links .link-wallet')
                 ->on(new WalletPage())
                 ->assertSeeIn('@main button', 'Add credit')
                 ->click('@main button')
                 ->with(new Dialog('@payment-dialog'), function (Browser $browser) {
                     $browser->assertSeeIn('@title', 'Top up your wallet')
                         ->waitFor('#payment-method-selection .link-creditcard svg')
                         ->waitFor('#payment-method-selection .link-paypal svg')
                         ->waitFor('#payment-method-selection .link-banktransfer svg')
                         ->click('#payment-method-selection .link-creditcard');
                 })
                 ->with(new Dialog('@payment-dialog'), function (Browser $browser) {
                     $browser->assertSeeIn('@title', 'Top up your wallet')
                         ->assertFocused('#amount')
                         ->assertSeeIn('@button-cancel', 'Cancel')
                         ->assertSeeIn('@button-action', 'Continue')
                         // Test error handling
                         ->type('@body #amount', 'aaa')
                         ->click('@button-action')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                         ->assertSeeIn('#amount + span + .invalid-feedback', 'The amount must be a number.')
                         // Submit valid data
                         ->type('@body #amount', '12.34')
                         // Note we use double click to assert it does not create redundant requests
                         ->click('@button-action')
                         ->click('@button-action');
                 })
                 ->on(new PaymentMollie())
                 ->assertSeeIn('@title', $user->tenant->title . ' Payment')
                 ->assertSeeIn('@amount', 'CHF 12.34')
                 ->submitPayment()
                 ->waitForLocation('/wallet')
                 ->on(new WalletPage())
                 ->assertSeeIn('@main .card-title', 'Account balance 12,34 CHF');
 
             $this->assertSame(1, $user->wallets()->first()->payments()->count());
         });
     }
 
     /**
      * Test the auto-payment setup process
      *
      * @group mollie
      */
     public function testAutoPaymentSetup(): void
     {
         $user = $this->getTestUser('payment-test@kolabnow.com', [
                 'password' => 'simple123',
         ]);
 
         $this->browse(function (Browser $browser) use ($user) {
             $browser->visit(new Home())
                 ->submitLogon('payment-test@kolabnow.com', 'simple123', true, ['paymentProvider' => 'mollie'])
                 ->on(new Dashboard())
                 ->click('@links .link-wallet')
                 ->on(new WalletPage())
                 ->assertMissing('@body #mandate-form .alert')
                 ->click('@main #mandate-form button')
+/*
                 ->with(new Dialog('@payment-dialog'), function (Browser $browser) {
                     $browser->assertSeeIn('@title', 'Set up auto-payment')
                         ->waitFor('#payment-method-selection .link-creditcard svg')
                         ->assertMissing('#payment-method-selection .link-paypal')
                         ->assertMissing('#payment-method-selection .link-banktransfer')
                         ->click('#payment-method-selection .link-creditcard');
                 })
+*/
                 ->with(new Dialog('@payment-dialog'), function (Browser $browser) {
                     $browser->assertSeeIn('@title', 'Set up auto-payment')
+                        ->waitFor('@body #mandate_amount')
                         ->assertSeeIn('@body label[for="mandate_amount"]', 'Fill up by')
                         ->assertValue('@body #mandate_amount', Payment::MIN_AMOUNT / 100)
                         ->assertSeeIn('@body label[for="mandate_balance"]', 'when account balance is below') // phpcs:ignore
                         ->assertValue('@body #mandate_balance', '0')
                         ->assertSeeIn('@button-cancel', 'Cancel')
                         ->assertSeeIn('@button-action', 'Continue')
                         // Test error handling
                         ->type('@body #mandate_amount', 'aaa')
                         ->type('@body #mandate_balance', '-1')
                         ->click('@button-action')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                         ->assertVisible('@body #mandate_amount.is-invalid')
                         ->assertVisible('@body #mandate_balance.is-invalid')
                         ->assertSeeIn('#mandate_amount + span + .invalid-feedback', 'The amount must be a number.')
                         ->assertSeeIn('#mandate_balance + span + .invalid-feedback', 'The balance must be at least 0.')
                         ->type('@body #mandate_amount', 'aaa')
                         ->type('@body #mandate_balance', '0')
                         ->click('@button-action')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                         ->assertVisible('@body #mandate_amount.is-invalid')
                         ->assertMissing('@body #mandate_balance.is-invalid')
                         ->assertSeeIn('#mandate_amount + span + .invalid-feedback', 'The amount must be a number.')
                         ->assertMissing('#mandate_balance + span + .invalid-feedback')
                         // Submit valid data
                         ->type('@body #mandate_amount', '100')
                         ->type('@body #mandate_balance', '0')
                         // Note we use double click to assert it does not create redundant requests
                         ->click('@button-action')
                         ->click('@button-action');
                 })
                 ->on(new PaymentMollie())
                 ->assertSeeIn('@title', $user->tenant->title . ' Auto-Payment Setup')
                 ->assertMissing('@amount')
                 ->submitPayment()
                 ->waitForLocation('/wallet')
                 ->visit('/wallet?paymentProvider=mollie')
                 ->waitFor('#mandate-info')
                 ->assertPresent('#mandate-info p:first-child')
                 ->assertSeeIn(
                     '#mandate-info p:first-child',
                     'Auto-payment is set to fill up your account by 100 CHF ' .
                     'every time your account balance gets under 0 CHF.'
                 )
                 ->assertSeeIn(
                     '#mandate-info p:nth-child(2)',
                     'Mastercard (**** **** **** 9399)'
                 )
                 ->assertMissing('@body .alert');
 
             $this->assertSame(1, $user->wallets()->first()->payments()->count());
         });
 
         // Test updating (disabled) auto-payment
         $this->browse(function (Browser $browser) use ($user) {
             $wallet = $user->wallets()->first();
             $wallet->setSetting('mandate_disabled', 1);
 
             $browser->refresh()
                 ->on(new WalletPage())
                 ->waitFor('#mandate-info')
                 ->assertSeeIn(
                     '#mandate-info .disabled-mandate',
                     'The configured auto-payment has been disabled'
                 )
                 ->assertSeeIn('#mandate-info button.btn-primary', 'Change auto-payment')
                 ->click('#mandate-info button.btn-primary')
                 ->with(new Dialog('@payment-dialog'), function (Browser $browser) {
                     $browser->assertSeeIn('@title', 'Update auto-payment')
                     ->assertSeeIn(
                         '@body form .disabled-mandate',
                         'The auto-payment is disabled.'
                     )
                     ->assertValue('@body #mandate_amount', '100')
                     ->assertValue('@body #mandate_balance', '0')
                     ->assertSeeIn('@button-cancel', 'Cancel')
                     ->assertSeeIn('@button-action', 'Submit')
                     // Test error handling
                     ->type('@body #mandate_amount', 'aaa')
                     ->click('@button-action')
                     ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                     ->assertVisible('@body #mandate_amount.is-invalid')
                     ->assertSeeIn('#mandate_amount + span + .invalid-feedback', 'The amount must be a number.')
                     // Submit valid data
                     ->type('@body #mandate_amount', '50')
                     ->click('@button-action');
                 })
                 ->waitUntilMissing('#payment-dialog')
                 ->assertToast(Toast::TYPE_SUCCESS, 'The auto-payment has been updated.')
                 // make sure the "disabled" text isn't there
                 ->assertMissing('#mandate-info .disabled-mandate')
                 ->click('#mandate-info button.btn-primary')
                 ->assertMissing('form .disabled-mandate')
                 ->click('button.modal-cancel');
         });
 
         // Test deleting auto-payment
         $this->browse(function (Browser $browser) {
             $browser->on(new WalletPage())
             ->waitFor('#mandate-info')
             ->assertSeeIn('#mandate-info * button.btn-danger', 'Cancel auto-payment')
             ->assertVisible('#mandate-info * button.btn-danger')
             ->click('#mandate-info * button.btn-danger')
             ->assertToast(Toast::TYPE_SUCCESS, 'The auto-payment has been removed.')
             ->assertVisible('#mandate-form')
             ->assertMissing('#mandate-info');
         });
 
         // Test pending and failed mandate
         $this->browse(function (Browser $browser) {
             $browser->on(new WalletPage())
                 ->assertMissing('@body #mandate-form .alert')
                 ->click('@main #mandate-form button')
+/*
                 ->with(new Dialog('@payment-dialog'), function (Browser $browser) {
                     $browser->assertSeeIn('@title', 'Set up auto-payment')
                         ->waitFor('#payment-method-selection .link-creditcard')
                         ->click('#payment-method-selection .link-creditcard');
                 })
+*/
                 ->with(new Dialog('@payment-dialog'), function (Browser $browser) {
                     $browser->assertSeeIn('@title', 'Set up auto-payment')
+                        ->waitFor('@body #mandate_amount')
                         ->assertSeeIn('@button-cancel', 'Cancel')
                         ->assertSeeIn('@button-action', 'Continue')
                         // Submit valid data
                         ->type('@body #mandate_amount', '100')
                         ->type('@body #mandate_balance', '0')
                         ->click('@button-action');
                 })
                 ->on(new PaymentMollie())
                 ->submitPayment('open')
                 ->waitForLocation('/wallet')
                 ->visit('/wallet?paymentProvider=mollie')
                 ->on(new WalletPage())
                 ->assertSeeIn(
                     '#mandate-info .alert-warning',
                     'The setup of the automatic payment is still in progress.'
                 )
                 // Delete the mandate
                 ->click('#mandate-info * button.btn-danger')
                 ->assertToast(Toast::TYPE_SUCCESS, 'The auto-payment has been removed.')
                 ->assertMissing('@body #mandate-form .alert')
 
                 // Create a new mandate
                 ->click('@main #mandate-form button')
+/*
                 ->with(new Dialog('@payment-dialog'), function (Browser $browser) {
                     $browser->assertSeeIn('@title', 'Set up auto-payment')
                         ->waitFor('#payment-method-selection .link-creditcard')
                         ->click('#payment-method-selection .link-creditcard');
                 })
+*/
                 ->with(new Dialog('@payment-dialog'), function (Browser $browser) {
                     $browser->assertSeeIn('@title', 'Set up auto-payment')
+                        ->waitFor('@body #mandate_amount')
                         ->assertSeeIn('@button-cancel', 'Cancel')
                         ->assertSeeIn('@button-action', 'Continue')
                         // Submit valid data
                         ->type('@body #mandate_amount', '100')
                         ->type('@body #mandate_balance', '0')
                         ->click('@button-action');
                 })
                 ->on(new PaymentMollie())
                 ->submitPayment('failed')
                 ->waitForLocation('/wallet')
                 ->visit('/wallet?paymentProvider=mollie')
                 ->on(new WalletPage())
                 ->waitFor('#mandate-form .alert-danger')
                 ->assertSeeIn(
                     '#mandate-form .alert-danger',
                     'The setup of automatic payments failed. Restart the process to enable'
                 )
                 ->click('@main button')
                 ->with(new Dialog('@payment-dialog'), function (Browser $browser) {
                     $browser->waitFor('#mandate-form')
                         ->assertMissing('#mandate-info');
                 });
         });
     }
 }
diff --git a/src/tests/Browser/PaymentStripeTest.php b/src/tests/Browser/PaymentStripeTest.php
index 7b203c7e..ba797203 100644
--- a/src/tests/Browser/PaymentStripeTest.php
+++ b/src/tests/Browser/PaymentStripeTest.php
@@ -1,234 +1,237 @@
 <?php
 
 namespace Tests\Browser;
 
 use App\Payment;
 use App\Wallet;
 use Tests\Browser;
 use Tests\Browser\Components\Dialog;
 use Tests\Browser\Components\Toast;
 use Tests\Browser\Pages\Dashboard;
 use Tests\Browser\Pages\Home;
 use Tests\Browser\Pages\PaymentStripe;
 use Tests\Browser\Pages\Wallet as WalletPage;
 use Tests\TestCaseDusk;
 
 class PaymentStripeTest extends TestCaseDusk
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('payment-test@kolabnow.com');
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser('payment-test@kolabnow.com');
 
         parent::tearDown();
     }
 
     /**
      * Test the payment process
      *
      * @group stripe
      */
     public function testPayment(): void
     {
         $user = $this->getTestUser('payment-test@kolabnow.com', [
                 'password' => 'simple123',
         ]);
 
         $this->browse(function (Browser $browser) use ($user) {
             $browser->visit(new Home())
                 ->submitLogon('payment-test@kolabnow.com', 'simple123', true, ['paymentProvider' => 'stripe'])
                 ->on(new Dashboard())
                 ->click('@links .link-wallet')
                 ->on(new WalletPage())
                 ->assertSeeIn('@main button', 'Add credit')
                 ->click('@main button')
                 ->with(new Dialog('@payment-dialog'), function (Browser $browser) {
                     $browser->assertSeeIn('@title', 'Top up your wallet')
                         ->waitFor('#payment-method-selection .link-creditcard svg')
                         ->waitFor('#payment-method-selection .link-paypal svg')
                         ->assertMissing('#payment-method-selection .link-banktransfer svg')
                         ->click('#payment-method-selection .link-creditcard');
                 })
                 ->with(new Dialog('@payment-dialog'), function (Browser $browser) {
                     $browser->assertSeeIn('@title', 'Top up your wallet')
                         ->assertFocused('#amount')
                         ->assertSeeIn('@button-cancel', 'Cancel')
                         ->assertSeeIn('@button-action', 'Continue')
                         // Test error handling
                         ->type('@body #amount', 'aaa')
                         ->click('@button-action')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                         ->assertSeeIn('#amount + span + .invalid-feedback', 'The amount must be a number.')
                         // Submit valid data
                         ->type('@body #amount', '12.34')
                         // Note we use double click to assert it does not create redundant requests
                         ->click('@button-action')
                         ->click('@button-action');
                 })
                 ->on(new PaymentStripe())
                 ->assertSeeIn('@title', $user->tenant->title . ' Payment')
                 ->assertSeeIn('@amount', 'CHF 12.34')
-                ->assertValue('@email-input', $user->email)
+                ->assertSeeIn('@email', $user->email)
                 ->submitValidCreditCard();
 
             // Now it should redirect back to wallet page and in background
             // use the webhook to update payment status (and balance).
 
             // Looks like in test-mode the webhook is executed before redirect
             // so we can expect balance updated on the wallet page
 
             $browser->waitForLocation('/wallet', 30) // need more time than default 5 sec.
                 ->on(new WalletPage())
                 ->assertSeeIn('@main .card-title', 'Account balance 12,34 CHF');
         });
     }
 
     /**
      * Test the auto-payment setup process
      *
      * @group stripe
      */
     public function testAutoPaymentSetup(): void
     {
         $user = $this->getTestUser('payment-test@kolabnow.com', [
                 'password' => 'simple123',
         ]);
 
         // Test creating auto-payment
         $this->browse(function (Browser $browser) use ($user) {
             $browser->visit(new Home())
                 ->submitLogon('payment-test@kolabnow.com', 'simple123', true, ['paymentProvider' => 'stripe'])
                 ->on(new Dashboard())
                 ->click('@links .link-wallet')
                 ->on(new WalletPage())
                 ->assertMissing('@body #mandate-form .alert')
                 ->click('@main #mandate-form button')
+/*
                 ->with(new Dialog('@payment-dialog'), function (Browser $browser) {
                     $browser->assertSeeIn('@title', 'Set up auto-payment')
                         ->waitFor('#payment-method-selection .link-creditcard')
                         ->assertMissing('#payment-method-selection .link-paypal')
                         ->assertMissing('#payment-method-selection .link-banktransfer')
                         ->click('#payment-method-selection .link-creditcard');
                 })
+*/
                 ->with(new Dialog('@payment-dialog'), function (Browser $browser) {
                     $browser->assertSeeIn('@title', 'Set up auto-payment')
+                        ->waitFor('@body #mandate_amount')
                         ->assertSeeIn('@body label[for="mandate_amount"]', 'Fill up by')
                         ->assertValue('@body #mandate_amount', Payment::MIN_AMOUNT / 100)
                         ->assertSeeIn('@body label[for="mandate_balance"]', 'when account balance is below') // phpcs:ignore
                         ->assertValue('@body #mandate_balance', '0')
                         ->assertSeeIn('@button-cancel', 'Cancel')
                         ->assertSeeIn('@button-action', 'Continue')
                         // Test error handling
                         ->type('@body #mandate_amount', 'aaa')
                         ->type('@body #mandate_balance', '-1')
                         ->click('@button-action')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                         ->assertVisible('@body #mandate_amount.is-invalid')
                         ->assertVisible('@body #mandate_balance.is-invalid')
                         ->assertSeeIn('#mandate_amount + span + .invalid-feedback', 'The amount must be a number.')
                         ->assertSeeIn('#mandate_balance + span + .invalid-feedback', 'The balance must be at least 0.')
                         ->type('@body #mandate_amount', 'aaa')
                         ->type('@body #mandate_balance', '0')
                         ->click('@button-action')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                         ->assertVisible('@body #mandate_amount.is-invalid')
                         ->assertMissing('@body #mandate_balance.is-invalid')
                         ->assertSeeIn('#mandate_amount + span + .invalid-feedback', 'The amount must be a number.')
                         ->assertMissing('#mandate_balance + span + .invalid-feedback')
                         // Submit valid data
                         ->type('@body #mandate_amount', '100')
                         ->type('@body #mandate_balance', '0')
                         // Note we use double click to assert it does not create redundant requests
                         ->click('@button-action')
                         ->click('@button-action');
                 })
                 ->on(new PaymentStripe())
                 ->assertMissing('@title')
                 ->assertMissing('@amount')
-                ->assertValue('@email-input', $user->email)
+                ->assertSeeIn('@email', $user->email)
                 ->submitValidCreditCard()
                 ->waitForLocation('/wallet', 30) // need more time than default 5 sec.
                 ->visit('/wallet?paymentProvider=stripe')
                 ->waitFor('#mandate-info')
                 ->assertPresent('#mandate-info p:first-child')
                 ->assertSeeIn(
                     '#mandate-info p:first-child',
                     'Auto-payment is set to fill up your account by 100 CHF ' .
                     'every time your account balance gets under 0 CHF.'
                 )
                 ->assertSeeIn(
                     '#mandate-info p:nth-child(2)',
                     'Visa (**** **** **** 4242)'
                 )
                 ->assertMissing('@body .alert');
         });
 
 
         // Test updating (disabled) auto-payment
         $this->browse(function (Browser $browser) use ($user) {
             $wallet = $user->wallets()->first();
             $wallet->setSetting('mandate_disabled', 1);
 
             $browser->refresh()
                 ->on(new WalletPage())
                 ->waitFor('#mandate-info')
                 ->assertSeeIn(
                     '#mandate-info .disabled-mandate',
                     'The configured auto-payment has been disabled'
                 )
                 ->assertSeeIn('#mandate-info button.btn-primary', 'Change auto-payment')
                 ->click('#mandate-info button.btn-primary')
                 ->with(new Dialog('@payment-dialog'), function (Browser $browser) {
                     $browser->assertSeeIn('@title', 'Update auto-payment')
                     ->assertSeeIn(
                         '@body form .disabled-mandate',
                         'The auto-payment is disabled.'
                     )
                     ->assertValue('@body #mandate_amount', '100')
                     ->assertValue('@body #mandate_balance', '0')
                     ->assertSeeIn('@button-cancel', 'Cancel')
                     ->assertSeeIn('@button-action', 'Submit')
                     // Test error handling
                     ->type('@body #mandate_amount', 'aaa')
                     ->click('@button-action')
                     ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                     ->assertVisible('@body #mandate_amount.is-invalid')
                     ->assertSeeIn('#mandate_amount + span + .invalid-feedback', 'The amount must be a number.')
                     // Submit valid data
                     ->type('@body #mandate_amount', '50')
                     ->click('@button-action');
                 })
                 ->waitUntilMissing('#payment-dialog')
                 ->assertToast(Toast::TYPE_SUCCESS, 'The auto-payment has been updated.')
                 // make sure the "disabled" text isn't there
                 ->assertMissing('#mandate-info .disabled-mandate')
                 ->click('#mandate-info button.btn-primary')
                 ->assertMissing('form .disabled-mandate')
                 ->click('button.modal-cancel');
         });
 
         // Test deleting auto-payment
         $this->browse(function (Browser $browser) {
             $browser->on(new WalletPage())
             ->waitFor('#mandate-info')
             ->assertSeeIn('#mandate-info * button.btn-danger', 'Cancel auto-payment')
             ->assertVisible('#mandate-info * button.btn-danger')
             ->click('#mandate-info * button.btn-danger')
             ->assertToast(Toast::TYPE_SUCCESS, 'The auto-payment has been removed.')
             ->assertVisible('#mandate-form')
             ->assertMissing('#mandate-info');
         });
     }
 }
diff --git a/src/tests/Browser/SignupTest.php b/src/tests/Browser/SignupTest.php
index 342d962f..eaef5390 100644
--- a/src/tests/Browser/SignupTest.php
+++ b/src/tests/Browser/SignupTest.php
@@ -1,765 +1,828 @@
 <?php
 
 namespace Tests\Browser;
 
 use App\Discount;
 use App\Domain;
 use App\Plan;
 use App\SignupCode;
 use App\SignupInvitation;
 use App\User;
 use Tests\Browser;
 use Tests\Browser\Components\Menu;
 use Tests\Browser\Components\Toast;
 use Tests\Browser\Pages\Dashboard;
+use Tests\Browser\Pages\Home;
 use Tests\Browser\Pages\Signup;
+use Tests\Browser\Pages\Wallet;
 use Tests\TestCaseDusk;
 use Illuminate\Foundation\Testing\DatabaseMigrations;
 
 class SignupTest extends TestCaseDusk
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('signuptestdusk@' . \config('app.domain'));
         $this->deleteTestUser('admin@user-domain-signup.com');
         $this->deleteTestDomain('user-domain-signup.com');
 
-        Plan::where('mode', 'token')->update(['mode' => 'email']);
+        Plan::whereIn('mode', ['token', 'mandate'])->update(['mode' => 'email']);
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser('signuptestdusk@' . \config('app.domain'));
         $this->deleteTestUser('admin@user-domain-signup.com');
         $this->deleteTestDomain('user-domain-signup.com');
         SignupInvitation::truncate();
 
-        Plan::where('mode', 'token')->update(['mode' => 'email']);
+        Plan::whereIn('mode', ['token', 'mandate'])->update(['mode' => 'email']);
 
         @unlink(storage_path('signup-tokens.txt'));
 
         parent::tearDown();
     }
 
     /**
      * Test signup code verification with a link
      */
     public function testSignupCodeByLink(): void
     {
         // Test invalid code (invalid format)
         $this->browse(function (Browser $browser) {
             // Register Signup page element selectors we'll be using
             $browser->onWithoutAssert(new Signup());
 
             // TODO: Test what happens if user is logged in
 
             $browser->visit('/signup/invalid-code');
 
             // TODO: According to https://github.com/vuejs/vue-router/issues/977
             // it is not yet easily possible to display error page component (route)
             // without changing the URL
             // TODO: Instead of css selector we should probably define page/component
             // and use it instead
             $browser->waitFor('#error-page');
         });
 
         // Test invalid code (valid format)
         $this->browse(function (Browser $browser) {
             $browser->visit('/signup/XXXXX-code');
 
             // FIXME: User will not be able to continue anyway, so we should
             //        either display 1st step or 404 error page
             $browser->waitFor('@step1')
                 ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
         });
 
         // Test valid code
         $this->browse(function (Browser $browser) {
             $code = SignupCode::create([
                     'email' => 'User@example.org',
                     'first_name' => 'User',
                     'last_name' => 'Name',
                     'plan' => 'individual',
                     'voucher' => '',
             ]);
 
             $browser->visit('/signup/' . $code->short_code . '-' . $code->code)
                 ->waitFor('@step3')
                 ->assertMissing('@step1')
                 ->assertMissing('@step2');
 
             // FIXME: Find a nice way to read javascript data without using hidden inputs
             $this->assertSame($code->code, $browser->value('@step2 #signup_code'));
 
             // TODO: Test if the signup process can be completed
         });
     }
 
     /**
      * Test signup "welcome" page
      */
     public function testSignupStep0(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->visit(new Signup());
 
             $browser->assertVisible('@step0')
                 ->assertMissing('@step1')
                 ->assertMissing('@step2')
                 ->assertMissing('@step3');
 
             $browser->within(new Menu(), function ($browser) {
                 $browser->assertMenuItems(['signup', 'explore', 'blog', 'support', 'login', 'lang'], 'signup');
             });
 
             $browser->waitFor('@step0 .plan-selector .card');
 
             // Assert first plan box and press the button
             $browser->with('@step0 .plan-selector .plan-individual', function ($step) {
                 $step->assertVisible('button')
                     ->assertSeeIn('button', 'Individual Account')
                     ->assertVisible('.plan-description')
                     ->click('button');
             });
 
             $browser->waitForLocation('/signup/individual')
                 ->assertVisible('@step1')
                 ->assertSeeIn('.card-title', 'Sign Up - Step 1/3')
                 ->assertMissing('@step0')
                 ->assertMissing('@step2')
                 ->assertMissing('@step3')
                 ->assertFocused('@step1 #signup_first_name');
 
             // Click Back button
             $browser->click('@step1 [type=button]')
                 ->waitForLocation('/signup')
                     ->assertVisible('@step0')
                     ->assertMissing('@step1')
                     ->assertMissing('@step2')
                     ->assertMissing('@step3');
 
             // Choose the group account plan
             $browser->click('@step0 .plan-selector .plan-group button')
                 ->waitForLocation('/signup/group')
                 ->assertVisible('@step1')
                 ->assertMissing('@step0')
                 ->assertMissing('@step2')
                 ->assertMissing('@step3')
                 ->assertFocused('@step1 #signup_first_name');
 
             // TODO: Test if 'plan' variable is set properly in vue component
         });
     }
 
     /**
      * Test 1st step of the signup process
      */
     public function testSignupStep1(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->visit('/signup/individual')
                 ->onWithoutAssert(new Signup());
 
             // Here we expect two text inputs and Back and Continue buttons
             $browser->with('@step1', function ($step) {
                 $step->waitFor('#signup_last_name')
                     ->assertSeeIn('.card-title', 'Sign Up - Step 1/3')
                     ->assertVisible('#signup_first_name')
                     ->assertFocused('#signup_first_name')
                     ->assertVisible('#signup_email')
                     ->assertVisible('[type=button]')
                     ->assertVisible('[type=submit]');
             });
 
             // Submit empty form
             // Email is required, so after pressing Submit
             // we expect focus to be moved to the email input
             $browser->with('@step1', function ($step) {
                 $step->click('[type=submit]');
                 $step->assertFocused('#signup_email');
             });
 
             $browser->within(new Menu(), function ($browser) {
                 $browser->assertMenuItems(['signup', 'explore', 'blog', 'support', 'login', 'lang'], 'signup');
             });
 
             // Submit invalid email, and first_name
             // We expect both inputs to have is-invalid class added, with .invalid-feedback element
             $browser->with('@step1', function ($step) {
                 $step->type('#signup_first_name', str_repeat('a', 250))
                     ->type('#signup_email', '@test')
                     ->click('[type=submit]')
                     ->waitFor('#signup_email.is-invalid')
                     ->assertVisible('#signup_first_name.is-invalid')
                     ->assertVisible('#signup_email + .invalid-feedback')
                     ->assertVisible('#signup_last_name + .invalid-feedback')
                     ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
             });
 
             // Submit valid data
             // We expect error state on email input to be removed, and Step 2 form visible
             $browser->with('@step1', function ($step) {
                 $step->type('#signup_first_name', 'Test')
                     ->type('#signup_last_name', 'User')
                     ->type('#signup_email', 'BrowserSignupTestUser1@kolab.org')
                     ->click('[type=submit]')
                     ->assertMissing('#signup_email.is-invalid')
                     ->assertMissing('#signup_email + .invalid-feedback');
             });
 
             $browser->waitUntilMissing('@step2 #signup_code[value=""]');
             $browser->waitFor('@step2');
             $browser->assertMissing('@step1');
         });
     }
 
     /**
      * Test 2nd Step of the signup process
      *
      * @depends testSignupStep1
      */
     public function testSignupStep2(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->assertVisible('@step2')
                 ->assertSeeIn('@step2 .card-title', 'Sign Up - Step 2/3')
                 ->assertMissing('@step0')
                 ->assertMissing('@step1')
                 ->assertMissing('@step3');
 
             // Here we expect one text input, Back and Continue buttons
             $browser->with('@step2', function ($step) {
                 $step->assertVisible('#signup_short_code')
                     ->assertFocused('#signup_short_code')
                     ->assertVisible('[type=button]')
                     ->assertVisible('[type=submit]');
             });
 
             // Test Back button functionality
             $browser->click('@step2 [type=button]')
                 ->waitFor('@step1')
                 ->assertFocused('@step1 #signup_first_name')
                 ->assertMissing('@step2');
 
             // Submit valid Step 1 data (again)
             $browser->with('@step1', function ($step) {
                 $step->type('#signup_first_name', 'User')
                     ->type('#signup_last_name', 'User')
                     ->type('#signup_email', 'BrowserSignupTestUser1@kolab.org')
                     ->click('[type=submit]');
             });
 
             $browser->waitFor('@step2');
             $browser->assertMissing('@step1');
 
             // Submit invalid code
             // We expect code input to have is-invalid class added, with .invalid-feedback element
             $browser->with('@step2', function ($step) {
                 $step->type('#signup_short_code', 'XXXXX');
                 $step->click('[type=submit]');
 
                 $step->waitFor('#signup_short_code.is-invalid')
                     ->assertVisible('#signup_short_code + .invalid-feedback')
                     ->assertFocused('#signup_short_code')
                     ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
             });
 
             // Submit valid code
             // We expect error state on code input to be removed, and Step 3 form visible
             $browser->with('@step2', function ($step) {
                 // Get the code and short_code from database
                 // FIXME: Find a nice way to read javascript data without using hidden inputs
                 $code = $step->value('#signup_code');
 
                 $this->assertNotEmpty($code);
 
                 $code = SignupCode::find($code);
 
                 $step->type('#signup_short_code', $code->short_code);
                 $step->click('[type=submit]');
 
                 $step->assertMissing('#signup_short_code.is-invalid');
                 $step->assertMissing('#signup_short_code + .invalid-feedback');
             });
 
             $browser->waitFor('@step3');
             $browser->assertMissing('@step2');
         });
     }
 
     /**
      * Test 3rd Step of the signup process
      *
      * @depends testSignupStep2
      */
     public function testSignupStep3(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->assertVisible('@step3');
 
             // Here we expect 3 text inputs, Back and Continue buttons
             $browser->with('@step3', function ($step) {
                 $domains = Domain::getPublicDomains();
                 $domains_count = count($domains);
 
                 $step->assertSeeIn('.card-title', 'Sign Up - Step 3/3')
                     ->assertMissing('#signup_last_name')
                     ->assertMissing('#signup_first_name')
                     ->assertVisible('#signup_login')
                     ->assertVisible('#signup_password')
                     ->assertVisible('#signup_password_confirmation')
                     ->assertVisible('select#signup_domain')
                     ->assertElementsCount('select#signup_domain option', $domains_count, false)
                     ->assertText('select#signup_domain option:nth-child(1)', $domains[0])
                     ->assertValue('select#signup_domain option:nth-child(1)', $domains[0])
                     ->assertText('select#signup_domain option:nth-child(2)', $domains[1])
                     ->assertValue('select#signup_domain option:nth-child(2)', $domains[1])
                     ->assertVisible('[type=button]')
                     ->assertVisible('[type=submit]')
                     ->assertSeeIn('[type=submit]', 'Submit')
                     ->assertFocused('#signup_login')
                     ->assertSelected('select#signup_domain', \config('app.domain'))
                     ->assertValue('#signup_login', '')
                     ->assertValue('#signup_password', '')
                     ->assertValue('#signup_password_confirmation', '')
                     ->with('#signup_password_policy', function (Browser $browser) {
                         $browser->assertElementsCount('li', 2)
                             ->assertMissing('li:first-child svg.text-success')
                             ->assertSeeIn('li:first-child small', "Minimum password length: 6 characters")
                             ->assertMissing('li:last-child svg.text-success')
                             ->assertSeeIn('li:last-child small', "Maximum password length: 255 characters");
                     });
 
                 // TODO: Test domain selector
             });
 
