diff --git a/src/resources/js/app.js b/src/resources/js/app.js
index 2edc14af..14abd0eb 100644
--- a/src/resources/js/app.js
+++ b/src/resources/js/app.js
@@ -1,519 +1,522 @@
 /**
  * First we will load all of this project's JavaScript dependencies which
  * includes Vue and other libraries. It is a great starting point when
  * building robust, powerful web applications using Vue and Laravel.
  */
 
 require('./bootstrap')
 
 import AppComponent from '../vue/App'
 import MenuComponent from '../vue/Widgets/Menu'
 import SupportForm from '../vue/Widgets/SupportForm'
 import store from './store'
 import { loadLangAsync, i18n } from './locale'
 
 const loader = '<div class="app-loader"><div class="spinner-border" role="status"><span class="sr-only">Loading</span></div></div>'
 
 let isLoading = 0
 
 // Lock the UI with the 'loading...' element
 const startLoading = () => {
     isLoading++
     let loading = $('#app > .app-loader').removeClass('fadeOut')
     if (!loading.length) {
         $('#app').append($(loader))
     }
 }
 
 // Hide "loading" overlay
 const stopLoading = () => {
     if (isLoading > 0) {
         $('#app > .app-loader').addClass('fadeOut')
         isLoading--;
     }
 }
 
 let loadingRoute
 
 // Note: This has to be before the app is created
 // Note: You cannot use app inside of the function
 window.router.beforeEach((to, from, next) => {
     // check if the route requires authentication and user is not logged in
     if (to.meta.requiresAuth && !store.state.isLoggedIn) {
         // remember the original request, to use after login
         store.state.afterLogin = to;
 
         // redirect to login page
         next({ name: 'login' })
 
         return
     }
 
     if (to.meta.loading) {
         startLoading()
         loadingRoute = to.name
     }
 
     next()
 })
 
 window.router.afterEach((to, from) => {
     if (to.name && loadingRoute === to.name) {
         stopLoading()
         loadingRoute = null
     }
 
     // When changing a page remove old:
     // - error page
     // - modal backdrop
     $('#error-page,.modal-backdrop.show').remove()
 })
 
 const app = new Vue({
     components: {
         AppComponent,
         MenuComponent,
     },
     i18n,
     store,
     router: window.router,
     data() {
         return {
             isAdmin: window.isAdmin,
             appName: window.config['app.name'],
             appUrl: window.config['app.url'],
             themeDir: '/themes/' + window.config['app.theme']
         }
     },
     methods: {
         // Clear (bootstrap) form validation state
         clearFormValidation(form) {
             $(form).find('.is-invalid').removeClass('is-invalid')
             $(form).find('.invalid-feedback').remove()
         },
         hasPermission(type) {
             const authInfo = store.state.authInfo
             const key = 'enable' + type.charAt(0).toUpperCase() + type.slice(1)
             return !!(authInfo && authInfo.statusInfo[key])
         },
         hasRoute(name) {
             return this.$router.resolve({ name: name }).resolved.matched.length > 0
         },
         hasSKU(name) {
             const authInfo = store.state.authInfo
             return authInfo.statusInfo.skus && authInfo.statusInfo.skus.indexOf(name) != -1
         },
         isController(wallet_id) {
             if (wallet_id && store.state.authInfo) {
                 let i
                 for (i = 0; i < store.state.authInfo.wallets.length; i++) {
                     if (wallet_id == store.state.authInfo.wallets[i].id) {
                         return true
                     }
                 }
                 for (i = 0; i < store.state.authInfo.accounts.length; i++) {
                     if (wallet_id == store.state.authInfo.accounts[i].id) {
                         return true
                     }
                 }
             }
 
             return false
         },
         // Set user state to "logged in"
         loginUser(response, dashboard, update) {
             if (!update) {
                 store.commit('logoutUser') // destroy old state data
                 store.commit('loginUser')
             }
 
             localStorage.setItem('token', response.access_token)
             axios.defaults.headers.common.Authorization = 'Bearer ' + response.access_token
 
             if (response.email) {
                 store.state.authInfo = response
             }
 
             if (dashboard !== false) {
                 this.$router.push(store.state.afterLogin || { name: 'dashboard' })
             }
 
             store.state.afterLogin = null
 
             // Refresh the token before it expires
             let timeout = response.expires_in || 0
 
             // We'll refresh 60 seconds before the token expires
             if (timeout > 60) {
                 timeout -= 60
             }
 
             // TODO: We probably should try a few times in case of an error
             // TODO: We probably should prevent axios from doing any requests
             //       while the token is being refreshed
 
             this.refreshTimeout = setTimeout(() => {
                 axios.post('/api/auth/refresh').then(response => {
                     this.loginUser(response.data, false, true)
                 })
             }, timeout * 1000)
         },
         // Set user state to "not logged in"
         logoutUser(redirect) {
             store.commit('logoutUser')
             localStorage.setItem('token', '')
             delete axios.defaults.headers.common.Authorization
 
             if (redirect !== false) {
                 this.$router.push({ name: 'login' })
             }
 
             clearTimeout(this.refreshTimeout)
         },
         logo(mode) {
             let src = this.appUrl + this.themeDir + '/images/logo_' + (mode || 'header') + '.png'
 
             return `<img src="${src}" alt="${this.appName}">`
         },
         // Display "loading" overlay inside of the specified element
         addLoader(elem, small = true) {
             $(elem).css({position: 'relative'}).append(small ? $(loader).addClass('small') : $(loader))
         },
         // Remove loader element added in addLoader()
         removeLoader(elem) {
             $(elem).find('.app-loader').remove()
         },
         startLoading,
         stopLoading,
         isLoading() {
             return isLoading > 0
         },
-        errorPage(code, msg) {
+        errorPage(code, msg, hint) {
             // Until https://github.com/vuejs/vue-router/issues/977 is implemented
             // we can't really use router to display error page as it has two side
             // effects: it changes the URL and adds the error page to browser history.
             // For now we'll be replacing current view with error page "manually".
             const map = {
                 400: "Bad request",
                 401: "Unauthorized",
                 403: "Access denied",
                 404: "Not found",
                 405: "Method not allowed",
                 500: "Internal server error"
             }
 
             if (!msg) msg = map[code] || "Unknown Error"
+            if (!hint) hint = ''
 
-            const error_page = `<div id="error-page" class="error-page"><div class="code">${code}</div><div class="message">${msg}</div></div>`
+            const error_page = '<div id="error-page" class="error-page">'
+                + `<div class="code">${code}</div><div class="message">${msg}</div><div class="hint">${hint}</div>`
+                + '</div>'
 
             $('#error-page').remove()
             $('#app').append(error_page)
 
             app.updateBodyClass('error')
         },
         errorHandler(error) {
             this.stopLoading()
 
             if (!error.response) {
                 // TODO: probably network connection error
             } else if (error.response.status === 401) {
                 // Remember requested route to come back to it after log in
                 if (this.$route.meta.requiresAuth) {
                     store.state.afterLogin = this.$route
                     this.logoutUser()
                 } else {
                     this.logoutUser(false)
                 }
             } else {
                 this.errorPage(error.response.status, error.response.statusText)
             }
         },
         downloadFile(url) {
             // TODO: This might not be a best way for big files as the content
             //       will be stored (temporarily) in browser memory
             // TODO: This method does not show the download progress in the browser
             //       but it could be implemented in the UI, axios has 'progress' property
             axios.get(url, { responseType: 'blob' })
                 .then(response => {
                     const link = document.createElement('a')
                     const contentDisposition = response.headers['content-disposition']
                     let filename = 'unknown'
 
                     if (contentDisposition) {
                         const match = contentDisposition.match(/filename="(.+)"/);
                         if (match.length === 2) {
                             filename = match[1];
                         }
                     }
 
                     link.href = window.URL.createObjectURL(response.data)
                     link.download = filename
                     link.click()
                 })
         },
         price(price, currency) {
             return ((price || 0) / 100).toLocaleString('de-DE', { style: 'currency', currency: currency || 'CHF' })
         },
         priceLabel(cost, discount) {
             let index = ''
 
             if (discount) {
                 cost = Math.floor(cost * ((100 - discount) / 100))
                 index = '\u00B9'
             }
 
             return this.price(cost) + '/month' + index
         },
         clickRecord(event) {
             if (!/^(a|button|svg|path)$/i.test(event.target.nodeName)) {
                 let link = $(event.target).closest('tr').find('a')[0]
                 if (link) {
                     link.click()
                 }
             }
         },
         domainStatusClass(domain) {
             if (domain.isDeleted) {
                 return 'text-muted'
             }
 
             if (domain.isSuspended) {
                 return 'text-warning'
             }
 
             if (!domain.isVerified || !domain.isLdapReady || !domain.isConfirmed) {
                 return 'text-danger'
             }
 
             return 'text-success'
         },
         domainStatusText(domain) {
             if (domain.isDeleted) {
                 return 'Deleted'
             }
 
             if (domain.isSuspended) {
                 return 'Suspended'
             }
 
             if (!domain.isVerified || !domain.isLdapReady || !domain.isConfirmed) {
                 return 'Not Ready'
             }
 
             return 'Active'
         },
         distlistStatusClass(list) {
             if (list.isDeleted) {
                 return 'text-muted'
             }
 
             if (list.isSuspended) {
                 return 'text-warning'
             }
 
             if (!list.isLdapReady) {
                 return 'text-danger'
             }
 
             return 'text-success'
         },
         distlistStatusText(list) {
             if (list.isDeleted) {
                 return 'Deleted'
             }
 
             if (list.isSuspended) {
                 return 'Suspended'
             }
 
             if (!list.isLdapReady) {
                 return 'Not Ready'
             }
 
             return 'Active'
         },
         pageName(path) {
             let page = this.$route.path
 
             // check if it is a "menu page", find the page name
             // otherwise we'll use the real path as page name
             window.config.menu.every(item => {
                 if (item.location == page && item.page) {
                     page = item.page
                     return false
                 }
             })
 
             page = page.replace(/^\//, '')
 
             return page ? page : '404'
         },
         supportDialog(container) {
             let dialog = $('#support-dialog')
 
             // FIXME: Find a nicer way of doing this
             if (!dialog.length) {
                 let form = new Vue(SupportForm)
                 form.$mount($('<div>').appendTo(container)[0])
                 form.$root = this
                 form.$toast = this.$toast
                 dialog = $(form.$el)
             }
 
             dialog.on('shown.bs.modal', () => {
                     dialog.find('input').first().focus()
                 }).modal()
         },
         userStatusClass(user) {
             if (user.isDeleted) {
                 return 'text-muted'
             }
 
             if (user.isSuspended) {
                 return 'text-warning'
             }
 
             if (!user.isImapReady || !user.isLdapReady) {
                 return 'text-danger'
             }
 
             return 'text-success'
         },
         userStatusText(user) {
             if (user.isDeleted) {
                 return 'Deleted'
             }
 
             if (user.isSuspended) {
                 return 'Suspended'
             }
 
             if (!user.isImapReady || !user.isLdapReady) {
                 return 'Not Ready'
             }
 
             return 'Active'
         },
         updateBodyClass(name) {
             // Add 'class' attribute to the body, different for each page
             // so, we can apply page-specific styles
             document.body.className = 'page-' + (name || this.pageName()).replace(/\/.*$/, '')
         }
     }
 })
 
 // Fetch the locale file and the start the app
 loadLangAsync().then(() => app.$mount('#app'))
 
 // Add a axios request interceptor
 window.axios.interceptors.request.use(
     config => {
         // This is the only way I found to change configuration options
         // on a running application. We need this for browser testing.
         config.headers['X-Test-Payment-Provider'] = window.config.paymentProvider
 
         return config
     },
     error => {
         // Do something with request error
         return Promise.reject(error)
     }
 )
 
 // Add a axios response interceptor for general/validation error handler
 window.axios.interceptors.response.use(
     response => {
         if (response.config.onFinish) {
             response.config.onFinish()
         }
 
         return response
     },
     error => {
         let error_msg
         let status = error.response ? error.response.status : 200
 
         // Do not display the error in a toast message, pass the error as-is
         if (error.config.ignoreErrors) {
             return Promise.reject(error)
         }
 
         if (error.config.onFinish) {
             error.config.onFinish()
         }
 
         if (error.response && status == 422) {
             error_msg = "Form validation error"
 
             const modal = $('div.modal.show')
 
             $(modal.length ? modal : 'form').each((i, form) => {
                 form = $(form)
 
                 $.each(error.response.data.errors || {}, (idx, msg) => {
                     const input_name = (form.data('validation-prefix') || form.find('form').first().data('validation-prefix') || '') + idx
                     let input = form.find('#' + input_name)
 
                     if (!input.length) {
                         input = form.find('[name="' + input_name + '"]');
                     }
 
                     if (input.length) {
                         // Create an error message\
                         // API responses can use a string, array or object
                         let msg_text = ''
                         if ($.type(msg) !== 'string') {
                             $.each(msg, (index, str) => {
                                 msg_text += str + ' '
                             })
                         }
                         else {
                             msg_text = msg
                         }
 
