diff --git a/src/app/Console/Commands/User/RestrictCommand.php b/src/app/Console/Commands/User/RestrictCommand.php
new file mode 100644
index 00000000..b28120f3
--- /dev/null
+++ b/src/app/Console/Commands/User/RestrictCommand.php
@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Console\Commands\User;
+
+use App\Console\Command;
+
+class RestrictCommand extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'user:restrict {user}';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Restrict a user';
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        $user = $this->getUser($this->argument('user'));
+
+        if (!$user) {
+            $this->error('User not found.');
+            return 1;
+        }
+
+        $user->restrict();
+    }
+}
diff --git a/src/app/Console/Commands/User/UnrestrictCommand.php b/src/app/Console/Commands/User/UnrestrictCommand.php
new file mode 100644
index 00000000..d6bf95b5
--- /dev/null
+++ b/src/app/Console/Commands/User/UnrestrictCommand.php
@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Console\Commands\User;
+
+use App\Console\Command;
+
+class UnrestrictCommand extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'user:unrestrict {user}';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Un-restrict a user';
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        $user = $this->getUser($this->argument('user'));
+
+        if (!$user) {
+            $this->error('User not found.');
+            return 1;
+        }
+
+        $user->unrestrict();
+    }
+}
diff --git a/src/app/Http/Controllers/API/SignupController.php b/src/app/Http/Controllers/API/SignupController.php
index 1d402924..3e4ec0a7 100644
--- a/src/app/Http/Controllers/API/SignupController.php
+++ b/src/app/Http/Controllers/API/SignupController.php
@@ -1,440 +1,440 @@
 <?php
 
 namespace App\Http\Controllers\API;
 
 use App\Http\Controllers\Controller;
 use App\Jobs\SignupVerificationEmail;
 use App\Discount;
 use App\Domain;
 use App\Plan;
 use App\Rules\SignupExternalEmail;
 use App\Rules\SignupToken;
 use App\Rules\Password;
 use App\Rules\UserEmailDomain;
 use App\Rules\UserEmailLocal;
 use App\SignupCode;
 use App\SignupInvitation;
 use App\User;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Support\Str;
 
 /**
  * Signup process API
  */
 class SignupController extends Controller
 {
     /**
      * Returns plans definitions for signup.
      *
      * @param \Illuminate\Http\Request $request HTTP request
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function plans(Request $request)
     {
         $plans = [];
 
         // Use reverse order just to have individual on left, group on right ;)
         Plan::withEnvTenantContext()->orderByDesc('title')->get()
             ->map(function ($plan) use (&$plans) {
                 // Allow themes to set custom button label
                 $button = \trans('theme::app.planbutton-' . $plan->title);
                 if ($button == 'theme::app.planbutton-' . $plan->title) {
                     $button = \trans('app.planbutton', ['plan' => $plan->name]);
                 }
 
                 $plans[] = [
                     'title' => $plan->title,
                     'name' => $plan->name,
                     'button' => $button,
                     'description' => $plan->description,
                     'mode' => $plan->mode ?: 'email',
                 ];
             });
 
         return response()->json(['status' => 'success', 'plans' => $plans]);
     }
 
     /**
      * Starts signup process.
      *
      * Verifies user name and email/phone, sends verification email/sms message.
      * Returns the verification code.
      *
      * @param \Illuminate\Http\Request $request HTTP request
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function init(Request $request)
     {
         $rules = [
             'first_name' => 'max:128',
             'last_name' => 'max:128',
             'voucher' => 'max:32',
         ];
 
         $plan = $this->getPlan();
 
         if ($plan->mode == 'token') {
             $rules['token'] = ['required', 'string', new SignupToken()];
         } else {
             $rules['email'] = ['required', 'string', new SignupExternalEmail()];
         }
 
         // Check required fields, validate input
         $v = Validator::make($request->all(), $rules);
 
         if ($v->fails()) {
             return response()->json(['status' => 'error', 'errors' => $v->errors()->toArray()], 422);
         }
 
         // Generate the verification code
         $code = SignupCode::create([
                 'email' => $plan->mode == 'token' ? $request->token : $request->email,
                 'first_name' => $request->first_name,
                 'last_name' => $request->last_name,
                 'plan' => $plan->title,
                 'voucher' => $request->voucher,
         ]);
 
         $response = [
             'status' => 'success',
             'code' => $code->code,
             'mode' => $plan->mode ?: 'email',
         ];
 
         if ($plan->mode == 'token') {
             // Token verification, jump to the last step
             $has_domain = $plan->hasDomain();
 
             $response['short_code'] = $code->short_code;
             $response['is_domain'] = $has_domain;
             $response['domains'] = $has_domain ? [] : Domain::getPublicDomains();
         } else {
             // External email verification, send an email message
             SignupVerificationEmail::dispatch($code);
         }
 
         return response()->json($response);
     }
 
     /**
      * Returns signup invitation information.
      *
      * @param string $id Signup invitation identifier
      *
      * @return \Illuminate\Http\JsonResponse|void
      */
     public function invitation($id)
     {
         $invitation = SignupInvitation::withEnvTenantContext()->find($id);
 
         if (empty($invitation) || $invitation->isCompleted()) {
             return $this->errorResponse(404);
         }
 
         $has_domain = $this->getPlan()->hasDomain();
 
         $result = [
             'id' => $id,
             'is_domain' => $has_domain,
             'domains' => $has_domain ? [] : Domain::getPublicDomains(),
         ];
 
         return response()->json($result);
     }
 
 
     /**
      * Validation of the verification code.
      *
      * @param \Illuminate\Http\Request $request HTTP request
      * @param bool                     $update  Update the signup code record
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function verify(Request $request, $update = true)
     {
         // Validate the request args
         $v = Validator::make(
             $request->all(),
             [
                 'code' => 'required',
                 'short_code' => 'required',
             ]
         );
 
         if ($v->fails()) {
             return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
         }
 
         // Validate the verification code
         $code = SignupCode::find($request->code);
 
         if (
             empty($code)
             || $code->isExpired()
             || Str::upper($request->short_code) !== Str::upper($code->short_code)
         ) {
             $errors = ['short_code' => "The code is invalid or expired."];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         // For signup last-step mode remember the code object, so we can delete it
         // with single SQL query (->delete()) instead of two
         $request->code = $code;
 
         if ($update) {
             $code->verify_ip_address = $request->ip();
             $code->save();
         }
 
         $has_domain = $this->getPlan()->hasDomain();
 
         // Return user name and email/phone/voucher from the codes database,
         // domains list for selection and "plan type" flag
         return response()->json([
                 'status' => 'success',
                 'email' => $code->email,
                 'first_name' => $code->first_name,
                 'last_name' => $code->last_name,
                 'voucher' => $code->voucher,
                 'is_domain' => $has_domain,
                 'domains' => $has_domain ? [] : Domain::getPublicDomains(),
         ]);
     }
 
     /**
      * Finishes the signup process by creating the user account.
      *
      * @param \Illuminate\Http\Request $request HTTP request
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function signup(Request $request)
     {
         // Validate input
         $v = Validator::make(
             $request->all(),
             [
                 'login' => 'required|min:2',
                 'password' => ['required', 'confirmed', new Password()],
                 'domain' => 'required',
                 'voucher' => 'max:32',
             ]
         );
 
         if ($v->fails()) {
             return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
         }
 
         // Signup via invitation
         if ($request->invitation) {
             $invitation = SignupInvitation::withEnvTenantContext()->find($request->invitation);
 
             if (empty($invitation) || $invitation->isCompleted()) {
                 return $this->errorResponse(404);
             }
 
             // Check required fields
             $v = Validator::make(
                 $request->all(),
                 [
                     'first_name' => 'max:128',
                     'last_name' => 'max:128',
                     'voucher' => 'max:32',
                 ]
             );
 
             $errors = $v->fails() ? $v->errors()->toArray() : [];
 
             if (!empty($errors)) {
                 return response()->json(['status' => 'error', 'errors' => $errors], 422);
             }
 
             $settings = [
                 'external_email' => $invitation->email,
                 'first_name' => $request->first_name,
                 'last_name' => $request->last_name,
             ];
         } else {
             // Validate verification codes (again)
             $v = $this->verify($request, false);
             if ($v->status() !== 200) {
                 return $v;
             }
 
             // Get user name/email from the verification code database
             $code_data = $v->getData();
 
             $settings = [
                 'first_name' => $code_data->first_name,
                 'last_name' => $code_data->last_name,
             ];
 
             if ($this->getPlan()->mode == 'token') {
                 $settings['signup_token'] = $code_data->email;
             } else {
                 $settings['external_email'] = $code_data->email;
             }
         }
 
         // Find the voucher discount
         if ($request->voucher) {
             $discount = Discount::where('code', \strtoupper($request->voucher))
                 ->where('active', true)->first();
 
             if (!$discount) {
                 $errors = ['voucher' => \trans('validation.voucherinvalid')];
                 return response()->json(['status' => 'error', 'errors' => $errors], 422);
             }
         }
 
         // Get the plan
         $plan = $this->getPlan();
         $is_domain = $plan->hasDomain();
 
         $login = $request->login;
         $domain_name = $request->domain;
 
         // Validate login
         if ($errors = self::validateLogin($login, $domain_name, $is_domain)) {
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         // We allow only ASCII, so we can safely lower-case the email address
         $login = Str::lower($login);
         $domain_name = Str::lower($domain_name);
         $domain = null;
 
         DB::beginTransaction();
 
         // Create domain record
         if ($is_domain) {
             $domain = Domain::create([
                     'namespace' => $domain_name,
-                    'status' => Domain::STATUS_NEW,
                     'type' => Domain::TYPE_EXTERNAL,
             ]);
         }
 
         // Create user record
         $user = User::create([
                 'email' => $login . '@' . $domain_name,
                 'password' => $request->password,
+                'status' => User::STATUS_RESTRICTED,
         ]);
 
         if (!empty($discount)) {
             $wallet = $user->wallets()->first();
             $wallet->discount()->associate($discount);
             $wallet->save();
         }
 
         $user->assignPlan($plan, $domain);
 
         // Save the external email and plan in user settings
         $user->setSettings($settings);
 
         // Update the invitation
         if (!empty($invitation)) {
             $invitation->status = SignupInvitation::STATUS_COMPLETED;
             $invitation->user_id = $user->id;
             $invitation->save();
         }
 
         // Soft-delete the verification code, and store some more info with it
         if ($request->code) {
             $request->code->user_id = $user->id;
             $request->code->submit_ip_address = $request->ip();
             $request->code->deleted_at = \now();
             $request->code->timestamps = false;
             $request->code->save();
         }
 
         DB::commit();
 
         return AuthController::logonResponse($user, $request->password);
     }
 
     /**
      * Returns plan for the signup process
      *
      * @returns \App\Plan Plan object selected for current signup process
      */
     protected function getPlan()
     {
         $request = request();
 
         if (!$request->plan || !$request->plan instanceof Plan) {
             // Get the plan if specified and exists...
             if ($request->code && $request->code->plan) {
                 $plan = Plan::withEnvTenantContext()->where('title', $request->code->plan)->first();
             } elseif ($request->plan) {
                 $plan = Plan::withEnvTenantContext()->where('title', $request->plan)->first();
             }
 
             // ...otherwise use the default plan
             if (empty($plan)) {
                 // TODO: Get default plan title from config
                 $plan = Plan::withEnvTenantContext()->where('title', 'individual')->first();
             }
 
             $request->plan = $plan;
         }
 
         return $request->plan;
     }
 
     /**
      * Login (kolab identity) validation
      *
      * @param string $login    Login (local part of an email address)
      * @param string $domain   Domain name
      * @param bool   $external Enables additional checks for domain part
      *
      * @return array Error messages on validation error
      */
     protected static function validateLogin($login, $domain, $external = false): ?array
     {
         // Validate login part alone
         $v = Validator::make(
             ['login' => $login],
             ['login' => ['required', 'string', new UserEmailLocal($external)]]
         );
 
         if ($v->fails()) {
             return ['login' => $v->errors()->toArray()['login'][0]];
         }
 
         $domains = $external ? null : Domain::getPublicDomains();
 
         // Validate the domain
         $v = Validator::make(
             ['domain' => $domain],
             ['domain' => ['required', 'string', new UserEmailDomain($domains)]]
         );
 
         if ($v->fails()) {
             return ['domain' => $v->errors()->toArray()['domain'][0]];
         }
 
         $domain = Str::lower($domain);
 
         // Check if domain is already registered with us
         if ($external) {
             if (Domain::withTrashed()->where('namespace', $domain)->exists()) {
                 return ['domain' => \trans('validation.domainexists')];
             }
         }
 
         // Check if user with specified login already exists
         $email = $login . '@' . $domain;
         if (User::emailExists($email) || User::aliasExists($email) || \App\Group::emailExists($email)) {
             return ['login' => \trans('validation.loginexists')];
         }
 
         return null;
     }
 }
diff --git a/src/app/Http/Controllers/API/V4/UsersController.php b/src/app/Http/Controllers/API/V4/UsersController.php
index 5e5613b9..ee6e32aa 100644
--- a/src/app/Http/Controllers/API/V4/UsersController.php
+++ b/src/app/Http/Controllers/API/V4/UsersController.php
@@ -1,699 +1,700 @@
 <?php
 
 namespace App\Http\Controllers\API\V4;
 
 use App\Http\Controllers\RelationController;
 use App\Domain;
 use App\Rules\Password;
 use App\Rules\UserEmailDomain;
 use App\Rules\UserEmailLocal;
 use App\Sku;
 use App\User;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Support\Str;
 
 class UsersController extends RelationController
 {
     /** @const array List of user setting keys available for modification in UI */
     public const USER_SETTINGS = [
         'billing_address',
         'country',
         'currency',
         'external_email',
         'first_name',
         'last_name',
         'organization',
         'phone',
     ];
 
     /**
      * On user create it is filled with a user or group object to force-delete
      * before the creation of a new user record is possible.
      *
      * @var \App\User|\App\Group|null
      */
     protected $deleteBeforeCreate;
 
     /** @var string Resource localization label */
     protected $label = 'user';
 
     /** @var string Resource model name */
     protected $model = User::class;
 
     /** @var array Common object properties in the API response */
     protected $objectProps = ['email'];
 
     /** @var ?\App\VerificationCode Password reset code to activate on user create/update */
     protected $passCode;
 
     /**
      * Listing of users.
      *
      * The user-entitlements billed to the current user wallet(s)
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function index()
     {
         $user = $this->guard()->user();
         $search = trim(request()->input('search'));
         $page = intval(request()->input('page')) ?: 1;
         $pageSize = 20;
         $hasMore = false;
 
         $result = $user->users();
 
         // Search by user email, alias or name
         if (strlen($search) > 0) {
             // thanks to cloning we skip some extra queries in $user->users()
             $allUsers1 = clone $result;
             $allUsers2 = clone $result;
 
             $result->whereLike('email', $search)
                 ->union(
                     $allUsers1->join('user_aliases', 'users.id', '=', 'user_aliases.user_id')
                         ->whereLike('alias', $search)
                 )
                 ->union(
                     $allUsers2->join('user_settings', 'users.id', '=', 'user_settings.user_id')
                         ->whereLike('value', $search)
                         ->whereIn('key', ['first_name', 'last_name'])
                 );
         }
 
         $result = $result->orderBy('email')
             ->limit($pageSize + 1)
             ->offset($pageSize * ($page - 1))
             ->get();
 
         if (count($result) > $pageSize) {
             $result->pop();
             $hasMore = true;
         }
 
         // Process the result
         $result = $result->map(
             function ($user) {
                 return $this->objectToClient($user);
             }
         );
 
         $result = [
             'list' => $result,
             'count' => count($result),
             'hasMore' => $hasMore,
         ];
 
         return response()->json($result);
     }
 
     /**
      * Display information on the user account specified by $id.
      *
      * @param string $id The account to show information for.
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function show($id)
     {
         $user = User::find($id);
 
         if (!$this->checkTenant($user)) {
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canRead($user)) {
             return $this->errorResponse(403);
         }
 
         $response = $this->userResponse($user);
 
         $response['skus'] = \App\Entitlement::objectEntitlementsSummary($user);
         $response['config'] = $user->getConfig();
         $response['aliases'] = $user->aliases()->pluck('alias')->all();
 
         $code = $user->verificationcodes()->where('active', true)
             ->where('expires_at', '>', \Carbon\Carbon::now())
             ->first();
 
         if ($code) {
             $response['passwordLinkCode'] = $code->short_code . '-' . $code->code;
         }
 
         return response()->json($response);
     }
 
     /**
      * User status (extended) information
      *
      * @param \App\User $user User object
      *
      * @return array Status information
      */
     public static function statusInfo($user): array
     {
         $process = self::processStateInfo(
             $user,
             [
                 'user-new' => true,
                 'user-ldap-ready' => $user->isLdapReady(),
                 'user-imap-ready' => $user->isImapReady(),
             ]
         );
 
         // Check if the user is a controller of his wallet
         $isController = $user->canDelete($user);
 
         $isDegraded = $user->isDegraded();
         $hasMeet = !$isDegraded && Sku::withObjectTenantContext($user)->where('title', 'room')->exists();
         $hasCustomDomain = $user->wallet()->entitlements()
             ->where('entitleable_type', Domain::class)
             ->count() > 0;
 
         // Get user's entitlements titles
         $skus = $user->entitlements()->select('skus.title')
             ->join('skus', 'skus.id', '=', 'entitlements.sku_id')
             ->get()
             ->pluck('title')
             ->sort()
             ->unique()
             ->values()
             ->all();
 
         $hasBeta = in_array('beta', $skus);
 
         $result = [
             'skus' => $skus,
             'enableBeta' => in_array('beta', $skus),
             // TODO: This will change when we enable all users to create domains
             'enableDomains' => $isController && $hasCustomDomain,
             // TODO: Make 'enableDistlists' working for wallet controllers that aren't account owners
             'enableDistlists' => $isController && $hasCustomDomain && $hasBeta,
             'enableFiles' => !$isDegraded && $hasBeta && \config('app.with_files'),
             // TODO: Make 'enableFolders' working for wallet controllers that aren't account owners
             'enableFolders' => $isController && $hasCustomDomain && $hasBeta,
             // TODO: Make 'enableResources' working for wallet controllers that aren't account owners
             'enableResources' => $isController && $hasCustomDomain && $hasBeta,
             'enableRooms' => $hasMeet,
             'enableSettings' => $isController,
             'enableUsers' => $isController,
             'enableWallets' => $isController,
             'enableCompanionapps' => $hasBeta,
         ];
 
         return array_merge($process, $result);
     }
 
     /**
      * Create a new user record.
      *
      * @param \Illuminate\Http\Request $request The API request.
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function store(Request $request)
     {
         $current_user = $this->guard()->user();
         $owner = $current_user->walletOwner();
 
         if ($owner->id != $current_user->id) {
             return $this->errorResponse(403);
         }
 
         $this->deleteBeforeCreate = null;
 
         if ($error_response = $this->validateUserRequest($request, null, $settings)) {
             return $error_response;
         }
 
         if (empty($request->package) || !($package = \App\Package::withEnvTenantContext()->find($request->package))) {
             $errors = ['package' => \trans('validation.packagerequired')];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         if ($package->isDomain()) {
             $errors = ['package' => \trans('validation.packageinvalid')];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         DB::beginTransaction();
 
         // @phpstan-ignore-next-line
         if ($this->deleteBeforeCreate) {
             $this->deleteBeforeCreate->forceDelete();
         }
 
         // Create user record
         $user = User::create([
                 'email' => $request->email,
                 'password' => $request->password,
+                'status' => $owner->isRestricted() ? User::STATUS_RESTRICTED : 0,
         ]);
 
         $this->activatePassCode($user);
 
         $owner->assignPackage($package, $user);
 
         if (!empty($settings)) {
             $user->setSettings($settings);
         }
 
         if (!empty($request->aliases)) {
             $user->setAliases($request->aliases);
         }
 
         DB::commit();
 
         return response()->json([
                 'status' => 'success',
                 'message' => \trans('app.user-create-success'),
         ]);
     }
 
     /**
      * Update user data.
      *
      * @param \Illuminate\Http\Request $request The API request.
      * @param string                   $id      User identifier
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function update(Request $request, $id)
     {
         $user = User::withEnvTenantContext()->find($id);
 
         if (empty($user)) {
             return $this->errorResponse(404);
         }
 
         $current_user = $this->guard()->user();
 
         // TODO: Decide what attributes a user can change on his own profile
         if (!$current_user->canUpdate($user)) {
             return $this->errorResponse(403);
         }
 
         if ($error_response = $this->validateUserRequest($request, $user, $settings)) {
             return $error_response;
         }
 
         // Entitlements, only controller can do that
         if ($request->skus !== null && !$current_user->canDelete($user)) {
             return $this->errorResponse(422, "You have no permission to change entitlements");
         }
 
         DB::beginTransaction();
 
         SkusController::updateEntitlements($user, $request->skus);
 
         if (!empty($settings)) {
             $user->setSettings($settings);
         }
 
         if (!empty($request->password)) {
             $user->password = $request->password;
             $user->save();
         }
 
         $this->activatePassCode($user);
 
         if (isset($request->aliases)) {
             $user->setAliases($request->aliases);
         }
 
         DB::commit();
 
         $response = [
             'status' => 'success',
             'message' => \trans('app.user-update-success'),
         ];
 
         // For self-update refresh the statusInfo in the UI
         if ($user->id == $current_user->id) {
             $response['statusInfo'] = self::statusInfo($user);
         }
 
         return response()->json($response);
     }
 
     /**
      * Create a response data array for specified user.
      *
      * @param \App\User $user User object
      *
      * @return array Response data
      */
     public static function userResponse(User $user): array
     {
         $response = array_merge($user->toArray(), self::objectState($user));
 
         // Settings
         $response['settings'] = [];
         foreach ($user->settings()->whereIn('key', self::USER_SETTINGS)->get() as $item) {
             $response['settings'][$item->key] = $item->value;
         }
 
         // Status info
         $response['statusInfo'] = self::statusInfo($user);
 
         // Add more info to the wallet object output
         $map_func = function ($wallet) use ($user) {
             $result = $wallet->toArray();
 
             if ($wallet->discount) {
                 $result['discount'] = $wallet->discount->discount;
                 $result['discount_description'] = $wallet->discount->description;
             }
 
             if ($wallet->user_id != $user->id) {
                 $result['user_email'] = $wallet->owner->email;
             }
 
             $provider = \App\Providers\PaymentProvider::factory($wallet);
             $result['provider'] = $provider->name();
 
             return $result;
         };
 
         // Information about wallets and accounts for access checks
         $response['wallets'] = $user->wallets->map($map_func)->toArray();
         $response['accounts'] = $user->accounts->map($map_func)->toArray();
         $response['wallet'] = $map_func($user->wallet());
 
         return $response;
     }
 
     /**
      * Prepare user statuses for the UI
      *
      * @param \App\User $user User object
      *
      * @return array Statuses array
      */
     protected static function objectState($user): array
     {
         $state = parent::objectState($user);
 
         $state['isAccountDegraded'] = $user->isDegraded(true);
 
         return $state;
     }
 
     /**
      * Validate user input
      *
      * @param \Illuminate\Http\Request $request  The API request.
      * @param \App\User|null           $user     User identifier
      * @param array                    $settings User settings (from the request)
      *
      * @return \Illuminate\Http\JsonResponse|null The error response on error
      */
     protected function validateUserRequest(Request $request, $user, &$settings = [])
     {
         $rules = [
             'external_email' => 'nullable|email',
             'phone' => 'string|nullable|max:64|regex:/^[0-9+() -]+$/',
             'first_name' => 'string|nullable|max:128',
             'last_name' => 'string|nullable|max:128',
             'organization' => 'string|nullable|max:512',
             'billing_address' => 'string|nullable|max:1024',
             'country' => 'string|nullable|alpha|size:2',
             'currency' => 'string|nullable|alpha|size:3',
             'aliases' => 'array|nullable',
         ];
 
         $controller = ($user ?: $this->guard()->user())->walletOwner();
 
         // Handle generated password reset code
         if ($code = $request->input('passwordLinkCode')) {
             // Accept <short-code>-<code> input
             if (strpos($code, '-')) {
                 $code = explode('-', $code)[1];
             }
 
             $this->passCode = $this->guard()->user()->verificationcodes()
                 ->where('code', $code)->where('active', false)->first();
 
             // Generate a password for a new user with password reset link
             // FIXME: Should/can we have a user with no password set?
             if ($this->passCode && empty($user)) {
                 $request->password = $request->password_confirmation = Str::random(16);
                 $ignorePassword = true;
             }
         }
 
         if (empty($user) || !empty($request->password) || !empty($request->password_confirmation)) {
             if (empty($ignorePassword)) {
                 $rules['password'] = ['required', 'confirmed', new Password($controller)];
             }
         }
 
         $errors = [];
 
         // Validate input
         $v = Validator::make($request->all(), $rules);
 
         if ($v->fails()) {
             $errors = $v->errors()->toArray();
         }
 
         // For new user validate email address
         if (empty($user)) {
             $email = $request->email;
 
             if (empty($email)) {
                 $errors['email'] = \trans('validation.required', ['attribute' => 'email']);
             } elseif ($error = self::validateEmail($email, $controller, $this->deleteBeforeCreate)) {
                 $errors['email'] = $error;
             }
         }
 
         // Validate aliases input
         if (isset($request->aliases)) {
             $aliases = [];
             $existing_aliases = $user ? $user->aliases()->get()->pluck('alias')->toArray() : [];
 
             foreach ($request->aliases as $idx => $alias) {
                 if (is_string($alias) && !empty($alias)) {
                     // Alias cannot be the same as the email address (new user)
                     if (!empty($email) && Str::lower($alias) == Str::lower($email)) {
                         continue;
                     }
 
                     // validate new aliases
                     if (
                         !in_array($alias, $existing_aliases)
                         && ($error = self::validateAlias($alias, $controller))
                     ) {
                         if (!isset($errors['aliases'])) {
                             $errors['aliases'] = [];
                         }
                         $errors['aliases'][$idx] = $error;
                         continue;
                     }
 
                     $aliases[] = $alias;
                 }
             }
 
             $request->aliases = $aliases;
         }
 
         if (!empty($errors)) {
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         // Update user settings
         $settings = $request->only(array_keys($rules));
         unset($settings['password'], $settings['aliases'], $settings['email']);
 
         return null;
     }
 
     /**
      * Execute (synchronously) specified step in a user setup process.
      *
      * @param \App\User $user User object
      * @param string    $step Step identifier (as in self::statusInfo())
      *
      * @return bool|null True if the execution succeeded, False if not, Null when
      *                   the job has been sent to the worker (result unknown)
      */
     public static function execProcessStep(User $user, string $step): ?bool
     {
         try {
             if (strpos($step, 'domain-') === 0) {
                 return DomainsController::execProcessStep($user->domain(), $step);
             }
 
             switch ($step) {
                 case 'user-ldap-ready':
                 case 'user-imap-ready':
                     // Use worker to do the job, frontend might not have the IMAP admin credentials
                     \App\Jobs\User\CreateJob::dispatch($user->id);
                     return null;
             }
         } catch (\Exception $e) {
             \Log::error($e);
         }
 
         return false;
     }
 
     /**
      * Email address validation for use as a user mailbox (login).
      *
      * @param string                    $email   Email address
      * @param \App\User                 $user    The account owner
      * @param null|\App\User|\App\Group $deleted Filled with an instance of a deleted user or group
      *                                           with the specified email address, if exists
      *
      * @return ?string Error message on validation error
      */
     public static function validateEmail(string $email, \App\User $user, &$deleted = null): ?string
     {
         $deleted = null;
 
         if (strpos($email, '@') === false) {
             return \trans('validation.entryinvalid', ['attribute' => 'email']);
         }
 
         list($login, $domain) = explode('@', Str::lower($email));
 
         if (strlen($login) === 0 || strlen($domain) === 0) {
             return \trans('validation.entryinvalid', ['attribute' => 'email']);
         }
 
         // Check if domain exists
         $domain = Domain::withObjectTenantContext($user)->where('namespace', $domain)->first();
 
         if (empty($domain)) {
             return \trans('validation.domaininvalid');
         }
 
         // Validate login part alone
         $v = Validator::make(
             ['email' => $login],
             ['email' => ['required', new UserEmailLocal(!$domain->isPublic())]]
         );
 
         if ($v->fails()) {
             return $v->errors()->toArray()['email'][0];
         }
 
         // Check if it is one of domains available to the user
         if (!$domain->isPublic() && $user->id != $domain->walletOwner()->id) {
             return \trans('validation.entryexists', ['attribute' => 'domain']);
         }
 
         // Check if a user/group/resource/shared folder with specified address already exists
         if (
             ($existing = User::emailExists($email, true))
             || ($existing = \App\Group::emailExists($email, true))
             || ($existing = \App\Resource::emailExists($email, true))
             || ($existing = \App\SharedFolder::emailExists($email, true))
         ) {
             // If this is a deleted user/group/resource/folder in the same custom domain
             // we'll force delete it before creating the target user
             if (!$domain->isPublic() && $existing->trashed()) {
                 $deleted = $existing;
             } else {
                 return \trans('validation.entryexists', ['attribute' => 'email']);
             }
         }
 
         // Check if an alias with specified address already exists.
         if (User::aliasExists($email) || \App\SharedFolder::aliasExists($email)) {
             return \trans('validation.entryexists', ['attribute' => 'email']);
         }
 
         return null;
     }
 
     /**
      * Email address validation for use as an alias.
      *
      * @param string    $email Email address
      * @param \App\User $user  The account owner
      *
      * @return ?string Error message on validation error
      */
     public static function validateAlias(string $email, \App\User $user): ?string
     {
         if (strpos($email, '@') === false) {
             return \trans('validation.entryinvalid', ['attribute' => 'alias']);
         }
 
         list($login, $domain) = explode('@', Str::lower($email));
 
         if (strlen($login) === 0 || strlen($domain) === 0) {
             return \trans('validation.entryinvalid', ['attribute' => 'alias']);
         }
 
         // Check if domain exists
         $domain = Domain::withObjectTenantContext($user)->where('namespace', $domain)->first();
 
         if (empty($domain)) {
             return \trans('validation.domaininvalid');
         }
 
         // Validate login part alone
         $v = Validator::make(
             ['alias' => $login],
             ['alias' => ['required', new UserEmailLocal(!$domain->isPublic())]]
         );
 
         if ($v->fails()) {
             return $v->errors()->toArray()['alias'][0];
         }
 
         // Check if it is one of domains available to the user
         if (!$domain->isPublic() && $user->id != $domain->walletOwner()->id) {
             return \trans('validation.entryexists', ['attribute' => 'domain']);
         }
 
         // Check if a user with specified address already exists
         if ($existing_user = User::emailExists($email, true)) {
             // Allow an alias in a custom domain to an address that was a user before
             if ($domain->isPublic() || !$existing_user->trashed()) {
                 return \trans('validation.entryexists', ['attribute' => 'alias']);
             }
         }
 
         // Check if a group/resource/shared folder with specified address already exists
         if (
             \App\Group::emailExists($email)
             || \App\Resource::emailExists($email)
             || \App\SharedFolder::emailExists($email)
         ) {
             return \trans('validation.entryexists', ['attribute' => 'alias']);
         }
 
         // Check if an alias with specified address already exists
         if (User::aliasExists($email) || \App\SharedFolder::aliasExists($email)) {
             // Allow assigning the same alias to a user in the same group account,
             // but only for non-public domains
             if ($domain->isPublic()) {
                 return \trans('validation.entryexists', ['attribute' => 'alias']);
             }
         }
 
         return null;
     }
 
     /**
      * Activate password reset code (if set), and assign it to a user.
      *
      * @param \App\User $user The user
      */
     protected function activatePassCode(User $user): void
     {
         // Activate the password reset code
         if ($this->passCode) {
             $this->passCode->user_id = $user->id;
             $this->passCode->active = true;
             $this->passCode->save();
         }
     }
 }
diff --git a/src/app/Observers/WalletObserver.php b/src/app/Observers/WalletObserver.php
index 46877c7f..201716aa 100644
--- a/src/app/Observers/WalletObserver.php
+++ b/src/app/Observers/WalletObserver.php
@@ -1,111 +1,122 @@
 <?php
 
 namespace App\Observers;
 
+use App\User;
 use App\Wallet;
 
 /**
  * This is an observer for the Wallet model definition.
  */
 class WalletObserver
 {
     /**
      * Ensure the wallet ID is a custom ID (uuid).
      *
      * @param Wallet $wallet
      *
      * @return void
      */
     public function creating(Wallet $wallet)
     {
         $wallet->currency = \config('app.currency');
     }
 
     /**
      * Handle the wallet "deleting" event.
      *
      * Ensures that a wallet with a non-zero balance can not be deleted.
      *
      * Ensures that the wallet being deleted is not the last wallet for the user.
      *
      * Ensures that no entitlements are being billed to the wallet currently.
      *
      * @param Wallet $wallet The wallet being deleted.
      *
      * @return bool
      */
     public function deleting(Wallet $wallet): bool
     {
         // can't delete a wallet that has any balance on it (positive and negative).
         if ($wallet->balance != 0.00) {
             return false;
         }
 
         if (!$wallet->owner) {
             throw new \Exception("Wallet: " . var_export($wallet, true));
         }
 
         // can't remove the last wallet for the owner.
         if ($wallet->owner->wallets()->count() <= 1) {
             return false;
         }
 
         // can't remove a wallet that has billable entitlements attached.
         if ($wallet->entitlements()->count() > 0) {
             return false;
         }
 /*
         // can't remove a wallet that has payments attached.
         if ($wallet->payments()->count() > 0) {
             return false;
         }
 */
 
         return true;
     }
 
     /**
      * Handle the wallet "updated" event.
      *
      * @param \App\Wallet $wallet The wallet.
      *
      * @return void
      */
     public function updated(Wallet $wallet)
     {
         $negative_since = $wallet->getSetting('balance_negative_since');
 
         if ($wallet->balance < 0) {
             if (!$negative_since) {
                 $now = \Carbon\Carbon::now()->toDateTimeString();
                 $wallet->setSetting('balance_negative_since', $now);
             }
         } elseif ($negative_since) {
             $wallet->setSettings([
                     'balance_negative_since' => null,
                     'balance_warning_initial' => null,
                     'balance_warning_reminder' => null,
                     'balance_warning_suspended' => null,
                     'balance_warning_before_delete' => null,
             ]);
 
             // FIXME: Since we use account degradation, should we leave suspended state untouched?
 