             // Test Back button
             $browser->click('@step3 [type=button]');
             $browser->waitFor('@step2');
             $browser->assertFocused('@step2 #signup_short_code');
             $browser->assertMissing('@step3');
 
             // TODO: Test form reset when going back
 
             // Submit valid code again
             $browser->with('@step2', function ($step) {
                 $code = $step->value('#signup_code');
 
                 $this->assertNotEmpty($code);
 
                 $code = SignupCode::find($code);
 
                 $step->type('#signup_short_code', $code->short_code);
                 $step->click('[type=submit]');
             });
 
             $browser->waitFor('@step3');
 
             // Submit invalid data
             $browser->with('@step3', function ($step) {
                 $step->assertFocused('#signup_login')
                     ->type('#signup_login', '*')
                     ->type('#signup_password', '12345678')
                     ->type('#signup_password_confirmation', '123456789')
                     ->with('#signup_password_policy', function (Browser $browser) {
                         $browser->waitFor('li:first-child svg.text-success')
                             ->waitFor('li:last-child svg.text-success');
                     })
                     ->click('[type=submit]')
                     ->waitFor('#signup_login.is-invalid')
                     ->assertVisible('#signup_domain + .invalid-feedback')
                     ->assertVisible('#signup_password.is-invalid')
                     ->assertVisible('#signup_password_input .invalid-feedback')
                     ->assertFocused('#signup_login')
                     ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
             });
 
             // Submit invalid data (valid login, invalid password)
             $browser->with('@step3', function ($step) {
                 $step->type('#signup_login', 'SignupTestDusk')
                     ->click('[type=submit]')
                     ->waitFor('#signup_password.is-invalid')
                     ->assertVisible('#signup_password_input .invalid-feedback')
                     ->assertMissing('#signup_login.is-invalid')
                     ->assertMissing('#signup_domain + .invalid-feedback')
                     ->assertFocused('#signup_password')
                     ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
             });
 
             // Submit valid data
             $browser->with('@step3', function ($step) {
                 $step->type('#signup_password_confirmation', '12345678');
 
                 $step->click('[type=submit]');
             });
 
             // At this point we should be auto-logged-in to dashboard
             $browser->waitUntilMissing('@step3')
                 ->waitUntilMissing('.app-loader')
                 ->on(new Dashboard())
                 ->assertUser('signuptestdusk@' . \config('app.domain'))
                 ->assertVisible('@links a.link-profile')
                 ->assertMissing('@links a.link-domains')
                 ->assertVisible('@links a.link-users')
                 ->assertVisible('@links a.link-wallet');
 
             // Logout the user
             $browser->within(new Menu(), function ($browser) {
                 $browser->clickMenuItem('logout');
             });
         });
     }
 
     /**
      * Test signup for a group account
      */
     public function testSignupGroup(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->visit(new Signup());
 
             // Choose the group account plan
             $browser->waitFor('@step0 .plan-group button')
                 ->click('@step0 .plan-group button');
 
             // Submit valid data
             // We expect error state on email input to be removed, and Step 2 form visible
             $browser->whenAvailable('@step1', function ($step) {
                 $step->type('#signup_first_name', 'Test')
                     ->type('#signup_last_name', 'User')
                     ->type('#signup_email', 'BrowserSignupTestUser1@kolab.org')
                     ->click('[type=submit]');
             });
 
             // Submit valid code
             $browser->whenAvailable('@step2', function ($step) {
                 // Get the code and short_code from database
                 // FIXME: Find a nice way to read javascript data without using hidden inputs
                 $code = $step->value('#signup_code');
                 $code = SignupCode::find($code);
 
                 $step->type('#signup_short_code', $code->short_code)
                     ->click('[type=submit]');
             });
 
             // Here we expect 4 text inputs, Back and Continue buttons
             $browser->whenAvailable('@step3', function ($step) {
                 $step->assertVisible('#signup_login')
                     ->assertVisible('#signup_password')
                     ->assertVisible('#signup_password_confirmation')
                     ->assertVisible('input#signup_domain')
                     ->assertVisible('[type=button]')
                     ->assertVisible('[type=submit]')
                     ->assertFocused('#signup_login')
                     ->assertValue('input#signup_domain', '')
                     ->assertValue('#signup_login', '')
                     ->assertValue('#signup_password', '')
                     ->assertValue('#signup_password_confirmation', '');
             });
 
             // Submit invalid login and password data
             $browser->with('@step3', function ($step) {
                 $step->assertFocused('#signup_login')
                     ->type('#signup_login', '*')
                     ->type('#signup_domain', 'test.com')
                     ->type('#signup_password', '12345678')
                     ->type('#signup_password_confirmation', '123456789')
                     ->click('[type=submit]')
                     ->waitFor('#signup_login.is-invalid')
                     ->assertVisible('#signup_domain + .invalid-feedback')
                     ->assertVisible('#signup_password.is-invalid')
                     ->assertVisible('#signup_password_input .invalid-feedback')
                     ->assertFocused('#signup_login')
                     ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
             });
 
             // Submit invalid domain
             $browser->with('@step3', function ($step) {
                 $step->type('#signup_login', 'admin')
                     ->type('#signup_domain', 'aaa')
                     ->type('#signup_password', '12345678')
                     ->type('#signup_password_confirmation', '12345678')
                     ->click('[type=submit]')
                     ->waitUntilMissing('#signup_login.is-invalid')
                     ->waitFor('#signup_domain.is-invalid + .invalid-feedback')
                     ->assertMissing('#signup_password.is-invalid')
                     ->assertMissing('#signup_password_input .invalid-feedback')
                     ->assertFocused('#signup_domain')
                     ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
             });
 
             // Submit invalid domain
             $browser->with('@step3', function ($step) {
                 $step->type('#signup_domain', 'user-domain-signup.com')
                     ->click('[type=submit]');
             });
 
             // At this point we should be auto-logged-in to dashboard
             $browser->waitUntilMissing('@step3')
                 ->waitUntilMissing('.app-loader')
                 ->on(new Dashboard())
                 ->assertUser('admin@user-domain-signup.com')
                 ->assertVisible('@links a.link-profile')
                 ->assertVisible('@links a.link-domains')
                 ->assertVisible('@links a.link-users')
                 ->assertVisible('@links a.link-wallet');
 
             $browser->within(new Menu(), function ($browser) {
                 $browser->clickMenuItem('logout');
             });
         });
     }
 
+    /**
+     * Test signup with a mandate plan, also the wallet lock
+     */
+    public function testSignupMandate(): void
+    {
+        // Test the individual plan
+        $plan = Plan::withEnvTenantContext()->where('title', 'individual')->first();
+        $plan->mode = 'mandate';
+        $plan->save();
+
+        $this->browse(function (Browser $browser) {
+            $browser->visit(new Signup())
+                ->waitFor('@step0 .plan-individual button')
+                ->click('@step0 .plan-individual button')
+                // Test Back button
+                ->whenAvailable('@step3', function ($browser) {
+                    $browser->click('button[type=button]');
+                })
+                ->whenAvailable('@step0', function ($browser) {
+                    $browser->click('.plan-individual button');
+                })
+                // Test submit
+                ->whenAvailable('@step3', function ($browser) {
+                    $domains = Domain::getPublicDomains();
+                    $domains_count = count($domains);
+
+                    $browser->assertMissing('.card-title')
+                        ->assertElementsCount('select#signup_domain option', $domains_count, false)
+                        ->assertText('select#signup_domain option:nth-child(1)', $domains[0])
+                        ->assertValue('select#signup_domain option:nth-child(1)', $domains[0])
+                        ->type('#signup_login', 'signuptestdusk')
+                        ->type('#signup_password', '12345678')
+                        ->type('#signup_password_confirmation', '12345678')
+                        ->click('[type=submit]');
+                })
+                ->waitUntilMissing('@step3')
+                ->on(new Wallet())
+                ->assertSeeIn('#lock-alert', "The account is locked")
+                ->within(new Menu(), function ($browser) {
+                    $browser->clickMenuItem('logout');
+                });
+        });
+
+        $user = User::where('email', 'signuptestdusk@' . \config('app.domain'))->first();
+        $this->assertSame($plan->id, $user->getSetting('plan_id'));
+
+        // Login again and see that the account is still locked
+        $this->browse(function (Browser $browser) use ($user) {
+            $browser->on(new Home())
+                ->submitLogon($user->email, '12345678', false)
+                ->waitForLocation('/wallet')
+                ->on(new Wallet())
+                ->assertSeeIn('#lock-alert', "The account is locked")
+                ->within(new Menu(), function ($browser) {
+                    $browser->clickMenuItem('logout');
+                });
+
+            // TODO: Test automatic UI unlock after creating a valid auto-payment mandate
+        });
+    }
+
     /**
      * Test signup with a token plan
      */
     public function testSignupToken(): void
     {
         // Test the individual plan
         Plan::where('title', 'individual')->update(['mode' => 'token']);
 
         // Register some valid tokens
         $tokens = ['1234567890', 'abcdefghijk'];
         file_put_contents(storage_path('signup-tokens.txt'), implode("\n", $tokens));
 
         $this->browse(function (Browser $browser) use ($tokens) {
             $browser->visit(new Signup())
                 ->waitFor('@step0 .plan-individual button')
                 ->click('@step0 .plan-individual button')
                 // Step 1
                 ->whenAvailable('@step1', function ($browser) use ($tokens) {
                     $browser->assertSeeIn('.card-title', 'Sign Up - Step 1/2')
                         ->type('#signup_first_name', 'Test')
                         ->type('#signup_last_name', 'User')
                         ->assertMissing('#signup_email')
                         ->type('#signup_token', '1234')
                         // invalid token
                         ->click('[type=submit]')
                         ->waitFor('#signup_token.is-invalid')
                         ->assertVisible('#signup_token + .invalid-feedback')
                         ->assertFocused('#signup_token')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                         // valid token
                         ->type('#signup_token', $tokens[0])
                         ->click('[type=submit]');
                 })
                 // Step 2
                 ->whenAvailable('@step3', function ($browser) {
                     $domains = Domain::getPublicDomains();
                     $domains_count = count($domains);
 
                     $browser->assertSeeIn('.card-title', 'Sign Up - Step 2/2')
                         ->assertElementsCount('select#signup_domain option', $domains_count, false)
                         ->assertText('select#signup_domain option:nth-child(1)', $domains[0])
                         ->assertValue('select#signup_domain option:nth-child(1)', $domains[0])
                         ->type('#signup_login', 'signuptestdusk')
                         ->type('#signup_password', '12345678')
                         ->type('#signup_password_confirmation', '12345678')
                         ->click('[type=submit]');
                 })
                 ->waitUntilMissing('@step3')
                 ->on(new Dashboard())
                 ->within(new Menu(), function ($browser) {
                     $browser->clickMenuItem('logout');
                 });
         });
 
         $user = User::where('email', 'signuptestdusk@' . \config('app.domain'))->first();
         $this->assertSame($tokens[0], $user->getSetting('signup_token'));
         $this->assertSame(null, $user->getSetting('external_email'));
 
         // Test the group plan
         Plan::where('title', 'group')->update(['mode' => 'token']);
 
         $this->browse(function (Browser $browser) use ($tokens) {
             $browser->visit(new Signup())
                 ->waitFor('@step0 .plan-group button')
                 ->click('@step0 .plan-group button')
                 // Step 1
                 ->whenAvailable('@step1', function ($browser) use ($tokens) {
                     $browser->assertSeeIn('.card-title', 'Sign Up - Step 1/2')
                         ->type('#signup_first_name', 'Test')
                         ->type('#signup_last_name', 'User')
                         ->assertMissing('#signup_email')
                         ->type('#signup_token', '1234')
                         // invalid token
                         ->click('[type=submit]')
                         ->waitFor('#signup_token.is-invalid')
                         ->assertVisible('#signup_token + .invalid-feedback')
                         ->assertFocused('#signup_token')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                         // valid token
                         ->type('#signup_token', $tokens[1])
                         ->click('[type=submit]');
                 })
                 // Step 2
                 ->whenAvailable('@step3', function ($browser) {
                     $browser->assertSeeIn('.card-title', 'Sign Up - Step 2/2')
                         ->type('input#signup_domain', 'user-domain-signup.com')
                         ->type('#signup_login', 'admin')
                         ->type('#signup_password', '12345678')
                         ->type('#signup_password_confirmation', '12345678')
                         ->click('[type=submit]');
                 })
                 ->waitUntilMissing('@step3')
                 ->on(new Dashboard())
                 ->within(new Menu(), function ($browser) {
                     $browser->clickMenuItem('logout');
                 });
         });
 
         $user = User::where('email', 'admin@user-domain-signup.com')->first();
         $this->assertSame($tokens[1], $user->getSetting('signup_token'));
         $this->assertSame(null, $user->getSetting('external_email'));
     }
 
     /**
      * Test signup with voucher
      */
     public function testSignupVoucherLink(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->visit('/signup/voucher/TEST')
                 ->onWithoutAssert(new Signup())
                 ->waitUntilMissing('.app-loader')
                 ->waitFor('@step0')
                 ->click('.plan-individual button')
                 ->whenAvailable('@step1', function (Browser $browser) {
                     $browser->type('#signup_first_name', 'Test')
                         ->type('#signup_last_name', 'User')
                         ->type('#signup_email', 'BrowserSignupTestUser1@kolab.org')
                         ->click('[type=submit]');
                 })
                 ->whenAvailable('@step2', function (Browser $browser) {
                     // Get the code and short_code from database
                     // FIXME: Find a nice way to read javascript data without using hidden inputs
                     $code = $browser->value('#signup_code');
 
                     $this->assertNotEmpty($code);
 
                     $code = SignupCode::find($code);
 
                     $browser->type('#signup_short_code', $code->short_code)
                         ->click('[type=submit]');
                 })
                 ->whenAvailable('@step3', function (Browser $browser) {
                     // Assert that the code is filled in the input
                     // Change it and test error handling
                     $browser->assertValue('#signup_voucher', 'TEST')
                         ->type('#signup_voucher', 'TESTXX')
                         ->type('#signup_login', 'signuptestdusk')
                         ->type('#signup_password', '123456789')
                         ->type('#signup_password_confirmation', '123456789')
                         ->click('[type=submit]')
                         ->waitFor('#signup_voucher.is-invalid')
                         ->assertVisible('#signup_voucher + .invalid-feedback')
                         ->assertFocused('#signup_voucher')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                         // Submit the correct code
                         ->type('#signup_voucher', 'TEST')
                         ->click('[type=submit]');
                 })
                 ->waitUntilMissing('@step3')
                 ->waitUntilMissing('.app-loader')
                 ->on(new Dashboard())
                 ->assertUser('signuptestdusk@' . \config('app.domain'))
                 // Logout the user
                 ->within(new Menu(), function ($browser) {
                     $browser->clickMenuItem('logout');
                 });
         });
 
         $user = $this->getTestUser('signuptestdusk@' . \config('app.domain'));
         $discount = Discount::where('code', 'TEST')->first();
         $this->assertSame($discount->id, $user->wallets()->first()->discount_id);
     }
 
     /**
      * Test signup via invitation link
      */
     public function testSignupInvitation(): void
     {
         // Test non-existing invitation
         $this->browse(function (Browser $browser) {
             $browser->visit('/signup/invite/TEST')
                 ->onWithoutAssert(new Signup())
                 ->waitFor('#app > #error-page')
                 ->assertErrorPage(404);
         });
 
         $invitation = SignupInvitation::create(['email' => 'test@domain.org']);
 
         $this->browse(function (Browser $browser) use ($invitation) {
             $browser->visit('/signup/invite/' . $invitation->id)
                 ->onWithoutAssert(new Signup())
                 ->waitUntilMissing('.app-loader')
                 ->with('@step3', function ($step) {
                     $domains_count = count(Domain::getPublicDomains());
 
                     $step->assertMissing('.card-title')
                         ->assertVisible('#signup_last_name')
                         ->assertVisible('#signup_first_name')
                         ->assertVisible('#signup_login')
                         ->assertVisible('#signup_password')
                         ->assertVisible('#signup_password_confirmation')
                         ->assertVisible('select#signup_domain')
                         ->assertElementsCount('select#signup_domain option', $domains_count, false)
                         ->assertVisible('[type=submit]')
                         ->assertMissing('[type=button]') // Back button
                         ->assertSeeIn('[type=submit]', 'Sign Up')
                         ->assertFocused('#signup_first_name')
                         ->assertValue('select#signup_domain', \config('app.domain'))
                         ->assertValue('#signup_first_name', '')
                         ->assertValue('#signup_last_name', '')
                         ->assertValue('#signup_login', '')
                         ->assertValue('#signup_password', '')
                         ->assertValue('#signup_password_confirmation', '');
 
                     // Submit invalid data
                     $step->type('#signup_login', '*')
                         ->type('#signup_password', '12345678')
                         ->type('#signup_password_confirmation', '123456789')
                         ->click('[type=submit]')
                         ->waitFor('#signup_login.is-invalid')
                         ->assertVisible('#signup_domain + .invalid-feedback')
                         ->assertVisible('#signup_password.is-invalid')
                         ->assertVisible('#signup_password_input .invalid-feedback')
                         ->assertFocused('#signup_login')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
 
                     // Submit valid data
                     $step->type('#signup_password_confirmation', '12345678')
                         ->type('#signup_login', 'signuptestdusk')
                         ->type('#signup_first_name', 'First')
                         ->type('#signup_last_name', 'Last')
                         ->click('[type=submit]');
                 })
                 // At this point we should be auto-logged-in to dashboard
                 ->waitUntilMissing('@step3')
                 ->waitUntilMissing('.app-loader')
                 ->on(new Dashboard())
                 ->assertUser('signuptestdusk@' . \config('app.domain'))
                 // Logout the user
                 ->within(new Menu(), function ($browser) {
                     $browser->clickMenuItem('logout');
                 });
         });
 
         $invitation->refresh();
         $user = User::where('email', 'signuptestdusk@' . \config('app.domain'))->first();
 
         $this->assertTrue($invitation->isCompleted());
         $this->assertSame($user->id, $invitation->user_id);
         $this->assertSame('First', $user->getSetting('first_name'));
         $this->assertSame('Last', $user->getSetting('last_name'));
         $this->assertSame($invitation->email, $user->getSetting('external_email'));
     }
 }
diff --git a/src/tests/Feature/Controller/PaymentsMollieEuroTest.php b/src/tests/Feature/Controller/PaymentsMollieEuroTest.php
index 9405fa7f..74b4720a 100644
--- a/src/tests/Feature/Controller/PaymentsMollieEuroTest.php
+++ b/src/tests/Feature/Controller/PaymentsMollieEuroTest.php
@@ -1,937 +1,937 @@
 <?php
 
 namespace Tests\Feature\Controller;
 
 use App\Http\Controllers\API\V4\PaymentsController;
 use App\Payment;
 use App\Providers\PaymentProvider;
 use App\Transaction;
 use App\Wallet;
 use App\WalletSetting;
 use GuzzleHttp\Psr7\Response;
 use Illuminate\Support\Facades\Bus;
 use Tests\TestCase;
 use Tests\BrowserAddonTrait;
 use Tests\MollieMocksTrait;
 
 class PaymentsMollieEuroTest extends TestCase
 {
     use MollieMocksTrait;
     use BrowserAddonTrait;
 
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         // All tests in this file use Mollie
         \config(['services.payment_provider' => 'mollie']);
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser('euro@' . \config('app.domain'));
 
         parent::tearDown();
     }
 
     /**
      * Test creating/updating/deleting an outo-payment mandate
      *
      * @group mollie
      */
     public function testMandates(): void
     {
         // Unauth access not allowed
         $response = $this->get("api/v4/payments/mandate");
         $response->assertStatus(401);
         $response = $this->post("api/v4/payments/mandate", []);
         $response->assertStatus(401);
         $response = $this->put("api/v4/payments/mandate", []);
         $response->assertStatus(401);
         $response = $this->delete("api/v4/payments/mandate");
         $response->assertStatus(401);
 
         $user = $this->getTestUser('euro@' . \config('app.domain'));
         $wallet = $user->wallets()->first();
         $wallet->currency = 'EUR';
         $wallet->save();
 
         // Test creating a mandate (invalid input)
         $post = [];
         $response = $this->actingAs($user)->post("api/v4/payments/mandate", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertSame('The amount field is required.', $json['errors']['amount'][0]);
         $this->assertSame('The balance field is required.', $json['errors']['balance'][0]);
 
         // Test creating a mandate (invalid input)
         $post = ['amount' => 100, 'balance' => 'a'];
         $response = $this->actingAs($user)->post("api/v4/payments/mandate", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertSame('The balance must be a number.', $json['errors']['balance'][0]);
 
         // Test creating a mandate (amount smaller than the minimum value)
         $post = ['amount' => -100, 'balance' => 0];
         $response = $this->actingAs($user)->post("api/v4/payments/mandate", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $min = $wallet->money(Payment::MIN_AMOUNT);
         $this->assertSame("Minimum amount for a single payment is {$min}.", $json['errors']['amount']);
         $this->assertMatchesRegularExpression("/[0-9.,]+ €\.$/", $json['errors']['amount']);
 
         // Test creating a mandate (negative balance, amount too small)
         Wallet::where('id', $wallet->id)->update(['balance' => -2000]);
         $post = ['amount' => Payment::MIN_AMOUNT / 100, 'balance' => 0];
         $response = $this->actingAs($user)->post("api/v4/payments/mandate", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertSame("The specified amount does not cover the balance on the account.", $json['errors']['amount']);
 
         // Test creating a mandate (valid input)
         $post = ['amount' => 20.10, 'balance' => 0, 'methodId' => PaymentProvider::METHOD_CREDITCARD];
         $response = $this->actingAs($user)->post("api/v4/payments/mandate", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertMatchesRegularExpression('|^https://www.mollie.com|', $json['redirectUrl']);
 
         // Assert the proper payment amount has been used
         $payment = Payment::where('id', $json['id'])->first();
         $this->assertSame(2010, $payment->amount);
         $this->assertSame($wallet->id, $payment->wallet_id);
         $this->assertSame($user->tenant->title . " Auto-Payment Setup", $payment->description);
         $this->assertSame(Payment::TYPE_MANDATE, $payment->type);
 
         // Test fetching the mandate information
         $response = $this->actingAs($user)->get("api/v4/payments/mandate");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals(20.10, $json['amount']);
         $this->assertEquals(0, $json['balance']);
         $this->assertEquals('Credit Card', $json['method']);
         $this->assertSame(true, $json['isPending']);
         $this->assertSame(false, $json['isValid']);
         $this->assertSame(false, $json['isDisabled']);
 
         $mandate_id = $json['id'];
 
         // We would have to invoke a browser to accept the "first payment" to make
         // the mandate validated/completed. Instead, we'll mock the mandate object.
         $mollie_response = [
             'resource' => 'mandate',
             'id' => $mandate_id,
             'status' => 'valid',
             'method' => 'creditcard',
             'details' => [
                 'cardNumber' => '4242',
                 'cardLabel' => 'Visa',
             ],
             'customerId' => 'cst_GMfxGPt7Gj',
             'createdAt' => '2020-04-28T11:09:47+00:00',
         ];
 
         $responseStack = $this->mockMollie();
         $responseStack->append(new Response(200, [], json_encode($mollie_response)));
 
         $wallet = $user->wallets()->first();
         $wallet->setSetting('mandate_disabled', 1);
 
         $response = $this->actingAs($user)->get("api/v4/payments/mandate");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals(20.10, $json['amount']);
         $this->assertEquals(0, $json['balance']);
         $this->assertEquals('Visa (**** **** **** 4242)', $json['method']);
         $this->assertSame(false, $json['isPending']);
         $this->assertSame(true, $json['isValid']);
         $this->assertSame(true, $json['isDisabled']);
 
         Bus::fake();
         $wallet->setSetting('mandate_disabled', null);
         $wallet->balance = 1000;
         $wallet->save();
 
         // Test updating mandate details (invalid input)
         $post = [];
         $response = $this->actingAs($user)->put("api/v4/payments/mandate", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertSame('The amount field is required.', $json['errors']['amount'][0]);
         $this->assertSame('The balance field is required.', $json['errors']['balance'][0]);
 
         $post = ['amount' => -100, 'balance' => 0];
         $response = $this->actingAs($user)->put("api/v4/payments/mandate", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertSame("Minimum amount for a single payment is {$min}.", $json['errors']['amount']);
         $this->assertMatchesRegularExpression("/[0-9.,]+ €\.$/", $json['errors']['amount']);
 
         // Test updating a mandate (valid input)
         $responseStack->append(new Response(200, [], json_encode($mollie_response)));
 
         $post = ['amount' => 30.10, 'balance' => 10];
         $response = $this->actingAs($user)->put("api/v4/payments/mandate", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame('The auto-payment has been updated.', $json['message']);
         $this->assertSame($mandate_id, $json['id']);
         $this->assertFalse($json['isDisabled']);
 
         $wallet->refresh();
 
         $this->assertEquals(30.10, $wallet->getSetting('mandate_amount'));
         $this->assertEquals(10, $wallet->getSetting('mandate_balance'));
 
         Bus::assertDispatchedTimes(\App\Jobs\WalletCharge::class, 0);
 
         // Test updating a disabled mandate (invalid input)
         $wallet->setSetting('mandate_disabled', 1);
         $wallet->balance = -2000;
         $wallet->save();
         $user->refresh(); // required so the controller sees the wallet update from above
 
         $post = ['amount' => 15.10, 'balance' => 1];
         $response = $this->actingAs($user)->put("api/v4/payments/mandate", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertSame('The specified amount does not cover the balance on the account.', $json['errors']['amount']);
 
         // Test updating a disabled mandate (valid input)
         $responseStack->append(new Response(200, [], json_encode($mollie_response)));
 
         $post = ['amount' => 30, 'balance' => 1];
         $response = $this->actingAs($user)->put("api/v4/payments/mandate", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame('The auto-payment has been updated.', $json['message']);
         $this->assertSame($mandate_id, $json['id']);
         $this->assertFalse($json['isDisabled']);
 
         Bus::assertDispatchedTimes(\App\Jobs\WalletCharge::class, 1);
         Bus::assertDispatched(\App\Jobs\WalletCharge::class, function ($job) use ($wallet) {
             $job_wallet = $this->getObjectProperty($job, 'wallet');
             return $job_wallet->id === $wallet->id;
         });
 
         $this->unmockMollie();
 
         // Delete mandate
         $response = $this->actingAs($user)->delete("api/v4/payments/mandate");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame('The auto-payment has been removed.', $json['message']);
 
         // Confirm with Mollie the mandate does not exist
         $customer_id = $wallet->getSetting('mollie_id');
         $this->expectException(\Mollie\Api\Exceptions\ApiException::class);
         $this->expectExceptionMessageMatches('/410: Gone/');
         $mandate = mollie()->mandates()->getForId($customer_id, $mandate_id);
 
         $this->assertNull($wallet->fresh()->getSetting('mollie_mandate_id'));
 
         // Test Mollie's "410 Gone" response handling when fetching the mandate info
         // It is expected to remove the mandate reference
         $mollie_response = [
             'status' => 410,
             'title' => "Gone",
             'detail' => "You are trying to access an object, which has previously been deleted",
             '_links' => [
                 'documentation' => [
                     'href' => "https://docs.mollie.com/errors",
                     'type' => "text/html"
                 ]
             ]
         ];
 
         $responseStack = $this->mockMollie();
         $responseStack->append(new Response(410, [], json_encode($mollie_response)));
 
         $wallet->fresh()->setSetting('mollie_mandate_id', '123');
 
         $response = $this->actingAs($user)->get("api/v4/payments/mandate");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertFalse(array_key_exists('id', $json));
         $this->assertFalse(array_key_exists('method', $json));
         $this->assertNull($wallet->fresh()->getSetting('mollie_mandate_id'));
     }
 
     /**
      * Test creating a payment and receiving a status via webhook
      *
      * @group mollie
      */
     public function testStoreAndWebhook(): void
     {
         Bus::fake();
 
         // Unauth access not allowed
         $response = $this->post("api/v4/payments", []);
         $response->assertStatus(401);
 
         $user = $this->getTestUser('euro@' . \config('app.domain'));
         $wallet = $user->wallets()->first();
         $wallet->currency = 'EUR';
         $wallet->save();
 
         // Invalid amount
         $post = ['amount' => -1];
         $response = $this->actingAs($user)->post("api/v4/payments", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $min = $wallet->money(Payment::MIN_AMOUNT);
         $this->assertSame("Minimum amount for a single payment is {$min}.", $json['errors']['amount']);
         $this->assertMatchesRegularExpression("/[0-9.,]+ €\.$/", $json['errors']['amount']);
 
         // Invalid currency
         $post = ['amount' => '12.34', 'currency' => 'FOO', 'methodId' => 'creditcard'];
         $response = $this->actingAs($user)->post("api/v4/payments", $post);
         $response->assertStatus(500);
 
         // Successful payment
         $post = ['amount' => '12.34', 'currency' => 'EUR', 'methodId' => 'creditcard'];
         $response = $this->actingAs($user)->post("api/v4/payments", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertMatchesRegularExpression('|^https://www.mollie.com|', $json['redirectUrl']);
 
         $payments = Payment::where('wallet_id', $wallet->id)->get();
 
         $this->assertCount(1, $payments);
         $payment = $payments[0];
         $this->assertSame(1234, $payment->amount);
         $this->assertSame(1234, $payment->currency_amount);
         $this->assertSame('EUR', $payment->currency);
         $this->assertSame($user->tenant->title . ' Payment', $payment->description);
         $this->assertSame('open', $payment->status);
         $this->assertEquals(0, $wallet->balance);
 
         // Test the webhook
         // Note: Webhook end-point does not require authentication
 
         $mollie_response = [
             "resource" => "payment",
             "id" => $payment->id,
             "status" => "paid",
             // Status is not enough, paidAt is used to distinguish the state
             "paidAt" => date('c'),
             "mode" => "test",
         ];
 
         // We'll trigger the webhook with payment id and use mocking for
         // a request to the Mollie payments API. We cannot force Mollie
         // to make the payment status change.
         $responseStack = $this->mockMollie();
         $responseStack->append(new Response(200, [], json_encode($mollie_response)));
 
         $post = ['id' => $payment->id];
         $response = $this->post("api/webhooks/payment/mollie", $post);
         $response->assertStatus(200);
 
         $this->assertSame(Payment::STATUS_PAID, $payment->fresh()->status);
         $this->assertEquals(1234, $wallet->fresh()->balance);
 
         $transaction = $wallet->transactions()
             ->where('type', Transaction::WALLET_CREDIT)->get()->last();
 
         $this->assertSame(1234, $transaction->amount);
         $this->assertSame(
             "Payment transaction {$payment->id} using Mollie",
             $transaction->description
         );
 
         // Assert that email notification job wasn't dispatched,
         // it is expected only for recurring payments
         Bus::assertDispatchedTimes(\App\Jobs\PaymentEmail::class, 0);
 
         // Verify "paid -> open -> paid" scenario, assert that balance didn't change
         $mollie_response['status'] = 'open';
         unset($mollie_response['paidAt']);
         $responseStack->append(new Response(200, [], json_encode($mollie_response)));
 
         $response = $this->post("api/webhooks/payment/mollie", $post);
         $response->assertStatus(200);
 
         $this->assertSame(Payment::STATUS_PAID, $payment->fresh()->status);
         $this->assertEquals(1234, $wallet->fresh()->balance);
 
         $mollie_response['status'] = 'paid';
         $mollie_response['paidAt'] = date('c');
         $responseStack->append(new Response(200, [], json_encode($mollie_response)));
 
         $response = $this->post("api/webhooks/payment/mollie", $post);
         $response->assertStatus(200);
 
         $this->assertSame(Payment::STATUS_PAID, $payment->fresh()->status);
         $this->assertEquals(1234, $wallet->fresh()->balance);
 
         // Test for payment failure
         Bus::fake();
 
         $payment->refresh();
         $payment->status = Payment::STATUS_OPEN;
         $payment->save();
 
         $mollie_response = [
             "resource" => "payment",
             "id" => $payment->id,
             "status" => "failed",
             "mode" => "test",
         ];
 
         // We'll trigger the webhook with payment id and use mocking for
         // a request to the Mollie payments API. We cannot force Mollie
         // to make the payment status change.
         $responseStack = $this->mockMollie();
         $responseStack->append(new Response(200, [], json_encode($mollie_response)));
 
         $response = $this->post("api/webhooks/payment/mollie", $post);
         $response->assertStatus(200);
 