                         let feedback = $('<div class="invalid-feedback">').text(msg_text)
 
                         if (input.is('.list-input')) {
                             // List input widget
                             let controls = input.children(':not(:first-child)')
 
                             if (!controls.length && typeof msg == 'string') {
                                 // this is an empty list (the main input only)
                                 // and the error message is not an array
                                 input.find('.main-input').addClass('is-invalid')
                             } else {
                                 controls.each((index, element) => {
                                     if (msg[index]) {
                                         $(element).find('input').addClass('is-invalid')
                                     }
                                 })
                             }
 
                             input.addClass('is-invalid').next('.invalid-feedback').remove()
                             input.after(feedback)
                         }
                         else {
                             // Standard form element
                             input.addClass('is-invalid')
                             input.parent().find('.invalid-feedback').remove()
                             input.parent().append(feedback)
                         }
                     }
                 })
 
                 form.find('.is-invalid:not(.listinput-widget)').first().focus()
             })
         }
         else if (error.response && error.response.data) {
             error_msg = error.response.data.message
         }
         else {
             error_msg = error.request ? error.request.statusText : error.message
         }
 
         app.$toast.error(error_msg || "Server Error")
 
         // Pass the error as-is
         return Promise.reject(error)
     }
 )
diff --git a/src/resources/js/routes-user.js b/src/resources/js/routes-user.js
index b31a1204..4585d61d 100644
--- a/src/resources/js/routes-user.js
+++ b/src/resources/js/routes-user.js
@@ -1,124 +1,124 @@
 import DashboardComponent from '../vue/Dashboard'
 import DistlistInfoComponent from '../vue/Distlist/Info'
 import DistlistListComponent from '../vue/Distlist/List'
 import DomainInfoComponent from '../vue/Domain/Info'
 import DomainListComponent from '../vue/Domain/List'
 import LoginComponent from '../vue/Login'
 import LogoutComponent from '../vue/Logout'
 import MeetComponent from '../vue/Rooms'
 import PageComponent from '../vue/Page'
 import PasswordResetComponent from '../vue/PasswordReset'
 import SignupComponent from '../vue/Signup'
 import UserInfoComponent from '../vue/User/Info'
 import UserListComponent from '../vue/User/List'
 import UserProfileComponent from '../vue/User/Profile'
 import UserProfileDeleteComponent from '../vue/User/ProfileDelete'
 import WalletComponent from '../vue/Wallet'
 
 // Here's a list of lazy-loaded components
 // Note: you can pack multiple components into the same chunk, webpackChunkName
 // is also used to get a sensible file name instead of numbers
 const RoomComponent = () => import(/* webpackChunkName: "room" */ '../vue/Meet/Room.vue')
 
 const routes = [
     {
         path: '/dashboard',
         name: 'dashboard',
         component: DashboardComponent,
         meta: { requiresAuth: true }
     },
     {
         path: '/distlist/:list',
         name: 'distlist',
         component: DistlistInfoComponent,
-        meta: { requiresAuth: true }
+        meta: { requiresAuth: true, perm: 'distlists' }
     },
     {
         path: '/distlists',
         name: 'distlists',
         component: DistlistListComponent,
-        meta: { requiresAuth: true }
+        meta: { requiresAuth: true, perm: 'distlists' }
     },
     {
         path: '/domain/:domain',
         name: 'domain',
         component: DomainInfoComponent,
-        meta: { requiresAuth: true }
+        meta: { requiresAuth: true, perm: 'domains' }
     },
     {
         path: '/domains',
         name: 'domains',
         component: DomainListComponent,
-        meta: { requiresAuth: true }
+        meta: { requiresAuth: true, perm: 'domains' }
     },
     {
         path: '/login',
         name: 'login',
         component: LoginComponent
     },
     {
         path: '/logout',
         name: 'logout',
         component: LogoutComponent
     },
     {
         path: '/password-reset/:code?',
         name: 'password-reset',
         component: PasswordResetComponent
     },
     {
         path: '/profile',
         name: 'profile',
         component: UserProfileComponent,
         meta: { requiresAuth: true }
     },
     {
         path: '/profile/delete',
         name: 'profile-delete',
         component: UserProfileDeleteComponent,
         meta: { requiresAuth: true }
     },
     {
         component: RoomComponent,
         name: 'room',
         path: '/meet/:room',
         meta: { loading: true }
     },
     {
         path: '/rooms',
         name: 'rooms',
         component: MeetComponent,
         meta: { requiresAuth: true }
     },
     {
         path: '/signup/:param?',
         alias: '/signup/voucher/:param',
         name: 'signup',
         component: SignupComponent
     },
     {
         path: '/user/:user',
         name: 'user',
         component: UserInfoComponent,
-        meta: { requiresAuth: true }
+        meta: { requiresAuth: true, perm: 'users' }
     },
     {
         path: '/users',
         name: 'users',
         component: UserListComponent,
-        meta: { requiresAuth: true }
+        meta: { requiresAuth: true, perm: 'users' }
     },
     {
         path: '/wallet',
         name: 'wallet',
         component: WalletComponent,
-        meta: { requiresAuth: true }
+        meta: { requiresAuth: true, perm: 'wallets' }
     },
     {
         name: '404',
         path: '*',
         component: PageComponent
     }
 ]
 
 export default routes
diff --git a/src/resources/themes/app.scss b/src/resources/themes/app.scss
index c5b8c840..96ce40c3 100644
--- a/src/resources/themes/app.scss
+++ b/src/resources/themes/app.scss
@@ -1,452 +1,460 @@
 html,
 body,
 body > .outer-container {
     height: 100%;
 }
 
 #app {
     display: flex;
     flex-direction: column;
     min-height: 100%;
     overflow: hidden;
 
     & > nav {
         flex-shrink: 0;
         z-index: 12;
     }
 
     & > div.container {
         flex-grow: 1;
         margin-top: 2rem;
         margin-bottom: 2rem;
     }
 
     & > .filler {
         flex-grow: 1;
     }
 
     & > div.container + .filler {
         display: none;
     }
 }
 
 .error-page {
     position: absolute;
     top: 0;
     height: 100%;
     width: 100%;
+    align-content: center;
     align-items: center;
     display: flex;
+    flex-wrap: wrap;
     justify-content: center;
     color: #636b6f;
     z-index: 10;
     background: white;
 
     .code {
         text-align: right;
         border-right: 2px solid;
         font-size: 26px;
         padding: 0 15px;
     }
 
     .message {
         font-size: 18px;
         padding: 0 15px;
     }
+
+    .hint {
+        margin-top: 3em;
+        text-align: center;
+        width: 100%;
+    }
 }
 
 .app-loader {
     background-color: $body-bg;
     height: 100%;
     width: 100%;
     position: absolute;
     top: 0;
     left: 0;
     display: flex;
     align-items: center;
     justify-content: center;
     z-index: 8;
 
     .spinner-border {
         width: 120px;
         height: 120px;
         border-width: 15px;
         color: #b2aa99;
     }
 
     &.small .spinner-border {
         width: 25px;
         height: 25px;
         border-width: 3px;
     }
 
     &.fadeOut {
         visibility: hidden;
         opacity: 0;
         transition: visibility 300ms linear, opacity 300ms linear;
     }
 }
 
 pre {
     margin: 1rem 0;
     padding: 1rem;
     background-color: $menu-bg-color;
 }
 
 .card-title {
     font-size: 1.2rem;
     font-weight: bold;
 }
 
 tfoot.table-fake-body {
     background-color: #f8f8f8;
     color: grey;
     text-align: center;
 
     td {
         vertical-align: middle;
         height: 8em;
         border: 0;
     }
 
     tbody:not(:empty) + & {
         display: none;
     }
 }
 
 table {
     td.buttons,
     td.email,
     td.price,
     td.datetime,
     td.selection {
         width: 1%;
         white-space: nowrap;
     }
 
     th.price,
     td.price {
         width: 1%;
         text-align: right;
         white-space: nowrap;
     }
 
     &.form-list {
         margin: 0;
 
         td {
             border: 0;
 
             &:first-child {
                 padding-left: 0;
             }
 
             &:last-child {
                 padding-right: 0;
             }
         }
 
         button {
             line-height: 1;
         }
     }
 
     .btn-action {
         line-height: 1;
         padding: 0;
     }
 }
 
 .list-details {
     min-height: 1em;
 
     & > ul {
         margin: 0;
         padding-left: 1.2em;
     }
 }
 
 .plan-selector {
     .plan-header {
         display: flex;
     }
 
     .plan-ico {
         margin:auto;
         font-size: 3.8rem;
         color: #f1a539;
         border: 3px solid #f1a539;
         width: 6rem;
         height: 6rem;
         border-radius: 50%;
     }
 }
 
 .status-message {
     display: flex;
     align-items: center;
     justify-content: center;
 
     .app-loader {
         width: auto;
         position: initial;
 
         .spinner-border {
             color: $body-color;
         }
     }
 
     svg {
         font-size: 1.5em;
     }
 
     :first-child {
         margin-right: 0.4em;
     }
 }
 
 .form-separator {
     position: relative;
     margin: 1em 0;
     display: flex;
     justify-content: center;
 
     hr {
         border-color: #999;
         margin: 0;
         position: absolute;
         top: 0.75em;
         width: 100%;
     }
 
     span {
         background: #fff;
         padding: 0 1em;
         z-index: 1;
     }
 }
 
 #status-box {
     background-color: lighten($green, 35);
 
     .progress {
         background-color: #fff;
         height: 10px;
     }
 
     .progress-label {
         font-size: 0.9em;
     }
 
     .progress-bar {
         background-color: $green;
     }
 
     &.process-failed {
         background-color: lighten($orange, 30);
 
         .progress-bar {
             background-color: $red;
         }
     }
 }
 
 @keyframes blinker {
     50% {
         opacity: 0;
     }
 }
 
 .blinker {
     animation: blinker 750ms step-start infinite;
 }
 
 #dashboard-nav {
     display: flex;
     flex-wrap: wrap;
     justify-content: center;
 
     & > a {
         padding: 1rem;
         text-align: center;
         white-space: nowrap;
         margin: 0.25rem;
         text-decoration: none;
         width: 150px;
 
         &.disabled {
             pointer-events: none;
             opacity: 0.6;
         }
 
         .badge {
             position: absolute;
             top: 0.5rem;
             right: 0.5rem;
         }
     }
 
     svg {
         width: 6rem;
         height: 6rem;
         margin: auto;
     }
 }
 
 #payment-method-selection {
     display: flex;
     flex-wrap: wrap;
     justify-content: center;
 
     & > a {
         padding: 1rem;
         text-align: center;
         white-space: nowrap;
         margin: 0.25rem;
         text-decoration: none;
         width: 150px;
     }
 
     svg {
         width: 6rem;
         height: 6rem;
         margin: auto;
     }
 }
 
 #logon-form {
     flex-basis: auto; // Bootstrap issue? See logon page with width < 992
 }
 
 #logon-form-footer {
     a:not(:first-child) {
         margin-left: 2em;
     }
 }
 
 // Various improvements for mobile
 @include media-breakpoint-down(sm) {
     .card,
     .card-footer {
         border: 0;
     }
 
     .card-body {
         padding: 0.5rem 0;
     }
 
     .form-group {
         margin-bottom: 0.5rem;
     }
 
     .nav-tabs {
         flex-wrap: nowrap;
         overflow-x: auto;
 
         .nav-link {
             white-space: nowrap;
             padding: 0.5rem 0.75rem;
         }
     }
 
     .tab-content {
         margin-top: 0.5rem;
     }
 
     .col-form-label {
         color: #666;
         font-size: 95%;
     }
 
     .form-group.plaintext .col-form-label {
         padding-bottom: 0;
     }
 
     form.read-only.short label {
         width: 35%;
 
         & + * {
             width: 65%;
         }
     }
 
     #app > div.container {
         margin-bottom: 1rem;
         margin-top: 1rem;
         max-width: 100%;
     }
 
     #header-menu-navbar {
         padding: 0;
     }
 
     #dashboard-nav > a {
         width: 135px;
     }
 
     .table-sm:not(.form-list) {
         tbody td {
             padding: 0.75rem 0.5rem;
 
             svg {
                 vertical-align: -0.175em;
             }
 
             & > svg {
                 font-size: 125%;
                 margin-right: 0.25rem;
             }
         }
     }
 
     .table.transactions {
         thead {
             display: none;
         }
 
         tbody {
             tr {
                 position: relative;
                 display: flex;
                 flex-wrap: wrap;
             }
 
             td {
                 width: auto;
                 border: 0;
                 padding: 0.5rem;
 
                 &.datetime {
                     width: 50%;
                     padding-left: 0;
                 }
 
                 &.description {
                     order: 3;
                     width: 100%;
                     border-bottom: 1px solid $border-color;
                     color: $secondary;
                     padding: 0 1.5em 0.5rem 0;
                     margin-top: -0.25em;
                 }
 
                 &.selection {
                     position: absolute;
                     right: 0;
                     border: 0;
                     top: 1.7em;
                     padding-right: 0;
                 }
 
