diff --git a/src/.env.example b/src/.env.example
index d51a7ba6..f82c26b8 100644
--- a/src/.env.example
+++ b/src/.env.example
@@ -1,178 +1,180 @@
 APP_NAME=Kolab
 APP_ENV=local
 APP_KEY=
 APP_DEBUG=true
 APP_URL=http://127.0.0.1:8000
 #APP_PASSPHRASE=
 APP_PUBLIC_URL=
 APP_DOMAIN=kolabnow.com
 APP_WEBSITE_DOMAIN=kolabnow.com
 APP_THEME=default
 APP_TENANT_ID=5
 APP_LOCALE=en
 APP_LOCALES=
 
 APP_WITH_ADMIN=1
 APP_WITH_RESELLER=1
 APP_WITH_SERVICES=1
 
 APP_HEADER_CSP="connect-src 'self'; child-src 'self'; font-src 'self'; form-action 'self' data:; frame-ancestors 'self'; img-src blob: data: 'self' *; media-src 'self'; object-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-eval' 'unsafe-inline'; default-src 'self';"
 APP_HEADER_XFO=sameorigin
 
 SIGNUP_LIMIT_EMAIL=0
 SIGNUP_LIMIT_IP=0
 
 ASSET_URL=http://127.0.0.1:8000
 
 WEBMAIL_URL=/apps
 SUPPORT_URL=/support
 SUPPORT_EMAIL=
 
 LOG_CHANNEL=stack
 LOG_SLOW_REQUESTS=5
 
 DB_CONNECTION=mysql
 DB_DATABASE=kolabdev
 DB_HOST=127.0.0.1
 DB_PASSWORD=kolab
 DB_PORT=3306
 DB_USERNAME=kolabdev
 
 BROADCAST_DRIVER=redis
 CACHE_DRIVER=redis
 
 QUEUE_CONNECTION=redis
 
 SESSION_DRIVER=file
 SESSION_LIFETIME=120
 
 OPENEXCHANGERATES_API_KEY="from openexchangerates.org"
 
 MFA_DSN=mysql://roundcube:Welcome2KolabSystems@127.0.0.1/roundcube
 MFA_TOTP_DIGITS=6
 MFA_TOTP_INTERVAL=30
 MFA_TOTP_DIGEST=sha1
 
 IMAP_URI=ssl://127.0.0.1:11993
 IMAP_ADMIN_LOGIN=cyrus-admin
 IMAP_ADMIN_PASSWORD=Welcome2KolabSystems
 IMAP_VERIFY_HOST=false
 IMAP_VERIFY_PEER=false
 
 LDAP_BASE_DN="dc=mgmt,dc=com"
 LDAP_DOMAIN_BASE_DN="ou=Domains,dc=mgmt,dc=com"
 LDAP_HOSTS=127.0.0.1
 LDAP_PORT=389
 LDAP_SERVICE_BIND_DN="uid=kolab-service,ou=Special Users,dc=mgmt,dc=com"
 LDAP_SERVICE_BIND_PW="Welcome2KolabSystems"
 LDAP_USE_SSL=false
 LDAP_USE_TLS=false
 
 # Administrative
 LDAP_ADMIN_BIND_DN="cn=Directory Manager"
 LDAP_ADMIN_BIND_PW="Welcome2KolabSystems"
 LDAP_ADMIN_ROOT_DN="dc=mgmt,dc=com"
 
 # Hosted (public registration)
 LDAP_HOSTED_BIND_DN="uid=hosted-kolab-service,ou=Special Users,dc=mgmt,dc=com"
 LDAP_HOSTED_BIND_PW="Welcome2KolabSystems"
 LDAP_HOSTED_ROOT_DN="dc=hosted,dc=com"
 
 OPENVIDU_API_PASSWORD=MY_SECRET
 OPENVIDU_API_URL=http://localhost:8080/api/
 OPENVIDU_API_USERNAME=OPENVIDUAPP
 OPENVIDU_API_VERIFY_TLS=true
 OPENVIDU_COTURN_IP=127.0.0.1
 OPENVIDU_COTURN_REDIS_DATABASE=2
 OPENVIDU_COTURN_REDIS_IP=127.0.0.1
 OPENVIDU_COTURN_REDIS_PASSWORD=turn
 # Used as COTURN_IP, TURN_PUBLIC_IP, for KMS_TURN_URL
 OPENVIDU_PUBLIC_IP=127.0.0.1
 OPENVIDU_PUBLIC_PORT=3478
 OPENVIDU_SERVER_PORT=8080
 OPENVIDU_WEBHOOK=true
 OPENVIDU_WEBHOOK_ENDPOINT=http://127.0.0.1:8000/webhooks/meet/openvidu
 
 # "CDR" events, see https://docs.openvidu.io/en/2.13.0/reference-docs/openvidu-server-cdr/
 #OPENVIDU_WEBHOOK_EVENTS=[sessionCreated,sessionDestroyed,participantJoined,participantLeft,webrtcConnectionCreated,webrtcConnectionDestroyed,recordingStatusChanged,filterEventDispatched,mediaNodeStatusChanged]
 #OPENVIDU_WEBHOOK_HEADERS=[\"Authorization:\ Basic\ SOMETHING\"]
 
 PGP_ENABLED=
 PGP_BINARY=
 PGP_AGENT=
 PGP_GPGCONF=
 PGP_LENGTH=
 
 # Set these to IP addresses you serve WOAT with.
 # Have the domain owner point _woat.<hosted-domain> NS RRs refer to ns0{1,2}.<provider-domain>
 WOAT_NS1=ns01.domain.tld
 WOAT_NS2=ns02.domain.tld
 
 REDIS_HOST=127.0.0.1
 REDIS_PASSWORD=null
 REDIS_PORT=6379
 
 SWOOLE_HOT_RELOAD_ENABLE=true
 SWOOLE_HTTP_ACCESS_LOG=true
 SWOOLE_HTTP_HOST=127.0.0.1
 SWOOLE_HTTP_PORT=8000
 SWOOLE_HTTP_REACTOR_NUM=1
 SWOOLE_HTTP_WEBSOCKET=true
 SWOOLE_HTTP_WORKER_NUM=1
 SWOOLE_OB_OUTPUT=true
 
 PAYMENT_PROVIDER=
 MOLLIE_KEY=
 STRIPE_KEY=
 STRIPE_PUBLIC_KEY=
 STRIPE_WEBHOOK_SECRET=
 
 MAIL_DRIVER=smtp
 MAIL_HOST=smtp.mailtrap.io
 MAIL_PORT=2525
 MAIL_USERNAME=null
 MAIL_PASSWORD=null
 MAIL_ENCRYPTION=null
 MAIL_FROM_ADDRESS="noreply@example.com"
 MAIL_FROM_NAME="Example.com"
 MAIL_REPLYTO_ADDRESS="replyto@example.com"
 MAIL_REPLYTO_NAME=null
 
 DNS_TTL=3600
 DNS_SPF="v=spf1 mx -all"
 DNS_STATIC="%s.    MX  10 ext-mx01.mykolab.com."
 DNS_COPY_FROM=null
 
 AWS_ACCESS_KEY_ID=
 AWS_SECRET_ACCESS_KEY=
 AWS_DEFAULT_REGION=us-east-1
 AWS_BUCKET=
 
 PUSHER_APP_ID=
 PUSHER_APP_KEY=
 PUSHER_APP_SECRET=
 PUSHER_APP_CLUSTER=mt1
 
 MIX_ASSET_PATH='/'
 MIX_PUSHER_APP_KEY="${PUSHER_APP_KEY}"
 MIX_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}"
 
 # Generate with ./artisan passport:client --password
 #PASSPORT_PROXY_OAUTH_CLIENT_ID=
 #PASSPORT_PROXY_OAUTH_CLIENT_SECRET=
 
 PASSPORT_PRIVATE_KEY=
 PASSPORT_PUBLIC_KEY=
 
+PASSWORD_POLICY=
+
 COMPANY_NAME=
 COMPANY_ADDRESS=
 COMPANY_DETAILS=
 COMPANY_EMAIL=
 COMPANY_LOGO=
 COMPANY_FOOTER=
 
 VAT_COUNTRIES=CH,LI
 VAT_RATE=7.7
 
 KB_ACCOUNT_DELETE=
 KB_ACCOUNT_SUSPENDED=
diff --git a/src/app/Http/Controllers/API/PasswordPolicyController.php b/src/app/Http/Controllers/API/PasswordPolicyController.php
new file mode 100644
index 00000000..475f664f
--- /dev/null
+++ b/src/app/Http/Controllers/API/PasswordPolicyController.php
@@ -0,0 +1,66 @@
+<?php
+
+namespace App\Http\Controllers\API;
+
+use App\Http\Controllers\Controller;
+use App\Rules\Password;
+use Illuminate\Http\Request;
+
+class PasswordPolicyController extends Controller
+{
+    /**
+     * Fetch the password policy for the current user account.
+     * The result includes all supported policy rules.
+     *
+     * @param \Illuminate\Http\Request $request
+     *
+     * @return \Illuminate\Http\JsonResponse
+     */
+    public function index(Request $request)
+    {
+        // Get the account owner
+        $owner = $this->guard()->user()->walletOwner();
+
+        // Get the policy
+        $policy = new Password($owner);
+        $rules = $policy->rules(true);
+
+        return response()->json([
+                'list' => array_values($rules),
+                'count' => count($rules),
+        ]);
+    }
+
+    /**
+     * Validate the password regarding the defined policies.
+     *
+     * @param \Illuminate\Http\Request $request
+     *
+     * @return \Illuminate\Http\JsonResponse
+     */
+    public function check(Request $request)
+    {
+        $userId = $request->input('user');
+
+        $user = !empty($userId) ? \App\User::find($userId) : null;
+
+        // Get the policy
+        $policy = new Password($user ? $user->walletOwner() : null);
+
+        // Check the password
+        $status = $policy->check($request->input('password'));
+
+        $passed = array_filter(
+            $status,
+            function ($rule) {
+                return !empty($rule['status']);
+            }
+        );
+
+        return response()->json([
+                'status' => count($passed) == count($status) ? 'success' : 'error',
+                'list' => array_values($status),
+                'count' => count($status),
+        ]);
+    }
+}
diff --git a/src/app/Http/Controllers/API/PasswordResetController.php b/src/app/Http/Controllers/API/PasswordResetController.php
index 00d57df6..0274dd8e 100644
--- a/src/app/Http/Controllers/API/PasswordResetController.php
+++ b/src/app/Http/Controllers/API/PasswordResetController.php
@@ -1,206 +1,208 @@
 <?php
 
 namespace App\Http\Controllers\API;
 
 use App\Http\Controllers\Controller;
 use App\Jobs\PasswordResetEmail;
+use App\Rules\Password;
 use App\User;
 use App\VerificationCode;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Support\Str;
 
 /**
  * Password reset API
  */
 class PasswordResetController extends Controller
 {
     /** @var \App\VerificationCode A verification code object */
     protected $code;
 
 
     /**
      * Sends password reset code to the user's external email
      *
      * Verifies user email, sends verification email message.
      *
      * @param \Illuminate\Http\Request $request HTTP request
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function init(Request $request)
     {
         // Check required fields
         $v = Validator::make($request->all(), ['email' => 'required|email']);
 
         if ($v->fails()) {
             return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
         }
 
         // Find a user by email
         $user = User::findByEmail($request->email);
 
         if (!$user) {
             $errors = ['email' => \trans('validation.usernotexists')];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         if (!$user->getSetting('external_email')) {
             $errors = ['email' => \trans('validation.noextemail')];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         // Generate the verification code
         $code = new VerificationCode(['mode' => 'password-reset']);
         $user->verificationcodes()->save($code);
 
         // Send email/sms message
         PasswordResetEmail::dispatch($code);
 
         return response()->json(['status' => 'success', 'code' => $code->code]);
     }
 
     /**
      * Validation of the verification code.
      *
      * @param \Illuminate\Http\Request $request HTTP request
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function verify(Request $request)
     {
         // Validate the request args
         $v = Validator::make(
             $request->all(),
             [
                 'code' => 'required',
                 'short_code' => 'required',
             ]
         );
 
         if ($v->fails()) {
             return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
         }
 
         // Validate the verification code
         $code = VerificationCode::where('code', $request->code)->where('active', true)->first();
 
         if (
             empty($code)
             || $code->isExpired()
             || $code->mode !== 'password-reset'
             || Str::upper($request->short_code) !== Str::upper($code->short_code)
         ) {
             $errors = ['short_code' => "The code is invalid or expired."];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         // For last-step remember the code object, so we can delete it
         // with single SQL query (->delete()) instead of two (::destroy())
         $this->code = $code;
 
-        // Return user name and email/phone from the codes database on success
-        return response()->json(['status' => 'success']);
+        return response()->json([
+                'status' => 'success',
+                // we need user's ID for e.g. password policy checks
+                'userId' => $code->user_id,
+        ]);
     }
 
     /**
      * Password change
      *
      * @param \Illuminate\Http\Request $request HTTP request
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function reset(Request $request)
     {
-        // Validate the request args
+        $v = $this->verify($request);
+        if ($v->status() !== 200) {
+            return $v;
+        }
+
+        $user = $this->code->user;
+
+        // Validate the password
         $v = Validator::make(
             $request->all(),
-            [
-                'password' => 'required|min:4|confirmed',
-            ]
+            ['password' => ['required', 'confirmed', new Password($user->walletOwner())]]
         );
 
         if ($v->fails()) {
             return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
         }
 
-        $v = $this->verify($request);
-        if ($v->status() !== 200) {
-            return $v;
-        }
-
-        $user = $this->code->user;
-
         // Change the user password
         $user->setPasswordAttribute($request->password);
         $user->save();
 
         // Remove the verification code
         $this->code->delete();
 
         return AuthController::logonResponse($user, $request->password);
     }
 
     /**
      * Create a verification code for the current user.
      *
      * @param \Illuminate\Http\Request $request HTTP request
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function codeCreate(Request $request)
     {
         // Generate the verification code
         $code = new VerificationCode();
         $code->mode = 'password-reset';
 
         // These codes are valid for 24 hours
         $code->expires_at = now()->addHours(24);
 
         // The code is inactive until it is submitted via a different endpoint
         $code->active = false;
 
         $this->guard()->user()->verificationcodes()->save($code);
 
         return response()->json([
                 'status' => 'success',
                 'code' => $code->code,
                 'short_code' => $code->short_code,
                 'expires_at' => $code->expires_at->toDateTimeString(),
         ]);
     }
 
     /**
      * Delete a verification code.
      *
      * @param string $id Code identifier
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function codeDelete($id)
     {
         // Accept <short-code>-<code> input
         if (strpos($id, '-')) {
             $id = explode('-', $id)[1];
         }
 
         $code = VerificationCode::find($id);
 
         if (!$code) {
             return $this->errorResponse(404);
         }
 
         $current_user = $this->guard()->user();
 
         if (empty($code->user) || !$current_user->canUpdate($code->user)) {
             return $this->errorResponse(403);
         }
 
         $code->delete();
 
         return response()->json([
                 'status' => 'success',
                 'message' => \trans('app.password-reset-code-delete-success'),
         ]);
     }
 }
diff --git a/src/app/Http/Controllers/API/SignupController.php b/src/app/Http/Controllers/API/SignupController.php
index 8a84238f..f1f2cbe9 100644
--- a/src/app/Http/Controllers/API/SignupController.php
+++ b/src/app/Http/Controllers/API/SignupController.php
@@ -1,448 +1,449 @@
 <?php
 
 namespace App\Http\Controllers\API;
 
 use App\Http\Controllers\Controller;
 use App\Jobs\SignupVerificationEmail;
 use App\Jobs\SignupVerificationSMS;
 use App\Discount;
 use App\Domain;
 use App\Plan;
 use App\Rules\SignupExternalEmail;
+use App\Rules\Password;
 use App\Rules\UserEmailDomain;
 use App\Rules\UserEmailLocal;
 use App\SignupCode;
 use App\SignupInvitation;
 use App\User;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Support\Str;
 
 /**
  * Signup process API
  */
 class SignupController extends Controller
 {
     /** @var ?\App\SignupCode A verification code object */
     protected $code;
 
     /** @var ?\App\Plan Signup plan object */
     protected $plan;
 
 
     /**
      * Returns plans definitions for signup.
      *
      * @param \Illuminate\Http\Request $request HTTP request
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function plans(Request $request)
     {
         $plans = [];
 
         // Use reverse order just to have individual on left, group on right ;)
         Plan::withEnvTenantContext()->orderByDesc('title')->get()
             ->map(function ($plan) use (&$plans) {
                 $plans[] = [
                     'title' => $plan->title,
                     'name' => $plan->name,
                     'button' => \trans('app.planbutton', ['plan' => $plan->name]),
                     'description' => $plan->description,
                 ];
             });
 
         return response()->json(['status' => 'success', 'plans' => $plans]);
     }
 
     /**
      * Starts signup process.
      *
      * Verifies user name and email/phone, sends verification email/sms message.
      * Returns the verification code.
      *
      * @param \Illuminate\Http\Request $request HTTP request
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function init(Request $request)
     {
         // Check required fields
         $v = Validator::make(
             $request->all(),
             [
                 'email' => 'required',
                 'first_name' => 'max:128',
                 'last_name' => 'max:128',
                 'plan' => 'nullable|alpha_num|max:128',
                 'voucher' => 'max:32',
             ]
         );
 
         $is_phone = false;
         $errors = $v->fails() ? $v->errors()->toArray() : [];
 
         // Validate user email (or phone)
         if (empty($errors['email'])) {
             if ($error = $this->validatePhoneOrEmail($request->email, $is_phone)) {
                 $errors['email'] = $error;
             }
         }
 
         if (!empty($errors)) {
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         // Generate the verification code
         $code = SignupCode::create([
                 'email' => $request->email,
                 'first_name' => $request->first_name,
                 'last_name' => $request->last_name,
                 'plan' => $request->plan,
                 'voucher' => $request->voucher,
         ]);
 
         // Send email/sms message
         if ($is_phone) {
             SignupVerificationSMS::dispatch($code);
         } else {
             SignupVerificationEmail::dispatch($code);
         }
 
         return response()->json(['status' => 'success', 'code' => $code->code]);
     }
 
     /**
      * Returns signup invitation information.
      *
      * @param string $id Signup invitation identifier
      *
      * @return \Illuminate\Http\JsonResponse|void
      */
     public function invitation($id)
     {
         $invitation = SignupInvitation::withEnvTenantContext()->find($id);
 
         if (empty($invitation) || $invitation->isCompleted()) {
             return $this->errorResponse(404);
         }
 
         $has_domain = $this->getPlan()->hasDomain();
 
         $result = [
             'id' => $id,
             'is_domain' => $has_domain,
             'domains' => $has_domain ? [] : Domain::getPublicDomains(),
         ];
 
         return response()->json($result);
     }
 
 
     /**
      * Validation of the verification code.
      *
      * @param \Illuminate\Http\Request $request HTTP request
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function verify(Request $request)
     {
         // Validate the request args
         $v = Validator::make(
             $request->all(),
             [
                 'code' => 'required',
                 'short_code' => 'required',
             ]
         );
 
         if ($v->fails()) {
             return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
         }
 
         // Validate the verification code
         $code = SignupCode::find($request->code);
 
         if (
             empty($code)
             || $code->isExpired()
             || Str::upper($request->short_code) !== Str::upper($code->short_code)
         ) {
             $errors = ['short_code' => "The code is invalid or expired."];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         // For signup last-step mode remember the code object, so we can delete it
         // with single SQL query (->delete()) instead of two (::destroy())
         $this->code = $code;
 
         $has_domain = $this->getPlan()->hasDomain();
 
         // Return user name and email/phone/voucher from the codes database,
         // domains list for selection and "plan type" flag
         return response()->json([
                 'status' => 'success',
                 'email' => $code->email,
                 'first_name' => $code->first_name,
                 'last_name' => $code->last_name,
                 'voucher' => $code->voucher,
                 'is_domain' => $has_domain,
                 'domains' => $has_domain ? [] : Domain::getPublicDomains(),
         ]);
     }
 
     /**
      * Finishes the signup process by creating the user account.
      *
      * @param \Illuminate\Http\Request $request HTTP request
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function signup(Request $request)
     {
         // Validate input
         $v = Validator::make(
             $request->all(),
             [
                 'login' => 'required|min:2',
-                'password' => 'required|min:4|confirmed',
+                'password' => ['required', 'confirmed', new Password()],
                 'domain' => 'required',
                 'voucher' => 'max:32',
             ]
         );
 
         if ($v->fails()) {
             return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
         }
 
         // Signup via invitation
         if ($request->invitation) {
             $invitation = SignupInvitation::withEnvTenantContext()->find($request->invitation);
 
             if (empty($invitation) || $invitation->isCompleted()) {
                 return $this->errorResponse(404);
             }
 
             // Check required fields
             $v = Validator::make(
                 $request->all(),
                 [
                     'first_name' => 'max:128',
                     'last_name' => 'max:128',
                     'voucher' => 'max:32',
                 ]
             );
 
             $errors = $v->fails() ? $v->errors()->toArray() : [];
 
             if (!empty($errors)) {
                 return response()->json(['status' => 'error', 'errors' => $errors], 422);
             }
 
             $settings = [
                 'external_email' => $invitation->email,
                 'first_name' => $request->first_name,
                 'last_name' => $request->last_name,
             ];
         } else {
             // Validate verification codes (again)
             $v = $this->verify($request);
             if ($v->status() !== 200) {
                 return $v;
             }
 
             // Get user name/email from the verification code database
             $code_data = $v->getData();
 
             $settings = [
                 'external_email' => $code_data->email,
                 'first_name' => $code_data->first_name,
                 'last_name' => $code_data->last_name,
             ];
         }
 
         // Find the voucher discount
         if ($request->voucher) {
             $discount = Discount::where('code', \strtoupper($request->voucher))
                 ->where('active', true)->first();
 
             if (!$discount) {
                 $errors = ['voucher' => \trans('validation.voucherinvalid')];
                 return response()->json(['status' => 'error', 'errors' => $errors], 422);
             }
         }
 
         // Get the plan
         $plan = $this->getPlan();
         $is_domain = $plan->hasDomain();
 
         $login = $request->login;
         $domain_name = $request->domain;
 
         // Validate login
         if ($errors = self::validateLogin($login, $domain_name, $is_domain)) {
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         // We allow only ASCII, so we can safely lower-case the email address
         $login = Str::lower($login);
         $domain_name = Str::lower($domain_name);
         $domain = null;
 
         DB::beginTransaction();
 
         // Create domain record
         if ($is_domain) {
             $domain = Domain::create([
                     'namespace' => $domain_name,
                     'status' => Domain::STATUS_NEW,
                     'type' => Domain::TYPE_EXTERNAL,
             ]);
         }
 
         // Create user record
         $user = User::create([
                 'email' => $login . '@' . $domain_name,
                 'password' => $request->password,
         ]);
 
         if (!empty($discount)) {
             $wallet = $user->wallets()->first();
             $wallet->discount()->associate($discount);
             $wallet->save();
         }
 
         $user->assignPlan($plan, $domain);
 
         // Save the external email and plan in user settings
         $user->setSettings($settings);
 
         // Update the invitation
         if (!empty($invitation)) {
             $invitation->status = SignupInvitation::STATUS_COMPLETED;
             $invitation->user_id = $user->id;
             $invitation->save();
         }
 
         // Remove the verification code
         if ($this->code) {
             $this->code->delete();
         }
 
         DB::commit();
 
         return AuthController::logonResponse($user, $request->password);
     }
 
     /**
      * Returns plan for the signup process
      *
      * @returns \App\Plan Plan object selected for current signup process
      */
     protected function getPlan()
     {
         if (!$this->plan) {
             // Get the plan if specified and exists...
             if ($this->code && $this->code->plan) {
                 $plan = Plan::withEnvTenantContext()->where('title', $this->code->plan)->first();
             }
 
             // ...otherwise use the default plan
             if (empty($plan)) {
                 // TODO: Get default plan title from config
                 $plan = Plan::withEnvTenantContext()->where('title', 'individual')->first();
             }
 
             $this->plan = $plan;
         }
 
         return $this->plan;
     }
 
     /**
      * Checks if the input string is a valid email address or a phone number
      *
      * @param string $input    Email address or phone number
      * @param bool   $is_phone Will have been set to True if the string is valid phone number
      *
      * @return string Error message on validation error
      */
     protected static function validatePhoneOrEmail($input, &$is_phone = false): ?string
     {
         $is_phone = false;
 
         $v = Validator::make(
             ['email' => $input],
             ['email' => ['required', 'string', new SignupExternalEmail()]]
         );
 
         if ($v->fails()) {
             return $v->errors()->toArray()['email'][0];
         }
 
         // TODO: Phone number support
 /*
         $input = str_replace(array('-', ' '), '', $input);
 
         if (!preg_match('/^\+?[0-9]{9,12}$/', $input)) {
             return \trans('validation.noemailorphone');
         }
 
         $is_phone = true;
 */
         return null;
     }
 
     /**
      * Login (kolab identity) validation
      *
      * @param string $login    Login (local part of an email address)
      * @param string $domain   Domain name
      * @param bool   $external Enables additional checks for domain part
      *
      * @return array Error messages on validation error
      */
     protected static function validateLogin($login, $domain, $external = false): ?array
     {
         // Validate login part alone
         $v = Validator::make(
             ['login' => $login],
             ['login' => ['required', 'string', new UserEmailLocal($external)]]
         );
 
         if ($v->fails()) {
             return ['login' => $v->errors()->toArray()['login'][0]];
         }
 
         $domains = $external ? null : Domain::getPublicDomains();
 
         // Validate the domain
         $v = Validator::make(
             ['domain' => $domain],
             ['domain' => ['required', 'string', new UserEmailDomain($domains)]]
         );
 
         if ($v->fails()) {
             return ['domain' => $v->errors()->toArray()['domain'][0]];
         }
 
         $domain = Str::lower($domain);
 
         // Check if domain is already registered with us
         if ($external) {
             if (Domain::where('namespace', $domain)->first()) {
                 return ['domain' => \trans('validation.domainexists')];
             }
         }
 
         // Check if user with specified login already exists
         $email = $login . '@' . $domain;
         if (User::emailExists($email) || User::aliasExists($email) || \App\Group::emailExists($email)) {
             return ['login' => \trans('validation.loginexists')];
         }
 
         return null;
     }
 }
diff --git a/src/app/Http/Controllers/API/V4/UsersController.php b/src/app/Http/Controllers/API/V4/UsersController.php
index 22d94552..5eb4e0ca 100644
--- a/src/app/Http/Controllers/API/V4/UsersController.php
+++ b/src/app/Http/Controllers/API/V4/UsersController.php
@@ -1,775 +1,773 @@
 <?php
 
 namespace App\Http\Controllers\API\V4;
 
 use App\Http\Controllers\RelationController;
 use App\Domain;
 use App\Group;
+use App\Rules\Password;
 use App\Rules\UserEmailDomain;
 use App\Rules\UserEmailLocal;
 use App\Sku;
 use App\User;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Support\Str;
 
 class UsersController extends RelationController
 {
     /** @const array List of user setting keys available for modification in UI */
     public const USER_SETTINGS = [
         'billing_address',
         'country',
         'currency',
         'external_email',
         'first_name',
         'last_name',
         'organization',
         'phone',
     ];
 
     /**
      * On user create it is filled with a user or group object to force-delete
      * before the creation of a new user record is possible.
      *
      * @var \App\User|\App\Group|null
      */
     protected $deleteBeforeCreate;
 
     /** @var string Resource localization label */
     protected $label = 'user';
 
     /** @var string Resource model name */
     protected $model = User::class;
 
     /** @var array Common object properties in the API response */
     protected $objectProps = ['email'];
 
     /** @var ?\App\VerificationCode Password reset code to activate on user create/update */
     protected $passCode;
 
     /**
      * Listing of users.
      *
      * The user-entitlements billed to the current user wallet(s)
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function index()
     {
         $user = $this->guard()->user();
         $search = trim(request()->input('search'));
         $page = intval(request()->input('page')) ?: 1;
         $pageSize = 20;
         $hasMore = false;
 
         $result = $user->users();
 
         // Search by user email, alias or name
         if (strlen($search) > 0) {
             // thanks to cloning we skip some extra queries in $user->users()
             $allUsers1 = clone $result;
             $allUsers2 = clone $result;
 
             $result->whereLike('email', $search)
                 ->union(
                     $allUsers1->join('user_aliases', 'users.id', '=', 'user_aliases.user_id')
                         ->whereLike('alias', $search)
                 )
                 ->union(
                     $allUsers2->join('user_settings', 'users.id', '=', 'user_settings.user_id')
                         ->whereLike('value', $search)
                         ->whereIn('key', ['first_name', 'last_name'])
                 );
         }
 
         $result = $result->orderBy('email')
             ->limit($pageSize + 1)
             ->offset($pageSize * ($page - 1))
             ->get();
 
         if (count($result) > $pageSize) {
             $result->pop();
             $hasMore = true;
         }
 
         // Process the result
         $result = $result->map(
             function ($user) {
                 return $this->objectToClient($user);
             }
         );
 
         $result = [
             'list' => $result,
             'count' => count($result),
             'hasMore' => $hasMore,
         ];
 
         return response()->json($result);
     }
 
     /**
      * Display information on the user account specified by $id.
      *
      * @param string $id The account to show information for.
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function show($id)
     {
         $user = User::find($id);
 
         if (!$this->checkTenant($user)) {
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canRead($user)) {
             return $this->errorResponse(403);
         }
 
         $response = $this->userResponse($user);
 
         $response['skus'] = \App\Entitlement::objectEntitlementsSummary($user);
         $response['config'] = $user->getConfig();
 
         $code = $user->verificationcodes()->where('active', true)
             ->where('expires_at', '>', \Carbon\Carbon::now())
             ->first();
 
         if ($code) {
             $response['passwordLinkCode'] = $code->short_code . '-' . $code->code;
         }
 
         return response()->json($response);
     }
 
     /**
      * User status (extended) information
      *
      * @param \App\User $user User object
      *
      * @return array Status information
      */
     public static function statusInfo($user): array
     {
         $process = self::processStateInfo(
             $user,
             [
                 'user-new' => true,
                 'user-ldap-ready' => $user->isLdapReady(),
                 'user-imap-ready' => $user->isImapReady(),
             ]
         );
 
         // Check if the user is a controller of his wallet
         $isController = $user->canDelete($user);
         $hasCustomDomain = $user->wallet()->entitlements()
             ->where('entitleable_type', Domain::class)
             ->count() > 0;
 
         // Get user's entitlements titles
         $skus = $user->entitlements()->select('skus.title')
             ->join('skus', 'skus.id', '=', 'entitlements.sku_id')
             ->get()
             ->pluck('title')
             ->sort()
             ->unique()
             ->values()
             ->all();
 
         $result = [
             'skus' => $skus,
             // TODO: This will change when we enable all users to create domains
             'enableDomains' => $isController && $hasCustomDomain,
             // TODO: Make 'enableDistlists' working for wallet controllers that aren't account owners
             'enableDistlists' => $isController && $hasCustomDomain && in_array('beta-distlists', $skus),
             // TODO: Make 'enableFolders' working for wallet controllers that aren't account owners
             'enableFolders' => $isController && $hasCustomDomain && in_array('beta-shared-folders', $skus),
             // TODO: Make 'enableResources' working for wallet controllers that aren't account owners
             'enableResources' => $isController && $hasCustomDomain && in_array('beta-resources', $skus),
+            'enableSettings' => $isController,
             'enableUsers' => $isController,
             'enableWallets' => $isController,
         ];
 
         return array_merge($process, $result);
     }
 
     /**
      * Create a new user record.
      *
      * @param \Illuminate\Http\Request $request The API request.
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function store(Request $request)
     {
         $current_user = $this->guard()->user();
         $owner = $current_user->wallet()->owner;
 
         if ($owner->id != $current_user->id) {
             return $this->errorResponse(403);
         }
 
         $this->deleteBeforeCreate = null;
 
         if ($error_response = $this->validateUserRequest($request, null, $settings)) {
             return $error_response;
         }
 
         if (empty($request->package) || !($package = \App\Package::withEnvTenantContext()->find($request->package))) {
             $errors = ['package' => \trans('validation.packagerequired')];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         if ($package->isDomain()) {
             $errors = ['package' => \trans('validation.packageinvalid')];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         DB::beginTransaction();
 
         // @phpstan-ignore-next-line
         if ($this->deleteBeforeCreate) {
             $this->deleteBeforeCreate->forceDelete();
         }
 
         // Create user record
         $user = User::create([
                 'email' => $request->email,
                 'password' => $request->password,
         ]);
 
         $this->activatePassCode($user);
 
         $owner->assignPackage($package, $user);
 
         if (!empty($settings)) {
             $user->setSettings($settings);
         }
 
         if (!empty($request->aliases)) {
             $user->setAliases($request->aliases);
         }
 
         DB::commit();
 
         return response()->json([
                 'status' => 'success',
                 'message' => \trans('app.user-create-success'),
         ]);
     }
 
     /**
      * Update user data.
      *
      * @param \Illuminate\Http\Request $request The API request.
      * @param string                   $id      User identifier
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function update(Request $request, $id)
     {
         $user = User::withEnvTenantContext()->find($id);
 
         if (empty($user)) {
             return $this->errorResponse(404);
         }
 
         $current_user = $this->guard()->user();
 
         // TODO: Decide what attributes a user can change on his own profile
         if (!$current_user->canUpdate($user)) {
             return $this->errorResponse(403);
         }
 
         if ($error_response = $this->validateUserRequest($request, $user, $settings)) {
             return $error_response;
         }
 
         // Entitlements, only controller can do that
         if ($request->skus !== null && !$current_user->canDelete($user)) {
             return $this->errorResponse(422, "You have no permission to change entitlements");
         }
 
         DB::beginTransaction();
 
         $this->updateEntitlements($user, $request->skus);
 
         if (!empty($settings)) {
             $user->setSettings($settings);
         }
 
         if (!empty($request->password)) {
             $user->password = $request->password;
             $user->save();
         }
 
         $this->activatePassCode($user);
 
         if (isset($request->aliases)) {
             $user->setAliases($request->aliases);
         }
 
-        // TODO: Make sure that UserUpdate job is created in case of entitlements update
-        //       and no password change. So, for example quota change is applied to LDAP
-        // TODO: Review use of $user->save() in the above context
-
         DB::commit();
 
         $response = [
             'status' => 'success',
             'message' => \trans('app.user-update-success'),
         ];
 
         // For self-update refresh the statusInfo in the UI
         if ($user->id == $current_user->id) {
             $response['statusInfo'] = self::statusInfo($user);
         }
 
         return response()->json($response);
     }
 
     /**
      * Update user entitlements.
      *
      * @param \App\User $user  The user
      * @param array     $rSkus List of SKU IDs requested for the user in the form [id=>qty]
      */
     protected function updateEntitlements(User $user, $rSkus)
     {
         if (!is_array($rSkus)) {
             return;
         }
 
         // list of skus, [id=>obj]
         $skus = Sku::withEnvTenantContext()->get()->mapWithKeys(
             function ($sku) {
                 return [$sku->id => $sku];
             }
         );
 
         // existing entitlement's SKUs
         $eSkus = [];
 
         $user->entitlements()->groupBy('sku_id')
             ->selectRaw('count(*) as total, sku_id')->each(
                 function ($e) use (&$eSkus) {
                     $eSkus[$e->sku_id] = $e->total;
                 }
             );
 
         foreach ($skus as $skuID => $sku) {
             $e = array_key_exists($skuID, $eSkus) ? $eSkus[$skuID] : 0;
             $r = array_key_exists($skuID, $rSkus) ? $rSkus[$skuID] : 0;
 
             if ($sku->handler_class == \App\Handlers\Mailbox::class) {
                 if ($r != 1) {
                     throw new \Exception("Invalid quantity of mailboxes");
                 }
             }
 
             if ($e > $r) {
                 // remove those entitled more than existing
                 $user->removeSku($sku, ($e - $r));
             } elseif ($e < $r) {
                 // add those requested more than entitled
                 $user->assignSku($sku, ($r - $e));
             }
         }
     }
 
     /**
      * Create a response data array for specified user.
      *
      * @param \App\User $user User object
      *
      * @return array Response data
      */
     public static function userResponse(User $user): array
     {
         $response = array_merge($user->toArray(), self::objectState($user));
 
         // Settings
         $response['settings'] = [];
         foreach ($user->settings()->whereIn('key', self::USER_SETTINGS)->get() as $item) {
             $response['settings'][$item->key] = $item->value;
         }
 
         // Aliases
         $response['aliases'] = [];
         foreach ($user->aliases as $item) {
             $response['aliases'][] = $item->alias;
         }
 
         // Status info
         $response['statusInfo'] = self::statusInfo($user);
 
         // Add more info to the wallet object output
         $map_func = function ($wallet) use ($user) {
             $result = $wallet->toArray();
 
             if ($wallet->discount) {
                 $result['discount'] = $wallet->discount->discount;
                 $result['discount_description'] = $wallet->discount->description;
             }
 
             if ($wallet->user_id != $user->id) {
                 $result['user_email'] = $wallet->owner->email;
             }
 
             $provider = \App\Providers\PaymentProvider::factory($wallet);
             $result['provider'] = $provider->name();
 
             return $result;
         };
 
         // Information about wallets and accounts for access checks
         $response['wallets'] = $user->wallets->map($map_func)->toArray();
         $response['accounts'] = $user->accounts->map($map_func)->toArray();
         $response['wallet'] = $map_func($user->wallet());
 
         return $response;
     }
 
     /**
      * Prepare user statuses for the UI
      *
      * @param \App\User $user User object
      *
      * @return array Statuses array
      */
     protected static function objectState($user): array
     {
         $state = parent::objectState($user);
 
         $state['isAccountDegraded'] = $user->isDegraded(true);
 
         return $state;
     }
 
     /**
      * Validate user input
      *
      * @param \Illuminate\Http\Request $request  The API request.
      * @param \App\User|null           $user     User identifier
      * @param array                    $settings User settings (from the request)
      *
      * @return \Illuminate\Http\JsonResponse|null The error response on error
      */
     protected function validateUserRequest(Request $request, $user, &$settings = [])
     {
         $rules = [
             'external_email' => 'nullable|email',
             'phone' => 'string|nullable|max:64|regex:/^[0-9+() -]+$/',
             'first_name' => 'string|nullable|max:128',
             'last_name' => 'string|nullable|max:128',
             'organization' => 'string|nullable|max:512',
             'billing_address' => 'string|nullable|max:1024',
             'country' => 'string|nullable|alpha|size:2',
             'currency' => 'string|nullable|alpha|size:3',
             'aliases' => 'array|nullable',
         ];
 
+        $controller = ($user ?: $this->guard()->user())->walletOwner();
+
         // Handle generated password reset code
         if ($code = $request->input('passwordLinkCode')) {
             // Accept <short-code>-<code> input
             if (strpos($code, '-')) {
                 $code = explode('-', $code)[1];
             }
 
             $this->passCode = $this->guard()->user()->verificationcodes()
                 ->where('code', $code)->where('active', false)->first();
 
             // Generate a password for a new user with password reset link
             // FIXME: Should/can we have a user with no password set?
             if ($this->passCode && empty($user)) {
                 $request->password = $request->password_confirmation = Str::random(16);
                 $ignorePassword = true;
             }
         }
 
         if (empty($user) || !empty($request->password) || !empty($request->password_confirmation)) {
             if (empty($ignorePassword)) {
-                $rules['password'] = 'required|min:6|max:255|confirmed';
+                $rules['password'] = ['required', 'confirmed', new Password($controller)];
             }
         }
 
         $errors = [];
 
         // Validate input
         $v = Validator::make($request->all(), $rules);
 
         if ($v->fails()) {
             $errors = $v->errors()->toArray();
         }
 
-        $controller = $user ? $user->wallet()->owner : $this->guard()->user();
-
         // For new user validate email address
         if (empty($user)) {
             $email = $request->email;
 
             if (empty($email)) {
                 $errors['email'] = \trans('validation.required', ['attribute' => 'email']);
             } elseif ($error = self::validateEmail($email, $controller, $this->deleteBeforeCreate)) {
                 $errors['email'] = $error;
             }
         }
 
         // Validate aliases input
         if (isset($request->aliases)) {
             $aliases = [];
             $existing_aliases = $user ? $user->aliases()->get()->pluck('alias')->toArray() : [];
 
             foreach ($request->aliases as $idx => $alias) {
                 if (is_string($alias) && !empty($alias)) {
                     // Alias cannot be the same as the email address (new user)
                     if (!empty($email) && Str::lower($alias) == Str::lower($email)) {
                         continue;
                     }
 
                     // validate new aliases
                     if (
                         !in_array($alias, $existing_aliases)
                         && ($error = self::validateAlias($alias, $controller))
                     ) {
                         if (!isset($errors['aliases'])) {
                             $errors['aliases'] = [];
                         }
                         $errors['aliases'][$idx] = $error;
                         continue;
                     }
 
                     $aliases[] = $alias;
                 }
             }
 
             $request->aliases = $aliases;
         }
 
         if (!empty($errors)) {
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         // Update user settings
         $settings = $request->only(array_keys($rules));
         unset($settings['password'], $settings['aliases'], $settings['email']);
 
         return null;
     }
 
     /**
      * Execute (synchronously) specified step in a user setup process.
      *
      * @param \App\User $user User object
      * @param string    $step Step identifier (as in self::statusInfo())
      *
      * @return bool|null True if the execution succeeded, False if not, Null when
      *                   the job has been sent to the worker (result unknown)
      */
     public static function execProcessStep(User $user, string $step): ?bool
     {
         try {
             if (strpos($step, 'domain-') === 0) {
                 list ($local, $domain) = explode('@', $user->email);
                 $domain = Domain::where('namespace', $domain)->first();
 
                 return DomainsController::execProcessStep($domain, $step);
             }
 
             switch ($step) {
                 case 'user-ldap-ready':
                     // User not in LDAP, create it
                     $job = new \App\Jobs\User\CreateJob($user->id);
                     $job->handle();
 
                     $user->refresh();
 
                     return $user->isLdapReady();
 
                 case 'user-imap-ready':
                     // User not in IMAP? Verify again
                     // Do it synchronously if the imap admin credentials are available
                     // otherwise let the worker do the job
                     if (!\config('imap.admin_password')) {
                         \App\Jobs\User\VerifyJob::dispatch($user->id);
 
                         return null;
                     }
 
                     $job = new \App\Jobs\User\VerifyJob($user->id);
                     $job->handle();
 
                     $user->refresh();
 
                     return $user->isImapReady();
             }
         } catch (\Exception $e) {
             \Log::error($e);
         }
 
         return false;
     }
 
     /**
      * Email address validation for use as a user mailbox (login).
      *
      * @param string                    $email   Email address
      * @param \App\User                 $user    The account owner
      * @param null|\App\User|\App\Group $deleted Filled with an instance of a deleted user or group
      *                                           with the specified email address, if exists
      *
      * @return ?string Error message on validation error
      */
     public static function validateEmail(string $email, \App\User $user, &$deleted = null): ?string
     {
         $deleted = null;
 
         if (strpos($email, '@') === false) {
             return \trans('validation.entryinvalid', ['attribute' => 'email']);
         }
 
         list($login, $domain) = explode('@', Str::lower($email));
 
         if (strlen($login) === 0 || strlen($domain) === 0) {
             return \trans('validation.entryinvalid', ['attribute' => 'email']);
         }
 
         // Check if domain exists
         $domain = Domain::withObjectTenantContext($user)->where('namespace', $domain)->first();
 
         if (empty($domain)) {
             return \trans('validation.domaininvalid');
         }
 
         // Validate login part alone
         $v = Validator::make(
             ['email' => $login],
             ['email' => ['required', new UserEmailLocal(!$domain->isPublic())]]
         );
 
         if ($v->fails()) {
             return $v->errors()->toArray()['email'][0];
         }
 
         // Check if it is one of domains available to the user
         if (!$user->domains()->where('namespace', $domain->namespace)->exists()) {
             return \trans('validation.entryexists', ['attribute' => 'domain']);
         }
 
         // Check if a user with specified address already exists
         if ($existing_user = User::emailExists($email, true)) {
             // If this is a deleted user in the same custom domain
             // we'll force delete him before
             if (!$domain->isPublic() && $existing_user->trashed()) {
                 $deleted = $existing_user;
             } else {
                 return \trans('validation.entryexists', ['attribute' => 'email']);
             }
         }
 
         // Check if an alias with specified address already exists.
         if (User::aliasExists($email)) {
             return \trans('validation.entryexists', ['attribute' => 'email']);
         }
 
         // Check if a group or resource with specified address already exists
         if (
             ($existing = Group::emailExists($email, true))
             || ($existing = \App\Resource::emailExists($email, true))
         ) {
             // If this is a deleted group/resource in the same custom domain
             // we'll force delete it before
             if (!$domain->isPublic() && $existing->trashed()) {
                 $deleted = $existing;
             } else {
                 return \trans('validation.entryexists', ['attribute' => 'email']);
             }
         }
 
         return null;
     }
 
     /**
      * Email address validation for use as an alias.
      *
      * @param string    $email Email address
      * @param \App\User $user  The account owner
      *
      * @return ?string Error message on validation error
      */
     public static function validateAlias(string $email, \App\User $user): ?string
     {
         if (strpos($email, '@') === false) {
             return \trans('validation.entryinvalid', ['attribute' => 'alias']);
         }
 
         list($login, $domain) = explode('@', Str::lower($email));
 
         if (strlen($login) === 0 || strlen($domain) === 0) {
             return \trans('validation.entryinvalid', ['attribute' => 'alias']);
         }
 
         // Check if domain exists
         $domain = Domain::withObjectTenantContext($user)->where('namespace', $domain)->first();
 
         if (empty($domain)) {
             return \trans('validation.domaininvalid');
         }
 
         // Validate login part alone
         $v = Validator::make(
             ['alias' => $login],
             ['alias' => ['required', new UserEmailLocal(!$domain->isPublic())]]
         );
 
         if ($v->fails()) {
             return $v->errors()->toArray()['alias'][0];
         }
 
         // Check if it is one of domains available to the user
         if (!$user->domains()->where('namespace', $domain->namespace)->exists()) {
             return \trans('validation.entryexists', ['attribute' => 'domain']);
         }
 
         // Check if a user with specified address already exists
         if ($existing_user = User::emailExists($email, true)) {
             // Allow an alias in a custom domain to an address that was a user before
             if ($domain->isPublic() || !$existing_user->trashed()) {
                 return \trans('validation.entryexists', ['attribute' => 'alias']);
             }
         }
 
         // Check if an alias with specified address already exists
         if (User::aliasExists($email)) {
             // Allow assigning the same alias to a user in the same group account,
             // but only for non-public domains
             if ($domain->isPublic()) {
                 return \trans('validation.entryexists', ['attribute' => 'alias']);
             }
         }
 
         // Check if a group with specified address already exists
         if (Group::emailExists($email)) {
             return \trans('validation.entryexists', ['attribute' => 'alias']);
         }
 
         return null;
     }
 
     /**
      * Activate password reset code (if set), and assign it to a user.
      *
      * @param \App\User $user The user
      */
     protected function activatePassCode(User $user): void
     {
         // Activate the password reset code
         if ($this->passCode) {
             $this->passCode->user_id = $user->id;
             $this->passCode->active = true;
             $this->passCode->save();
         }
     }
 }
diff --git a/src/app/Rules/Password.php b/src/app/Rules/Password.php
new file mode 100644
index 00000000..d02922ef
--- /dev/null
+++ b/src/app/Rules/Password.php
@@ -0,0 +1,199 @@
+<?php
+
+namespace App\Rules;
+
+use Illuminate\Contracts\Validation\Rule;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Support\Str;
+
+class Password implements Rule
+{
+    private $message;
+    private $owner;
+
+    /**
+     * Class constructor.
+     *
+     * @param \App\User $owner The account owner (to take the policy from)
+     */
+    public function __construct(?\App\User $owner = null)
+    {
+        $this->owner = $owner;
+    }
+
+    /**
+     * Determine if the validation rule passes.
+     *
+     * @param string $attribute Attribute name
+     * @param mixed  $password  Password string
+     *
+     * @return bool
+     */
+    public function passes($attribute, $password): bool
+    {
+        foreach ($this->check($password) as $rule) {
+            if (empty($rule['status'])) {
+                $this->message = \trans('validation.password-policy-error');
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    /**
+     * Get the validation error message.
+     *
+     * @return string
+     */
+    public function message(): ?string
+    {
+        return $this->message;
+    }
+
+    /**
+     * Check a password against the policy rules
+     *
+     * @param string $password The password
+     */
+    public function check($password): array
+    {
+        $rules = $this->rules();
+
+        foreach ($rules as $name => $rule) {
+            switch ($name) {
+                case 'min':
+                    // Check the min length
+                    $pass = strlen($password) >= intval($rule['param']);
+                    break;
+
+                case 'max':
+                    // Check the max length
+                    $length = strlen($password);
+                    $pass = $length && $length <= intval($rule['param']);
+                    break;
+
+                case 'lower':
+                    // Check if password contains a lower-case character
+                    $pass = preg_match('/[a-z]/', $password) > 0;
+                    break;
+
+                case 'upper':
+                    // Check if password contains a upper-case character
+                    $pass = preg_match('/[A-Z]/', $password) > 0;
+                    break;
+
+                case 'digit':
+                    // Check if password contains a digit
+                    $pass = preg_match('/[0-9]/', $password) > 0;
+                    break;
+
+                case 'special':
+                    // Check if password contains a special character
+                    $pass = preg_match('/[-~!@#$%^&*_+=`(){}[]|:;"\'`<>,.?\/\\]/', $password) > 0;
+                    break;
+
+                default:
+                    // Ignore unknown rule name
+                    $pass = true;
+            }
+
+            $rules[$name]['status'] = $pass;
+        }
+
+        return $rules;
+    }
+
+    /**
+     * Get the list of rules for a password
+     *
+     * @param bool $all List all supported rules, instead of the enabled ones
+     *
+     * @return array List of rule definitions
+     */
+    public function rules(bool $all = false): array
+    {
+        // All supported password policy rules (with default params)
+        $supported = 'min:6,max:255,lower,upper,digit,special';
+
+        // Get the password policy from the $owner settings
+        if ($this->owner) {
+            $conf = $this->owner->getSetting('password_policy');
+        }
+
+        // Fallback to the configured policy
+        if (empty($conf)) {
+            $conf = \config('app.password_policy');
+        }
+
+        // Default policy, if not set
+        if (empty($conf)) {
+            $conf = 'min:6,max:255';
+        }
+
+        $supported = self::parsePolicy($supported);
+        $conf = self::parsePolicy($conf);
+        $rules = $all ? $supported : $conf;
+
+        foreach ($rules as $idx => $rule) {
+            $param = $rule;
+
+            if ($all && array_key_exists($idx, $conf)) {
+                $param = $conf[$idx];
+                $enabled = true;
+            } else {
+                $enabled = !$all;
+            }
+
+            $rules[$idx] = [
+                'label' => $idx,
+                'name' => \trans("app.password-rule-{$idx}", ['param' => $param]),
+                'param' => $param,
+                'enabled' => $enabled,
+            ];
+        }
+
+        return $rules;
+    }
+
+    /**
+     * Parse configured policy string
+     *
+     * @param ?string $policy Policy specification
+     *
+     * @return array Policy specification as an array indexed by the policy rule type
+     */
+    public static function parsePolicy(?string $policy): array
+    {
+        $policy = explode(',', strtolower((string) $policy));
+        $policy = array_map('trim', $policy);
+        $policy = array_unique(array_filter($policy));
+
+        return self::mapWithKeys($policy);
+    }
+
+    /**
+     * Convert an array with password policy rules into one indexed by the rule name
+     *
+     * @param array $rules The rules list
+     *
+     * @return array
+     */
+    private static function mapWithKeys(array $rules): array
+    {
+        $result = [];
+
+        foreach ($rules as $rule) {
+            $key = $rule;
+            $value = null;
+
+            if (strpos($key, ':')) {
+                list($key, $value) = explode(':', $key, 2);
+            }
+
+            $result[$key] = $value;
+        }
+
+        return $result;
+    }
+}
diff --git a/src/app/Traits/EntitleableTrait.php b/src/app/Traits/EntitleableTrait.php
index 535db87a..b0bd3997 100644
--- a/src/app/Traits/EntitleableTrait.php
+++ b/src/app/Traits/EntitleableTrait.php
@@ -1,258 +1,278 @@
 <?php
 
 namespace App\Traits;
 
 use App\Entitlement;
 use App\Sku;
 use App\Wallet;
 use Illuminate\Support\Str;
 
 trait EntitleableTrait
 {
     /**
      * Assign a package to an entitleable object. It should not have any existing entitlements.
      *
      * @param \App\Package $package The package
      * @param \App\Wallet  $wallet  The wallet
      *
      * @return $this
      */
     public function assignPackageAndWallet(\App\Package $package, Wallet $wallet)
     {
         // TODO: There should be some sanity checks here. E.g. not package can be
         // assigned to any entitleable, but we don't really have package types.
 
         foreach ($package->skus as $sku) {
             for ($i = $sku->pivot->qty; $i > 0; $i--) {
                 Entitlement::create([
                         'wallet_id' => $wallet->id,
                         'sku_id' => $sku->id,
                         'cost' => $sku->pivot->cost(),
                         'fee' => $sku->pivot->fee(),
                         'entitleable_id' => $this->id,
                         'entitleable_type' => self::class
                 ]);
             }
         }
 
         return $this;
     }
 
     /**
      * Assign a Sku to an entitleable object.
      *
      * @param \App\Sku $sku   The sku to assign.
      * @param int      $count Count of entitlements to add
      *
      * @return $this
      * @throws \Exception
      */
     public function assignSku(Sku $sku, int $count = 1)
     {
         // TODO: I guess wallet could be parametrized in future
         $wallet = $this->wallet();
         $exists = $this->entitlements()->where('sku_id', $sku->id)->count();
 
         // TODO: Make sure the SKU can be assigned to the object
 
         while ($count > 0) {
             Entitlement::create([
                 'wallet_id' => $wallet->id,
                 'sku_id' => $sku->id,
                 'cost' => $exists >= $sku->units_free ? $sku->cost : 0,
                 'fee' => $exists >= $sku->units_free ? $sku->fee : 0,
                 'entitleable_id' => $this->id,
                 'entitleable_type' => self::class
             ]);
 
             $exists++;
             $count--;
         }
 
         return $this;
     }
 
     /**
      * Assign the object to a wallet.
      *
      * @param \App\Wallet $wallet The wallet
      *
      * @return $this
      * @throws \Exception
      */
     public function assignToWallet(Wallet $wallet)
     {
         if (empty($this->id)) {
             throw new \Exception("Object not yet exists");
         }
 
         if ($this->entitlements()->count()) {
             throw new \Exception("Object already assigned to a wallet");
         }
 
         // Find the SKU title, e.g. \App\SharedFolder -> shared-folder
         // Note: it does not work with User/Domain model (yet)
         $title = Str::kebab(\class_basename(self::class));
 
         $sku = Sku::withObjectTenantContext($this)->where('title', $title)->first();
         $exists = $wallet->entitlements()->where('sku_id', $sku->id)->count();
 
         Entitlement::create([
             'wallet_id' => $wallet->id,
             'sku_id' => $sku->id,
             'cost' => $exists >= $sku->units_free ? $sku->cost : 0,
             'fee' => $exists >= $sku->units_free ? $sku->fee : 0,
             'entitleable_id' => $this->id,
             'entitleable_type' => self::class
         ]);
 
         return $this;
     }
 
     /**
      * Boot function from Laravel.
      */
     protected static function bootEntitleableTrait()
     {
         // Soft-delete and force-delete object's entitlements on object's delete
         static::deleting(function ($model) {
             $force = $model->isForceDeleting();
             $entitlements = $model->entitlements();
 
             if ($force) {
                 $entitlements = $entitlements->withTrashed();
             }
 
             $list = $entitlements->get()
                 ->map(function ($entitlement) use ($force) {
                     if ($force) {
                         $entitlement->forceDelete();
                     } else {
                         $entitlement->delete();
                     }
                     return $entitlement->id;
                 })
                 ->all();
 
             // Remove transactions, they have no foreign key constraint
             if ($force && !empty($list)) {
                 \App\Transaction::where('object_type', \App\Entitlement::class)
                     ->whereIn('object_id', $list)
                     ->delete();
             }
         });
 
         // Restore object's entitlements on restore
         static::restored(function ($model) {
             $model->restoreEntitlements();
         });
     }
 
     /**
      * Entitlements for this object.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function entitlements()
     {
         return $this->hasMany(Entitlement::class, 'entitleable_id', 'id')
             ->where('entitleable_type', self::class);
     }
 
     /**
      * Check if an entitlement for the specified SKU exists.
      *
      * @param string $title The SKU title
      *
      * @return bool True if specified SKU entitlement exists
      */
     public function hasSku(string $title): bool
     {
         $sku = Sku::withObjectTenantContext($this)->where('title', $title)->first();
 
         if (!$sku) {
             return false;
         }
 
         return $this->entitlements()->where('sku_id', $sku->id)->count() > 0;
     }
 
     /**
      * Remove a number of entitlements for the SKU.
      *
      * @param \App\Sku $sku   The SKU
      * @param int      $count The number of entitlements to remove
      *
      * @return $this
      */
     public function removeSku(Sku $sku, int $count = 1)
     {
         $entitlements = $this->entitlements()
             ->where('sku_id', $sku->id)
             ->orderBy('cost', 'desc')
             ->orderBy('created_at')
             ->get();
 
         $entitlements_count = count($entitlements);
 
         foreach ($entitlements as $entitlement) {
             if ($entitlements_count <= $sku->units_free) {
                 continue;
             }
 
             if ($count > 0) {
                 $entitlement->delete();
                 $entitlements_count--;
                 $count--;
             }
         }
 
         return $this;
     }
 
     /**
      * Restore object entitlements.
      */
     public function restoreEntitlements(): void
     {
         // We'll restore only these that were deleted last. So, first we get
         // the maximum deleted_at timestamp and then use it to select
         // entitlements for restore
         $deleted_at = $this->entitlements()->withTrashed()->max('deleted_at');
 
         if ($deleted_at) {
             $threshold = (new \Carbon\Carbon($deleted_at))->subMinute();
 
             // Restore object entitlements
             $this->entitlements()->withTrashed()
                 ->where('deleted_at', '>=', $threshold)
                 ->update(['updated_at' => now(), 'deleted_at' => null]);
 
             // Note: We're assuming that cost of entitlements was correct
             // on deletion, so we don't have to re-calculate it again.
             // TODO: We should probably re-calculate the cost
         }
     }
 
     /**
      * Returns the wallet by which the object is controlled
      *
      * @return ?\App\Wallet A wallet object
      */
     public function wallet(): ?Wallet
     {
         $entitlement = $this->entitlements()->withTrashed()->orderBy('created_at', 'desc')->first();
 
         if ($entitlement) {
             return $entitlement->wallet;
         }
 
         // TODO: No entitlement should not happen, but in tests we have
         //       such cases, so we fallback to the user's wallet in this case
         if ($this instanceof \App\User) {
             return $this->wallets()->first();
         }
 
         return null;
     }
+
+    /**
+     * Return the owner of the wallet (account) this entitleable is assigned to
+     *
+     * @return ?\App\User Account owner
+     */
+    public function walletOwner(): ?\App\User
+    {
+        $wallet = $this->wallet();
+
+        if ($wallet) {
+            if ($this instanceof \App\User && $wallet->user_id == $this->id) {
+                return $this;
+            }
+
+            return $wallet->owner;
+        }
+
+        return null;
+    }
 }
diff --git a/src/app/Traits/UserConfigTrait.php b/src/app/Traits/UserConfigTrait.php
index 15519f01..9c955e30 100644
--- a/src/app/Traits/UserConfigTrait.php
+++ b/src/app/Traits/UserConfigTrait.php
@@ -1,44 +1,97 @@
 <?php
 
 namespace App\Traits;
 
 use App\Policy\Greylist;
 
 trait UserConfigTrait
 {
     /**
      * A helper to get the user configuration.
      */
     public function getConfig(): array
     {
         $config = [];
 
         // TODO: Should we store the default value somewhere in config?
 
