diff --git a/src/app/Traits/UserConfigTrait.php b/src/app/Traits/UserConfigTrait.php
index 5f5bd462..d373cc1c 100644
--- a/src/app/Traits/UserConfigTrait.php
+++ b/src/app/Traits/UserConfigTrait.php
@@ -1,104 +1,110 @@
 <?php
 
 namespace App\Traits;
 
 use App\Policy\Greylist;
 
 trait UserConfigTrait
 {
     /**
      * A helper to get the user configuration.
      */
     public function getConfig(): array
     {
         $config = [];
 
         // TODO: Should we store the default value somewhere in config?
 
         $config['greylist_enabled'] = $this->getSetting('greylist_enabled') !== 'false';
         $config['password_policy'] = $this->getSetting('password_policy');
 
         return $config;
     }
 
     /**
      * A helper to update user configuration.
      *
      * @param array $config An array of configuration options
      *
      * @return array A list of input validation error messages
      */
     public function setConfig(array $config): array
     {
         $errors = [];
 
         foreach ($config as $key => $value) {
             if ($key == 'greylist_enabled') {
                 $this->setSetting('greylist_enabled', $value ? 'true' : 'false');
             } elseif ($key == 'password_policy') {
-                if (!is_string($value) || (strlen($value) && !preg_match('/^[a-z0-9:,]+$/', $value))) {
+                // Validate the syntax and make sure min and max is included
+                if (
+                    !is_string($value)
+                    || strpos($value, 'min:') === false
+                    || strpos($value, 'max:') === false
+                    || !preg_match('/^[a-z0-9:,]+$/', $value)
+                ) {
                     $errors[$key] = \trans('validation.invalid-password-policy');
                     continue;
                 }
 
                 foreach (explode(',', $value) as $rule) {
                     if ($error = $this->validatePasswordPolicyRule($rule)) {
                         $errors[$key] = $error;
                         continue 2;
                     }
                 }
 
                 $this->setSetting('password_policy', $value);
             } else {
                 $errors[$key] = \trans('validation.invalid-config-parameter');
             }
         }
 
         return $errors;
     }
 
     /**
      * Validates password policy rule.
      *
      * @param string $rule Policy rule
      *
      * @return ?string An error message on error, Null otherwise
      */
     protected function validatePasswordPolicyRule(string $rule): ?string
     {
         $regexp = [
             'min:[0-9]+', 'max:[0-9]+', 'upper', 'lower', 'digit', 'special', 'last:[0-9]+'
         ];
 
         if (empty($rule) || !preg_match('/^(' . implode('|', $regexp) . ')$/', $rule)) {
             return \trans('validation.invalid-password-policy');
         }
 
         $systemPolicy = \App\Rules\Password::parsePolicy(\config('app.password_policy'));
 
         // Min/Max values cannot exceed the system defaults, i.e. if system policy
         // is min:5, user's policy cannot be set to a smaller number.
         if (!empty($systemPolicy['min']) && strpos($rule, 'min:') === 0) {
             $value = trim(substr($rule, 4));
             if ($value < $systemPolicy['min']) {
                 return \trans('validation.password-policy-min-len-error', ['min' => $systemPolicy['min']]);
             }
         }
 
         if (!empty($systemPolicy['max']) && strpos($rule, 'max:') === 0) {
             $value = trim(substr($rule, 4));
             if ($value > $systemPolicy['max']) {
                 return \trans('validation.password-policy-max-len-error', ['max' => $systemPolicy['max']]);
             }
         }
 
         if (!empty($systemPolicy['last']) && strpos($rule, 'last:') === 0) {
             $value = trim(substr($rule, 5));
             if ($value < $systemPolicy['last']) {
                 return \trans('validation.password-policy-last-error', ['last' => $systemPolicy['last']]);
             }
         }
 
