diff --git a/src/app/Console/Commands/User/DomainsCommand.php b/src/app/Console/Commands/User/DomainsCommand.php
index 681a879c..0006e375 100644
--- a/src/app/Console/Commands/User/DomainsCommand.php
+++ b/src/app/Console/Commands/User/DomainsCommand.php
@@ -1,41 +1,14 @@
 <?php
 
 namespace App\Console\Commands\User;
 
-use App\Console\Command;
+use App\Console\ObjectRelationListCommand;
 
-class DomainsCommand extends Command
+class DomainsCommand extends ObjectRelationListCommand
 {
-    /**
-     * The name and signature of the console command.
-     *
-     * @var string
-     */
-    protected $signature = 'user:domains {user}';
-
-    /**
-     * The console command description.
-     *
-     * @var string
-     */
-    protected $description = "List a user's domains.";
-
-    /**
-     * Execute the console command.
-     *
-     * @return mixed
-     */
-    public function handle()
-    {
-        $user = $this->getUser($this->argument('user'));
-
-        if (!$user) {
-            $this->error("User not found.");
-            return 1;
-        }
-
-        foreach ($user->domains() as $domain) {
-            $this->info($domain->namespace);
-        }
-    }
+    protected $objectClass = \App\User::class;
+    protected $objectName = 'user';
+    protected $objectTitle = 'email';
+    protected $objectRelation = 'domains';
+    protected $objectRelationArgs = [true, false];
 }
diff --git a/src/app/Console/Commands/User/GroupsCommand.php b/src/app/Console/Commands/User/GroupsCommand.php
new file mode 100644
index 00000000..35f16c40
--- /dev/null
+++ b/src/app/Console/Commands/User/GroupsCommand.php
@@ -0,0 +1,13 @@
+<?php
+
+namespace App\Console\Commands\User;
+
+use App\Console\ObjectRelationListCommand;
+
+class GroupsCommand extends ObjectRelationListCommand
+{
+    protected $objectClass = \App\User::class;
+    protected $objectName = 'user';
+    protected $objectTitle = 'email';
+    protected $objectRelation = 'groups';
+}
diff --git a/src/app/Console/Commands/User/ResourcesCommand.php b/src/app/Console/Commands/User/ResourcesCommand.php
new file mode 100644
index 00000000..9de9d7c5
--- /dev/null
+++ b/src/app/Console/Commands/User/ResourcesCommand.php
@@ -0,0 +1,13 @@
+<?php
+
+namespace App\Console\Commands\User;
+
+use App\Console\ObjectRelationListCommand;
+
+class ResourcesCommand extends ObjectRelationListCommand
+{
+    protected $objectClass = \App\User::class;
+    protected $objectName = 'user';
+    protected $objectTitle = 'email';
+    protected $objectRelation = 'resources';
+}
diff --git a/src/app/Console/Commands/User/SharedFoldersCommand.php b/src/app/Console/Commands/User/SharedFoldersCommand.php
new file mode 100644
index 00000000..9333f4c1
--- /dev/null
+++ b/src/app/Console/Commands/User/SharedFoldersCommand.php
@@ -0,0 +1,13 @@
+<?php
+
+namespace App\Console\Commands\User;
+
+use App\Console\ObjectRelationListCommand;
+
+class SharedFoldersCommand extends ObjectRelationListCommand
+{
+    protected $objectClass = \App\User::class;
+    protected $objectName = 'user';
+    protected $objectTitle = 'email';
+    protected $objectRelation = 'sharedFolders';
+}
diff --git a/src/app/Console/Commands/User/UsersCommand.php b/src/app/Console/Commands/User/UsersCommand.php
new file mode 100644
index 00000000..408f5554
--- /dev/null
+++ b/src/app/Console/Commands/User/UsersCommand.php
@@ -0,0 +1,13 @@
+<?php
+
+namespace App\Console\Commands\User;
+
+use App\Console\ObjectRelationListCommand;
+
+class UsersCommand extends ObjectRelationListCommand
+{
+    protected $objectClass = \App\User::class;
+    protected $objectName = 'user';
+    protected $objectTitle = 'email';
+    protected $objectRelation = 'users';
+}
diff --git a/src/app/Console/ObjectRelationListCommand.php b/src/app/Console/ObjectRelationListCommand.php
index fd9049a9..1e090f7e 100644
--- a/src/app/Console/ObjectRelationListCommand.php
+++ b/src/app/Console/ObjectRelationListCommand.php
@@ -1,87 +1,99 @@
 <?php
 
 namespace App\Console;
 
+use Illuminate\Support\Str;
+
 /**
  * This abstract class provides a means to treat objects in our model using CRUD, with the exception that
  * this particular abstract class lists objects' relations.
  */
 abstract class ObjectRelationListCommand extends ObjectCommand
 {
     /**
      * The "relation" -- a method or property.
      *
      * @var string
      */
     protected $objectRelation;
 
+    /**
+     * Optional arguments for $objectRelation method
+     *
+     * @var array
+     */
+    protected $objectRelationArgs = [];
+
     /**
      * Supplement the base command constructor with a derived or generated signature and
      * description.
      *
      * @return mixed
      */
     public function __construct()
     {
         $this->description = "List {$this->objectRelation} for a {$this->objectName}";
 
         $this->signature = sprintf(
             "%s%s:%s {%s}",
             $this->commandPrefix ? $this->commandPrefix . ":" : "",
             $this->objectName,
-            $this->objectRelation,
+            Str::kebab($this->objectRelation),
             $this->objectName
         );
 
         $this->signature .= " {--attr=* : Attributes other than the primary unique key to include}";
 
         parent::__construct();
     }
 
     /**
      * Execute the console command.
      *
      * @return mixed
      */
     public function handle()
     {
         $argument = $this->argument($this->objectName);
 
         $object = $this->getObject(
             $this->objectClass,
             $argument,
             $this->objectTitle
         );
 
         if (!$object) {
             $this->error("No such {$this->objectName} {$argument}");
             return 1;
         }
 
         if (method_exists($object, $this->objectRelation)) {
-            $result = call_user_func([$object, $this->objectRelation]);
+            $result = call_user_func_array([$object, $this->objectRelation], $this->objectRelationArgs);
         } elseif (property_exists($object, $this->objectRelation)) {
             $result = $object->{"{$this->objectRelation}"};
         } else {
             $this->error("No such relation {$this->objectRelation}");
             return 1;
         }
 
         // Convert query builder into a collection
-        if ($result instanceof \Illuminate\Database\Eloquent\Relations\Relation) {
+        if (
+            ($result instanceof \Illuminate\Database\Eloquent\Relations\Relation)
+            || ($result instanceof \Illuminate\Database\Eloquent\Builder)
+        ) {
             $result = $result->get();
         }
 
         // Print the result
         if (
             ($result instanceof \Illuminate\Database\Eloquent\Collection)
             || is_array($result)
         ) {
             foreach ($result as $entry) {
                 $this->info($this->toString($entry));
             }
         } else {
             $this->info($this->toString($result));
         }
     }
 }
diff --git a/src/app/Domain.php b/src/app/Domain.php
index eafd7c40..0162f9fa 100644
--- a/src/app/Domain.php
+++ b/src/app/Domain.php
@@ -1,485 +1,480 @@
 <?php
 
 namespace App;
 
 use App\Wallet;
 use App\Traits\BelongsToTenantTrait;
 use App\Traits\DomainConfigTrait;
 use App\Traits\EntitleableTrait;
 use App\Traits\SettingsTrait;
 use App\Traits\UuidIntKeyTrait;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 /**
  * The eloquent definition of a Domain.
  *
  * @property string $namespace
  * @property int    $status
  * @property int    $tenant_id
  * @property int    $type
  */
 class Domain extends Model
 {
     use BelongsToTenantTrait;
     use DomainConfigTrait;
     use EntitleableTrait;
     use SettingsTrait;
     use SoftDeletes;
     use UuidIntKeyTrait;
 
     // we've simply never heard of this domain
     public const STATUS_NEW        = 1 << 0;
     // it's been activated
     public const STATUS_ACTIVE     = 1 << 1;
     // domain has been suspended.
     public const STATUS_SUSPENDED  = 1 << 2;
     // domain has been deleted
     public const STATUS_DELETED    = 1 << 3;
     // ownership of the domain has been confirmed
     public const STATUS_CONFIRMED  = 1 << 4;
     // domain has been verified that it exists in DNS
     public const STATUS_VERIFIED   = 1 << 5;
     // domain has been created in LDAP
     public const STATUS_LDAP_READY = 1 << 6;
 
     // open for public registration
     public const TYPE_PUBLIC       = 1 << 0;
     // zone hosted with us
     public const TYPE_HOSTED       = 1 << 1;
     // zone registered externally
     public const TYPE_EXTERNAL     = 1 << 2;
 
     public const HASH_CODE = 1;
     public const HASH_TEXT = 2;
     public const HASH_CNAME = 3;
 
     protected $fillable = [
         'namespace',
         'status',
         'type'
     ];
 
     /**
      * Assign a package to a domain. The domain should not belong to any existing entitlements.
      *
      * @param \App\Package $package The package to assign.
      * @param \App\User    $user    The wallet owner.
      *
      * @return \App\Domain Self
      */
     public function assignPackage($package, $user)
     {
         // If this domain is public it can not be assigned to a user.
         if ($this->isPublic()) {
             return $this;
         }
 
         // See if this domain is already owned by another user.
         $wallet = $this->wallet();
 
         if ($wallet) {
             \Log::error(
                 "Domain {$this->namespace} is already assigned to {$wallet->owner->email}"
             );
 
             return $this;
         }
 
         return $this->assignPackageAndWallet($package, $user->wallets()->first());
     }
 
     /**
      * Return list of public+active domain names (for current tenant)
      */
     public static function getPublicDomains(): array
     {
         return self::withEnvTenantContext()
             ->whereRaw(sprintf('(type & %s)', Domain::TYPE_PUBLIC))
             ->get(['namespace'])->pluck('namespace')->toArray();
     }
 
     /**
      * Returns whether this domain is active.
      *
      * @return bool
      */
     public function isActive(): bool
     {
         return ($this->status & self::STATUS_ACTIVE) > 0;
     }
 
     /**
      * Returns whether this domain is confirmed the ownership of.
      *
      * @return bool
      */
     public function isConfirmed(): bool
     {
         return ($this->status & self::STATUS_CONFIRMED) > 0;
     }
 
     /**
      * Returns whether this domain is deleted.
      *
      * @return bool
      */
     public function isDeleted(): bool
     {
         return ($this->status & self::STATUS_DELETED) > 0;
     }
 
     /**
      * Returns whether this domain is registered with us.
      *
      * @return bool
      */
     public function isExternal(): bool
     {
         return ($this->type & self::TYPE_EXTERNAL) > 0;
     }
 
     /**
      * Returns whether this domain is hosted with us.
      *
      * @return bool
      */
     public function isHosted(): bool
     {
         return ($this->type & self::TYPE_HOSTED) > 0;
     }
 
     /**
      * Returns whether this domain is new.
      *
      * @return bool
      */
     public function isNew(): bool
     {
         return ($this->status & self::STATUS_NEW) > 0;
     }
 
     /**
      * Returns whether this domain is public.
      *
      * @return bool
      */
     public function isPublic(): bool
     {
         return ($this->type & self::TYPE_PUBLIC) > 0;
     }
 
     /**
      * Returns whether this domain is registered in LDAP.
      *
      * @return bool
      */
     public function isLdapReady(): bool
     {
         return ($this->status & self::STATUS_LDAP_READY) > 0;
     }
 
     /**
      * Returns whether this domain is suspended.
      *
      * @return bool
      */
     public function isSuspended(): bool
     {
         return ($this->status & self::STATUS_SUSPENDED) > 0;
     }
 
     /**
      * Returns whether this (external) domain has been verified
      * to exist in DNS.
      *
      * @return bool
      */
     public function isVerified(): bool
     {
         return ($this->status & self::STATUS_VERIFIED) > 0;
     }
 
     /**
      * Ensure the namespace is appropriately cased.
      */
     public function setNamespaceAttribute($namespace)
     {
         $this->attributes['namespace'] = strtolower($namespace);
     }
 
     /**
      * Domain status mutator
      *
      * @throws \Exception
      */
     public function setStatusAttribute($status)
     {
         $new_status = 0;
 
         $allowed_values = [
             self::STATUS_NEW,
             self::STATUS_ACTIVE,
             self::STATUS_SUSPENDED,
             self::STATUS_DELETED,
             self::STATUS_CONFIRMED,
             self::STATUS_VERIFIED,
             self::STATUS_LDAP_READY,
         ];
 
         foreach ($allowed_values as $value) {
             if ($status & $value) {
                 $new_status |= $value;
                 $status ^= $value;
             }
         }
 
         if ($status > 0) {
             throw new \Exception("Invalid domain status: {$status}");
         }
 
         if ($this->isPublic()) {
             $this->attributes['status'] = $new_status;
             return;
         }
 
         if ($new_status & self::STATUS_CONFIRMED) {
             // if we have confirmed ownership of or management access to the domain, then we have
             // also confirmed the domain exists in DNS.
             $new_status |= self::STATUS_VERIFIED;
             $new_status |= self::STATUS_ACTIVE;
         }
 
         if ($new_status & self::STATUS_DELETED && $new_status & self::STATUS_ACTIVE) {
             $new_status ^= self::STATUS_ACTIVE;
         }
 
         if ($new_status & self::STATUS_SUSPENDED && $new_status & self::STATUS_ACTIVE) {
             $new_status ^= self::STATUS_ACTIVE;
         }
 
         // if the domain is now active, it is not new anymore.
         if ($new_status & self::STATUS_ACTIVE && $new_status & self::STATUS_NEW) {
             $new_status ^= self::STATUS_NEW;
         }
 
         $this->attributes['status'] = $new_status;
     }
 
     /**
      * Ownership verification by checking for a TXT (or CNAME) record
      * in the domain's DNS (that matches the verification hash).
      *
      * @return bool True if verification was successful, false otherwise
      * @throws \Exception Throws exception on DNS or DB errors
      */
     public function confirm(): bool
     {
         if ($this->isConfirmed()) {
             return true;
         }
 
         $hash = $this->hash(self::HASH_TEXT);
         $confirmed = false;
 
         // Get DNS records and find a matching TXT entry
         $records = \dns_get_record($this->namespace, DNS_TXT);
 
         if ($records === false) {
             throw new \Exception("Failed to get DNS record for {$this->namespace}");
         }
 
         foreach ($records as $record) {
             if ($record['txt'] === $hash) {
                 $confirmed = true;
                 break;
             }
         }
 
         // Get DNS records and find a matching CNAME entry
         // Note: some servers resolve every non-existing name
         // so we need to define left and right side of the CNAME record
         // i.e.: kolab-verify IN CNAME <hash>.domain.tld.
         if (!$confirmed) {
             $cname = $this->hash(self::HASH_CODE) . '.' . $this->namespace;
             $records = \dns_get_record('kolab-verify.' . $this->namespace, DNS_CNAME);
 
             if ($records === false) {
                 throw new \Exception("Failed to get DNS record for {$this->namespace}");
             }
 
             foreach ($records as $records) {
                 if ($records['target'] === $cname) {
                     $confirmed = true;
                     break;
                 }
             }
         }
 
         if ($confirmed) {
             $this->status |= Domain::STATUS_CONFIRMED;
             $this->save();
         }
 
         return $confirmed;
     }
 
     /**
      * Generate a verification hash for this domain
      *
      * @param int $mod One of: HASH_CNAME, HASH_CODE (Default), HASH_TEXT
      *
      * @return string Verification hash
      */
     public function hash($mod = null): string
     {
         $cname = 'kolab-verify';
 
         if ($mod === self::HASH_CNAME) {
             return $cname;
         }
 
         $hash = \md5('hkccp-verify-' . $this->namespace);
 
         return $mod === self::HASH_TEXT ? "$cname=$hash" : $hash;
     }
 
     /**
      * Checks if there are any objects (users/aliases/groups) in a domain.
      * Note: Public domains are always reported not empty.
      *
      * @return bool True if there are no objects assigned, False otherwise
      */
     public function isEmpty(): bool
     {
         if ($this->isPublic()) {
             return false;
         }
 
         // FIXME: These queries will not use indexes, so maybe we should consider
         // wallet/entitlements to search in objects that belong to this domain account?
 
