diff --git a/src/app/AuthAttempt.php b/src/app/AuthAttempt.php
index eb0a3ad6..7e5a3ccd 100644
--- a/src/app/AuthAttempt.php
+++ b/src/app/AuthAttempt.php
@@ -1,197 +1,196 @@
 <?php
 
 namespace App;
 
 use Illuminate\Database\Eloquent\Model;
 use Iatstuti\Database\Support\NullableFields;
+use App\Traits\UuidStrKeyTrait;
 use Carbon\Carbon;
 
 /**
  * The eloquent definition of an AuthAttempt.
  *
  * An AuthAttempt represents an authenticaton attempt from an application/client.
  */
 class AuthAttempt extends Model
 {
     use NullableFields;
+    use UuidStrKeyTrait;
 
     // No specific reason
     public const REASON_NONE = '';
     // Password mismatch
     public const REASON_PASSWORD = 'password';
     // Geolocation whitelist mismatch
     public const REASON_GEOLOCATION = 'geolocation';
 
     private const STATUS_ACCEPTED  = 'ACCEPTED';
     private const STATUS_DENIED  = 'DENIED';
 
     protected $nullable = [
         'reason',
     ];
 
     protected $fillable = [
         'ip',
         'user_id',
         'status',
         'reason',
         'expires_at',
         'last_seen',
     ];
 
     protected $casts = [
         'expires_at' => 'datetime',
         'last_seen' => 'datetime'
     ];
 
-    public $incrementing = false;
-    protected $keyType = 'string';
-
     /**
     * Prepare a date for array / JSON serialization.
     *
     * Required to not omit timezone and match the format of update_at/created_at timestamps.
     *
     * @param  \DateTimeInterface  $date
     * @return string
     */
     protected function serializeDate(\DateTimeInterface $date): string
     {
         return Carbon::instance($date)->toIso8601ZuluString('microseconds');
     }
 
     /**
     * Returns true if the authentication attempt is accepted.
     *
     * @return bool
     */
     public function isAccepted(): bool
     {
         if ($this->status == self::STATUS_ACCEPTED && Carbon::now() < $this->expires_at) {
             return true;
         }
         return false;
     }
 
     /**
     * Returns true if the authentication attempt is denied.
     *
     * @return bool
     */
     public function isDenied(): bool
     {
         return ($this->status == self::STATUS_DENIED);
     }
 
     /**
     * Accept the authentication attempt.
     */
     public function accept($reason = AuthAttempt::REASON_NONE)
     {
         $this->expires_at = Carbon::now()->addHours(8);
         $this->status = self::STATUS_ACCEPTED;
         $this->reason = $reason;
         $this->save();
     }
 
     /**
     * Deny the authentication attempt.
     */
     public function deny($reason = AuthAttempt::REASON_NONE)
     {
         $this->status = self::STATUS_DENIED;
         $this->reason = $reason;
         $this->save();
     }
 
     /**
     * Notify the user of this authentication attempt.
     *
     * @return bool false if there was no means to notify
     */
     public function notify(): bool
     {
         return \App\CompanionApp::notifyUser($this->user_id, ['token' => $this->id]);
     }
 
     /**
     * Notify the user and wait for a confirmation.
     */
     private function notifyAndWait()
     {
         if (!$this->notify()) {
             //FIXME if the webclient can confirm too we don't need to abort here.
             \Log::warning("There is no 2fa device to notify.");
             return false;
         }
 
         \Log::debug("Authentication attempt: {$this->id}");
 
         $confirmationTimeout = 120;
         $timeout = Carbon::now()->addSeconds($confirmationTimeout);
 
         do {
             if ($this->isDenied()) {
                 \Log::debug("The authentication attempt was denied {$this->id}");
                 return false;
             }
 
             if ($this->isAccepted()) {
                 \Log::debug("The authentication attempt was accepted {$this->id}");
                 return true;
             }
 
             if ($timeout < Carbon::now()) {
                 \Log::debug("The authentication attempt timed-out: {$this->id}");
                 return false;
             }
 
             sleep(2);
             $this->refresh();
         } while (true);
     }
 
     /**
     * Record a new authentication attempt or update an existing one.
     *
     * @param \App\User $user     The user attempting to authenticate.
     * @param string    $clientIP The ip the authentication attempt is coming from.
     *
     * @return \App\AuthAttempt
     */
     public static function recordAuthAttempt(\App\User $user, $clientIP)
     {
         $authAttempt = \App\AuthAttempt::where('ip', $clientIP)->where('user_id', $user->id)->first();
 
         if (!$authAttempt) {
             $authAttempt = new \App\AuthAttempt();
             $authAttempt->ip = $clientIP;
             $authAttempt->user_id = $user->id;
         }
 
         $authAttempt->last_seen = Carbon::now();
         $authAttempt->save();
 
         return $authAttempt;
     }
 
     /**
     * Trigger a notification if necessary and wait for confirmation.
     *
     * @return bool Returns true if the attempt is accepted on confirmation
     */
     public function waitFor2FA(): bool
     {
         if ($this->isAccepted()) {
             return true;
         }
         if ($this->isDenied()) {
             return false;
         }
 
         if (!$this->notifyAndWait()) {
             return false;
         }
 
         return $this->isAccepted();
     }
 }
diff --git a/src/app/Discount.php b/src/app/Discount.php
index 3917961e..493c9725 100644
--- a/src/app/Discount.php
+++ b/src/app/Discount.php
@@ -1,81 +1,80 @@
 <?php
 
 namespace App;
 
+use App\Traits\UuidStrKeyTrait;
 use Illuminate\Database\Eloquent\Model;
 use Spatie\Translatable\HasTranslations;
 
 /**
  * The eloquent definition of a Discount.
  *
  * @property bool   $active
  * @property string $code
  * @property string $description
  * @property int    $discount
  * @property int    $tenant_id
  */
 class Discount extends Model
 {
     use HasTranslations;
-
-    public $incrementing = false;
-    protected $keyType = 'string';
+    use UuidStrKeyTrait;
 
     protected $casts = [
         'discount' => 'integer',
     ];
 
     protected $fillable = [
         'active',
         'code',
         'description',
         'discount',
     ];
 
     /** @var array Translatable properties */
     public $translatable = [
         'description',
     ];
 
     /**
      * Discount value mutator
      *
      * @throws \Exception
      */
     public function setDiscountAttribute($discount)
     {
         $discount = (int) $discount;
 
         if ($discount < 0) {
             \Log::warning("Expecting a discount rate >= 0");
             $discount = 0;
         }
 
         if ($discount > 100) {
             \Log::warning("Expecting a discount rate <= 100");
             $discount = 100;
         }
 
         $this->attributes['discount'] = $discount;
     }
 
     /**
      * The tenant for this discount.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function tenant()
     {
         return $this->belongsTo('App\Tenant', 'tenant_id', 'id');
     }
 
     /**
      * List of wallets with this discount assigned.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function wallets()
     {
         return $this->hasMany('App\Wallet');
     }
 }
diff --git a/src/app/Domain.php b/src/app/Domain.php
index b69759f7..cdd88fdc 100644
--- a/src/app/Domain.php
+++ b/src/app/Domain.php
@@ -1,515 +1,513 @@
 <?php
 
 namespace App;
 
 use App\Wallet;
+use App\Traits\UuidIntKeyTrait;
 use App\Traits\DomainConfigTrait;
 use App\Traits\SettingsTrait;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 /**
  * The eloquent definition of a Domain.
  *
  * @property string $namespace
  * @property int    $status
  * @property int    $tenant_id
  * @property int    $type
  */
 class Domain extends Model
 {
+    use UuidIntKeyTrait;
     use DomainConfigTrait;
     use SettingsTrait;
     use SoftDeletes;
 
     // we've simply never heard of this domain
     public const STATUS_NEW        = 1 << 0;
     // it's been activated
     public const STATUS_ACTIVE     = 1 << 1;
     // domain has been suspended.
     public const STATUS_SUSPENDED  = 1 << 2;
     // domain has been deleted
     public const STATUS_DELETED    = 1 << 3;
     // ownership of the domain has been confirmed
     public const STATUS_CONFIRMED  = 1 << 4;
     // domain has been verified that it exists in DNS
     public const STATUS_VERIFIED   = 1 << 5;
     // domain has been created in LDAP
     public const STATUS_LDAP_READY = 1 << 6;
 
     // open for public registration
     public const TYPE_PUBLIC       = 1 << 0;
     // zone hosted with us
     public const TYPE_HOSTED       = 1 << 1;
     // zone registered externally
     public const TYPE_EXTERNAL     = 1 << 2;
 
     public const HASH_CODE = 1;
     public const HASH_TEXT = 2;
     public const HASH_CNAME = 3;
 
-    public $incrementing = false;
-
-    protected $keyType = 'bigint';
-
     protected $fillable = [
         'namespace',
         'status',
         'type'
     ];
 
     /**
      * Assign a package to a domain. The domain should not belong to any existing entitlements.
      *
      * @param \App\Package $package The package to assign.
      * @param \App\User    $user    The wallet owner.
      *
      * @return \App\Domain Self
      */
     public function assignPackage($package, $user)
     {
         // If this domain is public it can not be assigned to a user.
         if ($this->isPublic()) {
             return $this;
         }
 
         // See if this domain is already owned by another user.
         $wallet = $this->wallet();
 
         if ($wallet) {
             \Log::error(
                 "Domain {$this->namespace} is already assigned to {$wallet->owner->email}"
             );
 
             return $this;
         }
 
         $wallet_id = $user->wallets()->first()->id;
 
         foreach ($package->skus as $sku) {
             for ($i = $sku->pivot->qty; $i > 0; $i--) {
                 \App\Entitlement::create(
                     [
                         'wallet_id' => $wallet_id,
                         'sku_id' => $sku->id,
                         'cost' => $sku->pivot->cost(),
                         'fee' => $sku->pivot->fee(),
                         'entitleable_id' => $this->id,
                         'entitleable_type' => Domain::class
                     ]
                 );
             }
         }
 
         return $this;
     }
 
     /**
      * The domain entitlement.
      *
      * @return \Illuminate\Database\Eloquent\Relations\MorphOne
      */
     public function entitlement()
     {
         return $this->morphOne('App\Entitlement', 'entitleable');
     }
 
     /**
      * Return list of public+active domain names (for current tenant)
      */
     public static function getPublicDomains(): array
     {
         return self::withEnvTenantContext()
             ->whereRaw(sprintf('(type & %s)', Domain::TYPE_PUBLIC))
             ->get(['namespace'])->pluck('namespace')->toArray();
     }
 
     /**
      * Returns whether this domain is active.
      *
      * @return bool
      */
     public function isActive(): bool
     {
         return ($this->status & self::STATUS_ACTIVE) > 0;
     }
 
     /**
      * Returns whether this domain is confirmed the ownership of.
      *
      * @return bool
      */
     public function isConfirmed(): bool
     {
         return ($this->status & self::STATUS_CONFIRMED) > 0;
     }
 
     /**
      * Returns whether this domain is deleted.
      *
      * @return bool
      */
     public function isDeleted(): bool
     {
         return ($this->status & self::STATUS_DELETED) > 0;
     }
 
     /**
      * Returns whether this domain is registered with us.
      *
      * @return bool
      */
     public function isExternal(): bool
     {
         return ($this->type & self::TYPE_EXTERNAL) > 0;
     }
 
     /**
      * Returns whether this domain is hosted with us.
      *
      * @return bool
      */
     public function isHosted(): bool
     {
         return ($this->type & self::TYPE_HOSTED) > 0;
     }
 
     /**
      * Returns whether this domain is new.
      *
      * @return bool
      */
     public function isNew(): bool
     {
         return ($this->status & self::STATUS_NEW) > 0;
     }
 
     /**
      * Returns whether this domain is public.
      *
      * @return bool
      */
     public function isPublic(): bool
     {
         return ($this->type & self::TYPE_PUBLIC) > 0;
     }
 
     /**
      * Returns whether this domain is registered in LDAP.
      *
      * @return bool
      */
     public function isLdapReady(): bool
     {
         return ($this->status & self::STATUS_LDAP_READY) > 0;
     }
 
     /**
      * Returns whether this domain is suspended.
      *
      * @return bool
      */
     public function isSuspended(): bool
     {
         return ($this->status & self::STATUS_SUSPENDED) > 0;
     }
 
     /**
      * Returns whether this (external) domain has been verified
      * to exist in DNS.
      *
      * @return bool
      */
     public function isVerified(): bool
     {
         return ($this->status & self::STATUS_VERIFIED) > 0;
     }
 
     /**
      * Ensure the namespace is appropriately cased.
      */
     public function setNamespaceAttribute($namespace)
     {
         $this->attributes['namespace'] = strtolower($namespace);
     }
 
     /**
      * Domain status mutator
      *
      * @throws \Exception
      */
     public function setStatusAttribute($status)
     {
         $new_status = 0;
 
         $allowed_values = [
             self::STATUS_NEW,
             self::STATUS_ACTIVE,
             self::STATUS_SUSPENDED,
             self::STATUS_DELETED,
             self::STATUS_CONFIRMED,
             self::STATUS_VERIFIED,
             self::STATUS_LDAP_READY,
         ];
 
         foreach ($allowed_values as $value) {
             if ($status & $value) {
                 $new_status |= $value;
                 $status ^= $value;
             }
         }
 
         if ($status > 0) {
             throw new \Exception("Invalid domain status: {$status}");
         }
 
         if ($this->isPublic()) {
             $this->attributes['status'] = $new_status;
             return;
         }
 
         if ($new_status & self::STATUS_CONFIRMED) {
             // if we have confirmed ownership of or management access to the domain, then we have
             // also confirmed the domain exists in DNS.
             $new_status |= self::STATUS_VERIFIED;
             $new_status |= self::STATUS_ACTIVE;
         }
 
         if ($new_status & self::STATUS_DELETED && $new_status & self::STATUS_ACTIVE) {
             $new_status ^= self::STATUS_ACTIVE;
         }
 
         if ($new_status & self::STATUS_SUSPENDED && $new_status & self::STATUS_ACTIVE) {
             $new_status ^= self::STATUS_ACTIVE;
         }
 
         // if the domain is now active, it is not new anymore.
         if ($new_status & self::STATUS_ACTIVE && $new_status & self::STATUS_NEW) {
             $new_status ^= self::STATUS_NEW;
         }
 
         $this->attributes['status'] = $new_status;
     }
 
     /**
      * Ownership verification by checking for a TXT (or CNAME) record
      * in the domain's DNS (that matches the verification hash).
      *
      * @return bool True if verification was successful, false otherwise
      * @throws \Exception Throws exception on DNS or DB errors
      */
     public function confirm(): bool
     {
         if ($this->isConfirmed()) {
             return true;
         }
 
         $hash = $this->hash(self::HASH_TEXT);
         $confirmed = false;
 
         // Get DNS records and find a matching TXT entry
         $records = \dns_get_record($this->namespace, DNS_TXT);
 
         if ($records === false) {
             throw new \Exception("Failed to get DNS record for {$this->namespace}");
         }
 
         foreach ($records as $record) {
             if ($record['txt'] === $hash) {
                 $confirmed = true;
                 break;
             }
         }
 