                 &.price {
                     width: 50%;
                     padding-right: 0;
                 }
 
                 &.email {
                     display: none;
                 }
             }
         }
     }
 }
diff --git a/src/resources/vue/App.vue b/src/resources/vue/App.vue
index b30fd825..46f5fca0 100644
--- a/src/resources/vue/App.vue
+++ b/src/resources/vue/App.vue
@@ -1,91 +1,110 @@
 <template>
-    <router-view v-if="!isLoading && !routerReloading" :key="key" @hook:mounted="childMounted"></router-view>
+    <router-view v-if="!isLoading && !routerReloading && key" :key="key" @hook:mounted="childMounted"></router-view>
 </template>
 
 <script>
     export default {
         data() {
             return {
                 isLoading: true,
                 routerReloading: false
             }
         },
         computed: {
             key() {
+                // Display 403 error page if the current user has no permission to a specified page
+                // Note that it's the only place I found that allows us to do this.
+                if (this.$route.meta.perm && !this.checkPermission(this.$route.meta.perm)) {
+                    // Returning false here will block the page component from execution,
+                    // as we're using the key in v-if condition on the router-view above
+                    return false
+                }
+
                 // The 'key' property is used to reload the Page component
                 // whenever a route changes. Normally vue does not do that.
                 return this.$route.name == '404' ? this.$route.path : 'static'
             }
         },
         mounted() {
             const token = localStorage.getItem('token')
 
             if (token) {
                 this.$root.startLoading()
                 axios.defaults.headers.common.Authorization = 'Bearer ' + token
 
                 axios.get('/api/auth/info?refresh_token=1')
                     .then(response => {
                         this.$root.loginUser(response.data, false)
                         this.$root.stopLoading()
                         this.isLoading = false
                     })
                     .catch(error => {
                         // Release lock on the router-view, otherwise links (e.g. Logout) will not work
                         this.isLoading = false
                         this.$root.logoutUser(false)
                         this.$root.errorHandler(error)
                     })
             } else {
                 this.isLoading = false
             }
         },
         methods: {
+            checkPermission(type) {
+                if (this.$root.hasPermission(type)) {
+                    return true
+                }
+
+                const hint = type == 'wallets' ? "Only account owners can access a wallet." : ''
+
+                this.$root.errorPage(403, null, hint)
+
+                return false
+            },
             childMounted() {
                 this.$root.updateBodyClass()
                 this.getFAQ()
             },
             getFAQ() {
                 let page = this.$route.path
 
                 if (page == '/' || page == '/login') {
                     return
                 }
 
                 axios.get('/content/faq' + page, { ignoreErrors: true })
                     .then(response => {
                         const result = response.data.faq
                         $('#faq').remove()
                         if (result && result.length) {
                             let faq = $('<div id="faq" class="faq mt-3"><h5>FAQ</h5><ul class="pl-4"></ul></div>')
                             let list = []
 
                             result.forEach(item => {
                                 list.push($('<li>').append($('<a>').attr('href', item.href).text(item.title)))
 
                                 // Handle internal links with the vue-router
                                 if (item.href.charAt(0) == '/') {
                                     list[list.length-1].find('a').on('click', event => {
                                         event.preventDefault()
                                         this.$router.push(item.href)
                                     })
                                 }
                             })
 
                             faq.find('ul').append(list)
                             $(this.$el).append(faq)
                         }
                     })
             },
             routerReload() {
                 // Together with beforeRouteUpdate even on a route component
                 // allows us to force reload the component. So it is possible
                 // to jump from/to page that uses currently loaded component.
                 this.routerReloading = true
                 this.$nextTick().then(() => {
                     this.routerReloading = false
                 })
             }
         }
     }
 </script>
diff --git a/src/resources/vue/Distlist/Info.vue b/src/resources/vue/Distlist/Info.vue
index f9a91cd6..8722a7dd 100644
--- a/src/resources/vue/Distlist/Info.vue
+++ b/src/resources/vue/Distlist/Info.vue
@@ -1,110 +1,105 @@
 <template>
     <div class="container">
         <status-component v-if="list_id !== 'new'" :status="status" @status-update="statusUpdate"></status-component>
 
         <div class="card" id="distlist-info">
             <div class="card-body">
                 <div class="card-title" v-if="list_id !== 'new'">
                     Distribution list
                     <button class="btn btn-outline-danger button-delete float-right" @click="deleteList()" tag="button">
                         <svg-icon icon="trash-alt"></svg-icon> Delete list
                     </button>
                 </div>
                 <div class="card-title" v-if="list_id === 'new'">New distribution list</div>
                 <div class="card-text">
                     <form @submit.prevent="submit">
                         <div v-if="list_id !== 'new'" class="form-group row plaintext">
                             <label for="status" class="col-sm-4 col-form-label">Status</label>
                             <div class="col-sm-8">
                                 <span :class="$root.distlistStatusClass(list) + ' form-control-plaintext'" id="status">{{ $root.distlistStatusText(list) }}</span>
                             </div>
                         </div>
                         <div class="form-group row">
                             <label for="email" class="col-sm-4 col-form-label">Email</label>
                             <div class="col-sm-8">
                                 <input type="text" class="form-control" id="email" :disabled="list_id !== 'new'" required v-model="list.email">
                             </div>
                         </div>
                         <div class="form-group row">
                             <label for="members-input" class="col-sm-4 col-form-label">Recipients</label>
                             <div class="col-sm-8">
                                 <list-input id="members" :list="list.members"></list-input>
                             </div>
                         </div>
                         <button class="btn btn-primary" type="submit"><svg-icon icon="check"></svg-icon> Submit</button>
                     </form>
                 </div>
             </div>
         </div>
     </div>
 </template>
 
 <script>
     import ListInput from '../Widgets/ListInput'
     import StatusComponent from '../Widgets/Status'
 
     export default {
         components: {
             ListInput,
             StatusComponent
         },
         data() {
             return {
                 list_id: null,
                 list: { members: [] },
                 status: {}
             }
         },
         created() {
-            if (!this.$root.hasPermission('distlists')) {
-                this.$root.errorPage(404)
-                return
-            }
-
             this.list_id = this.$route.params.list
 
             if (this.list_id != 'new') {
                 this.$root.startLoading()
 
                 axios.get('/api/v4/groups/' + this.list_id)
                     .then(response => {
                         this.$root.stopLoading()
                         this.list = response.data
                         this.status = response.data.statusInfo
                     })
                     .catch(this.$root.errorHandler)
             }
         },
         methods: {
             deleteList() {
                 axios.delete('/api/v4/groups/' + this.list_id)
                     .then(response => {
                         if (response.data.status == 'success') {
                             this.$toast.success(response.data.message)
                             this.$router.push({ name: 'distlists' })
                         }
                     })
             },
             statusUpdate(list) {
                 this.list = Object.assign({}, this.list, list)
             },
             submit() {
                 this.$root.clearFormValidation($('#list-info form'))
 
                 let method = 'post'
                 let location = '/api/v4/groups'
 
                 if (this.list_id !== 'new') {
                     method = 'put'
                     location += '/' + this.list_id
                 }
 
                 axios[method](location, this.list)
                     .then(response => {
                         this.$toast.success(response.data.message)
                         this.$router.push({ name: 'distlists' })
                     })
             }
         }
     }
 </script>
diff --git a/src/resources/vue/Distlist/List.vue b/src/resources/vue/Distlist/List.vue
index 8070dff6..eb41315d 100644
--- a/src/resources/vue/Distlist/List.vue
+++ b/src/resources/vue/Distlist/List.vue
@@ -1,63 +1,56 @@
 <template>
     <div class="container">
         <div class="card" id="distlist-list">
             <div class="card-body">
                 <div class="card-title">
                     Distribution lists
                     <router-link class="btn btn-success float-right create-list" :to="{ path: 'distlist/new' }" tag="button">
                         <svg-icon icon="users"></svg-icon> Create list
                     </router-link>
                 </div>
                 <div class="card-text">
                     <table class="table table-sm table-hover">
                         <thead class="thead-light">
                             <tr>
                                 <th scope="col">Email</th>
                             </tr>
                         </thead>
                         <tbody>
                             <tr v-for="list in lists" :key="list.id" @click="$root.clickRecord">
                                 <td>
                                     <svg-icon icon="users" :class="$root.distlistStatusClass(list)" :title="$root.distlistStatusText(list)"></svg-icon>
                                     <router-link :to="{ path: 'distlist/' + list.id }">{{ list.email }}</router-link>
                                 </td>
                             </tr>
                         </tbody>
                         <tfoot class="table-fake-body">
                             <tr>
                                 <td>There are no distribution lists in this account.</td>
                             </tr>
                         </tfoot>
                     </table>
                 </div>
             </div>
         </div>
     </div>
 </template>
 
 <script>
     export default {
         data() {
             return {
                 lists: []
             }
         },
         created() {
-            // TODO: Find a way to do this in some more global way. Note that it cannot
-            //       be done in the vue-router, but maybe the app component?
-            if (!this.$root.hasPermission('distlists')) {
-                this.$root.errorPage(404)
-                return
-            }
-
             this.$root.startLoading()
 
             axios.get('/api/v4/groups')
                 .then(response => {
                     this.$root.stopLoading()
                     this.lists = response.data
                 })
                 .catch(this.$root.errorHandler)
         }
     }
 </script>
diff --git a/src/tests/Browser.php b/src/tests/Browser.php
index 33d6cbf3..b69fdba4 100644
--- a/src/tests/Browser.php
+++ b/src/tests/Browser.php
@@ -1,266 +1,266 @@
 <?php
 
 namespace Tests;
 
 use Facebook\WebDriver\WebDriverKeys;
 use PHPUnit\Framework\Assert;
 use Tests\Browser\Components\Error;
 use Tests\Browser\Components\Toast;
 
 /**
  * Laravel Dusk Browser extensions
  */
 class Browser extends \Laravel\Dusk\Browser
 {
     /**
      * Assert that the given element attribute contains specified text.
      */
     public function assertAttributeRegExp($selector, $attribute, $regexp)
     {
         $element = $this->resolver->findOrFail($selector);
         $value   = (string) $element->getAttribute($attribute);
 
         Assert::assertRegExp($regexp, $value, "No expected text in [$selector][$attribute]. Found: $value");
 
         return $this;
     }
 
     /**
      * Assert number of (visible) elements
      */
     public function assertElementsCount($selector, $expected_count, $visible = true)
     {
         $elements = $this->elements($selector);
         $count = count($elements);
 
         if ($visible) {
             foreach ($elements as $element) {
                 if (!$element->isDisplayed()) {
                     $count--;
                 }
             }
         }
 
         Assert::assertEquals($expected_count, $count, "Count of [$selector] elements is not $expected_count");
 
         return $this;
     }
 
     /**
      * Assert Tip element content
      */
     public function assertTip($selector, $content)
     {
         return $this->click($selector)
             ->withinBody(function ($browser) use ($content) {
                 $browser->waitFor('div.tooltip .tooltip-inner')
                     ->assertSeeIn('div.tooltip .tooltip-inner', $content);
             })
             ->click($selector);
     }
 
     /**
      * Assert Toast element content (and close it)
      */
     public function assertToast(string $type, string $message, $title = null)
     {
         return $this->withinBody(function ($browser) use ($type, $title, $message) {
             $browser->with(new Toast($type), function (Browser $browser) use ($title, $message) {
                 $browser->assertToastTitle($title)
                     ->assertToastMessage($message)
                         ->closeToast();
             });
         });
     }
 
     /**
      * Assert specified error page is displayed.
      */
-    public function assertErrorPage(int $error_code)
+    public function assertErrorPage(int $error_code, string $hint = '')
     {
-        $this->with(new Error($error_code), function ($browser) {
+        $this->with(new Error($error_code, $hint), function ($browser) {
             // empty, assertions will be made by the Error component itself
         });
 
         return $this;
     }
 
     /**
      * Assert that the given element has specified class assigned.
      */
     public function assertHasClass($selector, $class_name)
     {
         $element = $this->resolver->findOrFail($selector);
         $classes = explode(' ', (string) $element->getAttribute('class'));
 
         Assert::assertContains($class_name, $classes, "[$selector] has no class '{$class_name}'");
 
         return $this;
     }
 
     /**
      * Assert that the given element is readonly
      */
     public function assertReadonly($selector)
     {
         $element = $this->resolver->findOrFail($selector);
         $value = $element->getAttribute('readonly');
 
         Assert::assertTrue($value == 'true', "Element [$selector] is not readonly");
 
         return $this;
     }
 
     /**
      * Assert that the given element is not readonly
      */
     public function assertNotReadonly($selector)
     {
         $element = $this->resolver->findOrFail($selector);
         $value = $element->getAttribute('readonly');
 