         $suffix = '@' . $this->namespace;
         $suffixLen = strlen($suffix);
 
         return !(
             \App\User::whereRaw('substr(email, ?) = ?', [-$suffixLen, $suffix])->exists()
             || \App\UserAlias::whereRaw('substr(alias, ?) = ?', [-$suffixLen, $suffix])->exists()
             || \App\Group::whereRaw('substr(email, ?) = ?', [-$suffixLen, $suffix])->exists()
             || \App\Resource::whereRaw('substr(email, ?) = ?', [-$suffixLen, $suffix])->exists()
             || \App\SharedFolder::whereRaw('substr(email, ?) = ?', [-$suffixLen, $suffix])->exists()
         );
     }
 
     /**
      * Suspend this domain.
      *
      * @return void
      */
     public function suspend(): void
     {
         if ($this->isSuspended()) {
             return;
         }
 
         $this->status |= Domain::STATUS_SUSPENDED;
         $this->save();
     }
 
     /**
      * Unsuspend this domain.
      *
      * The domain is unsuspended through either of the following courses of actions;
      *
      *   * The account balance has been topped up, or
      *   * a suspected spammer has resolved their issues, or
      *   * the command-line is triggered.
      *
      * Therefore, we can also confidently set the domain status to 'active' should the ownership of or management
      * access to have been confirmed before.
      *
      * @return void
      */
     public function unsuspend(): void
     {
         if (!$this->isSuspended()) {
             return;
         }
 
         $this->status ^= Domain::STATUS_SUSPENDED;
 
         if ($this->isConfirmed() && $this->isVerified()) {
             $this->status |= Domain::STATUS_ACTIVE;
         }
 
         $this->save();
     }
 
     /**
      * List the users of a domain, so long as the domain is not a public registration domain.
      * Note: It returns only users with a mailbox.
      *
      * @return \App\User[] A list of users
      */
     public function users(): array
     {
         if ($this->isPublic()) {
             return [];
         }
 
         $wallet = $this->wallet();
 
         if (!$wallet) {
             return [];
         }
 
         $mailboxSKU = \App\Sku::withObjectTenantContext($this)->where('title', 'mailbox')->first();
 
         if (!$mailboxSKU) {
             \Log::error("No mailbox SKU available.");
             return [];
         }
 
-        $entitlements = $wallet->entitlements()
+        return $wallet->entitlements()
             ->where('entitleable_type', \App\User::class)
-            ->where('sku_id', $mailboxSKU->id)->get();
-
-        $users = [];
-
-        foreach ($entitlements as $entitlement) {
-            $users[] = $entitlement->entitleable;
-        }
-
-        return $users;
+            ->where('sku_id', $mailboxSKU->id)
+            ->get()
+            ->pluck('entitleable')
+            ->all();
     }
 
     /**
      * Verify if a domain exists in DNS
      *
      * @return bool True if registered, False otherwise
      * @throws \Exception Throws exception on DNS or DB errors
      */
     public function verify(): bool
     {
         if ($this->isVerified()) {
             return true;
         }
 
         $records = \dns_get_record($this->namespace, DNS_ANY);
 
         if ($records === false) {
             throw new \Exception("Failed to get DNS record for {$this->namespace}");
         }
 
         // It may happen that result contains other domains depending on the host DNS setup
         // that's why in_array() and not just !empty()
         if (in_array($this->namespace, array_column($records, 'host'))) {
             $this->status |= Domain::STATUS_VERIFIED;
             $this->save();
 
             return true;
         }
 
         return false;
     }
 }
diff --git a/src/app/Http/Controllers/API/V4/DomainsController.php b/src/app/Http/Controllers/API/V4/DomainsController.php
index b247fbda..0ba683c5 100644
--- a/src/app/Http/Controllers/API/V4/DomainsController.php
+++ b/src/app/Http/Controllers/API/V4/DomainsController.php
@@ -1,463 +1,460 @@
 <?php
 
 namespace App\Http\Controllers\API\V4;
 
 use App\Domain;
 use App\Http\Controllers\Controller;
 use App\Backends\LDAP;
 use App\Rules\UserEmailDomain;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Validator;
 
 class DomainsController extends Controller
 {
     /** @var array Common object properties in the API response */
     protected static $objectProps = ['namespace', 'type'];
 
 
     /**
      * Return a list of domains owned by the current user
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function index()
     {
         $user = $this->guard()->user();
 
-        $list = \collect($user->domains())
-            ->filter(function ($domain) {
-                return !$domain->isPublic();
-            })
+        $list = $user->domains(true, false)
+            ->orderBy('namespace')
+            ->get()
             ->map(function ($domain) {
                 return $this->objectToClient($domain);
             })
-            ->sortBy('namespace')
-            ->values()
             ->all();
 
         return response()->json($list);
     }
 
     /**
      * Show the form for creating a new domain.
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function create()
     {
         return $this->errorResponse(404);
     }
 
     /**
      * Confirm ownership of the specified domain (via DNS check).
      *
      * @param int $id Domain identifier
      *
      * @return \Illuminate\Http\JsonResponse|void
      */
     public function confirm($id)
     {
         $domain = Domain::find($id);
 
         if (!$this->checkTenant($domain)) {
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canRead($domain)) {
             return $this->errorResponse(403);
         }
 
         if (!$domain->confirm()) {
             return response()->json([
                     'status' => 'error',
                     'message' => \trans('app.domain-verify-error'),
             ]);
         }
 
         return response()->json([
                 'status' => 'success',
                 'statusInfo' => self::statusInfo($domain),
                 'message' => \trans('app.domain-verify-success'),
         ]);
     }
 
     /**
      * Remove the specified domain.
      *
      * @param int $id Domain identifier
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function destroy($id)
     {
         $domain = Domain::withEnvTenantContext()->find($id);
 
         if (empty($domain)) {
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canDelete($domain)) {
             return $this->errorResponse(403);
         }
 
         // It is possible to delete domain only if there are no users/aliases/groups using it.
         if (!$domain->isEmpty()) {
             $response = ['status' => 'error', 'message' => \trans('app.domain-notempty-error')];
             return response()->json($response, 422);
         }
 
         $domain->delete();
 
         return response()->json([
                 'status' => 'success',
                 'message' => \trans('app.domain-delete-success'),
         ]);
     }
 
     /**
      * Show the form for editing the specified domain.
      *
      * @param int $id Domain identifier
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function edit($id)
     {
         return $this->errorResponse(404);
     }
 
     /**
      * Set the domain configuration.
      *
      * @param int $id Domain identifier
      *
      * @return \Illuminate\Http\JsonResponse|void
      */
     public function setConfig($id)
     {
         $domain = Domain::find($id);
 
         if (empty($domain)) {
             return $this->errorResponse(404);
         }
 
         // Only owner (or admin) has access to the domain
         if (!$this->guard()->user()->canUpdate($domain)) {
             return $this->errorResponse(403);
         }
 
         $errors = $domain->setConfig(request()->input());
 
         if (!empty($errors)) {
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         return response()->json([
                 'status' => 'success',
                 'message' => \trans('app.domain-setconfig-success'),
         ]);
     }
 
     /**
      * Create a domain.
      *
      * @param \Illuminate\Http\Request $request
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function store(Request $request)
     {
         $current_user = $this->guard()->user();
         $owner = $current_user->wallet()->owner;
 
         if ($owner->id != $current_user->id) {
             return $this->errorResponse(403);
         }
 
         // Validate the input
         $v = Validator::make(
             $request->all(),
             [
                 'namespace' => ['required', 'string', new UserEmailDomain()]
             ]
         );
 
         if ($v->fails()) {
             return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
         }
 
         $namespace = \strtolower(request()->input('namespace'));
 
         // Domain already exists
         if ($domain = Domain::withTrashed()->where('namespace', $namespace)->first()) {
             // Check if the domain is soft-deleted and belongs to the same user
             $deleteBeforeCreate = $domain->trashed() && ($wallet = $domain->wallet())
                 && $wallet->owner && $wallet->owner->id == $owner->id;
 
             if (!$deleteBeforeCreate) {
                 $errors = ['namespace' => \trans('validation.domainnotavailable')];
                 return response()->json(['status' => 'error', 'errors' => $errors], 422);
             }
         }
 
         if (empty($request->package) || !($package = \App\Package::withEnvTenantContext()->find($request->package))) {
             $errors = ['package' => \trans('validation.packagerequired')];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         if (!$package->isDomain()) {
             $errors = ['package' => \trans('validation.packageinvalid')];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         DB::beginTransaction();
 
         // Force-delete the existing domain if it is soft-deleted and belongs to the same user
         if (!empty($deleteBeforeCreate)) {
             $domain->forceDelete();
         }
 
         // Create the domain
         $domain = Domain::create([
                 'namespace' => $namespace,
                 'type' => \App\Domain::TYPE_EXTERNAL,
         ]);
 
         $domain->assignPackage($package, $owner);
 
         DB::commit();
 
         return response()->json([
                 'status' => 'success',
                 'message' => __('app.domain-create-success'),
         ]);
     }
 
     /**
      * Get the information about the specified domain.
      *
      * @param int $id Domain identifier
      *
      * @return \Illuminate\Http\JsonResponse|void
      */
     public function show($id)
     {
         $domain = Domain::find($id);
 
         if (!$this->checkTenant($domain)) {
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canRead($domain)) {
             return $this->errorResponse(403);
         }
 
         $response = $this->objectToClient($domain, true);
 
         // Add hash information to the response
         $response['hash_text'] = $domain->hash(Domain::HASH_TEXT);
         $response['hash_cname'] = $domain->hash(Domain::HASH_CNAME);
         $response['hash_code'] = $domain->hash(Domain::HASH_CODE);
 
         // Add DNS/MX configuration for the domain
         $response['dns'] = self::getDNSConfig($domain);
         $response['mx'] = self::getMXConfig($domain->namespace);
 
         // Domain configuration, e.g. spf whitelist
         $response['config'] = $domain->getConfig();
 
         // Status info
         $response['statusInfo'] = self::statusInfo($domain);
 
         // Entitlements info
         $response['skus'] = \App\Entitlement::objectEntitlementsSummary($domain);
 
         // Some basic information about the domain wallet
         $wallet = $domain->wallet();
         $response['wallet'] = $wallet->toArray();
         if ($wallet->discount) {
             $response['wallet']['discount'] = $wallet->discount->discount;
             $response['wallet']['discount_description'] = $wallet->discount->description;
         }
 
         return response()->json($response);
     }
 
     /**
      * Fetch domain status (and reload setup process)
      *
      * @param int $id Domain identifier
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function status($id)
     {
         $domain = Domain::find($id);
 
         if (!$this->checkTenant($domain)) {
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canRead($domain)) {
             return $this->errorResponse(403);
         }
 
         $response = $this->processStateUpdate($domain);
         $response = array_merge($response, self::objectState($domain));
 
         return response()->json($response);
     }
 
     /**
      * Update the specified domain.
      *
      * @param \Illuminate\Http\Request $request
      * @param int                      $id Domain identifier
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function update(Request $request, $id)
     {
         return $this->errorResponse(404);
     }
 
     /**
      * Provide DNS MX information to configure specified domain for
      */
     protected static function getMXConfig(string $namespace): array
     {
         $entries = [];
 
         // copy MX entries from an existing domain
         if ($master = \config('dns.copyfrom')) {
             // TODO: cache this lookup
             foreach ((array) dns_get_record($master, DNS_MX) as $entry) {
                 $entries[] = sprintf(
                     "@\t%s\t%s\tMX\t%d %s.",
                     \config('dns.ttl', $entry['ttl']),
                     $entry['class'],
                     $entry['pri'],
                     $entry['target']
                 );
             }
         } elseif ($static = \config('dns.static')) {
             $entries[] = strtr($static, array('\n' => "\n", '%s' => $namespace));
         }
 
         // display SPF settings
         if ($spf = \config('dns.spf')) {
             $entries[] = ';';
             foreach (['TXT', 'SPF'] as $type) {
                 $entries[] = sprintf(
                     "@\t%s\tIN\t%s\t\"%s\"",
                     \config('dns.ttl'),
                     $type,
                     $spf
                 );
             }
         }
 
         return $entries;
     }
 
     /**
      * Provide sample DNS config for domain confirmation
      */
     protected static function getDNSConfig(Domain $domain): array
     {
         $serial = date('Ymd01');
         $hash_txt = $domain->hash(Domain::HASH_TEXT);
         $hash_cname = $domain->hash(Domain::HASH_CNAME);
         $hash = $domain->hash(Domain::HASH_CODE);
 
         return [
             "@   IN  SOA ns1.dnsservice.com. hostmaster.{$domain->namespace}. (",
             "        {$serial}  10800  3600  604800  86400 )",
             ";",
             "@       IN  A   <some-ip>",
             "www     IN  A   <some-ip>",
             ";",
             "{$hash_cname}.{$domain->namespace}. IN CNAME {$hash}.{$domain->namespace}.",
             "@   3600    TXT \"{$hash_txt}\"",
         ];
     }
 
     /**
      * Prepare domain statuses for the UI
      *
      * @param \App\Domain $domain Domain object
      *
      * @return array Statuses array
      */
     protected static function objectState(Domain $domain): array
     {
         return [
             'isLdapReady' => $domain->isLdapReady(),
             'isConfirmed' => $domain->isConfirmed(),
             'isVerified' => $domain->isVerified(),
             'isSuspended' => $domain->isSuspended(),
             'isActive' => $domain->isActive(),
             'isDeleted' => $domain->isDeleted() || $domain->trashed(),
         ];
     }
 
     /**
      * Domain status (extended) information.
      *
      * @param \App\Domain $domain Domain object
      *
      * @return array Status information
      */
     public static function statusInfo(Domain $domain): array
     {
         // If that is not a public domain, add domain specific steps
         return self::processStateInfo(
             $domain,
             [
                 'domain-new' => true,
                 'domain-ldap-ready' => $domain->isLdapReady(),
                 'domain-verified' => $domain->isVerified(),
                 'domain-confirmed' => [$domain->isConfirmed(), "/domain/{$domain->id}"],
             ]
         );
     }
 