         // Get DNS records and find a matching CNAME entry
         // Note: some servers resolve every non-existing name
         // so we need to define left and right side of the CNAME record
         // i.e.: kolab-verify IN CNAME <hash>.domain.tld.
         if (!$confirmed) {
             $cname = $this->hash(self::HASH_CODE) . '.' . $this->namespace;
             $records = \dns_get_record('kolab-verify.' . $this->namespace, DNS_CNAME);
 
             if ($records === false) {
                 throw new \Exception("Failed to get DNS record for {$this->namespace}");
             }
 
             foreach ($records as $records) {
                 if ($records['target'] === $cname) {
                     $confirmed = true;
                     break;
                 }
             }
         }
 
         if ($confirmed) {
             $this->status |= Domain::STATUS_CONFIRMED;
             $this->save();
         }
 
         return $confirmed;
     }
 
     /**
      * Generate a verification hash for this domain
      *
      * @param int $mod One of: HASH_CNAME, HASH_CODE (Default), HASH_TEXT
      *
      * @return string Verification hash
      */
     public function hash($mod = null): string
     {
         $cname = 'kolab-verify';
 
         if ($mod === self::HASH_CNAME) {
             return $cname;
         }
 
         $hash = \md5('hkccp-verify-' . $this->namespace);
 
         return $mod === self::HASH_TEXT ? "$cname=$hash" : $hash;
     }
 
     /**
      * Any (additional) properties of this domain.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function settings()
     {
         return $this->hasMany('App\DomainSetting', 'domain_id');
     }
 
     /**
      * Suspend this domain.
      *
      * @return void
      */
     public function suspend(): void
     {
         if ($this->isSuspended()) {
             return;
         }
 
         $this->status |= Domain::STATUS_SUSPENDED;
         $this->save();
     }
 
     /**
      * The tenant for this domain.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function tenant()
     {
         return $this->belongsTo('App\Tenant', 'tenant_id', 'id');
     }
 
     /**
      * Unsuspend this domain.
      *
      * The domain is unsuspended through either of the following courses of actions;
      *
      *   * The account balance has been topped up, or
      *   * a suspected spammer has resolved their issues, or
      *   * the command-line is triggered.
      *
      * Therefore, we can also confidently set the domain status to 'active' should the ownership of or management
      * access to have been confirmed before.
      *
      * @return void
      */
     public function unsuspend(): void
     {
         if (!$this->isSuspended()) {
             return;
         }
 
         $this->status ^= Domain::STATUS_SUSPENDED;
 
         if ($this->isConfirmed() && $this->isVerified()) {
             $this->status |= Domain::STATUS_ACTIVE;
         }
 
         $this->save();
     }
 
     /**
      * List the users of a domain, so long as the domain is not a public registration domain.
      *
      * @return array
      */
     public function users(): array
     {
         if ($this->isPublic()) {
             return [];
         }
 
         $wallet = $this->wallet();
 
         if (!$wallet) {
             return [];
         }
 
         $mailboxSKU = \App\Sku::withObjectTenantContext($this)->where('title', 'mailbox')->first();
 
         if (!$mailboxSKU) {
             \Log::error("No mailbox SKU available.");
             return [];
         }
 
         $entitlements = $wallet->entitlements()
             ->where('entitleable_type', \App\User::class)
             ->where('sku_id', $mailboxSKU->id)->get();
 
         $users = [];
 
         foreach ($entitlements as $entitlement) {
             $users[] = $entitlement->entitleable;
         }
 
         return $users;
     }
 
     /**
      * Verify if a domain exists in DNS
      *
      * @return bool True if registered, False otherwise
      * @throws \Exception Throws exception on DNS or DB errors
      */
     public function verify(): bool
     {
         if ($this->isVerified()) {
             return true;
         }
 
         $records = \dns_get_record($this->namespace, DNS_ANY);
 
         if ($records === false) {
             throw new \Exception("Failed to get DNS record for {$this->namespace}");
         }
 
         // It may happen that result contains other domains depending on the host DNS setup
         // that's why in_array() and not just !empty()
         if (in_array($this->namespace, array_column($records, 'host'))) {
             $this->status |= Domain::STATUS_VERIFIED;
             $this->save();
 
             return true;
         }
 
         return false;
     }
 
     /**
      * Returns the wallet by which the domain is controlled
      *
      * @return \App\Wallet A wallet object
      */
     public function wallet(): ?Wallet
     {
         // Note: Not all domains have a entitlement/wallet
         $entitlement = $this->entitlement()->withTrashed()->orderBy('created_at', 'desc')->first();
 
         return $entitlement ? $entitlement->wallet : null;
     }
 }
diff --git a/src/app/Entitlement.php b/src/app/Entitlement.php
index cf147f72..f2e8074e 100644
--- a/src/app/Entitlement.php
+++ b/src/app/Entitlement.php
@@ -1,159 +1,147 @@
 <?php
 
 namespace App;
 
 use Carbon\Carbon;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\SoftDeletes;
+use App\Traits\UuidStrKeyTrait;
 
 /**
  * The eloquent definition of an Entitlement.
  *
  * Owned by a {@link \App\User}, billed to a {@link \App\Wallet}.
  *
  * @property int                   $cost
  * @property ?string               $description
  * @property \App\Domain|\App\User $entitleable      The entitled object (receiver of the entitlement).
  * @property int                   $entitleable_id
  * @property string                $entitleable_type
  * @property int                   $fee
  * @property string                $id
  * @property \App\User             $owner            The owner of this entitlement (subject).
  * @property \App\Sku              $sku              The SKU to which this entitlement applies.
  * @property string                $sku_id
  * @property \App\Wallet           $wallet           The wallet to which this entitlement is charged.
  * @property string                $wallet_id
  */
 class Entitlement extends Model
 {
     use SoftDeletes;
-
-    /**
-     * This table does not use auto-increment.
-     *
-     * @var boolean
-     */
-    public $incrementing = false;
-
-    /**
-     * The key type is actually a string.
-     *
-     * @var string
-     */
-    protected $keyType = 'string';
+    use UuidStrKeyTrait;
 
     /**
      * The fillable columns for this Entitlement
      *
      * @var array
      */
     protected $fillable = [
         'sku_id',
         'wallet_id',
         'entitleable_id',
         'entitleable_type',
         'cost',
         'description',
         'fee',
     ];
 
     protected $casts = [
         'cost' => 'integer',
         'fee' => 'integer'
     ];
 
     /**
      * Return the costs per day for this entitlement.
      *
      * @return float
      */
     public function costsPerDay()
     {
         if ($this->cost == 0) {
             return (float) 0;
         }
 
         $discount = $this->wallet->getDiscountRate();
 
         $daysInLastMonth = \App\Utils::daysInLastMonth();
 
         $costsPerDay = (float) ($this->cost * $discount) / $daysInLastMonth;
 
         return $costsPerDay;
     }
 
     /**
      * Create a transaction record for this entitlement.
      *
      * @param string $type The type of transaction ('created', 'billed', 'deleted'), but use the
      *                     \App\Transaction constants.
      * @param int $amount  The amount involved in cents
      *
      * @return string The transaction ID
      */
     public function createTransaction($type, $amount = null)
     {
         $transaction = \App\Transaction::create(
             [
                 'object_id' => $this->id,
                 'object_type' => \App\Entitlement::class,
                 'type' => $type,
                 'amount' => $amount
             ]
         );
 
         return $transaction->id;
     }
 
     /**
      * Principally entitleable objects such as 'Domain' or 'User'.
      *
      * @return mixed
      */
     public function entitleable()
     {
         return $this->morphTo();
     }
 
     /**
      * Returns entitleable object title (e.g. email or domain name).
      *
      * @return string|null An object title/name
      */
     public function entitleableTitle(): ?string
     {
         if ($this->entitleable instanceof \App\Domain) {
             return $this->entitleable->namespace;
         }
 
         return $this->entitleable->email;
     }
 
     /**
      * The SKU concerned.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function sku()
     {
         return $this->belongsTo('App\Sku');
     }
 
     /**
      * The wallet this entitlement is being billed to
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function wallet()
     {
         return $this->belongsTo('App\Wallet');
     }
 
     /**
      * Cost mutator. Make sure cost is integer.
      */
     public function setCostAttribute($cost): void
     {
         $this->attributes['cost'] = round($cost);
     }
 }
diff --git a/src/app/Group.php b/src/app/Group.php
index a131f742..32009e3c 100644
--- a/src/app/Group.php
+++ b/src/app/Group.php
@@ -1,292 +1,290 @@
 <?php
 
 namespace App;
 
+use App\Traits\UuidIntKeyTrait;
 use App\Wallet;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 /**
  * The eloquent definition of a Group.
  *
  * @property int    $id        The group identifier
  * @property string $email     An email address
  * @property string $members   A comma-separated list of email addresses
  * @property int    $status    The group status
  * @property int    $tenant_id Tenant identifier
  */
 class Group extends Model
 {
+    use UuidIntKeyTrait;
     use SoftDeletes;
 
     // we've simply never heard of this domain
     public const STATUS_NEW        = 1 << 0;
     // it's been activated
     public const STATUS_ACTIVE     = 1 << 1;
     // domain has been suspended.
     public const STATUS_SUSPENDED  = 1 << 2;
     // domain has been deleted
     public const STATUS_DELETED    = 1 << 3;
     // domain has been created in LDAP
     public const STATUS_LDAP_READY = 1 << 4;
 
-    public $incrementing = false;
-
-    protected $keyType = 'bigint';
-
     protected $fillable = [
         'email',
         'status',
         'members'
     ];
 
     /**
      * Assign the group to a wallet.
      *
      * @param \App\Wallet $wallet The wallet
      *
      * @return \App\Group Self
      * @throws \Exception
      */
     public function assignToWallet(Wallet $wallet): Group
     {
         if (empty($this->id)) {
             throw new \Exception("Group not yet exists");
         }
 
         if ($this->entitlement()->count()) {
             throw new \Exception("Group already assigned to a wallet");
         }
 
         $sku = \App\Sku::withObjectTenantContext($this)->where('title', 'group')->first();
         $exists = $wallet->entitlements()->where('sku_id', $sku->id)->count();
 
         \App\Entitlement::create([
             'wallet_id' => $wallet->id,
             'sku_id' => $sku->id,
             'cost' => $exists >= $sku->units_free ? $sku->cost : 0,
             'fee' => $exists >= $sku->units_free ? $sku->fee : 0,
             'entitleable_id' => $this->id,
             'entitleable_type' => Group::class
         ]);
 
         return $this;
     }
 
     /**
      * Returns group domain.
      *
      * @return ?\App\Domain The domain group belongs to, NULL if it does not exist
      */
     public function domain(): ?Domain
     {
         list($local, $domainName) = explode('@', $this->email);
 
         return Domain::where('namespace', $domainName)->first();
     }
 
     /**
      * Find whether an email address exists as a group (including deleted groups).
      *
      * @param string $email        Email address
      * @param bool   $return_group Return Group instance instead of boolean
      *
      * @return \App\Group|bool True or Group model object if found, False otherwise
      */
     public static function emailExists(string $email, bool $return_group = false)
     {
         if (strpos($email, '@') === false) {
             return false;
         }
 
         $email = \strtolower($email);
 
         $group = self::withTrashed()->where('email', $email)->first();
 
         if ($group) {
             return $return_group ? $group : true;
         }
 
         return false;
     }
 
     /**
      * The group entitlement.
      *
      * @return \Illuminate\Database\Eloquent\Relations\MorphOne
      */
     public function entitlement()
     {
         return $this->morphOne('App\Entitlement', 'entitleable');
     }
 
     /**
      * Group members propert accessor. Converts internal comma-separated list into an array
      *
      * @param string $members Comma-separated list of email addresses
      *
      * @return array Email addresses of the group members, as an array
      */
     public function getMembersAttribute($members): array
     {
         return $members ? explode(',', $members) : [];
     }
 
     /**
      * Returns whether this domain is active.
      *
      * @return bool
      */
     public function isActive(): bool
     {
         return ($this->status & self::STATUS_ACTIVE) > 0;
     }
 
     /**
      * Returns whether this domain is deleted.
      *
      * @return bool
      */
     public function isDeleted(): bool
     {
         return ($this->status & self::STATUS_DELETED) > 0;
     }
 
     /**
      * Returns whether this domain is new.
      *
      * @return bool
      */
     public function isNew(): bool
     {
         return ($this->status & self::STATUS_NEW) > 0;
     }
 
     /**
      * Returns whether this domain is registered in LDAP.
      *
      * @return bool
      */
     public function isLdapReady(): bool
     {
         return ($this->status & self::STATUS_LDAP_READY) > 0;
     }
 
     /**
      * Returns whether this domain is suspended.
      *
      * @return bool
      */
     public function isSuspended(): bool
     {
         return ($this->status & self::STATUS_SUSPENDED) > 0;
     }
 
     /**
      * Ensure the email is appropriately cased.
      *
      * @param string $email Group email address
      */
     public function setEmailAttribute(string $email)
     {
         $this->attributes['email'] = strtolower($email);
     }
 
     /**
      * Ensure the members are appropriately formatted.
      *
      * @param array $members Email addresses of the group members
      */
     public function setMembersAttribute(array $members): void
     {
         $members = array_unique(array_filter(array_map('strtolower', $members)));
 
         sort($members);
 
         $this->attributes['members'] = implode(',', $members);
     }
 
     /**
      * Group status mutator
      *
      * @throws \Exception
      */
     public function setStatusAttribute($status)
     {
         $new_status = 0;
 
         $allowed_values = [
             self::STATUS_NEW,
             self::STATUS_ACTIVE,
             self::STATUS_SUSPENDED,
             self::STATUS_DELETED,
             self::STATUS_LDAP_READY,
         ];
 
         foreach ($allowed_values as $value) {
             if ($status & $value) {
                 $new_status |= $value;
                 $status ^= $value;
             }
         }
 
         if ($status > 0) {
             throw new \Exception("Invalid group status: {$status}");
         }
 
         $this->attributes['status'] = $new_status;
     }
 
     /**
      * Suspend this group.
      *
      * @return void
      */
     public function suspend(): void
     {
         if ($this->isSuspended()) {
             return;
         }
 
         $this->status |= Group::STATUS_SUSPENDED;
         $this->save();
     }
 
     /**
      * The tenant for this group.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function tenant()
     {
         return $this->belongsTo('App\Tenant', 'tenant_id', 'id');
     }
 
     /**
      * Unsuspend this group.
      *
      * @return void
      */
     public function unsuspend(): void
     {
         if (!$this->isSuspended()) {
             return;
         }
 