         $config['greylist_enabled'] = $this->getSetting('greylist_enabled') !== 'false';
+        $config['password_policy'] = $this->getSetting('password_policy');
 
         return $config;
     }
 
     /**
      * A helper to update user configuration.
      *
      * @param array $config An array of configuration options
      *
      * @return array A list of input validation error messages
      */
     public function setConfig(array $config): array
     {
         $errors = [];
 
         foreach ($config as $key => $value) {
             if ($key == 'greylist_enabled') {
                 $this->setSetting('greylist_enabled', $value ? 'true' : 'false');
+            } elseif ($key == 'password_policy') {
+                if (!is_string($value) || (strlen($value) && !preg_match('/^[a-z0-9:,]+$/', $value))) {
+                    $errors[$key] = \trans('validation.invalid-password-policy');
+                    continue;
+                }
+
+                foreach (explode(',', $value) as $rule) {
+                    if ($error = $this->validatePasswordPolicyRule($rule)) {
+                        $errors[$key] = $error;
+                        continue 2;
+                    }
+                }
+
+                $this->setSetting('password_policy', $value);
             } else {
                 $errors[$key] = \trans('validation.invalid-config-parameter');
             }
         }
 
         return $errors;
     }
+
+    /**
+     * Validates password policy rule.
+     *
+     * @param string $rule Policy rule
+     *
+     * @return ?string An error message on error, Null otherwise
+     */
+    protected function validatePasswordPolicyRule(string $rule): ?string
+    {
+        $regexp = [
+            'min:[0-9]+', 'max:[0-9]+', 'upper', 'lower', 'digit', 'special',
+        ];
+
+        if (empty($rule) || !preg_match('/^(' . implode('|', $regexp) . ')$/', $rule)) {
+            return \trans('validation.invalid-password-policy');
+        }
+
+        $systemPolicy = \App\Rules\Password::parsePolicy(\config('app.password_policy'));
+
+        // Min/Max values cannot exceed the system defaults, i.e. if system policy
+        // is min:5, user's policy cannot be set to a smaller number.
+        if (!empty($systemPolicy['min'])) {
+            $value = trim(substr($rule, 4));
+            if ($value < $systemPolicy['min']) {
+                return \trans('validation.password-policy-min-len-error', ['min' => $systemPolicy['min']]);
+            }
+        }
+
+        if (!empty($systemPolicy['max'])) {
+            $value = trim(substr($rule, 4));
+            if ($value > $systemPolicy['max']) {
+                return \trans('validation.password-policy-max-len-error', ['max' => $systemPolicy['max']]);
+            }
+        }
+
+        return null;
+    }
 }
diff --git a/src/config/app.php b/src/config/app.php
index ca93105a..7aa974ad 100644
--- a/src/config/app.php
+++ b/src/config/app.php
@@ -1,306 +1,308 @@
 <?php
 
 return [
 
     /*
     |--------------------------------------------------------------------------
     | Application Name
     |--------------------------------------------------------------------------
     |
     | This value is the name of your application. This value is used when the
     | framework needs to place the application's name in a notification or
     | any other location as required by the application or its packages.
     |
     */
 
     'name' => env('APP_NAME', 'Laravel'),
 
     /*
     |--------------------------------------------------------------------------
     | Application Environment
     |--------------------------------------------------------------------------
     |
     | This value determines the "environment" your application is currently
     | running in. This may determine how you prefer to configure various
     | services the application utilizes. Set this in your ".env" file.
     |
     */
 
     'env' => env('APP_ENV', 'production'),
 
     /*
     |--------------------------------------------------------------------------
     | Application Debug Mode
     |--------------------------------------------------------------------------
     |
     | When your application is in debug mode, detailed error messages with
     | stack traces will be shown on every error that occurs within your
     | application. If disabled, a simple generic error page is shown.
     |
     */
 
     'debug' => env('APP_DEBUG', false),
 
     /*
     |--------------------------------------------------------------------------
     | Application URL
     |--------------------------------------------------------------------------
     |
     | This URL is used by the console to properly generate URLs when using
     | the Artisan command line tool. You should set this to the root of
     | your application so that it is used when running Artisan tasks.
     */
 
     'url' => env('APP_URL', 'http://localhost'),
 
     'passphrase' => env('APP_PASSPHRASE', null),
 
     'public_url' => env('APP_PUBLIC_URL', env('APP_URL', 'http://localhost')),
 
     'asset_url' => env('ASSET_URL', null),
 
     'support_url' => env('SUPPORT_URL', null),
 
     'support_email' => env('SUPPORT_EMAIL', null),
 
     'webmail_url' => env('WEBMAIL_URL', null),
 
     'theme' => env('APP_THEME', 'default'),
 
     'tenant_id' => env('APP_TENANT_ID', null),
 
     'currency' => \strtoupper(env('APP_CURRENCY', 'CHF')),
 
     /*
     |--------------------------------------------------------------------------
     | Application Domain
     |--------------------------------------------------------------------------
     |
     | System domain used for user signup (kolab identity)
     */
     'domain' => env('APP_DOMAIN', 'domain.tld'),
 
     'website_domain' => env('APP_WEBSITE_DOMAIN', env('APP_DOMAIN', 'domain.tld')),
 
     /*
     |--------------------------------------------------------------------------
     | Application Timezone
     |--------------------------------------------------------------------------
     |
     | Here you may specify the default timezone for your application, which
     | will be used by the PHP date and date-time functions. We have gone
     | ahead and set this to a sensible default for you out of the box.
     |
     */
 
     'timezone' => 'UTC',
 
     /*
     |--------------------------------------------------------------------------
     | Application Locale Configuration
     |--------------------------------------------------------------------------
     |
     | The application locale determines the default locale that will be used
     | by the translation service provider. You are free to set this value
     | to any of the locales which will be supported by the application.
     |
     */
 
     'locale' => env('APP_LOCALE', 'en'),
 
     /*
     |--------------------------------------------------------------------------
     | Application Fallback Locale
     |--------------------------------------------------------------------------
     |
     | The fallback locale determines the locale to use when the current one
     | is not available. You may change the value to correspond to any of
     | the language folders that are provided through your application.
     |
     */
 
     'fallback_locale' => 'en',
 
     /*
     |--------------------------------------------------------------------------
     | Faker Locale
     |--------------------------------------------------------------------------
     |
     | This locale will be used by the Faker PHP library when generating fake
     | data for your database seeds. For example, this will be used to get
     | localized telephone numbers, street address information and more.
     |
     */
 
     'faker_locale' => 'en_US',
 
     /*
     |--------------------------------------------------------------------------
     | Encryption Key
     |--------------------------------------------------------------------------
     |
     | This key is used by the Illuminate encrypter service and should be set
     | to a random, 32 character string, otherwise these encrypted strings
     | will not be safe. Please do this before deploying an application!
     |
     */
 
     'key' => env('APP_KEY'),
 
     'cipher' => 'AES-256-CBC',
 
     /*
     |--------------------------------------------------------------------------
     | Autoloaded Service Providers
     |--------------------------------------------------------------------------
     |
     | The service providers listed here will be automatically loaded on the
     | request to your application. Feel free to add your own services to
     | this array to grant expanded functionality to your applications.
     |
     */
 
     'providers' => [
         /*
          * Laravel Framework Service Providers...
          */
         Illuminate\Auth\AuthServiceProvider::class,
         Illuminate\Broadcasting\BroadcastServiceProvider::class,
         Illuminate\Bus\BusServiceProvider::class,
         Illuminate\Cache\CacheServiceProvider::class,
         Illuminate\Foundation\Providers\ConsoleSupportServiceProvider::class,
         Illuminate\Cookie\CookieServiceProvider::class,
         Illuminate\Database\DatabaseServiceProvider::class,
         Illuminate\Encryption\EncryptionServiceProvider::class,
         Illuminate\Filesystem\FilesystemServiceProvider::class,
         Illuminate\Foundation\Providers\FoundationServiceProvider::class,
         Illuminate\Hashing\HashServiceProvider::class,
         Illuminate\Mail\MailServiceProvider::class,
         Illuminate\Notifications\NotificationServiceProvider::class,
         Illuminate\Pagination\PaginationServiceProvider::class,
         Illuminate\Pipeline\PipelineServiceProvider::class,
         Illuminate\Queue\QueueServiceProvider::class,
         Illuminate\Redis\RedisServiceProvider::class,
         Illuminate\Auth\Passwords\PasswordResetServiceProvider::class,
         Illuminate\Session\SessionServiceProvider::class,
         Illuminate\Translation\TranslationServiceProvider::class,
         Illuminate\Validation\ValidationServiceProvider::class,
         Illuminate\View\ViewServiceProvider::class,
 
         /*
          * Package Service Providers...
          */
         Barryvdh\DomPDF\ServiceProvider::class,
 
         /*
          * Application Service Providers...
          */
         App\Providers\AppServiceProvider::class,
         App\Providers\AuthServiceProvider::class,
         // App\Providers\BroadcastServiceProvider::class,
         App\Providers\EventServiceProvider::class,
         App\Providers\HorizonServiceProvider::class,
         App\Providers\PassportServiceProvider::class,
         App\Providers\RouteServiceProvider::class,
     ],
 
     /*
     |--------------------------------------------------------------------------
     | Class Aliases
     |--------------------------------------------------------------------------
     |
     | This array of class aliases will be registered when this application
     | is started. However, feel free to register as many as you wish as
     | the aliases are "lazy" loaded so they don't hinder performance.
     |
     */
 
     'aliases' => [
         'App' => Illuminate\Support\Facades\App::class,
         'Arr' => Illuminate\Support\Arr::class,
         'Artisan' => Illuminate\Support\Facades\Artisan::class,
         'Auth' => Illuminate\Support\Facades\Auth::class,
         'Blade' => Illuminate\Support\Facades\Blade::class,
         'Broadcast' => Illuminate\Support\Facades\Broadcast::class,
         'Bus' => Illuminate\Support\Facades\Bus::class,
         'Cache' => Illuminate\Support\Facades\Cache::class,
         'Config' => Illuminate\Support\Facades\Config::class,
         'Cookie' => Illuminate\Support\Facades\Cookie::class,
         'Crypt' => Illuminate\Support\Facades\Crypt::class,
         'DB' => Illuminate\Support\Facades\DB::class,
         'Eloquent' => Illuminate\Database\Eloquent\Model::class,
         'Event' => Illuminate\Support\Facades\Event::class,
         'File' => Illuminate\Support\Facades\File::class,
         'Gate' => Illuminate\Support\Facades\Gate::class,
         'Hash' => Illuminate\Support\Facades\Hash::class,
         'Lang' => Illuminate\Support\Facades\Lang::class,
         'Log' => Illuminate\Support\Facades\Log::class,
         'Mail' => Illuminate\Support\Facades\Mail::class,
         'Notification' => Illuminate\Support\Facades\Notification::class,
         'Password' => Illuminate\Support\Facades\Password::class,
         'PDF' => Barryvdh\DomPDF\Facade::class,
         'Queue' => Illuminate\Support\Facades\Queue::class,
         'Redirect' => Illuminate\Support\Facades\Redirect::class,
         'Redis' => Illuminate\Support\Facades\Redis::class,
         'Request' => Illuminate\Support\Facades\Request::class,
         'Response' => Illuminate\Support\Facades\Response::class,
         'Route' => Illuminate\Support\Facades\Route::class,
         'Schema' => Illuminate\Support\Facades\Schema::class,
         'Session' => Illuminate\Support\Facades\Session::class,
         'Storage' => Illuminate\Support\Facades\Storage::class,
         'Str' => Illuminate\Support\Str::class,
         'URL' => Illuminate\Support\Facades\URL::class,
         'Validator' => Illuminate\Support\Facades\Validator::class,
         'View' => Illuminate\Support\Facades\View::class,
     ],
 
     'headers' => [
         'csp' => env('APP_HEADER_CSP', ""),
         'xfo' => env('APP_HEADER_XFO', ""),
     ],
 
     // Locations of knowledge base articles
     'kb' => [
         // An article about suspended accounts
         'account_suspended' => env('KB_ACCOUNT_SUSPENDED'),
         // An article about a way to delete an owned account
         'account_delete' => env('KB_ACCOUNT_DELETE'),
     ],
 
     'company' => [
         'name' => env('COMPANY_NAME'),
         'address' => env('COMPANY_ADDRESS'),
         'details' => env('COMPANY_DETAILS'),
         'email' => env('COMPANY_EMAIL'),
         'logo' => env('COMPANY_LOGO'),
         'footer' => env('COMPANY_FOOTER', env('COMPANY_DETAILS')),
     ],
 
     'storage' => [
         'min_qty' => (int) env('STORAGE_MIN_QTY', 5), // in GB
     ],
 
     'vat' => [
         'countries' => env('VAT_COUNTRIES'),
         'rate' => (float) env('VAT_RATE'),
     ],
 
+    'password_policy' => env('PASSWORD_POLICY'),
+
     'payment' => [
         'methods_oneoff' => env('PAYMENT_METHODS_ONEOFF', "creditcard,paypal,banktransfer"),
         'methods_recurring' => env('PAYMENT_METHODS_RECURRING', "creditcard"),
     ],
 
     'with_admin' => (bool) env('APP_WITH_ADMIN', false),
     'with_reseller' => (bool) env('APP_WITH_RESELLER', false),
     'with_services' => (bool) env('APP_WITH_SERVICES', false),
 
     'signup' => [
         'email_limit' => (int) env('SIGNUP_LIMIT_EMAIL', 0),
         'ip_limit' => (int) env('SIGNUP_LIMIT_IP', 0),
     ],
 
     'woat_ns1' => env('WOAT_NS1', 'ns01.' . env('APP_DOMAIN')),
     'woat_ns2' => env('WOAT_NS2', 'ns02.' . env('APP_DOMAIN')),
 
     'ratelimit_whitelist' => explode(',', env('RATELIMIT_WHITELIST', ''))
 ];
diff --git a/src/database/migrations/2022_01_13_100000_verification_code_active_column.php b/src/database/migrations/2022_01_13_100000_verification_code_active_column.php
index 6209c12c..e3b2f1f4 100644
--- a/src/database/migrations/2022_01_13_100000_verification_code_active_column.php
+++ b/src/database/migrations/2022_01_13_100000_verification_code_active_column.php
@@ -1,39 +1,43 @@
 <?php
 
 use Illuminate\Support\Facades\Schema;
 use Illuminate\Database\Schema\Blueprint;
 use Illuminate\Database\Migrations\Migration;
 
 // phpcs:ignore
 class VerificationCodeActiveColumn extends Migration
 {
     /**
      * Run the migrations.
      *
      * @return void
      */
     public function up()
     {
         Schema::table(
             'verification_codes',
             function (Blueprint $table) {
                 $table->boolean('active')->default(true);
             }
         );
     }
 
     /**
      * Reverse the migrations.
      *
      * @return void
      */
     public function down()
     {
+        if (!Schema::hasTable('verification_codes')) {
+            return;
+        }
+
         Schema::table(
             'verification_codes',
             function (Blueprint $table) {
                 $table->dropColumn('active');
             }
         );
     }
 }
diff --git a/src/resources/js/app.js b/src/resources/js/app.js
index f8fae474..8cae06be 100644
--- a/src/resources/js/app.js
+++ b/src/resources/js/app.js
@@ -1,507 +1,507 @@
 /**
  * First we will load all of this project's JavaScript dependencies which
  * includes Vue and other libraries. It is a great starting point when
  * building robust, powerful web applications using Vue and Laravel.
  */
 
 require('./bootstrap')
 
 import AppComponent from '../vue/App'
 import MenuComponent from '../vue/Widgets/Menu'
 import SupportForm from '../vue/Widgets/SupportForm'
 import store from './store'
 import { Tab } from 'bootstrap'
 import { loadLangAsync, i18n } from './locale'
 
 const loader = '<div class="app-loader"><div class="spinner-border" role="status"><span class="visually-hidden">Loading</span></div></div>'
 
 let isLoading = 0
 
 // Lock the UI with the 'loading...' element
 const startLoading = () => {
     isLoading++
     let loading = $('#app > .app-loader').removeClass('fadeOut')
     if (!loading.length) {
         $('#app').append($(loader))
     }
 }
 
 // Hide "loading" overlay
 const stopLoading = () => {
     if (isLoading > 0) {
         $('#app > .app-loader').addClass('fadeOut')
         isLoading--;
     }
 }
 
 let loadingRoute
 
 // Note: This has to be before the app is created
 // Note: You cannot use app inside of the function
 window.router.beforeEach((to, from, next) => {
     // check if the route requires authentication and user is not logged in
     if (to.meta.requiresAuth && !store.state.isLoggedIn) {
         // remember the original request, to use after login
         store.state.afterLogin = to;
 
         // redirect to login page
         next({ name: 'login' })
 
         return
     }
 
     if (to.meta.loading) {
         startLoading()
         loadingRoute = to.name
     }
 
     next()
 })
 
 window.router.afterEach((to, from) => {
     if (to.name && loadingRoute === to.name) {
         stopLoading()
         loadingRoute = null
     }
 
     // When changing a page remove old:
     // - error page
     // - modal backdrop
     $('#error-page,.modal-backdrop.show').remove()
     $('body').css('padding', 0) // remove padding added by unclosed modal
 })
 
 const app = new Vue({
     components: {
         AppComponent,
         MenuComponent,
     },
     i18n,
     store,
     router: window.router,
     data() {
         return {
             isUser: !window.isAdmin && !window.isReseller,
             appName: window.config['app.name'],
             appUrl: window.config['app.url'],
             themeDir: '/themes/' + window.config['app.theme']
         }
     },
     methods: {
         // Clear (bootstrap) form validation state
         clearFormValidation(form) {
             $(form).find('.is-invalid').removeClass('is-invalid')
             $(form).find('.invalid-feedback').remove()
         },
         hasPermission(type) {
             const authInfo = store.state.authInfo
             const key = 'enable' + type.charAt(0).toUpperCase() + type.slice(1)
             return !!(authInfo && authInfo.statusInfo[key])
         },
         hasRoute(name) {
             return this.$router.resolve({ name: name }).resolved.matched.length > 0
         },
         hasSKU(name) {
             const authInfo = store.state.authInfo
             return authInfo.statusInfo.skus && authInfo.statusInfo.skus.indexOf(name) != -1
         },
         isController(wallet_id) {
             if (wallet_id && store.state.authInfo) {
                 let i
                 for (i = 0; i < store.state.authInfo.wallets.length; i++) {
                     if (wallet_id == store.state.authInfo.wallets[i].id) {
                         return true
                     }
                 }
                 for (i = 0; i < store.state.authInfo.accounts.length; i++) {
                     if (wallet_id == store.state.authInfo.accounts[i].id) {
                         return true
                     }
                 }
             }
 
             return false
         },
         // Set user state to "logged in"
         loginUser(response, dashboard, update) {
             if (!update) {
                 store.commit('logoutUser') // destroy old state data
                 store.commit('loginUser')
             }
 
             localStorage.setItem('token', response.access_token)
             localStorage.setItem('refreshToken', response.refresh_token)
             axios.defaults.headers.common.Authorization = 'Bearer ' + response.access_token
 
             if (response.email) {
                 store.state.authInfo = response
             }
 
             if (dashboard !== false) {
                 this.$router.push(store.state.afterLogin || { name: 'dashboard' })
             }
 
             store.state.afterLogin = null
 
             // Refresh the token before it expires
             let timeout = response.expires_in || 0
 
             // We'll refresh 60 seconds before the token expires
             if (timeout > 60) {
                 timeout -= 60
             }
 
             // TODO: We probably should try a few times in case of an error
             // TODO: We probably should prevent axios from doing any requests
             //       while the token is being refreshed
 
             this.refreshTimeout = setTimeout(() => {
                 axios.post('/api/auth/refresh', {'refresh_token': response.refresh_token}).then(response => {
                     this.loginUser(response.data, false, true)
                 })
             }, timeout * 1000)
         },
         // Set user state to "not logged in"
         logoutUser(redirect) {
             store.commit('logoutUser')
             localStorage.setItem('token', '')
             localStorage.setItem('refreshToken', '')
             delete axios.defaults.headers.common.Authorization
 
             if (redirect !== false) {
                 this.$router.push({ name: 'login' })
             }
 
             clearTimeout(this.refreshTimeout)
         },
         logo(mode) {
             let src = this.appUrl + this.themeDir + '/images/logo_' + (mode || 'header') + '.png'
 
             return `<img src="${src}" alt="${this.appName}">`
         },
         // Display "loading" overlay inside of the specified element
         addLoader(elem, small = true, style = null) {
             if (style) {
                 $(elem).css(style)
             } else {
                 $(elem).css('position', 'relative')
             }
 
             $(elem).append(small ? $(loader).addClass('small') : $(loader))
         },
         // Create an object copy with specified properties only
         pick(obj, properties) {
             let result = {}
 
             properties.forEach(prop => {
                 if (prop in obj) {
                     result[prop] = obj[prop]
                 }
             })
 
             return result
         },
         // Remove loader element added in addLoader()
         removeLoader(elem) {
             $(elem).find('.app-loader').remove()
         },
         startLoading,
         stopLoading,
         isLoading() {
             return isLoading > 0
         },
         tab(e) {
             e.preventDefault()
             new Tab(e.target).show()
         },
         errorPage(code, msg, hint) {
             // Until https://github.com/vuejs/vue-router/issues/977 is implemented
             // we can't really use router to display error page as it has two side
             // effects: it changes the URL and adds the error page to browser history.
             // For now we'll be replacing current view with error page "manually".
 
             if (!msg) msg = this.$te('error.' + code) ? this.$t('error.' + code) : this.$t('error.unknown')
             if (!hint) hint = ''
 
             const error_page = '<div id="error-page" class="error-page">'
                 + `<div class="code">${code}</div><div class="message">${msg}</div><div class="hint">${hint}</div>`
                 + '</div>'
 
             $('#error-page').remove()
             $('#app').append(error_page)
 
             app.updateBodyClass('error')
         },
         errorHandler(error) {
             this.stopLoading()
 
             const status = error.response ? error.response.status : 500
             const message = error.response ? error.response.statusText : ''
 
             if (status == 401) {
                 // Remember requested route to come back to it after log in
                 if (this.$route.meta.requiresAuth) {
                     store.state.afterLogin = this.$route
                     this.logoutUser()
                 } else {
                     this.logoutUser(false)
                 }
             } else {
                 this.errorPage(status, message)
             }
         },
         downloadFile(url) {
             // TODO: This might not be a best way for big files as the content
             //       will be stored (temporarily) in browser memory
             // TODO: This method does not show the download progress in the browser
             //       but it could be implemented in the UI, axios has 'progress' property
             axios.get(url, { responseType: 'blob' })
                 .then(response => {
                     const link = document.createElement('a')
                     const contentDisposition = response.headers['content-disposition']
                     let filename = 'unknown'
 
                     if (contentDisposition) {
                         const match = contentDisposition.match(/filename="(.+)"/);
                         if (match.length === 2) {
                             filename = match[1];
                         }
                     }
 
                     link.href = window.URL.createObjectURL(response.data)
                     link.download = filename
                     link.click()
                 })
         },
         price(price, currency) {
             // TODO: Set locale argument according to the currently used locale
             return ((price || 0) / 100).toLocaleString('de-DE', { style: 'currency', currency: currency || 'CHF' })
         },
         priceLabel(cost, discount, currency) {
             let index = ''
 
             if (discount) {
                 cost = Math.floor(cost * ((100 - discount) / 100))
                 index = '\u00B9'
             }
 
             return this.price(cost, currency) + '/' + this.$t('wallet.month') + index
         },
         clickRecord(event) {
             if (!/^(a|button|svg|path)$/i.test(event.target.nodeName)) {
                 $(event.target).closest('tr').find('a').trigger('click')
             }
         },
         isDegraded() {
             return store.state.authInfo && store.state.authInfo.isAccountDegraded
         },
         pageName(path) {
             let page = this.$route.path
 
             // check if it is a "menu page", find the page name
             // otherwise we'll use the real path as page name
             window.config.menu.every(item => {
                 if (item.location == page && item.page) {
                     page = item.page
                     return false
                 }
             })
 
             page = page.replace(/^\//, '')
 
             return page ? page : '404'
         },
         supportDialog(container) {
             let dialog = $('#support-dialog')[0]
 
             if (!dialog) {
                 // FIXME: Find a nicer way of doing this
                 SupportForm.i18n = i18n
                 let form = new Vue(SupportForm)
                 form.$mount($('<div>').appendTo(container)[0])
                 form.$root = this
                 form.$toast = this.$toast
                 dialog = form.$el
             }
 
             dialog.__vue__.showDialog()
         },
         statusClass(obj) {
             if (obj.isDeleted) {
                 return 'text-muted'
             }
 
             if (obj.isDegraded || obj.isAccountDegraded || obj.isSuspended) {
                 return 'text-warning'
             }
 
             if (obj.isImapReady === false || obj.isLdapReady === false || obj.isVerified === false || obj.isConfirmed === false) {
                 return 'text-danger'
             }
 
             return 'text-success'
         },
         statusText(obj) {
             if (obj.isDeleted) {
                 return this.$t('status.deleted')
             }
 
             if (obj.isDegraded || obj.isAccountDegraded) {
                 return this.$t('status.degraded')
             }
 
             if (obj.isSuspended) {
                 return this.$t('status.suspended')
             }
 
             if (obj.isImapReady === false || obj.isLdapReady === false || obj.isVerified === false || obj.isConfirmed === false) {
                 return this.$t('status.notready')
             }
 
             return this.$t('status.active')
         },
         // Append some wallet properties to the object
         userWalletProps(object) {
             let wallet = store.state.authInfo.accounts[0]
 
             if (!wallet) {
                 wallet = store.state.authInfo.wallets[0]
             }
 
             if (wallet) {
                 object.currency = wallet.currency
                 if (wallet.discount) {
                     object.discount = wallet.discount
                     object.discount_description = wallet.discount_description
                 }
             }
         },
         updateBodyClass(name) {
             // Add 'class' attribute to the body, different for each page
             // so, we can apply page-specific styles
             document.body.className = 'page-' + (name || this.pageName()).replace(/\/.*$/, '')
         }
     }
 })
 
 // Fetch the locale file and the start the app
 loadLangAsync().then(() => app.$mount('#app'))
 
 // Add a axios request interceptor
-window.axios.interceptors.request.use(
+axios.interceptors.request.use(
     config => {
         // This is the only way I found to change configuration options
         // on a running application. We need this for browser testing.
         config.headers['X-Test-Payment-Provider'] = window.config.paymentProvider
 
         return config
     },
     error => {
         // Do something with request error
         return Promise.reject(error)
     }
 )
 
 // Add a axios response interceptor for general/validation error handler
-window.axios.interceptors.response.use(
+axios.interceptors.response.use(
     response => {
         if (response.config.onFinish) {
             response.config.onFinish()
         }
 
         return response
     },
     error => {
         // Do not display the error in a toast message, pass the error as-is
-        if (error.config.ignoreErrors) {
+        if (axios.isCancel(error) || error.config.ignoreErrors) {
             return Promise.reject(error)
         }
 
         if (error.config.onFinish) {
             error.config.onFinish()
         }
 
         let error_msg
 
         const status = error.response ? error.response.status : 200
         const data = error.response ? error.response.data : {}
 
         if (status == 422 && data.errors) {
             error_msg = app.$t('error.form')
 
             const modal = $('div.modal.show')
 
             $(modal.length ? modal : 'form').each((i, form) => {
                 form = $(form)
 
                 $.each(data.errors, (idx, msg) => {
                     const input_name = (form.data('validation-prefix') || form.find('form').first().data('validation-prefix') || '') + idx
                     let input = form.find('#' + input_name)
 
                     if (!input.length) {
                         input = form.find('[name="' + input_name + '"]');
                     }
 
                     if (input.length) {
                         // Create an error message
                         // API responses can use a string, array or object
                         let msg_text = ''
                         if (typeof(msg) !== 'string') {
                             $.each(msg, (index, str) => {
                                 msg_text += str + ' '
                             })
                         }
                         else {
                             msg_text = msg
                         }
 
                         let feedback = $('<div class="invalid-feedback">').text(msg_text)
 
                         if (input.is('.list-input')) {
                             // List input widget
                             let controls = input.children(':not(:first-child)')
 
                             if (!controls.length && typeof msg == 'string') {
                                 // this is an empty list (the main input only)
                                 // and the error message is not an array
                                 input.find('.main-input').addClass('is-invalid')
                             } else {
                                 controls.each((index, element) => {
                                     if (msg[index]) {
                                         $(element).find('input').addClass('is-invalid')
                                     }
                                 })
                             }
 
                             input.addClass('is-invalid').next('.invalid-feedback').remove()
                             input.after(feedback)
                         } else {
                             // a special case, e.g. the invitation policy widget
                             if (input.is('select') && input.parent().is('.input-group-select.selected')) {
                                 input = input.next()
                             }
 
                             // Standard form element
                             input.addClass('is-invalid')
                             input.parent().find('.invalid-feedback').remove()
                             input.parent().append(feedback)
                         }
                     }
                 })
 
                 form.find('.is-invalid:not(.listinput-widget)').first().focus()
             })
         }
         else if (data.status == 'error') {
             error_msg = data.message
         }
         else {
             error_msg = error.request ? error.request.statusText : error.message
         }
 
         app.$toast.error(error_msg || app.$t('error.server'))
 
         // Pass the error as-is
         return Promise.reject(error)
     }
 )
diff --git a/src/resources/js/fontawesome.js b/src/resources/js/fontawesome.js
index 2647fe73..70a078b7 100644
--- a/src/resources/js/fontawesome.js
+++ b/src/resources/js/fontawesome.js
@@ -1,74 +1,76 @@
 
 import { library } from '@fortawesome/fontawesome-svg-core'
 import { FontAwesomeIcon } from '@fortawesome/vue-fontawesome'
 //import { } from '@fortawesome/free-brands-svg-icons'
 import {
     faCheckSquare,
     faClipboard,
     faCreditCard,
     faSquare,
 } from '@fortawesome/free-regular-svg-icons'
 
 import {
     faCheck,
     faCheckCircle,
     faCog,
     faComments,
     faDownload,
     faEnvelope,
     faFolderOpen,
     faGlobe,
     faUniversity,
     faExclamationCircle,
     faInfoCircle,
     faLock,
     faKey,
     faPlus,
     faSearch,
     faSignInAlt,
+    faSlidersH,
     faSyncAlt,
     faTrashAlt,
     faUser,
     faUserCog,
     faUserFriends,
     faUsers,
     faWallet
 } from '@fortawesome/free-solid-svg-icons'
 
 import {
     faPaypal
 } from '@fortawesome/free-brands-svg-icons'
 
 // Register only these icons we need
 library.add(
     faCheck,
     faCheckCircle,
     faCheckSquare,
     faClipboard,
     faCog,
     faComments,
     faCreditCard,
     faPaypal,
     faUniversity,
     faDownload,
     faEnvelope,
     faExclamationCircle,
     faFolderOpen,
     faGlobe,
     faInfoCircle,
     faLock,
     faKey,
     faPlus,
     faSearch,
     faSignInAlt,
+    faSlidersH,
     faSquare,
     faSyncAlt,
     faTrashAlt,
     faUser,
     faUserCog,
     faUserFriends,
     faUsers,
     faWallet
 )
 
 export default FontAwesomeIcon
diff --git a/src/resources/js/user/routes.js b/src/resources/js/user/routes.js
index efb1c3c7..e47b8801 100644
--- a/src/resources/js/user/routes.js
+++ b/src/resources/js/user/routes.js
@@ -1,158 +1,165 @@
 import LoginComponent from '../../vue/Login'
 import LogoutComponent from '../../vue/Logout'
 import PageComponent from '../../vue/Page'
 import PasswordResetComponent from '../../vue/PasswordReset'
 import SignupComponent from '../../vue/Signup'
 
 // Here's a list of lazy-loaded components
 // Note: you can pack multiple components into the same chunk, webpackChunkName
 // is also used to get a sensible file name instead of numbers
 
 const DashboardComponent = () => import(/* webpackChunkName: "../user/pages" */ '../../vue/Dashboard')
 const DistlistInfoComponent = () => import(/* webpackChunkName: "../user/pages" */ '../../vue/Distlist/Info')
 const DistlistListComponent = () => import(/* webpackChunkName: "../user/pages" */ '../../vue/Distlist/List')
 const DomainInfoComponent = () => import(/* webpackChunkName: "../user/pages" */ '../../vue/Domain/Info')
 const DomainListComponent = () => import(/* webpackChunkName: "../user/pages" */ '../../vue/Domain/List')
 const MeetComponent = () => import(/* webpackChunkName: "../user/pages" */ '../../vue/Rooms')
 const ResourceInfoComponent = () => import(/* webpackChunkName: "../user/pages" */ '../../vue/Resource/Info')
 const ResourceListComponent = () => import(/* webpackChunkName: "../user/pages" */ '../../vue/Resource/List')
+const SettingsComponent = () => import(/* webpackChunkName: "../user/pages" */ '../../vue/Settings')
 const SharedFolderInfoComponent = () => import(/* webpackChunkName: "../user/pages" */ '../../vue/SharedFolder/Info')
 const SharedFolderListComponent = () => import(/* webpackChunkName: "../user/pages" */ '../../vue/SharedFolder/List')
 const UserInfoComponent = () => import(/* webpackChunkName: "../user/pages" */ '../../vue/User/Info')
 const UserListComponent = () => import(/* webpackChunkName: "../user/pages" */ '../../vue/User/List')
 const UserProfileComponent = () => import(/* webpackChunkName: "../user/pages" */ '../../vue/User/Profile')
 const UserProfileDeleteComponent = () => import(/* webpackChunkName: "../user/pages" */ '../../vue/User/ProfileDelete')
 const WalletComponent = () => import(/* webpackChunkName: "../user/pages" */ '../../vue/Wallet')
 const RoomComponent = () => import(/* webpackChunkName: "../user/meet" */ '../../vue/Meet/Room.vue')
 
 const routes = [
     {
         path: '/dashboard',
         name: 'dashboard',
         component: DashboardComponent,
         meta: { requiresAuth: true }
     },
     {
         path: '/distlist/:list',
         name: 'distlist',
         component: DistlistInfoComponent,
         meta: { requiresAuth: true, perm: 'distlists' }
     },
     {
         path: '/distlists',
         name: 'distlists',
         component: DistlistListComponent,
         meta: { requiresAuth: true, perm: 'distlists' }
     },
     {
         path: '/domain/:domain',
         name: 'domain',
         component: DomainInfoComponent,
         meta: { requiresAuth: true, perm: 'domains' }
     },
     {
         path: '/domains',
         name: 'domains',
         component: DomainListComponent,
         meta: { requiresAuth: true, perm: 'domains' }
     },
     {
         path: '/login',
         name: 'login',
         component: LoginComponent
     },
     {
         path: '/logout',
         name: 'logout',
         component: LogoutComponent
     },
     {
         path: '/password-reset/:code?',
         name: 'password-reset',
         component: PasswordResetComponent
     },
     {
         path: '/profile',
         name: 'profile',
         component: UserProfileComponent,
         meta: { requiresAuth: true }
     },
     {
         path: '/profile/delete',
         name: 'profile-delete',
         component: UserProfileDeleteComponent,
         meta: { requiresAuth: true }
     },
     {
         path: '/resource/:resource',
         name: 'resource',
         component: ResourceInfoComponent,
         meta: { requiresAuth: true, perm: 'resources' }
     },
     {
         path: '/resources',
         name: 'resources',
         component: ResourceListComponent,
         meta: { requiresAuth: true, perm: 'resources' }
     },
     {
         component: RoomComponent,
         name: 'room',
         path: '/meet/:room',
         meta: { loading: true }
     },
     {
         path: '/rooms',
         name: 'rooms',
         component: MeetComponent,
         meta: { requiresAuth: true }
     },
+    {
+        path: '/settings',
+        name: 'settings',
+        component: SettingsComponent,
+        meta: { requiresAuth: true, perm: 'settings' }
+    },
     {
         path: '/shared-folder/:folder',
         name: 'shared-folder',
         component: SharedFolderInfoComponent,
         meta: { requiresAuth: true, perm: 'folders' }
     },
     {
         path: '/shared-folders',
         name: 'shared-folders',
         component: SharedFolderListComponent,
         meta: { requiresAuth: true, perm: 'folders' }
     },
     {
         path: '/signup/invite/:param',
         name: 'signup-invite',
         component: SignupComponent
     },
     {
         path: '/signup/:param?',
         alias: '/signup/voucher/:param',
         name: 'signup',
         component: SignupComponent
     },
     {
         path: '/user/:user',
         name: 'user',
         component: UserInfoComponent,
         meta: { requiresAuth: true, perm: 'users' }
     },
     {
         path: '/users',
         name: 'users',
         component: UserListComponent,
         meta: { requiresAuth: true, perm: 'users' }
     },
     {
         path: '/wallet',
         name: 'wallet',
         component: WalletComponent,
         meta: { requiresAuth: true, perm: 'wallets' }
     },
     {
         name: '404',
         path: '*',
         component: PageComponent
     }
 ]
 
 export default routes
diff --git a/src/resources/lang/en/app.php b/src/resources/lang/en/app.php
index 36ba0330..f35ced05 100644
--- a/src/resources/lang/en/app.php
+++ b/src/resources/lang/en/app.php
@@ -1,119 +1,125 @@
 <?php
 
 return [
 
     /*
     |--------------------------------------------------------------------------
     | Application Language Lines
     |--------------------------------------------------------------------------
     |
     | The following language lines are used in the application.
     */
 
     'chart-created' => 'Created',
     'chart-deleted' => 'Deleted',
     'chart-average' => 'average',
     'chart-allusers' => 'All Users - last year',
     'chart-discounts' => 'Discounts',
     'chart-vouchers' => 'Vouchers',
     'chart-income' => 'Income in :currency - last 8 weeks',
     'chart-users' => 'Users - last 8 weeks',
 
     'mandate-delete-success' => 'The auto-payment has been removed.',
     'mandate-update-success' => 'The auto-payment has been updated.',
 
     'planbutton' => 'Choose :plan',
 
     'process-async' => 'Setup process has been pushed. Please wait.',
     'process-user-new' => 'Registering a user...',
     'process-user-ldap-ready' => 'Creating a user...',
     'process-user-imap-ready' => 'Creating a mailbox...',
     'process-domain-new' => 'Registering a custom domain...',
     'process-domain-ldap-ready' => 'Creating a custom domain...',
     'process-domain-verified' => 'Verifying a custom domain...',
     'process-domain-confirmed' => 'Verifying an ownership of a custom domain...',
     'process-success' => 'Setup process finished successfully.',
     'process-error-distlist-ldap-ready' => 'Failed to create a distribution list.',
     'process-error-domain-ldap-ready' => 'Failed to create a domain.',
     'process-error-domain-verified' => 'Failed to verify a domain.',
     'process-error-domain-confirmed' => 'Failed to verify an ownership of a domain.',
     'process-error-resource-imap-ready' => 'Failed to verify that a shared folder exists.',
     'process-error-resource-ldap-ready' => 'Failed to create a resource.',
     'process-error-shared-folder-imap-ready' => 'Failed to verify that a shared folder exists.',
     'process-error-shared-folder-ldap-ready' => 'Failed to create a shared folder.',
     'process-error-user-ldap-ready' => 'Failed to create a user.',
     'process-error-user-imap-ready' => 'Failed to verify that a mailbox exists.',
     'process-distlist-new' => 'Registering a distribution list...',
     'process-distlist-ldap-ready' => 'Creating a distribution list...',
     'process-resource-new' => 'Registering a resource...',
     'process-resource-imap-ready' => 'Creating a shared folder...',
     'process-resource-ldap-ready' => 'Creating a resource...',
     'process-shared-folder-new' => 'Registering a shared folder...',
     'process-shared-folder-imap-ready' => 'Creating a shared folder...',
     'process-shared-folder-ldap-ready' => 'Creating a shared folder...',
 
     'distlist-update-success' => 'Distribution list updated successfully.',
     'distlist-create-success' => 'Distribution list created successfully.',
     'distlist-delete-success' => 'Distribution list deleted successfully.',
     'distlist-suspend-success' => 'Distribution list suspended successfully.',
     'distlist-unsuspend-success' => 'Distribution list unsuspended successfully.',
     'distlist-setconfig-success' => 'Distribution list settings updated successfully.',
 
     'domain-create-success' => 'Domain created successfully.',
     'domain-delete-success' => 'Domain deleted successfully.',
     'domain-notempty-error' => 'Unable to delete a domain with assigned users or other objects.',
     'domain-verify-success' => 'Domain verified successfully.',
     'domain-verify-error' => 'Domain ownership verification failed.',
     'domain-suspend-success' => 'Domain suspended successfully.',
     'domain-unsuspend-success' => 'Domain unsuspended successfully.',
     'domain-setconfig-success' => 'Domain settings updated successfully.',
 
     'resource-update-success' => 'Resource updated successfully.',
     'resource-create-success' => 'Resource created successfully.',
     'resource-delete-success' => 'Resource deleted successfully.',
     'resource-setconfig-success' => 'Resource settings updated successfully.',
 
     'shared-folder-update-success' => 'Shared folder updated successfully.',
     'shared-folder-create-success' => 'Shared folder created successfully.',
     'shared-folder-delete-success' => 'Shared folder deleted successfully.',
     'shared-folder-setconfig-success' => 'Shared folder settings updated successfully.',
 
     'user-update-success' => 'User data updated successfully.',
     'user-create-success' => 'User created successfully.',
     'user-delete-success' => 'User deleted successfully.',
     'user-suspend-success' => 'User suspended successfully.',
     'user-unsuspend-success' => 'User unsuspended successfully.',
     'user-reset-2fa-success' => '2-Factor authentication reset successfully.',
     'user-setconfig-success' => 'User settings updated successfully.',
     'user-set-sku-success' => 'The subscription added successfully.',
     'user-set-sku-already-exists' => 'The subscription already exists.',
 
     'search-foundxdomains' => ':x domains have been found.',
     'search-foundxdistlists' => ':x distribution lists have been found.',
     'search-foundxresources' => ':x resources have been found.',
     'search-foundxsharedfolders' => ':x shared folders have been found.',
     'search-foundxusers' => ':x user accounts have been found.',
 
     'signup-invitations-created' => 'The invitation has been created.|:count invitations has been created.',
     'signup-invitations-csv-empty' => 'Failed to find any valid email addresses in the uploaded file.',
     'signup-invitations-csv-invalid-email' => 'Found an invalid email address (:email) on line :line.',
     'signup-invitation-delete-success' => 'Invitation deleted successfully.',
     'signup-invitation-resend-success' => 'Invitation added to the sending queue successfully.',
 
     'support-request-success' => 'Support request submitted successfully.',
     'support-request-error' => 'Failed to submit the support request.',
 
     'siteuser' => ':site User',
 
     'wallet-award-success' => 'The bonus has been added to the wallet successfully.',
     'wallet-penalty-success' => 'The penalty has been added to the wallet successfully.',
     'wallet-update-success' => 'User wallet updated successfully.',
 
     'password-reset-code-delete-success' => 'Password reset code deleted successfully.',
+    'password-rule-min' => 'Minimum password length: :param characters',
+    'password-rule-max' => 'Maximum password length: :param characters',
+    'password-rule-lower' => 'Password contains a lower-case character',
+    'password-rule-upper' => 'Password contains an upper-case character',
+    'password-rule-digit' => 'Password contains a digit',
+    'password-rule-special' => 'Password contains a special character',
 
     'wallet-notice-date' => 'With your current subscriptions your account balance will last until about :date (:days).',
     'wallet-notice-nocredit' => 'You are out of credit, top up your balance now.',
     'wallet-notice-today' => 'You will run out of credit today, top up your balance now.',
     'wallet-notice-trial' => 'You are in your free trial period.',
     'wallet-notice-trial-end' => 'Your free trial is about to end, top up to continue.',
 ];
diff --git a/src/resources/lang/en/ui.php b/src/resources/lang/en/ui.php
index 81202e75..789b7a2c 100644
--- a/src/resources/lang/en/ui.php
+++ b/src/resources/lang/en/ui.php
@@ -1,487 +1,489 @@
 <?php
 
 /**
  * This file will be converted to a Vue-i18n compatible JSON format on build time
  *
  * Note: The Laravel localization features do not work here. Vue-i18n rules are different
  */
 
 return [
 
     'app' => [
         'faq' => "FAQ",
     ],
 
     'btn' => [
         'add' => "Add",
         'accept' => "Accept",
         'back' => "Back",
         'cancel' => "Cancel",
         'close' => "Close",
         'continue' => "Continue",
         'copy' => "Copy",
         'delete' => "Delete",
         'deny' => "Deny",
         'download' => "Download",
         'edit' => "Edit",
         'file' => "Choose file...",
         'moreinfo' => "More information",
         'refresh' => "Refresh",
         'reset' => "Reset",
         'resend' => "Resend",
         'save' => "Save",
         'search' => "Search",
         'signup' => "Sign Up",
         'submit' => "Submit",
         'suspend' => "Suspend",
         'unsuspend' => "Unsuspend",
         'verify' => "Verify",
     ],
 
     'dashboard' => [
         'beta' => "beta",
         'distlists' => "Distribution lists",
         'chat' => "Video chat",
         'domains' => "Domains",
         'invitations' => "Invitations",
         'profile' => "Your profile",
         'resources' => "Resources",
+        'settings' => "Settings",
         'shared-folders' => "Shared folders",
         'users' => "User accounts",
         'wallet' => "Wallet",
         'webmail' => "Webmail",
         'stats' => "Stats",
     ],
 
     'distlist' => [
         'list-title' => "Distribution list | Distribution lists",
         'create' => "Create list",
         'delete' => "Delete list",
         'email' => "Email",
         'list-empty' => "There are no distribution lists in this account.",
         'name' => "Name",
         'new' => "New distribution list",
         'recipients' => "Recipients",
         'sender-policy' => "Sender Access List",
         'sender-policy-text' => "With this list you can specify who can send mail to the distribution list."
             . " You can put a complete email address (jane@kolab.org), domain (kolab.org) or suffix (.org) that the sender email address is compared to."
             . " If the list is empty, mail from anyone is allowed.",
     ],
 
     'domain' => [
         'delete' => "Delete domain",
         'delete-domain' => "Delete {domain}",
         'delete-text' => "Do you really want to delete this domain permanently?"
             . " This is only possible if there are no users, aliases or other objects in this domain."
             . " Please note that this action cannot be undone.",
         'dns-verify' => "Domain DNS verification sample:",
         'dns-config' => "Domain DNS configuration sample:",
         'namespace' => "Namespace",
         'spf-whitelist' => "SPF Whitelist",
         'spf-whitelist-text' => "The Sender Policy Framework allows a sender domain to disclose, through DNS, "
             . "which systems are allowed to send emails with an envelope sender address within said domain.",
         'spf-whitelist-ex' => "Here you can specify a list of allowed servers, for example: <var>.ess.barracuda.com</var>.",
         'verify' => "Domain verification",
         'verify-intro' => "In order to confirm that you're the actual holder of the domain, we need to run a verification process before finally activating it for email delivery.",
         'verify-dns' => "The domain <b>must have one of the following entries</b> in DNS:",
         'verify-dns-txt' => "TXT entry with value:",
         'verify-dns-cname' => "or CNAME entry:",
         'verify-outro' => "When this is done press the button below to start the verification.",
         'verify-sample' => "Here's a sample zone file for your domain:",
         'config' => "Domain configuration",
         'config-intro' => "In order to let {app} receive email traffic for your domain you need to adjust the DNS settings, more precisely the MX entries, accordingly.",
         'config-sample' => "Edit your domain's zone file and replace existing MX entries with the following values:",
         'config-hint' => "If you don't know how to set DNS entries for your domain, please contact the registration service where you registered the domain or your web hosting provider.",
         'create' => "Create domain",
         'new' => "New domain",
     ],
 
     'error' => [
         '400' => "Bad request",
         '401' => "Unauthorized",
         '403' => "Access denied",
         '404' => "Not found",
         '405' => "Method not allowed",
         '500' => "Internal server error",
         'unknown' => "Unknown Error",
         'server' => "Server Error",
         'form' => "Form validation error",
     ],
 
     'form' => [
         'acl' => "Access rights",
         'acl-full' => "All",
         'acl-read-only' => "Read-only",
         'acl-read-write' => "Read-write",
         'amount' => "Amount",
         'anyone' => "Anyone",
         'code' => "Confirmation Code",
         'config' => "Configuration",
         'date' => "Date",
         'description' => "Description",
         'details' => "Details",
         'disabled' => "disabled",
         'domain' => "Domain",
         'email' => "Email Address",
         'enabled' => "enabled",
         'firstname' => "First Name",
         'general' => "General",
         'lastname' => "Last Name",
         'name' => "Name",
         'none' => "none",
         'or' => "or",
         'password' => "Password",
         'password-confirm' => "Confirm Password",
         'phone' => "Phone",
         'settings' => "Settings",
         'shared-folder' => "Shared Folder",
         'status' => "Status",
         'surname' => "Surname",
         'type' => "Type",
         'user' => "User",
         'primary-email' => "Primary Email",
         'id' => "ID",
         'created' => "Created",
         'deleted' => "Deleted",
     ],
 