         return null;
     }
 }
diff --git a/src/resources/vue/Settings.vue b/src/resources/vue/Settings.vue
index acdec061..3725369f 100644
--- a/src/resources/vue/Settings.vue
+++ b/src/resources/vue/Settings.vue
@@ -1,93 +1,101 @@
 <template>
     <div class="container">
         <div class="card" id="settings">
             <div class="card-body">
                 <div class="card-title">
                     {{ $t('dashboard.settings') }}
                 </div>
                 <div class="card-text">
                     <form @submit.prevent="submit">
                         <div class="row mb-3">
                             <label class="col-sm-4 col-form-label">{{ $t('user.passwordpolicy') }}</label>
                             <div class="col-sm-8">
                                 <ul id="password_policy" class="list-group ms-1 mt-1">
                                     <li v-for="rule in passwordPolicy" :key="rule.label" class="list-group-item border-0 form-check pt-1 pb-1">
-                                        <input type="checkbox" class="form-check-input" :id="'policy-' + rule.label" :name="rule.label" :checked="rule.enabled">
+                                        <input type="checkbox" class="form-check-input"
+                                               :id="'policy-' + rule.label"
+                                               :name="rule.label"
+                                               :checked="rule.enabled || isRequired(rule)"
+                                               :disabled="isRequired(rule)"
+                                        >
                                         <span v-if="rule.label == 'last'" v-html="ruleLastHTML(rule)"></span>
-                                        <label v-else :for="'policy-' + rule.label" class="form-check-label pe-2">{{ rule.name.split(':')[0] }}</label>
+                                        <label v-else :for="'policy-' + rule.label" class="form-check-label pe-2" style="opacity:1">{{ rule.name.split(':')[0] }}</label>
                                         <input type="text" class="form-control form-control-sm w-auto d-inline" v-if="['min', 'max'].includes(rule.label)" :value="rule.param" size="3">
                                     </li>
                                 </ul>
                             </div>
                         </div>
                         <btn class="btn-primary" type="submit" icon="check">{{ $t('btn.submit') }}</btn>
                     </form>
                 </div>
             </div>
         </div>
     </div>
 </template>
 
 <script>
     export default {
         data() {
             return {
                 passwordPolicy: []
             }
         },
         created() {
             this.wallet = this.$store.state.authInfo.wallet
         },
         mounted() {
             this.$root.startLoading()
 
             axios.get('/api/v4/password-policy')
                 .then(response => {
                     this.$root.stopLoading()
 
                     if (response.data.list) {
                         this.passwordPolicy = response.data.list
                     }
                 })
                 .catch(this.$root.errorHandler)
         },
         methods: {
+            isRequired(rule) {
+                return rule.label == 'min' || rule.label == 'max'
+            },
             ruleLastHTML(rule) {
                 let parts = rule.name.split(/[0-9]+/)
                 let options = [1, 2, 3, 4, 5, 6]
 
                 options = options.map(num => {
                     let selected = num == rule.param ? ' selected' : ''
                     return `<option value="${num}"${selected}>${num}</option>`
                 })
 
                 return `<label for="policy-last" class="form-check-label pe-2">
                     ${parts[0]} <select class="form-select form-select-sm d-inline w-auto">${options.join('')}</select> ${parts[1]}
                     </label>`
             },
             submit() {
                 this.$root.clearFormValidation($('#settings form'))
 
                 let password_policy = [];
 
                 $('#password_policy > li > input:checked').each((i, element) => {
                     let entry = element.name
                     let param = $(element.parentNode).find('select,input[type=text]').val()
 
                     if (param) {
                         entry += ':' + param
                     }
 
                     password_policy.push(entry)
                 })
 
                 let post = { password_policy: password_policy.join(',') }
 
                 axios.post('/api/v4/users/' + this.wallet.user_id + '/config', post)
                     .then(response => {
                         this.$toast.success(response.data.message)
                     })
             },
         }
     }
 </script>
diff --git a/src/tests/Browser/SettingsTest.php b/src/tests/Browser/SettingsTest.php
index 0ff830b0..4307a6b9 100644
--- a/src/tests/Browser/SettingsTest.php
+++ b/src/tests/Browser/SettingsTest.php
@@ -1,105 +1,107 @@
 <?php
 
 namespace Tests\Browser;
 
 use Tests\Browser;
 use Tests\Browser\Components\Menu;
 use Tests\Browser\Components\Toast;
 use Tests\Browser\Pages\Dashboard;
 use Tests\Browser\Pages\Home;
 use Tests\Browser\Pages\Settings;
 use Tests\TestCaseDusk;
 
 class SettingsTest extends TestCaseDusk
 {
     /**
      * Test settings page (unauthenticated)
      */
     public function testSettingsUnauth(): void
     {
         // Test that the page requires authentication
         $this->browse(function (Browser $browser) {
             $browser->visit('/settings')->on(new Home());
         });
     }
 