         $this->status ^= Group::STATUS_SUSPENDED;
         $this->save();
     }
 
     /**
      * Returns the wallet by which the group is controlled
      *
      * @return \App\Wallet A wallet object
      */
     public function wallet(): ?Wallet
     {
         // Note: Not all domains have a entitlement/wallet
         $entitlement = $this->entitlement()->withTrashed()->orderBy('created_at', 'desc')->first();
 
         return $entitlement ? $entitlement->wallet : null;
     }
 }
diff --git a/src/app/Observers/AuthAttemptObserver.php b/src/app/Observers/AuthAttemptObserver.php
deleted file mode 100644
index 5a07428b..00000000
--- a/src/app/Observers/AuthAttemptObserver.php
+++ /dev/null
@@ -1,31 +0,0 @@
-<?php
-
-namespace App\Observers;
-
-use App\AuthAttempt;
-
-/**
- * This is an observer for the AuthAttempt model definition.
- */
-class AuthAttemptObserver
-{
-    /**
-     * Handle the "creating" event on an AuthAttempt.
-     *
-     * Ensures that the entry uses a custom ID (uuid).
-     *
-     * @param AuthAttempt $authAttempt The AuthAttempt being created.
-     *
-     * @return void
-     */
-    public function creating(AuthAttempt $authAttempt)
-    {
-        while (true) {
-            $allegedly_unique = \App\Utils::uuidStr();
-            if (!AuthAttempt::find($allegedly_unique)) {
-                $authAttempt->{$authAttempt->getKeyName()} = $allegedly_unique;
-                break;
-            }
-        }
-    }
-}
diff --git a/src/app/Observers/DiscountObserver.php b/src/app/Observers/DiscountObserver.php
index 7d9bd037..7abf41f4 100644
--- a/src/app/Observers/DiscountObserver.php
+++ b/src/app/Observers/DiscountObserver.php
@@ -1,31 +1,23 @@
 <?php
 
 namespace App\Observers;
 
 use App\Discount;
 
 /**
  * This is an observer for the Discount model definition.
  */
 class DiscountObserver
 {
     /**
      * Ensure the discount ID is a custom ID (uuid).
      *
      * @param \App\Discount $discount The discount object
      *
      * @return void
      */
     public function creating(Discount $discount): void
     {
-        while (true) {
-            $allegedly_unique = \App\Utils::uuidStr();
-            if (!Discount::find($allegedly_unique)) {
-                $discount->{$discount->getKeyName()} = $allegedly_unique;
-                break;
-            }
-        }
-
         $discount->tenant_id = \config('app.tenant_id');
     }
 }
diff --git a/src/app/Observers/DomainObserver.php b/src/app/Observers/DomainObserver.php
index e9003af0..fd0a12ed 100644
--- a/src/app/Observers/DomainObserver.php
+++ b/src/app/Observers/DomainObserver.php
@@ -1,159 +1,151 @@
 <?php
 
 namespace App\Observers;
 
 use App\Domain;
 use Illuminate\Support\Facades\DB;
 
 class DomainObserver
 {
     /**
      * Handle the domain "created" event.
      *
      * @param \App\Domain $domain The domain.
      *
      * @return void
      */
     public function creating(Domain $domain): void
     {
-        while (true) {
-            $allegedly_unique = \App\Utils::uuidInt();
-            if (!Domain::withTrashed()->find($allegedly_unique)) {
-                $domain->{$domain->getKeyName()} = $allegedly_unique;
-                break;
-            }
-        }
-
         $domain->namespace = \strtolower($domain->namespace);
 
         $domain->status |= Domain::STATUS_NEW;
 
         $domain->tenant_id = \config('app.tenant_id');
     }
 
     /**
      * Handle the domain "created" event.
      *
      * @param \App\Domain $domain The domain.
      *
      * @return void
      */
     public function created(Domain $domain)
     {
         // Create domain record in LDAP
         // Note: DomainCreate job will dispatch DomainVerify job
         \App\Jobs\Domain\CreateJob::dispatch($domain->id);
     }
 
     /**
      * Handle the domain "deleting" event.
      *
      * @param \App\Domain $domain The domain.
      *
      * @return void
      */
     public function deleting(Domain $domain)
     {
         // Entitlements do not have referential integrity on the entitled object, so this is our
         // way of doing an onDelete('cascade') without the foreign key.
         \App\Entitlement::where('entitleable_id', $domain->id)
             ->where('entitleable_type', Domain::class)
             ->delete();
     }
 
     /**
      * Handle the domain "deleted" event.
      *
      * @param \App\Domain $domain The domain.
      *
      * @return void
      */
     public function deleted(Domain $domain)
     {
         if ($domain->isForceDeleting()) {
             return;
         }
 
         \App\Jobs\Domain\DeleteJob::dispatch($domain->id);
     }
 
     /**
      * Handle the domain "updated" event.
      *
      * @param \App\Domain $domain The domain.
      *
      * @return void
      */
     public function updated(Domain $domain)
     {
         \App\Jobs\Domain\UpdateJob::dispatch($domain->id);
     }
 
     /**
      * Handle the domain "restoring" event.
      *
      * @param \App\Domain $domain The domain.
      *
      * @return void
      */
     public function restoring(Domain $domain)
     {
         // Make sure it's not DELETED/LDAP_READY/SUSPENDED
         if ($domain->isDeleted()) {
             $domain->status ^= Domain::STATUS_DELETED;
         }
         if ($domain->isLdapReady()) {
             $domain->status ^= Domain::STATUS_LDAP_READY;
         }
         if ($domain->isSuspended()) {
             $domain->status ^= Domain::STATUS_SUSPENDED;
         }
         if ($domain->isConfirmed() && $domain->isVerified()) {
             $domain->status |= Domain::STATUS_ACTIVE;
         }
 
         // Note: $domain->save() is invoked between 'restoring' and 'restored' events
     }
 
     /**
      * Handle the domain "restored" event.
      *
      * @param \App\Domain $domain The domain.
      *
      * @return void
      */
     public function restored(Domain $domain)
     {
         // Restore domain entitlements
         // We'll restore only these that were deleted last. So, first we get
         // the maximum deleted_at timestamp and then use it to select
         // domain entitlements for restore
         $deleted_at = \App\Entitlement::withTrashed()
             ->where('entitleable_id', $domain->id)
             ->where('entitleable_type', Domain::class)
             ->max('deleted_at');
 
         if ($deleted_at) {
             \App\Entitlement::withTrashed()
                 ->where('entitleable_id', $domain->id)
                 ->where('entitleable_type', Domain::class)
                 ->where('deleted_at', '>=', (new \Carbon\Carbon($deleted_at))->subMinute())
                 ->update(['updated_at' => now(), 'deleted_at' => null]);
         }
 
         // Create the domain in LDAP again
         \App\Jobs\Domain\CreateJob::dispatch($domain->id);
     }
 
     /**
      * Handle the domain "force deleted" event.
      *
      * @param \App\Domain $domain The domain.
      *
      * @return void
      */
     public function forceDeleted(Domain $domain)
     {
         //
     }
 }
diff --git a/src/app/Observers/EntitlementObserver.php b/src/app/Observers/EntitlementObserver.php
index 6f8cf0e7..7464094b 100644
--- a/src/app/Observers/EntitlementObserver.php
+++ b/src/app/Observers/EntitlementObserver.php
@@ -1,175 +1,167 @@
 <?php
 
 namespace App\Observers;
 
 use App\Entitlement;
 use Carbon\Carbon;
 
 /**
  * This is an observer for the Entitlement model definition.
  */
 class EntitlementObserver
 {
     /**
      * Handle the "creating" event on an Entitlement.
      *
      * Ensures that the entry uses a custom ID (uuid).
      *
      * Ensures that the {@link \App\Wallet} to which it is to be billed is owned or controlled by
      * the {@link \App\User} entitled.
      *
      * @param Entitlement $entitlement The entitlement being created.
      *
      * @return bool
      */
     public function creating(Entitlement $entitlement): bool
     {
         // can't dispatch job here because it'll fail serialization
 
         // Make sure the owner is at least a controller on the wallet
         $wallet = \App\Wallet::find($entitlement->wallet_id);
 
         if (!$wallet || !$wallet->owner) {
             return false;
         }
 
         $sku = \App\Sku::find($entitlement->sku_id);
 
         if (!$sku) {
             return false;
         }
 
         $result = $sku->handler_class::preReq($entitlement, $wallet->owner);
 
         if (!$result) {
             return false;
         }
 
-        while (true) {
-            $allegedly_unique = \App\Utils::uuidStr();
-            if (!Entitlement::withTrashed()->find($allegedly_unique)) {
-                $entitlement->{$entitlement->getKeyName()} = $allegedly_unique;
-                break;
-            }
-        }
-
         return true;
     }
 
     /**
      * Handle the entitlement "created" event.
      *
      * @param \App\Entitlement $entitlement The entitlement.
      *
      * @return void
      */
     public function created(Entitlement $entitlement)
     {
         $entitlement->entitleable->updated_at = Carbon::now();
         $entitlement->entitleable->save();
 
         $entitlement->createTransaction(\App\Transaction::ENTITLEMENT_CREATED);
     }
 
     /**
      * Handle the entitlement "deleted" event.
      *
      * @param \App\Entitlement $entitlement The entitlement.
      *
      * @return void
      */
     public function deleted(Entitlement $entitlement)
     {
         // Remove all configured 2FA methods from Roundcube database
         if ($entitlement->sku->title == '2fa') {
             // FIXME: Should that be an async job?
             $sf = new \App\Auth\SecondFactor($entitlement->entitleable);
             $sf->removeFactors();
         }
 
         $entitlement->entitleable->updated_at = Carbon::now();
         $entitlement->entitleable->save();
 
         $entitlement->createTransaction(\App\Transaction::ENTITLEMENT_DELETED);
     }
 
     /**
      * Handle the entitlement "deleting" event.
      *
      * @param \App\Entitlement $entitlement The entitlement.
      *
      * @return void
      */
     public function deleting(Entitlement $entitlement)
     {
         if ($entitlement->trashed()) {
             return;
         }
 
         // Start calculating the costs for the consumption of this entitlement if the
         // existing consumption spans >= 14 days.
         //
         // Effect is that anything's free for the first 14 days
         if ($entitlement->created_at >= Carbon::now()->subDays(14)) {
             return;
         }
 
         $owner = $entitlement->wallet->owner;
 
         // Determine if we're still within the free first month
         $freeMonthEnds = $owner->created_at->copy()->addMonthsWithoutOverflow(1);
 
         if ($freeMonthEnds >= Carbon::now()) {
             return;
         }
 
         $now = Carbon::now();
 
         // get the discount rate applied to the wallet.
         $discount = $entitlement->wallet->getDiscountRate();
 
         // just in case this had not been billed yet, ever
         $diffInMonths = $entitlement->updated_at->diffInMonths($now);
         $cost = (int) ($entitlement->cost * $discount * $diffInMonths);
         $fee = (int) ($entitlement->fee * $diffInMonths);
 
         // this moves the hypothetical updated at forward to however many months past the original
         $updatedAt = $entitlement->updated_at->copy()->addMonthsWithoutOverflow($diffInMonths);
 
         // now we have the diff in days since the last "billed" period end.
         // This may be an entitlement paid up until February 28th, 2020, with today being March
         // 12th 2020. Calculating the costs for the entitlement is based on the daily price
 
         // the price per day is based on the number of days in the last month
         // or the current month if the period does not overlap with the previous month
         // FIXME: This really should be simplified to $daysInMonth=30
 
         $diffInDays = $updatedAt->diffInDays($now);
 
         if ($now->day >= $diffInDays) {
             $daysInMonth = $now->daysInMonth;
         } else {
             $daysInMonth = \App\Utils::daysInLastMonth();
         }
 
         $pricePerDay = $entitlement->cost / $daysInMonth;
         $feePerDay = $entitlement->fee / $daysInMonth;
 
         $cost += (int) (round($pricePerDay * $discount * $diffInDays, 0));
         $fee += (int) (round($feePerDay * $diffInDays, 0));
 
         $profit = $cost - $fee;
 
         if ($profit != 0 && $owner->tenant && ($wallet = $owner->tenant->wallet())) {
             $desc = "Charged user {$owner->email}";
             $method = $profit > 0 ? 'credit' : 'debit';
             $wallet->{$method}(abs($profit), $desc);
         }
 
         if ($cost == 0) {
             return;
         }
 
         $entitlement->wallet->debit($cost);
     }
 }
diff --git a/src/app/Observers/GroupObserver.php b/src/app/Observers/GroupObserver.php
index 7f133f01..c9872b75 100644
--- a/src/app/Observers/GroupObserver.php
+++ b/src/app/Observers/GroupObserver.php
@@ -1,115 +1,107 @@
 <?php
 
 namespace App\Observers;
 
 use App\Group;
 use Illuminate\Support\Facades\DB;
 
 class GroupObserver
 {
     /**
      * Handle the group "created" event.
      *
      * @param \App\Group $group The group
      *
      * @return void
      */
     public function creating(Group $group): void
     {
-        while (true) {
-            $allegedly_unique = \App\Utils::uuidInt();
-            if (!Group::withTrashed()->find($allegedly_unique)) {
-                $group->{$group->getKeyName()} = $allegedly_unique;
-                break;
-            }
-        }
-
         $group->status |= Group::STATUS_NEW | Group::STATUS_ACTIVE;
 
         $group->tenant_id = \config('app.tenant_id');
     }
 
     /**
      * Handle the group "created" event.
      *
      * @param \App\Group $group The group
      *
      * @return void
      */
     public function created(Group $group)
     {
         \App\Jobs\Group\CreateJob::dispatch($group->id);
     }
 
     /**
      * Handle the group "deleting" event.
      *
      * @param \App\Group $group The group
      *
      * @return void
      */
     public function deleting(Group $group)
     {
         // Entitlements do not have referential integrity on the entitled object, so this is our
         // way of doing an onDelete('cascade') without the foreign key.
         \App\Entitlement::where('entitleable_id', $group->id)
             ->where('entitleable_type', Group::class)
             ->delete();
     }
 
     /**
      * Handle the group "deleted" event.
      *
      * @param \App\Group $group The group
      *
      * @return void
      */
     public function deleted(Group $group)
     {
         if ($group->isForceDeleting()) {
             return;
         }
 
         \App\Jobs\Group\DeleteJob::dispatch($group->id);
     }
 
     /**
      * Handle the group "updated" event.
      *
      * @param \App\Group $group The group
      *
      * @return void
      */
     public function updated(Group $group)
     {
         \App\Jobs\Group\UpdateJob::dispatch($group->id);
     }
 
     /**
      * Handle the group "restored" event.
      *
      * @param \App\Group $group The group
      *
      * @return void
      */
     public function restored(Group $group)
     {
         //
     }
 
     /**
      * Handle the group "force deleting" event.
      *
      * @param \App\Group $group The group
      *
      * @return void
      */
     public function forceDeleted(Group $group)
     {
         // A group can be force-deleted separately from the owner
         // we have to force-delete entitlements
         \App\Entitlement::where('entitleable_id', $group->id)
             ->where('entitleable_type', Group::class)
             ->forceDelete();
     }
 }
diff --git a/src/app/Observers/PackageObserver.php b/src/app/Observers/PackageObserver.php
index e567a44d..7025e852 100644
--- a/src/app/Observers/PackageObserver.php
+++ b/src/app/Observers/PackageObserver.php
@@ -1,33 +1,23 @@
 <?php
 
 namespace App\Observers;
 
 use App\Package;
 