             // Un-suspend and un-degrade the account owner
             if ($wallet->owner) {
                 $wallet->owner->unsuspend();
                 $wallet->owner->undegrade();
             }
 
             // Un-suspend domains/users
             foreach ($wallet->entitlements as $entitlement) {
                 if (
                     method_exists($entitlement->entitleable_type, 'unsuspend')
                     && !empty($entitlement->entitleable)
                 ) {
                     $entitlement->entitleable->unsuspend();
                 }
             }
         }
+
+        // Remove RESTRICTED flag from the wallet owner and all users in the wallet
+        if ($wallet->balance > $wallet->getOriginal('balance') && $wallet->owner && $wallet->owner->isRestricted()) {
+            $wallet->owner->unrestrict();
+
+            User::whereIn('id', $wallet->entitlements()->select('entitleable_id')->where('entitleable_type', User::class))
+                ->each(function ($user) {
+                    $user->unrestrict();
+                });
+        }
     }
 }
diff --git a/src/app/User.php b/src/app/User.php
index 24e536d9..3d840c99 100644
--- a/src/app/User.php
+++ b/src/app/User.php
@@ -1,807 +1,850 @@
 <?php
 
 namespace App;
 
 use App\AuthAttempt;
 use App\Traits\AliasesTrait;
 use App\Traits\BelongsToTenantTrait;
 use App\Traits\EntitleableTrait;
 use App\Traits\EmailPropertyTrait;
 use App\Traits\UserConfigTrait;
 use App\Traits\UuidIntKeyTrait;
 use App\Traits\SettingsTrait;
 use App\Traits\StatusPropertyTrait;
 use Dyrynda\Database\Support\NullableFields;
 use Illuminate\Database\Eloquent\SoftDeletes;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Laravel\Passport\HasApiTokens;
 use League\OAuth2\Server\Exception\OAuthServerException;
 
 /**
  * The eloquent definition of a User.
  *
  * @property string $email
  * @property int    $id
  * @property string $password
  * @property string $password_ldap
  * @property string $role
  * @property int    $status
  * @property int    $tenant_id
  */
 class User extends Authenticatable
 {
     use AliasesTrait;
     use BelongsToTenantTrait;
     use EntitleableTrait;
     use EmailPropertyTrait;
     use HasApiTokens;
     use NullableFields;
     use UserConfigTrait;
     use UuidIntKeyTrait;
     use SettingsTrait;
     use SoftDeletes;
     use StatusPropertyTrait;
 
     // a new user, default on creation
     public const STATUS_NEW        = 1 << 0;
     // it's been activated
     public const STATUS_ACTIVE     = 1 << 1;
     // user has been suspended
     public const STATUS_SUSPENDED  = 1 << 2;
     // user has been deleted
     public const STATUS_DELETED    = 1 << 3;
     // user has been created in LDAP
     public const STATUS_LDAP_READY = 1 << 4;
     // user mailbox has been created in IMAP
     public const STATUS_IMAP_READY = 1 << 5;
     // user in "limited feature-set" state
     public const STATUS_DEGRADED   = 1 << 6;
+    // a restricted user
+    public const STATUS_RESTRICTED = 1 << 7;
 
     /** @var array<int, string> The attributes that are mass assignable */
     protected $fillable = [
         'id',
         'email',
         'password',
         'password_ldap',
         'status',
     ];
 
     /** @var array<int, string> The attributes that should be hidden for arrays */
     protected $hidden = [
         'password',
         'password_ldap',
         'role'
     ];
 
     /** @var array<int, string> The attributes that can be null */
     protected $nullable = [
         'password',
         'password_ldap'
     ];
 
     /** @var array<string, string> The attributes that should be cast */
     protected $casts = [
         'created_at' => 'datetime:Y-m-d H:i:s',
         'deleted_at' => 'datetime:Y-m-d H:i:s',
         'updated_at' => 'datetime:Y-m-d H:i:s',
     ];
 
     /**
      * Any wallets on which this user is a controller.
      *
      * This does not include wallets owned by the user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
      */
     public function accounts()
     {
         return $this->belongsToMany(
             Wallet::class,      // The foreign object definition
             'user_accounts',    // The table name
             'user_id',          // The local foreign key
             'wallet_id'         // The remote foreign key
         );
     }
 
     /**
      * Assign a package to a user. The user should not have any existing entitlements.
      *
      * @param \App\Package   $package The package to assign.
      * @param \App\User|null $user    Assign the package to another user.
      *
      * @return \App\User
      */
     public function assignPackage($package, $user = null)
     {
         if (!$user) {
             $user = $this;
         }
 
         return $user->assignPackageAndWallet($package, $this->wallets()->first());
     }
 
     /**
      * Assign a package plan to a user.
      *
      * @param \App\Plan   $plan   The plan to assign
      * @param \App\Domain $domain Optional domain object
      *
      * @return \App\User Self
      */
     public function assignPlan($plan, $domain = null): User
     {
         $this->setSetting('plan_id', $plan->id);
 
         foreach ($plan->packages as $package) {
             if ($package->isDomain()) {
                 $domain->assignPackage($package, $this);
             } else {
                 $this->assignPackage($package);
             }
         }
 
         return $this;
     }
 
     /**
      * Check if current user can delete another object.
      *
      * @param mixed $object A user|domain|wallet|group object
      *
      * @return bool True if he can, False otherwise
      */
     public function canDelete($object): bool
     {
-        if (!method_exists($object, 'wallet')) {
+        if (!is_object($object) || !method_exists($object, 'wallet')) {
             return false;
         }
 
         $wallet = $object->wallet();
 
         // TODO: For now controller can delete/update the account owner,
         //       this may change in future, controllers are not 0-regression feature
 
         return $wallet && ($wallet->user_id == $this->id || $this->accounts->contains($wallet));
     }
 
     /**
      * Check if current user can read data of another object.
      *
      * @param mixed $object A user|domain|wallet|group object
      *
      * @return bool True if he can, False otherwise
      */
     public function canRead($object): bool
     {
         if ($this->role == 'admin') {
             return true;
         }
 
         if ($object instanceof User && $this->id == $object->id) {
             return true;
         }
 
         if ($this->role == 'reseller') {
             if ($object instanceof User && $object->role == 'admin') {
                 return false;
             }
 
             if ($object instanceof Wallet && !empty($object->owner)) {
                 $object = $object->owner;
             }
 
             return isset($object->tenant_id) && $object->tenant_id == $this->tenant_id;
         }
 
         if ($object instanceof Wallet) {
             return $object->user_id == $this->id || $object->controllers->contains($this);
         }
 
         if (!method_exists($object, 'wallet')) {
             return false;
         }
 
         $wallet = $object->wallet();
 
         return $wallet && ($wallet->user_id == $this->id || $this->accounts->contains($wallet));
     }
 
     /**
      * Check if current user can update data of another object.
      *
      * @param mixed $object A user|domain|wallet|group object
      *
      * @return bool True if he can, False otherwise
      */
     public function canUpdate($object): bool
     {
         if ($object instanceof User && $this->id == $object->id) {
             return true;
         }
 
         if ($this->role == 'admin') {
             return true;
         }
 
         if ($this->role == 'reseller') {
             if ($object instanceof User && $object->role == 'admin') {
                 return false;
             }
 
             if ($object instanceof Wallet && !empty($object->owner)) {
                 $object = $object->owner;
             }
 
             return isset($object->tenant_id) && $object->tenant_id == $this->tenant_id;
         }
 
         return $this->canDelete($object);
     }
 
     /**
      * Degrade the user
      *
      * @return void
      */
     public function degrade(): void
     {
         if ($this->isDegraded()) {
             return;
         }
 
         $this->status |= User::STATUS_DEGRADED;
         $this->save();
     }
 
     /**
      * List the domains to which this user is entitled.
      *
      * @param bool $with_accounts Include domains assigned to wallets
      *                            the current user controls but not owns.
      * @param bool $with_public   Include active public domains (for the user tenant).
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function domains($with_accounts = true, $with_public = true)
     {
         $domains = $this->entitleables(Domain::class, $with_accounts);
 
         if ($with_public) {
             $domains->orWhere(function ($query) {
                 if (!$this->tenant_id) {
                     $query->where('tenant_id', $this->tenant_id);
                 } else {
                     $query->withEnvTenantContext();
                 }
 
                 $query->where('domains.type', '&', Domain::TYPE_PUBLIC)
                     ->where('domains.status', '&', Domain::STATUS_ACTIVE);
             });
         }
 
         return $domains;
     }
 
     /**
      * Return entitleable objects of a specified type controlled by the current user.
      *
      * @param string $class         Object class
      * @param bool   $with_accounts Include objects assigned to wallets
      *                              the current user controls, but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     private function entitleables(string $class, bool $with_accounts = true)
     {
         $wallets = $this->wallets()->pluck('id')->all();
 
         if ($with_accounts) {
             $wallets = array_merge($wallets, $this->accounts()->pluck('wallet_id')->all());
         }
 
         $object = new $class();
         $table = $object->getTable();
 
         return $object->select("{$table}.*")
             ->whereExists(function ($query) use ($table, $wallets, $class) {
                 $query->select(DB::raw(1))
                     ->from('entitlements')
                     ->whereColumn('entitleable_id', "{$table}.id")
                     ->whereIn('entitlements.wallet_id', $wallets)
                     ->where('entitlements.entitleable_type', $class);
             });
     }
 
     /**
      * Helper to find user by email address, whether it is
      * main email address, alias or an external email.
      *
      * If there's more than one alias NULL will be returned.
      *
      * @param string $email    Email address
      * @param bool   $external Search also for an external email
      *
      * @return \App\User|null User model object if found
      */
     public static function findByEmail(string $email, bool $external = false): ?User
     {
         if (strpos($email, '@') === false) {
             return null;
         }
 
         $email = \strtolower($email);
 
         $user = self::where('email', $email)->first();
 
         if ($user) {
             return $user;
         }
 
         $aliases = UserAlias::where('alias', $email)->get();
 
         if (count($aliases) == 1) {
             return $aliases->first()->user;
         }
 
         // TODO: External email
 
         return null;
     }
 
     /**
      * Storage items for this user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function fsItems()
     {
         return $this->hasMany(Fs\Item::class);
     }
 
     /**
      * Return groups controlled by the current user.
      *
      * @param bool $with_accounts Include groups assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function groups($with_accounts = true)
     {
         return $this->entitleables(Group::class, $with_accounts);
     }
 
     /**
      * Returns whether this user (or its wallet owner) is degraded.
      *
      * @param bool $owner Check also the wallet owner instead just the user himself
      *
      * @return bool
      */
     public function isDegraded(bool $owner = false): bool
     {
         if ($this->status & self::STATUS_DEGRADED) {
             return true;
         }
 
         if ($owner && ($wallet = $this->wallet())) {
             return $wallet->owner && $wallet->owner->isDegraded();
         }
 
         return false;
     }
 
+    /**
+     * Returns whether this user is restricted.
+     *
+     * @return bool
+     */
+    public function isRestricted(): bool
+    {
+        return ($this->status & self::STATUS_RESTRICTED) > 0;
+    }
+
     /**
      * A shortcut to get the user name.
      *
      * @param bool $fallback Return "<aa.name> User" if there's no name
      *
      * @return string Full user name
      */
     public function name(bool $fallback = false): string
     {
         $settings = $this->getSettings(['first_name', 'last_name']);
 
         $name = trim($settings['first_name'] . ' ' . $settings['last_name']);
 
         if (empty($name) && $fallback) {
             return trim(\trans('app.siteuser', ['site' => Tenant::getConfig($this->tenant_id, 'app.name')]));
         }
 
         return $name;
     }
 
     /**
      * Old passwords for this user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function passwords()
     {
         return $this->hasMany(UserPassword::class);
     }
 
+    /**
+     * Restrict this user.
+     *
+     * @return void
+     */
+    public function restrict(): void
+    {
+        if ($this->isRestricted()) {
+            return;
+        }
+
+        $this->status |= User::STATUS_RESTRICTED;
+        $this->save();
+    }
+
     /**
      * Return resources controlled by the current user.
      *
      * @param bool $with_accounts Include resources assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function resources($with_accounts = true)
     {
         return $this->entitleables(Resource::class, $with_accounts);
     }
 
     /**
      * Return rooms controlled by the current user.
      *
      * @param bool $with_accounts Include rooms assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function rooms($with_accounts = true)
     {
         return $this->entitleables(Meet\Room::class, $with_accounts);
     }
 
     /**
      * Return shared folders controlled by the current user.
      *
      * @param bool $with_accounts Include folders assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function sharedFolders($with_accounts = true)
     {
         return $this->entitleables(SharedFolder::class, $with_accounts);
     }
 
     public function senderPolicyFrameworkWhitelist($clientName)
     {
         $setting = $this->getSetting('spf_whitelist');
 
         if (!$setting) {
             return false;
         }
 
         $whitelist = json_decode($setting);
 
         $matchFound = false;
 
         foreach ($whitelist as $entry) {
             if (substr($entry, 0, 1) == '/') {
                 $match = preg_match($entry, $clientName);
 
                 if ($match) {
                     $matchFound = true;
                 }
 
                 continue;
             }
 
             if (substr($entry, 0, 1) == '.') {
                 if (substr($clientName, (-1 * strlen($entry))) == $entry) {
                     $matchFound = true;
                 }
 
                 continue;
             }
 
             if ($entry == $clientName) {
                 $matchFound = true;
                 continue;
             }
         }
 
         return $matchFound;
     }
 
     /**
      * Un-degrade this user.
      *
      * @return void
      */
     public function undegrade(): void
     {
         if (!$this->isDegraded()) {
             return;
         }
 
         $this->status ^= User::STATUS_DEGRADED;
         $this->save();
     }
 
+    /**
+     * Un-restrict this user.
+     *
+     * @return void
+     */
+    public function unrestrict(): void
+    {
+        if (!$this->isRestricted()) {
+            return;
+        }
+
+        $this->status ^= User::STATUS_RESTRICTED;
+        $this->save();
+    }
+
     /**
      * Return users controlled by the current user.
      *
      * @param bool $with_accounts Include users assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function users($with_accounts = true)
     {
         return $this->entitleables(User::class, $with_accounts);
     }
 
     /**
      * Verification codes for this user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function verificationcodes()
     {
         return $this->hasMany(VerificationCode::class, 'user_id', 'id');
     }
 
     /**
      * Wallets this user owns.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function wallets()
     {
         return $this->hasMany(Wallet::class);
     }
 
     /**
      * User password mutator
      *
      * @param string $password The password in plain text.
      *
      * @return void
      */
     public function setPasswordAttribute($password)
     {
         if (!empty($password)) {
             $this->attributes['password'] = Hash::make($password);
             $this->attributes['password_ldap'] = '{SSHA512}' . base64_encode(
                 pack('H*', hash('sha512', $password))
             );
         }
     }
 
     /**
      * User LDAP password mutator
      *
      * @param string $password The password in plain text.
      *
      * @return void
      */
     public function setPasswordLdapAttribute($password)
     {
         $this->setPasswordAttribute($password);
     }
 
     /**
      * User status mutator
      *
      * @throws \Exception
      */
     public function setStatusAttribute($status)
     {
         $new_status = 0;
 
         $allowed_values = [
             self::STATUS_NEW,
             self::STATUS_ACTIVE,
             self::STATUS_SUSPENDED,
             self::STATUS_DELETED,
             self::STATUS_LDAP_READY,
             self::STATUS_IMAP_READY,
             self::STATUS_DEGRADED,
+            self::STATUS_RESTRICTED,
         ];
 
         foreach ($allowed_values as $value) {
             if ($status & $value) {
                 $new_status |= $value;
                 $status ^= $value;
             }
         }
 
         if ($status > 0) {
             throw new \Exception("Invalid user status: {$status}");
         }
 
         $this->attributes['status'] = $new_status;
     }
 
     /**
      * Validate the user credentials
      *
      * @param string $username       The username.
      * @param string $password       The password in plain text.
      * @param bool   $updatePassword Store the password if currently empty
      *
      * @return bool true on success
      */
     public function validateCredentials(string $username, string $password, bool $updatePassword = true): bool
     {
         $authenticated = false;
 
         if ($this->email === \strtolower($username)) {
             if (!empty($this->password)) {
                 if (Hash::check($password, $this->password)) {
                     $authenticated = true;
                 }
             } elseif (!empty($this->password_ldap)) {
                 if (substr($this->password_ldap, 0, 6) == "{SSHA}") {
                     $salt = substr(base64_decode(substr($this->password_ldap, 6)), 20);
 
                     $hash = '{SSHA}' . base64_encode(
                         sha1($password . $salt, true) . $salt
                     );
 
                     if ($hash == $this->password_ldap) {
                         $authenticated = true;
                     }
                 } elseif (substr($this->password_ldap, 0, 9) == "{SSHA512}") {
                     $salt = substr(base64_decode(substr($this->password_ldap, 9)), 64);
 
                     $hash = '{SSHA512}' . base64_encode(
                         pack('H*', hash('sha512', $password . $salt)) . $salt
                     );
 
                     if ($hash == $this->password_ldap) {
                         $authenticated = true;
                     }
                 }
             } else {
                 \Log::error("Incomplete credentials for {$this->email}");
             }
         }
 
         if ($authenticated) {
             // TODO: update last login time
             if ($updatePassword && (empty($this->password) || empty($this->password_ldap))) {
                 $this->password = $password;
                 $this->save();
             }
         }
 
         return $authenticated;
     }
 
     /**
      * Validate request location regarding geo-lockin
      *
      * @param string $ip IP address to check, usually request()->ip()
      *
      * @return bool
      */
     public function validateLocation($ip): bool
     {
         $countryCodes = json_decode($this->getSetting('limit_geo', "[]"));
 
         if (empty($countryCodes)) {
             return true;
         }
 
         return in_array(\App\Utils::countryForIP($ip), $countryCodes);
     }
 
     /**
      * Check if multi factor verification is enabled
      *
      * @return bool
      */
     public function mfaEnabled(): bool
     {
         return \App\CompanionApp::where('user_id', $this->id)
             ->where('mfa_enabled', true)
             ->exists();
     }
 
     /**
      * Retrieve and authenticate a user
      *
      * @param string  $username The username
      * @param string  $password The password in plain text
      * @param ?string $clientIP The IP address of the client
      *
      * @return array ['user', 'reason', 'errorMessage']
      */
     public static function findAndAuthenticate($username, $password, $clientIP = null, $verifyMFA = true): array
     {
         $error = null;
 
         if (!$clientIP) {
             $clientIP = request()->ip();
         }
 
         $user = User::where('email', $username)->first();
 
         if (!$user) {
             $error = AuthAttempt::REASON_NOTFOUND;
         }
 
         // Check user password
         if (!$error && !$user->validateCredentials($username, $password)) {
             $error = AuthAttempt::REASON_PASSWORD;
         }
 
         if ($verifyMFA) {
             // Check user (request) location
             if (!$error && !$user->validateLocation($clientIP)) {
                 $error = AuthAttempt::REASON_GEOLOCATION;
             }
 
             // Check 2FA
             if (!$error) {
                 try {
                     (new \App\Auth\SecondFactor($user))->validate(request()->secondfactor);
                 } catch (\Exception $e) {
                     $error = AuthAttempt::REASON_2FA_GENERIC;
                     $message = $e->getMessage();
                 }
             }
 
             // Check 2FA - Companion App
             if (!$error && $user->mfaEnabled()) {
                 $attempt = \App\AuthAttempt::recordAuthAttempt($user, $clientIP);
                 if (!$attempt->waitFor2FA()) {
                     $error = AuthAttempt::REASON_2FA;
                 }
             }
         }
 
         if ($error) {
             if ($user && empty($attempt)) {
                 $attempt = \App\AuthAttempt::recordAuthAttempt($user, $clientIP);
                 if (!$attempt->isAccepted()) {
                     $attempt->deny($error);
                     $attempt->save();
                     $attempt->notify();
                 }
             }
 
             if ($user) {
                 \Log::info("Authentication failed for {$user->email}");
             }
 
             return ['reason' => $error, 'errorMessage' => $message ?? \trans("auth.error.{$error}")];
         }
 
         \Log::info("Successful authentication for {$user->email}");
 
         return ['user' => $user];
     }
 
     /**
      * Hook for passport
      *
      * @throws \Throwable
      *
      * @return \App\User User model object if found
      */
     public static function findAndValidateForPassport($username, $password): User
     {
         $verifyMFA = true;
         if (request()->scope == "mfa") {
             \Log::info("Not validating MFA because this is a request for an mfa scope.");
             // Don't verify MFA if this is only an mfa token.
             // If we didn't do this, we couldn't pair backup devices.
             $verifyMFA = false;
         }
         $result = self::findAndAuthenticate($username, $password, null, $verifyMFA);
 
         if (isset($result['reason'])) {
             if ($result['reason'] == AuthAttempt::REASON_2FA_GENERIC) {
                 // This results in a json response of {'error': 'secondfactor', 'error_description': '$errorMessage'}
                 throw new OAuthServerException($result['errorMessage'], 6, 'secondfactor', 401);
             }
 
             // TODO: Display specific error message if 2FA via Companion App was expected?
 
             throw OAuthServerException::invalidCredentials();
         }
 
         return $result['user'];
     }
 }
diff --git a/src/composer.json b/src/composer.json
index ac100c61..6c1cb1f5 100644
--- a/src/composer.json
+++ b/src/composer.json
@@ -1,85 +1,85 @@
 {
     "name": "kolab/kolab4",
     "type": "project",
     "description": "Kolab 4",
     "keywords": [
         "framework",
         "laravel"
     ],
     "license": "MIT",
     "repositories": [
         {
             "type": "vcs",
             "url": "https://git.kolab.org/diffusion/PNL/php-net_ldap3.git"
         }
     ],
     "require": {
         "php": "^8.0",
         "bacon/bacon-qr-code": "^2.0",
         "barryvdh/laravel-dompdf": "^2.0.0",
         "doctrine/dbal": "^3.3.2",
         "dyrynda/laravel-nullable-fields": "^4.2.0",
         "guzzlehttp/guzzle": "^7.4.1",
         "kolab/net_ldap3": "dev-master",
         "laravel/framework": "^9.2",
         "laravel/horizon": "^5.9",
         "laravel/octane": "^1.2",
         "laravel/passport": "^11.3",
         "laravel/tinker": "^2.7",
         "mlocati/spf-lib": "^3.1",
         "mollie/laravel-mollie": "^2.19",
         "moontoast/math": "^1.2",
         "pear/crypt_gpg": "^1.6.6",
         "predis/predis": "^1.1.10",
         "sabre/vobject": "^4.5",
         "spatie/laravel-translatable": "^5.2",
         "spomky-labs/otphp": "~10.0.0",
         "stripe/stripe-php": "^7.29"
     },
     "require-dev": {
         "code-lts/doctum": "^5.5.1",
-        "laravel/dusk": "~6.22.0",
+        "laravel/dusk": "~7.5.0",
         "nunomaduro/larastan": "^2.0",
         "phpstan/phpstan": "^1.4",
         "phpunit/phpunit": "^9",
         "squizlabs/php_codesniffer": "^3.6"
     },
     "config": {
         "optimize-autoloader": true,
         "preferred-install": "dist",
         "sort-packages": true
     },
     "extra": {
         "laravel": {
             "dont-discover": []
         }
     },
     "autoload": {
         "psr-4": {
             "App\\": "app/"
         },
         "classmap": [
             "database/seeds",
             "include"
         ]
     },
     "autoload-dev": {
         "psr-4": {
             "Tests\\": "tests/"
         }
     },
     "minimum-stability": "stable",
     "prefer-stable": true,
     "scripts": {
         "post-autoload-dump": [
             "Illuminate\\Foundation\\ComposerScripts::postAutoloadDump",
             "@php artisan package:discover --ansi"
         ],
         "post-update-cmd": [
             "@php artisan vendor:publish --tag=laravel-assets --ansi --force"
         ],
         "post-create-project-cmd": [
             "@php artisan key:generate --ansi"
         ]
     }
 }
diff --git a/src/resources/lang/en/ui.php b/src/resources/lang/en/ui.php
index 71a1f9bc..23a10ca4 100644
--- a/src/resources/lang/en/ui.php
+++ b/src/resources/lang/en/ui.php
@@ -1,559 +1,560 @@
 <?php
 
 /**
  * This file will be converted to a Vue-i18n compatible JSON format on build time
  *
  * Note: The Laravel localization features do not work here. Vue-i18n rules are different
  */
 
 return [
 
     'app' => [
         'faq' => "FAQ",
     ],
 
     'btn' => [
         'add' => "Add",
         'accept' => "Accept",
         'back' => "Back",
         'cancel' => "Cancel",
         'close' => "Close",
         'continue' => "Continue",
         'copy' => "Copy",
         'delete' => "Delete",
         'deny' => "Deny",
         'download' => "Download",
         'edit' => "Edit",
         'file' => "Choose file...",
         'moreinfo' => "More information",
         'refresh' => "Refresh",
         'reset' => "Reset",
         'resend' => "Resend",
         'save' => "Save",
         'search' => "Search",
         'share' => "Share",
         'signup' => "Sign Up",
         'submit' => "Submit",
         'suspend' => "Suspend",
         'unsuspend' => "Unsuspend",
         'verify' => "Verify",
     ],
 
     'companion' => [
         'title' => "Companion Apps",
         'companion' => "Companion App",
         'name' => "Name",
         'create' => "Pair new device",
         'create-recovery-device' => "Prepare recovery code",
         'description' => "Use the Companion App on your mobile phone as multi-factor authentication device.",
         'download-description' => "You may download the Companion App for Android here: "
             . "<a href=\"{href}\">Download</a>",
         'description-detailed' => "Here is how this works: " .
             "Pairing a device will automatically enable multi-factor autentication for all login attempts. " .
             "This includes not only the Cockpit, but also logins via Webmail, IMAP, SMPT, DAV and ActiveSync. " .
             "Any authentication attempt will result in a notification on your device, " .
             "that you can use to confirm if it was you, or deny otherwise. " .
             "Once confirmed, the same username + IP address combination will be whitelisted for 8 hours. " .
             "Unpair all your active devices to disable multi-factor authentication again.",
         'description-warning' => "Warning: Loosing access to all your multi-factor authentication devices, " .
             "will permanently lock you out of your account with no course for recovery. " .
             "Always make sure you have a recovery QR-Code printed to pair a recovery device.",
         'new' => "Pair new device",
         'recovery' => "Prepare recovery device",
         'paired' => "Paired devices",
         'print' => "Print for backup",
         'pairing-instructions' => "Pair your device using the following QR-Code.",
         'recovery-device' => "Recovery Device",
         'deviceid' => "Device ID",
         'list-empty' => "There are currently no devices",
         'delete' => "Delete/Unpair",
         'delete-companion' => "Delete/Unpair",
         'delete-text' => "You are about to delete this entry and unpair any paired companion app. " .
             "This cannot be undone, but you can pair the device again.",
         'pairing-successful' => "Your companion app is paired and ready to be used " .
             "as a multi-factor authentication device.",
     ],
 
     'dashboard' => [
         'beta' => "beta",
         'distlists' => "Distribution lists",
         'chat' => "Video chat",
         'companion' => "Companion app",
         'domains' => "Domains",
         'files' => "Files",
         'invitations' => "Invitations",
         'profile' => "Your profile",
         'resources' => "Resources",
         'settings' => "Settings",
         'shared-folders' => "Shared folders",
         'users' => "User accounts",
         'wallet' => "Wallet",
         'webmail' => "Webmail",
         'stats' => "Stats",
     ],
 
     'distlist' => [
         'list-title' => "Distribution list | Distribution lists",
         'create' => "Create list",
         'delete' => "Delete list",
         'email' => "Email",
         'list-empty' => "There are no distribution lists in this account.",
         'name' => "Name",
         'new' => "New distribution list",
         'recipients' => "Recipients",
         'sender-policy' => "Sender Access List",
         'sender-policy-text' => "With this list you can specify who can send mail to the distribution list."
             . " You can put a complete email address (jane@kolab.org), domain (kolab.org) or suffix (.org) that the sender email address is compared to."
             . " If the list is empty, mail from anyone is allowed.",
     ],
 
     'domain' => [
         'delete' => "Delete domain",
         'delete-domain' => "Delete {domain}",
         'delete-text' => "Do you really want to delete this domain permanently?"
             . " This is only possible if there are no users, aliases or other objects in this domain."
             . " Please note that this action cannot be undone.",
         'dns-verify' => "Domain DNS verification sample:",
         'dns-config' => "Domain DNS configuration sample:",
         'list-empty' => "There are no domains in this account.",
         'namespace' => "Namespace",
         'spf-whitelist' => "SPF Whitelist",
         'spf-whitelist-text' => "The Sender Policy Framework allows a sender domain to disclose, through DNS, "
             . "which systems are allowed to send emails with an envelope sender address within said domain.",
         'spf-whitelist-ex' => "Here you can specify a list of allowed servers, for example: <var>.ess.barracuda.com</var>.",
         'verify' => "Domain verification",
         'verify-intro' => "In order to confirm that you're the actual holder of the domain, we need to run a verification process before finally activating it for email delivery.",
         'verify-dns' => "The domain <b>must have one of the following entries</b> in DNS:",
         'verify-dns-txt' => "TXT entry with value:",
         'verify-dns-cname' => "or CNAME entry:",
         'verify-outro' => "When this is done press the button below to start the verification.",
         'verify-sample' => "Here's a sample zone file for your domain:",
         'config' => "Domain configuration",
         'config-intro' => "In order to let {app} receive email traffic for your domain you need to adjust the DNS settings, more precisely the MX entries, accordingly.",
         'config-sample' => "Edit your domain's zone file and replace existing MX entries with the following values:",
         'config-hint' => "If you don't know how to set DNS entries for your domain, please contact the registration service where you registered the domain or your web hosting provider.",
         'create' => "Create domain",
         'new' => "New domain",
     ],
 
     'error' => [
         '400' => "Bad request",
         '401' => "Unauthorized",
         '403' => "Access denied",
         '404' => "Not found",
         '405' => "Method not allowed",
         '500' => "Internal server error",
         'unknown' => "Unknown Error",
         'server' => "Server Error",
         'form' => "Form validation error",
     ],
 
     'file' => [
         'create' => "Create file",
         'delete' => "Delete file",
         'list-empty' => "There are no files in this account.",
         'mimetype' => "Mimetype",
         'mtime' => "Modified",
         'new' => "New file",
         'search' => "File name",
         'sharing' => "Sharing",
         'sharing-links-text' => "You can share the file with other users by giving them read-only access "
             . "to the file via a unique link.",
     ],
 
     'form' => [
         'acl' => "Access rights",
         'acl-full' => "All",
         'acl-read-only' => "Read-only",
         'acl-read-write' => "Read-write",
         'amount' => "Amount",
         'anyone' => "Anyone",
         'code' => "Confirmation Code",
         'config' => "Configuration",
         'companion' => "Companion App",
         'date' => "Date",
         'description' => "Description",
         'details' => "Details",
         'disabled' => "disabled",
         'domain' => "Domain",
         'email' => "Email Address",
         'emails' => "Email Addresses",
         'enabled' => "enabled",
         'firstname' => "First Name",
         'general' => "General",
         'geolocation' => "Your current location: {location}",
         'lastname' => "Last Name",
         'name' => "Name",
         'months' => "months",
         'none' => "none",
         'norestrictions' => "No restrictions",
         'or' => "or",
         'password' => "Password",
         'password-confirm' => "Confirm Password",
         'phone' => "Phone",
         'selectcountries' => "Select countries",
         'settings' => "Settings",
         'shared-folder' => "Shared Folder",
         'size' => "Size",
         'status' => "Status",
         'subscriptions' => "Subscriptions",
         'surname' => "Surname",
         'type' => "Type",
         'unknown' => "unknown",
         'user' => "User",
         'primary-email' => "Primary Email",
         'id' => "ID",
         'created' => "Created",
         'deleted' => "Deleted",
     ],
 
     'invitation' => [
         'create' => "Create invite(s)",
         'create-title' => "Invite for a signup",
         'create-email' => "Enter an email address of the person you want to invite.",
         'create-csv' => "To send multiple invitations at once, provide a CSV (comma separated) file, or alternatively a plain-text file, containing one email address per line.",
         'list-empty' => "There are no invitations in the database.",
         'title' => "Signup invitations",
         'search' => "Email address or domain",
         'send' => "Send invite(s)",
         'status-completed' => "User signed up",
         'status-failed' => "Sending failed",
         'status-sent' => "Sent",
         'status-new' => "Not sent yet",
     ],
 
     'lang' => [
         'en' => "English",
         'de' => "German",
         'fr' => "French",
         'it' => "Italian",
     ],
 
     'login' => [
         '2fa' => "Second factor code",
         '2fa_desc' => "Second factor code is optional for users with no 2-Factor Authentication setup.",
         'forgot_password' => "Forgot password?",
         'header' => "Please sign in",
         'sign_in' => "Sign in",
         'signing_in' => "Signing in...",
         'webmail' => "Webmail"
     ],
 
     'meet' => [
         // Room options dialog
         'options' => "Room options",
         'password' => "Password",
         'password-none' => "none",
         'password-clear' => "Clear password",
         'password-set' => "Set password",
         'password-text' => "You can add a password to your meeting. Participants will have to provide the password before they are allowed to join the meeting.",
         'lock' => "Locked room",
         'lock-text' => "When the room is locked participants have to be approved by a moderator before they could join the meeting.",
         'nomedia' => "Subscribers only",
         'nomedia-text' => "Forces all participants to join as subscribers (with camera and microphone turned off)."
             . " Moderators will be able to promote them to publishers throughout the session.",
 
         // Room menu
         'partcnt' => "Number of participants",
         'menu-audio-mute' => "Mute audio",
         'menu-audio-unmute' => "Unmute audio",
         'menu-video-mute' => "Mute video",
         'menu-video-unmute' => "Unmute video",
         'menu-screen' => "Share screen",
         'menu-hand-lower' => "Lower hand",
         'menu-hand-raise' => "Raise hand",
         'menu-channel' => "Interpreted language channel",
         'menu-chat' => "Chat",
         'menu-fullscreen' => "Full screen",
         'menu-fullscreen-exit' => "Exit full screen",
         'menu-leave' => "Leave session",
 
         // Room setup screen
         'setup-title' => "Set up your session",
         'mic' => "Microphone",
         'cam' => "Camera",
         'nick' => "Nickname",
         'nick-placeholder' => "Your name",
         'join' => "JOIN",
         'joinnow' => "JOIN NOW",
         'imaowner' => "I'm the owner",
 
         // Room
         'qa' => "Q & A",
         'leave-title' => "Room closed",
         'leave-body' => "The session has been closed by the room owner.",
         'media-title' => "Media setup",
         'join-request' => "Join request",
         'join-requested' => "{user} requested to join.",
 
         // Status messages
         'status-init' => "Checking the room...",
         'status-323' => "The room is closed. Please, wait for the owner to start the session.",
         'status-324' => "The room is closed. It will be open for others after you join.",
         'status-325' => "The room is ready. Please, provide a valid password.",
         'status-326' => "The room is locked. Please, enter your name and try again.",
         'status-327' => "Waiting for permission to join the room.",
         'status-404' => "The room does not exist.",
         'status-429' => "Too many requests. Please, wait.",
         'status-500' => "Failed to connect to the room. Server error.",
 
         // Other menus
         'media-setup' => "Media setup",
         'perm' => "Permissions",
         'perm-av' => "Audio &amp; Video publishing",
         'perm-mod' => "Moderation",
         'lang-int' => "Language interpreter",
         'menu-options' => "Options",
     ],
 
     'menu' => [
         'cockpit' => "Cockpit",
         'login' => "Login",
         'logout' => "Logout",
         'signup' => "Signup",
         'toggle' => "Toggle navigation",
     ],
 
     'msg' => [
         'initializing' => "Initializing...",
         'loading' => "Loading...",
         'loading-failed' => "Failed to load data.",
         'notfound' => "Resource not found.",
         'info' => "Information",
         'error' => "Error",
         'uploading' => "Uploading...",
         'warning' => "Warning",
         'success' => "Success",
     ],
 
     'nav' => [
         'more' => "Load more",
         'step' => "Step {i}/{n}",
     ],
 
     'password' => [
         'link-invalid' => "The password reset code is expired or invalid.",
         'reset' => "Password Reset",
         'reset-step1' => "Enter your email address to reset your password.",
         'reset-step1-hint' => "You may need to check your spam folder or unblock {email}.",
         'reset-step2' => "We sent out a confirmation code to your external email address."
             . " Enter the code we sent you, or click the link in the message.",
     ],
 
     'resource' => [
         'create' => "Create resource",
         'delete' => "Delete resource",
         'invitation-policy' => "Invitation policy",
         'invitation-policy-text' => "Event invitations for a resource are normally accepted automatically"
             . " if there is no conflicting event on the requested time slot. Invitation policy allows"
             . " for rejecting such requests or to require a manual acceptance from a specified user.",
         'ipolicy-manual' => "Manual (tentative)",
         'ipolicy-accept' => "Accept",
         'ipolicy-reject' => "Reject",
         'list-title' => "Resource | Resources",
         'list-empty' => "There are no resources in this account.",
         'new' => "New resource",
     ],
 
     'room' => [
         'create' => "Create room",
         'delete' => "Delete room",
         'copy-location' => "Copy room location",
         'description-hint' => "This is an optional short description for the room, so you can find it more easily on the list.",
         'goto' => "Enter the room",
         'list-empty' => "There are no conference rooms in this account.",
         'list-empty-nocontroller' => "Do you need a room? Ask your account owner to create one and share it with you.",
         'list-title' => "Voice & video conferencing rooms",
         'moderators' => "Moderators",
         'moderators-text' => "You can share your room with other users. They will become the room moderators with all moderator powers and ability to open the room without your presence.",
         'new' => "New room",
         'new-hint' => "We'll generate a unique name for the room that will then allow you to access the room.",
         'title' => "Room: {name}",
         'url' => "You can access the room at the URL below. Use this URL to invite people to join you. This room is only open when you (or another room moderator) is in attendance.",
     ],
 
     'settings' => [
         'password-policy' => "Password Policy",
         'password-retention' => "Password Retention",
         'password-max-age' => "Require a password change every",
     ],
 
     'shf' => [
         'aliases-none' => "This shared folder has no email aliases.",
         'create' => "Create folder",
         'delete' => "Delete folder",
         'acl-text' => "Defines user permissions to access the shared folder.",
         'list-title' => "Shared folder | Shared folders",
         'list-empty' => "There are no shared folders in this account.",
         'new' => "New shared folder",
         'type-mail' => "Mail",
         'type-event' => "Calendar",
         'type-contact' => "Address Book",
         'type-task' => "Tasks",
         'type-note' => "Notes",
         'type-file' => "Files",
     ],
 
     'signup' => [
         'email' => "Existing Email Address",
         'login' => "Login",
         'title' => "Sign Up",
         'step1' => "Sign up to start your free month.",
         'step2' => "We sent out a confirmation code to your email address. Enter the code we sent you, or click the link in the message.",
         'step3' => "Create your {app} identity (you can choose additional addresses later).",
         'token' => "Signup authorization token",
         'voucher' => "Voucher Code",
     ],
 
     'status' => [
         'prepare-account' => "We are preparing your account.",
         'prepare-domain' => "We are preparing the domain.",
         'prepare-distlist' => "We are preparing the distribution list.",
         'prepare-resource' => "We are preparing the resource.",
         'prepare-shared-folder' => "We are preparing the shared folder.",
         'prepare-user' => "We are preparing the user account.",
         'prepare-hint' => "Some features may be missing or readonly at the moment.",
         'prepare-refresh' => "The process never ends? Press the \"Refresh\" button, please.",
         'ready-account' => "Your account is almost ready.",
         'ready-domain' => "The domain is almost ready.",
         'ready-distlist' => "The distribution list is almost ready.",
         'ready-resource' => "The resource is almost ready.",
         'ready-shared-folder' => "The shared-folder is almost ready.",
         'ready-user' => "The user account is almost ready.",
         'verify' => "Verify your domain to finish the setup process.",
         'verify-domain' => "Verify domain",
         'degraded' => "Degraded",
         'deleted' => "Deleted",
+        'restricted' => "Restricted",
         'suspended' => "Suspended",
         'notready' => "Not Ready",
         'active' => "Active",
     ],
 
     'support' => [
         'title' => "Contact Support",
         'id' => "Customer number or email address you have with us",
         'id-pl' => "e.g. 12345678 or the affected email address",
         'id-hint' => "Leave blank if you are not a customer yet",
         'name' => "Name",
         'name-pl' => "how we should call you in our reply",
         'email' => "Working email address",
         'email-pl' => "make sure we can reach you at this address",
         'summary' => "Issue Summary",
         'summary-pl' => "one sentence that summarizes your issue",
         'expl' => "Issue Explanation",
     ],
 
     'user' => [
         '2fa-hint1' => "This will remove 2-Factor Authentication entitlement as well as the user-configured factors.",
         '2fa-hint2' => "Please, make sure to confirm the user identity properly.",
         'add-beta' => "Enable beta program",
         'address' => "Address",
         'aliases' => "Aliases",
         'aliases-none' => "This user has no email aliases.",
         'add-bonus' => "Add bonus",
         'add-bonus-title' => "Add a bonus to the wallet",
         'add-penalty' => "Add penalty",
         'add-penalty-title' => "Add a penalty to the wallet",
         'auto-payment' => "Auto-payment",
         'auto-payment-text' => "Fill up by <b>{amount}</b> when under <b>{balance}</b> using {method}",
         'country' => "Country",
         'create' => "Create user",
         'custno' => "Customer No.",
         'degraded-warning' => "The account is degraded. Some features have been disabled.",
         'degraded-hint' => "Please, make a payment.",
         'delete' => "Delete user",
         'delete-account' => "Delete this account?",
         'delete-email' => "Delete {email}",
         'delete-text' => "Do you really want to delete this user permanently?"
             . " This will delete all account data and withdraw the permission to access the email account."
             . " Please note that this action cannot be undone.",
         'discount' => "Discount",
         'discount-hint' => "applied discount",
         'discount-title' => "Account discount",
         'distlists' => "Distribution lists",
         'domains' => "Domains",
         'ext-email' => "External Email",
         'email-aliases' => "Email Aliases",
         'finances' => "Finances",
         'geolimit' => "Geo-lockin",
         'geolimit-text' => "Defines a list of locations that are allowed for logon. You will not be able to login from a country that is not listed here.",
         'greylisting' => "Greylisting",
         'greylisting-text' => "Greylisting is a method of defending users against spam. Any incoming mail from an unrecognized sender "
             . "is temporarily rejected. The originating server should try again after a delay. "
             . "This time the email will be accepted. Spammers usually do not reattempt mail delivery.",
         'imapproxy' => "IMAP proxy",
         'imapproxy-text' => "Enables IMAP proxy that filters out non-mail groupware folders, so your IMAP clients do not see them.",
         'list-title' => "User accounts",
         'list-empty' => "There are no users in this account.",
         'managed-by' => "Managed by",
         'new' => "New user account",
         'org' => "Organization",
         'package' => "Package",
         'pass-input' => "Enter password",
         'pass-link' => "Set via link",
         'pass-link-label' => "Link:",
         'pass-link-hint' => "Press Submit to activate the link",
         'passwordpolicy' => "Password Policy",
         'price' => "Price",
         'profile-title' => "Your profile",
         'profile-delete' => "Delete account",
         'profile-delete-title' => "Delete this account?",
         'profile-delete-text1' => "This will delete the account as well as all domains, users and aliases associated with this account.",
         'profile-delete-warning' => "This operation is irreversible",
         'profile-delete-text2' => "As you will not be able to recover anything after this point, please make sure that you have migrated all data before proceeding.",
         'profile-delete-support' => "As we always strive to improve, we would like to ask for 2 minutes of your time. "
             . "The best tool for improvement is feedback from users, and we would like to ask "
             . "for a few words about your reasons for leaving our service. Please send your feedback to <a href=\"{href}\">{email}</a>.",
         'profile-delete-contact' => "Also feel free to contact {app} Support with any questions or concerns that you may have in this context.",
         'reset-2fa' => "Reset 2-Factor Auth",
         'reset-2fa-title' => "2-Factor Authentication Reset",
         'resources' => "Resources",
         'title' => "User account",
         'search' => "User email address or name",
         'search-pl' => "User ID, email or domain",
         'skureq' => "{sku} requires {list}.",
         'subscription' => "Subscription",
         'subscriptions-none' => "This user has no subscriptions.",
         'users' => "Users",
     ],
 