     /**
      * Execute (synchronously) specified step in a domain setup process.
      *
      * @param \App\Domain $domain Domain object
      * @param string      $step   Step identifier (as in self::statusInfo())
      *
      * @return bool True if the execution succeeded, False otherwise
      */
     public static function execProcessStep(Domain $domain, string $step): bool
     {
         try {
             switch ($step) {
                 case 'domain-ldap-ready':
                     // Domain not in LDAP, create it
                     if (!$domain->isLdapReady()) {
                         LDAP::createDomain($domain);
                         $domain->status |= Domain::STATUS_LDAP_READY;
                         $domain->save();
                     }
                     return $domain->isLdapReady();
 
                 case 'domain-verified':
                     // Domain existence not verified
                     $domain->verify();
                     return $domain->isVerified();
 
                 case 'domain-confirmed':
                     // Domain ownership confirmation
                     $domain->confirm();
                     return $domain->isConfirmed();
             }
         } catch (\Exception $e) {
             \Log::error($e);
         }
 
         return false;
     }
 }
diff --git a/src/app/Http/Controllers/API/V4/UsersController.php b/src/app/Http/Controllers/API/V4/UsersController.php
index 56a9a618..597db507 100644
--- a/src/app/Http/Controllers/API/V4/UsersController.php
+++ b/src/app/Http/Controllers/API/V4/UsersController.php
@@ -1,810 +1,806 @@
 <?php
 
 namespace App\Http\Controllers\API\V4;
 
 use App\Http\Controllers\Controller;
 use App\Domain;
 use App\Group;
 use App\Rules\UserEmailDomain;
 use App\Rules\UserEmailLocal;
 use App\Sku;
 use App\User;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Support\Str;
 
 class UsersController extends Controller
 {
     /** @const array List of user setting keys available for modification in UI */
     public const USER_SETTINGS = [
         'billing_address',
         'country',
         'currency',
         'external_email',
         'first_name',
         'last_name',
         'organization',
         'phone',
     ];
 
     /**
      * On user create it is filled with a user or group object to force-delete
      * before the creation of a new user record is possible.
      *
      * @var \App\User|\App\Group|null
      */
     protected $deleteBeforeCreate;
 
     /** @var array Common object properties in the API response */
     protected static $objectProps = ['email'];
 
 
     /**
      * Delete a user.
      *
      * @param int $id User identifier
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function destroy($id)
     {
         $user = User::withEnvTenantContext()->find($id);
 
         if (empty($user)) {
             return $this->errorResponse(404);
         }
 
         // User can't remove himself until he's the controller
         if (!$this->guard()->user()->canDelete($user)) {
             return $this->errorResponse(403);
         }
 
         $user->delete();
 
         return response()->json([
                 'status' => 'success',
                 'message' => \trans('app.user-delete-success'),
         ]);
     }
 
     /**
      * Listing of users.
      *
      * The user-entitlements billed to the current user wallet(s)
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function index()
     {
         $user = $this->guard()->user();
         $search = trim(request()->input('search'));
         $page = intval(request()->input('page')) ?: 1;
         $pageSize = 20;
         $hasMore = false;
 
         $result = $user->users();
 
         // Search by user email, alias or name
         if (strlen($search) > 0) {
             // thanks to cloning we skip some extra queries in $user->users()
             $allUsers1 = clone $result;
             $allUsers2 = clone $result;
 
             $result->whereLike('email', $search)
                 ->union(
                     $allUsers1->join('user_aliases', 'users.id', '=', 'user_aliases.user_id')
                         ->whereLike('alias', $search)
                 )
                 ->union(
                     $allUsers2->join('user_settings', 'users.id', '=', 'user_settings.user_id')
                         ->whereLike('value', $search)
                         ->whereIn('key', ['first_name', 'last_name'])
                 );
         }
 
         $result = $result->orderBy('email')
             ->limit($pageSize + 1)
             ->offset($pageSize * ($page - 1))
             ->get();
 
         if (count($result) > $pageSize) {
             $result->pop();
             $hasMore = true;
         }
 
         // Process the result
         $result = $result->map(
             function ($user) {
                 return $this->objectToClient($user);
             }
         );
 
         $result = [
             'list' => $result,
             'count' => count($result),
             'hasMore' => $hasMore,
         ];
 
         return response()->json($result);
     }
 
     /**
      * Set user config.
      *
      * @param int $id The user
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function setConfig($id)
     {
         $user = User::find($id);
 
         if (empty($user)) {
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canUpdate($user)) {
             return $this->errorResponse(403);
         }
 
         $errors = $user->setConfig(request()->input());
 
         if (!empty($errors)) {
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         return response()->json([
                 'status' => 'success',
                 'message' => \trans('app.user-setconfig-success'),
         ]);
     }
 
     /**
      * Display information on the user account specified by $id.
      *
      * @param int $id The account to show information for.
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function show($id)
     {
         $user = User::withEnvTenantContext()->find($id);
 
         if (empty($user)) {
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canRead($user)) {
             return $this->errorResponse(403);
         }
 
         $response = $this->userResponse($user);
 
         $response['skus'] = \App\Entitlement::objectEntitlementsSummary($user);
         $response['config'] = $user->getConfig();
 
         return response()->json($response);
     }
 
     /**
      * Fetch user status (and reload setup process)
      *
      * @param int $id User identifier
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function status($id)
     {
         $user = User::withEnvTenantContext()->find($id);
 
         if (empty($user)) {
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canRead($user)) {
             return $this->errorResponse(403);
         }
 
         $response = $this->processStateUpdate($user);
         $response = array_merge($response, self::objectState($user));
 
         return response()->json($response);
     }
 
     /**
      * User status (extended) information
      *
      * @param \App\User $user User object
      *
      * @return array Status information
      */
     public static function statusInfo(User $user): array
     {
         $process = self::processStateInfo(
             $user,
             [
                 'user-new' => true,
                 'user-ldap-ready' => $user->isLdapReady(),
                 'user-imap-ready' => $user->isImapReady(),
             ]
         );
 
         // Check if the user is a controller of his wallet
         $isController = $user->canDelete($user);
         $hasCustomDomain = $user->wallet()->entitlements()
             ->where('entitleable_type', Domain::class)
             ->count() > 0;
 
         // Get user's entitlements titles
         $skus = $user->entitlements()->select('skus.title')
             ->join('skus', 'skus.id', '=', 'entitlements.sku_id')
             ->get()
             ->pluck('title')
             ->sort()
             ->unique()
             ->values()
             ->all();
 
         $result = [
             'skus' => $skus,
             // TODO: This will change when we enable all users to create domains
             'enableDomains' => $isController && $hasCustomDomain,
             // TODO: Make 'enableDistlists' working for wallet controllers that aren't account owners
             'enableDistlists' => $isController && $hasCustomDomain && in_array('distlist', $skus),
             // TODO: Make 'enableFolders' working for wallet controllers that aren't account owners
             'enableFolders' => $isController && $hasCustomDomain && in_array('beta-shared-folders', $skus),
             // TODO: Make 'enableResources' working for wallet controllers that aren't account owners
             'enableResources' => $isController && $hasCustomDomain && in_array('beta-resources', $skus),
             'enableUsers' => $isController,
             'enableWallets' => $isController,
         ];
 
         return array_merge($process, $result);
     }
 
     /**
      * Create a new user record.
      *
      * @param \Illuminate\Http\Request $request The API request.
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function store(Request $request)
     {
         $current_user = $this->guard()->user();
         $owner = $current_user->wallet()->owner;
 
         if ($owner->id != $current_user->id) {
             return $this->errorResponse(403);
         }
 
         $this->deleteBeforeCreate = null;
 
         if ($error_response = $this->validateUserRequest($request, null, $settings)) {
             return $error_response;
         }
 
         if (empty($request->package) || !($package = \App\Package::withEnvTenantContext()->find($request->package))) {
             $errors = ['package' => \trans('validation.packagerequired')];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         if ($package->isDomain()) {
             $errors = ['package' => \trans('validation.packageinvalid')];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         DB::beginTransaction();
 
         // @phpstan-ignore-next-line
         if ($this->deleteBeforeCreate) {
             $this->deleteBeforeCreate->forceDelete();
         }
 
         // Create user record
         $user = User::create([
                 'email' => $request->email,
                 'password' => $request->password,
         ]);
 
         $owner->assignPackage($package, $user);
 
         if (!empty($settings)) {
             $user->setSettings($settings);
         }
 
         if (!empty($request->aliases)) {
             $user->setAliases($request->aliases);
         }
 
         DB::commit();
 
         return response()->json([
                 'status' => 'success',
                 'message' => \trans('app.user-create-success'),
         ]);
     }
 
     /**
      * Update user data.
      *
      * @param \Illuminate\Http\Request $request The API request.
      * @param string                   $id      User identifier
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function update(Request $request, $id)
     {
         $user = User::withEnvTenantContext()->find($id);
 
         if (empty($user)) {
             return $this->errorResponse(404);
         }
 
         $current_user = $this->guard()->user();
 
         // TODO: Decide what attributes a user can change on his own profile
         if (!$current_user->canUpdate($user)) {
             return $this->errorResponse(403);
         }
 
         if ($error_response = $this->validateUserRequest($request, $user, $settings)) {
             return $error_response;
         }
 
         // Entitlements, only controller can do that
         if ($request->skus !== null && !$current_user->canDelete($user)) {
             return $this->errorResponse(422, "You have no permission to change entitlements");
         }
 
         DB::beginTransaction();
 
         $this->updateEntitlements($user, $request->skus);
 
         if (!empty($settings)) {
             $user->setSettings($settings);
         }
 
         if (!empty($request->password)) {
             $user->password = $request->password;
             $user->save();
         }
 
         if (isset($request->aliases)) {
             $user->setAliases($request->aliases);
         }
 
         // TODO: Make sure that UserUpdate job is created in case of entitlements update
         //       and no password change. So, for example quota change is applied to LDAP
         // TODO: Review use of $user->save() in the above context
 
         DB::commit();
 
         $response = [
             'status' => 'success',
             'message' => \trans('app.user-update-success'),
         ];
 
         // For self-update refresh the statusInfo in the UI
         if ($user->id == $current_user->id) {
             $response['statusInfo'] = self::statusInfo($user);
         }
 
         return response()->json($response);
     }
 
     /**
      * Update user entitlements.
      *
      * @param \App\User $user  The user
      * @param array     $rSkus List of SKU IDs requested for the user in the form [id=>qty]
      */
     protected function updateEntitlements(User $user, $rSkus)
     {
         if (!is_array($rSkus)) {
             return;
         }
 
         // list of skus, [id=>obj]
         $skus = Sku::withEnvTenantContext()->get()->mapWithKeys(
             function ($sku) {
                 return [$sku->id => $sku];
             }
         );
 
         // existing entitlement's SKUs
         $eSkus = [];
 
         $user->entitlements()->groupBy('sku_id')
             ->selectRaw('count(*) as total, sku_id')->each(
                 function ($e) use (&$eSkus) {
                     $eSkus[$e->sku_id] = $e->total;
                 }
             );
 
         foreach ($skus as $skuID => $sku) {
             $e = array_key_exists($skuID, $eSkus) ? $eSkus[$skuID] : 0;
             $r = array_key_exists($skuID, $rSkus) ? $rSkus[$skuID] : 0;
 
             if ($sku->handler_class == \App\Handlers\Mailbox::class) {
                 if ($r != 1) {
                     throw new \Exception("Invalid quantity of mailboxes");
                 }
             }
 
             if ($e > $r) {
                 // remove those entitled more than existing
                 $user->removeSku($sku, ($e - $r));
             } elseif ($e < $r) {
                 // add those requested more than entitled
                 $user->assignSku($sku, ($r - $e));
             }
         }
     }
 
     /**
      * Create a response data array for specified user.
      *
      * @param \App\User $user User object
      *
      * @return array Response data
      */
     public static function userResponse(User $user): array
     {
         $response = self::objectToClient($user, true);
 
         // Settings
         $response['settings'] = [];
         foreach ($user->settings()->whereIn('key', self::USER_SETTINGS)->get() as $item) {
             $response['settings'][$item->key] = $item->value;
         }
 
         // Aliases
         $response['aliases'] = [];
         foreach ($user->aliases as $item) {
             $response['aliases'][] = $item->alias;
         }
 
         // Status info
         $response['statusInfo'] = self::statusInfo($user);
 
         // Add more info to the wallet object output
         $map_func = function ($wallet) use ($user) {
             $result = $wallet->toArray();
 
             if ($wallet->discount) {
                 $result['discount'] = $wallet->discount->discount;
                 $result['discount_description'] = $wallet->discount->description;
             }
 
             if ($wallet->user_id != $user->id) {
                 $result['user_email'] = $wallet->owner->email;
             }
 
             $provider = \App\Providers\PaymentProvider::factory($wallet);
             $result['provider'] = $provider->name();
 
             return $result;
         };
 
         // Information about wallets and accounts for access checks
         $response['wallets'] = $user->wallets->map($map_func)->toArray();
         $response['accounts'] = $user->accounts->map($map_func)->toArray();
         $response['wallet'] = $map_func($user->wallet());
 
         return $response;
     }
 
     /**
      * Prepare user statuses for the UI
      *
      * @param \App\User $user User object
      *
      * @return array Statuses array
      */
     protected static function objectState(User $user): array
     {
         return [
             'isImapReady' => $user->isImapReady(),
             'isLdapReady' => $user->isLdapReady(),
             'isSuspended' => $user->isSuspended(),
             'isActive' => $user->isActive(),
             'isDeleted' => $user->isDeleted() || $user->trashed(),
         ];
     }
 
     /**
      * Validate user input
      *
      * @param \Illuminate\Http\Request $request  The API request.
      * @param \App\User|null           $user     User identifier
      * @param array                    $settings User settings (from the request)
      *
      * @return \Illuminate\Http\JsonResponse|null The error response on error
      */
     protected function validateUserRequest(Request $request, $user, &$settings = [])
     {
         $rules = [
             'external_email' => 'nullable|email',
             'phone' => 'string|nullable|max:64|regex:/^[0-9+() -]+$/',
             'first_name' => 'string|nullable|max:128',
             'last_name' => 'string|nullable|max:128',
             'organization' => 'string|nullable|max:512',
             'billing_address' => 'string|nullable|max:1024',
             'country' => 'string|nullable|alpha|size:2',
             'currency' => 'string|nullable|alpha|size:3',
             'aliases' => 'array|nullable',
         ];
 
         if (empty($user) || !empty($request->password) || !empty($request->password_confirmation)) {
             $rules['password'] = 'required|min:4|max:2048|confirmed';
         }
 
         $errors = [];
 
         // Validate input
         $v = Validator::make($request->all(), $rules);
 
         if ($v->fails()) {
             $errors = $v->errors()->toArray();
         }
 
         $controller = $user ? $user->wallet()->owner : $this->guard()->user();
 
         // For new user validate email address
         if (empty($user)) {
             $email = $request->email;
 
             if (empty($email)) {
                 $errors['email'] = \trans('validation.required', ['attribute' => 'email']);
             } elseif ($error = self::validateEmail($email, $controller, $this->deleteBeforeCreate)) {
                 $errors['email'] = $error;
             }
         }
 
         // Validate aliases input
         if (isset($request->aliases)) {
             $aliases = [];
             $existing_aliases = $user ? $user->aliases()->get()->pluck('alias')->toArray() : [];
 
             foreach ($request->aliases as $idx => $alias) {
                 if (is_string($alias) && !empty($alias)) {
                     // Alias cannot be the same as the email address (new user)
                     if (!empty($email) && Str::lower($alias) == Str::lower($email)) {
                         continue;
                     }
 
                     // validate new aliases
                     if (
                         !in_array($alias, $existing_aliases)
                         && ($error = self::validateAlias($alias, $controller))
                     ) {
                         if (!isset($errors['aliases'])) {
                             $errors['aliases'] = [];
                         }
                         $errors['aliases'][$idx] = $error;
                         continue;
                     }
 