     /**
      * Test settings "box" on Dashboard
      */
     public function testDashboard(): void
     {
         $this->browse(function (Browser $browser) {
             // Test a user that is not an account owner
             $browser->visit(new Home())
                 ->submitLogon('jack@kolab.org', 'simple123', true)
                 ->on(new Dashboard())
                 ->assertMissing('@links .link-settings .name')
                 ->visit('/settings')
                 ->assertErrorPage(403)
                 ->within(new Menu(), function (Browser $browser) {
                     $browser->clickMenuItem('logout');
                 });
 
             // Test the account owner
             $browser->waitForLocation('/login')
                 ->on(new Home())
                 ->submitLogon('john@kolab.org', 'simple123', true)
                 ->on(new Dashboard())
                 ->assertSeeIn('@links .link-settings .name', 'Settings');
         });
     }
 
     /**
      * Test Settings page
      *
      * @depends testDashboard
      */
     public function testSettings(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $john->setSetting('password_policy', 'min:5,max:100,lower');
 
         $this->browse(function (Browser $browser) {
             $browser->click('@links .link-settings')
                 ->on(new Settings())
                 ->assertSeeIn('#settings .card-title', 'Settings')
                 // Password policy
                 ->assertSeeIn('@form .row:nth-child(1) > label', 'Password Policy')
                 ->with('@form #password_policy', function (Browser $browser) {
                     $browser->assertElementsCount('li', 7)
                         ->assertSeeIn('li:nth-child(1) label', 'Minimum password length')
                         ->assertChecked('li:nth-child(1) input[type=checkbox]')
+                        ->assertDisabled('li:nth-child(1) input[type=checkbox]')
                         ->assertValue('li:nth-child(1) input[type=text]', '5')
                         ->assertSeeIn('li:nth-child(2) label', 'Maximum password length')
                         ->assertChecked('li:nth-child(2) input[type=checkbox]')
+                        ->assertDisabled('li:nth-child(2) input[type=checkbox]')
                         ->assertValue('li:nth-child(2) input[type=text]', '100')
                         ->assertSeeIn('li:nth-child(3) label', 'Password contains a lower-case character')
                         ->assertChecked('li:nth-child(3) input[type=checkbox]')
                         ->assertMissing('li:nth-child(3) input[type=text]')
                         ->assertSeeIn('li:nth-child(4) label', 'Password contains an upper-case character')
                         ->assertNotChecked('li:nth-child(4) input[type=checkbox]')
                         ->assertMissing('li:nth-child(4) input[type=text]')
                         ->assertSeeIn('li:nth-child(5) label', 'Password contains a digit')
                         ->assertNotChecked('li:nth-child(5) input[type=checkbox]')
                         ->assertMissing('li:nth-child(5) input[type=text]')
                         ->assertSeeIn('li:nth-child(6) label', 'Password contains a special character')
                         ->assertNotChecked('li:nth-child(6) input[type=checkbox]')
                         ->assertMissing('li:nth-child(6) input[type=text]')
                         ->assertSeeIn('li:nth-child(7) label', 'Password cannot be the same as the last')
                         ->assertNotChecked('li:nth-child(7) input[type=checkbox]')
                         ->assertMissing('li:nth-child(7) input[type=text]')
                         ->assertSelected('li:nth-child(7) select', 3)
                         ->assertSelectHasOptions('li:nth-child(7) select', [1,2,3,4,5,6])
                         // Change the policy
                         ->type('li:nth-child(1) input[type=text]', '11')
                         ->type('li:nth-child(2) input[type=text]', '120')
                         ->click('li:nth-child(3) input[type=checkbox]')
                         ->click('li:nth-child(4) input[type=checkbox]');
                 })
                 ->click('button[type=submit]')
                 ->assertToast(Toast::TYPE_SUCCESS, 'User settings updated successfully.');
         });
 
