diff --git a/src/app/Console/Commands/Wallet/ChargeCommand.php b/src/app/Console/Commands/Wallet/ChargeCommand.php
index 7a0ff711..50e55714 100644
--- a/src/app/Console/Commands/Wallet/ChargeCommand.php
+++ b/src/app/Console/Commands/Wallet/ChargeCommand.php
@@ -1,83 +1,81 @@
 <?php
 
 namespace App\Console\Commands\Wallet;
 
 use App\Console\Command;
 
 class ChargeCommand extends Command
 {
     /**
      * The name and signature of the console command.
      *
      * @var string
      */
     protected $signature = 'wallet:charge {wallet?}';
 
     /**
      * The console command description.
      *
      * @var string
      */
     protected $description = 'Charge wallets';
 
     /**
      * Execute the console command.
      *
      * @return mixed
      */
     public function handle()
     {
         if ($wallet = $this->argument('wallet')) {
             // Find specified wallet by ID
             $wallet = $this->getWallet($wallet);
 
             if (!$wallet) {
                 $this->error("Wallet not found.");
                 return 1;
             }
 
             if (!$wallet->owner) {
                 $this->error("Wallet's owner is deleted.");
                 return 1;
             }
 
             $wallets = [$wallet];
         } else {
             // Get all wallets, excluding deleted accounts
             $wallets = \App\Wallet::select('wallets.id')
                 ->join('users', 'users.id', '=', 'wallets.user_id')
                 ->withEnvTenantContext('users')
                 ->whereNull('users.deleted_at')
                 ->cursor();
         }
 
         foreach ($wallets as $wallet) {
             // This is a long-running process. Because another process might have modified
             // the wallet balance in meantime we have to refresh it.
             // Note: This is needed despite the use of cursor() above.
             $wallet->refresh();
 
             // Sanity check after refresh (owner deleted in meantime)
             if (!$wallet->owner) {
                 continue;
             }
 
             $charge = $wallet->chargeEntitlements();
 
             if ($charge > 0) {
-                $this->info(
-                    "Charged wallet {$wallet->id} for user {$wallet->owner->email} with {$charge}"
-                );
+                $this->info("Charged wallet {$wallet->id} for user {$wallet->owner->email} with {$charge}");
 
                 // Top-up the wallet if auto-payment enabled for the wallet
                 \App\Jobs\WalletCharge::dispatch($wallet);
             }
 
             if ($wallet->balance < 0) {
                 // Check the account balance, send notifications, (suspend, delete,) degrade
                 // Also sends reminders to the degraded account owners
                 \App\Jobs\WalletCheck::dispatch($wallet);
             }
         }
     }
 }
diff --git a/src/app/Http/Controllers/API/SignupController.php b/src/app/Http/Controllers/API/SignupController.php
index 6a4ca1d4..498b40c0 100644
--- a/src/app/Http/Controllers/API/SignupController.php
+++ b/src/app/Http/Controllers/API/SignupController.php
@@ -1,599 +1,599 @@
 <?php
 
 namespace App\Http\Controllers\API;
 
 use App\Http\Controllers\Controller;
 use App\Jobs\SignupVerificationEmail;
 use App\Discount;
 use App\Domain;
 use App\Plan;
 use App\Providers\PaymentProvider;
 use App\Rules\SignupExternalEmail;
 use App\Rules\SignupToken;
 use App\Rules\Password;
 use App\Rules\UserEmailDomain;
 use App\Rules\UserEmailLocal;
 use App\SignupCode;
 use App\SignupInvitation;
 use App\User;
 use App\Utils;
 use App\VatRate;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Support\Str;
 
 /**
  * Signup process API
  */
 class SignupController extends Controller
 {
     /**
      * Returns plans definitions for signup.
      *
      * @param \Illuminate\Http\Request $request HTTP request
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function plans(Request $request)
     {
         // Use reverse order just to have individual on left, group on right ;)
         // But prefer monthly on left, yearly on right
         $plans = Plan::withEnvTenantContext()->orderBy('months')->orderByDesc('title')->get()
             ->map(function ($plan) {
                 $button = self::trans("app.planbutton-{$plan->title}");
                 if (strpos($button, 'app.planbutton') !== false) {
                     $button = self::trans('app.planbutton', ['plan' => $plan->name]);
                 }
 
                 return [
                     'title' => $plan->title,
                     'name' => $plan->name,
                     'button' => $button,
                     'description' => $plan->description,
                     'mode' => $plan->mode ?: Plan::MODE_EMAIL,
                     'isDomain' => $plan->hasDomain(),
                 ];
             })
             ->all();
 
         return response()->json(['status' => 'success', 'plans' => $plans]);
     }
 
     /**
      * Returns list of public domains for signup.
      *
      * @param \Illuminate\Http\Request $request HTTP request
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function domains(Request $request)
     {
         return response()->json(['status' => 'success', 'domains' => Domain::getPublicDomains()]);
     }
 
     /**
      * Starts signup process.
      *
      * Verifies user name and email/phone, sends verification email/sms message.
      * Returns the verification code.
      *
      * @param \Illuminate\Http\Request $request HTTP request
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function init(Request $request)
     {
         $rules = [
             'first_name' => 'max:128',
             'last_name' => 'max:128',
             'voucher' => 'max:32',
         ];
 
         $plan = $this->getPlan();
 
         if ($plan->mode == Plan::MODE_TOKEN) {
             $rules['token'] = ['required', 'string', new SignupToken()];
         } else {
             $rules['email'] = ['required', 'string', new SignupExternalEmail()];
         }
 
         // Check required fields, validate input
         $v = Validator::make($request->all(), $rules);
 
         if ($v->fails()) {
             return response()->json(['status' => 'error', 'errors' => $v->errors()->toArray()], 422);
         }
 
         // Generate the verification code
         $code = SignupCode::create([
                 'email' => $plan->mode == Plan::MODE_TOKEN ? $request->token : $request->email,
                 'first_name' => $request->first_name,
                 'last_name' => $request->last_name,
                 'plan' => $plan->title,
                 'voucher' => $request->voucher,
         ]);
 
         $response = [
             'status' => 'success',
             'code' => $code->code,
             'mode' => $plan->mode ?: 'email',
         ];
 
         if ($plan->mode == Plan::MODE_TOKEN) {
             // Token verification, jump to the last step
             $has_domain = $plan->hasDomain();
 
             $response['short_code'] = $code->short_code;
             $response['is_domain'] = $has_domain;
             $response['domains'] = $has_domain ? [] : Domain::getPublicDomains();
         } else {
             // External email verification, send an email message
             SignupVerificationEmail::dispatch($code);
         }
 
         return response()->json($response);
     }
 
     /**
      * Returns signup invitation information.
      *
      * @param string $id Signup invitation identifier
      *
      * @return \Illuminate\Http\JsonResponse|void
      */
     public function invitation($id)
     {
         $invitation = SignupInvitation::withEnvTenantContext()->find($id);
 
         if (empty($invitation) || $invitation->isCompleted()) {
             return $this->errorResponse(404);
         }
 
         $has_domain = $this->getPlan()->hasDomain();
 
         $result = [
             'id' => $id,
             'is_domain' => $has_domain,
             'domains' => $has_domain ? [] : Domain::getPublicDomains(),
         ];
 
         return response()->json($result);
     }
 
 
     /**
      * Validation of the verification code.
      *
      * @param \Illuminate\Http\Request $request HTTP request
      * @param bool                     $update  Update the signup code record
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function verify(Request $request, $update = true)
     {
         // Validate the request args
         $v = Validator::make(
             $request->all(),
             [
                 'code' => 'required',
                 'short_code' => 'required',
             ]
         );
 
         if ($v->fails()) {
             return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
         }
 
         // Validate the verification code
         $code = SignupCode::find($request->code);
 
         if (
             empty($code)
             || $code->isExpired()
             || Str::upper($request->short_code) !== Str::upper($code->short_code)
         ) {
             $errors = ['short_code' => "The code is invalid or expired."];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         // For signup last-step mode remember the code object, so we can delete it
         // with single SQL query (->delete()) instead of two
         $request->code = $code;
 
         if ($update) {
             $code->verify_ip_address = $request->ip();
             $code->save();
         }
 
         $has_domain = $this->getPlan()->hasDomain();
 
         // Return user name and email/phone/voucher from the codes database,
         // domains list for selection and "plan type" flag
         return response()->json([
                 'status' => 'success',
                 'email' => $code->email,
                 'first_name' => $code->first_name,
                 'last_name' => $code->last_name,
                 'voucher' => $code->voucher,
                 'is_domain' => $has_domain,
                 'domains' => $has_domain ? [] : Domain::getPublicDomains(),
         ]);
     }
 
     /**
      * Validates the input to the final signup request.
      *
      * @param \Illuminate\Http\Request $request HTTP request
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function signupValidate(Request $request)
     {
         // Validate input
         $v = Validator::make(
             $request->all(),
             [
                 'login' => 'required|min:2',
                 'password' => ['required', 'confirmed', new Password()],
                 'domain' => 'required',
                 'voucher' => 'max:32',
             ]
         );
 
         if ($v->fails()) {
             return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
         }
 
         $settings = [];
 
         // Plan parameter is required/allowed in mandate mode
         if (!empty($request->plan) && empty($request->code) && empty($request->invitation)) {
             $plan = Plan::withEnvTenantContext()->where('title', $request->plan)->first();
 
             if (!$plan || $plan->mode != Plan::MODE_MANDATE) {
                 $msg = self::trans('validation.exists', ['attribute' => 'plan']);
                 return response()->json(['status' => 'error', 'errors' => ['plan' => $msg]], 422);
             }
         } elseif ($request->invitation) {
             // Signup via invitation
             $invitation = SignupInvitation::withEnvTenantContext()->find($request->invitation);
 
             if (empty($invitation) || $invitation->isCompleted()) {
                 return $this->errorResponse(404);
             }
 
             // Check required fields
             $v = Validator::make(
                 $request->all(),
                 [
                     'first_name' => 'max:128',
                     'last_name' => 'max:128',
                 ]
             );
 
             $errors = $v->fails() ? $v->errors()->toArray() : [];
 
             if (!empty($errors)) {
                 return response()->json(['status' => 'error', 'errors' => $errors], 422);
             }
 
             $settings = [
                 'external_email' => $invitation->email,
                 'first_name' => $request->first_name,
                 'last_name' => $request->last_name,
             ];
         } else {
             // Validate verification codes (again)
             $v = $this->verify($request, false);
             if ($v->status() !== 200) {
                 return $v;
             }
 
             $plan = $this->getPlan();
 
             // Get user name/email from the verification code database
             $code_data = $v->getData();
 
             $settings = [
                 'first_name' => $code_data->first_name,
                 'last_name' => $code_data->last_name,
             ];
 
             if ($plan->mode == Plan::MODE_TOKEN) {
                 $settings['signup_token'] = $code_data->email;
             } else {
                 $settings['external_email'] = $code_data->email;
             }
         }
 
         // Find the voucher discount
         if ($request->voucher) {
             $discount = Discount::where('code', \strtoupper($request->voucher))
                 ->where('active', true)->first();
 
             if (!$discount) {
                 $errors = ['voucher' => self::trans('validation.voucherinvalid')];
                 return response()->json(['status' => 'error', 'errors' => $errors], 422);
             }
         }
 
         if (empty($plan)) {
             $plan = $this->getPlan();
         }
 
         $is_domain = $plan->hasDomain();
 
         // Validate login
         if ($errors = self::validateLogin($request->login, $request->domain, $is_domain)) {
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         // Set some properties for signup() method
         $request->settings = $settings;
         $request->plan = $plan;
         $request->discount = $discount ?? null;
         $request->invitation = $invitation ?? null;
 
         $result = [];
 
         if ($plan->mode == Plan::MODE_MANDATE) {
             $result = $this->mandateForPlan($plan, $request->discount);
         }
 
         return response()->json($result + ['status' => 'success']);
     }
 
     /**
      * Finishes the signup process by creating the user account.
      *
      * @param \Illuminate\Http\Request $request HTTP request
      *
      * @return \Illuminate\Http\JsonResponse JSON response
      */
     public function signup(Request $request)
     {
         $v = $this->signupValidate($request);
         if ($v->status() !== 200) {
             return $v;
         }
 
         $is_domain = $request->plan->hasDomain();
 
         // We allow only ASCII, so we can safely lower-case the email address
         $login = Str::lower($request->login);
         $domain_name = Str::lower($request->domain);
         $domain = null;
 
         DB::beginTransaction();
 
         // Create domain record
         if ($is_domain) {
             $domain = Domain::create([
                     'namespace' => $domain_name,
                     'type' => Domain::TYPE_EXTERNAL,
             ]);
         }
 
         // Create user record
         $user = User::create([
                 'email' => $login . '@' . $domain_name,
                 'password' => $request->password,
                 'status' => User::STATUS_RESTRICTED,
         ]);
 
         if ($request->discount) {
             $wallet = $user->wallets()->first();
             $wallet->discount()->associate($request->discount);
             $wallet->save();
         }
 
         $user->assignPlan($request->plan, $domain);
 
         // Save the external email and plan in user settings
         $user->setSettings($request->settings);
 
         // Update the invitation
         if ($request->invitation) {
             $request->invitation->status = SignupInvitation::STATUS_COMPLETED;
             $request->invitation->user_id = $user->id;
             $request->invitation->save();
         }
 
         // Soft-delete the verification code, and store some more info with it
         if ($request->code) {
             $request->code->user_id = $user->id;
             $request->code->submit_ip_address = $request->ip();
             $request->code->deleted_at = \now();
             $request->code->timestamps = false;
             $request->code->save();
         }
 
         DB::commit();
 
         $response = AuthController::logonResponse($user, $request->password);
 
         if ($request->plan->mode == Plan::MODE_MANDATE) {
             $data = $response->getData(true);
             $data['checkout'] = $this->mandateForPlan($request->plan, $request->discount, $user);
             $response->setData($data);
         }
 
         return $response;
     }
 
     /**
      * Collects some content to display to the user before redirect to a checkout page.
      * Optionally creates a recurrent payment mandate for specified user/plan.
      */
     protected function mandateForPlan(Plan $plan, Discount $discount = null, User $user = null): array
     {
         $result = [];
 