                     $aliases[] = $alias;
                 }
             }
 
             $request->aliases = $aliases;
         }
 
         if (!empty($errors)) {
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         // Update user settings
         $settings = $request->only(array_keys($rules));
         unset($settings['password'], $settings['aliases'], $settings['email']);
 
         return null;
     }
 
     /**
      * Execute (synchronously) specified step in a user setup process.
      *
      * @param \App\User $user User object
      * @param string    $step Step identifier (as in self::statusInfo())
      *
      * @return bool|null True if the execution succeeded, False if not, Null when
      *                   the job has been sent to the worker (result unknown)
      */
     public static function execProcessStep(User $user, string $step): ?bool
     {
         try {
             if (strpos($step, 'domain-') === 0) {
                 list ($local, $domain) = explode('@', $user->email);
                 $domain = Domain::where('namespace', $domain)->first();
 
                 return DomainsController::execProcessStep($domain, $step);
             }
 
             switch ($step) {
                 case 'user-ldap-ready':
                     // User not in LDAP, create it
                     $job = new \App\Jobs\User\CreateJob($user->id);
                     $job->handle();
 
                     $user->refresh();
 
                     return $user->isLdapReady();
 
                 case 'user-imap-ready':
                     // User not in IMAP? Verify again
                     // Do it synchronously if the imap admin credentials are available
                     // otherwise let the worker do the job
                     if (!\config('imap.admin_password')) {
                         \App\Jobs\User\VerifyJob::dispatch($user->id);
 
                         return null;
                     }
 
                     $job = new \App\Jobs\User\VerifyJob($user->id);
                     $job->handle();
 
                     $user->refresh();
 
                     return $user->isImapReady();
             }
         } catch (\Exception $e) {
             \Log::error($e);
         }
 
         return false;
     }
 
     /**
      * Email address validation for use as a user mailbox (login).
      *
      * @param string                    $email   Email address
      * @param \App\User                 $user    The account owner
      * @param null|\App\User|\App\Group $deleted Filled with an instance of a deleted user or group
      *                                           with the specified email address, if exists
      *
      * @return ?string Error message on validation error
      */
     public static function validateEmail(string $email, \App\User $user, &$deleted = null): ?string
     {
         $deleted = null;
 
         if (strpos($email, '@') === false) {
             return \trans('validation.entryinvalid', ['attribute' => 'email']);
         }
 
         list($login, $domain) = explode('@', Str::lower($email));
 
         if (strlen($login) === 0 || strlen($domain) === 0) {
             return \trans('validation.entryinvalid', ['attribute' => 'email']);
         }
 
         // Check if domain exists
-        $domain = Domain::withEnvTenantContext()->where('namespace', $domain)->first();
+        $domain = Domain::withObjectTenantContext($user)->where('namespace', $domain)->first();
 
         if (empty($domain)) {
             return \trans('validation.domaininvalid');
         }
 
         // Validate login part alone
         $v = Validator::make(
             ['email' => $login],
             ['email' => ['required', new UserEmailLocal(!$domain->isPublic())]]
         );
 
         if ($v->fails()) {
             return $v->errors()->toArray()['email'][0];
         }
 
         // Check if it is one of domains available to the user
-        $domains = \collect($user->domains())->pluck('namespace')->all();
-
-        if (!in_array($domain->namespace, $domains)) {
+        if (!$user->domains()->where('namespace', $domain->namespace)->exists()) {
             return \trans('validation.entryexists', ['attribute' => 'domain']);
         }
 
         // Check if a user with specified address already exists
         if ($existing_user = User::emailExists($email, true)) {
             // If this is a deleted user in the same custom domain
             // we'll force delete him before
             if (!$domain->isPublic() && $existing_user->trashed()) {
                 $deleted = $existing_user;
             } else {
                 return \trans('validation.entryexists', ['attribute' => 'email']);
             }
         }
 
         // Check if an alias with specified address already exists.
         if (User::aliasExists($email)) {
             return \trans('validation.entryexists', ['attribute' => 'email']);
         }
 
         // Check if a group or resource with specified address already exists
         if (
             ($existing = Group::emailExists($email, true))
             || ($existing = \App\Resource::emailExists($email, true))
         ) {
             // If this is a deleted group/resource in the same custom domain
             // we'll force delete it before
             if (!$domain->isPublic() && $existing->trashed()) {
                 $deleted = $existing;
             } else {
                 return \trans('validation.entryexists', ['attribute' => 'email']);
             }
         }
 
         return null;
     }
 
     /**
      * Email address validation for use as an alias.
      *
      * @param string    $email Email address
      * @param \App\User $user  The account owner
      *
      * @return ?string Error message on validation error
      */
     public static function validateAlias(string $email, \App\User $user): ?string
     {
         if (strpos($email, '@') === false) {
             return \trans('validation.entryinvalid', ['attribute' => 'alias']);
         }
 
         list($login, $domain) = explode('@', Str::lower($email));
 
         if (strlen($login) === 0 || strlen($domain) === 0) {
             return \trans('validation.entryinvalid', ['attribute' => 'alias']);
         }
 
         // Check if domain exists
-        $domain = Domain::withEnvTenantContext()->where('namespace', $domain)->first();
+        $domain = Domain::withObjectTenantContext($user)->where('namespace', $domain)->first();
 
         if (empty($domain)) {
             return \trans('validation.domaininvalid');
         }
 
         // Validate login part alone
         $v = Validator::make(
             ['alias' => $login],
             ['alias' => ['required', new UserEmailLocal(!$domain->isPublic())]]
         );
 
         if ($v->fails()) {
             return $v->errors()->toArray()['alias'][0];
         }
 
         // Check if it is one of domains available to the user
-        $domains = \collect($user->domains())->pluck('namespace')->all();
-
-        if (!in_array($domain->namespace, $domains)) {
+        if (!$user->domains()->where('namespace', $domain->namespace)->exists()) {
             return \trans('validation.entryexists', ['attribute' => 'domain']);
         }
 
         // Check if a user with specified address already exists
         if ($existing_user = User::emailExists($email, true)) {
             // Allow an alias in a custom domain to an address that was a user before
             if ($domain->isPublic() || !$existing_user->trashed()) {
                 return \trans('validation.entryexists', ['attribute' => 'alias']);
             }
         }
 
         // Check if an alias with specified address already exists
         if (User::aliasExists($email)) {
             // Allow assigning the same alias to a user in the same group account,
             // but only for non-public domains
             if ($domain->isPublic()) {
                 return \trans('validation.entryexists', ['attribute' => 'alias']);
             }
         }
 
         // Check if a group with specified address already exists
         if (Group::emailExists($email)) {
             return \trans('validation.entryexists', ['attribute' => 'alias']);
         }
 
         return null;
     }
 }
diff --git a/src/app/Rules/GroupName.php b/src/app/Rules/GroupName.php
index ba4aec3a..45fee4d2 100644
--- a/src/app/Rules/GroupName.php
+++ b/src/app/Rules/GroupName.php
@@ -1,72 +1,72 @@
 <?php
 
 namespace App\Rules;
 
 use Illuminate\Contracts\Validation\Rule;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Support\Str;
 
 class GroupName implements Rule
 {
     private $message;
     private $owner;
     private $domain;
 
     /**
      * Class constructor.
      *
      * @param \App\User $owner  The account owner
      * @param string    $domain The domain name of the group
      */
     public function __construct($owner, $domain)
     {
         $this->owner = $owner;
         $this->domain = Str::lower($domain);
     }
 
     /**
      * Determine if the validation rule passes.
      *
      * @param string $attribute Attribute name
      * @param mixed  $name      The value to validate
      *
      * @return bool
      */
     public function passes($attribute, $name): bool
     {
         if (empty($name) || !is_string($name)) {
             $this->message = \trans('validation.nameinvalid');
             return false;
         }
 
         // Check the max length, according to the database column length
         if (strlen($name) > 191) {
             $this->message = \trans('validation.max.string', ['max' => 191]);
             return false;
         }
 
         // Check if the name is unique in the domain
         // FIXME: Maybe just using the whole groups table would be faster than groups()?
         $exists = $this->owner->groups()
-            ->where('groups.name', $name)
-            ->where('groups.email', 'like', '%@' . $this->domain)
+            ->where('name', $name)
+            ->where('email', 'like', '%@' . $this->domain)
             ->exists();
 
         if ($exists) {
             $this->message = \trans('validation.nameexists');
             return false;
         }
 
         return true;
     }
 
     /**
      * Get the validation error message.
      *
      * @return string
      */
     public function message(): ?string
     {
         return $this->message;
     }
 }
diff --git a/src/app/Rules/ResourceName.php b/src/app/Rules/ResourceName.php
index fb88b3bd..801e6856 100644
--- a/src/app/Rules/ResourceName.php
+++ b/src/app/Rules/ResourceName.php
@@ -1,86 +1,85 @@
 <?php
 
 namespace App\Rules;
 
 use Illuminate\Contracts\Validation\Rule;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Support\Str;
 
 class ResourceName implements Rule
 {
     private $message;
     private $owner;
     private $domain;
 
     private const FORBIDDEN_CHARS = '+/^%*!`@(){}|\\?<;"';
 
     /**
      * Class constructor.
      *
      * @param \App\User $owner  The account owner
      * @param string    $domain The domain name of the group
      */
     public function __construct($owner, $domain)
     {
         $this->owner = $owner;
         $this->domain = Str::lower($domain);
     }
 
     /**
      * Determine if the validation rule passes.
      *
      * @param string $attribute Attribute name
      * @param mixed  $name      Resource name input
      *
      * @return bool
      */
     public function passes($attribute, $name): bool
     {
         if (empty($name) || !is_string($name)) {
             $this->message = \trans('validation.nameinvalid');
             return false;
         }
 
         if (strcspn($name, self::FORBIDDEN_CHARS) < strlen($name)) {
             $this->message = \trans('validation.nameinvalid');
             return false;
         }
 
         // Check the max length, according to the database column length
         if (strlen($name) > 191) {
             $this->message = \trans('validation.max.string', ['max' => 191]);
             return false;
         }
 
         // Check if specified domain belongs to the user
-        $domains = \collect($this->owner->domains(true, false))->pluck('namespace')->all();
-        if (!in_array($this->domain, $domains)) {
+        if (!$this->owner->domains(true, false)->where('namespace', $this->domain)->exists()) {
             $this->message = \trans('validation.domaininvalid');
             return false;
         }
 
         // Check if the name is unique in the domain
         // FIXME: Maybe just using the whole resources table would be faster than resources()?
         $exists = $this->owner->resources()
-            ->where('resources.name', $name)
-            ->where('resources.email', 'like', '%@' . $this->domain)
+            ->where('name', $name)
+            ->where('email', 'like', '%@' . $this->domain)
             ->exists();
 
         if ($exists) {
             $this->message = \trans('validation.nameexists');
             return false;
         }
 
         return true;
     }
 
     /**
      * Get the validation error message.
      *
      * @return string
      */
     public function message(): ?string
     {
         return $this->message;
     }
 }
diff --git a/src/app/Rules/SharedFolderName.php b/src/app/Rules/SharedFolderName.php
index 1dff6aeb..f67b2403 100644
--- a/src/app/Rules/SharedFolderName.php
+++ b/src/app/Rules/SharedFolderName.php
@@ -1,86 +1,85 @@
 <?php
 
 namespace App\Rules;
 
 use Illuminate\Contracts\Validation\Rule;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Support\Str;
 
 class SharedFolderName implements Rule
 {
     private $message;
     private $owner;
     private $domain;
 
     private const FORBIDDEN_CHARS = '+/^%*!`@(){}|\\?<;"';
 
     /**
      * Class constructor.
      *
      * @param \App\User $owner  The account owner
      * @param string    $domain The domain name of the group
      */
     public function __construct($owner, $domain)
     {
         $this->owner = $owner;
         $this->domain = Str::lower($domain);
     }
 
     /**
      * Determine if the validation rule passes.
      *
      * @param string $attribute Attribute name
      * @param mixed  $name      Shared folder name input
      *
      * @return bool
      */
     public function passes($attribute, $name): bool
     {
         if (empty($name) || !is_string($name) || $name == 'Resources') {
             $this->message = \trans('validation.nameinvalid');
             return false;
         }
 
         if (strcspn($name, self::FORBIDDEN_CHARS) < strlen($name)) {
             $this->message = \trans('validation.nameinvalid');
             return false;
         }
 
         // Check the max length, according to the database column length
         if (strlen($name) > 191) {
             $this->message = \trans('validation.max.string', ['max' => 191]);
             return false;
         }
 
         // Check if specified domain belongs to the user
-        $domains = \collect($this->owner->domains(true, false))->pluck('namespace')->all();
-        if (!in_array($this->domain, $domains)) {
+        if (!$this->owner->domains(true, false)->where('namespace', $this->domain)->exists()) {
             $this->message = \trans('validation.domaininvalid');
             return false;
         }
 
         // Check if the name is unique in the domain
         // FIXME: Maybe just using the whole shared_folders table would be faster than sharedFolders()?
         $exists = $this->owner->sharedFolders()
-            ->where('shared_folders.name', $name)
-            ->where('shared_folders.email', 'like', '%@' . $this->domain)
+            ->where('name', $name)
+            ->where('email', 'like', '%@' . $this->domain)
             ->exists();
 
         if ($exists) {
             $this->message = \trans('validation.nameexists');
             return false;
         }
 
         return true;
     }
 
     /**
      * Get the validation error message.
      *
      * @return string
      */
     public function message(): ?string
     {
         return $this->message;
     }
 }
diff --git a/src/app/User.php b/src/app/User.php
index 6b086486..c3546cc5 100644
--- a/src/app/User.php
+++ b/src/app/User.php
@@ -1,809 +1,782 @@
 <?php
 
 namespace App;
 
-use App\Entitlement;
 use App\UserAlias;
-use App\Sku;
 use App\Traits\BelongsToTenantTrait;
 use App\Traits\EntitleableTrait;
 use App\Traits\UserAliasesTrait;
 use App\Traits\UserConfigTrait;
 use App\Traits\UuidIntKeyTrait;
 use App\Traits\SettingsTrait;
 use App\Wallet;
 use Illuminate\Database\Eloquent\SoftDeletes;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Iatstuti\Database\Support\NullableFields;
 use Laravel\Passport\HasApiTokens;
 use League\OAuth2\Server\Exception\OAuthServerException;
 
 /**
  * The eloquent definition of a User.
  *
  * @property string $email
  * @property int    $id
  * @property string $password
  * @property int    $status
  * @property int    $tenant_id
  */
 class User extends Authenticatable
 {
     use BelongsToTenantTrait;
     use EntitleableTrait;
     use HasApiTokens;
     use NullableFields;
     use UserConfigTrait;
     use UserAliasesTrait;
     use UuidIntKeyTrait;
     use SettingsTrait;
     use SoftDeletes;
 
     // a new user, default on creation
     public const STATUS_NEW        = 1 << 0;
     // it's been activated
     public const STATUS_ACTIVE     = 1 << 1;
     // user has been suspended
     public const STATUS_SUSPENDED  = 1 << 2;
     // user has been deleted
     public const STATUS_DELETED    = 1 << 3;
     // user has been created in LDAP
     public const STATUS_LDAP_READY = 1 << 4;
     // user mailbox has been created in IMAP
     public const STATUS_IMAP_READY = 1 << 5;
 
     /**
      * The attributes that are mass assignable.
      *
      * @var array
      */
     protected $fillable = [
         'id',
         'email',
         'password',
         'password_ldap',
         'status',
     ];
 