     'wallet' => [
         'add-credit' => "Add credit",
         'auto-payment-cancel' => "Cancel auto-payment",
         'auto-payment-change' => "Change auto-payment",
         'auto-payment-failed' => "The setup of automatic payments failed. Restart the process to enable automatic top-ups.",
         'auto-payment-hint' => "Here is how it works: Every time your account runs low, we will charge your preferred payment method for an amount you choose."
             . " You can cancel or change the auto-payment option at any time.",
         'auto-payment-setup' => "Set up auto-payment",
         'auto-payment-disabled' => "The configured auto-payment has been disabled. Top up your wallet or raise the auto-payment amount.",
         'auto-payment-info' => "Auto-payment is <b>set</b> to fill up your account by <b>{amount}</b> every time your account balance gets under <b>{balance}</b>.",
         'auto-payment-inprogress' => "The setup of the automatic payment is still in progress.",
         'auto-payment-next' => "Next, you will be redirected to the checkout page, where you can provide your credit card details.",
         'auto-payment-disabled-next' => "The auto-payment is disabled. Immediately after you submit new settings we'll enable it and attempt to top up your wallet.",
         'auto-payment-update' => "Update auto-payment",
         'banktransfer-hint' => "Please note that a bank transfer can take several days to complete.",
         'coinbase-hint' => "Here is how it works: You specify the amount by which you want to top up your wallet in {wc}."
             . " We will then create a charge on Coinbase for the specified amount that you can pay using Bitcoin.",
         'currency-conv' => "Here is how it works: You specify the amount by which you want to top up your wallet in {wc}."
             . " We will then convert this to {pc}, and on the next page you will be provided with the bank-details to transfer the amount in {pc}.",
         'fill-up' => "Fill up by",
         'history' => "History",
         'month' => "month",
         'noperm' => "Only account owners can access a wallet.",
         'norefund' => "The money in your wallet is non-refundable.",
         'payment-amount-hint' => "Choose the amount by which you want to top up your wallet.",
         'payment-method' => "Method of payment: {method}",
         'payment-warning' => "You will be charged for {price}.",
         'pending-payments' => "Pending Payments",
         'pending-payments-warning' => "You have payments that are still in progress. See the \"Pending Payments\" tab below.",
         'pending-payments-none' => "There are no pending payments for this account.",
         'receipts' => "Receipts",
         'receipts-hint' => "Here you can download receipts (in PDF format) for payments in specified period. Select the period and press the Download button.",
         'receipts-none' => "There are no receipts for payments in this account. Please, note that you can download receipts after the month ends.",
         'title' => "Account balance",
         'top-up' => "Top up your wallet",
         'transactions' => "Transactions",
         'transactions-none' => "There are no transactions for this account.",
         'when-below' => "when account balance is below",
     ],
 ];
diff --git a/src/resources/vue/Admin/User.vue b/src/resources/vue/Admin/User.vue
index e1f99a02..766b979a 100644
--- a/src/resources/vue/Admin/User.vue
+++ b/src/resources/vue/Admin/User.vue
@@ -1,646 +1,647 @@
 <template>
     <div class="container">
         <div class="card" id="user-info">
             <div class="card-body">
                 <h1 class="card-title">{{ user.email }}</h1>
                 <div class="card-text">
                     <form class="read-only short">
                         <div v-if="user.wallet.user_id != user.id" class="row plaintext">
                             <label for="manager" class="col-sm-4 col-form-label">{{ $t('user.managed-by') }}</label>
                             <div class="col-sm-8">
                                 <span class="form-control-plaintext" id="manager">
                                     <router-link :to="{ path: '/user/' + user.wallet.user_id }">{{ user.wallet.user_email }}</router-link>
                                 </span>
                             </div>
                         </div>
                         <div class="row plaintext">
                             <label for="userid" class="col-sm-4 col-form-label">ID <span class="text-muted">({{ $t('form.created') }})</span></label>
                             <div class="col-sm-8">
                                 <span class="form-control-plaintext" id="userid">
                                     {{ user.id }} <span class="text-muted">({{ user.created_at }})</span>
                                 </span>
                             </div>
                         </div>
                         <div class="row plaintext">
                             <label for="status" class="col-sm-4 col-form-label">{{ $t('form.status') }}</label>
                             <div class="col-sm-8">
                                 <span class="form-control-plaintext" id="status">
                                     <span :class="$root.statusClass(user)">{{ $root.statusText(user) }}</span>
+                                    <span v-if="user.isRestricted" class="badge bg-primary rounded-pill ms-1">{{ $t('status.restricted') }}</span>
                                 </span>
                             </div>
                         </div>
                         <div class="row plaintext" v-if="user.first_name">
                             <label for="first_name" class="col-sm-4 col-form-label">{{ $t('form.firstname') }}</label>
                             <div class="col-sm-8">
                                 <span class="form-control-plaintext" id="first_name">{{ user.first_name }}</span>
                             </div>
                         </div>
                         <div class="row plaintext" v-if="user.last_name">
                             <label for="last_name" class="col-sm-4 col-form-label">{{ $t('form.lastname') }}</label>
                             <div class="col-sm-8">
                                 <span class="form-control-plaintext" id="last_name">{{ user.last_name }}</span>
                             </div>
                         </div>
                         <div class="row plaintext" v-if="user.organization">
                             <label for="organization" class="col-sm-4 col-form-label">{{ $t('user.org') }}</label>
                             <div class="col-sm-8">
                                 <span class="form-control-plaintext" id="organization">{{ user.organization }}</span>
                             </div>
                         </div>
                         <div class="row plaintext" v-if="user.phone">
                             <label for="phone" class="col-sm-4 col-form-label">{{ $t('form.phone') }}</label>
                             <div class="col-sm-8">
                                 <span class="form-control-plaintext" id="phone">{{ user.phone }}</span>
                             </div>
                         </div>
                         <div class="row plaintext">
                             <label for="external_email" class="col-sm-4 col-form-label">{{ $t('user.ext-email') }}</label>
                             <div class="col-sm-8">
                                 <span class="form-control-plaintext" id="external_email">
                                     <a v-if="user.external_email" :href="'mailto:' + user.external_email">{{ user.external_email }}</a>
                                     <btn class="btn-secondary btn-sm ms-2" @click="emailEdit">{{ $t('btn.edit') }}</btn>
                                 </span>
                             </div>
                         </div>
                         <div class="row plaintext" v-if="user.billing_address">
                             <label for="billing_address" class="col-sm-4 col-form-label">{{ $t('user.address') }}</label>
                             <div class="col-sm-8">
                                 <span class="form-control-plaintext" style="white-space:pre" id="billing_address">{{ user.billing_address }}</span>
                             </div>
                         </div>
                         <div class="row plaintext">
                             <label for="country" class="col-sm-4 col-form-label">{{ $t('user.country') }}</label>
                             <div class="col-sm-8">
                                 <span class="form-control-plaintext" id="country">{{ user.country }}</span>
                             </div>
                         </div>
                     </form>
                     <div class="mt-2 buttons">
                         <btn v-if="!user.isSuspended" id="button-suspend" class="btn-warning" @click="suspendUser">
                             {{ $t('btn.suspend') }}
                         </btn>
                         <btn v-if="user.isSuspended" id="button-unsuspend" class="btn-warning" @click="unsuspendUser">
                             {{ $t('btn.unsuspend') }}
                         </btn>
                     </div>
                 </div>
             </div>
         </div>
         <tabs class="mt-3" :tabs="tabs" ref="tabs"></tabs>
         <div class="tab-content">
             <div class="tab-pane show active" id="finances" role="tabpanel" aria-labelledby="tab-finances">
                 <div class="card-body">
                     <h2 class="card-title">
                         {{ $t('wallet.title') }}
                         <span :class="wallet.balance < 0 ? 'text-danger' : 'text-success'"><strong>{{ $root.price(wallet.balance, wallet.currency) }}</strong></span>
                     </h2>
                     <div class="card-text">
                         <form class="read-only short">
                             <div class="row">
                                 <label class="col-sm-4 col-form-label">{{ $t('user.discount') }}</label>
                                 <div class="col-sm-8">
                                     <span class="form-control-plaintext" id="discount">
                                         <span>{{ wallet.discount ? (wallet.discount + '% - ' + wallet.discount_description) : 'none' }}</span>
                                         <btn class="btn-secondary btn-sm ms-2" @click="discountEdit">{{ $t('btn.edit') }}</btn>
                                     </span>
                                 </div>
                             </div>
                             <div class="row" v-if="wallet.mandate && wallet.mandate.id">
                                 <label class="col-sm-4 col-form-label">{{ $t('user.auto-payment') }}</label>
                                 <div class="col-sm-8">
                                     <span id="autopayment" :class="'form-control-plaintext' + (wallet.mandateState ? ' text-danger' : '')"
                                           v-html="$t('user.auto-payment-text', {
                                               amount: wallet.mandate.amount + ' ' + wallet.currency,
                                               balance: wallet.mandate.balance + ' ' + wallet.currency,
                                               method: wallet.mandate.method
                                           })"
                                     >
                                         <span v-if="wallet.mandateState">({{ wallet.mandateState }})</span>.
                                     </span>
                                 </div>
                             </div>
                             <div class="row" v-if="wallet.providerLink">
                                 <label class="col-sm-4 col-form-label">{{ capitalize(wallet.provider) }} {{ $t('form.id') }}</label>
                                 <div class="col-sm-8">
                                     <span class="form-control-plaintext" v-html="wallet.providerLink"></span>
                                 </div>
                             </div>
                         </form>
                         <div class="mt-2 buttons">
                             <btn id="button-award" class="btn-success" @click="awardDialog">{{ $t('user.add-bonus') }}</btn>
                             <btn id="button-penalty" class="btn-danger" @click="penalizeDialog">{{ $t('user.add-penalty') }}</btn>
                         </div>
                     </div>
                     <h2 class="card-title mt-4">{{ $t('wallet.transactions') }}</h2>
                     <transaction-log v-if="wallet.id && !walletReload" class="card-text" :wallet-id="wallet.id" :is-admin="true"></transaction-log>
                 </div>
             </div>
             <div class="tab-pane" id="aliases" role="tabpanel" aria-labelledby="tab-aliases">
                 <div class="card-body">
                     <div class="card-text">
                         <list-table :list="user.aliases" :setup="aliasesListSetup" class="mb-0"></list-table>
                     </div>
                 </div>
             </div>
             <div class="tab-pane" id="subscriptions" role="tabpanel" aria-labelledby="tab-subscriptions">
                 <div class="card-body">
                     <div class="card-text">
                         <list-table :list="skus" :setup="skusListSetup" class="mb-0"></list-table>
                         <small v-if="discount > 0" class="hint">
                             <hr class="m-0">
                             &sup1; {{ $t('user.discount-hint') }}: {{ discount }}% - {{ discount_description }}
                         </small>
                         <div class="mt-2 buttons">
                             <btn class="btn-danger" id="reset2fa" v-if="has2FA" @click="$refs.reset2faDialog.show()">{{ $t('user.reset-2fa') }}</btn>
                             <btn class="btn-secondary" id="addbetasku" v-if="!hasBeta" @click="addBetaSku">{{ $t('user.add-beta') }}</btn>
                         </div>
                     </div>
                 </div>
             </div>
             <div class="tab-pane" id="domains" role="tabpanel" aria-labelledby="tab-domains">
                 <div class="card-body">
                     <div class="card-text">
                         <domain-list :list="domains" class="mb-0"></domain-list>
                     </div>
                 </div>
             </div>
             <div class="tab-pane" id="users" role="tabpanel" aria-labelledby="tab-users">
                 <div class="card-body">
                     <div class="card-text">
                         <user-list :list="users" :current="user" class="mb-0"></user-list>
                     </div>
                 </div>
             </div>
             <div class="tab-pane" id="distlists" role="tabpanel" aria-labelledby="tab-distlists">
                 <div class="card-body">
                     <div class="card-text">
                         <distlist-list :list="distlists" class="mb-0"></distlist-list>
                     </div>
                 </div>
             </div>
             <div class="tab-pane" id="resources" role="tabpanel" aria-labelledby="tab-resources">
                 <div class="card-body">
                     <div class="card-text">
                         <resource-list :list="resources" class="mb-0"></resource-list>
                     </div>
                 </div>
             </div>
             <div class="tab-pane" id="folders" role="tabpanel" aria-labelledby="tab-folders">
                 <div class="card-body">
                     <div class="card-text">
                         <shared-folder-list :list="folders" :with-email="true" class="mb-0"></shared-folder-list>
                     </div>
                 </div>
             </div>
             <div class="tab-pane" id="settings" role="tabpanel" aria-labelledby="tab-settings">
                 <div class="card-body">
                     <div class="card-text">
                         <form class="read-only short">
                             <div class="row plaintext">
                                 <label for="greylist_enabled" class="col-sm-4 col-form-label">{{ $t('user.greylisting') }}</label>
                                 <div class="col-sm-8">
                                     <span class="form-control-plaintext" id="greylist_enabled">
                                         <span v-if="user.config.greylist_enabled" class="text-success">{{ $t('form.enabled') }}</span>
                                         <span v-else class="text-danger">{{ $t('form.disabled') }}</span>
                                     </span>
                                 </div>
                             </div>
                             <div class="row plaintext">
                                 <label for="guam_enabled" class="col-sm-4 col-form-label">{{ $t('user.imapproxy') }}</label>
                                 <div class="col-sm-8">
                                     <span class="form-control-plaintext" id="guam_enabled">
                                         <span v-if="user.config.guam_enabled" class="text-success">{{ $t('form.enabled') }}</span>
                                         <span v-else class="text-danger">{{ $t('form.disabled') }}</span>
                                     </span>
                                 </div>
                             </div>
                             <div class="row plaintext">
                                 <label for="limit_geo" class="col-sm-4 col-form-label">{{ $t('user.geolimit') }}</label>
                                 <div class="col-sm-8">
                                     <span class="form-control-plaintext" id="limit_geo">
                                         {{ $root.countriesText(user.config.limit_geo) }}
                                     </span>
                                     <btn v-if="user.config.limit_geo && user.config.limit_geo.length" class="btn-secondary btn-sm ms-2" @click="resetGeoLock">{{ $t('btn.reset') }}</btn>
                                 </div>
                             </div>
                         </form>
                     </div>
                 </div>
             </div>
         </div>
 
         <modal-dialog id="discount-dialog" ref="discountDialog" :title="$t('user.discount-title')" @click="submitDiscount()" :buttons="['submit']">
             <div>
                 <select v-model="wallet.discount_id" class="form-select">
                     <option value="">- {{ $t('form.none') }} -</option>
                     <option v-for="item in discounts" :value="item.id" :key="item.id">{{ item.label }}</option>
                 </select>
             </div>
         </modal-dialog>
 
         <modal-dialog id="email-dialog" ref="emailDialog" :title="$t('user.ext-email')" @click="submitEmail()" :buttons="['submit']">
             <div>
                 <input v-model="external_email" name="external_email" class="form-control">
             </div>
         </modal-dialog>
 
         <modal-dialog id="oneoff-dialog" ref="oneoffDialog" @click="submitOneOff()" :buttons="['submit']"
                       :title="$t(oneoff_negative ? 'user.add-penalty-title' : 'user.add-bonus-title')"
         >
             <form data-validation-prefix="oneoff_">
                 <div class="mb-3">
                     <label for="oneoff_amount" class="form-label">{{ $t('form.amount') }}</label>
                     <div class="input-group">
                         <input type="text" class="form-control" id="oneoff_amount" v-model="oneoff_amount" required>
                         <span class="input-group-text">{{ wallet.currency }}</span>
                     </div>
                 </div>
                 <div>
                     <label for="oneoff_description" class="form-label">{{ $t('form.description') }}</label>
                     <input class="form-control" id="oneoff_description" v-model="oneoff_description" required>
                 </div>
             </form>
         </modal-dialog>
 
         <modal-dialog id="reset-2fa-dialog" ref="reset2faDialog" :title="$t('user.reset-2fa-title')" @click="reset2FA()"
                       :buttons="[{className: 'btn-danger modal-action', label: 'btn.reset'}]"
         >
             <p>{{ $t('user.2fa-hint1') }}</p>
             <p>{{ $t('user.2fa-hint2') }}</p>
         </modal-dialog>
     </div>
 </template>
 
 <script>
     import ModalDialog from '../Widgets/ModalDialog'
     import TransactionLog from '../Widgets/TransactionLog'
     import { ListTable } from '../Widgets/ListTools'
     import { default as DistlistList } from '../Distlist/ListWidget'
     import { default as DomainList } from '../Domain/ListWidget'
     import { default as ResourceList } from '../Resource/ListWidget'
     import { default as SharedFolderList } from '../SharedFolder/ListWidget'
     import { default as UserList } from '../User/ListWidget'
 
     import { library } from '@fortawesome/fontawesome-svg-core'
 
     library.add(
         require('@fortawesome/free-solid-svg-icons/faFolderOpen').definition,
         require('@fortawesome/free-solid-svg-icons/faGear').definition,
         require('@fortawesome/free-solid-svg-icons/faGlobe').definition,
         require('@fortawesome/free-solid-svg-icons/faUsers').definition,
     )
 
     export default {
         components: {
             DistlistList,
             DomainList,
             ListTable,
             ModalDialog,
             ResourceList,
             SharedFolderList,
             TransactionLog,
             UserList
         },
         beforeRouteUpdate (to, from, next) {
             // An event called when the route that renders this component has changed,
             // but this component is reused in the new route.
             // Required to handle links from /user/XXX to /user/YYY
             next()
             this.$parent.routerReload()
         },
         data() {
             return {
                 aliasesListSetup: {
                     columns: [
                         {
                             prop: 'email',
                             content: item => item
                         },
                     ],
                     footLabel: 'user.aliases-none'
                 },
                 oneoff_amount: '',
                 oneoff_description: '',
                 oneoff_negative: false,
                 discount: 0,
                 discount_description: '',
                 discounts: [],
                 external_email: '',
                 folders: [],
                 has2FA: false,
                 hasBeta: false,
                 wallet: {},
                 walletReload: false,
                 distlists: [],
                 domains: [],
                 resources: [],
                 sku2FA: null,
                 skus: [],
                 skusListSetup: {
                     columns: [
                         {
                             prop: 'name',
                             label: 'user.subscription'
                         },
                         {
                             prop: 'price',
                             className: 'price',
                             label: 'user.price'
                         }
                     ],
                     footLabel: 'user.subscriptions-none',
                     model: 'sku'
                 },
                 tabs: [
                     { label: 'user.finances' },
                     { label: 'user.aliases', count: 0 },
                     { label: 'form.subscriptions', count: 0 },
                     { label: 'user.domains', count: 0 },
                     { label: 'user.users', count: 0 },
                     { label: 'user.distlists', count: 0 },
                     { label: 'user.resources', count: 0 },
                     { label: 'dashboard.shared-folders', count: 0 },
                     { label: 'form.settings' }
                 ],
                 users: [],
                 user: {
                     aliases: [],
                     config: {},
                     wallet: {},
                     skus: {},
                 }
             }
         },
         created() {
             const user_id = this.$route.params.user
 
             axios.get('/api/v4/users/' + user_id, { loader: true })
                 .then(response => {
                     this.user = response.data
 
                     const loader = '#finances'
                     const keys = ['first_name', 'last_name', 'external_email', 'billing_address', 'phone', 'organization']
 
                     let country = this.user.settings.country
                     if (country && country in window.config.countries) {
                         country = window.config.countries[country][1]
                     }
 
                     this.user.country = country
 
                     keys.forEach(key => { this.user[key] = this.user.settings[key] })
 
                     this.discount = this.user.wallet.discount
                     this.discount_description = this.user.wallet.discount_description
 
                     this.$refs.tabs.updateCounter('aliases', this.user.aliases.length)
 
                     // TODO: currencies, multi-wallets, accounts
                     // Get more info about the wallet (e.g. payment provider related)
                     axios.get('/api/v4/wallets/' + this.user.wallets[0].id, { loader })
                         .then(response => {
                             this.wallet = response.data
                             this.setMandateState()
                         })
 
                     // Create subscriptions list
                     axios.get('/api/v4/users/' + user_id + '/skus')
                         .then(response => {
                             // "merge" SKUs with user entitlement-SKUs
                             response.data.forEach(sku => {
                                 const userSku = this.user.skus[sku.id]
                                 if (userSku) {
                                     let cost = userSku.costs.reduce((sum, current) => sum + current)
                                     let item = {
                                         id: sku.id,
                                         name: sku.name,
                                         cost: cost,
                                         price: this.$root.priceLabel(cost, this.discount, this.user.wallet.currency)
                                     }
 
                                     if (sku.range) {
                                         item.name += ' ' + userSku.count + ' ' + sku.range.unit
                                     }
 
                                     this.skus.push(item)
 
                                     if (sku.handler == 'Auth2F') {
                                         this.has2FA = true
                                         this.sku2FA = sku.id
                                     } else if (sku.handler == 'Beta') {
                                         this.hasBeta = true
                                     }
                                 }
                             })
 
                             this.$refs.tabs.updateCounter('subscriptions', this.skus.length)
                         })
 
                     // Fetch users
                     // TODO: Multiple wallets
                     axios.get('/api/v4/users?owner=' + user_id)
                         .then(response => {
                             this.users = response.data.list;
                             this.$refs.tabs.updateCounter('users', this.users.length)
                         })
 
                     // Fetch domains
                     axios.get('/api/v4/domains?owner=' + user_id)
                         .then(response => {
                             this.domains = response.data.list
                             this.$refs.tabs.updateCounter('domains', this.domains.length)
                         })
 
                     // Fetch distribution lists
                     axios.get('/api/v4/groups?owner=' + user_id)
                         .then(response => {
                             this.distlists = response.data.list
                             this.$refs.tabs.updateCounter('distlists', this.distlists.length)
                         })
 
                     // Fetch resources lists
                     axios.get('/api/v4/resources?owner=' + user_id)
                         .then(response => {
                             this.resources = response.data.list
                             this.$refs.tabs.updateCounter('resources', this.resources.length)
                         })
 
                     // Fetch shared folders lists
                     axios.get('/api/v4/shared-folders?owner=' + user_id)
                         .then(response => {
                             this.folders = response.data.list
                             this.$refs.tabs.updateCounter('folders', this.folders.length)
                         })
                 })
                 .catch(this.$root.errorHandler)
         },
         mounted() {
             this.$refs.discountDialog.events({
                 shown: () => {
                     // Note: Vue v-model is strict, convert null to a string
                     this.wallet.discount_id = this.wallet.discount_id || ''
                 }
             })
         },
         methods: {
             addBetaSku() {
                 axios.post('/api/v4/users/' + this.user.id + '/skus/beta')
                     .then(response => {
                         if (response.data.status == 'success') {
                             this.$toast.success(response.data.message)
                             this.hasBeta = true
                             const sku = response.data.sku
                             this.skus.push({
                                 id: sku.id,
                                 name: sku.name,
                                 cost: sku.cost,
                                 price: this.$root.priceLabel(sku.cost, this.discount, this.wallet.currency)
                             })
 
                             this.$refs.tabs.updateCounter('subscriptions', this.skus.length)
                         }
                     })
             },
             capitalize(str) {
                 return str.charAt(0).toUpperCase() + str.slice(1)
             },
             awardDialog() {
                 this.oneOffDialog(false)
             },
             discountEdit() {
                 this.$refs.discountDialog.show()
 
                 if (!this.discounts.length) {
                     // Fetch discounts
                     axios.get('/api/v4/users/' + this.user.id + '/discounts')
                         .then(response => {
                             this.discounts = response.data.list
                         })
                 }
             },
             emailEdit() {
                 this.external_email = this.user.external_email
                 this.$root.clearFormValidation($('#email-dialog'))
                 this.$refs.emailDialog.show()
             },
             setMandateState() {
                 let mandate = this.wallet.mandate
                 if (mandate && mandate.id) {
                     if (!mandate.isValid) {
                         this.wallet.mandateState = mandate.isPending ? 'pending' : 'invalid'
                     } else if (mandate.isDisabled) {
                         this.wallet.mandateState = 'disabled'
                     }
                 }
             },
             oneOffDialog(negative) {
                 this.oneoff_negative = negative
                 this.$refs.oneoffDialog.show()
             },
             penalizeDialog() {
                 this.oneOffDialog(true)
             },
             reload() {
                 // this is to reload transaction log
                 this.walletReload = true
                 this.$nextTick(() => { this.walletReload = false })
             },
             reset2FA() {
                 this.$refs.reset2faDialog.hide()
                 axios.post('/api/v4/users/' + this.user.id + '/reset2FA')
                     .then(response => {
                         if (response.data.status == 'success') {
                             this.$toast.success(response.data.message)
                             this.skus = this.skus.filter(sku => sku.id != this.sku2FA)
                             this.has2FA = false
                             this.$refs.tabs.updateCounter('subscriptions', this.skus.length)
                         }
                     })
             },
             resetGeoLock() {
                 axios.post('/api/v4/users/' + this.user.id + '/resetGeoLock')
                     .then(response => {
                         if (response.data.status == 'success') {
                             this.$toast.success(response.data.message)
                             this.user.config.limit_geo = []
                         }
                     })
             },
             submitDiscount() {
                 this.$refs.discountDialog.hide()
 
                 axios.put('/api/v4/wallets/' + this.user.wallets[0].id, { discount: this.wallet.discount_id })
                     .then(response => {
                         if (response.data.status == 'success') {
                             this.$toast.success(response.data.message)
                             this.wallet = Object.assign({}, this.wallet, response.data)
 
                             // Update prices in Subscriptions tab
                             if (this.user.wallet.id == response.data.id) {
                                 this.discount = this.wallet.discount
                                 this.discount_description = this.wallet.discount_description
 
                                 this.skus.forEach(sku => {
                                     sku.price = this.$root.priceLabel(sku.cost, this.discount, this.wallet.currency)
                                 })
                             }
                         }
                     })
             },
             submitEmail() {
                 axios.put('/api/v4/users/' + this.user.id, { external_email: this.external_email })
                     .then(response => {
                         if (response.data.status == 'success') {
                             this.$refs.emailDialog.hide()
                             this.$toast.success(response.data.message)
                             this.user.external_email = this.external_email
                             this.external_email = null // required because of Vue
                         }
                     })
             },
             submitOneOff() {
                 let wallet_id = this.user.wallets[0].id
                 let post = {
                     amount: this.oneoff_amount,
                     description: this.oneoff_description
                 }
 
                 if (this.oneoff_negative && /^\d+(\.?\d+)?$/.test(post.amount)) {
                     post.amount *= -1
                 }
 
                 this.$root.clearFormValidation('#oneoff-dialog')
 
                 axios.post('/api/v4/wallets/' + wallet_id + '/one-off', post)
                     .then(response => {
                         if (response.data.status == 'success') {
                             this.$refs.oneoffDialog.hide()
                             this.$toast.success(response.data.message)
                             this.wallet = Object.assign({}, this.wallet, {balance: response.data.balance})
                             this.oneoff_amount = ''
                             this.oneoff_description = ''
                             this.reload()
                         }
                     })
             },
             suspendUser() {
                 axios.post('/api/v4/users/' + this.user.id + '/suspend')
                     .then(response => {
                         if (response.data.status == 'success') {
                             this.$toast.success(response.data.message)
                             this.user = Object.assign({}, this.user, { isSuspended: true })
                         }
                     })
             },
             unsuspendUser() {
                 axios.post('/api/v4/users/' + this.user.id + '/unsuspend')
                     .then(response => {
                         if (response.data.status == 'success') {
                             this.$toast.success(response.data.message)
                             this.user = Object.assign({}, this.user, { isSuspended: false })
                         }
                     })
             }
         }
     }
 </script>
diff --git a/src/tests/Browser/Admin/UserTest.php b/src/tests/Browser/Admin/UserTest.php
index 75ec0545..ec58f431 100644
--- a/src/tests/Browser/Admin/UserTest.php
+++ b/src/tests/Browser/Admin/UserTest.php
@@ -1,632 +1,635 @@
 <?php
 
 namespace Tests\Browser\Admin;
 
 use App\Auth\SecondFactor;
 use App\Discount;
 use App\Entitlement;
 use App\Sku;
 use App\User;
 use Tests\Browser;
 use Tests\Browser\Components\Dialog;
 use Tests\Browser\Components\Toast;
 use Tests\Browser\Pages\Admin\User as UserPage;
 use Tests\Browser\Pages\Dashboard;
 use Tests\Browser\Pages\Home;
 use Tests\TestCaseDusk;
 use Illuminate\Foundation\Testing\DatabaseMigrations;
 
 class UserTest extends TestCaseDusk
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
         self::useAdminUrl();
 
         $john = $this->getTestUser('john@kolab.org');
         $john->setSettings([
                 'phone' => '+48123123123',
                 'external_email' => 'john.doe.external@gmail.com',
         ]);
         if ($john->isSuspended()) {
             User::where('email', $john->email)->update(['status' => $john->status - User::STATUS_SUSPENDED]);
         }
         $wallet = $john->wallets()->first();
         $wallet->discount()->dissociate();
         $wallet->save();
 
         Entitlement::where('cost', '>=', 5000)->delete();
         $this->deleteTestGroup('group-test@kolab.org');
         $this->deleteTestUser('userstest1@kolabnow.com');
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $john->setSettings([
                 'phone' => null,
                 'external_email' => 'john.doe.external@gmail.com',
         ]);
         if ($john->isSuspended()) {
             User::where('email', $john->email)->update(['status' => $john->status - User::STATUS_SUSPENDED]);
         }
         $wallet = $john->wallets()->first();
         $wallet->discount()->dissociate();
         $wallet->save();
 
         Entitlement::where('cost', '>=', 5000)->delete();
         $this->deleteTestGroup('group-test@kolab.org');
         $this->deleteTestUser('userstest1@kolabnow.com');
 
         parent::tearDown();
     }
 
     /**
      * Test user info page (unauthenticated)
      */
     public function testUserUnauth(): void
     {
         // Test that the page requires authentication
         $this->browse(function (Browser $browser) {
             $jack = $this->getTestUser('jack@kolab.org');
             $browser->visit('/user/' . $jack->id)->on(new Home());
         });
     }
 
     /**
      * Test user info page
      */
     public function testUserInfo(): void
     {
         $this->browse(function (Browser $browser) {
             $jack = $this->getTestUser('jack@kolab.org');
             $jack->setSetting('limit_geo', null);
             $jack->setSetting('guam_enabled', null);
 
             $page = new UserPage($jack->id);
 
             $browser->visit(new Home())
                 ->submitLogon('jeroen@jeroen.jeroen', \App\Utils::generatePassphrase(), true)
                 ->on(new Dashboard())
                 ->visit($page)
                 ->on($page);
 
             // Assert main info box content
             $browser->assertSeeIn('@user-info .card-title', $jack->email)
                 ->with('@user-info form', function (Browser $browser) use ($jack) {
                     $browser->assertElementsCount('.row', 7)
                         ->assertSeeIn('.row:nth-child(1) label', 'Managed by')
                         ->assertSeeIn('.row:nth-child(1) #manager a', 'john@kolab.org')
                         ->assertSeeIn('.row:nth-child(2) label', 'ID (Created)')
                         ->assertSeeIn('.row:nth-child(2) #userid', "{$jack->id} ({$jack->created_at})")
                         ->assertSeeIn('.row:nth-child(3) label', 'Status')
                         ->assertSeeIn('.row:nth-child(3) #status span.text-success', 'Active')
+                        ->assertDontSeeIn('.row:nth-child(3) #status', 'Restricted')
                         ->assertSeeIn('.row:nth-child(4) label', 'First Name')
                         ->assertSeeIn('.row:nth-child(4) #first_name', 'Jack')
                         ->assertSeeIn('.row:nth-child(5) label', 'Last Name')
                         ->assertSeeIn('.row:nth-child(5) #last_name', 'Daniels')
                         ->assertSeeIn('.row:nth-child(6) label', 'External Email')
                         ->assertMissing('.row:nth-child(6) #external_email a')
                         ->assertSeeIn('.row:nth-child(7) label', 'Country')
                         ->assertSeeIn('.row:nth-child(7) #country', 'United States');
                 });
 
             // Some tabs are loaded in background, wait a second
             $browser->pause(500)
                 ->assertElementsCount('@nav a', 9);
 
             // Note: Finances tab is tested in UserFinancesTest.php
             $browser->assertSeeIn('@nav #tab-finances', 'Finances');
 
             // Assert Aliases tab
             $browser->assertSeeIn('@nav #tab-aliases', 'Aliases (1)')
                 ->click('@nav #tab-aliases')
                 ->whenAvailable('@user-aliases', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 1)
                         ->assertSeeIn('table tbody tr:first-child td:first-child', 'jack.daniels@kolab.org')
                         ->assertMissing('table tfoot');
                 });
 
             // Assert Subscriptions tab
             $browser->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (3)')
                 ->click('@nav #tab-subscriptions')
                 ->with('@user-subscriptions', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 3)
                         ->assertSeeIn('table tbody tr:nth-child(1) td:first-child', 'User Mailbox')
                         ->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '5,00 CHF')
                         ->assertSeeIn('table tbody tr:nth-child(2) td:first-child', 'Storage Quota 5 GB')
                         ->assertSeeIn('table tbody tr:nth-child(2) td:last-child', '0,00 CHF')
                         ->assertSeeIn('table tbody tr:nth-child(3) td:first-child', 'Groupware Features')
                         ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '4,90 CHF')
                         ->assertMissing('table tfoot')
                         ->assertMissing('#reset2fa');
                 });
 
             // Assert Domains tab
             $browser->assertSeeIn('@nav #tab-domains', 'Domains (0)')
                 ->click('@nav #tab-domains')
                 ->with('@user-domains', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 0)
                         ->assertSeeIn('table tfoot tr td', 'There are no domains in this account.');
                 });
 
             // Assert Users tab
             $browser->assertSeeIn('@nav #tab-users', 'Users (0)')
                 ->click('@nav #tab-users')
                 ->with('@user-users', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 0)
                         ->assertSeeIn('table tfoot tr td', 'There are no users in this account.');
                 });
 
             // Assert Distribution lists tab
             $browser->assertSeeIn('@nav #tab-distlists', 'Distribution lists (0)')
                 ->click('@nav #tab-distlists')
                 ->with('@user-distlists', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 0)
                         ->assertSeeIn('table tfoot tr td', 'There are no distribution lists in this account.');
                 });
 
             // Assert Resources tab
             $browser->assertSeeIn('@nav #tab-resources', 'Resources (0)')
                 ->click('@nav #tab-resources')
                 ->with('@user-resources', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 0)
                         ->assertSeeIn('table tfoot tr td', 'There are no resources in this account.');
                 });
 
             // Assert Shared folders tab
             $browser->assertSeeIn('@nav #tab-folders', 'Shared folders (0)')
                 ->click('@nav #tab-folders')
                 ->with('@user-folders', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 0)
                         ->assertSeeIn('table tfoot tr td', 'There are no shared folders in this account.');
                 });
 
             // Assert Settings tab
             $browser->assertSeeIn('@nav #tab-settings', 'Settings')
                 ->click('@nav #tab-settings')
                 ->whenAvailable('@user-settings form', function (Browser $browser) {
                     $browser->assertElementsCount('.row', 3)
                         ->assertSeeIn('.row:first-child label', 'Greylisting')
                         ->assertSeeIn('.row:first-child .text-success', 'enabled')
                         ->assertSeeIn('.row:nth-child(2) label', 'IMAP proxy')
                         ->assertSeeIn('.row:nth-child(2) .text-danger', 'disabled')
                         ->assertSeeIn('.row:nth-child(3) label', 'Geo-lockin')
                         ->assertSeeIn('.row:nth-child(3) #limit_geo', 'No restrictions')
                         ->assertMissing('#limit_geo + button');
                 });
         });
     }
 
     /**
      * Test user info page (continue)
      *
      * @depends testUserInfo
      */
     public function testUserInfo2(): void
     {
         $this->browse(function (Browser $browser) {
             $john = $this->getTestUser('john@kolab.org');
             $page = new UserPage($john->id);
             $discount = Discount::where('code', 'TEST')->first();
             $wallet = $john->wallet();
             $wallet->discount()->associate($discount);
             $wallet->debit(2010);
             $wallet->save();
             $group = $this->getTestGroup('group-test@kolab.org', ['name' => 'Test Group']);
             $group->assignToWallet($john->wallets->first());
             $john->setSetting('greylist_enabled', null);
 
             // Click the managed-by link on Jack's page
             $browser->click('@user-info #manager a')
                 ->on($page);
 
             // Assert main info box content
             $browser->assertSeeIn('@user-info .card-title', $john->email)
                 ->with('@user-info form', function (Browser $browser) use ($john) {
                     $ext_email = $john->getSetting('external_email');
 
                     $browser->assertElementsCount('.row', 9)
                         ->assertSeeIn('.row:nth-child(1) label', 'ID (Created)')
                         ->assertSeeIn('.row:nth-child(1) #userid', "{$john->id} ({$john->created_at})")
                         ->assertSeeIn('.row:nth-child(2) label', 'Status')
                         ->assertSeeIn('.row:nth-child(2) #status span.text-success', 'Active')
                         ->assertSeeIn('.row:nth-child(3) label', 'First Name')
                         ->assertSeeIn('.row:nth-child(3) #first_name', 'John')
                         ->assertSeeIn('.row:nth-child(4) label', 'Last Name')
                         ->assertSeeIn('.row:nth-child(4) #last_name', 'Doe')
                         ->assertSeeIn('.row:nth-child(5) label', 'Organization')
                         ->assertSeeIn('.row:nth-child(5) #organization', 'Kolab Developers')
                         ->assertSeeIn('.row:nth-child(6) label', 'Phone')
                         ->assertSeeIn('.row:nth-child(6) #phone', $john->getSetting('phone'))
                         ->assertSeeIn('.row:nth-child(7) label', 'External Email')
                         ->assertSeeIn('.row:nth-child(7) #external_email a', $ext_email)
                         ->assertAttribute('.row:nth-child(7) #external_email a', 'href', "mailto:$ext_email")
                         ->assertSeeIn('.row:nth-child(8) label', 'Address')
                         ->assertSeeIn('.row:nth-child(8) #billing_address', $john->getSetting('billing_address'))
                         ->assertSeeIn('.row:nth-child(9) label', 'Country')
                         ->assertSeeIn('.row:nth-child(9) #country', 'United States');
                 });
 
             // Some tabs are loaded in background, wait a second
             $browser->pause(500)
                 ->assertElementsCount('@nav a', 9);
 
             // Note: Finances tab is tested in UserFinancesTest.php
             $browser->assertSeeIn('@nav #tab-finances', 'Finances');
 
             // Assert Aliases tab
             $browser->assertSeeIn('@nav #tab-aliases', 'Aliases (1)')
                 ->click('@nav #tab-aliases')
                 ->whenAvailable('@user-aliases', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 1)
                         ->assertSeeIn('table tbody tr:first-child td:first-child', 'john.doe@kolab.org')
                         ->assertMissing('table tfoot');
                 });
 
             // Assert Subscriptions tab
             $browser->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (3)')
                 ->click('@nav #tab-subscriptions')
                 ->with('@user-subscriptions', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 3)
                         ->assertSeeIn('table tbody tr:nth-child(1) td:first-child', 'User Mailbox')
                         ->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '4,50 CHF/month¹')
                         ->assertSeeIn('table tbody tr:nth-child(2) td:first-child', 'Storage Quota 5 GB')
                         ->assertSeeIn('table tbody tr:nth-child(2) td:last-child', '0,00 CHF/month¹')
                         ->assertSeeIn('table tbody tr:nth-child(3) td:first-child', 'Groupware Features')
                         ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '4,41 CHF/month¹')
                         ->assertMissing('table tfoot')
                         ->assertSeeIn('table + .hint', '¹ applied discount: 10% - Test voucher');
                 });
 
             // Assert Domains tab
             $browser->assertSeeIn('@nav #tab-domains', 'Domains (1)')
                 ->click('@nav #tab-domains')
                 ->with('@user-domains table', function (Browser $browser) {
                     $browser->assertElementsCount('tbody tr', 1)
                         ->assertSeeIn('tbody tr:nth-child(1) td:first-child a', 'kolab.org')
                         ->assertVisible('tbody tr:nth-child(1) td:first-child svg.text-success')
                         ->assertMissing('tfoot');
                 });
 
             // Assert Users tab
             $browser->assertSeeIn('@nav #tab-users', 'Users (4)')
                 ->click('@nav #tab-users')
                 ->with('@user-users table', function (Browser $browser) {
                     $browser->assertElementsCount('tbody tr', 4)
                         ->assertSeeIn('tbody tr:nth-child(1) td:first-child a', 'jack@kolab.org')
                         ->assertVisible('tbody tr:nth-child(1) td:first-child svg.text-success')
                         ->assertSeeIn('tbody tr:nth-child(2) td:first-child a', 'joe@kolab.org')
                         ->assertVisible('tbody tr:nth-child(2) td:first-child svg.text-success')
                         ->assertSeeIn('tbody tr:nth-child(3) td:first-child span', 'john@kolab.org')
                         ->assertVisible('tbody tr:nth-child(3) td:first-child svg.text-success')
                         ->assertSeeIn('tbody tr:nth-child(4) td:first-child a', 'ned@kolab.org')
                         ->assertVisible('tbody tr:nth-child(4) td:first-child svg.text-success')
                         ->assertMissing('tfoot');
                 });
 
             // Assert Distribution lists tab
             $browser->assertSeeIn('@nav #tab-distlists', 'Distribution lists (1)')
                 ->click('@nav #tab-distlists')
                 ->with('@user-distlists table', function (Browser $browser) {
                     $browser->assertElementsCount('tbody tr', 1)
                         ->assertSeeIn('tbody tr:nth-child(1) td:first-child a', 'Test Group')
                         ->assertVisible('tbody tr:nth-child(1) td:first-child svg.text-danger')
                         ->assertSeeIn('tbody tr:nth-child(1) td:last-child a', 'group-test@kolab.org')
                         ->assertMissing('tfoot');
                 });
 
