diff --git a/src/app/Http/Controllers/API/PasswordPolicyController.php b/src/app/Http/Controllers/API/PasswordPolicyController.php
index 475f664f..4bac8a60 100644
--- a/src/app/Http/Controllers/API/PasswordPolicyController.php
+++ b/src/app/Http/Controllers/API/PasswordPolicyController.php
@@ -1,66 +1,66 @@
 <?php
 
 namespace App\Http\Controllers\API;
 
 use App\Http\Controllers\Controller;
 use App\Rules\Password;
 use Illuminate\Http\Request;
 
 class PasswordPolicyController extends Controller
 {
     /**
      * Fetch the password policy for the current user account.
      * The result includes all supported policy rules.
      *
      * @param \Illuminate\Http\Request $request
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function index(Request $request)
     {
         // Get the account owner
         $owner = $this->guard()->user()->walletOwner();
 
         // Get the policy
         $policy = new Password($owner);
         $rules = $policy->rules(true);
 
         return response()->json([
                 'list' => array_values($rules),
                 'count' => count($rules),
         ]);
     }
 
     /**
      * Validate the password regarding the defined policies.
      *
      * @param \Illuminate\Http\Request $request
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function check(Request $request)
     {
         $userId = $request->input('user');
 
         $user = !empty($userId) ? \App\User::find($userId) : null;
 
         // Get the policy
-        $policy = new Password($user ? $user->walletOwner() : null);
+        $policy = new Password($user ? $user->walletOwner() : null, $user);
 
         // Check the password
         $status = $policy->check($request->input('password'));
 
         $passed = array_filter(
             $status,
             function ($rule) {
                 return !empty($rule['status']);
             }
         );
 
         return response()->json([
                 'status' => count($passed) == count($status) ? 'success' : 'error',
                 'list' => array_values($status),
                 'count' => count($status),
         ]);
     }
 }
diff --git a/src/app/Observers/UserObserver.php b/src/app/Observers/UserObserver.php
index b0cbc916..3ea65ce8 100644
--- a/src/app/Observers/UserObserver.php
+++ b/src/app/Observers/UserObserver.php
@@ -1,283 +1,324 @@
 <?php
 
 namespace App\Observers;
 
 use App\User;
 use App\Wallet;
 
 class UserObserver
 {
     /**
      * Handle the "creating" event.
      *
      * Ensure that the user is created with a random, large integer.
      *
      * @param \App\User $user The user being created.
      *
      * @return void
      */
     public function creating(User $user)
     {
         $user->email = \strtolower($user->email);
 
         // only users that are not imported get the benefit of the doubt.
         $user->status |= User::STATUS_NEW | User::STATUS_ACTIVE;
     }
 
     /**
      * Handle the "created" event.
      *
      * Ensures the user has at least one wallet.
      *
      * Should ensure some basic settings are available as well.
      *
      * @param \App\User $user The user created.
      *
      * @return void
      */
     public function created(User $user)
     {
         $settings = [
             'country' => \App\Utils::countryForRequest(),
             'currency' => \config('app.currency'),
             /*
             'first_name' => '',
             'last_name' => '',
             'billing_address' => '',
             'organization' => '',
             'phone' => '',
             'external_email' => '',
             */
         ];
 
         foreach ($settings as $key => $value) {
             $settings[$key] = [
                 'key' => $key,
                 'value' => $value,
                 'user_id' => $user->id,
             ];
         }
 
         // Note: Don't use setSettings() here to bypass UserSetting observers
         // Note: This is a single multi-insert query
         $user->settings()->insert(array_values($settings));
 
         $user->wallets()->create();
 
         // Create user record in LDAP, then check if the account is created in IMAP
         $chain = [
             new \App\Jobs\User\VerifyJob($user->id),
         ];
 
         \App\Jobs\User\CreateJob::withChain($chain)->dispatch($user->id);
 
         if (\App\Tenant::getConfig($user->tenant_id, 'pgp.enable')) {
             \App\Jobs\PGP\KeyCreateJob::dispatch($user->id, $user->email);
         }
     }
 
     /**
      * Handle the "deleted" event.
      *
      * @param \App\User $user The user deleted.
      *
      * @return void
      */
     public function deleted(User $user)
     {
         // Remove the user from existing groups
         $wallet = $user->wallet();
         if ($wallet && $wallet->owner) {
             $wallet->owner->groups()->each(function ($group) use ($user) {
                 if (in_array($user->email, $group->members)) {
                     $group->members = array_diff($group->members, [$user->email]);
                     $group->save();
                 }
             });
         }
     }
 
     /**
      * Handle the "deleting" event.
      *
      * @param User $user The user that is being deleted.
      *
      * @return void
      */
     public function deleting(User $user)
     {
         // Remove owned users/domains/groups/resources/etc
         self::removeRelatedObjects($user, $user->isForceDeleting());
 
         // TODO: Especially in tests we're doing delete() on a already deleted user.
         //       Should we escape here - for performance reasons?
 
         if (!$user->isForceDeleting()) {
             \App\Jobs\User\DeleteJob::dispatch($user->id);
 
             if (\App\Tenant::getConfig($user->tenant_id, 'pgp.enable')) {
                 \App\Jobs\PGP\KeyDeleteJob::dispatch($user->id, $user->email);
             }
 
             // Debit the reseller's wallet with the user negative balance
             $balance = 0;
             foreach ($user->wallets as $wallet) {
                 // Note: here we assume all user wallets are using the same currency.
                 //       It might get changed in the future
                 $balance += $wallet->balance;
             }
 
             if ($balance < 0 && $user->tenant && ($wallet = $user->tenant->wallet())) {
                 $wallet->debit($balance * -1, "Deleted user {$user->email}");
             }
         }
     }
 
     /**
      * Handle the user "restoring" event.
      *
      * @param \App\User $user The user
      *
      * @return void
      */
     public function restoring(User $user)
     {
         // Make sure it's not DELETED/LDAP_READY/IMAP_READY/SUSPENDED anymore
         if ($user->isDeleted()) {
             $user->status ^= User::STATUS_DELETED;
         }
         if ($user->isLdapReady()) {
             $user->status ^= User::STATUS_LDAP_READY;
         }
         if ($user->isImapReady()) {
             $user->status ^= User::STATUS_IMAP_READY;
         }
         if ($user->isSuspended()) {
             $user->status ^= User::STATUS_SUSPENDED;
         }
 
         $user->status |= User::STATUS_ACTIVE;
 
         // Note: $user->save() is invoked between 'restoring' and 'restored' events
     }
 
     /**
      * Handle the user "restored" event.
      *
      * @param \App\User $user The user
      *
      * @return void
      */
     public function restored(User $user)
     {
         // We need at least the user domain so it can be created in ldap.
         // FIXME: What if the domain is owned by someone else?
         $domain = $user->domain();
         if ($domain->trashed() && !$domain->isPublic()) {
             // Note: Domain entitlements will be restored by the DomainObserver
             $domain->restore();
         }
 
         // FIXME: Should we reset user aliases? or re-validate them in any way?
 
         // Create user record in LDAP, then run the verification process
         $chain = [
             new \App\Jobs\User\VerifyJob($user->id),
         ];
 
         \App\Jobs\User\CreateJob::withChain($chain)->dispatch($user->id);
     }
 
     /**
      * Handle the "updated" event.
      *
      * @param \App\User $user The user that is being updated.
      *
      * @return void
      */
     public function updated(User $user)
     {
         \App\Jobs\User\UpdateJob::dispatch($user->id);
 
         $oldStatus = $user->getOriginal('status');
         $newStatus = $user->status;
 
         if (($oldStatus & User::STATUS_DEGRADED) !== ($newStatus & User::STATUS_DEGRADED)) {
             $wallets = [];
             $isDegraded = $user->isDegraded();
 
             // Charge all entitlements as if they were being deleted,
             // but don't delete them. Just debit the wallet and update
             // entitlements' updated_at timestamp. On un-degrade we still
             // update updated_at, but with no debit (the cost is 0 on a degraded account).
             foreach ($user->wallets as $wallet) {
                 $wallet->updateEntitlements($isDegraded);
 
                 // Remember time of the degradation for sending periodic reminders
                 // and reset it on un-degradation
                 $val = $isDegraded ? \Carbon\Carbon::now()->toDateTimeString() : null;
                 $wallet->setSetting('degraded_last_reminder', $val);
 
                 $wallets[] = $wallet->id;
             }
 
             // (Un-)degrade users by invoking an update job.
             // LDAP backend will read the wallet owner's degraded status and
             // set LDAP attributes accordingly.
             // We do not change their status as their wallets have its own state
             \App\Entitlement::whereIn('wallet_id', $wallets)
                 ->where('entitleable_id', '!=', $user->id)
                 ->where('entitleable_type', User::class)
                 ->pluck('entitleable_id')
                 ->unique()
                 ->each(function ($user_id) {
                     \App\Jobs\User\UpdateJob::dispatch($user_id);
                 });
         }
+
+        // Save the old password in the password history
+        $oldPassword = $user->getOriginal('password');
+        if ($oldPassword && $user->password != $oldPassword) {
+            self::saveOldPassword($user, $oldPassword);
+        }
     }
 
     /**
      * Remove entitleables/transactions related to the user (in user's wallets)
      *
      * @param \App\User $user  The user
      * @param bool      $force Force-delete mode
      */
     private static function removeRelatedObjects(User $user, $force = false): void
     {
         $wallets = $user->wallets->pluck('id')->all();
 
         \App\Entitlement::withTrashed()
             ->select('entitleable_id', 'entitleable_type')
             ->distinct()
             ->whereIn('wallet_id', $wallets)
             ->get()
             ->each(function ($entitlement) use ($user, $force) {
                 // Skip the current user (infinite recursion loop)
                 if ($entitlement->entitleable_type == User::class && $entitlement->entitleable_id == $user->id) {
                     return;
                 }
 
                 // Objects need to be deleted one by one to make sure observers can do the proper cleanup
                 if ($force) {
                     $entitlement->entitleable->forceDelete();
                 } elseif (!$entitlement->entitleable->trashed()) {
                     $entitlement->entitleable->delete();
                 }
             });
 
         if ($force) {
             // Remove "wallet" transactions, they have no foreign key constraint
             \App\Transaction::where('object_type', Wallet::class)
                 ->whereIn('object_id', $wallets)
                 ->delete();
         }
 
         // regardless of force delete, we're always purging whitelists... just in case
         \App\Policy\RateLimitWhitelist::where(
             [
                 'whitelistable_id' => $user->id,
                 'whitelistable_type' => User::class
             ]
         )->delete();
     }
+
+    /**
+     * Store the old password in user password history. Make sure
+     * we do not store more passwords than we need in the history.
+     *
+     * @param \App\User $user     The user
+     * @param string    $password The old password
+     */
+    private static function saveOldPassword(User $user, string $password): void
+    {
+        // Note: All this is kinda heavy and complicated because we don't want to store
+        // more old passwords than we need. However, except the complication/performance,
+        // there's one issue with it. E.g. the policy changes from 2 to 4, and we already
+        // removed the old passwords that were excessive before, but not now.
+
+        // Get the account password policy
+        $policy = new \App\Rules\Password($user->walletOwner());
+        $rules = $policy->rules();
+
+        // Password history disabled?
+        if (empty($rules['last']) || $rules['last']['param'] < 2) {
+            return;
+        }
+
+        // Store the old password
+        $user->passwords()->create(['password' => $password]);
+
+        // Remove passwords that we don't need anymore
+        $limit = $rules['last']['param'] - 1;
+        $ids = $user->passwords()->latest()->limit($limit)->pluck('id')->all();
+
+        if (count($ids) >= $limit) {
+            $user->passwords()->where('id', '<', $ids[count($ids) - 1])->delete();
+        }
+    }
 }
diff --git a/src/app/Rules/Password.php b/src/app/Rules/Password.php
index 67d8df0a..63110d39 100644
--- a/src/app/Rules/Password.php
+++ b/src/app/Rules/Password.php
@@ -1,194 +1,246 @@
 <?php
 
 namespace App\Rules;
 
 use Illuminate\Contracts\Validation\Rule;
+use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Support\Str;
 
 class Password implements Rule
 {
+    /** @var ?string The validation error message */
     private $message;
+
+    /** @var ?\App\User The account owner which to take the policy from */
     private $owner;
 
+    /** @var ?\App\User The user to whom the checked password belongs */
+    private $user;
+
     /**
      * Class constructor.
      *
-     * @param \App\User $owner The account owner (to take the policy from)
+     * @param ?\App\User $owner The account owner (to take the policy from)
+     * @param ?\App\User $user  The user the password is for (Null for a new user)
      */
-    public function __construct(?\App\User $owner = null)
+    public function __construct(?\App\User $owner = null, ?\App\User $user = null)
     {
         $this->owner = $owner;
+        $this->user = $user;
     }
 
     /**
      * Determine if the validation rule passes.
      *
      * @param string $attribute Attribute name
      * @param mixed  $password  Password string
      *
      * @return bool
      */
     public function passes($attribute, $password): bool
     {
         foreach ($this->check($password) as $rule) {
             if (empty($rule['status'])) {
                 $this->message = \trans('validation.password-policy-error');
                 return false;
             }
         }
 
         return true;
     }
 
     /**
      * Get the validation error message.
      *
      * @return string
      */
     public function message(): ?string
     {
         return $this->message;
     }
 
     /**
      * Check a password against the policy rules
      *
      * @param string $password The password
      */
     public function check($password): array
     {
         $rules = $this->rules();
 
         foreach ($rules as $name => $rule) {
             switch ($name) {
                 case 'min':
                     // Check the min length
-                    $pass = strlen($password) >= intval($rule['param']);
+                    $status = strlen($password) >= intval($rule['param']);
                     break;
 
                 case 'max':
                     // Check the max length
                     $length = strlen($password);
-                    $pass = $length && $length <= intval($rule['param']);
+                    $status = $length && $length <= intval($rule['param']);
                     break;
 
                 case 'lower':
                     // Check if password contains a lower-case character
-                    $pass = preg_match('/[a-z]/', $password) > 0;
+                    $status = preg_match('/[a-z]/', $password) > 0;
                     break;
 
                 case 'upper':
                     // Check if password contains a upper-case character
-                    $pass = preg_match('/[A-Z]/', $password) > 0;
+                    $status = preg_match('/[A-Z]/', $password) > 0;
                     break;
 
                 case 'digit':
                     // Check if password contains a digit
-                    $pass = preg_match('/[0-9]/', $password) > 0;
+                    $status = preg_match('/[0-9]/', $password) > 0;
                     break;
 
                 case 'special':
                     // Check if password contains a special character
-                    $pass = preg_match('/[-~!@#$%^&*_+=`(){}[]|:;"\'`<>,.?\/\\]/', $password) > 0;
+                    $status = preg_match('/[-~!@#$%^&*_+=`(){}[]|:;"\'`<>,.?\/\\]/', $password) > 0;
+                    break;
+
+                case 'last':
+                    // TODO: For performance reasons we might consider checking the history
+                    //       only when the password passed all other checks
+                    $status = $this->checkPasswordHistory($password, (int) $rule['param']);
                     break;
 
                 default:
                     // Ignore unknown rule name
-                    $pass = true;
+                    $status = true;
             }
 
-            $rules[$name]['status'] = $pass;
+            $rules[$name]['status'] = $status;
         }
 
         return $rules;
     }
 
     /**
      * Get the list of rules for a password
      *
      * @param bool $all List all supported rules, instead of the enabled ones
      *
      * @return array List of rule definitions
      */
     public function rules(bool $all = false): array
     {
         // All supported password policy rules (with default params)
-        $supported = 'min:6,max:255,lower,upper,digit,special';
+        $supported = 'min:6,max:255,lower,upper,digit,special,last:3';
 
         // Get the password policy from the $owner settings
         if ($this->owner) {
             $conf = $this->owner->getSetting('password_policy');
         }
 
         // Fallback to the configured policy
         if (empty($conf)) {
             $conf = \config('app.password_policy');
         }
 
         $supported = self::parsePolicy($supported);
         $conf = self::parsePolicy($conf);
         $rules = $all ? $supported : $conf;
 
         foreach ($rules as $idx => $rule) {
             $param = $rule;
 
             if ($all && array_key_exists($idx, $conf)) {
                 $param = $conf[$idx];
                 $enabled = true;
             } else {
                 $enabled = !$all;
             }
 
             $rules[$idx] = [
                 'label' => $idx,
                 'name' => \trans("app.password-rule-{$idx}", ['param' => $param]),
                 'param' => $param,
                 'enabled' => $enabled,
             ];
         }
 
         return $rules;
     }
 
     /**
      * Parse configured policy string
      *
      * @param ?string $policy Policy specification
      *
      * @return array Policy specification as an array indexed by the policy rule type
      */
     public static function parsePolicy(?string $policy): array
     {
         $policy = explode(',', strtolower((string) $policy));
         $policy = array_map('trim', $policy);
         $policy = array_unique(array_filter($policy));
 
         return self::mapWithKeys($policy);
     }
 
+    /**
+     * Check password agains <count> of old passwords in user history
+     *
+     * @param string $password The password to check
+     * @param int    $count    Number of old passwords to check (including current one)
+     *
+     * @return bool True if password is unique, False otherwise
+     */
+    protected function checkPasswordHistory($password, int $count): bool
+    {
+        $status = strlen($password) > 0;
+
+        // Check if password is not the same as last X passwords
+        if ($status && $this->user && $count > 0) {
+            // Current password
+            if ($this->user->password) {
+                $count -= 1;
+                if (Hash::check($password, $this->user->password)) {
+                    return false;
+                }
+            }
+
+            // Passwords from the history
+            if ($count > 0) {
+                $this->user->passwords()->latest()->limit($count)->get()
+                    ->each(function ($oldPassword) use (&$status, $password) {
+                        if (Hash::check($password, $oldPassword->password)) {
+                            $status = false;
+                            return false; // stop iteration
+                        }
+                    });
+            }
+        }
+
+        return $status;
+    }
+
     /**
      * Convert an array with password policy rules into one indexed by the rule name
      *
      * @param array $rules The rules list
      *
      * @return array
      */
     private static function mapWithKeys(array $rules): array
     {
         $result = [];
 
         foreach ($rules as $rule) {
             $key = $rule;
             $value = null;
 
             if (strpos($key, ':')) {
                 list($key, $value) = explode(':', $key, 2);
             }
 
             $result[$key] = $value;
         }
 
         return $result;
     }
 }
diff --git a/src/app/Traits/UserConfigTrait.php b/src/app/Traits/UserConfigTrait.php
index 1b90759f..5f5bd462 100644
--- a/src/app/Traits/UserConfigTrait.php
+++ b/src/app/Traits/UserConfigTrait.php
@@ -1,97 +1,104 @@
 <?php
 
 namespace App\Traits;
 
 use App\Policy\Greylist;
 
 trait UserConfigTrait
 {
     /**
      * A helper to get the user configuration.
      */
     public function getConfig(): array
     {
         $config = [];
 
         // TODO: Should we store the default value somewhere in config?
 