         $this->assertSame('min:11,max:120,upper', $john->getSetting('password_policy'));
     }
 }
diff --git a/src/tests/Feature/Controller/UsersTest.php b/src/tests/Feature/Controller/UsersTest.php
index d3f28b15..5ce5a8ac 100644
--- a/src/tests/Feature/Controller/UsersTest.php
+++ b/src/tests/Feature/Controller/UsersTest.php
@@ -1,1487 +1,1487 @@
 <?php
 
 namespace Tests\Feature\Controller;
 
 use App\Discount;
 use App\Domain;
 use App\Http\Controllers\API\V4\UsersController;
 use App\Package;
 use App\Sku;
 use App\User;
 use App\Wallet;
 use Carbon\Carbon;
 use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Str;
 use Tests\TestCase;
 
 class UsersTest extends TestCase
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('jane@kolabnow.com');
         $this->deleteTestUser('UsersControllerTest1@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest2@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest3@userscontroller.com');
         $this->deleteTestUser('UserEntitlement2A@UserEntitlement.com');
         $this->deleteTestUser('john2.doe2@kolab.org');
         $this->deleteTestUser('deleted@kolab.org');
         $this->deleteTestUser('deleted@kolabnow.com');
         $this->deleteTestDomain('userscontroller.com');
         $this->deleteTestGroup('group-test@kolabnow.com');
         $this->deleteTestGroup('group-test@kolab.org');
 
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
         $wallet->discount()->dissociate();
         $wallet->settings()->whereIn('key', ['mollie_id', 'stripe_id'])->delete();
         $wallet->save();
         $user->status |= User::STATUS_IMAP_READY;
         $user->save();
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser('jane@kolabnow.com');
         $this->deleteTestUser('UsersControllerTest1@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest2@userscontroller.com');
         $this->deleteTestUser('UsersControllerTest3@userscontroller.com');
         $this->deleteTestUser('UserEntitlement2A@UserEntitlement.com');
         $this->deleteTestUser('john2.doe2@kolab.org');
         $this->deleteTestUser('deleted@kolab.org');
         $this->deleteTestUser('deleted@kolabnow.com');
         $this->deleteTestDomain('userscontroller.com');
         $this->deleteTestGroup('group-test@kolabnow.com');
         $this->deleteTestGroup('group-test@kolab.org');
 
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
         $wallet->discount()->dissociate();
         $wallet->settings()->whereIn('key', ['mollie_id', 'stripe_id'])->delete();
         $wallet->save();
         $user->settings()->whereIn('key', ['greylist_enabled'])->delete();
         $user->status |= User::STATUS_IMAP_READY;
         $user->save();
 
         parent::tearDown();
     }
 
     /**
      * Test user deleting (DELETE /api/v4/users/<id>)
      */
     public function testDestroy(): void
     {
         // First create some users/accounts to delete
         $package_kolab = \App\Package::where('title', 'kolab')->first();
         $package_domain = \App\Package::where('title', 'domain-hosting')->first();
 
         $john = $this->getTestUser('john@kolab.org');
         $user1 = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $user2 = $this->getTestUser('UsersControllerTest2@userscontroller.com');
         $user3 = $this->getTestUser('UsersControllerTest3@userscontroller.com');
         $domain = $this->getTestDomain('userscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
         $user1->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $user1);
         $user1->assignPackage($package_kolab, $user2);
         $user1->assignPackage($package_kolab, $user3);
 
         // Test unauth access
         $response = $this->delete("api/v4/users/{$user2->id}");
         $response->assertStatus(401);
 
         // Test access to other user/account
         $response = $this->actingAs($john)->delete("api/v4/users/{$user2->id}");
         $response->assertStatus(403);
         $response = $this->actingAs($john)->delete("api/v4/users/{$user1->id}");
         $response->assertStatus(403);
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Access denied", $json['message']);
         $this->assertCount(2, $json);
 
         // Test that non-controller cannot remove himself
         $response = $this->actingAs($user3)->delete("api/v4/users/{$user3->id}");
         $response->assertStatus(403);
 
         // Test removing a non-controller user
         $response = $this->actingAs($user1)->delete("api/v4/users/{$user3->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals('success', $json['status']);
         $this->assertEquals('User deleted successfully.', $json['message']);
 
         // Test removing self (an account with users)
         $response = $this->actingAs($user1)->delete("api/v4/users/{$user1->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals('success', $json['status']);
         $this->assertEquals('User deleted successfully.', $json['message']);
     }
 