     'invitation' => [
         'create' => "Create invite(s)",
         'create-title' => "Invite for a signup",
         'create-email' => "Enter an email address of the person you want to invite.",
         'create-csv' => "To send multiple invitations at once, provide a CSV (comma separated) file, or alternatively a plain-text file, containing one email address per line.",
         'empty-list' => "There are no invitations in the database.",
         'title' => "Signup invitations",
         'search' => "Email address or domain",
         'send' => "Send invite(s)",
         'status-completed' => "User signed up",
         'status-failed' => "Sending failed",
         'status-sent' => "Sent",
         'status-new' => "Not sent yet",
     ],
 
     'lang' => [
         'en' => "English",
         'de' => "German",
         'fr' => "French",
         'it' => "Italian",
     ],
 
     'login' => [
         '2fa' => "Second factor code",
         '2fa_desc' => "Second factor code is optional for users with no 2-Factor Authentication setup.",
         'forgot_password' => "Forgot password?",
         'header' => "Please sign in",
         'sign_in' => "Sign in",
         'webmail' => "Webmail"
     ],
 
     'meet' => [
         'title' => "Voice & Video Conferencing",
         'welcome' => "Welcome to our beta program for Voice & Video Conferencing.",
         'url' => "You have a room of your own at the URL below. This room is only open when you yourself are in attendance. Use this URL to invite people to join you.",
         'notice' => "This is a work in progress and more features will be added over time. Current features include:",
         'sharing' => "Screen Sharing",
         'sharing-text' => "Share your screen for presentations or show-and-tell.",
         'security' => "Room Security",
         'security-text' => "Increase the room security by setting a password that attendees will need to know"
             . " before they can enter, or lock the door so attendees will have to knock, and a moderator can accept or deny those requests.",
         'qa' => "Raise Hand (Q&A)",
         'qa-text' => "Silent audience members can raise their hand to facilitate a Question & Answer session with the panel members.",
         'moderation' => "Moderator Delegation",
         'moderation-text' => "Delegate moderator authority for the session, so that a speaker is not needlessly"
             . " interrupted with attendees knocking and other moderator duties.",
         'eject' => "Eject Attendees",
         'eject-text' => "Eject attendees from the session in order to force them to reconnect, or address policy"
             . " violations. Click the user icon for effective dismissal.",
         'silent' => "Silent Audience Members",
         'silent-text' => "For a webinar-style session, configure the room to force all new attendees to be silent audience members.",
         'interpreters' => "Language Specific Audio Channels",
         'interpreters-text' => "Designate a participant to interpret the original audio to a target language, for sessions"
             . " with multi-lingual attendees. The interpreter is expected to be able to relay the original audio, and override it.",
         'beta-notice' => "Keep in mind that this is still in beta and might come with some issues."
             . " Should you encounter any on your way, let us know by contacting support.",
 
         // Room options dialog
         'options' => "Room options",
         'password' => "Password",
         'password-none' => "none",
         'password-clear' => "Clear password",
         'password-set' => "Set password",
         'password-text' => "You can add a password to your meeting. Participants will have to provide the password before they are allowed to join the meeting.",
         'lock' => "Locked room",
         'lock-text' => "When the room is locked participants have to be approved by a moderator before they could join the meeting.",
         'nomedia' => "Subscribers only",
         'nomedia-text' => "Forces all participants to join as subscribers (with camera and microphone turned off)."
             . " Moderators will be able to promote them to publishers throughout the session.",
 
         // Room menu
         'partcnt' => "Number of participants",
         'menu-audio-mute' => "Mute audio",
         'menu-audio-unmute' => "Unmute audio",
         'menu-video-mute' => "Mute video",
         'menu-video-unmute' => "Unmute video",
         'menu-screen' => "Share screen",
         'menu-hand-lower' => "Lower hand",
         'menu-hand-raise' => "Raise hand",
         'menu-channel' => "Interpreted language channel",
         'menu-chat' => "Chat",
         'menu-fullscreen' => "Full screen",
         'menu-fullscreen-exit' => "Exit full screen",
         'menu-leave' => "Leave session",
 
         // Room setup screen
         'setup-title' => "Set up your session",
         'mic' => "Microphone",
         'cam' => "Camera",
         'nick' => "Nickname",
         'nick-placeholder' => "Your name",
         'join' => "JOIN",
         'joinnow' => "JOIN NOW",
         'imaowner' => "I'm the owner",
 
         // Room
         'qa' => "Q & A",
         'leave-title' => "Room closed",
         'leave-body' => "The session has been closed by the room owner.",
         'media-title' => "Media setup",
         'join-request' => "Join request",
         'join-requested' => "{user} requested to join.",
 
         // Status messages
         'status-init' => "Checking the room...",
         'status-323' => "The room is closed. Please, wait for the owner to start the session.",
         'status-324' => "The room is closed. It will be open for others after you join.",
         'status-325' => "The room is ready. Please, provide a valid password.",
         'status-326' => "The room is locked. Please, enter your name and try again.",
         'status-327' => "Waiting for permission to join the room.",
         'status-404' => "The room does not exist.",
         'status-429' => "Too many requests. Please, wait.",
         'status-500' => "Failed to connect to the room. Server error.",
 
         // Other menus
         'media-setup' => "Media setup",
         'perm' => "Permissions",
         'perm-av' => "Audio &amp; Video publishing",
         'perm-mod' => "Moderation",
         'lang-int' => "Language interpreter",
         'menu-options' => "Options",
     ],
 
     'menu' => [
         'cockpit' => "Cockpit",
         'login' => "Login",
         'logout' => "Logout",
         'signup' => "Signup",
         'toggle' => "Toggle navigation",
     ],
 
     'msg' => [
         'initializing' => "Initializing...",
         'loading' => "Loading...",
         'loading-failed' => "Failed to load data.",
         'notfound' => "Resource not found.",
         'info' => "Information",
         'error' => "Error",
         'warning' => "Warning",
         'success' => "Success",
     ],
 
     'nav' => [
         'more' => "Load more",
         'step' => "Step {i}/{n}",
     ],
 
     'password' => [
         'reset' => "Password Reset",
         'reset-step1' => "Enter your email address to reset your password.",
         'reset-step1-hint' => "You may need to check your spam folder or unblock {email}.",
         'reset-step2' => "We sent out a confirmation code to your external email address."
             . " Enter the code we sent you, or click the link in the message.",
     ],
 
     'resource' => [
         'create' => "Create resource",
         'delete' => "Delete resource",
         'invitation-policy' => "Invitation policy",
         'invitation-policy-text' => "Event invitations for a resource are normally accepted automatically"
             . " if there is no conflicting event on the requested time slot. Invitation policy allows"
             . " for rejecting such requests or to require a manual acceptance from a specified user.",
         'ipolicy-manual' => "Manual (tentative)",
         'ipolicy-accept' => "Accept",
         'ipolicy-reject' => "Reject",
         'list-title' => "Resource | Resources",
         'list-empty' => "There are no resources in this account.",
         'new' => "New resource",
     ],
 
     'shf' => [
         'create' => "Create folder",
         'delete' => "Delete folder",
         'acl-text' => "Defines user permissions to access the shared folder.",
         'list-title' => "Shared folder | Shared folders",
         'list-empty' => "There are no shared folders in this account.",
         'new' => "New shared folder",
         'type-mail' => "Mail",
         'type-event' => "Calendar",
         'type-contact' => "Address Book",
         'type-task' => "Tasks",
         'type-note' => "Notes",
         'type-file' => "Files",
     ],
 
     'signup' => [
         'email' => "Existing Email Address",
         'login' => "Login",
         'title' => "Sign Up",
         'step1' => "Sign up to start your free month.",
         'step2' => "We sent out a confirmation code to your email address. Enter the code we sent you, or click the link in the message.",
         'step3' => "Create your Kolab identity (you can choose additional addresses later).",
         'voucher' => "Voucher Code",
     ],
 
     'status' => [
         'prepare-account' => "We are preparing your account.",
         'prepare-domain' => "We are preparing the domain.",
         'prepare-distlist' => "We are preparing the distribution list.",
         'prepare-resource' => "We are preparing the resource.",
         'prepare-shared-folder' => "We are preparing the shared folder.",
         'prepare-user' => "We are preparing the user account.",
         'prepare-hint' => "Some features may be missing or readonly at the moment.",
         'prepare-refresh' => "The process never ends? Press the \"Refresh\" button, please.",
         'ready-account' => "Your account is almost ready.",
         'ready-domain' => "The domain is almost ready.",
         'ready-distlist' => "The distribution list is almost ready.",
         'ready-resource' => "The resource is almost ready.",
         'ready-shared-folder' => "The shared-folder is almost ready.",
         'ready-user' => "The user account is almost ready.",
         'verify' => "Verify your domain to finish the setup process.",
         'verify-domain' => "Verify domain",
         'degraded' => "Degraded",
         'deleted' => "Deleted",
         'suspended' => "Suspended",
         'notready' => "Not Ready",
         'active' => "Active",
     ],
 
     'support' => [
         'title' => "Contact Support",
         'id' => "Customer number or email address you have with us",
         'id-pl' => "e.g. 12345678 or john@kolab.org",
         'id-hint' => "Leave blank if you are not a customer yet",
         'name' => "Name",
         'name-pl' => "how we should call you in our reply",
         'email' => "Working email address",
         'email-pl' => "make sure we can reach you at this address",
         'summary' => "Issue Summary",
         'summary-pl' => "one sentence that summarizes your issue",
         'expl' => "Issue Explanation",
     ],
 
     'user' => [
         '2fa-hint1' => "This will remove 2-Factor Authentication entitlement as well as the user-configured factors.",
         '2fa-hint2' => "Please, make sure to confirm the user identity properly.",
         'add-beta' => "Enable beta program",
         'address' => "Address",
         'aliases' => "Aliases",
         'aliases-email' => "Email Aliases",
         'aliases-none' => "This user has no email aliases.",
         'add-bonus' => "Add bonus",
         'add-bonus-title' => "Add a bonus to the wallet",
         'add-penalty' => "Add penalty",
         'add-penalty-title' => "Add a penalty to the wallet",
         'auto-payment' => "Auto-payment",
         'auto-payment-text' => "Fill up by <b>{amount}</b> when under <b>{balance}</b> using {method}",
         'country' => "Country",
         'create' => "Create user",
         'custno' => "Customer No.",
         'degraded-warning' => "The account is degraded. Some features have been disabled.",
         'degraded-hint' => "Please, make a payment.",
         'delete' => "Delete user",
         'delete-account' => "Delete this account?",
         'delete-email' => "Delete {email}",
         'delete-text' => "Do you really want to delete this user permanently?"
             . " This will delete all account data and withdraw the permission to access the email account."
             . " Please note that this action cannot be undone.",
         'discount' => "Discount",
         'discount-hint' => "applied discount",
         'discount-title' => "Account discount",
         'distlists' => "Distribution lists",
         'domains' => "Domains",
         'domains-none' => "There are no domains in this account.",
         'ext-email' => "External Email",
         'finances' => "Finances",
         'greylisting' => "Greylisting",
         'greylisting-text' => "Greylisting is a method of defending users against spam. Any incoming mail from an unrecognized sender "
             . "is temporarily rejected. The originating server should try again after a delay. "
             . "This time the email will be accepted. Spammers usually do not reattempt mail delivery.",
         'list-title' => "User accounts",
         'managed-by' => "Managed by",
         'new' => "New user account",
         'org' => "Organization",
         'package' => "Package",
         'pass-input' => "Enter password",
         'pass-link' => "Set via link",
         'pass-link-label' => "Link:",
+        'passwordpolicy' => "Password Policy",
         'price' => "Price",
         'profile-title' => "Your profile",
         'profile-delete' => "Delete account",
         'profile-delete-title' => "Delete this account?",
         'profile-delete-text1' => "This will delete the account as well as all domains, users and aliases associated with this account.",
         'profile-delete-warning' => "This operation is irreversible",
         'profile-delete-text2' => "As you will not be able to recover anything after this point, please make sure that you have migrated all data before proceeding.",
         'profile-delete-support' => "As we always strive to improve, we would like to ask for 2 minutes of your time. "
             . "The best tool for improvement is feedback from users, and we would like to ask "
             . "for a few words about your reasons for leaving our service. Please send your feedback to <a href=\"{href}\">{email}</a>.",
         'profile-delete-contact' => "Also feel free to contact {app} Support with any questions or concerns that you may have in this context.",
         'reset-2fa' => "Reset 2-Factor Auth",
         'reset-2fa-title' => "2-Factor Authentication Reset",
         'resources' => "Resources",
         'title' => "User account",
         'search' => "User email address or name",
         'search-pl' => "User ID, email or domain",
         'skureq' => "{sku} requires {list}.",
         'subscription' => "Subscription",
         'subscriptions' => "Subscriptions",
         'subscriptions-none' => "This user has no subscriptions.",
         'users' => "Users",
         'users-none' => "There are no users in this account.",
     ],
 
     'wallet' => [
         'add-credit' => "Add credit",
         'auto-payment-cancel' => "Cancel auto-payment",
         'auto-payment-change' => "Change auto-payment",
         'auto-payment-failed' => "The setup of automatic payments failed. Restart the process to enable automatic top-ups.",
         'auto-payment-hint' => "Here is how it works: Every time your account runs low, we will charge your preferred payment method for an amount you choose."
             . " You can cancel or change the auto-payment option at any time.",
         'auto-payment-setup' => "Set up auto-payment",
         'auto-payment-disabled' => "The configured auto-payment has been disabled. Top up your wallet or raise the auto-payment amount.",
         'auto-payment-info' => "Auto-payment is <b>set</b> to fill up your account by <b>{amount}</b> every time your account balance gets under <b>{balance}</b>.",
         'auto-payment-inprogress' => "The setup of the automatic payment is still in progress.",
         'auto-payment-next' => "Next, you will be redirected to the checkout page, where you can provide your credit card details.",
         'auto-payment-disabled-next' => "The auto-payment is disabled. Immediately after you submit new settings we'll enable it and attempt to top up your wallet.",
         'auto-payment-update' => "Update auto-payment",
         'banktransfer-hint' => "Please note that a bank transfer can take several days to complete.",
         'currency-conv' => "Here is how it works: You specify the amount by which you want to top up your wallet in {wc}."
             . " We will then convert this to {pc}, and on the next page you will be provided with the bank-details to transfer the amount in {pc}.",
         'fill-up' => "Fill up by",
         'history' => "History",
         'month' => "month",
         'noperm' => "Only account owners can access a wallet.",
         'payment-amount-hint' => "Choose the amount by which you want to top up your wallet.",
         'payment-method' => "Method of payment: {method}",
         'payment-warning' => "You will be charged for {price}.",
         'pending-payments' => "Pending Payments",
         'pending-payments-warning' => "You have payments that are still in progress. See the \"Pending Payments\" tab below.",
         'pending-payments-none' => "There are no pending payments for this account.",
         'receipts' => "Receipts",
         'receipts-hint' => "Here you can download receipts (in PDF format) for payments in specified period. Select the period and press the Download button.",
         'receipts-none' => "There are no receipts for payments in this account. Please, note that you can download receipts after the month ends.",
         'title' => "Account balance",
         'top-up' => "Top up your wallet",
         'transactions' => "Transactions",
         'transactions-none' => "There are no transactions for this account.",
         'when-below' => "when account balance is below",
     ],
 ];
diff --git a/src/resources/lang/en/validation.php b/src/resources/lang/en/validation.php
index 761dda11..a9982f4d 100644
--- a/src/resources/lang/en/validation.php
+++ b/src/resources/lang/en/validation.php
@@ -1,178 +1,182 @@
 <?php
 
 return [
 
     /*
     |--------------------------------------------------------------------------
     | Validation Language Lines
     |--------------------------------------------------------------------------
     |
     | The following language lines contain the default error messages used by
     | the validator class. Some of these rules have multiple versions such
     | as the size rules. Feel free to tweak each of these messages here.
     |
     */
 
     'accepted' => 'The :attribute must be accepted.',
     'active_url' => 'The :attribute is not a valid URL.',
     'after' => 'The :attribute must be a date after :date.',
     'after_or_equal' => 'The :attribute must be a date after or equal to :date.',
     'alpha' => 'The :attribute may only contain letters.',
     'alpha_dash' => 'The :attribute may only contain letters, numbers, dashes and underscores.',
     'alpha_num' => 'The :attribute may only contain letters and numbers.',
     'array' => 'The :attribute must be an array.',
     'before' => 'The :attribute must be a date before :date.',
     'before_or_equal' => 'The :attribute must be a date before or equal to :date.',
     'between' => [
         'numeric' => 'The :attribute must be between :min and :max.',
         'file' => 'The :attribute must be between :min and :max kilobytes.',
         'string' => 'The :attribute must be between :min and :max characters.',
         'array' => 'The :attribute must have between :min and :max items.',
     ],
     'boolean' => 'The :attribute field must be true or false.',
     'confirmed' => 'The :attribute confirmation does not match.',
     'date' => 'The :attribute is not a valid date.',
     'date_equals' => 'The :attribute must be a date equal to :date.',
     'date_format' => 'The :attribute does not match the format :format.',
     'different' => 'The :attribute and :other must be different.',
     'digits' => 'The :attribute must be :digits digits.',
     'digits_between' => 'The :attribute must be between :min and :max digits.',
     'dimensions' => 'The :attribute has invalid image dimensions.',
     'distinct' => 'The :attribute field has a duplicate value.',
     'email' => 'The :attribute must be a valid email address.',
     'ends_with' => 'The :attribute must end with one of the following: :values',
     'exists' => 'The selected :attribute is invalid.',
     'file' => 'The :attribute must be a file.',
     'filled' => 'The :attribute field must have a value.',
     'gt' => [
         'numeric' => 'The :attribute must be greater than :value.',
         'file' => 'The :attribute must be greater than :value kilobytes.',
         'string' => 'The :attribute must be greater than :value characters.',
         'array' => 'The :attribute must have more than :value items.',
     ],
     'gte' => [
         'numeric' => 'The :attribute must be greater than or equal :value.',
         'file' => 'The :attribute must be greater than or equal :value kilobytes.',
         'string' => 'The :attribute must be greater than or equal :value characters.',
         'array' => 'The :attribute must have :value items or more.',
     ],
     'image' => 'The :attribute must be an image.',
     'in' => 'The selected :attribute is invalid.',
     'in_array' => 'The :attribute field does not exist in :other.',
     'integer' => 'The :attribute must be an integer.',
     'ip' => 'The :attribute must be a valid IP address.',
     'ipv4' => 'The :attribute must be a valid IPv4 address.',
     'ipv6' => 'The :attribute must be a valid IPv6 address.',
     'json' => 'The :attribute must be a valid JSON string.',
     'lt' => [
         'numeric' => 'The :attribute must be less than :value.',
         'file' => 'The :attribute must be less than :value kilobytes.',
         'string' => 'The :attribute must be less than :value characters.',
         'array' => 'The :attribute must have less than :value items.',
     ],
     'lte' => [
         'numeric' => 'The :attribute must be less than or equal :value.',
         'file' => 'The :attribute must be less than or equal :value kilobytes.',
         'string' => 'The :attribute must be less than or equal :value characters.',
         'array' => 'The :attribute must not have more than :value items.',
     ],
     'max' => [
         'numeric' => 'The :attribute may not be greater than :max.',
         'file' => 'The :attribute may not be greater than :max kilobytes.',
         'string' => 'The :attribute may not be greater than :max characters.',
         'array' => 'The :attribute may not have more than :max items.',
     ],
     'mimes' => 'The :attribute must be a file of type: :values.',
     'mimetypes' => 'The :attribute must be a file of type: :values.',
     'min' => [
         'numeric' => 'The :attribute must be at least :min.',
         'file' => 'The :attribute must be at least :min kilobytes.',
         'string' => 'The :attribute must be at least :min characters.',
         'array' => 'The :attribute must have at least :min items.',
     ],
     'not_in' => 'The selected :attribute is invalid.',
     'not_regex' => 'The :attribute format is invalid.',
     'numeric' => 'The :attribute must be a number.',
     'present' => 'The :attribute field must be present.',
     'regex' => 'The :attribute format is invalid.',
     'required' => 'The :attribute field is required.',
     'required_if' => 'The :attribute field is required when :other is :value.',
     'required_unless' => 'The :attribute field is required unless :other is in :values.',
     'required_with' => 'The :attribute field is required when :values is present.',
     'required_with_all' => 'The :attribute field is required when :values are present.',
     'required_without' => 'The :attribute field is required when :values is not present.',
     'required_without_all' => 'The :attribute field is required when none of :values are present.',
     'same' => 'The :attribute and :other must match.',
     'size' => [
         'numeric' => 'The :attribute must be :size.',
         'file' => 'The :attribute must be :size kilobytes.',
         'string' => 'The :attribute must be :size characters.',
         'array' => 'The :attribute must contain :size items.',
     ],
     'starts_with' => 'The :attribute must start with one of the following: :values',
     'string' => 'The :attribute must be a string.',
     'timezone' => 'The :attribute must be a valid zone.',
     'unique' => 'The :attribute has already been taken.',
     'uploaded' => 'The :attribute failed to upload.',
     'url' => 'The :attribute format is invalid.',
     'uuid' => 'The :attribute must be a valid UUID.',
 
     '2fareq' => 'Second factor code is required.',
     '2fainvalid' => 'Second factor code is invalid.',
     'emailinvalid' => 'The specified email address is invalid.',
     'domaininvalid' => 'The specified domain is invalid.',
     'domainnotavailable' => 'The specified domain is not available.',
     'logininvalid' => 'The specified login is invalid.',
     'loginexists' => 'The specified login is not available.',
     'domainexists' => 'The specified domain is not available.',
     'noemailorphone' => 'The specified text is neither a valid email address nor a phone number.',
     'packageinvalid' => 'Invalid package selected.',
     'packagerequired' => 'Package is required.',
     'usernotexists' => 'Unable to find user.',
     'voucherinvalid' => 'The voucher code is invalid or expired.',
     'noextemail' => 'This user has no external email address.',
     'entryinvalid' => 'The specified :attribute is invalid.',
     'entryexists' => 'The specified :attribute is not available.',
     'minamount' => 'Minimum amount for a single payment is :amount.',
     'minamountdebt' => 'The specified amount does not cover the balance on the account.',
     'notalocaluser' => 'The specified email address does not exist.',
     'memberislist' => 'A recipient cannot be the same as the list address.',
     'listmembersrequired' => 'At least one recipient is required.',
     'spf-entry-invalid' => 'The entry format is invalid. Expected a domain name starting with a dot.',
     'sp-entry-invalid' => 'The entry format is invalid. Expected an email, domain, or part of it.',
     'acl-entry-invalid' => 'The entry format is invalid. Expected an email address.',
     'ipolicy-invalid' => 'The specified invitation policy is invalid.',
     'invalid-config-parameter' => 'The requested configuration parameter is not supported.',
     'nameexists' => 'The specified name is not available.',
     'nameinvalid' => 'The specified name is invalid.',
+    'password-policy-error' => 'Specified password does not comply with the policy.',
+    'invalid-password-policy' => 'Specified password policy is invalid.',
+    'password-policy-min-len-error' => 'Minimum password length cannot be less than :min.',
+    'password-policy-max-len-error' => 'Maximum password length cannot be more than :max.',
 
     /*
     |--------------------------------------------------------------------------
     | Custom Validation Language Lines
     |--------------------------------------------------------------------------
     |
     | Here you may specify custom validation messages for attributes using the
     | convention "attribute.rule" to name the lines. This makes it quick to
     | specify a specific custom language line for a given attribute rule.
     |
     */
 
     'custom' => [
         'attribute-name' => [
             'rule-name' => 'custom-message',
         ],
     ],
 
     /*
     |--------------------------------------------------------------------------
     | Custom Validation Attributes
     |--------------------------------------------------------------------------
     |
     | The following language lines are used to swap our attribute placeholder
     | with something more reader friendly such as "E-Mail Address" instead
     | of "email". This simply helps us make our message more expressive.
     |
     */
 
     'attributes' => [],
 ];
diff --git a/src/resources/themes/app.scss b/src/resources/themes/app.scss
index db382321..17605297 100644
--- a/src/resources/themes/app.scss
+++ b/src/resources/themes/app.scss
@@ -1,461 +1,462 @@
 html,
 body,
 body > .outer-container {
     height: 100%;
 }
 
 #app {
     display: flex;
     flex-direction: column;
     min-height: 100%;
     overflow: hidden;
 
     & > nav {
         flex-shrink: 0;
         z-index: 12;
     }
 
     & > div.container {
         flex-grow: 1;
         margin-top: 2rem;
         margin-bottom: 2rem;
     }
 
     & > .filler {
         flex-grow: 1;
     }
 
     & > div.container + .filler {
         display: none;
     }
 }
 
 .error-page {
     position: absolute;
     top: 0;
     height: 100%;
     width: 100%;
     align-content: center;
     align-items: center;
     display: flex;
     flex-wrap: wrap;
     justify-content: center;
     color: #636b6f;
     z-index: 10;
     background: white;
 
     .code {
         text-align: right;
         border-right: 2px solid;
         font-size: 26px;
         padding: 0 15px;
     }
 
     .message {
         font-size: 18px;
         padding: 0 15px;
     }
 
     .hint {
         margin-top: 3em;
         text-align: center;
         width: 100%;
     }
 }
 
 .app-loader {
     background-color: $body-bg;
     height: 100%;
     width: 100%;
     position: absolute;
     top: 0;
     left: 0;
     display: flex;
     align-items: center;
     justify-content: center;
     z-index: 8;
 
     .spinner-border {
         width: 120px;
         height: 120px;
         border-width: 15px;
         color: #b2aa99;
     }
 
     &.small .spinner-border {
         width: 25px;
         height: 25px;
         border-width: 3px;
     }
 
     &.fadeOut {
         visibility: hidden;
         opacity: 0;
         transition: visibility 300ms linear, opacity 300ms linear;
     }
 }
 
 pre {
     margin: 1rem 0;
     padding: 1rem;
     background-color: $menu-bg-color;
 }
 
 .card-title {
     font-size: 1.2rem;
     font-weight: bold;
 }
 
 tfoot.table-fake-body {
     background-color: #f8f8f8;
     color: grey;
     text-align: center;
 
     td {
         vertical-align: middle;
         height: 8em;
         border: 0;
     }
 
     tbody:not(:empty) + & {
         display: none;
     }
 }
 
 table {
     th {
         white-space: nowrap;
     }
 
     td.email,
     td.price,
     td.datetime,
     td.selection {
         width: 1%;
         white-space: nowrap;
     }
 
     td.buttons,
     th.price,
     td.price {
         width: 1%;
         text-align: right;
         white-space: nowrap;
     }
 
     &.form-list {
         margin: 0;
 
         td {
             border: 0;
 
             &:first-child {
                 padding-left: 0;
             }
 
             &:last-child {
                 padding-right: 0;
             }
         }
 
         button {
             line-height: 1;
         }
     }
 
     .btn-action {
         line-height: 1;
         padding: 0;
     }
 
     td {
         & > svg + a,
         & > svg + span {
             margin-left: .4em;
         }
     }
 }
 
 .list-details {
     min-height: 1em;
 
     & > ul {
         margin: 0;
         padding-left: 1.2em;
     }
 }
 
 .plan-selector {
     .plan-header {
         display: flex;
     }
 
     .plan-ico {
         margin:auto;
         font-size: 3.8rem;
         color: #f1a539;
         border: 3px solid #f1a539;
         width: 6rem;
         height: 6rem;
         border-radius: 50%;
     }
 }
 
 .status-message {
     display: flex;
     align-items: center;
     justify-content: center;
 
     .app-loader {
         width: auto;
         position: initial;
 
         .spinner-border {
             color: $body-color;
         }
     }
 
     svg {
         font-size: 1.5em;
     }
 
     :first-child {
         margin-right: 0.4em;
     }
 }
 
 .form-separator {
     position: relative;
     margin: 1em 0;
     display: flex;
     justify-content: center;
 
     hr {
         border-color: #999;
         margin: 0;
         position: absolute;
         top: 0.75em;
         width: 100%;
     }
 
     span {
         background: #fff;
         padding: 0 1em;
         z-index: 1;
     }
 }
 
 #status-box {
     background-color: lighten($green, 35);
 
     .progress {
         background-color: #fff;
         height: 10px;
     }
 
     .progress-label {
         font-size: 0.9em;
     }
 
     .progress-bar {
         background-color: $green;
     }
 
     &.process-failed {
         background-color: lighten($orange, 30);
 
         .progress-bar {
             background-color: $red;
         }
     }
 }
 
 @keyframes blinker {
     50% {
         opacity: 0;
     }
 }
 
 .blinker {
     animation: blinker 750ms step-start infinite;
 }
 
 #dashboard-nav {
     display: flex;
     flex-wrap: wrap;
     justify-content: center;
 
     & > a {
         padding: 1rem;
         text-align: center;
         white-space: nowrap;
         margin: 0.25rem;
         text-decoration: none;
         width: 150px;
 
         &.disabled {
             pointer-events: none;
             opacity: 0.6;
         }
 
         // Some icons are too big, scale them down
         &.link-domains,
         &.link-resources,
+        &.link-settings,
         &.link-wallet,
         &.link-invitations {
             svg {
                 transform: scale(0.9);
             }
         }
 
         .badge {
             position: absolute;
             top: 0.5rem;
             right: 0.5rem;
         }
     }
 
     svg {
         width: 6rem;
         height: 6rem;
         margin: auto;
     }
 }
 
 #payment-method-selection {
     display: flex;
     flex-wrap: wrap;
     justify-content: center;
 
     & > a {
         padding: 1rem;
         text-align: center;
         white-space: nowrap;
         margin: 0.25rem;
         text-decoration: none;
         width: 150px;
     }
 
     svg {
         width: 6rem;
         height: 6rem;
         margin: auto;
     }
 }
 
 #logon-form {
     flex-basis: auto; // Bootstrap issue? See logon page with width < 992
 }
 
 #logon-form-footer {
     a:not(:first-child) {
         margin-left: 2em;
     }
 }
 
 // Various improvements for mobile
 @include media-breakpoint-down(sm) {
     .card,
     .card-footer {
         border: 0;
     }
 
     .card-body {
         padding: 0.5rem 0;
     }
 
     .nav-tabs {
         flex-wrap: nowrap;
 
         .nav-link {
             white-space: nowrap;
             padding: 0.5rem 0.75rem;
         }
     }
 
     #app > div.container {
         margin-bottom: 1rem;
         margin-top: 1rem;
         max-width: 100%;
     }
 
     #header-menu-navbar {
         padding: 0;
     }
 
     #dashboard-nav > a {
         width: 135px;
     }
 
     .table-sm:not(.form-list) {
         tbody td {
             padding: 0.75rem 0.5rem;
 
             svg {
                 vertical-align: -0.175em;
             }
 
             & > svg {
                 font-size: 125%;
                 margin-right: 0.25rem;
             }
         }
     }
 
     .table.transactions {
         thead {
             display: none;
         }
 
         tbody {
             tr {
                 position: relative;
                 display: flex;
                 flex-wrap: wrap;
             }
 
             td {
                 width: auto;
                 border: 0;
                 padding: 0.5rem;
 
                 &.datetime {
                     width: 50%;
                     padding-left: 0;
                 }
 
                 &.description {
                     order: 3;
                     width: 100%;
                     border-bottom: 1px solid $border-color;
                     color: $secondary;
                     padding: 0 1.5em 0.5rem 0;
                     margin-top: -0.25em;
                 }
 
                 &.selection {
                     position: absolute;
                     right: 0;
                     border: 0;
                     top: 1.7em;
                     padding-right: 0;
                 }
 
                 &.price {
                     width: 50%;
                     padding-right: 0;
                 }
 
                 &.email {
                     display: none;
                 }
             }
         }
     }
 }
 
 @include media-breakpoint-down(sm) {
     .tab-pane > .card-body {
         padding: 0.5rem;
     }
 }
diff --git a/src/resources/themes/forms.scss b/src/resources/themes/forms.scss
index 44fa1853..b13edc66 100644
--- a/src/resources/themes/forms.scss
+++ b/src/resources/themes/forms.scss
@@ -1,160 +1,171 @@
 .list-input {
     & > div {
         &:not(:last-child) {
             margin-bottom: -1px;
 
             input,
             a.btn {
                 border-bottom-right-radius: 0;
                 border-bottom-left-radius: 0;
             }
         }
 
         &:not(:first-child) {
             input,
             a.btn {
                 border-top-right-radius: 0;
                 border-top-left-radius: 0;
             }
         }
     }
 
     input.is-invalid {
         z-index: 2;
     }
 
     .btn svg {
         vertical-align: middle;
     }
 }
 
 .acl-input {
     select.acl,
     select.mod-user {
         max-width: fit-content;
     }
 }
 
+.password-input {
+    ul {
+        svg {
+            width: 0.75em !important;
+        }
+        span {
+            padding: 0 0.05em;
+        }
+    }
+}
+
 .range-input {
     display: flex;
 
     label {
         margin-right: 0.5em;
         min-width: 4em;
         text-align: right;
         line-height: 1.7;
     }
 }
 
 .input-group-activable {
     &.active {
         :not(.activable) {
             display: none;
         }
     }
 
     &:not(.active) {
         .activable {
             display: none;
         }
     }
 
     // Label is always visible
     .label {
         color: $body-color;
         display: initial !important;
     }
 
     .input-group-text {
         border-color: transparent;
         background: transparent;
         padding-left: 0;
 
         &:not(.label) {
             flex: 1;
         }
     }
 }
 
 // An input group with a select and input, where input is displayed
 // only for some select values
 .input-group-select {
     &:not(.selected) {
         input {
             display: none;
         }
 
         select {
             border-bottom-right-radius: .25rem !important;
             border-top-right-radius: .25rem !important;
         }
     }
 
     input {
         border-bottom-right-radius: .25rem !important;
         border-top-right-radius: .25rem !important;
     }
 }
 
 .form-control-plaintext .btn-sm {
     margin-top: -0.25rem;
 }
 
 .buttons {
     & > button + button {
         margin-left: .5em;
     }
 }
 
 // Various improvements for mobile
 @include media-breakpoint-down(sm) {
     .row.mb-3 {
         margin-bottom: 0.5rem !important;
     }
 
     .nav-tabs {
         .nav-link {
             white-space: nowrap;
             padding: 0.5rem 0.75rem;
         }
     }
 
     .tab-content {
         margin-top: 0.5rem;
     }
 
     .col-form-label {
         color: #666;
         font-size: 95%;
     }
 
     .row.plaintext .col-form-label {
         padding-bottom: 0;
     }
 
     form.read-only.short label {
         width: 35%;
 
         & + * {
             width: 65%;
         }
     }
 
     .row.checkbox {
         position: relative;
 
         & > div {
             padding-top: 0 !important;
 
             input {
                 position: absolute;
                 top: 0.5rem;
                 right: 1rem;
             }
         }
 
         label {
             padding-right: 2.5rem;
         }
     }
 }
diff --git a/src/resources/vue/Dashboard.vue b/src/resources/vue/Dashboard.vue
index 0247262f..0d60e8b8 100644
--- a/src/resources/vue/Dashboard.vue
+++ b/src/resources/vue/Dashboard.vue
@@ -1,77 +1,80 @@
 <template>
     <div class="container" dusk="dashboard-component">
         <status-component :status="status" @status-update="statusUpdate"></status-component>
 
         <div id="dashboard-nav">
             <router-link class="card link-profile" :to="{ name: 'profile' }">
                 <svg-icon icon="user-cog"></svg-icon><span class="name">{{ $t('dashboard.profile') }}</span>
             </router-link>
             <router-link v-if="status.enableDomains" class="card link-domains" :to="{ name: 'domains' }">
                 <svg-icon icon="globe"></svg-icon><span class="name">{{ $t('dashboard.domains') }}</span>
             </router-link>
             <router-link v-if="status.enableUsers" class="card link-users" :to="{ name: 'users' }">
                 <svg-icon icon="user-friends"></svg-icon><span class="name">{{ $t('dashboard.users') }}</span>
             </router-link>
             <router-link v-if="status.enableDistlists" class="card link-distlists" :to="{ name: 'distlists' }">
                 <svg-icon icon="users"></svg-icon><span class="name">{{ $t('dashboard.distlists') }}</span>
                 <span class="badge bg-primary">{{ $t('dashboard.beta') }}</span>
             </router-link>
             <router-link v-if="status.enableResources" class="card link-resources" :to="{ name: 'resources' }">
                 <svg-icon icon="cog"></svg-icon><span class="name">{{ $t('dashboard.resources') }}</span>
                 <span class="badge bg-primary">{{ $t('dashboard.beta') }}</span>
             </router-link>
             <router-link v-if="status.enableFolders" class="card link-shared-folders" :to="{ name: 'shared-folders' }">
                 <svg-icon icon="folder-open"></svg-icon><span class="name">{{ $t('dashboard.shared-folders') }}</span>
                 <span class="badge bg-primary">{{ $t('dashboard.beta') }}</span>
             </router-link>
             <router-link v-if="status.enableWallets" class="card link-wallet" :to="{ name: 'wallet' }">
                 <svg-icon icon="wallet"></svg-icon><span class="name">{{ $t('dashboard.wallet') }}</span>
                 <span v-if="balance < 0" class="badge bg-danger">{{ $root.price(balance, currency) }}</span>
             </router-link>
             <router-link v-if="$root.hasSKU('meet') && !$root.isDegraded()" class="card link-chat" :to="{ name: 'rooms' }">
                 <svg-icon icon="comments"></svg-icon><span class="name">{{ $t('dashboard.chat') }}</span>
                 <span class="badge bg-primary">{{ $t('dashboard.beta') }}</span>
             </router-link>
+            <router-link v-if="status.enableSettings" class="card link-settings" :to="{ name: 'settings' }">
+                <svg-icon icon="sliders-h"></svg-icon><span class="name">{{ $t('dashboard.settings') }}</span>
+            </router-link>
             <a v-if="webmailURL" class="card link-webmail" :href="webmailURL">
                 <svg-icon icon="envelope"></svg-icon><span class="name">{{ $t('dashboard.webmail') }}</span>
             </a>
         </div>
     </div>
 </template>
 
 <script>
     import StatusComponent from './Widgets/Status'
 
     export default {
         components: {
             StatusComponent
         },
         data() {
             return {
                 status: {},
                 balance: 0,
                 currency: '',
                 webmailURL: window.config['app.webmail_url']
             }
         },
         mounted() {
             const authInfo = this.$store.state.authInfo
             this.status = authInfo.statusInfo
             this.getBalance(authInfo)
         },
         methods: {
             getBalance(authInfo) {
                 this.balance = 0;
                 // TODO: currencies, multi-wallets, accounts
                 authInfo.wallets.forEach(wallet => {
                     this.balance += wallet.balance
                     this.currency = wallet.currency
                 })
             },
             statusUpdate(user) {
                 this.status = Object.assign({}, this.status, user)
                 this.$store.state.authInfo.statusInfo = this.status
             }
         }
     }
 </script>
diff --git a/src/resources/vue/PasswordReset.vue b/src/resources/vue/PasswordReset.vue
index 329b1493..b7b26877 100644
--- a/src/resources/vue/PasswordReset.vue
+++ b/src/resources/vue/PasswordReset.vue
@@ -1,168 +1,169 @@
 <template>
     <div class="container">
         <div class="card" id="step1">
             <div class="card-body">
                 <h4 class="card-title">{{ $t('password.reset') }} - {{ $t('nav.step', { i: 1, n: 3 }) }}</h4>
                 <p class="card-text">
                     {{ $t('password.reset-step1') }}
                     <span v-if="fromEmail">{{ $t('password.reset-step1-hint', { email: fromEmail }) }}</span>
                 </p>
                 <form @submit.prevent="submitStep1" data-validation-prefix="reset_">
                     <div class="mb-3">
                         <label for="reset_email" class="visually-hidden">{{ $t('form.email') }}</label>
                         <input type="text" class="form-control" id="reset_email" :placeholder="$t('form.email')" required v-model="email">
                     </div>
                     <button class="btn btn-primary" type="submit"><svg-icon icon="check"></svg-icon> {{ $t('btn.continue') }}</button>
                 </form>
             </div>
         </div>
 
         <div class="card d-none" id="step2">
             <div class="card-body">
                 <h4 class="card-title">{{ $t('password.reset') }} - {{ $t('nav.step', { i: 2, n: 3 }) }}</h4>
                 <p class="card-text">
                     {{ $t('password.reset-step2') }}
                 </p>
                 <form @submit.prevent="submitStep2" data-validation-prefix="reset_">
                     <div class="mb-3">
                         <label for="reset_short_code" class="visually-hidden">{{ $t('form.code') }}</label>
                         <input type="text" class="form-control" id="reset_short_code" :placeholder="$t('form.code')" required v-model="short_code">
                     </div>
                     <button class="btn btn-secondary" type="button" @click="stepBack">{{ $t('btn.back') }}</button>
                     <button class="btn btn-primary ms-2" type="submit"><svg-icon icon="check"></svg-icon> {{ $t('btn.continue') }}</button>
                     <input type="hidden" id="reset_code" v-model="code" />
                 </form>
             </div>
         </div>
 
         <div class="card d-none" id="step3">
             <div class="card-body">
                 <h4 class="card-title">{{ $t('password.reset') }} - {{ $t('nav.step', { i: 3, n: 3 }) }}</h4>
                 <p class="card-text">
                 </p>
                 <form @submit.prevent="submitStep3" data-validation-prefix="reset_">
-                    <div class="mb-3">
-                        <label for="reset_password" class="visually-hidden">{{ $t('form.password') }}</label>
-                        <input type="password" class="form-control" id="reset_password" :placeholder="$t('form.password')" required v-model="password">
-                    </div>
-                    <div class="mb-3">
-                        <label for="reset_confirm" class="visually-hidden">{{ $t('form.password-confirm') }}</label>
-                        <input type="password" class="form-control" id="reset_confirm" :placeholder="$t('form.password-confirm')" required v-model="password_confirmation">
-                    </div>
-                    <div class="form-group pt-3 mb-3">
+                    <password-input class="mb-3" v-model="pass" :user="userId" v-if="userId" :focus="true"></password-input>
+                    <div class="form-group pt-1 mb-3">
                         <label for="secondfactor" class="sr-only">2FA</label>
                         <div class="input-group">
                             <span class="input-group-text">
                                 <svg-icon icon="key"></svg-icon>
                             </span>
                             <input type="text" id="secondfactor" class="form-control rounded-end" placeholder="Second factor code" v-model="secondFactor">
                         </div>
                         <small class="form-text text-muted">Second factor code is optional for users with no 2-Factor Authentication setup.</small>
                     </div>
                     <button class="btn btn-secondary" type="button" @click="stepBack">{{ $t('btn.back') }}</button>
                     <button class="btn btn-primary ms-2" type="submit"><svg-icon icon="check"></svg-icon> {{ $t('btn.submit') }}</button>
                 </form>
             </div>
         </div>
     </div>
 </template>
 
 <script>
+    import PasswordInput from './Widgets/PasswordInput'
+
     export default {
+        components: {
+            PasswordInput
+        },
         data() {
             return {
                 email: '',
                 code: '',
                 short_code: '',
-                password: '',
-                password_confirmation: '',
+                pass: {},
                 secondFactor: '',
+                userId: null,
                 fromEmail: window.config['mail.from.address']
             }
         },
         created() {
             // Verification code provided, auto-submit Step 2
             if (this.$route.params.code) {
                 if (/^([A-Z0-9]+)-([a-zA-Z0-9]+)$/.test(this.$route.params.code)) {
                     this.short_code = RegExp.$1
                     this.code = RegExp.$2
                     this.submitStep2(true)
                 }
                 else {
                     this.$root.errorPage(404)
                 }
             }
         },
         mounted() {
             // Focus the first input (autofocus does not work when using the menu/router)
             this.displayForm(1, true)
         },
         methods: {
             // Submits data to the API, validates and gets verification code
             submitStep1() {
                 this.$root.clearFormValidation($('#step1 form'))
 
                 axios.post('/api/auth/password-reset/init', {
                     email: this.email
                 }).then(response => {
                     this.displayForm(2, true)
                     this.code = response.data.code
                 })
             },
             // Submits the code to the API for verification
             submitStep2(bylink) {
                 if (bylink === true) {
                     this.displayForm(2, false)
                 }
 
                 this.$root.clearFormValidation($('#step2 form'))
 
                 axios.post('/api/auth/password-reset/verify', {
                     code: this.code,
                     short_code: this.short_code
                 }).then(response => {
+                    this.userId = response.data.userId
                     this.displayForm(3, true)
                 }).catch(error => {
                     if (bylink === true) {
                         // FIXME: display step 1, user can do nothing about it anyway
                         //        Maybe we should display 404 error page?
                         this.displayForm(1, true)
                     }
                 })
             },
             // Submits the data to the API to reset the password
             submitStep3() {
                 this.$root.clearFormValidation($('#step3 form'))
 
                 axios.post('/api/auth/password-reset', {
                     code: this.code,
                     short_code: this.short_code,
-                    password: this.password,
-                    password_confirmation: this.password_confirmation,
+                    password: this.pass.password,
+                    password_confirmation: this.pass.password_confirmation,
                     secondfactor: this.secondFactor
                 }).then(response => {
                     // auto-login and goto dashboard
                     this.$root.loginUser(response.data)
                 })
             },
             // Moves the user a step back in registration form
             stepBack(e) {
                 var card = $(e.target).closest('.card')
 
                 card.prev().removeClass('d-none').find('input').first().focus()
                 card.addClass('d-none').find('form')[0].reset()
+
+                this.userId = null
             },
             displayForm(step, focus) {
                 [1, 2, 3].filter(value => value != step).forEach(value => {
                     $('#step' + value).addClass('d-none')
                 })
 
                 $('#step' + step).removeClass('d-none')
 
                 if (focus) {
                     $('#step' + step).find('input').first().focus()
                 }
             }
         }
     }
 </script>
diff --git a/src/resources/vue/Settings.vue b/src/resources/vue/Settings.vue
new file mode 100644
index 00000000..6e4c91ff
--- /dev/null
+++ b/src/resources/vue/Settings.vue
@@ -0,0 +1,79 @@
+<template>
+    <div class="container">
+        <div class="card" id="settings">
+            <div class="card-body">
+                <div class="card-title">
+                    {{ $t('dashboard.settings') }}
+                </div>
+                <div class="card-text">
+                    <form @submit.prevent="submit">
+                        <div class="row mb-3">
+                            <label class="col-sm-4 col-form-label">{{ $t('user.passwordpolicy') }}</label>
+                            <div class="col-sm-8">
+                                <ul id="password_policy" class="list-group ms-1 mt-1">
+                                    <li v-for="rule in passwordPolicy" :key="rule.label" class="list-group-item border-0 form-check pt-1 pb-1">
+                                        <input type="checkbox" class="form-check-input" :id="'policy-' + rule.label" :name="rule.label" :checked="rule.enabled">
+                                        <label :for="'policy-' + rule.label" class="form-check-label pe-2">{{ rule.name.split(':')[0] }}</label>
+                                        <input type="text" class="form-control form-control-sm w-auto d-inline" v-if="['min', 'max'].includes(rule.label)" :value="rule.param" size="3">
+                                    </li>
+                                </ul>
+                            </div>
+                        </div>
+                        <button class="btn btn-primary" type="submit"><svg-icon icon="check"></svg-icon> {{ $t('btn.submit') }}</button>
+                    </form>
+                </div>
+            </div>
+        </div>
+    </div>
+</template>
+
+<script>
+    export default {
+        data() {
+            return {
+                passwordPolicy: []
+            }
+        },
+        created() {
+            this.wallet = this.$store.state.authInfo.wallet
+        },
+        mounted() {
+            this.$root.startLoading()
+
+            axios.get('/api/v4/password-policy')
+                .then(response => {
+                    this.$root.stopLoading()
+
+                    if (response.data.list) {
+                        this.passwordPolicy = response.data.list
+                    }
+                })
+                .catch(this.$root.errorHandler)
+        },
+        methods: {
+            submit() {
+                this.$root.clearFormValidation($('#settings form'))
+
+                let password_policy = [];
+
+                $('#password_policy > li > input:checked').each((i, element) => {
+                    let entry = element.name
+                    const input = $(element.parentNode).find('input[type=text]')[0]
+
+                    if (input) {
+                        entry += ':' + input.value
+                    }
+
+                    password_policy.push(entry)
+                })
+
+                let post = { password_policy: password_policy.join(',') }
+
+                axios.post('/api/v4/users/' + this.wallet.user_id + '/config', post)
+                    .then(response => {
+                        this.$toast.success(response.data.message)
+                    })
+            },
+        }
+    }
+</script>
diff --git a/src/resources/vue/Signup.vue b/src/resources/vue/Signup.vue
index 38816736..23c06e3a 100644
--- a/src/resources/vue/Signup.vue
+++ b/src/resources/vue/Signup.vue
@@ -1,304 +1,301 @@
 <template>
     <div class="container">
         <div id="step0" v-if="!invitation">
             <div class="plan-selector row row-cols-sm-2 g-3">
                 <div v-for="item in plans" :key="item.id">
                     <div :class="'card bg-light plan-' + item.title">
                         <div class="card-header plan-header">
                             <div class="plan-ico text-center">
                                 <svg-icon :icon="plan_icons[item.title]"></svg-icon>
                             </div>
                         </div>
                         <div class="card-body text-center">
                             <button class="btn btn-primary" :data-title="item.title" @click="selectPlan(item.title)" v-html="item.button"></button>
                             <div class="plan-description text-start mt-3" v-html="item.description"></div>
                         </div>
                     </div>
                 </div>
             </div>
         </div>
 
         <div class="card d-none" id="step1" v-if="!invitation">
             <div class="card-body">
                 <h4 class="card-title">{{ $t('signup.title') }} - {{ $t('nav.step', { i: 1, n: 3 }) }}</h4>
                 <p class="card-text">
                     {{ $t('signup.step1') }}
                 </p>
                 <form @submit.prevent="submitStep1" data-validation-prefix="signup_">
                     <div class="mb-3">
                         <div class="input-group">
                             <input type="text" class="form-control" id="signup_first_name" :placeholder="$t('form.firstname')" autofocus v-model="first_name">
                             <input type="text" class="form-control rounded-end" id="signup_last_name" :placeholder="$t('form.surname')" v-model="last_name">
                         </div>
                     </div>
                     <div class="mb-3">
                         <label for="signup_email" class="visually-hidden">{{ $t('signup.email') }}</label>
                         <input type="text" class="form-control" id="signup_email" :placeholder="$t('signup.email')" required v-model="email">
                     </div>
                     <button class="btn btn-secondary" type="button" @click="stepBack">{{ $t('btn.back') }}</button>
                     <button class="btn btn-primary ms-2" type="submit"><svg-icon icon="check"></svg-icon> {{ $t('btn.continue') }}</button>
                 </form>
             </div>
         </div>
 
         <div class="card d-none" id="step2" v-if="!invitation">
             <div class="card-body">
                 <h4 class="card-title">{{ $t('signup.title') }} - {{ $t('nav.step', { i: 2, n: 3 }) }}</h4>
                 <p class="card-text">
                     {{ $t('signup.step2') }}
                 </p>
                 <form @submit.prevent="submitStep2" data-validation-prefix="signup_">
                     <div class="mb-3">
                         <label for="signup_short_code" class="visually-hidden">{{ $t('form.code') }}</label>
                         <input type="text" class="form-control" id="signup_short_code" :placeholder="$t('form.code')" required v-model="short_code">
                     </div>
                     <button class="btn btn-secondary" type="button" @click="stepBack">{{ $t('btn.back') }}</button>
                     <button class="btn btn-primary ms-2" type="submit"><svg-icon icon="check"></svg-icon> {{ $t('btn.continue') }}</button>
                     <input type="hidden" id="signup_code" v-model="code" />
                 </form>
             </div>
         </div>
 
         <div class="card d-none" id="step3">
             <div class="card-body">
                 <h4 v-if="!invitation" class="card-title">{{ $t('signup.title') }} - {{ $t('nav.step', { i: 3, n: 3 }) }}</h4>
                 <p class="card-text">
                     {{ $t('signup.step3') }}
                 </p>
                 <form @submit.prevent="submitStep3" data-validation-prefix="signup_">
                     <div class="mb-3" v-if="invitation">
                         <div class="input-group">
                             <input type="text" class="form-control" id="signup_first_name" :placeholder="$t('form.firstname')" autofocus v-model="first_name">
                             <input type="text" class="form-control rounded-end" id="signup_last_name" :placeholder="$t('form.surname')" v-model="last_name">
                         </div>
                     </div>
                     <div class="mb-3">
                         <label for="signup_login" class="visually-hidden"></label>
                         <div class="input-group">
                             <input type="text" class="form-control" id="signup_login" required v-model="login" :placeholder="$t('signup.login')">
                             <span class="input-group-text">@</span>
                             <input v-if="is_domain" type="text" class="form-control rounded-end" id="signup_domain" required v-model="domain" :placeholder="$t('form.domain')">
                             <select v-else class="form-select rounded-end" id="signup_domain" required v-model="domain">
                                 <option v-for="_domain in domains" :key="_domain" :value="_domain">{{ _domain }}</option>
                             </select>
                         </div>
                     </div>
+                    <password-input class="mb-3" v-model="pass"></password-input>
                     <div class="mb-3">
-                        <label for="signup_password" class="visually-hidden">{{ $t('form.password') }}</label>
-                        <input type="password" class="form-control" id="signup_password" :placeholder="$t('form.password')" required v-model="password">
-                    </div>
-                    <div class="mb-3">
-                        <label for="signup_confirm" class="visually-hidden">{{ $t('form.password-confirm') }}</label>
-                        <input type="password" class="form-control" id="signup_confirm" :placeholder="$t('form.password-confirm')" required v-model="password_confirmation">
-                    </div>
-                    <div class="mb-3 pt-2">
                         <label for="signup_voucher" class="visually-hidden">{{ $t('signup.voucher') }}</label>
                         <input type="text" class="form-control" id="signup_voucher" :placeholder="$t('signup.voucher')" v-model="voucher">
                     </div>
                     <button v-if="!invitation" class="btn btn-secondary me-2" type="button" @click="stepBack">{{ $t('btn.back') }}</button>
                     <button class="btn btn-primary" type="submit">
                         <svg-icon icon="check"></svg-icon> <span v-if="invitation">{{ $t('btn.signup') }}</span><span v-else>{{ $t('btn.submit') }}</span>
                     </button>
                 </form>
             </div>
         </div>
     </div>
 </template>
 