         $config['greylist_enabled'] = $this->getSetting('greylist_enabled') !== 'false';
         $config['password_policy'] = $this->getSetting('password_policy');
 
         return $config;
     }
 
     /**
      * A helper to update user configuration.
      *
      * @param array $config An array of configuration options
      *
      * @return array A list of input validation error messages
      */
     public function setConfig(array $config): array
     {
         $errors = [];
 
         foreach ($config as $key => $value) {
             if ($key == 'greylist_enabled') {
                 $this->setSetting('greylist_enabled', $value ? 'true' : 'false');
             } elseif ($key == 'password_policy') {
                 if (!is_string($value) || (strlen($value) && !preg_match('/^[a-z0-9:,]+$/', $value))) {
                     $errors[$key] = \trans('validation.invalid-password-policy');
                     continue;
                 }
 
                 foreach (explode(',', $value) as $rule) {
                     if ($error = $this->validatePasswordPolicyRule($rule)) {
                         $errors[$key] = $error;
                         continue 2;
                     }
                 }
 
                 $this->setSetting('password_policy', $value);
             } else {
                 $errors[$key] = \trans('validation.invalid-config-parameter');
             }
         }
 
         return $errors;
     }
 
     /**
      * Validates password policy rule.
      *
      * @param string $rule Policy rule
      *
      * @return ?string An error message on error, Null otherwise
      */
     protected function validatePasswordPolicyRule(string $rule): ?string
     {
         $regexp = [
-            'min:[0-9]+', 'max:[0-9]+', 'upper', 'lower', 'digit', 'special',
+            'min:[0-9]+', 'max:[0-9]+', 'upper', 'lower', 'digit', 'special', 'last:[0-9]+'
         ];
 
         if (empty($rule) || !preg_match('/^(' . implode('|', $regexp) . ')$/', $rule)) {
             return \trans('validation.invalid-password-policy');
         }
 
         $systemPolicy = \App\Rules\Password::parsePolicy(\config('app.password_policy'));
 
         // Min/Max values cannot exceed the system defaults, i.e. if system policy
         // is min:5, user's policy cannot be set to a smaller number.
         if (!empty($systemPolicy['min']) && strpos($rule, 'min:') === 0) {
             $value = trim(substr($rule, 4));
             if ($value < $systemPolicy['min']) {
                 return \trans('validation.password-policy-min-len-error', ['min' => $systemPolicy['min']]);
             }
         }
 
         if (!empty($systemPolicy['max']) && strpos($rule, 'max:') === 0) {
             $value = trim(substr($rule, 4));
             if ($value > $systemPolicy['max']) {
                 return \trans('validation.password-policy-max-len-error', ['max' => $systemPolicy['max']]);
             }
         }
 
+        if (!empty($systemPolicy['last']) && strpos($rule, 'last:') === 0) {
+            $value = trim(substr($rule, 5));
+            if ($value < $systemPolicy['last']) {
+                return \trans('validation.password-policy-last-error', ['last' => $systemPolicy['last']]);
+            }
+        }
+
         return null;
     }
 }
diff --git a/src/app/User.php b/src/app/User.php
index 59b8eb85..1b3a221e 100644
--- a/src/app/User.php
+++ b/src/app/User.php
@@ -1,748 +1,758 @@
 <?php
 
 namespace App;
 
 use App\UserAlias;
 use App\Traits\BelongsToTenantTrait;
 use App\Traits\EntitleableTrait;
 use App\Traits\UserAliasesTrait;
 use App\Traits\UserConfigTrait;
 use App\Traits\UuidIntKeyTrait;
 use App\Traits\SettingsTrait;
 use App\Traits\StatusPropertyTrait;
 use App\Wallet;
 use Illuminate\Database\Eloquent\SoftDeletes;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Iatstuti\Database\Support\NullableFields;
 use Laravel\Passport\HasApiTokens;
 use League\OAuth2\Server\Exception\OAuthServerException;
 
 /**
  * The eloquent definition of a User.
  *
  * @property string $email
  * @property int    $id
  * @property string $password
  * @property string $password_ldap
  * @property int    $status
  * @property int    $tenant_id
  */
 class User extends Authenticatable
 {
     use BelongsToTenantTrait;
     use EntitleableTrait;
     use HasApiTokens;
     use NullableFields;
     use UserConfigTrait;
     use UserAliasesTrait;
     use UuidIntKeyTrait;
     use SettingsTrait;
     use SoftDeletes;
     use StatusPropertyTrait;
 
     // a new user, default on creation
     public const STATUS_NEW        = 1 << 0;
     // it's been activated
     public const STATUS_ACTIVE     = 1 << 1;
     // user has been suspended
     public const STATUS_SUSPENDED  = 1 << 2;
     // user has been deleted
     public const STATUS_DELETED    = 1 << 3;
     // user has been created in LDAP
     public const STATUS_LDAP_READY = 1 << 4;
     // user mailbox has been created in IMAP
     public const STATUS_IMAP_READY = 1 << 5;
     // user in "limited feature-set" state
     public const STATUS_DEGRADED   = 1 << 6;
 
     /**
      * The attributes that are mass assignable.
      *
      * @var array
      */
     protected $fillable = [
         'id',
         'email',
         'password',
         'password_ldap',
         'status',
     ];
 
     /**
      * The attributes that should be hidden for arrays.
      *
      * @var array
      */
     protected $hidden = [
         'password',
         'password_ldap',
         'role'
     ];
 
     protected $nullable = [
         'password',
         'password_ldap'
     ];
 
     /**
      * Any wallets on which this user is a controller.
      *
      * This does not include wallets owned by the user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
      */
     public function accounts()
     {
         return $this->belongsToMany(
             'App\Wallet',       // The foreign object definition
             'user_accounts',    // The table name
             'user_id',          // The local foreign key
             'wallet_id'         // The remote foreign key
         );
     }
 
     /**
      * Email aliases of this user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function aliases()
     {
         return $this->hasMany('App\UserAlias', 'user_id');
     }
 
     /**
      * Assign a package to a user. The user should not have any existing entitlements.
      *
      * @param \App\Package   $package The package to assign.
      * @param \App\User|null $user    Assign the package to another user.
      *
      * @return \App\User
      */
     public function assignPackage($package, $user = null)
     {
         if (!$user) {
             $user = $this;
         }
 
         return $user->assignPackageAndWallet($package, $this->wallets()->first());
     }
 
     /**
      * Assign a package plan to a user.
      *
      * @param \App\Plan   $plan   The plan to assign
      * @param \App\Domain $domain Optional domain object
      *
      * @return \App\User Self
      */
     public function assignPlan($plan, $domain = null): User
     {
         $this->setSetting('plan_id', $plan->id);
 
         foreach ($plan->packages as $package) {
             if ($package->isDomain()) {
                 $domain->assignPackage($package, $this);
             } else {
                 $this->assignPackage($package);
             }
         }
 
         return $this;
     }
 
     /**
      * Check if current user can delete another object.
      *
      * @param mixed $object A user|domain|wallet|group object
      *
      * @return bool True if he can, False otherwise
      */
     public function canDelete($object): bool
     {
         if (!method_exists($object, 'wallet')) {
             return false;
         }
 
         $wallet = $object->wallet();
 
         // TODO: For now controller can delete/update the account owner,
         //       this may change in future, controllers are not 0-regression feature
 
         return $wallet && ($wallet->user_id == $this->id || $this->accounts->contains($wallet));
     }
 
     /**
      * Check if current user can read data of another object.
      *
      * @param mixed $object A user|domain|wallet|group object
      *
      * @return bool True if he can, False otherwise
      */
     public function canRead($object): bool
     {
         if ($this->role == 'admin') {
             return true;
         }
 
         if ($object instanceof User && $this->id == $object->id) {
             return true;
         }
 
         if ($this->role == 'reseller') {
             if ($object instanceof User && $object->role == 'admin') {
                 return false;
             }
 
             if ($object instanceof Wallet && !empty($object->owner)) {
                 $object = $object->owner;
             }
 
             return isset($object->tenant_id) && $object->tenant_id == $this->tenant_id;
         }
 
         if ($object instanceof Wallet) {
             return $object->user_id == $this->id || $object->controllers->contains($this);
         }
 
         if (!method_exists($object, 'wallet')) {
             return false;
         }
 
         $wallet = $object->wallet();
 
         return $wallet && ($wallet->user_id == $this->id || $this->accounts->contains($wallet));
     }
 
     /**
      * Check if current user can update data of another object.
      *
      * @param mixed $object A user|domain|wallet|group object
      *
      * @return bool True if he can, False otherwise
      */
     public function canUpdate($object): bool
     {
         if ($object instanceof User && $this->id == $object->id) {
             return true;
         }
 
         if ($this->role == 'admin') {
             return true;
         }
 
         if ($this->role == 'reseller') {
             if ($object instanceof User && $object->role == 'admin') {
                 return false;
             }
 
             if ($object instanceof Wallet && !empty($object->owner)) {
                 $object = $object->owner;
             }
 
             return isset($object->tenant_id) && $object->tenant_id == $this->tenant_id;
         }
 
         return $this->canDelete($object);
     }
 
     /**
      * Degrade the user
      *
      * @return void
      */
     public function degrade(): void
     {
         if ($this->isDegraded()) {
             return;
         }
 
         $this->status |= User::STATUS_DEGRADED;
         $this->save();
     }
 
     /**
      * Return the \App\Domain for this user.
      *
      * @return \App\Domain|null
      */
     public function domain()
     {
         list($local, $domainName) = explode('@', $this->email);
 
         $domain = \App\Domain::withTrashed()->where('namespace', $domainName)->first();
 
         return $domain;
     }
 
     /**
      * List the domains to which this user is entitled.
      *
      * @param bool $with_accounts Include domains assigned to wallets
      *                            the current user controls but not owns.
      * @param bool $with_public   Include active public domains (for the user tenant).
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function domains($with_accounts = true, $with_public = true)
     {
         $domains = $this->entitleables(Domain::class, $with_accounts);
 
         if ($with_public) {
             $domains->orWhere(function ($query) {
                 if (!$this->tenant_id) {
                     $query->where('tenant_id', $this->tenant_id);
                 } else {
                     $query->withEnvTenantContext();
                 }
 
                 $query->whereRaw(sprintf('(domains.type & %s)', Domain::TYPE_PUBLIC))
                     ->whereRaw(sprintf('(domains.status & %s)', Domain::STATUS_ACTIVE));
             });
         }
 
         return $domains;
     }
 
     /**
      * Find whether an email address exists as a user (including deleted users).
      *
      * @param string $email       Email address
      * @param bool   $return_user Return User instance instead of boolean
      *
      * @return \App\User|bool True or User model object if found, False otherwise
      */
     public static function emailExists(string $email, bool $return_user = false)
     {
         if (strpos($email, '@') === false) {
             return false;
         }
 
         $email = \strtolower($email);
 
         $user = self::withTrashed()->where('email', $email)->first();
 
         if ($user) {
             return $return_user ? $user : true;
         }
 
         return false;
     }
 
     /**
      * Return entitleable objects of a specified type controlled by the current user.
      *
      * @param string $class         Object class
      * @param bool   $with_accounts Include objects assigned to wallets
      *                              the current user controls, but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     private function entitleables(string $class, bool $with_accounts = true)
     {
         $wallets = $this->wallets()->pluck('id')->all();
 
         if ($with_accounts) {
             $wallets = array_merge($wallets, $this->accounts()->pluck('wallet_id')->all());
         }
 
         $object = new $class();
         $table = $object->getTable();
 
         return $object->select("{$table}.*")
             ->whereExists(function ($query) use ($table, $wallets, $class) {
                 $query->select(DB::raw(1))
                     ->from('entitlements')
                     ->whereColumn('entitleable_id', "{$table}.id")
                     ->whereIn('entitlements.wallet_id', $wallets)
                     ->where('entitlements.entitleable_type', $class);
             });
     }
 
     /**
      * Helper to find user by email address, whether it is
      * main email address, alias or an external email.
      *
      * If there's more than one alias NULL will be returned.
      *
      * @param string $email    Email address
      * @param bool   $external Search also for an external email
      *
      * @return \App\User|null User model object if found
      */
     public static function findByEmail(string $email, bool $external = false): ?User
     {
         if (strpos($email, '@') === false) {
             return null;
         }
 
         $email = \strtolower($email);
 
         $user = self::where('email', $email)->first();
 
         if ($user) {
             return $user;
         }
 
         $aliases = UserAlias::where('alias', $email)->get();
 
         if (count($aliases) == 1) {
             return $aliases->first()->user;
         }
 
         // TODO: External email
 
         return null;
     }
 
     /**
      * Return groups controlled by the current user.
      *
      * @param bool $with_accounts Include groups assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function groups($with_accounts = true)
     {
         return $this->entitleables(Group::class, $with_accounts);
     }
 
     /**
      * Returns whether this user (or its wallet owner) is degraded.
      *
      * @param bool $owner Check also the wallet owner instead just the user himself
      *
      * @return bool
      */
     public function isDegraded(bool $owner = false): bool
     {
         if ($this->status & self::STATUS_DEGRADED) {
             return true;
         }
 
         if ($owner && ($wallet = $this->wallet())) {
             return $wallet->owner && $wallet->owner->isDegraded();
         }
 
         return false;
     }
 
     /**
      * A shortcut to get the user name.
      *
      * @param bool $fallback Return "<aa.name> User" if there's no name
      *
      * @return string Full user name
      */
     public function name(bool $fallback = false): string
     {
         $settings = $this->getSettings(['first_name', 'last_name']);
 
         $name = trim($settings['first_name'] . ' ' . $settings['last_name']);
 
         if (empty($name) && $fallback) {
             return trim(\trans('app.siteuser', ['site' => \App\Tenant::getConfig($this->tenant_id, 'app.name')]));
         }
 
         return $name;
     }
 
+    /**
+     * Old passwords for this user.
+     *
+     * @return \Illuminate\Database\Eloquent\Relations\HasMany
+     */
+    public function passwords()
+    {
+        return $this->hasMany('App\UserPassword');
+    }
+
     /**
      * Return resources controlled by the current user.
      *
      * @param bool $with_accounts Include resources assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function resources($with_accounts = true)
     {
         return $this->entitleables(\App\Resource::class, $with_accounts);
     }
 
     /**
      * Return shared folders controlled by the current user.
      *
      * @param bool $with_accounts Include folders assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function sharedFolders($with_accounts = true)
     {
         return $this->entitleables(\App\SharedFolder::class, $with_accounts);
     }
 
     public function senderPolicyFrameworkWhitelist($clientName)
     {
         $setting = $this->getSetting('spf_whitelist');
 
         if (!$setting) {
             return false;
         }
 
         $whitelist = json_decode($setting);
 
         $matchFound = false;
 
         foreach ($whitelist as $entry) {
             if (substr($entry, 0, 1) == '/') {
                 $match = preg_match($entry, $clientName);
 
                 if ($match) {
                     $matchFound = true;
                 }
 
                 continue;
             }
 
             if (substr($entry, 0, 1) == '.') {
                 if (substr($clientName, (-1 * strlen($entry))) == $entry) {
                     $matchFound = true;
                 }
 
                 continue;
             }
 
             if ($entry == $clientName) {
                 $matchFound = true;
                 continue;
             }
         }
 
         return $matchFound;
     }
 
     /**
      * Un-degrade this user.
      *
      * @return void
      */
     public function undegrade(): void
     {
         if (!$this->isDegraded()) {
             return;
         }
 
         $this->status ^= User::STATUS_DEGRADED;
         $this->save();
     }
 
     /**
      * Return users controlled by the current user.
      *
      * @param bool $with_accounts Include users assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function users($with_accounts = true)
     {
         return $this->entitleables(User::class, $with_accounts);
     }
 
     /**
      * Verification codes for this user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function verificationcodes()
     {
         return $this->hasMany('App\VerificationCode', 'user_id', 'id');
     }
 
     /**
      * Wallets this user owns.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function wallets()
     {
         return $this->hasMany('App\Wallet');
     }
 
     /**
      * User password mutator
      *
      * @param string $password The password in plain text.
      *
      * @return void
      */
     public function setPasswordAttribute($password)
     {
         if (!empty($password)) {
             $this->attributes['password'] = Hash::make($password);
             $this->attributes['password_ldap'] = '{SSHA512}' . base64_encode(
                 pack('H*', hash('sha512', $password))
             );
         }
     }
 
     /**
      * User LDAP password mutator
      *
      * @param string $password The password in plain text.
      *
      * @return void
      */
     public function setPasswordLdapAttribute($password)
     {
         $this->setPasswordAttribute($password);
     }
 
     /**
      * User status mutator
      *
      * @throws \Exception
      */
     public function setStatusAttribute($status)
     {
         $new_status = 0;
 
         $allowed_values = [
             self::STATUS_NEW,
             self::STATUS_ACTIVE,
             self::STATUS_SUSPENDED,
             self::STATUS_DELETED,
             self::STATUS_LDAP_READY,
             self::STATUS_IMAP_READY,
             self::STATUS_DEGRADED,
         ];
 
         foreach ($allowed_values as $value) {
             if ($status & $value) {
                 $new_status |= $value;
                 $status ^= $value;
             }
         }
 
         if ($status > 0) {
             throw new \Exception("Invalid user status: {$status}");
         }
 
         $this->attributes['status'] = $new_status;
     }
 
     /**
      * Validate the user credentials
      *
      * @param string $username       The username.
      * @param string $password       The password in plain text.
      * @param bool   $updatePassword Store the password if currently empty
      *
      * @return bool true on success
      */
     public function validateCredentials(string $username, string $password, bool $updatePassword = true): bool
     {
         $authenticated = false;
 
         if ($this->email === \strtolower($username)) {
             if (!empty($this->password)) {
                 if (Hash::check($password, $this->password)) {
                     $authenticated = true;
                 }
             } elseif (!empty($this->password_ldap)) {
                 if (substr($this->password_ldap, 0, 6) == "{SSHA}") {
                     $salt = substr(base64_decode(substr($this->password_ldap, 6)), 20);
 
                     $hash = '{SSHA}' . base64_encode(
                         sha1($password . $salt, true) . $salt
                     );
 
                     if ($hash == $this->password_ldap) {
                         $authenticated = true;
                     }
                 } elseif (substr($this->password_ldap, 0, 9) == "{SSHA512}") {
                     $salt = substr(base64_decode(substr($this->password_ldap, 9)), 64);
 
                     $hash = '{SSHA512}' . base64_encode(
                         pack('H*', hash('sha512', $password . $salt)) . $salt
                     );
 
                     if ($hash == $this->password_ldap) {
                         $authenticated = true;
                     }
                 }
             } else {
                 \Log::error("Incomplete credentials for {$this->email}");
             }
         }
 
         if ($authenticated) {
             \Log::info("Successful authentication for {$this->email}");
 
             // TODO: update last login time
             if ($updatePassword && (empty($this->password) || empty($this->password_ldap))) {
                 $this->password = $password;
                 $this->save();
             }
         } else {
             // TODO: Try actual LDAP?
             \Log::info("Authentication failed for {$this->email}");
         }
 
         return $authenticated;
     }
 
     /**
      * Retrieve and authenticate a user
      *
      * @param string $username     The username.
      * @param string $password     The password in plain text.
      * @param string $secondFactor The second factor (secondfactor from current request is used as fallback).
      *
      * @return array ['user', 'reason', 'errorMessage']
      */
     public static function findAndAuthenticate($username, $password, $secondFactor = null): ?array
     {
         $user = User::where('email', $username)->first();
 
         if (!$user) {
             return ['reason' => 'notfound', 'errorMessage' => "User not found."];
         }
 
         if (!$user->validateCredentials($username, $password)) {
             return ['reason' => 'credentials', 'errorMessage' => "Invalid password."];
         }
 
         if (!$secondFactor) {
             // Check the request if there is a second factor provided
             // as fallback.
             $secondFactor = request()->secondfactor;
         }
 
         try {
             (new \App\Auth\SecondFactor($user))->validate($secondFactor);
         } catch (\Exception $e) {
             return ['reason' => 'secondfactor', 'errorMessage' => $e->getMessage()];
         }
 
         return ['user' => $user];
     }
 
     /**
      * Hook for passport
      *
      * @throws \Throwable
      *
      * @return \App\User User model object if found
      */
     public function findAndValidateForPassport($username, $password): User
     {
         $result = self::findAndAuthenticate($username, $password);
 
         if (isset($result['reason'])) {
             if ($result['reason'] == 'secondfactor') {
                 // This results in a json response of {'error': 'secondfactor', 'error_description': '$errorMessage'}
                 throw new OAuthServerException($result['errorMessage'], 6, 'secondfactor', 401);
             }
 
             throw OAuthServerException::invalidCredentials();
         }
 
         return $result['user'];
     }
 }
diff --git a/src/app/UserPassword.php b/src/app/UserPassword.php
new file mode 100644
index 00000000..63ab0efa
--- /dev/null
+++ b/src/app/UserPassword.php
@@ -0,0 +1,37 @@
+<?php
+
+namespace App;
+
+use Illuminate\Database\Eloquent\Model;
+
+/**
+ * A password history entry of a User.
+ *
+ * @property int    $id
+ * @property int    $user_id
+ * @property string $password
+ */
+class UserPassword extends Model
+{
+    /** @var bool Indicates if the model should be timestamped. */
+    public $timestamps = false;
+
+    /** @var array The attributes that should be mutated to dates. */
+    protected $dates = ['created_at'];
+
+    /** @var array The attributes that are mass assignable. */
+    protected $fillable = ['user_id', 'password'];
+
+    /** @var array The attributes that should be hidden for arrays. */
+    protected $hidden = ['password'];
+
+    /**
+     * The user to which this entry belongs.
+     *
+     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
+     */
+    public function user()
+    {
+        return $this->belongsTo('\App\User', 'user_id', 'id');
+    }
+}
diff --git a/src/database/migrations/2022_02_04_100000_create_user_passwords_table.php b/src/database/migrations/2022_02_04_100000_create_user_passwords_table.php
new file mode 100644
index 00000000..da158df3
--- /dev/null
+++ b/src/database/migrations/2022_02_04_100000_create_user_passwords_table.php
@@ -0,0 +1,42 @@
+<?php
+
+use Illuminate\Support\Facades\Schema;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Database\Migrations\Migration;
+
+// phpcs:ignore
+class CreateUserPasswordsTable extends Migration
+{
+    /**
+     * Run the migrations.
+     *
+     * @return void
+     */
+    public function up()
+    {
+        Schema::create(
+            'user_passwords',
+            function (Blueprint $table) {
+                $table->bigIncrements('id');
+                $table->bigInteger('user_id');
+                $table->string('password');
+                $table->timestamp('created_at')->useCurrent();
+
+                $table->index(['user_id', 'created_at']);
+
+                $table->foreign('user_id')->references('id')->on('users')
+                    ->onDelete('cascade')->onUpdate('cascade');
+            }
+        );
+    }
+
+    /**
+     * Reverse the migrations.
+     *
+     * @return void
+     */
+    public function down()
+    {
+        Schema::dropIfExists('user_passwords');
+    }
+}
diff --git a/src/resources/lang/en/app.php b/src/resources/lang/en/app.php
index f35ced05..a2ce8f17 100644
--- a/src/resources/lang/en/app.php
+++ b/src/resources/lang/en/app.php
@@ -1,125 +1,126 @@
 <?php
 
 return [
 
     /*
     |--------------------------------------------------------------------------
     | Application Language Lines
     |--------------------------------------------------------------------------
     |
     | The following language lines are used in the application.
     */
 