         $this->assertSame('failed', $payment->fresh()->status);
         $this->assertEquals(1234, $wallet->fresh()->balance);
 
         // Assert that email notification job wasn't dispatched,
         // it is expected only for recurring payments
         Bus::assertDispatchedTimes(\App\Jobs\PaymentEmail::class, 0);
     }
 
     /**
      * Test automatic payment charges
      *
      * @group mollie
      */
     public function testTopUp(): void
     {
         Bus::fake();
 
         $user = $this->getTestUser('euro@' . \config('app.domain'));
         $wallet = $user->wallets()->first();
         $wallet->currency = 'EUR';
         $wallet->save();
 
         // Create a valid mandate first (balance=0, so there's no extra payment yet)
         $this->createMandate($wallet, ['amount' => 20.10, 'balance' => 0, 'methodId' => 'creditcard']);
 
         $wallet->setSetting('mandate_balance', 10);
 
         // Expect a recurring payment as we have a valid mandate at this point
         // and the balance is below the threshold
         $result = PaymentsController::topUpWallet($wallet);
         $this->assertTrue($result);
 
         // Check that the payments table contains a new record with proper amount.
         // There should be two records, one for the mandate payment and another for
         // the top-up payment
         $payments = $wallet->payments()->orderBy('amount')->get();
         $this->assertCount(2, $payments);
         $this->assertSame(0, $payments[0]->amount);
         $this->assertSame(0, $payments[0]->currency_amount);
         $this->assertSame(2010, $payments[1]->amount);
         $this->assertSame(2010, $payments[1]->currency_amount);
         $payment = $payments[1];
 
         // In mollie we don't have to wait for a webhook, the response to
         // PaymentIntent already sets the status to 'paid', so we can test
         // immediately the balance update
         // Assert that email notification job has been dispatched
         $this->assertSame(Payment::STATUS_PAID, $payment->status);
         $this->assertEquals(2010, $wallet->fresh()->balance);
         $transaction = $wallet->transactions()
             ->where('type', Transaction::WALLET_CREDIT)->get()->last();
 
         $this->assertSame(2010, $transaction->amount);
         $this->assertSame(
-            "Auto-payment transaction {$payment->id} using Mastercard (**** **** **** 9399)",
+            "Auto-payment transaction {$payment->id} using Mastercard (**** **** **** 6787)",
             $transaction->description
         );
 
         Bus::assertDispatchedTimes(\App\Jobs\PaymentEmail::class, 1);
         Bus::assertDispatched(\App\Jobs\PaymentEmail::class, function ($job) use ($payment) {
             $job_payment = $this->getObjectProperty($job, 'payment');
             return $job_payment->id === $payment->id;
         });
 
         // Expect no payment if the mandate is disabled
         $wallet->setSetting('mandate_disabled', 1);
         $result = PaymentsController::topUpWallet($wallet);
         $this->assertFalse($result);
         $this->assertCount(2, $wallet->payments()->get());
 
         // Expect no payment if balance is ok
         $wallet->setSetting('mandate_disabled', null);
         $wallet->balance = 1000;
         $wallet->save();
         $result = PaymentsController::topUpWallet($wallet);
         $this->assertFalse($result);
         $this->assertCount(2, $wallet->payments()->get());
 
         // Expect no payment if the top-up amount is not enough
         $wallet->setSetting('mandate_disabled', null);
         $wallet->balance = -2050;
         $wallet->save();
         $result = PaymentsController::topUpWallet($wallet);
         $this->assertFalse($result);
         $this->assertCount(2, $wallet->payments()->get());
 
         Bus::assertDispatchedTimes(\App\Jobs\PaymentMandateDisabledEmail::class, 1);
         Bus::assertDispatched(\App\Jobs\PaymentMandateDisabledEmail::class, function ($job) use ($wallet) {
             $job_wallet = $this->getObjectProperty($job, 'wallet');
             return $job_wallet->id === $wallet->id;
         });
 
         // Expect no payment if there's no mandate
         $wallet->setSetting('mollie_mandate_id', null);
         $wallet->balance = 0;
         $wallet->save();
         $result = PaymentsController::topUpWallet($wallet);
         $this->assertFalse($result);
         $this->assertCount(2, $wallet->payments()->get());
 
         Bus::assertDispatchedTimes(\App\Jobs\PaymentMandateDisabledEmail::class, 1);
 
         // Test webhook for recurring payments
 
         $wallet->transactions()->delete();
 
         $responseStack = $this->mockMollie();
         Bus::fake();
 
         $payment->refresh();
         $payment->status = Payment::STATUS_OPEN;
         $payment->save();
 
         $mollie_response = [
             "resource" => "payment",
             "id" => $payment->id,
             "status" => "paid",
             // Status is not enough, paidAt is used to distinguish the state
             "paidAt" => date('c'),
             "mode" => "test",
         ];
 
         // We'll trigger the webhook with payment id and use mocking for
         // a request to the Mollie payments API. We cannot force Mollie
         // to make the payment status change.
         $responseStack->append(new Response(200, [], json_encode($mollie_response)));
 
         $post = ['id' => $payment->id];
         $response = $this->post("api/webhooks/payment/mollie", $post);
         $response->assertStatus(200);
 
         $this->assertSame(Payment::STATUS_PAID, $payment->fresh()->status);
         $this->assertEquals(2010, $wallet->fresh()->balance);
 
         $transaction = $wallet->transactions()
             ->where('type', Transaction::WALLET_CREDIT)->get()->last();
 
         $this->assertSame(2010, $transaction->amount);
         $this->assertSame(
             "Auto-payment transaction {$payment->id} using Mollie",
             $transaction->description
         );
 
         // Assert that email notification job has been dispatched
         Bus::assertDispatchedTimes(\App\Jobs\PaymentEmail::class, 1);
         Bus::assertDispatched(\App\Jobs\PaymentEmail::class, function ($job) use ($payment) {
             $job_payment = $this->getObjectProperty($job, 'payment');
             return $job_payment->id === $payment->id;
         });
 
         Bus::fake();
 
         // Test for payment failure
         $payment->refresh();
         $payment->status = Payment::STATUS_OPEN;
         $payment->save();
 
         $wallet->setSetting('mollie_mandate_id', 'xxx');
         $wallet->setSetting('mandate_disabled', null);
 
         $mollie_response = [
             "resource" => "payment",
             "id" => $payment->id,
             "status" => "failed",
             "mode" => "test",
         ];
 
         $responseStack->append(new Response(200, [], json_encode($mollie_response)));
 
         $response = $this->post("api/webhooks/payment/mollie", $post);
         $response->assertStatus(200);
 
         $wallet->refresh();
 
         $this->assertSame(Payment::STATUS_FAILED, $payment->fresh()->status);
         $this->assertEquals(2010, $wallet->balance);
         $this->assertTrue(!empty($wallet->getSetting('mandate_disabled')));
 
         // Assert that email notification job has been dispatched
         Bus::assertDispatchedTimes(\App\Jobs\PaymentEmail::class, 1);
         Bus::assertDispatched(\App\Jobs\PaymentEmail::class, function ($job) use ($payment) {
             $job_payment = $this->getObjectProperty($job, 'payment');
             return $job_payment->id === $payment->id;
         });
 
         $this->unmockMollie();
     }
 
     /**
      * Test refund/chargeback handling by the webhook
      *
      * @group mollie
      */
     public function testRefundAndChargeback(): void
     {
         Bus::fake();
 
         $user = $this->getTestUser('euro@' . \config('app.domain'));
         $wallet = $user->wallets()->first();
         $wallet->currency = 'EUR';
         $wallet->save();
         $wallet->transactions()->delete();
 
         $mollie = PaymentProvider::factory('mollie');
 
         // Create a paid payment
         $payment = Payment::create([
                 'id' => 'tr_123456',
                 'status' => Payment::STATUS_PAID,
                 'amount' => 123,
                 'credit_amount' => 123,
                 'currency_amount' => 123,
                 'currency' => 'EUR',
                 'type' => Payment::TYPE_ONEOFF,
                 'wallet_id' => $wallet->id,
                 'provider' => 'mollie',
                 'description' => 'test',
         ]);
 
         // Test handling a refund by the webhook
 
         $mollie_response1 = [
             "resource" => "payment",
             "id" => $payment->id,
             "status" => "paid",
             // Status is not enough, paidAt is used to distinguish the state
             "paidAt" => date('c'),
             "mode" => "test",
             "_links" => [
                 "refunds" => [
                    "href" => "https://api.mollie.com/v2/payments/{$payment->id}/refunds",
                    "type" => "application/hal+json"
                 ]
             ]
         ];
 
         $mollie_response2 = [
             "count" => 1,
             "_links" => [],
             "_embedded" => [
                 "refunds" => [
                     [
                         "resource" => "refund",
                         "id" => "re_123456",
                         "status" => \Mollie\Api\Types\RefundStatus::STATUS_REFUNDED,
                         "paymentId" => $payment->id,
                         "description" => "refund desc",
                         "amount" => [
                             "currency" => "EUR",
                             "value" => "1.01",
                         ],
                     ]
                 ]
             ]
         ];
 
         // We'll trigger the webhook with payment id and use mocking for
         // requests to the Mollie payments API.
         $responseStack = $this->mockMollie();
         $responseStack->append(new Response(200, [], json_encode($mollie_response1)));
         $responseStack->append(new Response(200, [], json_encode($mollie_response2)));
 
         $post = ['id' => $payment->id];
         $response = $this->post("api/webhooks/payment/mollie", $post);
         $response->assertStatus(200);
 
         $wallet->refresh();
 
         $this->assertEquals(-101, $wallet->balance);
 
         $transactions = $wallet->transactions()->where('type', Transaction::WALLET_REFUND)->get();
 
         $this->assertCount(1, $transactions);
         $this->assertSame(-101, $transactions[0]->amount);
         $this->assertSame(Transaction::WALLET_REFUND, $transactions[0]->type);
         $this->assertSame("refund desc", $transactions[0]->description);
 
         $payments = $wallet->payments()->where('id', 're_123456')->get();
 
         $this->assertCount(1, $payments);
         $this->assertSame(-101, $payments[0]->amount);
         $this->assertSame(-101, $payments[0]->currency_amount);
         $this->assertSame(Payment::STATUS_PAID, $payments[0]->status);
         $this->assertSame(Payment::TYPE_REFUND, $payments[0]->type);
         $this->assertSame("mollie", $payments[0]->provider);
         $this->assertSame("refund desc", $payments[0]->description);
 
         // Test handling a chargeback by the webhook
 
         $mollie_response1["_links"] = [
             "chargebacks" => [
                "href" => "https://api.mollie.com/v2/payments/{$payment->id}/chargebacks",
                "type" => "application/hal+json"
             ]
         ];
 
         $mollie_response2 = [
             "count" => 1,
             "_links" => [],
             "_embedded" => [
                 "chargebacks" => [
                     [
                         "resource" => "chargeback",
                         "id" => "chb_123456",
                         "paymentId" => $payment->id,
                         "amount" => [
                             "currency" => "EUR",
                             "value" => "0.15",
                         ],
                     ]
                 ]
             ]
         ];
 
         // We'll trigger the webhook with payment id and use mocking for
         // requests to the Mollie payments API.
         $responseStack = $this->mockMollie();
         $responseStack->append(new Response(200, [], json_encode($mollie_response1)));
         $responseStack->append(new Response(200, [], json_encode($mollie_response2)));
 
         $post = ['id' => $payment->id];
         $response = $this->post("api/webhooks/payment/mollie", $post);
         $response->assertStatus(200);
 
         $wallet->refresh();
 
         $this->assertEquals(-116, $wallet->balance);
 
         $transactions = $wallet->transactions()->where('type', Transaction::WALLET_CHARGEBACK)->get();
 
         $this->assertCount(1, $transactions);
         $this->assertSame(-15, $transactions[0]->amount);
         $this->assertSame(Transaction::WALLET_CHARGEBACK, $transactions[0]->type);
         $this->assertSame('', $transactions[0]->description);
 
         $payments = $wallet->payments()->where('id', 'chb_123456')->get();
 
         $this->assertCount(1, $payments);
         $this->assertSame(-15, $payments[0]->amount);
         $this->assertSame(Payment::STATUS_PAID, $payments[0]->status);
         $this->assertSame(Payment::TYPE_CHARGEBACK, $payments[0]->type);
         $this->assertSame("mollie", $payments[0]->provider);
         $this->assertSame('', $payments[0]->description);
 
         Bus::assertNotDispatched(\App\Jobs\PaymentEmail::class);
 
         $this->unmockMollie();
     }
 
     /**
      * Create Mollie's auto-payment mandate using our API and Chrome browser
      */
     protected function createMandate(Wallet $wallet, array $params)
     {
         // Use the API to create a first payment with a mandate
         $response = $this->actingAs($wallet->owner)->post("api/v4/payments/mandate", $params);
         $response->assertStatus(200);
         $json = $response->json();
 
         // There's no easy way to confirm a created mandate.
         // The only way seems to be to fire up Chrome on checkout page
         // and do actions with use of Dusk browser.
         $this->startBrowser()->visit($json['redirectUrl']);
 
         $molliePage = new \Tests\Browser\Pages\PaymentMollie();
         $molliePage->assert($this->browser);
         $molliePage->submitPayment($this->browser, 'paid');
 
         $this->stopBrowser();
     }
 
     /**
      * Test listing a pending payment
      *
      * @group mollie
      */
     public function testListingPayments(): void
     {
         Bus::fake();
 
         $user = $this->getTestUser('euro@' . \config('app.domain'));
         $wallet = $user->wallets()->first();
         $wallet->currency = 'EUR';
         $wallet->save();
 
         //Empty response
         $response = $this->actingAs($user)->get("api/v4/payments/pending");
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame(0, $json['count']);
         $this->assertSame(1, $json['page']);
         $this->assertSame(false, $json['hasMore']);
         $this->assertCount(0, $json['list']);
 
         $response = $this->actingAs($user)->get("api/v4/payments/has-pending");
         $json = $response->json();
         $this->assertSame(false, $json['hasPending']);
 
         // Successful payment
         $post = ['amount' => '12.34', 'currency' => 'EUR', 'methodId' => 'creditcard'];
         $response = $this->actingAs($user)->post("api/v4/payments", $post);
         $response->assertStatus(200);
 
         //A response
         $response = $this->actingAs($user)->get("api/v4/payments/pending");
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame(1, $json['count']);
         $this->assertSame(1, $json['page']);
         $this->assertSame(false, $json['hasMore']);
         $this->assertCount(1, $json['list']);
         $this->assertSame(Payment::STATUS_OPEN, $json['list'][0]['status']);
         $this->assertSame('EUR', $json['list'][0]['currency']);
         $this->assertSame(Payment::TYPE_ONEOFF, $json['list'][0]['type']);
         $this->assertSame(1234, $json['list'][0]['amount']);
 
         $response = $this->actingAs($user)->get("api/v4/payments/has-pending");
         $json = $response->json();
         $this->assertSame(true, $json['hasPending']);
 
         // Set the payment to paid
         $payments = Payment::where('wallet_id', $wallet->id)->get();
 
         $this->assertCount(1, $payments);
         $payment = $payments[0];
 
         $payment->status = Payment::STATUS_PAID;
         $payment->save();
 
         // They payment should be gone from the pending list now
         $response = $this->actingAs($user)->get("api/v4/payments/pending");
         $json = $response->json();
         $this->assertSame('success', $json['status']);
         $this->assertSame(0, $json['count']);
         $this->assertCount(0, $json['list']);
 
         $response = $this->actingAs($user)->get("api/v4/payments/has-pending");
         $json = $response->json();
         $this->assertSame(false, $json['hasPending']);
     }
 
     /**
      * Test listing payment methods
      *
      * @group mollie
      */
     public function testListingPaymentMethods(): void
     {
         Bus::fake();
 
         $user = $this->getTestUser('euro@' . \config('app.domain'));
         $wallet = $user->wallets()->first();
         $wallet->currency = 'EUR';
         $wallet->save();
 
         $response = $this->actingAs($user)->get('api/v4/payments/methods?type=' . Payment::TYPE_ONEOFF);
         $response->assertStatus(200);
         $json = $response->json();
 
         $hasCoinbase = !empty(\config('services.coinbase.key'));
 
         $this->assertCount(3 + intval($hasCoinbase), $json);
         $this->assertSame('creditcard', $json[0]['id']);
         $this->assertSame('paypal', $json[1]['id']);
         $this->assertSame('banktransfer', $json[2]['id']);
         $this->assertSame('EUR', $json[0]['currency']);
         $this->assertSame('EUR', $json[1]['currency']);
         $this->assertSame('EUR', $json[2]['currency']);
         $this->assertSame(1, $json[0]['exchangeRate']);
         $this->assertSame(1, $json[1]['exchangeRate']);
         $this->assertSame(1, $json[2]['exchangeRate']);
 
         if ($hasCoinbase) {
             $this->assertSame('bitcoin', $json[3]['id']);
             $this->assertSame('BTC', $json[3]['currency']);
         }
 
         $response = $this->actingAs($user)->get('api/v4/payments/methods?type=' . Payment::TYPE_RECURRING);
         $response->assertStatus(200);
         $json = $response->json();
 
         $this->assertCount(1, $json);
         $this->assertSame('creditcard', $json[0]['id']);
         $this->assertSame('EUR', $json[0]['currency']);
     }
 }
diff --git a/src/tests/Feature/Controller/PaymentsMollieTest.php b/src/tests/Feature/Controller/PaymentsMollieTest.php
index 36d1030e..6aa7d175 100644
--- a/src/tests/Feature/Controller/PaymentsMollieTest.php
+++ b/src/tests/Feature/Controller/PaymentsMollieTest.php
@@ -1,1152 +1,1193 @@
 <?php
 
 namespace Tests\Feature\Controller;
 
 use App\Http\Controllers\API\V4\PaymentsController;
 use App\Payment;
+use App\Plan;
 use App\Providers\PaymentProvider;
 use App\Transaction;
 use App\Wallet;
 use App\WalletSetting;
 use App\VatRate;
 use App\Utils;
 use GuzzleHttp\Psr7\Response;
 use Illuminate\Support\Facades\Bus;
 use Tests\TestCase;
 use Tests\BrowserAddonTrait;
 use Tests\MollieMocksTrait;
 
 class PaymentsMollieTest extends TestCase
 {
     use MollieMocksTrait;
     use BrowserAddonTrait;
 
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         // All tests in this file use Mollie
         \config(['services.payment_provider' => 'mollie']);
         \config(['app.vat.mode' => 0]);
         Utils::setTestExchangeRates(['EUR' => '0.90503424978382']);
 
         $this->deleteTestUser('payment-test@' . \config('app.domain'));
 
         $john = $this->getTestUser('john@kolab.org');
         $wallet = $john->wallets()->first();
         Payment::query()->delete();
         VatRate::query()->delete();
         Wallet::where('id', $wallet->id)->update(['balance' => 0]);
         WalletSetting::where('wallet_id', $wallet->id)->delete();
         $types = [
             Transaction::WALLET_CREDIT,
             Transaction::WALLET_REFUND,
             Transaction::WALLET_CHARGEBACK,
         ];
         Transaction::where('object_id', $wallet->id)->whereIn('type', $types)->delete();
+        Plan::withEnvTenantContext()->where('title', 'individual')->update(['mode' => 'email', 'months' => 1]);
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser('payment-test@' . \config('app.domain'));
 
         $john = $this->getTestUser('john@kolab.org');
         $wallet = $john->wallets()->first();
         Payment::query()->delete();
         VatRate::query()->delete();
         Wallet::where('id', $wallet->id)->update(['balance' => 0]);
         WalletSetting::where('wallet_id', $wallet->id)->delete();
         $types = [
             Transaction::WALLET_CREDIT,
             Transaction::WALLET_REFUND,
             Transaction::WALLET_CHARGEBACK,
         ];
         Transaction::where('object_id', $wallet->id)->whereIn('type', $types)->delete();
+        Plan::withEnvTenantContext()->where('title', 'individual')->update(['mode' => 'email', 'months' => 1]);
         Utils::setTestExchangeRates([]);
 
         parent::tearDown();
     }
 
     /**
      * Test creating/updating/deleting an outo-payment mandate
      *
      * @group mollie
      */
     public function testMandates(): void
     {
         // Unauth access not allowed
         $response = $this->get("api/v4/payments/mandate");
         $response->assertStatus(401);
         $response = $this->post("api/v4/payments/mandate", []);
         $response->assertStatus(401);
         $response = $this->put("api/v4/payments/mandate", []);
         $response->assertStatus(401);
         $response = $this->delete("api/v4/payments/mandate");
         $response->assertStatus(401);
 
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
 
         // Test creating a mandate (invalid input)
         $post = [];
         $response = $this->actingAs($user)->post("api/v4/payments/mandate", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertSame('The amount field is required.', $json['errors']['amount'][0]);
         $this->assertSame('The balance field is required.', $json['errors']['balance'][0]);
 
         // Test creating a mandate (invalid input)
         $post = ['amount' => 100, 'balance' => 'a'];
         $response = $this->actingAs($user)->post("api/v4/payments/mandate", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertSame('The balance must be a number.', $json['errors']['balance'][0]);
 
         // Test creating a mandate (amount smaller than the minimum value)
         $post = ['amount' => -100, 'balance' => 0];
         $response = $this->actingAs($user)->post("api/v4/payments/mandate", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $min = $wallet->money(Payment::MIN_AMOUNT);
         $this->assertSame("Minimum amount for a single payment is {$min}.", $json['errors']['amount']);
 
         // Test creating a mandate (negative balance, amount too small)
         Wallet::where('id', $wallet->id)->update(['balance' => -2000]);
         $post = ['amount' => Payment::MIN_AMOUNT / 100, 'balance' => 0];
         $response = $this->actingAs($user)->post("api/v4/payments/mandate", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertSame("The specified amount does not cover the balance on the account.", $json['errors']['amount']);
 
         // Test creating a mandate (valid input)
         $post = ['amount' => 20.10, 'balance' => 0, 'methodId' => PaymentProvider::METHOD_CREDITCARD];
         $response = $this->actingAs($user)->post("api/v4/payments/mandate", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertMatchesRegularExpression('|^https://www.mollie.com|', $json['redirectUrl']);
 
         // Assert the proper payment amount has been used
         $payment = Payment::where('id', $json['id'])->first();
         $this->assertSame(2010, $payment->amount);
         $this->assertSame($wallet->id, $payment->wallet_id);
         $this->assertSame($user->tenant->title . " Auto-Payment Setup", $payment->description);
         $this->assertSame(Payment::TYPE_MANDATE, $payment->type);
 
         // Test fetching the mandate information
         $response = $this->actingAs($user)->get("api/v4/payments/mandate");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals(20.10, $json['amount']);
         $this->assertEquals(0, $json['balance']);
         $this->assertEquals('Credit Card', $json['method']);
         $this->assertSame(true, $json['isPending']);
         $this->assertSame(false, $json['isValid']);
         $this->assertSame(false, $json['isDisabled']);
 
         $mandate_id = $json['id'];
 
         // We would have to invoke a browser to accept the "first payment" to make
         // the mandate validated/completed. Instead, we'll mock the mandate object.
         $mollie_response = [
             'resource' => 'mandate',
             'id' => $mandate_id,
             'status' => 'valid',
             'method' => 'creditcard',
             'details' => [
                 'cardNumber' => '4242',
                 'cardLabel' => 'Visa',
             ],
             'customerId' => 'cst_GMfxGPt7Gj',
             'createdAt' => '2020-04-28T11:09:47+00:00',
         ];
 
         $responseStack = $this->mockMollie();
         $responseStack->append(new Response(200, [], json_encode($mollie_response)));
 
         $wallet = $user->wallets()->first();
         $wallet->setSetting('mandate_disabled', 1);
 
         $response = $this->actingAs($user)->get("api/v4/payments/mandate");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals(20.10, $json['amount']);
         $this->assertEquals(0, $json['balance']);
         $this->assertEquals('Visa (**** **** **** 4242)', $json['method']);
         $this->assertSame(false, $json['isPending']);
         $this->assertSame(true, $json['isValid']);
         $this->assertSame(true, $json['isDisabled']);
 
         Bus::fake();
         $wallet->setSetting('mandate_disabled', null);
         $wallet->balance = 1000;
         $wallet->save();
 
         // Test updating mandate details (invalid input)
         $post = [];
         $response = $this->actingAs($user)->put("api/v4/payments/mandate", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertSame('The amount field is required.', $json['errors']['amount'][0]);
         $this->assertSame('The balance field is required.', $json['errors']['balance'][0]);
 
         $post = ['amount' => -100, 'balance' => 0];
         $response = $this->actingAs($user)->put("api/v4/payments/mandate", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertSame("Minimum amount for a single payment is {$min}.", $json['errors']['amount']);
 
         // Test updating a mandate (valid input)
         $responseStack->append(new Response(200, [], json_encode($mollie_response)));
 
         $post = ['amount' => 30.10, 'balance' => 10];
         $response = $this->actingAs($user)->put("api/v4/payments/mandate", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame('The auto-payment has been updated.', $json['message']);
         $this->assertSame($mandate_id, $json['id']);
         $this->assertFalse($json['isDisabled']);
 
         $wallet->refresh();
 
         $this->assertEquals(30.10, $wallet->getSetting('mandate_amount'));
         $this->assertEquals(10, $wallet->getSetting('mandate_balance'));
 
         Bus::assertDispatchedTimes(\App\Jobs\WalletCharge::class, 0);
 
         // Test updating a disabled mandate (invalid input)
         $wallet->setSetting('mandate_disabled', 1);
         $wallet->balance = -2000;
         $wallet->save();
         $user->refresh(); // required so the controller sees the wallet update from above
 
         $post = ['amount' => 15.10, 'balance' => 1];
         $response = $this->actingAs($user)->put("api/v4/payments/mandate", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertSame('The specified amount does not cover the balance on the account.', $json['errors']['amount']);
 
         // Test updating a disabled mandate (valid input)
         $responseStack->append(new Response(200, [], json_encode($mollie_response)));
 
         $post = ['amount' => 30, 'balance' => 1];
         $response = $this->actingAs($user)->put("api/v4/payments/mandate", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame('The auto-payment has been updated.', $json['message']);
         $this->assertSame($mandate_id, $json['id']);
         $this->assertFalse($json['isDisabled']);
 
         Bus::assertDispatchedTimes(\App\Jobs\WalletCharge::class, 1);
         Bus::assertDispatched(\App\Jobs\WalletCharge::class, function ($job) use ($wallet) {
             $job_wallet = $this->getObjectProperty($job, 'wallet');
             return $job_wallet->id === $wallet->id;
         });
 
         $this->unmockMollie();
 
         // Delete mandate
         $response = $this->actingAs($user)->delete("api/v4/payments/mandate");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame('The auto-payment has been removed.', $json['message']);
 
         // Confirm with Mollie the mandate does not exist
         $customer_id = $wallet->getSetting('mollie_id');
         $this->expectException(\Mollie\Api\Exceptions\ApiException::class);
         $this->expectExceptionMessageMatches('/410: Gone/');
         $mandate = mollie()->mandates()->getForId($customer_id, $mandate_id);
 
         $this->assertNull($wallet->fresh()->getSetting('mollie_mandate_id'));
 
         // Test Mollie's "410 Gone" response handling when fetching the mandate info
         // It is expected to remove the mandate reference
         $mollie_response = [
             'status' => 410,
             'title' => "Gone",
             'detail' => "You are trying to access an object, which has previously been deleted",
             '_links' => [
                 'documentation' => [
                     'href' => "https://docs.mollie.com/errors",
                     'type' => "text/html"
                 ]
             ]
         ];
 
         $responseStack = $this->mockMollie();
         $responseStack->append(new Response(410, [], json_encode($mollie_response)));
 
         $wallet->fresh()->setSetting('mollie_mandate_id', '123');
 
         $response = $this->actingAs($user)->get("api/v4/payments/mandate");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertFalse(array_key_exists('id', $json));
         $this->assertFalse(array_key_exists('method', $json));
         $this->assertNull($wallet->fresh()->getSetting('mollie_mandate_id'));
     }
 
+    /**
+     * Test fetching an outo-payment mandate parameters
+     *
+     * @group mollie
+     */
+    public function testMandateParams(): void
+    {
+        $plan = Plan::withEnvTenantContext()->where('title', 'individual')->first();
+        $user = $this->getTestUser('payment-test@' . \config('app.domain'));
+        $wallet = $user->wallets()->first();
+
+        $response = $this->actingAs($user)->get("api/v4/payments/mandate");
+        $response->assertStatus(200);
+
+        $json = $response->json();
+
+        $this->assertSame((int) ceil(Payment::MIN_AMOUNT / 100), $json['amount']);
+        $this->assertSame($json['amount'], $json['minAmount']);
+        $this->assertSame(0, $json['balance']);
+        $this->assertFalse($json['isValid']);
+        $this->assertFalse($json['isDisabled']);
+
+        $plan->months = 12;
+        $plan->save();
+        $user->setSetting('plan_id', $plan->id);
+
+        $response = $this->actingAs($user)->get("api/v4/payments/mandate");
+        $response->assertStatus(200);
+
+        $json = $response->json();
+
+        $this->assertSame((int) ceil(Payment::MIN_AMOUNT / 100), $json['amount']);
+        $this->assertSame((int) ceil(($plan->cost() * $plan->months) / 100), $json['minAmount']);
+
+        // TODO: Test more cases
+        // TODO: Test user unrestricting if mandate is valid
+    }
+
     /**
      * Test creating a payment and receiving a status via webhook
      *
      * @group mollie
      */
     public function testStoreAndWebhook(): void
     {
         Bus::fake();
 
         // Unauth access not allowed
         $response = $this->post("api/v4/payments", []);
         $response->assertStatus(401);
 
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
 
         // Invalid amount
         $post = ['amount' => -1];
         $response = $this->actingAs($user)->post("api/v4/payments", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $min = $wallet->money(Payment::MIN_AMOUNT);
         $this->assertSame("Minimum amount for a single payment is {$min}.", $json['errors']['amount']);
 
         // Invalid currency
         $post = ['amount' => '12.34', 'currency' => 'FOO', 'methodId' => 'creditcard'];
         $response = $this->actingAs($user)->post("api/v4/payments", $post);
         $response->assertStatus(500);
 
         // Successful payment
         $post = ['amount' => '12.34', 'currency' => 'CHF', 'methodId' => 'creditcard'];
         $response = $this->actingAs($user)->post("api/v4/payments", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertMatchesRegularExpression('|^https://www.mollie.com|', $json['redirectUrl']);
 
         $payments = Payment::where('wallet_id', $wallet->id)->get();
 
         $this->assertCount(1, $payments);
         $payment = $payments[0];
         $this->assertSame(1234, $payment->amount);
         $this->assertSame(1234, $payment->currency_amount);
         $this->assertSame('CHF', $payment->currency);
         $this->assertSame($user->tenant->title . ' Payment', $payment->description);
         $this->assertSame('open', $payment->status);
         $this->assertEquals(0, $wallet->balance);
 
         // Test the webhook
         // Note: Webhook end-point does not require authentication
 
         $mollie_response = [
             "resource" => "payment",
             "id" => $payment->id,
             "status" => "paid",
             // Status is not enough, paidAt is used to distinguish the state
             "paidAt" => date('c'),
             "mode" => "test",
         ];
 
         // We'll trigger the webhook with payment id and use mocking for
         // a request to the Mollie payments API. We cannot force Mollie
         // to make the payment status change.
         $responseStack = $this->mockMollie();
         $responseStack->append(new Response(200, [], json_encode($mollie_response)));
 
         $post = ['id' => $payment->id];
         $response = $this->post("api/webhooks/payment/mollie", $post);
         $response->assertStatus(200);
 
         $this->assertSame(Payment::STATUS_PAID, $payment->fresh()->status);
         $this->assertEquals(1234, $wallet->fresh()->balance);
 
         $transaction = $wallet->transactions()
             ->where('type', Transaction::WALLET_CREDIT)->get()->last();
 
         $this->assertSame(1234, $transaction->amount);
         $this->assertSame(
             "Payment transaction {$payment->id} using Mollie",
             $transaction->description
         );
 
         // Assert that email notification job wasn't dispatched,
         // it is expected only for recurring payments
         Bus::assertDispatchedTimes(\App\Jobs\PaymentEmail::class, 0);
 