 /**
  * This is an observer for the Package model definition.
  */
 class PackageObserver
 {
     /**
      * Handle the "creating" event on an Package.
      *
-     * Ensures that the entry uses a custom ID (uuid).
-     *
      * @param Package $package The Package being created.
      *
      * @return void
      */
     public function creating(Package $package)
     {
-        while (true) {
-            $allegedly_unique = \App\Utils::uuidStr();
-            if (!Package::find($allegedly_unique)) {
-                $package->{$package->getKeyName()} = $allegedly_unique;
-                break;
-            }
-        }
-
         $package->tenant_id = \config('app.tenant_id');
     }
 }
diff --git a/src/app/Observers/PlanObserver.php b/src/app/Observers/PlanObserver.php
index aa501f62..e570f113 100644
--- a/src/app/Observers/PlanObserver.php
+++ b/src/app/Observers/PlanObserver.php
@@ -1,33 +1,25 @@
 <?php
 
 namespace App\Observers;
 
 use App\Plan;
 
 /**
  * This is an observer for the Plan model definition.
  */
 class PlanObserver
 {
     /**
      * Handle the "creating" event on an Plan.
      *
      * Ensures that the entry uses a custom ID (uuid).
      *
      * @param Plan $plan The Plan being created.
      *
      * @return void
      */
     public function creating(Plan $plan)
     {
-        while (true) {
-            $allegedly_unique = \App\Utils::uuidStr();
-            if (!Plan::find($allegedly_unique)) {
-                $plan->{$plan->getKeyName()} = $allegedly_unique;
-                break;
-            }
-        }
-
         $plan->tenant_id = \config('app.tenant_id');
     }
 }
diff --git a/src/app/Observers/SignupInvitationObserver.php b/src/app/Observers/SignupInvitationObserver.php
index f598bf0c..413763d1 100644
--- a/src/app/Observers/SignupInvitationObserver.php
+++ b/src/app/Observers/SignupInvitationObserver.php
@@ -1,65 +1,57 @@
 <?php
 
 namespace App\Observers;
 
 use App\SignupInvitation as SI;
 
 /**
  * This is an observer for the SignupInvitation model definition.
  */
 class SignupInvitationObserver
 {
     /**
      * Ensure the invitation ID is a custom ID (uuid).
      *
      * @param \App\SignupInvitation $invitation The invitation object
      *
      * @return void
      */
     public function creating(SI $invitation)
     {
-        while (true) {
-            $allegedly_unique = \App\Utils::uuidStr();
-            if (!SI::find($allegedly_unique)) {
-                $invitation->{$invitation->getKeyName()} = $allegedly_unique;
-                break;
-            }
-        }
-
         $invitation->status = SI::STATUS_NEW;
 
         $invitation->tenant_id = \config('app.tenant_id');
     }
 
     /**
      * Handle the invitation "created" event.
      *
      * @param \App\SignupInvitation $invitation The invitation object
      *
      * @return void
      */
     public function created(SI $invitation)
     {
         \App\Jobs\SignupInvitationEmail::dispatch($invitation);
     }
 
     /**
      * Handle the invitation "updated" event.
      *
      * @param \App\SignupInvitation $invitation The invitation object
      *
      * @return void
      */
     public function updated(SI $invitation)
     {
         $oldStatus = $invitation->getOriginal('status');
 
         // Resend the invitation
         if (
             $invitation->status == SI::STATUS_NEW
             && ($oldStatus == SI::STATUS_FAILED || $oldStatus == SI::STATUS_SENT)
         ) {
             \App\Jobs\SignupInvitationEmail::dispatch($invitation);
         }
     }
 }
diff --git a/src/app/Observers/SkuObserver.php b/src/app/Observers/SkuObserver.php
index 7ebf6c1b..8121b66a 100644
--- a/src/app/Observers/SkuObserver.php
+++ b/src/app/Observers/SkuObserver.php
@@ -1,28 +1,20 @@
 <?php
 
 namespace App\Observers;
 
 use App\Sku;
 
 class SkuObserver
 {
     /**
      * Ensure the SKU ID is a custom ID (uuid).
      *
      * @param Sku $sku The SKU object
      *
      * @return void
      */
     public function creating(Sku $sku)
     {
-        while (true) {
-            $allegedly_unique = \App\Utils::uuidStr();
-            if (!Sku::find($allegedly_unique)) {
-                $sku->{$sku->getKeyName()} = $allegedly_unique;
-                break;
-            }
-        }
-
         $sku->tenant_id = \config('app.tenant_id');
     }
 }
diff --git a/src/app/Observers/TransactionObserver.php b/src/app/Observers/TransactionObserver.php
index d24cc474..24a44882 100644
--- a/src/app/Observers/TransactionObserver.php
+++ b/src/app/Observers/TransactionObserver.php
@@ -1,30 +1,22 @@
 <?php
 
 namespace App\Observers;
 
 use App\Transaction;
 
 class TransactionObserver
 {
     /**
      * Ensure the transaction ID is a custom ID (uuid).
      *
      * @param \App\Transaction $transaction The transaction object
      *
      * @return void
      */
     public function creating(Transaction $transaction): void
     {
-        while (true) {
-            $allegedly_unique = \App\Utils::uuidStr();
-            if (!Transaction::find($allegedly_unique)) {
-                $transaction->{$transaction->getKeyName()} = $allegedly_unique;
-                break;
-            }
-        }
-
         if (!isset($transaction->user_email)) {
             $transaction->user_email = \App\Utils::userEmailOrNull();
         }
     }
 }
diff --git a/src/app/Observers/UserObserver.php b/src/app/Observers/UserObserver.php
index c91ee919..7a20cedd 100644
--- a/src/app/Observers/UserObserver.php
+++ b/src/app/Observers/UserObserver.php
@@ -1,378 +1,368 @@
 <?php
 
 namespace App\Observers;
 
 use App\Entitlement;
 use App\Domain;
 use App\Group;
 use App\Transaction;
 use App\User;
 use App\Wallet;
 use Illuminate\Support\Facades\DB;
 
 class UserObserver
 {
     /**
      * Handle the "creating" event.
      *
      * Ensure that the user is created with a random, large integer.
      *
      * @param \App\User $user The user being created.
      *
      * @return void
      */
     public function creating(User $user)
     {
-        if (!$user->id) {
-            while (true) {
-                $allegedly_unique = \App\Utils::uuidInt();
-                if (!User::withTrashed()->find($allegedly_unique)) {
-                    $user->{$user->getKeyName()} = $allegedly_unique;
-                    break;
-                }
-            }
-        }
-
         $user->email = \strtolower($user->email);
 
         // only users that are not imported get the benefit of the doubt.
         $user->status |= User::STATUS_NEW | User::STATUS_ACTIVE;
 
         $user->tenant_id = \config('app.tenant_id');
     }
 
     /**
      * Handle the "created" event.
      *
      * Ensures the user has at least one wallet.
      *
      * Should ensure some basic settings are available as well.
      *
      * @param \App\User $user The user created.
      *
      * @return void
      */
     public function created(User $user)
     {
         $settings = [
             'country' => \App\Utils::countryForRequest(),
             'currency' => \config('app.currency'),
             /*
             'first_name' => '',
             'last_name' => '',
             'billing_address' => '',
             'organization' => '',
             'phone' => '',
             'external_email' => '',
             */
         ];
 
         foreach ($settings as $key => $value) {
             $settings[$key] = [
                 'key' => $key,
                 'value' => $value,
                 'user_id' => $user->id,
             ];
         }
 
         // Note: Don't use setSettings() here to bypass UserSetting observers
         // Note: This is a single multi-insert query
         $user->settings()->insert(array_values($settings));
 
         $user->wallets()->create();
 
         // Create user record in LDAP, then check if the account is created in IMAP
         $chain = [
             new \App\Jobs\User\VerifyJob($user->id),
         ];
 
         \App\Jobs\User\CreateJob::withChain($chain)->dispatch($user->id);
 
         if (\App\Tenant::getConfig($user->tenant_id, 'pgp.enable')) {
             \App\Jobs\PGP\KeyCreateJob::dispatch($user->id, $user->email);
         }
     }
 
     /**
      * Handle the "deleted" event.
      *
      * @param \App\User $user The user deleted.
      *
      * @return void
      */
     public function deleted(User $user)
     {
         // Remove the user from existing groups
         $wallet = $user->wallet();
         if ($wallet && $wallet->owner) {
             $wallet->owner->groups()->each(function ($group) use ($user) {
                 if (in_array($user->email, $group->members)) {
                     $group->members = array_diff($group->members, [$user->email]);
                     $group->save();
                 }
             });
         }
 
         // Debit the reseller's wallet with the user negative balance
         $balance = 0;
         foreach ($user->wallets as $wallet) {
             // Note: here we assume all user wallets are using the same currency.
             //       It might get changed in the future
             $balance += $wallet->balance;
         }
 
         if ($balance < 0 && $user->tenant && ($wallet = $user->tenant->wallet())) {
             $wallet->debit($balance * -1, "Deleted user {$user->email}");
         }
     }
 
     /**
      * Handle the "deleting" event.
      *
      * @param User $user The user that is being deleted.
      *
      * @return void
      */
     public function deleting(User $user)
     {
         if ($user->isForceDeleting()) {
             $this->forceDeleting($user);
             return;
         }
 
         // TODO: Especially in tests we're doing delete() on a already deleted user.
         //       Should we escape here - for performance reasons?
         // TODO: I think all of this should use database transactions
 
         // Entitlements do not have referential integrity on the entitled object, so this is our
         // way of doing an onDelete('cascade') without the foreign key.
         $entitlements = Entitlement::where('entitleable_id', $user->id)
             ->where('entitleable_type', User::class)->get();
 
         foreach ($entitlements as $entitlement) {
             $entitlement->delete();
         }
 
         // Remove owned users/domains
         $wallets = $user->wallets()->pluck('id')->all();
         $assignments = Entitlement::whereIn('wallet_id', $wallets)->get();
         $users = [];
         $domains = [];
         $groups = [];
         $entitlements = [];
 
         foreach ($assignments as $entitlement) {
             if ($entitlement->entitleable_type == Domain::class) {
                 $domains[] = $entitlement->entitleable_id;
             } elseif ($entitlement->entitleable_type == User::class && $entitlement->entitleable_id != $user->id) {
                 $users[] = $entitlement->entitleable_id;
             } elseif ($entitlement->entitleable_type == Group::class) {
                 $groups[] = $entitlement->entitleable_id;
             } else {
                 $entitlements[] = $entitlement;
             }
         }
 
         // Domains/users/entitlements need to be deleted one by one to make sure
         // events are fired and observers can do the proper cleanup.
         if (!empty($users)) {
             foreach (User::whereIn('id', array_unique($users))->get() as $_user) {
                 $_user->delete();
             }
         }
 
         if (!empty($domains)) {
             foreach (Domain::whereIn('id', array_unique($domains))->get() as $_domain) {
                 $_domain->delete();
             }
         }
 
         if (!empty($groups)) {
             foreach (Group::whereIn('id', array_unique($groups))->get() as $_group) {
                 $_group->delete();
             }
         }
 
         foreach ($entitlements as $entitlement) {
             $entitlement->delete();
         }
 
         // FIXME: What do we do with user wallets?
 
         \App\Jobs\User\DeleteJob::dispatch($user->id);
     }
 
     /**
      * Handle the "deleting" event on forceDelete() call.
      *
      * @param User $user The user that is being deleted.
      *
      * @return void
      */
     public function forceDeleting(User $user)
     {
         // TODO: We assume that at this moment all belongings are already soft-deleted.
 
         // Remove owned users/domains
         $wallets = $user->wallets()->pluck('id')->all();
         $assignments = Entitlement::withTrashed()->whereIn('wallet_id', $wallets)->get();
         $entitlements = [];
         $domains = [];
         $groups = [];
         $users = [];
 
         foreach ($assignments as $entitlement) {
             $entitlements[] = $entitlement->id;
 
             if ($entitlement->entitleable_type == Domain::class) {
                 $domains[] = $entitlement->entitleable_id;
             } elseif (
                 $entitlement->entitleable_type == User::class
                 && $entitlement->entitleable_id != $user->id
             ) {
                 $users[] = $entitlement->entitleable_id;
             } elseif ($entitlement->entitleable_type == Group::class) {
                 $groups[] = $entitlement->entitleable_id;
             }
         }
 
         // Remove the user "direct" entitlements explicitely, if they belong to another
         // user's wallet they will not be removed by the wallets foreign key cascade
         Entitlement::withTrashed()
             ->where('entitleable_id', $user->id)
             ->where('entitleable_type', User::class)
             ->forceDelete();
 
         // Users need to be deleted one by one to make sure observers can do the proper cleanup.
         if (!empty($users)) {
             foreach (User::withTrashed()->whereIn('id', array_unique($users))->get() as $_user) {
                 $_user->forceDelete();
             }
         }
 
         // Domains can be just removed
         if (!empty($domains)) {
             Domain::withTrashed()->whereIn('id', array_unique($domains))->forceDelete();
         }
 
         // Groups can be just removed
         if (!empty($groups)) {
             Group::withTrashed()->whereIn('id', array_unique($groups))->forceDelete();
         }
 
         // Remove transactions, they also have no foreign key constraint
         Transaction::where('object_type', Entitlement::class)
             ->whereIn('object_id', $entitlements)
             ->delete();
 
         Transaction::where('object_type', Wallet::class)
             ->whereIn('object_id', $wallets)
             ->delete();
     }
 
     /**
      * Handle the user "restoring" event.
      *
      * @param \App\User $user The user
      *
      * @return void
      */
     public function restoring(User $user)
     {
         // Make sure it's not DELETED/LDAP_READY/IMAP_READY/SUSPENDED anymore
         if ($user->isDeleted()) {
             $user->status ^= User::STATUS_DELETED;
         }
         if ($user->isLdapReady()) {
             $user->status ^= User::STATUS_LDAP_READY;
         }
         if ($user->isImapReady()) {
             $user->status ^= User::STATUS_IMAP_READY;
         }
         if ($user->isSuspended()) {
             $user->status ^= User::STATUS_SUSPENDED;
         }
 
         $user->status |= User::STATUS_ACTIVE;
 
         // Note: $user->save() is invoked between 'restoring' and 'restored' events
     }
 
     /**
      * Handle the user "restored" event.
      *
      * @param \App\User $user The user
      *
      * @return void
      */
     public function restored(User $user)
     {
         $wallets = $user->wallets()->pluck('id')->all();
 
         // Restore user entitlements
         // We'll restore only these that were deleted last. So, first we get
         // the maximum deleted_at timestamp and then use it to select
         // entitlements for restore
         $deleted_at = \App\Entitlement::withTrashed()
             ->where('entitleable_id', $user->id)
             ->where('entitleable_type', User::class)
             ->max('deleted_at');
 
         if ($deleted_at) {
             $threshold = (new \Carbon\Carbon($deleted_at))->subMinute();
 
             // We need at least the user domain so it can be created in ldap.
             // FIXME: What if the domain is owned by someone else?
             $domain = $user->domain();
             if ($domain->trashed() && !$domain->isPublic()) {
                 // Note: Domain entitlements will be restored by the DomainObserver
                 $domain->restore();
             }
 
             // Restore user entitlements
             \App\Entitlement::withTrashed()
                 ->where('entitleable_id', $user->id)
                 ->where('entitleable_type', User::class)
                 ->where('deleted_at', '>=', $threshold)
                 ->update(['updated_at' => now(), 'deleted_at' => null]);
 
             // Note: We're assuming that cost of entitlements was correct
             // on user deletion, so we don't have to re-calculate it again.
         }
 
         // FIXME: Should we reset user aliases? or re-validate them in any way?
 