     'chart-created' => 'Created',
     'chart-deleted' => 'Deleted',
     'chart-average' => 'average',
     'chart-allusers' => 'All Users - last year',
     'chart-discounts' => 'Discounts',
     'chart-vouchers' => 'Vouchers',
     'chart-income' => 'Income in :currency - last 8 weeks',
     'chart-users' => 'Users - last 8 weeks',
 
     'mandate-delete-success' => 'The auto-payment has been removed.',
     'mandate-update-success' => 'The auto-payment has been updated.',
 
     'planbutton' => 'Choose :plan',
 
     'process-async' => 'Setup process has been pushed. Please wait.',
     'process-user-new' => 'Registering a user...',
     'process-user-ldap-ready' => 'Creating a user...',
     'process-user-imap-ready' => 'Creating a mailbox...',
     'process-domain-new' => 'Registering a custom domain...',
     'process-domain-ldap-ready' => 'Creating a custom domain...',
     'process-domain-verified' => 'Verifying a custom domain...',
     'process-domain-confirmed' => 'Verifying an ownership of a custom domain...',
     'process-success' => 'Setup process finished successfully.',
     'process-error-distlist-ldap-ready' => 'Failed to create a distribution list.',
     'process-error-domain-ldap-ready' => 'Failed to create a domain.',
     'process-error-domain-verified' => 'Failed to verify a domain.',
     'process-error-domain-confirmed' => 'Failed to verify an ownership of a domain.',
     'process-error-resource-imap-ready' => 'Failed to verify that a shared folder exists.',
     'process-error-resource-ldap-ready' => 'Failed to create a resource.',
     'process-error-shared-folder-imap-ready' => 'Failed to verify that a shared folder exists.',
     'process-error-shared-folder-ldap-ready' => 'Failed to create a shared folder.',
     'process-error-user-ldap-ready' => 'Failed to create a user.',
     'process-error-user-imap-ready' => 'Failed to verify that a mailbox exists.',
     'process-distlist-new' => 'Registering a distribution list...',
     'process-distlist-ldap-ready' => 'Creating a distribution list...',
     'process-resource-new' => 'Registering a resource...',
     'process-resource-imap-ready' => 'Creating a shared folder...',
     'process-resource-ldap-ready' => 'Creating a resource...',
     'process-shared-folder-new' => 'Registering a shared folder...',
     'process-shared-folder-imap-ready' => 'Creating a shared folder...',
     'process-shared-folder-ldap-ready' => 'Creating a shared folder...',
 
     'distlist-update-success' => 'Distribution list updated successfully.',
     'distlist-create-success' => 'Distribution list created successfully.',
     'distlist-delete-success' => 'Distribution list deleted successfully.',
     'distlist-suspend-success' => 'Distribution list suspended successfully.',
     'distlist-unsuspend-success' => 'Distribution list unsuspended successfully.',
     'distlist-setconfig-success' => 'Distribution list settings updated successfully.',
 
     'domain-create-success' => 'Domain created successfully.',
     'domain-delete-success' => 'Domain deleted successfully.',
     'domain-notempty-error' => 'Unable to delete a domain with assigned users or other objects.',
     'domain-verify-success' => 'Domain verified successfully.',
     'domain-verify-error' => 'Domain ownership verification failed.',
     'domain-suspend-success' => 'Domain suspended successfully.',
     'domain-unsuspend-success' => 'Domain unsuspended successfully.',
     'domain-setconfig-success' => 'Domain settings updated successfully.',
 
     'resource-update-success' => 'Resource updated successfully.',
     'resource-create-success' => 'Resource created successfully.',
     'resource-delete-success' => 'Resource deleted successfully.',
     'resource-setconfig-success' => 'Resource settings updated successfully.',
 
     'shared-folder-update-success' => 'Shared folder updated successfully.',
     'shared-folder-create-success' => 'Shared folder created successfully.',
     'shared-folder-delete-success' => 'Shared folder deleted successfully.',
     'shared-folder-setconfig-success' => 'Shared folder settings updated successfully.',
 
     'user-update-success' => 'User data updated successfully.',
     'user-create-success' => 'User created successfully.',
     'user-delete-success' => 'User deleted successfully.',
     'user-suspend-success' => 'User suspended successfully.',
     'user-unsuspend-success' => 'User unsuspended successfully.',
     'user-reset-2fa-success' => '2-Factor authentication reset successfully.',
     'user-setconfig-success' => 'User settings updated successfully.',
     'user-set-sku-success' => 'The subscription added successfully.',
     'user-set-sku-already-exists' => 'The subscription already exists.',
 
     'search-foundxdomains' => ':x domains have been found.',
     'search-foundxdistlists' => ':x distribution lists have been found.',
     'search-foundxresources' => ':x resources have been found.',
     'search-foundxsharedfolders' => ':x shared folders have been found.',
     'search-foundxusers' => ':x user accounts have been found.',
 
     'signup-invitations-created' => 'The invitation has been created.|:count invitations has been created.',
     'signup-invitations-csv-empty' => 'Failed to find any valid email addresses in the uploaded file.',
     'signup-invitations-csv-invalid-email' => 'Found an invalid email address (:email) on line :line.',
     'signup-invitation-delete-success' => 'Invitation deleted successfully.',
     'signup-invitation-resend-success' => 'Invitation added to the sending queue successfully.',
 
     'support-request-success' => 'Support request submitted successfully.',
     'support-request-error' => 'Failed to submit the support request.',
 
     'siteuser' => ':site User',
 
     'wallet-award-success' => 'The bonus has been added to the wallet successfully.',
     'wallet-penalty-success' => 'The penalty has been added to the wallet successfully.',
     'wallet-update-success' => 'User wallet updated successfully.',
 
     'password-reset-code-delete-success' => 'Password reset code deleted successfully.',
     'password-rule-min' => 'Minimum password length: :param characters',
     'password-rule-max' => 'Maximum password length: :param characters',
     'password-rule-lower' => 'Password contains a lower-case character',
     'password-rule-upper' => 'Password contains an upper-case character',
     'password-rule-digit' => 'Password contains a digit',
     'password-rule-special' => 'Password contains a special character',
+    'password-rule-last' => 'Password cannot be the same as the last :param passwords',
 
     'wallet-notice-date' => 'With your current subscriptions your account balance will last until about :date (:days).',
     'wallet-notice-nocredit' => 'You are out of credit, top up your balance now.',
     'wallet-notice-today' => 'You will run out of credit today, top up your balance now.',
     'wallet-notice-trial' => 'You are in your free trial period.',
     'wallet-notice-trial-end' => 'Your free trial is about to end, top up to continue.',
 ];
diff --git a/src/resources/lang/en/validation.php b/src/resources/lang/en/validation.php
index a9982f4d..5fe7ce2c 100644
--- a/src/resources/lang/en/validation.php
+++ b/src/resources/lang/en/validation.php
@@ -1,182 +1,183 @@
 <?php
 
 return [
 
     /*
     |--------------------------------------------------------------------------
     | Validation Language Lines
     |--------------------------------------------------------------------------
     |
     | The following language lines contain the default error messages used by
     | the validator class. Some of these rules have multiple versions such
     | as the size rules. Feel free to tweak each of these messages here.
     |
     */
 
     'accepted' => 'The :attribute must be accepted.',
     'active_url' => 'The :attribute is not a valid URL.',
     'after' => 'The :attribute must be a date after :date.',
     'after_or_equal' => 'The :attribute must be a date after or equal to :date.',
     'alpha' => 'The :attribute may only contain letters.',
     'alpha_dash' => 'The :attribute may only contain letters, numbers, dashes and underscores.',
     'alpha_num' => 'The :attribute may only contain letters and numbers.',
     'array' => 'The :attribute must be an array.',
     'before' => 'The :attribute must be a date before :date.',
     'before_or_equal' => 'The :attribute must be a date before or equal to :date.',
     'between' => [
         'numeric' => 'The :attribute must be between :min and :max.',
         'file' => 'The :attribute must be between :min and :max kilobytes.',
         'string' => 'The :attribute must be between :min and :max characters.',
         'array' => 'The :attribute must have between :min and :max items.',
     ],
     'boolean' => 'The :attribute field must be true or false.',
     'confirmed' => 'The :attribute confirmation does not match.',
     'date' => 'The :attribute is not a valid date.',
     'date_equals' => 'The :attribute must be a date equal to :date.',
     'date_format' => 'The :attribute does not match the format :format.',
     'different' => 'The :attribute and :other must be different.',
     'digits' => 'The :attribute must be :digits digits.',
     'digits_between' => 'The :attribute must be between :min and :max digits.',
     'dimensions' => 'The :attribute has invalid image dimensions.',
     'distinct' => 'The :attribute field has a duplicate value.',
     'email' => 'The :attribute must be a valid email address.',
     'ends_with' => 'The :attribute must end with one of the following: :values',
     'exists' => 'The selected :attribute is invalid.',
     'file' => 'The :attribute must be a file.',
     'filled' => 'The :attribute field must have a value.',
     'gt' => [
         'numeric' => 'The :attribute must be greater than :value.',
         'file' => 'The :attribute must be greater than :value kilobytes.',
         'string' => 'The :attribute must be greater than :value characters.',
         'array' => 'The :attribute must have more than :value items.',
     ],
     'gte' => [
         'numeric' => 'The :attribute must be greater than or equal :value.',
         'file' => 'The :attribute must be greater than or equal :value kilobytes.',
         'string' => 'The :attribute must be greater than or equal :value characters.',
         'array' => 'The :attribute must have :value items or more.',
     ],
     'image' => 'The :attribute must be an image.',
     'in' => 'The selected :attribute is invalid.',
     'in_array' => 'The :attribute field does not exist in :other.',
     'integer' => 'The :attribute must be an integer.',
     'ip' => 'The :attribute must be a valid IP address.',
     'ipv4' => 'The :attribute must be a valid IPv4 address.',
     'ipv6' => 'The :attribute must be a valid IPv6 address.',
     'json' => 'The :attribute must be a valid JSON string.',
     'lt' => [
         'numeric' => 'The :attribute must be less than :value.',
         'file' => 'The :attribute must be less than :value kilobytes.',
         'string' => 'The :attribute must be less than :value characters.',
         'array' => 'The :attribute must have less than :value items.',
     ],
     'lte' => [
         'numeric' => 'The :attribute must be less than or equal :value.',
         'file' => 'The :attribute must be less than or equal :value kilobytes.',
         'string' => 'The :attribute must be less than or equal :value characters.',
         'array' => 'The :attribute must not have more than :value items.',
     ],
     'max' => [
         'numeric' => 'The :attribute may not be greater than :max.',
         'file' => 'The :attribute may not be greater than :max kilobytes.',
         'string' => 'The :attribute may not be greater than :max characters.',
         'array' => 'The :attribute may not have more than :max items.',
     ],
     'mimes' => 'The :attribute must be a file of type: :values.',
     'mimetypes' => 'The :attribute must be a file of type: :values.',
     'min' => [
         'numeric' => 'The :attribute must be at least :min.',
         'file' => 'The :attribute must be at least :min kilobytes.',
         'string' => 'The :attribute must be at least :min characters.',
         'array' => 'The :attribute must have at least :min items.',
     ],
     'not_in' => 'The selected :attribute is invalid.',
     'not_regex' => 'The :attribute format is invalid.',
     'numeric' => 'The :attribute must be a number.',
     'present' => 'The :attribute field must be present.',
     'regex' => 'The :attribute format is invalid.',
     'required' => 'The :attribute field is required.',
     'required_if' => 'The :attribute field is required when :other is :value.',
     'required_unless' => 'The :attribute field is required unless :other is in :values.',
     'required_with' => 'The :attribute field is required when :values is present.',
     'required_with_all' => 'The :attribute field is required when :values are present.',
     'required_without' => 'The :attribute field is required when :values is not present.',
     'required_without_all' => 'The :attribute field is required when none of :values are present.',
     'same' => 'The :attribute and :other must match.',
     'size' => [
         'numeric' => 'The :attribute must be :size.',
         'file' => 'The :attribute must be :size kilobytes.',
         'string' => 'The :attribute must be :size characters.',
         'array' => 'The :attribute must contain :size items.',
     ],
     'starts_with' => 'The :attribute must start with one of the following: :values',
     'string' => 'The :attribute must be a string.',
     'timezone' => 'The :attribute must be a valid zone.',
     'unique' => 'The :attribute has already been taken.',
     'uploaded' => 'The :attribute failed to upload.',
     'url' => 'The :attribute format is invalid.',
     'uuid' => 'The :attribute must be a valid UUID.',
 
     '2fareq' => 'Second factor code is required.',
     '2fainvalid' => 'Second factor code is invalid.',
     'emailinvalid' => 'The specified email address is invalid.',
     'domaininvalid' => 'The specified domain is invalid.',
     'domainnotavailable' => 'The specified domain is not available.',
     'logininvalid' => 'The specified login is invalid.',
     'loginexists' => 'The specified login is not available.',
     'domainexists' => 'The specified domain is not available.',
     'noemailorphone' => 'The specified text is neither a valid email address nor a phone number.',
     'packageinvalid' => 'Invalid package selected.',
     'packagerequired' => 'Package is required.',
     'usernotexists' => 'Unable to find user.',
     'voucherinvalid' => 'The voucher code is invalid or expired.',
     'noextemail' => 'This user has no external email address.',
     'entryinvalid' => 'The specified :attribute is invalid.',
     'entryexists' => 'The specified :attribute is not available.',
     'minamount' => 'Minimum amount for a single payment is :amount.',
     'minamountdebt' => 'The specified amount does not cover the balance on the account.',
     'notalocaluser' => 'The specified email address does not exist.',
     'memberislist' => 'A recipient cannot be the same as the list address.',
     'listmembersrequired' => 'At least one recipient is required.',
     'spf-entry-invalid' => 'The entry format is invalid. Expected a domain name starting with a dot.',
     'sp-entry-invalid' => 'The entry format is invalid. Expected an email, domain, or part of it.',
     'acl-entry-invalid' => 'The entry format is invalid. Expected an email address.',
     'ipolicy-invalid' => 'The specified invitation policy is invalid.',
     'invalid-config-parameter' => 'The requested configuration parameter is not supported.',
     'nameexists' => 'The specified name is not available.',
     'nameinvalid' => 'The specified name is invalid.',
     'password-policy-error' => 'Specified password does not comply with the policy.',
     'invalid-password-policy' => 'Specified password policy is invalid.',
     'password-policy-min-len-error' => 'Minimum password length cannot be less than :min.',
     'password-policy-max-len-error' => 'Maximum password length cannot be more than :max.',
+    'password-policy-last-error' => 'The minimum value for last N passwords is :last.',
 
     /*
     |--------------------------------------------------------------------------
     | Custom Validation Language Lines
     |--------------------------------------------------------------------------
     |
     | Here you may specify custom validation messages for attributes using the
     | convention "attribute.rule" to name the lines. This makes it quick to
     | specify a specific custom language line for a given attribute rule.
     |
     */
 
     'custom' => [
         'attribute-name' => [
             'rule-name' => 'custom-message',
         ],
     ],
 
     /*
     |--------------------------------------------------------------------------
     | Custom Validation Attributes
     |--------------------------------------------------------------------------
     |
     | The following language lines are used to swap our attribute placeholder
     | with something more reader friendly such as "E-Mail Address" instead
     | of "email". This simply helps us make our message more expressive.
     |
     */
 
     'attributes' => [],
 ];
diff --git a/src/resources/vue/Settings.vue b/src/resources/vue/Settings.vue
index 37123fe6..acdec061 100644
--- a/src/resources/vue/Settings.vue
+++ b/src/resources/vue/Settings.vue
@@ -1,79 +1,93 @@
 <template>
     <div class="container">
         <div class="card" id="settings">
             <div class="card-body">
                 <div class="card-title">
                     {{ $t('dashboard.settings') }}
                 </div>
                 <div class="card-text">
                     <form @submit.prevent="submit">
                         <div class="row mb-3">
                             <label class="col-sm-4 col-form-label">{{ $t('user.passwordpolicy') }}</label>
                             <div class="col-sm-8">
                                 <ul id="password_policy" class="list-group ms-1 mt-1">
                                     <li v-for="rule in passwordPolicy" :key="rule.label" class="list-group-item border-0 form-check pt-1 pb-1">
                                         <input type="checkbox" class="form-check-input" :id="'policy-' + rule.label" :name="rule.label" :checked="rule.enabled">
-                                        <label :for="'policy-' + rule.label" class="form-check-label pe-2">{{ rule.name.split(':')[0] }}</label>
+                                        <span v-if="rule.label == 'last'" v-html="ruleLastHTML(rule)"></span>
+                                        <label v-else :for="'policy-' + rule.label" class="form-check-label pe-2">{{ rule.name.split(':')[0] }}</label>
                                         <input type="text" class="form-control form-control-sm w-auto d-inline" v-if="['min', 'max'].includes(rule.label)" :value="rule.param" size="3">
                                     </li>
                                 </ul>
                             </div>
                         </div>
                         <btn class="btn-primary" type="submit" icon="check">{{ $t('btn.submit') }}</btn>
                     </form>
                 </div>
             </div>
         </div>
     </div>
 </template>
 
 <script>
     export default {
         data() {
             return {
                 passwordPolicy: []
             }
         },
         created() {
             this.wallet = this.$store.state.authInfo.wallet
         },
         mounted() {
             this.$root.startLoading()
 
             axios.get('/api/v4/password-policy')
                 .then(response => {
                     this.$root.stopLoading()
 
                     if (response.data.list) {
                         this.passwordPolicy = response.data.list
                     }
                 })
                 .catch(this.$root.errorHandler)
         },
         methods: {
+            ruleLastHTML(rule) {
+                let parts = rule.name.split(/[0-9]+/)
+                let options = [1, 2, 3, 4, 5, 6]
+
+                options = options.map(num => {
+                    let selected = num == rule.param ? ' selected' : ''
+                    return `<option value="${num}"${selected}>${num}</option>`
+                })
+
+                return `<label for="policy-last" class="form-check-label pe-2">
+                    ${parts[0]} <select class="form-select form-select-sm d-inline w-auto">${options.join('')}</select> ${parts[1]}
+                    </label>`
+            },
             submit() {
                 this.$root.clearFormValidation($('#settings form'))
 
                 let password_policy = [];
 
                 $('#password_policy > li > input:checked').each((i, element) => {
                     let entry = element.name
-                    const input = $(element.parentNode).find('input[type=text]')[0]
+                    let param = $(element.parentNode).find('select,input[type=text]').val()
 
-                    if (input) {
-                        entry += ':' + input.value
+                    if (param) {
+                        entry += ':' + param
                     }
 
                     password_policy.push(entry)
                 })
 
                 let post = { password_policy: password_policy.join(',') }
 
                 axios.post('/api/v4/users/' + this.wallet.user_id + '/config', post)
                     .then(response => {
                         this.$toast.success(response.data.message)
                     })
             },
         }
     }
 </script>
diff --git a/src/tests/Browser/SettingsTest.php b/src/tests/Browser/SettingsTest.php
index f77b3259..0ff830b0 100644
--- a/src/tests/Browser/SettingsTest.php
+++ b/src/tests/Browser/SettingsTest.php
@@ -1,100 +1,105 @@
 <?php
 
 namespace Tests\Browser;
 
 use Tests\Browser;
 use Tests\Browser\Components\Menu;
 use Tests\Browser\Components\Toast;
 use Tests\Browser\Pages\Dashboard;
 use Tests\Browser\Pages\Home;
 use Tests\Browser\Pages\Settings;
 use Tests\TestCaseDusk;
 
 class SettingsTest extends TestCaseDusk
 {
     /**
      * Test settings page (unauthenticated)
      */
     public function testSettingsUnauth(): void
     {
         // Test that the page requires authentication
         $this->browse(function (Browser $browser) {
             $browser->visit('/settings')->on(new Home());
         });
     }
 
     /**
      * Test settings "box" on Dashboard
      */
     public function testDashboard(): void
     {
         $this->browse(function (Browser $browser) {
             // Test a user that is not an account owner
             $browser->visit(new Home())
                 ->submitLogon('jack@kolab.org', 'simple123', true)
                 ->on(new Dashboard())
                 ->assertMissing('@links .link-settings .name')
                 ->visit('/settings')
                 ->assertErrorPage(403)
                 ->within(new Menu(), function (Browser $browser) {
                     $browser->clickMenuItem('logout');
                 });
 
             // Test the account owner
             $browser->waitForLocation('/login')
                 ->on(new Home())
                 ->submitLogon('john@kolab.org', 'simple123', true)
                 ->on(new Dashboard())
                 ->assertSeeIn('@links .link-settings .name', 'Settings');
         });
     }
 
     /**
      * Test Settings page
      *
      * @depends testDashboard
      */
     public function testSettings(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $john->setSetting('password_policy', 'min:5,max:100,lower');
 