             // Assert Resources tab
             $browser->assertSeeIn('@nav #tab-resources', 'Resources (2)')
                 ->click('@nav #tab-resources')
                 ->with('@user-resources', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 2)
                         ->assertSeeIn('table tbody tr:nth-child(1) td:first-child', 'Conference Room #1')
                         ->assertSeeIn('table tbody tr:nth-child(1) td:last-child', 'resource-test1@kolab.org')
                         ->assertSeeIn('table tbody tr:nth-child(2) td:first-child', 'Conference Room #2')
                         ->assertSeeIn('table tbody tr:nth-child(2) td:last-child', 'resource-test2@kolab.org')
                         ->assertMissing('table tfoot');
                 });
 
             // Assert Shared folders tab
             $browser->assertSeeIn('@nav #tab-folders', 'Shared folders (2)')
                 ->click('@nav #tab-folders')
                 ->with('@user-folders', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 2)
                         ->assertSeeIn('table tbody tr:nth-child(1) td:first-child', 'Calendar')
                         ->assertSeeIn('table tbody tr:nth-child(1) td:nth-child(2)', 'Calendar')
                         ->assertSeeIn('table tbody tr:nth-child(1) td:last-child', 'folder-event@kolab.org')
                         ->assertSeeIn('table tbody tr:nth-child(2) td:first-child', 'Contacts')
                         ->assertSeeIn('table tbody tr:nth-child(2) td:nth-child(2)', 'Address Book')
                         ->assertSeeIn('table tbody tr:nth-child(2) td:last-child', 'folder-contact@kolab.org')
                         ->assertMissing('table tfoot');
                 });
         });
 
         // Now we go to Ned's info page, he's a controller on John's wallet
         $this->browse(function (Browser $browser) {
             $ned = $this->getTestUser('ned@kolab.org');
             $beta_sku = Sku::withEnvTenantContext()->where('title', 'beta')->first();
             $storage_sku = Sku::withEnvTenantContext()->where('title', 'storage')->first();
             $wallet = $ned->wallet();
 
             // Add an extra storage and beta entitlement with different prices
             Entitlement::create([
                     'wallet_id' => $wallet->id,
                     'sku_id' => $beta_sku->id,
                     'cost' => 5010,
                     'entitleable_id' => $ned->id,
                     'entitleable_type' => User::class
             ]);
             Entitlement::create([
                     'wallet_id' => $wallet->id,
                     'sku_id' => $storage_sku->id,
                     'cost' => 5000,
                     'entitleable_id' => $ned->id,
                     'entitleable_type' => User::class
             ]);
 
             $page = new UserPage($ned->id);
             $ned->setSetting('greylist_enabled', 'false');
 
             $browser->click('@nav #tab-users')
                 ->click('@user-users tbody tr:nth-child(4) td:first-child a')
                 ->on($page);
 
             // Assert main info box content
             $browser->assertSeeIn('@user-info .card-title', $ned->email)
                 ->with('@user-info form', function (Browser $browser) use ($ned) {
                     $browser->assertSeeIn('.row:nth-child(2) label', 'ID (Created)')
                         ->assertSeeIn('.row:nth-child(2) #userid', "{$ned->id} ({$ned->created_at})");
                 });
 
             // Some tabs are loaded in background, wait a second
             $browser->pause(500)
                 ->assertElementsCount('@nav a', 9);
 
             // Note: Finances tab is tested in UserFinancesTest.php
             $browser->assertSeeIn('@nav #tab-finances', 'Finances');
 
             // Assert Aliases tab
             $browser->assertSeeIn('@nav #tab-aliases', 'Aliases (0)')
                 ->click('@nav #tab-aliases')
                 ->whenAvailable('@user-aliases', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 0)
                         ->assertSeeIn('table tfoot tr td', 'This user has no email aliases.');
                 });
 
             // Assert Subscriptions tab, we expect John's discount here
             $browser->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (6)')
                 ->click('@nav #tab-subscriptions')
                 ->with('@user-subscriptions', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 6)
                         ->assertSeeIn('table tbody tr:nth-child(1) td:first-child', 'User Mailbox')
                         ->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '4,50 CHF/month¹')
                         ->assertSeeIn('table tbody tr:nth-child(2) td:first-child', 'Storage Quota 6 GB')
                         ->assertSeeIn('table tbody tr:nth-child(2) td:last-child', '45,00 CHF/month¹')
                         ->assertSeeIn('table tbody tr:nth-child(3) td:first-child', 'Groupware Features')
                         ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '4,41 CHF/month¹')
                         ->assertSeeIn('table tbody tr:nth-child(4) td:first-child', 'Activesync')
                         ->assertSeeIn('table tbody tr:nth-child(4) td:last-child', '0,00 CHF/month¹')
                         ->assertSeeIn('table tbody tr:nth-child(5) td:first-child', '2-Factor Authentication')
                         ->assertSeeIn('table tbody tr:nth-child(5) td:last-child', '0,00 CHF/month¹')
                         ->assertSeeIn('table tbody tr:nth-child(6) td:first-child', 'Private Beta (invitation only)')
                         ->assertSeeIn('table tbody tr:nth-child(6) td:last-child', '45,09 CHF/month¹')
                         ->assertMissing('table tfoot')
                         ->assertSeeIn('table + .hint', '¹ applied discount: 10% - Test voucher')
                         ->assertSeeIn('#reset2fa', 'Reset 2-Factor Auth')
                         ->assertMissing('#addbetasku');
                 });
 
             // We don't expect John's domains here
             $browser->assertSeeIn('@nav #tab-domains', 'Domains (0)')
                 ->click('@nav #tab-domains')
                 ->with('@user-domains', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 0)
                         ->assertSeeIn('table tfoot tr td', 'There are no domains in this account.');
                 });
 
             // We don't expect John's users here
             $browser->assertSeeIn('@nav #tab-users', 'Users (0)')
                 ->click('@nav #tab-users')
                 ->with('@user-users', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 0)
                         ->assertSeeIn('table tfoot tr td', 'There are no users in this account.');
                 });
 
             // We don't expect John's distribution lists here
             $browser->assertSeeIn('@nav #tab-distlists', 'Distribution lists (0)')
                 ->click('@nav #tab-distlists')
                 ->with('@user-distlists', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 0)
                         ->assertSeeIn('table tfoot tr td', 'There are no distribution lists in this account.');
                 });
 
             // We don't expect John's resources here
             $browser->assertSeeIn('@nav #tab-resources', 'Resources (0)')
                 ->click('@nav #tab-resources')
                 ->with('@user-resources', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 0)
                         ->assertSeeIn('table tfoot tr td', 'There are no resources in this account.');
                 });
 
             // We don't expect John's folders here
             $browser->assertSeeIn('@nav #tab-folders', 'Shared folders (0)')
                 ->click('@nav #tab-folders')
                 ->with('@user-folders', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 0)
                         ->assertSeeIn('table tfoot tr td', 'There are no shared folders in this account.');
                 });
 
             // Assert Settings tab
             $browser->assertSeeIn('@nav #tab-settings', 'Settings')
                 ->click('@nav #tab-settings')
                 ->whenAvailable('@user-settings form', function (Browser $browser) {
                     $browser->assertElementsCount('.row', 3)
                         ->assertSeeIn('.row:first-child label', 'Greylisting')
                         ->assertSeeIn('.row:first-child .text-danger', 'disabled');
                 });
         });
     }
 
     /**
      * Test editing an external email
      *
      * @depends testUserInfo2
      */
     public function testExternalEmail(): void
     {
         $this->browse(function (Browser $browser) {
             $john = $this->getTestUser('john@kolab.org');
 
             $browser->visit(new UserPage($john->id))
                 ->waitFor('@user-info #external_email button')
                 ->click('@user-info #external_email button')
                 // Test dialog content, and closing it with Cancel button
                 ->with(new Dialog('#email-dialog'), function (Browser $browser) {
                     $browser->assertSeeIn('@title', 'External Email')
                         ->assertFocused('@body input')
                         ->assertValue('@body input', 'john.doe.external@gmail.com')
                         ->assertSeeIn('@button-cancel', 'Cancel')
                         ->assertSeeIn('@button-action', 'Submit')
                         ->click('@button-cancel');
                 })
                 ->assertMissing('#email-dialog')
                 ->click('@user-info #external_email button')
                 // Test email validation error handling, and email update
                 ->with(new Dialog('#email-dialog'), function (Browser $browser) {
                     $browser->type('@body input', 'test')
                         ->click('@button-action')
                         ->waitFor('@body input.is-invalid')
                         ->assertSeeIn(
                             '@body input + .invalid-feedback',
                             'The external email must be a valid email address.'
                         )
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                         ->type('@body input', 'test@test.com')
                         ->click('@button-action');
                 })
                 ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.')
                 ->assertSeeIn('@user-info #external_email a', 'test@test.com')
                 ->click('@user-info #external_email button')
                 ->with(new Dialog('#email-dialog'), function (Browser $browser) {
                     $browser->assertValue('@body input', 'test@test.com')
                         ->assertMissing('@body input.is-invalid')
                         ->assertMissing('@body input + .invalid-feedback')
                         ->click('@button-cancel');
                 })
                 ->assertSeeIn('@user-info #external_email a', 'test@test.com');
 
             // $john->getSetting() may not work here as it uses internal cache
             // read the value form database
             $current_ext_email = $john->settings()->where('key', 'external_email')->first()->value;
             $this->assertSame('test@test.com', $current_ext_email);
         });
     }
 
     /**
      * Test suspending/unsuspending the user
      */
     public function testSuspendAndUnsuspend(): void
     {
         $this->browse(function (Browser $browser) {
             $john = $this->getTestUser('john@kolab.org');
 
             $browser->visit(new UserPage($john->id))
                 ->assertVisible('@user-info #button-suspend')
                 ->assertMissing('@user-info #button-unsuspend')
                 ->click('@user-info #button-suspend')
                 ->assertToast(Toast::TYPE_SUCCESS, 'User suspended successfully.')
                 ->assertSeeIn('@user-info #status span.text-warning', 'Suspended')
                 ->assertMissing('@user-info #button-suspend')
                 ->click('@user-info #button-unsuspend')
                 ->assertToast(Toast::TYPE_SUCCESS, 'User unsuspended successfully.')
                 ->assertSeeIn('@user-info #status span.text-success', 'Active')
                 ->assertVisible('@user-info #button-suspend')
                 ->assertMissing('@user-info #button-unsuspend');
         });
     }
 
     /**
      * Test resetting 2FA for the user
      */
     public function testReset2FA(): void
     {
         $this->browse(function (Browser $browser) {
             $user = $this->getTestUser('userstest1@kolabnow.com');
             $sku2fa = Sku::withEnvTenantContext()->where('title', '2fa')->first();
             $user->assignSku($sku2fa);
+            $user->restrict();
             SecondFactor::seed('userstest1@kolabnow.com');
 
             $browser->visit(new UserPage($user->id))
+                ->assertSeeIn('@user-info #status', 'Restricted')
                 ->click('@nav #tab-subscriptions')
                 ->with('@user-subscriptions', function (Browser $browser) use ($sku2fa) {
                     $browser->waitFor('#reset2fa')
                         ->assertVisible('#sku' . $sku2fa->id);
                 })
                 ->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (1)')
                 ->click('#reset2fa')
                 ->with(new Dialog('#reset-2fa-dialog'), function (Browser $browser) {
                     $browser->assertSeeIn('@title', '2-Factor Authentication Reset')
                         ->assertSeeIn('@button-cancel', 'Cancel')
                         ->assertSeeIn('@button-action', 'Reset')
                         ->click('@button-action');
                 })
                 ->assertToast(Toast::TYPE_SUCCESS, '2-Factor authentication reset successfully.')
                 ->assertMissing('#sku' . $sku2fa->id)
                 ->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (0)');
         });
     }
 
     /**
      * Test resetting Geo-Lock for the user
      */
     public function testResetGeoLock(): void
     {
         $this->browse(function (Browser $browser) {
             $user = $this->getTestUser('userstest1@kolabnow.com');
             $user->setSetting('limit_geo', '["PL","DE"]');
 
             $browser->visit(new UserPage($user->id))
                 ->click('@nav #tab-settings')
                 ->whenAvailable('@user-settings form', function (Browser $browser) {
                     $browser->assertSeeIn('.row:nth-child(3) label', 'Geo-lockin')
                         ->assertSeeIn('.row:nth-child(3) #limit_geo', 'Poland, Germany')
                         ->assertSeeIn('#limit_geo + button', 'Reset')
                         ->click('#limit_geo + button');
                 })
                 ->assertToast(Toast::TYPE_SUCCESS, 'Geo-lockin setup reset successfully.')
                 ->assertMissing('#limit_geo + button');
         });
     }
 
     /**
      * Test adding the beta SKU for the user
      */
     public function testAddBetaSku(): void
     {
         $this->browse(function (Browser $browser) {
             $user = $this->getTestUser('userstest1@kolabnow.com');
             $sku = Sku::withEnvTenantContext()->where('title', 'beta')->first();
 
             $browser->visit(new UserPage($user->id))
                 ->click('@nav #tab-subscriptions')
                 ->waitFor('@user-subscriptions #addbetasku')
                 ->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (0)')
                 ->assertSeeIn('#addbetasku', 'Enable beta program')
                 ->click('#addbetasku')
                 ->assertToast(Toast::TYPE_SUCCESS, 'The subscription added successfully.')
                 ->waitFor('#sku' . $sku->id)
                 ->assertSeeIn("#sku{$sku->id} td:first-child", 'Private Beta (invitation only)')
                 ->assertSeeIn("#sku{$sku->id} td:last-child", '0,00 CHF/month')
                 ->assertMissing('#addbetasku')
                 ->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (1)');
         });
     }
 }
diff --git a/src/tests/Browser/UsersTest.php b/src/tests/Browser/UsersTest.php
index 017f88f8..845ab989 100644
--- a/src/tests/Browser/UsersTest.php
+++ b/src/tests/Browser/UsersTest.php
@@ -1,811 +1,812 @@
 <?php
 
 namespace Tests\Browser;
 
 use App\Discount;
 use App\Entitlement;
 use App\Sku;
 use App\User;
 use App\UserAlias;
 use Tests\Browser;
 use Tests\Browser\Components\CountrySelect;
 use Tests\Browser\Components\Dialog;
 use Tests\Browser\Components\ListInput;
 use Tests\Browser\Components\QuotaInput;
 use Tests\Browser\Components\Toast;
 use Tests\Browser\Pages\Dashboard;
 use Tests\Browser\Pages\Home;
 use Tests\Browser\Pages\UserInfo;
 use Tests\Browser\Pages\UserList;
 use Tests\Browser\Pages\Wallet as WalletPage;
 use Tests\TestCaseDusk;
 use Illuminate\Foundation\Testing\DatabaseMigrations;
 
 class UsersTest extends TestCaseDusk
 {
     private $profile = [
         'first_name' => 'John',
         'last_name' => 'Doe',
         'organization' => 'Kolab Developers',
         'limit_geo' => null,
     ];
 
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('julia.roberts@kolab.org');
 
         $john = User::where('email', 'john@kolab.org')->first();
         $john->setSettings($this->profile);
         UserAlias::where('user_id', $john->id)
             ->where('alias', 'john.test@kolab.org')->delete();
 
         $activesync_sku = Sku::withEnvTenantContext()->where('title', 'activesync')->first();
         $storage_sku = Sku::withEnvTenantContext()->where('title', 'storage')->first();
 
         Entitlement::where('entitleable_id', $john->id)->where('sku_id', $activesync_sku->id)->delete();
         Entitlement::where('cost', '>=', 5000)->delete();
         Entitlement::where('cost', '=', 25)->where('sku_id', $storage_sku->id)->delete();
 
         $wallet = $john->wallets()->first();
         $wallet->discount()->dissociate();
         $wallet->currency = 'CHF';
         $wallet->save();
 
         $this->clearBetaEntitlements();
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser('julia.roberts@kolab.org');
 
         $john = User::where('email', 'john@kolab.org')->first();
         $john->setSettings($this->profile);
         UserAlias::where('user_id', $john->id)
             ->where('alias', 'john.test@kolab.org')->delete();
 
         $activesync_sku = Sku::withEnvTenantContext()->where('title', 'activesync')->first();
         $storage_sku = Sku::withEnvTenantContext()->where('title', 'storage')->first();
 
         Entitlement::where('entitleable_id', $john->id)->where('sku_id', $activesync_sku->id)->delete();
         Entitlement::where('cost', '>=', 5000)->delete();
         Entitlement::where('cost', '=', 25)->where('sku_id', $storage_sku->id)->delete();
 
         $wallet = $john->wallets()->first();
         $wallet->discount()->dissociate();
         $wallet->currency = 'CHF';
         $wallet->save();
 
         $this->clearBetaEntitlements();
 
         parent::tearDown();
     }
 
     /**
      * Test user account editing page (not profile page)
      */
     public function testInfo(): void
     {
         $this->browse(function (Browser $browser) {
             $john = $this->getTestUser('john@kolab.org');
             $jack = $this->getTestUser('jack@kolab.org');
             $john->verificationcodes()->delete();
             $jack->verificationcodes()->delete();
             $john->setSetting('password_policy', 'min:10,upper,digit');
 
             // Test that the page requires authentication
             $browser->visit('/user/' . $john->id)
                 ->on(new Home())
                 ->submitLogon('john@kolab.org', 'simple123', false)
                 ->on(new UserInfo())
                 ->assertSeeIn('#user-info .card-title', 'User account')
                 ->with('@general', function (Browser $browser) {
                     // Assert form content
                     $browser->assertSeeIn('div.row:nth-child(1) label', 'Status')
                         ->assertSeeIn('div.row:nth-child(1) #status', 'Active')
                         ->assertFocused('div.row:nth-child(2) input')
                         ->assertSeeIn('div.row:nth-child(2) label', 'First Name')
                         ->assertValue('div.row:nth-child(2) input[type=text]', $this->profile['first_name'])
                         ->assertSeeIn('div.row:nth-child(3) label', 'Last Name')
                         ->assertValue('div.row:nth-child(3) input[type=text]', $this->profile['last_name'])
                         ->assertSeeIn('div.row:nth-child(4) label', 'Organization')
                         ->assertValue('div.row:nth-child(4) input[type=text]', $this->profile['organization'])
                         ->assertSeeIn('div.row:nth-child(5) label', 'Email')
                         ->assertValue('div.row:nth-child(5) input[type=text]', 'john@kolab.org')
                         ->assertDisabled('div.row:nth-child(5) input[type=text]')
                         ->assertSeeIn('div.row:nth-child(6) label', 'Email Aliases')
                         ->assertVisible('div.row:nth-child(6) .list-input')
                         ->with(new ListInput('#aliases'), function (Browser $browser) {
                             $browser->assertListInputValue(['john.doe@kolab.org'])
                                 ->assertValue('@input', '');
                         })
                         ->assertSeeIn('div.row:nth-child(7) label', 'Password')
                         ->assertValue('div.row:nth-child(7) input#password', '')
                         ->assertValue('div.row:nth-child(7) input#password_confirmation', '')
                         ->assertAttribute('#password', 'placeholder', 'Password')
                         ->assertAttribute('#password_confirmation', 'placeholder', 'Confirm Password')
                         ->assertMissing('div.row:nth-child(7) .btn-group')
                         ->assertMissing('div.row:nth-child(7) #password-link')
                         ->assertSeeIn('button[type=submit]', 'Submit')
                         // Clear some fields and submit
                         ->vueClear('#first_name')
                         ->vueClear('#last_name')
                         ->click('button[type=submit]');
                 })
                 ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.')
                 ->on(new UserList())
                 ->click('@table tr:nth-child(3) a')
                 ->on(new UserInfo())
                 ->assertSeeIn('#user-info .card-title', 'User account')
                 ->with('@general', function (Browser $browser) {
                     // Test error handling (password)
                     $browser->type('#password', 'aaaaaA')
                         ->vueClear('#password_confirmation')
                         ->whenAvailable('#password_policy', function (Browser $browser) {
                             $browser->assertElementsCount('li', 3)
                                 ->assertMissing('li:nth-child(1) svg.text-success')
                                 ->assertSeeIn('li:nth-child(1) small', "Minimum password length: 10 characters")
                                 ->waitFor('li:nth-child(2) svg.text-success')
                                 ->assertSeeIn('li:nth-child(2) small', "Password contains an upper-case character")
                                 ->assertMissing('li:nth-child(3) svg.text-success')
                                 ->assertSeeIn('li:nth-child(3) small', "Password contains a digit");
                         })
                         ->click('button[type=submit]')
                         ->waitFor('#password_confirmation + .invalid-feedback')
                         ->assertSeeIn(
                             '#password_confirmation + .invalid-feedback',
                             'The password confirmation does not match.'
                         )
                         ->assertFocused('#password')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
 
                     // TODO: Test password change
 
                     // Test form error handling (aliases)
                     $browser->vueClear('#password')
                         ->vueClear('#password_confirmation')
                         ->with(new ListInput('#aliases'), function (Browser $browser) {
                             $browser->addListEntry('invalid address');
                         })
                         ->scrollTo('button[type=submit]')->pause(500)
                         ->click('button[type=submit]')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
 
                     $browser->with(new ListInput('#aliases'), function (Browser $browser) {
                         $browser->assertFormError(2, 'The specified alias is invalid.', false);
                     });
 
                     // Test adding aliases
                     $browser->with(new ListInput('#aliases'), function (Browser $browser) {
                         $browser->removeListEntry(2)
                             ->addListEntry('john.test@kolab.org');
                     })
                         ->click('button[type=submit]')
                         ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');
                 })
                 ->on(new UserList())
                 ->click('@table tr:nth-child(3) a')
                 ->on(new UserInfo());
 
             $alias = $john->aliases()->where('alias', 'john.test@kolab.org')->first();
             $this->assertTrue(!empty($alias));
 
             // Test subscriptions
             $browser->with('@general', function (Browser $browser) {
                 $browser->assertSeeIn('div.row:nth-child(8) label', 'Subscriptions')
                     ->assertVisible('@skus.row:nth-child(8)')
                     ->with('@skus', function ($browser) {
                         $browser->assertElementsCount('tbody tr', 5)
                             // Mailbox SKU
                             ->assertSeeIn('tbody tr:nth-child(1) td.name', 'User Mailbox')
                             ->assertSeeIn('tbody tr:nth-child(1) td.price', '5,00 CHF/month')
                             ->assertChecked('tbody tr:nth-child(1) td.selection input')
                             ->assertDisabled('tbody tr:nth-child(1) td.selection input')
                             ->assertTip(
                                 'tbody tr:nth-child(1) td.buttons button',
                                 'Just a mailbox'
                             )
                             // Storage SKU
                             ->assertSeeIn('tbody tr:nth-child(2) td.name', 'Storage Quota')
                             ->assertSeeIn('tr:nth-child(2) td.price', '0,00 CHF/month')
                             ->assertChecked('tbody tr:nth-child(2) td.selection input')
                             ->assertDisabled('tbody tr:nth-child(2) td.selection input')
                             ->assertTip(
                                 'tbody tr:nth-child(2) td.buttons button',
                                 'Some wiggle room'
                             )
                             ->with(new QuotaInput('tbody tr:nth-child(2) .range-input'), function ($browser) {
                                 $browser->assertQuotaValue(5)->setQuotaValue(6);
                             })
                             ->assertSeeIn('tr:nth-child(2) td.price', '0,25 CHF/month')
                             // groupware SKU
                             ->assertSeeIn('tbody tr:nth-child(3) td.name', 'Groupware Features')
                             ->assertSeeIn('tbody tr:nth-child(3) td.price', '4,90 CHF/month')
                             ->assertChecked('tbody tr:nth-child(3) td.selection input')
                             ->assertEnabled('tbody tr:nth-child(3) td.selection input')
                             ->assertTip(
                                 'tbody tr:nth-child(3) td.buttons button',
                                 'Groupware functions like Calendar, Tasks, Notes, etc.'
                             )
                             // ActiveSync SKU
                             ->assertSeeIn('tbody tr:nth-child(4) td.name', 'Activesync')
                             ->assertSeeIn('tbody tr:nth-child(4) td.price', '0,00 CHF/month')
                             ->assertNotChecked('tbody tr:nth-child(4) td.selection input')
                             ->assertEnabled('tbody tr:nth-child(4) td.selection input')
                             ->assertTip(
                                 'tbody tr:nth-child(4) td.buttons button',
                                 'Mobile synchronization'
                             )
                             // 2FA SKU
                             ->assertSeeIn('tbody tr:nth-child(5) td.name', '2-Factor Authentication')
                             ->assertSeeIn('tbody tr:nth-child(5) td.price', '0,00 CHF/month')
                             ->assertNotChecked('tbody tr:nth-child(5) td.selection input')
                             ->assertEnabled('tbody tr:nth-child(5) td.selection input')
                             ->assertTip(
                                 'tbody tr:nth-child(5) td.buttons button',
                                 'Two factor authentication for webmail and administration panel'
                             )
                             ->click('tbody tr:nth-child(4) td.selection input');
                     })
                     ->assertMissing('@skus table + .hint')
                     ->click('button[type=submit]')
                     ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');
             })
                 ->on(new UserList())
                 ->click('@table tr:nth-child(3) a')
                 ->on(new UserInfo());
 
             $expected = ['activesync', 'groupware', 'mailbox',
                 'storage', 'storage', 'storage', 'storage', 'storage', 'storage'];
             $this->assertEntitlements($john->fresh(), $expected);
 
             // Test subscriptions interaction
             $browser->with('@general', function (Browser $browser) {
                 $browser->with('@skus', function ($browser) {
                     // Uncheck 'groupware', expect activesync unchecked
                     $browser->click('#sku-input-groupware')
                         ->assertNotChecked('#sku-input-groupware')
                         ->assertNotChecked('#sku-input-activesync')
                         ->assertEnabled('#sku-input-activesync')
                         ->assertNotReadonly('#sku-input-activesync')
                         // Check 'activesync', expect an alert
                         ->click('#sku-input-activesync')
                         ->assertDialogOpened('Activesync requires Groupware Features.')
                         ->acceptDialog()
                         ->assertNotChecked('#sku-input-activesync')
                         // Check '2FA', expect 'activesync' unchecked and readonly
                         ->click('#sku-input-2fa')
                         ->assertChecked('#sku-input-2fa')
                         ->assertNotChecked('#sku-input-activesync')
                         ->assertReadonly('#sku-input-activesync')
                         // Uncheck '2FA'
                         ->click('#sku-input-2fa')
                         ->assertNotChecked('#sku-input-2fa')
                         ->assertNotReadonly('#sku-input-activesync');
                 });
             });
 
             // Test password reset link delete and create
             $code = new \App\VerificationCode(['mode' => 'password-reset']);
             $jack->verificationcodes()->save($code);
 
             $browser->visit('/user/' . $jack->id)
                 ->on(new UserInfo())
                 ->with('@general', function (Browser $browser) use ($jack, $john, $code) {
                     // Test displaying an existing password reset link
                     $link = Browser::$baseUrl . '/password-reset/' . $code->short_code . '-' . $code->code;
                     $browser->assertSeeIn('div.row:nth-child(7) label', 'Password')
                         ->assertMissing('#password')
                         ->assertMissing('#password_confirmation')
                         ->assertMissing('#pass-mode-link:checked')
                         ->assertMissing('#pass-mode-input:checked')
                         ->assertSeeIn('#password-link code', $link)
                         ->assertVisible('#password-link button.text-danger')
                         ->assertVisible('#password-link button:not(.text-danger)')
                         ->assertAttribute('#password-link button:not(.text-danger)', 'title', 'Copy')
                         ->assertAttribute('#password-link button.text-danger', 'title', 'Delete')
                         ->assertMissing('#password-link div.form-text');
 
                     // Test deleting an existing password reset link
                     $browser->click('#password-link button.text-danger')
                         ->assertToast(Toast::TYPE_SUCCESS, 'Password reset code deleted successfully.')
                         ->assertMissing('#password-link')
                         ->assertMissing('#pass-mode-link:checked')
                         ->assertMissing('#pass-mode-input:checked')
                         ->assertMissing('#password');
 
                     $this->assertSame(0, $jack->verificationcodes()->count());
 
                     // Test creating a password reset link
                     $link = preg_replace('|/[a-z0-9A-Z-]+$|', '', $link) . '/';
                     $browser->click('#pass-mode-link + label')
                         ->assertMissing('#password')
                         ->assertMissing('#password_confirmation')
                         ->waitFor('#password-link code')
                         ->assertSeeIn('#password-link code', $link)
-                        ->assertSeeIn('#password-link div.form-text', "Press Submit to activate the link");
+                        ->assertSeeIn('#password-link div.form-text', "Press Submit to activate the link")
+                        ->pause(100);
 
                     // Test copy to clipboard
                     /* TODO: Figure out how to give permission to do this operation
                     $code = $john->verificationcodes()->first();
                     $link .= $code->short_code . '-' . $code->code;
 
                     $browser->assertMissing('#password-link button.text-danger')
                         ->click('#password-link button:not(.text-danger)')
                         ->keys('#organization', ['{left_control}', 'v'])
                         ->assertAttribute('#organization', 'value', $link)
                         ->vueClear('#organization');
                     */
 
                     // Finally submit the form
                     $browser->click('button[type=submit]')
                         ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');
 
                     $this->assertSame(1, $jack->verificationcodes()->where('active', true)->count());
                     $this->assertSame(0, $john->verificationcodes()->count());
                 });
         });
     }
 
     /**
      * Test user settings tab
      *
      * @depends testInfo
      */
     public function testUserSettings(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $john->setSetting('greylist_enabled', null);
         $john->setSetting('guam_enabled', null);
         $john->setSetting('limit_geo', null);
 
         $this->browse(function (Browser $browser) use ($john) {
             $browser->visit('/user/' . $john->id)
                 ->on(new UserInfo())
                 ->assertElementsCount('@nav a', 2)
                 ->assertSeeIn('@nav #tab-general', 'General')
                 ->assertSeeIn('@nav #tab-settings', 'Settings')
                 ->click('@nav #tab-settings')
                 ->with('#settings form', function (Browser $browser) {
                     $browser->assertSeeIn('div.row:nth-child(1) label', 'Greylisting')
                         ->assertMissing('div.row:nth-child(2)') // guam and geo-lockin settings are hidden
                         ->click('div.row:nth-child(1) input[type=checkbox]:checked')
                         ->click('button[type=submit]')
                         ->assertToast(Toast::TYPE_SUCCESS, 'User settings updated successfully.');
                 });
         });
 
         $this->assertSame('false', $john->getSetting('greylist_enabled'));
 
         $this->addBetaEntitlement($john);
 
         $this->browse(function (Browser $browser) use ($john) {
             $browser->refresh()
                 ->on(new UserInfo())
                 ->click('@nav #tab-settings')
                 ->with('#settings form', function (Browser $browser) use ($john) {
                     $browser->assertSeeIn('div.row:nth-child(1) label', 'Greylisting')
                         ->assertSeeIn('div.row:nth-child(2) label', 'IMAP proxy')
                         ->assertNotChecked('div.row:nth-child(2) input')
                         ->assertSeeIn('div.row:nth-child(3) label', 'Geo-lockin')
                         ->with(new CountrySelect('#limit_geo'), function ($browser) {
                             $browser->assertCountries([])
                                 ->setCountries(['DE', 'PL'])
                                 ->assertCountries(['DE', 'PL']);
                         })
                         ->click('div.row:nth-child(2) input')
                         ->click('button[type=submit]')
                         ->assertToast(Toast::TYPE_SUCCESS, 'User settings updated successfully.');
 
                     $this->assertSame('["DE","PL"]', $john->getSetting('limit_geo'));
                     $this->assertSame('true', $john->getSetting('guam_enabled'));
 
                     $browser
                         ->with(new CountrySelect('#limit_geo'), function ($browser) {
                             $browser->setCountries([])
                                 ->assertCountries([]);
                         })
                         ->click('div.row:nth-child(2) input')
                         ->click('button[type=submit]')
                         ->assertToast(Toast::TYPE_SUCCESS, 'User settings updated successfully.');
 
                     $this->assertSame(null, $john->getSetting('limit_geo'));
                     $this->assertSame(null, $john->getSetting('guam_enabled'));
                 });
         });
     }
 
     /**
      * Test user adding page
      *
      * @depends testInfo
      */
     public function testNewUser(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $john->setSetting('password_policy', null);
 
         $this->browse(function (Browser $browser) {
             $browser->visit(new UserList())
                 ->assertSeeIn('button.user-new', 'Create user')
                 ->click('button.user-new')
                 ->on(new UserInfo())
                 ->assertSeeIn('#user-info .card-title', 'New user account')
                 ->with('@general', function (Browser $browser) {
                     // Assert form content
                     $browser->assertFocused('div.row:nth-child(1) input')
                         ->assertSeeIn('div.row:nth-child(1) label', 'First Name')
                         ->assertValue('div.row:nth-child(1) input[type=text]', '')
                         ->assertSeeIn('div.row:nth-child(2) label', 'Last Name')
                         ->assertValue('div.row:nth-child(2) input[type=text]', '')
                         ->assertSeeIn('div.row:nth-child(3) label', 'Organization')
                         ->assertValue('div.row:nth-child(3) input[type=text]', '')
                         ->assertSeeIn('div.row:nth-child(4) label', 'Email')
                         ->assertValue('div.row:nth-child(4) input[type=text]', '')
                         ->assertEnabled('div.row:nth-child(4) input[type=text]')
                         ->assertSeeIn('div.row:nth-child(5) label', 'Email Aliases')
                         ->assertVisible('div.row:nth-child(5) .list-input')
                         ->with(new ListInput('#aliases'), function (Browser $browser) {
                             $browser->assertListInputValue([])
                                 ->assertValue('@input', '');
                         })
                         ->assertSeeIn('div.row:nth-child(6) label', 'Password')
                         ->assertValue('div.row:nth-child(6) input#password', '')
                         ->assertValue('div.row:nth-child(6) input#password_confirmation', '')
                         ->assertAttribute('#password', 'placeholder', 'Password')
                         ->assertAttribute('#password_confirmation', 'placeholder', 'Confirm Password')
                         ->assertSeeIn('div.row:nth-child(6) .btn-group input:first-child + label', 'Enter password')
                         ->assertSeeIn('div.row:nth-child(6) .btn-group input:not(:first-child) + label', 'Set via link')
                         ->assertChecked('div.row:nth-child(6) .btn-group input:first-child')
                         ->assertMissing('div.row:nth-child(6) #password-link')
                         ->assertSeeIn('div.row:nth-child(7) label', 'Package')
                         // assert packages list widget, select "Lite Account"
                         ->with('@packages', function ($browser) {
                             $browser->assertElementsCount('tbody tr', 2)
                                 ->assertSeeIn('tbody tr:nth-child(1)', 'Groupware Account')
                                 ->assertSeeIn('tbody tr:nth-child(2)', 'Lite Account')
                                 ->assertSeeIn('tbody tr:nth-child(1) .price', '9,90 CHF/month')
                                 ->assertSeeIn('tbody tr:nth-child(2) .price', '5,00 CHF/month')
                                 ->assertChecked('tbody tr:nth-child(1) input')
                                 ->click('tbody tr:nth-child(2) input')
                                 ->assertNotChecked('tbody tr:nth-child(1) input')
                                 ->assertChecked('tbody tr:nth-child(2) input');
                         })
                         ->assertMissing('@packages table + .hint')
                         ->assertSeeIn('button[type=submit]', 'Submit');
 
                     // Test browser-side required fields and error handling
                     $browser->click('button[type=submit]')
                         ->assertFocused('#email')
                         ->type('#email', 'invalid email')
                         ->type('#password', 'simple123')
                         ->type('#password_confirmation', 'simple')
                         ->click('button[type=submit]')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                         ->assertSeeIn('#email + .invalid-feedback', 'The specified email is invalid.')
                         ->assertSeeIn(
                             '#password_confirmation + .invalid-feedback',
                             'The password confirmation does not match.'
                         );
                 });
 
             // Test form error handling (aliases)
             $browser->with('@general', function (Browser $browser) {
                 $browser->type('#email', 'julia.roberts@kolab.org')
                     ->type('#password_confirmation', 'simple123')
                     ->with(new ListInput('#aliases'), function (Browser $browser) {
                         $browser->addListEntry('invalid address');
                     })
                     ->click('button[type=submit]')
                     ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                     ->with(new ListInput('#aliases'), function (Browser $browser) {
                         $browser->assertFormError(1, 'The specified alias is invalid.', false);
                     });
             });
 
             // Successful account creation
             $browser->with('@general', function (Browser $browser) {
                 $browser->type('#first_name', 'Julia')
                     ->type('#last_name', 'Roberts')
                     ->type('#organization', 'Test Org')
                     ->with(new ListInput('#aliases'), function (Browser $browser) {
                         $browser->removeListEntry(1)
                             ->addListEntry('julia.roberts2@kolab.org');
                     })
                     ->click('button[type=submit]');
             })
             ->assertToast(Toast::TYPE_SUCCESS, 'User created successfully.')
             // check redirection to users list
             ->on(new UserList())
                 ->whenAvailable('@table', function (Browser $browser) {
                     $browser->assertElementsCount('tbody tr', 5)
                         ->assertSeeIn('tbody tr:nth-child(4) a', 'julia.roberts@kolab.org');
                 });
 
             $julia = User::where('email', 'julia.roberts@kolab.org')->first();
             $alias = UserAlias::where('user_id', $julia->id)->where('alias', 'julia.roberts2@kolab.org')->first();
 
             $this->assertTrue(!empty($alias));
             $this->assertEntitlements($julia, ['mailbox', 'storage', 'storage', 'storage', 'storage', 'storage']);
             $this->assertSame('Julia', $julia->getSetting('first_name'));
             $this->assertSame('Roberts', $julia->getSetting('last_name'));
             $this->assertSame('Test Org', $julia->getSetting('organization'));
 
             // Some additional tests for the list input widget
             $browser->click('@table tbody tr:nth-child(4) a')
                 ->on(new UserInfo())
                 ->with(new ListInput('#aliases'), function (Browser $browser) {
                     $browser->assertListInputValue(['julia.roberts2@kolab.org'])
                         ->addListEntry('invalid address')
                         ->type('.input-group:nth-child(2) input', '@kolab.org')
                         ->keys('.input-group:nth-child(2) input', '{enter}');
                 })
                 // TODO: Investigate why this click does not work, for now we
                 // submit the form with Enter key above
                 //->click('@general button[type=submit]')
                 ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                 ->with(new ListInput('#aliases'), function (Browser $browser) {
                     $browser->assertVisible('.input-group:nth-child(2) input.is-invalid')
                         ->assertVisible('.input-group:nth-child(3) input.is-invalid')
                         ->type('.input-group:nth-child(2) input', 'julia.roberts3@kolab.org')
                         ->type('.input-group:nth-child(3) input', 'julia.roberts4@kolab.org')
                         ->keys('.input-group:nth-child(3) input', '{enter}');
                 })
                 // TODO: Investigate why this click does not work, for now we
                 // submit the form with Enter key above
                 //->click('@general button[type=submit]')
                 ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');
 
             $julia = User::where('email', 'julia.roberts@kolab.org')->first();
             $aliases = $julia->aliases()->orderBy('alias')->get()->pluck('alias')->all();
 
             $this->assertSame(['julia.roberts3@kolab.org', 'julia.roberts4@kolab.org'], $aliases);
         });
     }
 
     /**
      * Test user delete
      *
      * @depends testNewUser
      */
     public function testDeleteUser(): void
     {
         // First create a new user
         $john = $this->getTestUser('john@kolab.org');
         $julia = $this->getTestUser('julia.roberts@kolab.org');
         $package_kolab = \App\Package::where('title', 'kolab')->first();
         $john->assignPackage($package_kolab, $julia);
 