         // Create user record in LDAP, then run the verification process
         $chain = [
             new \App\Jobs\User\VerifyJob($user->id),
         ];
 
         \App\Jobs\User\CreateJob::withChain($chain)->dispatch($user->id);
     }
 
     /**
      * Handle the "retrieving" event.
      *
      * @param User $user The user that is being retrieved.
      *
      * @todo This is useful for audit.
      *
      * @return void
      */
     public function retrieving(User $user)
     {
         // TODO   \App\Jobs\User\ReadJob::dispatch($user->id);
     }
 
     /**
      * Handle the "updating" event.
      *
      * @param User $user The user that is being updated.
      *
      * @return void
      */
     public function updating(User $user)
     {
         \App\Jobs\User\UpdateJob::dispatch($user->id);
     }
 }
diff --git a/src/app/Observers/WalletObserver.php b/src/app/Observers/WalletObserver.php
index 1297fe1c..8414de01 100644
--- a/src/app/Observers/WalletObserver.php
+++ b/src/app/Observers/WalletObserver.php
@@ -1,114 +1,106 @@
 <?php
 
 namespace App\Observers;
 
 use App\Wallet;
 
 /**
  * This is an observer for the Wallet model definition.
  */
 class WalletObserver
 {
     /**
      * Ensure the wallet ID is a custom ID (uuid).
      *
      * @param Wallet $wallet
      *
      * @return void
      */
     public function creating(Wallet $wallet)
     {
-        while (true) {
-            $allegedly_unique = \App\Utils::uuidStr();
-            if (!Wallet::find($allegedly_unique)) {
-                $wallet->{$wallet->getKeyName()} = $allegedly_unique;
-                break;
-            }
-        }
-
         $wallet->currency = \config('app.currency');
     }
 
     /**
      * Handle the wallet "deleting" event.
      *
      * Ensures that a wallet with a non-zero balance can not be deleted.
      *
      * Ensures that the wallet being deleted is not the last wallet for the user.
      *
      * Ensures that no entitlements are being billed to the wallet currently.
      *
      * @param Wallet $wallet The wallet being deleted.
      *
      * @return bool
      */
     public function deleting(Wallet $wallet): bool
     {
         // can't delete a wallet that has any balance on it (positive and negative).
         if ($wallet->balance != 0.00) {
             return false;
         }
 
         if (!$wallet->owner) {
             throw new \Exception("Wallet: " . var_export($wallet, true));
         }
 
         // can't remove the last wallet for the owner.
         if ($wallet->owner->wallets()->count() <= 1) {
             return false;
         }
 
         // can't remove a wallet that has billable entitlements attached.
         if ($wallet->entitlements()->count() > 0) {
             return false;
         }
 /*
         // can't remove a wallet that has payments attached.
         if ($wallet->payments()->count() > 0) {
             return false;
         }
 */
 
         return true;
     }
 
     /**
      * Handle the wallet "updated" event.
      *
      * @param \App\Wallet $wallet The wallet.
      *
      * @return void
      */
     public function updated(Wallet $wallet)
     {
         $negative_since = $wallet->getSetting('balance_negative_since');
 
         if ($wallet->balance < 0) {
             if (!$negative_since) {
                 $now = \Carbon\Carbon::now()->toDateTimeString();
                 $wallet->setSetting('balance_negative_since', $now);
             }
         } elseif ($negative_since) {
             $wallet->setSettings([
                     'balance_negative_since' => null,
                     'balance_warning_initial' => null,
                     'balance_warning_reminder' => null,
                     'balance_warning_suspended' => null,
                     'balance_warning_before_delete' => null,
             ]);
 
             // Unsuspend the account/domains/users
             if ($wallet->owner) {
                 $wallet->owner->unsuspend();
             }
             foreach ($wallet->entitlements as $entitlement) {
                 if (
                     $entitlement->entitleable_type == \App\Domain::class
                     || $entitlement->entitleable_type == \App\User::class
                 ) {
                     $entitlement->entitleable->unsuspend();
                 }
             }
         }
     }
 }
diff --git a/src/app/Package.php b/src/app/Package.php
index 1d58ab88..b65c3666 100644
--- a/src/app/Package.php
+++ b/src/app/Package.php
@@ -1,117 +1,116 @@
 <?php
 
 namespace App;
 
+use App\Traits\UuidStrKeyTrait;
 use Illuminate\Database\Eloquent\Model;
 use Spatie\Translatable\HasTranslations;
 
 /**
  * The eloquent definition of a Package.
  *
  * A package is a set of SKUs that a user can select, so that instead of;
  *
  * * Create a mailbox entitlement,
  * * Create a quota entitlement,
  * * Create a groupware entitlement,
  * * ...
  *
  * users can simply select a 'package';
  *
  * * Kolab package: mailbox + quota + groupware,
  * * Free package: mailbox + quota.
  *
  * Selecting a package will therefore create a set of entitlments from SKUs.
  *
  * @property string  $description
  * @property int     $discount_rate
  * @property string  $id
  * @property string  $name
  * @property ?int    $tenant_id
  * @property string  $title
  */
 class Package extends Model
 {
     use HasTranslations;
-
-    public $incrementing = false;
-    protected $keyType = 'string';
+    use UuidStrKeyTrait;
 
     public $timestamps = false;
 
     protected $fillable = [
         'description',
         'discount_rate',
         'name',
         'title',
     ];
 
     /** @var array Translatable properties */
     public $translatable = [
         'name',
         'description',
     ];
 
     /**
      * The costs of this package at its pre-defined, existing configuration.
      *
      * @return int The costs in cents.
      */
     public function cost()
     {
         $costs = 0;
 
         foreach ($this->skus as $sku) {
             $units = $sku->pivot->qty - $sku->units_free;
 
             if ($units < 0) {
                 \Log::debug("Package {$this->id} is misconfigured for more free units than qty.");
                 $units = 0;
             }
 
             $ppu = $sku->cost * ((100 - $this->discount_rate) / 100);
 
             $costs += $units * $ppu;
         }
 
         return $costs;
     }
 
     /**
      * Checks whether the package contains a domain SKU.
      */
     public function isDomain(): bool
     {
         foreach ($this->skus as $sku) {
             if ($sku->handler_class::entitleableClass() == \App\Domain::class) {
                 return true;
             }
         }
 
         return false;
     }
 
     /**
      * SKUs of this package.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
      */
     public function skus()
     {
         return $this->belongsToMany(
             'App\Sku',
             'package_skus'
         )->using('App\PackageSku')->withPivot(
             ['qty']
         );
     }
 
     /**
      * The tenant for this package.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function tenant()
     {
         return $this->belongsTo('App\Tenant', 'tenant_id', 'id');
     }
 }
diff --git a/src/app/Plan.php b/src/app/Plan.php
index c6b222de..dc86535e 100644
--- a/src/app/Plan.php
+++ b/src/app/Plan.php
@@ -1,127 +1,127 @@
 <?php
 
 namespace App;
 
+use App\Traits\UuidStrKeyTrait;
 use Illuminate\Database\Eloquent\Model;
 use Spatie\Translatable\HasTranslations;
 
 /**
  * The eloquent definition of a Plan.
  *
  * A Plan is a grouping of packages, such as a "Family Plan".
  *
  * A "Family Plan" as such may exist of "2 or more Kolab packages",
  * and apply a discount for the third and further Kolab packages.
  *
  * @property string         $description
  * @property int            $discount_qty
  * @property int            $discount_rate
  * @property string         $id
  * @property string         $name
  * @property \App\Package[] $packages
  * @property datetime       $promo_from
  * @property datetime       $promo_to
  * @property ?int           $tenant_id
  * @property string         $title
  */
 class Plan extends Model
 {
     use HasTranslations;
+    use UuidStrKeyTrait;
 
-    public $incrementing = false;
-    protected $keyType = 'string';
     public $timestamps = false;
 
     protected $fillable = [
         'title',
         'name',
         'description',
         // a start and end datetime for this promotion
         'promo_from',
         'promo_to',
         // discounts start at this quantity
         'discount_qty',
         // the rate of the discount for this plan
         'discount_rate',
     ];
 
     protected $casts = [
         'promo_from' => 'datetime',
         'promo_to' => 'datetime',
         'discount_qty' => 'integer',
         'discount_rate' => 'integer'
     ];
 
     /** @var array Translatable properties */
     public $translatable = [
         'name',
         'description',
     ];
 
     /**
      * The list price for this package at the minimum configuration.
      *
      * @return int The costs in cents.
      */
     public function cost()
     {
         $costs = 0;
 
         foreach ($this->packages as $package) {
             $costs += $package->pivot->cost();
         }
 
         return $costs;
     }
 
     /**
      * The relationship to packages.
      *
      * The plan contains one or more packages. Each package may have its minimum number (for
      * billing) or its maximum (to allow topping out "enterprise" customers on a "small business"
      * plan).
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
      */
     public function packages()
     {
         return $this->belongsToMany(
             'App\Package',
             'plan_packages'
         )->using('App\PlanPackage')->withPivot(
             [
                 'qty',
                 'qty_min',
                 'qty_max',
                 'discount_qty',
                 'discount_rate'
             ]
         );
     }
 
     /**
      * Checks if the plan has any type of domain SKU assigned.
      *
      * @return bool
      */
     public function hasDomain(): bool
     {
         foreach ($this->packages as $package) {
             if ($package->isDomain()) {
                 return true;
             }
         }
 
         return false;
     }
 
     /**
      * The tenant for this plan.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function tenant()
     {
         return $this->belongsTo('App\Tenant', 'tenant_id', 'id');
     }
 }
diff --git a/src/app/Providers/AppServiceProvider.php b/src/app/Providers/AppServiceProvider.php
index 5dcecd4d..73539e90 100644
--- a/src/app/Providers/AppServiceProvider.php
+++ b/src/app/Providers/AppServiceProvider.php
@@ -1,166 +1,165 @@
 <?php
 
 namespace App\Providers;
 
 use Illuminate\Database\Query\Builder;
 use Illuminate\Support\Facades\Blade;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Schema;
 use Illuminate\Support\ServiceProvider;
 use Laravel\Passport\Passport;
 
 class AppServiceProvider extends ServiceProvider
 {
     /**
      * Register any application services.
      *
      * @return void
      */
     public function register()
     {
         Passport::ignoreMigrations();
     }
 
     /**
      * Serialize a bindings array to a string.
      *
      * @return string
      */
     private static function serializeSQLBindings(array $array): string
     {
         $serialized = array_map(function ($entry) {
             if ($entry instanceof \DateTime) {
                 return $entry->format('Y-m-d h:i:s');
             }
             return $entry;
         }, $array);
         return implode(', ', $serialized);
     }
 
     /**
      * Bootstrap any application services.
      *
      * @return void
      */
     public function boot()
     {
-        \App\AuthAttempt::observe(\App\Observers\AuthAttemptObserver::class);
         \App\Discount::observe(\App\Observers\DiscountObserver::class);
         \App\Domain::observe(\App\Observers\DomainObserver::class);
         \App\Entitlement::observe(\App\Observers\EntitlementObserver::class);
         \App\Group::observe(\App\Observers\GroupObserver::class);
         \App\OpenVidu\Connection::observe(\App\Observers\OpenVidu\ConnectionObserver::class);
         \App\Package::observe(\App\Observers\PackageObserver::class);
         \App\PackageSku::observe(\App\Observers\PackageSkuObserver::class);
         \App\Plan::observe(\App\Observers\PlanObserver::class);
         \App\PlanPackage::observe(\App\Observers\PlanPackageObserver::class);
         \App\SignupCode::observe(\App\Observers\SignupCodeObserver::class);
         \App\SignupInvitation::observe(\App\Observers\SignupInvitationObserver::class);
         \App\Sku::observe(\App\Observers\SkuObserver::class);
         \App\Transaction::observe(\App\Observers\TransactionObserver::class);
         \App\User::observe(\App\Observers\UserObserver::class);
         \App\UserAlias::observe(\App\Observers\UserAliasObserver::class);
         \App\UserSetting::observe(\App\Observers\UserSettingObserver::class);
         \App\VerificationCode::observe(\App\Observers\VerificationCodeObserver::class);
         \App\Wallet::observe(\App\Observers\WalletObserver::class);
 
         \App\PowerDNS\Domain::observe(\App\Observers\PowerDNS\DomainObserver::class);
         \App\PowerDNS\Record::observe(\App\Observers\PowerDNS\RecordObserver::class);
 
         Schema::defaultStringLength(191);
 
         // Log SQL queries in debug mode
         if (\config('app.debug')) {
             DB::listen(function ($query) {
                 \Log::debug(
                     sprintf(
                         '[SQL] %s [%s]: %.4f sec.',
                         $query->sql,
                         self::serializeSQLBindings($query->bindings),
                         $query->time / 1000
                     )
                 );
             });
         }
 
         // Register some template helpers
         Blade::directive(
             'theme_asset',
             function ($path) {
                 $path = trim($path, '/\'"');
                 return "<?php echo secure_asset('themes/' . \$env['app.theme'] . '/' . '$path'); ?>";
             }
         );
 
         Builder::macro(
             'withEnvTenantContext',
             function (string $table = null) {
                 $tenantId = \config('app.tenant_id');
 
                 if ($tenantId) {
                     /** @var Builder $this */
                     return $this->where(($table ? "$table." : "") . "tenant_id", $tenantId);
                 }
 
                 /** @var Builder $this */
                 return $this->whereNull(($table ? "$table." : "") . "tenant_id");
             }
         );
 
         Builder::macro(
             'withObjectTenantContext',
             function (object $object, string $table = null) {
                 $tenantId = $object->tenant_id;
 
                 if ($tenantId) {
                     /** @var Builder $this */
                     return $this->where(($table ? "$table." : "") . "tenant_id", $tenantId);
                 }
 
                 /** @var Builder $this */
                 return $this->whereNull(($table ? "$table." : "") . "tenant_id");
             }
         );
 
         Builder::macro(
             'withSubjectTenantContext',
             function (string $table = null) {
                 if ($user = auth()->user()) {
                     $tenantId = $user->tenant_id;
                 } else {
                     $tenantId = \config('app.tenant_id');
                 }
 
                 if ($tenantId) {
                     /** @var Builder $this */
                     return $this->where(($table ? "$table." : "") . "tenant_id", $tenantId);
                 }
 
                 /** @var Builder $this */
                 return $this->whereNull(($table ? "$table." : "") . "tenant_id");
             }
         );
 