         $this->browse(function (Browser $browser) {
             $browser->click('@links .link-settings')
                 ->on(new Settings())
                 ->assertSeeIn('#settings .card-title', 'Settings')
                 // Password policy
                 ->assertSeeIn('@form .row:nth-child(1) > label', 'Password Policy')
                 ->with('@form #password_policy', function (Browser $browser) {
-                    $browser->assertElementsCount('li', 6)
+                    $browser->assertElementsCount('li', 7)
                         ->assertSeeIn('li:nth-child(1) label', 'Minimum password length')
                         ->assertChecked('li:nth-child(1) input[type=checkbox]')
                         ->assertValue('li:nth-child(1) input[type=text]', '5')
                         ->assertSeeIn('li:nth-child(2) label', 'Maximum password length')
                         ->assertChecked('li:nth-child(2) input[type=checkbox]')
                         ->assertValue('li:nth-child(2) input[type=text]', '100')
                         ->assertSeeIn('li:nth-child(3) label', 'Password contains a lower-case character')
                         ->assertChecked('li:nth-child(3) input[type=checkbox]')
                         ->assertMissing('li:nth-child(3) input[type=text]')
                         ->assertSeeIn('li:nth-child(4) label', 'Password contains an upper-case character')
                         ->assertNotChecked('li:nth-child(4) input[type=checkbox]')
                         ->assertMissing('li:nth-child(4) input[type=text]')
                         ->assertSeeIn('li:nth-child(5) label', 'Password contains a digit')
                         ->assertNotChecked('li:nth-child(5) input[type=checkbox]')
                         ->assertMissing('li:nth-child(5) input[type=text]')
                         ->assertSeeIn('li:nth-child(6) label', 'Password contains a special character')
                         ->assertNotChecked('li:nth-child(6) input[type=checkbox]')
                         ->assertMissing('li:nth-child(6) input[type=text]')
+                        ->assertSeeIn('li:nth-child(7) label', 'Password cannot be the same as the last')
+                        ->assertNotChecked('li:nth-child(7) input[type=checkbox]')
+                        ->assertMissing('li:nth-child(7) input[type=text]')
+                        ->assertSelected('li:nth-child(7) select', 3)
+                        ->assertSelectHasOptions('li:nth-child(7) select', [1,2,3,4,5,6])
                         // Change the policy
                         ->type('li:nth-child(1) input[type=text]', '11')
                         ->type('li:nth-child(2) input[type=text]', '120')
                         ->click('li:nth-child(3) input[type=checkbox]')
                         ->click('li:nth-child(4) input[type=checkbox]');
                 })
                 ->click('button[type=submit]')
                 ->assertToast(Toast::TYPE_SUCCESS, 'User settings updated successfully.');
         });
 
         $this->assertSame('min:11,max:120,upper', $john->getSetting('password_policy'));
     }
 }
diff --git a/src/tests/Feature/Controller/PasswordPolicyTest.php b/src/tests/Feature/Controller/PasswordPolicyTest.php
index 80dce63a..9c62a898 100644
--- a/src/tests/Feature/Controller/PasswordPolicyTest.php
+++ b/src/tests/Feature/Controller/PasswordPolicyTest.php
@@ -1,133 +1,137 @@
 <?php
 
 namespace Tests\Feature\Controller;
 
 use Tests\TestCase;
 
 class PasswordPolicyTest extends TestCase
 {
     /**
      * Test password policy check
      */
     public function testCheck(): void
     {
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $john->setSetting('password_policy', 'min:8,max:100,upper,digit');
 
         // Empty password
         $post = ['user' => $john->id];
         $response = $this->post('/api/auth/password-policy/check', $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(3, $json);
         $this->assertSame('error', $json['status']);
         $this->assertSame(4, $json['count']);
         $this->assertFalse($json['list'][0]['status']);
         $this->assertSame('min', $json['list'][0]['label']);
         $this->assertFalse($json['list'][1]['status']);
         $this->assertSame('max', $json['list'][1]['label']);
         $this->assertFalse($json['list'][2]['status']);
         $this->assertSame('upper', $json['list'][2]['label']);
         $this->assertFalse($json['list'][3]['status']);
         $this->assertSame('digit', $json['list'][3]['label']);
 
         // Test acting as Jack, password non-compliant
         $post = ['password' => '9999999', 'user' => $jack->id];
         $response = $this->post('/api/auth/password-policy/check', $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(3, $json);
         $this->assertSame('error', $json['status']);
         $this->assertSame(4, $json['count']);
         $this->assertFalse($json['list'][0]['status']); // min
         $this->assertTrue($json['list'][1]['status']); // max
         $this->assertFalse($json['list'][2]['status']); // upper
         $this->assertTrue($json['list'][3]['status']); // digit
 
         // Test with no user context, expect use of the default policy
         $post = ['password' => '9'];
         $response = $this->post('/api/auth/password-policy/check', $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(3, $json);
         $this->assertSame('error', $json['status']);
         $this->assertSame(2, $json['count']);
         $this->assertFalse($json['list'][0]['status']);
         $this->assertSame('min', $json['list'][0]['label']);
         $this->assertTrue($json['list'][1]['status']);
         $this->assertSame('max', $json['list'][1]['label']);
     }
 
     /**
      * Test password-policy listing
      */
     public function testIndex(): void
     {
         // Unauth access not allowed
         $response = $this->get('/api/v4/password-policy');
         $response->assertStatus(401);
 
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $john->setSetting('password_policy', 'min:8,max:255,special');
 
         // Get available policy rules
         $response = $this->actingAs($john)->get('/api/v4/password-policy');
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertCount(2, $json);
-        $this->assertSame(6, $json['count']);
-        $this->assertCount(6, $json['list']);
+        $this->assertSame(7, $json['count']);
+        $this->assertCount(7, $json['list']);
         $this->assertSame('Minimum password length: 8 characters', $json['list'][0]['name']);
         $this->assertSame('min', $json['list'][0]['label']);
         $this->assertSame('8', $json['list'][0]['param']);
         $this->assertSame(true, $json['list'][0]['enabled']);
         $this->assertSame('Maximum password length: 255 characters', $json['list'][1]['name']);
         $this->assertSame('max', $json['list'][1]['label']);
         $this->assertSame('255', $json['list'][1]['param']);
         $this->assertSame(true, $json['list'][1]['enabled']);
         $this->assertSame('lower', $json['list'][2]['label']);
         $this->assertSame(false, $json['list'][2]['enabled']);
         $this->assertSame('upper', $json['list'][3]['label']);
         $this->assertSame(false, $json['list'][3]['enabled']);
         $this->assertSame('digit', $json['list'][4]['label']);
         $this->assertSame(false, $json['list'][4]['enabled']);
         $this->assertSame('special', $json['list'][5]['label']);
         $this->assertSame(true, $json['list'][5]['enabled']);
+        $this->assertSame('last', $json['list'][6]['label']);
+        $this->assertSame(false, $json['list'][6]['enabled']);
 
         // Test acting as Jack
         $response = $this->actingAs($jack)->get('/api/v4/password-policy');
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertCount(2, $json);
-        $this->assertSame(6, $json['count']);
-        $this->assertCount(6, $json['list']);
+        $this->assertSame(7, $json['count']);
+        $this->assertCount(7, $json['list']);
         $this->assertSame('Minimum password length: 8 characters', $json['list'][0]['name']);
         $this->assertSame('min', $json['list'][0]['label']);
         $this->assertSame('8', $json['list'][0]['param']);
         $this->assertSame(true, $json['list'][0]['enabled']);
         $this->assertSame('Maximum password length: 255 characters', $json['list'][1]['name']);
         $this->assertSame('max', $json['list'][1]['label']);
         $this->assertSame('255', $json['list'][1]['param']);
         $this->assertSame(true, $json['list'][1]['enabled']);
         $this->assertSame('lower', $json['list'][2]['label']);
         $this->assertSame(false, $json['list'][2]['enabled']);
         $this->assertSame('upper', $json['list'][3]['label']);
         $this->assertSame(false, $json['list'][3]['enabled']);
         $this->assertSame('digit', $json['list'][4]['label']);
         $this->assertSame(false, $json['list'][4]['enabled']);
         $this->assertSame('special', $json['list'][5]['label']);
         $this->assertSame(true, $json['list'][5]['enabled']);
+        $this->assertSame('last', $json['list'][6]['label']);
+        $this->assertSame(false, $json['list'][6]['enabled']);
     }
 }
diff --git a/src/tests/Feature/Controller/UsersTest.php b/src/tests/Feature/Controller/UsersTest.php
index 207e4f9e..d3f28b15 100644
--- a/src/tests/Feature/Controller/UsersTest.php
+++ b/src/tests/Feature/Controller/UsersTest.php
@@ -1,1487 +1,1487 @@
 <?php
 
 namespace Tests\Feature\Controller;
 
 use App\Discount;
 use App\Domain;
 use App\Http\Controllers\API\V4\UsersController;
 use App\Package;
 use App\Sku;
 use App\User;
 use App\Wallet;
 use Carbon\Carbon;
 use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Str;
 use Tests\TestCase;
 
 class UsersTest extends TestCase
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('jane@kolabnow.com');
         $this->deleteTestUser('UsersControllerTest1@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest2@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest3@userscontroller.com');
         $this->deleteTestUser('UserEntitlement2A@UserEntitlement.com');
         $this->deleteTestUser('john2.doe2@kolab.org');
         $this->deleteTestUser('deleted@kolab.org');
         $this->deleteTestUser('deleted@kolabnow.com');
         $this->deleteTestDomain('userscontroller.com');
         $this->deleteTestGroup('group-test@kolabnow.com');
         $this->deleteTestGroup('group-test@kolab.org');
 
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
         $wallet->discount()->dissociate();
         $wallet->settings()->whereIn('key', ['mollie_id', 'stripe_id'])->delete();
         $wallet->save();
         $user->status |= User::STATUS_IMAP_READY;
         $user->save();
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser('jane@kolabnow.com');
         $this->deleteTestUser('UsersControllerTest1@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest2@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest3@userscontroller.com');
         $this->deleteTestUser('UserEntitlement2A@UserEntitlement.com');
         $this->deleteTestUser('john2.doe2@kolab.org');
         $this->deleteTestUser('deleted@kolab.org');
         $this->deleteTestUser('deleted@kolabnow.com');
         $this->deleteTestDomain('userscontroller.com');
         $this->deleteTestGroup('group-test@kolabnow.com');
         $this->deleteTestGroup('group-test@kolab.org');
 
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
         $wallet->discount()->dissociate();
         $wallet->settings()->whereIn('key', ['mollie_id', 'stripe_id'])->delete();
         $wallet->save();
         $user->settings()->whereIn('key', ['greylist_enabled'])->delete();
         $user->status |= User::STATUS_IMAP_READY;
         $user->save();
 
         parent::tearDown();
     }
 
     /**
      * Test user deleting (DELETE /api/v4/users/<id>)
      */
     public function testDestroy(): void
     {
         // First create some users/accounts to delete
         $package_kolab = \App\Package::where('title', 'kolab')->first();
         $package_domain = \App\Package::where('title', 'domain-hosting')->first();
 
         $john = $this->getTestUser('john@kolab.org');
         $user1 = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $user2 = $this->getTestUser('UsersControllerTest2@userscontroller.com');
         $user3 = $this->getTestUser('UsersControllerTest3@userscontroller.com');
         $domain = $this->getTestDomain('userscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
         $user1->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $user1);
         $user1->assignPackage($package_kolab, $user2);
         $user1->assignPackage($package_kolab, $user3);
 
         // Test unauth access
         $response = $this->delete("api/v4/users/{$user2->id}");
         $response->assertStatus(401);
 
         // Test access to other user/account
         $response = $this->actingAs($john)->delete("api/v4/users/{$user2->id}");
         $response->assertStatus(403);
         $response = $this->actingAs($john)->delete("api/v4/users/{$user1->id}");
         $response->assertStatus(403);
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Access denied", $json['message']);
         $this->assertCount(2, $json);
 
         // Test that non-controller cannot remove himself
         $response = $this->actingAs($user3)->delete("api/v4/users/{$user3->id}");
         $response->assertStatus(403);
 
         // Test removing a non-controller user
         $response = $this->actingAs($user1)->delete("api/v4/users/{$user3->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals('success', $json['status']);
         $this->assertEquals('User deleted successfully.', $json['message']);
 
         // Test removing self (an account with users)
         $response = $this->actingAs($user1)->delete("api/v4/users/{$user1->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals('success', $json['status']);
         $this->assertEquals('User deleted successfully.', $json['message']);
     }
 
     /**
      * Test user deleting (DELETE /api/v4/users/<id>)
      */
     public function testDestroyByController(): void
     {
         // Create an account with additional controller - $user2
         $package_kolab = \App\Package::where('title', 'kolab')->first();
         $package_domain = \App\Package::where('title', 'domain-hosting')->first();
         $user1 = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $user2 = $this->getTestUser('UsersControllerTest2@userscontroller.com');
         $user3 = $this->getTestUser('UsersControllerTest3@userscontroller.com');
         $domain = $this->getTestDomain('userscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
         $user1->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $user1);
         $user1->assignPackage($package_kolab, $user2);
         $user1->assignPackage($package_kolab, $user3);
         $user1->wallets()->first()->addController($user2);
 
         // TODO/FIXME:
         //   For now controller can delete himself, as well as
         //   the whole account he has control to, including the owner
         //   Probably he should not be able to do none of those
         //   However, this is not 0-regression scenario as we
         //   do not fully support additional controllers.
 
         //$response = $this->actingAs($user2)->delete("api/v4/users/{$user2->id}");
         //$response->assertStatus(403);
 
         $response = $this->actingAs($user2)->delete("api/v4/users/{$user3->id}");
         $response->assertStatus(200);
 
         $response = $this->actingAs($user2)->delete("api/v4/users/{$user1->id}");
         $response->assertStatus(200);
 
         // Note: More detailed assertions in testDestroy() above
 
         $this->assertTrue($user1->fresh()->trashed());
         $this->assertTrue($user2->fresh()->trashed());
         $this->assertTrue($user3->fresh()->trashed());
     }
 
     /**
      * Test user listing (GET /api/v4/users)
      */
     public function testIndex(): void
     {
         // Test unauth access
         $response = $this->get("api/v4/users");
         $response->assertStatus(401);
 
         $jack = $this->getTestUser('jack@kolab.org');
         $joe = $this->getTestUser('joe@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         $response = $this->actingAs($jack)->get("/api/v4/users");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(0, $json['count']);
         $this->assertCount(0, $json['list']);
 
         $response = $this->actingAs($john)->get("/api/v4/users");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(4, $json['count']);
         $this->assertCount(4, $json['list']);
         $this->assertSame($jack->email, $json['list'][0]['email']);
         $this->assertSame($joe->email, $json['list'][1]['email']);
         $this->assertSame($john->email, $json['list'][2]['email']);
         $this->assertSame($ned->email, $json['list'][3]['email']);
         // Values below are tested by Unit tests
         $this->assertArrayHasKey('isDeleted', $json['list'][0]);
         $this->assertArrayHasKey('isDegraded', $json['list'][0]);
         $this->assertArrayHasKey('isAccountDegraded', $json['list'][0]);
         $this->assertArrayHasKey('isSuspended', $json['list'][0]);
         $this->assertArrayHasKey('isActive', $json['list'][0]);
         $this->assertArrayHasKey('isLdapReady', $json['list'][0]);
         $this->assertArrayHasKey('isImapReady', $json['list'][0]);
 
         $response = $this->actingAs($ned)->get("/api/v4/users");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(4, $json['count']);
         $this->assertCount(4, $json['list']);
         $this->assertSame($jack->email, $json['list'][0]['email']);
         $this->assertSame($joe->email, $json['list'][1]['email']);
         $this->assertSame($john->email, $json['list'][2]['email']);
         $this->assertSame($ned->email, $json['list'][3]['email']);
 
         // Search by user email
         $response = $this->actingAs($john)->get("/api/v4/users?search=jack@k");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(1, $json['count']);
         $this->assertCount(1, $json['list']);
         $this->assertSame($jack->email, $json['list'][0]['email']);
 
         // Search by alias
         $response = $this->actingAs($john)->get("/api/v4/users?search=monster");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(1, $json['count']);
         $this->assertCount(1, $json['list']);
         $this->assertSame($joe->email, $json['list'][0]['email']);
 
         // Search by name
         $response = $this->actingAs($john)->get("/api/v4/users?search=land");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(1, $json['count']);
         $this->assertCount(1, $json['list']);
         $this->assertSame($ned->email, $json['list'][0]['email']);
 
         // TODO: Test paging
     }
 
     /**
      * Test fetching user data/profile (GET /api/v4/users/<user-id>)
      */
     public function testShow(): void
     {
         $userA = $this->getTestUser('UserEntitlement2A@UserEntitlement.com');
 
         // Test getting profile of self
         $response = $this->actingAs($userA)->get("/api/v4/users/{$userA->id}");
 
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertEquals($userA->id, $json['id']);
         $this->assertEquals($userA->email, $json['email']);
         $this->assertTrue(is_array($json['statusInfo']));
         $this->assertTrue(is_array($json['settings']));
         $this->assertTrue(is_array($json['aliases']));
         $this->assertTrue($json['config']['greylist_enabled']);
         $this->assertSame([], $json['skus']);
         // Values below are tested by Unit tests
         $this->assertArrayHasKey('isDeleted', $json);
         $this->assertArrayHasKey('isDegraded', $json);
         $this->assertArrayHasKey('isAccountDegraded', $json);
         $this->assertArrayHasKey('isSuspended', $json);
         $this->assertArrayHasKey('isActive', $json);
         $this->assertArrayHasKey('isLdapReady', $json);
         $this->assertArrayHasKey('isImapReady', $json);
 
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         // Test unauthorized access to a profile of other user
         $response = $this->actingAs($jack)->get("/api/v4/users/{$userA->id}");
         $response->assertStatus(403);
 
         // Test authorized access to a profile of other user
         // Ned: Additional account controller
         $response = $this->actingAs($ned)->get("/api/v4/users/{$john->id}");
         $response->assertStatus(200);
         $response = $this->actingAs($ned)->get("/api/v4/users/{$jack->id}");
         $response->assertStatus(200);
 
         // John: Account owner
         $response = $this->actingAs($john)->get("/api/v4/users/{$jack->id}");
         $response->assertStatus(200);
         $response = $this->actingAs($john)->get("/api/v4/users/{$ned->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $storage_sku = Sku::withEnvTenantContext()->where('title', 'storage')->first();
         $groupware_sku = Sku::withEnvTenantContext()->where('title', 'groupware')->first();
         $mailbox_sku = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();
         $secondfactor_sku = Sku::withEnvTenantContext()->where('title', '2fa')->first();
 
         $this->assertCount(5, $json['skus']);
 
         $this->assertSame(5, $json['skus'][$storage_sku->id]['count']);
         $this->assertSame([0,0,0,0,0], $json['skus'][$storage_sku->id]['costs']);
         $this->assertSame(1, $json['skus'][$groupware_sku->id]['count']);
         $this->assertSame([490], $json['skus'][$groupware_sku->id]['costs']);
         $this->assertSame(1, $json['skus'][$mailbox_sku->id]['count']);
         $this->assertSame([500], $json['skus'][$mailbox_sku->id]['costs']);
         $this->assertSame(1, $json['skus'][$secondfactor_sku->id]['count']);
         $this->assertSame([0], $json['skus'][$secondfactor_sku->id]['costs']);
     }
 
     /**
      * Test fetching user status (GET /api/v4/users/<user-id>/status)
      * and forcing setup process update (?refresh=1)
      *
      * @group imap
      * @group dns
      */
     public function testStatus(): void
     {
         Queue::fake();
 
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
 
         // Test unauthorized access
         $response = $this->actingAs($jack)->get("/api/v4/users/{$john->id}/status");
         $response->assertStatus(403);
 
         if ($john->isImapReady()) {
             $john->status ^= User::STATUS_IMAP_READY;
             $john->save();
         }
 
         // Get user status
         $response = $this->actingAs($john)->get("/api/v4/users/{$john->id}/status");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertFalse($json['isImapReady']);
         $this->assertFalse($json['isReady']);
         $this->assertCount(7, $json['process']);
         $this->assertSame('user-imap-ready', $json['process'][2]['label']);
         $this->assertSame(false, $json['process'][2]['state']);
         $this->assertTrue(empty($json['status']));
         $this->assertTrue(empty($json['message']));
 
         // Make sure the domain is confirmed (other test might unset that status)
         $domain = $this->getTestDomain('kolab.org');
         $domain->status |= Domain::STATUS_CONFIRMED;
         $domain->save();
 
         // Now "reboot" the process and verify the user in imap synchronously
         $response = $this->actingAs($john)->get("/api/v4/users/{$john->id}/status?refresh=1");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertTrue($json['isImapReady']);
         $this->assertTrue($json['isReady']);
         $this->assertCount(7, $json['process']);
         $this->assertSame('user-imap-ready', $json['process'][2]['label']);
         $this->assertSame(true, $json['process'][2]['state']);
         $this->assertSame('success', $json['status']);
         $this->assertSame('Setup process finished successfully.', $json['message']);
 
         Queue::size(1);
 
         // Test case for when the verify job is dispatched to the worker
         $john->refresh();
         $john->status ^= User::STATUS_IMAP_READY;
         $john->save();
 
         \config(['imap.admin_password' => null]);
 
         $response = $this->actingAs($john)->get("/api/v4/users/{$john->id}/status?refresh=1");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertFalse($json['isImapReady']);
         $this->assertFalse($json['isReady']);
         $this->assertSame('success', $json['status']);
         $this->assertSame('waiting', $json['processState']);
         $this->assertSame('Setup process has been pushed. Please wait.', $json['message']);
 