     /**
      * The attributes that should be hidden for arrays.
      *
      * @var array
      */
     protected $hidden = [
         'password',
         'password_ldap',
         'role'
     ];
 
     protected $nullable = [
         'password',
         'password_ldap'
     ];
 
     /**
      * Any wallets on which this user is a controller.
      *
      * This does not include wallets owned by the user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
      */
     public function accounts()
     {
         return $this->belongsToMany(
             'App\Wallet',       // The foreign object definition
             'user_accounts',    // The table name
             'user_id',          // The local foreign key
             'wallet_id'         // The remote foreign key
         );
     }
 
     /**
      * Email aliases of this user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function aliases()
     {
         return $this->hasMany('App\UserAlias', 'user_id');
     }
 
     /**
      * Assign a package to a user. The user should not have any existing entitlements.
      *
      * @param \App\Package   $package The package to assign.
      * @param \App\User|null $user    Assign the package to another user.
      *
      * @return \App\User
      */
     public function assignPackage($package, $user = null)
     {
         if (!$user) {
             $user = $this;
         }
 
         return $user->assignPackageAndWallet($package, $this->wallets()->first());
     }
 
     /**
      * Assign a package plan to a user.
      *
      * @param \App\Plan   $plan   The plan to assign
      * @param \App\Domain $domain Optional domain object
      *
      * @return \App\User Self
      */
     public function assignPlan($plan, $domain = null): User
     {
         $this->setSetting('plan_id', $plan->id);
 
         foreach ($plan->packages as $package) {
             if ($package->isDomain()) {
                 $domain->assignPackage($package, $this);
             } else {
                 $this->assignPackage($package);
             }
         }
 
         return $this;
     }
 
     /**
      * Check if current user can delete another object.
      *
      * @param mixed $object A user|domain|wallet|group object
      *
      * @return bool True if he can, False otherwise
      */
     public function canDelete($object): bool
     {
         if (!method_exists($object, 'wallet')) {
             return false;
         }
 
         $wallet = $object->wallet();
 
         // TODO: For now controller can delete/update the account owner,
         //       this may change in future, controllers are not 0-regression feature
 
         return $wallet && ($wallet->user_id == $this->id || $this->accounts->contains($wallet));
     }
 
     /**
      * Check if current user can read data of another object.
      *
      * @param mixed $object A user|domain|wallet|group object
      *
      * @return bool True if he can, False otherwise
      */
     public function canRead($object): bool
     {
         if ($this->role == 'admin') {
             return true;
         }
 
         if ($object instanceof User && $this->id == $object->id) {
             return true;
         }
 
         if ($this->role == 'reseller') {
             if ($object instanceof User && $object->role == 'admin') {
                 return false;
             }
 
             if ($object instanceof Wallet && !empty($object->owner)) {
                 $object = $object->owner;
             }
 
             return isset($object->tenant_id) && $object->tenant_id == $this->tenant_id;
         }
 
         if ($object instanceof Wallet) {
             return $object->user_id == $this->id || $object->controllers->contains($this);
         }
 
         if (!method_exists($object, 'wallet')) {
             return false;
         }
 
         $wallet = $object->wallet();
 
         return $wallet && ($wallet->user_id == $this->id || $this->accounts->contains($wallet));
     }
 
     /**
      * Check if current user can update data of another object.
      *
      * @param mixed $object A user|domain|wallet|group object
      *
      * @return bool True if he can, False otherwise
      */
     public function canUpdate($object): bool
     {
         if ($object instanceof User && $this->id == $object->id) {
             return true;
         }
 
         if ($this->role == 'admin') {
             return true;
         }
 
         if ($this->role == 'reseller') {
             if ($object instanceof User && $object->role == 'admin') {
                 return false;
             }
 
             if ($object instanceof Wallet && !empty($object->owner)) {
                 $object = $object->owner;
             }
 
             return isset($object->tenant_id) && $object->tenant_id == $this->tenant_id;
         }
 
         return $this->canDelete($object);
     }
 
     /**
      * Return the \App\Domain for this user.
      *
      * @return \App\Domain|null
      */
     public function domain()
     {
         list($local, $domainName) = explode('@', $this->email);
 
         $domain = \App\Domain::withTrashed()->where('namespace', $domainName)->first();
 
         return $domain;
     }
 
     /**
      * List the domains to which this user is entitled.
      *
      * @param bool $with_accounts Include domains assigned to wallets
      *                            the current user controls but not owns.
      * @param bool $with_public   Include active public domains (for the user tenant).
      *
-     * @return Domain[] List of Domain objects
+     * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
-    public function domains($with_accounts = true, $with_public = true): array
+    public function domains($with_accounts = true, $with_public = true)
     {
-        $domains = [];
+        $domains = $this->entitleables(Domain::class, $with_accounts);
 
         if ($with_public) {
-            if ($this->tenant_id) {
-                $domains = Domain::where('tenant_id', $this->tenant_id);
-            } else {
-                $domains = Domain::withEnvTenantContext();
-            }
-
-            $domains = $domains->whereRaw(sprintf('(type & %s)', Domain::TYPE_PUBLIC))
-                ->whereRaw(sprintf('(status & %s)', Domain::STATUS_ACTIVE))
-                ->get()
-                ->all();
-        }
-
-        foreach ($this->wallets as $wallet) {
-            $entitlements = $wallet->entitlements()->where('entitleable_type', Domain::class)->get();
-            foreach ($entitlements as $entitlement) {
-                $domains[] = $entitlement->entitleable;
-            }
-        }
-
-        if ($with_accounts) {
-            foreach ($this->accounts as $wallet) {
-                $entitlements = $wallet->entitlements()->where('entitleable_type', Domain::class)->get();
-                foreach ($entitlements as $entitlement) {
-                    $domains[] = $entitlement->entitleable;
+            $domains->orWhere(function ($query) {
+                if (!$this->tenant_id) {
+                    $query->where('tenant_id', $this->tenant_id);
+                } else {
+                    $query->withEnvTenantContext();
                 }
-            }
+
+                $query->whereRaw(sprintf('(domains.type & %s)', Domain::TYPE_PUBLIC))
+                    ->whereRaw(sprintf('(domains.status & %s)', Domain::STATUS_ACTIVE));
+            });
         }
 
         return $domains;
     }
 
     /**
      * Find whether an email address exists as a user (including deleted users).
      *
      * @param string $email       Email address
      * @param bool   $return_user Return User instance instead of boolean
      *
      * @return \App\User|bool True or User model object if found, False otherwise
      */
     public static function emailExists(string $email, bool $return_user = false)
     {
         if (strpos($email, '@') === false) {
             return false;
         }
 
         $email = \strtolower($email);
 
         $user = self::withTrashed()->where('email', $email)->first();
 
         if ($user) {
             return $return_user ? $user : true;
         }
 
         return false;
     }
 
+    /**
+     * Return entitleable objects of a specified type controlled by the current user.
+     *
+     * @param string $class         Object class
+     * @param bool   $with_accounts Include objects assigned to wallets
+     *                              the current user controls, but not owns.
+     *
+     * @return \Illuminate\Database\Eloquent\Builder Query builder
+     */
+    private function entitleables(string $class, bool $with_accounts = true)
+    {
+        $wallets = $this->wallets()->pluck('id')->all();
+
+        if ($with_accounts) {
+            $wallets = array_merge($wallets, $this->accounts()->pluck('wallet_id')->all());
+        }
+
+        $object = new $class();
+        $table = $object->getTable();
+
+        return $object->select("{$table}.*")
+            ->whereExists(function ($query) use ($table, $wallets, $class) {
+                $query->select(DB::raw(1))
+                    ->from('entitlements')
+                    ->whereColumn('entitleable_id', "{$table}.id")
+                    ->whereIn('entitlements.wallet_id', $wallets)
+                    ->where('entitlements.entitleable_type', $class);
+            });
+    }
+
     /**
      * Helper to find user by email address, whether it is
      * main email address, alias or an external email.
      *
      * If there's more than one alias NULL will be returned.
      *
      * @param string $email    Email address
      * @param bool   $external Search also for an external email
      *
      * @return \App\User|null User model object if found
      */
     public static function findByEmail(string $email, bool $external = false): ?User
     {
         if (strpos($email, '@') === false) {
             return null;
         }
 
         $email = \strtolower($email);
 
         $user = self::where('email', $email)->first();
 
         if ($user) {
             return $user;
         }
 
         $aliases = UserAlias::where('alias', $email)->get();
 
         if (count($aliases) == 1) {
             return $aliases->first()->user;
         }
 
         // TODO: External email
 
         return null;
     }
 
     /**
      * Return groups controlled by the current user.
      *
      * @param bool $with_accounts Include groups assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function groups($with_accounts = true)
     {
-        $wallets = $this->wallets()->pluck('id')->all();
-
-        if ($with_accounts) {
-            $wallets = array_merge($wallets, $this->accounts()->pluck('wallet_id')->all());
-        }
-
-        return Group::select(['groups.*', 'entitlements.wallet_id'])
-            ->distinct()
-            ->join('entitlements', 'entitlements.entitleable_id', '=', 'groups.id')
-            ->whereIn('entitlements.wallet_id', $wallets)
-            ->where('entitlements.entitleable_type', Group::class);
+        return $this->entitleables(Group::class, $with_accounts);
     }
 
     /**
      * Returns whether this domain is active.
      *
      * @return bool
      */
     public function isActive(): bool
     {
         return ($this->status & self::STATUS_ACTIVE) > 0;
     }
 
     /**
      * Returns whether this domain is deleted.
      *
      * @return bool
      */
     public function isDeleted(): bool
     {
         return ($this->status & self::STATUS_DELETED) > 0;
     }
 
     /**
      * Returns whether this (external) domain has been verified
      * to exist in DNS.
      *
      * @return bool
      */
     public function isImapReady(): bool
     {
         return ($this->status & self::STATUS_IMAP_READY) > 0;
     }
 
     /**
      * Returns whether this user is registered in LDAP.
      *
      * @return bool
      */
     public function isLdapReady(): bool
     {
         return ($this->status & self::STATUS_LDAP_READY) > 0;
     }
 
     /**
      * Returns whether this user is new.
      *
      * @return bool
      */
     public function isNew(): bool
     {
         return ($this->status & self::STATUS_NEW) > 0;
     }
 
     /**
      * Returns whether this domain is suspended.
      *
      * @return bool
      */
     public function isSuspended(): bool
     {
         return ($this->status & self::STATUS_SUSPENDED) > 0;
     }
 
     /**
      * A shortcut to get the user name.
      *
      * @param bool $fallback Return "<aa.name> User" if there's no name
      *
      * @return string Full user name
      */
     public function name(bool $fallback = false): string
     {
         $settings = $this->getSettings(['first_name', 'last_name']);
 
         $name = trim($settings['first_name'] . ' ' . $settings['last_name']);
 
         if (empty($name) && $fallback) {
             return trim(\trans('app.siteuser', ['site' => \App\Tenant::getConfig($this->tenant_id, 'app.name')]));
         }
 
         return $name;
     }
 
     /**
      * Return resources controlled by the current user.
      *
      * @param bool $with_accounts Include resources assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function resources($with_accounts = true)
     {
-        $wallets = $this->wallets()->pluck('id')->all();
-
-        if ($with_accounts) {
-            $wallets = array_merge($wallets, $this->accounts()->pluck('wallet_id')->all());
-        }
-
-        return \App\Resource::select(['resources.*', 'entitlements.wallet_id'])
-            ->distinct()
-            ->join('entitlements', 'entitlements.entitleable_id', '=', 'resources.id')
-            ->whereIn('entitlements.wallet_id', $wallets)
-            ->where('entitlements.entitleable_type', \App\Resource::class);
+        return $this->entitleables(\App\Resource::class, $with_accounts);
     }
 
     /**
      * Return shared folders controlled by the current user.
      *
      * @param bool $with_accounts Include folders assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function sharedFolders($with_accounts = true)
     {
-        $wallets = $this->wallets()->pluck('id')->all();
-
-        if ($with_accounts) {
-            $wallets = array_merge($wallets, $this->accounts()->pluck('wallet_id')->all());
-        }
-
-        return \App\SharedFolder::select(['shared_folders.*', 'entitlements.wallet_id'])
-            ->distinct()
-            ->join('entitlements', 'entitlements.entitleable_id', '=', 'shared_folders.id')
-            ->whereIn('entitlements.wallet_id', $wallets)
-            ->where('entitlements.entitleable_type', \App\SharedFolder::class);
+        return $this->entitleables(\App\SharedFolder::class, $with_accounts);
     }
 
     public function senderPolicyFrameworkWhitelist($clientName)
     {
         $setting = $this->getSetting('spf_whitelist');
 
         if (!$setting) {
             return false;
         }
 
         $whitelist = json_decode($setting);
 
         $matchFound = false;
 
         foreach ($whitelist as $entry) {
             if (substr($entry, 0, 1) == '/') {
                 $match = preg_match($entry, $clientName);
 
                 if ($match) {
                     $matchFound = true;
                 }
 
                 continue;
             }
 
             if (substr($entry, 0, 1) == '.') {
                 if (substr($clientName, (-1 * strlen($entry))) == $entry) {
                     $matchFound = true;
                 }
 
                 continue;
             }
 
             if ($entry == $clientName) {
                 $matchFound = true;
                 continue;
             }
         }
 
         return $matchFound;
     }
 
     /**
      * Suspend this domain.
      *
      * @return void
      */
     public function suspend(): void
     {
         if ($this->isSuspended()) {
             return;
         }
 
         $this->status |= User::STATUS_SUSPENDED;
         $this->save();
     }
 
     /**
      * Unsuspend this domain.
      *
      * @return void
      */
     public function unsuspend(): void
     {
         if (!$this->isSuspended()) {
             return;
         }
 
         $this->status ^= User::STATUS_SUSPENDED;
         $this->save();
     }
 
     /**
      * Return users controlled by the current user.
      *
      * @param bool $with_accounts Include users assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function users($with_accounts = true)
     {
-        $wallets = $this->wallets()->pluck('id')->all();
-
-        if ($with_accounts) {
-            $wallets = array_merge($wallets, $this->accounts()->pluck('wallet_id')->all());
-        }
-
-        return $this->select(['users.*', 'entitlements.wallet_id'])
-            ->distinct()
-            ->leftJoin('entitlements', 'entitlements.entitleable_id', '=', 'users.id')
-            ->whereIn('entitlements.wallet_id', $wallets)
-            ->where('entitlements.entitleable_type', User::class);
+        return $this->entitleables(User::class, $with_accounts);
     }
 
     /**
      * Verification codes for this user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function verificationcodes()
     {
         return $this->hasMany('App\VerificationCode', 'user_id', 'id');
     }
 
     /**
      * Wallets this user owns.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function wallets()
     {
         return $this->hasMany('App\Wallet');
     }
 
     /**
      * User password mutator
      *
      * @param string $password The password in plain text.
      *
      * @return void
      */
     public function setPasswordAttribute($password)
     {
         if (!empty($password)) {
             $this->attributes['password'] = bcrypt($password, [ "rounds" => 12 ]);
             $this->attributes['password_ldap'] = '{SSHA512}' . base64_encode(
                 pack('H*', hash('sha512', $password))
             );
         }
     }
 
     /**
      * User LDAP password mutator
      *
      * @param string $password The password in plain text.
      *
      * @return void
      */
     public function setPasswordLdapAttribute($password)
     {
         $this->setPasswordAttribute($password);
     }
 