         // Verify "paid -> open -> paid" scenario, assert that balance didn't change
         $mollie_response['status'] = 'open';
         unset($mollie_response['paidAt']);
         $responseStack->append(new Response(200, [], json_encode($mollie_response)));
 
         $response = $this->post("api/webhooks/payment/mollie", $post);
         $response->assertStatus(200);
 
         $this->assertSame(Payment::STATUS_PAID, $payment->fresh()->status);
         $this->assertEquals(1234, $wallet->fresh()->balance);
 
         $mollie_response['status'] = 'paid';
         $mollie_response['paidAt'] = date('c');
         $responseStack->append(new Response(200, [], json_encode($mollie_response)));
 
         $response = $this->post("api/webhooks/payment/mollie", $post);
         $response->assertStatus(200);
 
         $this->assertSame(Payment::STATUS_PAID, $payment->fresh()->status);
         $this->assertEquals(1234, $wallet->fresh()->balance);
 
         // Test for payment failure
         Bus::fake();
 
         $payment->refresh();
         $payment->status = Payment::STATUS_OPEN;
         $payment->save();
 
         $mollie_response = [
             "resource" => "payment",
             "id" => $payment->id,
             "status" => "failed",
             "mode" => "test",
         ];
 
         // We'll trigger the webhook with payment id and use mocking for
         // a request to the Mollie payments API. We cannot force Mollie
         // to make the payment status change.
         $responseStack = $this->mockMollie();
         $responseStack->append(new Response(200, [], json_encode($mollie_response)));
 
         $response = $this->post("api/webhooks/payment/mollie", $post);
         $response->assertStatus(200);
 
         $this->assertSame('failed', $payment->fresh()->status);
         $this->assertEquals(1234, $wallet->fresh()->balance);
 
         // Assert that email notification job wasn't dispatched,
         // it is expected only for recurring payments
         Bus::assertDispatchedTimes(\App\Jobs\PaymentEmail::class, 0);
     }
 
     /**
      * Test creating a payment and receiving a status via webhook using a foreign currency
      *
      * @group mollie
      */
     public function testStoreAndWebhookForeignCurrency(): void
     {
         Bus::fake();
 
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
 
         // Successful payment in EUR
         $post = ['amount' => '12.34', 'currency' => 'EUR', 'methodId' => 'banktransfer'];
         $response = $this->actingAs($user)->post("api/v4/payments", $post);
         $response->assertStatus(200);
 
         $payment = $wallet->payments()
             ->where('currency', 'EUR')->get()->last();
 
         $this->assertSame(1234, $payment->amount);
         $this->assertSame(1117, $payment->currency_amount);
         $this->assertSame('EUR', $payment->currency);
         $this->assertEquals(0, $wallet->balance);
 
         $mollie_response = [
             "resource" => "payment",
             "id" => $payment->id,
             "status" => "paid",
             // Status is not enough, paidAt is used to distinguish the state
             "paidAt" => date('c'),
             "mode" => "test",
         ];
 
         $responseStack = $this->mockMollie();
         $responseStack->append(new Response(200, [], json_encode($mollie_response)));
 
         $post = ['id' => $payment->id];
         $response = $this->post("api/webhooks/payment/mollie", $post);
         $response->assertStatus(200);
 
         $this->assertSame(Payment::STATUS_PAID, $payment->fresh()->status);
         $this->assertEquals(1234, $wallet->fresh()->balance);
     }
 
     /**
      * Test automatic payment charges
      *
      * @group mollie
      */
     public function testTopUp(): void
     {
         Bus::fake();
 
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
 
         // Create a valid mandate first (balance=0, so there's no extra payment yet)
         $this->createMandate($wallet, ['amount' => 20.10, 'balance' => 0]);
 
         $wallet->setSetting('mandate_balance', 10);
 
         // Expect a recurring payment as we have a valid mandate at this point
         // and the balance is below the threshold
         $this->assertTrue(PaymentsController::topUpWallet($wallet));
 
         // Check that the payments table contains a new record with proper amount.
         // There should be two records, one for the mandate payment and another for
         // the top-up payment
         $payments = $wallet->payments()->orderBy('amount')->get();
         $this->assertCount(2, $payments);
         $this->assertSame(0, $payments[0]->amount);
         $this->assertSame(0, $payments[0]->currency_amount);
         $this->assertSame(2010, $payments[1]->amount);
         $this->assertSame(2010, $payments[1]->currency_amount);
         $payment = $payments[1];
 
         // In mollie we don't have to wait for a webhook, the response to
         // PaymentIntent already sets the status to 'paid', so we can test
         // immediately the balance update
         // Assert that email notification job has been dispatched
         $this->assertSame(Payment::STATUS_PAID, $payment->status);
         $this->assertEquals(2010, $wallet->fresh()->balance);
         $transaction = $wallet->transactions()
             ->where('type', Transaction::WALLET_CREDIT)->get()->last();
 
         $this->assertSame(2010, $transaction->amount);
         $this->assertSame(
-            "Auto-payment transaction {$payment->id} using Mastercard (**** **** **** 9399)",
+            "Auto-payment transaction {$payment->id} using Mastercard (**** **** **** 6787)",
             $transaction->description
         );
 
         Bus::assertDispatchedTimes(\App\Jobs\PaymentEmail::class, 1);
         Bus::assertDispatched(\App\Jobs\PaymentEmail::class, function ($job) use ($payment) {
             $job_payment = $this->getObjectProperty($job, 'payment');
             return $job_payment->id === $payment->id;
         });
 
         // Expect no payment if the mandate is disabled
         $wallet->setSetting('mandate_disabled', 1);
         $result = PaymentsController::topUpWallet($wallet);
         $this->assertFalse($result);
         $this->assertCount(2, $wallet->payments()->get());
 
         // Expect no payment if balance is ok
         $wallet->setSetting('mandate_disabled', null);
         $wallet->balance = 1000;
         $wallet->save();
         $result = PaymentsController::topUpWallet($wallet);
         $this->assertFalse($result);
         $this->assertCount(2, $wallet->payments()->get());
 
         // Expect no payment if the top-up amount is not enough
         $wallet->setSetting('mandate_disabled', null);
         $wallet->balance = -2050;
         $wallet->save();
         $result = PaymentsController::topUpWallet($wallet);
         $this->assertFalse($result);
         $this->assertCount(2, $wallet->payments()->get());
 
         Bus::assertDispatchedTimes(\App\Jobs\PaymentMandateDisabledEmail::class, 1);
         Bus::assertDispatched(\App\Jobs\PaymentMandateDisabledEmail::class, function ($job) use ($wallet) {
             $job_wallet = $this->getObjectProperty($job, 'wallet');
             return $job_wallet->id === $wallet->id;
         });
 
         // Expect no payment if there's no mandate
         $wallet->setSetting('mollie_mandate_id', null);
         $wallet->balance = 0;
         $wallet->save();
         $result = PaymentsController::topUpWallet($wallet);
         $this->assertFalse($result);
         $this->assertCount(2, $wallet->payments()->get());
 
         Bus::assertDispatchedTimes(\App\Jobs\PaymentMandateDisabledEmail::class, 1);
 
         // Test webhook for recurring payments
 
         $wallet->transactions()->delete();
 
         $responseStack = $this->mockMollie();
         Bus::fake();
 
         $payment->refresh();
         $payment->status = Payment::STATUS_OPEN;
         $payment->save();
 
         $mollie_response = [
             "resource" => "payment",
             "id" => $payment->id,
             "status" => "paid",
             // Status is not enough, paidAt is used to distinguish the state
             "paidAt" => date('c'),
             "mode" => "test",
         ];
 
         // We'll trigger the webhook with payment id and use mocking for
         // a request to the Mollie payments API. We cannot force Mollie
         // to make the payment status change.
         $responseStack->append(new Response(200, [], json_encode($mollie_response)));
 
         $post = ['id' => $payment->id];
         $response = $this->post("api/webhooks/payment/mollie", $post);
         $response->assertStatus(200);
 
         $this->assertSame(Payment::STATUS_PAID, $payment->fresh()->status);
         $this->assertEquals(2010, $wallet->fresh()->balance);
 
         $transaction = $wallet->transactions()
             ->where('type', Transaction::WALLET_CREDIT)->get()->last();
 
         $this->assertSame(2010, $transaction->amount);
         $this->assertSame(
             "Auto-payment transaction {$payment->id} using Mollie",
             $transaction->description
         );
 
         // Assert that email notification job has been dispatched
         Bus::assertDispatchedTimes(\App\Jobs\PaymentEmail::class, 1);
         Bus::assertDispatched(\App\Jobs\PaymentEmail::class, function ($job) use ($payment) {
             $job_payment = $this->getObjectProperty($job, 'payment');
             return $job_payment->id === $payment->id;
         });
 
         Bus::fake();
 
         // Test for payment failure
         $payment->refresh();
         $payment->status = Payment::STATUS_OPEN;
         $payment->save();
 
         $wallet->setSetting('mollie_mandate_id', 'xxx');
         $wallet->setSetting('mandate_disabled', null);
 
         $mollie_response = [
             "resource" => "payment",
             "id" => $payment->id,
             "status" => "failed",
             "mode" => "test",
         ];
 
         $responseStack->append(new Response(200, [], json_encode($mollie_response)));
 
         $response = $this->post("api/webhooks/payment/mollie", $post);
         $response->assertStatus(200);
 
         $wallet->refresh();
 
         $this->assertSame(Payment::STATUS_FAILED, $payment->fresh()->status);
         $this->assertEquals(2010, $wallet->balance);
         $this->assertTrue(!empty($wallet->getSetting('mandate_disabled')));
 
         // Assert that email notification job has been dispatched
         Bus::assertDispatchedTimes(\App\Jobs\PaymentEmail::class, 1);
         Bus::assertDispatched(\App\Jobs\PaymentEmail::class, function ($job) use ($payment) {
             $job_payment = $this->getObjectProperty($job, 'payment');
             return $job_payment->id === $payment->id;
         });
 
         $this->unmockMollie();
     }
 
     /**
      * Test payment/top-up with VAT_MODE=1
      *
      * @group mollie
      */
     public function testPaymentsWithVatModeOne(): void
     {
         \config(['app.vat.mode' => 1]);
 
         $user = $this->getTestUser('payment-test@' . \config('app.domain'));
         $user->setSetting('country', 'US');
         $wallet = $user->wallets()->first();
         $vatRate = VatRate::create([
                 'country' => 'US',
                 'rate' => 5.0,
                 'start' => now()->subDay(),
         ]);
 
         // Payment
         $post = ['amount' => '10', 'currency' => 'CHF', 'methodId' => 'creditcard'];
         $response = $this->actingAs($user)->post("api/v4/payments", $post);
         $response->assertStatus(200);
 
         // Check that the payments table contains a new record with proper amount(s)
         $payment = $wallet->payments()->first();
         $this->assertSame(1000 + intval(round(1000 * $vatRate->rate / 100)), $payment->amount);
         $this->assertSame(1000, $payment->credit_amount);
         $this->assertSame($payment->amount, $payment->currency_amount);
         $this->assertSame('CHF', $payment->currency);
         $this->assertSame($vatRate->id, $payment->vat_rate_id);
         $this->assertSame('open', $payment->status);
 
         $wallet->payments()->delete();
         $wallet->balance = -1000;
         $wallet->save();
 
         // Top-up (mandate creation)
         // Create a valid mandate first (expect an extra payment)
         $this->createMandate($wallet, ['amount' => 20.10, 'balance' => 0]);
 
         // Check that the payments table contains a new record with proper amount(s)
         $payment = $wallet->payments()->first();
         $this->assertSame(2010 + intval(round(2010 * $vatRate->rate / 100)), $payment->amount);
         $this->assertSame(2010, $payment->credit_amount);
         $this->assertSame($payment->amount, $payment->currency_amount);
         $this->assertSame($vatRate->id, $payment->vat_rate_id);
 
         $wallet->payments()->delete();
         $wallet->balance = -1000;
         $wallet->save();
 
         // Top-up (recurring payment)
         // Expect a recurring payment as we have a valid mandate at this point
         // and the balance is below the threshold
         $this->assertTrue(PaymentsController::topUpWallet($wallet));
 
         // Check that the payments table contains a new record with proper amount(s)
         $payment = $wallet->payments()->first();
         $this->assertSame(2010 + intval(round(2010 * $vatRate->rate / 100)), $payment->amount);
         $this->assertSame(2010, $payment->credit_amount);
         $this->assertSame($payment->amount, $payment->currency_amount);
         $this->assertSame($vatRate->id, $payment->vat_rate_id);
     }
 
     /**
      * Test refund/chargeback handling by the webhook
      *
      * @group mollie
      */
     public function testRefundAndChargeback(): void
     {
         Bus::fake();
 
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
         $wallet->transactions()->delete();
 
         $mollie = PaymentProvider::factory('mollie');
 
         // Create a paid payment
         $payment = Payment::create([
                 'id' => 'tr_123456',
                 'status' => Payment::STATUS_PAID,
                 'amount' => 123,
                 'credit_amount' => 123,
                 'currency_amount' => 123,
                 'currency' => 'CHF',
                 'type' => Payment::TYPE_ONEOFF,
                 'wallet_id' => $wallet->id,
                 'provider' => 'mollie',
                 'description' => 'test',
         ]);
 
         // Test handling a refund by the webhook
 
         $mollie_response1 = [
             "resource" => "payment",
             "id" => $payment->id,
             "status" => "paid",
             // Status is not enough, paidAt is used to distinguish the state
             "paidAt" => date('c'),
             "mode" => "test",
             "_links" => [
                 "refunds" => [
                    "href" => "https://api.mollie.com/v2/payments/{$payment->id}/refunds",
                    "type" => "application/hal+json"
                 ]
             ]
         ];
 
         $mollie_response2 = [
             "count" => 1,
             "_links" => [],
             "_embedded" => [
                 "refunds" => [
                     [
                         "resource" => "refund",
                         "id" => "re_123456",
                         "status" => \Mollie\Api\Types\RefundStatus::STATUS_REFUNDED,
                         "paymentId" => $payment->id,
                         "description" => "refund desc",
                         "amount" => [
                             "currency" => "CHF",
                             "value" => "1.01",
                         ],
                     ]
                 ]
             ]
         ];
 
         // We'll trigger the webhook with payment id and use mocking for
         // requests to the Mollie payments API.
         $responseStack = $this->mockMollie();
         $responseStack->append(new Response(200, [], json_encode($mollie_response1)));
         $responseStack->append(new Response(200, [], json_encode($mollie_response2)));
 
         $post = ['id' => $payment->id];
         $response = $this->post("api/webhooks/payment/mollie", $post);
         $response->assertStatus(200);
 
         $wallet->refresh();
 
         $this->assertEquals(-101, $wallet->balance);
 
         $transactions = $wallet->transactions()->where('type', Transaction::WALLET_REFUND)->get();
 
         $this->assertCount(1, $transactions);
         $this->assertSame(-101, $transactions[0]->amount);
         $this->assertSame(Transaction::WALLET_REFUND, $transactions[0]->type);
         $this->assertSame("refund desc", $transactions[0]->description);
 
         $payments = $wallet->payments()->where('id', 're_123456')->get();
 
         $this->assertCount(1, $payments);
         $this->assertSame(-101, $payments[0]->amount);
         $this->assertSame(-101, $payments[0]->currency_amount);
         $this->assertSame(Payment::STATUS_PAID, $payments[0]->status);
         $this->assertSame(Payment::TYPE_REFUND, $payments[0]->type);
         $this->assertSame("mollie", $payments[0]->provider);
         $this->assertSame("refund desc", $payments[0]->description);
 
         // Test handling a chargeback by the webhook
 
         $mollie_response1["_links"] = [
             "chargebacks" => [
                "href" => "https://api.mollie.com/v2/payments/{$payment->id}/chargebacks",
                "type" => "application/hal+json"
             ]
         ];
 
         $mollie_response2 = [
             "count" => 1,
             "_links" => [],
             "_embedded" => [
                 "chargebacks" => [
                     [
                         "resource" => "chargeback",
                         "id" => "chb_123456",
                         "paymentId" => $payment->id,
                         "amount" => [
                             "currency" => "CHF",
                             "value" => "0.15",
                         ],
                     ]
                 ]
             ]
         ];
 
         // We'll trigger the webhook with payment id and use mocking for
         // requests to the Mollie payments API.
         $responseStack = $this->mockMollie();
         $responseStack->append(new Response(200, [], json_encode($mollie_response1)));
         $responseStack->append(new Response(200, [], json_encode($mollie_response2)));
 
         $post = ['id' => $payment->id];
         $response = $this->post("api/webhooks/payment/mollie", $post);
         $response->assertStatus(200);
 
         $wallet->refresh();
 
         $this->assertEquals(-116, $wallet->balance);
 
         $transactions = $wallet->transactions()->where('type', Transaction::WALLET_CHARGEBACK)->get();
 
         $this->assertCount(1, $transactions);
         $this->assertSame(-15, $transactions[0]->amount);
         $this->assertSame(Transaction::WALLET_CHARGEBACK, $transactions[0]->type);
         $this->assertSame('', $transactions[0]->description);
 
         $payments = $wallet->payments()->where('id', 'chb_123456')->get();
 
         $this->assertCount(1, $payments);
         $this->assertSame(-15, $payments[0]->amount);
         $this->assertSame(Payment::STATUS_PAID, $payments[0]->status);
         $this->assertSame(Payment::TYPE_CHARGEBACK, $payments[0]->type);
         $this->assertSame("mollie", $payments[0]->provider);
         $this->assertSame('', $payments[0]->description);
 
         Bus::assertNotDispatched(\App\Jobs\PaymentEmail::class);
 
         $this->unmockMollie();
     }
 
     /**
      * Test refund/chargeback handling by the webhook in a foreign currency
      *
      * @group mollie
      */
     public function testRefundAndChargebackForeignCurrency(): void
     {
         Bus::fake();
 
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
         $wallet->transactions()->delete();
 
         $mollie = PaymentProvider::factory('mollie');
 
         // Create a paid payment
         $payment = Payment::create([
                 'id' => 'tr_123456',
                 'status' => Payment::STATUS_PAID,
                 'amount' => 1234,
                 'credit_amount' => 1234,
                 'currency_amount' => 1117,
                 'currency' => 'EUR',
                 'type' => Payment::TYPE_ONEOFF,
                 'wallet_id' => $wallet->id,
                 'provider' => 'mollie',
                 'description' => 'test',
         ]);
 
         // Test handling a refund by the webhook
 
         $mollie_response1 = [
             "resource" => "payment",
             "id" => $payment->id,
             "status" => "paid",
             // Status is not enough, paidAt is used to distinguish the state
             "paidAt" => date('c'),
             "mode" => "test",
             "_links" => [
                 "refunds" => [
                    "href" => "https://api.mollie.com/v2/payments/{$payment->id}/refunds",
                    "type" => "application/hal+json"
                 ]
             ]
         ];
 
         $mollie_response2 = [
             "count" => 1,
             "_links" => [],
             "_embedded" => [
                 "refunds" => [
                     [
                         "resource" => "refund",
                         "id" => "re_123456",
                         "status" => \Mollie\Api\Types\RefundStatus::STATUS_REFUNDED,
                         "paymentId" => $payment->id,
                         "description" => "refund desc",
                         "amount" => [
                             "currency" => "EUR",
                             "value" => "1.01",
                         ],
                     ]
                 ]
             ]
         ];
 
         // We'll trigger the webhook with payment id and use mocking for
         // requests to the Mollie payments API.
         $responseStack = $this->mockMollie();
         $responseStack->append(new Response(200, [], json_encode($mollie_response1)));
         $responseStack->append(new Response(200, [], json_encode($mollie_response2)));
 
         $post = ['id' => $payment->id];
         $response = $this->post("api/webhooks/payment/mollie", $post);
         $response->assertStatus(200);
 
         $wallet->refresh();
 
         $this->assertTrue($wallet->balance <= -100);
         $this->assertTrue($wallet->balance >= -114);
 
         $payments = $wallet->payments()->where('id', 're_123456')->get();
 
         $this->assertCount(1, $payments);
         $this->assertTrue($payments[0]->amount <= -100);
         $this->assertTrue($payments[0]->amount >= -114);
         $this->assertSame(-101, $payments[0]->currency_amount);
         $this->assertSame('EUR', $payments[0]->currency);
 
         $this->unmockMollie();
     }
 
     /**
      * Create Mollie's auto-payment mandate using our API and Chrome browser
      */
     protected function createMandate(Wallet $wallet, array $params)
     {
         // Use the API to create a first payment with a mandate
         $response = $this->actingAs($wallet->owner)->post("api/v4/payments/mandate", $params);
         $response->assertStatus(200);
         $json = $response->json();
 
         // There's no easy way to confirm a created mandate.
         // The only way seems to be to fire up Chrome on checkout page
         // and do actions with use of Dusk browser.
         $this->startBrowser()->visit($json['redirectUrl']);
 
         $molliePage = new \Tests\Browser\Pages\PaymentMollie();
         $molliePage->assert($this->browser);
         $molliePage->submitPayment($this->browser, 'paid');
 
         $this->stopBrowser();
     }
 
     /**
      * Test listing a pending payment
      *
      * @group mollie
      */
     public function testListingPayments(): void
     {
         Bus::fake();
 
         $user = $this->getTestUser('john@kolab.org');
 
         //Empty response
         $response = $this->actingAs($user)->get("api/v4/payments/pending");
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame(0, $json['count']);
         $this->assertSame(1, $json['page']);
         $this->assertSame(false, $json['hasMore']);
         $this->assertCount(0, $json['list']);
 
         $response = $this->actingAs($user)->get("api/v4/payments/has-pending");
         $json = $response->json();
         $this->assertSame(false, $json['hasPending']);
 
         $wallet = $user->wallets()->first();
 
         // Successful payment
         $post = ['amount' => '12.34', 'currency' => 'CHF', 'methodId' => 'creditcard'];
         $response = $this->actingAs($user)->post("api/v4/payments", $post);
         $response->assertStatus(200);
 
         //A response
         $response = $this->actingAs($user)->get("api/v4/payments/pending");
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame(1, $json['count']);
         $this->assertSame(1, $json['page']);
         $this->assertSame(false, $json['hasMore']);
         $this->assertCount(1, $json['list']);
         $this->assertSame(Payment::STATUS_OPEN, $json['list'][0]['status']);
         $this->assertSame('CHF', $json['list'][0]['currency']);
         $this->assertSame(Payment::TYPE_ONEOFF, $json['list'][0]['type']);
         $this->assertSame(1234, $json['list'][0]['amount']);
 
         $response = $this->actingAs($user)->get("api/v4/payments/has-pending");
         $json = $response->json();
         $this->assertSame(true, $json['hasPending']);
 
         // Set the payment to paid
         $payments = Payment::where('wallet_id', $wallet->id)->get();
 
         $this->assertCount(1, $payments);
         $payment = $payments[0];
 
         $payment->status = Payment::STATUS_PAID;
         $payment->save();
 
         // They payment should be gone from the pending list now
         $response = $this->actingAs($user)->get("api/v4/payments/pending");
         $json = $response->json();
         $this->assertSame('success', $json['status']);
         $this->assertSame(0, $json['count']);
         $this->assertCount(0, $json['list']);
 
         $response = $this->actingAs($user)->get("api/v4/payments/has-pending");
         $json = $response->json();
         $this->assertSame(false, $json['hasPending']);
     }
 
     /**
      * Test listing payment methods
      *
      * @group mollie
      */
     public function testListingPaymentMethods(): void
     {
         Bus::fake();
 
         $user = $this->getTestUser('john@kolab.org');
 
         $response = $this->actingAs($user)->get('api/v4/payments/methods?type=' . Payment::TYPE_ONEOFF);
         $response->assertStatus(200);
         $json = $response->json();
 
         $hasCoinbase = !empty(\config('services.coinbase.key'));
 
         $this->assertCount(3 + intval($hasCoinbase), $json);
         $this->assertSame('creditcard', $json[0]['id']);
         $this->assertSame('paypal', $json[1]['id']);
         $this->assertSame('banktransfer', $json[2]['id']);
         $this->assertSame('CHF', $json[0]['currency']);
         $this->assertSame('CHF', $json[1]['currency']);
         $this->assertSame('EUR', $json[2]['currency']);
 
         if ($hasCoinbase) {
             $this->assertSame('bitcoin', $json[3]['id']);
             $this->assertSame('BTC', $json[3]['currency']);
         }
 
         $response = $this->actingAs($user)->get('api/v4/payments/methods?type=' . Payment::TYPE_RECURRING);
         $response->assertStatus(200);
         $json = $response->json();
 
         $this->assertCount(1, $json);
         $this->assertSame('creditcard', $json[0]['id']);
         $this->assertSame('CHF', $json[0]['currency']);
     }
 }
diff --git a/src/tests/Feature/Controller/SignupTest.php b/src/tests/Feature/Controller/SignupTest.php
index 8ca62fc2..05dc0f20 100644
--- a/src/tests/Feature/Controller/SignupTest.php
+++ b/src/tests/Feature/Controller/SignupTest.php
@@ -1,920 +1,1004 @@
 <?php
 
 namespace Tests\Feature\Controller;
 
 use App\Http\Controllers\API\SignupController;
 use App\Discount;
 use App\Domain;
+use App\Plan;
+use App\Package;
 use App\SignupCode;
 use App\SignupInvitation as SI;
 use App\User;
 use Illuminate\Support\Facades\Queue;
 use Tests\TestCase;
 
 class SignupTest extends TestCase
 {
     private $domain;
 
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         // TODO: Some tests depend on existence of individual and group plans,
         //       we should probably create plans here to not depend on that
         $this->domain = $this->getPublicDomain();
 
         $this->deleteTestUser("SignupControllerTest1@$this->domain");
         $this->deleteTestUser("signuplogin@$this->domain");
         $this->deleteTestUser("admin@external.com");
         $this->deleteTestUser("test-inv@kolabnow.com");
 
         $this->deleteTestDomain('external.com');
         $this->deleteTestDomain('signup-domain.com');
 
         $this->deleteTestGroup('group-test@kolabnow.com');
         SI::truncate();
+        Plan::where('title', 'test')->delete();
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser("SignupControllerTest1@$this->domain");
         $this->deleteTestUser("signuplogin@$this->domain");
         $this->deleteTestUser("admin@external.com");
         $this->deleteTestUser("test-inv@kolabnow.com");
 
         $this->deleteTestDomain('external.com');
         $this->deleteTestDomain('signup-domain.com');
 
         $this->deleteTestGroup('group-test@kolabnow.com');
         SI::truncate();
+        Plan::where('title', 'test')->delete();
 
         parent::tearDown();
     }
 
     /**
      * Return a public domain for signup tests
      */
     private function getPublicDomain(): string
     {
         if (!$this->domain) {
             $this->refreshApplication();
             $public_domains = Domain::getPublicDomains();
             $this->domain = reset($public_domains);
 
             if (empty($this->domain)) {
                 $this->domain = 'signup-domain.com';
                 Domain::create([
                         'namespace' => $this->domain,
                         'status' => Domain::STATUS_ACTIVE,
                         'type' => Domain::TYPE_PUBLIC,
                 ]);
             }
         }
 
         return $this->domain;
     }
 
+    /**
+     * Test fetching public domains for signup
+     */
+    public function testSignupDomains(): void
+    {
+        $response = $this->get('/api/auth/signup/domains');
+        $json = $response->json();
+
+        $response->assertStatus(200);
+
+        $this->assertCount(2, $json);
+        $this->assertSame('success', $json['status']);
+        $this->assertSame(Domain::getPublicDomains(), $json['domains']);
+    }
+
     /**
      * Test fetching plans for signup
      */
     public function testSignupPlans(): void
     {
+        $individual = Plan::withEnvTenantContext()->where('title', 'individual')->first();
+        $group = Plan::withEnvTenantContext()->where('title', 'group')->first();
+
         $response = $this->get('/api/auth/signup/plans');
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertCount(2, $json['plans']);
-        $this->assertArrayHasKey('title', $json['plans'][0]);
-        $this->assertArrayHasKey('name', $json['plans'][0]);
-        $this->assertArrayHasKey('description', $json['plans'][0]);
+        $this->assertSame($individual->title, $json['plans'][0]['title']);
+        $this->assertSame($individual->name, $json['plans'][0]['name']);
+        $this->assertSame($individual->description, $json['plans'][0]['description']);
+        $this->assertFalse($json['plans'][0]['isDomain']);
         $this->assertArrayHasKey('button', $json['plans'][0]);
+        $this->assertSame($group->title, $json['plans'][1]['title']);
+        $this->assertSame($group->name, $json['plans'][1]['name']);
+        $this->assertSame($group->description, $json['plans'][1]['description']);
+        $this->assertTrue($json['plans'][1]['isDomain']);
+        $this->assertArrayHasKey('button', $json['plans'][1]);
     }
 
     /**
      * Test fetching invitation
      */
     public function testSignupInvitations(): void
     {
         Queue::fake();
 
         $invitation = SI::create(['email' => 'email1@ext.com']);
 
         // Test existing invitation
         $response = $this->get("/api/auth/signup/invitations/{$invitation->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame($invitation->id, $json['id']);
 
         // Test non-existing invitation
         $response = $this->get("/api/auth/signup/invitations/abc");
         $response->assertStatus(404);
 
         // Test completed invitation
         SI::where('id', $invitation->id)->update(['status' => SI::STATUS_COMPLETED]);
         $response = $this->get("/api/auth/signup/invitations/{$invitation->id}");
         $response->assertStatus(404);
     }
 
     /**
      * Test signup initialization with invalid input
      */
     public function testSignupInitInvalidInput(): void
     {
         // Empty input data
         $data = [];
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('email', $json['errors']);
 
         // Data with missing name
         $data = [
             'email' => 'UsersApiControllerTest1@UsersApiControllerTest.com',
             'first_name' => str_repeat('a', 250),
             'last_name' => str_repeat('a', 250),
         ];
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertArrayHasKey('first_name', $json['errors']);
         $this->assertArrayHasKey('last_name', $json['errors']);
 
         // Data with invalid email (but not phone number)
         $data = [
             'email' => '@example.org',
             'first_name' => 'Signup',
             'last_name' => 'User',
         ];
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('email', $json['errors']);
 
         // Sanity check on voucher code, last/first name is optional
         $data = [
             'voucher' => '123456789012345678901234567890123',
             'email' => 'valid@email.com',
         ];
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('voucher', $json['errors']);
 
         // Email address too long
         $data = [
             'email' => str_repeat('a', 190) . '@example.org',
             'first_name' => 'Signup',
             'last_name' => 'User',
         ];
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertSame(["The specified email address is invalid."], $json['errors']['email']);
 
         SignupCode::truncate();
 
         // Email address limit check
         $data = [
             'email' => 'test@example.org',
             'first_name' => 'Signup',
             'last_name' => 'User',
         ];
 
         \config(['app.signup.email_limit' => 0]);
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         \config(['app.signup.email_limit' => 1]);
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         // TODO: This probably should be a different message?
         $this->assertSame(["The specified email address is invalid."], $json['errors']['email']);
 
         // IP address limit check
         $data = [
             'email' => 'ip@example.org',
             'first_name' => 'Signup',
             'last_name' => 'User',
         ];
 
         \config(['app.signup.email_limit' => 0]);
         \config(['app.signup.ip_limit' => 0]);
 
         $response = $this->post('/api/auth/signup/init', $data, ['REMOTE_ADDR' => '10.1.1.1']);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         \config(['app.signup.ip_limit' => 1]);
 
         $response = $this->post('/api/auth/signup/init', $data, ['REMOTE_ADDR' => '10.1.1.1']);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         // TODO: This probably should be a different message?
         $this->assertSame(["The specified email address is invalid."], $json['errors']['email']);
 
         // TODO: Test phone validation
     }
 
     /**
      * Test signup initialization with valid input
      */
     public function testSignupInitValidInput(): array
     {
         Queue::fake();
 
         // Assert that no jobs were pushed...
         Queue::assertNothingPushed();
 
         $data = [
             'email' => 'testuser@external.com',
             'first_name' => 'Signup',
             'last_name' => 'User',
             'plan' => 'individual',
         ];
 
         $response = $this->post('/api/auth/signup/init', $data, ['REMOTE_ADDR' => '10.1.1.2']);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertCount(3, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame('email', $json['mode']);
         $this->assertNotEmpty($json['code']);
 
         $code = SignupCode::find($json['code']);
 
         $this->assertSame('10.1.1.2', $code->ip_address);
         $this->assertSame(null, $code->verify_ip_address);
         $this->assertSame(null, $code->submit_ip_address);
 