         Queue::assertPushed(\App\Jobs\User\VerifyJob::class, 1);
     }
 
     /**
      * Test UsersController::statusInfo()
      */
     public function testStatusInfo(): void
     {
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $domain = $this->getTestDomain('userscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
 
         $user->created_at = Carbon::now();
         $user->status = User::STATUS_NEW;
         $user->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertFalse($result['isReady']);
         $this->assertSame([], $result['skus']);
         $this->assertCount(3, $result['process']);
         $this->assertSame('user-new', $result['process'][0]['label']);
         $this->assertSame(true, $result['process'][0]['state']);
         $this->assertSame('user-ldap-ready', $result['process'][1]['label']);
         $this->assertSame(false, $result['process'][1]['state']);
         $this->assertSame('user-imap-ready', $result['process'][2]['label']);
         $this->assertSame(false, $result['process'][2]['state']);
         $this->assertSame('running', $result['processState']);
 
         $user->created_at = Carbon::now()->subSeconds(181);
         $user->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertSame('failed', $result['processState']);
 
         $user->status |= User::STATUS_LDAP_READY | User::STATUS_IMAP_READY;
         $user->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertTrue($result['isReady']);
         $this->assertCount(3, $result['process']);
         $this->assertSame('user-new', $result['process'][0]['label']);
         $this->assertSame(true, $result['process'][0]['state']);
         $this->assertSame('user-ldap-ready', $result['process'][1]['label']);
         $this->assertSame(true, $result['process'][1]['state']);
         $this->assertSame('user-imap-ready', $result['process'][2]['label']);
         $this->assertSame(true, $result['process'][2]['state']);
         $this->assertSame('done', $result['processState']);
 
         $domain->status |= Domain::STATUS_VERIFIED;
         $domain->type = Domain::TYPE_EXTERNAL;
         $domain->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertFalse($result['isReady']);
         $this->assertSame([], $result['skus']);
         $this->assertCount(7, $result['process']);
         $this->assertSame('user-new', $result['process'][0]['label']);
         $this->assertSame(true, $result['process'][0]['state']);
         $this->assertSame('user-ldap-ready', $result['process'][1]['label']);
         $this->assertSame(true, $result['process'][1]['state']);
         $this->assertSame('user-imap-ready', $result['process'][2]['label']);
         $this->assertSame(true, $result['process'][2]['state']);
         $this->assertSame('domain-new', $result['process'][3]['label']);
         $this->assertSame(true, $result['process'][3]['state']);
         $this->assertSame('domain-ldap-ready', $result['process'][4]['label']);
         $this->assertSame(false, $result['process'][4]['state']);
         $this->assertSame('domain-verified', $result['process'][5]['label']);
         $this->assertSame(true, $result['process'][5]['state']);
         $this->assertSame('domain-confirmed', $result['process'][6]['label']);
         $this->assertSame(false, $result['process'][6]['state']);
 
         // Test 'skus' property
         $user->assignSku(Sku::withEnvTenantContext()->where('title', 'beta')->first());
 
         $result = UsersController::statusInfo($user);
 
         $this->assertSame(['beta'], $result['skus']);
 
         $user->assignSku(Sku::withEnvTenantContext()->where('title', 'meet')->first());
 
         $result = UsersController::statusInfo($user);
 
         $this->assertSame(['beta', 'meet'], $result['skus']);
 
         $user->assignSku(Sku::withEnvTenantContext()->where('title', 'meet')->first());
 
         $result = UsersController::statusInfo($user);
 
         $this->assertSame(['beta', 'meet'], $result['skus']);
     }
 
     /**
      * Test user config update (POST /api/v4/users/<user>/config)
      */
     public function testSetConfig(): void
     {
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
 
         $john->setSetting('greylist_enabled', null);
         $john->setSetting('password_policy', null);
 
         // Test unknown user id
         $post = ['greylist_enabled' => 1];
         $response = $this->actingAs($john)->post("/api/v4/users/123/config", $post);
         $json = $response->json();
 
         $response->assertStatus(404);
 
         // Test access by user not being a wallet controller
         $post = ['greylist_enabled' => 1];
         $response = $this->actingAs($jack)->post("/api/v4/users/{$john->id}/config", $post);
         $json = $response->json();
 
         $response->assertStatus(403);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Access denied", $json['message']);
         $this->assertCount(2, $json);
 
         // Test some invalid data
         $post = ['grey' => 1, 'password_policy' => 'min:1'];
         $response = $this->actingAs($john)->post("/api/v4/users/{$john->id}/config", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertCount(2, $json['errors']);
         $this->assertSame("The requested configuration parameter is not supported.", $json['errors']['grey']);
         $this->assertSame("Minimum password length cannot be less than 6.", $json['errors']['password_policy']);
 
         $this->assertNull($john->fresh()->getSetting('greylist_enabled'));
 
         // Test some valid data
         $post = ['greylist_enabled' => 1, 'password_policy' => 'min:10,max:255,upper,lower,digit,special'];
         $response = $this->actingAs($john)->post("/api/v4/users/{$john->id}/config", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(2, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame('User settings updated successfully.', $json['message']);
 
         $this->assertSame('true', $john->fresh()->getSetting('greylist_enabled'));
         $this->assertSame('min:10,max:255,upper,lower,digit,special', $john->fresh()->getSetting('password_policy'));
 
         // Test some valid data, acting as another account controller
         $ned = $this->getTestUser('ned@kolab.org');
-        $post = ['greylist_enabled' => 0, 'password_policy' => 'min:10,max:255,upper'];
+        $post = ['greylist_enabled' => 0, 'password_policy' => 'min:10,max:255,upper,last:1'];
         $response = $this->actingAs($ned)->post("/api/v4/users/{$john->id}/config", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(2, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame('User settings updated successfully.', $json['message']);
 
         $this->assertSame('false', $john->fresh()->getSetting('greylist_enabled'));
-        $this->assertSame('min:10,max:255,upper', $john->fresh()->getSetting('password_policy'));
+        $this->assertSame('min:10,max:255,upper,last:1', $john->fresh()->getSetting('password_policy'));
     }
 
     /**
      * Test user creation (POST /api/v4/users)
      */
     public function testStore(): void
     {
         Queue::fake();
 
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $john->setSetting('password_policy', 'min:8,max:100,digit');
         $deleted_priv = $this->getTestUser('deleted@kolab.org');
         $deleted_priv->delete();
 
         // Test empty request
         $response = $this->actingAs($john)->post("/api/v4/users", []);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("The email field is required.", $json['errors']['email']);
         $this->assertSame("The password field is required.", $json['errors']['password'][0]);
         $this->assertCount(2, $json);
 
         // Test access by user not being a wallet controller
         $post = ['first_name' => 'Test'];
         $response = $this->actingAs($jack)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(403);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Access denied", $json['message']);
         $this->assertCount(2, $json);
 
         // Test some invalid data
         $post = ['password' => '12345678', 'email' => 'invalid'];
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertSame('The password confirmation does not match.', $json['errors']['password'][0]);
         $this->assertSame('The specified email is invalid.', $json['errors']['email']);
 
         // Test existing user email
         $post = [
             'password' => 'simple123',
             'password_confirmation' => 'simple123',
             'first_name' => 'John2',
             'last_name' => 'Doe2',
             'email' => 'jack.daniels@kolab.org',
         ];
 
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertSame('The specified email is not available.', $json['errors']['email']);
 
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
 
         $post = [
             'password' => 'simple123',
             'password_confirmation' => 'simple123',
             'first_name' => 'John2',
             'last_name' => 'Doe2',
             'email' => 'john2.doe2@kolab.org',
             'organization' => 'TestOrg',
             'aliases' => ['useralias1@kolab.org', 'deleted@kolab.org'],
         ];
 
         // Missing package
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Package is required.", $json['errors']['package']);
         $this->assertCount(2, $json);
 
         // Invalid package
         $post['package'] = $package_domain->id;
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Invalid package selected.", $json['errors']['package']);
         $this->assertCount(2, $json);
 
         // Test password policy checking
         $post['package'] = $package_kolab->id;
         $post['password'] = 'password';
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("The password confirmation does not match.", $json['errors']['password'][0]);
         $this->assertSame("Specified password does not comply with the policy.", $json['errors']['password'][1]);
         $this->assertCount(2, $json);
 
         // Test password confirmation
         $post['password_confirmation'] = 'password';
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Specified password does not comply with the policy.", $json['errors']['password'][0]);
         $this->assertCount(2, $json);
 
         // Test full and valid data
         $post['password'] = 'password123';
         $post['password_confirmation'] = 'password123';
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User created successfully.", $json['message']);
         $this->assertCount(2, $json);
 
         $user = User::where('email', 'john2.doe2@kolab.org')->first();
         $this->assertInstanceOf(User::class, $user);
         $this->assertSame('John2', $user->getSetting('first_name'));
         $this->assertSame('Doe2', $user->getSetting('last_name'));
         $this->assertSame('TestOrg', $user->getSetting('organization'));
         $aliases = $user->aliases()->orderBy('alias')->get();
         $this->assertCount(2, $aliases);
         $this->assertSame('deleted@kolab.org', $aliases[0]->alias);
         $this->assertSame('useralias1@kolab.org', $aliases[1]->alias);
         // Assert the new user entitlements
         $this->assertEntitlements($user, ['groupware', 'mailbox',
             'storage', 'storage', 'storage', 'storage', 'storage']);
         // Assert the wallet to which the new user should be assigned to
         $wallet = $user->wallet();
         $this->assertSame($john->wallets->first()->id, $wallet->id);
 
         // Attempt to create a user previously deleted
         $user->delete();
 
         $post['package'] = $package_kolab->id;
         $post['aliases'] = [];
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User created successfully.", $json['message']);
         $this->assertCount(2, $json);
 
         $user = User::where('email', 'john2.doe2@kolab.org')->first();
         $this->assertInstanceOf(User::class, $user);
         $this->assertSame('John2', $user->getSetting('first_name'));
         $this->assertSame('Doe2', $user->getSetting('last_name'));
         $this->assertSame('TestOrg', $user->getSetting('organization'));
         $this->assertCount(0, $user->aliases()->get());
         $this->assertEntitlements($user, ['groupware', 'mailbox',
             'storage', 'storage', 'storage', 'storage', 'storage']);
 
         // Test password reset link "mode"
         $code = new \App\VerificationCode(['mode' => 'password-reset', 'active' => false]);
         $john->verificationcodes()->save($code);
 
         $post = [
             'first_name' => 'John2',
             'last_name' => 'Doe2',
             'email' => 'deleted@kolab.org',
             'organization' => '',
             'aliases' => [],
             'passwordLinkCode' => $code->short_code . '-' . $code->code,
             'package' => $package_kolab->id,
         ];
 
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User created successfully.", $json['message']);
         $this->assertCount(2, $json);
 
         $user = $this->getTestUser('deleted@kolab.org');
         $code->refresh();
 
         $this->assertSame($user->id, $code->user_id);
         $this->assertTrue($code->active);
         $this->assertTrue(is_string($user->password) && strlen($user->password) >= 60);
 
         // Test acting as account controller not owner, which is not yet supported
         $john->wallets->first()->addController($user);
 
         $response = $this->actingAs($user)->post("/api/v4/users", []);
         $response->assertStatus(403);
     }
 
     /**
      * Test user update (PUT /api/v4/users/<user-id>)
      */
     public function testUpdate(): void
     {
         $userA = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $userA->setSetting('password_policy', 'min:8,digit');
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $domain = $this->getTestDomain(
             'userscontroller.com',
             ['status' => Domain::STATUS_NEW, 'type' => Domain::TYPE_EXTERNAL]
         );
 
         // Test unauthorized update of other user profile
         $response = $this->actingAs($jack)->get("/api/v4/users/{$userA->id}", []);
         $response->assertStatus(403);
 
         // Test authorized update of account owner by account controller
         $response = $this->actingAs($ned)->get("/api/v4/users/{$john->id}", []);
         $response->assertStatus(200);
 
         // Test updating of self (empty request)
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", []);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User data updated successfully.", $json['message']);
         $this->assertTrue(!empty($json['statusInfo']));
         $this->assertCount(3, $json);
 
         // Test some invalid data
         $post = ['password' => '1234567', 'currency' => 'invalid'];
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertSame("The password confirmation does not match.", $json['errors']['password'][0]);
         $this->assertSame("Specified password does not comply with the policy.", $json['errors']['password'][1]);
         $this->assertSame("The currency must be 3 characters.", $json['errors']['currency'][0]);
 
         // Test full profile update including password
         $post = [
             'password' => 'simple123',
             'password_confirmation' => 'simple123',
             'first_name' => 'John2',
             'last_name' => 'Doe2',
             'organization' => 'TestOrg',
             'phone' => '+123 123 123',
             'external_email' => 'external@gmail.com',
             'billing_address' => 'billing',
             'country' => 'CH',
             'currency' => 'CHF',
             'aliases' => ['useralias1@' . \config('app.domain'), 'useralias2@' . \config('app.domain')]
         ];
 
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User data updated successfully.", $json['message']);
         $this->assertTrue(!empty($json['statusInfo']));
         $this->assertCount(3, $json);
         $this->assertTrue($userA->password != $userA->fresh()->password);
         unset($post['password'], $post['password_confirmation'], $post['aliases']);
         foreach ($post as $key => $value) {
             $this->assertSame($value, $userA->getSetting($key));
         }
         $aliases = $userA->aliases()->orderBy('alias')->get();
         $this->assertCount(2, $aliases);
         $this->assertSame('useralias1@' . \config('app.domain'), $aliases[0]->alias);
         $this->assertSame('useralias2@' . \config('app.domain'), $aliases[1]->alias);
 
         // Test unsetting values
         $post = [
             'first_name' => '',
             'last_name' => '',
             'organization' => '',
             'phone' => '',
             'external_email' => '',
             'billing_address' => '',
             'country' => '',
             'currency' => '',
             'aliases' => ['useralias2@' . \config('app.domain')]
         ];
 
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User data updated successfully.", $json['message']);
         $this->assertTrue(!empty($json['statusInfo']));
         $this->assertCount(3, $json);
         unset($post['aliases']);
         foreach ($post as $key => $value) {
             $this->assertNull($userA->getSetting($key));
         }
         $aliases = $userA->aliases()->get();
         $this->assertCount(1, $aliases);
         $this->assertSame('useralias2@' . \config('app.domain'), $aliases[0]->alias);
 
         // Test error on some invalid aliases missing password confirmation
         $post = [
             'password' => 'simple123',
             'aliases' => [
                 'useralias2@' . \config('app.domain'),
                 'useralias1@kolab.org',
                 '@kolab.org',
             ]
         ];
 
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertCount(2, $json['errors']['aliases']);
         $this->assertSame("The specified domain is not available.", $json['errors']['aliases'][1]);
         $this->assertSame("The specified alias is invalid.", $json['errors']['aliases'][2]);
         $this->assertSame("The password confirmation does not match.", $json['errors']['password'][0]);
 
         // Test authorized update of other user
         $response = $this->actingAs($ned)->put("/api/v4/users/{$jack->id}", []);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertTrue(empty($json['statusInfo']));
 
         // TODO: Test error on aliases with invalid/non-existing/other-user's domain
 
         // Create entitlements and additional user for following tests
         $owner = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $user = $this->getTestUser('UsersControllerTest2@userscontroller.com');
         $package_domain = Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $package_kolab = Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_lite = Package::withEnvTenantContext()->where('title', 'lite')->first();
         $sku_mailbox = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();
         $sku_storage = Sku::withEnvTenantContext()->where('title', 'storage')->first();
         $sku_groupware = Sku::withEnvTenantContext()->where('title', 'groupware')->first();
 
         $domain = $this->getTestDomain(
             'userscontroller.com',
             [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_EXTERNAL,
             ]
         );
 
         $domain->assignPackage($package_domain, $owner);
         $owner->assignPackage($package_kolab);
         $owner->assignPackage($package_lite, $user);
 
         // Non-controller cannot update his own entitlements
         $post = ['skus' => []];
         $response = $this->actingAs($user)->put("/api/v4/users/{$user->id}", $post);
         $response->assertStatus(422);
 
         // Test updating entitlements
         $post = [
             'skus' => [
                 $sku_mailbox->id => 1,
                 $sku_storage->id => 6,
                 $sku_groupware->id => 1,
             ],
         ];
 
         $response = $this->actingAs($owner)->put("/api/v4/users/{$user->id}", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $storage_cost = $user->entitlements()
             ->where('sku_id', $sku_storage->id)
             ->orderBy('cost')
             ->pluck('cost')->all();
 
         $this->assertEntitlements(
             $user,
             ['groupware', 'mailbox', 'storage', 'storage', 'storage', 'storage', 'storage', 'storage']
         );
 
         $this->assertSame([0, 0, 0, 0, 0, 25], $storage_cost);
         $this->assertTrue(empty($json['statusInfo']));
 
         // Test password reset link "mode"
         $code = new \App\VerificationCode(['mode' => 'password-reset', 'active' => false]);
         $owner->verificationcodes()->save($code);
 
         $post = ['passwordLinkCode' => $code->short_code . '-' . $code->code];
 
         $response = $this->actingAs($owner)->put("/api/v4/users/{$user->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $code->refresh();
 
         $this->assertSame($user->id, $code->user_id);
         $this->assertTrue($code->active);
         $this->assertSame($user->password, $user->fresh()->password);
     }
 
     /**
      * Test UsersController::updateEntitlements()
      */
     public function testUpdateEntitlements(): void
     {
         $jane = $this->getTestUser('jane@kolabnow.com');
 
         $kolab = Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $storage = Sku::withEnvTenantContext()->where('title', 'storage')->first();
         $activesync = Sku::withEnvTenantContext()->where('title', 'activesync')->first();
         $groupware = Sku::withEnvTenantContext()->where('title', 'groupware')->first();
         $mailbox = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();
 
         // standard package, 1 mailbox, 1 groupware, 2 storage
         $jane->assignPackage($kolab);
 
         // add 2 storage, 1 activesync
         $post = [
             'skus' => [
                 $mailbox->id => 1,
                 $groupware->id => 1,
                 $storage->id => 7,
                 $activesync->id => 1
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(200);
 
         $this->assertEntitlements(
             $jane,
             [
                 'activesync',
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
 
         // add 2 storage, remove 1 activesync
         $post = [
             'skus' => [
                 $mailbox->id => 1,
                 $groupware->id => 1,
                 $storage->id => 9,
                 $activesync->id => 0
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(200);
 
         $this->assertEntitlements(
             $jane,
             [
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
 
         // add mailbox
         $post = [
             'skus' => [
                 $mailbox->id => 2,
                 $groupware->id => 1,
                 $storage->id => 9,
                 $activesync->id => 0
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(500);
 
         $this->assertEntitlements(
             $jane,
             [
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
 
         // remove mailbox
         $post = [
             'skus' => [
                 $mailbox->id => 0,
                 $groupware->id => 1,
                 $storage->id => 9,
                 $activesync->id => 0
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(500);
 
         $this->assertEntitlements(
             $jane,
             [
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
 
         // less than free storage
         $post = [
             'skus' => [
                 $mailbox->id => 1,
                 $groupware->id => 1,
                 $storage->id => 1,
                 $activesync->id => 0
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(200);
 
         $this->assertEntitlements(
             $jane,
             [
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
     }
 
     /**
      * Test user data response used in show and info actions
      */
     public function testUserResponse(): void
     {
         $provider = \config('services.payment_provider') ?: 'mollie';
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
         $wallet->setSettings(['mollie_id' => null, 'stripe_id' => null]);
         $result = $this->invokeMethod(new UsersController(), 'userResponse', [$user]);
 
         $this->assertEquals($user->id, $result['id']);
         $this->assertEquals($user->email, $result['email']);
         $this->assertEquals($user->status, $result['status']);
         $this->assertTrue(is_array($result['statusInfo']));
 
         $this->assertTrue(is_array($result['aliases']));
         $this->assertCount(1, $result['aliases']);
         $this->assertSame('john.doe@kolab.org', $result['aliases'][0]);
 
         $this->assertTrue(is_array($result['settings']));
         $this->assertSame('US', $result['settings']['country']);
         $this->assertSame('USD', $result['settings']['currency']);
 
         $this->assertTrue(is_array($result['accounts']));
         $this->assertTrue(is_array($result['wallets']));
         $this->assertCount(0, $result['accounts']);
         $this->assertCount(1, $result['wallets']);
         $this->assertSame($wallet->id, $result['wallet']['id']);
         $this->assertArrayNotHasKey('discount', $result['wallet']);
 
         $this->assertTrue($result['statusInfo']['enableDomains']);
         $this->assertTrue($result['statusInfo']['enableWallets']);
         $this->assertTrue($result['statusInfo']['enableUsers']);
         $this->assertTrue($result['statusInfo']['enableSettings']);
 
         // Ned is John's wallet controller
         $ned = $this->getTestUser('ned@kolab.org');
         $ned_wallet = $ned->wallets()->first();
         $result = $this->invokeMethod(new UsersController(), 'userResponse', [$ned]);
 
         $this->assertEquals($ned->id, $result['id']);
         $this->assertEquals($ned->email, $result['email']);
         $this->assertTrue(is_array($result['accounts']));
         $this->assertTrue(is_array($result['wallets']));
         $this->assertCount(1, $result['accounts']);
         $this->assertCount(1, $result['wallets']);
         $this->assertSame($wallet->id, $result['wallet']['id']);
         $this->assertSame($wallet->id, $result['accounts'][0]['id']);
         $this->assertSame($ned_wallet->id, $result['wallets'][0]['id']);
         $this->assertSame($provider, $result['wallet']['provider']);
         $this->assertSame($provider, $result['wallets'][0]['provider']);
 