     /**
      * User status mutator
      *
      * @throws \Exception
      */
     public function setStatusAttribute($status)
     {
         $new_status = 0;
 
         $allowed_values = [
             self::STATUS_NEW,
             self::STATUS_ACTIVE,
             self::STATUS_SUSPENDED,
             self::STATUS_DELETED,
             self::STATUS_LDAP_READY,
             self::STATUS_IMAP_READY,
         ];
 
         foreach ($allowed_values as $value) {
             if ($status & $value) {
                 $new_status |= $value;
                 $status ^= $value;
             }
         }
 
         if ($status > 0) {
             throw new \Exception("Invalid user status: {$status}");
         }
 
         $this->attributes['status'] = $new_status;
     }
 
     /**
      * Validate the user credentials
      *
      * @param string $username       The username.
      * @param string $password       The password in plain text.
      * @param bool   $updatePassword Store the password if currently empty
      *
      * @return bool true on success
      */
     public function validateCredentials(string $username, string $password, bool $updatePassword = true): bool
     {
         $authenticated = false;
 
         if ($this->email === \strtolower($username)) {
             if (!empty($this->password)) {
                 if (Hash::check($password, $this->password)) {
                     $authenticated = true;
                 }
             } elseif (!empty($this->password_ldap)) {
                 if (substr($this->password_ldap, 0, 6) == "{SSHA}") {
                     $salt = substr(base64_decode(substr($this->password_ldap, 6)), 20);
 
                     $hash = '{SSHA}' . base64_encode(
                         sha1($password . $salt, true) . $salt
                     );
 
                     if ($hash == $this->password_ldap) {
                         $authenticated = true;
                     }
                 } elseif (substr($this->password_ldap, 0, 9) == "{SSHA512}") {
                     $salt = substr(base64_decode(substr($this->password_ldap, 9)), 64);
 
                     $hash = '{SSHA512}' . base64_encode(
                         pack('H*', hash('sha512', $password . $salt)) . $salt
                     );
 
                     if ($hash == $this->password_ldap) {
                         $authenticated = true;
                     }
                 }
             } else {
                 \Log::error("Incomplete credentials for {$this->email}");
             }
         }
 
         if ($authenticated) {
             \Log::info("Successful authentication for {$this->email}");
 
             // TODO: update last login time
             if ($updatePassword && (empty($this->password) || empty($this->password_ldap))) {
                 $this->password = $password;
                 $this->save();
             }
         } else {
             // TODO: Try actual LDAP?
             \Log::info("Authentication failed for {$this->email}");
         }
 
         return $authenticated;
     }
 
     /**
      * Retrieve and authenticate a user
      *
      * @param string $username     The username.
      * @param string $password     The password in plain text.
      * @param string $secondFactor The second factor (secondfactor from current request is used as fallback).
      *
      * @return array ['user', 'reason', 'errorMessage']
      */
     public static function findAndAuthenticate($username, $password, $secondFactor = null): ?array
     {
         $user = User::where('email', $username)->first();
         if (!$user) {
             return ['reason' => 'notfound', 'errorMessage' => "User not found."];
         }
 
         if (!$user->validateCredentials($username, $password)) {
             return ['reason' => 'credentials', 'errorMessage' => "Invalid password."];
         }
 
 
 
         if (!$secondFactor) {
             // Check the request if there is a second factor provided
             // as fallback.
             $secondFactor = request()->secondfactor;
         }
 
         try {
             (new \App\Auth\SecondFactor($user))->validate($secondFactor);
         } catch (\Exception $e) {
             return ['reason' => 'secondfactor', 'errorMessage' => $e->getMessage()];
         }
 
         return ['user' => $user];
     }
 
     /**
      * Hook for passport
      *
      * @throws \Throwable
      *
      * @return \App\User User model object if found
      */
     public function findAndValidateForPassport($username, $password): User
     {
         $result = self::findAndAuthenticate($username, $password);
 
         if (isset($result['reason'])) {
             if ($result['reason'] == 'secondfactor') {
                 // This results in a json response of {'error': 'secondfactor', 'error_description': '$errorMessage'}
                 throw new OAuthServerException($result['errorMessage'], 6, 'secondfactor', 401);
             }
             throw OAuthServerException::invalidCredentials();
         }
         return $result['user'];
     }
 }
diff --git a/src/tests/Feature/Console/User/DomainsTest.php b/src/tests/Feature/Console/User/DomainsTest.php
index 2ca6d3ad..f146c37f 100644
--- a/src/tests/Feature/Console/User/DomainsTest.php
+++ b/src/tests/Feature/Console/User/DomainsTest.php
@@ -1,27 +1,28 @@
 <?php
 
 namespace Tests\Feature\Console\User;
 
 use Tests\TestCase;
 
 class DomainsTest extends TestCase
 {
     /**
      * Test command runs
      */
     public function testHandle(): void
     {
         $code = \Artisan::call("user:domains unknown");
         $output = trim(\Artisan::output());
 
         $this->assertSame(1, $code);
-        $this->assertSame("User not found.", $output);
+        $this->assertSame("No such user unknown", $output);
 
-        $code = \Artisan::call("user:domains john@kolab.org");
+        $code = \Artisan::call("user:domains john@kolab.org --attr=namespace");
         $output = trim(\Artisan::output());
 
+        $domain = $this->getTestDomain('kolab.org');
+
         $this->assertSame(0, $code);
-        $this->assertTrue(strpos($output, "kolab.org") !== false);
-        $this->assertTrue(strpos($output, \config('app.domain')) !== false);
+        $this->assertSame("{$domain->id} {$domain->namespace}", $output);
     }
 }
diff --git a/src/tests/Feature/Console/User/GroupsTest.php b/src/tests/Feature/Console/User/GroupsTest.php
new file mode 100644
index 00000000..59d76c0c
--- /dev/null
+++ b/src/tests/Feature/Console/User/GroupsTest.php
@@ -0,0 +1,50 @@
+<?php
+
+namespace Tests\Feature\Console\User;
+
+use Tests\TestCase;
+
+class GroupsTest extends TestCase
+{
+    /**
+     * {@inheritDoc}
+     */
+    public function setUp(): void
+    {
+        parent::setUp();
+
+        $this->deleteTestGroup('group-test@kolab.org');
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public function tearDown(): void
+    {
+        $this->deleteTestGroup('group-test@kolab.org');
+
+        parent::tearDown();
+    }
+
+    /**
+     * Test command runs
+     */
+    public function testHandle(): void
+    {
+        $code = \Artisan::call("user:groups unknown");
+        $output = trim(\Artisan::output());
+
+        $this->assertSame(1, $code);
+        $this->assertSame("No such user unknown", $output);
+
+        $john = $this->getTestUser('john@kolab.org');
+        $group = $this->getTestGroup('group-test@kolab.org');
+        $group->assignToWallet($john->wallets->first());
+
+        $code = \Artisan::call("user:groups john@kolab.org --attr=name");
+        $output = trim(\Artisan::output());
+
+        $this->assertSame(0, $code);
+        $this->assertSame("{$group->id} {$group->name}", $output);
+    }
+}
diff --git a/src/tests/Feature/Console/User/ResourcesTest.php b/src/tests/Feature/Console/User/ResourcesTest.php
new file mode 100644
index 00000000..444beb38
--- /dev/null
+++ b/src/tests/Feature/Console/User/ResourcesTest.php
@@ -0,0 +1,31 @@
+<?php
+
+namespace Tests\Feature\Console\User;
+
+use Tests\TestCase;
+
+class ResourcesTest extends TestCase
+{
+    /**
+     * Test command runs
+     */
+    public function testHandle(): void
+    {
+        $code = \Artisan::call("user:resources unknown");
+        $output = trim(\Artisan::output());
+
+        $this->assertSame(1, $code);
+        $this->assertSame("No such user unknown", $output);
+
+        $code = \Artisan::call("user:resources john@kolab.org --attr=name");
+        $output = trim(\Artisan::output());
+
+        $resource1 = $this->getTestResource('resource-test1@kolab.org');
+        $resource2 = $this->getTestResource('resource-test2@kolab.org');
+
+        $this->assertSame(0, $code);
+        $this->assertCount(2, explode("\n", $output));
+        $this->assertStringContainsString("{$resource1->id} {$resource1->name}", $output);
+        $this->assertStringContainsString("{$resource2->id} {$resource2->name}", $output);
+    }
+}
diff --git a/src/tests/Feature/Console/User/SharedFoldersTest.php b/src/tests/Feature/Console/User/SharedFoldersTest.php
new file mode 100644
index 00000000..633898fd
--- /dev/null
+++ b/src/tests/Feature/Console/User/SharedFoldersTest.php
@@ -0,0 +1,31 @@
+<?php
+
+namespace Tests\Feature\Console\User;
+
+use Tests\TestCase;
+
+class SharedFoldersTest extends TestCase
+{
+    /**
+     * Test command runs
+     */
+    public function testHandle(): void
+    {
+        $code = \Artisan::call("user:shared-folders unknown");
+        $output = trim(\Artisan::output());
+
+        $this->assertSame(1, $code);
+        $this->assertSame("No such user unknown", $output);
+
+        $code = \Artisan::call("user:shared-folders john@kolab.org --attr=name");
+        $output = trim(\Artisan::output());
+
+        $folder1 = $this->getTestSharedFolder('folder-event@kolab.org');
+        $folder2 = $this->getTestSharedFolder('folder-contact@kolab.org');
+
+        $this->assertSame(0, $code);
+        $this->assertCount(2, explode("\n", $output));
+        $this->assertStringContainsString("{$folder1->id} {$folder1->name}", $output);
+        $this->assertStringContainsString("{$folder2->id} {$folder2->name}", $output);
+    }
+}
diff --git a/src/tests/Feature/Console/User/UsersTest.php b/src/tests/Feature/Console/User/UsersTest.php
new file mode 100644
index 00000000..4c6908ff
--- /dev/null
+++ b/src/tests/Feature/Console/User/UsersTest.php
@@ -0,0 +1,30 @@
+<?php
+
+namespace Tests\Feature\Console\User;
+
+use Tests\TestCase;
+
+class UsersTest extends TestCase
+{
+    /**
+     * Test command runs
+     */
+    public function testHandle(): void
+    {
+        $code = \Artisan::call("user:users unknown");
+        $output = trim(\Artisan::output());
+
+        $this->assertSame(1, $code);
+        $this->assertSame("No such user unknown", $output);
+
+        $code = \Artisan::call("user:users john@kolab.org --attr=email");
+        $output = trim(\Artisan::output());
+
+        $this->assertSame(0, $code);
+        $this->assertCount(4, explode("\n", $output));
+        $this->assertStringContainsString("john@kolab.org", $output);
+        $this->assertStringContainsString("ned@kolab.org", $output);
+        $this->assertStringContainsString("joe@kolab.org", $output);
+        $this->assertStringContainsString("jack@kolab.org", $output);
+    }
+}
diff --git a/src/tests/Feature/UserTest.php b/src/tests/Feature/UserTest.php
index c7b82b15..9864fa6f 100644
--- a/src/tests/Feature/UserTest.php
+++ b/src/tests/Feature/UserTest.php
@@ -1,1084 +1,1080 @@
 <?php
 
 namespace Tests\Feature;
 
 use App\Domain;
 use App\Group;
 use App\User;
 use Illuminate\Support\Facades\Queue;
 use Tests\TestCase;
 
 class UserTest extends TestCase
 {
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('user-test@' . \config('app.domain'));
         $this->deleteTestUser('UserAccountA@UserAccount.com');
         $this->deleteTestUser('UserAccountB@UserAccount.com');
         $this->deleteTestUser('UserAccountC@UserAccount.com');
         $this->deleteTestGroup('test-group@UserAccount.com');
         $this->deleteTestResource('test-resource@UserAccount.com');
         $this->deleteTestSharedFolder('test-folder@UserAccount.com');
         $this->deleteTestDomain('UserAccount.com');
         $this->deleteTestDomain('UserAccountAdd.com');
     }
 
     public function tearDown(): void
     {
         \App\TenantSetting::truncate();
         $this->deleteTestUser('user-test@' . \config('app.domain'));
         $this->deleteTestUser('UserAccountA@UserAccount.com');
         $this->deleteTestUser('UserAccountB@UserAccount.com');
         $this->deleteTestUser('UserAccountC@UserAccount.com');
         $this->deleteTestGroup('test-group@UserAccount.com');
         $this->deleteTestResource('test-resource@UserAccount.com');
         $this->deleteTestSharedFolder('test-folder@UserAccount.com');
         $this->deleteTestDomain('UserAccount.com');
         $this->deleteTestDomain('UserAccountAdd.com');
 
         parent::tearDown();
     }
 
     /**
      * Tests for User::assignPackage()
      */
     public function testAssignPackage(): void
     {
         $this->markTestIncomplete();
     }
 
     /**
      * Tests for User::assignPlan()
      */
     public function testAssignPlan(): void
     {
         $this->markTestIncomplete();
     }
 
     /**
      * Tests for User::assignSku()
      */
     public function testAssignSku(): void
     {
         $this->markTestIncomplete();
     }
 
     /**
      * Verify a wallet assigned a controller is among the accounts of the assignee.
      */
     public function testAccounts(): void
     {
         $userA = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
 
         $this->assertTrue($userA->wallets()->count() == 1);
 
         $userA->wallets()->each(
             function ($wallet) use ($userB) {
                 $wallet->addController($userB);
             }
         );
 
         $this->assertTrue($userB->accounts()->get()[0]->id === $userA->wallets()->get()[0]->id);
     }
 
     public function testCanDelete(): void
     {
         $this->markTestIncomplete();
     }
 
     /**
      * Test User::canRead() method
      */
     public function testCanRead(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
         $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
         $domain = $this->getTestDomain('kolab.org');
 
         // Admin
         $this->assertTrue($admin->canRead($admin));
         $this->assertTrue($admin->canRead($john));
         $this->assertTrue($admin->canRead($jack));
         $this->assertTrue($admin->canRead($reseller1));
         $this->assertTrue($admin->canRead($reseller2));
         $this->assertTrue($admin->canRead($domain));
         $this->assertTrue($admin->canRead($domain->wallet()));
 
         // Reseller - kolabnow
         $this->assertTrue($reseller1->canRead($john));
         $this->assertTrue($reseller1->canRead($jack));
         $this->assertTrue($reseller1->canRead($reseller1));
         $this->assertTrue($reseller1->canRead($domain));
         $this->assertTrue($reseller1->canRead($domain->wallet()));
         $this->assertFalse($reseller1->canRead($reseller2));
         $this->assertFalse($reseller1->canRead($admin));
 
         // Reseller - different tenant
         $this->assertTrue($reseller2->canRead($reseller2));
         $this->assertFalse($reseller2->canRead($john));
         $this->assertFalse($reseller2->canRead($jack));
         $this->assertFalse($reseller2->canRead($reseller1));
         $this->assertFalse($reseller2->canRead($domain));
         $this->assertFalse($reseller2->canRead($domain->wallet()));
         $this->assertFalse($reseller2->canRead($admin));
 
         // Normal user - account owner
         $this->assertTrue($john->canRead($john));
         $this->assertTrue($john->canRead($ned));
         $this->assertTrue($john->canRead($jack));
         $this->assertTrue($john->canRead($domain));
         $this->assertTrue($john->canRead($domain->wallet()));
         $this->assertFalse($john->canRead($reseller1));
         $this->assertFalse($john->canRead($reseller2));
         $this->assertFalse($john->canRead($admin));
 