 <script>
+    import PasswordInput from './Widgets/PasswordInput'
+
     export default {
+        components: {
+            PasswordInput
+        },
         data() {
             return {
                 email: '',
                 first_name: '',
                 last_name: '',
                 code: '',
                 short_code: '',
                 login: '',
-                password: '',
-                password_confirmation: '',
+                pass: {},
                 domain: '',
                 domains: [],
                 invitation: null,
                 is_domain: false,
                 plan: null,
                 plan_icons: {
                     individual: 'user',
                     group: 'users'
                 },
                 plans: [],
                 voucher: ''
             }
         },
         mounted() {
             let param = this.$route.params.param;
 
             if (this.$route.name == 'signup-invite') {
                 this.$root.startLoading()
                 axios.get('/api/auth/signup/invitations/' + param)
                     .then(response => {
                         this.invitation = response.data
                         this.login = response.data.login
                         this.voucher = response.data.voucher
                         this.first_name = response.data.first_name
                         this.last_name = response.data.last_name
                         this.plan = response.data.plan
                         this.is_domain = response.data.is_domain
                         this.setDomain(response.data)
                         this.$root.stopLoading()
                         this.displayForm(3, true)
                     })
                     .catch(error => {
                         this.$root.errorHandler(error)
                     })
             } else if (param) {
                 if (this.$route.path.indexOf('/signup/voucher/') === 0) {
                     // Voucher (discount) code
                     this.voucher = param
                     this.displayForm(0)
                 } else if (/^([A-Z0-9]+)-([a-zA-Z0-9]+)$/.test(param)) {
                     // Verification code provided, auto-submit Step 2
                     this.short_code = RegExp.$1
                     this.code = RegExp.$2
                     this.submitStep2(true)
                 } else if (/^([a-zA-Z_]+)$/.test(param)) {
                     // Plan title provided, save it and display Step 1
                     this.plan = param
                     this.displayForm(1, true)
                 } else {
                     this.$root.errorPage(404)
                 }
             } else {
                 this.displayForm(0)
             }
         },
         methods: {
             selectPlan(plan) {
                 this.$router.push({path: '/signup/' + plan})
                 this.plan = plan
                 this.displayForm(1, true)
             },
             // Composes plan selection page
             step0() {
                 if (!this.plans.length) {
                     this.$root.startLoading()
                     axios.get('/api/auth/signup/plans').then(response => {
                         this.$root.stopLoading()
                         this.plans = response.data.plans
                     })
                     .catch(error => {
                         this.$root.errorHandler(error)
                     })
                 }
             },
             // Submits data to the API, validates and gets verification code
             submitStep1() {
                 this.$root.clearFormValidation($('#step1 form'))
 
                 axios.post('/api/auth/signup/init', {
                     email: this.email,
                     last_name: this.last_name,
                     first_name: this.first_name,
                     plan: this.plan,
                     voucher: this.voucher
                 }).then(response => {
                     this.displayForm(2, true)
                     this.code = response.data.code
                 })
             },
             // Submits the code to the API for verification
             submitStep2(bylink) {
                 if (bylink === true) {
                     this.displayForm(2, false)
                 }
 
                 this.$root.clearFormValidation($('#step2 form'))
 
                 axios.post('/api/auth/signup/verify', {
                     code: this.code,
                     short_code: this.short_code
                 }).then(response => {
                     this.displayForm(3, true)
                     // Reset user name/email/plan, we don't have them if user used a verification link
                     this.first_name = response.data.first_name
                     this.last_name = response.data.last_name
                     this.email = response.data.email
                     this.is_domain = response.data.is_domain
                     this.voucher = response.data.voucher
 
                     // Fill the domain selector with available domains
                     if (!this.is_domain) {
                         this.setDomain(response.data)
                     }
                 }).catch(error => {
                     if (bylink === true) {
                         // FIXME: display step 1, user can do nothing about it anyway
                         //        Maybe we should display 404 error page?
                         this.displayForm(1, true)
                     }
                 })
             },
             // Submits the data to the API to create the user account
             submitStep3() {
                 this.$root.clearFormValidation($('#step3 form'))
 
                 let post = {
                     login: this.login,
                     domain: this.domain,
-                    password: this.password,
-                    password_confirmation: this.password_confirmation,
+                    password: this.pass.password,
+                    password_confirmation: this.pass.password_confirmation,
                     voucher: this.voucher
                 }
 
                 if (this.invitation) {
                     post.invitation = this.invitation.id
                     post.plan = this.plan
                     post.first_name = this.first_name
                     post.last_name = this.last_name
                 } else {
                     post.code = this.code
                     post.short_code = this.short_code
                 }
 
                 axios.post('/api/auth/signup', post).then(response => {
                     // auto-login and goto dashboard
                     this.$root.loginUser(response.data)
                 })
             },
             // Moves the user a step back in registration form
             stepBack(e) {
                 var card = $(e.target).closest('.card')
 
                 card.prev().removeClass('d-none').find('input').first().focus()
                 card.addClass('d-none').find('form')[0].reset()
 
                 if (card.attr('id') == 'step1') {
                     this.step0()
                     this.$router.replace({path: '/signup'})
                 }
             },
             displayForm(step, focus) {
                 [0, 1, 2, 3].filter(value => value != step).forEach(value => {
                     $('#step' + value).addClass('d-none')
                 })
 
                 if (!step) {
                     return this.step0()
                 }
 
                 $('#step' + step).removeClass('d-none')
 
                 if (focus) {
                     $('#step' + step).find('input').first().focus()
                 }
             },
             setDomain(response) {
                 if (response.domains) {
                     this.domains = response.domains
                 }
 
                 this.domain = response.domain || window.config['app.domain']
             }
         }
     }
 </script>
diff --git a/src/resources/vue/User/Info.vue b/src/resources/vue/User/Info.vue
index 2bb84e15..8330b8a2 100644
--- a/src/resources/vue/User/Info.vue
+++ b/src/resources/vue/User/Info.vue
@@ -1,341 +1,334 @@
 <template>
     <div class="container">
         <status-component v-if="user_id !== 'new'" :status="status" @status-update="statusUpdate"></status-component>
 
         <div class="card" id="user-info">
             <div class="card-body">
                 <div class="card-title" v-if="user_id !== 'new'">{{ $t('user.title') }}
                     <button
                         class="btn btn-outline-danger button-delete float-end"
                         @click="showDeleteConfirmation()" type="button"
                     >
                         <svg-icon icon="trash-alt"></svg-icon> {{ $t('user.delete') }}
                     </button>
                 </div>
                 <div class="card-title" v-if="user_id === 'new'">{{ $t('user.new') }}</div>
                 <div class="card-text">
                     <ul class="nav nav-tabs mt-3" role="tablist">
                         <li class="nav-item">
                             <a class="nav-link active" id="tab-general" href="#general" role="tab" aria-controls="general" aria-selected="true" @click="$root.tab">
                                 {{ $t('form.general') }}
                             </a>
                         </li>
                         <li v-if="user_id !== 'new'" class="nav-item">
                             <a class="nav-link" id="tab-settings" href="#settings" role="tab" aria-controls="settings" aria-selected="false" @click="$root.tab">
                                 {{ $t('form.settings') }}
                             </a>
                         </li>
                     </ul>
                     <div class="tab-content">
                         <div class="tab-pane show active" id="general" role="tabpanel" aria-labelledby="tab-general">
                             <form @submit.prevent="submit" class="card-body">
                                 <div v-if="user_id !== 'new'" class="row plaintext mb-3">
                                     <label for="status" class="col-sm-4 col-form-label">{{ $t('form.status') }}</label>
                                     <div class="col-sm-8">
                                         <span :class="$root.statusClass(user) + ' form-control-plaintext'" id="status">{{ $root.statusText(user) }}</span>
                                     </div>
                                 </div>
                                 <div class="row mb-3">
                                     <label for="first_name" class="col-sm-4 col-form-label">{{ $t('form.firstname') }}</label>
                                     <div class="col-sm-8">
                                         <input type="text" class="form-control" id="first_name" v-model="user.first_name">
                                     </div>
                                 </div>
                                 <div class="row mb-3">
                                     <label for="last_name" class="col-sm-4 col-form-label">{{ $t('form.lastname') }}</label>
                                     <div class="col-sm-8">
                                         <input type="text" class="form-control" id="last_name" v-model="user.last_name">
                                     </div>
                                 </div>
                                 <div class="row mb-3">
                                     <label for="organization" class="col-sm-4 col-form-label">{{ $t('user.org') }}</label>
                                     <div class="col-sm-8">
                                         <input type="text" class="form-control" id="organization" v-model="user.organization">
                                     </div>
                                 </div>
                                 <div class="row mb-3">
                                     <label for="email" class="col-sm-4 col-form-label">{{ $t('form.email') }}</label>
                                     <div class="col-sm-8">
                                         <input type="text" class="form-control" id="email" :disabled="user_id !== 'new'" required v-model="user.email">
                                     </div>
                                 </div>
                                 <div class="row mb-3">
                                     <label for="aliases-input" class="col-sm-4 col-form-label">{{ $t('user.aliases-email') }}</label>
                                     <div class="col-sm-8">
                                         <list-input id="aliases" :list="user.aliases"></list-input>
                                     </div>
                                 </div>
                                 <div class="row mb-3">
                                     <label for="password" class="col-sm-4 col-form-label">{{ $t('form.password') }}</label>
                                     <div class="col-sm-8">
                                         <div v-if="!isSelf" class="btn-group w-100" role="group">
                                             <input type="checkbox" id="pass-mode-input" value="input" class="btn-check" @change="setPasswordMode" :checked="passwordMode == 'input'">
                                             <label class="btn btn-outline-secondary" for="pass-mode-input">{{ $t('user.pass-input') }}</label>
                                             <input type="checkbox" id="pass-mode-link" value="link" class="btn-check" @change="setPasswordMode">
                                             <label class="btn btn-outline-secondary" for="pass-mode-link">{{ $t('user.pass-link') }}</label>
                                         </div>
-                                        <div v-if="passwordMode == 'input'" :class="isSelf ? '' : 'mt-2'">
-                                            <input id="password" type="password" class="form-control"
-                                                   v-model="user.password"
-                                                   :placeholder="$t('form.password')"
-                                            >
-                                            <input id="password_confirmation" type="password" class="form-control mt-2"
-                                                   v-model="user.password_confirmation"
-                                                   :placeholder="$t('form.password-confirm')"
-                                            >
-                                        </div>
+                                        <password-input v-if="passwordMode == 'input'" :class="isSelf ? '' : 'mt-2'" v-model="user"></password-input>
                                         <div id="password-link" v-if="passwordMode == 'link' || user.passwordLinkCode" class="mt-2">
                                             <span>{{ $t('user.pass-link-label') }}</span>&nbsp;<code>{{ passwordLink }}</code>
                                             <span class="d-inline-block">
                                                 <button class="btn btn-link p-1" type="button" :title="$t('btn.copy')" @click="passwordLinkCopy">
                                                     <svg-icon :icon="['far', 'clipboard']"></svg-icon>
                                                 </button>
                                                 <button v-if="user.passwordLinkCode" class="btn btn-link text-danger p-1" type="button" :title="$t('btn.delete')" @click="passwordLinkDelete">
                                                     <svg-icon icon="trash-alt"></svg-icon>
                                                 </button>
                                             </span>
                                         </div>
                                     </div>
                                 </div>
                                 <div v-if="user_id === 'new'" id="user-packages" class="row mb-3">
                                     <label class="col-sm-4 col-form-label">{{ $t('user.package') }}</label>
                                     <package-select class="col-sm-8 pt-sm-1"></package-select>
                                 </div>
                                 <div v-if="user_id !== 'new'" id="user-skus" class="row mb-3">
                                     <label class="col-sm-4 col-form-label">{{ $t('user.subscriptions') }}</label>
                                     <subscription-select v-if="user.id" class="col-sm-8 pt-sm-1" :object="user"></subscription-select>
                                 </div>
                                 <button class="btn btn-primary" type="submit"><svg-icon icon="check"></svg-icon> {{ $t('btn.submit') }}</button>
                             </form>
                         </div>
                         <div class="tab-pane" id="settings" role="tabpanel" aria-labelledby="tab-settings">
                             <form @submit.prevent="submitSettings" class="card-body">
                                 <div class="row checkbox mb-3">
                                     <label for="greylist_enabled" class="col-sm-4 col-form-label">{{ $t('user.greylisting') }}</label>
                                     <div class="col-sm-8 pt-2">
                                         <input type="checkbox" id="greylist_enabled" name="greylist_enabled" value="1" class="form-check-input d-block mb-2" :checked="user.config.greylist_enabled">
                                         <small id="greylisting-hint" class="text-muted">
                                             {{ $t('user.greylisting-text') }}
                                         </small>
                                     </div>
                                 </div>
                                 <button class="btn btn-primary" type="submit"><svg-icon icon="check"></svg-icon> {{ $t('btn.submit') }}</button>
                             </form>
                         </div>
                     </div>
                 </div>
             </div>
         </div>
         <div id="delete-warning" class="modal" tabindex="-1" role="dialog">
             <div class="modal-dialog" role="document">
                 <div class="modal-content">
                     <div class="modal-header">
                         <h5 class="modal-title">{{ $t('user.delete-email', { email: user.email }) }}</h5>
                         <button type="button" class="btn-close" data-bs-dismiss="modal" :aria-label="$t('btn.close')"></button>
                     </div>
                     <div class="modal-body">
                         <p>{{ $t('user.delete-text') }}</p>
                     </div>
                     <div class="modal-footer">
                         <button type="button" class="btn btn-secondary modal-cancel" data-bs-dismiss="modal">{{ $t('btn.cancel') }}</button>
                         <button type="button" class="btn btn-danger modal-action" @click="deleteUser()">
                             <svg-icon icon="trash-alt"></svg-icon> {{ $t('btn.delete') }}
                         </button>
                     </div>
                 </div>
             </div>
         </div>
     </div>
 </template>
 
 <script>
     import { Modal } from 'bootstrap'
     import ListInput from '../Widgets/ListInput'
     import PackageSelect from '../Widgets/PackageSelect'
+    import PasswordInput from '../Widgets/PasswordInput'
     import StatusComponent from '../Widgets/Status'
     import SubscriptionSelect from '../Widgets/SubscriptionSelect'
 
     export default {
         components: {
             ListInput,
             PackageSelect,
+            PasswordInput,
             StatusComponent,
             SubscriptionSelect
         },
         data() {
             return {
                 passwordLinkCode: '',
                 passwordMode: '',
                 user_id: null,
                 user: { aliases: [], config: [] },
                 status: {}
             }
         },
         computed: {
             isSelf: function () {
                 return this.user_id == this.$store.state.authInfo.id
             },
             passwordLink: function () {
                 return this.$root.appUrl + '/password-reset/' + this.passwordLinkCode
             }
         },
         created() {
             this.user_id = this.$route.params.user
 
             if (this.user_id !== 'new') {
                 this.$root.startLoading()
 
                 axios.get('/api/v4/users/' + this.user_id)
                     .then(response => {
                         this.$root.stopLoading()
 
                         this.user = response.data
                         this.user.first_name = response.data.settings.first_name
                         this.user.last_name = response.data.settings.last_name
                         this.user.organization = response.data.settings.organization
                         this.status = response.data.statusInfo
 
                         this.passwordLinkCode = this.user.passwordLinkCode
                     })
                     .catch(this.$root.errorHandler)
 
                 if (this.isSelf) {
                     this.passwordMode = 'input'
                 }
             } else {
                 this.passwordMode = 'input'
             }
         },
         mounted() {
             $('#first_name').focus()
             $('#delete-warning')[0].addEventListener('shown.bs.modal', event => {
                 $(event.target).find('button.modal-cancel').focus()
             })
         },
         methods: {
             passwordLinkCopy() {
                 navigator.clipboard.writeText($('#password-link code').text());
             },
             passwordLinkDelete() {
                 this.passwordMode = ''
                 $('#pass-mode-link')[0].checked = false
 
                 // Delete the code for real
                 axios.delete('/api/v4/password-reset/code/' + this.passwordLinkCode)
                     .then(response => {
                         this.passwordLinkCode = ''
                         this.user.passwordLinkCode = ''
                         if (response.data.status == 'success') {
                             this.$toast.success(response.data.message)
                         }
                     })
             },
             setPasswordMode(event) {
                 const mode = event.target.checked ? event.target.value : ''
 
                 // In the "new user" mode the password mode cannot be unchecked
                 if (!mode && this.user_id === 'new') {
                     event.target.checked = true
                     return
                 }
 
                 this.passwordMode = mode
 
                 if (!event.target.checked) {
                     return
                 }
 
                 $('#pass-mode-' + (mode == 'link' ? 'input' : 'link'))[0].checked = false
 
                 // Note: we use $nextTick() becouse we have to wait for the HTML elements to exist
                 this.$nextTick().then(() => {
                     if (mode == 'link' && !this.passwordLinkCode) {
                         const element = $('#password-link')
                         this.$root.addLoader(element)
                         axios.post('/api/v4/password-reset/code', [])
                             .then(response => {
                                 this.$root.removeLoader(element)
                                 this.passwordLinkCode = response.data.short_code + '-' + response.data.code
                             })
                             .catch(error => {
                                 this.$root.removeLoader(element)
                             })
                     } else if (mode == 'input') {
                         $('#password').focus();
                     }
                 })
             },
             submit() {
                 this.$root.clearFormValidation($('#general form'))
 
                 let method = 'post'
                 let location = '/api/v4/users'
                 let post = this.$root.pick(this.user, ['aliases', 'email', 'first_name', 'last_name', 'organization'])
 
                 if (this.user_id !== 'new') {
                     method = 'put'
                     location += '/' + this.user_id
 
                     let skus = {}
                     $('#user-skus input[type=checkbox]:checked').each((idx, input) => {
                         let id = $(input).val()
                         let range = $(input).parents('tr').first().find('input[type=range]').val()
 
                         skus[id] = range || 1
                     })
                     post.skus = skus
                 } else {
                     post.package = $('#user-packages input:checked').val()
                 }
 
                 if (this.passwordMode == 'link' && this.passwordLinkCode) {
                     post.passwordLinkCode = this.passwordLinkCode
                 } else if (this.passwordMode == 'input') {
                     post.password = this.user.password
                     post.password_confirmation = this.user.password_confirmation
                 }
 
                 axios[method](location, post)
                     .then(response => {
                         if (response.data.statusInfo) {
                             this.$store.state.authInfo.statusInfo = response.data.statusInfo
                         }
 
                         this.$toast.success(response.data.message)
                         this.$router.push({ name: 'users' })
                     })
             },
             submitSettings() {
                 this.$root.clearFormValidation($('#settings form'))
                 let post = { greylist_enabled: $('#greylist_enabled').prop('checked') ? 1 : 0 }
 
                 axios.post('/api/v4/users/' + this.user_id + '/config', post)
                     .then(response => {
                         this.$toast.success(response.data.message)
                     })
             },
             statusUpdate(user) {
                 this.user = Object.assign({}, this.user, user)
             },
             deleteUser() {
                 // Delete the user from the confirm dialog
                 axios.delete('/api/v4/users/' + this.user_id)
                     .then(response => {
                         if (response.data.status == 'success') {
                             this.$toast.success(response.data.message)
                             this.$router.push({ name: 'users' })
                         }
                     })
             },
             showDeleteConfirmation() {
                 if (this.user_id == this.$store.state.authInfo.id) {
                     // Deleting self, redirect to /profile/delete page
                     this.$router.push({ name: 'profile-delete' })
                 } else {
                     // Display the warning
                     new Modal('#delete-warning').show()
                 }
             }
         }
     }
 </script>
diff --git a/src/resources/vue/User/Profile.vue b/src/resources/vue/User/Profile.vue
index 78d1ecd4..61515202 100644
--- a/src/resources/vue/User/Profile.vue
+++ b/src/resources/vue/User/Profile.vue
@@ -1,122 +1,118 @@
 <template>
     <div class="container">
         <div class="card" id="user-profile">
             <div class="card-body">
                 <div class="card-title">
                     {{ $t('user.profile-title') }}
                     <router-link
-                        v-if="$root.isController(wallet_id)"
+                        v-if="$root.isController(wallet.id)"
                         class="btn btn-outline-danger button-delete float-end"
                         to="/profile/delete" tag="button"
                     >
                         <svg-icon icon="trash-alt"></svg-icon> {{ $t('user.profile-delete') }}
                     </router-link>
                 </div>
                 <div class="card-text">
                     <form @submit.prevent="submit">
                         <div class="row mb-3 plaintext">
                             <label class="col-sm-4 col-form-label">{{ $t('user.custno') }}</label>
                             <div class="col-sm-8">
                                 <span class="form-control-plaintext" id="userid">{{ user_id }}</span>
                             </div>
                         </div>
                         <div class="row mb-3">
                             <label for="first_name" class="col-sm-4 col-form-label">{{ $t('form.firstname') }}</label>
                             <div class="col-sm-8">
                                 <input type="text" class="form-control" id="first_name" v-model="profile.first_name">
                             </div>
                         </div>
                         <div class="row mb-3">
                             <label for="last_name" class="col-sm-4 col-form-label">{{ $t('form.lastname') }}</label>
                             <div class="col-sm-8">
                                 <input type="text" class="form-control" id="last_name" v-model="profile.last_name">
                             </div>
                         </div>
                         <div class="row mb-3">
                             <label for="organization" class="col-sm-4 col-form-label">{{ $t('user.org') }}</label>
                             <div class="col-sm-8">
                                 <input type="text" class="form-control" id="organization" v-model="profile.organization">
                             </div>
                         </div>
                         <div class="row mb-3">
                             <label for="phone" class="col-sm-4 col-form-label">{{ $t('form.phone') }}</label>
                             <div class="col-sm-8">
                                 <input type="text" class="form-control" id="phone" v-model="profile.phone">
                             </div>
                         </div>
                         <div class="row mb-3">
                             <label for="external_email" class="col-sm-4 col-form-label">{{ $t('user.ext-email') }}</label>
                             <div class="col-sm-8">
                                 <input type="text" class="form-control" id="external_email" v-model="profile.external_email">
                             </div>
                         </div>
                         <div class="row mb-3">
                             <label for="billing_address" class="col-sm-4 col-form-label">{{ $t('user.address') }}</label>
                             <div class="col-sm-8">
                                 <textarea class="form-control" id="billing_address" rows="3" v-model="profile.billing_address"></textarea>
                             </div>
                         </div>
                         <div class="row mb-3">
                             <label for="country" class="col-sm-4 col-form-label">{{ $t('user.country') }}</label>
                             <div class="col-sm-8">
                                 <select class="form-select" id="country" v-model="profile.country">
                                     <option value="">-</option>
                                     <option v-for="(item, code) in countries" :value="code" :key="code">{{ item[1] }}</option>
                                 </select>
                             </div>
                         </div>
                         <div class="row mb-3">
                             <label for="password" class="col-sm-4 col-form-label">{{ $t('form.password') }}</label>
-                            <div class="col-sm-8">
-                                <input type="password" class="form-control" id="password"
-                                       v-model="profile.password"
-                                       :placeholder="$t('form.password')"
-                                >
-                                <input type="password" class="form-control mt-2" id="password_confirmation"
-                                       v-model="profile.password_confirmation"
-                                       :placeholder="$t('form.password-confirm')"
-                                >
-                            </div>
+                            <password-input class="col-sm-8" v-model="profile"></password-input>
                         </div>
                         <button class="btn btn-primary button-submit mt-2" type="submit"><svg-icon icon="check"></svg-icon> {{ $t('btn.submit') }}</button>
                     </form>
                 </div>
             </div>
         </div>
     </div>
 </template>
 
 <script>
+    import PasswordInput from '../Widgets/PasswordInput'
+
     export default {
+        components: {
+            PasswordInput
+        },
         data() {
             return {
                 profile: {},
                 user_id: null,
-                wallet_id: null,
+                wallet: {},
                 countries: window.config.countries
             }
         },
         created() {
-            this.wallet_id = this.$store.state.authInfo.wallet.id
+            this.wallet = this.$store.state.authInfo.wallet
             this.profile = this.$store.state.authInfo.settings
             this.user_id = this.$store.state.authInfo.id
         },
         mounted() {
             $('#first_name').focus()
         },
         methods: {
             submit() {
                 this.$root.clearFormValidation($('#user-profile form'))
 
                 axios.put('/api/v4/users/' + this.user_id, this.profile)
                     .then(response => {
                         delete this.profile.password
                         delete this.profile.password_confirm
 
                         this.$toast.success(response.data.message)
                         this.$router.push({ name: 'dashboard' })
                     })
             }
         }
     }
 </script>
diff --git a/src/resources/vue/Widgets/PasswordInput.vue b/src/resources/vue/Widgets/PasswordInput.vue
new file mode 100644
index 00000000..ac824ea5
--- /dev/null
+++ b/src/resources/vue/Widgets/PasswordInput.vue
@@ -0,0 +1,94 @@
+<template>
+    <div class="password-input">
+        <div :id="prefix + 'password_input'">
+            <input type="password"
+                   class="form-control"
+                   autocomplete="new-password"
+                   :id="prefix + 'password'"
+                   :placeholder="$t('form.password')"
+                   v-model="password"
+                   @input="onInput"
+            >
+            <input type="password"
+                   class="form-control mt-2"
+                   autocomplete="new-password"
+                   :id="prefix + 'password_confirmation'"
+                   :placeholder="$t('form.password-confirm')"
+                   v-model="password_confirmation"
+                   @input="onInputConfirm"
+            >
+        </div>
+        <ul v-if="policy.length" :id="prefix + 'password_policy'" class="list-group pt-2">
+            <li v-for="rule in policy" :key="rule.label" class="list-group-item border-0 p-0">
+                <svg-icon v-if="rule.status" icon="check" class="text-success"></svg-icon>
+                <span v-else class="text-secondary">&bullet;</span>
+                <small class="ps-1 form-text">{{ rule.name }}</small>
+            </li>
+        </ul>
+    </div>
+</template>
+
+<script>
+    export default {
+        props: {
+            focus: { type: Boolean, default: false },
+            value: { type: Object, default: () => {} },
+            user: { type: [String, Number], default: '' }
+        },
+        data() {
+            return {
+                password: '',
+                password_confirmation: '',
+                policy: [],
+                prefix: ''
+            }
+        },
+        mounted() {
+            this.checkPolicy('')
+
+            const input = $('#password')[0]
+
+            this.prefix = $(input.form).data('validation-prefix') || ''
+
+            $(input.form).on('reset', () => { this.checkPolicy('') })
+
+            if (this.focus) {
+                input.focus()
+            }
+        },
+        methods: {
+            checkPolicy(password) {
+                if (this.cancelToken) {
+                    this.cancelToken.cancel()
+                }
+
+                const post = { password, user: this.user }
+
+                if (!post.user && this.$store.state.authInfo) {
+                    post.user = this.$store.state.authInfo.id
+                }
+
+                const cancelToken = axios.CancelToken;
+                this.cancelToken = cancelToken.source();
+
+                axios.post('/api/auth/password-policy/check', post, { cancelToken: this.cancelToken.token })
+                    .then(response => {
+                        if (response.data.list) {
+                            this.policy = response.data.list
+                        }
+                    })
+            },
+            onInput(event) {
+                this.checkPolicy(event.target.value)
+                this.update()
+            },
+            onInputConfirm(event) {
+                this.update()
+            },
+            update() {
+                const update = { password: this.password, password_confirmation: this.password_confirmation }
+                this.$emit('input', {...this.value, ...update})
+            }
+        }
+    }
+</script>
diff --git a/src/routes/api.php b/src/routes/api.php
index 5e35578b..f7ae9956 100644
--- a/src/routes/api.php
+++ b/src/routes/api.php
@@ -1,267 +1,270 @@
 <?php
 
 use Illuminate\Http\Request;
 
 /*
 |--------------------------------------------------------------------------
 | API Routes
 |--------------------------------------------------------------------------
 |
 | Here is where you can register API routes for your application. These
 | routes are loaded by the RouteServiceProvider within a group which
 | is assigned the "api" middleware group. Enjoy building your API!
 |
 */
 
 $prefix = \trim(\parse_url(\config('app.url'), PHP_URL_PATH), '/') . '/';
 
 Route::group(
     [
         'middleware' => 'api',
         'prefix' => $prefix . 'api/auth'
     ],
     function ($router) {
         Route::post('login', 'API\AuthController@login');
 
         Route::group(
             ['middleware' => 'auth:api'],
             function ($router) {
                 Route::get('info', 'API\AuthController@info');
                 Route::post('info', 'API\AuthController@info');
                 Route::post('logout', 'API\AuthController@logout');
                 Route::post('refresh', 'API\AuthController@refresh');
             }
         );
     }
 );
 
 Route::group(
     [
         'domain' => \config('app.website_domain'),
         'middleware' => 'api',
         'prefix' => $prefix . 'api/auth'
     ],
     function ($router) {
+        Route::post('password-policy/check', 'API\PasswordPolicyController@check');
+
         Route::post('password-reset/init', 'API\PasswordResetController@init');
         Route::post('password-reset/verify', 'API\PasswordResetController@verify');
         Route::post('password-reset', 'API\PasswordResetController@reset');
 
         Route::post('signup/init', 'API\SignupController@init');
         Route::get('signup/invitations/{id}', 'API\SignupController@invitation');
         Route::get('signup/plans', 'API\SignupController@plans');
         Route::post('signup/verify', 'API\SignupController@verify');
         Route::post('signup', 'API\SignupController@signup');
     }
 );
 
 Route::group(
     [
         'domain' => \config('app.website_domain'),
         'middleware' => 'auth:api',
         'prefix' => $prefix . 'api/v4'
     ],
     function () {
         Route::post('companion/register', 'API\V4\CompanionAppsController@register');
 
         Route::post('auth-attempts/{id}/confirm', 'API\V4\AuthAttemptsController@confirm');
         Route::post('auth-attempts/{id}/deny', 'API\V4\AuthAttemptsController@deny');
         Route::get('auth-attempts/{id}/details', 'API\V4\AuthAttemptsController@details');
         Route::get('auth-attempts', 'API\V4\AuthAttemptsController@index');
 
         Route::apiResource('domains', 'API\V4\DomainsController');
         Route::get('domains/{id}/confirm', 'API\V4\DomainsController@confirm');
         Route::get('domains/{id}/skus', 'API\V4\SkusController@domainSkus');
         Route::get('domains/{id}/status', 'API\V4\DomainsController@status');
         Route::post('domains/{id}/config', 'API\V4\DomainsController@setConfig');
 
         Route::apiResource('groups', 'API\V4\GroupsController');
         Route::get('groups/{id}/status', 'API\V4\GroupsController@status');
         Route::post('groups/{id}/config', 'API\V4\GroupsController@setConfig');
 
         Route::apiResource('packages', 'API\V4\PackagesController');
 
         Route::apiResource('resources', 'API\V4\ResourcesController');
         Route::get('resources/{id}/status', 'API\V4\ResourcesController@status');
         Route::post('resources/{id}/config', 'API\V4\ResourcesController@setConfig');
 
         Route::apiResource('shared-folders', 'API\V4\SharedFoldersController');
         Route::get('shared-folders/{id}/status', 'API\V4\SharedFoldersController@status');
         Route::post('shared-folders/{id}/config', 'API\V4\SharedFoldersController@setConfig');
 
         Route::apiResource('skus', 'API\V4\SkusController');
 
         Route::apiResource('users', 'API\V4\UsersController');
         Route::post('users/{id}/config', 'API\V4\UsersController@setConfig');
         Route::get('users/{id}/skus', 'API\V4\SkusController@userSkus');
         Route::get('users/{id}/status', 'API\V4\UsersController@status');
 
         Route::apiResource('wallets', 'API\V4\WalletsController');
         Route::get('wallets/{id}/transactions', 'API\V4\WalletsController@transactions');
         Route::get('wallets/{id}/receipts', 'API\V4\WalletsController@receipts');
         Route::get('wallets/{id}/receipts/{receipt}', 'API\V4\WalletsController@receiptDownload');
 
+        Route::get('password-policy', 'API\PasswordPolicyController@index');
         Route::post('password-reset/code', 'API\PasswordResetController@codeCreate');
         Route::delete('password-reset/code/{id}', 'API\PasswordResetController@codeDelete');
 
         Route::post('payments', 'API\V4\PaymentsController@store');
         //Route::delete('payments', 'API\V4\PaymentsController@cancel');
         Route::get('payments/mandate', 'API\V4\PaymentsController@mandate');
         Route::post('payments/mandate', 'API\V4\PaymentsController@mandateCreate');
         Route::put('payments/mandate', 'API\V4\PaymentsController@mandateUpdate');
         Route::delete('payments/mandate', 'API\V4\PaymentsController@mandateDelete');
         Route::get('payments/methods', 'API\V4\PaymentsController@paymentMethods');
         Route::get('payments/pending', 'API\V4\PaymentsController@payments');
         Route::get('payments/has-pending', 'API\V4\PaymentsController@hasPayments');
 
         Route::get('openvidu/rooms', 'API\V4\OpenViduController@index');
         Route::post('openvidu/rooms/{id}/close', 'API\V4\OpenViduController@closeRoom');
         Route::post('openvidu/rooms/{id}/config', 'API\V4\OpenViduController@setRoomConfig');
 
         // FIXME: I'm not sure about this one, should we use DELETE request maybe?
         Route::post('openvidu/rooms/{id}/connections/{conn}/dismiss', 'API\V4\OpenViduController@dismissConnection');
         Route::put('openvidu/rooms/{id}/connections/{conn}', 'API\V4\OpenViduController@updateConnection');
         Route::post('openvidu/rooms/{id}/request/{reqid}/accept', 'API\V4\OpenViduController@acceptJoinRequest');
         Route::post('openvidu/rooms/{id}/request/{reqid}/deny', 'API\V4\OpenViduController@denyJoinRequest');
     }
 );
 
 // Note: In Laravel 7.x we could just use withoutMiddleware() instead of a separate group
 Route::group(
     [
         'domain' => \config('app.website_domain'),
         'prefix' => $prefix . 'api/v4'
     ],
     function () {
         Route::post('openvidu/rooms/{id}', 'API\V4\OpenViduController@joinRoom');
         Route::post('openvidu/rooms/{id}/connections', 'API\V4\OpenViduController@createConnection');
         // FIXME: I'm not sure about this one, should we use DELETE request maybe?
         Route::post('openvidu/rooms/{id}/connections/{conn}/dismiss', 'API\V4\OpenViduController@dismissConnection');
         Route::put('openvidu/rooms/{id}/connections/{conn}', 'API\V4\OpenViduController@updateConnection');
         Route::post('openvidu/rooms/{id}/request/{reqid}/accept', 'API\V4\OpenViduController@acceptJoinRequest');
         Route::post('openvidu/rooms/{id}/request/{reqid}/deny', 'API\V4\OpenViduController@denyJoinRequest');
     }
 );
 
 Route::group(
     [
         'domain' => \config('app.website_domain'),
         'middleware' => 'api',
         'prefix' => $prefix . 'api/v4'
     ],
     function ($router) {
         Route::post('support/request', 'API\V4\SupportController@request');
     }
 );
 
 Route::group(
     [
         'domain' => \config('app.website_domain'),
         'prefix' => $prefix . 'api/webhooks'
     ],
     function () {
         Route::post('payment/{provider}', 'API\V4\PaymentsController@webhook');
         Route::post('meet/openvidu', 'API\V4\OpenViduController@webhook');
     }
 );
 
 if (\config('app.with_services')) {
     Route::group(
         [
             'domain' => 'services.' . \config('app.website_domain'),
             'prefix' => $prefix . 'api/webhooks'
         ],
         function () {
             Route::get('nginx', 'API\V4\NGINXController@authenticate');
             Route::get('nginx-httpauth', 'API\V4\NGINXController@httpauth');
             Route::post('policy/greylist', 'API\V4\PolicyController@greylist');
             Route::post('policy/ratelimit', 'API\V4\PolicyController@ratelimit');
             Route::post('policy/spf', 'API\V4\PolicyController@senderPolicyFramework');
         }
     );
 }
 
 if (\config('app.with_admin')) {
     Route::group(
         [
             'domain' => 'admin.' . \config('app.website_domain'),
             'middleware' => ['auth:api', 'admin'],
             'prefix' => $prefix . 'api/v4',
         ],
         function () {
             Route::apiResource('domains', 'API\V4\Admin\DomainsController');
             Route::get('domains/{id}/skus', 'API\V4\Admin\SkusController@domainSkus');
             Route::post('domains/{id}/suspend', 'API\V4\Admin\DomainsController@suspend');
             Route::post('domains/{id}/unsuspend', 'API\V4\Admin\DomainsController@unsuspend');
 
             Route::apiResource('groups', 'API\V4\Admin\GroupsController');
             Route::post('groups/{id}/suspend', 'API\V4\Admin\GroupsController@suspend');
             Route::post('groups/{id}/unsuspend', 'API\V4\Admin\GroupsController@unsuspend');
 
             Route::apiResource('resources', 'API\V4\Admin\ResourcesController');
             Route::apiResource('shared-folders', 'API\V4\Admin\SharedFoldersController');
             Route::apiResource('skus', 'API\V4\Admin\SkusController');
             Route::apiResource('users', 'API\V4\Admin\UsersController');
             Route::get('users/{id}/discounts', 'API\V4\Reseller\DiscountsController@userDiscounts');
             Route::post('users/{id}/reset2FA', 'API\V4\Admin\UsersController@reset2FA');
             Route::get('users/{id}/skus', 'API\V4\Admin\SkusController@userSkus');
             Route::post('users/{id}/skus/{sku}', 'API\V4\Admin\UsersController@setSku');
             Route::post('users/{id}/suspend', 'API\V4\Admin\UsersController@suspend');
             Route::post('users/{id}/unsuspend', 'API\V4\Admin\UsersController@unsuspend');
             Route::apiResource('wallets', 'API\V4\Admin\WalletsController');
             Route::post('wallets/{id}/one-off', 'API\V4\Admin\WalletsController@oneOff');
             Route::get('wallets/{id}/transactions', 'API\V4\Admin\WalletsController@transactions');
 
             Route::get('stats/chart/{chart}', 'API\V4\Admin\StatsController@chart');
         }
     );
 }
 
 if (\config('app.with_reseller')) {
     Route::group(
         [
             'domain' => 'reseller.' . \config('app.website_domain'),
             'middleware' => ['auth:api', 'reseller'],
             'prefix' => $prefix . 'api/v4',
         ],
         function () {
             Route::apiResource('domains', 'API\V4\Reseller\DomainsController');
             Route::get('domains/{id}/skus', 'API\V4\Reseller\SkusController@domainSkus');
             Route::post('domains/{id}/suspend', 'API\V4\Reseller\DomainsController@suspend');
             Route::post('domains/{id}/unsuspend', 'API\V4\Reseller\DomainsController@unsuspend');
 
             Route::apiResource('groups', 'API\V4\Reseller\GroupsController');
             Route::post('groups/{id}/suspend', 'API\V4\Reseller\GroupsController@suspend');
             Route::post('groups/{id}/unsuspend', 'API\V4\Reseller\GroupsController@unsuspend');
 
             Route::apiResource('invitations', 'API\V4\Reseller\InvitationsController');
             Route::post('invitations/{id}/resend', 'API\V4\Reseller\InvitationsController@resend');
 
             Route::post('payments', 'API\V4\Reseller\PaymentsController@store');
             Route::get('payments/mandate', 'API\V4\Reseller\PaymentsController@mandate');
             Route::post('payments/mandate', 'API\V4\Reseller\PaymentsController@mandateCreate');
             Route::put('payments/mandate', 'API\V4\Reseller\PaymentsController@mandateUpdate');
             Route::delete('payments/mandate', 'API\V4\Reseller\PaymentsController@mandateDelete');
             Route::get('payments/methods', 'API\V4\Reseller\PaymentsController@paymentMethods');
             Route::get('payments/pending', 'API\V4\Reseller\PaymentsController@payments');
             Route::get('payments/has-pending', 'API\V4\Reseller\PaymentsController@hasPayments');
 
             Route::apiResource('resources', 'API\V4\Reseller\ResourcesController');
             Route::apiResource('shared-folders', 'API\V4\Reseller\SharedFoldersController');
             Route::apiResource('skus', 'API\V4\Reseller\SkusController');
             Route::apiResource('users', 'API\V4\Reseller\UsersController');
             Route::get('users/{id}/discounts', 'API\V4\Reseller\DiscountsController@userDiscounts');
             Route::post('users/{id}/reset2FA', 'API\V4\Reseller\UsersController@reset2FA');
             Route::get('users/{id}/skus', 'API\V4\Reseller\SkusController@userSkus');
             Route::post('users/{id}/skus/{sku}', 'API\V4\Admin\UsersController@setSku');
             Route::post('users/{id}/suspend', 'API\V4\Reseller\UsersController@suspend');
             Route::post('users/{id}/unsuspend', 'API\V4\Reseller\UsersController@unsuspend');
             Route::apiResource('wallets', 'API\V4\Reseller\WalletsController');
             Route::post('wallets/{id}/one-off', 'API\V4\Reseller\WalletsController@oneOff');
             Route::get('wallets/{id}/receipts', 'API\V4\Reseller\WalletsController@receipts');
             Route::get('wallets/{id}/receipts/{receipt}', 'API\V4\Reseller\WalletsController@receiptDownload');
             Route::get('wallets/{id}/transactions', 'API\V4\Reseller\WalletsController@transactions');
 
             Route::get('stats/chart/{chart}', 'API\V4\Reseller\StatsController@chart');
         }
     );
 }
diff --git a/src/tests/Browser/Pages/Settings.php b/src/tests/Browser/Pages/Settings.php
new file mode 100644
index 00000000..42e208b7
--- /dev/null
+++ b/src/tests/Browser/Pages/Settings.php
@@ -0,0 +1,44 @@
+<?php
+
+namespace Tests\Browser\Pages;
+
+use Laravel\Dusk\Page;
+
+class Settings extends Page
+{
+    /**
+     * Get the URL for the page.
+     *
+     * @return string
+     */
+    public function url(): string
+    {
+        return '/settings';
+    }
+
+    /**
+     * Assert that the browser is on the page.
+     *
+     * @param \Laravel\Dusk\Browser $browser The browser object
+     *
+     * @return void
+     */
+    public function assert($browser)
+    {
+        $browser->waitFor('@form')
+            ->waitUntilMissing('.app-loader');
+    }
+
+    /**
+     * Get the element shortcuts for the page.
+     *
+     * @return array
+     */
+    public function elements(): array
+    {
+        return [
+            '@app' => '#app',
+            '@form' => '#settings form',
+        ];
+    }
+}
diff --git a/src/tests/Browser/PasswordResetTest.php b/src/tests/Browser/PasswordResetTest.php
index 64762b8d..996e9c32 100644
--- a/src/tests/Browser/PasswordResetTest.php
+++ b/src/tests/Browser/PasswordResetTest.php
@@ -1,276 +1,294 @@
 <?php
 
 namespace Tests\Browser;
 
 use App\User;
 use App\VerificationCode;
 use Tests\Browser;
 use Tests\Browser\Pages\Dashboard;
 use Tests\Browser\Pages\Home;
 use Tests\Browser\Pages\PasswordReset;
 use Tests\TestCaseDusk;
 use Illuminate\Foundation\Testing\DatabaseMigrations;
 
 class PasswordResetTest extends TestCaseDusk
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('passwordresettestdusk@' . \config('app.domain'));
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser('passwordresettestdusk@' . \config('app.domain'));
 
         parent::tearDown();
     }
 
     /**
      * Test the link from logon to password-reset page
      */
-    public function testPasswordResetLinkOnLogon(): void
+    public function testLinkOnLogon(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->visit(new Home());
 
             $browser->assertSeeLink('Forgot password?');
             $browser->clickLink('Forgot password?');
 
             $browser->on(new PasswordReset());
             $browser->assertVisible('@step1');
         });
     }
 
     /**
      * Test 1st step of password-reset
      */
-    public function testPasswordResetStep1(): void
+    public function testStep1(): void
     {
         $user = $this->getTestUser('passwordresettestdusk@' . \config('app.domain'));
         $user->setSetting('external_email', 'external@domain.tld');
 
         $this->browse(function (Browser $browser) {
             $browser->visit(new PasswordReset());
 
             $browser->assertVisible('@step1');
 
             // Here we expect email input and submit button
             $browser->with('@step1', function ($step) {
                 $step->assertVisible('#reset_email');
                 $step->assertFocused('#reset_email');
                 $step->assertVisible('[type=submit]');
             });
 
             // Submit empty form
             $browser->with('@step1', function ($step) {
                 $step->click('[type=submit]');
                 $step->assertFocused('#reset_email');
             });
 
             // Submit invalid email
             // We expect email input to have is-invalid class added, with .invalid-feedback element
             $browser->with('@step1', function ($step) use ($browser) {
                 $step->type('#reset_email', '@test');
                 $step->click('[type=submit]');
 
                 $step->waitFor('#reset_email.is-invalid');
                 $step->waitFor('#reset_email + .invalid-feedback');
                 $browser->waitFor('.toast-error');
                 $browser->click('.toast-error'); // remove the toast
             });
 
             // Submit valid data
             $browser->with('@step1', function ($step) {
                 $step->type('#reset_email', 'passwordresettestdusk@' . \config('app.domain'));
                 $step->click('[type=submit]');
 
                 $step->assertMissing('#reset_email.is-invalid');
                 $step->assertMissing('#reset_email + .invalid-feedback');
             });
 
             $browser->waitUntilMissing('@step2 #reset_code[value=""]');
             $browser->waitFor('@step2');
             $browser->assertMissing('@step1');
         });
     }
 
     /**
      * Test 2nd Step of the password reset process
      *
-     * @depends testPasswordResetStep1
+     * @depends testStep1
      */
-    public function testPasswordResetStep2(): void
+    public function testStep2(): void
     {
         $user = $this->getTestUser('passwordresettestdusk@' . \config('app.domain'));
         $user->setSetting('external_email', 'external@domain.tld');
 
         $this->browse(function (Browser $browser) {
             $browser->assertVisible('@step2');
 
             // Here we expect one text input, Back and Continue buttons
             $browser->with('@step2', function ($step) {
                 $step->assertVisible('#reset_short_code');
                 $step->assertFocused('#reset_short_code');
                 $step->assertVisible('[type=button]');
                 $step->assertVisible('[type=submit]');
             });
 
             // Test Back button functionality
             $browser->click('@step2 [type=button]');
             $browser->waitFor('@step1');
             $browser->assertFocused('@step1 #reset_email');
             $browser->assertMissing('@step2');
 
             // Submit valid Step 1 data (again)
             $browser->with('@step1', function ($step) {
                 $step->type('#reset_email', 'passwordresettestdusk@' . \config('app.domain'));
                 $step->click('[type=submit]');
             });
 
             $browser->waitFor('@step2');
             $browser->assertMissing('@step1');
 
             // Submit invalid code
             // We expect code input to have is-invalid class added, with .invalid-feedback element
             $browser->with('@step2', function ($step) use ($browser) {
                 $step->type('#reset_short_code', 'XXXXX');
                 $step->click('[type=submit]');
 
                 $browser->waitFor('.toast-error');
 
                 $step->waitFor('#reset_short_code.is-invalid')
                     ->assertVisible('#reset_short_code.is-invalid')
                     ->assertVisible('#reset_short_code + .invalid-feedback')
                     ->assertFocused('#reset_short_code');
 
                 $browser->click('.toast-error'); // remove the toast
             });
 
             // Submit valid code
             // We expect error state on code input to be removed, and Step 3 form visible
             $browser->with('@step2', function ($step) {
                 // Get the code and short_code from database
                 // FIXME: Find a nice way to read javascript data without using hidden inputs
                 $code = $step->value('#reset_code');
 
                 $this->assertNotEmpty($code);
 
                 $code = VerificationCode::find($code);
 
                 $step->type('#reset_short_code', $code->short_code);
                 $step->click('[type=submit]');
 
                 $step->assertMissing('#reset_short_code.is-invalid');
                 $step->assertMissing('#reset_short_code + .invalid-feedback');
             });
 
             $browser->waitFor('@step3');
             $browser->assertMissing('@step2');
         });
     }
 
     /**
      * Test 3rd Step of the password reset process
      *
-     * @depends testPasswordResetStep2
+     * @depends testStep2
      */
-    public function testPasswordResetStep3(): void
+    public function testStep3(): void
     {
         $user = $this->getTestUser('passwordresettestdusk@' . \config('app.domain'));
         $user->setSetting('external_email', 'external@domain.tld');
+        $user->setSetting('password_policy', 'upper,digit');
 
         $this->browse(function (Browser $browser) {
-            $browser->assertVisible('@step3');
+            $browser->assertVisible('@step3')
+                ->clearToasts();
 
             // Here we expect 2 text inputs, Back and Continue buttons
-            $browser->with('@step3', function ($step) {
-                $step->assertVisible('#reset_password');
-                $step->assertVisible('#reset_confirm');
-                $step->assertVisible('[type=button]');
-                $step->assertVisible('[type=submit]');
-                $step->assertFocused('#reset_password');
+            $browser->with('@step3', function (Browser $step) {
+                $step->assertVisible('#reset_password')
+                    ->assertVisible('#reset_password_confirmation')
+                    ->assertVisible('[type=button]')
+                    ->assertVisible('[type=submit]')
+                    ->assertFocused('#reset_password');
             });
 
             // Test Back button
-            $browser->click('@step3 [type=button]');
-            $browser->waitFor('@step2');
-            $browser->assertFocused('@step2 #reset_short_code');
-            $browser->assertMissing('@step3');
-            $browser->assertMissing('@step1');
+            $browser->click('@step3 [type=button]')
+                ->waitFor('@step2')
+                ->assertFocused('@step2 #reset_short_code')
+                ->assertMissing('@step3')
+                ->assertMissing('@step1');
 
             // TODO: Test form reset when going back
 
             // Because the verification code is removed in tearDown()
             // we'll start from the beginning (Step 1)
-            $browser->click('@step2 [type=button]');
-            $browser->waitFor('@step1');
-            $browser->assertFocused('@step1 #reset_email');
-            $browser->assertMissing('@step3');
-            $browser->assertMissing('@step2');
+            $browser->click('@step2 [type=button]')
+                ->waitFor('@step1')
+                ->assertFocused('@step1 #reset_email')
+                ->assertMissing('@step3')
+                ->assertMissing('@step2');
 
             // Submit valid data
             $browser->with('@step1', function ($step) {
                 $step->type('#reset_email', 'passwordresettestdusk@' . \config('app.domain'));
                 $step->click('[type=submit]');
             });
 
-            $browser->waitFor('@step2');
-            $browser->waitUntilMissing('@step2 #reset_code[value=""]');
+            $browser->waitFor('@step2')
+                ->waitUntilMissing('@step2 #reset_code[value=""]');
 
             // Submit valid code again
             $browser->with('@step2', function ($step) {
                 $code = $step->value('#reset_code');
 
                 $this->assertNotEmpty($code);
 
                 $code = VerificationCode::find($code);
 
                 $step->type('#reset_short_code', $code->short_code);
                 $step->click('[type=submit]');
             });
 
             $browser->waitFor('@step3');
 
             // Submit invalid data
             $browser->with('@step3', function ($step) use ($browser) {
-                $step->assertFocused('#reset_password');
-
-                $step->type('#reset_password', '12345678');
-                $step->type('#reset_confirm', '123456789');
+                $step->assertFocused('#reset_password')
+                    ->whenAvailable('#reset_password_policy', function (Browser $browser) {
+                        $browser->assertElementsCount('li', 2)
+                            ->assertMissing('li:first-child svg.text-success')
+                            ->assertSeeIn('li:first-child small', "Password contains an upper-case character")
+                            ->assertMissing('li:last-child svg.text-success')
+                            ->assertSeeIn('li:last-child small', "Password contains a digit");
+                    })
+                    ->type('#reset_password', 'A2345678')
+                    ->type('#reset_password_confirmation', '123456789')
+                    ->with('#reset_password_policy', function (Browser $browser) {
+                        $browser->waitFor('li:first-child svg.text-success')
+                            ->waitFor('li:last-child svg.text-success');
+                    });
 
                 $step->click('[type=submit]');
 
                 $browser->waitFor('.toast-error');
 
                 $step->waitFor('#reset_password.is-invalid')
-                    ->assertVisible('#reset_password.is-invalid')
-                    ->assertVisible('#reset_password + .invalid-feedback')
+                    ->assertVisible('#reset_password_input .invalid-feedback')
                     ->assertFocused('#reset_password');
 
                 $browser->click('.toast-error'); // remove the toast
             });
 
             // Submit valid data
             $browser->with('@step3', function ($step) {
-                $step->type('#reset_confirm', '12345678');
-
-                $step->click('[type=submit]');
+                $step->type('#reset_password_confirmation', 'A2345678')
+                    ->click('[type=submit]');
             });
 
             $browser->waitUntilMissing('@step3');
 
             // At this point we should be auto-logged-in to dashboard
             $browser->on(new Dashboard());
 