         Assert::assertTrue($value != 'true', "Element [$selector] is not readonly");
 
         return $this;
     }
 
     /**
      * Assert that the given element contains specified text,
      * no matter it's displayed or not.
      */
     public function assertText($selector, $text)
     {
         $element = $this->resolver->findOrFail($selector);
 
         if ($text === '') {
             Assert::assertTrue((string) $element->getText() === $text, "Element's text is not empty [$selector]");
         } else {
             Assert::assertTrue(strpos($element->getText(), $text) !== false, "No expected text in [$selector]");
         }
 
         return $this;
     }
 
     /**
      * Assert that the given element contains specified text,
      * no matter it's displayed or not - using a regular expression.
      */
     public function assertTextRegExp($selector, $regexp)
     {
         $element = $this->resolver->findOrFail($selector);
 
         Assert::assertRegExp($regexp, $element->getText(), "No expected text in [$selector]");
 
         return $this;
     }
 
     /**
      * Remove all toast messages
      */
     public function clearToasts()
     {
         $this->script("jQuery('.toast-container > *').remove()");
 
         return $this;
     }
 
     /**
      * Wait until a button becomes enabled and click it
      */
     public function clickWhenEnabled($selector)
     {
         return $this->waitFor($selector . ':not([disabled])')->click($selector);
     }
 
     /**
      * Check if in Phone mode
      */
     public static function isPhone()
     {
         return getenv('TESTS_MODE') == 'phone';
     }
 
     /**
      * Check if in Tablet mode
      */
     public static function isTablet()
     {
         return getenv('TESTS_MODE') == 'tablet';
     }
 
     /**
      * Check if in Desktop mode
      */
     public static function isDesktop()
     {
         return !self::isPhone() && !self::isTablet();
     }
 
     /**
      * Returns content of a downloaded file
      */
     public function readDownloadedFile($filename, $sleep = 5)
     {
         $filename = __DIR__ . "/Browser/downloads/$filename";
 
         // Give the browser a chance to finish download
         if (!file_exists($filename) && $sleep) {
             sleep($sleep);
         }
 
         Assert::assertFileExists($filename);
 
         return file_get_contents($filename);
     }
 
     /**
      * Removes downloaded file
      */
     public function removeDownloadedFile($filename)
     {
         @unlink(__DIR__ . "/Browser/downloads/$filename");
 
         return $this;
     }
 
     /**
      * Clears the input field and related vue v-model data.
      */
     public function vueClear($selector)
     {
         if ($this->resolver->prefix != 'body') {
             $selector = $this->resolver->prefix . ' ' . $selector;
         }
 
         // The existing clear(), and type() with empty string do not work.
         // We have to clear the field and dispatch 'input' event programatically.
 
         $this->script(
             "var element = document.querySelector('$selector');"
             . "element.value = '';"
             . "element.dispatchEvent(new Event('input'))"
         );
 
         return $this;
     }
 
     /**
      * Execute code within body context.
      * Useful to execute code that selects elements outside of a component context
      */
     public function withinBody($callback)
     {
         if ($this->resolver->prefix != 'body') {
             $orig_prefix = $this->resolver->prefix;
             $this->resolver->prefix = 'body';
         }
 
         call_user_func($callback, $this);
 
         if (isset($orig_prefix)) {
             $this->resolver->prefix = $orig_prefix;
         }
 
         return $this;
     }
 }
diff --git a/src/tests/Browser/Components/Error.php b/src/tests/Browser/Components/Error.php
index ae5eb39e..4214906d 100644
--- a/src/tests/Browser/Components/Error.php
+++ b/src/tests/Browser/Components/Error.php
@@ -1,67 +1,76 @@
 <?php
 
 namespace Tests\Browser\Components;
 
 use Laravel\Dusk\Component as BaseComponent;
 use PHPUnit\Framework\Assert as PHPUnit;
 
 class Error extends BaseComponent
 {
     protected $code;
+    protected $hint;
     protected $message;
     protected $messages_map = [
         400 => "Bad request",
         401 => "Unauthorized",
         403 => "Access denied",
         404 => "Not found",
         405 => "Method not allowed",
         500 => "Internal server error",
     ];
 
-    public function __construct($code)
+    public function __construct($code, $hint = '')
     {
         $this->code = $code;
+        $this->hint = $hint;
         $this->message = $this->messages_map[$code];
     }
 
     /**
      * Get the root selector for the component.
      *
      * @return string
      */
     public function selector()
     {
         return '#error-page';
     }
 
     /**
      * Assert that the browser page contains the component.
      *
      * @param \Laravel\Dusk\Browser $browser
      *
      * @return void
      */
     public function assert($browser)
     {
         $browser->waitFor($this->selector())
             ->assertSeeIn('@code', $this->code);
 
+        if ($this->hint) {
+            $browser->assertSeeIn('@hint', $this->hint);
+        } else {
+            $browser->assertMissing('@hint');
+        }
+
         $message = $browser->text('@message');
         PHPUnit::assertSame(strtolower($message), strtolower($this->message));
     }
 
     /**
      * Get the element shortcuts for the component.
      *
      * @return array
      */
     public function elements()
     {
         $selector = $this->selector();
 
         return [
             '@code' => "$selector .code",
             '@message' =>  "$selector .message",
+            '@hint' =>  "$selector .hint",
         ];
     }
 }
diff --git a/src/tests/Browser/DistlistTest.php b/src/tests/Browser/DistlistTest.php
index 2a83ff22..cf0c39a3 100644
--- a/src/tests/Browser/DistlistTest.php
+++ b/src/tests/Browser/DistlistTest.php
@@ -1,266 +1,266 @@
 <?php
 
 namespace Tests\Browser;
 
 use App\Group;
 use App\Sku;
 use Tests\Browser;
 use Tests\Browser\Components\ListInput;
 use Tests\Browser\Components\Status;
 use Tests\Browser\Components\Toast;
 use Tests\Browser\Pages\Dashboard;
 use Tests\Browser\Pages\Home;
 use Tests\Browser\Pages\DistlistInfo;
 use Tests\Browser\Pages\DistlistList;
 use Tests\TestCaseDusk;
 
 class DistlistTest extends TestCaseDusk
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestGroup('group-test@kolab.org');
         $this->clearBetaEntitlements();
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestGroup('group-test@kolab.org');
         $this->clearBetaEntitlements();
 
         parent::tearDown();
     }
 
     /**
      * Test distlist info page (unauthenticated)
      */
     public function testInfoUnauth(): void
     {
         // Test that the page requires authentication
         $this->browse(function (Browser $browser) {
             $browser->visit('/distlist/abc')->on(new Home());
         });
     }
 
     /**
      * Test distlist list page (unauthenticated)
      */
     public function testListUnauth(): void
     {
         // Test that the page requires authentication
         $this->browse(function (Browser $browser) {
             $browser->visit('/distlists')->on(new Home());
         });
     }
 
     /**
      * Test distlist list page
      */
     public function testList(): void
     {
         // Log on the user
         $this->browse(function (Browser $browser) {
             $browser->visit(new Home())
                 ->submitLogon('john@kolab.org', 'simple123', true)
                 ->on(new Dashboard())
                 ->assertMissing('@links .link-distlists');
         });
 
         // Test that Distribution lists page is not accessible without the 'distlist' entitlement
         $this->browse(function (Browser $browser) {
             $browser->visit('/distlists')
-                ->assertErrorPage(404);
+                ->assertErrorPage(403);
         });
 
         // Create a single group, add beta+distlist entitlements
         $john = $this->getTestUser('john@kolab.org');
         $this->addDistlistEntitlement($john);
         $group = $this->getTestGroup('group-test@kolab.org');
         $group->assignToWallet($john->wallets->first());
 
         // Test distribution lists page
         $this->browse(function (Browser $browser) {
             $browser->visit(new Dashboard())
                 ->assertSeeIn('@links .link-distlists', 'Distribution lists')
                 ->click('@links .link-distlists')
                 ->on(new DistlistList())
                 ->whenAvailable('@table', function (Browser $browser) {
                     $browser->waitFor('tbody tr')
                         ->assertElementsCount('tbody tr', 1)
                         ->assertSeeIn('tbody tr:nth-child(1) a', 'group-test@kolab.org')
                         ->assertText('tbody tr:nth-child(1) svg.text-danger title', 'Not Ready')
                         ->assertMissing('tfoot');
                 });
         });
     }
 
     /**
      * Test distlist creation/editing/deleting
      *
      * @depends testList
      */
     public function testCreateUpdateDelete(): void
     {
         // Test that the page is not available accessible without the 'distlist' entitlement
         $this->browse(function (Browser $browser) {
             $browser->visit('/distlist/new')
-                ->assertErrorPage(404);
+                ->assertErrorPage(403);
         });
 
         // Add beta+distlist entitlements
         $john = $this->getTestUser('john@kolab.org');
         $this->addDistlistEntitlement($john);
 
         $this->browse(function (Browser $browser) {
             // Create a group
             $browser->visit(new DistlistList())
                 ->assertSeeIn('button.create-list', 'Create list')
                 ->click('button.create-list')
                 ->on(new DistlistInfo())
                 ->assertSeeIn('#distlist-info .card-title', 'New distribution list')
                 ->with('@form', function (Browser $browser) {
                     // Assert form content
                     $browser->assertMissing('#status')
                         ->assertSeeIn('div.row:nth-child(1) label', 'Email')
                         ->assertValue('div.row:nth-child(1) input[type=text]', '')
                         ->assertSeeIn('div.row:nth-child(2) label', 'Recipients')
                         ->assertVisible('div.row:nth-child(2) .list-input')
                         ->with(new ListInput('#members'), function (Browser $browser) {
                             $browser->assertListInputValue([])
                                 ->assertValue('@input', '');
                         })
                         ->assertSeeIn('button[type=submit]', 'Submit');
                 })
                 // Test error conditions
                 ->type('#email', 'group-test@kolabnow.com')
                 ->click('button[type=submit]')
                 ->waitFor('#email + .invalid-feedback')
                 ->assertSeeIn('#email + .invalid-feedback', 'The specified domain is not available.')
                 ->assertFocused('#email')
                 ->waitFor('#members + .invalid-feedback')
                 ->assertSeeIn('#members + .invalid-feedback', 'At least one recipient is required.')
                 ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                 // Test successful group creation
                 ->type('#email', 'group-test@kolab.org')
                 ->with(new ListInput('#members'), function (Browser $browser) {
                     $browser->addListEntry('test1@gmail.com')
                         ->addListEntry('test2@gmail.com');
                 })
                 ->click('button[type=submit]')
                 ->assertToast(Toast::TYPE_SUCCESS, 'Distribution list created successfully.')
                 ->on(new DistlistList())
                 ->assertElementsCount('@table tbody tr', 1);
 
             // Test group update
             $browser->click('@table tr:nth-child(1) a')
                 ->on(new DistlistInfo())
                 ->assertSeeIn('#distlist-info .card-title', 'Distribution list')
                 ->with('@form', function (Browser $browser) {
                     // Assert form content
                     $browser->assertSeeIn('div.row:nth-child(1) label', 'Status')
                         ->assertSeeIn('div.row:nth-child(1) span.text-danger', 'Not Ready')
                         ->assertSeeIn('div.row:nth-child(2) label', 'Email')
                         ->assertValue('div.row:nth-child(2) input[type=text]:disabled', 'group-test@kolab.org')
                         ->assertSeeIn('div.row:nth-child(3) label', 'Recipients')
                         ->assertVisible('div.row:nth-child(3) .list-input')
                         ->with(new ListInput('#members'), function (Browser $browser) {
                             $browser->assertListInputValue(['test1@gmail.com', 'test2@gmail.com'])
                                 ->assertValue('@input', '');
                         })
                         ->assertSeeIn('button[type=submit]', 'Submit');
                 })
                 // Test error handling
                 ->with(new ListInput('#members'), function (Browser $browser) {
                     $browser->addListEntry('invalid address');
                 })
                 ->click('button[type=submit]')
                 ->waitFor('#members + .invalid-feedback')
                 ->assertSeeIn('#members + .invalid-feedback', 'The specified email address is invalid.')
                 ->assertVisible('#members .input-group:nth-child(4) input.is-invalid')
                 ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                 // Test successful update
                 ->with(new ListInput('#members'), function (Browser $browser) {
                     $browser->removeListEntry(3)->removeListEntry(2);
                 })
                 ->click('button[type=submit]')
                 ->assertToast(Toast::TYPE_SUCCESS, 'Distribution list updated successfully.')
                 ->assertMissing('.invalid-feedback')
                 ->on(new DistlistList())
                 ->assertElementsCount('@table tbody tr', 1);
 
             $group = Group::where('email', 'group-test@kolab.org')->first();
             $this->assertSame(['test1@gmail.com'], $group->members);
 
             // Test group deletion
             $browser->click('@table tr:nth-child(1) a')
                 ->on(new DistlistInfo())
                 ->assertSeeIn('button.button-delete', 'Delete list')
                 ->click('button.button-delete')
                 ->assertToast(Toast::TYPE_SUCCESS, 'Distribution list deleted successfully.')
                 ->on(new DistlistList())
                 ->assertElementsCount('@table tbody tr', 0)
                 ->assertVisible('@table tfoot');
 
             $this->assertNull(Group::where('email', 'group-test@kolab.org')->first());
         });
     }
 