         $this->assertTrue($result['statusInfo']['enableDomains']);
         $this->assertTrue($result['statusInfo']['enableWallets']);
         $this->assertTrue($result['statusInfo']['enableUsers']);
         $this->assertTrue($result['statusInfo']['enableSettings']);
 
         // Test discount in a response
         $discount = Discount::where('code', 'TEST')->first();
         $wallet->discount()->associate($discount);
         $wallet->save();
         $mod_provider = $provider == 'mollie' ? 'stripe' : 'mollie';
         $wallet->setSetting($mod_provider . '_id', 123);
         $user->refresh();
 
         $result = $this->invokeMethod(new UsersController(), 'userResponse', [$user]);
 
         $this->assertEquals($user->id, $result['id']);
         $this->assertSame($discount->id, $result['wallet']['discount_id']);
         $this->assertSame($discount->discount, $result['wallet']['discount']);
         $this->assertSame($discount->description, $result['wallet']['discount_description']);
         $this->assertSame($mod_provider, $result['wallet']['provider']);
         $this->assertSame($discount->id, $result['wallets'][0]['discount_id']);
         $this->assertSame($discount->discount, $result['wallets'][0]['discount']);
         $this->assertSame($discount->description, $result['wallets'][0]['discount_description']);
         $this->assertSame($mod_provider, $result['wallets'][0]['provider']);
 
         // Jack is not a John's wallet controller
         $jack = $this->getTestUser('jack@kolab.org');
         $result = $this->invokeMethod(new UsersController(), 'userResponse', [$jack]);
 
         $this->assertFalse($result['statusInfo']['enableDomains']);
         $this->assertFalse($result['statusInfo']['enableWallets']);
         $this->assertFalse($result['statusInfo']['enableUsers']);
         $this->assertFalse($result['statusInfo']['enableSettings']);
     }
 
     /**
      * List of email address validation cases for testValidateEmail()
      *
      * @return array Arguments for testValidateEmail()
      */
     public function dataValidateEmail(): array
     {
         $this->refreshApplication();
         $public_domains = Domain::getPublicDomains();
         $domain = reset($public_domains);
 
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
 
         return [
             // Invalid format
             ["$domain", $john, 'The specified email is invalid.'],
             [".@$domain", $john, 'The specified email is invalid.'],
             ["test123456@localhost", $john, 'The specified domain is invalid.'],
             ["test123456@unknown-domain.org", $john, 'The specified domain is invalid.'],
 
             ["$domain", $john, 'The specified email is invalid.'],
             [".@$domain", $john, 'The specified email is invalid.'],
 
             // forbidden local part on public domains
             ["admin@$domain", $john, 'The specified email is not available.'],
             ["administrator@$domain", $john, 'The specified email is not available.'],
 
             // forbidden (other user's domain)
             ["testtest@kolab.org", $user, 'The specified domain is not available.'],
 
             // existing alias of other user, to be a user email
             ["jack.daniels@kolab.org", $john, 'The specified email is not available.'],
 
             // valid (user domain)
             ["admin@kolab.org", $john, null],
 
             // valid (public domain)
             ["test.test@$domain", $john, null],
         ];
     }
 
     /**
      * User email address validation.
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      *
      * @dataProvider dataValidateEmail
      */
     public function testValidateEmail($email, $user, $expected_result): void
     {
         $result = UsersController::validateEmail($email, $user);
         $this->assertSame($expected_result, $result);
     }
 
     /**
      * User email validation - tests for $deleted argument
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      */
     public function testValidateEmailDeleted(): void
     {
         Queue::fake();
 
         $john = $this->getTestUser('john@kolab.org');
         $deleted_priv = $this->getTestUser('deleted@kolab.org');
         $deleted_priv->delete();
         $deleted_pub = $this->getTestUser('deleted@kolabnow.com');
         $deleted_pub->delete();
 
         $result = UsersController::validateEmail('deleted@kolab.org', $john, $deleted);
         $this->assertSame(null, $result);
         $this->assertSame($deleted_priv->id, $deleted->id);
 
         $result = UsersController::validateEmail('deleted@kolabnow.com', $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertSame(null, $deleted);
 
         $result = UsersController::validateEmail('jack@kolab.org', $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertSame(null, $deleted);
     }
 
     /**
      * User email validation - tests for an address being a group email address
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      */
     public function testValidateEmailGroup(): void
     {
         Queue::fake();
 
         $john = $this->getTestUser('john@kolab.org');
         $pub_group = $this->getTestGroup('group-test@kolabnow.com');
         $priv_group = $this->getTestGroup('group-test@kolab.org');
 
         // A group in a public domain, existing
         $result = UsersController::validateEmail($pub_group->email, $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertNull($deleted);
 
         $pub_group->delete();
 
         // A group in a public domain, deleted
         $result = UsersController::validateEmail($pub_group->email, $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertNull($deleted);
 
         // A group in a private domain, existing
         $result = UsersController::validateEmail($priv_group->email, $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertNull($deleted);
 
         $priv_group->delete();
 
         // A group in a private domain, deleted
         $result = UsersController::validateEmail($priv_group->email, $john, $deleted);
         $this->assertSame(null, $result);
         $this->assertSame($priv_group->id, $deleted->id);
     }
 
     /**
      * List of alias validation cases for testValidateAlias()
      *
      * @return array Arguments for testValidateAlias()
      */
     public function dataValidateAlias(): array
     {
         $this->refreshApplication();
         $public_domains = Domain::getPublicDomains();
         $domain = reset($public_domains);
 
         $john = $this->getTestUser('john@kolab.org');
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
 
         return [
             // Invalid format
             ["$domain", $john, 'The specified alias is invalid.'],
             [".@$domain", $john, 'The specified alias is invalid.'],
             ["test123456@localhost", $john, 'The specified domain is invalid.'],
             ["test123456@unknown-domain.org", $john, 'The specified domain is invalid.'],
 
             ["$domain", $john, 'The specified alias is invalid.'],
             [".@$domain", $john, 'The specified alias is invalid.'],
 
             // forbidden local part on public domains
             ["admin@$domain", $john, 'The specified alias is not available.'],
             ["administrator@$domain", $john, 'The specified alias is not available.'],
 
             // forbidden (other user's domain)
             ["testtest@kolab.org", $user, 'The specified domain is not available.'],
 
             // existing alias of other user, to be an alias, user in the same group account
             ["jack.daniels@kolab.org", $john, null],
 
             // existing user
             ["jack@kolab.org", $john, 'The specified alias is not available.'],
 
             // valid (user domain)
             ["admin@kolab.org", $john, null],
 
             // valid (public domain)
             ["test.test@$domain", $john, null],
         ];
     }
 
     /**
      * User email alias validation.
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      *
      * @dataProvider dataValidateAlias
      */
     public function testValidateAlias($alias, $user, $expected_result): void
     {
         $result = UsersController::validateAlias($alias, $user);
         $this->assertSame($expected_result, $result);
     }
 
     /**
      * User alias validation - more cases.
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      */
     public function testValidateAlias2(): void
     {
         Queue::fake();
 
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $deleted_priv = $this->getTestUser('deleted@kolab.org');
         $deleted_priv->setAliases(['deleted-alias@kolab.org']);
         $deleted_priv->delete();
         $deleted_pub = $this->getTestUser('deleted@kolabnow.com');
         $deleted_pub->setAliases(['deleted-alias@kolabnow.com']);
         $deleted_pub->delete();
         $group = $this->getTestGroup('group-test@kolabnow.com');
 
         // An alias that was a user email before is allowed, but only for custom domains
         $result = UsersController::validateAlias('deleted@kolab.org', $john);
         $this->assertSame(null, $result);
 
         $result = UsersController::validateAlias('deleted-alias@kolab.org', $john);
         $this->assertSame(null, $result);
 
         $result = UsersController::validateAlias('deleted@kolabnow.com', $john);
         $this->assertSame('The specified alias is not available.', $result);
 
         $result = UsersController::validateAlias('deleted-alias@kolabnow.com', $john);
         $this->assertSame('The specified alias is not available.', $result);
 
         // A grpoup with the same email address exists
         $result = UsersController::validateAlias($group->email, $john);
         $this->assertSame('The specified alias is not available.', $result);
     }
 }
diff --git a/src/tests/Feature/UserTest.php b/src/tests/Feature/UserTest.php
index a2f1657b..84804adb 100644
--- a/src/tests/Feature/UserTest.php
+++ b/src/tests/Feature/UserTest.php
@@ -1,1253 +1,1326 @@
 <?php
 
 namespace Tests\Feature;
 
 use App\Domain;
 use App\Group;
 use App\User;
 use Carbon\Carbon;
 use Illuminate\Support\Facades\Queue;
 use Tests\TestCase;
 
 class UserTest extends TestCase
 {
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('user-test@' . \config('app.domain'));
         $this->deleteTestUser('UserAccountA@UserAccount.com');
         $this->deleteTestUser('UserAccountB@UserAccount.com');
         $this->deleteTestUser('UserAccountC@UserAccount.com');
         $this->deleteTestGroup('test-group@UserAccount.com');
         $this->deleteTestResource('test-resource@UserAccount.com');
         $this->deleteTestSharedFolder('test-folder@UserAccount.com');
         $this->deleteTestDomain('UserAccount.com');
         $this->deleteTestDomain('UserAccountAdd.com');
     }
 
     public function tearDown(): void
     {
         \App\TenantSetting::truncate();
         $this->deleteTestUser('user-test@' . \config('app.domain'));
         $this->deleteTestUser('UserAccountA@UserAccount.com');
         $this->deleteTestUser('UserAccountB@UserAccount.com');
         $this->deleteTestUser('UserAccountC@UserAccount.com');
         $this->deleteTestGroup('test-group@UserAccount.com');
         $this->deleteTestResource('test-resource@UserAccount.com');
         $this->deleteTestSharedFolder('test-folder@UserAccount.com');
         $this->deleteTestDomain('UserAccount.com');
         $this->deleteTestDomain('UserAccountAdd.com');
 
         parent::tearDown();
     }
 
     /**
      * Tests for User::assignPackage()
      */
     public function testAssignPackage(): void
     {
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
         $wallet = $user->wallets()->first();
 
         $package = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
 
         $user->assignPackage($package);
 
         $sku = \App\Sku::withEnvTenantContext()->where('title', 'mailbox')->first();
 
         $entitlement = \App\Entitlement::where('wallet_id', $wallet->id)
             ->where('sku_id', $sku->id)->first();
 
         $this->assertNotNull($entitlement);
         $this->assertSame($sku->id, $entitlement->sku->id);
         $this->assertSame($wallet->id, $entitlement->wallet->id);
         $this->assertEquals($user->id, $entitlement->entitleable->id);
         $this->assertTrue($entitlement->entitleable instanceof \App\User);
         $this->assertCount(7, $user->entitlements()->get());
     }
 
     /**
      * Tests for User::assignPlan()
      */
     public function testAssignPlan(): void
     {
         $this->markTestIncomplete();
     }
 
     /**
      * Tests for User::assignSku()
      */
     public function testAssignSku(): void
     {
         $this->markTestIncomplete();
     }
 
     /**
      * Verify a wallet assigned a controller is among the accounts of the assignee.
      */
     public function testAccounts(): void
     {
         $userA = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
 
         $this->assertTrue($userA->wallets()->count() == 1);
 
         $userA->wallets()->each(
             function ($wallet) use ($userB) {
                 $wallet->addController($userB);
             }
         );
 
         $this->assertTrue($userB->accounts()->get()[0]->id === $userA->wallets()->get()[0]->id);
     }
 
+    /**
+     * Test User::canDelete() method
+     */
     public function testCanDelete(): void
     {
-        $this->markTestIncomplete();
+        $john = $this->getTestUser('john@kolab.org');
+        $ned = $this->getTestUser('ned@kolab.org');
+        $jack = $this->getTestUser('jack@kolab.org');
+        $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
+        $admin = $this->getTestUser('jeroen@jeroen.jeroen');
+        $domain = $this->getTestDomain('kolab.org');
+
+        // Admin
+        $this->assertTrue($admin->canDelete($admin));
+        $this->assertFalse($admin->canDelete($john));
+        $this->assertFalse($admin->canDelete($jack));
+        $this->assertFalse($admin->canDelete($reseller1));
+        $this->assertFalse($admin->canDelete($domain));
+        $this->assertFalse($admin->canDelete($domain->wallet()));
+
+        // Reseller - kolabnow
+        $this->assertFalse($reseller1->canDelete($john));
+        $this->assertFalse($reseller1->canDelete($jack));
+        $this->assertTrue($reseller1->canDelete($reseller1));
+        $this->assertFalse($reseller1->canDelete($domain));
+        $this->assertFalse($reseller1->canDelete($domain->wallet()));
+        $this->assertFalse($reseller1->canDelete($admin));
+
+        // Normal user - account owner
+        $this->assertTrue($john->canDelete($john));
+        $this->assertTrue($john->canDelete($ned));
+        $this->assertTrue($john->canDelete($jack));
+        $this->assertTrue($john->canDelete($domain));
+        $this->assertFalse($john->canDelete($domain->wallet()));
+        $this->assertFalse($john->canDelete($reseller1));
+        $this->assertFalse($john->canDelete($admin));
+
+        // Normal user - a non-owner and non-controller
+        $this->assertFalse($jack->canDelete($jack));
+        $this->assertFalse($jack->canDelete($john));
+        $this->assertFalse($jack->canDelete($domain));
+        $this->assertFalse($jack->canDelete($domain->wallet()));
+        $this->assertFalse($jack->canDelete($reseller1));
+        $this->assertFalse($jack->canDelete($admin));
+
+        // Normal user - John's wallet controller
+        $this->assertTrue($ned->canDelete($ned));
+        $this->assertTrue($ned->canDelete($john));
+        $this->assertTrue($ned->canDelete($jack));
+        $this->assertTrue($ned->canDelete($domain));
+        $this->assertFalse($ned->canDelete($domain->wallet()));
+        $this->assertFalse($ned->canDelete($reseller1));
+        $this->assertFalse($ned->canDelete($admin));
     }
 
     /**
      * Test User::canRead() method
      */
     public function testCanRead(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
         $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
         $domain = $this->getTestDomain('kolab.org');
 
         // Admin
         $this->assertTrue($admin->canRead($admin));
         $this->assertTrue($admin->canRead($john));
         $this->assertTrue($admin->canRead($jack));
         $this->assertTrue($admin->canRead($reseller1));
         $this->assertTrue($admin->canRead($reseller2));
         $this->assertTrue($admin->canRead($domain));
         $this->assertTrue($admin->canRead($domain->wallet()));
 
         // Reseller - kolabnow
         $this->assertTrue($reseller1->canRead($john));
         $this->assertTrue($reseller1->canRead($jack));
         $this->assertTrue($reseller1->canRead($reseller1));
         $this->assertTrue($reseller1->canRead($domain));
         $this->assertTrue($reseller1->canRead($domain->wallet()));
         $this->assertFalse($reseller1->canRead($reseller2));
         $this->assertFalse($reseller1->canRead($admin));
 
         // Reseller - different tenant
         $this->assertTrue($reseller2->canRead($reseller2));
         $this->assertFalse($reseller2->canRead($john));
         $this->assertFalse($reseller2->canRead($jack));
         $this->assertFalse($reseller2->canRead($reseller1));
         $this->assertFalse($reseller2->canRead($domain));
         $this->assertFalse($reseller2->canRead($domain->wallet()));
         $this->assertFalse($reseller2->canRead($admin));
 
         // Normal user - account owner
         $this->assertTrue($john->canRead($john));
         $this->assertTrue($john->canRead($ned));
         $this->assertTrue($john->canRead($jack));
         $this->assertTrue($john->canRead($domain));
         $this->assertTrue($john->canRead($domain->wallet()));
         $this->assertFalse($john->canRead($reseller1));
         $this->assertFalse($john->canRead($reseller2));
         $this->assertFalse($john->canRead($admin));
 
         // Normal user - a non-owner and non-controller
         $this->assertTrue($jack->canRead($jack));
         $this->assertFalse($jack->canRead($john));
         $this->assertFalse($jack->canRead($domain));
         $this->assertFalse($jack->canRead($domain->wallet()));
         $this->assertFalse($jack->canRead($reseller1));
         $this->assertFalse($jack->canRead($reseller2));
         $this->assertFalse($jack->canRead($admin));
 
         // Normal user - John's wallet controller
         $this->assertTrue($ned->canRead($ned));
         $this->assertTrue($ned->canRead($john));
         $this->assertTrue($ned->canRead($jack));
         $this->assertTrue($ned->canRead($domain));
         $this->assertTrue($ned->canRead($domain->wallet()));
         $this->assertFalse($ned->canRead($reseller1));
         $this->assertFalse($ned->canRead($reseller2));
         $this->assertFalse($ned->canRead($admin));
     }
 
     /**
      * Test User::canUpdate() method
      */
     public function testCanUpdate(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
         $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
         $domain = $this->getTestDomain('kolab.org');
 
         // Admin
         $this->assertTrue($admin->canUpdate($admin));
         $this->assertTrue($admin->canUpdate($john));
         $this->assertTrue($admin->canUpdate($jack));
         $this->assertTrue($admin->canUpdate($reseller1));
         $this->assertTrue($admin->canUpdate($reseller2));
         $this->assertTrue($admin->canUpdate($domain));
         $this->assertTrue($admin->canUpdate($domain->wallet()));
 
         // Reseller - kolabnow
         $this->assertTrue($reseller1->canUpdate($john));
         $this->assertTrue($reseller1->canUpdate($jack));
         $this->assertTrue($reseller1->canUpdate($reseller1));
         $this->assertTrue($reseller1->canUpdate($domain));
         $this->assertTrue($reseller1->canUpdate($domain->wallet()));
         $this->assertFalse($reseller1->canUpdate($reseller2));
         $this->assertFalse($reseller1->canUpdate($admin));
 
         // Reseller - different tenant
         $this->assertTrue($reseller2->canUpdate($reseller2));
         $this->assertFalse($reseller2->canUpdate($john));
         $this->assertFalse($reseller2->canUpdate($jack));
         $this->assertFalse($reseller2->canUpdate($reseller1));
         $this->assertFalse($reseller2->canUpdate($domain));
         $this->assertFalse($reseller2->canUpdate($domain->wallet()));
         $this->assertFalse($reseller2->canUpdate($admin));
 
         // Normal user - account owner
         $this->assertTrue($john->canUpdate($john));
         $this->assertTrue($john->canUpdate($ned));
         $this->assertTrue($john->canUpdate($jack));
         $this->assertTrue($john->canUpdate($domain));
         $this->assertFalse($john->canUpdate($domain->wallet()));
         $this->assertFalse($john->canUpdate($reseller1));
         $this->assertFalse($john->canUpdate($reseller2));
         $this->assertFalse($john->canUpdate($admin));
 
         // Normal user - a non-owner and non-controller
         $this->assertTrue($jack->canUpdate($jack));
         $this->assertFalse($jack->canUpdate($john));
         $this->assertFalse($jack->canUpdate($domain));
         $this->assertFalse($jack->canUpdate($domain->wallet()));
         $this->assertFalse($jack->canUpdate($reseller1));
         $this->assertFalse($jack->canUpdate($reseller2));
         $this->assertFalse($jack->canUpdate($admin));
 
         // Normal user - John's wallet controller
         $this->assertTrue($ned->canUpdate($ned));
         $this->assertTrue($ned->canUpdate($john));
         $this->assertTrue($ned->canUpdate($jack));
         $this->assertTrue($ned->canUpdate($domain));
         $this->assertFalse($ned->canUpdate($domain->wallet()));
         $this->assertFalse($ned->canUpdate($reseller1));
         $this->assertFalse($ned->canUpdate($reseller2));
         $this->assertFalse($ned->canUpdate($admin));
     }
 
     /**
-     * Test user create/creating observer
+     * Test user created/creating/updated observers
      */
-    public function testCreate(): void
+    public function testCreateAndUpdate(): void
     {
         Queue::fake();
 
         $domain = \config('app.domain');
 
-        $user = User::create(['email' => 'USER-test@' . \strtoupper($domain)]);
+        $user = User::create([
+                'email' => 'USER-test@' . \strtoupper($domain),
+                'password' => 'test',
+        ]);
 
-        $result = User::where('email', 'user-test@' . $domain)->first();
+        $result = User::where('email', "user-test@$domain")->first();
 
-        $this->assertSame('user-test@' . $domain, $result->email);
+        $this->assertSame("user-test@$domain", $result->email);
         $this->assertSame($user->id, $result->id);
         $this->assertSame(User::STATUS_NEW | User::STATUS_ACTIVE, $result->status);
-    }
-
-    /**
-     * Verify user creation process
-     */
-    public function testCreateJobs(): void
-    {
-        Queue::fake();
-
-        $user = User::create([
-                'email' => 'user-test@' . \config('app.domain')
-        ]);
+        $this->assertSame(0, $user->passwords()->count());
 