         // Test deleting non-controller user
         $this->browse(function (Browser $browser) use ($julia) {
             $browser->visit('/user/' . $julia->id)
                 ->on(new UserInfo())
                 ->assertSeeIn('button.button-delete', 'Delete user')
                 ->click('button.button-delete')
                 ->with(new Dialog('#delete-warning'), function (Browser $browser) {
                     $browser->assertSeeIn('@title', 'Delete julia.roberts@kolab.org')
                         ->assertFocused('@button-cancel')
                         ->assertSeeIn('@button-cancel', 'Cancel')
                         ->assertSeeIn('@button-action', 'Delete')
                         ->click('@button-cancel');
                 })
                 ->waitUntilMissing('#delete-warning')
                 ->click('button.button-delete')
                 ->with(new Dialog('#delete-warning'), function (Browser $browser) {
                     $browser->click('@button-action');
                 })
                 ->waitUntilMissing('#delete-warning')
                 ->assertToast(Toast::TYPE_SUCCESS, 'User deleted successfully.')
                 ->on(new UserList())
                 ->with('@table', function (Browser $browser) {
                     $browser->assertElementsCount('tbody tr', 4)
                         ->assertSeeIn('tbody tr:nth-child(1) a', 'jack@kolab.org')
                         ->assertSeeIn('tbody tr:nth-child(2) a', 'joe@kolab.org')
                         ->assertSeeIn('tbody tr:nth-child(3) a', 'john@kolab.org')
                         ->assertSeeIn('tbody tr:nth-child(4) a', 'ned@kolab.org');
                 });
 
             $julia = User::where('email', 'julia.roberts@kolab.org')->first();
             $this->assertTrue(empty($julia));
         });
 
         // Test that non-controller user cannot see/delete himself on the users list
         $this->browse(function (Browser $browser) {
             $browser->visit('/logout')
                 ->on(new Home())
                 ->submitLogon('jack@kolab.org', 'simple123', true)
                 ->visit('/users')
                 ->assertErrorPage(403);
         });
 
         // Test that controller user (Ned) can see all the users
         $this->browse(function (Browser $browser) {
             $browser->visit('/logout')
                 ->on(new Home())
                 ->submitLogon('ned@kolab.org', 'simple123', true)
                 ->visit(new UserList())
                 ->whenAvailable('@table', function (Browser $browser) {
                     $browser->assertElementsCount('tbody tr', 4);
                 });
 
                 // TODO: Test the delete action in details
         });
 
         // TODO: Test what happens with the logged in user session after he's been deleted by another user
     }
 
     /**
      * Test discounted sku/package prices in the UI
      */
     public function testDiscountedPrices(): void
     {
         // Add 10% discount
         $discount = Discount::where('code', 'TEST')->first();
         $john = User::where('email', 'john@kolab.org')->first();
         $wallet = $john->wallet();
         $wallet->discount()->associate($discount);
         $wallet->save();
 
         // SKUs on user edit page
         $this->browse(function (Browser $browser) {
             $browser->visit('/logout')
                 ->on(new Home())
                 ->submitLogon('john@kolab.org', 'simple123', true)
                 ->visit(new UserList())
                 ->waitFor('@table tr:nth-child(2)')
                 ->click('@table tr:nth-child(2) a') // joe@kolab.org
                 ->on(new UserInfo())
                 ->with('@general', function (Browser $browser) {
                     $browser->whenAvailable('@skus', function (Browser $browser) {
                         $quota_input = new QuotaInput('tbody tr:nth-child(2) .range-input');
                         $browser->waitFor('tbody tr')
                             ->assertElementsCount('tbody tr', 5)
                             // Mailbox SKU
                             ->assertSeeIn('tbody tr:nth-child(1) td.price', '4,50 CHF/month¹')
                             // Storage SKU
                             ->assertSeeIn('tr:nth-child(2) td.price', '0,00 CHF/month¹')
                             ->with($quota_input, function (Browser $browser) {
                                 $browser->setQuotaValue(100);
                             })
                             ->assertSeeIn('tr:nth-child(2) td.price', '21,37 CHF/month¹')
                             // Groupware SKU
                             ->assertSeeIn('tbody tr:nth-child(3) td.price', '4,41 CHF/month¹')
                             // ActiveSync SKU
                             ->assertSeeIn('tbody tr:nth-child(4) td.price', '0,00 CHF/month¹')
                             // 2FA SKU
                             ->assertSeeIn('tbody tr:nth-child(5) td.price', '0,00 CHF/month¹');
                     })
                     ->assertSeeIn('@skus table + .hint', '¹ applied discount: 10% - Test voucher');
                 });
         });
 
         // Packages on new user page
         $this->browse(function (Browser $browser) {
             $browser->visit(new UserList())
                 ->click('button.user-new')
                 ->on(new UserInfo())
                 ->with('@general', function (Browser $browser) {
                     $browser->whenAvailable('@packages', function (Browser $browser) {
                         $browser->assertElementsCount('tbody tr', 2)
                             ->assertSeeIn('tbody tr:nth-child(1) .price', '8,91 CHF/month¹') // Groupware
                             ->assertSeeIn('tbody tr:nth-child(2) .price', '4,50 CHF/month¹'); // Lite
                     })
                     ->assertSeeIn('@packages table + .hint', '¹ applied discount: 10% - Test voucher');
                 });
         });
 
         // Test using entitlement cost instead of the SKU cost
         $this->browse(function (Browser $browser) use ($wallet) {
             $joe = User::where('email', 'joe@kolab.org')->first();
             $beta_sku = Sku::withEnvTenantContext()->where('title', 'beta')->first();
             $storage_sku = Sku::withEnvTenantContext()->where('title', 'storage')->first();
 
             // Add an extra storage and beta entitlement with different prices
             Entitlement::create([
                     'wallet_id' => $wallet->id,
                     'sku_id' => $beta_sku->id,
                     'cost' => 5010,
                     'entitleable_id' => $joe->id,
                     'entitleable_type' => User::class
             ]);
             Entitlement::create([
                     'wallet_id' => $wallet->id,
                     'sku_id' => $storage_sku->id,
                     'cost' => 5000,
                     'entitleable_id' => $joe->id,
                     'entitleable_type' => User::class
             ]);
 
             $browser->visit('/user/' . $joe->id)
                 ->on(new UserInfo())
                 ->with('@general', function (Browser $browser) {
                     $browser->whenAvailable('@skus', function (Browser $browser) {
                         $quota_input = new QuotaInput('tbody tr:nth-child(2) .range-input');
                         $browser->waitFor('tbody tr')
                             // Beta SKU
                             ->assertSeeIn('tbody tr:nth-child(6) td.price', '45,09 CHF/month¹')
                             // Storage SKU
                             ->assertSeeIn('tr:nth-child(2) td.price', '45,00 CHF/month¹')
                             ->with($quota_input, function (Browser $browser) {
                                 $browser->setQuotaValue(7);
                             })
                             ->assertSeeIn('tr:nth-child(2) td.price', '45,22 CHF/month¹')
                             ->with($quota_input, function (Browser $browser) {
                                 $browser->setQuotaValue(5);
                             })
                             ->assertSeeIn('tr:nth-child(2) td.price', '0,00 CHF/month¹');
                     })
                     ->assertSeeIn('@skus table + .hint', '¹ applied discount: 10% - Test voucher');
                 });
         });
     }
 
     /**
      * Test non-default currency in the UI
      */
     public function testCurrency(): void
     {
         // Add 10% discount
         $john = User::where('email', 'john@kolab.org')->first();
         $wallet = $john->wallet();
         $wallet->balance = -1000;
         $wallet->currency = 'EUR';
         $wallet->save();
 
         // On Dashboard and the wallet page
         $this->browse(function (Browser $browser) {
             $browser->visit('/logout')
                 ->on(new Home())
                 ->submitLogon('john@kolab.org', 'simple123', true)
                 ->on(new Dashboard())
                 ->assertSeeIn('@links .link-wallet .badge', '-10,00 €')
                 ->click('@links .link-wallet')
                 ->on(new WalletPage())
                 ->assertSeeIn('#wallet .card-title', 'Account balance -10,00 €');
         });
 
         // SKUs on user edit page
         $this->browse(function (Browser $browser) {
             $browser->visit(new UserList())
                 ->waitFor('@table tr:nth-child(2)')
                 ->click('@table tr:nth-child(2) a') // joe@kolab.org
                 ->on(new UserInfo())
                 ->with('@general', function (Browser $browser) {
                     $browser->whenAvailable('@skus', function (Browser $browser) {
                         $quota_input = new QuotaInput('tbody tr:nth-child(2) .range-input');
                         $browser->waitFor('tbody tr')
                             ->assertElementsCount('tbody tr', 5)
                             // Mailbox SKU
                             ->assertSeeIn('tbody tr:nth-child(1) td.price', '5,00 €/month')
                             // Storage SKU
                             ->assertSeeIn('tr:nth-child(2) td.price', '0,00 €/month')
                             ->with($quota_input, function (Browser $browser) {
                                 $browser->setQuotaValue(100);
                             })
                             ->assertSeeIn('tr:nth-child(2) td.price', '23,75 €/month');
                     });
                 });
         });
 
         // Packages on new user page
         $this->browse(function (Browser $browser) {
             $browser->visit(new UserList())
                 ->click('button.user-new')
                 ->on(new UserInfo())
                 ->with('@general', function (Browser $browser) {
                     $browser->whenAvailable('@packages', function (Browser $browser) {
                         $browser->assertElementsCount('tbody tr', 2)
                             ->assertSeeIn('tbody tr:nth-child(1) .price', '9,90 €/month') // Groupware
                             ->assertSeeIn('tbody tr:nth-child(2) .price', '5,00 €/month'); // Lite
                     });
                 });
         });
     }
 }
diff --git a/src/tests/Feature/Console/User/RestrictTest.php b/src/tests/Feature/Console/User/RestrictTest.php
new file mode 100644
index 00000000..d96c13b4
--- /dev/null
+++ b/src/tests/Feature/Console/User/RestrictTest.php
@@ -0,0 +1,58 @@
+<?php
+
+namespace Tests\Feature\Console\User;
+
+use Illuminate\Support\Facades\Queue;
+use Tests\TestCase;
+
+class RestrictTest extends TestCase
+{
+    /**
+     * {@inheritDoc}
+     */
+    public function setUp(): void
+    {
+        parent::setUp();
+
+        $this->deleteTestUser('user-restrict-test@kolabnow.com');
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public function tearDown(): void
+    {
+        $this->deleteTestUser('user-restrict-test@kolabnow.com');
+
+        parent::tearDown();
+    }
+
+    /**
+     * Test the command
+     */
+    public function testHandle(): void
+    {
+        Queue::fake();
+
+        // Non-existing user
+        $code = \Artisan::call("user:restrict unknown@unknown.org");
+        $output = trim(\Artisan::output());
+
+        $this->assertSame(1, $code);
+        $this->assertSame("User not found.", $output);
+
+        // Create a user account for degrade
+        $user = $this->getTestUser('user-restrict-test@kolabnow.com');
+
+        $this->assertFalse($user->isRestricted());
+
+        $code = \Artisan::call("user:restrict {$user->email}");
+        $output = trim(\Artisan::output());
+
+        $user->refresh();
+
+        $this->assertTrue($user->isRestricted());
+        $this->assertSame('', $output);
+        $this->assertSame(0, $code);
+    }
+}
diff --git a/src/tests/Feature/Console/User/ResyncTest.php b/src/tests/Feature/Console/User/ResyncTest.php
index a98364f5..25a83589 100644
--- a/src/tests/Feature/Console/User/ResyncTest.php
+++ b/src/tests/Feature/Console/User/ResyncTest.php
@@ -1,105 +1,105 @@
 <?php
 
 namespace Tests\Feature\Console\User;
 
 use App\User;
 use Illuminate\Support\Facades\Queue;
 use Tests\TestCase;
 
 class ResyncTest extends TestCase
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('user@force-delete.com');
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser('user@force-delete.com');
 
         parent::tearDown();
     }
 
     /**
      * Test the command
      */
     public function testHandle(): void
     {
         // Non-existing user
         $code = \Artisan::call("user:resync unknown");
         $output = trim(\Artisan::output());
 
         $this->assertSame(1, $code);
         $this->assertSame("User not found.", $output);
 
         $user = $this->getTestUser('user@force-delete.com');
         User::where('id', $user->id)->update([
                 'deleted_at' => now(),
                 'status' => User::STATUS_DELETED | User::STATUS_IMAP_READY,
         ]);
 
         Queue::fake();
 
         // Test success (--dry-run)
         $code = \Artisan::call("user:resync {$user->email} --dry-run");
         $output = trim(\Artisan::output());
 
         $this->assertSame(0, $code);
         $this->assertSame("{$user->email}: will be pushed", $output);
         $this->assertTrue($user->fresh()->isDeleted());
 
         Queue::assertNothingPushed();
 
         // Test success
         $code = \Artisan::call("user:resync {$user->email}");
         $output = trim(\Artisan::output());
 
         $this->assertSame(0, $code);
         $this->assertSame("{$user->email}: pushed", $output);
         $user->refresh();
         $this->assertFalse($user->isDeleted());
         $this->assertTrue($user->isImapReady());
 
         Queue::assertPushed(\App\Jobs\User\DeleteJob::class, 1);
         Queue::assertPushed(\App\Jobs\User\DeleteJob::class, function ($job) use ($user) {
             $job_user_id = TestCase::getObjectProperty($job, 'userId');
             return $job_user_id === $user->id;
         });
 
         Queue::fake();
         User::withTrashed()->where('id', $user->id)->update(['status' => User::STATUS_DELETED]);
 
         // Test nothing to be done (deleted user)
         $code = \Artisan::call("user:resync {$user->email}");
         $output = trim(\Artisan::output());
 
         $this->assertSame(0, $code);
         $this->assertSame("{$user->email}: in-sync", $output);
         Queue::assertNothingPushed();
 
         Queue::fake();
         User::withTrashed()->where('id', $user->id)->update([
                 'status' => User::STATUS_DELETED | User::STATUS_IMAP_READY
         ]);
 
         // Remove all deleted users except one, to not interfere
-        User::withTrashed()->whereNotIn('id', [$user->id])->forceDelete();
+        User::withTrashed()->whereNotNull('deleted_at')->whereNotIn('id', [$user->id])->forceDelete();
 
         // Test run for all deleted users
         $code = \Artisan::call("user:resync --deleted-only");
         $output = trim(\Artisan::output());
 
         $this->assertSame(0, $code);
         $this->assertSame("{$user->email}: pushed", $output);
 
         // TODO: Test other cases (non-deleted users)
     }
 }
diff --git a/src/tests/Feature/Console/User/UnrestrictTest.php b/src/tests/Feature/Console/User/UnrestrictTest.php
new file mode 100644
index 00000000..9e22666f
--- /dev/null
+++ b/src/tests/Feature/Console/User/UnrestrictTest.php
@@ -0,0 +1,57 @@
+<?php
+
+namespace Tests\Feature\Console\User;
+
+use Illuminate\Support\Facades\Queue;
+use Tests\TestCase;
+
+class UnrestrictTest extends TestCase
+{
+    /**
+     * {@inheritDoc}
+     */
+    public function setUp(): void
+    {
+        parent::setUp();
+
+        $this->deleteTestUser('user-restrict-test@kolabnow.com');
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public function tearDown(): void
+    {
+        $this->deleteTestUser('user-restrict-test@kolabnow.com');
+
+        parent::tearDown();
+    }
+
+    /**
+     * Test the command
+     */
+    public function testHandle(): void
+    {
+        Queue::fake();
+
+        // Non-existing user
+        $code = \Artisan::call("user:unrestrict unknown@unknown.org");
+        $output = trim(\Artisan::output());
+
+        $this->assertSame(1, $code);
+        $this->assertSame("User not found.", $output);
+
+        $user = $this->getTestUser('user-restrict-test@kolabnow.com', ['status' => \App\User::STATUS_RESTRICTED]);
+
+        $this->assertTrue($user->isRestricted());
+
+        $code = \Artisan::call("user:unrestrict {$user->email}");
+        $output = trim(\Artisan::output());
+
+        $user->refresh();
+
+        $this->assertFalse($user->isRestricted());
+        $this->assertSame('', $output);
+        $this->assertSame(0, $code);
+    }
+}
diff --git a/src/tests/Feature/Controller/SignupTest.php b/src/tests/Feature/Controller/SignupTest.php
index 391fc92c..8ca62fc2 100644
--- a/src/tests/Feature/Controller/SignupTest.php
+++ b/src/tests/Feature/Controller/SignupTest.php
@@ -1,918 +1,920 @@
 <?php
 
 namespace Tests\Feature\Controller;
 
 use App\Http\Controllers\API\SignupController;
 use App\Discount;
 use App\Domain;
 use App\SignupCode;
 use App\SignupInvitation as SI;
 use App\User;
 use Illuminate\Support\Facades\Queue;
 use Tests\TestCase;
 
 class SignupTest extends TestCase
 {
     private $domain;
 
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         // TODO: Some tests depend on existence of individual and group plans,
         //       we should probably create plans here to not depend on that
         $this->domain = $this->getPublicDomain();
 
         $this->deleteTestUser("SignupControllerTest1@$this->domain");
         $this->deleteTestUser("signuplogin@$this->domain");
         $this->deleteTestUser("admin@external.com");
         $this->deleteTestUser("test-inv@kolabnow.com");
 
         $this->deleteTestDomain('external.com');
         $this->deleteTestDomain('signup-domain.com');
 
         $this->deleteTestGroup('group-test@kolabnow.com');
         SI::truncate();
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser("SignupControllerTest1@$this->domain");
         $this->deleteTestUser("signuplogin@$this->domain");
         $this->deleteTestUser("admin@external.com");
         $this->deleteTestUser("test-inv@kolabnow.com");
 
         $this->deleteTestDomain('external.com');
         $this->deleteTestDomain('signup-domain.com');
 
         $this->deleteTestGroup('group-test@kolabnow.com');
         SI::truncate();
 
         parent::tearDown();
     }
 
     /**
      * Return a public domain for signup tests
      */
     private function getPublicDomain(): string
     {
         if (!$this->domain) {
             $this->refreshApplication();
             $public_domains = Domain::getPublicDomains();
             $this->domain = reset($public_domains);
 
             if (empty($this->domain)) {
                 $this->domain = 'signup-domain.com';
                 Domain::create([
                         'namespace' => $this->domain,
                         'status' => Domain::STATUS_ACTIVE,
                         'type' => Domain::TYPE_PUBLIC,
                 ]);
             }
         }
 
         return $this->domain;
     }
 
     /**
      * Test fetching plans for signup
      */
     public function testSignupPlans(): void
     {
         $response = $this->get('/api/auth/signup/plans');
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertCount(2, $json['plans']);
         $this->assertArrayHasKey('title', $json['plans'][0]);
         $this->assertArrayHasKey('name', $json['plans'][0]);
         $this->assertArrayHasKey('description', $json['plans'][0]);
         $this->assertArrayHasKey('button', $json['plans'][0]);
     }
 
     /**
      * Test fetching invitation
      */
     public function testSignupInvitations(): void
     {
         Queue::fake();
 
         $invitation = SI::create(['email' => 'email1@ext.com']);
 
         // Test existing invitation
         $response = $this->get("/api/auth/signup/invitations/{$invitation->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame($invitation->id, $json['id']);
 
         // Test non-existing invitation
         $response = $this->get("/api/auth/signup/invitations/abc");
         $response->assertStatus(404);
 
         // Test completed invitation
         SI::where('id', $invitation->id)->update(['status' => SI::STATUS_COMPLETED]);
         $response = $this->get("/api/auth/signup/invitations/{$invitation->id}");
         $response->assertStatus(404);
     }
 
     /**
      * Test signup initialization with invalid input
      */
     public function testSignupInitInvalidInput(): void
     {
         // Empty input data
         $data = [];
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('email', $json['errors']);
 
         // Data with missing name
         $data = [
             'email' => 'UsersApiControllerTest1@UsersApiControllerTest.com',
             'first_name' => str_repeat('a', 250),
             'last_name' => str_repeat('a', 250),
         ];
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertArrayHasKey('first_name', $json['errors']);
         $this->assertArrayHasKey('last_name', $json['errors']);
 
         // Data with invalid email (but not phone number)
         $data = [
             'email' => '@example.org',
             'first_name' => 'Signup',
             'last_name' => 'User',
         ];
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('email', $json['errors']);
 
         // Sanity check on voucher code, last/first name is optional
         $data = [
             'voucher' => '123456789012345678901234567890123',
             'email' => 'valid@email.com',
         ];
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('voucher', $json['errors']);
 
         // Email address too long
         $data = [
             'email' => str_repeat('a', 190) . '@example.org',
             'first_name' => 'Signup',
             'last_name' => 'User',
         ];
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertSame(["The specified email address is invalid."], $json['errors']['email']);
 
         SignupCode::truncate();
 
         // Email address limit check
         $data = [
             'email' => 'test@example.org',
             'first_name' => 'Signup',
             'last_name' => 'User',
         ];
 
         \config(['app.signup.email_limit' => 0]);
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         \config(['app.signup.email_limit' => 1]);
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         // TODO: This probably should be a different message?
         $this->assertSame(["The specified email address is invalid."], $json['errors']['email']);
 
         // IP address limit check
         $data = [
             'email' => 'ip@example.org',
             'first_name' => 'Signup',
             'last_name' => 'User',
         ];
 
         \config(['app.signup.email_limit' => 0]);
         \config(['app.signup.ip_limit' => 0]);
 
         $response = $this->post('/api/auth/signup/init', $data, ['REMOTE_ADDR' => '10.1.1.1']);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         \config(['app.signup.ip_limit' => 1]);
 
         $response = $this->post('/api/auth/signup/init', $data, ['REMOTE_ADDR' => '10.1.1.1']);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         // TODO: This probably should be a different message?
         $this->assertSame(["The specified email address is invalid."], $json['errors']['email']);
 
         // TODO: Test phone validation
     }
 
     /**
      * Test signup initialization with valid input
      */
     public function testSignupInitValidInput(): array
     {
         Queue::fake();
 
         // Assert that no jobs were pushed...
         Queue::assertNothingPushed();
 
         $data = [
             'email' => 'testuser@external.com',
             'first_name' => 'Signup',
             'last_name' => 'User',
             'plan' => 'individual',
         ];
 
         $response = $this->post('/api/auth/signup/init', $data, ['REMOTE_ADDR' => '10.1.1.2']);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertCount(3, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame('email', $json['mode']);
         $this->assertNotEmpty($json['code']);
 
         $code = SignupCode::find($json['code']);
 
         $this->assertSame('10.1.1.2', $code->ip_address);
         $this->assertSame(null, $code->verify_ip_address);
         $this->assertSame(null, $code->submit_ip_address);
 
         // Assert the email sending job was pushed once
         Queue::assertPushed(\App\Jobs\SignupVerificationEmail::class, 1);
 
         // Assert the job has proper data assigned
         Queue::assertPushed(\App\Jobs\SignupVerificationEmail::class, function ($job) use ($data, $json) {
             $code = TestCase::getObjectProperty($job, 'code');
 
             return $code->code === $json['code']
                 && $code->plan === $data['plan']
                 && $code->email === $data['email']
                 && $code->first_name === $data['first_name']
                 && $code->last_name === $data['last_name'];
         });
 
         // Try the same with voucher
         $data['voucher'] = 'TEST';
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertCount(3, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame('email', $json['mode']);
         $this->assertNotEmpty($json['code']);
 
         // Assert the job has proper data assigned
         Queue::assertPushed(\App\Jobs\SignupVerificationEmail::class, function ($job) use ($data, $json) {
             $code = TestCase::getObjectProperty($job, 'code');
 
             return $code->code === $json['code']
                 && $code->plan === $data['plan']
                 && $code->email === $data['email']
                 && $code->voucher === $data['voucher']
                 && $code->first_name === $data['first_name']
                 && $code->last_name === $data['last_name'];
         });
 
         return [
             'code' => $json['code'],
             'email' => $data['email'],
             'first_name' => $data['first_name'],
             'last_name' => $data['last_name'],
             'plan' => $data['plan'],
             'voucher' => $data['voucher']
         ];
     }
 
     /**
      * Test signup code verification with invalid input
      *
      * @depends testSignupInitValidInput
      */
     public function testSignupVerifyInvalidInput(array $result): void
     {
         // Empty data
         $data = [];
 
         $response = $this->post('/api/auth/signup/verify', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertArrayHasKey('code', $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
 
         // Data with existing code but missing short_code
         $data = [
             'code' => $result['code'],
         ];
 
         $response = $this->post('/api/auth/signup/verify', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
 
         // Data with invalid short_code
         $data = [
             'code' => $result['code'],
             'short_code' => 'XXXX',
         ];
 
         $response = $this->post('/api/auth/signup/verify', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
 
         // TODO: Test expired code
     }
 
     /**
      * Test signup code verification with valid input
      *
      * @depends testSignupInitValidInput
      */
     public function testSignupVerifyValidInput(array $result): array
     {
         $code = SignupCode::find($result['code']);
         $code->ip_address = '10.1.1.2';
         $code->save();
         $data = [
             'code' => $code->code,
             'short_code' => $code->short_code,
         ];
 
         $response = $this->post('/api/auth/signup/verify', $data, ['REMOTE_ADDR' => '10.1.1.3']);
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertCount(7, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame($result['email'], $json['email']);
         $this->assertSame($result['first_name'], $json['first_name']);
         $this->assertSame($result['last_name'], $json['last_name']);
         $this->assertSame($result['voucher'], $json['voucher']);
         $this->assertSame(false, $json['is_domain']);
         $this->assertTrue(is_array($json['domains']) && !empty($json['domains']));
 
         $code->refresh();
 
         $this->assertSame('10.1.1.2', $code->ip_address);
         $this->assertSame('10.1.1.3', $code->verify_ip_address);
         $this->assertSame(null, $code->submit_ip_address);
 
         return $result;
     }
 
     /**
      * Test last signup step with invalid input
      *
      * @depends testSignupVerifyValidInput
      */
     public function testSignupInvalidInput(array $result): void
     {
         // Empty data
         $data = [];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(3, $json['errors']);
         $this->assertArrayHasKey('login', $json['errors']);
         $this->assertArrayHasKey('password', $json['errors']);
         $this->assertArrayHasKey('domain', $json['errors']);
 
         $domain = $this->getPublicDomain();
 
         // Passwords do not match and missing domain
         $data = [
             'login' => 'test',
             'password' => 'test',
             'password_confirmation' => 'test2',
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertArrayHasKey('password', $json['errors']);
         $this->assertArrayHasKey('domain', $json['errors']);
 
         $domain = $this->getPublicDomain();
 
         // Login too short, password too short
         $data = [
             'login' => '1',
             'domain' => $domain,
             'password' => 'test',
             'password_confirmation' => 'test',
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertArrayHasKey('login', $json['errors']);
         $this->assertArrayHasKey('password', $json['errors']);
 
         // Missing codes
         $data = [
             'login' => 'login-valid',
             'domain' => $domain,
             'password' => 'testtest',
             'password_confirmation' => 'testtest',
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertArrayHasKey('code', $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
 
         // Data with invalid short_code
         $data = [
             'login' => 'TestLogin',
             'domain' => $domain,
             'password' => 'testtest',
             'password_confirmation' => 'testtest',
             'code' => $result['code'],
             'short_code' => 'XXXX',
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
 
         $code = SignupCode::find($result['code']);
 
         // Data with invalid voucher
         $data = [
             'login' => 'TestLogin',
             'domain' => $domain,
             'password' => 'testtest',
             'password_confirmation' => 'testtest',
             'code' => $result['code'],
             'short_code' => $code->short_code,
             'voucher' => 'XXX',
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('voucher', $json['errors']);
 
         // Valid code, invalid login
         $data = [
             'login' => 'żżżżżż',
             'domain' => $domain,
             'password' => 'testtest',
             'password_confirmation' => 'testtest',
             'code' => $result['code'],
             'short_code' => $code->short_code,
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('login', $json['errors']);
     }
 
     /**
      * Test last signup step with valid input (user creation)
      *
      * @depends testSignupVerifyValidInput
      */
     public function testSignupValidInput(array $result): void
     {
         $queue = Queue::fake();
 
         $domain = $this->getPublicDomain();
         $identity = \strtolower('SignupLogin@') . $domain;
         $code = SignupCode::find($result['code']);
         $code->ip_address = '10.1.1.2';
         $code->verify_ip_address = '10.1.1.3';
         $code->save();
         $data = [
             'login' => 'SignupLogin',
             'domain' => $domain,
             'password' => 'testtest',
             'password_confirmation' => 'testtest',
             'code' => $code->code,
             'short_code' => $code->short_code,
             'voucher' => 'TEST',
         ];
 
         $response = $this->post('/api/auth/signup', $data, ['REMOTE_ADDR' => '10.1.1.4']);
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertSame('success', $json['status']);
         $this->assertSame('bearer', $json['token_type']);
         $this->assertTrue(!empty($json['expires_in']) && is_int($json['expires_in']) && $json['expires_in'] > 0);
         $this->assertNotEmpty($json['access_token']);
         $this->assertSame($identity, $json['email']);
 
         Queue::assertPushed(\App\Jobs\User\CreateJob::class, 1);
 
         Queue::assertPushed(
             \App\Jobs\User\CreateJob::class,
             function ($job) use ($data) {
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 return $userEmail === \strtolower($data['login'] . '@' . $data['domain']);
             }
         );
 
         $code->refresh();
 
         // Check if the user has been created
         $user = User::where('email', $identity)->first();
 
         $this->assertNotEmpty($user);
         $this->assertSame($identity, $user->email);
+        $this->assertTrue($user->isRestricted());
 
         // Check if the code has been updated and soft-deleted
         $this->assertTrue($code->trashed());
         $this->assertSame('10.1.1.2', $code->ip_address);
         $this->assertSame('10.1.1.3', $code->verify_ip_address);
         $this->assertSame('10.1.1.4', $code->submit_ip_address);
         $this->assertSame($user->id, $code->user_id);
 
         // Check user settings
         $this->assertSame($result['first_name'], $user->getSetting('first_name'));
         $this->assertSame($result['last_name'], $user->getSetting('last_name'));
         $this->assertSame($result['email'], $user->getSetting('external_email'));
 
         // Discount
         $discount = Discount::where('code', 'TEST')->first();
         $this->assertSame($discount->id, $user->wallets()->first()->discount_id);
 
         // TODO: Check SKUs/Plan
 
         // TODO: Check if the access token works
     }
 
     /**
      * Test signup for a group (custom domain) account
      */
     public function testSignupGroupAccount(): void
     {
         Queue::fake();
 
         // Initial signup request
         $user_data = $data = [
             'email' => 'testuser@external.com',
             'first_name' => 'Signup',
             'last_name' => 'User',
             'plan' => 'group',
         ];
 
         $response = $this->withoutMiddleware()->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertCount(3, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame('email', $json['mode']);
         $this->assertNotEmpty($json['code']);
 
         // Assert the email sending job was pushed once
         Queue::assertPushed(\App\Jobs\SignupVerificationEmail::class, 1);
 
         // Assert the job has proper data assigned
         Queue::assertPushed(\App\Jobs\SignupVerificationEmail::class, function ($job) use ($data, $json) {
             $code = TestCase::getObjectProperty($job, 'code');
 
             return $code->code === $json['code']
                 && $code->plan === $data['plan']
                 && $code->email === $data['email']
                 && $code->first_name === $data['first_name']
                 && $code->last_name === $data['last_name'];
         });
 
         // Verify the code
         $code = SignupCode::find($json['code']);
         $data = [
             'code' => $code->code,
             'short_code' => $code->short_code,
         ];
 
         $response = $this->post('/api/auth/signup/verify', $data);
         $result = $response->json();
 
         $response->assertStatus(200);
         $this->assertCount(7, $result);
         $this->assertSame('success', $result['status']);
         $this->assertSame($user_data['email'], $result['email']);
         $this->assertSame($user_data['first_name'], $result['first_name']);
         $this->assertSame($user_data['last_name'], $result['last_name']);
         $this->assertSame(null, $result['voucher']);
         $this->assertSame(true, $result['is_domain']);
         $this->assertSame([], $result['domains']);
 
         // Final signup request
         $login = 'admin';
         $domain = 'external.com';
         $data = [
             'login' => $login,
             'domain' => $domain,
             'password' => 'testtest',
             'password_confirmation' => 'testtest',
             'code' => $code->code,
             'short_code' => $code->short_code,
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $result = $response->json();
 
         $response->assertStatus(200);
         $this->assertSame('success', $result['status']);
         $this->assertSame('bearer', $result['token_type']);
         $this->assertTrue(!empty($result['expires_in']) && is_int($result['expires_in']) && $result['expires_in'] > 0);
         $this->assertNotEmpty($result['access_token']);
         $this->assertSame("$login@$domain", $result['email']);
 
         Queue::assertPushed(\App\Jobs\Domain\CreateJob::class, 1);
 
         Queue::assertPushed(
             \App\Jobs\Domain\CreateJob::class,
             function ($job) use ($domain) {
                 $domainNamespace = TestCase::getObjectProperty($job, 'domainNamespace');
 
                 return $domainNamespace === $domain;
             }
         );
 
         Queue::assertPushed(\App\Jobs\User\CreateJob::class, 1);
 
         Queue::assertPushed(
             \App\Jobs\User\CreateJob::class,
             function ($job) use ($data) {
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
 
                 return $userEmail === $data['login'] . '@' . $data['domain'];
             }
         );
 
         // Check if the code has been removed
         $code->refresh();
         $this->assertTrue($code->trashed());
 
         // Check if the user has been created
         $user = User::where('email', $login . '@' . $domain)->first();
 
         $this->assertNotEmpty($user);
+        $this->assertTrue($user->isRestricted());
 
         // Check user settings
         $this->assertSame($user_data['email'], $user->getSetting('external_email'));
         $this->assertSame($user_data['first_name'], $user->getSetting('first_name'));
         $this->assertSame($user_data['last_name'], $user->getSetting('last_name'));
 
         // TODO: Check domain record
 
         // TODO: Check SKUs/Plan
 
         // TODO: Check if the access token works
     }
 
     /**
      * Test signup via invitation
      */
     public function testSignupViaInvitation(): void
     {
         Queue::fake();
 
         $invitation = SI::create(['email' => 'email1@ext.com']);
 
         $post = [
             'invitation' => 'abc',
             'first_name' => 'Signup',
             'last_name' => 'User',
             'login' => 'test-inv',
             'domain' => 'kolabnow.com',
             'password' => 'testtest',
             'password_confirmation' => 'testtest',
         ];
 
         // Test invalid invitation identifier
         $response = $this->post('/api/auth/signup', $post);
         $response->assertStatus(404);
 
         // Test valid input
         $post['invitation'] = $invitation->id;
         $response = $this->post('/api/auth/signup', $post);
         $result = $response->json();
 
         $response->assertStatus(200);
         $this->assertSame('success', $result['status']);
         $this->assertSame('bearer', $result['token_type']);
         $this->assertTrue(!empty($result['expires_in']) && is_int($result['expires_in']) && $result['expires_in'] > 0);
         $this->assertNotEmpty($result['access_token']);
         $this->assertSame('test-inv@kolabnow.com', $result['email']);
 
         // Check if the user has been created
         $user = User::where('email', 'test-inv@kolabnow.com')->first();
 
         $this->assertNotEmpty($user);
 
         // Check user settings
         $this->assertSame($invitation->email, $user->getSetting('external_email'));
         $this->assertSame($post['first_name'], $user->getSetting('first_name'));
         $this->assertSame($post['last_name'], $user->getSetting('last_name'));
 
         $invitation->refresh();
 
         $this->assertSame($user->id, $invitation->user_id);
         $this->assertTrue($invitation->isCompleted());
 
         // TODO: Test POST params validation
     }
 
     /**
      * List of login/domain validation cases for testValidateLogin()
      *
      * @return array Arguments for testValidateLogin()
      */
     public function dataValidateLogin(): array
     {
         $domain = $this->getPublicDomain();
 
         return [
             // Individual account
             ['', $domain, false, ['login' => 'The login field is required.']],
             ['test123456', 'localhost', false, ['domain' => 'The specified domain is invalid.']],
             ['test123456', 'unknown-domain.org', false, ['domain' => 'The specified domain is invalid.']],
             ['test.test', $domain, false, null],
             ['test_test', $domain, false, null],
             ['test-test', $domain, false, null],
             ['admin', $domain, false, ['login' => 'The specified login is not available.']],
             ['administrator', $domain, false, ['login' => 'The specified login is not available.']],
             ['sales', $domain, false, ['login' => 'The specified login is not available.']],
             ['root', $domain, false, ['login' => 'The specified login is not available.']],
 
             // Domain account
             ['admin', 'kolabsys.com', true, null],
             ['testnonsystemdomain', 'invalid', true, ['domain' => 'The specified domain is invalid.']],
             ['testnonsystemdomain', '.com', true, ['domain' => 'The specified domain is invalid.']],
         ];
     }
 
     /**
      * Signup login/domain validation.
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      *
      * @dataProvider dataValidateLogin
      */
     public function testValidateLogin($login, $domain, $external, $expected_result): void
     {
         $result = $this->invokeMethod(new SignupController(), 'validateLogin', [$login, $domain, $external]);
 
         $this->assertSame($expected_result, $result);
     }
 
     /**
      * Signup login/domain validation, more cases
      */
     public function testValidateLoginMore(): void
     {
         Queue::fake();
 
         // Test registering for an email of an existing group
         $login = 'group-test';
         $domain = 'kolabnow.com';
         $group = $this->getTestGroup("{$login}@{$domain}");
         $external = false;
 
         $result = $this->invokeMethod(new SignupController(), 'validateLogin', [$login, $domain, $external]);
 
         $this->assertSame(['login' => 'The specified login is not available.'], $result);
 
         // Test registering for an email of an existing, but soft-deleted group
         $group->delete();
 
         $result = $this->invokeMethod(new SignupController(), 'validateLogin', [$login, $domain, $external]);
 
         $this->assertSame(['login' => 'The specified login is not available.'], $result);
 
         // Test registering for an email of an existing user
         $domain = $this->getPublicDomain();
         $login = 'signuplogin';
         $user = $this->getTestUser("{$login}@{$domain}");
         $external = false;
 
         $result = $this->invokeMethod(new SignupController(), 'validateLogin', [$login, $domain, $external]);
 
         $this->assertSame(['login' => 'The specified login is not available.'], $result);
 
         // Test registering for an email of an existing, but soft-deleted user
         $user->delete();
 
         $result = $this->invokeMethod(new SignupController(), 'validateLogin', [$login, $domain, $external]);
 
         $this->assertSame(['login' => 'The specified login is not available.'], $result);
 
         // Test registering for a domain that exists
         $external = true;
         $domain = $this->getTestDomain(
             'external.com',
             ['status' => Domain::STATUS_NEW, 'type' => Domain::TYPE_EXTERNAL]
         );
 
         $result = $this->invokeMethod(new SignupController(), 'validateLogin', [$login, $domain->namespace, $external]);
 
         $this->assertSame(['domain' => 'The specified domain is not available.'], $result);
 
         // Test registering for a domain that exists but is soft-deleted
         $domain->delete();
 
         $result = $this->invokeMethod(new SignupController(), 'validateLogin', [$login, $domain->namespace, $external]);
 
         $this->assertSame(['domain' => 'The specified domain is not available.'], $result);
     }
 }
diff --git a/src/tests/Feature/Controller/UsersTest.php b/src/tests/Feature/Controller/UsersTest.php
index 9c74edc6..26e27311 100644
--- a/src/tests/Feature/Controller/UsersTest.php
+++ b/src/tests/Feature/Controller/UsersTest.php
@@ -1,1666 +1,1690 @@
 <?php
 
 namespace Tests\Feature\Controller;
 
 use App\Discount;
 use App\Domain;
 use App\Http\Controllers\API\V4\UsersController;
 use App\Package;
 use App\Sku;
 use App\Tenant;
 use App\User;
 use App\Wallet;
 use Carbon\Carbon;
 use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Str;
 use Tests\TestCase;
 
 class UsersTest extends TestCase
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->clearBetaEntitlements();
         $this->deleteTestUser('jane@kolabnow.com');
         $this->deleteTestUser('UsersControllerTest1@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest2@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest3@userscontroller.com');
         $this->deleteTestUser('UserEntitlement2A@UserEntitlement.com');
         $this->deleteTestUser('john2.doe2@kolab.org');
         $this->deleteTestUser('deleted@kolab.org');
         $this->deleteTestUser('deleted@kolabnow.com');
         $this->deleteTestDomain('userscontroller.com');
         $this->deleteTestGroup('group-test@kolabnow.com');
         $this->deleteTestGroup('group-test@kolab.org');
         $this->deleteTestSharedFolder('folder-test@kolabnow.com');
         $this->deleteTestResource('resource-test@kolabnow.com');
         Sku::where('title', 'test')->delete();
 
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
         $wallet->discount()->dissociate();
         $wallet->settings()->whereIn('key', ['mollie_id', 'stripe_id'])->delete();
         $wallet->save();
         $user->settings()->whereIn('key', ['greylist_enabled', 'guam_enabled'])->delete();
         $user->status |= User::STATUS_IMAP_READY | User::STATUS_LDAP_READY;
         $user->save();
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->clearBetaEntitlements();
         $this->deleteTestUser('jane@kolabnow.com');
         $this->deleteTestUser('UsersControllerTest1@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest2@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest3@userscontroller.com');
         $this->deleteTestUser('UserEntitlement2A@UserEntitlement.com');
         $this->deleteTestUser('john2.doe2@kolab.org');
         $this->deleteTestUser('deleted@kolab.org');
         $this->deleteTestUser('deleted@kolabnow.com');
         $this->deleteTestDomain('userscontroller.com');
         $this->deleteTestGroup('group-test@kolabnow.com');
         $this->deleteTestGroup('group-test@kolab.org');
         $this->deleteTestSharedFolder('folder-test@kolabnow.com');
         $this->deleteTestResource('resource-test@kolabnow.com');
         Sku::where('title', 'test')->delete();
 
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
         $wallet->discount()->dissociate();
         $wallet->settings()->whereIn('key', ['mollie_id', 'stripe_id'])->delete();
         $wallet->save();
         $user->settings()->whereIn('key', ['greylist_enabled', 'guam_enabled'])->delete();
         $user->status |= User::STATUS_IMAP_READY | User::STATUS_LDAP_READY;
         $user->save();
 
         parent::tearDown();
     }
 
     /**
      * Test user deleting (DELETE /api/v4/users/<id>)
      */
     public function testDestroy(): void
     {
         // First create some users/accounts to delete
         $package_kolab = \App\Package::where('title', 'kolab')->first();
         $package_domain = \App\Package::where('title', 'domain-hosting')->first();
 
         $john = $this->getTestUser('john@kolab.org');
         $user1 = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $user2 = $this->getTestUser('UsersControllerTest2@userscontroller.com');
         $user3 = $this->getTestUser('UsersControllerTest3@userscontroller.com');
         $domain = $this->getTestDomain('userscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
         $user1->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $user1);
         $user1->assignPackage($package_kolab, $user2);
         $user1->assignPackage($package_kolab, $user3);
 
         // Test unauth access
         $response = $this->delete("api/v4/users/{$user2->id}");
         $response->assertStatus(401);
 
         // Test access to other user/account
         $response = $this->actingAs($john)->delete("api/v4/users/{$user2->id}");
         $response->assertStatus(403);
         $response = $this->actingAs($john)->delete("api/v4/users/{$user1->id}");
         $response->assertStatus(403);
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Access denied", $json['message']);
         $this->assertCount(2, $json);
 
         // Test that non-controller cannot remove himself
         $response = $this->actingAs($user3)->delete("api/v4/users/{$user3->id}");
         $response->assertStatus(403);
 
         // Test removing a non-controller user
         $response = $this->actingAs($user1)->delete("api/v4/users/{$user3->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals('success', $json['status']);
         $this->assertEquals('User deleted successfully.', $json['message']);
 
         // Test removing self (an account with users)
         $response = $this->actingAs($user1)->delete("api/v4/users/{$user1->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals('success', $json['status']);
         $this->assertEquals('User deleted successfully.', $json['message']);
     }
 
     /**
      * Test user deleting (DELETE /api/v4/users/<id>)
      */
     public function testDestroyByController(): void
     {
         // Create an account with additional controller - $user2
         $package_kolab = \App\Package::where('title', 'kolab')->first();
         $package_domain = \App\Package::where('title', 'domain-hosting')->first();
         $user1 = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $user2 = $this->getTestUser('UsersControllerTest2@userscontroller.com');
         $user3 = $this->getTestUser('UsersControllerTest3@userscontroller.com');
         $domain = $this->getTestDomain('userscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
         $user1->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $user1);
         $user1->assignPackage($package_kolab, $user2);
         $user1->assignPackage($package_kolab, $user3);
         $user1->wallets()->first()->addController($user2);
 
         // TODO/FIXME:
         //   For now controller can delete himself, as well as
         //   the whole account he has control to, including the owner
         //   Probably he should not be able to do none of those
         //   However, this is not 0-regression scenario as we
         //   do not fully support additional controllers.
 