     /**
      * Test distribution list status
      *
      * @depends testList
      */
     public function testStatus(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $this->addDistlistEntitlement($john);
         $group = $this->getTestGroup('group-test@kolab.org');
         $group->assignToWallet($john->wallets->first());
         $group->status = Group::STATUS_NEW | Group::STATUS_ACTIVE;
         $group->save();
 
         $this->assertFalse($group->isLdapReady());
 
         $this->browse(function ($browser) use ($group) {
             // Test auto-refresh
             $browser->visit('/distlist/' . $group->id)
                 ->on(new DistlistInfo())
                 ->with(new Status(), function ($browser) {
                     $browser->assertSeeIn('@body', 'We are preparing the distribution list')
                         ->assertProgress(83, 'Creating a distribution list...', 'pending')
                         ->assertMissing('@refresh-button')
                         ->assertMissing('@refresh-text')
                         ->assertMissing('#status-link')
                         ->assertMissing('#status-verify');
                 });
 
             $group->status |= Group::STATUS_LDAP_READY;
             $group->save();
 
             // Test Verify button
             $browser->waitUntilMissing('@status', 10);
         });
 
         // TODO: Test all group statuses on the list
     }
 
 
     /**
      * Register the beta + distlist entitlements for the user
      */
     private function addDistlistEntitlement($user): void
     {
         // Add beta+distlist entitlements
         $beta_sku = Sku::where('title', 'beta')->first();
         $distlist_sku = Sku::where('title', 'distlist')->first();
         $user->assignSku($beta_sku);
         $user->assignSku($distlist_sku);
     }
 }
diff --git a/src/tests/Browser/Pages/Home.php b/src/tests/Browser/Pages/Home.php
index 0cc87564..6bffbd17 100644
--- a/src/tests/Browser/Pages/Home.php
+++ b/src/tests/Browser/Pages/Home.php
@@ -1,87 +1,88 @@
 <?php
 
 namespace Tests\Browser\Pages;
 
 use Laravel\Dusk\Page;
 
 class Home extends Page
 {
     /**
      * Get the URL for the page.
      *
      * @return string
      */
     public function url()
     {
         return '/login';
     }
 
     /**
      * Assert that the browser is on the page.
      *
      * @param \Laravel\Dusk\Browser $browser The browser object
      *
      * @return void
      */
     public function assert($browser)
     {
         $browser->waitForLocation($this->url())
             ->waitUntilMissing('.app-loader')
             ->assertVisible('form.form-signin');
     }
 
     /**
      * Get the element shortcuts for the page.
      *
      * @return array
      */
     public function elements()
     {
         return [
             '@app' => '#app',
             '@email-input' => '#inputEmail',
             '@password-input' => '#inputPassword',
             '@second-factor-input' => '#secondfactor',
             '@logon-button' => '#logon-form button.btn-primary'
         ];
     }
 
     /**
      * Submit logon form.
      *
      * @param \Laravel\Dusk\Browser $browser  The browser object
      * @param string                $username User name
      * @param string                $password User password
      * @param bool                  $wait_for_dashboard
      * @param array                 $config   Client-site config
      *
      * @return void
      */
     public function submitLogon(
         $browser,
         $username,
         $password,
         $wait_for_dashboard = false,
         $config = []
     ) {
-        $browser->type('@email-input', $username)
+        $browser->clearToasts()
+            ->type('@email-input', $username)
             ->type('@password-input', $password);
 
         if ($username == 'ned@kolab.org') {
             $code = \App\Auth\SecondFactor::code('ned@kolab.org');
             $browser->type('@second-factor-input', $code);
         }
 
         if (!empty($config)) {
             $browser->script(
                 sprintf('Object.assign(window.config, %s)', \json_encode($config))
             );
         }
 
         $browser->press('form button');
 
         if ($wait_for_dashboard) {
             $browser->waitForLocation('/dashboard');
         }
     }
 }
diff --git a/src/tests/Browser/UserProfileTest.php b/src/tests/Browser/UserProfileTest.php
index bbd5d2a2..1058c66c 100644
--- a/src/tests/Browser/UserProfileTest.php
+++ b/src/tests/Browser/UserProfileTest.php
@@ -1,194 +1,193 @@
 <?php
 
 namespace Tests\Browser;
 
 use App\User;
 use Tests\Browser;
 use Tests\Browser\Components\Toast;
 use Tests\Browser\Pages\Dashboard;
 use Tests\Browser\Pages\Home;
 use Tests\Browser\Pages\UserProfile;
 use Tests\TestCaseDusk;
 use Illuminate\Foundation\Testing\DatabaseMigrations;
 
 class UserProfileTest extends TestCaseDusk
 {
     private $profile = [
         'first_name' => 'John',
         'last_name' => 'Doe',
         'currency' => 'USD',
         'country' => 'US',
         'billing_address' => "601 13th Street NW\nSuite 900 South\nWashington, DC 20005",
         'external_email' => 'john.doe.external@gmail.com',
         'phone' => '+1 509-248-1111',
         'organization' => 'Kolab Developers',
     ];
 
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         User::where('email', 'john@kolab.org')->first()->setSettings($this->profile);
         $this->deleteTestUser('profile-delete@kolabnow.com');
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         User::where('email', 'john@kolab.org')->first()->setSettings($this->profile);
         $this->deleteTestUser('profile-delete@kolabnow.com');
 
         parent::tearDown();
     }
 
     /**
      * Test profile page (unauthenticated)
      */
     public function testProfileUnauth(): void
     {
         // Test that the page requires authentication
         $this->browse(function (Browser $browser) {
             $browser->visit('/profile')->on(new Home());
         });
     }
 
     /**
      * Test profile page
      */
     public function testProfile(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->visit(new Home())
                 ->submitLogon('john@kolab.org', 'simple123', true)
                 ->on(new Dashboard())
                 ->assertSeeIn('@links .link-profile', 'Your profile')
                 ->click('@links .link-profile')
                 ->on(new UserProfile())
                 ->assertSeeIn('#user-profile .button-delete', 'Delete account')
                 ->whenAvailable('@form', function (Browser $browser) {
                     $user = User::where('email', 'john@kolab.org')->first();
                     // Assert form content
                     $browser->assertFocused('div.row:nth-child(2) input')
                         ->assertSeeIn('div.row:nth-child(1) label', 'Customer No.')
                         ->assertSeeIn('div.row:nth-child(1) .form-control-plaintext', $user->id)
                         ->assertSeeIn('div.row:nth-child(2) label', 'First name')
                         ->assertValue('div.row:nth-child(2) input[type=text]', $this->profile['first_name'])
                         ->assertSeeIn('div.row:nth-child(3) label', 'Last name')
                         ->assertValue('div.row:nth-child(3) input[type=text]', $this->profile['last_name'])
                         ->assertSeeIn('div.row:nth-child(4) label', 'Organization')
                         ->assertValue('div.row:nth-child(4) input[type=text]', $this->profile['organization'])
                         ->assertSeeIn('div.row:nth-child(5) label', 'Phone')
                         ->assertValue('div.row:nth-child(5) input[type=text]', $this->profile['phone'])
                         ->assertSeeIn('div.row:nth-child(6) label', 'External email')
                         ->assertValue('div.row:nth-child(6) input[type=text]', $this->profile['external_email'])
                         ->assertSeeIn('div.row:nth-child(7) label', 'Address')
                         ->assertValue('div.row:nth-child(7) textarea', $this->profile['billing_address'])
                         ->assertSeeIn('div.row:nth-child(8) label', 'Country')
                         ->assertValue('div.row:nth-child(8) select', $this->profile['country'])
                         ->assertSeeIn('div.row:nth-child(9) label', 'Password')
                         ->assertValue('div.row:nth-child(9) input[type=password]', '')
                         ->assertSeeIn('div.row:nth-child(10) label', 'Confirm password')
                         ->assertValue('div.row:nth-child(10) input[type=password]', '')
                         ->assertSeeIn('button[type=submit]', 'Submit');
 
                     // Test form error handling
                     $browser->type('#phone', 'aaaaaa')
                         ->type('#external_email', 'bbbbb')
                         ->click('button[type=submit]')
                         ->waitFor('#phone + .invalid-feedback')
                         ->assertSeeIn('#phone + .invalid-feedback', 'The phone format is invalid.')
                         ->assertSeeIn(
                             '#external_email + .invalid-feedback',
                             'The external email must be a valid email address.'
                         )
                         ->assertFocused('#phone')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                         ->clearToasts();
 
                     // Clear all fields and submit
                     // FIXME: Should any of these fields be required?
                     $browser->vueClear('#first_name')
                         ->vueClear('#last_name')
                         ->vueClear('#organization')
                         ->vueClear('#phone')
                         ->vueClear('#external_email')
                         ->vueClear('#billing_address')
                         ->click('button[type=submit]')
                         ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');
                 })
                 // On success we're redirected to Dashboard
                 ->on(new Dashboard());
         });
     }
 
     /**
      * Test profile of non-controller user
      */
     public function testProfileNonController(): void
     {
         // Test acting as non-controller
         $this->browse(function (Browser $browser) {
             $browser->visit('/logout')
                 ->visit(new Home())
                 ->submitLogon('jack@kolab.org', 'simple123', true)
                 ->on(new Dashboard())
                 ->assertSeeIn('@links .link-profile', 'Your profile')
                 ->click('@links .link-profile')
                 ->on(new UserProfile())
                 ->assertMissing('#user-profile .button-delete')
                 ->whenAvailable('@form', function (Browser $browser) {
                     // TODO: decide on what fields the non-controller user should be able
                     //       to see/change
                 });
 
             // Test that /profile/delete page is not accessible
             $browser->visit('/profile/delete')
                 ->assertErrorPage(403);
         });
     }
 
     /**
      * Test profile delete page
      */
     public function testProfileDelete(): void
     {
         $user = $this->getTestUser('profile-delete@kolabnow.com', ['password' => 'simple123']);
 
         $this->browse(function (Browser $browser) use ($user) {
             $browser->visit('/logout')
                 ->on(new Home())
                 ->submitLogon('profile-delete@kolabnow.com', 'simple123', true)
                 ->on(new Dashboard())
-                ->clearToasts()
                 ->assertSeeIn('@links .link-profile', 'Your profile')
                 ->click('@links .link-profile')
                 ->on(new UserProfile())
                 ->click('#user-profile .button-delete')
                 ->waitForLocation('/profile/delete')
                 ->assertSeeIn('#user-delete .card-title', 'Delete this account?')
                 ->assertSeeIn('#user-delete .button-cancel', 'Cancel')
                 ->assertSeeIn('#user-delete .card-text', 'This operation is irreversible')
                 ->assertFocused('#user-delete .button-cancel')
                 ->click('#user-delete .button-cancel')
                 ->waitForLocation('/profile')
                 ->on(new UserProfile());
 
             // Test deleting the user
             $browser->click('#user-profile .button-delete')
                 ->waitForLocation('/profile/delete')
                 ->click('#user-delete .button-delete')
                 ->waitForLocation('/login')
                 ->assertToast(Toast::TYPE_SUCCESS, 'User deleted successfully.');
 
             $this->assertTrue($user->fresh()->trashed());
         });
     }
 
     // TODO: Test that Ned (John's "delegatee") can delete himself
     // TODO: Test that Ned (John's "delegatee") can/can't delete John ?
 }
diff --git a/src/tests/Browser/UsersTest.php b/src/tests/Browser/UsersTest.php
index 86aff858..c877cb23 100644
--- a/src/tests/Browser/UsersTest.php
+++ b/src/tests/Browser/UsersTest.php
@@ -1,716 +1,713 @@
 <?php
 
 namespace Tests\Browser;
 
 use App\Discount;
 use App\Entitlement;
 use App\Sku;
 use App\User;
 use App\UserAlias;
 use Tests\Browser;
 use Tests\Browser\Components\Dialog;
 use Tests\Browser\Components\ListInput;
 use Tests\Browser\Components\QuotaInput;
 use Tests\Browser\Components\Toast;
 use Tests\Browser\Pages\Dashboard;
 use Tests\Browser\Pages\Home;
 use Tests\Browser\Pages\UserInfo;
 use Tests\Browser\Pages\UserList;
 use Tests\TestCaseDusk;
 use Illuminate\Foundation\Testing\DatabaseMigrations;
 
 class UsersTest extends TestCaseDusk
 {
     private $profile = [
         'first_name' => 'John',
         'last_name' => 'Doe',
         'organization' => 'Kolab Developers',
     ];
 
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('julia.roberts@kolab.org');
 
         $john = User::where('email', 'john@kolab.org')->first();
         $john->setSettings($this->profile);
         UserAlias::where('user_id', $john->id)
             ->where('alias', 'john.test@kolab.org')->delete();
 
         Entitlement::where('entitleable_id', $john->id)->whereIn('cost', [25, 100])->delete();
         Entitlement::where('cost', '>=', 5000)->delete();
 
         $wallet = $john->wallets()->first();
         $wallet->discount()->dissociate();
         $wallet->save();
 
         $this->clearBetaEntitlements();
         $this->clearMeetEntitlements();
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser('julia.roberts@kolab.org');
 