             // FIXME: Is it enough to be sure user is logged in?
         });
     }
+
+    /**
+     * Test password reset process for a user with 2FA enabled.
+     */
+    public function testResetWith2FA(): void
+    {
+        $this->markTestIncomplete();
+    }
 }
diff --git a/src/tests/Browser/SettingsTest.php b/src/tests/Browser/SettingsTest.php
new file mode 100644
index 00000000..f77b3259
--- /dev/null
+++ b/src/tests/Browser/SettingsTest.php
@@ -0,0 +1,100 @@
+<?php
+
+namespace Tests\Browser;
+
+use Tests\Browser;
+use Tests\Browser\Components\Menu;
+use Tests\Browser\Components\Toast;
+use Tests\Browser\Pages\Dashboard;
+use Tests\Browser\Pages\Home;
+use Tests\Browser\Pages\Settings;
+use Tests\TestCaseDusk;
+
+class SettingsTest extends TestCaseDusk
+{
+    /**
+     * Test settings page (unauthenticated)
+     */
+    public function testSettingsUnauth(): void
+    {
+        // Test that the page requires authentication
+        $this->browse(function (Browser $browser) {
+            $browser->visit('/settings')->on(new Home());
+        });
+    }
+
+    /**
+     * Test settings "box" on Dashboard
+     */
+    public function testDashboard(): void
+    {
+        $this->browse(function (Browser $browser) {
+            // Test a user that is not an account owner
+            $browser->visit(new Home())
+                ->submitLogon('jack@kolab.org', 'simple123', true)
+                ->on(new Dashboard())
+                ->assertMissing('@links .link-settings .name')
+                ->visit('/settings')
+                ->assertErrorPage(403)
+                ->within(new Menu(), function (Browser $browser) {
+                    $browser->clickMenuItem('logout');
+                });
+
+            // Test the account owner
+            $browser->waitForLocation('/login')
+                ->on(new Home())
+                ->submitLogon('john@kolab.org', 'simple123', true)
+                ->on(new Dashboard())
+                ->assertSeeIn('@links .link-settings .name', 'Settings');
+        });
+    }
+
+    /**
+     * Test Settings page
+     *
+     * @depends testDashboard
+     */
+    public function testSettings(): void
+    {
+        $john = $this->getTestUser('john@kolab.org');
+        $john->setSetting('password_policy', 'min:5,max:100,lower');
+
+        $this->browse(function (Browser $browser) {
+            $browser->click('@links .link-settings')
+                ->on(new Settings())
+                ->assertSeeIn('#settings .card-title', 'Settings')
+                // Password policy
+                ->assertSeeIn('@form .row:nth-child(1) > label', 'Password Policy')
+                ->with('@form #password_policy', function (Browser $browser) {
+                    $browser->assertElementsCount('li', 6)
+                        ->assertSeeIn('li:nth-child(1) label', 'Minimum password length')
+                        ->assertChecked('li:nth-child(1) input[type=checkbox]')
+                        ->assertValue('li:nth-child(1) input[type=text]', '5')
+                        ->assertSeeIn('li:nth-child(2) label', 'Maximum password length')
+                        ->assertChecked('li:nth-child(2) input[type=checkbox]')
+                        ->assertValue('li:nth-child(2) input[type=text]', '100')
+                        ->assertSeeIn('li:nth-child(3) label', 'Password contains a lower-case character')
+                        ->assertChecked('li:nth-child(3) input[type=checkbox]')
+                        ->assertMissing('li:nth-child(3) input[type=text]')
+                        ->assertSeeIn('li:nth-child(4) label', 'Password contains an upper-case character')
+                        ->assertNotChecked('li:nth-child(4) input[type=checkbox]')
+                        ->assertMissing('li:nth-child(4) input[type=text]')
+                        ->assertSeeIn('li:nth-child(5) label', 'Password contains a digit')
+                        ->assertNotChecked('li:nth-child(5) input[type=checkbox]')
+                        ->assertMissing('li:nth-child(5) input[type=text]')
+                        ->assertSeeIn('li:nth-child(6) label', 'Password contains a special character')
+                        ->assertNotChecked('li:nth-child(6) input[type=checkbox]')
+                        ->assertMissing('li:nth-child(6) input[type=text]')
+                        // Change the policy
+                        ->type('li:nth-child(1) input[type=text]', '11')
+                        ->type('li:nth-child(2) input[type=text]', '120')
+                        ->click('li:nth-child(3) input[type=checkbox]')
+                        ->click('li:nth-child(4) input[type=checkbox]');
+                })
+                ->click('button[type=submit]')
+                ->assertToast(Toast::TYPE_SUCCESS, 'User settings updated successfully.');
+        });
+
+        $this->assertSame('min:11,max:120,upper', $john->getSetting('password_policy'));
+    }
+}
diff --git a/src/tests/Browser/SignupTest.php b/src/tests/Browser/SignupTest.php
index 9fb0b951..4d8c9d7a 100644
--- a/src/tests/Browser/SignupTest.php
+++ b/src/tests/Browser/SignupTest.php
@@ -1,641 +1,652 @@
 <?php
 
 namespace Tests\Browser;
 
 use App\Discount;
 use App\Domain;
 use App\SignupCode;
 use App\SignupInvitation;
 use App\User;
 use Tests\Browser;
 use Tests\Browser\Components\Menu;
 use Tests\Browser\Components\Toast;
 use Tests\Browser\Pages\Dashboard;
 use Tests\Browser\Pages\Signup;
 use Tests\TestCaseDusk;
 use Illuminate\Foundation\Testing\DatabaseMigrations;
 
 class SignupTest extends TestCaseDusk
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('signuptestdusk@' . \config('app.domain'));
         $this->deleteTestUser('admin@user-domain-signup.com');
         $this->deleteTestDomain('user-domain-signup.com');
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser('signuptestdusk@' . \config('app.domain'));
         $this->deleteTestUser('admin@user-domain-signup.com');
         $this->deleteTestDomain('user-domain-signup.com');
         SignupInvitation::truncate();
 
         parent::tearDown();
     }
 
     /**
      * Test signup code verification with a link
      */
     public function testSignupCodeByLink(): void
     {
         // Test invalid code (invalid format)
         $this->browse(function (Browser $browser) {
             // Register Signup page element selectors we'll be using
             $browser->onWithoutAssert(new Signup());
 
             // TODO: Test what happens if user is logged in
 
             $browser->visit('/signup/invalid-code');
 
             // TODO: According to https://github.com/vuejs/vue-router/issues/977
             // it is not yet easily possible to display error page component (route)
             // without changing the URL
             // TODO: Instead of css selector we should probably define page/component
             // and use it instead
             $browser->waitFor('#error-page');
         });
 
         // Test invalid code (valid format)
         $this->browse(function (Browser $browser) {
             $browser->visit('/signup/XXXXX-code');
 
             // FIXME: User will not be able to continue anyway, so we should
             //        either display 1st step or 404 error page
             $browser->waitFor('@step1')
                 ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
         });
 
         // Test valid code
         $this->browse(function (Browser $browser) {
             $code = SignupCode::create([
                     'email' => 'User@example.org',
                     'first_name' => 'User',
                     'last_name' => 'Name',
                     'plan' => 'individual',
                     'voucher' => '',
             ]);
 
             $browser->visit('/signup/' . $code->short_code . '-' . $code->code)
                 ->waitFor('@step3')
                 ->assertMissing('@step1')
                 ->assertMissing('@step2');
 
             // FIXME: Find a nice way to read javascript data without using hidden inputs
             $this->assertSame($code->code, $browser->value('@step2 #signup_code'));
 
             // TODO: Test if the signup process can be completed
         });
     }
 
     /**
      * Test signup "welcome" page
      */
     public function testSignupStep0(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->visit(new Signup());
 
             $browser->assertVisible('@step0')
                 ->assertMissing('@step1')
                 ->assertMissing('@step2')
                 ->assertMissing('@step3');
 
             $browser->within(new Menu(), function ($browser) {
                 $browser->assertMenuItems(['signup', 'explore', 'blog', 'support', 'login', 'lang'], 'signup');
             });
 
             $browser->waitFor('@step0 .plan-selector .card');
 
             // Assert first plan box and press the button
             $browser->with('@step0 .plan-selector .plan-individual', function ($step) {
                 $step->assertVisible('button')
                     ->assertSeeIn('button', 'Individual Account')
                     ->assertVisible('.plan-description')
                     ->click('button');
             });
 
             $browser->waitForLocation('/signup/individual')
                 ->assertVisible('@step1')
                 ->assertMissing('@step0')
                 ->assertMissing('@step2')
                 ->assertMissing('@step3')
                 ->assertFocused('@step1 #signup_first_name');
 
             // Click Back button
             $browser->click('@step1 [type=button]')
                 ->waitForLocation('/signup')
                     ->assertVisible('@step0')
                     ->assertMissing('@step1')
                     ->assertMissing('@step2')
                     ->assertMissing('@step3');
 
             // Choose the group account plan
             $browser->click('@step0 .plan-selector .plan-group button')
                 ->waitForLocation('/signup/group')
                 ->assertVisible('@step1')
                 ->assertMissing('@step0')
                 ->assertMissing('@step2')
                 ->assertMissing('@step3')
                 ->assertFocused('@step1 #signup_first_name');
 
             // TODO: Test if 'plan' variable is set properly in vue component
         });
     }
 
     /**
      * Test 1st step of the signup process
      */
     public function testSignupStep1(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->visit('/signup/individual')
                 ->onWithoutAssert(new Signup());
 
             // Here we expect two text inputs and Back and Continue buttons
             $browser->with('@step1', function ($step) {
                 $step->assertVisible('#signup_last_name')
                     ->assertVisible('#signup_first_name')
                     ->assertFocused('#signup_first_name')
                     ->assertVisible('#signup_email')
                     ->assertVisible('[type=button]')
                     ->assertVisible('[type=submit]');
             });
 
             // Submit empty form
             // Email is required, so after pressing Submit
             // we expect focus to be moved to the email input
             $browser->with('@step1', function ($step) {
                 $step->click('[type=submit]');
                 $step->assertFocused('#signup_email');
             });
 
             $browser->within(new Menu(), function ($browser) {
                 $browser->assertMenuItems(['signup', 'explore', 'blog', 'support', 'login', 'lang'], 'signup');
             });
 
             // Submit invalid email, and first_name
             // We expect both inputs to have is-invalid class added, with .invalid-feedback element
             $browser->with('@step1', function ($step) {
                 $step->type('#signup_first_name', str_repeat('a', 250))
                     ->type('#signup_email', '@test')
                     ->click('[type=submit]')
                     ->waitFor('#signup_email.is-invalid')
                     ->assertVisible('#signup_first_name.is-invalid')
                     ->assertVisible('#signup_email + .invalid-feedback')
                     ->assertVisible('#signup_last_name + .invalid-feedback')
                     ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
             });
 
             // Submit valid data
             // We expect error state on email input to be removed, and Step 2 form visible
             $browser->with('@step1', function ($step) {
                 $step->type('#signup_first_name', 'Test')
                     ->type('#signup_last_name', 'User')
                     ->type('#signup_email', 'BrowserSignupTestUser1@kolab.org')
                     ->click('[type=submit]')
                     ->assertMissing('#signup_email.is-invalid')
                     ->assertMissing('#signup_email + .invalid-feedback');
             });
 
             $browser->waitUntilMissing('@step2 #signup_code[value=""]');
             $browser->waitFor('@step2');
             $browser->assertMissing('@step1');
         });
     }
 
     /**
      * Test 2nd Step of the signup process
      *
      * @depends testSignupStep1
      */
     public function testSignupStep2(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->assertVisible('@step2')
                 ->assertMissing('@step0')
                 ->assertMissing('@step1')
                 ->assertMissing('@step3');
 
             // Here we expect one text input, Back and Continue buttons
             $browser->with('@step2', function ($step) {
                 $step->assertVisible('#signup_short_code')
                     ->assertFocused('#signup_short_code')
                     ->assertVisible('[type=button]')
                     ->assertVisible('[type=submit]');
             });
 
             // Test Back button functionality
             $browser->click('@step2 [type=button]')
                 ->waitFor('@step1')
                 ->assertFocused('@step1 #signup_first_name')
                 ->assertMissing('@step2');
 
             // Submit valid Step 1 data (again)
             $browser->with('@step1', function ($step) {
                 $step->type('#signup_first_name', 'User')
                     ->type('#signup_last_name', 'User')
                     ->type('#signup_email', 'BrowserSignupTestUser1@kolab.org')
                     ->click('[type=submit]');
             });
 
             $browser->waitFor('@step2');
             $browser->assertMissing('@step1');
 
             // Submit invalid code
             // We expect code input to have is-invalid class added, with .invalid-feedback element
             $browser->with('@step2', function ($step) {
                 $step->type('#signup_short_code', 'XXXXX');
                 $step->click('[type=submit]');
 
                 $step->waitFor('#signup_short_code.is-invalid')
                     ->assertVisible('#signup_short_code + .invalid-feedback')
                     ->assertFocused('#signup_short_code')
                     ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
             });
 
             // Submit valid code
             // We expect error state on code input to be removed, and Step 3 form visible
             $browser->with('@step2', function ($step) {
                 // Get the code and short_code from database
                 // FIXME: Find a nice way to read javascript data without using hidden inputs
                 $code = $step->value('#signup_code');
 
                 $this->assertNotEmpty($code);
 
                 $code = SignupCode::find($code);
 
                 $step->type('#signup_short_code', $code->short_code);
                 $step->click('[type=submit]');
 
                 $step->assertMissing('#signup_short_code.is-invalid');
                 $step->assertMissing('#signup_short_code + .invalid-feedback');
             });
 
             $browser->waitFor('@step3');
             $browser->assertMissing('@step2');
         });
     }
 
     /**
      * Test 3rd Step of the signup process
      *
      * @depends testSignupStep2
      */
     public function testSignupStep3(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->assertVisible('@step3');
 
             // Here we expect 3 text inputs, Back and Continue buttons
             $browser->with('@step3', function ($step) {
                 $domains = Domain::getPublicDomains();
                 $domains_count = count($domains);
 
                 $step->assertSeeIn('.card-title', 'Sign Up - Step 3/3')
                     ->assertMissing('#signup_last_name')
                     ->assertMissing('#signup_first_name')
                     ->assertVisible('#signup_login')
                     ->assertVisible('#signup_password')
-                    ->assertVisible('#signup_confirm')
+                    ->assertVisible('#signup_password_confirmation')
                     ->assertVisible('select#signup_domain')
                     ->assertElementsCount('select#signup_domain option', $domains_count, false)
                     ->assertText('select#signup_domain option:nth-child(1)', $domains[0])
                     ->assertValue('select#signup_domain option:nth-child(1)', $domains[0])
                     ->assertText('select#signup_domain option:nth-child(2)', $domains[1])
                     ->assertValue('select#signup_domain option:nth-child(2)', $domains[1])
                     ->assertVisible('[type=button]')
                     ->assertVisible('[type=submit]')
                     ->assertSeeIn('[type=submit]', 'Submit')
                     ->assertFocused('#signup_login')
                     ->assertSelected('select#signup_domain', \config('app.domain'))
                     ->assertValue('#signup_login', '')
                     ->assertValue('#signup_password', '')
-                    ->assertValue('#signup_confirm', '');
+                    ->assertValue('#signup_password_confirmation', '')
+                    ->with('#signup_password_policy', function (Browser $browser) {
+                        $browser->assertElementsCount('li', 2)
+                            ->assertMissing('li:first-child svg.text-success')
+                            ->assertSeeIn('li:first-child small', "Minimum password length: 6 characters")
+                            ->assertMissing('li:last-child svg.text-success')
+                            ->assertSeeIn('li:last-child small', "Maximum password length: 255 characters");
+                    });
 
                 // TODO: Test domain selector
             });
 
             // Test Back button
             $browser->click('@step3 [type=button]');
             $browser->waitFor('@step2');
             $browser->assertFocused('@step2 #signup_short_code');
             $browser->assertMissing('@step3');
 
             // TODO: Test form reset when going back
 
             // Submit valid code again
             $browser->with('@step2', function ($step) {
                 $code = $step->value('#signup_code');
 
                 $this->assertNotEmpty($code);
 
                 $code = SignupCode::find($code);
 
                 $step->type('#signup_short_code', $code->short_code);
                 $step->click('[type=submit]');
             });
 
             $browser->waitFor('@step3');
 
             // Submit invalid data
             $browser->with('@step3', function ($step) {
                 $step->assertFocused('#signup_login')
                     ->type('#signup_login', '*')
                     ->type('#signup_password', '12345678')
-                    ->type('#signup_confirm', '123456789')
+                    ->type('#signup_password_confirmation', '123456789')
+                    ->with('#signup_password_policy', function (Browser $browser) {
+                        $browser->waitFor('li:first-child svg.text-success')
+                            ->waitFor('li:last-child svg.text-success');
+                    })
                     ->click('[type=submit]')
                     ->waitFor('#signup_login.is-invalid')
                     ->assertVisible('#signup_domain + .invalid-feedback')
                     ->assertVisible('#signup_password.is-invalid')
-                    ->assertVisible('#signup_password + .invalid-feedback')
+                    ->assertVisible('#signup_password_input .invalid-feedback')
                     ->assertFocused('#signup_login')
                     ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
             });
 
             // Submit invalid data (valid login, invalid password)
             $browser->with('@step3', function ($step) {
                 $step->type('#signup_login', 'SignupTestDusk')
                     ->click('[type=submit]')
                     ->waitFor('#signup_password.is-invalid')
-                    ->assertVisible('#signup_password + .invalid-feedback')
+                    ->assertVisible('#signup_password_input .invalid-feedback')
                     ->assertMissing('#signup_login.is-invalid')
                     ->assertMissing('#signup_domain + .invalid-feedback')
                     ->assertFocused('#signup_password')
                     ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
             });
 
             // Submit valid data
             $browser->with('@step3', function ($step) {
-                $step->type('#signup_confirm', '12345678');
+                $step->type('#signup_password_confirmation', '12345678');
 
                 $step->click('[type=submit]');
             });
 
             // At this point we should be auto-logged-in to dashboard
             $browser->waitUntilMissing('@step3')
                 ->waitUntilMissing('.app-loader')
                 ->on(new Dashboard())
                 ->assertUser('signuptestdusk@' . \config('app.domain'))
                 ->assertVisible('@links a.link-profile')
                 ->assertMissing('@links a.link-domains')
                 ->assertVisible('@links a.link-users')
                 ->assertVisible('@links a.link-wallet');
 
             // Logout the user
             $browser->within(new Menu(), function ($browser) {
                 $browser->clickMenuItem('logout');
             });
         });
     }
 
     /**
      * Test signup for a group account
      */
     public function testSignupGroup(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->visit(new Signup());
 
             // Choose the group account plan
             $browser->waitFor('@step0 .plan-group button')
                 ->click('@step0 .plan-group button');
 
             // Submit valid data
             // We expect error state on email input to be removed, and Step 2 form visible
             $browser->whenAvailable('@step1', function ($step) {
                 $step->type('#signup_first_name', 'Test')
                     ->type('#signup_last_name', 'User')
                     ->type('#signup_email', 'BrowserSignupTestUser1@kolab.org')
                     ->click('[type=submit]');
             });
 
             // Submit valid code
             $browser->whenAvailable('@step2', function ($step) {
                 // Get the code and short_code from database
                 // FIXME: Find a nice way to read javascript data without using hidden inputs
                 $code = $step->value('#signup_code');
                 $code = SignupCode::find($code);
 
                 $step->type('#signup_short_code', $code->short_code)
                     ->click('[type=submit]');
             });
 
             // Here we expect 4 text inputs, Back and Continue buttons
             $browser->whenAvailable('@step3', function ($step) {
                 $step->assertVisible('#signup_login')
                     ->assertVisible('#signup_password')
-                    ->assertVisible('#signup_confirm')
+                    ->assertVisible('#signup_password_confirmation')
                     ->assertVisible('input#signup_domain')
                     ->assertVisible('[type=button]')
                     ->assertVisible('[type=submit]')
                     ->assertFocused('#signup_login')
                     ->assertValue('input#signup_domain', '')
                     ->assertValue('#signup_login', '')
                     ->assertValue('#signup_password', '')
-                    ->assertValue('#signup_confirm', '');
+                    ->assertValue('#signup_password_confirmation', '');
             });
 
             // Submit invalid login and password data
             $browser->with('@step3', function ($step) {
                 $step->assertFocused('#signup_login')
                     ->type('#signup_login', '*')
                     ->type('#signup_domain', 'test.com')
                     ->type('#signup_password', '12345678')
-                    ->type('#signup_confirm', '123456789')
+                    ->type('#signup_password_confirmation', '123456789')
                     ->click('[type=submit]')
                     ->waitFor('#signup_login.is-invalid')
                     ->assertVisible('#signup_domain + .invalid-feedback')
                     ->assertVisible('#signup_password.is-invalid')
-                    ->assertVisible('#signup_password + .invalid-feedback')
+                    ->assertVisible('#signup_password_input .invalid-feedback')
                     ->assertFocused('#signup_login')
                     ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
             });
 
             // Submit invalid domain
             $browser->with('@step3', function ($step) {
                 $step->type('#signup_login', 'admin')
                     ->type('#signup_domain', 'aaa')
                     ->type('#signup_password', '12345678')
-                    ->type('#signup_confirm', '12345678')
+                    ->type('#signup_password_confirmation', '12345678')
                     ->click('[type=submit]')
                     ->waitUntilMissing('#signup_login.is-invalid')
                     ->waitFor('#signup_domain.is-invalid + .invalid-feedback')
                     ->assertMissing('#signup_password.is-invalid')
-                    ->assertMissing('#signup_password + .invalid-feedback')
+                    ->assertMissing('#signup_password_input .invalid-feedback')
                     ->assertFocused('#signup_domain')
                     ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
             });
 
             // Submit invalid domain
             $browser->with('@step3', function ($step) {
                 $step->type('#signup_domain', 'user-domain-signup.com')
                     ->click('[type=submit]');
             });
 
             // At this point we should be auto-logged-in to dashboard
             $browser->waitUntilMissing('@step3')
                 ->waitUntilMissing('.app-loader')
                 ->on(new Dashboard())
                 ->assertUser('admin@user-domain-signup.com')
                 ->assertVisible('@links a.link-profile')
                 ->assertVisible('@links a.link-domains')
                 ->assertVisible('@links a.link-users')
                 ->assertVisible('@links a.link-wallet');
 
             $browser->within(new Menu(), function ($browser) {
                 $browser->clickMenuItem('logout');
             });
         });
     }
 
     /**
      * Test signup with voucher
      */
     public function testSignupVoucherLink(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->visit('/signup/voucher/TEST')
                 ->onWithoutAssert(new Signup())
                 ->waitUntilMissing('.app-loader')
                 ->waitFor('@step0')
                 ->click('.plan-individual button')
                 ->whenAvailable('@step1', function (Browser $browser) {
                     $browser->type('#signup_first_name', 'Test')
                         ->type('#signup_last_name', 'User')
                         ->type('#signup_email', 'BrowserSignupTestUser1@kolab.org')
                         ->click('[type=submit]');
                 })
                 ->whenAvailable('@step2', function (Browser $browser) {
                     // Get the code and short_code from database
                     // FIXME: Find a nice way to read javascript data without using hidden inputs
                     $code = $browser->value('#signup_code');
 
                     $this->assertNotEmpty($code);
 
                     $code = SignupCode::find($code);
 
                     $browser->type('#signup_short_code', $code->short_code)
                         ->click('[type=submit]');
                 })
                 ->whenAvailable('@step3', function (Browser $browser) {
                     // Assert that the code is filled in the input
                     // Change it and test error handling
                     $browser->assertValue('#signup_voucher', 'TEST')
                         ->type('#signup_voucher', 'TESTXX')
                         ->type('#signup_login', 'signuptestdusk')
                         ->type('#signup_password', '123456789')
-                        ->type('#signup_confirm', '123456789')
+                        ->type('#signup_password_confirmation', '123456789')
                         ->click('[type=submit]')
                         ->waitFor('#signup_voucher.is-invalid')
                         ->assertVisible('#signup_voucher + .invalid-feedback')
                         ->assertFocused('#signup_voucher')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                         // Submit the correct code
                         ->type('#signup_voucher', 'TEST')
                         ->click('[type=submit]');
                 })
                 ->waitUntilMissing('@step3')
                 ->waitUntilMissing('.app-loader')
                 ->on(new Dashboard())
                 ->assertUser('signuptestdusk@' . \config('app.domain'))
                 // Logout the user
                 ->within(new Menu(), function ($browser) {
                     $browser->clickMenuItem('logout');
                 });
         });
 
         $user = $this->getTestUser('signuptestdusk@' . \config('app.domain'));
         $discount = Discount::where('code', 'TEST')->first();
         $this->assertSame($discount->id, $user->wallets()->first()->discount_id);
     }
 
     /**
      * Test signup via invitation link
      */
     public function testSignupInvitation(): void
     {
         // Test non-existing invitation
         $this->browse(function (Browser $browser) {
             $browser->visit('/signup/invite/TEST')
                 ->onWithoutAssert(new Signup())
                 ->waitFor('#app > #error-page')
                 ->assertErrorPage(404);
         });
 
         $invitation = SignupInvitation::create(['email' => 'test@domain.org']);
 
         $this->browse(function (Browser $browser) use ($invitation) {
             $browser->visit('/signup/invite/' . $invitation->id)
                 ->onWithoutAssert(new Signup())
                 ->waitUntilMissing('.app-loader')
                 ->with('@step3', function ($step) {
                     $domains_count = count(Domain::getPublicDomains());
 
                     $step->assertMissing('.card-title')
                         ->assertVisible('#signup_last_name')
                         ->assertVisible('#signup_first_name')
                         ->assertVisible('#signup_login')
                         ->assertVisible('#signup_password')
-                        ->assertVisible('#signup_confirm')
+                        ->assertVisible('#signup_password_confirmation')
                         ->assertVisible('select#signup_domain')
                         ->assertElementsCount('select#signup_domain option', $domains_count, false)
                         ->assertVisible('[type=submit]')
                         ->assertMissing('[type=button]') // Back button
                         ->assertSeeIn('[type=submit]', 'Sign Up')
                         ->assertFocused('#signup_first_name')
                         ->assertValue('select#signup_domain', \config('app.domain'))
                         ->assertValue('#signup_first_name', '')
                         ->assertValue('#signup_last_name', '')
                         ->assertValue('#signup_login', '')
                         ->assertValue('#signup_password', '')
-                        ->assertValue('#signup_confirm', '');
+                        ->assertValue('#signup_password_confirmation', '');
 
                     // Submit invalid data
                     $step->type('#signup_login', '*')
                         ->type('#signup_password', '12345678')
-                        ->type('#signup_confirm', '123456789')
+                        ->type('#signup_password_confirmation', '123456789')
                         ->click('[type=submit]')
                         ->waitFor('#signup_login.is-invalid')
                         ->assertVisible('#signup_domain + .invalid-feedback')
                         ->assertVisible('#signup_password.is-invalid')
-                        ->assertVisible('#signup_password + .invalid-feedback')
+                        ->assertVisible('#signup_password_input .invalid-feedback')
                         ->assertFocused('#signup_login')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
 
                     // Submit valid data
-                    $step->type('#signup_confirm', '12345678')
+                    $step->type('#signup_password_confirmation', '12345678')
                         ->type('#signup_login', 'signuptestdusk')
                         ->type('#signup_first_name', 'First')
                         ->type('#signup_last_name', 'Last')
                         ->click('[type=submit]');
                 })
                 // At this point we should be auto-logged-in to dashboard
                 ->waitUntilMissing('@step3')
                 ->waitUntilMissing('.app-loader')
                 ->on(new Dashboard())
                 ->assertUser('signuptestdusk@' . \config('app.domain'))
                 // Logout the user
                 ->within(new Menu(), function ($browser) {
                     $browser->clickMenuItem('logout');
                 });
         });
 
         $invitation->refresh();
         $user = User::where('email', 'signuptestdusk@' . \config('app.domain'))->first();
 
         $this->assertTrue($invitation->isCompleted());
         $this->assertSame($user->id, $invitation->user_id);
         $this->assertSame('First', $user->getSetting('first_name'));
         $this->assertSame('Last', $user->getSetting('last_name'));
         $this->assertSame($invitation->email, $user->getSetting('external_email'));
     }
 }
diff --git a/src/tests/Browser/UserProfileTest.php b/src/tests/Browser/UserProfileTest.php
index e66cdc8c..48467f7a 100644
--- a/src/tests/Browser/UserProfileTest.php
+++ b/src/tests/Browser/UserProfileTest.php
@@ -1,194 +1,228 @@
 <?php
 
 namespace Tests\Browser;
 
 use App\User;
 use Tests\Browser;
 use Tests\Browser\Components\Toast;
 use Tests\Browser\Pages\Dashboard;
 use Tests\Browser\Pages\Home;
 use Tests\Browser\Pages\UserProfile;
 use Tests\TestCaseDusk;
 use Illuminate\Foundation\Testing\DatabaseMigrations;
 
 class UserProfileTest extends TestCaseDusk
 {
     private $profile = [
         'first_name' => 'John',
         'last_name' => 'Doe',
         'currency' => 'USD',
         'country' => 'US',
         'billing_address' => "601 13th Street NW\nSuite 900 South\nWashington, DC 20005",
         'external_email' => 'john.doe.external@gmail.com',
         'phone' => '+1 509-248-1111',
         'organization' => 'Kolab Developers',
     ];
 
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         User::where('email', 'john@kolab.org')->first()->setSettings($this->profile);
         $this->deleteTestUser('profile-delete@kolabnow.com');
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         User::where('email', 'john@kolab.org')->first()->setSettings($this->profile);
         $this->deleteTestUser('profile-delete@kolabnow.com');
 
         parent::tearDown();
     }
 
     /**
      * Test profile page (unauthenticated)
      */
     public function testProfileUnauth(): void
     {
         // Test that the page requires authentication
         $this->browse(function (Browser $browser) {
             $browser->visit('/profile')->on(new Home());
         });
     }
 
     /**
      * Test profile page
      */
     public function testProfile(): void
     {
+        $user = $this->getTestUser('john@kolab.org');
+        $user->setSetting('password_policy', 'min:10,upper,digit');
+
         $this->browse(function (Browser $browser) {
             $browser->visit(new Home())
                 ->submitLogon('john@kolab.org', 'simple123', true)
                 ->on(new Dashboard())
                 ->assertSeeIn('@links .link-profile', 'Your profile')
                 ->click('@links .link-profile')
                 ->on(new UserProfile())
                 ->assertSeeIn('#user-profile .button-delete', 'Delete account')
                 ->whenAvailable('@form', function (Browser $browser) {
                     $user = User::where('email', 'john@kolab.org')->first();
                     // Assert form content
                     $browser->assertFocused('div.row:nth-child(2) input')
                         ->assertSeeIn('div.row:nth-child(1) label', 'Customer No.')
                         ->assertSeeIn('div.row:nth-child(1) .form-control-plaintext', $user->id)
                         ->assertSeeIn('div.row:nth-child(2) label', 'First Name')
                         ->assertValue('div.row:nth-child(2) input[type=text]', $this->profile['first_name'])
                         ->assertSeeIn('div.row:nth-child(3) label', 'Last Name')
                         ->assertValue('div.row:nth-child(3) input[type=text]', $this->profile['last_name'])
                         ->assertSeeIn('div.row:nth-child(4) label', 'Organization')
                         ->assertValue('div.row:nth-child(4) input[type=text]', $this->profile['organization'])
                         ->assertSeeIn('div.row:nth-child(5) label', 'Phone')
                         ->assertValue('div.row:nth-child(5) input[type=text]', $this->profile['phone'])
                         ->assertSeeIn('div.row:nth-child(6) label', 'External Email')
                         ->assertValue('div.row:nth-child(6) input[type=text]', $this->profile['external_email'])
                         ->assertSeeIn('div.row:nth-child(7) label', 'Address')
                         ->assertValue('div.row:nth-child(7) textarea', $this->profile['billing_address'])
                         ->assertSeeIn('div.row:nth-child(8) label', 'Country')
                         ->assertValue('div.row:nth-child(8) select', $this->profile['country'])
                         ->assertSeeIn('div.row:nth-child(9) label', 'Password')
                         ->assertValue('div.row:nth-child(9) input#password', '')
                         ->assertValue('div.row:nth-child(9) input#password_confirmation', '')
                         ->assertAttribute('#password', 'placeholder', 'Password')
                         ->assertAttribute('#password_confirmation', 'placeholder', 'Confirm Password')
+                        ->whenAvailable('#password_policy', function (Browser $browser) {
+                            $browser->assertElementsCount('li', 3)
+                                ->assertMissing('li:nth-child(1) svg.text-success')
+                                ->assertSeeIn('li:nth-child(1) small', "Minimum password length: 10 characters")
+                                ->assertMissing('li:nth-child(2) svg.text-success')
+                                ->assertSeeIn('li:nth-child(2) small', "Password contains an upper-case character")
+                                ->assertMissing('li:nth-child(3) svg.text-success')
+                                ->assertSeeIn('li:nth-child(3) small', "Password contains a digit");
+                        })
                         ->assertSeeIn('button[type=submit]', 'Submit');
 
+                    // Test password policy checking
+                    $browser->type('#password', '1A')
+                        ->whenAvailable('#password_policy', function (Browser $browser) {
+                            $browser->waitFor('li:nth-child(2) svg.text-success')
+                                ->waitFor('li:nth-child(3) svg.text-success')
+                                ->assertMissing('li:nth-child(1) svg.text-success');
+                        })
+                        ->vueClear('#password');
+
                     // Test form error handling
                     $browser->type('#phone', 'aaaaaa')
                         ->type('#external_email', 'bbbbb')
                         ->click('button[type=submit]')
                         ->waitFor('#phone + .invalid-feedback')
                         ->assertSeeIn('#phone + .invalid-feedback', 'The phone format is invalid.')
                         ->assertSeeIn(
                             '#external_email + .invalid-feedback',
                             'The external email must be a valid email address.'
                         )
                         ->assertFocused('#phone')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                         ->clearToasts();
 
                     // Clear all fields and submit
                     // FIXME: Should any of these fields be required?
                     $browser->vueClear('#first_name')
                         ->vueClear('#last_name')
                         ->vueClear('#organization')
                         ->vueClear('#phone')
                         ->vueClear('#external_email')
                         ->vueClear('#billing_address')
                         ->click('button[type=submit]')
                         ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');
                 })
                 // On success we're redirected to Dashboard
                 ->on(new Dashboard());
         });
     }
 
     /**
      * Test profile of non-controller user
      */
     public function testProfileNonController(): void
     {
+        $user = $this->getTestUser('john@kolab.org');
+        $user->setSetting('password_policy', 'min:10,upper,digit');
+
         // Test acting as non-controller
         $this->browse(function (Browser $browser) {
             $browser->visit('/logout')
                 ->visit(new Home())
                 ->submitLogon('jack@kolab.org', 'simple123', true)
                 ->on(new Dashboard())
                 ->assertSeeIn('@links .link-profile', 'Your profile')
                 ->click('@links .link-profile')
                 ->on(new UserProfile())
                 ->assertMissing('#user-profile .button-delete')
                 ->whenAvailable('@form', function (Browser $browser) {
                     // TODO: decide on what fields the non-controller user should be able
                     //       to see/change
+                })
+                // Check that the account policy is used
+                ->whenAvailable('#password_policy', function (Browser $browser) {
+                    $browser->assertElementsCount('li', 3)
+                        ->assertMissing('li:nth-child(1) svg.text-success')
+                        ->assertSeeIn('li:nth-child(1) small', "Minimum password length: 10 characters")
+                        ->assertMissing('li:nth-child(2) svg.text-success')
+                        ->assertSeeIn('li:nth-child(2) small', "Password contains an upper-case character")
+                        ->assertMissing('li:nth-child(3) svg.text-success')
+                        ->assertSeeIn('li:nth-child(3) small', "Password contains a digit");
                 });
 
             // Test that /profile/delete page is not accessible
             $browser->visit('/profile/delete')
                 ->assertErrorPage(403);
         });
     }
 
     /**
      * Test profile delete page
      */
     public function testProfileDelete(): void
     {
         $user = $this->getTestUser('profile-delete@kolabnow.com', ['password' => 'simple123']);
 
         $this->browse(function (Browser $browser) use ($user) {
             $browser->visit('/logout')
                 ->on(new Home())
                 ->submitLogon('profile-delete@kolabnow.com', 'simple123', true)
                 ->on(new Dashboard())
                 ->assertSeeIn('@links .link-profile', 'Your profile')
                 ->click('@links .link-profile')
                 ->on(new UserProfile())
                 ->click('#user-profile .button-delete')
                 ->waitForLocation('/profile/delete')
                 ->assertSeeIn('#user-delete .card-title', 'Delete this account?')
                 ->assertSeeIn('#user-delete .button-cancel', 'Cancel')
                 ->assertSeeIn('#user-delete .card-text', 'This operation is irreversible')
                 ->assertFocused('#user-delete .button-cancel')
                 ->click('#user-delete .button-cancel')
                 ->waitForLocation('/profile')
                 ->on(new UserProfile());
 
             // Test deleting the user
             $browser->click('#user-profile .button-delete')
                 ->waitForLocation('/profile/delete')
                 ->click('#user-delete .button-delete')
                 ->waitForLocation('/login')
                 ->assertToast(Toast::TYPE_SUCCESS, 'User deleted successfully.');
 
             $this->assertTrue($user->fresh()->trashed());
         });
     }
 
     // TODO: Test that Ned (John's "delegatee") can delete himself
     // TODO: Test that Ned (John's "delegatee") can/can't delete John ?
 }
diff --git a/src/tests/Browser/UsersTest.php b/src/tests/Browser/UsersTest.php
index aafdf4db..a1392a5a 100644
--- a/src/tests/Browser/UsersTest.php
+++ b/src/tests/Browser/UsersTest.php
@@ -1,878 +1,893 @@
 <?php
 
 namespace Tests\Browser;
 
 use App\Discount;
 use App\Entitlement;
 use App\Sku;
 use App\User;
 use App\UserAlias;
 use Tests\Browser;
 use Tests\Browser\Components\Dialog;
 use Tests\Browser\Components\ListInput;
 use Tests\Browser\Components\QuotaInput;
 use Tests\Browser\Components\Toast;
 use Tests\Browser\Pages\Dashboard;
 use Tests\Browser\Pages\Home;
 use Tests\Browser\Pages\UserInfo;
 use Tests\Browser\Pages\UserList;
 use Tests\Browser\Pages\Wallet as WalletPage;
 use Tests\TestCaseDusk;
 use Illuminate\Foundation\Testing\DatabaseMigrations;
 
 class UsersTest extends TestCaseDusk
 {
     private $profile = [
         'first_name' => 'John',
         'last_name' => 'Doe',
         'organization' => 'Kolab Developers',
     ];
 
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('julia.roberts@kolab.org');
 
         $john = User::where('email', 'john@kolab.org')->first();
         $john->setSettings($this->profile);
         UserAlias::where('user_id', $john->id)
             ->where('alias', 'john.test@kolab.org')->delete();
 
         $activesync_sku = Sku::withEnvTenantContext()->where('title', 'activesync')->first();
         $storage_sku = Sku::withEnvTenantContext()->where('title', 'storage')->first();
 
         Entitlement::where('entitleable_id', $john->id)->where('sku_id', $activesync_sku->id)->delete();
         Entitlement::where('cost', '>=', 5000)->delete();
         Entitlement::where('cost', '=', 25)->where('sku_id', $storage_sku->id)->delete();
 
         $wallet = $john->wallets()->first();
         $wallet->discount()->dissociate();
         $wallet->currency = 'CHF';
         $wallet->save();
 
         $this->clearBetaEntitlements();
         $this->clearMeetEntitlements();
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser('julia.roberts@kolab.org');
 
         $john = User::where('email', 'john@kolab.org')->first();
         $john->setSettings($this->profile);
         UserAlias::where('user_id', $john->id)
             ->where('alias', 'john.test@kolab.org')->delete();
 
         $activesync_sku = Sku::withEnvTenantContext()->where('title', 'activesync')->first();
         $storage_sku = Sku::withEnvTenantContext()->where('title', 'storage')->first();
 
         Entitlement::where('entitleable_id', $john->id)->where('sku_id', $activesync_sku->id)->delete();
         Entitlement::where('cost', '>=', 5000)->delete();
         Entitlement::where('cost', '=', 25)->where('sku_id', $storage_sku->id)->delete();
 
         $wallet = $john->wallets()->first();
         $wallet->discount()->dissociate();
         $wallet->save();
 
         $this->clearBetaEntitlements();
         $this->clearMeetEntitlements();
 
         parent::tearDown();
     }
 
     /**
      * Test user account editing page (not profile page)
      */
     public function testInfo(): void
     {
         $this->browse(function (Browser $browser) {
             $john = $this->getTestUser('john@kolab.org');
             $jack = $this->getTestUser('jack@kolab.org');
             $john->verificationcodes()->delete();
             $jack->verificationcodes()->delete();
+            $john->setSetting('password_policy', 'min:10,upper,digit');
 
             // Test that the page requires authentication
             $browser->visit('/user/' . $john->id)
                 ->on(new Home())
                 ->submitLogon('john@kolab.org', 'simple123', false)
                 ->on(new UserInfo())
                 ->assertSeeIn('#user-info .card-title', 'User account')
                 ->with('@general', function (Browser $browser) {
                     // Assert form content
                     $browser->assertSeeIn('div.row:nth-child(1) label', 'Status')
                         ->assertSeeIn('div.row:nth-child(1) #status', 'Active')
                         ->assertFocused('div.row:nth-child(2) input')
                         ->assertSeeIn('div.row:nth-child(2) label', 'First Name')
                         ->assertValue('div.row:nth-child(2) input[type=text]', $this->profile['first_name'])
                         ->assertSeeIn('div.row:nth-child(3) label', 'Last Name')
                         ->assertValue('div.row:nth-child(3) input[type=text]', $this->profile['last_name'])
                         ->assertSeeIn('div.row:nth-child(4) label', 'Organization')
                         ->assertValue('div.row:nth-child(4) input[type=text]', $this->profile['organization'])
                         ->assertSeeIn('div.row:nth-child(5) label', 'Email')
                         ->assertValue('div.row:nth-child(5) input[type=text]', 'john@kolab.org')
                         ->assertDisabled('div.row:nth-child(5) input[type=text]')
                         ->assertSeeIn('div.row:nth-child(6) label', 'Email Aliases')
                         ->assertVisible('div.row:nth-child(6) .list-input')
                         ->with(new ListInput('#aliases'), function (Browser $browser) {
                             $browser->assertListInputValue(['john.doe@kolab.org'])
                                 ->assertValue('@input', '');
                         })
                         ->assertSeeIn('div.row:nth-child(7) label', 'Password')
                         ->assertValue('div.row:nth-child(7) input#password', '')
                         ->assertValue('div.row:nth-child(7) input#password_confirmation', '')
                         ->assertAttribute('#password', 'placeholder', 'Password')
                         ->assertAttribute('#password_confirmation', 'placeholder', 'Confirm Password')
                         ->assertMissing('div.row:nth-child(7) .btn-group')
                         ->assertMissing('div.row:nth-child(7) #password-link')
                         ->assertSeeIn('button[type=submit]', 'Submit')
                         // Clear some fields and submit
                         ->vueClear('#first_name')
                         ->vueClear('#last_name')
                         ->click('button[type=submit]');
                 })
                 ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.')
                 ->on(new UserList())
                 ->click('@table tr:nth-child(3) a')
                 ->on(new UserInfo())
                 ->assertSeeIn('#user-info .card-title', 'User account')
                 ->with('@general', function (Browser $browser) {
                     // Test error handling (password)
-                    $browser->type('#password', 'aaaaaa')
+                    $browser->type('#password', 'aaaaaA')
                         ->vueClear('#password_confirmation')
+                        ->whenAvailable('#password_policy', function (Browser $browser) {
+                            $browser->assertElementsCount('li', 3)
+                                ->assertMissing('li:nth-child(1) svg.text-success')
+                                ->assertSeeIn('li:nth-child(1) small', "Minimum password length: 10 characters")
+                                ->waitFor('li:nth-child(2) svg.text-success')
+                                ->assertSeeIn('li:nth-child(2) small', "Password contains an upper-case character")
+                                ->assertMissing('li:nth-child(3) svg.text-success')
+                                ->assertSeeIn('li:nth-child(3) small', "Password contains a digit");
+                        })
                         ->click('button[type=submit]')
                         ->waitFor('#password_confirmation + .invalid-feedback')
                         ->assertSeeIn(
                             '#password_confirmation + .invalid-feedback',
                             'The password confirmation does not match.'
                         )
                         ->assertFocused('#password')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
 
                     // TODO: Test password change
 
                     // Test form error handling (aliases)
                     $browser->vueClear('#password')
                         ->vueClear('#password_confirmation')
                         ->with(new ListInput('#aliases'), function (Browser $browser) {
                             $browser->addListEntry('invalid address');
                         })
+                        ->scrollTo('button[type=submit]')->pause(500)
                         ->click('button[type=submit]')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
 
                     $browser->with(new ListInput('#aliases'), function (Browser $browser) {
                         $browser->assertFormError(2, 'The specified alias is invalid.', false);
                     });
 
                     // Test adding aliases
                     $browser->with(new ListInput('#aliases'), function (Browser $browser) {
                         $browser->removeListEntry(2)
                             ->addListEntry('john.test@kolab.org');
                     })
                         ->click('button[type=submit]')
                         ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');
                 })
                 ->on(new UserList())
                 ->click('@table tr:nth-child(3) a')
                 ->on(new UserInfo());
 
             $alias = $john->aliases()->where('alias', 'john.test@kolab.org')->first();
             $this->assertTrue(!empty($alias));
 
             // Test subscriptions
             $browser->with('@general', function (Browser $browser) {
                 $browser->assertSeeIn('div.row:nth-child(8) label', 'Subscriptions')
                     ->assertVisible('@skus.row:nth-child(8)')
                     ->with('@skus', function ($browser) {
                         $browser->assertElementsCount('tbody tr', 6)
                             // Mailbox SKU
                             ->assertSeeIn('tbody tr:nth-child(1) td.name', 'User Mailbox')
                             ->assertSeeIn('tbody tr:nth-child(1) td.price', '5,00 CHF/month')
                             ->assertChecked('tbody tr:nth-child(1) td.selection input')
                             ->assertDisabled('tbody tr:nth-child(1) td.selection input')
                             ->assertTip(
                                 'tbody tr:nth-child(1) td.buttons button',
                                 'Just a mailbox'
                             )
                             // Storage SKU
                             ->assertSeeIn('tbody tr:nth-child(2) td.name', 'Storage Quota')
                             ->assertSeeIn('tr:nth-child(2) td.price', '0,00 CHF/month')
                             ->assertChecked('tbody tr:nth-child(2) td.selection input')
                             ->assertDisabled('tbody tr:nth-child(2) td.selection input')
                             ->assertTip(
                                 'tbody tr:nth-child(2) td.buttons button',
                                 'Some wiggle room'
                             )
                             ->with(new QuotaInput('tbody tr:nth-child(2) .range-input'), function ($browser) {
                                 $browser->assertQuotaValue(5)->setQuotaValue(6);
                             })
                             ->assertSeeIn('tr:nth-child(2) td.price', '0,25 CHF/month')
                             // groupware SKU
                             ->assertSeeIn('tbody tr:nth-child(3) td.name', 'Groupware Features')
                             ->assertSeeIn('tbody tr:nth-child(3) td.price', '4,90 CHF/month')
                             ->assertChecked('tbody tr:nth-child(3) td.selection input')
                             ->assertEnabled('tbody tr:nth-child(3) td.selection input')
                             ->assertTip(
                                 'tbody tr:nth-child(3) td.buttons button',
                                 'Groupware functions like Calendar, Tasks, Notes, etc.'
                             )
                             // ActiveSync SKU
                             ->assertSeeIn('tbody tr:nth-child(4) td.name', 'Activesync')
                             ->assertSeeIn('tbody tr:nth-child(4) td.price', '0,00 CHF/month')
                             ->assertNotChecked('tbody tr:nth-child(4) td.selection input')
                             ->assertEnabled('tbody tr:nth-child(4) td.selection input')
                             ->assertTip(
                                 'tbody tr:nth-child(4) td.buttons button',
                                 'Mobile synchronization'
                             )
                             // 2FA SKU
                             ->assertSeeIn('tbody tr:nth-child(5) td.name', '2-Factor Authentication')
                             ->assertSeeIn('tbody tr:nth-child(5) td.price', '0,00 CHF/month')
                             ->assertNotChecked('tbody tr:nth-child(5) td.selection input')
                             ->assertEnabled('tbody tr:nth-child(5) td.selection input')
                             ->assertTip(
                                 'tbody tr:nth-child(5) td.buttons button',
                                 'Two factor authentication for webmail and administration panel'
                             )
                             // Meet SKU
                             ->assertSeeIn('tbody tr:nth-child(6) td.name', 'Voice & Video Conferencing (public beta)')
                             ->assertSeeIn('tbody tr:nth-child(6) td.price', '0,00 CHF/month')
                             ->assertNotChecked('tbody tr:nth-child(6) td.selection input')
                             ->assertEnabled('tbody tr:nth-child(6) td.selection input')
                             ->assertTip(
                                 'tbody tr:nth-child(6) td.buttons button',
                                 'Video conferencing tool'
                             )
                             ->click('tbody tr:nth-child(4) td.selection input');
                     })
                     ->assertMissing('@skus table + .hint')
                     ->click('button[type=submit]')
                     ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');
             })
                 ->on(new UserList())
                 ->click('@table tr:nth-child(3) a')
                 ->on(new UserInfo());
 
             $expected = ['activesync', 'groupware', 'mailbox',
                 'storage', 'storage', 'storage', 'storage', 'storage', 'storage'];
             $this->assertEntitlements($john->fresh(), $expected);
 
             // Test subscriptions interaction
             $browser->with('@general', function (Browser $browser) {
                 $browser->with('@skus', function ($browser) {
                     // Uncheck 'groupware', expect activesync unchecked
                     $browser->click('#sku-input-groupware')
                         ->assertNotChecked('#sku-input-groupware')
                         ->assertNotChecked('#sku-input-activesync')
                         ->assertEnabled('#sku-input-activesync')
                         ->assertNotReadonly('#sku-input-activesync')
                         // Check 'activesync', expect an alert
                         ->click('#sku-input-activesync')
                         ->assertDialogOpened('Activesync requires Groupware Features.')
                         ->acceptDialog()
                         ->assertNotChecked('#sku-input-activesync')
                         // Check 'meet', expect an alert
                         ->click('#sku-input-meet')
                         ->assertDialogOpened('Voice & Video Conferencing (public beta) requires Groupware Features.')
                         ->acceptDialog()
                         ->assertNotChecked('#sku-input-meet')
                         // Check '2FA', expect 'activesync' unchecked and readonly
                         ->click('#sku-input-2fa')
                         ->assertChecked('#sku-input-2fa')
                         ->assertNotChecked('#sku-input-activesync')
                         ->assertReadonly('#sku-input-activesync')
                         // Uncheck '2FA'
                         ->click('#sku-input-2fa')
                         ->assertNotChecked('#sku-input-2fa')
                         ->assertNotReadonly('#sku-input-activesync');
                 });
             });
 
             // Test password reset link delete and create
             $code = new \App\VerificationCode(['mode' => 'password-reset']);
             $jack->verificationcodes()->save($code);
 
             $browser->visit('/user/' . $jack->id)
                 ->on(new UserInfo())
                 ->with('@general', function (Browser $browser) use ($jack, $john, $code) {
                     // Test displaying an existing password reset link
                     $link = Browser::$baseUrl . '/password-reset/' . $code->short_code . '-' . $code->code;
                     $browser->assertSeeIn('div.row:nth-child(7) label', 'Password')
                         ->assertMissing('#password')
                         ->assertMissing('#password_confirmation')
                         ->assertMissing('#pass-mode-link:checked')
                         ->assertMissing('#pass-mode-input:checked')
                         ->assertSeeIn('#password-link code', $link)
                         ->assertVisible('#password-link button.text-danger')
                         ->assertVisible('#password-link button:not(.text-danger)')
                         ->assertAttribute('#password-link button:not(.text-danger)', 'title', 'Copy')
                         ->assertAttribute('#password-link button.text-danger', 'title', 'Delete');
 
                     // Test deleting an existing password reset link
                     $browser->click('#password-link button.text-danger')
                         ->assertToast(Toast::TYPE_SUCCESS, 'Password reset code deleted successfully.')
                         ->assertMissing('#password-link')
                         ->assertMissing('#pass-mode-link:checked')
                         ->assertMissing('#pass-mode-input:checked')
                         ->assertMissing('#password');
 
                     $this->assertSame(0, $jack->verificationcodes()->count());
 
                     // Test creating a password reset link
                     $link = preg_replace('|/[a-z0-9A-Z-]+$|', '', $link) . '/';
                     $browser->click('#pass-mode-link + label')
                         ->assertMissing('#password')
                         ->assertMissing('#password_confirmation')
                         ->waitFor('#password-link code')
                         ->assertSeeIn('#password-link code', $link);
 
                     // Test copy to clipboard
                     /* TODO: Figure out how to give permission to do this operation
                     $code = $john->verificationcodes()->first();
                     $link .= $code->short_code . '-' . $code->code;
 
                     $browser->assertMissing('#password-link button.text-danger')
                         ->click('#password-link button:not(.text-danger)')
                         ->keys('#organization', ['{left_control}', 'v'])
                         ->assertAttribute('#organization', 'value', $link)
                         ->vueClear('#organization');
                     */
 
                     // Finally submit the form
                     $browser->click('button[type=submit]')
                         ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');
 
                     $this->assertSame(1, $jack->verificationcodes()->where('active', true)->count());
                     $this->assertSame(0, $john->verificationcodes()->count());
                 });
         });
     }
 
     /**
      * Test user settings tab
      *
      * @depends testInfo
      */
     public function testUserSettings(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $john->setSetting('greylist_enabled', null);
 
         $this->browse(function (Browser $browser) use ($john) {
             $browser->visit('/user/' . $john->id)
                 ->on(new UserInfo())
                 ->assertElementsCount('@nav a', 2)
                 ->assertSeeIn('@nav #tab-general', 'General')
                 ->assertSeeIn('@nav #tab-settings', 'Settings')
                 ->click('@nav #tab-settings')
                 ->with('#settings form', function (Browser $browser) {
                     $browser->assertSeeIn('div.row:nth-child(1) label', 'Greylisting')
                         ->click('div.row:nth-child(1) input[type=checkbox]:checked')
                         ->click('button[type=submit]')
                         ->assertToast(Toast::TYPE_SUCCESS, 'User settings updated successfully.');
                 });
         });
 
         $this->assertSame('false', $john->fresh()->getSetting('greylist_enabled'));
     }
 