         // Assert the email sending job was pushed once
         Queue::assertPushed(\App\Jobs\SignupVerificationEmail::class, 1);
 
         // Assert the job has proper data assigned
         Queue::assertPushed(\App\Jobs\SignupVerificationEmail::class, function ($job) use ($data, $json) {
             $code = TestCase::getObjectProperty($job, 'code');
 
             return $code->code === $json['code']
                 && $code->plan === $data['plan']
                 && $code->email === $data['email']
                 && $code->first_name === $data['first_name']
                 && $code->last_name === $data['last_name'];
         });
 
         // Try the same with voucher
         $data['voucher'] = 'TEST';
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertCount(3, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame('email', $json['mode']);
         $this->assertNotEmpty($json['code']);
 
         // Assert the job has proper data assigned
         Queue::assertPushed(\App\Jobs\SignupVerificationEmail::class, function ($job) use ($data, $json) {
             $code = TestCase::getObjectProperty($job, 'code');
 
             return $code->code === $json['code']
                 && $code->plan === $data['plan']
                 && $code->email === $data['email']
                 && $code->voucher === $data['voucher']
                 && $code->first_name === $data['first_name']
                 && $code->last_name === $data['last_name'];
         });
 
         return [
             'code' => $json['code'],
             'email' => $data['email'],
             'first_name' => $data['first_name'],
             'last_name' => $data['last_name'],
             'plan' => $data['plan'],
             'voucher' => $data['voucher']
         ];
     }
 
     /**
      * Test signup code verification with invalid input
      *
      * @depends testSignupInitValidInput
      */
     public function testSignupVerifyInvalidInput(array $result): void
     {
         // Empty data
         $data = [];
 
         $response = $this->post('/api/auth/signup/verify', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertArrayHasKey('code', $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
 
         // Data with existing code but missing short_code
         $data = [
             'code' => $result['code'],
         ];
 
         $response = $this->post('/api/auth/signup/verify', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
 
         // Data with invalid short_code
         $data = [
             'code' => $result['code'],
             'short_code' => 'XXXX',
         ];
 
         $response = $this->post('/api/auth/signup/verify', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
 
         // TODO: Test expired code
     }
 
     /**
      * Test signup code verification with valid input
      *
      * @depends testSignupInitValidInput
      */
     public function testSignupVerifyValidInput(array $result): array
     {
         $code = SignupCode::find($result['code']);
         $code->ip_address = '10.1.1.2';
         $code->save();
         $data = [
             'code' => $code->code,
             'short_code' => $code->short_code,
         ];
 
         $response = $this->post('/api/auth/signup/verify', $data, ['REMOTE_ADDR' => '10.1.1.3']);
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertCount(7, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame($result['email'], $json['email']);
         $this->assertSame($result['first_name'], $json['first_name']);
         $this->assertSame($result['last_name'], $json['last_name']);
         $this->assertSame($result['voucher'], $json['voucher']);
         $this->assertSame(false, $json['is_domain']);
         $this->assertTrue(is_array($json['domains']) && !empty($json['domains']));
 
         $code->refresh();
 
         $this->assertSame('10.1.1.2', $code->ip_address);
         $this->assertSame('10.1.1.3', $code->verify_ip_address);
         $this->assertSame(null, $code->submit_ip_address);
 
         return $result;
     }
 
     /**
      * Test last signup step with invalid input
      *
      * @depends testSignupVerifyValidInput
      */
     public function testSignupInvalidInput(array $result): void
     {
         // Empty data
         $data = [];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(3, $json['errors']);
         $this->assertArrayHasKey('login', $json['errors']);
         $this->assertArrayHasKey('password', $json['errors']);
         $this->assertArrayHasKey('domain', $json['errors']);
 
         $domain = $this->getPublicDomain();
 
         // Passwords do not match and missing domain
         $data = [
             'login' => 'test',
             'password' => 'test',
             'password_confirmation' => 'test2',
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertArrayHasKey('password', $json['errors']);
         $this->assertArrayHasKey('domain', $json['errors']);
 
         $domain = $this->getPublicDomain();
 
         // Login too short, password too short
         $data = [
             'login' => '1',
             'domain' => $domain,
             'password' => 'test',
             'password_confirmation' => 'test',
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertArrayHasKey('login', $json['errors']);
         $this->assertArrayHasKey('password', $json['errors']);
 
         // Missing codes
         $data = [
             'login' => 'login-valid',
             'domain' => $domain,
             'password' => 'testtest',
             'password_confirmation' => 'testtest',
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertArrayHasKey('code', $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
 
         // Data with invalid short_code
         $data = [
             'login' => 'TestLogin',
             'domain' => $domain,
             'password' => 'testtest',
             'password_confirmation' => 'testtest',
             'code' => $result['code'],
             'short_code' => 'XXXX',
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
 
         $code = SignupCode::find($result['code']);
 
         // Data with invalid voucher
         $data = [
             'login' => 'TestLogin',
             'domain' => $domain,
             'password' => 'testtest',
             'password_confirmation' => 'testtest',
             'code' => $result['code'],
             'short_code' => $code->short_code,
             'voucher' => 'XXX',
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('voucher', $json['errors']);
 
         // Valid code, invalid login
         $data = [
             'login' => 'żżżżżż',
             'domain' => $domain,
             'password' => 'testtest',
             'password_confirmation' => 'testtest',
             'code' => $result['code'],
             'short_code' => $code->short_code,
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('login', $json['errors']);
     }
 
     /**
      * Test last signup step with valid input (user creation)
      *
      * @depends testSignupVerifyValidInput
      */
     public function testSignupValidInput(array $result): void
     {
         $queue = Queue::fake();
 
         $domain = $this->getPublicDomain();
         $identity = \strtolower('SignupLogin@') . $domain;
         $code = SignupCode::find($result['code']);
         $code->ip_address = '10.1.1.2';
         $code->verify_ip_address = '10.1.1.3';
         $code->save();
         $data = [
             'login' => 'SignupLogin',
             'domain' => $domain,
             'password' => 'testtest',
             'password_confirmation' => 'testtest',
             'code' => $code->code,
             'short_code' => $code->short_code,
             'voucher' => 'TEST',
         ];
 
         $response = $this->post('/api/auth/signup', $data, ['REMOTE_ADDR' => '10.1.1.4']);
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertSame('success', $json['status']);
         $this->assertSame('bearer', $json['token_type']);
         $this->assertTrue(!empty($json['expires_in']) && is_int($json['expires_in']) && $json['expires_in'] > 0);
         $this->assertNotEmpty($json['access_token']);
         $this->assertSame($identity, $json['email']);
 
         Queue::assertPushed(\App\Jobs\User\CreateJob::class, 1);
 
         Queue::assertPushed(
             \App\Jobs\User\CreateJob::class,
             function ($job) use ($data) {
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 return $userEmail === \strtolower($data['login'] . '@' . $data['domain']);
             }
         );
 
         $code->refresh();
 
         // Check if the user has been created
         $user = User::where('email', $identity)->first();
 
         $this->assertNotEmpty($user);
         $this->assertSame($identity, $user->email);
         $this->assertTrue($user->isRestricted());
 
         // Check if the code has been updated and soft-deleted
         $this->assertTrue($code->trashed());
         $this->assertSame('10.1.1.2', $code->ip_address);
         $this->assertSame('10.1.1.3', $code->verify_ip_address);
         $this->assertSame('10.1.1.4', $code->submit_ip_address);
         $this->assertSame($user->id, $code->user_id);
 
         // Check user settings
         $this->assertSame($result['first_name'], $user->getSetting('first_name'));
         $this->assertSame($result['last_name'], $user->getSetting('last_name'));
         $this->assertSame($result['email'], $user->getSetting('external_email'));
 
         // Discount
         $discount = Discount::where('code', 'TEST')->first();
         $this->assertSame($discount->id, $user->wallets()->first()->discount_id);
 
         // TODO: Check SKUs/Plan
 
         // TODO: Check if the access token works
     }
 
     /**
      * Test signup for a group (custom domain) account
      */
     public function testSignupGroupAccount(): void
     {
         Queue::fake();
 
         // Initial signup request
         $user_data = $data = [
             'email' => 'testuser@external.com',
             'first_name' => 'Signup',
             'last_name' => 'User',
             'plan' => 'group',
         ];
 
         $response = $this->withoutMiddleware()->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertCount(3, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame('email', $json['mode']);
         $this->assertNotEmpty($json['code']);
 
         // Assert the email sending job was pushed once
         Queue::assertPushed(\App\Jobs\SignupVerificationEmail::class, 1);
 
         // Assert the job has proper data assigned
         Queue::assertPushed(\App\Jobs\SignupVerificationEmail::class, function ($job) use ($data, $json) {
             $code = TestCase::getObjectProperty($job, 'code');
 
             return $code->code === $json['code']
                 && $code->plan === $data['plan']
                 && $code->email === $data['email']
                 && $code->first_name === $data['first_name']
                 && $code->last_name === $data['last_name'];
         });
 
         // Verify the code
         $code = SignupCode::find($json['code']);
         $data = [
             'code' => $code->code,
             'short_code' => $code->short_code,
         ];
 
         $response = $this->post('/api/auth/signup/verify', $data);
         $result = $response->json();
 
         $response->assertStatus(200);
         $this->assertCount(7, $result);
         $this->assertSame('success', $result['status']);
         $this->assertSame($user_data['email'], $result['email']);
         $this->assertSame($user_data['first_name'], $result['first_name']);
         $this->assertSame($user_data['last_name'], $result['last_name']);
         $this->assertSame(null, $result['voucher']);
         $this->assertSame(true, $result['is_domain']);
         $this->assertSame([], $result['domains']);
 
         // Final signup request
         $login = 'admin';
         $domain = 'external.com';
         $data = [
             'login' => $login,
             'domain' => $domain,
             'password' => 'testtest',
             'password_confirmation' => 'testtest',
             'code' => $code->code,
             'short_code' => $code->short_code,
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $result = $response->json();
 
         $response->assertStatus(200);
         $this->assertSame('success', $result['status']);
         $this->assertSame('bearer', $result['token_type']);
         $this->assertTrue(!empty($result['expires_in']) && is_int($result['expires_in']) && $result['expires_in'] > 0);
         $this->assertNotEmpty($result['access_token']);
         $this->assertSame("$login@$domain", $result['email']);
 
         Queue::assertPushed(\App\Jobs\Domain\CreateJob::class, 1);
 
         Queue::assertPushed(
             \App\Jobs\Domain\CreateJob::class,
             function ($job) use ($domain) {
                 $domainNamespace = TestCase::getObjectProperty($job, 'domainNamespace');
 
                 return $domainNamespace === $domain;
             }
         );
 
         Queue::assertPushed(\App\Jobs\User\CreateJob::class, 1);
 
         Queue::assertPushed(
             \App\Jobs\User\CreateJob::class,
             function ($job) use ($data) {
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
 
                 return $userEmail === $data['login'] . '@' . $data['domain'];
             }
         );
 
         // Check if the code has been removed
         $code->refresh();
         $this->assertTrue($code->trashed());
 
         // Check if the user has been created
         $user = User::where('email', $login . '@' . $domain)->first();
 
         $this->assertNotEmpty($user);
         $this->assertTrue($user->isRestricted());
 
         // Check user settings
         $this->assertSame($user_data['email'], $user->getSetting('external_email'));
         $this->assertSame($user_data['first_name'], $user->getSetting('first_name'));
         $this->assertSame($user_data['last_name'], $user->getSetting('last_name'));
 
         // TODO: Check domain record
 
         // TODO: Check SKUs/Plan
 
         // TODO: Check if the access token works
     }
 
+    /**
+     * Test signup with mode=mandate
+     */
+    public function testSignupMandateMode(): void
+    {
+        Queue::fake();
+
+        $plan = Plan::create([
+                'title' => 'test',
+                'name' => 'Test Account',
+                'description' => 'Test',
+                'free_months' => 1,
+                'discount_qty' => 0,
+                'discount_rate' => 0,
+                'mode' => 'mandate',
+        ]);
+
+        $packages = [
+            Package::where(['title' => 'kolab', 'tenant_id' => \config('app.tenant_id')])->first()
+        ];
+
+        $plan->packages()->saveMany($packages);
+
+        $post = [
+            'plan' => 'abc',
+            'login' => 'test-inv',
+            'domain' => 'kolabnow.com',
+            'password' => 'testtest',
+            'password_confirmation' => 'testtest',
+        ];
+
+        // Test invalid plan identifier
+        $response = $this->post('/api/auth/signup', $post);
+        $response->assertStatus(422);
+
+        $json = $response->json();
+
+        $this->assertSame('error', $json['status']);
+        $this->assertCount(1, $json['errors']);
+        $this->assertSame("The selected plan is invalid.", $json['errors']['plan']);
+
+        // Test valid input
+        $post['plan'] = $plan->title;
+        $response = $this->post('/api/auth/signup', $post);
+        $json = $response->json();
+
+        $response->assertStatus(200);
+        $this->assertSame('success', $json['status']);
+        $this->assertNotEmpty($json['access_token']);
+        $this->assertSame('test-inv@kolabnow.com', $json['email']);
+        $this->assertTrue($json['isLocked']);
+        $user = User::where('email', 'test-inv@kolabnow.com')->first();
+        $this->assertNotEmpty($user);
+        $this->assertSame($plan->id, $user->getSetting('plan_id'));
+    }
+
     /**
      * Test signup via invitation
      */
     public function testSignupViaInvitation(): void
     {
         Queue::fake();
 
         $invitation = SI::create(['email' => 'email1@ext.com']);
 
         $post = [
             'invitation' => 'abc',
             'first_name' => 'Signup',
             'last_name' => 'User',
             'login' => 'test-inv',
             'domain' => 'kolabnow.com',
             'password' => 'testtest',
             'password_confirmation' => 'testtest',
         ];
 
         // Test invalid invitation identifier
         $response = $this->post('/api/auth/signup', $post);
         $response->assertStatus(404);
 
         // Test valid input
         $post['invitation'] = $invitation->id;
         $response = $this->post('/api/auth/signup', $post);
         $result = $response->json();
 
         $response->assertStatus(200);
         $this->assertSame('success', $result['status']);
         $this->assertSame('bearer', $result['token_type']);
         $this->assertTrue(!empty($result['expires_in']) && is_int($result['expires_in']) && $result['expires_in'] > 0);
         $this->assertNotEmpty($result['access_token']);
         $this->assertSame('test-inv@kolabnow.com', $result['email']);
 
         // Check if the user has been created
         $user = User::where('email', 'test-inv@kolabnow.com')->first();
 
         $this->assertNotEmpty($user);
 
         // Check user settings
         $this->assertSame($invitation->email, $user->getSetting('external_email'));
         $this->assertSame($post['first_name'], $user->getSetting('first_name'));
         $this->assertSame($post['last_name'], $user->getSetting('last_name'));
 
         $invitation->refresh();
 
         $this->assertSame($user->id, $invitation->user_id);
         $this->assertTrue($invitation->isCompleted());
 
         // TODO: Test POST params validation
     }
 
     /**
      * List of login/domain validation cases for testValidateLogin()
      *
      * @return array Arguments for testValidateLogin()
      */
     public function dataValidateLogin(): array
     {
         $domain = $this->getPublicDomain();
 
         return [
             // Individual account
             ['', $domain, false, ['login' => 'The login field is required.']],
             ['test123456', 'localhost', false, ['domain' => 'The specified domain is invalid.']],
             ['test123456', 'unknown-domain.org', false, ['domain' => 'The specified domain is invalid.']],
             ['test.test', $domain, false, null],
             ['test_test', $domain, false, null],
             ['test-test', $domain, false, null],
             ['admin', $domain, false, ['login' => 'The specified login is not available.']],
             ['administrator', $domain, false, ['login' => 'The specified login is not available.']],
             ['sales', $domain, false, ['login' => 'The specified login is not available.']],
             ['root', $domain, false, ['login' => 'The specified login is not available.']],
 
             // Domain account
             ['admin', 'kolabsys.com', true, null],
             ['testnonsystemdomain', 'invalid', true, ['domain' => 'The specified domain is invalid.']],
             ['testnonsystemdomain', '.com', true, ['domain' => 'The specified domain is invalid.']],
         ];
     }
 
     /**
      * Signup login/domain validation.
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      *
      * @dataProvider dataValidateLogin
      */
     public function testValidateLogin($login, $domain, $external, $expected_result): void
     {
         $result = $this->invokeMethod(new SignupController(), 'validateLogin', [$login, $domain, $external]);
 
         $this->assertSame($expected_result, $result);
     }
 
     /**
      * Signup login/domain validation, more cases
      */
     public function testValidateLoginMore(): void
     {
         Queue::fake();
 
         // Test registering for an email of an existing group
         $login = 'group-test';
         $domain = 'kolabnow.com';
         $group = $this->getTestGroup("{$login}@{$domain}");
         $external = false;
 
         $result = $this->invokeMethod(new SignupController(), 'validateLogin', [$login, $domain, $external]);
 
         $this->assertSame(['login' => 'The specified login is not available.'], $result);
 
         // Test registering for an email of an existing, but soft-deleted group
         $group->delete();
 
         $result = $this->invokeMethod(new SignupController(), 'validateLogin', [$login, $domain, $external]);
 
         $this->assertSame(['login' => 'The specified login is not available.'], $result);
 
         // Test registering for an email of an existing user
         $domain = $this->getPublicDomain();
         $login = 'signuplogin';
         $user = $this->getTestUser("{$login}@{$domain}");
         $external = false;
 
         $result = $this->invokeMethod(new SignupController(), 'validateLogin', [$login, $domain, $external]);
 
         $this->assertSame(['login' => 'The specified login is not available.'], $result);
 
         // Test registering for an email of an existing, but soft-deleted user
         $user->delete();
 
         $result = $this->invokeMethod(new SignupController(), 'validateLogin', [$login, $domain, $external]);
 
         $this->assertSame(['login' => 'The specified login is not available.'], $result);
 
         // Test registering for a domain that exists
         $external = true;
         $domain = $this->getTestDomain(
             'external.com',
             ['status' => Domain::STATUS_NEW, 'type' => Domain::TYPE_EXTERNAL]
         );
 
         $result = $this->invokeMethod(new SignupController(), 'validateLogin', [$login, $domain->namespace, $external]);
 
         $this->assertSame(['domain' => 'The specified domain is not available.'], $result);
 
         // Test registering for a domain that exists but is soft-deleted
         $domain->delete();
 
         $result = $this->invokeMethod(new SignupController(), 'validateLogin', [$login, $domain->namespace, $external]);
 
         $this->assertSame(['domain' => 'The specified domain is not available.'], $result);
     }
 }
diff --git a/src/tests/Feature/Controller/UsersTest.php b/src/tests/Feature/Controller/UsersTest.php
index 26e27311..919802e8 100644
--- a/src/tests/Feature/Controller/UsersTest.php
+++ b/src/tests/Feature/Controller/UsersTest.php
@@ -1,1690 +1,1718 @@
 <?php
 
 namespace Tests\Feature\Controller;
 
 use App\Discount;
 use App\Domain;
 use App\Http\Controllers\API\V4\UsersController;
 use App\Package;
+use App\Plan;
 use App\Sku;
 use App\Tenant;
 use App\User;
 use App\Wallet;
 use Carbon\Carbon;
 use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Str;
 use Tests\TestCase;
 
 class UsersTest extends TestCase
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->clearBetaEntitlements();
         $this->deleteTestUser('jane@kolabnow.com');
         $this->deleteTestUser('UsersControllerTest1@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest2@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest3@userscontroller.com');
         $this->deleteTestUser('UserEntitlement2A@UserEntitlement.com');
         $this->deleteTestUser('john2.doe2@kolab.org');
         $this->deleteTestUser('deleted@kolab.org');
         $this->deleteTestUser('deleted@kolabnow.com');
         $this->deleteTestDomain('userscontroller.com');
         $this->deleteTestGroup('group-test@kolabnow.com');
         $this->deleteTestGroup('group-test@kolab.org');
         $this->deleteTestSharedFolder('folder-test@kolabnow.com');
         $this->deleteTestResource('resource-test@kolabnow.com');
         Sku::where('title', 'test')->delete();
 
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
         $wallet->discount()->dissociate();
         $wallet->settings()->whereIn('key', ['mollie_id', 'stripe_id'])->delete();
         $wallet->save();
         $user->settings()->whereIn('key', ['greylist_enabled', 'guam_enabled'])->delete();
         $user->status |= User::STATUS_IMAP_READY | User::STATUS_LDAP_READY;
+        $user->status &= ~User::STATUS_RESTRICTED;
         $user->save();
+        Plan::withEnvTenantContext()->where('title', 'individual')->update(['mode' => 'email']);
+        $user->setSettings(['plan_id' => null]);
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->clearBetaEntitlements();
         $this->deleteTestUser('jane@kolabnow.com');
         $this->deleteTestUser('UsersControllerTest1@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest2@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest3@userscontroller.com');
         $this->deleteTestUser('UserEntitlement2A@UserEntitlement.com');
         $this->deleteTestUser('john2.doe2@kolab.org');
         $this->deleteTestUser('deleted@kolab.org');
         $this->deleteTestUser('deleted@kolabnow.com');
         $this->deleteTestDomain('userscontroller.com');
         $this->deleteTestGroup('group-test@kolabnow.com');
         $this->deleteTestGroup('group-test@kolab.org');
         $this->deleteTestSharedFolder('folder-test@kolabnow.com');
         $this->deleteTestResource('resource-test@kolabnow.com');
         Sku::where('title', 'test')->delete();
 
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
         $wallet->discount()->dissociate();
         $wallet->settings()->whereIn('key', ['mollie_id', 'stripe_id'])->delete();
         $wallet->save();
         $user->settings()->whereIn('key', ['greylist_enabled', 'guam_enabled'])->delete();
         $user->status |= User::STATUS_IMAP_READY | User::STATUS_LDAP_READY;
+        $user->status &= ~User::STATUS_RESTRICTED;
         $user->save();
+        Plan::withEnvTenantContext()->where('title', 'individual')->update(['mode' => 'email']);
+        $user->setSettings(['plan_id' => null]);
 
         parent::tearDown();
     }
 
     /**
      * Test user deleting (DELETE /api/v4/users/<id>)
      */
     public function testDestroy(): void
     {
         // First create some users/accounts to delete
         $package_kolab = \App\Package::where('title', 'kolab')->first();
         $package_domain = \App\Package::where('title', 'domain-hosting')->first();
 
         $john = $this->getTestUser('john@kolab.org');
         $user1 = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $user2 = $this->getTestUser('UsersControllerTest2@userscontroller.com');
         $user3 = $this->getTestUser('UsersControllerTest3@userscontroller.com');
         $domain = $this->getTestDomain('userscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
         $user1->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $user1);
         $user1->assignPackage($package_kolab, $user2);
         $user1->assignPackage($package_kolab, $user3);
 
         // Test unauth access
         $response = $this->delete("api/v4/users/{$user2->id}");
         $response->assertStatus(401);
 
         // Test access to other user/account
         $response = $this->actingAs($john)->delete("api/v4/users/{$user2->id}");
         $response->assertStatus(403);
         $response = $this->actingAs($john)->delete("api/v4/users/{$user1->id}");
         $response->assertStatus(403);
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Access denied", $json['message']);
         $this->assertCount(2, $json);
 
         // Test that non-controller cannot remove himself
         $response = $this->actingAs($user3)->delete("api/v4/users/{$user3->id}");
         $response->assertStatus(403);
 
         // Test removing a non-controller user
         $response = $this->actingAs($user1)->delete("api/v4/users/{$user3->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals('success', $json['status']);
         $this->assertEquals('User deleted successfully.', $json['message']);
 
         // Test removing self (an account with users)
         $response = $this->actingAs($user1)->delete("api/v4/users/{$user1->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals('success', $json['status']);
         $this->assertEquals('User deleted successfully.', $json['message']);
     }
 
     /**
      * Test user deleting (DELETE /api/v4/users/<id>)
      */
     public function testDestroyByController(): void
     {
         // Create an account with additional controller - $user2
         $package_kolab = \App\Package::where('title', 'kolab')->first();
         $package_domain = \App\Package::where('title', 'domain-hosting')->first();
         $user1 = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $user2 = $this->getTestUser('UsersControllerTest2@userscontroller.com');
         $user3 = $this->getTestUser('UsersControllerTest3@userscontroller.com');
         $domain = $this->getTestDomain('userscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
         $user1->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $user1);
         $user1->assignPackage($package_kolab, $user2);
         $user1->assignPackage($package_kolab, $user3);
         $user1->wallets()->first()->addController($user2);
 
         // TODO/FIXME:
         //   For now controller can delete himself, as well as
         //   the whole account he has control to, including the owner
         //   Probably he should not be able to do none of those
         //   However, this is not 0-regression scenario as we
         //   do not fully support additional controllers.
 
         //$response = $this->actingAs($user2)->delete("api/v4/users/{$user2->id}");
         //$response->assertStatus(403);
 
         $response = $this->actingAs($user2)->delete("api/v4/users/{$user3->id}");
         $response->assertStatus(200);
 
         $response = $this->actingAs($user2)->delete("api/v4/users/{$user1->id}");
         $response->assertStatus(200);
 
         // Note: More detailed assertions in testDestroy() above
 
         $this->assertTrue($user1->fresh()->trashed());
         $this->assertTrue($user2->fresh()->trashed());
         $this->assertTrue($user3->fresh()->trashed());
     }
 
     /**
      * Test user listing (GET /api/v4/users)
      */
     public function testIndex(): void
     {
         // Test unauth access
         $response = $this->get("api/v4/users");
         $response->assertStatus(401);
 
         $jack = $this->getTestUser('jack@kolab.org');
         $joe = $this->getTestUser('joe@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         $response = $this->actingAs($jack)->get("/api/v4/users");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(0, $json['count']);
         $this->assertCount(0, $json['list']);
 
         $response = $this->actingAs($john)->get("/api/v4/users");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(4, $json['count']);
         $this->assertCount(4, $json['list']);
         $this->assertSame($jack->email, $json['list'][0]['email']);
         $this->assertSame($joe->email, $json['list'][1]['email']);
         $this->assertSame($john->email, $json['list'][2]['email']);
         $this->assertSame($ned->email, $json['list'][3]['email']);
         // Values below are tested by Unit tests
         $this->assertArrayHasKey('isDeleted', $json['list'][0]);
         $this->assertArrayHasKey('isDegraded', $json['list'][0]);
         $this->assertArrayHasKey('isAccountDegraded', $json['list'][0]);
         $this->assertArrayHasKey('isSuspended', $json['list'][0]);
         $this->assertArrayHasKey('isActive', $json['list'][0]);
         $this->assertArrayHasKey('isReady', $json['list'][0]);
         $this->assertArrayHasKey('isImapReady', $json['list'][0]);
         if (\config('app.with_ldap')) {
             $this->assertArrayHasKey('isLdapReady', $json['list'][0]);
         } else {
             $this->assertArrayNotHasKey('isLdapReady', $json['list'][0]);
         }
 
         $response = $this->actingAs($ned)->get("/api/v4/users");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(4, $json['count']);
         $this->assertCount(4, $json['list']);
         $this->assertSame($jack->email, $json['list'][0]['email']);
         $this->assertSame($joe->email, $json['list'][1]['email']);
         $this->assertSame($john->email, $json['list'][2]['email']);
         $this->assertSame($ned->email, $json['list'][3]['email']);
 
         // Search by user email
         $response = $this->actingAs($john)->get("/api/v4/users?search=jack@k");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(1, $json['count']);
         $this->assertCount(1, $json['list']);
         $this->assertSame($jack->email, $json['list'][0]['email']);
 
         // Search by alias
         $response = $this->actingAs($john)->get("/api/v4/users?search=monster");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(1, $json['count']);
         $this->assertCount(1, $json['list']);
         $this->assertSame($joe->email, $json['list'][0]['email']);
 
         // Search by name
         $response = $this->actingAs($john)->get("/api/v4/users?search=land");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(1, $json['count']);
         $this->assertCount(1, $json['list']);
         $this->assertSame($ned->email, $json['list'][0]['email']);
 
         // TODO: Test paging
     }
 
     /**
      * Test fetching user data/profile (GET /api/v4/users/<user-id>)
      */
     public function testShow(): void
     {
         $userA = $this->getTestUser('UserEntitlement2A@UserEntitlement.com');
 
         // Test getting profile of self
         $response = $this->actingAs($userA)->get("/api/v4/users/{$userA->id}");
 
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertEquals($userA->id, $json['id']);
         $this->assertEquals($userA->email, $json['email']);
         $this->assertTrue(is_array($json['statusInfo']));
         $this->assertTrue(is_array($json['settings']));
         $this->assertTrue($json['config']['greylist_enabled']);
         $this->assertFalse($json['config']['guam_enabled']);
         $this->assertSame([], $json['skus']);
         $this->assertSame([], $json['aliases']);
         // Values below are tested by Unit tests
         $this->assertArrayHasKey('isDeleted', $json);
         $this->assertArrayHasKey('isDegraded', $json);
         $this->assertArrayHasKey('isAccountDegraded', $json);
         $this->assertArrayHasKey('isSuspended', $json);
         $this->assertArrayHasKey('isActive', $json);
         $this->assertArrayHasKey('isReady', $json);
         $this->assertArrayHasKey('isImapReady', $json);
         if (\config('app.with_ldap')) {
             $this->assertArrayHasKey('isLdapReady', $json);
         } else {
             $this->assertArrayNotHasKey('isLdapReady', $json);
         }
 
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         // Test unauthorized access to a profile of other user
         $response = $this->actingAs($jack)->get("/api/v4/users/{$userA->id}");
         $response->assertStatus(403);
 
         // Test authorized access to a profile of other user
         // Ned: Additional account controller
         $response = $this->actingAs($ned)->get("/api/v4/users/{$john->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
         $this->assertSame(['john.doe@kolab.org'], $json['aliases']);
 
         $response = $this->actingAs($ned)->get("/api/v4/users/{$jack->id}");
         $response->assertStatus(200);
 
         // John: Account owner
         $response = $this->actingAs($john)->get("/api/v4/users/{$jack->id}");
         $response->assertStatus(200);
         $response = $this->actingAs($john)->get("/api/v4/users/{$ned->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $storage_sku = Sku::withEnvTenantContext()->where('title', 'storage')->first();
         $groupware_sku = Sku::withEnvTenantContext()->where('title', 'groupware')->first();
         $mailbox_sku = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();
         $secondfactor_sku = Sku::withEnvTenantContext()->where('title', '2fa')->first();
 
         $this->assertCount(5, $json['skus']);
 
         $this->assertSame(5, $json['skus'][$storage_sku->id]['count']);
         $this->assertSame([0,0,0,0,0], $json['skus'][$storage_sku->id]['costs']);
         $this->assertSame(1, $json['skus'][$groupware_sku->id]['count']);
         $this->assertSame([490], $json['skus'][$groupware_sku->id]['costs']);
         $this->assertSame(1, $json['skus'][$mailbox_sku->id]['count']);
         $this->assertSame([500], $json['skus'][$mailbox_sku->id]['costs']);
         $this->assertSame(1, $json['skus'][$secondfactor_sku->id]['count']);
         $this->assertSame([0], $json['skus'][$secondfactor_sku->id]['costs']);
 
         $this->assertSame([], $json['aliases']);
     }
 
     /**
      * Test fetching SKUs list for a user (GET /users/<id>/skus)
      */
     public function testSkus(): void
     {
         $user = $this->getTestUser('john@kolab.org');
 
         // Unauth access not allowed
         $response = $this->get("api/v4/users/{$user->id}/skus");
         $response->assertStatus(401);
 
         // Create an sku for another tenant, to make sure it is not included in the result
         $nsku = Sku::create([
                 'title' => 'test',
                 'name' => 'Test',
                 'description' => '',
                 'active' => true,
                 'cost' => 100,
                 'handler_class' => 'Mailbox',
         ]);
         $tenant = Tenant::whereNotIn('id', [\config('app.tenant_id')])->first();
         $nsku->tenant_id = $tenant->id;
         $nsku->save();
 
         $response = $this->actingAs($user)->get("api/v4/users/{$user->id}/skus");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(5, $json);
 
         $this->assertSkuElement('mailbox', $json[0], [
                 'prio' => 100,
                 'type' => 'user',
                 'handler' => 'Mailbox',
                 'enabled' => true,
                 'readonly' => true,
         ]);
 