         $john = User::where('email', 'john@kolab.org')->first();
         $john->setSettings($this->profile);
         UserAlias::where('user_id', $john->id)
             ->where('alias', 'john.test@kolab.org')->delete();
 
         Entitlement::where('entitleable_id', $john->id)->whereIn('cost', [25, 100])->delete();
         Entitlement::where('cost', '>=', 5000)->delete();
 
         $wallet = $john->wallets()->first();
         $wallet->discount()->dissociate();
         $wallet->save();
 
         $this->clearBetaEntitlements();
         $this->clearMeetEntitlements();
 
         parent::tearDown();
     }
 
     /**
      * Test user info page (unauthenticated)
      */
     public function testInfoUnauth(): void
     {
         // Test that the page requires authentication
         $this->browse(function (Browser $browser) {
             $user = User::where('email', 'john@kolab.org')->first();
 
             $browser->visit('/user/' . $user->id)->on(new Home());
         });
     }
 
     /**
      * Test users list page (unauthenticated)
      */
     public function testListUnauth(): void
     {
         // Test that the page requires authentication
         $this->browse(function (Browser $browser) {
             $browser->visit('/users')->on(new Home());
         });
     }
 
     /**
      * Test users list page
      */
     public function testList(): void
     {
         // Test that the page requires authentication
         $this->browse(function (Browser $browser) {
             $browser->visit(new Home())
                 ->submitLogon('john@kolab.org', 'simple123', true)
                 ->on(new Dashboard())
                 ->assertSeeIn('@links .link-users', 'User accounts')
                 ->click('@links .link-users')
                 ->on(new UserList())
                 ->whenAvailable('@table', function (Browser $browser) {
                     $browser->waitFor('tbody tr')
                         ->assertElementsCount('tbody tr', 4)
                         ->assertSeeIn('tbody tr:nth-child(1) a', 'jack@kolab.org')
                         ->assertSeeIn('tbody tr:nth-child(2) a', 'joe@kolab.org')
                         ->assertSeeIn('tbody tr:nth-child(3) a', 'john@kolab.org')
                         ->assertSeeIn('tbody tr:nth-child(4) a', 'ned@kolab.org')
                         ->assertMissing('tfoot');
                 });
         });
     }
 
     /**
      * Test user account editing page (not profile page)
      *
      * @depends testList
      */
     public function testInfo(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->on(new UserList())
                 ->click('@table tr:nth-child(3) a')
                 ->on(new UserInfo())
                 ->assertSeeIn('#user-info .card-title', 'User account')
                 ->with('@form', function (Browser $browser) {
                     // Assert form content
                     $browser->assertSeeIn('div.row:nth-child(1) label', 'Status')
                         ->assertSeeIn('div.row:nth-child(1) #status', 'Active')
                         ->assertFocused('div.row:nth-child(2) input')
                         ->assertSeeIn('div.row:nth-child(2) label', 'First name')
                         ->assertValue('div.row:nth-child(2) input[type=text]', $this->profile['first_name'])
                         ->assertSeeIn('div.row:nth-child(3) label', 'Last name')
                         ->assertValue('div.row:nth-child(3) input[type=text]', $this->profile['last_name'])
                         ->assertSeeIn('div.row:nth-child(4) label', 'Organization')
                         ->assertValue('div.row:nth-child(4) input[type=text]', $this->profile['organization'])
                         ->assertSeeIn('div.row:nth-child(5) label', 'Email')
                         ->assertValue('div.row:nth-child(5) input[type=text]', 'john@kolab.org')
                         ->assertDisabled('div.row:nth-child(5) input[type=text]')
                         ->assertSeeIn('div.row:nth-child(6) label', 'Email aliases')
                         ->assertVisible('div.row:nth-child(6) .list-input')
                         ->with(new ListInput('#aliases'), function (Browser $browser) {
                             $browser->assertListInputValue(['john.doe@kolab.org'])
                                 ->assertValue('@input', '');
                         })
                         ->assertSeeIn('div.row:nth-child(7) label', 'Password')
                         ->assertValue('div.row:nth-child(7) input[type=password]', '')
                         ->assertSeeIn('div.row:nth-child(8) label', 'Confirm password')
                         ->assertValue('div.row:nth-child(8) input[type=password]', '')
                         ->assertSeeIn('button[type=submit]', 'Submit')
                         // Clear some fields and submit
                         ->vueClear('#first_name')
                         ->vueClear('#last_name')
                         ->click('button[type=submit]');
                 })
                 ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.')
                 ->on(new UserList())
                 ->click('@table tr:nth-child(3) a')
                 ->on(new UserInfo())
                 ->assertSeeIn('#user-info .card-title', 'User account')
                 ->with('@form', function (Browser $browser) {
                     // Test error handling (password)
                     $browser->type('#password', 'aaaaaa')
                         ->vueClear('#password_confirmation')
                         ->click('button[type=submit]')
                         ->waitFor('#password + .invalid-feedback')
                         ->assertSeeIn('#password + .invalid-feedback', 'The password confirmation does not match.')
                         ->assertFocused('#password')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
 
                     // TODO: Test password change
 
                     // Test form error handling (aliases)
                     $browser->vueClear('#password')
                         ->vueClear('#password_confirmation')
                         ->with(new ListInput('#aliases'), function (Browser $browser) {
                             $browser->addListEntry('invalid address');
                         })
                         ->click('button[type=submit]')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error');
 
                     $browser->with(new ListInput('#aliases'), function (Browser $browser) {
                         $browser->assertFormError(2, 'The specified alias is invalid.', false);
                     });
 
                     // Test adding aliases
                     $browser->with(new ListInput('#aliases'), function (Browser $browser) {
                         $browser->removeListEntry(2)
                             ->addListEntry('john.test@kolab.org');
                     })
                         ->click('button[type=submit]')
                         ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');
                 })
                 ->on(new UserList())
                 ->click('@table tr:nth-child(3) a')
                 ->on(new UserInfo());
 
             $john = User::where('email', 'john@kolab.org')->first();
             $alias = UserAlias::where('user_id', $john->id)->where('alias', 'john.test@kolab.org')->first();
             $this->assertTrue(!empty($alias));
 
             // Test subscriptions
             $browser->with('@form', function (Browser $browser) {
                 $browser->assertSeeIn('div.row:nth-child(9) label', 'Subscriptions')
                     ->assertVisible('@skus.row:nth-child(9)')
                     ->with('@skus', function ($browser) {
                         $browser->assertElementsCount('tbody tr', 6)
                             // Mailbox SKU
                             ->assertSeeIn('tbody tr:nth-child(1) td.name', 'User Mailbox')
                             ->assertSeeIn('tbody tr:nth-child(1) td.price', '4,44 CHF/month')
                             ->assertChecked('tbody tr:nth-child(1) td.selection input')
                             ->assertDisabled('tbody tr:nth-child(1) td.selection input')
                             ->assertTip(
                                 'tbody tr:nth-child(1) td.buttons button',
                                 'Just a mailbox'
                             )
                             // Storage SKU
                             ->assertSeeIn('tbody tr:nth-child(2) td.name', 'Storage Quota')
                             ->assertSeeIn('tr:nth-child(2) td.price', '0,00 CHF/month')
                             ->assertChecked('tbody tr:nth-child(2) td.selection input')
                             ->assertDisabled('tbody tr:nth-child(2) td.selection input')
                             ->assertTip(
                                 'tbody tr:nth-child(2) td.buttons button',
                                 'Some wiggle room'
                             )
                             ->with(new QuotaInput('tbody tr:nth-child(2) .range-input'), function ($browser) {
                                 $browser->assertQuotaValue(2)->setQuotaValue(3);
                             })
                             ->assertSeeIn('tr:nth-child(2) td.price', '0,25 CHF/month')
                             // groupware SKU
                             ->assertSeeIn('tbody tr:nth-child(3) td.name', 'Groupware Features')
                             ->assertSeeIn('tbody tr:nth-child(3) td.price', '5,55 CHF/month')
                             ->assertChecked('tbody tr:nth-child(3) td.selection input')
                             ->assertEnabled('tbody tr:nth-child(3) td.selection input')
                             ->assertTip(
                                 'tbody tr:nth-child(3) td.buttons button',
                                 'Groupware functions like Calendar, Tasks, Notes, etc.'
                             )
                             // ActiveSync SKU
                             ->assertSeeIn('tbody tr:nth-child(4) td.name', 'Activesync')
                             ->assertSeeIn('tbody tr:nth-child(4) td.price', '1,00 CHF/month')
                             ->assertNotChecked('tbody tr:nth-child(4) td.selection input')
                             ->assertEnabled('tbody tr:nth-child(4) td.selection input')
                             ->assertTip(
                                 'tbody tr:nth-child(4) td.buttons button',
                                 'Mobile synchronization'
                             )
                             // 2FA SKU
                             ->assertSeeIn('tbody tr:nth-child(5) td.name', '2-Factor Authentication')
                             ->assertSeeIn('tbody tr:nth-child(5) td.price', '0,00 CHF/month')
                             ->assertNotChecked('tbody tr:nth-child(5) td.selection input')
                             ->assertEnabled('tbody tr:nth-child(5) td.selection input')
                             ->assertTip(
                                 'tbody tr:nth-child(5) td.buttons button',
                                 'Two factor authentication for webmail and administration panel'
                             )
                             // Meet SKU
                             ->assertSeeIn('tbody tr:nth-child(6) td.name', 'Voice & Video Conferencing (public beta)')
                             ->assertSeeIn('tbody tr:nth-child(6) td.price', '0,00 CHF/month')
                             ->assertNotChecked('tbody tr:nth-child(6) td.selection input')
                             ->assertEnabled('tbody tr:nth-child(6) td.selection input')
                             ->assertTip(
                                 'tbody tr:nth-child(6) td.buttons button',
                                 'Video conferencing tool'
                             )
                             ->click('tbody tr:nth-child(4) td.selection input');
                     })
                     ->assertMissing('@skus table + .hint')
                     ->click('button[type=submit]')
                     ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');
             })
                 ->on(new UserList())
                 ->click('@table tr:nth-child(3) a')
                 ->on(new UserInfo());
 
             $expected = ['activesync', 'groupware', 'mailbox', 'storage', 'storage', 'storage'];
             $this->assertUserEntitlements($john, $expected);
 
             // Test subscriptions interaction
             $browser->with('@form', function (Browser $browser) {
                 $browser->with('@skus', function ($browser) {
                     // Uncheck 'groupware', expect activesync unchecked
                     $browser->click('#sku-input-groupware')
                         ->assertNotChecked('#sku-input-groupware')
                         ->assertNotChecked('#sku-input-activesync')
                         ->assertEnabled('#sku-input-activesync')
                         ->assertNotReadonly('#sku-input-activesync')
                         // Check 'activesync', expect an alert
                         ->click('#sku-input-activesync')
                         ->assertDialogOpened('Activesync requires Groupware Features.')
                         ->acceptDialog()
                         ->assertNotChecked('#sku-input-activesync')
                         // Check 'meet', expect an alert
                         ->click('#sku-input-meet')
                         ->assertDialogOpened('Voice & Video Conferencing (public beta) requires Groupware Features.')
                         ->acceptDialog()
                         ->assertNotChecked('#sku-input-meet')
                         // Check '2FA', expect 'activesync' unchecked and readonly
                         ->click('#sku-input-2fa')
                         ->assertChecked('#sku-input-2fa')
                         ->assertNotChecked('#sku-input-activesync')
                         ->assertReadonly('#sku-input-activesync')
                         // Uncheck '2FA'
                         ->click('#sku-input-2fa')
                         ->assertNotChecked('#sku-input-2fa')
                         ->assertNotReadonly('#sku-input-activesync');
                 });
             });
         });
     }
 
     /**
      * Test user adding page
      *
      * @depends testList
      */
     public function testNewUser(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->visit(new UserList())
                 ->assertSeeIn('button.create-user', 'Create user')
                 ->click('button.create-user')
                 ->on(new UserInfo())
                 ->assertSeeIn('#user-info .card-title', 'New user account')
                 ->with('@form', function (Browser $browser) {
                     // Assert form content
                     $browser->assertFocused('div.row:nth-child(1) input')
                         ->assertSeeIn('div.row:nth-child(1) label', 'First name')
                         ->assertValue('div.row:nth-child(1) input[type=text]', '')
                         ->assertSeeIn('div.row:nth-child(2) label', 'Last name')
                         ->assertValue('div.row:nth-child(2) input[type=text]', '')
                         ->assertSeeIn('div.row:nth-child(3) label', 'Organization')
                         ->assertValue('div.row:nth-child(3) input[type=text]', '')
                         ->assertSeeIn('div.row:nth-child(4) label', 'Email')
                         ->assertValue('div.row:nth-child(4) input[type=text]', '')
                         ->assertEnabled('div.row:nth-child(4) input[type=text]')
                         ->assertSeeIn('div.row:nth-child(5) label', 'Email aliases')
                         ->assertVisible('div.row:nth-child(5) .list-input')
                         ->with(new ListInput('#aliases'), function (Browser $browser) {
                             $browser->assertListInputValue([])
                                 ->assertValue('@input', '');
                         })
                         ->assertSeeIn('div.row:nth-child(6) label', 'Password')
                         ->assertValue('div.row:nth-child(6) input[type=password]', '')
                         ->assertSeeIn('div.row:nth-child(7) label', 'Confirm password')
                         ->assertValue('div.row:nth-child(7) input[type=password]', '')
                         ->assertSeeIn('div.row:nth-child(8) label', 'Package')
                         // assert packages list widget, select "Lite Account"
                         ->with('@packages', function ($browser) {
                             $browser->assertElementsCount('tbody tr', 2)
                                 ->assertSeeIn('tbody tr:nth-child(1)', 'Groupware Account')
                                 ->assertSeeIn('tbody tr:nth-child(2)', 'Lite Account')
                                 ->assertSeeIn('tbody tr:nth-child(1) .price', '9,99 CHF/month')
                                 ->assertSeeIn('tbody tr:nth-child(2) .price', '4,44 CHF/month')
                                 ->assertChecked('tbody tr:nth-child(1) input')
                                 ->click('tbody tr:nth-child(2) input')
                                 ->assertNotChecked('tbody tr:nth-child(1) input')
                                 ->assertChecked('tbody tr:nth-child(2) input');
                         })
                         ->assertMissing('@packages table + .hint')
                         ->assertSeeIn('button[type=submit]', 'Submit');
 