         //$response = $this->actingAs($user2)->delete("api/v4/users/{$user2->id}");
         //$response->assertStatus(403);
 
         $response = $this->actingAs($user2)->delete("api/v4/users/{$user3->id}");
         $response->assertStatus(200);
 
         $response = $this->actingAs($user2)->delete("api/v4/users/{$user1->id}");
         $response->assertStatus(200);
 
         // Note: More detailed assertions in testDestroy() above
 
         $this->assertTrue($user1->fresh()->trashed());
         $this->assertTrue($user2->fresh()->trashed());
         $this->assertTrue($user3->fresh()->trashed());
     }
 
     /**
      * Test user listing (GET /api/v4/users)
      */
     public function testIndex(): void
     {
         // Test unauth access
         $response = $this->get("api/v4/users");
         $response->assertStatus(401);
 
         $jack = $this->getTestUser('jack@kolab.org');
         $joe = $this->getTestUser('joe@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         $response = $this->actingAs($jack)->get("/api/v4/users");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(0, $json['count']);
         $this->assertCount(0, $json['list']);
 
         $response = $this->actingAs($john)->get("/api/v4/users");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(4, $json['count']);
         $this->assertCount(4, $json['list']);
         $this->assertSame($jack->email, $json['list'][0]['email']);
         $this->assertSame($joe->email, $json['list'][1]['email']);
         $this->assertSame($john->email, $json['list'][2]['email']);
         $this->assertSame($ned->email, $json['list'][3]['email']);
         // Values below are tested by Unit tests
         $this->assertArrayHasKey('isDeleted', $json['list'][0]);
         $this->assertArrayHasKey('isDegraded', $json['list'][0]);
         $this->assertArrayHasKey('isAccountDegraded', $json['list'][0]);
         $this->assertArrayHasKey('isSuspended', $json['list'][0]);
         $this->assertArrayHasKey('isActive', $json['list'][0]);
         $this->assertArrayHasKey('isReady', $json['list'][0]);
         $this->assertArrayHasKey('isImapReady', $json['list'][0]);
         if (\config('app.with_ldap')) {
             $this->assertArrayHasKey('isLdapReady', $json['list'][0]);
         } else {
             $this->assertArrayNotHasKey('isLdapReady', $json['list'][0]);
         }
 
         $response = $this->actingAs($ned)->get("/api/v4/users");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(4, $json['count']);
         $this->assertCount(4, $json['list']);
         $this->assertSame($jack->email, $json['list'][0]['email']);
         $this->assertSame($joe->email, $json['list'][1]['email']);
         $this->assertSame($john->email, $json['list'][2]['email']);
         $this->assertSame($ned->email, $json['list'][3]['email']);
 
         // Search by user email
         $response = $this->actingAs($john)->get("/api/v4/users?search=jack@k");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(1, $json['count']);
         $this->assertCount(1, $json['list']);
         $this->assertSame($jack->email, $json['list'][0]['email']);
 
         // Search by alias
         $response = $this->actingAs($john)->get("/api/v4/users?search=monster");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(1, $json['count']);
         $this->assertCount(1, $json['list']);
         $this->assertSame($joe->email, $json['list'][0]['email']);
 
         // Search by name
         $response = $this->actingAs($john)->get("/api/v4/users?search=land");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(1, $json['count']);
         $this->assertCount(1, $json['list']);
         $this->assertSame($ned->email, $json['list'][0]['email']);
 
         // TODO: Test paging
     }
 
     /**
      * Test fetching user data/profile (GET /api/v4/users/<user-id>)
      */
     public function testShow(): void
     {
         $userA = $this->getTestUser('UserEntitlement2A@UserEntitlement.com');
 
         // Test getting profile of self
         $response = $this->actingAs($userA)->get("/api/v4/users/{$userA->id}");
 
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertEquals($userA->id, $json['id']);
         $this->assertEquals($userA->email, $json['email']);
         $this->assertTrue(is_array($json['statusInfo']));
         $this->assertTrue(is_array($json['settings']));
         $this->assertTrue($json['config']['greylist_enabled']);
         $this->assertFalse($json['config']['guam_enabled']);
         $this->assertSame([], $json['skus']);
         $this->assertSame([], $json['aliases']);
         // Values below are tested by Unit tests
         $this->assertArrayHasKey('isDeleted', $json);
         $this->assertArrayHasKey('isDegraded', $json);
         $this->assertArrayHasKey('isAccountDegraded', $json);
         $this->assertArrayHasKey('isSuspended', $json);
         $this->assertArrayHasKey('isActive', $json);
         $this->assertArrayHasKey('isReady', $json);
         $this->assertArrayHasKey('isImapReady', $json);
         if (\config('app.with_ldap')) {
             $this->assertArrayHasKey('isLdapReady', $json);
         } else {
             $this->assertArrayNotHasKey('isLdapReady', $json);
         }
 
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         // Test unauthorized access to a profile of other user
         $response = $this->actingAs($jack)->get("/api/v4/users/{$userA->id}");
         $response->assertStatus(403);
 
         // Test authorized access to a profile of other user
         // Ned: Additional account controller
         $response = $this->actingAs($ned)->get("/api/v4/users/{$john->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
         $this->assertSame(['john.doe@kolab.org'], $json['aliases']);
 
         $response = $this->actingAs($ned)->get("/api/v4/users/{$jack->id}");
         $response->assertStatus(200);
 
         // John: Account owner
         $response = $this->actingAs($john)->get("/api/v4/users/{$jack->id}");
         $response->assertStatus(200);
         $response = $this->actingAs($john)->get("/api/v4/users/{$ned->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $storage_sku = Sku::withEnvTenantContext()->where('title', 'storage')->first();
         $groupware_sku = Sku::withEnvTenantContext()->where('title', 'groupware')->first();
         $mailbox_sku = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();
         $secondfactor_sku = Sku::withEnvTenantContext()->where('title', '2fa')->first();
 
         $this->assertCount(5, $json['skus']);
 
         $this->assertSame(5, $json['skus'][$storage_sku->id]['count']);
         $this->assertSame([0,0,0,0,0], $json['skus'][$storage_sku->id]['costs']);
         $this->assertSame(1, $json['skus'][$groupware_sku->id]['count']);
         $this->assertSame([490], $json['skus'][$groupware_sku->id]['costs']);
         $this->assertSame(1, $json['skus'][$mailbox_sku->id]['count']);
         $this->assertSame([500], $json['skus'][$mailbox_sku->id]['costs']);
         $this->assertSame(1, $json['skus'][$secondfactor_sku->id]['count']);
         $this->assertSame([0], $json['skus'][$secondfactor_sku->id]['costs']);
 
         $this->assertSame([], $json['aliases']);
     }
 
     /**
      * Test fetching SKUs list for a user (GET /users/<id>/skus)
      */
     public function testSkus(): void
     {
         $user = $this->getTestUser('john@kolab.org');
 
         // Unauth access not allowed
         $response = $this->get("api/v4/users/{$user->id}/skus");
         $response->assertStatus(401);
 
         // Create an sku for another tenant, to make sure it is not included in the result
         $nsku = Sku::create([
                 'title' => 'test',
                 'name' => 'Test',
                 'description' => '',
                 'active' => true,
                 'cost' => 100,
                 'handler_class' => 'Mailbox',
         ]);
         $tenant = Tenant::whereNotIn('id', [\config('app.tenant_id')])->first();
         $nsku->tenant_id = $tenant->id;
         $nsku->save();
 
         $response = $this->actingAs($user)->get("api/v4/users/{$user->id}/skus");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(5, $json);
 
         $this->assertSkuElement('mailbox', $json[0], [
                 'prio' => 100,
                 'type' => 'user',
                 'handler' => 'Mailbox',
                 'enabled' => true,
                 'readonly' => true,
         ]);
 
         $this->assertSkuElement('storage', $json[1], [
                 'prio' => 90,
                 'type' => 'user',
                 'handler' => 'Storage',
                 'enabled' => true,
                 'readonly' => true,
                 'range' => [
                     'min' => 5,
                     'max' => 100,
                     'unit' => 'GB',
                 ]
         ]);
 
         $this->assertSkuElement('groupware', $json[2], [
                 'prio' => 80,
                 'type' => 'user',
                 'handler' => 'Groupware',
                 'enabled' => false,
                 'readonly' => false,
         ]);
 
         $this->assertSkuElement('activesync', $json[3], [
                 'prio' => 70,
                 'type' => 'user',
                 'handler' => 'Activesync',
                 'enabled' => false,
                 'readonly' => false,
                 'required' => ['Groupware'],
         ]);
 
         $this->assertSkuElement('2fa', $json[4], [
                 'prio' => 60,
                 'type' => 'user',
                 'handler' => 'Auth2F',
                 'enabled' => false,
                 'readonly' => false,
                 'forbidden' => ['Activesync'],
         ]);
 
         // Test inclusion of beta SKUs
         $sku = Sku::withEnvTenantContext()->where('title', 'beta')->first();
         $user->assignSku($sku);
         $response = $this->actingAs($user)->get("api/v4/users/{$user->id}/skus");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(6, $json);
 
         $this->assertSkuElement('beta', $json[5], [
                 'prio' => 10,
                 'type' => 'user',
                 'handler' => 'Beta',
                 'enabled' => false,
                 'readonly' => false,
         ]);
     }
 
     /**
      * Test fetching user status (GET /api/v4/users/<user-id>/status)
      * and forcing setup process update (?refresh=1)
      *
      * @group imap
      * @group dns
      */
     public function testStatus(): void
     {
         Queue::fake();
 
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
 
         // Test unauthorized access
         $response = $this->actingAs($jack)->get("/api/v4/users/{$john->id}/status");
         $response->assertStatus(403);
 
         $john->status &= ~User::STATUS_IMAP_READY;
         $john->status &= ~User::STATUS_LDAP_READY;
         $john->save();
 
         // Get user status
         $response = $this->actingAs($john)->get("/api/v4/users/{$john->id}/status");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertFalse($json['isReady']);
         $this->assertFalse($json['isImapReady']);
         $this->assertTrue(empty($json['status']));
         $this->assertTrue(empty($json['message']));
 
         if (\config('app.with_ldap')) {
             $this->assertFalse($json['isLdapReady']);
             $this->assertSame('user-ldap-ready', $json['process'][1]['label']);
             $this->assertFalse($json['process'][1]['state']);
             $this->assertSame('user-imap-ready', $json['process'][2]['label']);
             $this->assertFalse($json['process'][2]['state']);
         } else {
             $this->assertArrayNotHasKey('isLdapReady', $json);
             $this->assertSame('user-imap-ready', $json['process'][1]['label']);
             $this->assertFalse($json['process'][1]['state']);
         }
 
         // Make sure the domain is confirmed (other test might unset that status)
         $domain = $this->getTestDomain('kolab.org');
         $domain->status |= Domain::STATUS_CONFIRMED;
         $domain->save();
 
         // Now "reboot" the process
         Queue::fake();
         $response = $this->actingAs($john)->get("/api/v4/users/{$john->id}/status?refresh=1");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertFalse($json['isImapReady']);
         $this->assertFalse($json['isReady']);
         $this->assertSame('success', $json['status']);
         $this->assertSame('Setup process has been pushed. Please wait.', $json['message']);
 
         if (\config('app.with_ldap')) {
             $this->assertFalse($json['isLdapReady']);
             $this->assertSame('user-ldap-ready', $json['process'][1]['label']);
             $this->assertSame(false, $json['process'][1]['state']);
             $this->assertSame('user-imap-ready', $json['process'][2]['label']);
             $this->assertSame(false, $json['process'][2]['state']);
         } else {
             $this->assertSame('user-imap-ready', $json['process'][1]['label']);
             $this->assertSame(false, $json['process'][1]['state']);
         }
 
         Queue::assertPushed(\App\Jobs\User\CreateJob::class, 1);
     }
 
     /**
      * Test UsersController::statusInfo()
      */
     public function testStatusInfo(): void
     {
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $domain = $this->getTestDomain('userscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
 
         $user->created_at = Carbon::now();
         $user->status = User::STATUS_NEW;
         $user->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertFalse($result['isDone']);
         $this->assertSame([], $result['skus']);
         $this->assertCount(3, $result['process']);
         $this->assertSame('user-new', $result['process'][0]['label']);
         $this->assertSame(true, $result['process'][0]['state']);
         if (\config('app.with_ldap')) {
             $this->assertSame('user-ldap-ready', $result['process'][1]['label']);
             $this->assertSame(false, $result['process'][1]['state']);
             $this->assertSame('user-imap-ready', $result['process'][2]['label']);
             $this->assertSame(false, $result['process'][2]['state']);
         } else {
             $this->assertSame('user-imap-ready', $result['process'][1]['label']);
             $this->assertSame(false, $result['process'][1]['state']);
         }
         $this->assertSame('running', $result['processState']);
         $this->assertTrue($result['enableRooms']);
         $this->assertFalse($result['enableBeta']);
 
         $user->created_at = Carbon::now()->subSeconds(181);
         $user->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertSame('failed', $result['processState']);
 
         $user->status |= User::STATUS_LDAP_READY | User::STATUS_IMAP_READY;
         $user->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertTrue($result['isDone']);
         $this->assertCount(3, $result['process']);
         $this->assertSame('done', $result['processState']);
         $this->assertSame('user-new', $result['process'][0]['label']);
         $this->assertSame(true, $result['process'][0]['state']);
         if (\config('app.with_ldap')) {
             $this->assertSame('user-ldap-ready', $result['process'][1]['label']);
             $this->assertSame(true, $result['process'][1]['state']);
             $this->assertSame('user-imap-ready', $result['process'][2]['label']);
             $this->assertSame(true, $result['process'][2]['state']);
         } else {
             $this->assertSame('user-imap-ready', $result['process'][1]['label']);
             $this->assertSame(true, $result['process'][1]['state']);
         }
 
         $domain->status |= Domain::STATUS_VERIFIED;
         $domain->type = Domain::TYPE_EXTERNAL;
         $domain->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertFalse($result['isDone']);
         $this->assertSame([], $result['skus']);
         $this->assertCount(7, $result['process']);
         $this->assertSame('user-new', $result['process'][0]['label']);
         $this->assertSame(true, $result['process'][0]['state']);
         if (\config('app.with_ldap')) {
             $this->assertSame('user-ldap-ready', $result['process'][1]['label']);
             $this->assertSame(true, $result['process'][1]['state']);
             $this->assertSame('user-imap-ready', $result['process'][2]['label']);
             $this->assertSame(true, $result['process'][2]['state']);
             $this->assertSame('domain-new', $result['process'][3]['label']);
             $this->assertSame(true, $result['process'][3]['state']);
             $this->assertSame('domain-ldap-ready', $result['process'][4]['label']);
             $this->assertSame(false, $result['process'][4]['state']);
             $this->assertSame('domain-verified', $result['process'][5]['label']);
             $this->assertSame(true, $result['process'][5]['state']);
             $this->assertSame('domain-confirmed', $result['process'][6]['label']);
             $this->assertSame(false, $result['process'][6]['state']);
         } else {
             $this->assertSame('user-imap-ready', $result['process'][1]['label']);
             $this->assertSame(true, $result['process'][1]['state']);
             $this->assertSame('domain-new', $result['process'][2]['label']);
             $this->assertSame(true, $result['process'][2]['state']);
             $this->assertSame('domain-verified', $result['process'][3]['label']);
             $this->assertSame(true, $result['process'][3]['state']);
             $this->assertSame('domain-confirmed', $result['process'][4]['label']);
             $this->assertSame(false, $result['process'][4]['state']);
         }
 
         // Test 'skus' property
         $user->assignSku(Sku::withEnvTenantContext()->where('title', 'beta')->first());
 
         $result = UsersController::statusInfo($user);
 
         $this->assertSame(['beta'], $result['skus']);
         $this->assertTrue($result['enableBeta']);
 
         $user->assignSku(Sku::withEnvTenantContext()->where('title', 'groupware')->first());
 
         $result = UsersController::statusInfo($user);
 
         $this->assertSame(['beta', 'groupware'], $result['skus']);
 
         // Degraded user
         $user->status |= User::STATUS_DEGRADED;
         $user->save();
 
         $result = UsersController::statusInfo($user);
         $this->assertTrue($result['enableBeta']);
         $this->assertFalse($result['enableRooms']);
 
         // User in a tenant without 'room' SKU
         $user->status = User::STATUS_LDAP_READY | User::STATUS_IMAP_READY | User::STATUS_ACTIVE;
         $user->tenant_id = Tenant::where('title', 'Sample Tenant')->first()->id;
         $user->save();
 
         $result = UsersController::statusInfo($user);
         $this->assertTrue($result['enableBeta']);
         $this->assertFalse($result['enableRooms']);
     }
 
     /**
      * Test user config update (POST /api/v4/users/<user>/config)
      */
     public function testSetConfig(): void
     {
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
 
         $john->setSetting('greylist_enabled', null);
         $john->setSetting('guam_enabled', null);
         $john->setSetting('password_policy', null);
         $john->setSetting('max_password_age', null);
 
         // Test unknown user id
         $post = ['greylist_enabled' => 1];
         $response = $this->actingAs($john)->post("/api/v4/users/123/config", $post);
         $json = $response->json();
 
         $response->assertStatus(404);
 
         // Test access by user not being a wallet controller
         $post = ['greylist_enabled' => 1];
         $response = $this->actingAs($jack)->post("/api/v4/users/{$john->id}/config", $post);
         $json = $response->json();
 
         $response->assertStatus(403);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Access denied", $json['message']);
         $this->assertCount(2, $json);
 
         // Test some invalid data
         $post = ['grey' => 1, 'password_policy' => 'min:1,max:255'];
         $response = $this->actingAs($john)->post("/api/v4/users/{$john->id}/config", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertCount(2, $json['errors']);
         $this->assertSame("The requested configuration parameter is not supported.", $json['errors']['grey']);
         $this->assertSame("Minimum password length cannot be less than 6.", $json['errors']['password_policy']);
 
         $this->assertNull($john->fresh()->getSetting('greylist_enabled'));
 
         // Test some valid data
         $post = [
             'greylist_enabled' => 1,
             'guam_enabled' => 1,
             'password_policy' => 'min:10,max:255,upper,lower,digit,special',
             'max_password_age' => 6,
         ];
 
         $response = $this->actingAs($john)->post("/api/v4/users/{$john->id}/config", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(2, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame('User settings updated successfully.', $json['message']);
 
         $this->assertSame('true', $john->getSetting('greylist_enabled'));
         $this->assertSame('true', $john->getSetting('guam_enabled'));
         $this->assertSame('min:10,max:255,upper,lower,digit,special', $john->getSetting('password_policy'));
         $this->assertSame('6', $john->getSetting('max_password_age'));
 
         // Test some valid data, acting as another account controller
         $ned = $this->getTestUser('ned@kolab.org');
         $post = ['greylist_enabled' => 0, 'guam_enabled' => 0, 'password_policy' => 'min:10,max:255,upper,last:1'];
         $response = $this->actingAs($ned)->post("/api/v4/users/{$john->id}/config", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(2, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame('User settings updated successfully.', $json['message']);
 
         $this->assertSame('false', $john->fresh()->getSetting('greylist_enabled'));
         $this->assertSame(null, $john->fresh()->getSetting('guam_enabled'));
         $this->assertSame('min:10,max:255,upper,last:1', $john->fresh()->getSetting('password_policy'));
     }
 
     /**
      * Test user creation (POST /api/v4/users)
      */
     public function testStore(): void
     {
         Queue::fake();
 
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $john->setSetting('password_policy', 'min:8,max:100,digit');
         $deleted_priv = $this->getTestUser('deleted@kolab.org');
         $deleted_priv->delete();
 
         // Test empty request
         $response = $this->actingAs($john)->post("/api/v4/users", []);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("The email field is required.", $json['errors']['email']);
         $this->assertSame("The password field is required.", $json['errors']['password'][0]);
         $this->assertCount(2, $json);
 
         // Test access by user not being a wallet controller
         $post = ['first_name' => 'Test'];
         $response = $this->actingAs($jack)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(403);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Access denied", $json['message']);
         $this->assertCount(2, $json);
 
         // Test some invalid data
         $post = ['password' => '12345678', 'email' => 'invalid'];
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertSame('The password confirmation does not match.', $json['errors']['password'][0]);
         $this->assertSame('The specified email is invalid.', $json['errors']['email']);
 
         // Test existing user email
         $post = [
             'password' => 'simple123',
             'password_confirmation' => 'simple123',
             'first_name' => 'John2',
             'last_name' => 'Doe2',
             'email' => 'jack.daniels@kolab.org',
         ];
 
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertSame('The specified email is not available.', $json['errors']['email']);
 
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
 
         $post = [
             'password' => 'simple123',
             'password_confirmation' => 'simple123',
             'first_name' => 'John2',
             'last_name' => 'Doe2',
             'email' => 'john2.doe2@kolab.org',
             'organization' => 'TestOrg',
             'aliases' => ['useralias1@kolab.org', 'deleted@kolab.org'],
         ];
 
         // Missing package
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Package is required.", $json['errors']['package']);
         $this->assertCount(2, $json);
 
         // Invalid package
         $post['package'] = $package_domain->id;
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Invalid package selected.", $json['errors']['package']);
         $this->assertCount(2, $json);
 
         // Test password policy checking
         $post['package'] = $package_kolab->id;
         $post['password'] = 'password';
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("The password confirmation does not match.", $json['errors']['password'][0]);
         $this->assertSame("Specified password does not comply with the policy.", $json['errors']['password'][1]);
         $this->assertCount(2, $json);
 
         // Test password confirmation
         $post['password_confirmation'] = 'password';
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Specified password does not comply with the policy.", $json['errors']['password'][0]);
         $this->assertCount(2, $json);
 
         // Test full and valid data
         $post['password'] = 'password123';
         $post['password_confirmation'] = 'password123';
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User created successfully.", $json['message']);
         $this->assertCount(2, $json);
 
         $user = User::where('email', 'john2.doe2@kolab.org')->first();
         $this->assertInstanceOf(User::class, $user);
         $this->assertSame('John2', $user->getSetting('first_name'));
         $this->assertSame('Doe2', $user->getSetting('last_name'));
         $this->assertSame('TestOrg', $user->getSetting('organization'));
+        $this->assertFalse($user->isRestricted());
         /** @var \App\UserAlias[] $aliases */
         $aliases = $user->aliases()->orderBy('alias')->get();
         $this->assertCount(2, $aliases);
         $this->assertSame('deleted@kolab.org', $aliases[0]->alias);
         $this->assertSame('useralias1@kolab.org', $aliases[1]->alias);
         // Assert the new user entitlements
         $this->assertEntitlements($user, ['groupware', 'mailbox',
             'storage', 'storage', 'storage', 'storage', 'storage']);
         // Assert the wallet to which the new user should be assigned to
         $wallet = $user->wallet();
         $this->assertSame($john->wallets->first()->id, $wallet->id);
 
         // Attempt to create a user previously deleted
         $user->delete();
 
         $post['package'] = $package_kolab->id;
         $post['aliases'] = [];
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User created successfully.", $json['message']);
         $this->assertCount(2, $json);
 
         $user = User::where('email', 'john2.doe2@kolab.org')->first();
         $this->assertInstanceOf(User::class, $user);
         $this->assertSame('John2', $user->getSetting('first_name'));
         $this->assertSame('Doe2', $user->getSetting('last_name'));
         $this->assertSame('TestOrg', $user->getSetting('organization'));
         $this->assertCount(0, $user->aliases()->get());
         $this->assertEntitlements($user, ['groupware', 'mailbox',
             'storage', 'storage', 'storage', 'storage', 'storage']);
 
         // Test password reset link "mode"
         $code = new \App\VerificationCode(['mode' => 'password-reset', 'active' => false]);
         $john->verificationcodes()->save($code);
 
         $post = [
             'first_name' => 'John2',
             'last_name' => 'Doe2',
             'email' => 'deleted@kolab.org',
             'organization' => '',
             'aliases' => [],
             'passwordLinkCode' => $code->short_code . '-' . $code->code,
             'package' => $package_kolab->id,
         ];
 
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User created successfully.", $json['message']);
         $this->assertCount(2, $json);
 
         $user = $this->getTestUser('deleted@kolab.org');
         $code->refresh();
 
         $this->assertSame($user->id, $code->user_id);
         $this->assertTrue($code->active);
         $this->assertTrue(is_string($user->password) && strlen($user->password) >= 60);
 
         // Test acting as account controller not owner, which is not yet supported
         $john->wallets->first()->addController($user);
 
         $response = $this->actingAs($user)->post("/api/v4/users", []);
         $response->assertStatus(403);
+
+        // Test that creating a user in a restricted account creates a restricted user
+        $package_domain = Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
+        $owner = $this->getTestUser('UsersControllerTest1@userscontroller.com');
+        $domain = $this->getTestDomain(
+            'userscontroller.com',
+            ['status' => Domain::STATUS_NEW, 'type' => Domain::TYPE_EXTERNAL]
+        );
+        $domain->assignPackage($package_domain, $owner);
+        $owner->restrict();
+
+        $post = [
+            'password' => 'simple123',
+            'password_confirmation' => 'simple123',
+            'email' => 'UsersControllerTest2@userscontroller.com',
+            'package' => $package_kolab->id,
+        ];
+
+        $response = $this->actingAs($owner)->post("/api/v4/users", $post);
+        $response->assertStatus(200);
+
+        $user = User::where('email', 'UsersControllerTest1@userscontroller.com')->first();
+        $this->assertTrue($user->isRestricted());
     }
 
     /**
      * Test user update (PUT /api/v4/users/<user-id>)
      */
     public function testUpdate(): void
     {
         $userA = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $userA->setSetting('password_policy', 'min:8,digit');
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $domain = $this->getTestDomain(
             'userscontroller.com',
             ['status' => Domain::STATUS_NEW, 'type' => Domain::TYPE_EXTERNAL]
         );
 
         // Test unauthorized update of other user profile
         $response = $this->actingAs($jack)->get("/api/v4/users/{$userA->id}", []);
         $response->assertStatus(403);
 
         // Test authorized update of account owner by account controller
         $response = $this->actingAs($ned)->get("/api/v4/users/{$john->id}", []);
         $response->assertStatus(200);
 
         // Test updating of self (empty request)
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", []);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User data updated successfully.", $json['message']);
         $this->assertTrue(!empty($json['statusInfo']));
         $this->assertCount(3, $json);
 
         // Test some invalid data
         $post = ['password' => '1234567', 'currency' => 'invalid'];
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertSame("The password confirmation does not match.", $json['errors']['password'][0]);
         $this->assertSame("Specified password does not comply with the policy.", $json['errors']['password'][1]);
         $this->assertSame("The currency must be 3 characters.", $json['errors']['currency'][0]);
 
         // Test full profile update including password
         $post = [
             'password' => 'simple123',
             'password_confirmation' => 'simple123',
             'first_name' => 'John2',
             'last_name' => 'Doe2',
             'organization' => 'TestOrg',
             'phone' => '+123 123 123',
             'external_email' => 'external@gmail.com',
             'billing_address' => 'billing',
             'country' => 'CH',
             'currency' => 'CHF',
             'aliases' => ['useralias1@' . \config('app.domain'), 'useralias2@' . \config('app.domain')]
         ];
 
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User data updated successfully.", $json['message']);
         $this->assertTrue(!empty($json['statusInfo']));
         $this->assertCount(3, $json);
         $this->assertTrue($userA->password != $userA->fresh()->password);
         unset($post['password'], $post['password_confirmation'], $post['aliases']);
         foreach ($post as $key => $value) {
             $this->assertSame($value, $userA->getSetting($key));
         }
         $aliases = $userA->aliases()->orderBy('alias')->get();
         $this->assertCount(2, $aliases);
         $this->assertSame('useralias1@' . \config('app.domain'), $aliases[0]->alias);
         $this->assertSame('useralias2@' . \config('app.domain'), $aliases[1]->alias);
 
         // Test unsetting values
         $post = [
             'first_name' => '',
             'last_name' => '',
             'organization' => '',
             'phone' => '',
             'external_email' => '',
             'billing_address' => '',
             'country' => '',
             'currency' => '',
             'aliases' => ['useralias2@' . \config('app.domain')]
         ];
 
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User data updated successfully.", $json['message']);
         $this->assertTrue(!empty($json['statusInfo']));
         $this->assertCount(3, $json);
         unset($post['aliases']);
         foreach ($post as $key => $value) {
             $this->assertNull($userA->getSetting($key));
         }
         $aliases = $userA->aliases()->get();
         $this->assertCount(1, $aliases);
         $this->assertSame('useralias2@' . \config('app.domain'), $aliases[0]->alias);
 
         // Test error on some invalid aliases missing password confirmation
         $post = [
             'password' => 'simple123',
             'aliases' => [
                 'useralias2@' . \config('app.domain'),
                 'useralias1@kolab.org',
                 '@kolab.org',
             ]
         ];
 
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertCount(2, $json['errors']['aliases']);
         $this->assertSame("The specified domain is not available.", $json['errors']['aliases'][1]);
         $this->assertSame("The specified alias is invalid.", $json['errors']['aliases'][2]);
         $this->assertSame("The password confirmation does not match.", $json['errors']['password'][0]);
 
         // Test authorized update of other user
         $response = $this->actingAs($ned)->put("/api/v4/users/{$jack->id}", []);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertTrue(empty($json['statusInfo']));
 
         // TODO: Test error on aliases with invalid/non-existing/other-user's domain
 
         // Create entitlements and additional user for following tests
         $owner = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $user = $this->getTestUser('UsersControllerTest2@userscontroller.com');
         $package_domain = Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $package_kolab = Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_lite = Package::withEnvTenantContext()->where('title', 'lite')->first();
         $sku_mailbox = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();
         $sku_storage = Sku::withEnvTenantContext()->where('title', 'storage')->first();
         $sku_groupware = Sku::withEnvTenantContext()->where('title', 'groupware')->first();
 
         $domain = $this->getTestDomain(
             'userscontroller.com',
             [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_EXTERNAL,
             ]
         );
 
         $domain->assignPackage($package_domain, $owner);
         $owner->assignPackage($package_kolab);
         $owner->assignPackage($package_lite, $user);
 
         // Non-controller cannot update his own entitlements
         $post = ['skus' => []];
         $response = $this->actingAs($user)->put("/api/v4/users/{$user->id}", $post);
         $response->assertStatus(422);
 
         // Test updating entitlements
         $post = [
             'skus' => [
                 $sku_mailbox->id => 1,
                 $sku_storage->id => 6,
                 $sku_groupware->id => 1,
             ],
         ];
 
         $response = $this->actingAs($owner)->put("/api/v4/users/{$user->id}", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $storage_cost = $user->entitlements()
             ->where('sku_id', $sku_storage->id)
             ->orderBy('cost')
             ->pluck('cost')->all();
 
         $this->assertEntitlements(
             $user,
             ['groupware', 'mailbox', 'storage', 'storage', 'storage', 'storage', 'storage', 'storage']
         );
 
         $this->assertSame([0, 0, 0, 0, 0, 25], $storage_cost);
         $this->assertTrue(empty($json['statusInfo']));
 
         // Test password reset link "mode"
         $code = new \App\VerificationCode(['mode' => 'password-reset', 'active' => false]);
         $owner->verificationcodes()->save($code);
 
         $post = ['passwordLinkCode' => $code->short_code . '-' . $code->code];
 
         $response = $this->actingAs($owner)->put("/api/v4/users/{$user->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $code->refresh();
 
         $this->assertSame($user->id, $code->user_id);
         $this->assertTrue($code->active);
         $this->assertSame($user->password, $user->fresh()->password);
     }
 
     /**
      * Test UsersController::updateEntitlements()
      */
     public function testUpdateEntitlements(): void
     {
         $jane = $this->getTestUser('jane@kolabnow.com');
 
         $kolab = Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $storage = Sku::withEnvTenantContext()->where('title', 'storage')->first();
         $activesync = Sku::withEnvTenantContext()->where('title', 'activesync')->first();
         $groupware = Sku::withEnvTenantContext()->where('title', 'groupware')->first();
         $mailbox = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();
 
         // standard package, 1 mailbox, 1 groupware, 2 storage
         $jane->assignPackage($kolab);
 
         // add 2 storage, 1 activesync
         $post = [
             'skus' => [
                 $mailbox->id => 1,
                 $groupware->id => 1,
                 $storage->id => 7,
                 $activesync->id => 1
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(200);
 
         $this->assertEntitlements(
             $jane,
             [
                 'activesync',
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
 
         // add 2 storage, remove 1 activesync
         $post = [
             'skus' => [
                 $mailbox->id => 1,
                 $groupware->id => 1,
                 $storage->id => 9,
                 $activesync->id => 0
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(200);
 
         $this->assertEntitlements(
             $jane,
             [
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
 
         // add mailbox
         $post = [
             'skus' => [
                 $mailbox->id => 2,
                 $groupware->id => 1,
                 $storage->id => 9,
                 $activesync->id => 0
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(500);
 
         $this->assertEntitlements(
             $jane,
             [
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
 
         // remove mailbox
         $post = [
             'skus' => [
                 $mailbox->id => 0,
                 $groupware->id => 1,
                 $storage->id => 9,
                 $activesync->id => 0
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(500);
 
         $this->assertEntitlements(
             $jane,
             [
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
 
         // less than free storage
         $post = [
             'skus' => [
                 $mailbox->id => 1,
                 $groupware->id => 1,
                 $storage->id => 1,
                 $activesync->id => 0
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(200);
 
         $this->assertEntitlements(
             $jane,
             [
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
     }
 
     /**
      * Test user data response used in show and info actions
      */
     public function testUserResponse(): void
     {
         $provider = \config('services.payment_provider') ?: 'mollie';
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
         $wallet->setSettings(['mollie_id' => null, 'stripe_id' => null]);
         $result = $this->invokeMethod(new UsersController(), 'userResponse', [$user]);
 
         $this->assertEquals($user->id, $result['id']);
         $this->assertEquals($user->email, $result['email']);
         $this->assertEquals($user->status, $result['status']);
         $this->assertTrue(is_array($result['statusInfo']));
 
         $this->assertTrue(is_array($result['settings']));
         $this->assertSame('US', $result['settings']['country']);
         $this->assertSame('USD', $result['settings']['currency']);
 
         $this->assertTrue(is_array($result['accounts']));
         $this->assertTrue(is_array($result['wallets']));
         $this->assertCount(0, $result['accounts']);
         $this->assertCount(1, $result['wallets']);
         $this->assertSame($wallet->id, $result['wallet']['id']);
         $this->assertArrayNotHasKey('discount', $result['wallet']);
 
         $this->assertTrue($result['statusInfo']['enableDomains']);
         $this->assertTrue($result['statusInfo']['enableWallets']);
         $this->assertTrue($result['statusInfo']['enableUsers']);
         $this->assertTrue($result['statusInfo']['enableSettings']);
 
         // Ned is John's wallet controller
         $ned = $this->getTestUser('ned@kolab.org');
         $ned_wallet = $ned->wallets()->first();
         $result = $this->invokeMethod(new UsersController(), 'userResponse', [$ned]);
 
         $this->assertEquals($ned->id, $result['id']);
         $this->assertEquals($ned->email, $result['email']);
         $this->assertTrue(is_array($result['accounts']));
         $this->assertTrue(is_array($result['wallets']));
         $this->assertCount(1, $result['accounts']);
         $this->assertCount(1, $result['wallets']);
         $this->assertSame($wallet->id, $result['wallet']['id']);
         $this->assertSame($wallet->id, $result['accounts'][0]['id']);
         $this->assertSame($ned_wallet->id, $result['wallets'][0]['id']);
         $this->assertSame($provider, $result['wallet']['provider']);
         $this->assertSame($provider, $result['wallets'][0]['provider']);
 
         $this->assertTrue($result['statusInfo']['enableDomains']);
         $this->assertTrue($result['statusInfo']['enableWallets']);
         $this->assertTrue($result['statusInfo']['enableUsers']);
         $this->assertTrue($result['statusInfo']['enableSettings']);
 
         // Test discount in a response
         $discount = Discount::where('code', 'TEST')->first();
         $wallet->discount()->associate($discount);
         $wallet->save();
         $mod_provider = $provider == 'mollie' ? 'stripe' : 'mollie';
         $wallet->setSetting($mod_provider . '_id', 123);
         $user->refresh();
 