         Queue::assertPushed(\App\Jobs\User\CreateJob::class, 1);
         Queue::assertPushed(\App\Jobs\PGP\KeyCreateJob::class, 0);
 
         Queue::assertPushed(
             \App\Jobs\User\CreateJob::class,
             function ($job) use ($user) {
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 $userId = TestCase::getObjectProperty($job, 'userId');
 
                 return $userEmail === $user->email
                     && $userId === $user->id;
             }
         );
 
         Queue::assertPushedWithChain(
             \App\Jobs\User\CreateJob::class,
             [
                 \App\Jobs\User\VerifyJob::class,
             ]
         );
 /*
         FIXME: Looks like we can't really do detailed assertions on chained jobs
                Another thing to consider is if we maybe should run these jobs
                independently (not chained) and make sure there's no race-condition
                in status update
 
         Queue::assertPushed(\App\Jobs\User\VerifyJob::class, 1);
         Queue::assertPushed(\App\Jobs\User\VerifyJob::class, function ($job) use ($user) {
             $userEmail = TestCase::getObjectProperty($job, 'userEmail');
             $userId = TestCase::getObjectProperty($job, 'userId');
 
             return $userEmail === $user->email
                 && $userId === $user->id;
         });
 */
-    }
 
-    /**
-     * Verify user creation process invokes the PGP keys creation job (if configured)
-     */
-    public function testCreatePGPJob(): void
-    {
-        Queue::fake();
+        // Test invoking KeyCreateJob
+        $this->deleteTestUser("user-test@$domain");
 
         \App\Tenant::find(\config('app.tenant_id'))->setSetting('pgp.enable', 1);
 
-        $user = User::create([
-                'email' => 'user-test@' . \config('app.domain')
-        ]);
+        $user = User::create(['email' => "user-test@$domain", 'password' => 'test']);
 
         Queue::assertPushed(\App\Jobs\PGP\KeyCreateJob::class, 1);
 
         Queue::assertPushed(
             \App\Jobs\PGP\KeyCreateJob::class,
             function ($job) use ($user) {
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 $userId = TestCase::getObjectProperty($job, 'userId');
 
                 return $userEmail === $user->email
                     && $userId === $user->id;
             }
         );
+
+        // Update the user, test the password change
+        $oldPassword = $user->password;
+        $user->password = 'test123';
+        $user->save();
+
+        $this->assertNotEquals($oldPassword, $user->password);
+        $this->assertSame(0, $user->passwords()->count());
+
+        Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
+        Queue::assertPushed(
+            \App\Jobs\User\UpdateJob::class,
+            function ($job) use ($user) {
+                $userEmail = TestCase::getObjectProperty($job, 'userEmail');
+                $userId = TestCase::getObjectProperty($job, 'userId');
+
+                return $userEmail === $user->email
+                    && $userId === $user->id;
+            }
+        );
+
+        // Update the user, test the password history
+        $user->setSetting('password_policy', 'last:3');
+        $oldPassword = $user->password;
+        $user->password = 'test1234';
+        $user->save();
+
+        $this->assertSame(1, $user->passwords()->count());
+        $this->assertSame($oldPassword, $user->passwords()->first()->password);
+
+        $user->password = 'test12345';
+        $user->save();
+        $oldPassword = $user->password;
+        $user->password = 'test123456';
+        $user->save();
+
+        $this->assertSame(2, $user->passwords()->count());
+        $this->assertSame($oldPassword, $user->passwords()->latest()->first()->password);
     }
 
     /**
      * Tests for User::domains()
      */
     public function testDomains(): void
     {
         $user = $this->getTestUser('john@kolab.org');
 
         $domain = $this->getTestDomain('useraccount.com', [
                 'status' => Domain::STATUS_NEW | Domain::STATUS_ACTIVE,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
 
         $domains = $user->domains()->pluck('namespace')->all();
 
         $this->assertContains($domain->namespace, $domains);
         $this->assertContains('kolab.org', $domains);
 
         // Jack is not the wallet controller, so for him the list should not
         // include John's domains, kolab.org specifically
         $user = $this->getTestUser('jack@kolab.org');
 
         $domains = $user->domains()->pluck('namespace')->all();
 
         $this->assertContains($domain->namespace, $domains);
         $this->assertNotContains('kolab.org', $domains);
 
         // Public domains of other tenants should not be returned
         $tenant = \App\Tenant::where('id', '!=', \config('app.tenant_id'))->first();
         $domain->tenant_id = $tenant->id;
         $domain->save();
 
         $domains = $user->domains()->pluck('namespace')->all();
 
         $this->assertNotContains($domain->namespace, $domains);
     }
 
     /**
      * Test User::getConfig() and setConfig() methods
      */
     public function testConfigTrait(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $john->setSetting('greylist_enabled', null);
         $john->setSetting('password_policy', null);
 
         // Greylist_enabled
         $this->assertSame(true, $john->getConfig()['greylist_enabled']);
 
         $result = $john->setConfig(['greylist_enabled' => false, 'unknown' => false]);
 
         $this->assertSame(['unknown' => "The requested configuration parameter is not supported."], $result);
         $this->assertSame(false, $john->getConfig()['greylist_enabled']);
         $this->assertSame('false', $john->getSetting('greylist_enabled'));
 
         $result = $john->setConfig(['greylist_enabled' => true]);
 
         $this->assertSame([], $result);
         $this->assertSame(true, $john->getConfig()['greylist_enabled']);
         $this->assertSame('true', $john->getSetting('greylist_enabled'));
 
         // Password_policy
         $result = $john->setConfig(['password_policy' => true]);
 
         $this->assertSame(['password_policy' => "Specified password policy is invalid."], $result);
         $this->assertSame(null, $john->getConfig()['password_policy']);
         $this->assertSame(null, $john->getSetting('password_policy'));
 
         $result = $john->setConfig(['password_policy' => 'min:-1']);
 
         $this->assertSame(['password_policy' => "Specified password policy is invalid."], $result);
 
         $result = $john->setConfig(['password_policy' => 'min:-1']);
 
         $this->assertSame(['password_policy' => "Specified password policy is invalid."], $result);
 
         $result = $john->setConfig(['password_policy' => 'min:10,unknown']);
 
         $this->assertSame(['password_policy' => "Specified password policy is invalid."], $result);
 
         \config(['app.password_policy' => 'min:5,max:100']);
         $result = $john->setConfig(['password_policy' => 'min:4,max:255']);
 
         $this->assertSame(['password_policy' => "Minimum password length cannot be less than 5."], $result);
 
         \config(['app.password_policy' => 'min:5,max:100']);
         $result = $john->setConfig(['password_policy' => 'min:10,max:255']);
 
         $this->assertSame(['password_policy' => "Maximum password length cannot be more than 100."], $result);
 
         \config(['app.password_policy' => 'min:5,max:255']);
         $result = $john->setConfig(['password_policy' => 'min:10,max:255']);
 
         $this->assertSame([], $result);
         $this->assertSame('min:10,max:255', $john->getConfig()['password_policy']);
         $this->assertSame('min:10,max:255', $john->getSetting('password_policy'));
     }
 
     /**
      * Test user account degradation and un-degradation
      */
     public function testDegradeAndUndegrade(): void
     {
         Queue::fake();
 
         // Test an account with users, domain
         $userA = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $domain = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $userA->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $userA);
         $userA->assignPackage($package_kolab, $userB);
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
         $entitlementsDomain = \App\Entitlement::where('entitleable_id', $domain->id);
 
         $yesterday = Carbon::now()->subDays(1);
 
         $this->backdateEntitlements($entitlementsA->get(), $yesterday, Carbon::now()->subMonthsWithoutOverflow(1));
         $this->backdateEntitlements($entitlementsB->get(), $yesterday, Carbon::now()->subMonthsWithoutOverflow(1));
 
         $wallet = $userA->wallets->first();
 
         $this->assertSame(7, $entitlementsA->count());
         $this->assertSame(7, $entitlementsB->count());
         $this->assertSame(7, $entitlementsA->whereDate('updated_at', $yesterday->toDateString())->count());
         $this->assertSame(7, $entitlementsB->whereDate('updated_at', $yesterday->toDateString())->count());
         $this->assertSame(0, $wallet->balance);
 
         Queue::fake(); // reset queue state
 
         // Degrade the account/wallet owner
         $userA->degrade();
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
 
         $this->assertTrue($userA->fresh()->isDegraded());
         $this->assertTrue($userA->fresh()->isDegraded(true));
         $this->assertFalse($userB->fresh()->isDegraded());
         $this->assertTrue($userB->fresh()->isDegraded(true));
 
         $balance = $wallet->fresh()->balance;
         $this->assertTrue($balance <= -64);
         $this->assertSame(7, $entitlementsA->whereDate('updated_at', Carbon::now()->toDateString())->count());
         $this->assertSame(7, $entitlementsB->whereDate('updated_at', Carbon::now()->toDateString())->count());
 
         // Expect one update job for every user
         // @phpstan-ignore-next-line
         $userIds = Queue::pushed(\App\Jobs\User\UpdateJob::class)->map(function ($job) {
             return TestCase::getObjectProperty($job, 'userId');
         })->all();
 
         $this->assertSame([$userA->id, $userB->id], $userIds);
 
         // Un-Degrade the account/wallet owner
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
 
         $yesterday = Carbon::now()->subDays(1);
 
         $this->backdateEntitlements($entitlementsA->get(), $yesterday, Carbon::now()->subMonthsWithoutOverflow(1));
         $this->backdateEntitlements($entitlementsB->get(), $yesterday, Carbon::now()->subMonthsWithoutOverflow(1));
 
         Queue::fake(); // reset queue state
 
         $userA->undegrade();
 
         $this->assertFalse($userA->fresh()->isDegraded());
         $this->assertFalse($userA->fresh()->isDegraded(true));
         $this->assertFalse($userB->fresh()->isDegraded());
         $this->assertFalse($userB->fresh()->isDegraded(true));
 
         // Expect no balance change, degraded account entitlements are free
         $this->assertSame($balance, $wallet->fresh()->balance);
         $this->assertSame(7, $entitlementsA->whereDate('updated_at', Carbon::now()->toDateString())->count());
         $this->assertSame(7, $entitlementsB->whereDate('updated_at', Carbon::now()->toDateString())->count());
 
         // Expect one update job for every user
         // @phpstan-ignore-next-line
         $userIds = Queue::pushed(\App\Jobs\User\UpdateJob::class)->map(function ($job) {
             return TestCase::getObjectProperty($job, 'userId');
         })->all();
 
         $this->assertSame([$userA->id, $userB->id], $userIds);
     }
 
     /**
      * Test user deletion
      */
     public function testDelete(): void
     {
         Queue::fake();
 
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
         $package = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $user->assignPackage($package);
 
         $id = $user->id;
 
         $this->assertCount(7, $user->entitlements()->get());
 
         $user->delete();
 
         $this->assertCount(0, $user->entitlements()->get());
         $this->assertTrue($user->fresh()->trashed());
         $this->assertFalse($user->fresh()->isDeleted());
 
         // Delete the user for real
         $job = new \App\Jobs\User\DeleteJob($id);
         $job->handle();
 
         $this->assertTrue(User::withTrashed()->where('id', $id)->first()->isDeleted());
 
         $user->forceDelete();
 
         $this->assertCount(0, User::withTrashed()->where('id', $id)->get());
 
         // Test an account with users, domain, and group, and resource
         $userA = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $userC = $this->getTestUser('UserAccountC@UserAccount.com');
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $domain = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $userA->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $userA);
         $userA->assignPackage($package_kolab, $userB);
         $userA->assignPackage($package_kolab, $userC);
         $group = $this->getTestGroup('test-group@UserAccount.com');
         $group->assignToWallet($userA->wallets->first());
         $resource = $this->getTestResource('test-resource@UserAccount.com', ['name' => 'test']);
         $resource->assignToWallet($userA->wallets->first());
         $folder = $this->getTestSharedFolder('test-folder@UserAccount.com', ['name' => 'test']);
         $folder->assignToWallet($userA->wallets->first());
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
         $entitlementsC = \App\Entitlement::where('entitleable_id', $userC->id);
         $entitlementsDomain = \App\Entitlement::where('entitleable_id', $domain->id);
         $entitlementsGroup = \App\Entitlement::where('entitleable_id', $group->id);
         $entitlementsResource = \App\Entitlement::where('entitleable_id', $resource->id);
         $entitlementsFolder = \App\Entitlement::where('entitleable_id', $folder->id);
 
         $this->assertSame(7, $entitlementsA->count());
         $this->assertSame(7, $entitlementsB->count());
         $this->assertSame(7, $entitlementsC->count());
         $this->assertSame(1, $entitlementsDomain->count());
         $this->assertSame(1, $entitlementsGroup->count());
         $this->assertSame(1, $entitlementsResource->count());
         $this->assertSame(1, $entitlementsFolder->count());
 
         // Delete non-controller user
         $userC->delete();
 
         $this->assertTrue($userC->fresh()->trashed());
         $this->assertFalse($userC->fresh()->isDeleted());
         $this->assertSame(0, $entitlementsC->count());
 
         // Delete the controller (and expect "sub"-users to be deleted too)
         $userA->delete();
 
         $this->assertSame(0, $entitlementsA->count());
         $this->assertSame(0, $entitlementsB->count());
         $this->assertSame(0, $entitlementsDomain->count());
         $this->assertSame(0, $entitlementsGroup->count());
         $this->assertSame(0, $entitlementsResource->count());
         $this->assertSame(0, $entitlementsFolder->count());
         $this->assertSame(7, $entitlementsA->withTrashed()->count());
         $this->assertSame(7, $entitlementsB->withTrashed()->count());
         $this->assertSame(7, $entitlementsC->withTrashed()->count());
         $this->assertSame(1, $entitlementsDomain->withTrashed()->count());
         $this->assertSame(1, $entitlementsGroup->withTrashed()->count());
         $this->assertSame(1, $entitlementsResource->withTrashed()->count());
         $this->assertSame(1, $entitlementsFolder->withTrashed()->count());
         $this->assertTrue($userA->fresh()->trashed());
         $this->assertTrue($userB->fresh()->trashed());
         $this->assertTrue($domain->fresh()->trashed());
         $this->assertTrue($group->fresh()->trashed());
         $this->assertTrue($resource->fresh()->trashed());
         $this->assertTrue($folder->fresh()->trashed());
         $this->assertFalse($userA->isDeleted());
         $this->assertFalse($userB->isDeleted());
         $this->assertFalse($domain->isDeleted());
         $this->assertFalse($group->isDeleted());
         $this->assertFalse($resource->isDeleted());
         $this->assertFalse($folder->isDeleted());
 
         $userA->forceDelete();
 
         $all_entitlements = \App\Entitlement::where('wallet_id', $userA->wallets->first()->id);
         $transactions = \App\Transaction::where('object_id', $userA->wallets->first()->id);
 
         $this->assertSame(0, $all_entitlements->withTrashed()->count());
         $this->assertSame(0, $transactions->count());
         $this->assertCount(0, User::withTrashed()->where('id', $userA->id)->get());
         $this->assertCount(0, User::withTrashed()->where('id', $userB->id)->get());
         $this->assertCount(0, User::withTrashed()->where('id', $userC->id)->get());
         $this->assertCount(0, Domain::withTrashed()->where('id', $domain->id)->get());
         $this->assertCount(0, Group::withTrashed()->where('id', $group->id)->get());
         $this->assertCount(0, \App\Resource::withTrashed()->where('id', $resource->id)->get());
         $this->assertCount(0, \App\SharedFolder::withTrashed()->where('id', $folder->id)->get());
     }
 
     /**
      * Test user deletion vs. group membership
      */
     public function testDeleteAndGroups(): void
     {
         Queue::fake();
 
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $userA = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $userA->assignPackage($package_kolab, $userB);
         $group = $this->getTestGroup('test-group@UserAccount.com');
         $group->members = ['test@gmail.com', $userB->email];
         $group->assignToWallet($userA->wallets->first());
         $group->save();
 
         Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 1);
 
         $userGroups = $userA->groups()->get();
         $this->assertSame(1, $userGroups->count());
         $this->assertSame($group->id, $userGroups->first()->id);
 
         $userB->delete();
 
         $this->assertSame(['test@gmail.com'], $group->fresh()->members);
 
         // Twice, one for save() and one for delete() above
         Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 2);
     }
 
     /**
      * Test handling negative balance on user deletion
      */
     public function testDeleteWithNegativeBalance(): void
     {
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
         $wallet = $user->wallets()->first();
         $wallet->balance = -1000;
         $wallet->save();
         $reseller_wallet = $user->tenant->wallet();
         $reseller_wallet->balance = 0;
         $reseller_wallet->save();
         \App\Transaction::where('object_id', $reseller_wallet->id)->where('object_type', \App\Wallet::class)->delete();
 
         $user->delete();
 
         $reseller_transactions = \App\Transaction::where('object_id', $reseller_wallet->id)
             ->where('object_type', \App\Wallet::class)->get();
 
         $this->assertSame(-1000, $reseller_wallet->fresh()->balance);
         $this->assertCount(1, $reseller_transactions);
         $trans = $reseller_transactions[0];
         $this->assertSame("Deleted user {$user->email}", $trans->description);
         $this->assertSame(-1000, $trans->amount);
         $this->assertSame(\App\Transaction::WALLET_DEBIT, $trans->type);
     }
 
     /**
      * Test handling positive balance on user deletion
      */
     public function testDeleteWithPositiveBalance(): void
     {
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
         $wallet = $user->wallets()->first();
         $wallet->balance = 1000;
         $wallet->save();
         $reseller_wallet = $user->tenant->wallet();
         $reseller_wallet->balance = 0;
         $reseller_wallet->save();
 
         $user->delete();
 
         $this->assertSame(0, $reseller_wallet->fresh()->balance);
     }
 
     /**
      * Test user deletion with PGP/WOAT enabled
      */
     public function testDeleteWithPGP(): void
     {
         Queue::fake();
 
         // Test with PGP disabled
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
 
         $user->tenant->setSetting('pgp.enable', 0);
         $user->delete();
 
         Queue::assertPushed(\App\Jobs\PGP\KeyDeleteJob::class, 0);
 
         // Test with PGP enabled
         $this->deleteTestUser('user-test@' . \config('app.domain'));
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
 
         $user->tenant->setSetting('pgp.enable', 1);
         $user->delete();
         $user->tenant->setSetting('pgp.enable', 0);
 
         Queue::assertPushed(\App\Jobs\PGP\KeyDeleteJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\PGP\KeyDeleteJob::class,
             function ($job) use ($user) {
                 $userId = TestCase::getObjectProperty($job, 'userId');
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 return $userId == $user->id && $userEmail === $user->email;
             }
         );
     }
 
     /**
      * Tests for User::aliasExists()
      */
     public function testAliasExists(): void
     {
         $this->assertTrue(User::aliasExists('jack.daniels@kolab.org'));
 
         $this->assertFalse(User::aliasExists('j.daniels@kolab.org'));
         $this->assertFalse(User::aliasExists('john@kolab.org'));
     }
 
     /**
      * Tests for User::emailExists()
      */
     public function testEmailExists(): void
     {
         $this->assertFalse(User::emailExists('jack.daniels@kolab.org'));
         $this->assertFalse(User::emailExists('j.daniels@kolab.org'));
 
         $this->assertTrue(User::emailExists('john@kolab.org'));
         $user = User::emailExists('john@kolab.org', true);
         $this->assertSame('john@kolab.org', $user->email);
     }
 
     /**
      * Tests for User::findByEmail()
      */
     public function testFindByEmail(): void
     {
         $user = $this->getTestUser('john@kolab.org');
 
         $result = User::findByEmail('john');
         $this->assertNull($result);
 
         $result = User::findByEmail('non-existing@email.com');
         $this->assertNull($result);
 
         $result = User::findByEmail('john@kolab.org');
         $this->assertInstanceOf(User::class, $result);
         $this->assertSame($user->id, $result->id);
 
         // Use an alias
         $result = User::findByEmail('john.doe@kolab.org');
         $this->assertInstanceOf(User::class, $result);
         $this->assertSame($user->id, $result->id);
 
         Queue::fake();
 
         // A case where two users have the same alias
         $ned = $this->getTestUser('ned@kolab.org');
         $ned->setAliases(['joe.monster@kolab.org']);
         $result = User::findByEmail('joe.monster@kolab.org');
         $this->assertNull($result);
         $ned->setAliases([]);
 
         // TODO: searching by external email (setting)
         $this->markTestIncomplete();
     }
 
     /**
      * Test User::hasSku() method
      */
     public function testHasSku(): void
     {
         $john = $this->getTestUser('john@kolab.org');
 
         $this->assertTrue($john->hasSku('mailbox'));
         $this->assertTrue($john->hasSku('storage'));
         $this->assertFalse($john->hasSku('beta'));
         $this->assertFalse($john->hasSku('unknown'));
     }
 
     /**
      * Test User::name()
      */
     public function testName(): void
     {
         Queue::fake();
 
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
 
         $this->assertSame('', $user->name());
         $this->assertSame($user->tenant->title . ' User', $user->name(true));
 
         $user->setSetting('first_name', 'First');
 
         $this->assertSame('First', $user->name());
         $this->assertSame('First', $user->name(true));
 
         $user->setSetting('last_name', 'Last');
 
         $this->assertSame('First Last', $user->name());
         $this->assertSame('First Last', $user->name(true));
     }
 