         $min = \App\Payment::MIN_AMOUNT;
-        $planCost = $cost = $plan->cost() * $plan->months;
+        $planCost = $cost = $plan->cost();
         $disc = 0;
 
         if ($discount) {
             $planCost = (int) ($planCost * (100 - $discount->discount) / 100);
             $disc = $cost - $planCost;
         }
 
         if ($planCost > $min) {
             $min = $planCost;
         }
 
         if ($user) {
             $wallet = $user->wallets()->first();
             $wallet->setSettings([
                 'mandate_amount' => sprintf('%.2f', round($min / 100, 2)),
                 'mandate_balance' => 0,
             ]);
 
             $mandate = [
                 'currency' => $wallet->currency,
 
                 'description' => \App\Tenant::getConfig($user->tenant_id, 'app.name')
                     . ' ' . self::trans('app.mandate-description-suffix'),
 
                 'methodId' => PaymentProvider::METHOD_CREDITCARD,
                 'redirectUrl' => Utils::serviceUrl('/payment/status', $user->tenant_id),
             ];
 
             $provider = PaymentProvider::factory($wallet);
 
             $result = $provider->createMandate($wallet, $mandate);
         }
 
         $country = Utils::countryForRequest();
         $period = $plan->months == 12 ? 'yearly' : 'monthly';
         $currency = \config('app.currency');
         $rate = VatRate::where('country', $country)
             ->where('start', '<=', now()->format('Y-m-d h:i:s'))
             ->orderByDesc('start')
             ->limit(1)
             ->first();
 
         $summary = '<tr class="subscription">'
                 . '<td>' . self::trans("app.signup-subscription-{$period}") . '</td>'
                 . '<td class="money">' . Utils::money($cost, $currency) . '</td>'
             . '</tr>';
 
         if ($discount) {
             $summary .= '<tr class="discount">'
                 . '<td>' . self::trans('app.discount-code', ['code' => $discount->code]) . '</td>'
                 . '<td class="money">' . Utils::money(-$disc, $currency) . '</td>'
             . '</tr>';
         }
 
         $summary .= '<tr class="sep"><td colspan="2"></td></tr>'
             . '<tr class="total">'
                 . '<td>' . self::trans('app.total') . '</td>'
                 . '<td class="money">' . Utils::money($planCost, $currency) . '</td>'
             . '</tr>';
 
         if ($rate && $rate->rate > 0) {
             // TODO: app.vat.mode
             $vat = round($planCost * $rate->rate / 100);
             $content = self::trans('app.vat-incl', [
                     'rate' => Utils::percent($rate->rate),
                     'cost' => Utils::money($planCost - $vat, $currency),
                     'vat' => Utils::money($vat, $currency),
             ]);
 
             $summary .= '<tr class="vat-summary"><td colspan="2">*' . $content . '</td></tr>';
         }
 
         $trialEnd = $plan->free_months ? now()->copy()->addMonthsWithoutOverflow($plan->free_months) : now();
         $params = [
             'cost' => Utils::money($planCost, $currency),
             'date' => $trialEnd->toDateString(),
         ];
 
         $result['title'] = self::trans("app.signup-plan-{$period}");
         $result['content'] = self::trans('app.signup-account-mandate', $params);
         $result['summary'] = '<table>' . $summary . '</table>';
 
         return $result;
     }
 
     /**
      * Returns plan for the signup process
      *
      * @returns \App\Plan Plan object selected for current signup process
      */
     protected function getPlan()
     {
         $request = request();
 
         if (!$request->plan || !$request->plan instanceof Plan) {
             // Get the plan if specified and exists...
             if (($request->code instanceof SignupCode) && $request->code->plan) {
                 $plan = Plan::withEnvTenantContext()->where('title', $request->code->plan)->first();
             } elseif ($request->plan) {
                 $plan = Plan::withEnvTenantContext()->where('title', $request->plan)->first();
             }
 
             // ...otherwise use the default plan
             if (empty($plan)) {
                 // TODO: Get default plan title from config
                 $plan = Plan::withEnvTenantContext()->where('title', 'individual')->first();
             }
 
             $request->plan = $plan;
         }
 
         return $request->plan;
     }
 
     /**
      * Login (kolab identity) validation
      *
      * @param string $login    Login (local part of an email address)
      * @param string $domain   Domain name
      * @param bool   $external Enables additional checks for domain part
      *
      * @return array Error messages on validation error
      */
     protected static function validateLogin($login, $domain, $external = false): ?array
     {
         // Validate login part alone
         $v = Validator::make(
             ['login' => $login],
             ['login' => ['required', 'string', new UserEmailLocal($external)]]
         );
 
         if ($v->fails()) {
             return ['login' => $v->errors()->toArray()['login'][0]];
         }
 
         $domains = $external ? null : Domain::getPublicDomains();
 
         // Validate the domain
         $v = Validator::make(
             ['domain' => $domain],
             ['domain' => ['required', 'string', new UserEmailDomain($domains)]]
         );
 
         if ($v->fails()) {
             return ['domain' => $v->errors()->toArray()['domain'][0]];
         }
 
         $domain = Str::lower($domain);
 
         // Check if domain is already registered with us
         if ($external) {
             if (Domain::withTrashed()->where('namespace', $domain)->exists()) {
                 return ['domain' => self::trans('validation.domainexists')];
             }
         }
 
         // Check if user with specified login already exists
         $email = $login . '@' . $domain;
         if (User::emailExists($email) || User::aliasExists($email) || \App\Group::emailExists($email)) {
             return ['login' => self::trans('validation.loginexists')];
         }
 
         return null;
     }
 }
diff --git a/src/app/Package.php b/src/app/Package.php
index 3162d393..bbfd5a85 100644
--- a/src/app/Package.php
+++ b/src/app/Package.php
@@ -1,103 +1,104 @@
 <?php
 
 namespace App;
 
 use App\Traits\BelongsToTenantTrait;
 use App\Traits\UuidStrKeyTrait;
 use Illuminate\Database\Eloquent\Model;
 use Spatie\Translatable\HasTranslations;
 
 /**
  * The eloquent definition of a Package.
  *
  * A package is a set of SKUs that a user can select, so that instead of;
  *
  * * Create a mailbox entitlement,
  * * Create a quota entitlement,
  * * Create a groupware entitlement,
  * * ...
  *
  * users can simply select a 'package';
  *
  * * Kolab package: mailbox + quota + groupware,
  * * Free package: mailbox + quota.
  *
  * Selecting a package will therefore create a set of entitlments from SKUs.
  *
  * @property string  $description
  * @property int     $discount_rate
  * @property string  $id
  * @property string  $name
  * @property ?int    $tenant_id
  * @property string  $title
  */
 class Package extends Model
 {
     use BelongsToTenantTrait;
     use HasTranslations;
     use UuidStrKeyTrait;
 
     /** @var bool Indicates if the model should be timestamped. */
     public $timestamps = false;
 
     /** @var array<int, string> The attributes that are mass assignable */
     protected $fillable = [
         'description',
         'discount_rate',
         'name',
         'title',
     ];
 
     /** @var array<int, string> Translatable properties */
     public $translatable = [
         'name',
         'description',
     ];
 
     /**
      * The total monthly costs of this package at either the configured level of the individual
      * SKUs in this package (in the PackageSku table), or the list price PPU for the SKU (free
      * units notwithstanding) with the discount rate for this package applied.
      *
      * NOTE: This results in the overall list price and foregoes additional wallet discount
      * deductions.
      *
      * @return int The costs in cents.
      */
     public function cost()
     {
         $costs = 0;
 
         foreach ($this->skus as $sku) {
+            // Note: This cost already takes package's discount_rate
             $costs += $sku->pivot->cost();
         }
 
         return $costs;
     }
 
     /**
      * Checks whether the package contains a domain SKU.
      */
     public function isDomain(): bool
     {
         foreach ($this->skus as $sku) {
             if ($sku->handler_class::entitleableClass() == Domain::class) {
                 return true;
             }
         }
 
         return false;
     }
 
     /**
      * SKUs of this package.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
      */
     public function skus()
     {
         return $this->belongsToMany(Sku::class, 'package_skus')
             ->using(PackageSku::class)
-            ->withPivot(['qty']);
+            ->withPivot(['qty', 'cost']);
     }
 }
diff --git a/src/app/PackageSku.php b/src/app/PackageSku.php
index fbf77087..1efd2707 100644
--- a/src/app/PackageSku.php
+++ b/src/app/PackageSku.php
@@ -1,101 +1,117 @@
 <?php
 
 namespace App;
 
 use Illuminate\Database\Eloquent\Relations\Pivot;
 
 /**
  * Link SKUs to Packages.
  *
  * @property int          $cost
  * @property string       $package_id
  * @property \App\Package $package
  * @property int          $qty
  * @property \App\Sku     $sku
  * @property string       $sku_id
  */
 class PackageSku extends Pivot
 {
     /** @var array<int, string> The attributes that are mass assignable */
     protected $fillable = [
         'package_id',
         'sku_id',
         // to set the costs here overrides the sku->cost and package->discount_rate, see function
         // cost() for more detail
         'cost',
         'qty'
     ];
 
     /** @var array<string, string> The attributes that should be cast */
     protected $casts = [
         'cost' => 'integer',
         'qty' => 'integer'
     ];
 
+    /** @var array<int, string> The attributes that can be not set */
+    protected $nullable = [
+        'cost',
+    ];
+
+    /** @var string Database table name */
+    protected $table = 'package_skus';
+
+    /** @var bool Indicates if the model should be timestamped. */
+    public $timestamps = false;
+
+
     /**
      * Under this package, how much does this SKU cost?
      *
      * @return int The costs of this SKU under this package in cents.
      */
-    public function cost()
+    public function cost(): int
     {
         $units = $this->qty - $this->sku->units_free;
 
         if ($units < 0) {
-            $units = 0;
+            return 0;
         }
 
         // one way is to set a very nice looking price in the package_sku->cost
         // this should not be modified by a discount_rate or else there is no purpose to choose
         // that nicely looking pricepoint
         //
         // the other way is to take the sku list price, but sell the package with a percentage
         // discount; this way a nice list price of 1399 with a 15% discount ends up with an "ugly"
         // 1189.15 that needs to be rounded and ends up 1189
         //
         // additional discounts could come from discount vouchers
-        if ($this->cost > 0) {
+
+        // Side-note: Package's discount_rate is on a higher level, so conceptually
+        // I wouldn't be surprised if one would expect it to apply to package_sku.cost.
+
+        if ($this->cost !== null) {
             $ppu = $this->cost;
         } else {
-            $ppu = $this->sku->cost * ((100 - $this->package->discount_rate) / 100);
+            $ppu = round($this->sku->cost * ((100 - $this->package->discount_rate) / 100));
         }
 
         return $units * $ppu;
     }
 
     /**
      * Under this package, what fee this SKU has?
      *
      * @return int The fee for this SKU under this package in cents.
      */
     public function fee()
     {
         $units = $this->qty - $this->sku->units_free;
 
         if ($units < 0) {
             $units = 0;
         }
 
         return $this->sku->fee * $units;
     }
 
     /**
      * The package for this relation.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function package()
     {
         return $this->belongsTo(Package::class);
     }
 
     /**
      * The SKU for this relation.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function sku()
     {
         return $this->belongsTo(Sku::class);
     }
 }
diff --git a/src/app/Plan.php b/src/app/Plan.php
index 5b0bbf82..25ba98b0 100644
--- a/src/app/Plan.php
+++ b/src/app/Plan.php
@@ -1,132 +1,136 @@
 <?php
 
 namespace App;
 
 use App\Traits\BelongsToTenantTrait;
 use App\Traits\UuidStrKeyTrait;
 use Illuminate\Database\Eloquent\Model;
 use Spatie\Translatable\HasTranslations;
 
 /**
  * The eloquent definition of a Plan.
  *
  * A Plan is a grouping of packages, such as a "Family Plan".
  *
  * A "Family Plan" as such may exist of "2 or more Kolab packages",
  * and apply a discount for the third and further Kolab packages.
  *
  * @property string         $description
  * @property int            $discount_qty
  * @property int            $discount_rate
  * @property int            $free_months
  * @property string         $id
  * @property string         $mode           Plan signup mode (Plan::MODE_*)
  * @property string         $name
  * @property \App\Package[] $packages
  * @property datetime       $promo_from
  * @property datetime       $promo_to
  * @property ?int           $tenant_id
  * @property string         $title
  */
 class Plan extends Model
 {
     use BelongsToTenantTrait;
     use HasTranslations;
     use UuidStrKeyTrait;
 
     public const MODE_EMAIL = 'email';
     public const MODE_TOKEN = 'token';
     public const MODE_MANDATE = 'mandate';
 
     /** @var bool Indicates if the model should be timestamped. */
     public $timestamps = false;
 
     /** @var array<int, string> The attributes that are mass assignable */
     protected $fillable = [
         'title',
         'mode',
         'name',
         'description',
         // a start and end datetime for this promotion
         'promo_from',
         'promo_to',
         // discounts start at this quantity
         'discount_qty',
         // the rate of the discount for this plan
         'discount_rate',
         // minimum number of months this plan is for
         'months',
         // number of free months (trial)
         'free_months',
     ];
 
     /** @var array<string, string> The attributes that should be cast */
     protected $casts = [
         'promo_from' => 'datetime:Y-m-d H:i:s',
         'promo_to' => 'datetime:Y-m-d H:i:s',
         'discount_qty' => 'integer',
         'discount_rate' => 'integer',
         'months' => 'integer',
         'free_months' => 'integer'
     ];
 
     /** @var array<int, string> Translatable properties */
     public $translatable = [
         'name',
         'description',
     ];
 
     /**
-     * The list price for this package at the minimum configuration.
+     * The list price for this plan at the minimum configuration.
      *
      * @return int The costs in cents.
      */
-    public function cost()
+    public function cost(): int
     {
         $costs = 0;
 
+        // TODO: What about plan's discount_qty/discount_rate?
+
         foreach ($this->packages as $package) {
             $costs += $package->pivot->cost();
         }
 