     /**
      * Test user adding page
      *
      * @depends testInfo
      */
     public function testNewUser(): void
     {
+        $john = $this->getTestUser('john@kolab.org');
+        $john->setSetting('password_policy', null);
+
         $this->browse(function (Browser $browser) {
             $browser->visit(new UserList())
                 ->assertSeeIn('button.create-user', 'Create user')
                 ->click('button.create-user')
                 ->on(new UserInfo())
                 ->assertSeeIn('#user-info .card-title', 'New user account')
                 ->with('@general', function (Browser $browser) {
                     // Assert form content
                     $browser->assertFocused('div.row:nth-child(1) input')
                         ->assertSeeIn('div.row:nth-child(1) label', 'First Name')
                         ->assertValue('div.row:nth-child(1) input[type=text]', '')
                         ->assertSeeIn('div.row:nth-child(2) label', 'Last Name')
                         ->assertValue('div.row:nth-child(2) input[type=text]', '')
                         ->assertSeeIn('div.row:nth-child(3) label', 'Organization')
                         ->assertValue('div.row:nth-child(3) input[type=text]', '')
                         ->assertSeeIn('div.row:nth-child(4) label', 'Email')
                         ->assertValue('div.row:nth-child(4) input[type=text]', '')
                         ->assertEnabled('div.row:nth-child(4) input[type=text]')
                         ->assertSeeIn('div.row:nth-child(5) label', 'Email Aliases')
                         ->assertVisible('div.row:nth-child(5) .list-input')
                         ->with(new ListInput('#aliases'), function (Browser $browser) {
                             $browser->assertListInputValue([])
                                 ->assertValue('@input', '');
                         })
                         ->assertSeeIn('div.row:nth-child(6) label', 'Password')
                         ->assertValue('div.row:nth-child(6) input#password', '')
                         ->assertValue('div.row:nth-child(6) input#password_confirmation', '')
                         ->assertAttribute('#password', 'placeholder', 'Password')
                         ->assertAttribute('#password_confirmation', 'placeholder', 'Confirm Password')
                         ->assertSeeIn('div.row:nth-child(6) .btn-group input:first-child + label', 'Enter password')
                         ->assertSeeIn('div.row:nth-child(6) .btn-group input:not(:first-child) + label', 'Set via link')
                         ->assertChecked('div.row:nth-child(6) .btn-group input:first-child')
                         ->assertMissing('div.row:nth-child(6) #password-link')
                         ->assertSeeIn('div.row:nth-child(7) label', 'Package')
                         // assert packages list widget, select "Lite Account"
                         ->with('@packages', function ($browser) {
                             $browser->assertElementsCount('tbody tr', 2)
                                 ->assertSeeIn('tbody tr:nth-child(1)', 'Groupware Account')
                                 ->assertSeeIn('tbody tr:nth-child(2)', 'Lite Account')
                                 ->assertSeeIn('tbody tr:nth-child(1) .price', '9,90 CHF/month')
                                 ->assertSeeIn('tbody tr:nth-child(2) .price', '5,00 CHF/month')
                                 ->assertChecked('tbody tr:nth-child(1) input')
                                 ->click('tbody tr:nth-child(2) input')
                                 ->assertNotChecked('tbody tr:nth-child(1) input')
                                 ->assertChecked('tbody tr:nth-child(2) input');
                         })
                         ->assertMissing('@packages table + .hint')
                         ->assertSeeIn('button[type=submit]', 'Submit');
 
                     // Test browser-side required fields and error handling
                     $browser->click('button[type=submit]')
                         ->assertFocused('#email')
                         ->type('#email', 'invalid email')
                         ->type('#password', 'simple123')
                         ->type('#password_confirmation', 'simple')
                         ->click('button[type=submit]')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                         ->assertSeeIn('#email + .invalid-feedback', 'The specified email is invalid.')
                         ->assertSeeIn(
                             '#password_confirmation + .invalid-feedback',
                             'The password confirmation does not match.'
                         );
                 });
 
             // Test form error handling (aliases)
             $browser->with('@general', function (Browser $browser) {
                 $browser->type('#email', 'julia.roberts@kolab.org')
                     ->type('#password_confirmation', 'simple123')
                     ->with(new ListInput('#aliases'), function (Browser $browser) {
                         $browser->addListEntry('invalid address');
                     })
                     ->click('button[type=submit]')
                     ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                     ->with(new ListInput('#aliases'), function (Browser $browser) {
                         $browser->assertFormError(1, 'The specified alias is invalid.', false);
                     });
             });
 
             // Successful account creation
             $browser->with('@general', function (Browser $browser) {
                 $browser->type('#first_name', 'Julia')
                     ->type('#last_name', 'Roberts')
                     ->type('#organization', 'Test Org')
                     ->with(new ListInput('#aliases'), function (Browser $browser) {
                         $browser->removeListEntry(1)
                             ->addListEntry('julia.roberts2@kolab.org');
                     })
                     ->click('button[type=submit]');
             })
             ->assertToast(Toast::TYPE_SUCCESS, 'User created successfully.')
             // check redirection to users list
             ->on(new UserList())
                 ->whenAvailable('@table', function (Browser $browser) {
                     $browser->assertElementsCount('tbody tr', 5)
                         ->assertSeeIn('tbody tr:nth-child(4) a', 'julia.roberts@kolab.org');
                 });
 
             $julia = User::where('email', 'julia.roberts@kolab.org')->first();
             $alias = UserAlias::where('user_id', $julia->id)->where('alias', 'julia.roberts2@kolab.org')->first();
 
             $this->assertTrue(!empty($alias));
             $this->assertEntitlements($julia, ['mailbox', 'storage', 'storage', 'storage', 'storage', 'storage']);
             $this->assertSame('Julia', $julia->getSetting('first_name'));
             $this->assertSame('Roberts', $julia->getSetting('last_name'));
             $this->assertSame('Test Org', $julia->getSetting('organization'));
 
             // Some additional tests for the list input widget
             $browser->click('@table tbody tr:nth-child(4) a')
                 ->on(new UserInfo())
                 ->with(new ListInput('#aliases'), function (Browser $browser) {
                     $browser->assertListInputValue(['julia.roberts2@kolab.org'])
                         ->addListEntry('invalid address')
                         ->type('.input-group:nth-child(2) input', '@kolab.org')
                         ->keys('.input-group:nth-child(2) input', '{enter}');
                 })
                 // TODO: Investigate why this click does not work, for now we
                 // submit the form with Enter key above
                 //->click('@general button[type=submit]')
                 ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                 ->with(new ListInput('#aliases'), function (Browser $browser) {
                     $browser->assertVisible('.input-group:nth-child(2) input.is-invalid')
                         ->assertVisible('.input-group:nth-child(3) input.is-invalid')
                         ->type('.input-group:nth-child(2) input', 'julia.roberts3@kolab.org')
                         ->type('.input-group:nth-child(3) input', 'julia.roberts4@kolab.org')
                         ->keys('.input-group:nth-child(3) input', '{enter}');
                 })
                 // TODO: Investigate why this click does not work, for now we
                 // submit the form with Enter key above
                 //->click('@general button[type=submit]')
                 ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');
 
             $julia = User::where('email', 'julia.roberts@kolab.org')->first();
             $aliases = $julia->aliases()->orderBy('alias')->get()->pluck('alias')->all();
 
             $this->assertSame(['julia.roberts3@kolab.org', 'julia.roberts4@kolab.org'], $aliases);
         });
     }
 
     /**
      * Test user delete
      *
      * @depends testNewUser
      */
     public function testDeleteUser(): void
     {
         // First create a new user
         $john = $this->getTestUser('john@kolab.org');
         $julia = $this->getTestUser('julia.roberts@kolab.org');
         $package_kolab = \App\Package::where('title', 'kolab')->first();
         $john->assignPackage($package_kolab, $julia);
 
         // Test deleting non-controller user
         $this->browse(function (Browser $browser) use ($julia) {
             $browser->visit('/user/' . $julia->id)
                 ->on(new UserInfo())
                 ->assertSeeIn('button.button-delete', 'Delete user')
                 ->click('button.button-delete')
                 ->with(new Dialog('#delete-warning'), function (Browser $browser) {
                     $browser->assertSeeIn('@title', 'Delete julia.roberts@kolab.org')
                         ->assertFocused('@button-cancel')
                         ->assertSeeIn('@button-cancel', 'Cancel')
                         ->assertSeeIn('@button-action', 'Delete')
                         ->click('@button-cancel');
                 })
                 ->waitUntilMissing('#delete-warning')
                 ->click('button.button-delete')
                 ->with(new Dialog('#delete-warning'), function (Browser $browser) {
                     $browser->click('@button-action');
                 })
                 ->waitUntilMissing('#delete-warning')
                 ->assertToast(Toast::TYPE_SUCCESS, 'User deleted successfully.')
                 ->on(new UserList())
                 ->with('@table', function (Browser $browser) {
                     $browser->assertElementsCount('tbody tr', 4)
                         ->assertSeeIn('tbody tr:nth-child(1) a', 'jack@kolab.org')
                         ->assertSeeIn('tbody tr:nth-child(2) a', 'joe@kolab.org')
                         ->assertSeeIn('tbody tr:nth-child(3) a', 'john@kolab.org')
                         ->assertSeeIn('tbody tr:nth-child(4) a', 'ned@kolab.org');
                 });
 
             $julia = User::where('email', 'julia.roberts@kolab.org')->first();
             $this->assertTrue(empty($julia));
         });
 
         // Test that non-controller user cannot see/delete himself on the users list
         $this->browse(function (Browser $browser) {
             $browser->visit('/logout')
                 ->on(new Home())
                 ->submitLogon('jack@kolab.org', 'simple123', true)
                 ->visit('/users')
                 ->assertErrorPage(403);
         });
 
         // Test that controller user (Ned) can see all the users
         $this->browse(function (Browser $browser) {
             $browser->visit('/logout')
                 ->on(new Home())
                 ->submitLogon('ned@kolab.org', 'simple123', true)
                 ->visit(new UserList())
                 ->whenAvailable('@table', function (Browser $browser) {
                     $browser->assertElementsCount('tbody tr', 4);
                 });
 
                 // TODO: Test the delete action in details
         });
 
         // TODO: Test what happens with the logged in user session after he's been deleted by another user
     }
 
     /**
      * Test discounted sku/package prices in the UI
      */
     public function testDiscountedPrices(): void
     {
         // Add 10% discount
         $discount = Discount::where('code', 'TEST')->first();
         $john = User::where('email', 'john@kolab.org')->first();
         $wallet = $john->wallet();
         $wallet->discount()->associate($discount);
         $wallet->save();
 
         // SKUs on user edit page
         $this->browse(function (Browser $browser) {
             $browser->visit('/logout')
                 ->on(new Home())
                 ->submitLogon('john@kolab.org', 'simple123', true)
                 ->visit(new UserList())
                 ->waitFor('@table tr:nth-child(2)')
                 ->click('@table tr:nth-child(2) a') // joe@kolab.org
                 ->on(new UserInfo())
                 ->with('@general', function (Browser $browser) {
                     $browser->whenAvailable('@skus', function (Browser $browser) {
                         $quota_input = new QuotaInput('tbody tr:nth-child(2) .range-input');
                         $browser->waitFor('tbody tr')
                             ->assertElementsCount('tbody tr', 6)
                             // Mailbox SKU
                             ->assertSeeIn('tbody tr:nth-child(1) td.price', '4,50 CHF/month¹')
                             // Storage SKU
                             ->assertSeeIn('tr:nth-child(2) td.price', '0,00 CHF/month¹')
                             ->with($quota_input, function (Browser $browser) {
                                 $browser->setQuotaValue(100);
                             })
                             ->assertSeeIn('tr:nth-child(2) td.price', '21,37 CHF/month¹')
                             // groupware SKU
                             ->assertSeeIn('tbody tr:nth-child(3) td.price', '4,41 CHF/month¹')
                             // ActiveSync SKU
                             ->assertSeeIn('tbody tr:nth-child(4) td.price', '0,00 CHF/month¹')
                             // 2FA SKU
                             ->assertSeeIn('tbody tr:nth-child(5) td.price', '0,00 CHF/month¹');
                     })
                     ->assertSeeIn('@skus table + .hint', '¹ applied discount: 10% - Test voucher');
                 });
         });
 
         // Packages on new user page
         $this->browse(function (Browser $browser) {
             $browser->visit(new UserList())
                 ->click('button.create-user')
                 ->on(new UserInfo())
                 ->with('@general', function (Browser $browser) {
                     $browser->whenAvailable('@packages', function (Browser $browser) {
                         $browser->assertElementsCount('tbody tr', 2)
                             ->assertSeeIn('tbody tr:nth-child(1) .price', '8,91 CHF/month¹') // Groupware
                             ->assertSeeIn('tbody tr:nth-child(2) .price', '4,50 CHF/month¹'); // Lite
                     })
                     ->assertSeeIn('@packages table + .hint', '¹ applied discount: 10% - Test voucher');
                 });
         });
 
         // Test using entitlement cost instead of the SKU cost
         $this->browse(function (Browser $browser) use ($wallet) {
             $joe = User::where('email', 'joe@kolab.org')->first();
             $beta_sku = Sku::withEnvTenantContext()->where('title', 'beta')->first();
             $storage_sku = Sku::withEnvTenantContext()->where('title', 'storage')->first();
 
             // Add an extra storage and beta entitlement with different prices
             Entitlement::create([
                     'wallet_id' => $wallet->id,
                     'sku_id' => $beta_sku->id,
                     'cost' => 5010,
                     'entitleable_id' => $joe->id,
                     'entitleable_type' => User::class
             ]);
             Entitlement::create([
                     'wallet_id' => $wallet->id,
                     'sku_id' => $storage_sku->id,
                     'cost' => 5000,
                     'entitleable_id' => $joe->id,
                     'entitleable_type' => User::class
             ]);
 
             $browser->visit('/user/' . $joe->id)
                 ->on(new UserInfo())
                 ->with('@general', function (Browser $browser) {
                     $browser->whenAvailable('@skus', function (Browser $browser) {
                         $quota_input = new QuotaInput('tbody tr:nth-child(2) .range-input');
                         $browser->waitFor('tbody tr')
                             // Beta SKU
                             ->assertSeeIn('tbody tr:nth-child(7) td.price', '45,09 CHF/month¹')
                             // Storage SKU
                             ->assertSeeIn('tr:nth-child(2) td.price', '45,00 CHF/month¹')
                             ->with($quota_input, function (Browser $browser) {
                                 $browser->setQuotaValue(7);
                             })
                             ->assertSeeIn('tr:nth-child(2) td.price', '45,22 CHF/month¹')
                             ->with($quota_input, function (Browser $browser) {
                                 $browser->setQuotaValue(5);
                             })
                             ->assertSeeIn('tr:nth-child(2) td.price', '0,00 CHF/month¹');
                     })
                     ->assertSeeIn('@skus table + .hint', '¹ applied discount: 10% - Test voucher');
                 });
         });
     }
 
     /**
      * Test non-default currency in the UI
      */
     public function testCurrency(): void
     {
         // Add 10% discount
         $john = User::where('email', 'john@kolab.org')->first();
         $wallet = $john->wallet();
         $wallet->balance = -1000;
         $wallet->currency = 'EUR';
         $wallet->save();
 
         // On Dashboard and the wallet page
         $this->browse(function (Browser $browser) {
             $browser->visit('/logout')
                 ->on(new Home())
                 ->submitLogon('john@kolab.org', 'simple123', true)
                 ->on(new Dashboard())
                 ->assertSeeIn('@links .link-wallet .badge', '-10,00 €')
                 ->click('@links .link-wallet')
                 ->on(new WalletPage())
                 ->assertSeeIn('#wallet .card-title', 'Account balance -10,00 €');
         });
 
         // SKUs on user edit page
         $this->browse(function (Browser $browser) {
             $browser->visit(new UserList())
                 ->waitFor('@table tr:nth-child(2)')
                 ->click('@table tr:nth-child(2) a') // joe@kolab.org
                 ->on(new UserInfo())
                 ->with('@general', function (Browser $browser) {
                     $browser->whenAvailable('@skus', function (Browser $browser) {
                         $quota_input = new QuotaInput('tbody tr:nth-child(2) .range-input');
                         $browser->waitFor('tbody tr')
                             ->assertElementsCount('tbody tr', 6)
                             // Mailbox SKU
                             ->assertSeeIn('tbody tr:nth-child(1) td.price', '5,00 €/month')
                             // Storage SKU
                             ->assertSeeIn('tr:nth-child(2) td.price', '0,00 €/month')
                             ->with($quota_input, function (Browser $browser) {
                                 $browser->setQuotaValue(100);
                             })
                             ->assertSeeIn('tr:nth-child(2) td.price', '23,75 €/month');
                     });
                 });
         });
 
         // Packages on new user page
         $this->browse(function (Browser $browser) {
             $browser->visit(new UserList())
                 ->click('button.create-user')
                 ->on(new UserInfo())
                 ->with('@general', function (Browser $browser) {
                     $browser->whenAvailable('@packages', function (Browser $browser) {
                         $browser->assertElementsCount('tbody tr', 2)
                             ->assertSeeIn('tbody tr:nth-child(1) .price', '9,90 €/month') // Groupware
                             ->assertSeeIn('tbody tr:nth-child(2) .price', '5,00 €/month'); // Lite
                     });
                 });
         });
     }
 
     /**
      * Test beta entitlements
      *
      * @depends testInfo
      */
     public function testBetaEntitlements(): void
     {
         $this->browse(function (Browser $browser) {
             $john = User::where('email', 'john@kolab.org')->first();
             $sku = Sku::withEnvTenantContext()->where('title', 'beta')->first();
             $john->assignSku($sku);
 
             $browser->visit('/user/' . $john->id)
                 ->on(new UserInfo())
                 ->with('@skus', function ($browser) {
                     $browser->assertElementsCount('tbody tr', 10)
                         // Meet SKU
                         ->assertSeeIn('tbody tr:nth-child(6) td.name', 'Voice & Video Conferencing (public beta)')
                         ->assertSeeIn('tr:nth-child(6) td.price', '0,00 CHF/month')
                         ->assertNotChecked('tbody tr:nth-child(6) td.selection input')
                         ->assertEnabled('tbody tr:nth-child(6) td.selection input')
                         ->assertTip(
                             'tbody tr:nth-child(6) td.buttons button',
                             'Video conferencing tool'
                         )
                         // Beta SKU
                         ->assertSeeIn('tbody tr:nth-child(7) td.name', 'Private Beta (invitation only)')
                         ->assertSeeIn('tbody tr:nth-child(7) td.price', '0,00 CHF/month')
                         ->assertChecked('tbody tr:nth-child(7) td.selection input')
                         ->assertEnabled('tbody tr:nth-child(7) td.selection input')
                         ->assertTip(
                             'tbody tr:nth-child(7) td.buttons button',
                             'Access to the private beta program subscriptions'
                         )
                         // Distlists SKU
                         ->assertSeeIn('tbody tr:nth-child(8) td.name', 'Distribution lists')
                         ->assertSeeIn('tr:nth-child(8) td.price', '0,00 CHF/month')
                         ->assertNotChecked('tbody tr:nth-child(8) td.selection input')
                         ->assertEnabled('tbody tr:nth-child(8) td.selection input')
                         ->assertTip(
                             'tbody tr:nth-child(8) td.buttons button',
                             'Access to mail distribution lists'
                         )
                         // Resources SKU
                         ->assertSeeIn('tbody tr:nth-child(9) td.name', 'Calendaring resources')
                         ->assertSeeIn('tr:nth-child(9) td.price', '0,00 CHF/month')
                         ->assertNotChecked('tbody tr:nth-child(9) td.selection input')
                         ->assertEnabled('tbody tr:nth-child(9) td.selection input')
                         ->assertTip(
                             'tbody tr:nth-child(9) td.buttons button',
                             'Access to calendaring resources'
                         )
                         // Shared folders SKU
+                        ->scrollTo('tbody tr:nth-child(10)')->pause(500)
                         ->assertSeeIn('tbody tr:nth-child(10) td.name', 'Shared folders')
                         ->assertSeeIn('tr:nth-child(10) td.price', '0,00 CHF/month')
                         ->assertNotChecked('tbody tr:nth-child(10) td.selection input')
                         ->assertEnabled('tbody tr:nth-child(10) td.selection input')
                         ->assertTip(
                             'tbody tr:nth-child(10) td.buttons button',
                             'Access to shared folders'
                         )
                         // Check Distlist, Uncheck Beta, expect Distlist unchecked
                         ->click('#sku-input-beta-distlists')
                         ->click('#sku-input-beta')
                         ->assertNotChecked('#sku-input-beta')
                         ->assertNotChecked('#sku-input-beta-distlists')
                         // Click Distlists expect an alert
                         ->click('#sku-input-beta-distlists')
                         ->assertDialogOpened('Distribution lists requires Private Beta (invitation only).')
                         ->acceptDialog()
                         // Enable Beta and Distlist and submit
                         ->click('#sku-input-beta')
                         ->click('#sku-input-beta-distlists');
                 })
                 ->scrollTo('@general button[type=submit]')
                 ->click('@general button[type=submit]')
                 ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');
 
             $expected = [
                 'beta',
                 'beta-distlists',
                 'groupware',
                 'mailbox',
                 'storage', 'storage', 'storage', 'storage', 'storage'
             ];
 
             $this->assertEntitlements($john, $expected);
 
             $browser->visit('/user/' . $john->id)
                 ->on(new UserInfo())
                 ->waitFor('#sku-input-beta')
                 ->click('#sku-input-beta')
-                ->scrollTo('@general button[type=submit]')
+                ->scrollTo('@general button[type=submit]')->pause(500)
                 ->click('@general button[type=submit]')
                 ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');
 
             $expected = [
                 'groupware',
                 'mailbox',
                 'storage', 'storage', 'storage', 'storage', 'storage'
             ];
 
             $this->assertEntitlements($john, $expected);
         });
 
         // TODO: Test that the Distlists SKU is not available for users that aren't a group account owners
         // TODO: Test that entitlements change has immediate effect on the available items in dashboard
         //       i.e. does not require a page reload nor re-login.
     }
 }
diff --git a/src/tests/Feature/Controller/PasswordPolicyTest.php b/src/tests/Feature/Controller/PasswordPolicyTest.php
new file mode 100644
index 00000000..80dce63a
--- /dev/null
+++ b/src/tests/Feature/Controller/PasswordPolicyTest.php
@@ -0,0 +1,133 @@
+<?php
+
+namespace Tests\Feature\Controller;
+
+use Tests\TestCase;
+
+class PasswordPolicyTest extends TestCase
+{
+    /**
+     * Test password policy check
+     */
+    public function testCheck(): void
+    {
+        $jack = $this->getTestUser('jack@kolab.org');
+        $john = $this->getTestUser('john@kolab.org');
+        $john->setSetting('password_policy', 'min:8,max:100,upper,digit');
+
+        // Empty password
+        $post = ['user' => $john->id];
+        $response = $this->post('/api/auth/password-policy/check', $post);
+        $response->assertStatus(200);
+
+        $json = $response->json();
+
+        $this->assertCount(3, $json);
+        $this->assertSame('error', $json['status']);
+        $this->assertSame(4, $json['count']);
+        $this->assertFalse($json['list'][0]['status']);
+        $this->assertSame('min', $json['list'][0]['label']);
+        $this->assertFalse($json['list'][1]['status']);
+        $this->assertSame('max', $json['list'][1]['label']);
+        $this->assertFalse($json['list'][2]['status']);
+        $this->assertSame('upper', $json['list'][2]['label']);
+        $this->assertFalse($json['list'][3]['status']);
+        $this->assertSame('digit', $json['list'][3]['label']);
+
+        // Test acting as Jack, password non-compliant
+        $post = ['password' => '9999999', 'user' => $jack->id];
+        $response = $this->post('/api/auth/password-policy/check', $post);
+        $response->assertStatus(200);
+
+        $json = $response->json();
+
+        $this->assertCount(3, $json);
+        $this->assertSame('error', $json['status']);
+        $this->assertSame(4, $json['count']);
+        $this->assertFalse($json['list'][0]['status']); // min
+        $this->assertTrue($json['list'][1]['status']); // max
+        $this->assertFalse($json['list'][2]['status']); // upper
+        $this->assertTrue($json['list'][3]['status']); // digit
+
+        // Test with no user context, expect use of the default policy
+        $post = ['password' => '9'];
+        $response = $this->post('/api/auth/password-policy/check', $post);
+        $response->assertStatus(200);
+
+        $json = $response->json();
+
+        $this->assertCount(3, $json);
+        $this->assertSame('error', $json['status']);
+        $this->assertSame(2, $json['count']);
+        $this->assertFalse($json['list'][0]['status']);
+        $this->assertSame('min', $json['list'][0]['label']);
+        $this->assertTrue($json['list'][1]['status']);
+        $this->assertSame('max', $json['list'][1]['label']);
+    }
+
+    /**
+     * Test password-policy listing
+     */
+    public function testIndex(): void
+    {
+        // Unauth access not allowed
+        $response = $this->get('/api/v4/password-policy');
+        $response->assertStatus(401);
+
+        $jack = $this->getTestUser('jack@kolab.org');
+        $john = $this->getTestUser('john@kolab.org');
+        $john->setSetting('password_policy', 'min:8,max:255,special');
+
+        // Get available policy rules
+        $response = $this->actingAs($john)->get('/api/v4/password-policy');
+        $json = $response->json();
+
+        $response->assertStatus(200);
+
+        $this->assertCount(2, $json);
+        $this->assertSame(6, $json['count']);
+        $this->assertCount(6, $json['list']);
+        $this->assertSame('Minimum password length: 8 characters', $json['list'][0]['name']);
+        $this->assertSame('min', $json['list'][0]['label']);
+        $this->assertSame('8', $json['list'][0]['param']);
+        $this->assertSame(true, $json['list'][0]['enabled']);
+        $this->assertSame('Maximum password length: 255 characters', $json['list'][1]['name']);
+        $this->assertSame('max', $json['list'][1]['label']);
+        $this->assertSame('255', $json['list'][1]['param']);
+        $this->assertSame(true, $json['list'][1]['enabled']);
+        $this->assertSame('lower', $json['list'][2]['label']);
+        $this->assertSame(false, $json['list'][2]['enabled']);
+        $this->assertSame('upper', $json['list'][3]['label']);
+        $this->assertSame(false, $json['list'][3]['enabled']);
+        $this->assertSame('digit', $json['list'][4]['label']);
+        $this->assertSame(false, $json['list'][4]['enabled']);
+        $this->assertSame('special', $json['list'][5]['label']);
+        $this->assertSame(true, $json['list'][5]['enabled']);
+
+        // Test acting as Jack
+        $response = $this->actingAs($jack)->get('/api/v4/password-policy');
+        $json = $response->json();
+
+        $response->assertStatus(200);
+
+        $this->assertCount(2, $json);
+        $this->assertSame(6, $json['count']);
+        $this->assertCount(6, $json['list']);
+        $this->assertSame('Minimum password length: 8 characters', $json['list'][0]['name']);
+        $this->assertSame('min', $json['list'][0]['label']);
+        $this->assertSame('8', $json['list'][0]['param']);
+        $this->assertSame(true, $json['list'][0]['enabled']);
+        $this->assertSame('Maximum password length: 255 characters', $json['list'][1]['name']);
+        $this->assertSame('max', $json['list'][1]['label']);
+        $this->assertSame('255', $json['list'][1]['param']);
+        $this->assertSame(true, $json['list'][1]['enabled']);
+        $this->assertSame('lower', $json['list'][2]['label']);
+        $this->assertSame(false, $json['list'][2]['enabled']);
+        $this->assertSame('upper', $json['list'][3]['label']);
+        $this->assertSame(false, $json['list'][3]['enabled']);
+        $this->assertSame('digit', $json['list'][4]['label']);
+        $this->assertSame(false, $json['list'][4]['enabled']);
+        $this->assertSame('special', $json['list'][5]['label']);
+        $this->assertSame(true, $json['list'][5]['enabled']);
+    }
+}
diff --git a/src/tests/Feature/Controller/PasswordResetTest.php b/src/tests/Feature/Controller/PasswordResetTest.php
index 8e95ec9a..242b818b 100644
--- a/src/tests/Feature/Controller/PasswordResetTest.php
+++ b/src/tests/Feature/Controller/PasswordResetTest.php
@@ -1,411 +1,432 @@
 <?php
 
 namespace Tests\Feature\Controller;
 
 use App\VerificationCode;
 use App\User;
 use Illuminate\Support\Facades\Queue;
 use Tests\TestCase;
 
 class PasswordResetTest extends TestCase
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('passwordresettest@' . \config('app.domain'));
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser('passwordresettest@' . \config('app.domain'));
 
         parent::tearDown();
     }
 
     /**
      * Test password-reset/init with invalid input
      */
     public function testPasswordResetInitInvalidInput(): void
     {
         // Empty input data
         $data = [];
 
         $response = $this->post('/api/auth/password-reset/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('email', $json['errors']);
 
         // Data with invalid email
         $data = [
             'email' => '@example.org',
         ];
 
         $response = $this->post('/api/auth/password-reset/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('email', $json['errors']);
 
         // Data with valid but non-existing email
         $data = [
             'email' => 'non-existing-password-reset@example.org',
         ];
 
         $response = $this->post('/api/auth/password-reset/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('email', $json['errors']);
 
         // Data with valid email af an existing user with no external email
         $data = [
             'email' => 'passwordresettest@' . \config('app.domain'),
         ];
 
         $response = $this->post('/api/auth/password-reset/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('email', $json['errors']);
     }
 
     /**
      * Test password-reset/init with valid input
      *
      * @return array
      */
     public function testPasswordResetInitValidInput()
     {
         Queue::fake();
 
         // Assert that no jobs were pushed...
         Queue::assertNothingPushed();
 
         // Add required external email address to user settings
         $user = $this->getTestUser('passwordresettest@' . \config('app.domain'));
         $user->setSetting('external_email', 'ext@email.com');
 
         $data = [
             'email' => 'passwordresettest@' . \config('app.domain'),
         ];
 
         $response = $this->post('/api/auth/password-reset/init', $data);
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertCount(2, $json);
         $this->assertSame('success', $json['status']);
         $this->assertNotEmpty($json['code']);
 
         // Assert the email sending job was pushed once
         Queue::assertPushed(\App\Jobs\PasswordResetEmail::class, 1);
 
         // Assert the job has proper data assigned
         Queue::assertPushed(\App\Jobs\PasswordResetEmail::class, function ($job) use ($user, &$code, $json) {
             $code = TestCase::getObjectProperty($job, 'code');
 
             return $code->user->id == $user->id && $code->code == $json['code'];
         });
 
         return [
             'code' => $code
         ];
     }
 
     /**
      * Test password-reset/verify with invalid input
      *
      * @return void
      */
     public function testPasswordResetVerifyInvalidInput()
     {
         // Empty data
         $data = [];
 
         $response = $this->post('/api/auth/password-reset/verify', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
 
         // Add verification code and required external email address to user settings
         $user = $this->getTestUser('passwordresettest@' . \config('app.domain'));
         $code = new VerificationCode(['mode' => 'password-reset']);
         $user->verificationcodes()->save($code);
 
         // Data with existing code but missing short_code
         $data = [
             'code' => $code->code,
         ];
 
         $response = $this->post('/api/auth/password-reset/verify', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
 
         // Data with invalid code
         $data = [
             'short_code' => '123456789',
             'code' => $code->code,
         ];
 
         $response = $this->post('/api/auth/password-reset/verify', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
 
         // TODO: Test expired code
     }
 
     /**
      * Test password-reset/verify with valid input
      *
      * @return void
      */
     public function testPasswordResetVerifyValidInput()
     {
         // Add verification code and required external email address to user settings
         $user = $this->getTestUser('passwordresettest@' . \config('app.domain'));
         $code = new VerificationCode(['mode' => 'password-reset']);
         $user->verificationcodes()->save($code);
 
         // Data with invalid code
         $data = [
             'short_code' => $code->short_code,
             'code' => $code->code,
         ];
 
         $response = $this->post('/api/auth/password-reset/verify', $data);
         $json = $response->json();
 
         $response->assertStatus(200);
-        $this->assertCount(1, $json);
+        $this->assertCount(2, $json);
         $this->assertSame('success', $json['status']);
+        $this->assertSame($user->id, $json['userId']);
     }
 
     /**
      * Test password-reset with invalid input
      *
      * @return void
      */
     public function testPasswordResetInvalidInput()
     {
         // Empty data
         $data = [];
 
         $response = $this->post('/api/auth/password-reset', $data);
+        $response->assertStatus(422);
+
         $json = $response->json();
 
-        $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
-        $this->assertCount(1, $json['errors']);
-        $this->assertArrayHasKey('password', $json['errors']);
+        $this->assertCount(2, $json['errors']);
+        $this->assertArrayHasKey('code', $json['errors']);
+        $this->assertArrayHasKey('short_code', $json['errors']);
 
         $user = $this->getTestUser('passwordresettest@' . \config('app.domain'));
         $code = new VerificationCode(['mode' => 'password-reset']);
         $user->verificationcodes()->save($code);
 
         // Data with existing code but missing password
         $data = [
             'code' => $code->code,
+            'short_code' => $code->short_code,
         ];
 
         $response = $this->post('/api/auth/password-reset', $data);
+        $response->assertStatus(422);
+
         $json = $response->json();
 
-        $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('password', $json['errors']);
 
         // Data with existing code but wrong password confirmation
         $data = [
             'code' => $code->code,
             'short_code' => $code->short_code,
             'password' => 'password',
             'password_confirmation' => 'passwrong',
         ];
 
         $response = $this->post('/api/auth/password-reset', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('password', $json['errors']);
 
+        // Data with existing code but password too short
+        $data = [
+            'code' => $code->code,
+            'short_code' => $code->short_code,
+            'password' => 'pas',
+            'password_confirmation' => 'pas',
+        ];
+
+        $response = $this->post('/api/auth/password-reset', $data);
+        $json = $response->json();
+
+        $response->assertStatus(422);
+        $this->assertSame('error', $json['status']);
+        $this->assertCount(1, $json['errors']);
+        $this->assertArrayHasKey('password', $json['errors']);
+
         // Data with invalid short code
         $data = [
             'code' => $code->code,
             'short_code' => '123456789',
             'password' => 'password',
             'password_confirmation' => 'password',
         ];
 
         $response = $this->post('/api/auth/password-reset', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
     }
 
     /**
      * Test password reset with valid input
      *
      * @return void
      */
     public function testPasswordResetValidInput()
     {
         $user = $this->getTestUser('passwordresettest@' . \config('app.domain'));
         $code = new VerificationCode(['mode' => 'password-reset']);
         $user->verificationcodes()->save($code);
 
         Queue::fake();
         Queue::assertNothingPushed();
 
         $data = [
-            'password' => 'test',
-            'password_confirmation' => 'test',
+            'password' => 'testtest',
+            'password_confirmation' => 'testtest',
             'code' => $code->code,
             'short_code' => $code->short_code,
         ];
 
         $response = $this->post('/api/auth/password-reset', $data);
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertSame('success', $json['status']);
         $this->assertSame('bearer', $json['token_type']);
         $this->assertTrue(!empty($json['expires_in']) && is_int($json['expires_in']) && $json['expires_in'] > 0);
         $this->assertNotEmpty($json['access_token']);
         $this->assertSame($user->email, $json['email']);
         $this->assertSame($user->id, $json['id']);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
 
         Queue::assertPushed(
             \App\Jobs\User\UpdateJob::class,
             function ($job) use ($user) {
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 $userId = TestCase::getObjectProperty($job, 'userId');
 
                 return $userEmail == $user->email && $userId == $user->id;
             }
         );
 
         // Check if the code has been removed
         $this->assertNull(VerificationCode::find($code->code));
 
         // TODO: Check password before and after (?)
 
         // TODO: Check if the access token works
     }
 
     /**
      * Test creating a password verification code
      *
      * @return void
      */
     public function testCodeCreate()
     {
         $user = $this->getTestUser('john@kolab.org');
         $user->verificationcodes()->delete();
 
         $response = $this->actingAs($user)->post('/api/v4/password-reset/code', []);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $code = $user->verificationcodes()->first();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame($code->code, $json['code']);
         $this->assertSame($code->short_code, $json['short_code']);
         $this->assertStringContainsString(now()->addHours(24)->toDateString(), $json['expires_at']);
     }
 
     /**
      * Test deleting a password verification code
      *
      * @return void
      */
     public function testCodeDelete()
     {
         $user = $this->getTestUser('passwordresettest@' . \config('app.domain'));
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $john->verificationcodes()->delete();
         $jack->verificationcodes()->delete();
 
         $john_code = new VerificationCode(['mode' => 'password-reset']);
         $john->verificationcodes()->save($john_code);
         $jack_code = new VerificationCode(['mode' => 'password-reset']);
         $jack->verificationcodes()->save($jack_code);
         $user_code = new VerificationCode(['mode' => 'password-reset']);
         $user->verificationcodes()->save($user_code);
 
         // Unauth access
         $response = $this->delete('/api/v4/password-reset/code/' . $user_code->code);
         $response->assertStatus(401);
 
         // Non-existing code
         $response = $this->actingAs($john)->delete('/api/v4/password-reset/code/123');
         $response->assertStatus(404);
 
         // Existing code belonging to another user not controlled by the acting user
         $response = $this->actingAs($john)->delete('/api/v4/password-reset/code/' . $user_code->code);
         $response->assertStatus(403);
 
         // Deleting owned code
         $response = $this->actingAs($john)->delete('/api/v4/password-reset/code/' . $john_code->code);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(0, $john->verificationcodes()->count());
         $this->assertSame('success', $json['status']);
         $this->assertSame("Password reset code deleted successfully.", $json['message']);
 
         // Deleting code of another user owned by the acting user
         // also use short_code+code as input parameter
         $id = $jack_code->short_code . '-' . $jack_code->code;
         $response = $this->actingAs($john)->delete('/api/v4/password-reset/code/' . $id);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(0, $jack->verificationcodes()->count());
         $this->assertSame('success', $json['status']);
         $this->assertSame("Password reset code deleted successfully.", $json['message']);
     }
 }
diff --git a/src/tests/Feature/Controller/SignupTest.php b/src/tests/Feature/Controller/SignupTest.php
index 306070f9..449c35f7 100644
--- a/src/tests/Feature/Controller/SignupTest.php
+++ b/src/tests/Feature/Controller/SignupTest.php
@@ -1,852 +1,853 @@
 <?php
 
 namespace Tests\Feature\Controller;
 
 use App\Http\Controllers\API\SignupController;
 use App\Discount;
 use App\Domain;
 use App\SignupCode;
 use App\SignupInvitation as SI;
 use App\User;
 use Illuminate\Support\Facades\Queue;
 use Tests\TestCase;
 
 class SignupTest extends TestCase
 {
     private $domain;
 
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         // TODO: Some tests depend on existence of individual and group plans,
         //       we should probably create plans here to not depend on that
         $this->domain = $this->getPublicDomain();
 
         $this->deleteTestUser("SignupControllerTest1@$this->domain");
         $this->deleteTestUser("signuplogin@$this->domain");
         $this->deleteTestUser("admin@external.com");
         $this->deleteTestUser("test-inv@kolabnow.com");
 
         $this->deleteTestDomain('external.com');
         $this->deleteTestDomain('signup-domain.com');
 
         $this->deleteTestGroup('group-test@kolabnow.com');
         SI::truncate();
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser("SignupControllerTest1@$this->domain");
         $this->deleteTestUser("signuplogin@$this->domain");
         $this->deleteTestUser("admin@external.com");
         $this->deleteTestUser("test-inv@kolabnow.com");
 
         $this->deleteTestDomain('external.com');
         $this->deleteTestDomain('signup-domain.com');
 
         $this->deleteTestGroup('group-test@kolabnow.com');
         SI::truncate();
 
         parent::tearDown();
     }
 
     /**
      * Return a public domain for signup tests
      */
     private function getPublicDomain(): string
     {
         if (!$this->domain) {
             $this->refreshApplication();
             $public_domains = Domain::getPublicDomains();
             $this->domain = reset($public_domains);
 
             if (empty($this->domain)) {
                 $this->domain = 'signup-domain.com';
                 Domain::create([
                         'namespace' => $this->domain,
                         'status' => Domain::STATUS_ACTIVE,
                         'type' => Domain::TYPE_PUBLIC,
                 ]);
             }
         }
 
         return $this->domain;
     }
 
     /**
      * Test fetching plans for signup
      */
     public function testSignupPlans(): void
     {
         $response = $this->get('/api/auth/signup/plans');
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertCount(2, $json['plans']);
         $this->assertArrayHasKey('title', $json['plans'][0]);
         $this->assertArrayHasKey('name', $json['plans'][0]);
         $this->assertArrayHasKey('description', $json['plans'][0]);
         $this->assertArrayHasKey('button', $json['plans'][0]);
     }
 
     /**
      * Test fetching invitation
      */
     public function testSignupInvitations(): void
     {
         Queue::fake();
 
         $invitation = SI::create(['email' => 'email1@ext.com']);
 
         // Test existing invitation
         $response = $this->get("/api/auth/signup/invitations/{$invitation->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame($invitation->id, $json['id']);
 
         // Test non-existing invitation
         $response = $this->get("/api/auth/signup/invitations/abc");
         $response->assertStatus(404);
 
         // Test completed invitation
         SI::where('id', $invitation->id)->update(['status' => SI::STATUS_COMPLETED]);
         $response = $this->get("/api/auth/signup/invitations/{$invitation->id}");
         $response->assertStatus(404);
     }
 
     /**
      * Test signup initialization with invalid input
      */
     public function testSignupInitInvalidInput(): void
     {
         // Empty input data
         $data = [];
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('email', $json['errors']);
 
         // Data with missing name
         $data = [
             'email' => 'UsersApiControllerTest1@UsersApiControllerTest.com',
             'first_name' => str_repeat('a', 250),
             'last_name' => str_repeat('a', 250),
         ];
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertArrayHasKey('first_name', $json['errors']);
         $this->assertArrayHasKey('last_name', $json['errors']);
 
         // Data with invalid email (but not phone number)
         $data = [
             'email' => '@example.org',
             'first_name' => 'Signup',
             'last_name' => 'User',
         ];
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('email', $json['errors']);
 
         // Sanity check on voucher code, last/first name is optional
         $data = [
             'voucher' => '123456789012345678901234567890123',
             'email' => 'valid@email.com',
         ];
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('voucher', $json['errors']);
 
         // Email address too long
         $data = [
             'email' => str_repeat('a', 190) . '@example.org',
             'first_name' => 'Signup',
             'last_name' => 'User',
         ];
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertSame("The specified email address is invalid.", $json['errors']['email']);
 
         SignupCode::truncate();
 
         // Email address limit check
         $data = [
             'email' => 'test@example.org',
             'first_name' => 'Signup',
             'last_name' => 'User',
         ];
 
         \config(['app.signup.email_limit' => 0]);
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         \config(['app.signup.email_limit' => 1]);
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         // TODO: This probably should be a different message?
         $this->assertSame("The specified email address is invalid.", $json['errors']['email']);
 
         // IP address limit check
         $data = [
             'email' => 'ip@example.org',
             'first_name' => 'Signup',
             'last_name' => 'User',
         ];
 
         \config(['app.signup.email_limit' => 0]);
         \config(['app.signup.ip_limit' => 0]);
 
         $response = $this->post('/api/auth/signup/init', $data, ['REMOTE_ADDR' => '10.1.1.1']);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         \config(['app.signup.ip_limit' => 1]);
 
         $response = $this->post('/api/auth/signup/init', $data, ['REMOTE_ADDR' => '10.1.1.1']);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         // TODO: This probably should be a different message?
         $this->assertSame("The specified email address is invalid.", $json['errors']['email']);
 
         // TODO: Test phone validation
     }
 
     /**
      * Test signup initialization with valid input
      */
     public function testSignupInitValidInput(): array
     {
         Queue::fake();
 
         // Assert that no jobs were pushed...
         Queue::assertNothingPushed();
 
         $data = [
             'email' => 'testuser@external.com',
             'first_name' => 'Signup',
             'last_name' => 'User',
             'plan' => 'individual',
         ];
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertCount(2, $json);
         $this->assertSame('success', $json['status']);
         $this->assertNotEmpty($json['code']);
 
         // Assert the email sending job was pushed once
         Queue::assertPushed(\App\Jobs\SignupVerificationEmail::class, 1);
 
         // Assert the job has proper data assigned
         Queue::assertPushed(\App\Jobs\SignupVerificationEmail::class, function ($job) use ($data, $json) {
             $code = TestCase::getObjectProperty($job, 'code');
 
             return $code->code === $json['code']
                 && $code->plan === $data['plan']
                 && $code->email === $data['email']
                 && $code->first_name === $data['first_name']
                 && $code->last_name === $data['last_name'];
         });
 
         // Try the same with voucher
         $data['voucher'] = 'TEST';
 
         $response = $this->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertCount(2, $json);
         $this->assertSame('success', $json['status']);
         $this->assertNotEmpty($json['code']);
 
         // Assert the job has proper data assigned
         Queue::assertPushed(\App\Jobs\SignupVerificationEmail::class, function ($job) use ($data, $json) {
             $code = TestCase::getObjectProperty($job, 'code');
 
             return $code->code === $json['code']
                 && $code->plan === $data['plan']
                 && $code->email === $data['email']
                 && $code->voucher === $data['voucher']
                 && $code->first_name === $data['first_name']
                 && $code->last_name === $data['last_name'];
         });
 
         return [
             'code' => $json['code'],
             'email' => $data['email'],
             'first_name' => $data['first_name'],
             'last_name' => $data['last_name'],
             'plan' => $data['plan'],
             'voucher' => $data['voucher']
         ];
     }
 
     /**
      * Test signup code verification with invalid input
      *
      * @depends testSignupInitValidInput
      */
     public function testSignupVerifyInvalidInput(array $result): void
     {
         // Empty data
         $data = [];
 
         $response = $this->post('/api/auth/signup/verify', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertArrayHasKey('code', $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
 
         // Data with existing code but missing short_code
         $data = [
             'code' => $result['code'],
         ];
 
         $response = $this->post('/api/auth/signup/verify', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
 
         // Data with invalid short_code
         $data = [
             'code' => $result['code'],
             'short_code' => 'XXXX',
         ];
 
         $response = $this->post('/api/auth/signup/verify', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
 
         // TODO: Test expired code
     }
 
     /**
      * Test signup code verification with valid input
      *
      * @depends testSignupInitValidInput
      */
     public function testSignupVerifyValidInput(array $result): array
     {
         $code = SignupCode::find($result['code']);
         $data = [
             'code' => $code->code,
             'short_code' => $code->short_code,
         ];
 
         $response = $this->post('/api/auth/signup/verify', $data);
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertCount(7, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame($result['email'], $json['email']);
         $this->assertSame($result['first_name'], $json['first_name']);
         $this->assertSame($result['last_name'], $json['last_name']);
         $this->assertSame($result['voucher'], $json['voucher']);
         $this->assertSame(false, $json['is_domain']);
         $this->assertTrue(is_array($json['domains']) && !empty($json['domains']));
 
         return $result;
     }
 
     /**
      * Test last signup step with invalid input
      *
      * @depends testSignupVerifyValidInput
      */
     public function testSignupInvalidInput(array $result): void
     {
         // Empty data
         $data = [];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(3, $json['errors']);
         $this->assertArrayHasKey('login', $json['errors']);
         $this->assertArrayHasKey('password', $json['errors']);
         $this->assertArrayHasKey('domain', $json['errors']);
 
         $domain = $this->getPublicDomain();
 
         // Passwords do not match and missing domain
         $data = [
             'login' => 'test',
             'password' => 'test',
             'password_confirmation' => 'test2',
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertArrayHasKey('password', $json['errors']);
         $this->assertArrayHasKey('domain', $json['errors']);
 
         $domain = $this->getPublicDomain();
 
-        // Login too short
+        // Login too short, password too short
         $data = [
             'login' => '1',
             'domain' => $domain,
             'password' => 'test',
             'password_confirmation' => 'test',
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
-        $this->assertCount(1, $json['errors']);
+        $this->assertCount(2, $json['errors']);
         $this->assertArrayHasKey('login', $json['errors']);
+        $this->assertArrayHasKey('password', $json['errors']);
 
         // Missing codes
         $data = [
             'login' => 'login-valid',
             'domain' => $domain,
-            'password' => 'test',
-            'password_confirmation' => 'test',
+            'password' => 'testtest',
+            'password_confirmation' => 'testtest',
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertArrayHasKey('code', $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
 
         // Data with invalid short_code
         $data = [
             'login' => 'TestLogin',
             'domain' => $domain,
-            'password' => 'test',
-            'password_confirmation' => 'test',
+            'password' => 'testtest',
+            'password_confirmation' => 'testtest',
             'code' => $result['code'],
             'short_code' => 'XXXX',
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('short_code', $json['errors']);
 
         $code = SignupCode::find($result['code']);
 
         // Data with invalid voucher
         $data = [
             'login' => 'TestLogin',
             'domain' => $domain,
-            'password' => 'test',
-            'password_confirmation' => 'test',
+            'password' => 'testtest',
+            'password_confirmation' => 'testtest',
             'code' => $result['code'],
             'short_code' => $code->short_code,
             'voucher' => 'XXX',
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('voucher', $json['errors']);
 
         // Valid code, invalid login
         $data = [
             'login' => 'żżżżżż',
             'domain' => $domain,
-            'password' => 'test',
-            'password_confirmation' => 'test',
+            'password' => 'testtest',
+            'password_confirmation' => 'testtest',
             'code' => $result['code'],
             'short_code' => $code->short_code,
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(422);
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertArrayHasKey('login', $json['errors']);
     }
 
     /**
      * Test last signup step with valid input (user creation)
      *
      * @depends testSignupVerifyValidInput
      */
     public function testSignupValidInput(array $result): void
     {
         $queue = Queue::fake();
 
         $domain = $this->getPublicDomain();
         $identity = \strtolower('SignupLogin@') . $domain;
         $code = SignupCode::find($result['code']);
         $data = [
             'login' => 'SignupLogin',
             'domain' => $domain,
-            'password' => 'test',
-            'password_confirmation' => 'test',
+            'password' => 'testtest',
+            'password_confirmation' => 'testtest',
             'code' => $code->code,
             'short_code' => $code->short_code,
             'voucher' => 'TEST',
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertSame('success', $json['status']);
         $this->assertSame('bearer', $json['token_type']);
         $this->assertTrue(!empty($json['expires_in']) && is_int($json['expires_in']) && $json['expires_in'] > 0);
         $this->assertNotEmpty($json['access_token']);
         $this->assertSame($identity, $json['email']);
 
         Queue::assertPushed(\App\Jobs\User\CreateJob::class, 1);
 
         Queue::assertPushed(
             \App\Jobs\User\CreateJob::class,
             function ($job) use ($data) {
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 return $userEmail === \strtolower($data['login'] . '@' . $data['domain']);
             }
         );
 
         // Check if the code has been removed
         $this->assertNull(SignupCode::where('code', $result['code'])->first());
 
         // Check if the user has been created
         $user = User::where('email', $identity)->first();
 
         $this->assertNotEmpty($user);
         $this->assertSame($identity, $user->email);
 
         // Check user settings
         $this->assertSame($result['first_name'], $user->getSetting('first_name'));
         $this->assertSame($result['last_name'], $user->getSetting('last_name'));
         $this->assertSame($result['email'], $user->getSetting('external_email'));
 
         // Discount
         $discount = Discount::where('code', 'TEST')->first();
         $this->assertSame($discount->id, $user->wallets()->first()->discount_id);
 
         // TODO: Check SKUs/Plan
 
         // TODO: Check if the access token works
     }
 
     /**
      * Test signup for a group (custom domain) account
      */
     public function testSignupGroupAccount(): void
     {
         Queue::fake();
 
         // Initial signup request
         $user_data = $data = [
             'email' => 'testuser@external.com',
             'first_name' => 'Signup',
             'last_name' => 'User',
             'plan' => 'group',
         ];
 
         $response = $this->withoutMiddleware()->post('/api/auth/signup/init', $data);
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertCount(2, $json);
         $this->assertSame('success', $json['status']);
         $this->assertNotEmpty($json['code']);
 
         // Assert the email sending job was pushed once
         Queue::assertPushed(\App\Jobs\SignupVerificationEmail::class, 1);
 
         // Assert the job has proper data assigned
         Queue::assertPushed(\App\Jobs\SignupVerificationEmail::class, function ($job) use ($data, $json) {
             $code = TestCase::getObjectProperty($job, 'code');
 
             return $code->code === $json['code']
                 && $code->plan === $data['plan']
                 && $code->email === $data['email']
                 && $code->first_name === $data['first_name']
                 && $code->last_name === $data['last_name'];
         });
 
         // Verify the code
         $code = SignupCode::find($json['code']);
         $data = [
             'code' => $code->code,
             'short_code' => $code->short_code,
         ];
 
         $response = $this->post('/api/auth/signup/verify', $data);
         $result = $response->json();
 
         $response->assertStatus(200);
         $this->assertCount(7, $result);
         $this->assertSame('success', $result['status']);
         $this->assertSame($user_data['email'], $result['email']);
         $this->assertSame($user_data['first_name'], $result['first_name']);
         $this->assertSame($user_data['last_name'], $result['last_name']);
         $this->assertSame(null, $result['voucher']);
         $this->assertSame(true, $result['is_domain']);
         $this->assertSame([], $result['domains']);
 
         // Final signup request
         $login = 'admin';
         $domain = 'external.com';
         $data = [
             'login' => $login,
             'domain' => $domain,
-            'password' => 'test',
-            'password_confirmation' => 'test',
+            'password' => 'testtest',
+            'password_confirmation' => 'testtest',
             'code' => $code->code,
             'short_code' => $code->short_code,
         ];
 
         $response = $this->post('/api/auth/signup', $data);
         $result = $response->json();
 
         $response->assertStatus(200);
         $this->assertSame('success', $result['status']);
         $this->assertSame('bearer', $result['token_type']);
         $this->assertTrue(!empty($result['expires_in']) && is_int($result['expires_in']) && $result['expires_in'] > 0);
         $this->assertNotEmpty($result['access_token']);
         $this->assertSame("$login@$domain", $result['email']);
 
         Queue::assertPushed(\App\Jobs\Domain\CreateJob::class, 1);
 
         Queue::assertPushed(
             \App\Jobs\Domain\CreateJob::class,
             function ($job) use ($domain) {
                 $domainNamespace = TestCase::getObjectProperty($job, 'domainNamespace');
 
                 return $domainNamespace === $domain;
             }
         );
 
         Queue::assertPushed(\App\Jobs\User\CreateJob::class, 1);
 
         Queue::assertPushed(
             \App\Jobs\User\CreateJob::class,
             function ($job) use ($data) {
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
 
                 return $userEmail === $data['login'] . '@' . $data['domain'];
             }
         );
 
         // Check if the code has been removed
         $this->assertNull(SignupCode::find($code->id));
 
         // Check if the user has been created
         $user = User::where('email', $login . '@' . $domain)->first();
 
         $this->assertNotEmpty($user);
 
         // Check user settings
         $this->assertSame($user_data['email'], $user->getSetting('external_email'));
         $this->assertSame($user_data['first_name'], $user->getSetting('first_name'));
         $this->assertSame($user_data['last_name'], $user->getSetting('last_name'));
 
         // TODO: Check domain record
 
         // TODO: Check SKUs/Plan
 
         // TODO: Check if the access token works
     }
 
     /**
      * Test signup via invitation
      */
     public function testSignupViaInvitation(): void
     {
         Queue::fake();
 
         $invitation = SI::create(['email' => 'email1@ext.com']);
 