         // Normal user - a non-owner and non-controller
         $this->assertTrue($jack->canRead($jack));
         $this->assertFalse($jack->canRead($john));
         $this->assertFalse($jack->canRead($domain));
         $this->assertFalse($jack->canRead($domain->wallet()));
         $this->assertFalse($jack->canRead($reseller1));
         $this->assertFalse($jack->canRead($reseller2));
         $this->assertFalse($jack->canRead($admin));
 
         // Normal user - John's wallet controller
         $this->assertTrue($ned->canRead($ned));
         $this->assertTrue($ned->canRead($john));
         $this->assertTrue($ned->canRead($jack));
         $this->assertTrue($ned->canRead($domain));
         $this->assertTrue($ned->canRead($domain->wallet()));
         $this->assertFalse($ned->canRead($reseller1));
         $this->assertFalse($ned->canRead($reseller2));
         $this->assertFalse($ned->canRead($admin));
     }
 
     /**
      * Test User::canUpdate() method
      */
     public function testCanUpdate(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
         $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
         $domain = $this->getTestDomain('kolab.org');
 
         // Admin
         $this->assertTrue($admin->canUpdate($admin));
         $this->assertTrue($admin->canUpdate($john));
         $this->assertTrue($admin->canUpdate($jack));
         $this->assertTrue($admin->canUpdate($reseller1));
         $this->assertTrue($admin->canUpdate($reseller2));
         $this->assertTrue($admin->canUpdate($domain));
         $this->assertTrue($admin->canUpdate($domain->wallet()));
 
         // Reseller - kolabnow
         $this->assertTrue($reseller1->canUpdate($john));
         $this->assertTrue($reseller1->canUpdate($jack));
         $this->assertTrue($reseller1->canUpdate($reseller1));
         $this->assertTrue($reseller1->canUpdate($domain));
         $this->assertTrue($reseller1->canUpdate($domain->wallet()));
         $this->assertFalse($reseller1->canUpdate($reseller2));
         $this->assertFalse($reseller1->canUpdate($admin));
 
         // Reseller - different tenant
         $this->assertTrue($reseller2->canUpdate($reseller2));
         $this->assertFalse($reseller2->canUpdate($john));
         $this->assertFalse($reseller2->canUpdate($jack));
         $this->assertFalse($reseller2->canUpdate($reseller1));
         $this->assertFalse($reseller2->canUpdate($domain));
         $this->assertFalse($reseller2->canUpdate($domain->wallet()));
         $this->assertFalse($reseller2->canUpdate($admin));
 
         // Normal user - account owner
         $this->assertTrue($john->canUpdate($john));
         $this->assertTrue($john->canUpdate($ned));
         $this->assertTrue($john->canUpdate($jack));
         $this->assertTrue($john->canUpdate($domain));
         $this->assertFalse($john->canUpdate($domain->wallet()));
         $this->assertFalse($john->canUpdate($reseller1));
         $this->assertFalse($john->canUpdate($reseller2));
         $this->assertFalse($john->canUpdate($admin));
 
         // Normal user - a non-owner and non-controller
         $this->assertTrue($jack->canUpdate($jack));
         $this->assertFalse($jack->canUpdate($john));
         $this->assertFalse($jack->canUpdate($domain));
         $this->assertFalse($jack->canUpdate($domain->wallet()));
         $this->assertFalse($jack->canUpdate($reseller1));
         $this->assertFalse($jack->canUpdate($reseller2));
         $this->assertFalse($jack->canUpdate($admin));
 
         // Normal user - John's wallet controller
         $this->assertTrue($ned->canUpdate($ned));
         $this->assertTrue($ned->canUpdate($john));
         $this->assertTrue($ned->canUpdate($jack));
         $this->assertTrue($ned->canUpdate($domain));
         $this->assertFalse($ned->canUpdate($domain->wallet()));
         $this->assertFalse($ned->canUpdate($reseller1));
         $this->assertFalse($ned->canUpdate($reseller2));
         $this->assertFalse($ned->canUpdate($admin));
     }
 
     /**
      * Test user create/creating observer
      */
     public function testCreate(): void
     {
         Queue::fake();
 
         $domain = \config('app.domain');
 
         $user = User::create(['email' => 'USER-test@' . \strtoupper($domain)]);
 
         $result = User::where('email', 'user-test@' . $domain)->first();
 
         $this->assertSame('user-test@' . $domain, $result->email);
         $this->assertSame($user->id, $result->id);
         $this->assertSame(User::STATUS_NEW | User::STATUS_ACTIVE, $result->status);
     }
 
     /**
      * Verify user creation process
      */
     public function testCreateJobs(): void
     {
         Queue::fake();
 
         $user = User::create([
                 'email' => 'user-test@' . \config('app.domain')
         ]);
 
         Queue::assertPushed(\App\Jobs\User\CreateJob::class, 1);
         Queue::assertPushed(\App\Jobs\PGP\KeyCreateJob::class, 0);
 
         Queue::assertPushed(
             \App\Jobs\User\CreateJob::class,
             function ($job) use ($user) {
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 $userId = TestCase::getObjectProperty($job, 'userId');
 
                 return $userEmail === $user->email
                     && $userId === $user->id;
             }
         );
 
         Queue::assertPushedWithChain(
             \App\Jobs\User\CreateJob::class,
             [
                 \App\Jobs\User\VerifyJob::class,
             ]
         );
 /*
         FIXME: Looks like we can't really do detailed assertions on chained jobs
                Another thing to consider is if we maybe should run these jobs
                independently (not chained) and make sure there's no race-condition
                in status update
 
         Queue::assertPushed(\App\Jobs\User\VerifyJob::class, 1);
         Queue::assertPushed(\App\Jobs\User\VerifyJob::class, function ($job) use ($user) {
             $userEmail = TestCase::getObjectProperty($job, 'userEmail');
             $userId = TestCase::getObjectProperty($job, 'userId');
 
             return $userEmail === $user->email
                 && $userId === $user->id;
         });
 */
     }
 
     /**
      * Verify user creation process invokes the PGP keys creation job (if configured)
      */
     public function testCreatePGPJob(): void
     {
         Queue::fake();
 
         \App\Tenant::find(\config('app.tenant_id'))->setSetting('pgp.enable', 1);
 
         $user = User::create([
                 'email' => 'user-test@' . \config('app.domain')
         ]);
 
         Queue::assertPushed(\App\Jobs\PGP\KeyCreateJob::class, 1);
 
         Queue::assertPushed(
             \App\Jobs\PGP\KeyCreateJob::class,
             function ($job) use ($user) {
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 $userId = TestCase::getObjectProperty($job, 'userId');
 
                 return $userEmail === $user->email
                     && $userId === $user->id;
             }
         );
     }
 
     /**
      * Tests for User::domains()
      */
     public function testDomains(): void
     {
         $user = $this->getTestUser('john@kolab.org');
 
         $domain = $this->getTestDomain('useraccount.com', [
                 'status' => Domain::STATUS_NEW | Domain::STATUS_ACTIVE,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
 
-        $domains = collect($user->domains())->pluck('namespace')->all();
+        $domains = $user->domains()->pluck('namespace')->all();
 
         $this->assertContains($domain->namespace, $domains);
         $this->assertContains('kolab.org', $domains);
 
         // Jack is not the wallet controller, so for him the list should not
         // include John's domains, kolab.org specifically
         $user = $this->getTestUser('jack@kolab.org');
 
-        $domains = collect($user->domains())->pluck('namespace')->all();
+        $domains = $user->domains()->pluck('namespace')->all();
 
         $this->assertContains($domain->namespace, $domains);
         $this->assertNotContains('kolab.org', $domains);
 
         // Public domains of other tenants should not be returned
         $tenant = \App\Tenant::where('id', '!=', \config('app.tenant_id'))->first();
         $domain->tenant_id = $tenant->id;
         $domain->save();
 
-        $domains = collect($user->domains())->pluck('namespace')->all();
+        $domains = $user->domains()->pluck('namespace')->all();
 
         $this->assertNotContains($domain->namespace, $domains);
     }
 
     /**
      * Test User::getConfig() and setConfig() methods
      */
     public function testConfigTrait(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $john->setSetting('greylist_enabled', null);
 
         $this->assertSame(['greylist_enabled' => true], $john->getConfig());
 
         $result = $john->setConfig(['greylist_enabled' => false, 'unknown' => false]);
 
         $this->assertSame(['greylist_enabled' => false], $john->getConfig());
         $this->assertSame('false', $john->getSetting('greylist_enabled'));
 
         $result = $john->setConfig(['greylist_enabled' => true]);
 
         $this->assertSame(['greylist_enabled' => true], $john->getConfig());
         $this->assertSame('true', $john->getSetting('greylist_enabled'));
     }
 
     /**
      * Test User::hasSku() method
      */
     public function testHasSku(): void
     {
         $john = $this->getTestUser('john@kolab.org');
 
         $this->assertTrue($john->hasSku('mailbox'));
         $this->assertTrue($john->hasSku('storage'));
         $this->assertFalse($john->hasSku('beta'));
         $this->assertFalse($john->hasSku('unknown'));
     }
 
     public function testUserQuota(): void
     {
         // TODO: This test does not test much, probably could be removed
         //       or moved to somewhere else, or extended with
         //       other entitlements() related cases.
 
         $user = $this->getTestUser('john@kolab.org');
         $storage_sku = \App\Sku::withEnvTenantContext()->where('title', 'storage')->first();
 
         $count = 0;
 
         foreach ($user->entitlements()->get() as $entitlement) {
             if ($entitlement->sku_id == $storage_sku->id) {
                 $count += 1;
             }
         }
 
         $this->assertTrue($count == 5);
     }
 
     /**
      * Test user deletion
      */
     public function testDelete(): void
     {
         Queue::fake();
 
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
         $package = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $user->assignPackage($package);
 
         $id = $user->id;
 
         $this->assertCount(7, $user->entitlements()->get());
 
         $user->delete();
 
         $this->assertCount(0, $user->entitlements()->get());
         $this->assertTrue($user->fresh()->trashed());
         $this->assertFalse($user->fresh()->isDeleted());
 
         // Delete the user for real
         $job = new \App\Jobs\User\DeleteJob($id);
         $job->handle();
 
         $this->assertTrue(User::withTrashed()->where('id', $id)->first()->isDeleted());
 
         $user->forceDelete();
 
         $this->assertCount(0, User::withTrashed()->where('id', $id)->get());
 
         // Test an account with users, domain, and group, and resource
         $userA = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $userC = $this->getTestUser('UserAccountC@UserAccount.com');
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $domain = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $userA->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $userA);
         $userA->assignPackage($package_kolab, $userB);
         $userA->assignPackage($package_kolab, $userC);
         $group = $this->getTestGroup('test-group@UserAccount.com');
         $group->assignToWallet($userA->wallets->first());
         $resource = $this->getTestResource('test-resource@UserAccount.com', ['name' => 'test']);
         $resource->assignToWallet($userA->wallets->first());
         $folder = $this->getTestSharedFolder('test-folder@UserAccount.com', ['name' => 'test']);
         $folder->assignToWallet($userA->wallets->first());
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
         $entitlementsC = \App\Entitlement::where('entitleable_id', $userC->id);
         $entitlementsDomain = \App\Entitlement::where('entitleable_id', $domain->id);
         $entitlementsGroup = \App\Entitlement::where('entitleable_id', $group->id);
         $entitlementsResource = \App\Entitlement::where('entitleable_id', $resource->id);
         $entitlementsFolder = \App\Entitlement::where('entitleable_id', $folder->id);
 
         $this->assertSame(7, $entitlementsA->count());
         $this->assertSame(7, $entitlementsB->count());
         $this->assertSame(7, $entitlementsC->count());
         $this->assertSame(1, $entitlementsDomain->count());
         $this->assertSame(1, $entitlementsGroup->count());
         $this->assertSame(1, $entitlementsResource->count());
         $this->assertSame(1, $entitlementsFolder->count());
 
         // Delete non-controller user
         $userC->delete();
 
         $this->assertTrue($userC->fresh()->trashed());
         $this->assertFalse($userC->fresh()->isDeleted());
         $this->assertSame(0, $entitlementsC->count());
 
         // Delete the controller (and expect "sub"-users to be deleted too)
         $userA->delete();
 
         $this->assertSame(0, $entitlementsA->count());
         $this->assertSame(0, $entitlementsB->count());
         $this->assertSame(0, $entitlementsDomain->count());
         $this->assertSame(0, $entitlementsGroup->count());
         $this->assertSame(0, $entitlementsResource->count());
         $this->assertSame(0, $entitlementsFolder->count());
         $this->assertTrue($userA->fresh()->trashed());
         $this->assertTrue($userB->fresh()->trashed());
         $this->assertTrue($domain->fresh()->trashed());
         $this->assertTrue($group->fresh()->trashed());
         $this->assertTrue($resource->fresh()->trashed());
         $this->assertTrue($folder->fresh()->trashed());
         $this->assertFalse($userA->isDeleted());
         $this->assertFalse($userB->isDeleted());
         $this->assertFalse($domain->isDeleted());
         $this->assertFalse($group->isDeleted());
         $this->assertFalse($resource->isDeleted());
         $this->assertFalse($folder->isDeleted());
 
         $userA->forceDelete();
 
         $all_entitlements = \App\Entitlement::where('wallet_id', $userA->wallets->first()->id);
 
         $this->assertSame(0, $all_entitlements->withTrashed()->count());
         $this->assertCount(0, User::withTrashed()->where('id', $userA->id)->get());
         $this->assertCount(0, User::withTrashed()->where('id', $userB->id)->get());
         $this->assertCount(0, User::withTrashed()->where('id', $userC->id)->get());
         $this->assertCount(0, Domain::withTrashed()->where('id', $domain->id)->get());
         $this->assertCount(0, Group::withTrashed()->where('id', $group->id)->get());
         $this->assertCount(0, \App\Resource::withTrashed()->where('id', $resource->id)->get());
         $this->assertCount(0, \App\SharedFolder::withTrashed()->where('id', $folder->id)->get());
     }
 
     /**
      * Test user deletion vs. group membership
      */
     public function testDeleteAndGroups(): void
     {
         Queue::fake();
 
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $userA = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $userA->assignPackage($package_kolab, $userB);
         $group = $this->getTestGroup('test-group@UserAccount.com');
         $group->members = ['test@gmail.com', $userB->email];
         $group->assignToWallet($userA->wallets->first());
         $group->save();
 
         Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 1);
 
         $userGroups = $userA->groups()->get();
         $this->assertSame(1, $userGroups->count());
         $this->assertSame($group->id, $userGroups->first()->id);
 
         $userB->delete();
 
         $this->assertSame(['test@gmail.com'], $group->fresh()->members);
 
         // Twice, one for save() and one for delete() above
         Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 2);
     }
 
     /**
      * Test handling negative balance on user deletion
      */
     public function testDeleteWithNegativeBalance(): void
     {
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
         $wallet = $user->wallets()->first();
         $wallet->balance = -1000;
         $wallet->save();
         $reseller_wallet = $user->tenant->wallet();
         $reseller_wallet->balance = 0;
         $reseller_wallet->save();
         \App\Transaction::where('object_id', $reseller_wallet->id)->where('object_type', \App\Wallet::class)->delete();
 
         $user->delete();
 
         $reseller_transactions = \App\Transaction::where('object_id', $reseller_wallet->id)
             ->where('object_type', \App\Wallet::class)->get();
 