         $result = $this->invokeMethod(new UsersController(), 'userResponse', [$user]);
 
         $this->assertEquals($user->id, $result['id']);
         $this->assertSame($discount->id, $result['wallet']['discount_id']);
         $this->assertSame($discount->discount, $result['wallet']['discount']);
         $this->assertSame($discount->description, $result['wallet']['discount_description']);
         $this->assertSame($mod_provider, $result['wallet']['provider']);
         $this->assertSame($discount->id, $result['wallets'][0]['discount_id']);
         $this->assertSame($discount->discount, $result['wallets'][0]['discount']);
         $this->assertSame($discount->description, $result['wallets'][0]['discount_description']);
         $this->assertSame($mod_provider, $result['wallets'][0]['provider']);
 
         // Jack is not a John's wallet controller
         $jack = $this->getTestUser('jack@kolab.org');
         $result = $this->invokeMethod(new UsersController(), 'userResponse', [$jack]);
 
         $this->assertFalse($result['statusInfo']['enableDomains']);
         $this->assertFalse($result['statusInfo']['enableWallets']);
         $this->assertFalse($result['statusInfo']['enableUsers']);
         $this->assertFalse($result['statusInfo']['enableSettings']);
     }
 
     /**
      * User email address validation.
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      */
     public function testValidateEmail(): void
     {
         Queue::fake();
 
         $public_domains = Domain::getPublicDomains();
         $domain = reset($public_domains);
 
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $folder = $this->getTestSharedFolder('folder-event@kolab.org');
         $folder->setAliases(['folder-alias1@kolab.org']);
         $folder_del = $this->getTestSharedFolder('folder-test@kolabnow.com');
         $folder_del->setAliases(['folder-alias2@kolabnow.com']);
         $folder_del->delete();
         $pub_group = $this->getTestGroup('group-test@kolabnow.com');
         $pub_group->delete();
         $priv_group = $this->getTestGroup('group-test@kolab.org');
         $resource = $this->getTestResource('resource-test@kolabnow.com');
         $resource->delete();
 
         $cases = [
             // valid (user domain)
             ["admin@kolab.org", $john, null],
 
             // valid (public domain)
             ["test.test@$domain", $john, null],
 
             // Invalid format
             ["$domain", $john, 'The specified email is invalid.'],
             [".@$domain", $john, 'The specified email is invalid.'],
             ["test123456@localhost", $john, 'The specified domain is invalid.'],
             ["test123456@unknown-domain.org", $john, 'The specified domain is invalid.'],
 
             ["$domain", $john, 'The specified email is invalid.'],
             [".@$domain", $john, 'The specified email is invalid.'],
 
             // forbidden local part on public domains
             ["admin@$domain", $john, 'The specified email is not available.'],
             ["administrator@$domain", $john, 'The specified email is not available.'],
 
             // forbidden (other user's domain)
             ["testtest@kolab.org", $user, 'The specified domain is not available.'],
 
             // existing alias of other user
             ["jack.daniels@kolab.org", $john, 'The specified email is not available.'],
 
             // An existing shared folder or folder alias
             ["folder-event@kolab.org", $john, 'The specified email is not available.'],
             ["folder-alias1@kolab.org", $john, 'The specified email is not available.'],
 
             // A soft-deleted shared folder or folder alias
             ["folder-test@kolabnow.com", $john, 'The specified email is not available.'],
             ["folder-alias2@kolabnow.com", $john, 'The specified email is not available.'],
 
             // A group
             ["group-test@kolab.org", $john, 'The specified email is not available.'],
 
             // A soft-deleted group
             ["group-test@kolabnow.com", $john, 'The specified email is not available.'],
 
             // A resource
             ["resource-test1@kolab.org", $john, 'The specified email is not available.'],
 
             // A soft-deleted resource
             ["resource-test@kolabnow.com", $john, 'The specified email is not available.'],
         ];
 
         foreach ($cases as $idx => $case) {
             list($email, $user, $expected) = $case;
 
             $deleted = null;
             $result = UsersController::validateEmail($email, $user, $deleted);
 
             $this->assertSame($expected, $result, "Case {$email}");
             $this->assertNull($deleted, "Case {$email}");
         }
     }
 
     /**
      * User email validation - tests for $deleted argument
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      */
     public function testValidateEmailDeleted(): void
     {
         Queue::fake();
 
         $john = $this->getTestUser('john@kolab.org');
         $deleted_priv = $this->getTestUser('deleted@kolab.org');
         $deleted_priv->delete();
         $deleted_pub = $this->getTestUser('deleted@kolabnow.com');
         $deleted_pub->delete();
 
         $result = UsersController::validateEmail('deleted@kolab.org', $john, $deleted);
         $this->assertSame(null, $result);
         $this->assertSame($deleted_priv->id, $deleted->id);
 
         $result = UsersController::validateEmail('deleted@kolabnow.com', $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertSame(null, $deleted);
 
         $result = UsersController::validateEmail('jack@kolab.org', $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertSame(null, $deleted);
 
         $pub_group = $this->getTestGroup('group-test@kolabnow.com');
         $priv_group = $this->getTestGroup('group-test@kolab.org');
 
         // A group in a public domain, existing
         $result = UsersController::validateEmail($pub_group->email, $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertNull($deleted);
 
         $pub_group->delete();
 
         // A group in a public domain, deleted
         $result = UsersController::validateEmail($pub_group->email, $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertNull($deleted);
 
         // A group in a private domain, existing
         $result = UsersController::validateEmail($priv_group->email, $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertNull($deleted);
 
         $priv_group->delete();
 
         // A group in a private domain, deleted
         $result = UsersController::validateEmail($priv_group->email, $john, $deleted);
         $this->assertSame(null, $result);
         $this->assertSame($priv_group->id, $deleted->id);
 
         // TODO: Test the same with a resource and shared folder
     }
 
     /**
      * User email alias validation.
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      */
     public function testValidateAlias(): void
     {
         Queue::fake();
 
         $public_domains = Domain::getPublicDomains();
         $domain = reset($public_domains);
 
         $john = $this->getTestUser('john@kolab.org');
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $deleted_priv = $this->getTestUser('deleted@kolab.org');
         $deleted_priv->setAliases(['deleted-alias@kolab.org']);
         $deleted_priv->delete();
         $deleted_pub = $this->getTestUser('deleted@kolabnow.com');
         $deleted_pub->setAliases(['deleted-alias@kolabnow.com']);
         $deleted_pub->delete();
         $folder = $this->getTestSharedFolder('folder-event@kolab.org');
         $folder->setAliases(['folder-alias1@kolab.org']);
         $folder_del = $this->getTestSharedFolder('folder-test@kolabnow.com');
         $folder_del->setAliases(['folder-alias2@kolabnow.com']);
         $folder_del->delete();
         $group_priv = $this->getTestGroup('group-test@kolab.org');
         $group = $this->getTestGroup('group-test@kolabnow.com');
         $group->delete();
         $resource = $this->getTestResource('resource-test@kolabnow.com');
         $resource->delete();
 
         $cases = [
             // Invalid format
             ["$domain", $john, 'The specified alias is invalid.'],
             [".@$domain", $john, 'The specified alias is invalid.'],
             ["test123456@localhost", $john, 'The specified domain is invalid.'],
             ["test123456@unknown-domain.org", $john, 'The specified domain is invalid.'],
 
             ["$domain", $john, 'The specified alias is invalid.'],
             [".@$domain", $john, 'The specified alias is invalid.'],
 
             // forbidden local part on public domains
             ["admin@$domain", $john, 'The specified alias is not available.'],
             ["administrator@$domain", $john, 'The specified alias is not available.'],
 
             // forbidden (other user's domain)
             ["testtest@kolab.org", $user, 'The specified domain is not available.'],
 
             // existing alias of other user, to be an alias, user in the same group account
             ["jack.daniels@kolab.org", $john, null],
 
             // existing user
             ["jack@kolab.org", $john, 'The specified alias is not available.'],
 
             // valid (user domain)
             ["admin@kolab.org", $john, null],
 
             // valid (public domain)
             ["test.test@$domain", $john, null],
 
             // An alias that was a user email before is allowed, but only for custom domains
             ["deleted@kolab.org", $john, null],
             ["deleted-alias@kolab.org", $john, null],
             ["deleted@kolabnow.com", $john, 'The specified alias is not available.'],
             ["deleted-alias@kolabnow.com", $john, 'The specified alias is not available.'],
 
             // An existing shared folder or folder alias
             ["folder-event@kolab.org", $john, 'The specified alias is not available.'],
             ["folder-alias1@kolab.org", $john, null],
 
             // A soft-deleted shared folder or folder alias
             ["folder-test@kolabnow.com", $john, 'The specified alias is not available.'],
             ["folder-alias2@kolabnow.com", $john, 'The specified alias is not available.'],
 
             // A group with the same email address exists
             ["group-test@kolab.org", $john, 'The specified alias is not available.'],
 
             // A soft-deleted group
             ["group-test@kolabnow.com", $john, 'The specified alias is not available.'],
 
             // A resource
             ["resource-test1@kolab.org", $john, 'The specified alias is not available.'],
 
             // A soft-deleted resource
             ["resource-test@kolabnow.com", $john, 'The specified alias is not available.'],
         ];
 
         foreach ($cases as $idx => $case) {
             list($alias, $user, $expected) = $case;
             $result = UsersController::validateAlias($alias, $user);
             $this->assertSame($expected, $result, "Case {$alias}");
         }
     }
 }
diff --git a/src/tests/Feature/UserTest.php b/src/tests/Feature/UserTest.php
index 327ab9be..0bd0b621 100644
--- a/src/tests/Feature/UserTest.php
+++ b/src/tests/Feature/UserTest.php
@@ -1,1382 +1,1418 @@
 <?php
 
 namespace Tests\Feature;
 
 use App\Domain;
 use App\Group;
 use App\User;
 use Carbon\Carbon;
 use Illuminate\Support\Facades\Queue;
 use Tests\TestCase;
 
 class UserTest extends TestCase
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('user-test@' . \config('app.domain'));
         $this->deleteTestUser('UserAccountA@UserAccount.com');
         $this->deleteTestUser('UserAccountB@UserAccount.com');
         $this->deleteTestUser('UserAccountC@UserAccount.com');
         $this->deleteTestGroup('test-group@UserAccount.com');
         $this->deleteTestResource('test-resource@UserAccount.com');
         $this->deleteTestSharedFolder('test-folder@UserAccount.com');
         $this->deleteTestDomain('UserAccount.com');
         $this->deleteTestDomain('UserAccountAdd.com');
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         \App\TenantSetting::truncate();
         $this->deleteTestUser('user-test@' . \config('app.domain'));
         $this->deleteTestUser('UserAccountA@UserAccount.com');
         $this->deleteTestUser('UserAccountB@UserAccount.com');
         $this->deleteTestUser('UserAccountC@UserAccount.com');
         $this->deleteTestGroup('test-group@UserAccount.com');
         $this->deleteTestResource('test-resource@UserAccount.com');
         $this->deleteTestSharedFolder('test-folder@UserAccount.com');
         $this->deleteTestDomain('UserAccount.com');
         $this->deleteTestDomain('UserAccountAdd.com');
 
         parent::tearDown();
     }
 
     /**
      * Tests for User::assignPackage()
      */
     public function testAssignPackage(): void
     {
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
         $wallet = $user->wallets()->first();
 
         $package = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
 
         $user->assignPackage($package);
 
         $sku = \App\Sku::withEnvTenantContext()->where('title', 'mailbox')->first();
 
         $entitlement = \App\Entitlement::where('wallet_id', $wallet->id)
             ->where('sku_id', $sku->id)->first();
 
         $this->assertNotNull($entitlement);
         $this->assertSame($sku->id, $entitlement->sku->id);
         $this->assertSame($wallet->id, $entitlement->wallet->id);
         $this->assertEquals($user->id, $entitlement->entitleable->id);
         $this->assertTrue($entitlement->entitleable instanceof \App\User);
         $this->assertCount(7, $user->entitlements()->get());
     }
 
     /**
      * Tests for User::assignPlan()
      */
     public function testAssignPlan(): void
     {
         $this->markTestIncomplete();
     }
 
     /**
      * Tests for User::assignSku()
      */
     public function testAssignSku(): void
     {
         $this->markTestIncomplete();
     }
 
     /**
      * Verify a wallet assigned a controller is among the accounts of the assignee.
      */
     public function testAccounts(): void
     {
         $userA = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
 
         $this->assertTrue($userA->wallets()->count() == 1);
 
         $userA->wallets()->each(
             function ($wallet) use ($userB) {
                 $wallet->addController($userB);
             }
         );
 
         $this->assertTrue($userB->accounts()->get()[0]->id === $userA->wallets()->get()[0]->id);
     }
 
     /**
      * Test User::canDelete() method
      */
     public function testCanDelete(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
         $domain = $this->getTestDomain('kolab.org');
 
         // Admin
         $this->assertTrue($admin->canDelete($admin));
         $this->assertFalse($admin->canDelete($john));
         $this->assertFalse($admin->canDelete($jack));
         $this->assertFalse($admin->canDelete($reseller1));
         $this->assertFalse($admin->canDelete($domain));
         $this->assertFalse($admin->canDelete($domain->wallet()));
 
         // Reseller - kolabnow
         $this->assertFalse($reseller1->canDelete($john));
         $this->assertFalse($reseller1->canDelete($jack));
         $this->assertTrue($reseller1->canDelete($reseller1));
         $this->assertFalse($reseller1->canDelete($domain));
         $this->assertFalse($reseller1->canDelete($domain->wallet()));
         $this->assertFalse($reseller1->canDelete($admin));
 
         // Normal user - account owner
         $this->assertTrue($john->canDelete($john));
         $this->assertTrue($john->canDelete($ned));
         $this->assertTrue($john->canDelete($jack));
         $this->assertTrue($john->canDelete($domain));
         $this->assertFalse($john->canDelete($domain->wallet()));
         $this->assertFalse($john->canDelete($reseller1));
         $this->assertFalse($john->canDelete($admin));
 
         // Normal user - a non-owner and non-controller
         $this->assertFalse($jack->canDelete($jack));
         $this->assertFalse($jack->canDelete($john));
         $this->assertFalse($jack->canDelete($domain));
         $this->assertFalse($jack->canDelete($domain->wallet()));
         $this->assertFalse($jack->canDelete($reseller1));
         $this->assertFalse($jack->canDelete($admin));
 
         // Normal user - John's wallet controller
         $this->assertTrue($ned->canDelete($ned));
         $this->assertTrue($ned->canDelete($john));
         $this->assertTrue($ned->canDelete($jack));
         $this->assertTrue($ned->canDelete($domain));
         $this->assertFalse($ned->canDelete($domain->wallet()));
         $this->assertFalse($ned->canDelete($reseller1));
         $this->assertFalse($ned->canDelete($admin));
     }
 
     /**
      * Test User::canRead() method
      */
     public function testCanRead(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
         $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
         $domain = $this->getTestDomain('kolab.org');
 
         // Admin
         $this->assertTrue($admin->canRead($admin));
         $this->assertTrue($admin->canRead($john));
         $this->assertTrue($admin->canRead($jack));
         $this->assertTrue($admin->canRead($reseller1));
         $this->assertTrue($admin->canRead($reseller2));
         $this->assertTrue($admin->canRead($domain));
         $this->assertTrue($admin->canRead($domain->wallet()));
 
         // Reseller - kolabnow
         $this->assertTrue($reseller1->canRead($john));
         $this->assertTrue($reseller1->canRead($jack));
         $this->assertTrue($reseller1->canRead($reseller1));
         $this->assertTrue($reseller1->canRead($domain));
         $this->assertTrue($reseller1->canRead($domain->wallet()));
         $this->assertFalse($reseller1->canRead($reseller2));
         $this->assertFalse($reseller1->canRead($admin));
 
         // Reseller - different tenant
         $this->assertTrue($reseller2->canRead($reseller2));
         $this->assertFalse($reseller2->canRead($john));
         $this->assertFalse($reseller2->canRead($jack));
         $this->assertFalse($reseller2->canRead($reseller1));
         $this->assertFalse($reseller2->canRead($domain));
         $this->assertFalse($reseller2->canRead($domain->wallet()));
         $this->assertFalse($reseller2->canRead($admin));
 
         // Normal user - account owner
         $this->assertTrue($john->canRead($john));
         $this->assertTrue($john->canRead($ned));
         $this->assertTrue($john->canRead($jack));
         $this->assertTrue($john->canRead($domain));
         $this->assertTrue($john->canRead($domain->wallet()));
         $this->assertFalse($john->canRead($reseller1));
         $this->assertFalse($john->canRead($reseller2));
         $this->assertFalse($john->canRead($admin));
 
         // Normal user - a non-owner and non-controller
         $this->assertTrue($jack->canRead($jack));
         $this->assertFalse($jack->canRead($john));
         $this->assertFalse($jack->canRead($domain));
         $this->assertFalse($jack->canRead($domain->wallet()));
         $this->assertFalse($jack->canRead($reseller1));
         $this->assertFalse($jack->canRead($reseller2));
         $this->assertFalse($jack->canRead($admin));
 
         // Normal user - John's wallet controller
         $this->assertTrue($ned->canRead($ned));
         $this->assertTrue($ned->canRead($john));
         $this->assertTrue($ned->canRead($jack));
         $this->assertTrue($ned->canRead($domain));
         $this->assertTrue($ned->canRead($domain->wallet()));
         $this->assertFalse($ned->canRead($reseller1));
         $this->assertFalse($ned->canRead($reseller2));
         $this->assertFalse($ned->canRead($admin));
     }
 
     /**
      * Test User::canUpdate() method
      */
     public function testCanUpdate(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
         $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
         $domain = $this->getTestDomain('kolab.org');
 
         // Admin
         $this->assertTrue($admin->canUpdate($admin));
         $this->assertTrue($admin->canUpdate($john));
         $this->assertTrue($admin->canUpdate($jack));
         $this->assertTrue($admin->canUpdate($reseller1));
         $this->assertTrue($admin->canUpdate($reseller2));
         $this->assertTrue($admin->canUpdate($domain));
         $this->assertTrue($admin->canUpdate($domain->wallet()));
 
         // Reseller - kolabnow
         $this->assertTrue($reseller1->canUpdate($john));
         $this->assertTrue($reseller1->canUpdate($jack));
         $this->assertTrue($reseller1->canUpdate($reseller1));
         $this->assertTrue($reseller1->canUpdate($domain));
         $this->assertTrue($reseller1->canUpdate($domain->wallet()));
         $this->assertFalse($reseller1->canUpdate($reseller2));
         $this->assertFalse($reseller1->canUpdate($admin));
 
         // Reseller - different tenant
         $this->assertTrue($reseller2->canUpdate($reseller2));
         $this->assertFalse($reseller2->canUpdate($john));
         $this->assertFalse($reseller2->canUpdate($jack));
         $this->assertFalse($reseller2->canUpdate($reseller1));
         $this->assertFalse($reseller2->canUpdate($domain));
         $this->assertFalse($reseller2->canUpdate($domain->wallet()));
         $this->assertFalse($reseller2->canUpdate($admin));
 
         // Normal user - account owner
         $this->assertTrue($john->canUpdate($john));
         $this->assertTrue($john->canUpdate($ned));
         $this->assertTrue($john->canUpdate($jack));
         $this->assertTrue($john->canUpdate($domain));
         $this->assertFalse($john->canUpdate($domain->wallet()));
         $this->assertFalse($john->canUpdate($reseller1));
         $this->assertFalse($john->canUpdate($reseller2));
         $this->assertFalse($john->canUpdate($admin));
 
         // Normal user - a non-owner and non-controller
         $this->assertTrue($jack->canUpdate($jack));
         $this->assertFalse($jack->canUpdate($john));
         $this->assertFalse($jack->canUpdate($domain));
         $this->assertFalse($jack->canUpdate($domain->wallet()));
         $this->assertFalse($jack->canUpdate($reseller1));
         $this->assertFalse($jack->canUpdate($reseller2));
         $this->assertFalse($jack->canUpdate($admin));
 
         // Normal user - John's wallet controller
         $this->assertTrue($ned->canUpdate($ned));
         $this->assertTrue($ned->canUpdate($john));
         $this->assertTrue($ned->canUpdate($jack));
         $this->assertTrue($ned->canUpdate($domain));
         $this->assertFalse($ned->canUpdate($domain->wallet()));
         $this->assertFalse($ned->canUpdate($reseller1));
         $this->assertFalse($ned->canUpdate($reseller2));
         $this->assertFalse($ned->canUpdate($admin));
     }
 
     /**
      * Test user created/creating/updated observers
      */
     public function testCreateAndUpdate(): void
     {
         Queue::fake();
 
         $domain = \config('app.domain');
 
         \App\Tenant::find(\config('app.tenant_id'))->setSetting('pgp.enable', 0);
         $user = User::create([
                 'email' => 'USER-test@' . \strtoupper($domain),
                 'password' => 'test',
         ]);
 
         $result = User::where('email', "user-test@$domain")->first();
 
         $this->assertSame("user-test@$domain", $result->email);
         $this->assertSame($user->id, $result->id);
         $this->assertSame(User::STATUS_NEW, $result->status);
         $this->assertSame(0, $user->passwords()->count());
 
         Queue::assertPushed(\App\Jobs\User\CreateJob::class, 1);
         Queue::assertPushed(\App\Jobs\PGP\KeyCreateJob::class, 0);
 
         Queue::assertPushed(
             \App\Jobs\User\CreateJob::class,
             function ($job) use ($user) {
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 $userId = TestCase::getObjectProperty($job, 'userId');
 
                 return $userEmail === $user->email
                     && $userId === $user->id;
             }
         );
 
         // Test invoking KeyCreateJob
         $this->deleteTestUser("user-test@$domain");
 
         \App\Tenant::find(\config('app.tenant_id'))->setSetting('pgp.enable', 1);
 
         $user = User::create(['email' => "user-test@$domain", 'password' => 'test']);
 
         Queue::assertPushed(\App\Jobs\PGP\KeyCreateJob::class, 1);
 
         Queue::assertPushed(
             \App\Jobs\PGP\KeyCreateJob::class,
             function ($job) use ($user) {
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 $userId = TestCase::getObjectProperty($job, 'userId');
 
                 return $userEmail === $user->email
                     && $userId === $user->id;
             }
         );
 
         // Update the user, test the password change
         $user->setSetting('password_expiration_warning', '2020-10-10 10:10:10');
         $oldPassword = $user->password;
         $user->password = 'test123';
         $user->save();
 
         $this->assertNotEquals($oldPassword, $user->password);
         $this->assertSame(0, $user->passwords()->count());
         $this->assertNull($user->getSetting('password_expiration_warning'));
         $this->assertMatchesRegularExpression(
             '/^' . now()->format('Y-m-d') . ' [0-9]{2}:[0-9]{2}:[0-9]{2}$/',
             $user->getSetting('password_update')
         );
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\User\UpdateJob::class,
             function ($job) use ($user) {
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 $userId = TestCase::getObjectProperty($job, 'userId');
 
                 return $userEmail === $user->email
                     && $userId === $user->id;
             }
         );
 
         // Update the user, test the password history
         $user->setSetting('password_policy', 'last:3');
         $oldPassword = $user->password;
         $user->password = 'test1234';
         $user->save();
 
         $this->assertSame(1, $user->passwords()->count());
         $this->assertSame($oldPassword, $user->passwords()->first()->password);
 
         $user->password = 'test12345';
         $user->save();
         $oldPassword = $user->password;
         $user->password = 'test123456';
         $user->save();
 
         $this->assertSame(2, $user->passwords()->count());
         $this->assertSame($oldPassword, $user->passwords()->latest()->first()->password);
     }
 
     /**
      * Tests for User::domains()
      */
     public function testDomains(): void
     {
         $user = $this->getTestUser('john@kolab.org');
 
         $domain = $this->getTestDomain('useraccount.com', [
                 'status' => Domain::STATUS_NEW | Domain::STATUS_ACTIVE,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
 
         $domains = $user->domains()->pluck('namespace')->all();
 
         $this->assertContains($domain->namespace, $domains);
         $this->assertContains('kolab.org', $domains);
 
         // Jack is not the wallet controller, so for him the list should not
         // include John's domains, kolab.org specifically
         $user = $this->getTestUser('jack@kolab.org');
 
         $domains = $user->domains()->pluck('namespace')->all();
 
         $this->assertContains($domain->namespace, $domains);
         $this->assertNotContains('kolab.org', $domains);
 
         // Public domains of other tenants should not be returned
         $tenant = \App\Tenant::where('id', '!=', \config('app.tenant_id'))->first();
         $domain->tenant_id = $tenant->id;
         $domain->save();
 
         $domains = $user->domains()->pluck('namespace')->all();
 
         $this->assertNotContains($domain->namespace, $domains);
     }
 
     /**
      * Test User::getConfig() and setConfig() methods
      */
     public function testConfigTrait(): void
     {
         $user = $this->getTestUser('UserAccountA@UserAccount.com');
         $user->setSetting('greylist_enabled', null);
         $user->setSetting('guam_enabled', null);
         $user->setSetting('password_policy', null);
         $user->setSetting('max_password_age', null);
         $user->setSetting('limit_geo', null);
 
         // greylist_enabled
         $this->assertSame(true, $user->getConfig()['greylist_enabled']);
 
         $result = $user->setConfig(['greylist_enabled' => false, 'unknown' => false]);
 
         $this->assertSame(['unknown' => "The requested configuration parameter is not supported."], $result);
         $this->assertSame(false, $user->getConfig()['greylist_enabled']);
         $this->assertSame('false', $user->getSetting('greylist_enabled'));
 
         $result = $user->setConfig(['greylist_enabled' => true]);
 
         $this->assertSame([], $result);
         $this->assertSame(true, $user->getConfig()['greylist_enabled']);
         $this->assertSame('true', $user->getSetting('greylist_enabled'));
 
         // guam_enabled
         $this->assertSame(false, $user->getConfig()['guam_enabled']);
 
         $result = $user->setConfig(['guam_enabled' => false]);
 
         $this->assertSame([], $result);
         $this->assertSame(false, $user->getConfig()['guam_enabled']);
         $this->assertSame(null, $user->getSetting('guam_enabled'));
 
         $result = $user->setConfig(['guam_enabled' => true]);
 
         $this->assertSame([], $result);
         $this->assertSame(true, $user->getConfig()['guam_enabled']);
         $this->assertSame('true', $user->getSetting('guam_enabled'));
 
         // max_apssword_age
         $this->assertSame(null, $user->getConfig()['max_password_age']);
 
         $result = $user->setConfig(['max_password_age' => -1]);
 
         $this->assertSame([], $result);
         $this->assertSame(null, $user->getConfig()['max_password_age']);
         $this->assertSame(null, $user->getSetting('max_password_age'));
 
         $result = $user->setConfig(['max_password_age' => 12]);
 
         $this->assertSame([], $result);
         $this->assertSame('12', $user->getConfig()['max_password_age']);
         $this->assertSame('12', $user->getSetting('max_password_age'));
 
         // password_policy
         $result = $user->setConfig(['password_policy' => true]);
 
         $this->assertSame(['password_policy' => "Specified password policy is invalid."], $result);
         $this->assertSame(null, $user->getConfig()['password_policy']);
         $this->assertSame(null, $user->getSetting('password_policy'));
 
         $result = $user->setConfig(['password_policy' => 'min:-1']);
 
         $this->assertSame(['password_policy' => "Specified password policy is invalid."], $result);
 
         $result = $user->setConfig(['password_policy' => 'min:-1']);
 
         $this->assertSame(['password_policy' => "Specified password policy is invalid."], $result);
 
         $result = $user->setConfig(['password_policy' => 'min:10,unknown']);
 
         $this->assertSame(['password_policy' => "Specified password policy is invalid."], $result);
 
         \config(['app.password_policy' => 'min:5,max:100']);
         $result = $user->setConfig(['password_policy' => 'min:4,max:255']);
 
         $this->assertSame(['password_policy' => "Minimum password length cannot be less than 5."], $result);
 
         \config(['app.password_policy' => 'min:5,max:100']);
         $result = $user->setConfig(['password_policy' => 'min:10,max:255']);
 
         $this->assertSame(['password_policy' => "Maximum password length cannot be more than 100."], $result);
 
         \config(['app.password_policy' => 'min:5,max:255']);
         $result = $user->setConfig(['password_policy' => 'min:10,max:255']);
 
         $this->assertSame([], $result);
         $this->assertSame('min:10,max:255', $user->getConfig()['password_policy']);
         $this->assertSame('min:10,max:255', $user->getSetting('password_policy'));
 
         // limit_geo
         $this->assertSame([], $user->getConfig()['limit_geo']);
 
         $result = $user->setConfig(['limit_geo' => '']);
 
         $err = "Specified configuration is invalid. Expected a list of two-letter country codes.";
         $this->assertSame(['limit_geo' => $err], $result);
         $this->assertSame(null, $user->getSetting('limit_geo'));
 
         $result = $user->setConfig(['limit_geo' => ['usa']]);
 
         $this->assertSame(['limit_geo' => $err], $result);
         $this->assertSame(null, $user->getSetting('limit_geo'));
 
         $result = $user->setConfig(['limit_geo' => []]);
 
         $this->assertSame([], $result);
         $this->assertSame(null, $user->getSetting('limit_geo'));
 
         $result = $user->setConfig(['limit_geo' => ['US', 'ru']]);
 
         $this->assertSame([], $result);
         $this->assertSame(['US', 'RU'], $user->getConfig()['limit_geo']);
         $this->assertSame('["US","RU"]', $user->getSetting('limit_geo'));
     }
 
     /**
      * Test user account degradation and un-degradation
      */
     public function testDegradeAndUndegrade(): void
     {
         Queue::fake();
 
         // Test an account with users, domain
         $userA = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $domain = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $userA->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $userA);
         $userA->assignPackage($package_kolab, $userB);
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
         $entitlementsDomain = \App\Entitlement::where('entitleable_id', $domain->id);
 
         $yesterday = Carbon::now()->subDays(1);
 
         $this->backdateEntitlements($entitlementsA->get(), $yesterday, Carbon::now()->subMonthsWithoutOverflow(1));
         $this->backdateEntitlements($entitlementsB->get(), $yesterday, Carbon::now()->subMonthsWithoutOverflow(1));
 
         $wallet = $userA->wallets->first();
 
         $this->assertSame(7, $entitlementsA->count());
         $this->assertSame(7, $entitlementsB->count());
         $this->assertSame(7, $entitlementsA->whereDate('updated_at', $yesterday->toDateString())->count());
         $this->assertSame(7, $entitlementsB->whereDate('updated_at', $yesterday->toDateString())->count());
         $this->assertSame(0, $wallet->balance);
 
         Queue::fake(); // reset queue state
 
         // Degrade the account/wallet owner
         $userA->degrade();
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
 
         $this->assertTrue($userA->fresh()->isDegraded());
         $this->assertTrue($userA->fresh()->isDegraded(true));
         $this->assertFalse($userB->fresh()->isDegraded());
         $this->assertTrue($userB->fresh()->isDegraded(true));
 
         $balance = $wallet->fresh()->balance;
         $this->assertTrue($balance <= -64);
         $this->assertSame(7, $entitlementsA->whereDate('updated_at', Carbon::now()->toDateString())->count());
         $this->assertSame(7, $entitlementsB->whereDate('updated_at', Carbon::now()->toDateString())->count());
 
         // Expect one update job for every user
         // @phpstan-ignore-next-line
         $userIds = Queue::pushed(\App\Jobs\User\UpdateJob::class)->map(function ($job) {
             return TestCase::getObjectProperty($job, 'userId');
         })->all();
 
         $this->assertSame([$userA->id, $userB->id], $userIds);
 
         // Un-Degrade the account/wallet owner
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
 
         $yesterday = Carbon::now()->subDays(1);
 
         $this->backdateEntitlements($entitlementsA->get(), $yesterday, Carbon::now()->subMonthsWithoutOverflow(1));
         $this->backdateEntitlements($entitlementsB->get(), $yesterday, Carbon::now()->subMonthsWithoutOverflow(1));
 
         Queue::fake(); // reset queue state
 
         $userA->undegrade();
 
         $this->assertFalse($userA->fresh()->isDegraded());
         $this->assertFalse($userA->fresh()->isDegraded(true));
         $this->assertFalse($userB->fresh()->isDegraded());
         $this->assertFalse($userB->fresh()->isDegraded(true));
 
         // Expect no balance change, degraded account entitlements are free
         $this->assertSame($balance, $wallet->fresh()->balance);
         $this->assertSame(7, $entitlementsA->whereDate('updated_at', Carbon::now()->toDateString())->count());
         $this->assertSame(7, $entitlementsB->whereDate('updated_at', Carbon::now()->toDateString())->count());
 
         // Expect one update job for every user
         // @phpstan-ignore-next-line
         $userIds = Queue::pushed(\App\Jobs\User\UpdateJob::class)->map(function ($job) {
             return TestCase::getObjectProperty($job, 'userId');
         })->all();
 
         $this->assertSame([$userA->id, $userB->id], $userIds);
     }
 
     /**
      * Test user deletion
      */
     public function testDelete(): void
     {
         Queue::fake();
 
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
         $package = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $user->assignPackage($package);
 
         $id = $user->id;
 
         $this->assertCount(7, $user->entitlements()->get());
 
         $user->delete();
 
         $this->assertCount(0, $user->entitlements()->get());
         $this->assertTrue($user->fresh()->trashed());
         $this->assertFalse($user->fresh()->isDeleted());
 
         // Delete the user for real
         $job = new \App\Jobs\User\DeleteJob($id);
         $job->handle();
 
         $this->assertTrue(User::withTrashed()->where('id', $id)->first()->isDeleted());
 
         $user->forceDelete();
 
         $this->assertCount(0, User::withTrashed()->where('id', $id)->get());
 
         // Test an account with users, domain, and group, and resource
         $userA = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $userC = $this->getTestUser('UserAccountC@UserAccount.com');
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $domain = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $userA->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $userA);
         $userA->assignPackage($package_kolab, $userB);
         $userA->assignPackage($package_kolab, $userC);
         $group = $this->getTestGroup('test-group@UserAccount.com');
         $group->assignToWallet($userA->wallets->first());
         $resource = $this->getTestResource('test-resource@UserAccount.com', ['name' => 'test']);
         $resource->assignToWallet($userA->wallets->first());
         $folder = $this->getTestSharedFolder('test-folder@UserAccount.com', ['name' => 'test']);
         $folder->assignToWallet($userA->wallets->first());
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
         $entitlementsC = \App\Entitlement::where('entitleable_id', $userC->id);
         $entitlementsDomain = \App\Entitlement::where('entitleable_id', $domain->id);
         $entitlementsGroup = \App\Entitlement::where('entitleable_id', $group->id);
         $entitlementsResource = \App\Entitlement::where('entitleable_id', $resource->id);
         $entitlementsFolder = \App\Entitlement::where('entitleable_id', $folder->id);
 
         $this->assertSame(7, $entitlementsA->count());
         $this->assertSame(7, $entitlementsB->count());
         $this->assertSame(7, $entitlementsC->count());
         $this->assertSame(1, $entitlementsDomain->count());
         $this->assertSame(1, $entitlementsGroup->count());
         $this->assertSame(1, $entitlementsResource->count());
         $this->assertSame(1, $entitlementsFolder->count());
 
         // Delete non-controller user
         $userC->delete();
 
         $this->assertTrue($userC->fresh()->trashed());
         $this->assertFalse($userC->fresh()->isDeleted());
         $this->assertSame(0, $entitlementsC->count());
 
         // Delete the controller (and expect "sub"-users to be deleted too)
         $userA->delete();
 
         $this->assertSame(0, $entitlementsA->count());
         $this->assertSame(0, $entitlementsB->count());
         $this->assertSame(0, $entitlementsDomain->count());
         $this->assertSame(0, $entitlementsGroup->count());
         $this->assertSame(0, $entitlementsResource->count());
         $this->assertSame(0, $entitlementsFolder->count());
         $this->assertSame(7, $entitlementsA->withTrashed()->count());
         $this->assertSame(7, $entitlementsB->withTrashed()->count());
         $this->assertSame(7, $entitlementsC->withTrashed()->count());
         $this->assertSame(1, $entitlementsDomain->withTrashed()->count());
         $this->assertSame(1, $entitlementsGroup->withTrashed()->count());
         $this->assertSame(1, $entitlementsResource->withTrashed()->count());
         $this->assertSame(1, $entitlementsFolder->withTrashed()->count());
         $this->assertTrue($userA->fresh()->trashed());
         $this->assertTrue($userB->fresh()->trashed());
         $this->assertTrue($domain->fresh()->trashed());
         $this->assertTrue($group->fresh()->trashed());
         $this->assertTrue($resource->fresh()->trashed());
         $this->assertTrue($folder->fresh()->trashed());
         $this->assertFalse($userA->isDeleted());
         $this->assertFalse($userB->isDeleted());
         $this->assertFalse($domain->isDeleted());
         $this->assertFalse($group->isDeleted());
         $this->assertFalse($resource->isDeleted());
         $this->assertFalse($folder->isDeleted());
 
         $userA->forceDelete();
 
         $all_entitlements = \App\Entitlement::where('wallet_id', $userA->wallets->first()->id);
         $transactions = \App\Transaction::where('object_id', $userA->wallets->first()->id);
 
         $this->assertSame(0, $all_entitlements->withTrashed()->count());
         $this->assertSame(0, $transactions->count());
         $this->assertCount(0, User::withTrashed()->where('id', $userA->id)->get());
         $this->assertCount(0, User::withTrashed()->where('id', $userB->id)->get());
         $this->assertCount(0, User::withTrashed()->where('id', $userC->id)->get());
         $this->assertCount(0, Domain::withTrashed()->where('id', $domain->id)->get());
         $this->assertCount(0, Group::withTrashed()->where('id', $group->id)->get());
         $this->assertCount(0, \App\Resource::withTrashed()->where('id', $resource->id)->get());
         $this->assertCount(0, \App\SharedFolder::withTrashed()->where('id', $folder->id)->get());
     }
 
     /**
      * Test user deletion vs. group membership
      */
     public function testDeleteAndGroups(): void
     {
         Queue::fake();
 
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $userA = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $userA->assignPackage($package_kolab, $userB);
         $group = $this->getTestGroup('test-group@UserAccount.com');
         $group->members = ['test@gmail.com', $userB->email];
         $group->assignToWallet($userA->wallets->first());
         $group->save();
 
         Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 1);
 
         $userGroups = $userA->groups()->get();
         $this->assertSame(1, $userGroups->count());
         $this->assertSame($group->id, $userGroups->first()->id);
 
         $userB->delete();
 
         $this->assertSame(['test@gmail.com'], $group->fresh()->members);
 
         // Twice, one for save() and one for delete() above
         Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 2);
     }
 
     /**
      * Test handling negative balance on user deletion
      */
     public function testDeleteWithNegativeBalance(): void
     {
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
         $wallet = $user->wallets()->first();
         $wallet->balance = -1000;
         $wallet->save();
         $reseller_wallet = $user->tenant->wallet();
         $reseller_wallet->balance = 0;
         $reseller_wallet->save();
         \App\Transaction::where('object_id', $reseller_wallet->id)->where('object_type', \App\Wallet::class)->delete();
 
         $user->delete();
 
         $reseller_transactions = \App\Transaction::where('object_id', $reseller_wallet->id)
             ->where('object_type', \App\Wallet::class)->get();
 
         $this->assertSame(-1000, $reseller_wallet->fresh()->balance);
         $this->assertCount(1, $reseller_transactions);
         $trans = $reseller_transactions[0];
         $this->assertSame("Deleted user {$user->email}", $trans->description);
         $this->assertSame(-1000, $trans->amount);
         $this->assertSame(\App\Transaction::WALLET_DEBIT, $trans->type);
     }
 
     /**
      * Test handling positive balance on user deletion
      */
     public function testDeleteWithPositiveBalance(): void
     {
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
         $wallet = $user->wallets()->first();
         $wallet->balance = 1000;
         $wallet->save();
         $reseller_wallet = $user->tenant->wallet();
         $reseller_wallet->balance = 0;
         $reseller_wallet->save();
 
         $user->delete();
 