         // Query builder 'whereLike' mocro
         Builder::macro(
             'whereLike',
             function (string $column, string $search, int $mode = 0) {
                 $search = addcslashes($search, '%_');
 
                 switch ($mode) {
                     case 2:
                         $search .= '%';
                         break;
                     case 1:
                         $search = '%' . $search;
                         break;
                     default:
                         $search = '%' . $search . '%';
                 }
 
                 /** @var Builder $this */
                 return $this->where($column, 'like', $search);
             }
         );
     }
 }
diff --git a/src/app/SignupInvitation.php b/src/app/SignupInvitation.php
index f8053463..b87d883b 100644
--- a/src/app/SignupInvitation.php
+++ b/src/app/SignupInvitation.php
@@ -1,109 +1,98 @@
 <?php
 
 namespace App;
 
 use Carbon\Carbon;
 use Illuminate\Database\Eloquent\Model;
+use App\Traits\UuidStrKeyTrait;
 
 /**
  * The eloquent definition of a signup invitation.
  *
  * @property string       $email
  * @property string       $id
  * @property ?int         $tenant_id
  * @property ?\App\Tenant $tenant
  * @property ?\App\User   $user
  */
 class SignupInvitation extends Model
 {
+    use UuidStrKeyTrait;
+
     // just created
     public const STATUS_NEW     = 1 << 0;
     // it's been sent successfully
     public const STATUS_SENT    = 1 << 1;
     // sending failed
     public const STATUS_FAILED  = 1 << 2;
     // the user signed up
     public const STATUS_COMPLETED = 1 << 3;
 
 
-    /**
-     * Indicates if the IDs are auto-incrementing.
-     *
-     * @var bool
-     */
-    public $incrementing = false;
-
-    /**
-     * The "type" of the auto-incrementing ID.
-     *
-     * @var string
-     */
-    protected $keyType = 'string';
-
     /**
      * The attributes that are mass assignable.
      *
      * @var array
      */
     protected $fillable = ['email'];
 
     /**
      * Returns whether this invitation process completed (user signed up)
      *
      * @return bool
      */
     public function isCompleted(): bool
     {
         return ($this->status & self::STATUS_COMPLETED) > 0;
     }
 
     /**
      * Returns whether this invitation sending failed.
      *
      * @return bool
      */
     public function isFailed(): bool
     {
         return ($this->status & self::STATUS_FAILED) > 0;
     }
 
     /**
      * Returns whether this invitation is new.
      *
      * @return bool
      */
     public function isNew(): bool
     {
         return ($this->status & self::STATUS_NEW) > 0;
     }
 
     /**
      * Returns whether this invitation has been sent.
      *
      * @return bool
      */
     public function isSent(): bool
     {
         return ($this->status & self::STATUS_SENT) > 0;
     }
 
     /**
      * The tenant for this invitation.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function tenant()
     {
         return $this->belongsTo('App\Tenant', 'tenant_id', 'id');
     }
 
     /**
      * The account to which the invitation was used for.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function user()
     {
         return $this->belongsTo('App\User', 'user_id', 'id');
     }
 }
diff --git a/src/app/Sku.php b/src/app/Sku.php
index 2e1a90ee..148e65e4 100644
--- a/src/app/Sku.php
+++ b/src/app/Sku.php
@@ -1,85 +1,84 @@
 <?php
 
 namespace App;
 
 use Illuminate\Database\Eloquent\Model;
 use Spatie\Translatable\HasTranslations;
+use App\Traits\UuidStrKeyTrait;
 
 /**
  * The eloquent definition of a Stock Keeping Unit (SKU).
  *
  * @property bool    $active
  * @property int     $cost
  * @property string  $description
  * @property int     $fee           The fee that the tenant pays to us
  * @property string  $handler_class
  * @property string  $id
  * @property string  $name
  * @property string  $period
  * @property ?int    $tenant_id
  * @property string  $title
  * @property int     $units_free
  */
 class Sku extends Model
 {
     use HasTranslations;
-
-    public $incrementing = false;
-    protected $keyType = 'string';
+    use UuidStrKeyTrait;
 
     protected $casts = [
         'units_free' => 'integer'
     ];
 
     protected $fillable = [
         'active',
         'cost',
         'description',
         'fee',
         'handler_class',
         'name',
         // persist for annual domain registration
         'period',
         'title',
         'units_free',
     ];
 
     /** @var array Translatable properties */
     public $translatable = [
         'name',
         'description',
     ];
 
     /**
      * List the entitlements that consume this SKU.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function entitlements()
     {
         return $this->hasMany('App\Entitlement');
     }
 
     /**
      * List of packages that use this SKU.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
      */
     public function packages()
     {
         return $this->belongsToMany(
             'App\Package',
             'package_skus'
         )->using('App\PackageSku')->withPivot(['cost', 'qty']);
     }
 
     /**
      * The tenant for this SKU.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function tenant()
     {
         return $this->belongsTo('App\Tenant', 'tenant_id', 'id');
     }
 }
diff --git a/src/app/Traits/UuidIntKeyTrait.php b/src/app/Traits/UuidIntKeyTrait.php
new file mode 100644
index 00000000..0bf0811d
--- /dev/null
+++ b/src/app/Traits/UuidIntKeyTrait.php
@@ -0,0 +1,51 @@
+<?php
+
+namespace App\Traits;
+
+trait UuidIntKeyTrait
+{
+    /**
+     * Boot function from Laravel.
+     */
+    protected static function bootUuidIntKeyTrait()
+    {
+        static::creating(function ($model) {
+            if (empty($model->{$model->getKeyName()})) {
+                $allegedly_unique = \App\Utils::uuidInt();
+
+                // Verify if unique
+                if (in_array('Illuminate\Database\Eloquent\SoftDeletes', class_uses($model))) {
+                    while ($model->withTrashed()->find($allegedly_unique)) {
+                        $allegedly_unique = \App\Utils::uuidInt();
+                    }
+                } else {
+                    while ($model->find($allegedly_unique)) {
+                        $allegedly_unique = \App\Utils::uuidInt();
+                    }
+                }
+
+                $model->{$model->getKeyName()} = $allegedly_unique;
+            }
+        });
+    }
+
+    /**
+     * Get if the key is incrementing.
+     *
+     * @return bool
+     */
+    public function getIncrementing()
+    {
+        return false;
+    }
+
+    /**
+     * Get the key type.
+     *
+     * @return string
+     */
+    public function getKeyType()
+    {
+        return 'bigint';
+    }
+}
diff --git a/src/app/Traits/UuidStrKeyTrait.php b/src/app/Traits/UuidStrKeyTrait.php
new file mode 100644
index 00000000..7c01c695
--- /dev/null
+++ b/src/app/Traits/UuidStrKeyTrait.php
@@ -0,0 +1,51 @@
+<?php
+
+namespace App\Traits;
+
+trait UuidStrKeyTrait
+{
+    /**
+     * Boot function from Laravel.
+     */
+    protected static function bootUuidStrKeyTrait()
+    {
+        static::creating(function ($model) {
+            if (empty($model->{$model->getKeyName()})) {
+                $allegedly_unique = \App\Utils::uuidStr();
+
+                // Verify if unique
+                if (in_array('Illuminate\Database\Eloquent\SoftDeletes', class_uses($model))) {
+                    while ($model->withTrashed()->find($allegedly_unique)) {
+                        $allegedly_unique = \App\Utils::uuidStr();
+                    }
+                } else {
+                    while ($model->find($allegedly_unique)) {
+                        $allegedly_unique = \App\Utils::uuidStr();
+                    }
+                }
+
+                $model->{$model->getKeyName()} = $allegedly_unique;
+            }
+        });
+    }
+
+    /**
+     * Get if the key is incrementing.
+     *
+     * @return bool
+     */
+    public function getIncrementing()
+    {
+        return false;
+    }
+
+    /**
+     * Get the key type.
+     *
+     * @return string
+     */
+    public function getKeyType()
+    {
+        return 'string';
+    }
+}
diff --git a/src/app/Transaction.php b/src/app/Transaction.php
index 684d8f3a..41ec8578 100644
--- a/src/app/Transaction.php
+++ b/src/app/Transaction.php
@@ -1,199 +1,196 @@
 <?php
 
 namespace App;
 
 use App\Entitlement;
 use App\Wallet;
+use App\Traits\UuidStrKeyTrait;
 use Illuminate\Database\Eloquent\Model;
 
 /**
  * The eloquent definition of a Transaction.
  *
  * @property int    $amount
  * @property string $description
  * @property string $id
  * @property string $object_id
  * @property string $object_type
  * @property string $type
  * @property string $transaction_id
  * @property string $user_email
  */
 class Transaction extends Model
 {
+    use UuidStrKeyTrait;
+
     public const ENTITLEMENT_BILLED = 'billed';
     public const ENTITLEMENT_CREATED = 'created';
     public const ENTITLEMENT_DELETED = 'deleted';
 
     public const WALLET_AWARD = 'award';
     public const WALLET_CREDIT = 'credit';
     public const WALLET_DEBIT = 'debit';
     public const WALLET_PENALTY = 'penalty';
     public const WALLET_REFUND = 'refund';
     public const WALLET_CHARGEBACK = 'chback';
 
     protected $fillable = [
         // actor, if any
         'user_email',
 
         // entitlement, wallet
         'object_id',
         'object_type',
 
         // entitlement: created, deleted, billed
         // wallet: debit, credit, award, penalty
         'type',
 
         'amount',
 
         'description',
 
         // parent, for example wallet debit is parent for entitlements charged.
         'transaction_id'
     ];
 
     /** @var array Casts properties as type */
     protected $casts = [
         'amount' => 'integer',
     ];
 
-    /** @var boolean This model uses an automatically incrementing integer primary key? */
-    public $incrementing = false;
-
-    /** @var string The type of the primary key */
-    protected $keyType = 'string';
-
 
     /**
      * Returns the entitlement to which the transaction is assigned (if any)
      *
      * @return \App\Entitlement|null The entitlement
      */
     public function entitlement(): ?Entitlement
     {
         if ($this->object_type !== Entitlement::class) {
             return null;
         }
 
         return Entitlement::withTrashed()->find($this->object_id);
     }
 
     /**
      * Transaction type mutator
      *
      * @throws \Exception
      */
     public function setTypeAttribute($value): void
     {
         switch ($value) {
             case self::ENTITLEMENT_BILLED:
             case self::ENTITLEMENT_CREATED:
             case self::ENTITLEMENT_DELETED:
                 // TODO: Must be an entitlement.
                 $this->attributes['type'] = $value;
                 break;
 
             case self::WALLET_AWARD:
             case self::WALLET_CREDIT:
             case self::WALLET_DEBIT:
             case self::WALLET_PENALTY:
             case self::WALLET_REFUND:
             case self::WALLET_CHARGEBACK:
                 // TODO: This must be a wallet.
                 $this->attributes['type'] = $value;
                 break;
 
             default:
                 throw new \Exception("Invalid type value");
         }
     }
 
     /**
      * Returns a short text describing the transaction.
      *
      * @return string The description
      */
     public function shortDescription(): string
     {
         $label = $this->objectTypeToLabelString() . '-' . $this->{'type'} . '-short';
 
         $result = \trans("transactions.{$label}", $this->descriptionParams());
 
         return trim($result, ': ');
     }
 
     /**
      * Returns a text describing the transaction.
      *
      * @return string The description
      */
     public function toString(): string
     {
         $label = $this->objectTypeToLabelString() . '-' . $this->{'type'};
 
         return \trans("transactions.{$label}", $this->descriptionParams());
     }
 
     /**
      * Returns a wallet to which the transaction is assigned (if any)
      *
      * @return \App\Wallet|null The wallet
      */
     public function wallet(): ?Wallet
     {
         if ($this->object_type !== Wallet::class) {
             return null;
         }
 
         return Wallet::find($this->object_id);
     }
 
     /**
      * Collect transaction parameters used in (localized) descriptions
      *
      * @return array Parameters
      */
     private function descriptionParams(): array
     {
         $result = [
             'user_email' => $this->user_email,
             'description' => $this->{'description'},
         ];
 
         $amount = $this->amount * ($this->amount < 0 ? -1 : 1);
 
         if ($entitlement = $this->entitlement()) {
             $wallet = $entitlement->wallet;
             $cost = $entitlement->cost;
             $discount = $entitlement->wallet->getDiscountRate();
 
             $result['entitlement_cost'] = $cost * $discount;
             $result['object'] = $entitlement->entitleableTitle();
             $result['sku_title'] = $entitlement->sku->{'title'};
         } else {
             $wallet = $this->wallet();
         }
 
         $result['wallet'] = $wallet->{'description'} ?: 'Default wallet';
         $result['amount'] = $wallet->money($amount);
 
         return $result;
     }
 
     /**
      * Get a string for use in translation tables derived from the object type.
      *
      * @return string|null
      */
     private function objectTypeToLabelString(): ?string
     {
         if ($this->object_type == Entitlement::class) {
             return 'entitlement';
         }
 
         if ($this->object_type == Wallet::class) {
             return 'wallet';
         }
 
         return null;
     }
 }
diff --git a/src/app/User.php b/src/app/User.php
index d40e7c16..05e1c750 100644
--- a/src/app/User.php
+++ b/src/app/User.php
@@ -1,913 +1,910 @@
 <?php
 
 namespace App;
 
 use App\Entitlement;
 use App\UserAlias;
 use App\Sku;
+use App\Traits\UuidIntKeyTrait;
 use App\Traits\UserConfigTrait;
 use App\Traits\UserAliasesTrait;
 use App\Traits\SettingsTrait;
 use App\Wallet;
 use Illuminate\Database\Eloquent\SoftDeletes;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Iatstuti\Database\Support\NullableFields;
 use Laravel\Passport\HasApiTokens;
 use League\OAuth2\Server\Exception\OAuthServerException;
 
 /**
  * The eloquent definition of a User.
  *
  * @property string $email
  * @property int    $id
  * @property string $password
  * @property int    $status
  * @property int    $tenant_id
  */
 class User extends Authenticatable
 {
+    use UuidIntKeyTrait;
     use NullableFields;
     use UserConfigTrait;
     use UserAliasesTrait;
     use SettingsTrait;
     use SoftDeletes;
     use HasApiTokens;
 
     // a new user, default on creation
     public const STATUS_NEW        = 1 << 0;
     // it's been activated
     public const STATUS_ACTIVE     = 1 << 1;
     // user has been suspended
     public const STATUS_SUSPENDED  = 1 << 2;
     // user has been deleted
     public const STATUS_DELETED    = 1 << 3;
     // user has been created in LDAP
     public const STATUS_LDAP_READY = 1 << 4;
     // user mailbox has been created in IMAP
     public const STATUS_IMAP_READY = 1 << 5;
 
-
-    // change the default primary key type
-    public $incrementing = false;
-    protected $keyType = 'bigint';
-
     /**
      * The attributes that are mass assignable.
      *
      * @var array
      */
     protected $fillable = [
         'id',
         'email',
         'password',
         'password_ldap',
         'status',
     ];
 
     /**
      * The attributes that should be hidden for arrays.
      *
      * @var array
      */
     protected $hidden = [
         'password',
         'password_ldap',
         'role'
     ];
 
     protected $nullable = [
         'password',
         'password_ldap'
     ];
 