-        return $costs;
+        // TODO: What about plan's free_months?
+
+        return $costs * $this->months;
     }
 
     /**
      * The relationship to packages.
      *
      * The plan contains one or more packages. Each package may have its minimum number (for
      * billing) or its maximum (to allow topping out "enterprise" customers on a "small business"
      * plan).
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
      */
     public function packages()
     {
         return $this->belongsToMany(Package::class, 'plan_packages')
             ->using(PlanPackage::class)
             ->withPivot([
                     'qty',
                     'qty_min',
                     'qty_max',
                     'discount_qty',
                     'discount_rate'
             ]);
     }
 
     /**
      * Checks if the plan has any type of domain SKU assigned.
      *
      * @return bool
      */
     public function hasDomain(): bool
     {
         foreach ($this->packages as $package) {
             if ($package->isDomain()) {
                 return true;
             }
         }
 
         return false;
     }
 }
diff --git a/src/app/PlanPackage.php b/src/app/PlanPackage.php
index a2a5fae8..b263521d 100644
--- a/src/app/PlanPackage.php
+++ b/src/app/PlanPackage.php
@@ -1,79 +1,81 @@
 <?php
 
 namespace App;
 
 use Illuminate\Database\Eloquent\Relations\Pivot;
 
 /**
  * Link Packages to Plans.
  *
  * @property int          $discount_qty
  * @property int          $discount_rate
  * @property string       $plan_id
  * @property string       $package_id
  * @property int          $qty
  * @property int          $qty_max
  * @property int          $qty_min
  * @property \App\Package $package
  * @property \App\Plan    $plan
  */
 class PlanPackage extends Pivot
 {
     /** @var array<int, string> The attributes that are mass assignable */
     protected $fillable = [
         'plan_id',
         'package_id',
         'qty',
         'qty_max',
         'qty_min',
         'discount_qty',
         'discount_rate'
     ];
 
     /** @var array<string, string> The attributes that should be cast */
     protected $casts = [
         'qty' => 'integer',
         'qty_max' => 'integer',
         'qty_min' => 'integer',
         'discount_qty' => 'integer',
         'discount_rate' => 'integer'
     ];
 
     /**
-     * Calculate the costs for this plan.
+     * Calculate the costs for this package.
      *
-     * @return integer
+     * @return int The costs in cents
      */
     public function cost()
     {
         $costs = 0;
 
+        // TODO: consider discount_qty/discount_rate here?
+
         if ($this->qty_min > 0) {
             $costs += $this->package->cost() * $this->qty_min;
         } elseif ($this->qty > 0) {
             $costs += $this->package->cost() * $this->qty;
         }
 
         return $costs;
     }
 
     /**
      * The package in this relation.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function package()
     {
         return $this->belongsTo(Package::class);
     }
 
     /**
      * The plan in this relation.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function plan()
     {
         return $this->belongsTo(Plan::class);
     }
 }
diff --git a/src/app/Wallet.php b/src/app/Wallet.php
index 18c5e2cc..54d3065e 100644
--- a/src/app/Wallet.php
+++ b/src/app/Wallet.php
@@ -1,746 +1,746 @@
 <?php
 
 namespace App;
 
 use App\Traits\SettingsTrait;
 use App\Traits\UuidStrKeyTrait;
 use Carbon\Carbon;
 use Dyrynda\Database\Support\NullableFields;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Facades\DB;
 
 /**
  * The eloquent definition of a wallet -- a container with a chunk of change.
  *
  * A wallet is owned by an {@link \App\User}.
  *
  * @property int        $balance     Current balance in cents
  * @property string     $currency    Currency code
  * @property ?string    $description Description
  * @property string     $id          Unique identifier
  * @property ?\App\User $owner       Owner (can be null when owner is deleted)
  * @property int        $user_id     Owner's identifier
  */
 class Wallet extends Model
 {
     use NullableFields;
     use SettingsTrait;
     use UuidStrKeyTrait;
 
     /** @var bool Indicates that the model should be timestamped or not */
     public $timestamps = false;
 
     /** @var array The attributes' default values */
     protected $attributes = [
         'balance' => 0,
     ];
 
     /** @var array<int, string> The attributes that are mass assignable */
     protected $fillable = [
         'currency',
         'description'
     ];
 
     /** @var array<int, string> The attributes that can be not set */
     protected $nullable = [
         'description',
     ];
 
     /** @var array<string, string> The types of attributes to which its values will be cast */
     protected $casts = [
         'balance' => 'integer',
     ];
 
 
     /**
      * Add a controller to this wallet.
      *
      * @param \App\User $user The user to add as a controller to this wallet.
      *
      * @return void
      */
     public function addController(User $user)
     {
         if (!$this->controllers->contains($user)) {
             $this->controllers()->save($user);
         }
     }
 
     /**
      * Add an award to this wallet's balance.
      *
      * @param int|\App\Payment $amount      The amount of award (in cents) or Payment object
      * @param string           $description The transaction description
      *
      * @return Wallet Self
      */
     public function award(int|Payment $amount, string $description = ''): Wallet
     {
         return $this->balanceUpdate(Transaction::WALLET_AWARD, $amount, $description);
     }
 
     /**
      * Charge a specific entitlement (for use on entitlement delete).
      *
      * @param \App\Entitlement $entitlement The entitlement.
      */
     public function chargeEntitlement(Entitlement $entitlement): void
     {
         // Sanity checks
         if ($entitlement->trashed() || $entitlement->wallet->id != $this->id || !$this->owner) {
             return;
         }
 
         // Start calculating the costs for the consumption of this entitlement if the
         // existing consumption spans >= 14 days.
         //
         // Effect is that anything's free for the first 14 days
         if ($entitlement->created_at >= Carbon::now()->subDays(14)) {
             return;
         }
 
         if ($this->owner->isDegraded()) {
             return;
         }
 
         $now = Carbon::now();
 
         // Determine if we're still within the trial period
         $trial = $this->trialInfo();
         if (
             !empty($trial)
             && $entitlement->updated_at < $trial['end']
             && in_array($entitlement->sku_id, $trial['skus'])
         ) {
             if ($trial['end'] >= $now) {
                 return;
             }
 
             $entitlement->updated_at = $trial['end'];
         }
 
         // get the discount rate applied to the wallet.
         $discount = $this->getDiscountRate();
 
         // just in case this had not been billed yet, ever
         $diffInMonths = $entitlement->updated_at->diffInMonths($now);
         $cost = (int) ($entitlement->cost * $discount * $diffInMonths);
         $fee = (int) ($entitlement->fee * $diffInMonths);
 
         // this moves the hypothetical updated at forward to however many months past the original
         $updatedAt = $entitlement->updated_at->copy()->addMonthsWithoutOverflow($diffInMonths);
 
         // now we have the diff in days since the last "billed" period end.
         // This may be an entitlement paid up until February 28th, 2020, with today being March
         // 12th 2020. Calculating the costs for the entitlement is based on the daily price
 
         // the price per day is based on the number of days in the last month
         // or the current month if the period does not overlap with the previous month
         // FIXME: This really should be simplified to $daysInMonth=30
 
         $diffInDays = $updatedAt->diffInDays($now);
 
         if ($now->day >= $diffInDays) {
             $daysInMonth = $now->daysInMonth;
         } else {
             $daysInMonth = \App\Utils::daysInLastMonth();
         }
 
         $pricePerDay = $entitlement->cost / $daysInMonth;
         $feePerDay = $entitlement->fee / $daysInMonth;
 
         $cost += (int) (round($pricePerDay * $discount * $diffInDays, 0));
         $fee += (int) (round($feePerDay * $diffInDays, 0));
 
         $profit = $cost - $fee;
 
         if ($profit != 0 && $this->owner->tenant && ($wallet = $this->owner->tenant->wallet())) {
             $desc = "Charged user {$this->owner->email}";
             $method = $profit > 0 ? 'credit' : 'debit';
             $wallet->{$method}(abs($profit), $desc);
         }
 
         if ($cost == 0) {
             return;
         }
 
         // TODO: Create per-entitlement transaction record?
 
         $this->debit($cost);
     }
 
     /**
      * Charge entitlements in the wallet
      *
      * @param bool $apply Set to false for a dry-run mode
      *
      * @return int Charged amount in cents
      */
     public function chargeEntitlements($apply = true): int
     {
         $transactions = [];
         $profit = 0;
         $charges = 0;
         $discount = $this->getDiscountRate();
         $isDegraded = $this->owner->isDegraded();
         $trial = $this->trialInfo();
 
         if ($apply) {
             DB::beginTransaction();
         }
 
         // Get all entitlements...
         $entitlements = $this->entitlements()
             // Skip entitlements created less than or equal to 14 days ago (this is at
             // maximum the fourteenth 24-hour period).
             // ->where('created_at', '<=', Carbon::now()->subDays(14))
             // Skip entitlements created, or billed last, less than a month ago.
             ->where('updated_at', '<=', Carbon::now()->subMonthsWithoutOverflow(1))
             ->get();
 
         foreach ($entitlements as $entitlement) {
             // If in trial, move entitlement's updated_at timestamps forward to the trial end.
             if (
                 !empty($trial)
                 && $entitlement->updated_at < $trial['end']
                 && in_array($entitlement->sku_id, $trial['skus'])
             ) {
                 // TODO: Consider not updating the updated_at to a future date, i.e. bump it
                 // as many months as possible, but not into the future
                 // if we're in dry-run, you know...
                 if ($apply) {
                     $entitlement->updated_at = $trial['end'];
                     $entitlement->save();
                 }
 
                 continue;
             }
 
             $diff = $entitlement->updated_at->diffInMonths(Carbon::now());
 
             if ($diff <= 0) {
                 continue;
             }
 
             $cost = (int) ($entitlement->cost * $discount * $diff);
             $fee = (int) ($entitlement->fee * $diff);
 
             if ($isDegraded) {
                 $cost = 0;
             }
 
             $charges += $cost;
             $profit += $cost - $fee;
 
             // if we're in dry-run, you know...
             if (!$apply) {
                 continue;
             }
 
             $entitlement->updated_at = $entitlement->updated_at->copy()->addMonthsWithoutOverflow($diff);
             $entitlement->save();
 
             if ($cost == 0) {
                 continue;
             }
 
             $transactions[] = $entitlement->createTransaction(Transaction::ENTITLEMENT_BILLED, $cost);
         }
 
         if ($apply) {
             $this->debit($charges, '', $transactions);
 
             // Credit/debit the reseller
             if ($profit != 0 && $this->owner->tenant) {
                 // FIXME: Should we have a simpler way to skip this for non-reseller tenant(s)
                 if ($wallet = $this->owner->tenant->wallet()) {
                     $desc = "Charged user {$this->owner->email}";
                     $method = $profit > 0 ? 'credit' : 'debit';
                     $wallet->{$method}(abs($profit), $desc);
                 }
             }
 
             DB::commit();
         }
 
         return $charges;
     }
 
     /**
      * Calculate for how long the current balance will last.
      *
      * Returns NULL for balance < 0 or discount = 100% or on a fresh account
      *
      * @return \Carbon\Carbon|null Date
      */
     public function balanceLastsUntil()
     {
         if ($this->balance < 0 || $this->getDiscount() == 100) {
             return null;
         }
 
         $balance = $this->balance;
         $discount = $this->getDiscountRate();
         $trial = $this->trialInfo();
 
         // Get all entitlements...
         $entitlements = $this->entitlements()->orderBy('updated_at')->get()
             ->filter(function ($entitlement) {
                 return $entitlement->cost > 0;
             })
             ->map(function ($entitlement) {
                 return [
                     'date' => $entitlement->updated_at ?: $entitlement->created_at,
                     'cost' => $entitlement->cost,
                     'sku_id' => $entitlement->sku_id,
                 ];
             })
             ->all();
 
         $max = 12 * 25;
         while ($max > 0) {
             foreach ($entitlements as &$entitlement) {
                 $until = $entitlement['date'] = $entitlement['date']->addMonthsWithoutOverflow(1);
 
                 if (
                     !empty($trial)
                     && $entitlement['date'] < $trial['end']
                     && in_array($entitlement['sku_id'], $trial['skus'])
                 ) {
                     continue;
                 }
 
                 $balance -= (int) ($entitlement['cost'] * $discount);
 
                 if ($balance < 0) {
                     break 2;
                 }
             }
 
             $max--;
         }
 
         if (empty($until)) {
             return null;
         }
 
         // Don't return dates from the past
         if ($until <= Carbon::now() && !$until->isToday()) {
             return null;
         }
 
         return $until;
     }
 
     /**
      * Chargeback an amount of pecunia from this wallet's balance.
      *
      * @param int|\App\Payment $amount      The amount of pecunia to charge back (in cents) or Payment object
      * @param string           $description The transaction description
      *
      * @return Wallet Self
      */
     public function chargeback(int|Payment $amount, string $description = ''): Wallet
     {
         return $this->balanceUpdate(Transaction::WALLET_CHARGEBACK, $amount, $description);
     }
 
     /**
      * Controllers of this wallet.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
      */
     public function controllers()
     {
         return $this->belongsToMany(
             User::class,      // The foreign object definition
             'user_accounts',  // The table name
             'wallet_id',      // The local foreign key
             'user_id'         // The remote foreign key
         );
     }
 
     /**
      * Add an amount of pecunia to this wallet's balance.
      *
      * @param int|\App\Payment $amount      The amount of pecunia to add (in cents) or Payment object
      * @param string           $description The transaction description
      *
      * @return Wallet Self
      */
     public function credit(int|Payment $amount, string $description = ''): Wallet
     {
         return $this->balanceUpdate(Transaction::WALLET_CREDIT, $amount, $description);
     }
 
     /**
      * Deduct an amount of pecunia from this wallet's balance.
      *
      * @param int|\App\Payment $amount      The amount of pecunia to deduct (in cents) or Payment object
      * @param string           $description The transaction description
      * @param array            $eTIDs       List of transaction IDs for the individual entitlements
      *                                      that make up this debit record, if any.
      * @return Wallet Self
      */
     public function debit(int|Payment $amount, string $description = '', array $eTIDs = []): Wallet
     {
         return $this->balanceUpdate(Transaction::WALLET_DEBIT, $amount, $description, $eTIDs);
     }
 