         $this->assertSame(0, $reseller_wallet->fresh()->balance);
     }
 
     /**
      * Test user deletion with PGP/WOAT enabled
      */
     public function testDeleteWithPGP(): void
     {
         Queue::fake();
 
         // Test with PGP disabled
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
 
         $user->tenant->setSetting('pgp.enable', 0);
         $user->delete();
 
         Queue::assertPushed(\App\Jobs\PGP\KeyDeleteJob::class, 0);
 
         // Test with PGP enabled
         $this->deleteTestUser('user-test@' . \config('app.domain'));
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
 
         $user->tenant->setSetting('pgp.enable', 1);
         $user->delete();
         $user->tenant->setSetting('pgp.enable', 0);
 
         Queue::assertPushed(\App\Jobs\PGP\KeyDeleteJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\PGP\KeyDeleteJob::class,
             function ($job) use ($user) {
                 $userId = TestCase::getObjectProperty($job, 'userId');
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 return $userId == $user->id && $userEmail === $user->email;
             }
         );
     }
 
     /**
      * Test user deletion vs. rooms
      */
     public function testDeleteWithRooms(): void
     {
         $this->markTestIncomplete();
     }
 
     /**
      * Tests for User::aliasExists()
      */
     public function testAliasExists(): void
     {
         $this->assertTrue(User::aliasExists('jack.daniels@kolab.org'));
 
         $this->assertFalse(User::aliasExists('j.daniels@kolab.org'));
         $this->assertFalse(User::aliasExists('john@kolab.org'));
     }
 
     /**
      * Tests for User::emailExists()
      */
     public function testEmailExists(): void
     {
         $this->assertFalse(User::emailExists('jack.daniels@kolab.org'));
         $this->assertFalse(User::emailExists('j.daniels@kolab.org'));
 
         $this->assertTrue(User::emailExists('john@kolab.org'));
         $user = User::emailExists('john@kolab.org', true);
         $this->assertSame('john@kolab.org', $user->email);
     }
 
     /**
      * Tests for User::findByEmail()
      */
     public function testFindByEmail(): void
     {
         $user = $this->getTestUser('john@kolab.org');
 
         $result = User::findByEmail('john');
         $this->assertNull($result);
 
         $result = User::findByEmail('non-existing@email.com');
         $this->assertNull($result);
 
         $result = User::findByEmail('john@kolab.org');
         $this->assertInstanceOf(User::class, $result);
         $this->assertSame($user->id, $result->id);
 
         // Use an alias
         $result = User::findByEmail('john.doe@kolab.org');
         $this->assertInstanceOf(User::class, $result);
         $this->assertSame($user->id, $result->id);
 
         Queue::fake();
 
         // A case where two users have the same alias
         $ned = $this->getTestUser('ned@kolab.org');
         $ned->setAliases(['joe.monster@kolab.org']);
         $result = User::findByEmail('joe.monster@kolab.org');
         $this->assertNull($result);
         $ned->setAliases([]);
 
         // TODO: searching by external email (setting)
         $this->markTestIncomplete();
     }
 
     /**
      * Test User::hasSku() and countEntitlementsBySku() methods
      */
     public function testHasSku(): void
     {
         $john = $this->getTestUser('john@kolab.org');
 
         $this->assertTrue($john->hasSku('mailbox'));
         $this->assertTrue($john->hasSku('storage'));
         $this->assertFalse($john->hasSku('beta'));
         $this->assertFalse($john->hasSku('unknown'));
 
         $this->assertSame(0, $john->countEntitlementsBySku('unknown'));
         $this->assertSame(0, $john->countEntitlementsBySku('2fa'));
         $this->assertSame(1, $john->countEntitlementsBySku('mailbox'));
         $this->assertSame(5, $john->countEntitlementsBySku('storage'));
     }
 
     /**
      * Test User::name()
      */
     public function testName(): void
     {
         Queue::fake();
 
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
 
         $this->assertSame('', $user->name());
         $this->assertSame($user->tenant->title . ' User', $user->name(true));
 
         $user->setSetting('first_name', 'First');
 
         $this->assertSame('First', $user->name());
         $this->assertSame('First', $user->name(true));
 
         $user->setSetting('last_name', 'Last');
 
         $this->assertSame('First Last', $user->name());
         $this->assertSame('First Last', $user->name(true));
     }
 
     /**
      * Test resources() method
      */
     public function testResources(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
 
         $resources = $john->resources()->orderBy('email')->get();
 
         $this->assertSame(2, $resources->count());
         $this->assertSame('resource-test1@kolab.org', $resources[0]->email);
         $this->assertSame('resource-test2@kolab.org', $resources[1]->email);
 
         $resources = $ned->resources()->orderBy('email')->get();
 
         $this->assertSame(2, $resources->count());
         $this->assertSame('resource-test1@kolab.org', $resources[0]->email);
         $this->assertSame('resource-test2@kolab.org', $resources[1]->email);
 
         $resources = $jack->resources()->get();
 
         $this->assertSame(0, $resources->count());
     }
 
     /**
      * Test sharedFolders() method
      */
     public function testSharedFolders(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
 
         $folders = $john->sharedFolders()->orderBy('email')->get();
 
         $this->assertSame(2, $folders->count());
         $this->assertSame('folder-contact@kolab.org', $folders[0]->email);
         $this->assertSame('folder-event@kolab.org', $folders[1]->email);
 
         $folders = $ned->sharedFolders()->orderBy('email')->get();
 
         $this->assertSame(2, $folders->count());
         $this->assertSame('folder-contact@kolab.org', $folders[0]->email);
         $this->assertSame('folder-event@kolab.org', $folders[1]->email);
 
         $folders = $jack->sharedFolders()->get();
 
         $this->assertSame(0, $folders->count());
     }
 
     /**
      * Test user restoring
      */
     public function testRestore(): void
     {
         Queue::fake();
 
         // Test an account with users and domain
         $userA = $this->getTestUser('UserAccountA@UserAccount.com', [
                 'status' => User::STATUS_LDAP_READY | User::STATUS_IMAP_READY | User::STATUS_SUSPENDED,
         ]);
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $domainA = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $domainB = $this->getTestDomain('UserAccountAdd.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $userA->assignPackage($package_kolab);
         $domainA->assignPackage($package_domain, $userA);
         $domainB->assignPackage($package_domain, $userA);
         $userA->assignPackage($package_kolab, $userB);
 
         $storage_sku = \App\Sku::withEnvTenantContext()->where('title', 'storage')->first();
         $now = \Carbon\Carbon::now();
         $wallet_id = $userA->wallets->first()->id;
 
         // add an extra storage entitlement
         $ent1 = \App\Entitlement::create([
                 'wallet_id' => $wallet_id,
                 'sku_id' => $storage_sku->id,
                 'cost' => 0,
                 'entitleable_id' => $userA->id,
                 'entitleable_type' => User::class,
         ]);
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
         $entitlementsDomain = \App\Entitlement::where('entitleable_id', $domainA->id);
 
         // First delete the user
         $userA->delete();
 
         $this->assertSame(0, $entitlementsA->count());
         $this->assertSame(0, $entitlementsB->count());
         $this->assertSame(0, $entitlementsDomain->count());
         $this->assertTrue($userA->fresh()->trashed());
         $this->assertTrue($userB->fresh()->trashed());
         $this->assertTrue($domainA->fresh()->trashed());
         $this->assertTrue($domainB->fresh()->trashed());
         $this->assertFalse($userA->isDeleted());
         $this->assertFalse($userB->isDeleted());
         $this->assertFalse($domainA->isDeleted());
 
         // Backdate one storage entitlement (it's not expected to be restored)
         \App\Entitlement::withTrashed()->where('id', $ent1->id)
             ->update(['deleted_at' => $now->copy()->subMinutes(2)]);
 
         // Backdate entitlements to assert that they were restored with proper updated_at timestamp
         \App\Entitlement::withTrashed()->where('wallet_id', $wallet_id)
             ->update(['updated_at' => $now->subMinutes(10)]);
 
         Queue::fake();
 
         // Then restore it
         $userA->restore();
         $userA->refresh();
 
         $this->assertFalse($userA->trashed());
         $this->assertFalse($userA->isDeleted());
         $this->assertFalse($userA->isSuspended());
         $this->assertFalse($userA->isLdapReady());
         $this->assertFalse($userA->isImapReady());
         $this->assertTrue($userA->isActive());
 
         $this->assertTrue($userB->fresh()->trashed());
         $this->assertTrue($domainB->fresh()->trashed());
         $this->assertFalse($domainA->fresh()->trashed());
 
         // Assert entitlements
         $this->assertSame(7, $entitlementsA->count()); // mailbox + groupware + 5 x storage
         $this->assertTrue($ent1->fresh()->trashed());
         $entitlementsA->get()->each(function ($ent) {
             $this->assertTrue($ent->updated_at->greaterThan(\Carbon\Carbon::now()->subSeconds(5)));
         });
 
         // We expect only CreateJob + UpdateJob pair for both user and domain.
         // Because how Illuminate/Database/Eloquent/SoftDeletes::restore() method
         // is implemented we cannot skip the UpdateJob in any way.
         // I don't want to overwrite this method, the extra job shouldn't do any harm.
         $this->assertCount(4, Queue::pushedJobs()); // @phpstan-ignore-line
         Queue::assertPushed(\App\Jobs\Domain\UpdateJob::class, 1);
         Queue::assertPushed(\App\Jobs\Domain\CreateJob::class, 1);
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
         Queue::assertPushed(\App\Jobs\User\CreateJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\User\CreateJob::class,
             function ($job) use ($userA) {
                 return $userA->id === TestCase::getObjectProperty($job, 'userId');
             }
         );
     }
 
+    /**
+     * Test user account restrict() and unrestrict()
+     */
+    public function testRestrictAndUnrestrict(): void
+    {
+        Queue::fake();
+
+        // Test an account with users, domain
+        $user = $this->getTestUser('UserAccountA@UserAccount.com');
+
+        $this->assertFalse($user->isRestricted());
+
+        $user->restrict();
+
+        $this->assertTrue($user->fresh()->isRestricted());
+
+        Queue::assertPushed(
+            \App\Jobs\User\UpdateJob::class,
+            function ($job) use ($user) {
+                return TestCase::getObjectProperty($job, 'userId') == $user->id;
+            });
+
+        Queue::fake(); // reset queue state
+
+        $user->refresh();
+        $user->unrestrict();
+
+        $this->assertFalse($user->fresh()->isRestricted());
+
+        Queue::assertPushed(
+            \App\Jobs\User\UpdateJob::class,
+            function ($job) use ($user) {
+                return TestCase::getObjectProperty($job, 'userId') == $user->id;
+            });
+    }
+
     /**
      * Tests for AliasesTrait::setAliases()
      */
     public function testSetAliases(): void
     {
         Queue::fake();
         Queue::assertNothingPushed();
 
         $user = $this->getTestUser('UserAccountA@UserAccount.com');
         $domain = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
 
         $this->assertCount(0, $user->aliases->all());
 
         $user->tenant->setSetting('pgp.enable', 1);
 
         // Add an alias
         $user->setAliases(['UserAlias1@UserAccount.com']);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
         Queue::assertPushed(\App\Jobs\PGP\KeyCreateJob::class, 1);
 
         $user->tenant->setSetting('pgp.enable', 0);
 
         $aliases = $user->aliases()->get();
         $this->assertCount(1, $aliases);
         $this->assertSame('useralias1@useraccount.com', $aliases[0]['alias']);
 
         // Add another alias
         $user->setAliases(['UserAlias1@UserAccount.com', 'UserAlias2@UserAccount.com']);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 2);
         Queue::assertPushed(\App\Jobs\PGP\KeyCreateJob::class, 1);
 
         $aliases = $user->aliases()->orderBy('alias')->get();
         $this->assertCount(2, $aliases);
         $this->assertSame('useralias1@useraccount.com', $aliases[0]->alias);
         $this->assertSame('useralias2@useraccount.com', $aliases[1]->alias);
 
         $user->tenant->setSetting('pgp.enable', 1);
 
         // Remove an alias
         $user->setAliases(['UserAlias1@UserAccount.com']);
 
         $user->tenant->setSetting('pgp.enable', 0);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 3);
         Queue::assertPushed(\App\Jobs\PGP\KeyDeleteJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\PGP\KeyDeleteJob::class,
             function ($job) use ($user) {
                 $userId = TestCase::getObjectProperty($job, 'userId');
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 return $userId == $user->id && $userEmail === 'useralias2@useraccount.com';
             }
         );
 
         $aliases = $user->aliases()->get();
         $this->assertCount(1, $aliases);
         $this->assertSame('useralias1@useraccount.com', $aliases[0]['alias']);
 
         // Remove all aliases
         $user->setAliases([]);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 4);
 
         $this->assertCount(0, $user->aliases()->get());
     }
 
     /**
      * Tests for UserSettingsTrait::setSettings() and getSetting() and getSettings()
      */
     public function testUserSettings(): void
     {
         Queue::fake();
         Queue::assertNothingPushed();
 
         $user = $this->getTestUser('UserAccountA@UserAccount.com');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 0);
 
         // Test default settings
         // Note: Technicly this tests UserObserver::created() behavior
         $all_settings = $user->settings()->orderBy('key')->get();
         $this->assertCount(2, $all_settings);
         $this->assertSame('country', $all_settings[0]->key);
         $this->assertSame('CH', $all_settings[0]->value);
         $this->assertSame('currency', $all_settings[1]->key);
         $this->assertSame('CHF', $all_settings[1]->value);
 
         // Add a setting
         $user->setSetting('first_name', 'Firstname');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame('Firstname', $user->getSetting('first_name'));
         $this->assertSame('Firstname', $user->fresh()->getSetting('first_name'));
 
         // Update a setting
         $user->setSetting('first_name', 'Firstname1');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 2);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame('Firstname1', $user->getSetting('first_name'));
         $this->assertSame('Firstname1', $user->fresh()->getSetting('first_name'));
 
         // Delete a setting (null)
         $user->setSetting('first_name', null);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 3);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame(null, $user->getSetting('first_name'));
         $this->assertSame(null, $user->fresh()->getSetting('first_name'));
 
         // Delete a setting (empty string)
         $user->setSetting('first_name', 'Firstname1');
         $user->setSetting('first_name', '');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 5);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame(null, $user->getSetting('first_name'));
         $this->assertSame(null, $user->fresh()->getSetting('first_name'));
 
         // Set multiple settings at once
         $user->setSettings([
                 'first_name' => 'Firstname2',
                 'last_name' => 'Lastname2',
                 'country' => null,
         ]);
 
         // TODO: This really should create a single UserUpdate job, not 3
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 7);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame('Firstname2', $user->getSetting('first_name'));
         $this->assertSame('Firstname2', $user->fresh()->getSetting('first_name'));
         $this->assertSame('Lastname2', $user->getSetting('last_name'));
         $this->assertSame('Lastname2', $user->fresh()->getSetting('last_name'));
         $this->assertSame(null, $user->getSetting('country'));
         $this->assertSame(null, $user->fresh()->getSetting('country'));
 
         $all_settings = $user->settings()->orderBy('key')->get();
         $this->assertCount(3, $all_settings);
 
         // Test getSettings() method
         $this->assertSame(
             [
                 'first_name' => 'Firstname2',
                 'last_name' => 'Lastname2',
                 'unknown' => null,
             ],
             $user->getSettings(['first_name', 'last_name', 'unknown'])
         );
     }
 
     /**
      * Tests for User::users()
      */
     public function testUsers(): void
     {
         $jack = $this->getTestUser('jack@kolab.org');
         $joe = $this->getTestUser('joe@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $wallet = $john->wallets()->first();
 
         $users = $john->users()->orderBy('email')->get();
 
         $this->assertCount(4, $users);
         $this->assertEquals($jack->id, $users[0]->id);
         $this->assertEquals($joe->id, $users[1]->id);
         $this->assertEquals($john->id, $users[2]->id);
         $this->assertEquals($ned->id, $users[3]->id);
 
         $users = $jack->users()->orderBy('email')->get();
 
         $this->assertCount(0, $users);
 
         $users = $ned->users()->orderBy('email')->get();
 
         $this->assertCount(4, $users);
     }
 
     /**
      * Tests for User::walletOwner() (from EntitleableTrait)
      */
     public function testWalletOwner(): void
     {
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         $this->assertSame($john->id, $john->walletOwner()->id);
         $this->assertSame($john->id, $jack->walletOwner()->id);
         $this->assertSame($john->id, $ned->walletOwner()->id);
 
         // User with no entitlements
         $user = $this->getTestUser('UserAccountA@UserAccount.com');
         $this->assertSame($user->id, $user->walletOwner()->id);
     }
 
     /**
      * Tests for User::wallets()
      */
     public function testWallets(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         $this->assertSame(1, $john->wallets()->count());
         $this->assertCount(1, $john->wallets);
         $this->assertInstanceOf(\App\Wallet::class, $john->wallets->first());
 
         $this->assertSame(1, $ned->wallets()->count());
         $this->assertCount(1, $ned->wallets);
         $this->assertInstanceOf(\App\Wallet::class, $ned->wallets->first());
     }
 }
diff --git a/src/tests/Feature/WalletTest.php b/src/tests/Feature/WalletTest.php
index 9e2cb154..a431e288 100644
--- a/src/tests/Feature/WalletTest.php
+++ b/src/tests/Feature/WalletTest.php
@@ -1,538 +1,567 @@
 <?php
 
 namespace Tests\Feature;
 
 use App\Package;
 use App\Plan;
 use App\User;
 use App\Sku;
 use App\Transaction;
 use App\Wallet;
 use Carbon\Carbon;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Queue;
 use Tests\TestCase;
 
 class WalletTest extends TestCase
 {
     private $users = [
         'UserWallet1@UserWallet.com',
         'UserWallet2@UserWallet.com',
         'UserWallet3@UserWallet.com',
         'UserWallet4@UserWallet.com',
         'UserWallet5@UserWallet.com',
         'WalletControllerA@WalletController.com',
         'WalletControllerB@WalletController.com',
         'WalletController2A@WalletController.com',
         'WalletController2B@WalletController.com',
         'jane@kolabnow.com'
     ];
 
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         Carbon::setTestNow(Carbon::createFromDate(2022, 02, 02));
         foreach ($this->users as $user) {
             $this->deleteTestUser($user);
         }
 
         Sku::select()->update(['fee' => 0]);
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         foreach ($this->users as $user) {
             $this->deleteTestUser($user);
         }
 
         Sku::select()->update(['fee' => 0]);
 
         parent::tearDown();
     }
 
     /**
      * Test that turning wallet balance from negative to positive
      * unsuspends and undegrades the account
      */
     public function testBalanceTurnsPositive(): void
     {
         Queue::fake();
 
         $user = $this->getTestUser('UserWallet1@UserWallet.com');
         $user->suspend();
         $user->degrade();
 
         $wallet = $user->wallets()->first();
         $wallet->balance = -100;
         $wallet->save();
 
         $this->assertTrue($user->isSuspended());
         $this->assertTrue($user->isDegraded());
         $this->assertNotNull($wallet->getSetting('balance_negative_since'));
 
         $wallet->balance = 100;
         $wallet->save();
 
         $user->refresh();
 
         $this->assertFalse($user->isSuspended());
         $this->assertFalse($user->isDegraded());
         $this->assertNull($wallet->getSetting('balance_negative_since'));
 
+        // Test un-restricting users on balance change
+        $this->deleteTestUser('UserWallet1@UserWallet.com');
+        $owner = $this->getTestUser('UserWallet1@UserWallet.com');
+        $user1 = $this->getTestUser('UserWallet2@UserWallet.com');
+        $user2 = $this->getTestUser('UserWallet3@UserWallet.com');
+        $package = Package::withEnvTenantContext()->where('title', 'lite')->first();
+        $owner->assignPackage($package, $user1);
+        $owner->assignPackage($package, $user2);
+        $wallet = $owner->wallets()->first();
+
+        $owner->restrict();
+        $user1->restrict();
+        $user2->restrict();
+
+        $this->assertTrue($owner->isRestricted());
+        $this->assertTrue($user1->isRestricted());
+        $this->assertTrue($user2->isRestricted());
+
+        Queue::fake();
+
+        $wallet->balance = 100;
+        $wallet->save();
+
+        $this->assertFalse($owner->fresh()->isRestricted());
+        $this->assertFalse($user1->fresh()->isRestricted());
+        $this->assertFalse($user2->fresh()->isRestricted());
+
+        Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 3);
+
         // TODO: Test group account and unsuspending domain/members/groups
     }
 
     /**
      * Test for Wallet::balanceLastsUntil()
      */
     public function testBalanceLastsUntil(): void
     {
         // Monthly cost of all entitlements: 990
         // 28 days: 35.36 per day
         // 31 days: 31.93 per day
 
         $user = $this->getTestUser('jane@kolabnow.com');
         $plan = Plan::withEnvTenantContext()->where('title', 'individual')->first();
         $user->assignPlan($plan);
         $wallet = $user->wallets()->first();
 
         // User/entitlements created today, balance=0
         $until = $wallet->balanceLastsUntil();
 
         $this->assertSame(
             Carbon::now()->addMonthsWithoutOverflow(1)->toDateString(),
             $until->toDateString()
         );
 
         // User/entitlements created today, balance=-10 CHF
         $wallet->balance = -1000;
         $until = $wallet->balanceLastsUntil();
 
         $this->assertSame(null, $until);
 
         // User/entitlements created today, balance=-9,99 CHF (monthly cost)
         $wallet->balance = 990;
         $until = $wallet->balanceLastsUntil();
 
         $daysInLastMonth = \App\Utils::daysInLastMonth();
 
         $delta = Carbon::now()->addMonthsWithoutOverflow(1)->addDays($daysInLastMonth)->diff($until)->days;
 
         $this->assertTrue($delta <= 1);
         $this->assertTrue($delta >= -1);
 
         // Old entitlements, 100% discount
         $this->backdateEntitlements($wallet->entitlements, Carbon::now()->subDays(40));
         $discount = \App\Discount::withEnvTenantContext()->where('discount', 100)->first();
         $wallet->discount()->associate($discount);
 
         $until = $wallet->refresh()->balanceLastsUntil();
 
         $this->assertSame(null, $until);
 
         // User with no entitlements
         $wallet->discount()->dissociate($discount);
         $wallet->entitlements()->delete();
 
         $until = $wallet->refresh()->balanceLastsUntil();
 
         $this->assertSame(null, $until);
     }
 
     /**
      * Verify a wallet is created, when a user is created.
      */
     public function testCreateUserCreatesWallet(): void
     {
         $user = $this->getTestUser('UserWallet1@UserWallet.com');
 
         $this->assertCount(1, $user->wallets);
         $this->assertSame(\config('app.currency'), $user->wallets[0]->currency);
         $this->assertSame(0, $user->wallets[0]->balance);
     }
 
     /**
      * Verify a user can haz more wallets.
      */
     public function testAddWallet(): void
     {
         $user = $this->getTestUser('UserWallet2@UserWallet.com');
 
         $user->wallets()->save(
             new Wallet(['currency' => 'USD'])
         );
 
         $this->assertCount(2, $user->wallets);
 
         $user->wallets()->each(
             function ($wallet) {
                 $this->assertEquals(0, $wallet->balance);
             }
         );
 
         // For now all wallets use system currency
         $this->assertFalse($user->wallets()->where('currency', 'USD')->exists());
     }
 
     /**
      * Verify we can not delete a user wallet that holds balance.
      */
     public function testDeleteWalletWithCredit(): void
     {
         $user = $this->getTestUser('UserWallet3@UserWallet.com');
 
         $user->wallets()->each(
             function ($wallet) {
                 $wallet->credit(100)->save();
             }
         );
 
         $user->wallets()->each(
             function ($wallet) {
                 $this->assertFalse($wallet->delete());
             }
         );
     }
 
     /**
      * Verify we can not delete a wallet that is the last wallet.
      */
     public function testDeleteLastWallet(): void
     {
         $user = $this->getTestUser('UserWallet4@UserWallet.com');
 
         $this->assertCount(1, $user->wallets);
 
         $user->wallets()->each(
             function ($wallet) {
                 $this->assertFalse($wallet->delete());
             }
         );
     }
 
     /**
      * Verify we can remove a wallet that is an additional wallet.
      */
     public function testDeleteAddtWallet(): void
     {
         $user = $this->getTestUser('UserWallet5@UserWallet.com');
 
         $user->wallets()->save(
             new Wallet(['currency' => 'USD'])
         );
 
         // For now additional wallets with a different currency is not allowed
         $this->assertFalse($user->wallets()->where('currency', 'USD')->exists());
 /*
         $user->wallets()->each(
             function ($wallet) {
                 if ($wallet->currency == 'USD') {
                     $this->assertNotFalse($wallet->delete());
                 }
             }
         );
 */
     }
 
     /**
      * Verify a wallet can be assigned a controller.
      */
     public function testAddWalletController(): void
     {
         $userA = $this->getTestUser('WalletControllerA@WalletController.com');
         $userB = $this->getTestUser('WalletControllerB@WalletController.com');
 
         $userA->wallets()->each(
             function ($wallet) use ($userB) {
                 $wallet->addController($userB);
             }
         );
 
         $this->assertCount(1, $userB->accounts);
 
         $aWallet = $userA->wallets()->first();
         $bAccount = $userB->accounts()->first();
 
         $this->assertTrue($bAccount->id === $aWallet->id);
     }
 
     /**
      * Test Wallet::isController()
      */
     public function testIsController(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         $wallet = $jack->wallet();
 
         $this->assertTrue($wallet->isController($john));
         $this->assertTrue($wallet->isController($ned));
         $this->assertFalse($wallet->isController($jack));
     }
 
     /**
      * Verify controllers can also be removed from wallets.
      */
     public function testRemoveWalletController(): void
     {
         $userA = $this->getTestUser('WalletController2A@WalletController.com');
         $userB = $this->getTestUser('WalletController2B@WalletController.com');
 
         $userA->wallets()->each(
             function ($wallet) use ($userB) {
                 $wallet->addController($userB);
             }
         );
 
         $userB->refresh();
 
         $userB->accounts()->each(
             function ($wallet) use ($userB) {
                 $wallet->removeController($userB);
             }
         );
 
         $this->assertCount(0, $userB->accounts);
     }
 
     /**
      * Test for charging and removing entitlements (including tenant commission calculations)
      */
     public function testChargeAndDeleteEntitlements(): void
     {
         $user = $this->getTestUser('jane@kolabnow.com');
         $wallet = $user->wallets()->first();
         $discount = \App\Discount::withEnvTenantContext()->where('discount', 30)->first();
         $wallet->discount()->associate($discount);
         $wallet->save();
 
         // Add 40% fee to all SKUs
         Sku::select()->update(['fee' => DB::raw("`cost` * 0.4")]);
 
         $plan = Plan::withEnvTenantContext()->where('title', 'individual')->first();
         $storage = Sku::withEnvTenantContext()->where('title', 'storage')->first();
         $user->assignPlan($plan);
         $user->assignSku($storage, 5);
         $user->setSetting('plan_id', null); // disable plan and trial
 
         // Reset reseller's wallet balance and transactions
         $reseller_wallet = $user->tenant->wallet();
         $reseller_wallet->balance = 0;
         $reseller_wallet->save();
         Transaction::where('object_id', $reseller_wallet->id)->where('object_type', \App\Wallet::class)->delete();
 
         // ------------------------------------
         // Test normal charging of entitlements
         // ------------------------------------
 
         // Backdate and charge entitlements, we're expecting one month to be charged
         // Set fake NOW date to make simpler asserting results that depend on number of days in current/last month
         Carbon::setTestNow(Carbon::create(2021, 5, 21, 12));
         $backdate = Carbon::now()->subWeeks(7);
         $this->backdateEntitlements($user->entitlements, $backdate);
         $charge = $wallet->chargeEntitlements();
         $wallet->refresh();
         $reseller_wallet->refresh();
 
         // User discount is 30%
         // Expected: groupware: 490 x 70% + mailbox: 500 x 70% + storage: 5 x round(25x70%) = 778
         $this->assertSame(-778, $wallet->balance);
         // Reseller fee is 40%
         // Expected: groupware: 490 x 30% + mailbox: 500 x 30% + storage: 5 x round(25x30%) = 332
         $this->assertSame(332, $reseller_wallet->balance);
 
         $transactions = Transaction::where('object_id', $wallet->id)
             ->where('object_type', \App\Wallet::class)->get();
 
         $reseller_transactions = Transaction::where('object_id', $reseller_wallet->id)
             ->where('object_type', \App\Wallet::class)->get();
 
         $this->assertCount(1, $reseller_transactions);
         $trans = $reseller_transactions[0];
         $this->assertSame("Charged user jane@kolabnow.com", $trans->description);
         $this->assertSame(332, $trans->amount);
         $this->assertSame(Transaction::WALLET_CREDIT, $trans->type);
 
         $this->assertCount(1, $transactions);
         $trans = $transactions[0];
         $this->assertSame('', $trans->description);
         $this->assertSame(-778, $trans->amount);
         $this->assertSame(Transaction::WALLET_DEBIT, $trans->type);
 
         // Assert all entitlements' updated_at timestamp
         $date = $backdate->addMonthsWithoutOverflow(1);
         $this->assertCount(12, $wallet->entitlements()->where('updated_at', $date)->get());
 
         // -----------------------------------
         // Test charging on entitlement delete
         // -----------------------------------
 
         $reseller_wallet->balance = 0;
         $reseller_wallet->save();
 
         $transactions = Transaction::where('object_id', $wallet->id)
             ->where('object_type', \App\Wallet::class)->delete();
 
         $reseller_transactions = Transaction::where('object_id', $reseller_wallet->id)
             ->where('object_type', \App\Wallet::class)->delete();
 
         $user->removeSku($storage, 2);
 
         // we expect the wallet to have been charged for 19 days of use of
         // 2 deleted storage entitlements
         $wallet->refresh();
         $reseller_wallet->refresh();
 
         // 2 x round(25 / 31 * 19 * 0.7) = 22
         $this->assertSame(-(778 + 22), $wallet->balance);
         // 22 - 2 x round(25 * 0.4 / 31 * 19) = 10
         $this->assertSame(10, $reseller_wallet->balance);
 
         $transactions = Transaction::where('object_id', $wallet->id)
             ->where('object_type', \App\Wallet::class)->get();
 
         $reseller_transactions = Transaction::where('object_id', $reseller_wallet->id)
             ->where('object_type', \App\Wallet::class)->get();
 
         $this->assertCount(2, $reseller_transactions);
         $trans = $reseller_transactions[0];
         $this->assertSame("Charged user jane@kolabnow.com", $trans->description);
         $this->assertSame(5, $trans->amount);
         $this->assertSame(Transaction::WALLET_CREDIT, $trans->type);
 
         $trans = $reseller_transactions[1];
         $this->assertSame("Charged user jane@kolabnow.com", $trans->description);
         $this->assertSame(5, $trans->amount);
         $this->assertSame(Transaction::WALLET_CREDIT, $trans->type);
 
         $this->assertCount(2, $transactions);
         $trans = $transactions[0];
         $this->assertSame('', $trans->description);
         $this->assertSame(-11, $trans->amount);
         $this->assertSame(Transaction::WALLET_DEBIT, $trans->type);
         $trans = $transactions[1];
         $this->assertSame('', $trans->description);
         $this->assertSame(-11, $trans->amount);
         $this->assertSame(Transaction::WALLET_DEBIT, $trans->type);
 
         // TODO: Test entitlement transaction records
     }
 
     /**
      * Test for charging and removing entitlements when in trial
      */
     public function testChargeAndDeleteEntitlementsTrial(): void
     {
         $user = $this->getTestUser('jane@kolabnow.com');
         $wallet = $user->wallets()->first();
 
         $plan = Plan::withEnvTenantContext()->where('title', 'individual')->first();
         $storage = Sku::withEnvTenantContext()->where('title', 'storage')->first();
         $user->assignPlan($plan);
         $user->assignSku($storage, 5);
 
         // ------------------------------------
         // Test normal charging of entitlements
         // ------------------------------------
 
         // Backdate and charge entitlements, we're expecting one month to be charged
         // Set fake NOW date to make simpler asserting results that depend on number of days in current/last month
         Carbon::setTestNow(Carbon::create(2021, 5, 21, 12));
         $backdate = Carbon::now()->subWeeks(7);
         $this->backdateEntitlements($user->entitlements, $backdate);
         $charge = $wallet->chargeEntitlements();
         $wallet->refresh();
 
         // Expected: storage: 5 x 25 = 125 (the rest is free in trial)
         $this->assertSame($balance = -125, $wallet->balance);
 
         // Assert wallet transaction
         $transactions = $wallet->transactions()->get();
 
         $this->assertCount(1, $transactions);
         $trans = $transactions[0];
         $this->assertSame('', $trans->description);
         $this->assertSame($balance, $trans->amount);
         $this->assertSame(Transaction::WALLET_DEBIT, $trans->type);
 
         // Assert entitlement transactions
         $etransactions = Transaction::where('transaction_id', $trans->id)->get();
         $this->assertCount(5, $etransactions);
         $trans = $etransactions[0];
         $this->assertSame(null, $trans->description);
         $this->assertSame(25, $trans->amount);
         $this->assertSame(Transaction::ENTITLEMENT_BILLED, $trans->type);
 
         // Assert all entitlements' updated_at timestamp
         $date = $backdate->addMonthsWithoutOverflow(1);
         $this->assertCount(12, $wallet->entitlements()->where('updated_at', $date)->get());
 
         // Run again, expect no changes
         $charge = $wallet->chargeEntitlements();
         $wallet->refresh();
 
         $this->assertSame($balance, $wallet->balance);
         $this->assertCount(1, $wallet->transactions()->get());
         $this->assertCount(12, $wallet->entitlements()->where('updated_at', $date)->get());
 
         // -----------------------------------
         // Test charging on entitlement delete
         // -----------------------------------
 
         $wallet->transactions()->delete();
 
         $user->removeSku($storage, 2);
 
         $wallet->refresh();
 
         // we expect the wallet to have been charged for 19 days of use of
         // 2 deleted storage entitlements: 2 x round(25 / 31 * 19) = 30
         $this->assertSame($balance -= 30, $wallet->balance);
 
         // Assert wallet transactions
         $transactions = $wallet->transactions()->get();
 
         $this->assertCount(2, $transactions);
         $trans = $transactions[0];
         $this->assertSame('', $trans->description);
         $this->assertSame(-15, $trans->amount);
         $this->assertSame(Transaction::WALLET_DEBIT, $trans->type);
         $trans = $transactions[1];
         $this->assertSame('', $trans->description);
         $this->assertSame(-15, $trans->amount);
         $this->assertSame(Transaction::WALLET_DEBIT, $trans->type);
 
         // Assert entitlement transactions
         /* Note: Commented out because the observer does not create per-entitlement transactions
         $etransactions = Transaction::where('transaction_id', $transactions[0]->id)->get();
         $this->assertCount(1, $etransactions);
         $trans = $etransactions[0];
         $this->assertSame(null, $trans->description);
         $this->assertSame(15, $trans->amount);
         $this->assertSame(Transaction::ENTITLEMENT_BILLED, $trans->type);
         $etransactions = Transaction::where('transaction_id', $transactions[1]->id)->get();
         $this->assertCount(1, $etransactions);
         $trans = $etransactions[0];
         $this->assertSame(null, $trans->description);
         $this->assertSame(15, $trans->amount);
         $this->assertSame(Transaction::ENTITLEMENT_BILLED, $trans->type);
         */
     }
 
     /**
      * Tests for updateEntitlements()
      */
     public function testUpdateEntitlements(): void
     {
         $this->markTestIncomplete();
     }
 }
diff --git a/src/tests/Unit/UserTest.php b/src/tests/Unit/UserTest.php
index 853e1abf..b26bd2de 100644
--- a/src/tests/Unit/UserTest.php
+++ b/src/tests/Unit/UserTest.php
@@ -1,117 +1,119 @@
 <?php
 
 namespace Tests\Unit;
 
 use App\User;
 use App\Wallet;
 use Tests\TestCase;
 
 class UserTest extends TestCase
 {
     /**
      * Test User password mutator
      */
     public function testSetPasswordAttribute(): void
     {
         $user = new User(['email' => 'user@email.com']);
 
         $user->password = 'test';
 
         $ssh512 = "{SSHA512}7iaw3Ur350mqGo7jwQrpkj9hiYB3Lkc/iBml1JQODbJ"
             . "6wYX4oOHV+E+IvIh/1nsUNzLDBMxfqa2Ob1f1ACio/w==";
 
         $this->assertMatchesRegularExpression('/^\$2y\$04\$[0-9a-zA-Z\/.]{53}$/', $user->password);
         $this->assertSame($ssh512, $user->password_ldap);
     }
 
     /**
      * Test User password mutator
      */
     public function testSetPasswordLdapAttribute(): void
     {
         $user = new User(['email' => 'user@email.com']);
 
         $user->password_ldap = 'test';
 
         $ssh512 = "{SSHA512}7iaw3Ur350mqGo7jwQrpkj9hiYB3Lkc/iBml1JQODbJ"
             . "6wYX4oOHV+E+IvIh/1nsUNzLDBMxfqa2Ob1f1ACio/w==";
 
         $this->assertMatchesRegularExpression('/^\$2y\$04\$[0-9a-zA-Z\/.]{53}$/', $user->password);
         $this->assertSame($ssh512, $user->password_ldap);
     }
 
     /**
      * Test User password validation
      */
     public function testPasswordValidation(): void
     {
         $user = new User(['email' => 'user@email.com']);
         $user->password = 'test';
 
         $this->assertSame(true, $user->validateCredentials('user@email.com', 'test'));
         $this->assertSame(false, $user->validateCredentials('user@email.com', 'wrong'));
         $this->assertSame(true, $user->validateCredentials('User@Email.Com', 'test'));
         $this->assertSame(false, $user->validateCredentials('wrong', 'test'));
 
         // Ensure the fallback to the ldap_password works if the current password is empty
         $ssh512 = "{SSHA512}7iaw3Ur350mqGo7jwQrpkj9hiYB3Lkc/iBml1JQODbJ"
             . "6wYX4oOHV+E+IvIh/1nsUNzLDBMxfqa2Ob1f1ACio/w==";
         $ldapUser = new User(['email' => 'user2@email.com']);
         $ldapUser->setRawAttributes(['password' => '', 'password_ldap' => $ssh512, 'email' => 'user2@email.com']);
         $this->assertSame($ldapUser->password, '');
         $this->assertSame($ldapUser->password_ldap, $ssh512);
 
         $this->assertSame(true, $ldapUser->validateCredentials('user2@email.com', 'test', false));
         $ldapUser->delete();
     }
 
     /**
      * Test basic User funtionality
      */
     public function testStatus(): void
     {
         $statuses = [
             User::STATUS_NEW,
             User::STATUS_ACTIVE,
             User::STATUS_SUSPENDED,
             User::STATUS_DELETED,
             User::STATUS_IMAP_READY,
             User::STATUS_LDAP_READY,
             User::STATUS_DEGRADED,
+            User::STATUS_RESTRICTED,
         ];
 
         $users = \App\Utils::powerSet($statuses);
 
         foreach ($users as $user_statuses) {
             $user = new User(
                 [
                     'email' => 'user@email.com',
                     'status' => \array_sum($user_statuses),
                 ]
             );
 
             $this->assertTrue($user->isNew() === in_array(User::STATUS_NEW, $user_statuses));
             $this->assertTrue($user->isActive() === in_array(User::STATUS_ACTIVE, $user_statuses));
             $this->assertTrue($user->isSuspended() === in_array(User::STATUS_SUSPENDED, $user_statuses));
             $this->assertTrue($user->isDeleted() === in_array(User::STATUS_DELETED, $user_statuses));
             $this->assertTrue($user->isLdapReady() === in_array(User::STATUS_LDAP_READY, $user_statuses));
             $this->assertTrue($user->isImapReady() === in_array(User::STATUS_IMAP_READY, $user_statuses));
             $this->assertTrue($user->isDegraded() === in_array(User::STATUS_DEGRADED, $user_statuses));
+            $this->assertTrue($user->isRestricted() === in_array(User::STATUS_RESTRICTED, $user_statuses));
         }
     }
 
     /**
      * Test setStatusAttribute exception
      */
     public function testStatusInvalid(): void
     {
         $this->expectException(\Exception::class);
 
         $user = new User(
             [
                 'email' => 'user@email.com',
                 'status' => 1234567,
             ]
         );
     }
 }