     /**
      * Test resources() method
      */
     public function testResources(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
 
         $resources = $john->resources()->orderBy('email')->get();
 
         $this->assertSame(2, $resources->count());
         $this->assertSame('resource-test1@kolab.org', $resources[0]->email);
         $this->assertSame('resource-test2@kolab.org', $resources[1]->email);
 
         $resources = $ned->resources()->orderBy('email')->get();
 
         $this->assertSame(2, $resources->count());
         $this->assertSame('resource-test1@kolab.org', $resources[0]->email);
         $this->assertSame('resource-test2@kolab.org', $resources[1]->email);
 
         $resources = $jack->resources()->get();
 
         $this->assertSame(0, $resources->count());
     }
 
     /**
      * Test sharedFolders() method
      */
     public function testSharedFolders(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
 
         $folders = $john->sharedFolders()->orderBy('email')->get();
 
         $this->assertSame(2, $folders->count());
         $this->assertSame('folder-contact@kolab.org', $folders[0]->email);
         $this->assertSame('folder-event@kolab.org', $folders[1]->email);
 
         $folders = $ned->sharedFolders()->orderBy('email')->get();
 
         $this->assertSame(2, $folders->count());
         $this->assertSame('folder-contact@kolab.org', $folders[0]->email);
         $this->assertSame('folder-event@kolab.org', $folders[1]->email);
 
         $folders = $jack->sharedFolders()->get();
 
         $this->assertSame(0, $folders->count());
     }
 
     /**
      * Test user restoring
      */
     public function testRestore(): void
     {
         Queue::fake();
 
         // Test an account with users and domain
         $userA = $this->getTestUser('UserAccountA@UserAccount.com', [
                 'status' => User::STATUS_LDAP_READY | User::STATUS_IMAP_READY | User::STATUS_SUSPENDED,
         ]);
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $domainA = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $domainB = $this->getTestDomain('UserAccountAdd.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $userA->assignPackage($package_kolab);
         $domainA->assignPackage($package_domain, $userA);
         $domainB->assignPackage($package_domain, $userA);
         $userA->assignPackage($package_kolab, $userB);
 
         $storage_sku = \App\Sku::withEnvTenantContext()->where('title', 'storage')->first();
         $now = \Carbon\Carbon::now();
         $wallet_id = $userA->wallets->first()->id;
 
         // add an extra storage entitlement
         $ent1 = \App\Entitlement::create([
                 'wallet_id' => $wallet_id,
                 'sku_id' => $storage_sku->id,
                 'cost' => 0,
                 'entitleable_id' => $userA->id,
                 'entitleable_type' => User::class,
         ]);
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
         $entitlementsDomain = \App\Entitlement::where('entitleable_id', $domainA->id);
 
         // First delete the user
         $userA->delete();
 
         $this->assertSame(0, $entitlementsA->count());
         $this->assertSame(0, $entitlementsB->count());
         $this->assertSame(0, $entitlementsDomain->count());
         $this->assertTrue($userA->fresh()->trashed());
         $this->assertTrue($userB->fresh()->trashed());
         $this->assertTrue($domainA->fresh()->trashed());
         $this->assertTrue($domainB->fresh()->trashed());
         $this->assertFalse($userA->isDeleted());
         $this->assertFalse($userB->isDeleted());
         $this->assertFalse($domainA->isDeleted());
 
         // Backdate one storage entitlement (it's not expected to be restored)
         \App\Entitlement::withTrashed()->where('id', $ent1->id)
             ->update(['deleted_at' => $now->copy()->subMinutes(2)]);
 
         // Backdate entitlements to assert that they were restored with proper updated_at timestamp
         \App\Entitlement::withTrashed()->where('wallet_id', $wallet_id)
             ->update(['updated_at' => $now->subMinutes(10)]);
 
         Queue::fake();
 
         // Then restore it
         $userA->restore();
         $userA->refresh();
 
         $this->assertFalse($userA->trashed());
         $this->assertFalse($userA->isDeleted());
         $this->assertFalse($userA->isSuspended());
         $this->assertFalse($userA->isLdapReady());
         $this->assertFalse($userA->isImapReady());
         $this->assertTrue($userA->isActive());
 
         $this->assertTrue($userB->fresh()->trashed());
         $this->assertTrue($domainB->fresh()->trashed());
         $this->assertFalse($domainA->fresh()->trashed());
 
         // Assert entitlements
         $this->assertSame(7, $entitlementsA->count()); // mailbox + groupware + 5 x storage
         $this->assertTrue($ent1->fresh()->trashed());
         $entitlementsA->get()->each(function ($ent) {
             $this->assertTrue($ent->updated_at->greaterThan(\Carbon\Carbon::now()->subSeconds(5)));
         });
 
         // We expect only CreateJob + UpdateJob pair for both user and domain.
         // Because how Illuminate/Database/Eloquent/SoftDeletes::restore() method
         // is implemented we cannot skip the UpdateJob in any way.
         // I don't want to overwrite this method, the extra job shouldn't do any harm.
         $this->assertCount(4, Queue::pushedJobs()); // @phpstan-ignore-line
         Queue::assertPushed(\App\Jobs\Domain\UpdateJob::class, 1);
         Queue::assertPushed(\App\Jobs\Domain\CreateJob::class, 1);
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
         Queue::assertPushed(\App\Jobs\User\CreateJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\User\CreateJob::class,
             function ($job) use ($userA) {
                 return $userA->id === TestCase::getObjectProperty($job, 'userId');
             }
         );
         Queue::assertPushedWithChain(
             \App\Jobs\User\CreateJob::class,
             [
                 \App\Jobs\User\VerifyJob::class,
             ]
         );
     }
 
     /**
      * Tests for UserAliasesTrait::setAliases()
      */
     public function testSetAliases(): void
     {
         Queue::fake();
         Queue::assertNothingPushed();
 
         $user = $this->getTestUser('UserAccountA@UserAccount.com');
         $domain = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
 
         $this->assertCount(0, $user->aliases->all());
 
         $user->tenant->setSetting('pgp.enable', 1);
 
         // Add an alias
         $user->setAliases(['UserAlias1@UserAccount.com']);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
         Queue::assertPushed(\App\Jobs\PGP\KeyCreateJob::class, 1);
 
         $user->tenant->setSetting('pgp.enable', 0);
 
         $aliases = $user->aliases()->get();
         $this->assertCount(1, $aliases);
         $this->assertSame('useralias1@useraccount.com', $aliases[0]['alias']);
 
         // Add another alias
         $user->setAliases(['UserAlias1@UserAccount.com', 'UserAlias2@UserAccount.com']);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 2);
         Queue::assertPushed(\App\Jobs\PGP\KeyCreateJob::class, 1);
 
         $aliases = $user->aliases()->orderBy('alias')->get();
         $this->assertCount(2, $aliases);
         $this->assertSame('useralias1@useraccount.com', $aliases[0]->alias);
         $this->assertSame('useralias2@useraccount.com', $aliases[1]->alias);
 
         $user->tenant->setSetting('pgp.enable', 1);
 
         // Remove an alias
         $user->setAliases(['UserAlias1@UserAccount.com']);
 
         $user->tenant->setSetting('pgp.enable', 0);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 3);
         Queue::assertPushed(\App\Jobs\PGP\KeyDeleteJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\PGP\KeyDeleteJob::class,
             function ($job) use ($user) {
                 $userId = TestCase::getObjectProperty($job, 'userId');
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 return $userId == $user->id && $userEmail === 'useralias2@useraccount.com';
             }
         );
 
         $aliases = $user->aliases()->get();
         $this->assertCount(1, $aliases);
         $this->assertSame('useralias1@useraccount.com', $aliases[0]['alias']);
 
         // Remove all aliases
         $user->setAliases([]);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 4);
 
         $this->assertCount(0, $user->aliases()->get());
     }
 
     /**
      * Tests for UserSettingsTrait::setSettings() and getSetting() and getSettings()
      */
     public function testUserSettings(): void
     {
         Queue::fake();
         Queue::assertNothingPushed();
 
         $user = $this->getTestUser('UserAccountA@UserAccount.com');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 0);
 
         // Test default settings
         // Note: Technicly this tests UserObserver::created() behavior
         $all_settings = $user->settings()->orderBy('key')->get();
         $this->assertCount(2, $all_settings);
         $this->assertSame('country', $all_settings[0]->key);
         $this->assertSame('CH', $all_settings[0]->value);
         $this->assertSame('currency', $all_settings[1]->key);
         $this->assertSame('CHF', $all_settings[1]->value);
 
         // Add a setting
         $user->setSetting('first_name', 'Firstname');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame('Firstname', $user->getSetting('first_name'));
         $this->assertSame('Firstname', $user->fresh()->getSetting('first_name'));
 
         // Update a setting
         $user->setSetting('first_name', 'Firstname1');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 2);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame('Firstname1', $user->getSetting('first_name'));
         $this->assertSame('Firstname1', $user->fresh()->getSetting('first_name'));
 
         // Delete a setting (null)
         $user->setSetting('first_name', null);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 3);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame(null, $user->getSetting('first_name'));
         $this->assertSame(null, $user->fresh()->getSetting('first_name'));
 
         // Delete a setting (empty string)
         $user->setSetting('first_name', 'Firstname1');
         $user->setSetting('first_name', '');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 5);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame(null, $user->getSetting('first_name'));
         $this->assertSame(null, $user->fresh()->getSetting('first_name'));
 
         // Set multiple settings at once
         $user->setSettings([
                 'first_name' => 'Firstname2',
                 'last_name' => 'Lastname2',
                 'country' => null,
         ]);
 
         // TODO: This really should create a single UserUpdate job, not 3
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 7);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame('Firstname2', $user->getSetting('first_name'));
         $this->assertSame('Firstname2', $user->fresh()->getSetting('first_name'));
         $this->assertSame('Lastname2', $user->getSetting('last_name'));
         $this->assertSame('Lastname2', $user->fresh()->getSetting('last_name'));
         $this->assertSame(null, $user->getSetting('country'));
         $this->assertSame(null, $user->fresh()->getSetting('country'));
 
         $all_settings = $user->settings()->orderBy('key')->get();
         $this->assertCount(3, $all_settings);
 
         // Test getSettings() method
         $this->assertSame(
             [
                 'first_name' => 'Firstname2',
                 'last_name' => 'Lastname2',
                 'unknown' => null,
             ],
             $user->getSettings(['first_name', 'last_name', 'unknown'])
         );
     }
 
     /**
      * Tests for User::users()
      */
     public function testUsers(): void
     {
         $jack = $this->getTestUser('jack@kolab.org');
         $joe = $this->getTestUser('joe@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $wallet = $john->wallets()->first();
 
         $users = $john->users()->orderBy('email')->get();
 
         $this->assertCount(4, $users);
         $this->assertEquals($jack->id, $users[0]->id);
         $this->assertEquals($joe->id, $users[1]->id);
         $this->assertEquals($john->id, $users[2]->id);
         $this->assertEquals($ned->id, $users[3]->id);
 
         $users = $jack->users()->orderBy('email')->get();
 
         $this->assertCount(0, $users);
 
         $users = $ned->users()->orderBy('email')->get();
 
         $this->assertCount(4, $users);
     }
 
     /**
      * Tests for User::walletOwner() (from EntitleableTrait)
      */
     public function testWalletOwner(): void
     {
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         $this->assertSame($john->id, $john->walletOwner()->id);
         $this->assertSame($john->id, $jack->walletOwner()->id);
         $this->assertSame($john->id, $ned->walletOwner()->id);
 
         // User with no entitlements
         $user = $this->getTestUser('UserAccountA@UserAccount.com');
         $this->assertSame($user->id, $user->walletOwner()->id);
     }
 
     /**
      * Tests for User::wallets()
      */
     public function testWallets(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         $this->assertSame(1, $john->wallets()->count());
         $this->assertCount(1, $john->wallets);
         $this->assertInstanceOf(\App\Wallet::class, $john->wallets->first());
 
         $this->assertSame(1, $ned->wallets()->count());
         $this->assertCount(1, $ned->wallets);
         $this->assertInstanceOf(\App\Wallet::class, $ned->wallets->first());
     }
 }
diff --git a/src/tests/Unit/Rules/PasswordTest.php b/src/tests/Unit/Rules/PasswordTest.php
index 2d4379aa..853dc47a 100644
--- a/src/tests/Unit/Rules/PasswordTest.php
+++ b/src/tests/Unit/Rules/PasswordTest.php
@@ -1,182 +1,234 @@
 <?php
 
 namespace Tests\Unit\Rules;
 
 use App\Rules\Password;
+use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Validator;
 use Tests\TestCase;
 
 class PasswordTest extends TestCase
 {
     /**
      * Test password validation
      */
     public function testValidator(): void
     {
         $error = "Specified password does not comply with the policy.";
 
         \config(['app.password_policy' => 'min:5']);
         $this->assertSame($error, $this->validate('abcd'));
         $this->assertSame(null, $this->validate('abcde'));
 
         \config(['app.password_policy' => 'min:5,max:10']);
         $this->assertSame($error, $this->validate('12345678901'));
         $this->assertSame(null, $this->validate('1234567890'));
 
         \config(['app.password_policy' => 'min:5,lower']);
         $this->assertSame($error, $this->validate('12345'));
         $this->assertSame($error, $this->validate('AAAAA'));
         $this->assertSame(null, $this->validate('12345a'));
 
         \config(['app.password_policy' => 'upper']);
         $this->assertSame($error, $this->validate('5'));
         $this->assertSame($error, $this->validate('a'));
         $this->assertSame(null, $this->validate('A'));
 
         \config(['app.password_policy' => 'digit']);
         $this->assertSame($error, $this->validate('a'));
         $this->assertSame($error, $this->validate('A'));
         $this->assertSame(null, $this->validate('5'));
 
         \config(['app.password_policy' => 'special']);
         $this->assertSame($error, $this->validate('a'));
         $this->assertSame($error, $this->validate('5'));
         $this->assertSame(null, $this->validate('*'));
         $this->assertSame(null, $this->validate('-'));
 
         // Test with an account policy
         $user = $this->getTestUser('john@kolab.org');
         $user->setSetting('password_policy', 'min:10,upper');
 
         $this->assertSame($error, $this->validate('aaa', $user));
         $this->assertSame($error, $this->validate('1234567890', $user));
         $this->assertSame(null, $this->validate('1234567890A', $user));
     }
 
     /**
      * Test check() method
      */
     public function testCheck(): void
     {
         $pass = new Password();
 
         \config(['app.password_policy' => 'min:5,max:10,upper,lower,digit']);
         $result = $pass->check('abcd');
 
         $this->assertCount(5, $result);
         $this->assertSame('min', $result['min']['label']);
         $this->assertSame('Minimum password length: 5 characters', $result['min']['name']);
         $this->assertSame('5', $result['min']['param']);
         $this->assertSame(true, $result['min']['enabled']);
         $this->assertSame(false, $result['min']['status']);
 
         $this->assertSame('max', $result['max']['label']);
         $this->assertSame('Maximum password length: 10 characters', $result['max']['name']);
         $this->assertSame('10', $result['max']['param']);
         $this->assertSame(true, $result['max']['enabled']);
         $this->assertSame(true, $result['max']['status']);
 
         $this->assertSame('upper', $result['upper']['label']);
         $this->assertSame('Password contains an upper-case character', $result['upper']['name']);
         $this->assertSame(null, $result['upper']['param']);
         $this->assertSame(true, $result['upper']['enabled']);
         $this->assertSame(false, $result['upper']['status']);
 
         $this->assertSame('lower', $result['lower']['label']);
         $this->assertSame('Password contains a lower-case character', $result['lower']['name']);
         $this->assertSame(null, $result['lower']['param']);
         $this->assertSame(true, $result['lower']['enabled']);
         $this->assertSame(true, $result['lower']['status']);
 
         $this->assertSame('digit', $result['digit']['label']);
         $this->assertSame('Password contains a digit', $result['digit']['name']);
         $this->assertSame(null, $result['digit']['param']);
         $this->assertSame(true, $result['digit']['enabled']);
         $this->assertSame(false, $result['digit']['status']);
+
+        // Test password history check
+        $user = $this->getTestUser('john@kolab.org');
+        $user->passwords()->delete();
+        $user_pass = \App\Utils::generatePassphrase(); // should be the same plain password as John already has
+
+        $pass = new Password(null, $user);
+
+        \config(['app.password_policy' => 'min:5,last:1']);
+
+        $result = $pass->check('abcd');
+
+        $this->assertCount(2, $result);
+        $this->assertSame('min', $result['min']['label']);
+        $this->assertSame('Minimum password length: 5 characters', $result['min']['name']);
+        $this->assertSame('5', $result['min']['param']);
+        $this->assertSame(true, $result['min']['enabled']);
+        $this->assertSame(false, $result['min']['status']);
+
+        $this->assertSame('last', $result['last']['label']);
+        $this->assertSame('Password cannot be the same as the last 1 passwords', $result['last']['name']);
+        $this->assertSame('1', $result['last']['param']);
+        $this->assertSame(true, $result['last']['enabled']);
+        $this->assertSame(true, $result['last']['status']);
+
+        $result = $pass->check($user_pass);
+
+        $this->assertCount(2, $result);
+        $this->assertSame('last', $result['last']['label']);
+        $this->assertSame('Password cannot be the same as the last 1 passwords', $result['last']['name']);
+        $this->assertSame('1', $result['last']['param']);
+        $this->assertSame(true, $result['last']['enabled']);
+        $this->assertSame(false, $result['last']['status']);
+
+        $user->passwords()->create(['password' => Hash::make('1234567891')]);
+        $user->passwords()->create(['password' => Hash::make('1234567890')]);
+
+        $result = $pass->check('1234567890');
+
+        $this->assertSame(true, $result['last']['status']);
+
+        \config(['app.password_policy' => 'min:5,last:3']);
+
+        $result = $pass->check('1234567890');
+
+        $this->assertSame(false, $result['last']['status']);
     }
 
     /**
      * Test rules() method
      */
     public function testRules(): void
     {
         $user = $this->getTestUser('john@kolab.org');
         $user->setSetting('password_policy', 'min:10,upper');
 
         $pass = new Password($user);
 
         \config(['app.password_policy' => 'min:5,max:10,digit']);
 
         $result = $pass->rules();
 
         $this->assertCount(2, $result);
         $this->assertSame('min', $result['min']['label']);
         $this->assertSame('Minimum password length: 10 characters', $result['min']['name']);
         $this->assertSame('10', $result['min']['param']);
         $this->assertSame(true, $result['min']['enabled']);
 
         $this->assertSame('upper', $result['upper']['label']);
         $this->assertSame('Password contains an upper-case character', $result['upper']['name']);
         $this->assertSame(null, $result['upper']['param']);
         $this->assertSame(true, $result['upper']['enabled']);
 
         // Expect to see all supported policy rules
         $result = $pass->rules(true);
 
-        $this->assertCount(6, $result);
+        $this->assertCount(7, $result);
         $this->assertSame('min', $result['min']['label']);
         $this->assertSame('Minimum password length: 10 characters', $result['min']['name']);
         $this->assertSame('10', $result['min']['param']);
         $this->assertSame(true, $result['min']['enabled']);
 
         $this->assertSame('max', $result['max']['label']);
         $this->assertSame('Maximum password length: 255 characters', $result['max']['name']);
         $this->assertSame('255', $result['max']['param']);
         $this->assertSame(false, $result['max']['enabled']);
 
         $this->assertSame('upper', $result['upper']['label']);
         $this->assertSame('Password contains an upper-case character', $result['upper']['name']);
         $this->assertSame(null, $result['upper']['param']);
         $this->assertSame(true, $result['upper']['enabled']);
 
         $this->assertSame('lower', $result['lower']['label']);
         $this->assertSame('Password contains a lower-case character', $result['lower']['name']);
         $this->assertSame(null, $result['lower']['param']);
         $this->assertSame(false, $result['lower']['enabled']);
 
         $this->assertSame('digit', $result['digit']['label']);
         $this->assertSame('Password contains a digit', $result['digit']['name']);
         $this->assertSame(null, $result['digit']['param']);
         $this->assertSame(false, $result['digit']['enabled']);
 
         $this->assertSame('special', $result['special']['label']);
         $this->assertSame('Password contains a special character', $result['special']['name']);
         $this->assertSame(null, $result['digit']['param']);
         $this->assertSame(false, $result['digit']['enabled']);
+
+        $this->assertSame('last', $result['last']['label']);
+        $this->assertSame('Password cannot be the same as the last 3 passwords', $result['last']['name']);
+        $this->assertSame('3', $result['last']['param']);
+        $this->assertSame(false, $result['last']['enabled']);
     }
 
     /**
      * Validates the password using Laravel Validator API
      *
      * @param string     $password The password to validate
-     * @param ?\App\User $user     The account owner
+     * @param ?\App\User $owner    The account owner
      *
      * @return ?string Validation error message on error, NULL otherwise
      */
-    private function validate($password, $user = null): ?string
+    private function validate($password, $owner = null): ?string
     {
         // Instead of doing direct tests, we use validator to make sure
         // it works with the framework api
 
         $v = Validator::make(
             ['password' => $password],
-            ['password' => new Password($user)]
+            ['password' => new Password($owner)]
         );
 
         if ($v->fails()) {
             return $v->errors()->toArray()['password'][0];
         }
 
         return null;
     }
 }