     /**
      * The discount assigned to the wallet.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function discount()
     {
         return $this->belongsTo(Discount::class, 'discount_id', 'id');
     }
 
     /**
      * Entitlements billed to this wallet.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function entitlements()
     {
         return $this->hasMany(Entitlement::class);
     }
 
     /**
      * Calculate the expected charges to this wallet.
      *
      * @return int
      */
     public function expectedCharges()
     {
         return $this->chargeEntitlements(false);
     }
 
     /**
      * Return the exact, numeric version of the discount to be applied.
      *
      * @return int Discount in percent, ranges from 0 - 100.
      */
     public function getDiscount(): int
     {
         return $this->discount ? $this->discount->discount : 0;
     }
 
     /**
      * The actual discount rate for use in multiplication
      *
      * @return float Discount rate, ranges from 0.00 to 1.00.
      */
     public function getDiscountRate(): float
     {
         return (100 - $this->getDiscount()) / 100;
     }
 
     /**
      * The minimum amount of an auto-payment mandate
      *
      * @return int Amount in cents
      */
     public function getMinMandateAmount(): int
     {
         $min = Payment::MIN_AMOUNT;
 
         if ($plan = $this->plan()) {
-            $planCost = (int) ($plan->cost() * $plan->months * $this->getDiscountRate());
+            $planCost = (int) ($plan->cost() * $this->getDiscountRate());
 
             if ($planCost > $min) {
                 $min = $planCost;
             }
         }
 
         return $min;
     }
 
     /**
      * Check if the specified user is a controller to this wallet.
      *
      * @param \App\User $user The user object.
      *
      * @return bool True if the user is one of the wallet controllers (including user), False otherwise
      */
     public function isController(User $user): bool
     {
         return $user->id == $this->user_id || $this->controllers->contains($user);
     }
 
     /**
      * A helper to display human-readable amount of money using
      * the wallet currency and specified locale.
      *
      * @param int    $amount A amount of money (in cents)
      * @param string $locale A locale for the output
      *
      * @return string String representation, e.g. "9.99 CHF"
      */
     public function money(int $amount, $locale = 'de_DE')
     {
         return \App\Utils::money($amount, $this->currency, $locale);
     }
 
     /**
      * The owner of the wallet -- the wallet is in his/her back pocket.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function owner()
     {
         return $this->belongsTo(User::class, 'user_id', 'id');
     }
 
     /**
      * Payments on this wallet.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function payments()
     {
         return $this->hasMany(Payment::class);
     }
 
     /**
      * Add a penalty to this wallet's balance.
      *
      * @param int|\App\Payment $amount      The amount of penalty (in cents) or Payment object
      * @param string           $description The transaction description
      *
      * @return Wallet Self
      */
     public function penalty(int|Payment $amount, string $description = ''): Wallet
     {
         return $this->balanceUpdate(Transaction::WALLET_PENALTY, $amount, $description);
     }
 
     /**
      * Plan of the wallet.
      *
      * @return ?\App\Plan
      */
     public function plan()
     {
         $planId = $this->owner->getSetting('plan_id');
 
         return $planId ? Plan::find($planId) : null;
     }
 
     /**
      * Remove a controller from this wallet.
      *
      * @param \App\User $user The user to remove as a controller from this wallet.
      *
      * @return void
      */
     public function removeController(User $user)
     {
         if ($this->controllers->contains($user)) {
             $this->controllers()->detach($user);
         }
     }
 
     /**
      * Refund an amount of pecunia from this wallet's balance.
      *
      * @param int|\App\Payment $amount      The amount of pecunia to refund (in cents) or Payment object
      * @param string           $description The transaction description
      *
      * @return Wallet Self
      */
     public function refund($amount, string $description = ''): Wallet
     {
         return $this->balanceUpdate(Transaction::WALLET_REFUND, $amount, $description);
     }
 
     /**
      * Get the VAT rate for the wallet owner country.
      *
      * @param ?\DateTime $start Get the rate valid for the specified date-time,
      *                          without it the current rate will be returned (if exists).
      *
      * @return ?\App\VatRate VAT rate
      */
     public function vatRate(\DateTime $start = null): ?VatRate
     {
         $owner = $this->owner;
 
         // Make it working with deleted accounts too
         if (!$owner) {
             $owner = $this->owner()->withTrashed()->first();
         }
 
         $country = $owner->getSetting('country');
 
         if (!$country) {
             return null;
         }
 
         return VatRate::where('country', $country)
             ->where('start', '<=', ($start ?: now())->format('Y-m-d h:i:s'))
             ->orderByDesc('start')
             ->limit(1)
             ->first();
     }
 
     /**
      * Retrieve the transactions against this wallet.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function transactions()
     {
         return Transaction::where('object_id', $this->id)->where('object_type', Wallet::class);
     }
 
     /**
      * Returns trial related information.
      *
      * @return ?array Plan ID, plan SKUs, trial end date, number of free months (planId, skus, end, months)
      */
     public function trialInfo(): ?array
     {
         $plan = $this->plan();
         $freeMonths = $plan ? $plan->free_months : 0;
         $trialEnd = $freeMonths ? $this->owner->created_at->copy()->addMonthsWithoutOverflow($freeMonths) : null;
 
         if ($trialEnd) {
             // Get all SKUs assigned to the plan (they are free in trial)
             // TODO: We could store the list of plan's SKUs in the wallet settings, for two reasons:
             //       - performance
             //       - if we change plan definition at some point in time, the old users would use
             //         the old definition, instead of the current one
             // TODO: The same for plan's free_months value
             $trialSkus = \App\Sku::select('id')
                 ->whereIn('id', function ($query) use ($plan) {
                     $query->select('sku_id')
                         ->from('package_skus')
                         ->whereIn('package_id', function ($query) use ($plan) {
                             $query->select('package_id')
                                 ->from('plan_packages')
                                 ->where('plan_id', $plan->id);
                         });
                 })
                 ->whereNot('title', 'storage')
                 ->pluck('id')
                 ->all();
 
             return [
                 'end' => $trialEnd,
                 'skus' => $trialSkus,
                 'planId' => $plan->id,
                 'months' => $freeMonths,
             ];
         }
 
         return null;
     }
 
     /**
      * Force-update entitlements' updated_at, charge if needed.
      *
      * @param bool $withCost When enabled the cost will be charged
      *
      * @return int Charged amount in cents
      */
     public function updateEntitlements($withCost = true): int
     {
         $charges = 0;
         $discount = $this->getDiscountRate();
         $now = Carbon::now();
 
         DB::beginTransaction();
 
         // used to parent individual entitlement billings to the wallet debit.
         $entitlementTransactions = [];
 
         foreach ($this->entitlements()->get() as $entitlement) {
             $cost = 0;
             $diffInDays = $entitlement->updated_at->diffInDays($now);
 
             // This entitlement has been created less than or equal to 14 days ago (this is at
             // maximum the fourteenth 24-hour period).
             if ($entitlement->created_at > Carbon::now()->subDays(14)) {
                 // $cost=0
             } elseif ($withCost && $diffInDays > 0) {
                 // The price per day is based on the number of days in the last month
                 // or the current month if the period does not overlap with the previous month
                 // FIXME: This really should be simplified to constant $daysInMonth=30
                 if ($now->day >= $diffInDays && $now->month == $entitlement->updated_at->month) {
                     $daysInMonth = $now->daysInMonth;
                 } else {
                     $daysInMonth = \App\Utils::daysInLastMonth();
                 }
 
                 $pricePerDay = $entitlement->cost / $daysInMonth;
 
                 $cost = (int) (round($pricePerDay * $discount * $diffInDays, 0));
             }
 
             if ($diffInDays > 0) {
                 $entitlement->updated_at = $entitlement->updated_at->setDateFrom($now);
                 $entitlement->save();
             }
 
             if ($cost == 0) {
                 continue;
             }
 
             $charges += $cost;
 
             // FIXME: Shouldn't we store also cost=0 transactions (to have the full history)?
             $entitlementTransactions[] = $entitlement->createTransaction(
                 Transaction::ENTITLEMENT_BILLED,
                 $cost
             );
         }
 
         if ($charges > 0) {
             $this->debit($charges, '', $entitlementTransactions);
         }
 
         DB::commit();
 
         return $charges;
     }
 
     /**
      * Update the wallet balance, and create a transaction record
      */
     protected function balanceUpdate(string $type, int|Payment $amount, $description = null, array $eTIDs = [])
     {
         if ($amount instanceof Payment) {
             $amount = $amount->credit_amount;
         }
 
         if ($amount === 0) {
             return $this;
         }
 
         if (in_array($type, [Transaction::WALLET_CREDIT, Transaction::WALLET_AWARD])) {
             $amount = abs($amount);
         } else {
             $amount = abs($amount) * -1;
         }
 
         $this->balance += $amount;
         $this->save();
 
         $transaction = Transaction::create([
                 'user_email' => \App\Utils::userEmailOrNull(),
                 'object_id' => $this->id,
                 'object_type' => Wallet::class,
                 'type' => $type,
                 'amount' => $amount,
                 'description' => $description,
         ]);
 
         if (!empty($eTIDs)) {
             Transaction::whereIn('id', $eTIDs)->update(['transaction_id' => $transaction->id]);
         }
 
         return $this;
     }
 }
diff --git a/src/database/migrations/2023_04_11_100000_plan_packages_cost_default.php b/src/database/migrations/2023_04_11_100000_plan_packages_cost_default.php
new file mode 100644
index 00000000..61e03662
--- /dev/null
+++ b/src/database/migrations/2023_04_11_100000_plan_packages_cost_default.php
@@ -0,0 +1,38 @@
+<?php
+
+use Illuminate\Support\Facades\Schema;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Database\Migrations\Migration;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     *
+     * @return void
+     */
+    public function up()
+    {
+        Schema::table(
+            'package_skus',
+            function (Blueprint $table) {
+                $table->integer('cost')->default(null)->nullable()->change();
+            }
+        );
+    }
+
+    /**
+     * Reverse the migrations.
+     *
+     * @return void
+     */
+    public function down()
+    {
+        Schema::table(
+            'package_skus',
+            function (Blueprint $table) {
+                $table->integer('cost')->default(0)->nullable()->change();
+            }
+        );
+    }
+};
diff --git a/src/tests/Feature/PackageTest.php b/src/tests/Feature/PackageTest.php
new file mode 100644
index 00000000..cca452ea
--- /dev/null
+++ b/src/tests/Feature/PackageTest.php
@@ -0,0 +1,93 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Entitlement;
+use App\Package;
+use App\PackageSku;
+use App\Sku;
+use Tests\TestCase;
+
+class PackageTest extends TestCase
+{
+    /**
+     * {@inheritDoc}
+     */
+    public function setUp(): void
+    {
+        parent::setUp();
+
+        Package::where('title', 'test-package')->delete();
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public function tearDown(): void
+    {
+        Package::where('title', 'test-package')->delete();
+
+        parent::tearDown();
+    }
+
+    /**
+     * Test for a package's cost.
+     */
+    public function testCost(): void
+    {
+        $skuGroupware = Sku::withEnvTenantContext()->where('title', 'groupware')->first();  // cost: 490
+        $skuMailbox = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();      // cost: 500
+        $skuStorage = Sku::withEnvTenantContext()->where('title', 'storage')->first();      // cost: 25
+
+        $package = Package::create([
+                'title' => 'test-package',
+                'name' => 'Test Account',
+                'description' => 'Test account.',
+                'discount_rate' => 0,
+        ]);
+
+        // WARNING: saveMany() sets package_skus.cost = skus.cost, the next line will reset it to NULL
+        $package->skus()->saveMany([
+                $skuMailbox,
+                $skuGroupware,
+                $skuStorage
+        ]);
+
+        PackageSku::where('package_id', $package->id)->update(['cost' => null]);
+
+        // Test a package w/o any extra parameters
+        $this->assertSame(490 + 500, $package->cost());
+
+        // Test a package with pivot's qty
+        $package->skus()->updateExistingPivot(
+            $skuStorage,
+            ['qty' => 6],
+            false
+        );
+        $package->refresh();
+
+        $this->assertSame(490 + 500 + 25, $package->cost());
+
+        // Test a package with pivot's cost
+        $package->skus()->updateExistingPivot(
+            $skuStorage,
+            ['cost' => 100],
+            false
+        );
+        $package->refresh();
+
+        $this->assertSame(490 + 500 + 100, $package->cost());
+
+        // Test a package with discount_rate
+        $package->discount_rate = 30;
+        $package->save();
+        $package->skus()->updateExistingPivot(
+            $skuMailbox,
+            ['qty' => 2],
+            false
+        );
+        $package->refresh();
+
+        $this->assertSame((int) (round(490 * 0.7) + 2 * round(500 * 0.7) + 100), $package->cost());
+    }
+}
diff --git a/src/tests/Feature/PlanTest.php b/src/tests/Feature/PlanTest.php
index aacb81a7..effa5ced 100644
--- a/src/tests/Feature/PlanTest.php
+++ b/src/tests/Feature/PlanTest.php
@@ -1,127 +1,125 @@
 <?php
 
 namespace Tests\Feature;
 
 use App\Entitlement;
 use App\Plan;
 use App\Sku;
 use Tests\TestCase;
 
 class PlanTest extends TestCase
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         Plan::where('title', 'test-plan')->delete();
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         Plan::where('title', 'test-plan')->delete();
 
         parent::tearDown();
     }
 
     /**
      * Tests for plan attributes localization
      */
     public function testPlanLocalization(): void
     {
         $plan = Plan::create([
             'title' => 'test-plan',
             'description' => [
                 'en' => 'Plan-EN',
                 'de' => 'Plan-DE',
             ],
             'name' => 'Test',
         ]);
 
         $this->assertSame('Plan-EN', $plan->description);
         $this->assertSame('Test', $plan->name);
 
         $plan->save();
         $plan = Plan::where('title', 'test-plan')->first();
 