         $post = [
             'invitation' => 'abc',
             'first_name' => 'Signup',
             'last_name' => 'User',
             'login' => 'test-inv',
             'domain' => 'kolabnow.com',
-            'password' => 'test',
-            'password_confirmation' => 'test',
+            'password' => 'testtest',
+            'password_confirmation' => 'testtest',
         ];
 
         // Test invalid invitation identifier
         $response = $this->post('/api/auth/signup', $post);
         $response->assertStatus(404);
 
         // Test valid input
         $post['invitation'] = $invitation->id;
         $response = $this->post('/api/auth/signup', $post);
         $result = $response->json();
 
         $response->assertStatus(200);
         $this->assertSame('success', $result['status']);
         $this->assertSame('bearer', $result['token_type']);
         $this->assertTrue(!empty($result['expires_in']) && is_int($result['expires_in']) && $result['expires_in'] > 0);
         $this->assertNotEmpty($result['access_token']);
         $this->assertSame('test-inv@kolabnow.com', $result['email']);
 
         // Check if the user has been created
         $user = User::where('email', 'test-inv@kolabnow.com')->first();
 
         $this->assertNotEmpty($user);
 
         // Check user settings
         $this->assertSame($invitation->email, $user->getSetting('external_email'));
         $this->assertSame($post['first_name'], $user->getSetting('first_name'));
         $this->assertSame($post['last_name'], $user->getSetting('last_name'));
 
         $invitation->refresh();
 
         $this->assertSame($user->id, $invitation->user_id);
         $this->assertTrue($invitation->isCompleted());
 
         // TODO: Test POST params validation
     }
 
     /**
      * List of login/domain validation cases for testValidateLogin()
      *
      * @return array Arguments for testValidateLogin()
      */
     public function dataValidateLogin(): array
     {
         $domain = $this->getPublicDomain();
 
         return [
             // Individual account
             ['', $domain, false, ['login' => 'The login field is required.']],
             ['test123456', 'localhost', false, ['domain' => 'The specified domain is invalid.']],
             ['test123456', 'unknown-domain.org', false, ['domain' => 'The specified domain is invalid.']],
             ['test.test', $domain, false, null],
             ['test_test', $domain, false, null],
             ['test-test', $domain, false, null],
             ['admin', $domain, false, ['login' => 'The specified login is not available.']],
             ['administrator', $domain, false, ['login' => 'The specified login is not available.']],
             ['sales', $domain, false, ['login' => 'The specified login is not available.']],
             ['root', $domain, false, ['login' => 'The specified login is not available.']],
 
             // TODO existing (public domain) user
             // ['signuplogin', $domain, false, ['login' => 'The specified login is not available.']],
 
             // Domain account
             ['admin', 'kolabsys.com', true, null],
             ['testnonsystemdomain', 'invalid', true, ['domain' => 'The specified domain is invalid.']],
             ['testnonsystemdomain', '.com', true, ['domain' => 'The specified domain is invalid.']],
 
             // existing custom domain
             ['jack', 'kolab.org', true, ['domain' => 'The specified domain is not available.']],
         ];
     }
 
     /**
      * Signup login/domain validation.
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      *
      * @dataProvider dataValidateLogin
      */
     public function testValidateLogin($login, $domain, $external, $expected_result): void
     {
         $result = $this->invokeMethod(new SignupController(), 'validateLogin', [$login, $domain, $external]);
 
         $this->assertSame($expected_result, $result);
     }
 
     /**
      * Signup login/domain validation, more cases
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      */
     public function testValidateLoginMore(): void
     {
         $group = $this->getTestGroup('group-test@kolabnow.com');
         $login = 'group-test';
         $domain = 'kolabnow.com';
         $external = false;
 
         $result = $this->invokeMethod(new SignupController(), 'validateLogin', [$login, $domain, $external]);
 
         $this->assertSame(['login' => 'The specified login is not available.'], $result);
     }
 }
diff --git a/src/tests/Feature/Controller/UsersTest.php b/src/tests/Feature/Controller/UsersTest.php
index 8f38f6c5..4079e1de 100644
--- a/src/tests/Feature/Controller/UsersTest.php
+++ b/src/tests/Feature/Controller/UsersTest.php
@@ -1,1451 +1,1486 @@
 <?php
 
 namespace Tests\Feature\Controller;
 
 use App\Discount;
 use App\Domain;
 use App\Http\Controllers\API\V4\UsersController;
 use App\Package;
 use App\Sku;
 use App\User;
 use App\Wallet;
 use Carbon\Carbon;
 use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Str;
 use Tests\TestCase;
 
 class UsersTest extends TestCase
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('jane@kolabnow.com');
         $this->deleteTestUser('UsersControllerTest1@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest2@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest3@userscontroller.com');
         $this->deleteTestUser('UserEntitlement2A@UserEntitlement.com');
         $this->deleteTestUser('john2.doe2@kolab.org');
         $this->deleteTestUser('deleted@kolab.org');
         $this->deleteTestUser('deleted@kolabnow.com');
         $this->deleteTestDomain('userscontroller.com');
         $this->deleteTestGroup('group-test@kolabnow.com');
         $this->deleteTestGroup('group-test@kolab.org');
 
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
         $wallet->discount()->dissociate();
         $wallet->settings()->whereIn('key', ['mollie_id', 'stripe_id'])->delete();
         $wallet->save();
         $user->status |= User::STATUS_IMAP_READY;
         $user->save();
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser('jane@kolabnow.com');
         $this->deleteTestUser('UsersControllerTest1@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest2@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest3@userscontroller.com');
         $this->deleteTestUser('UserEntitlement2A@UserEntitlement.com');
         $this->deleteTestUser('john2.doe2@kolab.org');
         $this->deleteTestUser('deleted@kolab.org');
         $this->deleteTestUser('deleted@kolabnow.com');
         $this->deleteTestDomain('userscontroller.com');
         $this->deleteTestGroup('group-test@kolabnow.com');
         $this->deleteTestGroup('group-test@kolab.org');
 
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
         $wallet->discount()->dissociate();
         $wallet->settings()->whereIn('key', ['mollie_id', 'stripe_id'])->delete();
         $wallet->save();
         $user->settings()->whereIn('key', ['greylist_enabled'])->delete();
         $user->status |= User::STATUS_IMAP_READY;
         $user->save();
 
         parent::tearDown();
     }
 
     /**
      * Test user deleting (DELETE /api/v4/users/<id>)
      */
     public function testDestroy(): void
     {
         // First create some users/accounts to delete
         $package_kolab = \App\Package::where('title', 'kolab')->first();
         $package_domain = \App\Package::where('title', 'domain-hosting')->first();
 
         $john = $this->getTestUser('john@kolab.org');
         $user1 = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $user2 = $this->getTestUser('UsersControllerTest2@userscontroller.com');
         $user3 = $this->getTestUser('UsersControllerTest3@userscontroller.com');
         $domain = $this->getTestDomain('userscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
         $user1->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $user1);
         $user1->assignPackage($package_kolab, $user2);
         $user1->assignPackage($package_kolab, $user3);
 
         // Test unauth access
         $response = $this->delete("api/v4/users/{$user2->id}");
         $response->assertStatus(401);
 
         // Test access to other user/account
         $response = $this->actingAs($john)->delete("api/v4/users/{$user2->id}");
         $response->assertStatus(403);
         $response = $this->actingAs($john)->delete("api/v4/users/{$user1->id}");
         $response->assertStatus(403);
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Access denied", $json['message']);
         $this->assertCount(2, $json);
 
         // Test that non-controller cannot remove himself
         $response = $this->actingAs($user3)->delete("api/v4/users/{$user3->id}");
         $response->assertStatus(403);
 
         // Test removing a non-controller user
         $response = $this->actingAs($user1)->delete("api/v4/users/{$user3->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals('success', $json['status']);
         $this->assertEquals('User deleted successfully.', $json['message']);
 
         // Test removing self (an account with users)
         $response = $this->actingAs($user1)->delete("api/v4/users/{$user1->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals('success', $json['status']);
         $this->assertEquals('User deleted successfully.', $json['message']);
     }
 
     /**
      * Test user deleting (DELETE /api/v4/users/<id>)
      */
     public function testDestroyByController(): void
     {
         // Create an account with additional controller - $user2
         $package_kolab = \App\Package::where('title', 'kolab')->first();
         $package_domain = \App\Package::where('title', 'domain-hosting')->first();
         $user1 = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $user2 = $this->getTestUser('UsersControllerTest2@userscontroller.com');
         $user3 = $this->getTestUser('UsersControllerTest3@userscontroller.com');
         $domain = $this->getTestDomain('userscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
         $user1->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $user1);
         $user1->assignPackage($package_kolab, $user2);
         $user1->assignPackage($package_kolab, $user3);
         $user1->wallets()->first()->addController($user2);
 
         // TODO/FIXME:
         //   For now controller can delete himself, as well as
         //   the whole account he has control to, including the owner
         //   Probably he should not be able to do none of those
         //   However, this is not 0-regression scenario as we
         //   do not fully support additional controllers.
 
         //$response = $this->actingAs($user2)->delete("api/v4/users/{$user2->id}");
         //$response->assertStatus(403);
 
         $response = $this->actingAs($user2)->delete("api/v4/users/{$user3->id}");
         $response->assertStatus(200);
 
         $response = $this->actingAs($user2)->delete("api/v4/users/{$user1->id}");
         $response->assertStatus(200);
 
         // Note: More detailed assertions in testDestroy() above
 
         $this->assertTrue($user1->fresh()->trashed());
         $this->assertTrue($user2->fresh()->trashed());
         $this->assertTrue($user3->fresh()->trashed());
     }
 
     /**
      * Test user listing (GET /api/v4/users)
      */
     public function testIndex(): void
     {
         // Test unauth access
         $response = $this->get("api/v4/users");
         $response->assertStatus(401);
 
         $jack = $this->getTestUser('jack@kolab.org');
         $joe = $this->getTestUser('joe@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         $response = $this->actingAs($jack)->get("/api/v4/users");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(0, $json['count']);
         $this->assertCount(0, $json['list']);
 
         $response = $this->actingAs($john)->get("/api/v4/users");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(4, $json['count']);
         $this->assertCount(4, $json['list']);
         $this->assertSame($jack->email, $json['list'][0]['email']);
         $this->assertSame($joe->email, $json['list'][1]['email']);
         $this->assertSame($john->email, $json['list'][2]['email']);
         $this->assertSame($ned->email, $json['list'][3]['email']);
         // Values below are tested by Unit tests
         $this->assertArrayHasKey('isDeleted', $json['list'][0]);
         $this->assertArrayHasKey('isDegraded', $json['list'][0]);
         $this->assertArrayHasKey('isAccountDegraded', $json['list'][0]);
         $this->assertArrayHasKey('isSuspended', $json['list'][0]);
         $this->assertArrayHasKey('isActive', $json['list'][0]);
         $this->assertArrayHasKey('isLdapReady', $json['list'][0]);
         $this->assertArrayHasKey('isImapReady', $json['list'][0]);
 
         $response = $this->actingAs($ned)->get("/api/v4/users");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(4, $json['count']);
         $this->assertCount(4, $json['list']);
         $this->assertSame($jack->email, $json['list'][0]['email']);
         $this->assertSame($joe->email, $json['list'][1]['email']);
         $this->assertSame($john->email, $json['list'][2]['email']);
         $this->assertSame($ned->email, $json['list'][3]['email']);
 
         // Search by user email
         $response = $this->actingAs($john)->get("/api/v4/users?search=jack@k");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(1, $json['count']);
         $this->assertCount(1, $json['list']);
         $this->assertSame($jack->email, $json['list'][0]['email']);
 
         // Search by alias
         $response = $this->actingAs($john)->get("/api/v4/users?search=monster");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(1, $json['count']);
         $this->assertCount(1, $json['list']);
         $this->assertSame($joe->email, $json['list'][0]['email']);
 
         // Search by name
         $response = $this->actingAs($john)->get("/api/v4/users?search=land");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(1, $json['count']);
         $this->assertCount(1, $json['list']);
         $this->assertSame($ned->email, $json['list'][0]['email']);
 
         // TODO: Test paging
     }
 
     /**
      * Test fetching user data/profile (GET /api/v4/users/<user-id>)
      */
     public function testShow(): void
     {
         $userA = $this->getTestUser('UserEntitlement2A@UserEntitlement.com');
 
         // Test getting profile of self
         $response = $this->actingAs($userA)->get("/api/v4/users/{$userA->id}");
 
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertEquals($userA->id, $json['id']);
         $this->assertEquals($userA->email, $json['email']);
         $this->assertTrue(is_array($json['statusInfo']));
         $this->assertTrue(is_array($json['settings']));
         $this->assertTrue(is_array($json['aliases']));
         $this->assertTrue($json['config']['greylist_enabled']);
         $this->assertSame([], $json['skus']);
         // Values below are tested by Unit tests
         $this->assertArrayHasKey('isDeleted', $json);
         $this->assertArrayHasKey('isDegraded', $json);
         $this->assertArrayHasKey('isAccountDegraded', $json);
         $this->assertArrayHasKey('isSuspended', $json);
         $this->assertArrayHasKey('isActive', $json);
         $this->assertArrayHasKey('isLdapReady', $json);
         $this->assertArrayHasKey('isImapReady', $json);
 
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         // Test unauthorized access to a profile of other user
         $response = $this->actingAs($jack)->get("/api/v4/users/{$userA->id}");
         $response->assertStatus(403);
 
         // Test authorized access to a profile of other user
         // Ned: Additional account controller
         $response = $this->actingAs($ned)->get("/api/v4/users/{$john->id}");
         $response->assertStatus(200);
         $response = $this->actingAs($ned)->get("/api/v4/users/{$jack->id}");
         $response->assertStatus(200);
 
         // John: Account owner
         $response = $this->actingAs($john)->get("/api/v4/users/{$jack->id}");
         $response->assertStatus(200);
         $response = $this->actingAs($john)->get("/api/v4/users/{$ned->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $storage_sku = Sku::withEnvTenantContext()->where('title', 'storage')->first();
         $groupware_sku = Sku::withEnvTenantContext()->where('title', 'groupware')->first();
         $mailbox_sku = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();
         $secondfactor_sku = Sku::withEnvTenantContext()->where('title', '2fa')->first();
 
         $this->assertCount(5, $json['skus']);
 
         $this->assertSame(5, $json['skus'][$storage_sku->id]['count']);
         $this->assertSame([0,0,0,0,0], $json['skus'][$storage_sku->id]['costs']);
         $this->assertSame(1, $json['skus'][$groupware_sku->id]['count']);
         $this->assertSame([490], $json['skus'][$groupware_sku->id]['costs']);
         $this->assertSame(1, $json['skus'][$mailbox_sku->id]['count']);
         $this->assertSame([500], $json['skus'][$mailbox_sku->id]['costs']);
         $this->assertSame(1, $json['skus'][$secondfactor_sku->id]['count']);
         $this->assertSame([0], $json['skus'][$secondfactor_sku->id]['costs']);
     }
 
     /**
      * Test fetching user status (GET /api/v4/users/<user-id>/status)
      * and forcing setup process update (?refresh=1)
      *
      * @group imap
      * @group dns
      */
     public function testStatus(): void
     {
         Queue::fake();
 
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
 
         // Test unauthorized access
         $response = $this->actingAs($jack)->get("/api/v4/users/{$john->id}/status");
         $response->assertStatus(403);
 
         if ($john->isImapReady()) {
             $john->status ^= User::STATUS_IMAP_READY;
             $john->save();
         }
 
         // Get user status
         $response = $this->actingAs($john)->get("/api/v4/users/{$john->id}/status");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertFalse($json['isImapReady']);
         $this->assertFalse($json['isReady']);
         $this->assertCount(7, $json['process']);
         $this->assertSame('user-imap-ready', $json['process'][2]['label']);
         $this->assertSame(false, $json['process'][2]['state']);
         $this->assertTrue(empty($json['status']));
         $this->assertTrue(empty($json['message']));
 
         // Make sure the domain is confirmed (other test might unset that status)
         $domain = $this->getTestDomain('kolab.org');
         $domain->status |= Domain::STATUS_CONFIRMED;
         $domain->save();
 
         // Now "reboot" the process and verify the user in imap synchronously
         $response = $this->actingAs($john)->get("/api/v4/users/{$john->id}/status?refresh=1");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertTrue($json['isImapReady']);
         $this->assertTrue($json['isReady']);
         $this->assertCount(7, $json['process']);
         $this->assertSame('user-imap-ready', $json['process'][2]['label']);
         $this->assertSame(true, $json['process'][2]['state']);
         $this->assertSame('success', $json['status']);
         $this->assertSame('Setup process finished successfully.', $json['message']);
 
         Queue::size(1);
 
         // Test case for when the verify job is dispatched to the worker
         $john->refresh();
         $john->status ^= User::STATUS_IMAP_READY;
         $john->save();
 
         \config(['imap.admin_password' => null]);
 
         $response = $this->actingAs($john)->get("/api/v4/users/{$john->id}/status?refresh=1");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertFalse($json['isImapReady']);
         $this->assertFalse($json['isReady']);
         $this->assertSame('success', $json['status']);
         $this->assertSame('waiting', $json['processState']);
         $this->assertSame('Setup process has been pushed. Please wait.', $json['message']);
 
         Queue::assertPushed(\App\Jobs\User\VerifyJob::class, 1);
     }
 
     /**
      * Test UsersController::statusInfo()
      */
     public function testStatusInfo(): void
     {
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $domain = $this->getTestDomain('userscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
 
         $user->created_at = Carbon::now();
         $user->status = User::STATUS_NEW;
         $user->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertFalse($result['isReady']);
         $this->assertSame([], $result['skus']);
         $this->assertCount(3, $result['process']);
         $this->assertSame('user-new', $result['process'][0]['label']);
         $this->assertSame(true, $result['process'][0]['state']);
         $this->assertSame('user-ldap-ready', $result['process'][1]['label']);
         $this->assertSame(false, $result['process'][1]['state']);
         $this->assertSame('user-imap-ready', $result['process'][2]['label']);
         $this->assertSame(false, $result['process'][2]['state']);
         $this->assertSame('running', $result['processState']);
 
         $user->created_at = Carbon::now()->subSeconds(181);
         $user->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertSame('failed', $result['processState']);
 
         $user->status |= User::STATUS_LDAP_READY | User::STATUS_IMAP_READY;
         $user->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertTrue($result['isReady']);
         $this->assertCount(3, $result['process']);
         $this->assertSame('user-new', $result['process'][0]['label']);
         $this->assertSame(true, $result['process'][0]['state']);
         $this->assertSame('user-ldap-ready', $result['process'][1]['label']);
         $this->assertSame(true, $result['process'][1]['state']);
         $this->assertSame('user-imap-ready', $result['process'][2]['label']);
         $this->assertSame(true, $result['process'][2]['state']);
         $this->assertSame('done', $result['processState']);
 
         $domain->status |= Domain::STATUS_VERIFIED;
         $domain->type = Domain::TYPE_EXTERNAL;
         $domain->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertFalse($result['isReady']);
         $this->assertSame([], $result['skus']);
         $this->assertCount(7, $result['process']);
         $this->assertSame('user-new', $result['process'][0]['label']);
         $this->assertSame(true, $result['process'][0]['state']);
         $this->assertSame('user-ldap-ready', $result['process'][1]['label']);
         $this->assertSame(true, $result['process'][1]['state']);
         $this->assertSame('user-imap-ready', $result['process'][2]['label']);
         $this->assertSame(true, $result['process'][2]['state']);
         $this->assertSame('domain-new', $result['process'][3]['label']);
         $this->assertSame(true, $result['process'][3]['state']);
         $this->assertSame('domain-ldap-ready', $result['process'][4]['label']);
         $this->assertSame(false, $result['process'][4]['state']);
         $this->assertSame('domain-verified', $result['process'][5]['label']);
         $this->assertSame(true, $result['process'][5]['state']);
         $this->assertSame('domain-confirmed', $result['process'][6]['label']);
         $this->assertSame(false, $result['process'][6]['state']);
 
         // Test 'skus' property
         $user->assignSku(Sku::withEnvTenantContext()->where('title', 'beta')->first());
 
         $result = UsersController::statusInfo($user);
 
         $this->assertSame(['beta'], $result['skus']);
 
         $user->assignSku(Sku::withEnvTenantContext()->where('title', 'meet')->first());
 
         $result = UsersController::statusInfo($user);
 
         $this->assertSame(['beta', 'meet'], $result['skus']);
 
         $user->assignSku(Sku::withEnvTenantContext()->where('title', 'meet')->first());
 
         $result = UsersController::statusInfo($user);
 
         $this->assertSame(['beta', 'meet'], $result['skus']);
     }
 
     /**
      * Test user config update (POST /api/v4/users/<user>/config)
      */
     public function testSetConfig(): void
     {
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
 
         $john->setSetting('greylist_enabled', null);
+        $john->setSetting('password_policy', null);
 
         // Test unknown user id
         $post = ['greylist_enabled' => 1];
         $response = $this->actingAs($john)->post("/api/v4/users/123/config", $post);
         $json = $response->json();
 
         $response->assertStatus(404);
 
         // Test access by user not being a wallet controller
         $post = ['greylist_enabled' => 1];
         $response = $this->actingAs($jack)->post("/api/v4/users/{$john->id}/config", $post);
         $json = $response->json();
 
         $response->assertStatus(403);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Access denied", $json['message']);
         $this->assertCount(2, $json);
 
         // Test some invalid data
         $post = ['grey' => 1];
         $response = $this->actingAs($john)->post("/api/v4/users/{$john->id}/config", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertCount(1, $json['errors']);
         $this->assertSame('The requested configuration parameter is not supported.', $json['errors']['grey']);
 
         $this->assertNull($john->fresh()->getSetting('greylist_enabled'));
 
         // Test some valid data
-        $post = ['greylist_enabled' => 1];
+        $post = ['greylist_enabled' => 1, 'password_policy' => 'min:10,max:255,upper,lower,digit,special'];
         $response = $this->actingAs($john)->post("/api/v4/users/{$john->id}/config", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(2, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame('User settings updated successfully.', $json['message']);
 
         $this->assertSame('true', $john->fresh()->getSetting('greylist_enabled'));
+        $this->assertSame('min:10,max:255,upper,lower,digit,special', $john->fresh()->getSetting('password_policy'));
 
-        // Test some valid data
-        $post = ['greylist_enabled' => 0];
-        $response = $this->actingAs($john)->post("/api/v4/users/{$john->id}/config", $post);
+        // Test some valid data, acting as another account controller
+        $ned = $this->getTestUser('ned@kolab.org');
+        $post = ['greylist_enabled' => 0, 'password_policy' => 'min:10,max:255,upper'];
+        $response = $this->actingAs($ned)->post("/api/v4/users/{$john->id}/config", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(2, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame('User settings updated successfully.', $json['message']);
 
         $this->assertSame('false', $john->fresh()->getSetting('greylist_enabled'));
+        $this->assertSame('min:10,max:255,upper', $john->fresh()->getSetting('password_policy'));
     }
 
     /**
      * Test user creation (POST /api/v4/users)
      */
     public function testStore(): void
     {
         Queue::fake();
 
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
+        $john->setSetting('password_policy', 'min:8,max:100,digit');
         $deleted_priv = $this->getTestUser('deleted@kolab.org');
         $deleted_priv->delete();
 
         // Test empty request
         $response = $this->actingAs($john)->post("/api/v4/users", []);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("The email field is required.", $json['errors']['email']);
         $this->assertSame("The password field is required.", $json['errors']['password'][0]);
         $this->assertCount(2, $json);
 
         // Test access by user not being a wallet controller
         $post = ['first_name' => 'Test'];
         $response = $this->actingAs($jack)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(403);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Access denied", $json['message']);
         $this->assertCount(2, $json);
 
         // Test some invalid data
         $post = ['password' => '12345678', 'email' => 'invalid'];
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertSame('The password confirmation does not match.', $json['errors']['password'][0]);
         $this->assertSame('The specified email is invalid.', $json['errors']['email']);
 
         // Test existing user email
         $post = [
-            'password' => 'simple',
-            'password_confirmation' => 'simple',
+            'password' => 'simple123',
+            'password_confirmation' => 'simple123',
             'first_name' => 'John2',
             'last_name' => 'Doe2',
             'email' => 'jack.daniels@kolab.org',
         ];
 
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertSame('The specified email is not available.', $json['errors']['email']);
 
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
 
         $post = [
-            'password' => 'simple',
-            'password_confirmation' => 'simple',
+            'password' => 'simple123',
+            'password_confirmation' => 'simple123',
             'first_name' => 'John2',
             'last_name' => 'Doe2',
             'email' => 'john2.doe2@kolab.org',
             'organization' => 'TestOrg',
             'aliases' => ['useralias1@kolab.org', 'deleted@kolab.org'],
         ];
 
         // Missing package
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Package is required.", $json['errors']['package']);
         $this->assertCount(2, $json);
 
         // Invalid package
         $post['package'] = $package_domain->id;
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Invalid package selected.", $json['errors']['package']);
         $this->assertCount(2, $json);
 
-        // Test full and valid data
+        // Test password policy checking
         $post['package'] = $package_kolab->id;
+        $post['password'] = 'password';
+        $response = $this->actingAs($john)->post("/api/v4/users", $post);
+        $json = $response->json();
+
+        $response->assertStatus(422);
+
+        $this->assertSame('error', $json['status']);
+        $this->assertSame("The password confirmation does not match.", $json['errors']['password'][0]);
+        $this->assertSame("Specified password does not comply with the policy.", $json['errors']['password'][1]);
+        $this->assertCount(2, $json);
+
+        // Test password confirmation
+        $post['password_confirmation'] = 'password';
+        $response = $this->actingAs($john)->post("/api/v4/users", $post);
+        $json = $response->json();
+
+        $response->assertStatus(422);
+
+        $this->assertSame('error', $json['status']);
+        $this->assertSame("Specified password does not comply with the policy.", $json['errors']['password'][0]);
+        $this->assertCount(2, $json);
+
+        // Test full and valid data
+        $post['password'] = 'password123';
+        $post['password_confirmation'] = 'password123';
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User created successfully.", $json['message']);
         $this->assertCount(2, $json);
 
         $user = User::where('email', 'john2.doe2@kolab.org')->first();
         $this->assertInstanceOf(User::class, $user);
         $this->assertSame('John2', $user->getSetting('first_name'));
         $this->assertSame('Doe2', $user->getSetting('last_name'));
         $this->assertSame('TestOrg', $user->getSetting('organization'));
         $aliases = $user->aliases()->orderBy('alias')->get();
         $this->assertCount(2, $aliases);
         $this->assertSame('deleted@kolab.org', $aliases[0]->alias);
         $this->assertSame('useralias1@kolab.org', $aliases[1]->alias);
         // Assert the new user entitlements
         $this->assertEntitlements($user, ['groupware', 'mailbox',
             'storage', 'storage', 'storage', 'storage', 'storage']);
         // Assert the wallet to which the new user should be assigned to
         $wallet = $user->wallet();
         $this->assertSame($john->wallets->first()->id, $wallet->id);
 
         // Attempt to create a user previously deleted
         $user->delete();
 
         $post['package'] = $package_kolab->id;
         $post['aliases'] = [];
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User created successfully.", $json['message']);
         $this->assertCount(2, $json);
 
         $user = User::where('email', 'john2.doe2@kolab.org')->first();
         $this->assertInstanceOf(User::class, $user);
         $this->assertSame('John2', $user->getSetting('first_name'));
         $this->assertSame('Doe2', $user->getSetting('last_name'));
         $this->assertSame('TestOrg', $user->getSetting('organization'));
         $this->assertCount(0, $user->aliases()->get());
         $this->assertEntitlements($user, ['groupware', 'mailbox',
             'storage', 'storage', 'storage', 'storage', 'storage']);
 
         // Test password reset link "mode"
         $code = new \App\VerificationCode(['mode' => 'password-reset', 'active' => false]);
         $john->verificationcodes()->save($code);
 
         $post = [
             'first_name' => 'John2',
             'last_name' => 'Doe2',
             'email' => 'deleted@kolab.org',
             'organization' => '',
             'aliases' => [],
             'passwordLinkCode' => $code->short_code . '-' . $code->code,
             'package' => $package_kolab->id,
         ];
 
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User created successfully.", $json['message']);
         $this->assertCount(2, $json);
 
         $user = $this->getTestUser('deleted@kolab.org');
         $code->refresh();
 
         $this->assertSame($user->id, $code->user_id);
         $this->assertTrue($code->active);
         $this->assertTrue(is_string($user->password) && strlen($user->password) >= 60);
 
         // Test acting as account controller not owner, which is not yet supported
         $john->wallets->first()->addController($user);
 
         $response = $this->actingAs($user)->post("/api/v4/users", []);
         $response->assertStatus(403);
     }
 
     /**
      * Test user update (PUT /api/v4/users/<user-id>)
      */
     public function testUpdate(): void
     {
         $userA = $this->getTestUser('UsersControllerTest1@userscontroller.com');
+        $userA->setSetting('password_policy', 'min:8,digit');
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $domain = $this->getTestDomain(
             'userscontroller.com',
             ['status' => Domain::STATUS_NEW, 'type' => Domain::TYPE_EXTERNAL]
         );
 
         // Test unauthorized update of other user profile
         $response = $this->actingAs($jack)->get("/api/v4/users/{$userA->id}", []);
         $response->assertStatus(403);
 
         // Test authorized update of account owner by account controller
         $response = $this->actingAs($ned)->get("/api/v4/users/{$john->id}", []);
         $response->assertStatus(200);
 
         // Test updating of self (empty request)
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", []);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User data updated successfully.", $json['message']);
         $this->assertTrue(!empty($json['statusInfo']));
         $this->assertCount(3, $json);
 
         // Test some invalid data
-        $post = ['password' => '12345678', 'currency' => 'invalid'];
+        $post = ['password' => '1234567', 'currency' => 'invalid'];
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
-        $this->assertSame('The password confirmation does not match.', $json['errors']['password'][0]);
-        $this->assertSame('The currency must be 3 characters.', $json['errors']['currency'][0]);
+        $this->assertSame("The password confirmation does not match.", $json['errors']['password'][0]);
+        $this->assertSame("Specified password does not comply with the policy.", $json['errors']['password'][1]);
+        $this->assertSame("The currency must be 3 characters.", $json['errors']['currency'][0]);
 
         // Test full profile update including password
         $post = [
-            'password' => 'simple',
-            'password_confirmation' => 'simple',
+            'password' => 'simple123',
+            'password_confirmation' => 'simple123',
             'first_name' => 'John2',
             'last_name' => 'Doe2',
             'organization' => 'TestOrg',
             'phone' => '+123 123 123',
             'external_email' => 'external@gmail.com',
             'billing_address' => 'billing',
             'country' => 'CH',
             'currency' => 'CHF',
             'aliases' => ['useralias1@' . \config('app.domain'), 'useralias2@' . \config('app.domain')]
         ];
 
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User data updated successfully.", $json['message']);
         $this->assertTrue(!empty($json['statusInfo']));
         $this->assertCount(3, $json);
         $this->assertTrue($userA->password != $userA->fresh()->password);
         unset($post['password'], $post['password_confirmation'], $post['aliases']);
         foreach ($post as $key => $value) {
             $this->assertSame($value, $userA->getSetting($key));
         }
         $aliases = $userA->aliases()->orderBy('alias')->get();
         $this->assertCount(2, $aliases);
         $this->assertSame('useralias1@' . \config('app.domain'), $aliases[0]->alias);
         $this->assertSame('useralias2@' . \config('app.domain'), $aliases[1]->alias);
 
         // Test unsetting values
         $post = [
             'first_name' => '',
             'last_name' => '',
             'organization' => '',
             'phone' => '',
             'external_email' => '',
             'billing_address' => '',
             'country' => '',
             'currency' => '',
             'aliases' => ['useralias2@' . \config('app.domain')]
         ];
 
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User data updated successfully.", $json['message']);
         $this->assertTrue(!empty($json['statusInfo']));
         $this->assertCount(3, $json);
         unset($post['aliases']);
         foreach ($post as $key => $value) {
             $this->assertNull($userA->getSetting($key));
         }
         $aliases = $userA->aliases()->get();
         $this->assertCount(1, $aliases);
         $this->assertSame('useralias2@' . \config('app.domain'), $aliases[0]->alias);
 
         // Test error on some invalid aliases missing password confirmation
         $post = [
             'password' => 'simple123',
             'aliases' => [
                 'useralias2@' . \config('app.domain'),
                 'useralias1@kolab.org',
                 '@kolab.org',
             ]
         ];
 
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertCount(2, $json['errors']['aliases']);
         $this->assertSame("The specified domain is not available.", $json['errors']['aliases'][1]);
         $this->assertSame("The specified alias is invalid.", $json['errors']['aliases'][2]);
         $this->assertSame("The password confirmation does not match.", $json['errors']['password'][0]);
 
         // Test authorized update of other user
         $response = $this->actingAs($ned)->put("/api/v4/users/{$jack->id}", []);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertTrue(empty($json['statusInfo']));
 
         // TODO: Test error on aliases with invalid/non-existing/other-user's domain
 
         // Create entitlements and additional user for following tests
         $owner = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $user = $this->getTestUser('UsersControllerTest2@userscontroller.com');
         $package_domain = Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $package_kolab = Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_lite = Package::withEnvTenantContext()->where('title', 'lite')->first();
         $sku_mailbox = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();
         $sku_storage = Sku::withEnvTenantContext()->where('title', 'storage')->first();
         $sku_groupware = Sku::withEnvTenantContext()->where('title', 'groupware')->first();
 
         $domain = $this->getTestDomain(
             'userscontroller.com',
             [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_EXTERNAL,
             ]
         );
 
         $domain->assignPackage($package_domain, $owner);
         $owner->assignPackage($package_kolab);
         $owner->assignPackage($package_lite, $user);
 
         // Non-controller cannot update his own entitlements
         $post = ['skus' => []];
         $response = $this->actingAs($user)->put("/api/v4/users/{$user->id}", $post);
         $response->assertStatus(422);
 
         // Test updating entitlements
         $post = [
             'skus' => [
                 $sku_mailbox->id => 1,
                 $sku_storage->id => 6,
                 $sku_groupware->id => 1,
             ],
         ];
 
         $response = $this->actingAs($owner)->put("/api/v4/users/{$user->id}", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $storage_cost = $user->entitlements()
             ->where('sku_id', $sku_storage->id)
             ->orderBy('cost')
             ->pluck('cost')->all();
 
         $this->assertEntitlements(
             $user,
             ['groupware', 'mailbox', 'storage', 'storage', 'storage', 'storage', 'storage', 'storage']
         );
 
         $this->assertSame([0, 0, 0, 0, 0, 25], $storage_cost);
         $this->assertTrue(empty($json['statusInfo']));
 
         // Test password reset link "mode"
         $code = new \App\VerificationCode(['mode' => 'password-reset', 'active' => false]);
         $owner->verificationcodes()->save($code);
 
         $post = ['passwordLinkCode' => $code->short_code . '-' . $code->code];
 
         $response = $this->actingAs($owner)->put("/api/v4/users/{$user->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $code->refresh();
 
         $this->assertSame($user->id, $code->user_id);
         $this->assertTrue($code->active);
         $this->assertSame($user->password, $user->fresh()->password);
     }
 
     /**
      * Test UsersController::updateEntitlements()
      */
     public function testUpdateEntitlements(): void
     {
         $jane = $this->getTestUser('jane@kolabnow.com');
 
         $kolab = Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $storage = Sku::withEnvTenantContext()->where('title', 'storage')->first();
         $activesync = Sku::withEnvTenantContext()->where('title', 'activesync')->first();
         $groupware = Sku::withEnvTenantContext()->where('title', 'groupware')->first();
         $mailbox = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();
 
         // standard package, 1 mailbox, 1 groupware, 2 storage
         $jane->assignPackage($kolab);
 
         // add 2 storage, 1 activesync
         $post = [
             'skus' => [
                 $mailbox->id => 1,
                 $groupware->id => 1,
                 $storage->id => 7,
                 $activesync->id => 1
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(200);
 
         $this->assertEntitlements(
             $jane,
             [
                 'activesync',
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
 
         // add 2 storage, remove 1 activesync
         $post = [
             'skus' => [
                 $mailbox->id => 1,
                 $groupware->id => 1,
                 $storage->id => 9,
                 $activesync->id => 0
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(200);
 
         $this->assertEntitlements(
             $jane,
             [
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
 
         // add mailbox
         $post = [
             'skus' => [
                 $mailbox->id => 2,
                 $groupware->id => 1,
                 $storage->id => 9,
                 $activesync->id => 0
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(500);
 
         $this->assertEntitlements(
             $jane,
             [
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
 
         // remove mailbox
         $post = [
             'skus' => [
                 $mailbox->id => 0,
                 $groupware->id => 1,
                 $storage->id => 9,
                 $activesync->id => 0
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(500);
 
         $this->assertEntitlements(
             $jane,
             [
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
 
         // less than free storage
         $post = [
             'skus' => [
                 $mailbox->id => 1,
                 $groupware->id => 1,
                 $storage->id => 1,
                 $activesync->id => 0
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(200);
 
         $this->assertEntitlements(
             $jane,
             [
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
     }
 
     /**
      * Test user data response used in show and info actions
      */
     public function testUserResponse(): void
     {
         $provider = \config('services.payment_provider') ?: 'mollie';
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
         $wallet->setSettings(['mollie_id' => null, 'stripe_id' => null]);
         $result = $this->invokeMethod(new UsersController(), 'userResponse', [$user]);
 
         $this->assertEquals($user->id, $result['id']);
         $this->assertEquals($user->email, $result['email']);
         $this->assertEquals($user->status, $result['status']);
         $this->assertTrue(is_array($result['statusInfo']));
 
         $this->assertTrue(is_array($result['aliases']));
         $this->assertCount(1, $result['aliases']);
         $this->assertSame('john.doe@kolab.org', $result['aliases'][0]);
 
         $this->assertTrue(is_array($result['settings']));
         $this->assertSame('US', $result['settings']['country']);
         $this->assertSame('USD', $result['settings']['currency']);
 
         $this->assertTrue(is_array($result['accounts']));
         $this->assertTrue(is_array($result['wallets']));
         $this->assertCount(0, $result['accounts']);
         $this->assertCount(1, $result['wallets']);
         $this->assertSame($wallet->id, $result['wallet']['id']);
         $this->assertArrayNotHasKey('discount', $result['wallet']);
 
         $this->assertTrue($result['statusInfo']['enableDomains']);
         $this->assertTrue($result['statusInfo']['enableWallets']);
         $this->assertTrue($result['statusInfo']['enableUsers']);
+        $this->assertTrue($result['statusInfo']['enableSettings']);
 
         // Ned is John's wallet controller
         $ned = $this->getTestUser('ned@kolab.org');
         $ned_wallet = $ned->wallets()->first();
         $result = $this->invokeMethod(new UsersController(), 'userResponse', [$ned]);
 
         $this->assertEquals($ned->id, $result['id']);
         $this->assertEquals($ned->email, $result['email']);
         $this->assertTrue(is_array($result['accounts']));
         $this->assertTrue(is_array($result['wallets']));
         $this->assertCount(1, $result['accounts']);
         $this->assertCount(1, $result['wallets']);
         $this->assertSame($wallet->id, $result['wallet']['id']);
         $this->assertSame($wallet->id, $result['accounts'][0]['id']);
         $this->assertSame($ned_wallet->id, $result['wallets'][0]['id']);
         $this->assertSame($provider, $result['wallet']['provider']);
         $this->assertSame($provider, $result['wallets'][0]['provider']);
 
         $this->assertTrue($result['statusInfo']['enableDomains']);
         $this->assertTrue($result['statusInfo']['enableWallets']);
         $this->assertTrue($result['statusInfo']['enableUsers']);
+        $this->assertTrue($result['statusInfo']['enableSettings']);
 
         // Test discount in a response
         $discount = Discount::where('code', 'TEST')->first();
         $wallet->discount()->associate($discount);
         $wallet->save();
         $mod_provider = $provider == 'mollie' ? 'stripe' : 'mollie';
         $wallet->setSetting($mod_provider . '_id', 123);
         $user->refresh();
 
         $result = $this->invokeMethod(new UsersController(), 'userResponse', [$user]);
 
         $this->assertEquals($user->id, $result['id']);
         $this->assertSame($discount->id, $result['wallet']['discount_id']);
         $this->assertSame($discount->discount, $result['wallet']['discount']);
         $this->assertSame($discount->description, $result['wallet']['discount_description']);
         $this->assertSame($mod_provider, $result['wallet']['provider']);
         $this->assertSame($discount->id, $result['wallets'][0]['discount_id']);
         $this->assertSame($discount->discount, $result['wallets'][0]['discount']);
         $this->assertSame($discount->description, $result['wallets'][0]['discount_description']);
         $this->assertSame($mod_provider, $result['wallets'][0]['provider']);
 
         // Jack is not a John's wallet controller
         $jack = $this->getTestUser('jack@kolab.org');
         $result = $this->invokeMethod(new UsersController(), 'userResponse', [$jack]);
 
         $this->assertFalse($result['statusInfo']['enableDomains']);
         $this->assertFalse($result['statusInfo']['enableWallets']);
         $this->assertFalse($result['statusInfo']['enableUsers']);
+        $this->assertFalse($result['statusInfo']['enableSettings']);
     }
 
     /**
      * List of email address validation cases for testValidateEmail()
      *
      * @return array Arguments for testValidateEmail()
      */
     public function dataValidateEmail(): array
     {
         $this->refreshApplication();
         $public_domains = Domain::getPublicDomains();
         $domain = reset($public_domains);
 
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
 
         return [
             // Invalid format
             ["$domain", $john, 'The specified email is invalid.'],
             [".@$domain", $john, 'The specified email is invalid.'],
             ["test123456@localhost", $john, 'The specified domain is invalid.'],
             ["test123456@unknown-domain.org", $john, 'The specified domain is invalid.'],
 
             ["$domain", $john, 'The specified email is invalid.'],
             [".@$domain", $john, 'The specified email is invalid.'],
 
             // forbidden local part on public domains
             ["admin@$domain", $john, 'The specified email is not available.'],
             ["administrator@$domain", $john, 'The specified email is not available.'],
 
             // forbidden (other user's domain)
             ["testtest@kolab.org", $user, 'The specified domain is not available.'],
 
             // existing alias of other user, to be a user email
             ["jack.daniels@kolab.org", $john, 'The specified email is not available.'],
 
             // valid (user domain)
             ["admin@kolab.org", $john, null],
 
             // valid (public domain)
             ["test.test@$domain", $john, null],
         ];
     }
 
     /**
      * User email address validation.
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      *
      * @dataProvider dataValidateEmail
      */
     public function testValidateEmail($email, $user, $expected_result): void
     {
         $result = UsersController::validateEmail($email, $user);
         $this->assertSame($expected_result, $result);
     }
 
     /**
      * User email validation - tests for $deleted argument
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      */
     public function testValidateEmailDeleted(): void
     {
         Queue::fake();
 
         $john = $this->getTestUser('john@kolab.org');
         $deleted_priv = $this->getTestUser('deleted@kolab.org');
         $deleted_priv->delete();
         $deleted_pub = $this->getTestUser('deleted@kolabnow.com');
         $deleted_pub->delete();
 
         $result = UsersController::validateEmail('deleted@kolab.org', $john, $deleted);
         $this->assertSame(null, $result);
         $this->assertSame($deleted_priv->id, $deleted->id);
 
         $result = UsersController::validateEmail('deleted@kolabnow.com', $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertSame(null, $deleted);
 
         $result = UsersController::validateEmail('jack@kolab.org', $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertSame(null, $deleted);
     }
 
     /**
      * User email validation - tests for an address being a group email address
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      */
     public function testValidateEmailGroup(): void
     {
         Queue::fake();
 
         $john = $this->getTestUser('john@kolab.org');
         $pub_group = $this->getTestGroup('group-test@kolabnow.com');
         $priv_group = $this->getTestGroup('group-test@kolab.org');
 
         // A group in a public domain, existing
         $result = UsersController::validateEmail($pub_group->email, $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertNull($deleted);
 
         $pub_group->delete();
 
         // A group in a public domain, deleted
         $result = UsersController::validateEmail($pub_group->email, $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertNull($deleted);
 
         // A group in a private domain, existing
         $result = UsersController::validateEmail($priv_group->email, $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertNull($deleted);
 
         $priv_group->delete();
 
         // A group in a private domain, deleted
         $result = UsersController::validateEmail($priv_group->email, $john, $deleted);
         $this->assertSame(null, $result);
         $this->assertSame($priv_group->id, $deleted->id);
     }
 
     /**
      * List of alias validation cases for testValidateAlias()
      *
      * @return array Arguments for testValidateAlias()
      */
     public function dataValidateAlias(): array
     {
         $this->refreshApplication();
         $public_domains = Domain::getPublicDomains();
         $domain = reset($public_domains);
 
         $john = $this->getTestUser('john@kolab.org');
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
 
         return [
             // Invalid format
             ["$domain", $john, 'The specified alias is invalid.'],
             [".@$domain", $john, 'The specified alias is invalid.'],
             ["test123456@localhost", $john, 'The specified domain is invalid.'],
             ["test123456@unknown-domain.org", $john, 'The specified domain is invalid.'],
 
             ["$domain", $john, 'The specified alias is invalid.'],
             [".@$domain", $john, 'The specified alias is invalid.'],
 
             // forbidden local part on public domains
             ["admin@$domain", $john, 'The specified alias is not available.'],
             ["administrator@$domain", $john, 'The specified alias is not available.'],
 
             // forbidden (other user's domain)
             ["testtest@kolab.org", $user, 'The specified domain is not available.'],
 
             // existing alias of other user, to be an alias, user in the same group account
             ["jack.daniels@kolab.org", $john, null],
 
             // existing user
             ["jack@kolab.org", $john, 'The specified alias is not available.'],
 
             // valid (user domain)
             ["admin@kolab.org", $john, null],
 
             // valid (public domain)
             ["test.test@$domain", $john, null],
         ];
     }
 
     /**
      * User email alias validation.
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      *
      * @dataProvider dataValidateAlias
      */
     public function testValidateAlias($alias, $user, $expected_result): void
     {
         $result = UsersController::validateAlias($alias, $user);
         $this->assertSame($expected_result, $result);
     }
 
     /**
      * User alias validation - more cases.
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      */
     public function testValidateAlias2(): void
     {
         Queue::fake();
 
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $deleted_priv = $this->getTestUser('deleted@kolab.org');
         $deleted_priv->setAliases(['deleted-alias@kolab.org']);
         $deleted_priv->delete();
         $deleted_pub = $this->getTestUser('deleted@kolabnow.com');
         $deleted_pub->setAliases(['deleted-alias@kolabnow.com']);
         $deleted_pub->delete();
         $group = $this->getTestGroup('group-test@kolabnow.com');
 
         // An alias that was a user email before is allowed, but only for custom domains
         $result = UsersController::validateAlias('deleted@kolab.org', $john);
         $this->assertSame(null, $result);
 
         $result = UsersController::validateAlias('deleted-alias@kolab.org', $john);
         $this->assertSame(null, $result);
 
         $result = UsersController::validateAlias('deleted@kolabnow.com', $john);
         $this->assertSame('The specified alias is not available.', $result);
 
         $result = UsersController::validateAlias('deleted-alias@kolabnow.com', $john);
         $this->assertSame('The specified alias is not available.', $result);
 
         // A grpoup with the same email address exists
         $result = UsersController::validateAlias($group->email, $john);
         $this->assertSame('The specified alias is not available.', $result);
     }
 }
diff --git a/src/tests/Feature/DomainTest.php b/src/tests/Feature/DomainTest.php
index ebf09c72..27f5fd00 100644
--- a/src/tests/Feature/DomainTest.php
+++ b/src/tests/Feature/DomainTest.php
@@ -1,351 +1,371 @@
 <?php
 
 namespace Tests\Feature;
 
 use App\Domain;
 use App\Entitlement;
 use App\Sku;
 use App\User;
 use App\Tenant;
 use Illuminate\Support\Facades\Queue;
 use Tests\TestCase;
 
 class DomainTest extends TestCase
 {
     private $domains = [
         'public-active.com',
         'gmail.com',
         'ci-success-cname.kolab.org',
         'ci-success-txt.kolab.org',
         'ci-failure-cname.kolab.org',
         'ci-failure-txt.kolab.org',
         'ci-failure-none.kolab.org',
     ];
 
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         foreach ($this->domains as $domain) {
             $this->deleteTestDomain($domain);
         }
 
         $this->deleteTestUser('user@gmail.com');
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         foreach ($this->domains as $domain) {
             $this->deleteTestDomain($domain);
         }
 
         $this->deleteTestUser('user@gmail.com');
 
         parent::tearDown();
     }
 
     /**
      * Test domain create/creating observer
      */
     public function testCreate(): void
     {
         Queue::fake();
 
         $domain = Domain::create([
                 'namespace' => 'GMAIL.COM',
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_EXTERNAL,
         ]);
 
         $result = Domain::where('namespace', 'gmail.com')->first();
 
         $this->assertSame('gmail.com', $result->namespace);
         $this->assertSame($domain->id, $result->id);
         $this->assertSame($domain->type, $result->type);
         $this->assertSame(Domain::STATUS_NEW, $result->status);
     }
 
     /**
      * Test domain creating jobs
      */
     public function testCreateJobs(): void
     {
         // Fake the queue, assert that no jobs were pushed...
         Queue::fake();
         Queue::assertNothingPushed();
 
         $domain = Domain::create([
                 'namespace' => 'gmail.com',
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_EXTERNAL,
         ]);
 
         Queue::assertPushed(\App\Jobs\Domain\CreateJob::class, 1);
 
         Queue::assertPushed(
             \App\Jobs\Domain\CreateJob::class,
             function ($job) use ($domain) {
                 $domainId = TestCase::getObjectProperty($job, 'domainId');
                 $domainNamespace = TestCase::getObjectProperty($job, 'domainNamespace');
 
                 return $domainId === $domain->id &&
                     $domainNamespace === $domain->namespace;
             }
         );
 
         $job = new \App\Jobs\Domain\CreateJob($domain->id);
         $job->handle();
     }
 
     /**
      * Tests getPublicDomains() method
      */
     public function testGetPublicDomains(): void
     {
         $public_domains = Domain::getPublicDomains();
 
         $this->assertNotContains('public-active.com', $public_domains);
 
         $queue = Queue::fake();
 
         $domain = Domain::create([
                 'namespace' => 'public-active.com',
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_EXTERNAL,
         ]);
 
         // External domains should not be returned
         $public_domains = Domain::getPublicDomains();
         $this->assertNotContains('public-active.com', $public_domains);
 
         $domain->type = Domain::TYPE_PUBLIC;
         $domain->save();
 
         $public_domains = Domain::getPublicDomains();
         $this->assertContains('public-active.com', $public_domains);
 
         // Domains of other tenants should not be returned
         $tenant = Tenant::whereNotIn('id', [\config('app.tenant_id')])->first();
         $domain->tenant_id = $tenant->id;
         $domain->save();
 
         $public_domains = Domain::getPublicDomains();
         $this->assertNotContains('public-active.com', $public_domains);
     }
 
     /**
      * Test domain (ownership) confirmation
      *
      * @group dns
      */
     public function testConfirm(): void
     {
         /*
             DNS records for positive and negative tests - kolab.org:
 
             ci-success-cname                A       212.103.80.148
             ci-success-cname                MX      10  mx01.kolabnow.com.
             ci-success-cname                TXT     "v=spf1 mx -all"
             kolab-verify.ci-success-cname   CNAME   2b719cfa4e1033b1e1e132977ed4fe3e.ci-success-cname
 
             ci-failure-cname                A       212.103.80.148
             ci-failure-cname                MX      10  mx01.kolabnow.com.
             kolab-verify.ci-failure-cname   CNAME   2b719cfa4e1033b1e1e132977ed4fe3e.ci-failure-cname
 
             ci-success-txt                  A       212.103.80.148
             ci-success-txt                  MX      10  mx01.kolabnow.com.
             ci-success-txt                  TXT     "v=spf1 mx -all"
             ci-success-txt                  TXT     "kolab-verify=de5d04ababb52d52e2519a2f16d11422"
 
             ci-failure-txt                  A       212.103.80.148
             ci-failure-txt                  MX      10  mx01.kolabnow.com.
             kolab-verify.ci-failure-txt     TXT     "kolab-verify=de5d04ababb52d52e2519a2f16d11422"
 
             ci-failure-none                 A       212.103.80.148
             ci-failure-none                 MX      10  mx01.kolabnow.com.
         */
 
         $queue = Queue::fake();
 
         $domain_props = ['status' => Domain::STATUS_NEW, 'type' => Domain::TYPE_EXTERNAL];
 
         $domain = $this->getTestDomain('ci-failure-none.kolab.org', $domain_props);
 
         $this->assertTrue($domain->confirm() === false);
         $this->assertFalse($domain->isConfirmed());
 
         $domain = $this->getTestDomain('ci-failure-txt.kolab.org', $domain_props);
 
         $this->assertTrue($domain->confirm() === false);
         $this->assertFalse($domain->isConfirmed());
 
         $domain = $this->getTestDomain('ci-failure-cname.kolab.org', $domain_props);
 
         $this->assertTrue($domain->confirm() === false);
         $this->assertFalse($domain->isConfirmed());
 
         $domain = $this->getTestDomain('ci-success-txt.kolab.org', $domain_props);
 
         $this->assertTrue($domain->confirm());
         $this->assertTrue($domain->isConfirmed());
 
         $domain = $this->getTestDomain('ci-success-cname.kolab.org', $domain_props);
 
         $this->assertTrue($domain->confirm());
         $this->assertTrue($domain->isConfirmed());
     }
 
     /**
      * Test domain deletion
      */
     public function testDelete(): void
     {
         Queue::fake();
 
         $domain = $this->getTestDomain('gmail.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
 
         $domain->delete();
 
         $this->assertTrue($domain->fresh()->trashed());
         $this->assertFalse($domain->fresh()->isDeleted());
 
         // Delete the domain for real
         $job = new \App\Jobs\Domain\DeleteJob($domain->id);
         $job->handle();
 
         $this->assertTrue(Domain::withTrashed()->where('id', $domain->id)->first()->isDeleted());
 
         $domain->forceDelete();
 
         $this->assertCount(0, Domain::withTrashed()->where('id', $domain->id)->get());
     }
 
     /**
      * Test isEmpty() method
      */
     public function testIsEmpty(): void
     {
         Queue::fake();
 