     /**
      * Any wallets on which this user is a controller.
      *
      * This does not include wallets owned by the user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
      */
     public function accounts()
     {
         return $this->belongsToMany(
             'App\Wallet',       // The foreign object definition
             'user_accounts',    // The table name
             'user_id',          // The local foreign key
             'wallet_id'         // The remote foreign key
         );
     }
 
     /**
      * Email aliases of this user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function aliases()
     {
         return $this->hasMany('App\UserAlias', 'user_id');
     }
 
     /**
      * Assign a package to a user. The user should not have any existing entitlements.
      *
      * @param \App\Package   $package The package to assign.
      * @param \App\User|null $user    Assign the package to another user.
      *
      * @return \App\User
      */
     public function assignPackage($package, $user = null)
     {
         if (!$user) {
             $user = $this;
         }
 
         $wallet_id = $this->wallets()->first()->id;
 
         foreach ($package->skus as $sku) {
             for ($i = $sku->pivot->qty; $i > 0; $i--) {
                 \App\Entitlement::create(
                     [
                         'wallet_id' => $wallet_id,
                         'sku_id' => $sku->id,
                         'cost' => $sku->pivot->cost(),
                         'fee' => $sku->pivot->fee(),
                         'entitleable_id' => $user->id,
                         'entitleable_type' => User::class
                     ]
                 );
             }
         }
 
         return $user;
     }
 
     /**
      * Assign a package plan to a user.
      *
      * @param \App\Plan   $plan   The plan to assign
      * @param \App\Domain $domain Optional domain object
      *
      * @return \App\User Self
      */
     public function assignPlan($plan, $domain = null): User
     {
         $this->setSetting('plan_id', $plan->id);
 
         foreach ($plan->packages as $package) {
             if ($package->isDomain()) {
                 $domain->assignPackage($package, $this);
             } else {
                 $this->assignPackage($package);
             }
         }
 
         return $this;
     }
 
     /**
      * Assign a Sku to a user.
      *
      * @param \App\Sku $sku   The sku to assign.
      * @param int      $count Count of entitlements to add
      *
      * @return \App\User Self
      * @throws \Exception
      */
     public function assignSku(Sku $sku, int $count = 1): User
     {
         // TODO: I guess wallet could be parametrized in future
         $wallet = $this->wallet();
         $exists = $this->entitlements()->where('sku_id', $sku->id)->count();
 
         while ($count > 0) {
             \App\Entitlement::create([
                 'wallet_id' => $wallet->id,
                 'sku_id' => $sku->id,
                 'cost' => $exists >= $sku->units_free ? $sku->cost : 0,
                 'fee' => $exists >= $sku->units_free ? $sku->fee : 0,
                 'entitleable_id' => $this->id,
                 'entitleable_type' => User::class
             ]);
 
             $exists++;
             $count--;
         }
 
         return $this;
     }
 
     /**
      * Check if current user can delete another object.
      *
      * @param mixed $object A user|domain|wallet|group object
      *
      * @return bool True if he can, False otherwise
      */
     public function canDelete($object): bool
     {
         if (!method_exists($object, 'wallet')) {
             return false;
         }
 
         $wallet = $object->wallet();
 
         // TODO: For now controller can delete/update the account owner,
         //       this may change in future, controllers are not 0-regression feature
 
         return $this->wallets->contains($wallet) || $this->accounts->contains($wallet);
     }
 
     /**
      * Check if current user can read data of another object.
      *
      * @param mixed $object A user|domain|wallet|group object
      *
      * @return bool True if he can, False otherwise
      */
     public function canRead($object): bool
     {
         if ($this->role == 'admin') {
             return true;
         }
 
         if ($object instanceof User && $this->id == $object->id) {
             return true;
         }
 
         if ($this->role == 'reseller') {
             if ($object instanceof User && $object->role == 'admin') {
                 return false;
             }
 
             if ($object instanceof Wallet && !empty($object->owner)) {
                 $object = $object->owner;
             }
 
             return isset($object->tenant_id) && $object->tenant_id == $this->tenant_id;
         }
 
         if ($object instanceof Wallet) {
             return $object->user_id == $this->id || $object->controllers->contains($this);
         }
 
         if (!method_exists($object, 'wallet')) {
             return false;
         }
 
         $wallet = $object->wallet();
 
         return $wallet && ($this->wallets->contains($wallet) || $this->accounts->contains($wallet));
     }
 
     /**
      * Check if current user can update data of another object.
      *
      * @param mixed $object A user|domain|wallet|group object
      *
      * @return bool True if he can, False otherwise
      */
     public function canUpdate($object): bool
     {
         if ($object instanceof User && $this->id == $object->id) {
             return true;
         }
 
         if ($this->role == 'admin') {
             return true;
         }
 
         if ($this->role == 'reseller') {
             if ($object instanceof User && $object->role == 'admin') {
                 return false;
             }
 
             if ($object instanceof Wallet && !empty($object->owner)) {
                 $object = $object->owner;
             }
 
             return isset($object->tenant_id) && $object->tenant_id == $this->tenant_id;
         }
 
         return $this->canDelete($object);
     }
 
     /**
      * Return the \App\Domain for this user.
      *
      * @return \App\Domain|null
      */
     public function domain()
     {
         list($local, $domainName) = explode('@', $this->email);
 
         $domain = \App\Domain::withTrashed()->where('namespace', $domainName)->first();
 
         return $domain;
     }
 
     /**
      * List the domains to which this user is entitled.
      * Note: Active public domains are also returned (for the user tenant).
      *
      * @return Domain[] List of Domain objects
      */
     public function domains(): array
     {
         if ($this->tenant_id) {
             $domains = Domain::where('tenant_id', $this->tenant_id);
         } else {
             $domains = Domain::withEnvTenantContext();
         }
 
         $domains = $domains->whereRaw(sprintf('(type & %s)', Domain::TYPE_PUBLIC))
             ->whereRaw(sprintf('(status & %s)', Domain::STATUS_ACTIVE))
             ->get()
             ->all();
 
         foreach ($this->wallets as $wallet) {
             $entitlements = $wallet->entitlements()->where('entitleable_type', Domain::class)->get();
             foreach ($entitlements as $entitlement) {
                 $domains[] = $entitlement->entitleable;
             }
         }
 
         foreach ($this->accounts as $wallet) {
             $entitlements = $wallet->entitlements()->where('entitleable_type', Domain::class)->get();
             foreach ($entitlements as $entitlement) {
                 $domains[] = $entitlement->entitleable;
             }
         }
 
         return $domains;
     }
 
     /**
      * The user entitlement.
      *
      * @return \Illuminate\Database\Eloquent\Relations\MorphOne
      */
     public function entitlement()
     {
         return $this->morphOne('App\Entitlement', 'entitleable');
     }
 
     /**
      * Entitlements for this user.
      *
      * Note that these are entitlements that apply to the user account, and not entitlements that
      * this user owns.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function entitlements()
     {
         return $this->hasMany('App\Entitlement', 'entitleable_id', 'id')
             ->where('entitleable_type', User::class);
     }
 
     /**
      * Find whether an email address exists as a user (including deleted users).
      *
      * @param string $email       Email address
      * @param bool   $return_user Return User instance instead of boolean
      *
      * @return \App\User|bool True or User model object if found, False otherwise
      */
     public static function emailExists(string $email, bool $return_user = false)
     {
         if (strpos($email, '@') === false) {
             return false;
         }
 
         $email = \strtolower($email);
 
         $user = self::withTrashed()->where('email', $email)->first();
 
         if ($user) {
             return $return_user ? $user : true;
         }
 
         return false;
     }
 
     /**
      * Helper to find user by email address, whether it is
      * main email address, alias or an external email.
      *
      * If there's more than one alias NULL will be returned.
      *
      * @param string $email    Email address
      * @param bool   $external Search also for an external email
      *
      * @return \App\User|null User model object if found
      */
     public static function findByEmail(string $email, bool $external = false): ?User
     {
         if (strpos($email, '@') === false) {
             return null;
         }
 
         $email = \strtolower($email);
 
         $user = self::where('email', $email)->first();
 
         if ($user) {
             return $user;
         }
 
         $aliases = UserAlias::where('alias', $email)->get();
 
         if (count($aliases) == 1) {
             return $aliases->first()->user;
         }
 
         // TODO: External email
 
         return null;
     }
 
 
 
     /**
      * Return groups controlled by the current user.
      *
      * @param bool $with_accounts Include groups assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function groups($with_accounts = true)
     {
         $wallets = $this->wallets()->pluck('id')->all();
 
         if ($with_accounts) {
             $wallets = array_merge($wallets, $this->accounts()->pluck('wallet_id')->all());
         }
 
         return Group::select(['groups.*', 'entitlements.wallet_id'])
             ->distinct()
             ->join('entitlements', 'entitlements.entitleable_id', '=', 'groups.id')
             ->whereIn('entitlements.wallet_id', $wallets)
             ->where('entitlements.entitleable_type', Group::class);
     }
 
     /**
      * Check if user has an entitlement for the specified SKU.
      *
      * @param string $title The SKU title
      *
      * @return bool True if specified SKU entitlement exists
      */
     public function hasSku(string $title): bool
     {
         $sku = Sku::withObjectTenantContext($this)->where('title', $title)->first();
 
         if (!$sku) {
             return false;
         }
 
         return $this->entitlements()->where('sku_id', $sku->id)->count() > 0;
     }
 
     /**
      * Returns whether this domain is active.
      *
      * @return bool
      */
     public function isActive(): bool
     {
         return ($this->status & self::STATUS_ACTIVE) > 0;
     }
 
     /**
      * Returns whether this domain is deleted.
      *
      * @return bool
      */
     public function isDeleted(): bool
     {
         return ($this->status & self::STATUS_DELETED) > 0;
     }
 
     /**
      * Returns whether this (external) domain has been verified
      * to exist in DNS.
      *
      * @return bool
      */
     public function isImapReady(): bool
     {
         return ($this->status & self::STATUS_IMAP_READY) > 0;
     }
 
     /**
      * Returns whether this user is registered in LDAP.
      *
      * @return bool
      */
     public function isLdapReady(): bool
     {
         return ($this->status & self::STATUS_LDAP_READY) > 0;
     }
 
     /**
      * Returns whether this user is new.
      *
      * @return bool
      */
     public function isNew(): bool
     {
         return ($this->status & self::STATUS_NEW) > 0;
     }
 
     /**
      * Returns whether this domain is suspended.
      *
      * @return bool
      */
     public function isSuspended(): bool
     {
         return ($this->status & self::STATUS_SUSPENDED) > 0;
     }
 
     /**
      * A shortcut to get the user name.
      *
      * @param bool $fallback Return "<aa.name> User" if there's no name
      *
      * @return string Full user name
      */
     public function name(bool $fallback = false): string
     {
         $settings = $this->getSettings(['first_name', 'last_name']);
 
         $name = trim($settings['first_name'] . ' ' . $settings['last_name']);
 
         if (empty($name) && $fallback) {
             return trim(\trans('app.siteuser', ['site' => \App\Tenant::getConfig($this->tenant_id, 'app.name')]));
         }
 
         return $name;
     }
 
     /**
      * Remove a number of entitlements for the SKU.
      *
      * @param \App\Sku $sku   The SKU
      * @param int      $count The number of entitlements to remove
      *
      * @return User Self
      */
     public function removeSku(Sku $sku, int $count = 1): User
     {
         $entitlements = $this->entitlements()
             ->where('sku_id', $sku->id)
             ->orderBy('cost', 'desc')
             ->orderBy('created_at')
             ->get();
 
         $entitlements_count = count($entitlements);
 
         foreach ($entitlements as $entitlement) {
             if ($entitlements_count <= $sku->units_free) {
                 continue;
             }
 
             if ($count > 0) {
                 $entitlement->delete();
                 $entitlements_count--;
                 $count--;
             }
         }
 
         return $this;
     }
 
     public function senderPolicyFrameworkWhitelist($clientName)
     {
         $setting = $this->getSetting('spf_whitelist');
 
         if (!$setting) {
             return false;
         }
 
         $whitelist = json_decode($setting);
 
         $matchFound = false;
 
         foreach ($whitelist as $entry) {
             if (substr($entry, 0, 1) == '/') {
                 $match = preg_match($entry, $clientName);
 
                 if ($match) {
                     $matchFound = true;
                 }
 
                 continue;
             }
 
             if (substr($entry, 0, 1) == '.') {
                 if (substr($clientName, (-1 * strlen($entry))) == $entry) {
                     $matchFound = true;
                 }
 
                 continue;
             }
 
             if ($entry == $clientName) {
                 $matchFound = true;
                 continue;
             }
         }
 
         return $matchFound;
     }
 
     /**
      * Any (additional) properties of this user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function settings()
     {
         return $this->hasMany('App\UserSetting', 'user_id');
     }
 
     /**
      * Suspend this domain.
      *
      * @return void
      */
     public function suspend(): void
     {
         if ($this->isSuspended()) {
             return;
         }
 
         $this->status |= User::STATUS_SUSPENDED;
         $this->save();
     }
 
     /**
      * The tenant for this user account.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function tenant()
     {
         return $this->belongsTo('App\Tenant', 'tenant_id', 'id');
     }
 
     /**
      * Unsuspend this domain.
      *
      * @return void
      */
     public function unsuspend(): void
     {
         if (!$this->isSuspended()) {
             return;
         }
 
         $this->status ^= User::STATUS_SUSPENDED;
         $this->save();
     }
 
     /**
      * Return users controlled by the current user.
      *
      * @param bool $with_accounts Include users assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function users($with_accounts = true)
     {
         $wallets = $this->wallets()->pluck('id')->all();
 
         if ($with_accounts) {
             $wallets = array_merge($wallets, $this->accounts()->pluck('wallet_id')->all());
         }
 
         return $this->select(['users.*', 'entitlements.wallet_id'])
             ->distinct()
             ->leftJoin('entitlements', 'entitlements.entitleable_id', '=', 'users.id')
             ->whereIn('entitlements.wallet_id', $wallets)
             ->where('entitlements.entitleable_type', User::class);
     }
 
     /**
      * Verification codes for this user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function verificationcodes()
     {
         return $this->hasMany('App\VerificationCode', 'user_id', 'id');
     }
 
     /**
      * Returns the wallet by which the user is controlled
      *
      * @return ?\App\Wallet A wallet object
      */
     public function wallet(): ?Wallet
     {
         $entitlement = $this->entitlement()->withTrashed()->orderBy('created_at', 'desc')->first();
 
         // TODO: No entitlement should not happen, but in tests we have
         //       such cases, so we fallback to the user's wallet in this case
         return $entitlement ? $entitlement->wallet : $this->wallets()->first();
     }
 
     /**
      * Wallets this user owns.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function wallets()
     {
         return $this->hasMany('App\Wallet');
     }
 
     /**
      * User password mutator
      *
      * @param string $password The password in plain text.
      *
      * @return void
      */
     public function setPasswordAttribute($password)
     {
         if (!empty($password)) {
             $this->attributes['password'] = bcrypt($password, [ "rounds" => 12 ]);
             $this->attributes['password_ldap'] = '{SSHA512}' . base64_encode(
                 pack('H*', hash('sha512', $password))
             );
         }
     }
 