                     // Test browser-side required fields and error handling
                     $browser->click('button[type=submit]')
                         ->assertFocused('#email')
                         ->type('#email', 'invalid email')
                         ->click('button[type=submit]')
                         ->assertFocused('#password')
                         ->type('#password', 'simple123')
                         ->click('button[type=submit]')
                         ->assertFocused('#password_confirmation')
                         ->type('#password_confirmation', 'simple')
                         ->click('button[type=submit]')
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                         ->assertSeeIn('#email + .invalid-feedback', 'The specified email is invalid.')
                         ->assertSeeIn('#password + .invalid-feedback', 'The password confirmation does not match.');
                 });
 
             // Test form error handling (aliases)
             $browser->with('@form', function (Browser $browser) {
                 $browser->type('#email', 'julia.roberts@kolab.org')
                     ->type('#password_confirmation', 'simple123')
                     ->with(new ListInput('#aliases'), function (Browser $browser) {
                         $browser->addListEntry('invalid address');
                     })
                     ->click('button[type=submit]')
                     ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                     ->with(new ListInput('#aliases'), function (Browser $browser) {
                         $browser->assertFormError(1, 'The specified alias is invalid.', false);
                     });
             });
 
             // Successful account creation
             $browser->with('@form', function (Browser $browser) {
                 $browser->type('#first_name', 'Julia')
                     ->type('#last_name', 'Roberts')
                     ->type('#organization', 'Test Org')
                     ->with(new ListInput('#aliases'), function (Browser $browser) {
                         $browser->removeListEntry(1)
                             ->addListEntry('julia.roberts2@kolab.org');
                     })
                     ->click('button[type=submit]');
             })
             ->assertToast(Toast::TYPE_SUCCESS, 'User created successfully.')
             // check redirection to users list
             ->on(new UserList())
                 ->whenAvailable('@table', function (Browser $browser) {
                     $browser->assertElementsCount('tbody tr', 5)
                         ->assertSeeIn('tbody tr:nth-child(4) a', 'julia.roberts@kolab.org');
                 });
 
             $julia = User::where('email', 'julia.roberts@kolab.org')->first();
             $alias = UserAlias::where('user_id', $julia->id)->where('alias', 'julia.roberts2@kolab.org')->first();
             $this->assertTrue(!empty($alias));
             $this->assertUserEntitlements($julia, ['mailbox', 'storage', 'storage']);
             $this->assertSame('Julia', $julia->getSetting('first_name'));
             $this->assertSame('Roberts', $julia->getSetting('last_name'));
             $this->assertSame('Test Org', $julia->getSetting('organization'));
 
             // Some additional tests for the list input widget
             $browser->click('tbody tr:nth-child(4) a')
                 ->on(new UserInfo())
                 ->with(new ListInput('#aliases'), function (Browser $browser) {
                     $browser->assertListInputValue(['julia.roberts2@kolab.org'])
                         ->addListEntry('invalid address')
                         ->type('.input-group:nth-child(2) input', '@kolab.org');
                 })
                 ->click('button[type=submit]')
                 ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                 ->with(new ListInput('#aliases'), function (Browser $browser) {
                     $browser->assertVisible('.input-group:nth-child(2) input.is-invalid')
                         ->assertVisible('.input-group:nth-child(3) input.is-invalid')
                         ->type('.input-group:nth-child(2) input', 'julia.roberts3@kolab.org')
                         ->type('.input-group:nth-child(3) input', 'julia.roberts4@kolab.org');
                 })
                 ->click('button[type=submit]')
                 ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');
 
             $julia = User::where('email', 'julia.roberts@kolab.org')->first();
             $aliases = $julia->aliases()->orderBy('alias')->get()->pluck('alias')->all();
             $this->assertSame(['julia.roberts3@kolab.org', 'julia.roberts4@kolab.org'], $aliases);
         });
     }
 
     /**
      * Test user delete
      *
      * @depends testNewUser
      */
     public function testDeleteUser(): void
     {
         // First create a new user
         $john = $this->getTestUser('john@kolab.org');
         $julia = $this->getTestUser('julia.roberts@kolab.org');
         $package_kolab = \App\Package::where('title', 'kolab')->first();
         $john->assignPackage($package_kolab, $julia);
 
         // Test deleting non-controller user
         $this->browse(function (Browser $browser) use ($julia) {
             $browser->visit('/user/' . $julia->id)
                 ->on(new UserInfo())
                 ->assertSeeIn('button.button-delete', 'Delete user')
                 ->click('button.button-delete')
                 ->with(new Dialog('#delete-warning'), function (Browser $browser) {
                     $browser->assertSeeIn('@title', 'Delete julia.roberts@kolab.org')
                         ->assertFocused('@button-cancel')
                         ->assertSeeIn('@button-cancel', 'Cancel')
                         ->assertSeeIn('@button-action', 'Delete')
                         ->click('@button-cancel');
                 })
                 ->waitUntilMissing('#delete-warning')
                 ->click('button.button-delete')
                 ->with(new Dialog('#delete-warning'), function (Browser $browser) {
                     $browser->click('@button-action');
                 })
                 ->waitUntilMissing('#delete-warning')
                 ->assertToast(Toast::TYPE_SUCCESS, 'User deleted successfully.')
                 ->on(new UserList())
                 ->with('@table', function (Browser $browser) {
                     $browser->assertElementsCount('tbody tr', 4)
                         ->assertSeeIn('tbody tr:nth-child(1) a', 'jack@kolab.org')
                         ->assertSeeIn('tbody tr:nth-child(2) a', 'joe@kolab.org')
                         ->assertSeeIn('tbody tr:nth-child(3) a', 'john@kolab.org')
                         ->assertSeeIn('tbody tr:nth-child(4) a', 'ned@kolab.org');
                 });
 
             $julia = User::where('email', 'julia.roberts@kolab.org')->first();
             $this->assertTrue(empty($julia));
         });
 
         // Test that non-controller user cannot see/delete himself on the users list
         $this->browse(function (Browser $browser) {
             $browser->visit('/logout')
                 ->on(new Home())
                 ->submitLogon('jack@kolab.org', 'simple123', true)
-                ->visit(new UserList())
-                ->whenAvailable('@table', function (Browser $browser) {
-                    $browser->assertElementsCount('tbody tr', 0)
-                        ->assertSeeIn('tfoot td', 'There are no users in this account.');
-                });
+                ->visit('/users')
+                ->assertErrorPage(403);
         });
 
         // Test that controller user (Ned) can see all the users
         $this->browse(function (Browser $browser) {
             $browser->visit('/logout')
                 ->on(new Home())
                 ->submitLogon('ned@kolab.org', 'simple123', true)
                 ->visit(new UserList())
                 ->whenAvailable('@table', function (Browser $browser) {
                     $browser->assertElementsCount('tbody tr', 4);
                 });
 
                 // TODO: Test the delete action in details
         });
 
         // TODO: Test what happens with the logged in user session after he's been deleted by another user
     }
 
     /**
      * Test discounted sku/package prices in the UI
      */
     public function testDiscountedPrices(): void
     {
         // Add 10% discount
         $discount = Discount::where('code', 'TEST')->first();
         $john = User::where('email', 'john@kolab.org')->first();
         $wallet = $john->wallet();
         $wallet->discount()->associate($discount);
         $wallet->save();
 
         // SKUs on user edit page
         $this->browse(function (Browser $browser) {
             $browser->visit('/logout')
                 ->on(new Home())
                 ->submitLogon('john@kolab.org', 'simple123', true)
                 ->visit(new UserList())
                 ->waitFor('@table tr:nth-child(2)')
                 ->click('@table tr:nth-child(2) a') // joe@kolab.org
                 ->on(new UserInfo())
                 ->with('@form', function (Browser $browser) {
                     $browser->whenAvailable('@skus', function (Browser $browser) {
                         $quota_input = new QuotaInput('tbody tr:nth-child(2) .range-input');
                         $browser->waitFor('tbody tr')
                             ->assertElementsCount('tbody tr', 6)
                             // Mailbox SKU
                             ->assertSeeIn('tbody tr:nth-child(1) td.price', '3,99 CHF/month¹')
                             // Storage SKU
                             ->assertSeeIn('tr:nth-child(2) td.price', '0,00 CHF/month¹')
                             ->with($quota_input, function (Browser $browser) {
                                 $browser->setQuotaValue(100);
                             })
                             ->assertSeeIn('tr:nth-child(2) td.price', '22,05 CHF/month¹')
                             // groupware SKU
                             ->assertSeeIn('tbody tr:nth-child(3) td.price', '4,99 CHF/month¹')
                             // ActiveSync SKU
                             ->assertSeeIn('tbody tr:nth-child(4) td.price', '0,90 CHF/month¹')
                             // 2FA SKU
                             ->assertSeeIn('tbody tr:nth-child(5) td.price', '0,00 CHF/month¹');
                     })
                     ->assertSeeIn('@skus table + .hint', '¹ applied discount: 10% - Test voucher');
                 });
         });
 
         // Packages on new user page
         $this->browse(function (Browser $browser) {
             $browser->visit(new UserList())
                 ->click('button.create-user')
                 ->on(new UserInfo())
                 ->with('@form', function (Browser $browser) {
                     $browser->whenAvailable('@packages', function (Browser $browser) {
                         $browser->assertElementsCount('tbody tr', 2)
                             ->assertSeeIn('tbody tr:nth-child(1) .price', '8,99 CHF/month¹') // Groupware
                             ->assertSeeIn('tbody tr:nth-child(2) .price', '3,99 CHF/month¹'); // Lite
                     })
                     ->assertSeeIn('@packages table + .hint', '¹ applied discount: 10% - Test voucher');
                 });
         });
 
         // Test using entitlement cost instead of the SKU cost
         $this->browse(function (Browser $browser) use ($wallet) {
             $joe = User::where('email', 'joe@kolab.org')->first();
             $beta_sku = Sku::where('title', 'beta')->first();
             $storage_sku = Sku::where('title', 'storage')->first();
 
             // Add an extra storage and beta entitlement with different prices
             Entitlement::create([
                     'wallet_id' => $wallet->id,
                     'sku_id' => $beta_sku->id,
                     'cost' => 5010,
                     'entitleable_id' => $joe->id,
                     'entitleable_type' => User::class
             ]);
             Entitlement::create([
                     'wallet_id' => $wallet->id,
                     'sku_id' => $storage_sku->id,
                     'cost' => 5000,
                     'entitleable_id' => $joe->id,
                     'entitleable_type' => User::class
             ]);
 
             $browser->visit('/user/' . $joe->id)
                 ->on(new UserInfo())
                 ->with('@form', function (Browser $browser) {
                     $browser->whenAvailable('@skus', function (Browser $browser) {
                         $quota_input = new QuotaInput('tbody tr:nth-child(2) .range-input');
                         $browser->waitFor('tbody tr')
                             // Beta SKU
                             ->assertSeeIn('tbody tr:nth-child(7) td.price', '45,09 CHF/month¹')
                             // Storage SKU
                             ->assertSeeIn('tr:nth-child(2) td.price', '45,00 CHF/month¹')
                             ->with($quota_input, function (Browser $browser) {
                                 $browser->setQuotaValue(4);
                             })
                             ->assertSeeIn('tr:nth-child(2) td.price', '45,22 CHF/month¹')
                             ->with($quota_input, function (Browser $browser) {
                                 $browser->setQuotaValue(2);
                             })
                             ->assertSeeIn('tr:nth-child(2) td.price', '0,00 CHF/month¹');
                     })
                     ->assertSeeIn('@skus table + .hint', '¹ applied discount: 10% - Test voucher');
                 });
         });
     }
 
     /**
      * Test beta entitlements
      *
      * @depends testList
      */
     public function testBetaEntitlements(): void
     {
         $this->browse(function (Browser $browser) {
             $john = User::where('email', 'john@kolab.org')->first();
             $sku = Sku::where('title', 'beta')->first();
             $john->assignSku($sku);
 