         $this->deleteTestUser('user@gmail.com');
         $this->deleteTestGroup('group@gmail.com');
         $this->deleteTestResource('resource@gmail.com');
         $this->deleteTestSharedFolder('folder@gmail.com');
 
         // Empty domain
         $domain = $this->getTestDomain('gmail.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_EXTERNAL,
         ]);
 
         $this->assertTrue($domain->isEmpty());
 
         $this->getTestUser('user@gmail.com');
         $this->assertFalse($domain->isEmpty());
         $this->deleteTestUser('user@gmail.com');
         $this->assertTrue($domain->isEmpty());
         $this->getTestGroup('group@gmail.com');
         $this->assertFalse($domain->isEmpty());
         $this->deleteTestGroup('group@gmail.com');
         $this->assertTrue($domain->isEmpty());
         $this->getTestResource('resource@gmail.com');
         $this->assertFalse($domain->isEmpty());
         $this->deleteTestResource('resource@gmail.com');
         $this->getTestSharedFolder('folder@gmail.com');
         $this->assertFalse($domain->isEmpty());
         $this->deleteTestSharedFolder('folder@gmail.com');
 
         // TODO: Test with an existing alias, but not other objects in a domain
 
         // Empty public domain
         $domain = Domain::where('namespace', 'libertymail.net')->first();
 
         $this->assertFalse($domain->isEmpty());
     }
 
     /**
      * Test domain restoring
      */
     public function testRestore(): void
     {
         Queue::fake();
 
         $domain = $this->getTestDomain('gmail.com', [
                 'status' => Domain::STATUS_NEW | Domain::STATUS_SUSPENDED
                     | Domain::STATUS_LDAP_READY | Domain::STATUS_CONFIRMED,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
 
         $user = $this->getTestUser('user@gmail.com');
         $sku = \App\Sku::where('title', 'domain-hosting')->first();
         $now = \Carbon\Carbon::now();
 
         // Assign two entitlements to the domain, so we can assert that only the
         // ones deleted last will be restored
         $ent1 = \App\Entitlement::create([
                 'wallet_id' => $user->wallets->first()->id,
                 'sku_id' => $sku->id,
                 'cost' => 0,
                 'entitleable_id' => $domain->id,
                 'entitleable_type' => Domain::class,
         ]);
         $ent2 = \App\Entitlement::create([
                 'wallet_id' => $user->wallets->first()->id,
                 'sku_id' => $sku->id,
                 'cost' => 0,
                 'entitleable_id' => $domain->id,
                 'entitleable_type' => Domain::class,
         ]);
 
         $domain->delete();
 
         $this->assertTrue($domain->fresh()->trashed());
         $this->assertFalse($domain->fresh()->isDeleted());
         $this->assertTrue($ent1->fresh()->trashed());
         $this->assertTrue($ent2->fresh()->trashed());
 
         // Backdate some properties
         \App\Entitlement::withTrashed()->where('id', $ent2->id)->update(['deleted_at' => $now->subMinutes(2)]);
         \App\Entitlement::withTrashed()->where('id', $ent1->id)->update(['updated_at' => $now->subMinutes(10)]);
 
         Queue::fake();
 
         $domain->restore();
         $domain->refresh();
 
         $this->assertFalse($domain->trashed());
         $this->assertFalse($domain->isDeleted());
         $this->assertFalse($domain->isSuspended());
         $this->assertFalse($domain->isLdapReady());
         $this->assertTrue($domain->isActive());
         $this->assertTrue($domain->isConfirmed());
 
         // Assert entitlements
         $this->assertTrue($ent2->fresh()->trashed());
         $this->assertFalse($ent1->fresh()->trashed());
         $this->assertTrue($ent1->updated_at->greaterThan(\Carbon\Carbon::now()->subSeconds(5)));
 
         // We expect only one CreateJob and one UpdateJob
         // Because how Illuminate/Database/Eloquent/SoftDeletes::restore() method
         // is implemented we cannot skip the UpdateJob in any way.
         // I don't want to overwrite this method, the extra job shouldn't do any harm.
         $this->assertCount(2, Queue::pushedJobs()); // @phpstan-ignore-line
         Queue::assertPushed(\App\Jobs\Domain\UpdateJob::class, 1);
         Queue::assertPushed(\App\Jobs\Domain\CreateJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\Domain\CreateJob::class,
             function ($job) use ($domain) {
                 return $domain->id === TestCase::getObjectProperty($job, 'domainId');
             }
         );
     }
+
+    /**
+     * Tests for Domain::walletOwner() (from EntitleableTrait)
+     */
+    public function testWalletOwner(): void
+    {
+        $domain = $this->getTestDomain('kolab.org');
+        $john = $this->getTestUser('john@kolab.org');
+
+        $this->assertSame($john->id, $domain->walletOwner()->id);
+
+        // A domain without an owner
+        $domain = $this->getTestDomain('gmail.com', [
+                'status' => Domain::STATUS_NEW | Domain::STATUS_SUSPENDED
+                    | Domain::STATUS_LDAP_READY | Domain::STATUS_CONFIRMED,
+                'type' => Domain::TYPE_PUBLIC,
+        ]);
+
+        $this->assertSame(null, $domain->walletOwner());
+    }
 }
diff --git a/src/tests/Feature/UserTest.php b/src/tests/Feature/UserTest.php
index 98538b3b..a2f1657b 100644
--- a/src/tests/Feature/UserTest.php
+++ b/src/tests/Feature/UserTest.php
@@ -1,1186 +1,1253 @@
 <?php
 
 namespace Tests\Feature;
 
 use App\Domain;
 use App\Group;
 use App\User;
 use Carbon\Carbon;
 use Illuminate\Support\Facades\Queue;
 use Tests\TestCase;
 
 class UserTest extends TestCase
 {
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('user-test@' . \config('app.domain'));
         $this->deleteTestUser('UserAccountA@UserAccount.com');
         $this->deleteTestUser('UserAccountB@UserAccount.com');
         $this->deleteTestUser('UserAccountC@UserAccount.com');
         $this->deleteTestGroup('test-group@UserAccount.com');
         $this->deleteTestResource('test-resource@UserAccount.com');
         $this->deleteTestSharedFolder('test-folder@UserAccount.com');
         $this->deleteTestDomain('UserAccount.com');
         $this->deleteTestDomain('UserAccountAdd.com');
     }
 
     public function tearDown(): void
     {
         \App\TenantSetting::truncate();
         $this->deleteTestUser('user-test@' . \config('app.domain'));
         $this->deleteTestUser('UserAccountA@UserAccount.com');
         $this->deleteTestUser('UserAccountB@UserAccount.com');
         $this->deleteTestUser('UserAccountC@UserAccount.com');
         $this->deleteTestGroup('test-group@UserAccount.com');
         $this->deleteTestResource('test-resource@UserAccount.com');
         $this->deleteTestSharedFolder('test-folder@UserAccount.com');
         $this->deleteTestDomain('UserAccount.com');
         $this->deleteTestDomain('UserAccountAdd.com');
 
         parent::tearDown();
     }
 
     /**
      * Tests for User::assignPackage()
      */
     public function testAssignPackage(): void
     {
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
         $wallet = $user->wallets()->first();
 
         $package = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
 
         $user->assignPackage($package);
 
         $sku = \App\Sku::withEnvTenantContext()->where('title', 'mailbox')->first();
 
         $entitlement = \App\Entitlement::where('wallet_id', $wallet->id)
             ->where('sku_id', $sku->id)->first();
 
         $this->assertNotNull($entitlement);
         $this->assertSame($sku->id, $entitlement->sku->id);
         $this->assertSame($wallet->id, $entitlement->wallet->id);
         $this->assertEquals($user->id, $entitlement->entitleable->id);
         $this->assertTrue($entitlement->entitleable instanceof \App\User);
         $this->assertCount(7, $user->entitlements()->get());
     }
 
     /**
      * Tests for User::assignPlan()
      */
     public function testAssignPlan(): void
     {
         $this->markTestIncomplete();
     }
 
     /**
      * Tests for User::assignSku()
      */
     public function testAssignSku(): void
     {
         $this->markTestIncomplete();
     }
 
     /**
      * Verify a wallet assigned a controller is among the accounts of the assignee.
      */
     public function testAccounts(): void
     {
         $userA = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
 
         $this->assertTrue($userA->wallets()->count() == 1);
 
         $userA->wallets()->each(
             function ($wallet) use ($userB) {
                 $wallet->addController($userB);
             }
         );
 
         $this->assertTrue($userB->accounts()->get()[0]->id === $userA->wallets()->get()[0]->id);
     }
 
     public function testCanDelete(): void
     {
         $this->markTestIncomplete();
     }
 
     /**
      * Test User::canRead() method
      */
     public function testCanRead(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
         $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
         $domain = $this->getTestDomain('kolab.org');
 
         // Admin
         $this->assertTrue($admin->canRead($admin));
         $this->assertTrue($admin->canRead($john));
         $this->assertTrue($admin->canRead($jack));
         $this->assertTrue($admin->canRead($reseller1));
         $this->assertTrue($admin->canRead($reseller2));
         $this->assertTrue($admin->canRead($domain));
         $this->assertTrue($admin->canRead($domain->wallet()));
 
         // Reseller - kolabnow
         $this->assertTrue($reseller1->canRead($john));
         $this->assertTrue($reseller1->canRead($jack));
         $this->assertTrue($reseller1->canRead($reseller1));
         $this->assertTrue($reseller1->canRead($domain));
         $this->assertTrue($reseller1->canRead($domain->wallet()));
         $this->assertFalse($reseller1->canRead($reseller2));
         $this->assertFalse($reseller1->canRead($admin));
 
         // Reseller - different tenant
         $this->assertTrue($reseller2->canRead($reseller2));
         $this->assertFalse($reseller2->canRead($john));
         $this->assertFalse($reseller2->canRead($jack));
         $this->assertFalse($reseller2->canRead($reseller1));
         $this->assertFalse($reseller2->canRead($domain));
         $this->assertFalse($reseller2->canRead($domain->wallet()));
         $this->assertFalse($reseller2->canRead($admin));
 
         // Normal user - account owner
         $this->assertTrue($john->canRead($john));
         $this->assertTrue($john->canRead($ned));
         $this->assertTrue($john->canRead($jack));
         $this->assertTrue($john->canRead($domain));
         $this->assertTrue($john->canRead($domain->wallet()));
         $this->assertFalse($john->canRead($reseller1));
         $this->assertFalse($john->canRead($reseller2));
         $this->assertFalse($john->canRead($admin));
 
         // Normal user - a non-owner and non-controller
         $this->assertTrue($jack->canRead($jack));
         $this->assertFalse($jack->canRead($john));
         $this->assertFalse($jack->canRead($domain));
         $this->assertFalse($jack->canRead($domain->wallet()));
         $this->assertFalse($jack->canRead($reseller1));
         $this->assertFalse($jack->canRead($reseller2));
         $this->assertFalse($jack->canRead($admin));
 
         // Normal user - John's wallet controller
         $this->assertTrue($ned->canRead($ned));
         $this->assertTrue($ned->canRead($john));
         $this->assertTrue($ned->canRead($jack));
         $this->assertTrue($ned->canRead($domain));
         $this->assertTrue($ned->canRead($domain->wallet()));
         $this->assertFalse($ned->canRead($reseller1));
         $this->assertFalse($ned->canRead($reseller2));
         $this->assertFalse($ned->canRead($admin));
     }
 
     /**
      * Test User::canUpdate() method
      */
     public function testCanUpdate(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
         $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
         $domain = $this->getTestDomain('kolab.org');
 
         // Admin
         $this->assertTrue($admin->canUpdate($admin));
         $this->assertTrue($admin->canUpdate($john));
         $this->assertTrue($admin->canUpdate($jack));
         $this->assertTrue($admin->canUpdate($reseller1));
         $this->assertTrue($admin->canUpdate($reseller2));
         $this->assertTrue($admin->canUpdate($domain));
         $this->assertTrue($admin->canUpdate($domain->wallet()));
 
         // Reseller - kolabnow
         $this->assertTrue($reseller1->canUpdate($john));
         $this->assertTrue($reseller1->canUpdate($jack));
         $this->assertTrue($reseller1->canUpdate($reseller1));
         $this->assertTrue($reseller1->canUpdate($domain));
         $this->assertTrue($reseller1->canUpdate($domain->wallet()));
         $this->assertFalse($reseller1->canUpdate($reseller2));
         $this->assertFalse($reseller1->canUpdate($admin));
 
         // Reseller - different tenant
         $this->assertTrue($reseller2->canUpdate($reseller2));
         $this->assertFalse($reseller2->canUpdate($john));
         $this->assertFalse($reseller2->canUpdate($jack));
         $this->assertFalse($reseller2->canUpdate($reseller1));
         $this->assertFalse($reseller2->canUpdate($domain));
         $this->assertFalse($reseller2->canUpdate($domain->wallet()));
         $this->assertFalse($reseller2->canUpdate($admin));
 
         // Normal user - account owner
         $this->assertTrue($john->canUpdate($john));
         $this->assertTrue($john->canUpdate($ned));
         $this->assertTrue($john->canUpdate($jack));
         $this->assertTrue($john->canUpdate($domain));
         $this->assertFalse($john->canUpdate($domain->wallet()));
         $this->assertFalse($john->canUpdate($reseller1));
         $this->assertFalse($john->canUpdate($reseller2));
         $this->assertFalse($john->canUpdate($admin));
 
         // Normal user - a non-owner and non-controller
         $this->assertTrue($jack->canUpdate($jack));
         $this->assertFalse($jack->canUpdate($john));
         $this->assertFalse($jack->canUpdate($domain));
         $this->assertFalse($jack->canUpdate($domain->wallet()));
         $this->assertFalse($jack->canUpdate($reseller1));
         $this->assertFalse($jack->canUpdate($reseller2));
         $this->assertFalse($jack->canUpdate($admin));
 
         // Normal user - John's wallet controller
         $this->assertTrue($ned->canUpdate($ned));
         $this->assertTrue($ned->canUpdate($john));
         $this->assertTrue($ned->canUpdate($jack));
         $this->assertTrue($ned->canUpdate($domain));
         $this->assertFalse($ned->canUpdate($domain->wallet()));
         $this->assertFalse($ned->canUpdate($reseller1));
         $this->assertFalse($ned->canUpdate($reseller2));
         $this->assertFalse($ned->canUpdate($admin));
     }
 
     /**
      * Test user create/creating observer
      */
     public function testCreate(): void
     {
         Queue::fake();
 
         $domain = \config('app.domain');
 
         $user = User::create(['email' => 'USER-test@' . \strtoupper($domain)]);
 
         $result = User::where('email', 'user-test@' . $domain)->first();
 
         $this->assertSame('user-test@' . $domain, $result->email);
         $this->assertSame($user->id, $result->id);
         $this->assertSame(User::STATUS_NEW | User::STATUS_ACTIVE, $result->status);
     }
 
     /**
      * Verify user creation process
      */
     public function testCreateJobs(): void
     {
         Queue::fake();
 
         $user = User::create([
                 'email' => 'user-test@' . \config('app.domain')
         ]);
 
         Queue::assertPushed(\App\Jobs\User\CreateJob::class, 1);
         Queue::assertPushed(\App\Jobs\PGP\KeyCreateJob::class, 0);
 
         Queue::assertPushed(
             \App\Jobs\User\CreateJob::class,
             function ($job) use ($user) {
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 $userId = TestCase::getObjectProperty($job, 'userId');
 
                 return $userEmail === $user->email
                     && $userId === $user->id;
             }
         );
 
         Queue::assertPushedWithChain(
             \App\Jobs\User\CreateJob::class,
             [
                 \App\Jobs\User\VerifyJob::class,
             ]
         );
 /*
         FIXME: Looks like we can't really do detailed assertions on chained jobs
                Another thing to consider is if we maybe should run these jobs
                independently (not chained) and make sure there's no race-condition
                in status update
 
         Queue::assertPushed(\App\Jobs\User\VerifyJob::class, 1);
         Queue::assertPushed(\App\Jobs\User\VerifyJob::class, function ($job) use ($user) {
             $userEmail = TestCase::getObjectProperty($job, 'userEmail');
             $userId = TestCase::getObjectProperty($job, 'userId');
 
             return $userEmail === $user->email
                 && $userId === $user->id;
         });
 */
     }
 
     /**
      * Verify user creation process invokes the PGP keys creation job (if configured)
      */
     public function testCreatePGPJob(): void
     {
         Queue::fake();
 
         \App\Tenant::find(\config('app.tenant_id'))->setSetting('pgp.enable', 1);
 
         $user = User::create([
                 'email' => 'user-test@' . \config('app.domain')
         ]);
 
         Queue::assertPushed(\App\Jobs\PGP\KeyCreateJob::class, 1);
 
         Queue::assertPushed(
             \App\Jobs\PGP\KeyCreateJob::class,
             function ($job) use ($user) {
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 $userId = TestCase::getObjectProperty($job, 'userId');
 
                 return $userEmail === $user->email
                     && $userId === $user->id;
             }
         );
     }
 
     /**
      * Tests for User::domains()
      */
     public function testDomains(): void
     {
         $user = $this->getTestUser('john@kolab.org');
 
         $domain = $this->getTestDomain('useraccount.com', [
                 'status' => Domain::STATUS_NEW | Domain::STATUS_ACTIVE,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
 
         $domains = $user->domains()->pluck('namespace')->all();
 
         $this->assertContains($domain->namespace, $domains);
         $this->assertContains('kolab.org', $domains);
 
         // Jack is not the wallet controller, so for him the list should not
         // include John's domains, kolab.org specifically
         $user = $this->getTestUser('jack@kolab.org');
 
         $domains = $user->domains()->pluck('namespace')->all();
 
         $this->assertContains($domain->namespace, $domains);
         $this->assertNotContains('kolab.org', $domains);
 
         // Public domains of other tenants should not be returned
         $tenant = \App\Tenant::where('id', '!=', \config('app.tenant_id'))->first();
         $domain->tenant_id = $tenant->id;
         $domain->save();
 
         $domains = $user->domains()->pluck('namespace')->all();
 
         $this->assertNotContains($domain->namespace, $domains);
     }
 
     /**
      * Test User::getConfig() and setConfig() methods
      */
     public function testConfigTrait(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $john->setSetting('greylist_enabled', null);
+        $john->setSetting('password_policy', null);
 
-        $this->assertSame(['greylist_enabled' => true], $john->getConfig());
+        // Greylist_enabled
+        $this->assertSame(true, $john->getConfig()['greylist_enabled']);
 
         $result = $john->setConfig(['greylist_enabled' => false, 'unknown' => false]);
 
-        $this->assertSame(['greylist_enabled' => false], $john->getConfig());
+        $this->assertSame(['unknown' => "The requested configuration parameter is not supported."], $result);
+        $this->assertSame(false, $john->getConfig()['greylist_enabled']);
         $this->assertSame('false', $john->getSetting('greylist_enabled'));
 
         $result = $john->setConfig(['greylist_enabled' => true]);
 
-        $this->assertSame(['greylist_enabled' => true], $john->getConfig());
+        $this->assertSame([], $result);
+        $this->assertSame(true, $john->getConfig()['greylist_enabled']);
         $this->assertSame('true', $john->getSetting('greylist_enabled'));
+
+        // Password_policy
+        $result = $john->setConfig(['password_policy' => true]);
+
+        $this->assertSame(['password_policy' => "Specified password policy is invalid."], $result);
+        $this->assertSame(null, $john->getConfig()['password_policy']);
+        $this->assertSame(null, $john->getSetting('password_policy'));
+
+        $result = $john->setConfig(['password_policy' => 'min:-1']);
+
+        $this->assertSame(['password_policy' => "Specified password policy is invalid."], $result);
+
+        $result = $john->setConfig(['password_policy' => 'min:-1']);
+
+        $this->assertSame(['password_policy' => "Specified password policy is invalid."], $result);
+
+        $result = $john->setConfig(['password_policy' => 'min:10,unknown']);
+
+        $this->assertSame(['password_policy' => "Specified password policy is invalid."], $result);
+
+        \config(['app.password_policy' => 'min:5,max:100']);
+        $result = $john->setConfig(['password_policy' => 'min:4,max:255']);
+
+        $this->assertSame(['password_policy' => "Minimum password length cannot be less than 5."], $result);
+
+        \config(['app.password_policy' => 'min:5,max:100']);
+        $result = $john->setConfig(['password_policy' => 'min:10,max:255']);
+
+        $this->assertSame(['password_policy' => "Maximum password length cannot be more than 100."], $result);
+
+        \config(['app.password_policy' => 'min:5,max:255']);
+        $result = $john->setConfig(['password_policy' => 'min:10,max:255']);
+
+        $this->assertSame([], $result);
+        $this->assertSame('min:10,max:255', $john->getConfig()['password_policy']);
+        $this->assertSame('min:10,max:255', $john->getSetting('password_policy'));
     }
 
     /**
      * Test user account degradation and un-degradation
      */
     public function testDegradeAndUndegrade(): void
     {
         Queue::fake();
 
         // Test an account with users, domain
         $userA = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $domain = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $userA->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $userA);
         $userA->assignPackage($package_kolab, $userB);
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
         $entitlementsDomain = \App\Entitlement::where('entitleable_id', $domain->id);
 
         $yesterday = Carbon::now()->subDays(1);
 
         $this->backdateEntitlements($entitlementsA->get(), $yesterday, Carbon::now()->subMonthsWithoutOverflow(1));
         $this->backdateEntitlements($entitlementsB->get(), $yesterday, Carbon::now()->subMonthsWithoutOverflow(1));
 
         $wallet = $userA->wallets->first();
 
         $this->assertSame(7, $entitlementsA->count());
         $this->assertSame(7, $entitlementsB->count());
         $this->assertSame(7, $entitlementsA->whereDate('updated_at', $yesterday->toDateString())->count());
         $this->assertSame(7, $entitlementsB->whereDate('updated_at', $yesterday->toDateString())->count());
         $this->assertSame(0, $wallet->balance);
 
         Queue::fake(); // reset queue state
 
         // Degrade the account/wallet owner
         $userA->degrade();
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
 
         $this->assertTrue($userA->fresh()->isDegraded());
         $this->assertTrue($userA->fresh()->isDegraded(true));
         $this->assertFalse($userB->fresh()->isDegraded());
         $this->assertTrue($userB->fresh()->isDegraded(true));
 
         $balance = $wallet->fresh()->balance;
         $this->assertTrue($balance <= -64);
         $this->assertSame(7, $entitlementsA->whereDate('updated_at', Carbon::now()->toDateString())->count());
         $this->assertSame(7, $entitlementsB->whereDate('updated_at', Carbon::now()->toDateString())->count());
 
         // Expect one update job for every user
         // @phpstan-ignore-next-line
         $userIds = Queue::pushed(\App\Jobs\User\UpdateJob::class)->map(function ($job) {
             return TestCase::getObjectProperty($job, 'userId');
         })->all();
 
         $this->assertSame([$userA->id, $userB->id], $userIds);
 
         // Un-Degrade the account/wallet owner
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
 
         $yesterday = Carbon::now()->subDays(1);
 
         $this->backdateEntitlements($entitlementsA->get(), $yesterday, Carbon::now()->subMonthsWithoutOverflow(1));
         $this->backdateEntitlements($entitlementsB->get(), $yesterday, Carbon::now()->subMonthsWithoutOverflow(1));
 
         Queue::fake(); // reset queue state
 
         $userA->undegrade();
 
         $this->assertFalse($userA->fresh()->isDegraded());
         $this->assertFalse($userA->fresh()->isDegraded(true));
         $this->assertFalse($userB->fresh()->isDegraded());
         $this->assertFalse($userB->fresh()->isDegraded(true));
 
         // Expect no balance change, degraded account entitlements are free
         $this->assertSame($balance, $wallet->fresh()->balance);
         $this->assertSame(7, $entitlementsA->whereDate('updated_at', Carbon::now()->toDateString())->count());
         $this->assertSame(7, $entitlementsB->whereDate('updated_at', Carbon::now()->toDateString())->count());
 
         // Expect one update job for every user
         // @phpstan-ignore-next-line
         $userIds = Queue::pushed(\App\Jobs\User\UpdateJob::class)->map(function ($job) {
             return TestCase::getObjectProperty($job, 'userId');
         })->all();
 
         $this->assertSame([$userA->id, $userB->id], $userIds);
     }
 
     /**
      * Test user deletion
      */
     public function testDelete(): void
     {
         Queue::fake();
 
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
         $package = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $user->assignPackage($package);
 
         $id = $user->id;
 
         $this->assertCount(7, $user->entitlements()->get());
 
         $user->delete();
 
         $this->assertCount(0, $user->entitlements()->get());
         $this->assertTrue($user->fresh()->trashed());
         $this->assertFalse($user->fresh()->isDeleted());
 
         // Delete the user for real
         $job = new \App\Jobs\User\DeleteJob($id);
         $job->handle();
 
         $this->assertTrue(User::withTrashed()->where('id', $id)->first()->isDeleted());
 
         $user->forceDelete();
 
         $this->assertCount(0, User::withTrashed()->where('id', $id)->get());
 
         // Test an account with users, domain, and group, and resource
         $userA = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $userC = $this->getTestUser('UserAccountC@UserAccount.com');
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $domain = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $userA->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $userA);
         $userA->assignPackage($package_kolab, $userB);
         $userA->assignPackage($package_kolab, $userC);
         $group = $this->getTestGroup('test-group@UserAccount.com');
         $group->assignToWallet($userA->wallets->first());
         $resource = $this->getTestResource('test-resource@UserAccount.com', ['name' => 'test']);
         $resource->assignToWallet($userA->wallets->first());
         $folder = $this->getTestSharedFolder('test-folder@UserAccount.com', ['name' => 'test']);
         $folder->assignToWallet($userA->wallets->first());
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
         $entitlementsC = \App\Entitlement::where('entitleable_id', $userC->id);
         $entitlementsDomain = \App\Entitlement::where('entitleable_id', $domain->id);
         $entitlementsGroup = \App\Entitlement::where('entitleable_id', $group->id);
         $entitlementsResource = \App\Entitlement::where('entitleable_id', $resource->id);
         $entitlementsFolder = \App\Entitlement::where('entitleable_id', $folder->id);
 
         $this->assertSame(7, $entitlementsA->count());
         $this->assertSame(7, $entitlementsB->count());
         $this->assertSame(7, $entitlementsC->count());
         $this->assertSame(1, $entitlementsDomain->count());
         $this->assertSame(1, $entitlementsGroup->count());
         $this->assertSame(1, $entitlementsResource->count());
         $this->assertSame(1, $entitlementsFolder->count());
 
         // Delete non-controller user
         $userC->delete();
 
         $this->assertTrue($userC->fresh()->trashed());
         $this->assertFalse($userC->fresh()->isDeleted());
         $this->assertSame(0, $entitlementsC->count());
 
         // Delete the controller (and expect "sub"-users to be deleted too)
         $userA->delete();
 
         $this->assertSame(0, $entitlementsA->count());
         $this->assertSame(0, $entitlementsB->count());
         $this->assertSame(0, $entitlementsDomain->count());
         $this->assertSame(0, $entitlementsGroup->count());
         $this->assertSame(0, $entitlementsResource->count());
         $this->assertSame(0, $entitlementsFolder->count());
         $this->assertSame(7, $entitlementsA->withTrashed()->count());
         $this->assertSame(7, $entitlementsB->withTrashed()->count());
         $this->assertSame(7, $entitlementsC->withTrashed()->count());
         $this->assertSame(1, $entitlementsDomain->withTrashed()->count());
         $this->assertSame(1, $entitlementsGroup->withTrashed()->count());
         $this->assertSame(1, $entitlementsResource->withTrashed()->count());
         $this->assertSame(1, $entitlementsFolder->withTrashed()->count());
         $this->assertTrue($userA->fresh()->trashed());
         $this->assertTrue($userB->fresh()->trashed());
         $this->assertTrue($domain->fresh()->trashed());
         $this->assertTrue($group->fresh()->trashed());
         $this->assertTrue($resource->fresh()->trashed());
         $this->assertTrue($folder->fresh()->trashed());
         $this->assertFalse($userA->isDeleted());
         $this->assertFalse($userB->isDeleted());
         $this->assertFalse($domain->isDeleted());
         $this->assertFalse($group->isDeleted());
         $this->assertFalse($resource->isDeleted());
         $this->assertFalse($folder->isDeleted());
 
         $userA->forceDelete();
 
         $all_entitlements = \App\Entitlement::where('wallet_id', $userA->wallets->first()->id);
         $transactions = \App\Transaction::where('object_id', $userA->wallets->first()->id);
 
         $this->assertSame(0, $all_entitlements->withTrashed()->count());
         $this->assertSame(0, $transactions->count());
         $this->assertCount(0, User::withTrashed()->where('id', $userA->id)->get());
         $this->assertCount(0, User::withTrashed()->where('id', $userB->id)->get());
         $this->assertCount(0, User::withTrashed()->where('id', $userC->id)->get());
         $this->assertCount(0, Domain::withTrashed()->where('id', $domain->id)->get());
         $this->assertCount(0, Group::withTrashed()->where('id', $group->id)->get());
         $this->assertCount(0, \App\Resource::withTrashed()->where('id', $resource->id)->get());
         $this->assertCount(0, \App\SharedFolder::withTrashed()->where('id', $folder->id)->get());
     }
 
     /**
      * Test user deletion vs. group membership
      */
     public function testDeleteAndGroups(): void
     {
         Queue::fake();
 
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $userA = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $userA->assignPackage($package_kolab, $userB);
         $group = $this->getTestGroup('test-group@UserAccount.com');
         $group->members = ['test@gmail.com', $userB->email];
         $group->assignToWallet($userA->wallets->first());
         $group->save();
 
         Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 1);
 
         $userGroups = $userA->groups()->get();
         $this->assertSame(1, $userGroups->count());
         $this->assertSame($group->id, $userGroups->first()->id);
 
         $userB->delete();
 
         $this->assertSame(['test@gmail.com'], $group->fresh()->members);
 
         // Twice, one for save() and one for delete() above
         Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 2);
     }
 
     /**
      * Test handling negative balance on user deletion
      */
     public function testDeleteWithNegativeBalance(): void
     {
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
         $wallet = $user->wallets()->first();
         $wallet->balance = -1000;
         $wallet->save();
         $reseller_wallet = $user->tenant->wallet();
         $reseller_wallet->balance = 0;
         $reseller_wallet->save();
         \App\Transaction::where('object_id', $reseller_wallet->id)->where('object_type', \App\Wallet::class)->delete();
 
         $user->delete();
 
         $reseller_transactions = \App\Transaction::where('object_id', $reseller_wallet->id)
             ->where('object_type', \App\Wallet::class)->get();
 
         $this->assertSame(-1000, $reseller_wallet->fresh()->balance);
         $this->assertCount(1, $reseller_transactions);
         $trans = $reseller_transactions[0];
         $this->assertSame("Deleted user {$user->email}", $trans->description);
         $this->assertSame(-1000, $trans->amount);
         $this->assertSame(\App\Transaction::WALLET_DEBIT, $trans->type);
     }
 
     /**
      * Test handling positive balance on user deletion
      */
     public function testDeleteWithPositiveBalance(): void
     {
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
         $wallet = $user->wallets()->first();
         $wallet->balance = 1000;
         $wallet->save();
         $reseller_wallet = $user->tenant->wallet();
         $reseller_wallet->balance = 0;
         $reseller_wallet->save();
 
         $user->delete();
 
         $this->assertSame(0, $reseller_wallet->fresh()->balance);
     }
 
     /**
      * Test user deletion with PGP/WOAT enabled
      */
     public function testDeleteWithPGP(): void
     {
         Queue::fake();
 
         // Test with PGP disabled
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
 
         $user->tenant->setSetting('pgp.enable', 0);
         $user->delete();
 
         Queue::assertPushed(\App\Jobs\PGP\KeyDeleteJob::class, 0);
 
         // Test with PGP enabled
         $this->deleteTestUser('user-test@' . \config('app.domain'));
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
 
         $user->tenant->setSetting('pgp.enable', 1);
         $user->delete();
         $user->tenant->setSetting('pgp.enable', 0);
 
         Queue::assertPushed(\App\Jobs\PGP\KeyDeleteJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\PGP\KeyDeleteJob::class,
             function ($job) use ($user) {
                 $userId = TestCase::getObjectProperty($job, 'userId');
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 return $userId == $user->id && $userEmail === $user->email;
             }
         );
     }
 
     /**
      * Tests for User::aliasExists()
      */
     public function testAliasExists(): void
     {
         $this->assertTrue(User::aliasExists('jack.daniels@kolab.org'));
 
         $this->assertFalse(User::aliasExists('j.daniels@kolab.org'));
         $this->assertFalse(User::aliasExists('john@kolab.org'));
     }
 
     /**
      * Tests for User::emailExists()
      */
     public function testEmailExists(): void
     {
         $this->assertFalse(User::emailExists('jack.daniels@kolab.org'));
         $this->assertFalse(User::emailExists('j.daniels@kolab.org'));
 
         $this->assertTrue(User::emailExists('john@kolab.org'));
         $user = User::emailExists('john@kolab.org', true);
         $this->assertSame('john@kolab.org', $user->email);
     }
 
     /**
      * Tests for User::findByEmail()
      */
     public function testFindByEmail(): void
     {
         $user = $this->getTestUser('john@kolab.org');
 
         $result = User::findByEmail('john');
         $this->assertNull($result);
 
         $result = User::findByEmail('non-existing@email.com');
         $this->assertNull($result);
 
         $result = User::findByEmail('john@kolab.org');
         $this->assertInstanceOf(User::class, $result);
         $this->assertSame($user->id, $result->id);
 
         // Use an alias
         $result = User::findByEmail('john.doe@kolab.org');
         $this->assertInstanceOf(User::class, $result);
         $this->assertSame($user->id, $result->id);
 
         Queue::fake();
 
         // A case where two users have the same alias
         $ned = $this->getTestUser('ned@kolab.org');
         $ned->setAliases(['joe.monster@kolab.org']);
         $result = User::findByEmail('joe.monster@kolab.org');
         $this->assertNull($result);
         $ned->setAliases([]);
 
         // TODO: searching by external email (setting)
         $this->markTestIncomplete();
     }
 
     /**
      * Test User::hasSku() method
      */
     public function testHasSku(): void
     {
         $john = $this->getTestUser('john@kolab.org');
 
         $this->assertTrue($john->hasSku('mailbox'));
         $this->assertTrue($john->hasSku('storage'));
         $this->assertFalse($john->hasSku('beta'));
         $this->assertFalse($john->hasSku('unknown'));
     }
 
     /**
      * Test User::name()
      */
     public function testName(): void
     {
         Queue::fake();
 
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
 
         $this->assertSame('', $user->name());
         $this->assertSame($user->tenant->title . ' User', $user->name(true));
 
         $user->setSetting('first_name', 'First');
 
         $this->assertSame('First', $user->name());
         $this->assertSame('First', $user->name(true));
 
         $user->setSetting('last_name', 'Last');
 
         $this->assertSame('First Last', $user->name());
         $this->assertSame('First Last', $user->name(true));
     }
 
     /**
      * Test resources() method
      */
     public function testResources(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
 
         $resources = $john->resources()->orderBy('email')->get();
 
         $this->assertSame(2, $resources->count());
         $this->assertSame('resource-test1@kolab.org', $resources[0]->email);
         $this->assertSame('resource-test2@kolab.org', $resources[1]->email);
 
         $resources = $ned->resources()->orderBy('email')->get();
 
         $this->assertSame(2, $resources->count());
         $this->assertSame('resource-test1@kolab.org', $resources[0]->email);
         $this->assertSame('resource-test2@kolab.org', $resources[1]->email);
 
         $resources = $jack->resources()->get();
 
         $this->assertSame(0, $resources->count());
     }
 
     /**
      * Test sharedFolders() method
      */
     public function testSharedFolders(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
 
         $folders = $john->sharedFolders()->orderBy('email')->get();
 
         $this->assertSame(2, $folders->count());
         $this->assertSame('folder-contact@kolab.org', $folders[0]->email);
         $this->assertSame('folder-event@kolab.org', $folders[1]->email);
 
         $folders = $ned->sharedFolders()->orderBy('email')->get();
 
         $this->assertSame(2, $folders->count());
         $this->assertSame('folder-contact@kolab.org', $folders[0]->email);
         $this->assertSame('folder-event@kolab.org', $folders[1]->email);
 
         $folders = $jack->sharedFolders()->get();
 
         $this->assertSame(0, $folders->count());
     }
 
     /**
      * Test user restoring
      */
     public function testRestore(): void
     {
         Queue::fake();
 
         // Test an account with users and domain
         $userA = $this->getTestUser('UserAccountA@UserAccount.com', [
                 'status' => User::STATUS_LDAP_READY | User::STATUS_IMAP_READY | User::STATUS_SUSPENDED,
         ]);
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $domainA = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $domainB = $this->getTestDomain('UserAccountAdd.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $userA->assignPackage($package_kolab);
         $domainA->assignPackage($package_domain, $userA);
         $domainB->assignPackage($package_domain, $userA);
         $userA->assignPackage($package_kolab, $userB);
 
         $storage_sku = \App\Sku::withEnvTenantContext()->where('title', 'storage')->first();
         $now = \Carbon\Carbon::now();
         $wallet_id = $userA->wallets->first()->id;
 
         // add an extra storage entitlement
         $ent1 = \App\Entitlement::create([
                 'wallet_id' => $wallet_id,
                 'sku_id' => $storage_sku->id,
                 'cost' => 0,
                 'entitleable_id' => $userA->id,
                 'entitleable_type' => User::class,
         ]);
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
         $entitlementsDomain = \App\Entitlement::where('entitleable_id', $domainA->id);
 
         // First delete the user
         $userA->delete();
 
         $this->assertSame(0, $entitlementsA->count());
         $this->assertSame(0, $entitlementsB->count());
         $this->assertSame(0, $entitlementsDomain->count());
         $this->assertTrue($userA->fresh()->trashed());
         $this->assertTrue($userB->fresh()->trashed());
         $this->assertTrue($domainA->fresh()->trashed());
         $this->assertTrue($domainB->fresh()->trashed());
         $this->assertFalse($userA->isDeleted());
         $this->assertFalse($userB->isDeleted());
         $this->assertFalse($domainA->isDeleted());
 
         // Backdate one storage entitlement (it's not expected to be restored)
         \App\Entitlement::withTrashed()->where('id', $ent1->id)
             ->update(['deleted_at' => $now->copy()->subMinutes(2)]);
 
         // Backdate entitlements to assert that they were restored with proper updated_at timestamp
         \App\Entitlement::withTrashed()->where('wallet_id', $wallet_id)
             ->update(['updated_at' => $now->subMinutes(10)]);
 
         Queue::fake();
 
         // Then restore it
         $userA->restore();
         $userA->refresh();
 
         $this->assertFalse($userA->trashed());
         $this->assertFalse($userA->isDeleted());
         $this->assertFalse($userA->isSuspended());
         $this->assertFalse($userA->isLdapReady());
         $this->assertFalse($userA->isImapReady());
         $this->assertTrue($userA->isActive());
 
         $this->assertTrue($userB->fresh()->trashed());
         $this->assertTrue($domainB->fresh()->trashed());
         $this->assertFalse($domainA->fresh()->trashed());
 
         // Assert entitlements
         $this->assertSame(7, $entitlementsA->count()); // mailbox + groupware + 5 x storage
         $this->assertTrue($ent1->fresh()->trashed());
         $entitlementsA->get()->each(function ($ent) {
             $this->assertTrue($ent->updated_at->greaterThan(\Carbon\Carbon::now()->subSeconds(5)));
         });
 
         // We expect only CreateJob + UpdateJob pair for both user and domain.
         // Because how Illuminate/Database/Eloquent/SoftDeletes::restore() method
         // is implemented we cannot skip the UpdateJob in any way.
         // I don't want to overwrite this method, the extra job shouldn't do any harm.
         $this->assertCount(4, Queue::pushedJobs()); // @phpstan-ignore-line
         Queue::assertPushed(\App\Jobs\Domain\UpdateJob::class, 1);
         Queue::assertPushed(\App\Jobs\Domain\CreateJob::class, 1);
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
         Queue::assertPushed(\App\Jobs\User\CreateJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\User\CreateJob::class,
             function ($job) use ($userA) {
                 return $userA->id === TestCase::getObjectProperty($job, 'userId');
             }
         );
         Queue::assertPushedWithChain(
             \App\Jobs\User\CreateJob::class,
             [
                 \App\Jobs\User\VerifyJob::class,
             ]
         );
     }
 
     /**
      * Tests for UserAliasesTrait::setAliases()
      */
     public function testSetAliases(): void
     {
         Queue::fake();
         Queue::assertNothingPushed();
 
         $user = $this->getTestUser('UserAccountA@UserAccount.com');
         $domain = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
 
         $this->assertCount(0, $user->aliases->all());
 
         $user->tenant->setSetting('pgp.enable', 1);
 
         // Add an alias
         $user->setAliases(['UserAlias1@UserAccount.com']);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
         Queue::assertPushed(\App\Jobs\PGP\KeyCreateJob::class, 1);
 
         $user->tenant->setSetting('pgp.enable', 0);
 
         $aliases = $user->aliases()->get();
         $this->assertCount(1, $aliases);
         $this->assertSame('useralias1@useraccount.com', $aliases[0]['alias']);
 
         // Add another alias
         $user->setAliases(['UserAlias1@UserAccount.com', 'UserAlias2@UserAccount.com']);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 2);
         Queue::assertPushed(\App\Jobs\PGP\KeyCreateJob::class, 1);
 
         $aliases = $user->aliases()->orderBy('alias')->get();
         $this->assertCount(2, $aliases);
         $this->assertSame('useralias1@useraccount.com', $aliases[0]->alias);
         $this->assertSame('useralias2@useraccount.com', $aliases[1]->alias);
 
         $user->tenant->setSetting('pgp.enable', 1);
 
         // Remove an alias
         $user->setAliases(['UserAlias1@UserAccount.com']);
 
         $user->tenant->setSetting('pgp.enable', 0);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 3);
         Queue::assertPushed(\App\Jobs\PGP\KeyDeleteJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\PGP\KeyDeleteJob::class,
             function ($job) use ($user) {
                 $userId = TestCase::getObjectProperty($job, 'userId');
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 return $userId == $user->id && $userEmail === 'useralias2@useraccount.com';
             }
         );
 
         $aliases = $user->aliases()->get();
         $this->assertCount(1, $aliases);
         $this->assertSame('useralias1@useraccount.com', $aliases[0]['alias']);
 
         // Remove all aliases
         $user->setAliases([]);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 4);
 
         $this->assertCount(0, $user->aliases()->get());
     }
 
     /**
      * Tests for UserSettingsTrait::setSettings() and getSetting() and getSettings()
      */
     public function testUserSettings(): void
     {
         Queue::fake();
         Queue::assertNothingPushed();
 
         $user = $this->getTestUser('UserAccountA@UserAccount.com');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 0);
 
         // Test default settings
         // Note: Technicly this tests UserObserver::created() behavior
         $all_settings = $user->settings()->orderBy('key')->get();
         $this->assertCount(2, $all_settings);
         $this->assertSame('country', $all_settings[0]->key);
         $this->assertSame('CH', $all_settings[0]->value);
         $this->assertSame('currency', $all_settings[1]->key);
         $this->assertSame('CHF', $all_settings[1]->value);
 
         // Add a setting
         $user->setSetting('first_name', 'Firstname');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame('Firstname', $user->getSetting('first_name'));
         $this->assertSame('Firstname', $user->fresh()->getSetting('first_name'));
 
         // Update a setting
         $user->setSetting('first_name', 'Firstname1');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 2);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame('Firstname1', $user->getSetting('first_name'));
         $this->assertSame('Firstname1', $user->fresh()->getSetting('first_name'));
 
         // Delete a setting (null)
         $user->setSetting('first_name', null);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 3);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame(null, $user->getSetting('first_name'));
         $this->assertSame(null, $user->fresh()->getSetting('first_name'));
 
         // Delete a setting (empty string)
         $user->setSetting('first_name', 'Firstname1');
         $user->setSetting('first_name', '');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 5);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame(null, $user->getSetting('first_name'));
         $this->assertSame(null, $user->fresh()->getSetting('first_name'));
 
         // Set multiple settings at once
         $user->setSettings([
                 'first_name' => 'Firstname2',
                 'last_name' => 'Lastname2',
                 'country' => null,
         ]);
 
         // TODO: This really should create a single UserUpdate job, not 3
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 7);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame('Firstname2', $user->getSetting('first_name'));
         $this->assertSame('Firstname2', $user->fresh()->getSetting('first_name'));
         $this->assertSame('Lastname2', $user->getSetting('last_name'));
         $this->assertSame('Lastname2', $user->fresh()->getSetting('last_name'));
         $this->assertSame(null, $user->getSetting('country'));
         $this->assertSame(null, $user->fresh()->getSetting('country'));
 
         $all_settings = $user->settings()->orderBy('key')->get();
         $this->assertCount(3, $all_settings);
 
         // Test getSettings() method
         $this->assertSame(
             [
                 'first_name' => 'Firstname2',
                 'last_name' => 'Lastname2',
                 'unknown' => null,
             ],
             $user->getSettings(['first_name', 'last_name', 'unknown'])
         );
     }
 
     /**
      * Tests for User::users()
      */
     public function testUsers(): void
     {
         $jack = $this->getTestUser('jack@kolab.org');
         $joe = $this->getTestUser('joe@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $wallet = $john->wallets()->first();
 
         $users = $john->users()->orderBy('email')->get();
 
         $this->assertCount(4, $users);
         $this->assertEquals($jack->id, $users[0]->id);
         $this->assertEquals($joe->id, $users[1]->id);
         $this->assertEquals($john->id, $users[2]->id);
         $this->assertEquals($ned->id, $users[3]->id);
 
         $users = $jack->users()->orderBy('email')->get();
 
         $this->assertCount(0, $users);
 
         $users = $ned->users()->orderBy('email')->get();
 
         $this->assertCount(4, $users);
     }
 
+    /**
+     * Tests for User::walletOwner() (from EntitleableTrait)
+     */
+    public function testWalletOwner(): void
+    {
+        $jack = $this->getTestUser('jack@kolab.org');
+        $john = $this->getTestUser('john@kolab.org');
+        $ned = $this->getTestUser('ned@kolab.org');
+
+        $this->assertSame($john->id, $john->walletOwner()->id);
+        $this->assertSame($john->id, $jack->walletOwner()->id);
+        $this->assertSame($john->id, $ned->walletOwner()->id);
+
+        // User with no entitlements
+        $user = $this->getTestUser('UserAccountA@UserAccount.com');
+        $this->assertSame($user->id, $user->walletOwner()->id);
+    }
+
     /**
      * Tests for User::wallets()
      */
     public function testWallets(): void
     {
-        $this->markTestIncomplete();
+        $john = $this->getTestUser('john@kolab.org');
+        $ned = $this->getTestUser('ned@kolab.org');
+
+        $this->assertSame(1, $john->wallets()->count());
+        $this->assertCount(1, $john->wallets);
+        $this->assertInstanceOf(\App\Wallet::class, $john->wallets->first());
+
+        $this->assertSame(1, $ned->wallets()->count());
+        $this->assertCount(1, $ned->wallets);
+        $this->assertInstanceOf(\App\Wallet::class, $ned->wallets->first());
     }
 }
diff --git a/src/tests/Unit/Rules/PasswordTest.php b/src/tests/Unit/Rules/PasswordTest.php
new file mode 100644
index 00000000..2d4379aa
--- /dev/null
+++ b/src/tests/Unit/Rules/PasswordTest.php
@@ -0,0 +1,182 @@
+<?php
+
+namespace Tests\Unit\Rules;
+
+use App\Rules\Password;
+use Illuminate\Support\Facades\Validator;
+use Tests\TestCase;
+
+class PasswordTest extends TestCase
+{
+    /**
+     * Test password validation
+     */
+    public function testValidator(): void
+    {
+        $error = "Specified password does not comply with the policy.";
+
+        \config(['app.password_policy' => 'min:5']);
+        $this->assertSame($error, $this->validate('abcd'));
+        $this->assertSame(null, $this->validate('abcde'));
+
+        \config(['app.password_policy' => 'min:5,max:10']);
+        $this->assertSame($error, $this->validate('12345678901'));
+        $this->assertSame(null, $this->validate('1234567890'));
+
+        \config(['app.password_policy' => 'min:5,lower']);
+        $this->assertSame($error, $this->validate('12345'));
+        $this->assertSame($error, $this->validate('AAAAA'));
+        $this->assertSame(null, $this->validate('12345a'));
+
+        \config(['app.password_policy' => 'upper']);
+        $this->assertSame($error, $this->validate('5'));
+        $this->assertSame($error, $this->validate('a'));
+        $this->assertSame(null, $this->validate('A'));
+
+        \config(['app.password_policy' => 'digit']);
+        $this->assertSame($error, $this->validate('a'));
+        $this->assertSame($error, $this->validate('A'));
+        $this->assertSame(null, $this->validate('5'));
+
+        \config(['app.password_policy' => 'special']);
+        $this->assertSame($error, $this->validate('a'));
+        $this->assertSame($error, $this->validate('5'));
+        $this->assertSame(null, $this->validate('*'));
+        $this->assertSame(null, $this->validate('-'));
+
+        // Test with an account policy
+        $user = $this->getTestUser('john@kolab.org');
+        $user->setSetting('password_policy', 'min:10,upper');
+
+        $this->assertSame($error, $this->validate('aaa', $user));
+        $this->assertSame($error, $this->validate('1234567890', $user));
+        $this->assertSame(null, $this->validate('1234567890A', $user));
+    }
+
+    /**
+     * Test check() method
+     */
+    public function testCheck(): void
+    {
+        $pass = new Password();
+
+        \config(['app.password_policy' => 'min:5,max:10,upper,lower,digit']);
+        $result = $pass->check('abcd');
+
+        $this->assertCount(5, $result);
+        $this->assertSame('min', $result['min']['label']);
+        $this->assertSame('Minimum password length: 5 characters', $result['min']['name']);
+        $this->assertSame('5', $result['min']['param']);
+        $this->assertSame(true, $result['min']['enabled']);
+        $this->assertSame(false, $result['min']['status']);
+
+        $this->assertSame('max', $result['max']['label']);
+        $this->assertSame('Maximum password length: 10 characters', $result['max']['name']);
+        $this->assertSame('10', $result['max']['param']);
+        $this->assertSame(true, $result['max']['enabled']);
+        $this->assertSame(true, $result['max']['status']);
+
+        $this->assertSame('upper', $result['upper']['label']);
+        $this->assertSame('Password contains an upper-case character', $result['upper']['name']);
+        $this->assertSame(null, $result['upper']['param']);
+        $this->assertSame(true, $result['upper']['enabled']);
+        $this->assertSame(false, $result['upper']['status']);
+
+        $this->assertSame('lower', $result['lower']['label']);
+        $this->assertSame('Password contains a lower-case character', $result['lower']['name']);
+        $this->assertSame(null, $result['lower']['param']);
+        $this->assertSame(true, $result['lower']['enabled']);
+        $this->assertSame(true, $result['lower']['status']);
+
+        $this->assertSame('digit', $result['digit']['label']);
+        $this->assertSame('Password contains a digit', $result['digit']['name']);
+        $this->assertSame(null, $result['digit']['param']);
+        $this->assertSame(true, $result['digit']['enabled']);
+        $this->assertSame(false, $result['digit']['status']);
+    }
+
+    /**
+     * Test rules() method
+     */
+    public function testRules(): void
+    {
+        $user = $this->getTestUser('john@kolab.org');
+        $user->setSetting('password_policy', 'min:10,upper');
+
+        $pass = new Password($user);
+
+        \config(['app.password_policy' => 'min:5,max:10,digit']);
+
+        $result = $pass->rules();
+
+        $this->assertCount(2, $result);
+        $this->assertSame('min', $result['min']['label']);
+        $this->assertSame('Minimum password length: 10 characters', $result['min']['name']);
+        $this->assertSame('10', $result['min']['param']);
+        $this->assertSame(true, $result['min']['enabled']);
+
+        $this->assertSame('upper', $result['upper']['label']);
+        $this->assertSame('Password contains an upper-case character', $result['upper']['name']);
+        $this->assertSame(null, $result['upper']['param']);
+        $this->assertSame(true, $result['upper']['enabled']);
+
+        // Expect to see all supported policy rules
+        $result = $pass->rules(true);
+
+        $this->assertCount(6, $result);
+        $this->assertSame('min', $result['min']['label']);
+        $this->assertSame('Minimum password length: 10 characters', $result['min']['name']);
+        $this->assertSame('10', $result['min']['param']);
+        $this->assertSame(true, $result['min']['enabled']);
+
+        $this->assertSame('max', $result['max']['label']);
+        $this->assertSame('Maximum password length: 255 characters', $result['max']['name']);
+        $this->assertSame('255', $result['max']['param']);
+        $this->assertSame(false, $result['max']['enabled']);
+
+        $this->assertSame('upper', $result['upper']['label']);
+        $this->assertSame('Password contains an upper-case character', $result['upper']['name']);
+        $this->assertSame(null, $result['upper']['param']);
+        $this->assertSame(true, $result['upper']['enabled']);
+
+        $this->assertSame('lower', $result['lower']['label']);
+        $this->assertSame('Password contains a lower-case character', $result['lower']['name']);
+        $this->assertSame(null, $result['lower']['param']);
+        $this->assertSame(false, $result['lower']['enabled']);
+
+        $this->assertSame('digit', $result['digit']['label']);
+        $this->assertSame('Password contains a digit', $result['digit']['name']);
+        $this->assertSame(null, $result['digit']['param']);
+        $this->assertSame(false, $result['digit']['enabled']);
+
+        $this->assertSame('special', $result['special']['label']);
+        $this->assertSame('Password contains a special character', $result['special']['name']);
+        $this->assertSame(null, $result['digit']['param']);
+        $this->assertSame(false, $result['digit']['enabled']);
+    }
+
+    /**
+     * Validates the password using Laravel Validator API
+     *
+     * @param string     $password The password to validate
+     * @param ?\App\User $user     The account owner
+     *
+     * @return ?string Validation error message on error, NULL otherwise
+     */
+    private function validate($password, $user = null): ?string
+    {
+        // Instead of doing direct tests, we use validator to make sure
+        // it works with the framework api
+
+        $v = Validator::make(
+            ['password' => $password],
+            ['password' => new Password($user)]
+        );
+
+        if ($v->fails()) {
+            return $v->errors()->toArray()['password'][0];
+        }
+
+        return null;
+    }
+}