         $this->assertSkuElement('storage', $json[1], [
                 'prio' => 90,
                 'type' => 'user',
                 'handler' => 'Storage',
                 'enabled' => true,
                 'readonly' => true,
                 'range' => [
                     'min' => 5,
                     'max' => 100,
                     'unit' => 'GB',
                 ]
         ]);
 
         $this->assertSkuElement('groupware', $json[2], [
                 'prio' => 80,
                 'type' => 'user',
                 'handler' => 'Groupware',
                 'enabled' => false,
                 'readonly' => false,
         ]);
 
         $this->assertSkuElement('activesync', $json[3], [
                 'prio' => 70,
                 'type' => 'user',
                 'handler' => 'Activesync',
                 'enabled' => false,
                 'readonly' => false,
                 'required' => ['Groupware'],
         ]);
 
         $this->assertSkuElement('2fa', $json[4], [
                 'prio' => 60,
                 'type' => 'user',
                 'handler' => 'Auth2F',
                 'enabled' => false,
                 'readonly' => false,
                 'forbidden' => ['Activesync'],
         ]);
 
         // Test inclusion of beta SKUs
         $sku = Sku::withEnvTenantContext()->where('title', 'beta')->first();
         $user->assignSku($sku);
         $response = $this->actingAs($user)->get("api/v4/users/{$user->id}/skus");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(6, $json);
 
         $this->assertSkuElement('beta', $json[5], [
                 'prio' => 10,
                 'type' => 'user',
                 'handler' => 'Beta',
                 'enabled' => false,
                 'readonly' => false,
         ]);
     }
 
     /**
      * Test fetching user status (GET /api/v4/users/<user-id>/status)
      * and forcing setup process update (?refresh=1)
      *
      * @group imap
      * @group dns
      */
     public function testStatus(): void
     {
         Queue::fake();
 
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
 
         // Test unauthorized access
         $response = $this->actingAs($jack)->get("/api/v4/users/{$john->id}/status");
         $response->assertStatus(403);
 
         $john->status &= ~User::STATUS_IMAP_READY;
         $john->status &= ~User::STATUS_LDAP_READY;
         $john->save();
 
         // Get user status
         $response = $this->actingAs($john)->get("/api/v4/users/{$john->id}/status");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertFalse($json['isReady']);
         $this->assertFalse($json['isImapReady']);
         $this->assertTrue(empty($json['status']));
         $this->assertTrue(empty($json['message']));
 
         if (\config('app.with_ldap')) {
             $this->assertFalse($json['isLdapReady']);
             $this->assertSame('user-ldap-ready', $json['process'][1]['label']);
             $this->assertFalse($json['process'][1]['state']);
             $this->assertSame('user-imap-ready', $json['process'][2]['label']);
             $this->assertFalse($json['process'][2]['state']);
         } else {
             $this->assertArrayNotHasKey('isLdapReady', $json);
             $this->assertSame('user-imap-ready', $json['process'][1]['label']);
             $this->assertFalse($json['process'][1]['state']);
         }
 
         // Make sure the domain is confirmed (other test might unset that status)
         $domain = $this->getTestDomain('kolab.org');
         $domain->status |= Domain::STATUS_CONFIRMED;
         $domain->save();
 
         // Now "reboot" the process
         Queue::fake();
         $response = $this->actingAs($john)->get("/api/v4/users/{$john->id}/status?refresh=1");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertFalse($json['isImapReady']);
         $this->assertFalse($json['isReady']);
         $this->assertSame('success', $json['status']);
         $this->assertSame('Setup process has been pushed. Please wait.', $json['message']);
 
         if (\config('app.with_ldap')) {
             $this->assertFalse($json['isLdapReady']);
             $this->assertSame('user-ldap-ready', $json['process'][1]['label']);
             $this->assertSame(false, $json['process'][1]['state']);
             $this->assertSame('user-imap-ready', $json['process'][2]['label']);
             $this->assertSame(false, $json['process'][2]['state']);
         } else {
             $this->assertSame('user-imap-ready', $json['process'][1]['label']);
             $this->assertSame(false, $json['process'][1]['state']);
         }
 
         Queue::assertPushed(\App\Jobs\User\CreateJob::class, 1);
     }
 
     /**
      * Test UsersController::statusInfo()
      */
     public function testStatusInfo(): void
     {
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $domain = $this->getTestDomain('userscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
 
         $user->created_at = Carbon::now();
         $user->status = User::STATUS_NEW;
         $user->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertFalse($result['isDone']);
         $this->assertSame([], $result['skus']);
         $this->assertCount(3, $result['process']);
         $this->assertSame('user-new', $result['process'][0]['label']);
         $this->assertSame(true, $result['process'][0]['state']);
         if (\config('app.with_ldap')) {
             $this->assertSame('user-ldap-ready', $result['process'][1]['label']);
             $this->assertSame(false, $result['process'][1]['state']);
             $this->assertSame('user-imap-ready', $result['process'][2]['label']);
             $this->assertSame(false, $result['process'][2]['state']);
         } else {
             $this->assertSame('user-imap-ready', $result['process'][1]['label']);
             $this->assertSame(false, $result['process'][1]['state']);
         }
         $this->assertSame('running', $result['processState']);
         $this->assertTrue($result['enableRooms']);
         $this->assertFalse($result['enableBeta']);
 
         $user->created_at = Carbon::now()->subSeconds(181);
         $user->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertSame('failed', $result['processState']);
 
         $user->status |= User::STATUS_LDAP_READY | User::STATUS_IMAP_READY;
         $user->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertTrue($result['isDone']);
         $this->assertCount(3, $result['process']);
         $this->assertSame('done', $result['processState']);
         $this->assertSame('user-new', $result['process'][0]['label']);
         $this->assertSame(true, $result['process'][0]['state']);
         if (\config('app.with_ldap')) {
             $this->assertSame('user-ldap-ready', $result['process'][1]['label']);
             $this->assertSame(true, $result['process'][1]['state']);
             $this->assertSame('user-imap-ready', $result['process'][2]['label']);
             $this->assertSame(true, $result['process'][2]['state']);
         } else {
             $this->assertSame('user-imap-ready', $result['process'][1]['label']);
             $this->assertSame(true, $result['process'][1]['state']);
         }
 
         $domain->status |= Domain::STATUS_VERIFIED;
         $domain->type = Domain::TYPE_EXTERNAL;
         $domain->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertFalse($result['isDone']);
         $this->assertSame([], $result['skus']);
         $this->assertCount(7, $result['process']);
         $this->assertSame('user-new', $result['process'][0]['label']);
         $this->assertSame(true, $result['process'][0]['state']);
         if (\config('app.with_ldap')) {
             $this->assertSame('user-ldap-ready', $result['process'][1]['label']);
             $this->assertSame(true, $result['process'][1]['state']);
             $this->assertSame('user-imap-ready', $result['process'][2]['label']);
             $this->assertSame(true, $result['process'][2]['state']);
             $this->assertSame('domain-new', $result['process'][3]['label']);
             $this->assertSame(true, $result['process'][3]['state']);
             $this->assertSame('domain-ldap-ready', $result['process'][4]['label']);
             $this->assertSame(false, $result['process'][4]['state']);
             $this->assertSame('domain-verified', $result['process'][5]['label']);
             $this->assertSame(true, $result['process'][5]['state']);
             $this->assertSame('domain-confirmed', $result['process'][6]['label']);
             $this->assertSame(false, $result['process'][6]['state']);
         } else {
             $this->assertSame('user-imap-ready', $result['process'][1]['label']);
             $this->assertSame(true, $result['process'][1]['state']);
             $this->assertSame('domain-new', $result['process'][2]['label']);
             $this->assertSame(true, $result['process'][2]['state']);
             $this->assertSame('domain-verified', $result['process'][3]['label']);
             $this->assertSame(true, $result['process'][3]['state']);
             $this->assertSame('domain-confirmed', $result['process'][4]['label']);
             $this->assertSame(false, $result['process'][4]['state']);
         }
 
         // Test 'skus' property
         $user->assignSku(Sku::withEnvTenantContext()->where('title', 'beta')->first());
 
         $result = UsersController::statusInfo($user);
 
         $this->assertSame(['beta'], $result['skus']);
         $this->assertTrue($result['enableBeta']);
 
         $user->assignSku(Sku::withEnvTenantContext()->where('title', 'groupware')->first());
 
         $result = UsersController::statusInfo($user);
 
         $this->assertSame(['beta', 'groupware'], $result['skus']);
 
         // Degraded user
         $user->status |= User::STATUS_DEGRADED;
         $user->save();
 
         $result = UsersController::statusInfo($user);
         $this->assertTrue($result['enableBeta']);
         $this->assertFalse($result['enableRooms']);
 
         // User in a tenant without 'room' SKU
         $user->status = User::STATUS_LDAP_READY | User::STATUS_IMAP_READY | User::STATUS_ACTIVE;
         $user->tenant_id = Tenant::where('title', 'Sample Tenant')->first()->id;
         $user->save();
 
         $result = UsersController::statusInfo($user);
         $this->assertTrue($result['enableBeta']);
         $this->assertFalse($result['enableRooms']);
     }
 
     /**
      * Test user config update (POST /api/v4/users/<user>/config)
      */
     public function testSetConfig(): void
     {
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
 
         $john->setSetting('greylist_enabled', null);
         $john->setSetting('guam_enabled', null);
         $john->setSetting('password_policy', null);
         $john->setSetting('max_password_age', null);
 
         // Test unknown user id
         $post = ['greylist_enabled' => 1];
         $response = $this->actingAs($john)->post("/api/v4/users/123/config", $post);
         $json = $response->json();
 
         $response->assertStatus(404);
 
         // Test access by user not being a wallet controller
         $post = ['greylist_enabled' => 1];
         $response = $this->actingAs($jack)->post("/api/v4/users/{$john->id}/config", $post);
         $json = $response->json();
 
         $response->assertStatus(403);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Access denied", $json['message']);
         $this->assertCount(2, $json);
 
         // Test some invalid data
         $post = ['grey' => 1, 'password_policy' => 'min:1,max:255'];
         $response = $this->actingAs($john)->post("/api/v4/users/{$john->id}/config", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertCount(2, $json['errors']);
         $this->assertSame("The requested configuration parameter is not supported.", $json['errors']['grey']);
         $this->assertSame("Minimum password length cannot be less than 6.", $json['errors']['password_policy']);
 
         $this->assertNull($john->fresh()->getSetting('greylist_enabled'));
 
         // Test some valid data
         $post = [
             'greylist_enabled' => 1,
             'guam_enabled' => 1,
             'password_policy' => 'min:10,max:255,upper,lower,digit,special',
             'max_password_age' => 6,
         ];
 
         $response = $this->actingAs($john)->post("/api/v4/users/{$john->id}/config", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(2, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame('User settings updated successfully.', $json['message']);
 
         $this->assertSame('true', $john->getSetting('greylist_enabled'));
         $this->assertSame('true', $john->getSetting('guam_enabled'));
         $this->assertSame('min:10,max:255,upper,lower,digit,special', $john->getSetting('password_policy'));
         $this->assertSame('6', $john->getSetting('max_password_age'));
 
         // Test some valid data, acting as another account controller
         $ned = $this->getTestUser('ned@kolab.org');
         $post = ['greylist_enabled' => 0, 'guam_enabled' => 0, 'password_policy' => 'min:10,max:255,upper,last:1'];
         $response = $this->actingAs($ned)->post("/api/v4/users/{$john->id}/config", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(2, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame('User settings updated successfully.', $json['message']);
 
         $this->assertSame('false', $john->fresh()->getSetting('greylist_enabled'));
         $this->assertSame(null, $john->fresh()->getSetting('guam_enabled'));
         $this->assertSame('min:10,max:255,upper,last:1', $john->fresh()->getSetting('password_policy'));
     }
 
     /**
      * Test user creation (POST /api/v4/users)
      */
     public function testStore(): void
     {
         Queue::fake();
 
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $john->setSetting('password_policy', 'min:8,max:100,digit');
         $deleted_priv = $this->getTestUser('deleted@kolab.org');
         $deleted_priv->delete();
 
         // Test empty request
         $response = $this->actingAs($john)->post("/api/v4/users", []);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("The email field is required.", $json['errors']['email']);
         $this->assertSame("The password field is required.", $json['errors']['password'][0]);
         $this->assertCount(2, $json);
 
         // Test access by user not being a wallet controller
         $post = ['first_name' => 'Test'];
         $response = $this->actingAs($jack)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(403);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Access denied", $json['message']);
         $this->assertCount(2, $json);
 
         // Test some invalid data
         $post = ['password' => '12345678', 'email' => 'invalid'];
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertSame('The password confirmation does not match.', $json['errors']['password'][0]);
         $this->assertSame('The specified email is invalid.', $json['errors']['email']);
 
         // Test existing user email
         $post = [
             'password' => 'simple123',
             'password_confirmation' => 'simple123',
             'first_name' => 'John2',
             'last_name' => 'Doe2',
             'email' => 'jack.daniels@kolab.org',
         ];
 
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertSame('The specified email is not available.', $json['errors']['email']);
 
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
 
         $post = [
             'password' => 'simple123',
             'password_confirmation' => 'simple123',
             'first_name' => 'John2',
             'last_name' => 'Doe2',
             'email' => 'john2.doe2@kolab.org',
             'organization' => 'TestOrg',
             'aliases' => ['useralias1@kolab.org', 'deleted@kolab.org'],
         ];
 
         // Missing package
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Package is required.", $json['errors']['package']);
         $this->assertCount(2, $json);
 
         // Invalid package
         $post['package'] = $package_domain->id;
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Invalid package selected.", $json['errors']['package']);
         $this->assertCount(2, $json);
 
         // Test password policy checking
         $post['package'] = $package_kolab->id;
         $post['password'] = 'password';
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("The password confirmation does not match.", $json['errors']['password'][0]);
         $this->assertSame("Specified password does not comply with the policy.", $json['errors']['password'][1]);
         $this->assertCount(2, $json);
 
         // Test password confirmation
         $post['password_confirmation'] = 'password';
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Specified password does not comply with the policy.", $json['errors']['password'][0]);
         $this->assertCount(2, $json);
 
         // Test full and valid data
         $post['password'] = 'password123';
         $post['password_confirmation'] = 'password123';
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User created successfully.", $json['message']);
         $this->assertCount(2, $json);
 
         $user = User::where('email', 'john2.doe2@kolab.org')->first();
         $this->assertInstanceOf(User::class, $user);
         $this->assertSame('John2', $user->getSetting('first_name'));
         $this->assertSame('Doe2', $user->getSetting('last_name'));
         $this->assertSame('TestOrg', $user->getSetting('organization'));
         $this->assertFalse($user->isRestricted());
         /** @var \App\UserAlias[] $aliases */
         $aliases = $user->aliases()->orderBy('alias')->get();
         $this->assertCount(2, $aliases);
         $this->assertSame('deleted@kolab.org', $aliases[0]->alias);
         $this->assertSame('useralias1@kolab.org', $aliases[1]->alias);
         // Assert the new user entitlements
         $this->assertEntitlements($user, ['groupware', 'mailbox',
             'storage', 'storage', 'storage', 'storage', 'storage']);
         // Assert the wallet to which the new user should be assigned to
         $wallet = $user->wallet();
         $this->assertSame($john->wallets->first()->id, $wallet->id);
 
         // Attempt to create a user previously deleted
         $user->delete();
 
         $post['package'] = $package_kolab->id;
         $post['aliases'] = [];
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User created successfully.", $json['message']);
         $this->assertCount(2, $json);
 
         $user = User::where('email', 'john2.doe2@kolab.org')->first();
         $this->assertInstanceOf(User::class, $user);
         $this->assertSame('John2', $user->getSetting('first_name'));
         $this->assertSame('Doe2', $user->getSetting('last_name'));
         $this->assertSame('TestOrg', $user->getSetting('organization'));
         $this->assertCount(0, $user->aliases()->get());
         $this->assertEntitlements($user, ['groupware', 'mailbox',
             'storage', 'storage', 'storage', 'storage', 'storage']);
 
         // Test password reset link "mode"
         $code = new \App\VerificationCode(['mode' => 'password-reset', 'active' => false]);
         $john->verificationcodes()->save($code);
 
         $post = [
             'first_name' => 'John2',
             'last_name' => 'Doe2',
             'email' => 'deleted@kolab.org',
             'organization' => '',
             'aliases' => [],
             'passwordLinkCode' => $code->short_code . '-' . $code->code,
             'package' => $package_kolab->id,
         ];
 
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User created successfully.", $json['message']);
         $this->assertCount(2, $json);
 
         $user = $this->getTestUser('deleted@kolab.org');
         $code->refresh();
 
         $this->assertSame($user->id, $code->user_id);
         $this->assertTrue($code->active);
         $this->assertTrue(is_string($user->password) && strlen($user->password) >= 60);
 
         // Test acting as account controller not owner, which is not yet supported
         $john->wallets->first()->addController($user);
 
         $response = $this->actingAs($user)->post("/api/v4/users", []);
         $response->assertStatus(403);
 
         // Test that creating a user in a restricted account creates a restricted user
         $package_domain = Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $owner = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $domain = $this->getTestDomain(
             'userscontroller.com',
             ['status' => Domain::STATUS_NEW, 'type' => Domain::TYPE_EXTERNAL]
         );
         $domain->assignPackage($package_domain, $owner);
         $owner->restrict();
 
         $post = [
             'password' => 'simple123',
             'password_confirmation' => 'simple123',
             'email' => 'UsersControllerTest2@userscontroller.com',
             'package' => $package_kolab->id,
         ];
 
         $response = $this->actingAs($owner)->post("/api/v4/users", $post);
         $response->assertStatus(200);
 
         $user = User::where('email', 'UsersControllerTest1@userscontroller.com')->first();
         $this->assertTrue($user->isRestricted());
     }
 
     /**
      * Test user update (PUT /api/v4/users/<user-id>)
      */
     public function testUpdate(): void
     {
         $userA = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $userA->setSetting('password_policy', 'min:8,digit');
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $domain = $this->getTestDomain(
             'userscontroller.com',
             ['status' => Domain::STATUS_NEW, 'type' => Domain::TYPE_EXTERNAL]
         );
 
         // Test unauthorized update of other user profile
         $response = $this->actingAs($jack)->get("/api/v4/users/{$userA->id}", []);
         $response->assertStatus(403);
 
         // Test authorized update of account owner by account controller
         $response = $this->actingAs($ned)->get("/api/v4/users/{$john->id}", []);
         $response->assertStatus(200);
 
         // Test updating of self (empty request)
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", []);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User data updated successfully.", $json['message']);
         $this->assertTrue(!empty($json['statusInfo']));
         $this->assertCount(3, $json);
 
         // Test some invalid data
         $post = ['password' => '1234567', 'currency' => 'invalid'];
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertSame("The password confirmation does not match.", $json['errors']['password'][0]);
         $this->assertSame("Specified password does not comply with the policy.", $json['errors']['password'][1]);
         $this->assertSame("The currency must be 3 characters.", $json['errors']['currency'][0]);
 
         // Test full profile update including password
         $post = [
             'password' => 'simple123',
             'password_confirmation' => 'simple123',
             'first_name' => 'John2',
             'last_name' => 'Doe2',
             'organization' => 'TestOrg',
             'phone' => '+123 123 123',
             'external_email' => 'external@gmail.com',
             'billing_address' => 'billing',
             'country' => 'CH',
             'currency' => 'CHF',
             'aliases' => ['useralias1@' . \config('app.domain'), 'useralias2@' . \config('app.domain')]
         ];
 
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User data updated successfully.", $json['message']);
         $this->assertTrue(!empty($json['statusInfo']));
         $this->assertCount(3, $json);
         $this->assertTrue($userA->password != $userA->fresh()->password);
         unset($post['password'], $post['password_confirmation'], $post['aliases']);
         foreach ($post as $key => $value) {
             $this->assertSame($value, $userA->getSetting($key));
         }
         $aliases = $userA->aliases()->orderBy('alias')->get();
         $this->assertCount(2, $aliases);
         $this->assertSame('useralias1@' . \config('app.domain'), $aliases[0]->alias);
         $this->assertSame('useralias2@' . \config('app.domain'), $aliases[1]->alias);
 
         // Test unsetting values
         $post = [
             'first_name' => '',
             'last_name' => '',
             'organization' => '',
             'phone' => '',
             'external_email' => '',
             'billing_address' => '',
             'country' => '',
             'currency' => '',
             'aliases' => ['useralias2@' . \config('app.domain')]
         ];
 
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User data updated successfully.", $json['message']);
         $this->assertTrue(!empty($json['statusInfo']));
         $this->assertCount(3, $json);
         unset($post['aliases']);
         foreach ($post as $key => $value) {
             $this->assertNull($userA->getSetting($key));
         }
         $aliases = $userA->aliases()->get();
         $this->assertCount(1, $aliases);
         $this->assertSame('useralias2@' . \config('app.domain'), $aliases[0]->alias);
 
         // Test error on some invalid aliases missing password confirmation
         $post = [
             'password' => 'simple123',
             'aliases' => [
                 'useralias2@' . \config('app.domain'),
                 'useralias1@kolab.org',
                 '@kolab.org',
             ]
         ];
 
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertCount(2, $json['errors']['aliases']);
         $this->assertSame("The specified domain is not available.", $json['errors']['aliases'][1]);
         $this->assertSame("The specified alias is invalid.", $json['errors']['aliases'][2]);
         $this->assertSame("The password confirmation does not match.", $json['errors']['password'][0]);
 
         // Test authorized update of other user
         $response = $this->actingAs($ned)->put("/api/v4/users/{$jack->id}", []);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertTrue(empty($json['statusInfo']));
 
         // TODO: Test error on aliases with invalid/non-existing/other-user's domain
 
         // Create entitlements and additional user for following tests
         $owner = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $user = $this->getTestUser('UsersControllerTest2@userscontroller.com');
         $package_domain = Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $package_kolab = Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_lite = Package::withEnvTenantContext()->where('title', 'lite')->first();
         $sku_mailbox = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();
         $sku_storage = Sku::withEnvTenantContext()->where('title', 'storage')->first();
         $sku_groupware = Sku::withEnvTenantContext()->where('title', 'groupware')->first();
 
         $domain = $this->getTestDomain(
             'userscontroller.com',
             [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_EXTERNAL,
             ]
         );
 
         $domain->assignPackage($package_domain, $owner);
         $owner->assignPackage($package_kolab);
         $owner->assignPackage($package_lite, $user);
 
         // Non-controller cannot update his own entitlements
         $post = ['skus' => []];
         $response = $this->actingAs($user)->put("/api/v4/users/{$user->id}", $post);
         $response->assertStatus(422);
 
         // Test updating entitlements
         $post = [
             'skus' => [
                 $sku_mailbox->id => 1,
                 $sku_storage->id => 6,
                 $sku_groupware->id => 1,
             ],
         ];
 
         $response = $this->actingAs($owner)->put("/api/v4/users/{$user->id}", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $storage_cost = $user->entitlements()
             ->where('sku_id', $sku_storage->id)
             ->orderBy('cost')
             ->pluck('cost')->all();
 
         $this->assertEntitlements(
             $user,
             ['groupware', 'mailbox', 'storage', 'storage', 'storage', 'storage', 'storage', 'storage']
         );
 
         $this->assertSame([0, 0, 0, 0, 0, 25], $storage_cost);
         $this->assertTrue(empty($json['statusInfo']));
 
         // Test password reset link "mode"
         $code = new \App\VerificationCode(['mode' => 'password-reset', 'active' => false]);
         $owner->verificationcodes()->save($code);
 
         $post = ['passwordLinkCode' => $code->short_code . '-' . $code->code];
 
         $response = $this->actingAs($owner)->put("/api/v4/users/{$user->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $code->refresh();
 
         $this->assertSame($user->id, $code->user_id);
         $this->assertTrue($code->active);
         $this->assertSame($user->password, $user->fresh()->password);
     }
 
     /**
      * Test UsersController::updateEntitlements()
      */
     public function testUpdateEntitlements(): void
     {
         $jane = $this->getTestUser('jane@kolabnow.com');
 
         $kolab = Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $storage = Sku::withEnvTenantContext()->where('title', 'storage')->first();
         $activesync = Sku::withEnvTenantContext()->where('title', 'activesync')->first();
         $groupware = Sku::withEnvTenantContext()->where('title', 'groupware')->first();
         $mailbox = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();
 
         // standard package, 1 mailbox, 1 groupware, 2 storage
         $jane->assignPackage($kolab);
 
         // add 2 storage, 1 activesync
         $post = [
             'skus' => [
                 $mailbox->id => 1,
                 $groupware->id => 1,
                 $storage->id => 7,
                 $activesync->id => 1
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(200);
 
         $this->assertEntitlements(
             $jane,
             [
                 'activesync',
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
 
         // add 2 storage, remove 1 activesync
         $post = [
             'skus' => [
                 $mailbox->id => 1,
                 $groupware->id => 1,
                 $storage->id => 9,
                 $activesync->id => 0
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(200);
 
         $this->assertEntitlements(
             $jane,
             [
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
 
         // add mailbox
         $post = [
             'skus' => [
                 $mailbox->id => 2,
                 $groupware->id => 1,
                 $storage->id => 9,
                 $activesync->id => 0
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(500);
 
         $this->assertEntitlements(
             $jane,
             [
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
 
         // remove mailbox
         $post = [
             'skus' => [
                 $mailbox->id => 0,
                 $groupware->id => 1,
                 $storage->id => 9,
                 $activesync->id => 0
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(500);
 
         $this->assertEntitlements(
             $jane,
             [
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
 
         // less than free storage
         $post = [
             'skus' => [
                 $mailbox->id => 1,
                 $groupware->id => 1,
                 $storage->id => 1,
                 $activesync->id => 0
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(200);
 
         $this->assertEntitlements(
             $jane,
             [
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
     }
 
     /**
      * Test user data response used in show and info actions
      */
     public function testUserResponse(): void
     {
         $provider = \config('services.payment_provider') ?: 'mollie';
-        $user = $this->getTestUser('john@kolab.org');
-        $wallet = $user->wallets()->first();
+        $john = $this->getTestUser('john@kolab.org');
+        $wallet = $john->wallets()->first();
         $wallet->setSettings(['mollie_id' => null, 'stripe_id' => null]);
-        $result = $this->invokeMethod(new UsersController(), 'userResponse', [$user]);
+        $wallet->owner->setSettings(['plan_id' => null]);
+        $result = $this->invokeMethod(new UsersController(), 'userResponse', [$john]);
 
-        $this->assertEquals($user->id, $result['id']);
-        $this->assertEquals($user->email, $result['email']);
-        $this->assertEquals($user->status, $result['status']);
+        $this->assertEquals($john->id, $result['id']);
+        $this->assertEquals($john->email, $result['email']);
+        $this->assertEquals($john->status, $result['status']);
         $this->assertTrue(is_array($result['statusInfo']));
 
         $this->assertTrue(is_array($result['settings']));
         $this->assertSame('US', $result['settings']['country']);
         $this->assertSame('USD', $result['settings']['currency']);
 
         $this->assertTrue(is_array($result['accounts']));
         $this->assertTrue(is_array($result['wallets']));
         $this->assertCount(0, $result['accounts']);
         $this->assertCount(1, $result['wallets']);
         $this->assertSame($wallet->id, $result['wallet']['id']);
         $this->assertArrayNotHasKey('discount', $result['wallet']);
+        $this->assertFalse($result['isLocked']);
 
         $this->assertTrue($result['statusInfo']['enableDomains']);
         $this->assertTrue($result['statusInfo']['enableWallets']);
+        $this->assertTrue($result['statusInfo']['enableWalletMandates']);
+        $this->assertTrue($result['statusInfo']['enableWalletPayments']);
         $this->assertTrue($result['statusInfo']['enableUsers']);
         $this->assertTrue($result['statusInfo']['enableSettings']);
 
         // Ned is John's wallet controller
+        $plan = Plan::withEnvTenantContext()->where('title', 'individual')->first();
+        $plan->mode = 'mandate';
+        $plan->save();
+        $wallet->owner->setSettings(['plan_id' => $plan->id]);
         $ned = $this->getTestUser('ned@kolab.org');
         $ned_wallet = $ned->wallets()->first();
         $result = $this->invokeMethod(new UsersController(), 'userResponse', [$ned]);
 
         $this->assertEquals($ned->id, $result['id']);
         $this->assertEquals($ned->email, $result['email']);
         $this->assertTrue(is_array($result['accounts']));
         $this->assertTrue(is_array($result['wallets']));
         $this->assertCount(1, $result['accounts']);
         $this->assertCount(1, $result['wallets']);
         $this->assertSame($wallet->id, $result['wallet']['id']);
         $this->assertSame($wallet->id, $result['accounts'][0]['id']);
         $this->assertSame($ned_wallet->id, $result['wallets'][0]['id']);
         $this->assertSame($provider, $result['wallet']['provider']);
         $this->assertSame($provider, $result['wallets'][0]['provider']);
+        $this->assertFalse($result['isLocked']);
 
         $this->assertTrue($result['statusInfo']['enableDomains']);
         $this->assertTrue($result['statusInfo']['enableWallets']);
+        $this->assertTrue($result['statusInfo']['enableWalletMandates']);
+        $this->assertFalse($result['statusInfo']['enableWalletPayments']);
         $this->assertTrue($result['statusInfo']['enableUsers']);
         $this->assertTrue($result['statusInfo']['enableSettings']);
 
         // Test discount in a response
         $discount = Discount::where('code', 'TEST')->first();
         $wallet->discount()->associate($discount);
         $wallet->save();
         $mod_provider = $provider == 'mollie' ? 'stripe' : 'mollie';
         $wallet->setSetting($mod_provider . '_id', 123);
-        $user->refresh();
+        $john->refresh();
 
-        $result = $this->invokeMethod(new UsersController(), 'userResponse', [$user]);
+        $result = $this->invokeMethod(new UsersController(), 'userResponse', [$john]);
 
-        $this->assertEquals($user->id, $result['id']);
+        $this->assertEquals($john->id, $result['id']);
         $this->assertSame($discount->id, $result['wallet']['discount_id']);
         $this->assertSame($discount->discount, $result['wallet']['discount']);
         $this->assertSame($discount->description, $result['wallet']['discount_description']);
         $this->assertSame($mod_provider, $result['wallet']['provider']);
         $this->assertSame($discount->id, $result['wallets'][0]['discount_id']);
         $this->assertSame($discount->discount, $result['wallets'][0]['discount']);
         $this->assertSame($discount->description, $result['wallets'][0]['discount_description']);
         $this->assertSame($mod_provider, $result['wallets'][0]['provider']);
+        $this->assertFalse($result['isLocked']);
 
         // Jack is not a John's wallet controller
         $jack = $this->getTestUser('jack@kolab.org');
         $result = $this->invokeMethod(new UsersController(), 'userResponse', [$jack]);
 
         $this->assertFalse($result['statusInfo']['enableDomains']);
         $this->assertFalse($result['statusInfo']['enableWallets']);
+        $this->assertFalse($result['statusInfo']['enableWalletMandates']);
+        $this->assertFalse($result['statusInfo']['enableWalletPayments']);
         $this->assertFalse($result['statusInfo']['enableUsers']);
         $this->assertFalse($result['statusInfo']['enableSettings']);
+        $this->assertFalse($result['isLocked']);
+
+        // Test locked user
+        $john->restrict();
+        $result = $this->invokeMethod(new UsersController(), 'userResponse', [$john]);
+
+        $this->assertTrue($result['isLocked']);
     }
 
     /**
      * User email address validation.
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      */
     public function testValidateEmail(): void
     {
         Queue::fake();
 
         $public_domains = Domain::getPublicDomains();
         $domain = reset($public_domains);
 
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $folder = $this->getTestSharedFolder('folder-event@kolab.org');
         $folder->setAliases(['folder-alias1@kolab.org']);
         $folder_del = $this->getTestSharedFolder('folder-test@kolabnow.com');
         $folder_del->setAliases(['folder-alias2@kolabnow.com']);
         $folder_del->delete();
         $pub_group = $this->getTestGroup('group-test@kolabnow.com');
         $pub_group->delete();
         $priv_group = $this->getTestGroup('group-test@kolab.org');
         $resource = $this->getTestResource('resource-test@kolabnow.com');
         $resource->delete();
 
         $cases = [
             // valid (user domain)
             ["admin@kolab.org", $john, null],
 