     /**
      * Test user deleting (DELETE /api/v4/users/<id>)
      */
     public function testDestroyByController(): void
     {
         // Create an account with additional controller - $user2
         $package_kolab = \App\Package::where('title', 'kolab')->first();
         $package_domain = \App\Package::where('title', 'domain-hosting')->first();
         $user1 = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $user2 = $this->getTestUser('UsersControllerTest2@userscontroller.com');
         $user3 = $this->getTestUser('UsersControllerTest3@userscontroller.com');
         $domain = $this->getTestDomain('userscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
         $user1->assignPackage($package_kolab);
         $domain->assignPackage($package_domain, $user1);
         $user1->assignPackage($package_kolab, $user2);
         $user1->assignPackage($package_kolab, $user3);
         $user1->wallets()->first()->addController($user2);
 
         // TODO/FIXME:
         //   For now controller can delete himself, as well as
         //   the whole account he has control to, including the owner
         //   Probably he should not be able to do none of those
         //   However, this is not 0-regression scenario as we
         //   do not fully support additional controllers.
 
         //$response = $this->actingAs($user2)->delete("api/v4/users/{$user2->id}");
         //$response->assertStatus(403);
 
         $response = $this->actingAs($user2)->delete("api/v4/users/{$user3->id}");
         $response->assertStatus(200);
 
         $response = $this->actingAs($user2)->delete("api/v4/users/{$user1->id}");
         $response->assertStatus(200);
 
         // Note: More detailed assertions in testDestroy() above
 
         $this->assertTrue($user1->fresh()->trashed());
         $this->assertTrue($user2->fresh()->trashed());
         $this->assertTrue($user3->fresh()->trashed());
     }
 
     /**
      * Test user listing (GET /api/v4/users)
      */
     public function testIndex(): void
     {
         // Test unauth access
         $response = $this->get("api/v4/users");
         $response->assertStatus(401);
 
         $jack = $this->getTestUser('jack@kolab.org');
         $joe = $this->getTestUser('joe@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         $response = $this->actingAs($jack)->get("/api/v4/users");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(0, $json['count']);
         $this->assertCount(0, $json['list']);
 
         $response = $this->actingAs($john)->get("/api/v4/users");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(4, $json['count']);
         $this->assertCount(4, $json['list']);
         $this->assertSame($jack->email, $json['list'][0]['email']);
         $this->assertSame($joe->email, $json['list'][1]['email']);
         $this->assertSame($john->email, $json['list'][2]['email']);
         $this->assertSame($ned->email, $json['list'][3]['email']);
         // Values below are tested by Unit tests
         $this->assertArrayHasKey('isDeleted', $json['list'][0]);
         $this->assertArrayHasKey('isDegraded', $json['list'][0]);
         $this->assertArrayHasKey('isAccountDegraded', $json['list'][0]);
         $this->assertArrayHasKey('isSuspended', $json['list'][0]);
         $this->assertArrayHasKey('isActive', $json['list'][0]);
         $this->assertArrayHasKey('isLdapReady', $json['list'][0]);
         $this->assertArrayHasKey('isImapReady', $json['list'][0]);
 
         $response = $this->actingAs($ned)->get("/api/v4/users");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(4, $json['count']);
         $this->assertCount(4, $json['list']);
         $this->assertSame($jack->email, $json['list'][0]['email']);
         $this->assertSame($joe->email, $json['list'][1]['email']);
         $this->assertSame($john->email, $json['list'][2]['email']);
         $this->assertSame($ned->email, $json['list'][3]['email']);
 
         // Search by user email
         $response = $this->actingAs($john)->get("/api/v4/users?search=jack@k");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(1, $json['count']);
         $this->assertCount(1, $json['list']);
         $this->assertSame($jack->email, $json['list'][0]['email']);
 
         // Search by alias
         $response = $this->actingAs($john)->get("/api/v4/users?search=monster");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(1, $json['count']);
         $this->assertCount(1, $json['list']);
         $this->assertSame($joe->email, $json['list'][0]['email']);
 
         // Search by name
         $response = $this->actingAs($john)->get("/api/v4/users?search=land");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(false, $json['hasMore']);
         $this->assertSame(1, $json['count']);
         $this->assertCount(1, $json['list']);
         $this->assertSame($ned->email, $json['list'][0]['email']);
 
         // TODO: Test paging
     }
 
     /**
      * Test fetching user data/profile (GET /api/v4/users/<user-id>)
      */
     public function testShow(): void
     {
         $userA = $this->getTestUser('UserEntitlement2A@UserEntitlement.com');
 
         // Test getting profile of self
         $response = $this->actingAs($userA)->get("/api/v4/users/{$userA->id}");
 
         $json = $response->json();
 