         $this->assertSame('Plan-EN', $plan->description);
         $this->assertSame('Test', $plan->name);
         $this->assertSame('Plan-DE', $plan->getTranslation('description', 'de'));
         $this->assertSame('Test', $plan->getTranslation('name', 'de'));
 
         $plan->setTranslation('name', 'de', 'Prüfung')->save();
 
         $this->assertSame('Prüfung', $plan->getTranslation('name', 'de'));
         $this->assertSame('Test', $plan->getTranslation('name', 'en'));
 
         $plan = Plan::where('title', 'test-plan')->first();
 
         $this->assertSame('Prüfung', $plan->getTranslation('name', 'de'));
         $this->assertSame('Test', $plan->getTranslation('name', 'en'));
 
         // TODO: Test system locale change
     }
 
     /**
      * Tests for Plan::hasDomain()
      */
     public function testHasDomain(): void
     {
         $plan = Plan::where('title', 'individual')->first();
 
         $this->assertTrue($plan->hasDomain() === false);
 
         $plan = Plan::where('title', 'group')->first();
 
         $this->assertTrue($plan->hasDomain() === true);
     }
 
     /**
      * Test for a plan's cost.
      */
     public function testCost(): void
     {
-        $plan = Plan::where('title', 'individual')->first();
-
-        $package_costs = 0;
+        $orig_plan = Plan::withEnvTenantContext()->where('title', 'individual')->first();
+        $plan = Plan::create([
+            'title' => 'test-plan',
+            'description' => 'Test',
+            'name' => 'Test',
+        ]);
 
-        foreach ($plan->packages as $package) {
-            $package_costs += $package->cost();
-        }
+        $plan->packages()->saveMany($orig_plan->packages);
+        $plan->refresh();
 
-        $this->assertTrue(
-            $package_costs == 990,
-            "The total costs of all packages for this plan is not 9.90"
-        );
+        $this->assertSame(990, $plan->cost());
 
-        $this->assertTrue(
-            $plan->cost() == 990,
-            "The total costs for this plan is not 9.90"
-        );
+        // Test plan months != 1
+        $plan->months = 12;
+        $plan->save();
 
-        $this->assertTrue($plan->cost() == $package_costs);
+        $this->assertSame(990 * 12, $plan->cost());
     }
 
     /**
      * Tests for Plan::tenant()
      */
     public function testTenant(): void
     {
         $plan = Plan::withEnvTenantContext()->where('title', 'individual')->first();
 
         $tenant = $plan->tenant()->first();
 
         $this->assertInstanceof(\App\Tenant::class, $tenant);
         $this->assertSame((int) \config('app.tenant_id'), $tenant->id);
 
         $tenant = $plan->tenant;
 
         $this->assertInstanceof(\App\Tenant::class, $tenant);
         $this->assertSame((int) \config('app.tenant_id'), $tenant->id);
     }
 }
diff --git a/src/tests/Feature/UserTest.php b/src/tests/Feature/UserTest.php
index 67301fa4..821672f0 100644
--- a/src/tests/Feature/UserTest.php
+++ b/src/tests/Feature/UserTest.php
@@ -1,1451 +1,1514 @@
 <?php
 
 namespace Tests\Feature;
 
 use App\Domain;
 use App\Group;
+use App\Package;
+use App\PackageSku;
+use App\Sku;
 use App\User;
 use Carbon\Carbon;
 use Illuminate\Support\Facades\Queue;
 use Tests\TestCase;
 
 class UserTest extends TestCase
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('user-test@' . \config('app.domain'));
         $this->deleteTestUser('UserAccountA@UserAccount.com');
         $this->deleteTestUser('UserAccountB@UserAccount.com');
         $this->deleteTestUser('UserAccountC@UserAccount.com');
         $this->deleteTestGroup('test-group@UserAccount.com');
         $this->deleteTestResource('test-resource@UserAccount.com');
         $this->deleteTestSharedFolder('test-folder@UserAccount.com');
         $this->deleteTestDomain('UserAccount.com');
         $this->deleteTestDomain('UserAccountAdd.com');
+        Package::where('title', 'test-package')->delete();
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         \App\TenantSetting::truncate();
+        Package::where('title', 'test-package')->delete();
         $this->deleteTestUser('user-test@' . \config('app.domain'));
         $this->deleteTestUser('UserAccountA@UserAccount.com');
         $this->deleteTestUser('UserAccountB@UserAccount.com');
         $this->deleteTestUser('UserAccountC@UserAccount.com');
         $this->deleteTestGroup('test-group@UserAccount.com');
         $this->deleteTestResource('test-resource@UserAccount.com');
         $this->deleteTestSharedFolder('test-folder@UserAccount.com');
         $this->deleteTestDomain('UserAccount.com');
         $this->deleteTestDomain('UserAccountAdd.com');
 
         parent::tearDown();
     }
 
     /**
      * Tests for User::assignPackage()
      */
     public function testAssignPackage(): void
     {
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
         $wallet = $user->wallets()->first();
+        $skuGroupware = Sku::withEnvTenantContext()->where('title', 'groupware')->first();  // cost: 490
+        $skuMailbox = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();      // cost: 500
+        $skuStorage = Sku::withEnvTenantContext()->where('title', 'storage')->first();      // cost: 25
+        $package = Package::create([
+                'title' => 'test-package',
+                'name' => 'Test Account',
+                'description' => 'Test account.',
+                'discount_rate' => 0,
+        ]);
 
-        $package = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
+        // WARNING: saveMany() sets package_skus.cost = skus.cost
+        $package->skus()->saveMany([
+                $skuMailbox,
+                $skuGroupware,
+                $skuStorage
+        ]);
+
+        $package->skus()->updateExistingPivot($skuStorage, ['qty' => 2, 'cost' => null], false);
+        $package->skus()->updateExistingPivot($skuMailbox, ['cost' => null], false);
+        $package->skus()->updateExistingPivot($skuGroupware, ['cost' => 100], false);
 
         $user->assignPackage($package);
 
-        $sku = \App\Sku::withEnvTenantContext()->where('title', 'mailbox')->first();
+        $this->assertCount(4, $user->entitlements()->get()); // mailbox + groupware + 2 x storage
 
-        $entitlement = \App\Entitlement::where('wallet_id', $wallet->id)
-            ->where('sku_id', $sku->id)->first();
+        $entitlement = $wallet->entitlements()->where('sku_id', $skuMailbox->id)->first();
+        $this->assertSame($skuMailbox->id, $entitlement->sku->id);
+        $this->assertSame($wallet->id, $entitlement->wallet->id);
+        $this->assertEquals($user->id, $entitlement->entitleable_id);
+        $this->assertTrue($entitlement->entitleable instanceof \App\User);
+        $this->assertSame($skuMailbox->cost, $entitlement->cost);
 
-        $this->assertNotNull($entitlement);
-        $this->assertSame($sku->id, $entitlement->sku->id);
+        $entitlement = $wallet->entitlements()->where('sku_id', $skuGroupware->id)->first();
+        $this->assertSame($skuGroupware->id, $entitlement->sku->id);
         $this->assertSame($wallet->id, $entitlement->wallet->id);
-        $this->assertEquals($user->id, $entitlement->entitleable->id);
+        $this->assertEquals($user->id, $entitlement->entitleable_id);
         $this->assertTrue($entitlement->entitleable instanceof \App\User);
-        $this->assertCount(7, $user->entitlements()->get());
+        $this->assertSame(100, $entitlement->cost);
+
+        $entitlement = $wallet->entitlements()->where('sku_id', $skuStorage->id)->first();
+        $this->assertSame($skuStorage->id, $entitlement->sku->id);
+        $this->assertSame($wallet->id, $entitlement->wallet->id);
+        $this->assertEquals($user->id, $entitlement->entitleable_id);
+        $this->assertTrue($entitlement->entitleable instanceof \App\User);
+        $this->assertSame(0, $entitlement->cost);
     }
 
     /**
      * Tests for User::assignPlan()
      */
     public function testAssignPlan(): void
     {
         $this->markTestIncomplete();
     }
 
     /**
      * Tests for User::assignSku()
      */
     public function testAssignSku(): void
     {
-        $this->markTestIncomplete();
+        $user = $this->getTestUser('user-test@' . \config('app.domain'));
+        $wallet = $user->wallets()->first();
+        $skuStorage = Sku::withEnvTenantContext()->where('title', 'storage')->first();
+        $skuMailbox = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();
+
+        $user->assignSku($skuMailbox);
+
+        $this->assertCount(1, $user->entitlements()->get());
+        $entitlement = $wallet->entitlements()->where('sku_id', $skuMailbox->id)->first();
+        $this->assertSame($skuMailbox->id, $entitlement->sku->id);
+        $this->assertSame($wallet->id, $entitlement->wallet->id);
+        $this->assertEquals($user->id, $entitlement->entitleable_id);
+        $this->assertTrue($entitlement->entitleable instanceof \App\User);
+        $this->assertSame($skuMailbox->cost, $entitlement->cost);
+
+        // Test units_free handling
+        for ($x = 0; $x < 5; $x++) {
+            $user->assignSku($skuStorage);
+        }
+
+        $entitlements = $user->entitlements()->where('sku_id', $skuStorage->id)
+            ->where('cost', 0)
+            ->get();
+        $this->assertCount(5, $entitlements);
+
+        $user->assignSku($skuStorage);
+        $entitlements = $user->entitlements()->where('sku_id', $skuStorage->id)
+            ->where('cost', $skuStorage->cost)
+            ->get();
+        $this->assertCount(1, $entitlements);
     }
 
     /**
      * Verify a wallet assigned a controller is among the accounts of the assignee.
      */
     public function testAccounts(): void
     {
         $userA = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
 
         $this->assertTrue($userA->wallets()->count() == 1);
 
         $userA->wallets()->each(
             function ($wallet) use ($userB) {
                 $wallet->addController($userB);
             }
         );
 
         $this->assertTrue($userB->accounts()->get()[0]->id === $userA->wallets()->get()[0]->id);
     }
 
     /**
      * Test User::canDelete() method
      */
     public function testCanDelete(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
         $domain = $this->getTestDomain('kolab.org');
 
         // Admin
         $this->assertTrue($admin->canDelete($admin));
         $this->assertFalse($admin->canDelete($john));
         $this->assertFalse($admin->canDelete($jack));
         $this->assertFalse($admin->canDelete($reseller1));
         $this->assertFalse($admin->canDelete($domain));
         $this->assertFalse($admin->canDelete($domain->wallet()));
 
         // Reseller - kolabnow
         $this->assertFalse($reseller1->canDelete($john));
         $this->assertFalse($reseller1->canDelete($jack));
         $this->assertTrue($reseller1->canDelete($reseller1));
         $this->assertFalse($reseller1->canDelete($domain));
         $this->assertFalse($reseller1->canDelete($domain->wallet()));
         $this->assertFalse($reseller1->canDelete($admin));
 
         // Normal user - account owner
         $this->assertTrue($john->canDelete($john));
         $this->assertTrue($john->canDelete($ned));
         $this->assertTrue($john->canDelete($jack));
         $this->assertTrue($john->canDelete($domain));
         $this->assertFalse($john->canDelete($domain->wallet()));
         $this->assertFalse($john->canDelete($reseller1));
         $this->assertFalse($john->canDelete($admin));
 
         // Normal user - a non-owner and non-controller
         $this->assertFalse($jack->canDelete($jack));
         $this->assertFalse($jack->canDelete($john));
         $this->assertFalse($jack->canDelete($domain));
         $this->assertFalse($jack->canDelete($domain->wallet()));
         $this->assertFalse($jack->canDelete($reseller1));
         $this->assertFalse($jack->canDelete($admin));
 
         // Normal user - John's wallet controller
         $this->assertTrue($ned->canDelete($ned));
         $this->assertTrue($ned->canDelete($john));
         $this->assertTrue($ned->canDelete($jack));
         $this->assertTrue($ned->canDelete($domain));
         $this->assertFalse($ned->canDelete($domain->wallet()));
         $this->assertFalse($ned->canDelete($reseller1));
         $this->assertFalse($ned->canDelete($admin));
     }
 
     /**
      * Test User::canRead() method
      */
     public function testCanRead(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
         $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
         $domain = $this->getTestDomain('kolab.org');
 
         // Admin
         $this->assertTrue($admin->canRead($admin));
         $this->assertTrue($admin->canRead($john));
         $this->assertTrue($admin->canRead($jack));
         $this->assertTrue($admin->canRead($reseller1));
         $this->assertTrue($admin->canRead($reseller2));
         $this->assertTrue($admin->canRead($domain));
         $this->assertTrue($admin->canRead($domain->wallet()));
 
         // Reseller - kolabnow
         $this->assertTrue($reseller1->canRead($john));
         $this->assertTrue($reseller1->canRead($jack));
         $this->assertTrue($reseller1->canRead($reseller1));
         $this->assertTrue($reseller1->canRead($domain));
         $this->assertTrue($reseller1->canRead($domain->wallet()));
         $this->assertFalse($reseller1->canRead($reseller2));
         $this->assertFalse($reseller1->canRead($admin));
 
         // Reseller - different tenant
         $this->assertTrue($reseller2->canRead($reseller2));
         $this->assertFalse($reseller2->canRead($john));
         $this->assertFalse($reseller2->canRead($jack));
         $this->assertFalse($reseller2->canRead($reseller1));
         $this->assertFalse($reseller2->canRead($domain));
         $this->assertFalse($reseller2->canRead($domain->wallet()));
         $this->assertFalse($reseller2->canRead($admin));
 
         // Normal user - account owner
         $this->assertTrue($john->canRead($john));
         $this->assertTrue($john->canRead($ned));
         $this->assertTrue($john->canRead($jack));
         $this->assertTrue($john->canRead($domain));
         $this->assertTrue($john->canRead($domain->wallet()));
         $this->assertFalse($john->canRead($reseller1));
         $this->assertFalse($john->canRead($reseller2));
         $this->assertFalse($john->canRead($admin));
 
         // Normal user - a non-owner and non-controller
         $this->assertTrue($jack->canRead($jack));
         $this->assertFalse($jack->canRead($john));
         $this->assertFalse($jack->canRead($domain));
         $this->assertFalse($jack->canRead($domain->wallet()));
         $this->assertFalse($jack->canRead($reseller1));
         $this->assertFalse($jack->canRead($reseller2));
         $this->assertFalse($jack->canRead($admin));
 