     /**
      * User LDAP password mutator
      *
      * @param string $password The password in plain text.
      *
      * @return void
      */
     public function setPasswordLdapAttribute($password)
     {
         $this->setPasswordAttribute($password);
     }
 
     /**
      * User status mutator
      *
      * @throws \Exception
      */
     public function setStatusAttribute($status)
     {
         $new_status = 0;
 
         $allowed_values = [
             self::STATUS_NEW,
             self::STATUS_ACTIVE,
             self::STATUS_SUSPENDED,
             self::STATUS_DELETED,
             self::STATUS_LDAP_READY,
             self::STATUS_IMAP_READY,
         ];
 
         foreach ($allowed_values as $value) {
             if ($status & $value) {
                 $new_status |= $value;
                 $status ^= $value;
             }
         }
 
         if ($status > 0) {
             throw new \Exception("Invalid user status: {$status}");
         }
 
         $this->attributes['status'] = $new_status;
     }
 
     /**
      * Validate the user credentials
      *
      * @param string $username       The username.
      * @param string $password       The password in plain text.
      * @param bool   $updatePassword Store the password if currently empty
      *
      * @return bool true on success
      */
     public function validateCredentials(string $username, string $password, bool $updatePassword = true): bool
     {
         $authenticated = false;
 
         if ($this->email === \strtolower($username)) {
             if (!empty($this->password)) {
                 if (Hash::check($password, $this->password)) {
                     $authenticated = true;
                 }
             } elseif (!empty($this->password_ldap)) {
                 if (substr($this->password_ldap, 0, 6) == "{SSHA}") {
                     $salt = substr(base64_decode(substr($this->password_ldap, 6)), 20);
 
                     $hash = '{SSHA}' . base64_encode(
                         sha1($password . $salt, true) . $salt
                     );
 
                     if ($hash == $this->password_ldap) {
                         $authenticated = true;
                     }
                 } elseif (substr($this->password_ldap, 0, 9) == "{SSHA512}") {
                     $salt = substr(base64_decode(substr($this->password_ldap, 9)), 64);
 
                     $hash = '{SSHA512}' . base64_encode(
                         pack('H*', hash('sha512', $password . $salt)) . $salt
                     );
 
                     if ($hash == $this->password_ldap) {
                         $authenticated = true;
                     }
                 }
             } else {
                 \Log::error("Incomplete credentials for {$this->email}");
             }
         }
 
         if ($authenticated) {
             \Log::info("Successful authentication for {$this->email}");
 
             // TODO: update last login time
             if ($updatePassword && (empty($this->password) || empty($this->password_ldap))) {
                 $this->password = $password;
                 $this->save();
             }
         } else {
             // TODO: Try actual LDAP?
             \Log::info("Authentication failed for {$this->email}");
         }
 
         return $authenticated;
     }
 
     /**
      * Retrieve and authenticate a user
      *
      * @param string $username     The username.
      * @param string $password     The password in plain text.
      * @param string $secondFactor The second factor (secondfactor from current request is used as fallback).
      *
      * @return array ['user', 'reason', 'errorMessage']
      */
     public static function findAndAuthenticate($username, $password, $secondFactor = null): ?array
     {
         $user = User::where('email', $username)->first();
         if (!$user) {
             return ['reason' => 'notfound', 'errorMessage' => "User not found."];
         }
 
         if (!$user->validateCredentials($username, $password)) {
             return ['reason' => 'credentials', 'errorMessage' => "Invalid password."];
         }
 
 
 
         if (!$secondFactor) {
             // Check the request if there is a second factor provided
             // as fallback.
             $secondFactor = request()->secondfactor;
         }
 
         try {
             (new \App\Auth\SecondFactor($user))->validate($secondFactor);
         } catch (\Exception $e) {
             return ['reason' => 'secondfactor', 'errorMessage' => $e->getMessage()];
         }
 
         return ['user' => $user];
     }
 
     /**
      * Hook for passport
      *
      * @throws \Throwable
      *
      * @return \App\User User model object if found
      */
     public function findAndValidateForPassport($username, $password): User
     {
         $result = self::findAndAuthenticate($username, $password);
 
         if (isset($result['reason'])) {
             if ($result['reason'] == 'secondfactor') {
                 // This results in a json response of {'error': 'secondfactor', 'error_description': '$errorMessage'}
                 throw new OAuthServerException($result['errorMessage'], 6, 'secondfactor', 401);
             }
             throw OAuthServerException::invalidCredentials();
         }
         return $result['user'];
     }
 }
diff --git a/src/app/Wallet.php b/src/app/Wallet.php
index d2ddbcf0..cc8d505b 100644
--- a/src/app/Wallet.php
+++ b/src/app/Wallet.php
@@ -1,437 +1,436 @@
 <?php
 
 namespace App;
 
 use App\User;
 use App\Traits\SettingsTrait;
+use App\Traits\UuidStrKeyTrait;
 use Carbon\Carbon;
 use Iatstuti\Database\Support\NullableFields;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Facades\DB;
 
 /**
  * The eloquent definition of a wallet -- a container with a chunk of change.
  *
  * A wallet is owned by an {@link \App\User}.
  *
  * @property int        $balance     Current balance in cents
  * @property string     $currency    Currency code
  * @property ?string    $description Description
  * @property string     $id          Unique identifier
  * @property ?\App\User $owner       Owner (can be null when owner is deleted)
  * @property int        $user_id     Owner's identifier
  */
 class Wallet extends Model
 {
     use NullableFields;
     use SettingsTrait;
-
-    public $incrementing = false;
-    protected $keyType = 'string';
+    use UuidStrKeyTrait;
 
     public $timestamps = false;
 
     /**
      * The attributes' default values.
      *
      * @var array
      */
     protected $attributes = [
         'balance' => 0,
     ];
 
     /**
      * The attributes that are mass assignable.
      *
      * @var array
      */
     protected $fillable = [
         'currency',
         'description'
     ];
 
     /**
      * The attributes that can be not set.
      *
      * @var array
      */
     protected $nullable = [
         'description',
     ];
 
     /**
      * The types of attributes to which its values will be cast
      *
      * @var array
      */
     protected $casts = [
         'balance' => 'integer',
     ];
 
 
     /**
      * Add a controller to this wallet.
      *
      * @param \App\User $user The user to add as a controller to this wallet.
      *
      * @return void
      */
     public function addController(User $user)
     {
         if (!$this->controllers->contains($user)) {
             $this->controllers()->save($user);
         }
     }
 
     public function chargeEntitlements($apply = true)
     {
         // This wallet has been created less than a month ago, this is the trial period
         if ($this->owner->created_at >= Carbon::now()->subMonthsWithoutOverflow(1)) {
             // Move all the current entitlement's updated_at timestamps forward to one month after
             // this wallet was created.
             $freeMonthEnds = $this->owner->created_at->copy()->addMonthsWithoutOverflow(1);
 
             foreach ($this->entitlements()->get()->fresh() as $entitlement) {
                 if ($entitlement->updated_at < $freeMonthEnds) {
                     $entitlement->updated_at = $freeMonthEnds;
                     $entitlement->save();
                 }
             }
 
             return 0;
         }
 
         $profit = 0;
         $charges = 0;
         $discount = $this->getDiscountRate();
 
         DB::beginTransaction();
 
         // used to parent individual entitlement billings to the wallet debit.
         $entitlementTransactions = [];
 
         foreach ($this->entitlements()->get()->fresh() as $entitlement) {
             // This entitlement has been created less than or equal to 14 days ago (this is at
             // maximum the fourteenth 24-hour period).
             if ($entitlement->created_at > Carbon::now()->subDays(14)) {
                 continue;
             }
 
             // This entitlement was created, or billed last, less than a month ago.
             if ($entitlement->updated_at > Carbon::now()->subMonthsWithoutOverflow(1)) {
                 continue;
             }
 
             // updated last more than a month ago -- was it billed?
             if ($entitlement->updated_at <= Carbon::now()->subMonthsWithoutOverflow(1)) {
                 $diff = $entitlement->updated_at->diffInMonths(Carbon::now());
 
                 $cost = (int) ($entitlement->cost * $discount * $diff);
                 $fee = (int) ($entitlement->fee * $diff);
 
                 $charges += $cost;
                 $profit += $cost - $fee;
 
                 // if we're in dry-run, you know...
                 if (!$apply) {
                     continue;
                 }
 
                 $entitlement->updated_at = $entitlement->updated_at->copy()
                     ->addMonthsWithoutOverflow($diff);
 
                 $entitlement->save();
 
                 if ($cost == 0) {
                     continue;
                 }
 
                 $entitlementTransactions[] = $entitlement->createTransaction(
                     \App\Transaction::ENTITLEMENT_BILLED,
                     $cost
                 );
             }
         }
 
         if ($apply) {
             $this->debit($charges, '', $entitlementTransactions);
 
             // Credit/debit the reseller
             if ($profit != 0 && $this->owner->tenant) {
                 // FIXME: Should we have a simpler way to skip this for non-reseller tenant(s)
                 if ($wallet = $this->owner->tenant->wallet()) {
                     $desc = "Charged user {$this->owner->email}";
                     $method = $profit > 0 ? 'credit' : 'debit';
                     $wallet->{$method}(abs($profit), $desc);
                 }
             }
         }
 
         DB::commit();
 
         return $charges;
     }
 
     /**
      * Calculate for how long the current balance will last.
      *
      * Returns NULL for balance < 0 or discount = 100% or on a fresh account
      *
      * @return \Carbon\Carbon|null Date
      */
     public function balanceLastsUntil()
     {
         if ($this->balance < 0 || $this->getDiscount() == 100) {
             return null;
         }
 
         // retrieve any expected charges
         $expectedCharge = $this->expectedCharges();
 
         // get the costs per day for all entitlements billed against this wallet
         $costsPerDay = $this->costsPerDay();
 
         if (!$costsPerDay) {
             return null;
         }
 
         // the number of days this balance, minus the expected charges, would last
         $daysDelta = ($this->balance - $expectedCharge) / $costsPerDay;
 
         // calculate from the last entitlement billed
         $entitlement = $this->entitlements()->orderBy('updated_at', 'desc')->first();
 
         $until = $entitlement->updated_at->copy()->addDays($daysDelta);
 
         // Don't return dates from the past
         if ($until < Carbon::now() && !$until->isToday()) {
             return null;
         }
 
         return $until;
     }
 
     /**
      * Controllers of this wallet.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
      */
     public function controllers()
     {
         return $this->belongsToMany(
             'App\User',         // The foreign object definition
             'user_accounts',    // The table name
             'wallet_id',      // The local foreign key
             'user_id'         // The remote foreign key
         );
     }
 
     /**
      * Retrieve the costs per day of everything charged to this wallet.
      *
      * @return float
      */
     public function costsPerDay()
     {
         $costs = (float) 0;
 
         foreach ($this->entitlements as $entitlement) {
             $costs += $entitlement->costsPerDay();
         }
 
         return $costs;
     }
 
     /**
      * Add an amount of pecunia to this wallet's balance.
      *
      * @param int    $amount      The amount of pecunia to add (in cents).
      * @param string $description The transaction description
      *
      * @return Wallet Self
      */
     public function credit(int $amount, string $description = ''): Wallet
     {
         $this->balance += $amount;
 
         $this->save();
 
         \App\Transaction::create(
             [
                 'object_id' => $this->id,
                 'object_type' => \App\Wallet::class,
                 'type' => \App\Transaction::WALLET_CREDIT,
                 'amount' => $amount,
                 'description' => $description
             ]
         );
 
         return $this;
     }
 
     /**
      * Deduct an amount of pecunia from this wallet's balance.
      *
      * @param int    $amount      The amount of pecunia to deduct (in cents).
      * @param string $description The transaction description
      * @param array  $eTIDs       List of transaction IDs for the individual entitlements
      *                            that make up this debit record, if any.
      * @return Wallet Self
      */
     public function debit(int $amount, string $description = '', array $eTIDs = []): Wallet
     {
         if ($amount == 0) {
             return $this;
         }
 
         $this->balance -= $amount;
 
         $this->save();
 
         $transaction = \App\Transaction::create(
             [
                 'object_id' => $this->id,
                 'object_type' => \App\Wallet::class,
                 'type' => \App\Transaction::WALLET_DEBIT,
                 'amount' => $amount * -1,
                 'description' => $description
             ]
         );
 
         if (!empty($eTIDs)) {
             \App\Transaction::whereIn('id', $eTIDs)->update(['transaction_id' => $transaction->id]);
         }
 
         return $this;
     }
 
     /**
      * The discount assigned to the wallet.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function discount()
     {
         return $this->belongsTo('App\Discount', 'discount_id', 'id');
     }
 
     /**
      * Entitlements billed to this wallet.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function entitlements()
     {
         return $this->hasMany('App\Entitlement');
     }
 
     /**
      * Calculate the expected charges to this wallet.
      *
      * @return int
      */
     public function expectedCharges()
     {
         return $this->chargeEntitlements(false);
     }
 
     /**
      * Return the exact, numeric version of the discount to be applied.
      *
      * Ranges from 0 - 100.
      *
      * @return int
      */
     public function getDiscount()
     {
         return $this->discount ? $this->discount->discount : 0;
     }
 
     /**
      * The actual discount rate for use in multiplication
      *
      * Ranges from 0.00 to 1.00.
      */
     public function getDiscountRate()
     {
         return (100 - $this->getDiscount()) / 100;
     }
 
     /**
      * A helper to display human-readable amount of money using
      * the wallet currency and specified locale.
      *
      * @param int    $amount A amount of money (in cents)
      * @param string $locale A locale for the output
      *
      * @return string String representation, e.g. "9.99 CHF"
      */
     public function money(int $amount, $locale = 'de_DE')
     {
         $amount = round($amount / 100, 2);
 
         $nf = new \NumberFormatter($locale, \NumberFormatter::CURRENCY);
         $result = $nf->formatCurrency($amount, $this->currency);
         // Replace non-breaking space
         return str_replace("\xC2\xA0", " ", $result);
     }
 
     /**
      * The owner of the wallet -- the wallet is in his/her back pocket.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function owner()
     {
         return $this->belongsTo('App\User', 'user_id', 'id');
     }
 
     /**
      * Payments on this wallet.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function payments()
     {
         return $this->hasMany('App\Payment');
     }
 
     /**
      * Remove a controller from this wallet.
      *
      * @param \App\User $user The user to remove as a controller from this wallet.
      *
      * @return void
      */
     public function removeController(User $user)
     {
         if ($this->controllers->contains($user)) {
             $this->controllers()->detach($user);
         }
     }
 
     /**
      * Any (additional) properties of this wallet.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function settings()
     {
         return $this->hasMany('App\WalletSetting');
     }
 
     /**
      * Retrieve the transactions against this wallet.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function transactions()
     {
         return \App\Transaction::where(
             [
                 'object_id' => $this->id,
                 'object_type' => \App\Wallet::class
             ]
         );
     }
 }