         $this->assertSame(-1000, $reseller_wallet->fresh()->balance);
         $this->assertCount(1, $reseller_transactions);
         $trans = $reseller_transactions[0];
         $this->assertSame("Deleted user {$user->email}", $trans->description);
         $this->assertSame(-1000, $trans->amount);
         $this->assertSame(\App\Transaction::WALLET_DEBIT, $trans->type);
     }
 
     /**
      * Test handling positive balance on user deletion
      */
     public function testDeleteWithPositiveBalance(): void
     {
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
         $wallet = $user->wallets()->first();
         $wallet->balance = 1000;
         $wallet->save();
         $reseller_wallet = $user->tenant->wallet();
         $reseller_wallet->balance = 0;
         $reseller_wallet->save();
 
         $user->delete();
 
         $this->assertSame(0, $reseller_wallet->fresh()->balance);
     }
 
     /**
      * Test user deletion with PGP/WOAT enabled
      */
     public function testDeleteWithPGP(): void
     {
         Queue::fake();
 
         // Test with PGP disabled
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
 
         $user->tenant->setSetting('pgp.enable', 0);
         $user->delete();
 
         Queue::assertPushed(\App\Jobs\PGP\KeyDeleteJob::class, 0);
 
         // Test with PGP enabled
         $this->deleteTestUser('user-test@' . \config('app.domain'));
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
 
         $user->tenant->setSetting('pgp.enable', 1);
         $user->delete();
         $user->tenant->setSetting('pgp.enable', 0);
 
         Queue::assertPushed(\App\Jobs\PGP\KeyDeleteJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\PGP\KeyDeleteJob::class,
             function ($job) use ($user) {
                 $userId = TestCase::getObjectProperty($job, 'userId');
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 return $userId == $user->id && $userEmail === $user->email;
             }
         );
     }
 
     /**
      * Tests for User::aliasExists()
      */
     public function testAliasExists(): void
     {
         $this->assertTrue(User::aliasExists('jack.daniels@kolab.org'));
 
         $this->assertFalse(User::aliasExists('j.daniels@kolab.org'));
         $this->assertFalse(User::aliasExists('john@kolab.org'));
     }
 
     /**
      * Tests for User::emailExists()
      */
     public function testEmailExists(): void
     {
         $this->assertFalse(User::emailExists('jack.daniels@kolab.org'));
         $this->assertFalse(User::emailExists('j.daniels@kolab.org'));
 
         $this->assertTrue(User::emailExists('john@kolab.org'));
         $user = User::emailExists('john@kolab.org', true);
         $this->assertSame('john@kolab.org', $user->email);
     }
 
     /**
      * Tests for User::findByEmail()
      */
     public function testFindByEmail(): void
     {
         $user = $this->getTestUser('john@kolab.org');
 
         $result = User::findByEmail('john');
         $this->assertNull($result);
 
         $result = User::findByEmail('non-existing@email.com');
         $this->assertNull($result);
 
         $result = User::findByEmail('john@kolab.org');
         $this->assertInstanceOf(User::class, $result);
         $this->assertSame($user->id, $result->id);
 
         // Use an alias
         $result = User::findByEmail('john.doe@kolab.org');
         $this->assertInstanceOf(User::class, $result);
         $this->assertSame($user->id, $result->id);
 
         Queue::fake();
 
         // A case where two users have the same alias
         $ned = $this->getTestUser('ned@kolab.org');
         $ned->setAliases(['joe.monster@kolab.org']);
         $result = User::findByEmail('joe.monster@kolab.org');
         $this->assertNull($result);
         $ned->setAliases([]);
 
         // TODO: searching by external email (setting)
         $this->markTestIncomplete();
     }
 
     /**
      * Test User::name()
      */
     public function testName(): void
     {
         Queue::fake();
 
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
 
         $this->assertSame('', $user->name());
         $this->assertSame($user->tenant->title . ' User', $user->name(true));
 
         $user->setSetting('first_name', 'First');
 
         $this->assertSame('First', $user->name());
         $this->assertSame('First', $user->name(true));
 
         $user->setSetting('last_name', 'Last');
 
         $this->assertSame('First Last', $user->name());
         $this->assertSame('First Last', $user->name(true));
     }
 
     /**
      * Test resources() method
      */
     public function testResources(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
 
         $resources = $john->resources()->orderBy('email')->get();
 
         $this->assertSame(2, $resources->count());
         $this->assertSame('resource-test1@kolab.org', $resources[0]->email);
         $this->assertSame('resource-test2@kolab.org', $resources[1]->email);
 
         $resources = $ned->resources()->orderBy('email')->get();
 
         $this->assertSame(2, $resources->count());
         $this->assertSame('resource-test1@kolab.org', $resources[0]->email);
         $this->assertSame('resource-test2@kolab.org', $resources[1]->email);
 
         $resources = $jack->resources()->get();
 
         $this->assertSame(0, $resources->count());
     }
 
     /**
      * Test sharedFolders() method
      */
     public function testSharedFolders(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
 
         $folders = $john->sharedFolders()->orderBy('email')->get();
 
         $this->assertSame(2, $folders->count());
         $this->assertSame('folder-contact@kolab.org', $folders[0]->email);
         $this->assertSame('folder-event@kolab.org', $folders[1]->email);
 
         $folders = $ned->sharedFolders()->orderBy('email')->get();
 
         $this->assertSame(2, $folders->count());
         $this->assertSame('folder-contact@kolab.org', $folders[0]->email);
         $this->assertSame('folder-event@kolab.org', $folders[1]->email);
 
         $folders = $jack->sharedFolders()->get();
 
         $this->assertSame(0, $folders->count());
     }
 
     /**
      * Test user restoring
      */
     public function testRestore(): void
     {
         Queue::fake();
 
         // Test an account with users and domain
         $userA = $this->getTestUser('UserAccountA@UserAccount.com', [
                 'status' => User::STATUS_LDAP_READY | User::STATUS_IMAP_READY | User::STATUS_SUSPENDED,
         ]);
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $domainA = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $domainB = $this->getTestDomain('UserAccountAdd.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $userA->assignPackage($package_kolab);
         $domainA->assignPackage($package_domain, $userA);
         $domainB->assignPackage($package_domain, $userA);
         $userA->assignPackage($package_kolab, $userB);
 
         $storage_sku = \App\Sku::withEnvTenantContext()->where('title', 'storage')->first();
         $now = \Carbon\Carbon::now();
         $wallet_id = $userA->wallets->first()->id;
 
         // add an extra storage entitlement
         $ent1 = \App\Entitlement::create([
                 'wallet_id' => $wallet_id,
                 'sku_id' => $storage_sku->id,
                 'cost' => 0,
                 'entitleable_id' => $userA->id,
                 'entitleable_type' => User::class,
         ]);
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
         $entitlementsDomain = \App\Entitlement::where('entitleable_id', $domainA->id);
 
         // First delete the user
         $userA->delete();
 
         $this->assertSame(0, $entitlementsA->count());
         $this->assertSame(0, $entitlementsB->count());
         $this->assertSame(0, $entitlementsDomain->count());
         $this->assertTrue($userA->fresh()->trashed());
         $this->assertTrue($userB->fresh()->trashed());
         $this->assertTrue($domainA->fresh()->trashed());
         $this->assertTrue($domainB->fresh()->trashed());
         $this->assertFalse($userA->isDeleted());
         $this->assertFalse($userB->isDeleted());
         $this->assertFalse($domainA->isDeleted());
 
         // Backdate one storage entitlement (it's not expected to be restored)
         \App\Entitlement::withTrashed()->where('id', $ent1->id)
             ->update(['deleted_at' => $now->copy()->subMinutes(2)]);
 
         // Backdate entitlements to assert that they were restored with proper updated_at timestamp
         \App\Entitlement::withTrashed()->where('wallet_id', $wallet_id)
             ->update(['updated_at' => $now->subMinutes(10)]);
 
         Queue::fake();
 
         // Then restore it
         $userA->restore();
         $userA->refresh();
 
         $this->assertFalse($userA->trashed());
         $this->assertFalse($userA->isDeleted());
         $this->assertFalse($userA->isSuspended());
         $this->assertFalse($userA->isLdapReady());
         $this->assertFalse($userA->isImapReady());
         $this->assertTrue($userA->isActive());
 
         $this->assertTrue($userB->fresh()->trashed());
         $this->assertTrue($domainB->fresh()->trashed());
         $this->assertFalse($domainA->fresh()->trashed());
 
         // Assert entitlements
         $this->assertSame(7, $entitlementsA->count()); // mailbox + groupware + 5 x storage
         $this->assertTrue($ent1->fresh()->trashed());
         $entitlementsA->get()->each(function ($ent) {
             $this->assertTrue($ent->updated_at->greaterThan(\Carbon\Carbon::now()->subSeconds(5)));
         });
 
         // We expect only CreateJob + UpdateJob pair for both user and domain.
         // Because how Illuminate/Database/Eloquent/SoftDeletes::restore() method
         // is implemented we cannot skip the UpdateJob in any way.
         // I don't want to overwrite this method, the extra job shouldn't do any harm.
         $this->assertCount(4, Queue::pushedJobs()); // @phpstan-ignore-line
         Queue::assertPushed(\App\Jobs\Domain\UpdateJob::class, 1);
         Queue::assertPushed(\App\Jobs\Domain\CreateJob::class, 1);
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
         Queue::assertPushed(\App\Jobs\User\CreateJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\User\CreateJob::class,
             function ($job) use ($userA) {
                 return $userA->id === TestCase::getObjectProperty($job, 'userId');
             }
         );
         Queue::assertPushedWithChain(
             \App\Jobs\User\CreateJob::class,
             [
                 \App\Jobs\User\VerifyJob::class,
             ]
         );
     }
 
     /**
      * Tests for UserAliasesTrait::setAliases()
      */
     public function testSetAliases(): void
     {
         Queue::fake();
         Queue::assertNothingPushed();
 
         $user = $this->getTestUser('UserAccountA@UserAccount.com');
         $domain = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
 
         $this->assertCount(0, $user->aliases->all());
 
         $user->tenant->setSetting('pgp.enable', 1);
 
         // Add an alias
         $user->setAliases(['UserAlias1@UserAccount.com']);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
         Queue::assertPushed(\App\Jobs\PGP\KeyCreateJob::class, 1);
 
         $user->tenant->setSetting('pgp.enable', 0);
 
         $aliases = $user->aliases()->get();
         $this->assertCount(1, $aliases);
         $this->assertSame('useralias1@useraccount.com', $aliases[0]['alias']);
 
         // Add another alias
         $user->setAliases(['UserAlias1@UserAccount.com', 'UserAlias2@UserAccount.com']);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 2);
         Queue::assertPushed(\App\Jobs\PGP\KeyCreateJob::class, 1);
 
         $aliases = $user->aliases()->orderBy('alias')->get();
         $this->assertCount(2, $aliases);
         $this->assertSame('useralias1@useraccount.com', $aliases[0]->alias);
         $this->assertSame('useralias2@useraccount.com', $aliases[1]->alias);
 
         $user->tenant->setSetting('pgp.enable', 1);
 
         // Remove an alias
         $user->setAliases(['UserAlias1@UserAccount.com']);
 
         $user->tenant->setSetting('pgp.enable', 0);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 3);
         Queue::assertPushed(\App\Jobs\PGP\KeyDeleteJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\PGP\KeyDeleteJob::class,
             function ($job) use ($user) {
                 $userId = TestCase::getObjectProperty($job, 'userId');
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 return $userId == $user->id && $userEmail === 'useralias2@useraccount.com';
             }
         );
 
         $aliases = $user->aliases()->get();
         $this->assertCount(1, $aliases);
         $this->assertSame('useralias1@useraccount.com', $aliases[0]['alias']);
 
         // Remove all aliases
         $user->setAliases([]);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 4);
 
         $this->assertCount(0, $user->aliases()->get());
     }
 
     /**
      * Tests for UserSettingsTrait::setSettings() and getSetting() and getSettings()
      */
     public function testUserSettings(): void
     {
         Queue::fake();
         Queue::assertNothingPushed();
 
         $user = $this->getTestUser('UserAccountA@UserAccount.com');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 0);
 
         // Test default settings
         // Note: Technicly this tests UserObserver::created() behavior
         $all_settings = $user->settings()->orderBy('key')->get();
         $this->assertCount(2, $all_settings);
         $this->assertSame('country', $all_settings[0]->key);
         $this->assertSame('CH', $all_settings[0]->value);
         $this->assertSame('currency', $all_settings[1]->key);
         $this->assertSame('CHF', $all_settings[1]->value);
 
         // Add a setting
         $user->setSetting('first_name', 'Firstname');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame('Firstname', $user->getSetting('first_name'));
         $this->assertSame('Firstname', $user->fresh()->getSetting('first_name'));
 
         // Update a setting
         $user->setSetting('first_name', 'Firstname1');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 2);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame('Firstname1', $user->getSetting('first_name'));
         $this->assertSame('Firstname1', $user->fresh()->getSetting('first_name'));
 
         // Delete a setting (null)
         $user->setSetting('first_name', null);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 3);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame(null, $user->getSetting('first_name'));
         $this->assertSame(null, $user->fresh()->getSetting('first_name'));
 
         // Delete a setting (empty string)
         $user->setSetting('first_name', 'Firstname1');
         $user->setSetting('first_name', '');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 5);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame(null, $user->getSetting('first_name'));
         $this->assertSame(null, $user->fresh()->getSetting('first_name'));
 
         // Set multiple settings at once
         $user->setSettings([
                 'first_name' => 'Firstname2',
                 'last_name' => 'Lastname2',
                 'country' => null,
         ]);
 
         // TODO: This really should create a single UserUpdate job, not 3
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 7);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame('Firstname2', $user->getSetting('first_name'));
         $this->assertSame('Firstname2', $user->fresh()->getSetting('first_name'));
         $this->assertSame('Lastname2', $user->getSetting('last_name'));
         $this->assertSame('Lastname2', $user->fresh()->getSetting('last_name'));
         $this->assertSame(null, $user->getSetting('country'));
         $this->assertSame(null, $user->fresh()->getSetting('country'));
 
         $all_settings = $user->settings()->orderBy('key')->get();
         $this->assertCount(3, $all_settings);
 
         // Test getSettings() method
         $this->assertSame(
             [
                 'first_name' => 'Firstname2',
                 'last_name' => 'Lastname2',
                 'unknown' => null,
             ],
             $user->getSettings(['first_name', 'last_name', 'unknown'])
         );
     }
 
     /**
      * Tests for User::users()
      */
     public function testUsers(): void
     {
         $jack = $this->getTestUser('jack@kolab.org');
         $joe = $this->getTestUser('joe@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $wallet = $john->wallets()->first();
 
         $users = $john->users()->orderBy('email')->get();
 
         $this->assertCount(4, $users);
         $this->assertEquals($jack->id, $users[0]->id);
         $this->assertEquals($joe->id, $users[1]->id);
         $this->assertEquals($john->id, $users[2]->id);
         $this->assertEquals($ned->id, $users[3]->id);
-        $this->assertSame($wallet->id, $users[0]->wallet_id);
-        $this->assertSame($wallet->id, $users[1]->wallet_id);
-        $this->assertSame($wallet->id, $users[2]->wallet_id);
-        $this->assertSame($wallet->id, $users[3]->wallet_id);
 
         $users = $jack->users()->orderBy('email')->get();
 
         $this->assertCount(0, $users);
 
         $users = $ned->users()->orderBy('email')->get();
 
         $this->assertCount(4, $users);
     }
 
     public function testWallets(): void
     {
         $this->markTestIncomplete();
     }
 }