         // Normal user - John's wallet controller
         $this->assertTrue($ned->canRead($ned));
         $this->assertTrue($ned->canRead($john));
         $this->assertTrue($ned->canRead($jack));
         $this->assertTrue($ned->canRead($domain));
         $this->assertTrue($ned->canRead($domain->wallet()));
         $this->assertFalse($ned->canRead($reseller1));
         $this->assertFalse($ned->canRead($reseller2));
         $this->assertFalse($ned->canRead($admin));
     }
 
     /**
      * Test User::canUpdate() method
      */
     public function testCanUpdate(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $reseller1 = $this->getTestUser('reseller@' . \config('app.domain'));
         $reseller2 = $this->getTestUser('reseller@sample-tenant.dev-local');
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
         $domain = $this->getTestDomain('kolab.org');
 
         // Admin
         $this->assertTrue($admin->canUpdate($admin));
         $this->assertTrue($admin->canUpdate($john));
         $this->assertTrue($admin->canUpdate($jack));
         $this->assertTrue($admin->canUpdate($reseller1));
         $this->assertTrue($admin->canUpdate($reseller2));
         $this->assertTrue($admin->canUpdate($domain));
         $this->assertTrue($admin->canUpdate($domain->wallet()));
 
         // Reseller - kolabnow
         $this->assertTrue($reseller1->canUpdate($john));
         $this->assertTrue($reseller1->canUpdate($jack));
         $this->assertTrue($reseller1->canUpdate($reseller1));
         $this->assertTrue($reseller1->canUpdate($domain));
         $this->assertTrue($reseller1->canUpdate($domain->wallet()));
         $this->assertFalse($reseller1->canUpdate($reseller2));
         $this->assertFalse($reseller1->canUpdate($admin));
 
         // Reseller - different tenant
         $this->assertTrue($reseller2->canUpdate($reseller2));
         $this->assertFalse($reseller2->canUpdate($john));
         $this->assertFalse($reseller2->canUpdate($jack));
         $this->assertFalse($reseller2->canUpdate($reseller1));
         $this->assertFalse($reseller2->canUpdate($domain));
         $this->assertFalse($reseller2->canUpdate($domain->wallet()));
         $this->assertFalse($reseller2->canUpdate($admin));
 
         // Normal user - account owner
         $this->assertTrue($john->canUpdate($john));
         $this->assertTrue($john->canUpdate($ned));
         $this->assertTrue($john->canUpdate($jack));
         $this->assertTrue($john->canUpdate($domain));
         $this->assertFalse($john->canUpdate($domain->wallet()));
         $this->assertFalse($john->canUpdate($reseller1));
         $this->assertFalse($john->canUpdate($reseller2));
         $this->assertFalse($john->canUpdate($admin));
 
         // Normal user - a non-owner and non-controller
         $this->assertTrue($jack->canUpdate($jack));
         $this->assertFalse($jack->canUpdate($john));
         $this->assertFalse($jack->canUpdate($domain));
         $this->assertFalse($jack->canUpdate($domain->wallet()));
         $this->assertFalse($jack->canUpdate($reseller1));
         $this->assertFalse($jack->canUpdate($reseller2));
         $this->assertFalse($jack->canUpdate($admin));
 
         // Normal user - John's wallet controller
         $this->assertTrue($ned->canUpdate($ned));
         $this->assertTrue($ned->canUpdate($john));
         $this->assertTrue($ned->canUpdate($jack));
         $this->assertTrue($ned->canUpdate($domain));
         $this->assertFalse($ned->canUpdate($domain->wallet()));
         $this->assertFalse($ned->canUpdate($reseller1));
         $this->assertFalse($ned->canUpdate($reseller2));
         $this->assertFalse($ned->canUpdate($admin));
     }
 
     /**
      * Test user created/creating/updated observers
      */
     public function testCreateAndUpdate(): void
     {
         Queue::fake();
 
         $domain = \config('app.domain');
 
         \App\Tenant::find(\config('app.tenant_id'))->setSetting('pgp.enable', 0);
         $user = User::create([
                 'email' => 'USER-test@' . \strtoupper($domain),
                 'password' => 'test',
         ]);
 
         $result = User::where('email', "user-test@$domain")->first();
 
         $this->assertSame("user-test@$domain", $result->email);
         $this->assertSame($user->id, $result->id);
         $this->assertSame(User::STATUS_NEW, $result->status);
         $this->assertSame(0, $user->passwords()->count());
 
         Queue::assertPushed(\App\Jobs\User\CreateJob::class, 1);
         Queue::assertPushed(\App\Jobs\PGP\KeyCreateJob::class, 0);
 
         Queue::assertPushed(
             \App\Jobs\User\CreateJob::class,
             function ($job) use ($user) {
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 $userId = TestCase::getObjectProperty($job, 'userId');
 
                 return $userEmail === $user->email
                     && $userId === $user->id;
             }
         );
 
         // Test invoking KeyCreateJob
         $this->deleteTestUser("user-test@$domain");
 
         \App\Tenant::find(\config('app.tenant_id'))->setSetting('pgp.enable', 1);
 
         $user = User::create(['email' => "user-test@$domain", 'password' => 'test']);
 
         Queue::assertPushed(\App\Jobs\PGP\KeyCreateJob::class, 1);
 
         Queue::assertPushed(
             \App\Jobs\PGP\KeyCreateJob::class,
             function ($job) use ($user) {
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 $userId = TestCase::getObjectProperty($job, 'userId');
 
                 return $userEmail === $user->email
                     && $userId === $user->id;
             }
         );
 
         // Update the user, test the password change
         $user->setSetting('password_expiration_warning', '2020-10-10 10:10:10');
         $oldPassword = $user->password;
         $user->password = 'test123';
         $user->save();
 
         $this->assertNotEquals($oldPassword, $user->password);
         $this->assertSame(0, $user->passwords()->count());
         $this->assertNull($user->getSetting('password_expiration_warning'));
         $this->assertMatchesRegularExpression(
             '/^' . now()->format('Y-m-d') . ' [0-9]{2}:[0-9]{2}:[0-9]{2}$/',
             $user->getSetting('password_update')
         );
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\User\UpdateJob::class,
             function ($job) use ($user) {
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 $userId = TestCase::getObjectProperty($job, 'userId');
 
                 return $userEmail === $user->email
                     && $userId === $user->id;
             }
         );
 
         // Update the user, test the password history
         $user->setSetting('password_policy', 'last:3');
         $oldPassword = $user->password;
         $user->password = 'test1234';
         $user->save();
 
         $this->assertSame(1, $user->passwords()->count());
         $this->assertSame($oldPassword, $user->passwords()->first()->password);
 
         $user->password = 'test12345';
         $user->save();
         $oldPassword = $user->password;
         $user->password = 'test123456';
         $user->save();
 
         $this->assertSame(2, $user->passwords()->count());
         $this->assertSame($oldPassword, $user->passwords()->latest()->first()->password);
     }
 
     /**
      * Tests for User::domains()
      */
     public function testDomains(): void
     {
         $user = $this->getTestUser('john@kolab.org');
 
         $domain = $this->getTestDomain('useraccount.com', [
                 'status' => Domain::STATUS_NEW | Domain::STATUS_ACTIVE,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
 
         $domains = $user->domains()->pluck('namespace')->all();
 
         $this->assertContains($domain->namespace, $domains);
         $this->assertContains('kolab.org', $domains);
 
         // Jack is not the wallet controller, so for him the list should not
         // include John's domains, kolab.org specifically
         $user = $this->getTestUser('jack@kolab.org');
 
         $domains = $user->domains()->pluck('namespace')->all();
 
         $this->assertContains($domain->namespace, $domains);
         $this->assertNotContains('kolab.org', $domains);
 
         // Public domains of other tenants should not be returned
         $tenant = \App\Tenant::where('id', '!=', \config('app.tenant_id'))->first();
         $domain->tenant_id = $tenant->id;
         $domain->save();
 
         $domains = $user->domains()->pluck('namespace')->all();
 
         $this->assertNotContains($domain->namespace, $domains);
     }
 
     /**
      * Test User::getConfig() and setConfig() methods
      */
     public function testConfigTrait(): void
     {
         $user = $this->getTestUser('UserAccountA@UserAccount.com');
         $user->setSetting('greylist_enabled', null);
         $user->setSetting('guam_enabled', null);
         $user->setSetting('password_policy', null);
         $user->setSetting('max_password_age', null);
         $user->setSetting('limit_geo', null);
 
         // greylist_enabled
         $this->assertSame(true, $user->getConfig()['greylist_enabled']);
 
         $result = $user->setConfig(['greylist_enabled' => false, 'unknown' => false]);
 
         $this->assertSame(['unknown' => "The requested configuration parameter is not supported."], $result);
         $this->assertSame(false, $user->getConfig()['greylist_enabled']);
         $this->assertSame('false', $user->getSetting('greylist_enabled'));
 
         $result = $user->setConfig(['greylist_enabled' => true]);
 
         $this->assertSame([], $result);
         $this->assertSame(true, $user->getConfig()['greylist_enabled']);
         $this->assertSame('true', $user->getSetting('greylist_enabled'));
 
         // guam_enabled
         $this->assertSame(false, $user->getConfig()['guam_enabled']);
 
         $result = $user->setConfig(['guam_enabled' => false]);
 
         $this->assertSame([], $result);
         $this->assertSame(false, $user->getConfig()['guam_enabled']);
         $this->assertSame(null, $user->getSetting('guam_enabled'));
 
         $result = $user->setConfig(['guam_enabled' => true]);
 
         $this->assertSame([], $result);
         $this->assertSame(true, $user->getConfig()['guam_enabled']);
         $this->assertSame('true', $user->getSetting('guam_enabled'));
 
         // max_apssword_age
         $this->assertSame(null, $user->getConfig()['max_password_age']);
 
         $result = $user->setConfig(['max_password_age' => -1]);
 
         $this->assertSame([], $result);
         $this->assertSame(null, $user->getConfig()['max_password_age']);
         $this->assertSame(null, $user->getSetting('max_password_age'));
 
         $result = $user->setConfig(['max_password_age' => 12]);
 
         $this->assertSame([], $result);
         $this->assertSame('12', $user->getConfig()['max_password_age']);
         $this->assertSame('12', $user->getSetting('max_password_age'));
 
         // password_policy
         $result = $user->setConfig(['password_policy' => true]);
 
         $this->assertSame(['password_policy' => "Specified password policy is invalid."], $result);
         $this->assertSame(null, $user->getConfig()['password_policy']);
         $this->assertSame(null, $user->getSetting('password_policy'));
 
         $result = $user->setConfig(['password_policy' => 'min:-1']);
 
         $this->assertSame(['password_policy' => "Specified password policy is invalid."], $result);
 
         $result = $user->setConfig(['password_policy' => 'min:-1']);
 
         $this->assertSame(['password_policy' => "Specified password policy is invalid."], $result);
 
         $result = $user->setConfig(['password_policy' => 'min:10,unknown']);
 
         $this->assertSame(['password_policy' => "Specified password policy is invalid."], $result);
 
         \config(['app.password_policy' => 'min:5,max:100']);
         $result = $user->setConfig(['password_policy' => 'min:4,max:255']);
 
         $this->assertSame(['password_policy' => "Minimum password length cannot be less than 5."], $result);
 
         \config(['app.password_policy' => 'min:5,max:100']);
         $result = $user->setConfig(['password_policy' => 'min:10,max:255']);
 
         $this->assertSame(['password_policy' => "Maximum password length cannot be more than 100."], $result);
 
         \config(['app.password_policy' => 'min:5,max:255']);
         $result = $user->setConfig(['password_policy' => 'min:10,max:255']);
 
         $this->assertSame([], $result);
         $this->assertSame('min:10,max:255', $user->getConfig()['password_policy']);
         $this->assertSame('min:10,max:255', $user->getSetting('password_policy'));
 
         // limit_geo
         $this->assertSame([], $user->getConfig()['limit_geo']);
 
         $result = $user->setConfig(['limit_geo' => '']);
 
         $err = "Specified configuration is invalid. Expected a list of two-letter country codes.";
         $this->assertSame(['limit_geo' => $err], $result);
         $this->assertSame(null, $user->getSetting('limit_geo'));
 
         $result = $user->setConfig(['limit_geo' => ['usa']]);
 
         $this->assertSame(['limit_geo' => $err], $result);
         $this->assertSame(null, $user->getSetting('limit_geo'));
 
         $result = $user->setConfig(['limit_geo' => []]);
 
         $this->assertSame([], $result);
         $this->assertSame(null, $user->getSetting('limit_geo'));
 
         $result = $user->setConfig(['limit_geo' => ['US', 'ru']]);
 
         $this->assertSame([], $result);
         $this->assertSame(['US', 'RU'], $user->getConfig()['limit_geo']);
         $this->assertSame('["US","RU"]', $user->getSetting('limit_geo'));
     }
 
     /**
      * Test user account degradation and un-degradation
      */
     public function testDegradeAndUndegrade(): void
     {
         Queue::fake();
 
         // Test an account with users, domain
         $userA = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $domain = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $userA->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $userA);
         $userA->assignPackage($package_kolab, $userB);
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
         $entitlementsDomain = \App\Entitlement::where('entitleable_id', $domain->id);
 
         $yesterday = Carbon::now()->subDays(1);
 
         $this->backdateEntitlements($entitlementsA->get(), $yesterday, Carbon::now()->subMonthsWithoutOverflow(1));
         $this->backdateEntitlements($entitlementsB->get(), $yesterday, Carbon::now()->subMonthsWithoutOverflow(1));
 
         $wallet = $userA->wallets->first();
 
         $this->assertSame(7, $entitlementsA->count());
         $this->assertSame(7, $entitlementsB->count());
         $this->assertSame(7, $entitlementsA->whereDate('updated_at', $yesterday->toDateString())->count());
         $this->assertSame(7, $entitlementsB->whereDate('updated_at', $yesterday->toDateString())->count());
         $this->assertSame(0, $wallet->balance);
 