             // valid (public domain)
             ["test.test@$domain", $john, null],
 
             // Invalid format
             ["$domain", $john, 'The specified email is invalid.'],
             [".@$domain", $john, 'The specified email is invalid.'],
             ["test123456@localhost", $john, 'The specified domain is invalid.'],
             ["test123456@unknown-domain.org", $john, 'The specified domain is invalid.'],
 
             ["$domain", $john, 'The specified email is invalid.'],
             [".@$domain", $john, 'The specified email is invalid.'],
 
             // forbidden local part on public domains
             ["admin@$domain", $john, 'The specified email is not available.'],
             ["administrator@$domain", $john, 'The specified email is not available.'],
 
             // forbidden (other user's domain)
             ["testtest@kolab.org", $user, 'The specified domain is not available.'],
 
             // existing alias of other user
             ["jack.daniels@kolab.org", $john, 'The specified email is not available.'],
 
             // An existing shared folder or folder alias
             ["folder-event@kolab.org", $john, 'The specified email is not available.'],
             ["folder-alias1@kolab.org", $john, 'The specified email is not available.'],
 
             // A soft-deleted shared folder or folder alias
             ["folder-test@kolabnow.com", $john, 'The specified email is not available.'],
             ["folder-alias2@kolabnow.com", $john, 'The specified email is not available.'],
 
             // A group
             ["group-test@kolab.org", $john, 'The specified email is not available.'],
 
             // A soft-deleted group
             ["group-test@kolabnow.com", $john, 'The specified email is not available.'],
 
             // A resource
             ["resource-test1@kolab.org", $john, 'The specified email is not available.'],
 
             // A soft-deleted resource
             ["resource-test@kolabnow.com", $john, 'The specified email is not available.'],
         ];
 
         foreach ($cases as $idx => $case) {
             list($email, $user, $expected) = $case;
 
             $deleted = null;
             $result = UsersController::validateEmail($email, $user, $deleted);
 
             $this->assertSame($expected, $result, "Case {$email}");
             $this->assertNull($deleted, "Case {$email}");
         }
     }
 
     /**
      * User email validation - tests for $deleted argument
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      */
     public function testValidateEmailDeleted(): void
     {
         Queue::fake();
 
         $john = $this->getTestUser('john@kolab.org');
         $deleted_priv = $this->getTestUser('deleted@kolab.org');
         $deleted_priv->delete();
         $deleted_pub = $this->getTestUser('deleted@kolabnow.com');
         $deleted_pub->delete();
 
         $result = UsersController::validateEmail('deleted@kolab.org', $john, $deleted);
         $this->assertSame(null, $result);
         $this->assertSame($deleted_priv->id, $deleted->id);
 
         $result = UsersController::validateEmail('deleted@kolabnow.com', $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertSame(null, $deleted);
 
         $result = UsersController::validateEmail('jack@kolab.org', $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertSame(null, $deleted);
 
         $pub_group = $this->getTestGroup('group-test@kolabnow.com');
         $priv_group = $this->getTestGroup('group-test@kolab.org');
 
         // A group in a public domain, existing
         $result = UsersController::validateEmail($pub_group->email, $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertNull($deleted);
 
         $pub_group->delete();
 
         // A group in a public domain, deleted
         $result = UsersController::validateEmail($pub_group->email, $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertNull($deleted);
 
         // A group in a private domain, existing
         $result = UsersController::validateEmail($priv_group->email, $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertNull($deleted);
 
         $priv_group->delete();
 
         // A group in a private domain, deleted
         $result = UsersController::validateEmail($priv_group->email, $john, $deleted);
         $this->assertSame(null, $result);
         $this->assertSame($priv_group->id, $deleted->id);
 
         // TODO: Test the same with a resource and shared folder
     }
 
     /**
      * User email alias validation.
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      */
     public function testValidateAlias(): void
     {
         Queue::fake();
 
         $public_domains = Domain::getPublicDomains();
         $domain = reset($public_domains);
 
         $john = $this->getTestUser('john@kolab.org');
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $deleted_priv = $this->getTestUser('deleted@kolab.org');
         $deleted_priv->setAliases(['deleted-alias@kolab.org']);
         $deleted_priv->delete();
         $deleted_pub = $this->getTestUser('deleted@kolabnow.com');
         $deleted_pub->setAliases(['deleted-alias@kolabnow.com']);
         $deleted_pub->delete();
         $folder = $this->getTestSharedFolder('folder-event@kolab.org');
         $folder->setAliases(['folder-alias1@kolab.org']);
         $folder_del = $this->getTestSharedFolder('folder-test@kolabnow.com');
         $folder_del->setAliases(['folder-alias2@kolabnow.com']);
         $folder_del->delete();
         $group_priv = $this->getTestGroup('group-test@kolab.org');
         $group = $this->getTestGroup('group-test@kolabnow.com');
         $group->delete();
         $resource = $this->getTestResource('resource-test@kolabnow.com');
         $resource->delete();
 
         $cases = [
             // Invalid format
             ["$domain", $john, 'The specified alias is invalid.'],
             [".@$domain", $john, 'The specified alias is invalid.'],
             ["test123456@localhost", $john, 'The specified domain is invalid.'],
             ["test123456@unknown-domain.org", $john, 'The specified domain is invalid.'],
 
             ["$domain", $john, 'The specified alias is invalid.'],
             [".@$domain", $john, 'The specified alias is invalid.'],
 
             // forbidden local part on public domains
             ["admin@$domain", $john, 'The specified alias is not available.'],
             ["administrator@$domain", $john, 'The specified alias is not available.'],
 
             // forbidden (other user's domain)
             ["testtest@kolab.org", $user, 'The specified domain is not available.'],
 
             // existing alias of other user, to be an alias, user in the same group account
             ["jack.daniels@kolab.org", $john, null],
 
             // existing user
             ["jack@kolab.org", $john, 'The specified alias is not available.'],
 
             // valid (user domain)
             ["admin@kolab.org", $john, null],
 
             // valid (public domain)
             ["test.test@$domain", $john, null],
 
             // An alias that was a user email before is allowed, but only for custom domains
             ["deleted@kolab.org", $john, null],
             ["deleted-alias@kolab.org", $john, null],
             ["deleted@kolabnow.com", $john, 'The specified alias is not available.'],
             ["deleted-alias@kolabnow.com", $john, 'The specified alias is not available.'],
 
             // An existing shared folder or folder alias
             ["folder-event@kolab.org", $john, 'The specified alias is not available.'],
             ["folder-alias1@kolab.org", $john, null],
 
             // A soft-deleted shared folder or folder alias
             ["folder-test@kolabnow.com", $john, 'The specified alias is not available.'],
             ["folder-alias2@kolabnow.com", $john, 'The specified alias is not available.'],
 
             // A group with the same email address exists
             ["group-test@kolab.org", $john, 'The specified alias is not available.'],
 
             // A soft-deleted group
             ["group-test@kolabnow.com", $john, 'The specified alias is not available.'],
 
             // A resource
             ["resource-test1@kolab.org", $john, 'The specified alias is not available.'],
 
             // A soft-deleted resource
             ["resource-test@kolabnow.com", $john, 'The specified alias is not available.'],
         ];
 
         foreach ($cases as $idx => $case) {
             list($alias, $user, $expected) = $case;
             $result = UsersController::validateAlias($alias, $user);
             $this->assertSame($expected, $result, "Case {$alias}");
         }
     }
 }
diff --git a/src/tests/Feature/PaymentTest.php b/src/tests/Feature/PaymentTest.php
index 4102bb10..189fe689 100644
--- a/src/tests/Feature/PaymentTest.php
+++ b/src/tests/Feature/PaymentTest.php
@@ -1,226 +1,228 @@
 <?php
 
 namespace Tests\Feature;
 
 use App\Payment;
 use App\Transaction;
 use App\Wallet;
 use App\VatRate;
 use Illuminate\Support\Facades\Queue;
 use Tests\TestCase;
 
 class PaymentTest extends TestCase
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('jane@kolabnow.com');
         Payment::query()->delete();
         VatRate::query()->delete();
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser('jane@kolabnow.com');
         Payment::query()->delete();
         VatRate::query()->delete();
 
         parent::tearDown();
     }
 
     /**
      * Test credit() method
      */
     public function testCredit(): void
     {
         Queue::fake();
 
         $user = $this->getTestUser('jane@kolabnow.com');
         $wallet = $user->wallets()->first();
 
         $wallet->setSetting('mandate_disabled', 1);
 
         $payment1 = Payment::createFromArray([
             'id' => 'test-payment1',
             'amount' => 10750,
             'currency' => $wallet->currency,
             'currency_amount' => 10750,
             'type' => Payment::TYPE_ONEOFF,
             'wallet_id' => $wallet->id,
             'status' => Payment::STATUS_PAID,
         ]);
 
         $payment2 = Payment::createFromArray([
             'id' => 'test-payment2',
             'amount' => 1075,
             'currency' => $wallet->currency,
             'currency_amount' => 1075,
             'type' => Payment::TYPE_RECURRING,
             'wallet_id' => $wallet->id,
             'status' => Payment::STATUS_PAID,
         ]);
 
         // Credit the 1st payment
         $payment1->credit('Test1');
         $wallet->refresh();
         $transaction = $wallet->transactions()->first();
 
         $this->assertSame($payment1->credit_amount, $wallet->balance);
         $this->assertNull($wallet->getSetting('mandate_disabled'));
         $this->assertSame($payment1->credit_amount, $transaction->amount);
         $this->assertSame("Payment transaction {$payment1->id} using Test1", $transaction->description);
 
         $wallet->transactions()->delete();
         $wallet->setSetting('mandate_disabled', 1);
         $wallet->balance = -5000;
         $wallet->save();
 
-        // Credit the 2nd payment
+        // Credit the 2nd payment (restricted user)
+        $user->restrict();
         $payment2->credit('Test2');
         $wallet->refresh();
         $transaction = $wallet->transactions()->first();
 
         $this->assertSame($payment2->credit_amount - 5000, $wallet->balance);
         $this->assertSame('1', $wallet->getSetting('mandate_disabled'));
         $this->assertSame($payment2->credit_amount, $transaction->amount);
         $this->assertSame("Auto-payment transaction {$payment2->id} using Test2", $transaction->description);
+        $this->assertFalse($user->refresh()->isRestricted());
     }
 
     /**
      * Test createFromArray() and refund() methods
      */
     public function testCreateAndRefund(): void
     {
         Queue::fake();
 
         $user = $this->getTestUser('jane@kolabnow.com');
         $wallet = $user->wallets()->first();
 
         $vatRate = VatRate::create([
                 'start' => now()->subDay(),
                 'country' => 'US',
                 'rate' => 7.5,
         ]);
 
         // Test required properties only
         $payment1Array = [
             'id' => 'test-payment2',
             'amount' => 10750,
             'currency' => 'USD',
             'currency_amount' => 9000,
             'type' => Payment::TYPE_ONEOFF,
             'wallet_id' => $wallet->id,
         ];
 
         $payment1 = Payment::createFromArray($payment1Array);
 
         $this->assertSame($payment1Array['id'], $payment1->id);
         $this->assertSame('', $payment1->provider);
         $this->assertSame('', $payment1->description);
         $this->assertSame(null, $payment1->vat_rate_id);
         $this->assertSame($payment1Array['amount'], $payment1->amount);
         $this->assertSame($payment1Array['amount'], $payment1->credit_amount);
         $this->assertSame($payment1Array['currency_amount'], $payment1->currency_amount);
         $this->assertSame($payment1Array['currency'], $payment1->currency);
         $this->assertSame($payment1Array['type'], $payment1->type);
         $this->assertSame(Payment::STATUS_OPEN, $payment1->status);
         $this->assertSame($payment1Array['wallet_id'], $payment1->wallet_id);
         $this->assertCount(1, Payment::where('id', $payment1->id)->get());
 
         // Test settable all properties
         $payment2Array = [
             'id' => 'test-payment',
             'provider' => 'mollie',
             'description' => 'payment description',
             'vat_rate_id' => $vatRate->id,
             'amount' => 10750,
             'credit_amount' => 10000,
             'currency' => $wallet->currency,
             'currency_amount' => 10750,
             'type' => Payment::TYPE_ONEOFF,
             'status' => Payment::STATUS_OPEN,
             'wallet_id' => $wallet->id,
         ];
 
         $payment2 = Payment::createFromArray($payment2Array);
 
         $this->assertSame($payment2Array['id'], $payment2->id);
         $this->assertSame($payment2Array['provider'], $payment2->provider);
         $this->assertSame($payment2Array['description'], $payment2->description);
         $this->assertSame($payment2Array['vat_rate_id'], $payment2->vat_rate_id);
         $this->assertSame($payment2Array['amount'], $payment2->amount);
         $this->assertSame($payment2Array['credit_amount'], $payment2->credit_amount);
         $this->assertSame($payment2Array['currency_amount'], $payment2->currency_amount);
         $this->assertSame($payment2Array['currency'], $payment2->currency);
         $this->assertSame($payment2Array['type'], $payment2->type);
         $this->assertSame($payment2Array['status'], $payment2->status);
         $this->assertSame($payment2Array['wallet_id'], $payment2->wallet_id);
         $this->assertSame($vatRate->id, $payment2->vatRate->id);
         $this->assertCount(1, Payment::where('id', $payment2->id)->get());
 
         $refundArray = [
             'id' => 'test-refund',
             'type' => Payment::TYPE_CHARGEBACK,
             'description' => 'test refund desc',
         ];
 
         // Refund amount is required
         $this->assertNull($payment2->refund($refundArray));
 
         // All needed info
         $refundArray['amount'] = 5000;
 
         $refund = $payment2->refund($refundArray);
 
         $this->assertSame($refundArray['id'], $refund->id);
         $this->assertSame($refundArray['description'], $refund->description);
         $this->assertSame(-5000, $refund->amount);
         $this->assertSame(-4651, $refund->credit_amount);
         $this->assertSame(-5000, $refund->currency_amount);
         $this->assertSame($refundArray['type'], $refund->type);
         $this->assertSame(Payment::STATUS_PAID, $refund->status);
         $this->assertSame($payment2->currency, $refund->currency);
         $this->assertSame($payment2->provider, $refund->provider);
         $this->assertSame($payment2->wallet_id, $refund->wallet_id);
         $this->assertSame($payment2->vat_rate_id, $refund->vat_rate_id);
         $wallet->refresh();
         $this->assertSame(-4651, $wallet->balance);
         $transaction = $wallet->transactions()->where('type', Transaction::WALLET_CHARGEBACK)->first();
         $this->assertSame(-4651, $transaction->amount);
         $this->assertSame($refundArray['description'], $transaction->description);
 
         $wallet->balance = 0;
         $wallet->save();
 
         // Test non-wallet currency
         $refundArray['id'] = 'test-refund-2';
         $refundArray['amount'] = 9000;
         $refundArray['type'] = Payment::TYPE_REFUND;
 
         $refund = $payment1->refund($refundArray);
 
         $this->assertSame($refundArray['id'], $refund->id);
         $this->assertSame($refundArray['description'], $refund->description);
         $this->assertSame(-10750, $refund->amount);
         $this->assertSame(-10750, $refund->credit_amount);
         $this->assertSame(-9000, $refund->currency_amount);
         $this->assertSame($refundArray['type'], $refund->type);
         $this->assertSame(Payment::STATUS_PAID, $refund->status);
         $this->assertSame($payment1->currency, $refund->currency);
         $this->assertSame($payment1->provider, $refund->provider);
         $this->assertSame($payment1->wallet_id, $refund->wallet_id);
         $this->assertSame($payment1->vat_rate_id, $refund->vat_rate_id);
         $wallet->refresh();
         $this->assertSame(-10750, $wallet->balance);
         $transaction = $wallet->transactions()->where('type', Transaction::WALLET_REFUND)->first();
         $this->assertSame(-10750, $transaction->amount);
         $this->assertSame($refundArray['description'], $transaction->description);
     }
 }
diff --git a/src/tests/Feature/UserTest.php b/src/tests/Feature/UserTest.php
index 39f09fda..15608237 100644
--- a/src/tests/Feature/UserTest.php
+++ b/src/tests/Feature/UserTest.php
@@ -1,1420 +1,1450 @@
 <?php
 
 namespace Tests\Feature;
 
 use App\Domain;
 use App\Group;
 use App\User;
 use Carbon\Carbon;
 use Illuminate\Support\Facades\Queue;
 use Tests\TestCase;
 
 class UserTest extends TestCase
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('user-test@' . \config('app.domain'));
         $this->deleteTestUser('UserAccountA@UserAccount.com');
         $this->deleteTestUser('UserAccountB@UserAccount.com');
         $this->deleteTestUser('UserAccountC@UserAccount.com');
         $this->deleteTestGroup('test-group@UserAccount.com');
         $this->deleteTestResource('test-resource@UserAccount.com');
         $this->deleteTestSharedFolder('test-folder@UserAccount.com');
         $this->deleteTestDomain('UserAccount.com');
         $this->deleteTestDomain('UserAccountAdd.com');
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         \App\TenantSetting::truncate();
         $this->deleteTestUser('user-test@' . \config('app.domain'));
         $this->deleteTestUser('UserAccountA@UserAccount.com');
         $this->deleteTestUser('UserAccountB@UserAccount.com');
         $this->deleteTestUser('UserAccountC@UserAccount.com');
         $this->deleteTestGroup('test-group@UserAccount.com');
         $this->deleteTestResource('test-resource@UserAccount.com');
         $this->deleteTestSharedFolder('test-folder@UserAccount.com');
         $this->deleteTestDomain('UserAccount.com');
         $this->deleteTestDomain('UserAccountAdd.com');
 
         parent::tearDown();
     }
 
     /**
      * Tests for User::assignPackage()
      */
     public function testAssignPackage(): void
     {
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
         $wallet = $user->wallets()->first();
 
         $package = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
 
         $user->assignPackage($package);
 
         $sku = \App\Sku::withEnvTenantContext()->where('title', 'mailbox')->first();
 
         $entitlement = \App\Entitlement::where('wallet_id', $wallet->id)
             ->where('sku_id', $sku->id)->first();
 
         $this->assertNotNull($entitlement);
         $this->assertSame($sku->id, $entitlement->sku->id);
         $this->assertSame($wallet->id, $entitlement->wallet->id);
         $this->assertEquals($user->id, $entitlement->entitleable->id);
         $this->assertTrue($entitlement->entitleable instanceof \App\User);
         $this->assertCount(7, $user->entitlements()->get());
     }
 
     /**
      * Tests for User::assignPlan()
      */
     public function testAssignPlan(): void
     {
         $this->markTestIncomplete();
     }
 
     /**
      * Tests for User::assignSku()
      */
     public function testAssignSku(): void
     {
         $this->markTestIncomplete();
     }
 
     /**
      * Verify a wallet assigned a controller is among the accounts of the assignee.
      */
     public function testAccounts(): void
     {
         $userA = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
 
         $this->assertTrue($userA->wallets()->count() == 1);
 
         $userA->wallets()->each(
             function ($wallet) use ($userB) {
                 $wallet->addController($userB);
             }
         );
 
         $this->assertTrue($userB->accounts()->get()[0]->id === $userA->wallets()->get()[0]->id);
     }
 
     /**
      * Test User::canDelete() method
      */
     public function testCanDelete(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
         $domain = $this->getTestDomain('kolab.org');
 
         // Admin
         $this->assertTrue($admin->canDelete($admin));
         $this->assertFalse($admin->canDelete($john));
         $this->assertFalse($admin->canDelete($jack));
         $this->assertFalse($admin->canDelete($reseller1));
         $this->assertFalse($admin->canDelete($domain));
         $this->assertFalse($admin->canDelete($domain->wallet()));
 
         // Reseller - kolabnow
         $this->assertFalse($reseller1->canDelete($john));
         $this->assertFalse($reseller1->canDelete($jack));
         $this->assertTrue($reseller1->canDelete($reseller1));
         $this->assertFalse($reseller1->canDelete($domain));
         $this->assertFalse($reseller1->canDelete($domain->wallet()));
         $this->assertFalse($reseller1->canDelete($admin));
 
         // Normal user - account owner
         $this->assertTrue($john->canDelete($john));
         $this->assertTrue($john->canDelete($ned));
         $this->assertTrue($john->canDelete($jack));
         $this->assertTrue($john->canDelete($domain));
         $this->assertFalse($john->canDelete($domain->wallet()));
         $this->assertFalse($john->canDelete($reseller1));
         $this->assertFalse($john->canDelete($admin));
 
         // Normal user - a non-owner and non-controller
         $this->assertFalse($jack->canDelete($jack));
         $this->assertFalse($jack->canDelete($john));
         $this->assertFalse($jack->canDelete($domain));
         $this->assertFalse($jack->canDelete($domain->wallet()));
         $this->assertFalse($jack->canDelete($reseller1));
         $this->assertFalse($jack->canDelete($admin));
 
         // Normal user - John's wallet controller
         $this->assertTrue($ned->canDelete($ned));
         $this->assertTrue($ned->canDelete($john));
         $this->assertTrue($ned->canDelete($jack));
         $this->assertTrue($ned->canDelete($domain));
         $this->assertFalse($ned->canDelete($domain->wallet()));
         $this->assertFalse($ned->canDelete($reseller1));
         $this->assertFalse($ned->canDelete($admin));
     }
 
     /**
      * Test User::canRead() method
      */
     public function testCanRead(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
         $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
         $domain = $this->getTestDomain('kolab.org');
 
         // Admin
         $this->assertTrue($admin->canRead($admin));
         $this->assertTrue($admin->canRead($john));
         $this->assertTrue($admin->canRead($jack));
         $this->assertTrue($admin->canRead($reseller1));
         $this->assertTrue($admin->canRead($reseller2));
         $this->assertTrue($admin->canRead($domain));
         $this->assertTrue($admin->canRead($domain->wallet()));
 
         // Reseller - kolabnow
         $this->assertTrue($reseller1->canRead($john));
         $this->assertTrue($reseller1->canRead($jack));
         $this->assertTrue($reseller1->canRead($reseller1));
         $this->assertTrue($reseller1->canRead($domain));
         $this->assertTrue($reseller1->canRead($domain->wallet()));
         $this->assertFalse($reseller1->canRead($reseller2));
         $this->assertFalse($reseller1->canRead($admin));
 
         // Reseller - different tenant
         $this->assertTrue($reseller2->canRead($reseller2));
         $this->assertFalse($reseller2->canRead($john));
         $this->assertFalse($reseller2->canRead($jack));
         $this->assertFalse($reseller2->canRead($reseller1));
         $this->assertFalse($reseller2->canRead($domain));
         $this->assertFalse($reseller2->canRead($domain->wallet()));
         $this->assertFalse($reseller2->canRead($admin));
 
         // Normal user - account owner
         $this->assertTrue($john->canRead($john));
         $this->assertTrue($john->canRead($ned));
         $this->assertTrue($john->canRead($jack));
         $this->assertTrue($john->canRead($domain));
         $this->assertTrue($john->canRead($domain->wallet()));
         $this->assertFalse($john->canRead($reseller1));
         $this->assertFalse($john->canRead($reseller2));
         $this->assertFalse($john->canRead($admin));
 
         // Normal user - a non-owner and non-controller
         $this->assertTrue($jack->canRead($jack));
         $this->assertFalse($jack->canRead($john));
         $this->assertFalse($jack->canRead($domain));
         $this->assertFalse($jack->canRead($domain->wallet()));
         $this->assertFalse($jack->canRead($reseller1));
         $this->assertFalse($jack->canRead($reseller2));
         $this->assertFalse($jack->canRead($admin));
 
         // Normal user - John's wallet controller
         $this->assertTrue($ned->canRead($ned));
         $this->assertTrue($ned->canRead($john));
         $this->assertTrue($ned->canRead($jack));
         $this->assertTrue($ned->canRead($domain));
         $this->assertTrue($ned->canRead($domain->wallet()));
         $this->assertFalse($ned->canRead($reseller1));
         $this->assertFalse($ned->canRead($reseller2));
         $this->assertFalse($ned->canRead($admin));
     }
 
     /**
      * Test User::canUpdate() method
      */
     public function testCanUpdate(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
         $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
         $domain = $this->getTestDomain('kolab.org');
 
         // Admin
         $this->assertTrue($admin->canUpdate($admin));
         $this->assertTrue($admin->canUpdate($john));
         $this->assertTrue($admin->canUpdate($jack));
         $this->assertTrue($admin->canUpdate($reseller1));
         $this->assertTrue($admin->canUpdate($reseller2));
         $this->assertTrue($admin->canUpdate($domain));
         $this->assertTrue($admin->canUpdate($domain->wallet()));
 
         // Reseller - kolabnow
         $this->assertTrue($reseller1->canUpdate($john));
         $this->assertTrue($reseller1->canUpdate($jack));
         $this->assertTrue($reseller1->canUpdate($reseller1));
         $this->assertTrue($reseller1->canUpdate($domain));
         $this->assertTrue($reseller1->canUpdate($domain->wallet()));
         $this->assertFalse($reseller1->canUpdate($reseller2));
         $this->assertFalse($reseller1->canUpdate($admin));
 
         // Reseller - different tenant
         $this->assertTrue($reseller2->canUpdate($reseller2));
         $this->assertFalse($reseller2->canUpdate($john));
         $this->assertFalse($reseller2->canUpdate($jack));
         $this->assertFalse($reseller2->canUpdate($reseller1));
         $this->assertFalse($reseller2->canUpdate($domain));
         $this->assertFalse($reseller2->canUpdate($domain->wallet()));
         $this->assertFalse($reseller2->canUpdate($admin));
 
         // Normal user - account owner
         $this->assertTrue($john->canUpdate($john));
         $this->assertTrue($john->canUpdate($ned));
         $this->assertTrue($john->canUpdate($jack));
         $this->assertTrue($john->canUpdate($domain));
         $this->assertFalse($john->canUpdate($domain->wallet()));
         $this->assertFalse($john->canUpdate($reseller1));
         $this->assertFalse($john->canUpdate($reseller2));
         $this->assertFalse($john->canUpdate($admin));
 
         // Normal user - a non-owner and non-controller
         $this->assertTrue($jack->canUpdate($jack));
         $this->assertFalse($jack->canUpdate($john));
         $this->assertFalse($jack->canUpdate($domain));
         $this->assertFalse($jack->canUpdate($domain->wallet()));
         $this->assertFalse($jack->canUpdate($reseller1));
         $this->assertFalse($jack->canUpdate($reseller2));
         $this->assertFalse($jack->canUpdate($admin));
 
         // Normal user - John's wallet controller
         $this->assertTrue($ned->canUpdate($ned));
         $this->assertTrue($ned->canUpdate($john));
         $this->assertTrue($ned->canUpdate($jack));
         $this->assertTrue($ned->canUpdate($domain));
         $this->assertFalse($ned->canUpdate($domain->wallet()));
         $this->assertFalse($ned->canUpdate($reseller1));
         $this->assertFalse($ned->canUpdate($reseller2));
         $this->assertFalse($ned->canUpdate($admin));
     }
 
     /**
      * Test user created/creating/updated observers
      */
     public function testCreateAndUpdate(): void
     {
         Queue::fake();
 
         $domain = \config('app.domain');
 
         \App\Tenant::find(\config('app.tenant_id'))->setSetting('pgp.enable', 0);
         $user = User::create([
                 'email' => 'USER-test@' . \strtoupper($domain),
                 'password' => 'test',
         ]);
 
         $result = User::where('email', "user-test@$domain")->first();
 
         $this->assertSame("user-test@$domain", $result->email);
         $this->assertSame($user->id, $result->id);
         $this->assertSame(User::STATUS_NEW, $result->status);
         $this->assertSame(0, $user->passwords()->count());
 
         Queue::assertPushed(\App\Jobs\User\CreateJob::class, 1);
         Queue::assertPushed(\App\Jobs\PGP\KeyCreateJob::class, 0);
 
         Queue::assertPushed(
             \App\Jobs\User\CreateJob::class,
             function ($job) use ($user) {
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 $userId = TestCase::getObjectProperty($job, 'userId');
 
                 return $userEmail === $user->email
                     && $userId === $user->id;
             }
         );
 
         // Test invoking KeyCreateJob
         $this->deleteTestUser("user-test@$domain");
 
         \App\Tenant::find(\config('app.tenant_id'))->setSetting('pgp.enable', 1);
 
         $user = User::create(['email' => "user-test@$domain", 'password' => 'test']);
 
         Queue::assertPushed(\App\Jobs\PGP\KeyCreateJob::class, 1);
 
         Queue::assertPushed(
             \App\Jobs\PGP\KeyCreateJob::class,
             function ($job) use ($user) {
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 $userId = TestCase::getObjectProperty($job, 'userId');
 
                 return $userEmail === $user->email
                     && $userId === $user->id;
             }
         );
 
         // Update the user, test the password change
         $user->setSetting('password_expiration_warning', '2020-10-10 10:10:10');
         $oldPassword = $user->password;
         $user->password = 'test123';
         $user->save();
 
         $this->assertNotEquals($oldPassword, $user->password);
         $this->assertSame(0, $user->passwords()->count());
         $this->assertNull($user->getSetting('password_expiration_warning'));
         $this->assertMatchesRegularExpression(
             '/^' . now()->format('Y-m-d') . ' [0-9]{2}:[0-9]{2}:[0-9]{2}$/',
             $user->getSetting('password_update')
         );
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\User\UpdateJob::class,
             function ($job) use ($user) {
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 $userId = TestCase::getObjectProperty($job, 'userId');
 
                 return $userEmail === $user->email
                     && $userId === $user->id;
             }
         );
 
         // Update the user, test the password history
         $user->setSetting('password_policy', 'last:3');
         $oldPassword = $user->password;
         $user->password = 'test1234';
         $user->save();
 
         $this->assertSame(1, $user->passwords()->count());
         $this->assertSame($oldPassword, $user->passwords()->first()->password);
 
         $user->password = 'test12345';
         $user->save();
         $oldPassword = $user->password;
         $user->password = 'test123456';
         $user->save();
 
         $this->assertSame(2, $user->passwords()->count());
         $this->assertSame($oldPassword, $user->passwords()->latest()->first()->password);
     }
 
     /**
      * Tests for User::domains()
      */
     public function testDomains(): void
     {
         $user = $this->getTestUser('john@kolab.org');
 
         $domain = $this->getTestDomain('useraccount.com', [
                 'status' => Domain::STATUS_NEW | Domain::STATUS_ACTIVE,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
 
         $domains = $user->domains()->pluck('namespace')->all();
 
         $this->assertContains($domain->namespace, $domains);
         $this->assertContains('kolab.org', $domains);
 
         // Jack is not the wallet controller, so for him the list should not
         // include John's domains, kolab.org specifically
         $user = $this->getTestUser('jack@kolab.org');
 
         $domains = $user->domains()->pluck('namespace')->all();
 
         $this->assertContains($domain->namespace, $domains);
         $this->assertNotContains('kolab.org', $domains);
 
         // Public domains of other tenants should not be returned
         $tenant = \App\Tenant::where('id', '!=', \config('app.tenant_id'))->first();
         $domain->tenant_id = $tenant->id;
         $domain->save();
 
         $domains = $user->domains()->pluck('namespace')->all();
 
         $this->assertNotContains($domain->namespace, $domains);
     }
 
     /**
      * Test User::getConfig() and setConfig() methods
      */
     public function testConfigTrait(): void
     {
         $user = $this->getTestUser('UserAccountA@UserAccount.com');
         $user->setSetting('greylist_enabled', null);
         $user->setSetting('guam_enabled', null);
         $user->setSetting('password_policy', null);
         $user->setSetting('max_password_age', null);
         $user->setSetting('limit_geo', null);
 
         // greylist_enabled
         $this->assertSame(true, $user->getConfig()['greylist_enabled']);
 
         $result = $user->setConfig(['greylist_enabled' => false, 'unknown' => false]);
 
         $this->assertSame(['unknown' => "The requested configuration parameter is not supported."], $result);
         $this->assertSame(false, $user->getConfig()['greylist_enabled']);
         $this->assertSame('false', $user->getSetting('greylist_enabled'));
 
         $result = $user->setConfig(['greylist_enabled' => true]);
 
         $this->assertSame([], $result);
         $this->assertSame(true, $user->getConfig()['greylist_enabled']);
         $this->assertSame('true', $user->getSetting('greylist_enabled'));
 
         // guam_enabled
         $this->assertSame(false, $user->getConfig()['guam_enabled']);
 