             $browser->visit('/user/' . $john->id)
                 ->on(new UserInfo())
                 ->with('@skus', function ($browser) {
                     $browser->assertElementsCount('tbody tr', 8)
                         // Meet SKU
                         ->assertSeeIn('tbody tr:nth-child(6) td.name', 'Voice & Video Conferencing (public beta)')
                         ->assertSeeIn('tr:nth-child(6) td.price', '0,00 CHF/month')
                         ->assertNotChecked('tbody tr:nth-child(6) td.selection input')
                         ->assertEnabled('tbody tr:nth-child(6) td.selection input')
                         ->assertTip(
                             'tbody tr:nth-child(6) td.buttons button',
                             'Video conferencing tool'
                         )
                         // Beta SKU
                         ->assertSeeIn('tbody tr:nth-child(7) td.name', 'Private Beta (invitation only)')
                         ->assertSeeIn('tbody tr:nth-child(7) td.price', '0,00 CHF/month')
                         ->assertChecked('tbody tr:nth-child(7) td.selection input')
                         ->assertEnabled('tbody tr:nth-child(7) td.selection input')
                         ->assertTip(
                             'tbody tr:nth-child(7) td.buttons button',
                             'Access to the private beta program subscriptions'
                         )
                         // Distlist SKU
                         ->assertSeeIn('tbody tr:nth-child(8) td.name', 'Distribution lists')
                         ->assertSeeIn('tr:nth-child(8) td.price', '0,00 CHF/month')
                         ->assertNotChecked('tbody tr:nth-child(8) td.selection input')
                         ->assertEnabled('tbody tr:nth-child(8) td.selection input')
                         ->assertTip(
                             'tbody tr:nth-child(8) td.buttons button',
                             'Access to mail distribution lists'
                         )
                         // Check Distlist, Uncheck Beta, expect Distlist unchecked
                         ->click('#sku-input-distlist')
                         ->click('#sku-input-beta')
                         ->assertNotChecked('#sku-input-beta')
                         ->assertNotChecked('#sku-input-distlist')
                         // Click Distlist expect an alert
                         ->click('#sku-input-distlist')
                         ->assertDialogOpened('Distribution lists requires Private Beta (invitation only).')
                         ->acceptDialog()
                         // Enable Beta and Distlist and submit
                         ->click('#sku-input-beta')
                         ->click('#sku-input-distlist');
                 })
                 ->click('button[type=submit]')
                 ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');
 
             $expected = ['beta', 'distlist', 'groupware', 'mailbox', 'storage', 'storage'];
             $this->assertUserEntitlements($john, $expected);
 
             $browser->visit('/user/' . $john->id)
                 ->on(new UserInfo())
                 ->click('#sku-input-beta')
                 ->click('button[type=submit]')
                 ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.');
 
             $expected = ['groupware', 'mailbox', 'storage', 'storage'];
             $this->assertUserEntitlements($john, $expected);
         });
 
         // TODO: Test that the Distlist SKU is not available for users that aren't a group account owners
         // TODO: Test that entitlements change has immediate effect on the available items in dashboard
         //       i.e. does not require a page reload nor re-login.
     }
 }
diff --git a/src/tests/Browser/WalletTest.php b/src/tests/Browser/WalletTest.php
index b87e9432..0ba73cc4 100644
--- a/src/tests/Browser/WalletTest.php
+++ b/src/tests/Browser/WalletTest.php
@@ -1,260 +1,276 @@
 <?php
 
 namespace Tests\Browser;
 
 use App\Payment;
 use App\Providers\PaymentProvider;
 use App\Transaction;
 use App\Wallet;
 use Carbon\Carbon;
 use Tests\Browser;
 use Tests\Browser\Pages\Dashboard;
 use Tests\Browser\Pages\Home;
 use Tests\Browser\Pages\Wallet as WalletPage;
 use Tests\TestCaseDusk;
 
 class WalletTest extends TestCaseDusk
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('wallets-controller@kolabnow.com');
 
         $john = $this->getTestUser('john@kolab.org');
         Wallet::where('user_id', $john->id)->update(['balance' => -1234]);
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser('wallets-controller@kolabnow.com');
 
         $john = $this->getTestUser('john@kolab.org');
         Wallet::where('user_id', $john->id)->update(['balance' => 0]);
 
 
         parent::tearDown();
     }
 
     /**
      * Test wallet page (unauthenticated)
      */
     public function testWalletUnauth(): void
     {
         // Test that the page requires authentication
         $this->browse(function (Browser $browser) {
             $browser->visit('/wallet')->on(new Home());
         });
     }
 
     /**
      * Test wallet "box" on Dashboard
      */
     public function testDashboard(): void
     {
         // Test that the page requires authentication
         $this->browse(function (Browser $browser) {
             $browser->visit(new Home())
                 ->submitLogon('john@kolab.org', 'simple123', true)
                 ->on(new Dashboard())
                 ->assertSeeIn('@links .link-wallet .name', 'Wallet')
                 ->assertSeeIn('@links .link-wallet .badge', '-12,34 CHF');
         });
     }
 
     /**
      * Test wallet page
      *
      * @depends testDashboard
      */
     public function testWallet(): void
     {
         $this->browse(function (Browser $browser) {
             $browser->click('@links .link-wallet')
                 ->on(new WalletPage())
                 ->assertSeeIn('#wallet .card-title', 'Account balance -12,34 CHF')
                 ->assertSeeIn('#wallet .card-title .text-danger', '-12,34 CHF')
                 ->assertSeeIn('#wallet .card-text', 'You are out of credit');
         });
     }
 
     /**
      * Test Receipts tab
      */
     public function testReceipts(): void
     {
         $user = $this->getTestUser('wallets-controller@kolabnow.com', ['password' => 'simple123']);
         $wallet = $user->wallets()->first();
         $wallet->payments()->delete();
 
         // Log out John and log in the test user
         $this->browse(function (Browser $browser) {
             $browser->visit('/logout')
                 ->waitForLocation('/login')
                 ->on(new Home())
                 ->submitLogon('wallets-controller@kolabnow.com', 'simple123', true);
         });
 
         // Assert Receipts tab content when there's no receipts available
         $this->browse(function (Browser $browser) {
             $browser->on(new Dashboard())
                 ->click('@links .link-wallet')
                 ->on(new WalletPage())
                 ->assertSeeIn('#wallet .card-title', 'Account balance 0,00 CHF')
                 ->assertSeeIn('#wallet .card-title .text-success', '0,00 CHF')
                 ->assertSeeIn('#wallet .card-text', 'You are in your free trial period.')
                 ->assertSeeIn('@nav #tab-receipts', 'Receipts')
                 ->with('@receipts-tab', function (Browser $browser) {
                     $browser->waitUntilMissing('.app-loader')
                         ->assertSeeIn('p', 'There are no receipts for payments')
                         ->assertDontSeeIn('p', 'Here you can download')
                         ->assertMissing('select')
                         ->assertMissing('button');
                 });
         });
 
         // Create some sample payments
         $receipts = [];
         $date = Carbon::create(intval(date('Y')) - 1, 3, 30);
         $payment = Payment::create([
                 'id' => 'AAA1',
                 'status' => PaymentProvider::STATUS_PAID,
                 'type' => PaymentProvider::TYPE_ONEOFF,
                 'description' => 'Paid in March',
                 'wallet_id' => $wallet->id,
                 'provider' => 'stripe',
                 'amount' => 1111,
                 'currency_amount' => 1111,
                 'currency' => 'CHF',
         ]);
         $payment->updated_at = $date;
         $payment->save();
         $receipts[] = $date->format('Y-m');
 
         $date = Carbon::create(intval(date('Y')) - 1, 4, 30);
         $payment = Payment::create([
                 'id' => 'AAA2',
                 'status' => PaymentProvider::STATUS_PAID,
                 'type' => PaymentProvider::TYPE_ONEOFF,
                 'description' => 'Paid in April',
                 'wallet_id' => $wallet->id,
                 'provider' => 'stripe',
                 'amount' => 1111,
                 'currency_amount' => 1111,
                 'currency' => 'CHF',
         ]);
         $payment->updated_at = $date;
         $payment->save();
         $receipts[] = $date->format('Y-m');
 
         // Assert Receipts tab with receipts available
         $this->browse(function (Browser $browser) use ($receipts) {
             $browser->refresh()
                 ->on(new WalletPage())
                 ->assertSeeIn('@nav #tab-receipts', 'Receipts')
                 ->with('@receipts-tab', function (Browser $browser) use ($receipts) {
                     $browser->waitUntilMissing('.app-loader')
                         ->assertDontSeeIn('p', 'There are no receipts for payments')
                         ->assertSeeIn('p', 'Here you can download')
                         ->assertSeeIn('button', 'Download')
                         ->assertElementsCount('select > option', 2)
                         ->assertSeeIn('select > option:nth-child(1)', $receipts[1])
                         ->assertSeeIn('select > option:nth-child(2)', $receipts[0]);
 
                     // Download a receipt file
                     $browser->select('select', $receipts[0])
                         ->click('button')
                         ->pause(2000);
 
                     $files = glob(__DIR__ . '/downloads/*.pdf');
 
                     $filename = pathinfo($files[0], PATHINFO_BASENAME);
                     $this->assertTrue(strpos($filename, $receipts[0]) !== false);
 
                     $content = $browser->readDownloadedFile($filename, 0);
                     $this->assertStringStartsWith("%PDF-1.", $content);
 
                     $browser->removeDownloadedFile($filename);
                 });
         });
     }
 
     /**
      * Test History tab
      */
     public function testHistory(): void
     {
         $user = $this->getTestUser('wallets-controller@kolabnow.com', ['password' => 'simple123']);
 
         // Log out John and log in the test user
         $this->browse(function (Browser $browser) {
             $browser->visit('/logout')
                 ->waitForLocation('/login')
                 ->on(new Home())
                 ->submitLogon('wallets-controller@kolabnow.com', 'simple123', true);
         });
 
         $package_kolab = \App\Package::where('title', 'kolab')->first();
         $user->assignPackage($package_kolab);
         $wallet = $user->wallets()->first();
 
         // Create some sample transactions
         $transactions = $this->createTestTransactions($wallet);
         $transactions = array_reverse($transactions);
         $pages = array_chunk($transactions, 10 /* page size*/);
 
         $this->browse(function (Browser $browser) use ($pages) {
             $browser->on(new Dashboard())
                 ->click('@links .link-wallet')
                 ->on(new WalletPage())
                 ->assertSeeIn('@nav #tab-history', 'History')
                 ->click('@nav #tab-history')
                 ->with('@history-tab', function (Browser $browser) use ($pages) {
                     $browser->waitUntilMissing('.app-loader')
                         ->assertElementsCount('table tbody tr', 10)
                         ->assertMissing('table td.email')
                         ->assertSeeIn('#transactions-loader button', 'Load more');
 
                     foreach ($pages[0] as $idx => $transaction) {
                         $selector = 'table tbody tr:nth-child(' . ($idx + 1) . ')';
                         $priceStyle = $transaction->type == Transaction::WALLET_AWARD ? 'text-success' : 'text-danger';
                         $browser->assertSeeIn("$selector td.description", $transaction->shortDescription())
                             ->assertMissing("$selector td.selection button")
                             ->assertVisible("$selector td.price.{$priceStyle}");
                         // TODO: Test more transaction details
                     }
 
                     // Load the next page
                     $browser->click('#transactions-loader button')
                         ->waitUntilMissing('.app-loader')
                         ->assertElementsCount('table tbody tr', 12)
                         ->assertMissing('#transactions-loader button');
 
                     $debitEntry = null;
                     foreach ($pages[1] as $idx => $transaction) {
                         $selector = 'table tbody tr:nth-child(' . ($idx + 1 + 10) . ')';
                         $priceStyle = $transaction->type == Transaction::WALLET_CREDIT ? 'text-success' : 'text-danger';
                         $browser->assertSeeIn("$selector td.description", $transaction->shortDescription());
 
                         if ($transaction->type == Transaction::WALLET_DEBIT) {
                             $debitEntry = $selector;
                         } else {
                             $browser->assertMissing("$selector td.selection button");
                         }
                     }
 
                     // Load sub-transactions
                     $browser->click("$debitEntry td.selection button")
                         ->waitUntilMissing('.app-loader')
                         ->assertElementsCount("$debitEntry td.description ul li", 2)
                         ->assertMissing("$debitEntry td.selection button");
                 });
         });
     }
+
+    /**
+     * Test that non-controller user has no access to wallet
+     */
+    public function testAccessDenied(): void
+    {
+        $this->browse(function (Browser $browser) {
+            $browser->visit('/logout')
+                ->on(new Home())
+                ->submitLogon('jack@kolab.org', 'simple123', true)
+                ->on(new Dashboard())
+                ->assertMissing('@links .link-wallet')
+                ->visit('/wallet')
+                ->assertErrorPage(403, "Only account owners can access a wallet.");
+        });
+    }
 }