         Queue::fake(); // reset queue state
 
         // Degrade the account/wallet owner
         $userA->degrade();
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
 
         $this->assertTrue($userA->fresh()->isDegraded());
         $this->assertTrue($userA->fresh()->isDegraded(true));
         $this->assertFalse($userB->fresh()->isDegraded());
         $this->assertTrue($userB->fresh()->isDegraded(true));
 
         $balance = $wallet->fresh()->balance;
         $this->assertTrue($balance <= -64);
         $this->assertSame(7, $entitlementsA->whereDate('updated_at', Carbon::now()->toDateString())->count());
         $this->assertSame(7, $entitlementsB->whereDate('updated_at', Carbon::now()->toDateString())->count());
 
         // Expect one update job for every user
         // @phpstan-ignore-next-line
         $userIds = Queue::pushed(\App\Jobs\User\UpdateJob::class)->map(function ($job) {
             return TestCase::getObjectProperty($job, 'userId');
         })->all();
 
         $this->assertSame([$userA->id, $userB->id], $userIds);
 
         // Un-Degrade the account/wallet owner
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
 
         $yesterday = Carbon::now()->subDays(1);
 
         $this->backdateEntitlements($entitlementsA->get(), $yesterday, Carbon::now()->subMonthsWithoutOverflow(1));
         $this->backdateEntitlements($entitlementsB->get(), $yesterday, Carbon::now()->subMonthsWithoutOverflow(1));
 
         Queue::fake(); // reset queue state
 
         $userA->undegrade();
 
         $this->assertFalse($userA->fresh()->isDegraded());
         $this->assertFalse($userA->fresh()->isDegraded(true));
         $this->assertFalse($userB->fresh()->isDegraded());
         $this->assertFalse($userB->fresh()->isDegraded(true));
 
         // Expect no balance change, degraded account entitlements are free
         $this->assertSame($balance, $wallet->fresh()->balance);
         $this->assertSame(7, $entitlementsA->whereDate('updated_at', Carbon::now()->toDateString())->count());
         $this->assertSame(7, $entitlementsB->whereDate('updated_at', Carbon::now()->toDateString())->count());
 
         // Expect one update job for every user
         // @phpstan-ignore-next-line
         $userIds = Queue::pushed(\App\Jobs\User\UpdateJob::class)->map(function ($job) {
             return TestCase::getObjectProperty($job, 'userId');
         })->all();
 
         $this->assertSame([$userA->id, $userB->id], $userIds);
     }
 
     /**
      * Test user deletion
      */
     public function testDelete(): void
     {
         Queue::fake();
 
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
         $package = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $user->assignPackage($package);
 
         $id = $user->id;
 
         $this->assertCount(7, $user->entitlements()->get());
 
         $user->delete();
 
         $this->assertCount(0, $user->entitlements()->get());
         $this->assertTrue($user->fresh()->trashed());
         $this->assertFalse($user->fresh()->isDeleted());
 
         // Delete the user for real
         $job = new \App\Jobs\User\DeleteJob($id);
         $job->handle();
 
         $this->assertTrue(User::withTrashed()->where('id', $id)->first()->isDeleted());
 
         $user->forceDelete();
 
         $this->assertCount(0, User::withTrashed()->where('id', $id)->get());
 
         // Test an account with users, domain, and group, and resource
         $userA = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $userC = $this->getTestUser('UserAccountC@UserAccount.com');
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $domain = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $userA->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $userA);
         $userA->assignPackage($package_kolab, $userB);
         $userA->assignPackage($package_kolab, $userC);
         $group = $this->getTestGroup('test-group@UserAccount.com');
         $group->assignToWallet($userA->wallets->first());
         $resource = $this->getTestResource('test-resource@UserAccount.com', ['name' => 'test']);
         $resource->assignToWallet($userA->wallets->first());
         $folder = $this->getTestSharedFolder('test-folder@UserAccount.com', ['name' => 'test']);
         $folder->assignToWallet($userA->wallets->first());
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
         $entitlementsC = \App\Entitlement::where('entitleable_id', $userC->id);
         $entitlementsDomain = \App\Entitlement::where('entitleable_id', $domain->id);
         $entitlementsGroup = \App\Entitlement::where('entitleable_id', $group->id);
         $entitlementsResource = \App\Entitlement::where('entitleable_id', $resource->id);
         $entitlementsFolder = \App\Entitlement::where('entitleable_id', $folder->id);
 
         $this->assertSame(7, $entitlementsA->count());
         $this->assertSame(7, $entitlementsB->count());
         $this->assertSame(7, $entitlementsC->count());
         $this->assertSame(1, $entitlementsDomain->count());
         $this->assertSame(1, $entitlementsGroup->count());
         $this->assertSame(1, $entitlementsResource->count());
         $this->assertSame(1, $entitlementsFolder->count());
 
         // Delete non-controller user
         $userC->delete();
 
         $this->assertTrue($userC->fresh()->trashed());
         $this->assertFalse($userC->fresh()->isDeleted());
         $this->assertSame(0, $entitlementsC->count());
 
         // Delete the controller (and expect "sub"-users to be deleted too)
         $userA->delete();
 
         $this->assertSame(0, $entitlementsA->count());
         $this->assertSame(0, $entitlementsB->count());
         $this->assertSame(0, $entitlementsDomain->count());
         $this->assertSame(0, $entitlementsGroup->count());
         $this->assertSame(0, $entitlementsResource->count());
         $this->assertSame(0, $entitlementsFolder->count());
         $this->assertSame(7, $entitlementsA->withTrashed()->count());
         $this->assertSame(7, $entitlementsB->withTrashed()->count());
         $this->assertSame(7, $entitlementsC->withTrashed()->count());
         $this->assertSame(1, $entitlementsDomain->withTrashed()->count());
         $this->assertSame(1, $entitlementsGroup->withTrashed()->count());
         $this->assertSame(1, $entitlementsResource->withTrashed()->count());
         $this->assertSame(1, $entitlementsFolder->withTrashed()->count());
         $this->assertTrue($userA->fresh()->trashed());
         $this->assertTrue($userB->fresh()->trashed());
         $this->assertTrue($domain->fresh()->trashed());
         $this->assertTrue($group->fresh()->trashed());
         $this->assertTrue($resource->fresh()->trashed());
         $this->assertTrue($folder->fresh()->trashed());
         $this->assertFalse($userA->isDeleted());
         $this->assertFalse($userB->isDeleted());
         $this->assertFalse($domain->isDeleted());
         $this->assertFalse($group->isDeleted());
         $this->assertFalse($resource->isDeleted());
         $this->assertFalse($folder->isDeleted());
 
         $userA->forceDelete();
 
         $all_entitlements = \App\Entitlement::where('wallet_id', $userA->wallets->first()->id);
         $transactions = \App\Transaction::where('object_id', $userA->wallets->first()->id);
 
         $this->assertSame(0, $all_entitlements->withTrashed()->count());
         $this->assertSame(0, $transactions->count());
         $this->assertCount(0, User::withTrashed()->where('id', $userA->id)->get());
         $this->assertCount(0, User::withTrashed()->where('id', $userB->id)->get());
         $this->assertCount(0, User::withTrashed()->where('id', $userC->id)->get());
         $this->assertCount(0, Domain::withTrashed()->where('id', $domain->id)->get());
         $this->assertCount(0, Group::withTrashed()->where('id', $group->id)->get());
         $this->assertCount(0, \App\Resource::withTrashed()->where('id', $resource->id)->get());
         $this->assertCount(0, \App\SharedFolder::withTrashed()->where('id', $folder->id)->get());
     }
 
     /**
      * Test user deletion vs. group membership
      */
     public function testDeleteAndGroups(): void
     {
         Queue::fake();
 
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $userA = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $userA->assignPackage($package_kolab, $userB);
         $group = $this->getTestGroup('test-group@UserAccount.com');
         $group->members = ['test@gmail.com', $userB->email];
         $group->assignToWallet($userA->wallets->first());
         $group->save();
 
         Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 1);
 
         $userGroups = $userA->groups()->get();
         $this->assertSame(1, $userGroups->count());
         $this->assertSame($group->id, $userGroups->first()->id);
 
         $userB->delete();
 
         $this->assertSame(['test@gmail.com'], $group->fresh()->members);
 
         // Twice, one for save() and one for delete() above
         Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 2);
     }
 
     /**
      * Test handling negative balance on user deletion
      */
     public function testDeleteWithNegativeBalance(): void
     {
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
         $wallet = $user->wallets()->first();
         $wallet->balance = -1000;
         $wallet->save();
         $reseller_wallet = $user->tenant->wallet();
         $reseller_wallet->balance = 0;
         $reseller_wallet->save();
         \App\Transaction::where('object_id', $reseller_wallet->id)->where('object_type', \App\Wallet::class)->delete();
 
         $user->delete();
 
         $reseller_transactions = \App\Transaction::where('object_id', $reseller_wallet->id)
             ->where('object_type', \App\Wallet::class)->get();
 
         $this->assertSame(-1000, $reseller_wallet->fresh()->balance);
         $this->assertCount(1, $reseller_transactions);
         $trans = $reseller_transactions[0];
         $this->assertSame("Deleted user {$user->email}", $trans->description);
         $this->assertSame(-1000, $trans->amount);
         $this->assertSame(\App\Transaction::WALLET_DEBIT, $trans->type);
     }
 
     /**
      * Test handling positive balance on user deletion
      */
     public function testDeleteWithPositiveBalance(): void
     {
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
         $wallet = $user->wallets()->first();
         $wallet->balance = 1000;
         $wallet->save();
         $reseller_wallet = $user->tenant->wallet();
         $reseller_wallet->balance = 0;
         $reseller_wallet->save();
 
         $user->delete();
 
         $this->assertSame(0, $reseller_wallet->fresh()->balance);
     }
 
     /**
      * Test user deletion with PGP/WOAT enabled
      */
     public function testDeleteWithPGP(): void
     {
         Queue::fake();
 
         // Test with PGP disabled
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
 
         $user->tenant->setSetting('pgp.enable', 0);
         $user->delete();
 
         Queue::assertPushed(\App\Jobs\PGP\KeyDeleteJob::class, 0);
 
         // Test with PGP enabled
         $this->deleteTestUser('user-test@' . \config('app.domain'));
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
 
         $user->tenant->setSetting('pgp.enable', 1);
         $user->delete();
         $user->tenant->setSetting('pgp.enable', 0);
 
         Queue::assertPushed(\App\Jobs\PGP\KeyDeleteJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\PGP\KeyDeleteJob::class,
             function ($job) use ($user) {
                 $userId = TestCase::getObjectProperty($job, 'userId');
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 return $userId == $user->id && $userEmail === $user->email;
             }
         );
     }
 
     /**
      * Test user deletion vs. rooms
      */
     public function testDeleteWithRooms(): void
     {
         $this->markTestIncomplete();
     }
 
     /**
      * Tests for User::aliasExists()
      */
     public function testAliasExists(): void
     {
         $this->assertTrue(User::aliasExists('jack.daniels@kolab.org'));
 
         $this->assertFalse(User::aliasExists('j.daniels@kolab.org'));
         $this->assertFalse(User::aliasExists('john@kolab.org'));
     }
 
     /**
      * Tests for User::emailExists()
      */
     public function testEmailExists(): void
     {
         $this->assertFalse(User::emailExists('jack.daniels@kolab.org'));
         $this->assertFalse(User::emailExists('j.daniels@kolab.org'));
 
         $this->assertTrue(User::emailExists('john@kolab.org'));
         $user = User::emailExists('john@kolab.org', true);
         $this->assertSame('john@kolab.org', $user->email);
     }
 
     /**
      * Tests for User::findByEmail()
      */
     public function testFindByEmail(): void
     {
         $user = $this->getTestUser('john@kolab.org');
 
         $result = User::findByEmail('john');
         $this->assertNull($result);
 
         $result = User::findByEmail('non-existing@email.com');
         $this->assertNull($result);
 
         $result = User::findByEmail('john@kolab.org');
         $this->assertInstanceOf(User::class, $result);
         $this->assertSame($user->id, $result->id);
 
         // Use an alias
         $result = User::findByEmail('john.doe@kolab.org');
         $this->assertInstanceOf(User::class, $result);
         $this->assertSame($user->id, $result->id);
 
         Queue::fake();
 
         // A case where two users have the same alias
         $ned = $this->getTestUser('ned@kolab.org');
         $ned->setAliases(['joe.monster@kolab.org']);
         $result = User::findByEmail('joe.monster@kolab.org');
         $this->assertNull($result);
         $ned->setAliases([]);
 
         // TODO: searching by external email (setting)
         $this->markTestIncomplete();
     }
 
     /**
      * Test User::hasSku() and countEntitlementsBySku() methods
      */
     public function testHasSku(): void
     {
         $john = $this->getTestUser('john@kolab.org');
 
         $this->assertTrue($john->hasSku('mailbox'));
         $this->assertTrue($john->hasSku('storage'));
         $this->assertFalse($john->hasSku('beta'));
         $this->assertFalse($john->hasSku('unknown'));
 
         $this->assertSame(0, $john->countEntitlementsBySku('unknown'));
         $this->assertSame(0, $john->countEntitlementsBySku('2fa'));
         $this->assertSame(1, $john->countEntitlementsBySku('mailbox'));
         $this->assertSame(5, $john->countEntitlementsBySku('storage'));
     }
 
     /**
      * Test User::name()
      */
     public function testName(): void
     {
         Queue::fake();
 
         $user = $this->getTestUser('user-test@' . \config('app.domain'));
 
         $this->assertSame('', $user->name());
         $this->assertSame($user->tenant->title . ' User', $user->name(true));
 
         $user->setSetting('first_name', 'First');
 
         $this->assertSame('First', $user->name());
         $this->assertSame('First', $user->name(true));
 
         $user->setSetting('last_name', 'Last');
 
         $this->assertSame('First Last', $user->name());
         $this->assertSame('First Last', $user->name(true));
     }
 
     /**
      * Test resources() method
      */
     public function testResources(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
 
         $resources = $john->resources()->orderBy('email')->get();
 