         $result = $user->setConfig(['guam_enabled' => false]);
 
         $this->assertSame([], $result);
         $this->assertSame(false, $user->getConfig()['guam_enabled']);
         $this->assertSame(null, $user->getSetting('guam_enabled'));
 
         $result = $user->setConfig(['guam_enabled' => true]);
 
         $this->assertSame([], $result);
         $this->assertSame(true, $user->getConfig()['guam_enabled']);
         $this->assertSame('true', $user->getSetting('guam_enabled'));
 
         // max_apssword_age
         $this->assertSame(null, $user->getConfig()['max_password_age']);
 
         $result = $user->setConfig(['max_password_age' => -1]);
 
         $this->assertSame([], $result);
         $this->assertSame(null, $user->getConfig()['max_password_age']);
         $this->assertSame(null, $user->getSetting('max_password_age'));
 
         $result = $user->setConfig(['max_password_age' => 12]);
 
         $this->assertSame([], $result);
         $this->assertSame('12', $user->getConfig()['max_password_age']);
         $this->assertSame('12', $user->getSetting('max_password_age'));
 
         // password_policy
         $result = $user->setConfig(['password_policy' => true]);
 
         $this->assertSame(['password_policy' => "Specified password policy is invalid."], $result);
         $this->assertSame(null, $user->getConfig()['password_policy']);
         $this->assertSame(null, $user->getSetting('password_policy'));
 
         $result = $user->setConfig(['password_policy' => 'min:-1']);
 
         $this->assertSame(['password_policy' => "Specified password policy is invalid."], $result);
 
         $result = $user->setConfig(['password_policy' => 'min:-1']);
 
         $this->assertSame(['password_policy' => "Specified password policy is invalid."], $result);
 
         $result = $user->setConfig(['password_policy' => 'min:10,unknown']);
 
         $this->assertSame(['password_policy' => "Specified password policy is invalid."], $result);
 
         \config(['app.password_policy' => 'min:5,max:100']);
         $result = $user->setConfig(['password_policy' => 'min:4,max:255']);
 
         $this->assertSame(['password_policy' => "Minimum password length cannot be less than 5."], $result);
 
         \config(['app.password_policy' => 'min:5,max:100']);
         $result = $user->setConfig(['password_policy' => 'min:10,max:255']);
 
         $this->assertSame(['password_policy' => "Maximum password length cannot be more than 100."], $result);
 
         \config(['app.password_policy' => 'min:5,max:255']);
         $result = $user->setConfig(['password_policy' => 'min:10,max:255']);
 
         $this->assertSame([], $result);
         $this->assertSame('min:10,max:255', $user->getConfig()['password_policy']);
         $this->assertSame('min:10,max:255', $user->getSetting('password_policy'));
 
         // limit_geo
         $this->assertSame([], $user->getConfig()['limit_geo']);
 
         $result = $user->setConfig(['limit_geo' => '']);
 
         $err = "Specified configuration is invalid. Expected a list of two-letter country codes.";
         $this->assertSame(['limit_geo' => $err], $result);
         $this->assertSame(null, $user->getSetting('limit_geo'));
 
         $result = $user->setConfig(['limit_geo' => ['usa']]);
 
         $this->assertSame(['limit_geo' => $err], $result);
         $this->assertSame(null, $user->getSetting('limit_geo'));
 
         $result = $user->setConfig(['limit_geo' => []]);
 
         $this->assertSame([], $result);
         $this->assertSame(null, $user->getSetting('limit_geo'));
 
         $result = $user->setConfig(['limit_geo' => ['US', 'ru']]);
 
         $this->assertSame([], $result);
         $this->assertSame(['US', 'RU'], $user->getConfig()['limit_geo']);
         $this->assertSame('["US","RU"]', $user->getSetting('limit_geo'));
     }
 
     /**
      * Test user account degradation and un-degradation
      */
     public function testDegradeAndUndegrade(): void
     {
         Queue::fake();
 
         // Test an account with users, domain
         $userA = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $domain = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $userA->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $userA);
         $userA->assignPackage($package_kolab, $userB);
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
         $entitlementsDomain = \App\Entitlement::where('entitleable_id', $domain->id);
 
         $yesterday = Carbon::now()->subDays(1);
 
         $this->backdateEntitlements($entitlementsA->get(), $yesterday, Carbon::now()->subMonthsWithoutOverflow(1));
         $this->backdateEntitlements($entitlementsB->get(), $yesterday, Carbon::now()->subMonthsWithoutOverflow(1));
 
         $wallet = $userA->wallets->first();
 
         $this->assertSame(7, $entitlementsA->count());
         $this->assertSame(7, $entitlementsB->count());
         $this->assertSame(7, $entitlementsA->whereDate('updated_at', $yesterday->toDateString())->count());
         $this->assertSame(7, $entitlementsB->whereDate('updated_at', $yesterday->toDateString())->count());
         $this->assertSame(0, $wallet->balance);
 
         Queue::fake(); // reset queue state
 
         // Degrade the account/wallet owner
         $userA->degrade();
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
 
         $this->assertTrue($userA->fresh()->isDegraded());
         $this->assertTrue($userA->fresh()->isDegraded(true));
         $this->assertFalse($userB->fresh()->isDegraded());
         $this->assertTrue($userB->fresh()->isDegraded(true));
 
         $balance = $wallet->fresh()->balance;
         $this->assertTrue($balance <= -64);
         $this->assertSame(7, $entitlementsA->whereDate('updated_at', Carbon::now()->toDateString())->count());
         $this->assertSame(7, $entitlementsB->whereDate('updated_at', Carbon::now()->toDateString())->count());
 
         // Expect one update job for every user
         // @phpstan-ignore-next-line
         $userIds = Queue::pushed(\App\Jobs\User\UpdateJob::class)->map(function ($job) {
             return TestCase::getObjectProperty($job, 'userId');
         })->all();
 
         $this->assertSame([$userA->id, $userB->id], $userIds);
 
         // Un-Degrade the account/wallet owner
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
 
         $yesterday = Carbon::now()->subDays(1);
 
         $this->backdateEntitlements($entitlementsA->get(), $yesterday, Carbon::now()->subMonthsWithoutOverflow(1));
         $this->backdateEntitlements($entitlementsB->get(), $yesterday, Carbon::now()->subMonthsWithoutOverflow(1));
 
         Queue::fake(); // reset queue state
 
         $userA->undegrade();
 
         $this->assertFalse($userA->fresh()->isDegraded());
         $this->assertFalse($userA->fresh()->isDegraded(true));
         $this->assertFalse($userB->fresh()->isDegraded());
         $this->assertFalse($userB->fresh()->isDegraded(true));
 
         // Expect no balance change, degraded account entitlements are free
         $this->assertSame($balance, $wallet->fresh()->balance);
         $this->assertSame(7, $entitlementsA->whereDate('updated_at', Carbon::now()->toDateString())->count());
         $this->assertSame(7, $entitlementsB->whereDate('updated_at', Carbon::now()->toDateString())->count());
 
         // Expect one update job for every user
         // @phpstan-ignore-next-line
         $userIds = Queue::pushed(\App\Jobs\User\UpdateJob::class)->map(function ($job) {
             return TestCase::getObjectProperty($job, 'userId');
         })->all();
 
         $this->assertSame([$userA->id, $userB->id], $userIds);
     }
 
     /**
      * Test user deletion
      */
     public function testDelete(): void
     {
         Queue::fake();
 
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
         $package = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $user->assignPackage($package);
 
         $id = $user->id;
 
         $this->assertCount(7, $user->entitlements()->get());
 
         $user->delete();
 
         $this->assertCount(0, $user->entitlements()->get());
         $this->assertTrue($user->fresh()->trashed());
         $this->assertFalse($user->fresh()->isDeleted());
 
         // Delete the user for real
         $job = new \App\Jobs\User\DeleteJob($id);
         $job->handle();
 
         $this->assertTrue(User::withTrashed()->where('id', $id)->first()->isDeleted());
 
         $user->forceDelete();
 
         $this->assertCount(0, User::withTrashed()->where('id', $id)->get());
 
         // Test an account with users, domain, and group, and resource
         $userA = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $userC = $this->getTestUser('UserAccountC@UserAccount.com');
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $domain = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $userA->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $userA);
         $userA->assignPackage($package_kolab, $userB);
         $userA->assignPackage($package_kolab, $userC);
         $group = $this->getTestGroup('test-group@UserAccount.com');
         $group->assignToWallet($userA->wallets->first());
         $resource = $this->getTestResource('test-resource@UserAccount.com', ['name' => 'test']);
         $resource->assignToWallet($userA->wallets->first());
         $folder = $this->getTestSharedFolder('test-folder@UserAccount.com', ['name' => 'test']);
         $folder->assignToWallet($userA->wallets->first());
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
         $entitlementsC = \App\Entitlement::where('entitleable_id', $userC->id);
         $entitlementsDomain = \App\Entitlement::where('entitleable_id', $domain->id);
         $entitlementsGroup = \App\Entitlement::where('entitleable_id', $group->id);
         $entitlementsResource = \App\Entitlement::where('entitleable_id', $resource->id);
         $entitlementsFolder = \App\Entitlement::where('entitleable_id', $folder->id);
 
         $this->assertSame(7, $entitlementsA->count());
         $this->assertSame(7, $entitlementsB->count());
         $this->assertSame(7, $entitlementsC->count());
         $this->assertSame(1, $entitlementsDomain->count());
         $this->assertSame(1, $entitlementsGroup->count());
         $this->assertSame(1, $entitlementsResource->count());
         $this->assertSame(1, $entitlementsFolder->count());
 
         // Delete non-controller user
         $userC->delete();
 
         $this->assertTrue($userC->fresh()->trashed());
         $this->assertFalse($userC->fresh()->isDeleted());
         $this->assertSame(0, $entitlementsC->count());
 
         // Delete the controller (and expect "sub"-users to be deleted too)
         $userA->delete();
 
         $this->assertSame(0, $entitlementsA->count());
         $this->assertSame(0, $entitlementsB->count());
         $this->assertSame(0, $entitlementsDomain->count());
         $this->assertSame(0, $entitlementsGroup->count());
         $this->assertSame(0, $entitlementsResource->count());
         $this->assertSame(0, $entitlementsFolder->count());
         $this->assertSame(7, $entitlementsA->withTrashed()->count());
         $this->assertSame(7, $entitlementsB->withTrashed()->count());
         $this->assertSame(7, $entitlementsC->withTrashed()->count());
         $this->assertSame(1, $entitlementsDomain->withTrashed()->count());
         $this->assertSame(1, $entitlementsGroup->withTrashed()->count());
         $this->assertSame(1, $entitlementsResource->withTrashed()->count());
         $this->assertSame(1, $entitlementsFolder->withTrashed()->count());
         $this->assertTrue($userA->fresh()->trashed());
         $this->assertTrue($userB->fresh()->trashed());
         $this->assertTrue($domain->fresh()->trashed());
         $this->assertTrue($group->fresh()->trashed());
         $this->assertTrue($resource->fresh()->trashed());
         $this->assertTrue($folder->fresh()->trashed());
         $this->assertFalse($userA->isDeleted());
         $this->assertFalse($userB->isDeleted());
         $this->assertFalse($domain->isDeleted());
         $this->assertFalse($group->isDeleted());
         $this->assertFalse($resource->isDeleted());
         $this->assertFalse($folder->isDeleted());
 
         $userA->forceDelete();
 
         $all_entitlements = \App\Entitlement::where('wallet_id', $userA->wallets->first()->id);
         $transactions = \App\Transaction::where('object_id', $userA->wallets->first()->id);
 
         $this->assertSame(0, $all_entitlements->withTrashed()->count());
         $this->assertSame(0, $transactions->count());
         $this->assertCount(0, User::withTrashed()->where('id', $userA->id)->get());
         $this->assertCount(0, User::withTrashed()->where('id', $userB->id)->get());
         $this->assertCount(0, User::withTrashed()->where('id', $userC->id)->get());
         $this->assertCount(0, Domain::withTrashed()->where('id', $domain->id)->get());
         $this->assertCount(0, Group::withTrashed()->where('id', $group->id)->get());
         $this->assertCount(0, \App\Resource::withTrashed()->where('id', $resource->id)->get());
         $this->assertCount(0, \App\SharedFolder::withTrashed()->where('id', $folder->id)->get());
     }
 
     /**
      * Test user deletion vs. group membership
      */
     public function testDeleteAndGroups(): void
     {
         Queue::fake();
 
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $userA = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $userA->assignPackage($package_kolab, $userB);
         $group = $this->getTestGroup('test-group@UserAccount.com');
         $group->members = ['test@gmail.com', $userB->email];
         $group->assignToWallet($userA->wallets->first());
         $group->save();
 
         Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 1);
 
         $userGroups = $userA->groups()->get();
         $this->assertSame(1, $userGroups->count());
         $this->assertSame($group->id, $userGroups->first()->id);
 
         $userB->delete();
 
         $this->assertSame(['test@gmail.com'], $group->fresh()->members);
 
         // Twice, one for save() and one for delete() above
         Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 2);
     }
 
     /**
      * Test handling negative balance on user deletion
      */
     public function testDeleteWithNegativeBalance(): void
     {
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
         $wallet = $user->wallets()->first();
         $wallet->balance = -1000;
         $wallet->save();
         $reseller_wallet = $user->tenant->wallet();
         $reseller_wallet->balance = 0;
         $reseller_wallet->save();
         \App\Transaction::where('object_id', $reseller_wallet->id)->where('object_type', \App\Wallet::class)->delete();
 
         $user->delete();
 
         $reseller_transactions = \App\Transaction::where('object_id', $reseller_wallet->id)
             ->where('object_type', \App\Wallet::class)->get();
 
         $this->assertSame(-1000, $reseller_wallet->fresh()->balance);
         $this->assertCount(1, $reseller_transactions);
         $trans = $reseller_transactions[0];
         $this->assertSame("Deleted user {$user->email}", $trans->description);
         $this->assertSame(-1000, $trans->amount);
         $this->assertSame(\App\Transaction::WALLET_DEBIT, $trans->type);
     }
 
     /**
      * Test handling positive balance on user deletion
      */
     public function testDeleteWithPositiveBalance(): void
     {
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
         $wallet = $user->wallets()->first();
         $wallet->balance = 1000;
         $wallet->save();
         $reseller_wallet = $user->tenant->wallet();
         $reseller_wallet->balance = 0;
         $reseller_wallet->save();
 
         $user->delete();
 
         $this->assertSame(0, $reseller_wallet->fresh()->balance);
     }
 
     /**
      * Test user deletion with PGP/WOAT enabled
      */
     public function testDeleteWithPGP(): void
     {
         Queue::fake();
 
         // Test with PGP disabled
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
 
         $user->tenant->setSetting('pgp.enable', 0);
         $user->delete();
 
         Queue::assertPushed(\App\Jobs\PGP\KeyDeleteJob::class, 0);
 
         // Test with PGP enabled
         $this->deleteTestUser('user-test@' . \config('app.domain'));
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
 
         $user->tenant->setSetting('pgp.enable', 1);
         $user->delete();
         $user->tenant->setSetting('pgp.enable', 0);
 
         Queue::assertPushed(\App\Jobs\PGP\KeyDeleteJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\PGP\KeyDeleteJob::class,
             function ($job) use ($user) {
                 $userId = TestCase::getObjectProperty($job, 'userId');
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 return $userId == $user->id && $userEmail === $user->email;
             }
         );
     }
 
     /**
      * Test user deletion vs. rooms
      */
     public function testDeleteWithRooms(): void
     {
         $this->markTestIncomplete();
     }
 
     /**
      * Tests for User::aliasExists()
      */
     public function testAliasExists(): void
     {
         $this->assertTrue(User::aliasExists('jack.daniels@kolab.org'));
 
         $this->assertFalse(User::aliasExists('j.daniels@kolab.org'));
         $this->assertFalse(User::aliasExists('john@kolab.org'));
     }
 
     /**
      * Tests for User::emailExists()
      */
     public function testEmailExists(): void
     {
         $this->assertFalse(User::emailExists('jack.daniels@kolab.org'));
         $this->assertFalse(User::emailExists('j.daniels@kolab.org'));
 
         $this->assertTrue(User::emailExists('john@kolab.org'));
         $user = User::emailExists('john@kolab.org', true);
         $this->assertSame('john@kolab.org', $user->email);
     }
 
     /**
      * Tests for User::findByEmail()
      */
     public function testFindByEmail(): void
     {
         $user = $this->getTestUser('john@kolab.org');
 
         $result = User::findByEmail('john');
         $this->assertNull($result);
 
         $result = User::findByEmail('non-existing@email.com');
         $this->assertNull($result);
 
         $result = User::findByEmail('john@kolab.org');
         $this->assertInstanceOf(User::class, $result);
         $this->assertSame($user->id, $result->id);
 
         // Use an alias
         $result = User::findByEmail('john.doe@kolab.org');
         $this->assertInstanceOf(User::class, $result);
         $this->assertSame($user->id, $result->id);
 
         Queue::fake();
 
         // A case where two users have the same alias
         $ned = $this->getTestUser('ned@kolab.org');
         $ned->setAliases(['joe.monster@kolab.org']);
         $result = User::findByEmail('joe.monster@kolab.org');
         $this->assertNull($result);
         $ned->setAliases([]);
 
         // TODO: searching by external email (setting)
         $this->markTestIncomplete();
     }
 
     /**
      * Test User::hasSku() and countEntitlementsBySku() methods
      */
     public function testHasSku(): void
     {
         $john = $this->getTestUser('john@kolab.org');
 
         $this->assertTrue($john->hasSku('mailbox'));
         $this->assertTrue($john->hasSku('storage'));
         $this->assertFalse($john->hasSku('beta'));
         $this->assertFalse($john->hasSku('unknown'));
 
         $this->assertSame(0, $john->countEntitlementsBySku('unknown'));
         $this->assertSame(0, $john->countEntitlementsBySku('2fa'));
         $this->assertSame(1, $john->countEntitlementsBySku('mailbox'));
         $this->assertSame(5, $john->countEntitlementsBySku('storage'));
     }
 
     /**
      * Test User::name()
      */
     public function testName(): void
     {
         Queue::fake();
 
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
 
         $this->assertSame('', $user->name());
         $this->assertSame($user->tenant->title . ' User', $user->name(true));
 
         $user->setSetting('first_name', 'First');
 
         $this->assertSame('First', $user->name());
         $this->assertSame('First', $user->name(true));
 
         $user->setSetting('last_name', 'Last');
 
         $this->assertSame('First Last', $user->name());
         $this->assertSame('First Last', $user->name(true));
     }
 
     /**
      * Test resources() method
      */
     public function testResources(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
 
         $resources = $john->resources()->orderBy('email')->get();
 
         $this->assertSame(2, $resources->count());
         $this->assertSame('resource-test1@kolab.org', $resources[0]->email);
         $this->assertSame('resource-test2@kolab.org', $resources[1]->email);
 
         $resources = $ned->resources()->orderBy('email')->get();
 
         $this->assertSame(2, $resources->count());
         $this->assertSame('resource-test1@kolab.org', $resources[0]->email);
         $this->assertSame('resource-test2@kolab.org', $resources[1]->email);
 
         $resources = $jack->resources()->get();
 
         $this->assertSame(0, $resources->count());
     }
 
     /**
      * Test sharedFolders() method
      */
     public function testSharedFolders(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
 
         $folders = $john->sharedFolders()->orderBy('email')->get();
 
         $this->assertSame(2, $folders->count());
         $this->assertSame('folder-contact@kolab.org', $folders[0]->email);
         $this->assertSame('folder-event@kolab.org', $folders[1]->email);
 
         $folders = $ned->sharedFolders()->orderBy('email')->get();
 
         $this->assertSame(2, $folders->count());
         $this->assertSame('folder-contact@kolab.org', $folders[0]->email);
         $this->assertSame('folder-event@kolab.org', $folders[1]->email);
 
         $folders = $jack->sharedFolders()->get();
 
         $this->assertSame(0, $folders->count());
     }
 
     /**
      * Test user restoring
      */
     public function testRestore(): void
     {
         Queue::fake();
 
         // Test an account with users and domain
         $userA = $this->getTestUser('UserAccountA@UserAccount.com', [
                 'status' => User::STATUS_LDAP_READY | User::STATUS_IMAP_READY | User::STATUS_SUSPENDED,
         ]);
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $domainA = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $domainB = $this->getTestDomain('UserAccountAdd.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $userA->assignPackage($package_kolab);
         $domainA->assignPackage($package_domain, $userA);
         $domainB->assignPackage($package_domain, $userA);
         $userA->assignPackage($package_kolab, $userB);
 
         $storage_sku = \App\Sku::withEnvTenantContext()->where('title', 'storage')->first();
         $now = \Carbon\Carbon::now();
         $wallet_id = $userA->wallets->first()->id;
 
         // add an extra storage entitlement
         $ent1 = \App\Entitlement::create([
                 'wallet_id' => $wallet_id,
                 'sku_id' => $storage_sku->id,
                 'cost' => 0,
                 'entitleable_id' => $userA->id,
                 'entitleable_type' => User::class,
         ]);
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
         $entitlementsDomain = \App\Entitlement::where('entitleable_id', $domainA->id);
 
         // First delete the user
         $userA->delete();
 
         $this->assertSame(0, $entitlementsA->count());
         $this->assertSame(0, $entitlementsB->count());
         $this->assertSame(0, $entitlementsDomain->count());
         $this->assertTrue($userA->fresh()->trashed());
         $this->assertTrue($userB->fresh()->trashed());
         $this->assertTrue($domainA->fresh()->trashed());
         $this->assertTrue($domainB->fresh()->trashed());
         $this->assertFalse($userA->isDeleted());
         $this->assertFalse($userB->isDeleted());
         $this->assertFalse($domainA->isDeleted());
 
         // Backdate one storage entitlement (it's not expected to be restored)
         \App\Entitlement::withTrashed()->where('id', $ent1->id)
             ->update(['deleted_at' => $now->copy()->subMinutes(2)]);
 
         // Backdate entitlements to assert that they were restored with proper updated_at timestamp
         \App\Entitlement::withTrashed()->where('wallet_id', $wallet_id)
             ->update(['updated_at' => $now->subMinutes(10)]);
 
         Queue::fake();
 
         // Then restore it
         $userA->restore();
         $userA->refresh();
 
         $this->assertFalse($userA->trashed());
         $this->assertFalse($userA->isDeleted());
         $this->assertFalse($userA->isSuspended());
         $this->assertFalse($userA->isLdapReady());
         $this->assertFalse($userA->isImapReady());
         $this->assertTrue($userA->isActive());
 
         $this->assertTrue($userB->fresh()->trashed());
         $this->assertTrue($domainB->fresh()->trashed());
         $this->assertFalse($domainA->fresh()->trashed());
 
         // Assert entitlements
         $this->assertSame(7, $entitlementsA->count()); // mailbox + groupware + 5 x storage
         $this->assertTrue($ent1->fresh()->trashed());
         $entitlementsA->get()->each(function ($ent) {
             $this->assertTrue($ent->updated_at->greaterThan(\Carbon\Carbon::now()->subSeconds(5)));
         });
 
         // We expect only CreateJob + UpdateJob pair for both user and domain.
         // Because how Illuminate/Database/Eloquent/SoftDeletes::restore() method
         // is implemented we cannot skip the UpdateJob in any way.
         // I don't want to overwrite this method, the extra job shouldn't do any harm.
         $this->assertCount(4, Queue::pushedJobs()); // @phpstan-ignore-line
         Queue::assertPushed(\App\Jobs\Domain\UpdateJob::class, 1);
         Queue::assertPushed(\App\Jobs\Domain\CreateJob::class, 1);
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
         Queue::assertPushed(\App\Jobs\User\CreateJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\User\CreateJob::class,
             function ($job) use ($userA) {
                 return $userA->id === TestCase::getObjectProperty($job, 'userId');
             }
         );
     }
 
     /**
      * Test user account restrict() and unrestrict()
      */
     public function testRestrictAndUnrestrict(): void
     {
         Queue::fake();
 
         // Test an account with users, domain
         $user = $this->getTestUser('UserAccountA@UserAccount.com');
+        $userB = $this->getTestUser('UserAccountB@UserAccount.com');
+        $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
+        $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
+        $domain = $this->getTestDomain('UserAccount.com', [
+                'status' => Domain::STATUS_NEW,
+                'type' => Domain::TYPE_HOSTED,
+        ]);
+        $user->assignPackage($package_kolab);
+        $domain->assignPackage($package_domain, $user);
+        $user->assignPackage($package_kolab, $userB);
 
         $this->assertFalse($user->isRestricted());
+        $this->assertFalse($userB->isRestricted());
 
         $user->restrict();
 
         $this->assertTrue($user->fresh()->isRestricted());
+        $this->assertFalse($userB->fresh()->isRestricted());
 
         Queue::assertPushed(
             \App\Jobs\User\UpdateJob::class,
             function ($job) use ($user) {
                 return TestCase::getObjectProperty($job, 'userId') == $user->id;
             }
         );
 
+        $userB->restrict();
+        $this->assertTrue($userB->fresh()->isRestricted());
+
         Queue::fake(); // reset queue state
 
         $user->refresh();
         $user->unrestrict();
 
         $this->assertFalse($user->fresh()->isRestricted());
+        $this->assertTrue($userB->fresh()->isRestricted());
 
         Queue::assertPushed(
             \App\Jobs\User\UpdateJob::class,
             function ($job) use ($user) {
                 return TestCase::getObjectProperty($job, 'userId') == $user->id;
             }
         );
+
+        Queue::fake(); // reset queue state
+
+        $user->unrestrict(true);
+
+        $this->assertFalse($user->fresh()->isRestricted());
+        $this->assertFalse($userB->fresh()->isRestricted());
+
+        Queue::assertPushed(
+            \App\Jobs\User\UpdateJob::class,
+            function ($job) use ($userB) {
+                return TestCase::getObjectProperty($job, 'userId') == $userB->id;
+            }
+        );
     }
 
     /**
      * Tests for AliasesTrait::setAliases()
      */
     public function testSetAliases(): void
     {
         Queue::fake();
         Queue::assertNothingPushed();
 
         $user = $this->getTestUser('UserAccountA@UserAccount.com');
         $domain = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
 
         $this->assertCount(0, $user->aliases->all());
 
         $user->tenant->setSetting('pgp.enable', 1);
 
         // Add an alias
         $user->setAliases(['UserAlias1@UserAccount.com']);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
         Queue::assertPushed(\App\Jobs\PGP\KeyCreateJob::class, 1);
 
         $user->tenant->setSetting('pgp.enable', 0);
 
         $aliases = $user->aliases()->get();
         $this->assertCount(1, $aliases);
         $this->assertSame('useralias1@useraccount.com', $aliases[0]['alias']);
 
         // Add another alias
         $user->setAliases(['UserAlias1@UserAccount.com', 'UserAlias2@UserAccount.com']);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 2);
         Queue::assertPushed(\App\Jobs\PGP\KeyCreateJob::class, 1);
 
         $aliases = $user->aliases()->orderBy('alias')->get();
         $this->assertCount(2, $aliases);
         $this->assertSame('useralias1@useraccount.com', $aliases[0]->alias);
         $this->assertSame('useralias2@useraccount.com', $aliases[1]->alias);
 
         $user->tenant->setSetting('pgp.enable', 1);
 
         // Remove an alias
         $user->setAliases(['UserAlias1@UserAccount.com']);
 
         $user->tenant->setSetting('pgp.enable', 0);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 3);
         Queue::assertPushed(\App\Jobs\PGP\KeyDeleteJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\PGP\KeyDeleteJob::class,
             function ($job) use ($user) {
                 $userId = TestCase::getObjectProperty($job, 'userId');
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 return $userId == $user->id && $userEmail === 'useralias2@useraccount.com';
             }
         );
 
         $aliases = $user->aliases()->get();
         $this->assertCount(1, $aliases);
         $this->assertSame('useralias1@useraccount.com', $aliases[0]['alias']);
 
         // Remove all aliases
         $user->setAliases([]);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 4);
 
         $this->assertCount(0, $user->aliases()->get());
     }
 
     /**
      * Tests for UserSettingsTrait::setSettings() and getSetting() and getSettings()
      */
     public function testUserSettings(): void
     {
         Queue::fake();
         Queue::assertNothingPushed();
 
         $user = $this->getTestUser('UserAccountA@UserAccount.com');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 0);
 
         // Test default settings
         // Note: Technicly this tests UserObserver::created() behavior
         $all_settings = $user->settings()->orderBy('key')->get();
         $this->assertCount(2, $all_settings);
         $this->assertSame('country', $all_settings[0]->key);
         $this->assertSame('CH', $all_settings[0]->value);
         $this->assertSame('currency', $all_settings[1]->key);
         $this->assertSame('CHF', $all_settings[1]->value);
 
         // Add a setting
         $user->setSetting('first_name', 'Firstname');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame('Firstname', $user->getSetting('first_name'));
         $this->assertSame('Firstname', $user->fresh()->getSetting('first_name'));
 
         // Update a setting
         $user->setSetting('first_name', 'Firstname1');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 2);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame('Firstname1', $user->getSetting('first_name'));
         $this->assertSame('Firstname1', $user->fresh()->getSetting('first_name'));
 
         // Delete a setting (null)
         $user->setSetting('first_name', null);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 3);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame(null, $user->getSetting('first_name'));
         $this->assertSame(null, $user->fresh()->getSetting('first_name'));
 
         // Delete a setting (empty string)
         $user->setSetting('first_name', 'Firstname1');
         $user->setSetting('first_name', '');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 5);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame(null, $user->getSetting('first_name'));
         $this->assertSame(null, $user->fresh()->getSetting('first_name'));
 
         // Set multiple settings at once
         $user->setSettings([
                 'first_name' => 'Firstname2',
                 'last_name' => 'Lastname2',
                 'country' => null,
         ]);
 
         // TODO: This really should create a single UserUpdate job, not 3
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 7);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame('Firstname2', $user->getSetting('first_name'));
         $this->assertSame('Firstname2', $user->fresh()->getSetting('first_name'));
         $this->assertSame('Lastname2', $user->getSetting('last_name'));
         $this->assertSame('Lastname2', $user->fresh()->getSetting('last_name'));
         $this->assertSame(null, $user->getSetting('country'));
         $this->assertSame(null, $user->fresh()->getSetting('country'));
 
         $all_settings = $user->settings()->orderBy('key')->get();
         $this->assertCount(3, $all_settings);
 
         // Test getSettings() method
         $this->assertSame(
             [
                 'first_name' => 'Firstname2',
                 'last_name' => 'Lastname2',
                 'unknown' => null,
             ],
             $user->getSettings(['first_name', 'last_name', 'unknown'])
         );
     }
 
     /**
      * Tests for User::users()
      */
     public function testUsers(): void
     {
         $jack = $this->getTestUser('jack@kolab.org');
         $joe = $this->getTestUser('joe@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $wallet = $john->wallets()->first();
 
         $users = $john->users()->orderBy('email')->get();
 
         $this->assertCount(4, $users);
         $this->assertEquals($jack->id, $users[0]->id);
         $this->assertEquals($joe->id, $users[1]->id);
         $this->assertEquals($john->id, $users[2]->id);
         $this->assertEquals($ned->id, $users[3]->id);
 
         $users = $jack->users()->orderBy('email')->get();
 
         $this->assertCount(0, $users);
 
         $users = $ned->users()->orderBy('email')->get();
 
         $this->assertCount(4, $users);
     }
 
     /**
      * Tests for User::walletOwner() (from EntitleableTrait)
      */
     public function testWalletOwner(): void
     {
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         $this->assertSame($john->id, $john->walletOwner()->id);
         $this->assertSame($john->id, $jack->walletOwner()->id);
         $this->assertSame($john->id, $ned->walletOwner()->id);
 
         // User with no entitlements
         $user = $this->getTestUser('UserAccountA@UserAccount.com');
         $this->assertSame($user->id, $user->walletOwner()->id);
     }
 
     /**
      * Tests for User::wallets()
      */
     public function testWallets(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         $this->assertSame(1, $john->wallets()->count());
         $this->assertCount(1, $john->wallets);
         $this->assertInstanceOf(\App\Wallet::class, $john->wallets->first());
 
         $this->assertSame(1, $ned->wallets()->count());
         $this->assertCount(1, $ned->wallets);
         $this->assertInstanceOf(\App\Wallet::class, $ned->wallets->first());
     }
 }