         $this->assertSame(2, $resources->count());
         $this->assertSame('resource-test1@kolab.org', $resources[0]->email);
         $this->assertSame('resource-test2@kolab.org', $resources[1]->email);
 
         $resources = $ned->resources()->orderBy('email')->get();
 
         $this->assertSame(2, $resources->count());
         $this->assertSame('resource-test1@kolab.org', $resources[0]->email);
         $this->assertSame('resource-test2@kolab.org', $resources[1]->email);
 
         $resources = $jack->resources()->get();
 
         $this->assertSame(0, $resources->count());
     }
 
     /**
      * Test sharedFolders() method
      */
     public function testSharedFolders(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
 
         $folders = $john->sharedFolders()->orderBy('email')->get();
 
         $this->assertSame(2, $folders->count());
         $this->assertSame('folder-contact@kolab.org', $folders[0]->email);
         $this->assertSame('folder-event@kolab.org', $folders[1]->email);
 
         $folders = $ned->sharedFolders()->orderBy('email')->get();
 
         $this->assertSame(2, $folders->count());
         $this->assertSame('folder-contact@kolab.org', $folders[0]->email);
         $this->assertSame('folder-event@kolab.org', $folders[1]->email);
 
         $folders = $jack->sharedFolders()->get();
 
         $this->assertSame(0, $folders->count());
     }
 
     /**
      * Test user restoring
      */
     public function testRestore(): void
     {
         Queue::fake();
 
         // Test an account with users and domain
         $userA = $this->getTestUser('UserAccountA@UserAccount.com', [
                 'status' => User::STATUS_LDAP_READY | User::STATUS_IMAP_READY | User::STATUS_SUSPENDED,
         ]);
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $domainA = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $domainB = $this->getTestDomain('UserAccountAdd.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $userA->assignPackage($package_kolab);
         $domainA->assignPackage($package_domain, $userA);
         $domainB->assignPackage($package_domain, $userA);
         $userA->assignPackage($package_kolab, $userB);
 
         $storage_sku = \App\Sku::withEnvTenantContext()->where('title', 'storage')->first();
         $now = \Carbon\Carbon::now();
         $wallet_id = $userA->wallets->first()->id;
 
         // add an extra storage entitlement
         $ent1 = \App\Entitlement::create([
                 'wallet_id' => $wallet_id,
                 'sku_id' => $storage_sku->id,
                 'cost' => 0,
                 'entitleable_id' => $userA->id,
                 'entitleable_type' => User::class,
         ]);
 
         $entitlementsA = \App\Entitlement::where('entitleable_id', $userA->id);
         $entitlementsB = \App\Entitlement::where('entitleable_id', $userB->id);
         $entitlementsDomain = \App\Entitlement::where('entitleable_id', $domainA->id);
 
         // First delete the user
         $userA->delete();
 
         $this->assertSame(0, $entitlementsA->count());
         $this->assertSame(0, $entitlementsB->count());
         $this->assertSame(0, $entitlementsDomain->count());
         $this->assertTrue($userA->fresh()->trashed());
         $this->assertTrue($userB->fresh()->trashed());
         $this->assertTrue($domainA->fresh()->trashed());
         $this->assertTrue($domainB->fresh()->trashed());
         $this->assertFalse($userA->isDeleted());
         $this->assertFalse($userB->isDeleted());
         $this->assertFalse($domainA->isDeleted());
 
         // Backdate one storage entitlement (it's not expected to be restored)
         \App\Entitlement::withTrashed()->where('id', $ent1->id)
             ->update(['deleted_at' => $now->copy()->subMinutes(2)]);
 
         // Backdate entitlements to assert that they were restored with proper updated_at timestamp
         \App\Entitlement::withTrashed()->where('wallet_id', $wallet_id)
             ->update(['updated_at' => $now->subMinutes(10)]);
 
         Queue::fake();
 
         // Then restore it
         $userA->restore();
         $userA->refresh();
 
         $this->assertFalse($userA->trashed());
         $this->assertFalse($userA->isDeleted());
         $this->assertFalse($userA->isSuspended());
         $this->assertFalse($userA->isLdapReady());
         $this->assertFalse($userA->isImapReady());
         $this->assertFalse($userA->isActive());
         $this->assertTrue($userA->isNew());
 
         $this->assertTrue($userB->fresh()->trashed());
         $this->assertTrue($domainB->fresh()->trashed());
         $this->assertFalse($domainA->fresh()->trashed());
 
         // Assert entitlements
         $this->assertSame(7, $entitlementsA->count()); // mailbox + groupware + 5 x storage
         $this->assertTrue($ent1->fresh()->trashed());
         $entitlementsA->get()->each(function ($ent) {
             $this->assertTrue($ent->updated_at->greaterThan(\Carbon\Carbon::now()->subSeconds(5)));
         });
 
         // We expect only CreateJob + UpdateJob pair for both user and domain.
         // Because how Illuminate/Database/Eloquent/SoftDeletes::restore() method
         // is implemented we cannot skip the UpdateJob in any way.
         // I don't want to overwrite this method, the extra job shouldn't do any harm.
         $this->assertCount(4, Queue::pushedJobs()); // @phpstan-ignore-line
         Queue::assertPushed(\App\Jobs\Domain\UpdateJob::class, 1);
         Queue::assertPushed(\App\Jobs\Domain\CreateJob::class, 1);
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
         Queue::assertPushed(\App\Jobs\User\CreateJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\User\CreateJob::class,
             function ($job) use ($userA) {
                 return $userA->id === TestCase::getObjectProperty($job, 'userId');
             }
         );
     }
 
     /**
      * Test user account restrict() and unrestrict()
      */
     public function testRestrictAndUnrestrict(): void
     {
         Queue::fake();
 
         // Test an account with users, domain
         $user = $this->getTestUser('UserAccountA@UserAccount.com');
         $userB = $this->getTestUser('UserAccountB@UserAccount.com');
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $domain = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
         $user->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $user);
         $user->assignPackage($package_kolab, $userB);
 
         $this->assertFalse($user->isRestricted());
         $this->assertFalse($userB->isRestricted());
 
         $user->restrict();
 
         $this->assertTrue($user->fresh()->isRestricted());
         $this->assertFalse($userB->fresh()->isRestricted());
 
         Queue::assertPushed(
             \App\Jobs\User\UpdateJob::class,
             function ($job) use ($user) {
                 return TestCase::getObjectProperty($job, 'userId') == $user->id;
             }
         );
 
         $userB->restrict();
         $this->assertTrue($userB->fresh()->isRestricted());
 
         Queue::fake(); // reset queue state
 
         $user->refresh();
         $user->unrestrict();
 
         $this->assertFalse($user->fresh()->isRestricted());
         $this->assertTrue($userB->fresh()->isRestricted());
 
         Queue::assertPushed(
             \App\Jobs\User\UpdateJob::class,
             function ($job) use ($user) {
                 return TestCase::getObjectProperty($job, 'userId') == $user->id;
             }
         );
 
         Queue::fake(); // reset queue state
 
         $user->unrestrict(true);
 
         $this->assertFalse($user->fresh()->isRestricted());
         $this->assertFalse($userB->fresh()->isRestricted());
 
         Queue::assertPushed(
             \App\Jobs\User\UpdateJob::class,
             function ($job) use ($userB) {
                 return TestCase::getObjectProperty($job, 'userId') == $userB->id;
             }
         );
     }
 
     /**
      * Tests for AliasesTrait::setAliases()
      */
     public function testSetAliases(): void
     {
         Queue::fake();
         Queue::assertNothingPushed();
 
         $user = $this->getTestUser('UserAccountA@UserAccount.com');
         $domain = $this->getTestDomain('UserAccount.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_HOSTED,
         ]);
 
         $this->assertCount(0, $user->aliases->all());
 
         $user->tenant->setSetting('pgp.enable', 1);
 
         // Add an alias
         $user->setAliases(['UserAlias1@UserAccount.com']);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
         Queue::assertPushed(\App\Jobs\PGP\KeyCreateJob::class, 1);
 
         $user->tenant->setSetting('pgp.enable', 0);
 
         $aliases = $user->aliases()->get();
         $this->assertCount(1, $aliases);
         $this->assertSame('useralias1@useraccount.com', $aliases[0]['alias']);
 
         // Add another alias
         $user->setAliases(['UserAlias1@UserAccount.com', 'UserAlias2@UserAccount.com']);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 2);
         Queue::assertPushed(\App\Jobs\PGP\KeyCreateJob::class, 1);
 
         $aliases = $user->aliases()->orderBy('alias')->get();
         $this->assertCount(2, $aliases);
         $this->assertSame('useralias1@useraccount.com', $aliases[0]->alias);
         $this->assertSame('useralias2@useraccount.com', $aliases[1]->alias);
 
         $user->tenant->setSetting('pgp.enable', 1);
 
         // Remove an alias
         $user->setAliases(['UserAlias1@UserAccount.com']);
 
         $user->tenant->setSetting('pgp.enable', 0);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 3);
         Queue::assertPushed(\App\Jobs\PGP\KeyDeleteJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\PGP\KeyDeleteJob::class,
             function ($job) use ($user) {
                 $userId = TestCase::getObjectProperty($job, 'userId');
                 $userEmail = TestCase::getObjectProperty($job, 'userEmail');
                 return $userId == $user->id && $userEmail === 'useralias2@useraccount.com';
             }
         );
 
         $aliases = $user->aliases()->get();
         $this->assertCount(1, $aliases);
         $this->assertSame('useralias1@useraccount.com', $aliases[0]['alias']);
 
         // Remove all aliases
         $user->setAliases([]);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 4);
 
         $this->assertCount(0, $user->aliases()->get());
     }
 
     /**
      * Tests for UserSettingsTrait::setSettings() and getSetting() and getSettings()
      */
     public function testUserSettings(): void
     {
         Queue::fake();
         Queue::assertNothingPushed();
 
         $user = $this->getTestUser('UserAccountA@UserAccount.com');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 0);
 
         // Test default settings
         // Note: Technicly this tests UserObserver::created() behavior
         $all_settings = $user->settings()->orderBy('key')->get();
         $this->assertCount(2, $all_settings);
         $this->assertSame('country', $all_settings[0]->key);
         $this->assertSame('CH', $all_settings[0]->value);
         $this->assertSame('currency', $all_settings[1]->key);
         $this->assertSame('CHF', $all_settings[1]->value);
 
         // Add a setting
         $user->setSetting('first_name', 'Firstname');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 1);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame('Firstname', $user->getSetting('first_name'));
         $this->assertSame('Firstname', $user->fresh()->getSetting('first_name'));
 
         // Update a setting
         $user->setSetting('first_name', 'Firstname1');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 2);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame('Firstname1', $user->getSetting('first_name'));
         $this->assertSame('Firstname1', $user->fresh()->getSetting('first_name'));
 
         // Delete a setting (null)
         $user->setSetting('first_name', null);
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 3);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame(null, $user->getSetting('first_name'));
         $this->assertSame(null, $user->fresh()->getSetting('first_name'));
 
         // Delete a setting (empty string)
         $user->setSetting('first_name', 'Firstname1');
         $user->setSetting('first_name', '');
 
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 5);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame(null, $user->getSetting('first_name'));
         $this->assertSame(null, $user->fresh()->getSetting('first_name'));
 
         // Set multiple settings at once
         $user->setSettings([
                 'first_name' => 'Firstname2',
                 'last_name' => 'Lastname2',
                 'country' => null,
         ]);
 
         // TODO: This really should create a single UserUpdate job, not 3
         Queue::assertPushed(\App\Jobs\User\UpdateJob::class, 7);
 
         // Note: We test both current user as well as fresh user object
         //       to make sure cache works as expected
         $this->assertSame('Firstname2', $user->getSetting('first_name'));
         $this->assertSame('Firstname2', $user->fresh()->getSetting('first_name'));
         $this->assertSame('Lastname2', $user->getSetting('last_name'));
         $this->assertSame('Lastname2', $user->fresh()->getSetting('last_name'));
         $this->assertSame(null, $user->getSetting('country'));
         $this->assertSame(null, $user->fresh()->getSetting('country'));
 
         $all_settings = $user->settings()->orderBy('key')->get();
         $this->assertCount(3, $all_settings);
 
         // Test getSettings() method
         $this->assertSame(
             [
                 'first_name' => 'Firstname2',
                 'last_name' => 'Lastname2',
                 'unknown' => null,
             ],
             $user->getSettings(['first_name', 'last_name', 'unknown'])
         );
     }
 
     /**
      * Tests for User::users()
      */
     public function testUsers(): void
     {
         $jack = $this->getTestUser('jack@kolab.org');
         $joe = $this->getTestUser('joe@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $wallet = $john->wallets()->first();
 
         $users = $john->users()->orderBy('email')->get();
 
         $this->assertCount(4, $users);
         $this->assertEquals($jack->id, $users[0]->id);
         $this->assertEquals($joe->id, $users[1]->id);
         $this->assertEquals($john->id, $users[2]->id);
         $this->assertEquals($ned->id, $users[3]->id);
 
         $users = $jack->users()->orderBy('email')->get();
 
         $this->assertCount(0, $users);
 
         $users = $ned->users()->orderBy('email')->get();
 
         $this->assertCount(4, $users);
     }
 
     /**
      * Tests for User::walletOwner() (from EntitleableTrait)
      */
     public function testWalletOwner(): void
     {
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         $this->assertSame($john->id, $john->walletOwner()->id);
         $this->assertSame($john->id, $jack->walletOwner()->id);
         $this->assertSame($john->id, $ned->walletOwner()->id);
 
         // User with no entitlements
         $user = $this->getTestUser('UserAccountA@UserAccount.com');
         $this->assertSame($user->id, $user->walletOwner()->id);
     }
 
     /**
      * Tests for User::wallets()
      */
     public function testWallets(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         $this->assertSame(1, $john->wallets()->count());
         $this->assertCount(1, $john->wallets);
         $this->assertInstanceOf(\App\Wallet::class, $john->wallets->first());
 
         $this->assertSame(1, $ned->wallets()->count());
         $this->assertCount(1, $ned->wallets);
         $this->assertInstanceOf(\App\Wallet::class, $ned->wallets->first());
     }
 }