         $response->assertStatus(200);
         $this->assertEquals($userA->id, $json['id']);
         $this->assertEquals($userA->email, $json['email']);
         $this->assertTrue(is_array($json['statusInfo']));
         $this->assertTrue(is_array($json['settings']));
         $this->assertTrue(is_array($json['aliases']));
         $this->assertTrue($json['config']['greylist_enabled']);
         $this->assertSame([], $json['skus']);
         // Values below are tested by Unit tests
         $this->assertArrayHasKey('isDeleted', $json);
         $this->assertArrayHasKey('isDegraded', $json);
         $this->assertArrayHasKey('isAccountDegraded', $json);
         $this->assertArrayHasKey('isSuspended', $json);
         $this->assertArrayHasKey('isActive', $json);
         $this->assertArrayHasKey('isLdapReady', $json);
         $this->assertArrayHasKey('isImapReady', $json);
 
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         // Test unauthorized access to a profile of other user
         $response = $this->actingAs($jack)->get("/api/v4/users/{$userA->id}");
         $response->assertStatus(403);
 
         // Test authorized access to a profile of other user
         // Ned: Additional account controller
         $response = $this->actingAs($ned)->get("/api/v4/users/{$john->id}");
         $response->assertStatus(200);
         $response = $this->actingAs($ned)->get("/api/v4/users/{$jack->id}");
         $response->assertStatus(200);
 
         // John: Account owner
         $response = $this->actingAs($john)->get("/api/v4/users/{$jack->id}");
         $response->assertStatus(200);
         $response = $this->actingAs($john)->get("/api/v4/users/{$ned->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $storage_sku = Sku::withEnvTenantContext()->where('title', 'storage')->first();
         $groupware_sku = Sku::withEnvTenantContext()->where('title', 'groupware')->first();
         $mailbox_sku = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();
         $secondfactor_sku = Sku::withEnvTenantContext()->where('title', '2fa')->first();
 
         $this->assertCount(5, $json['skus']);
 
         $this->assertSame(5, $json['skus'][$storage_sku->id]['count']);
         $this->assertSame([0,0,0,0,0], $json['skus'][$storage_sku->id]['costs']);
         $this->assertSame(1, $json['skus'][$groupware_sku->id]['count']);
         $this->assertSame([490], $json['skus'][$groupware_sku->id]['costs']);
         $this->assertSame(1, $json['skus'][$mailbox_sku->id]['count']);
         $this->assertSame([500], $json['skus'][$mailbox_sku->id]['costs']);
         $this->assertSame(1, $json['skus'][$secondfactor_sku->id]['count']);
         $this->assertSame([0], $json['skus'][$secondfactor_sku->id]['costs']);
     }
 
     /**
      * Test fetching user status (GET /api/v4/users/<user-id>/status)
      * and forcing setup process update (?refresh=1)
      *
      * @group imap
      * @group dns
      */
     public function testStatus(): void
     {
         Queue::fake();
 
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
 
         // Test unauthorized access
         $response = $this->actingAs($jack)->get("/api/v4/users/{$john->id}/status");
         $response->assertStatus(403);
 
         if ($john->isImapReady()) {
             $john->status ^= User::STATUS_IMAP_READY;
             $john->save();
         }
 
         // Get user status
         $response = $this->actingAs($john)->get("/api/v4/users/{$john->id}/status");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertFalse($json['isImapReady']);
         $this->assertFalse($json['isReady']);
         $this->assertCount(7, $json['process']);
         $this->assertSame('user-imap-ready', $json['process'][2]['label']);
         $this->assertSame(false, $json['process'][2]['state']);
         $this->assertTrue(empty($json['status']));
         $this->assertTrue(empty($json['message']));
 
         // Make sure the domain is confirmed (other test might unset that status)
         $domain = $this->getTestDomain('kolab.org');
         $domain->status |= Domain::STATUS_CONFIRMED;
         $domain->save();
 
         // Now "reboot" the process and verify the user in imap synchronously
         $response = $this->actingAs($john)->get("/api/v4/users/{$john->id}/status?refresh=1");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertTrue($json['isImapReady']);
         $this->assertTrue($json['isReady']);
         $this->assertCount(7, $json['process']);
         $this->assertSame('user-imap-ready', $json['process'][2]['label']);
         $this->assertSame(true, $json['process'][2]['state']);
         $this->assertSame('success', $json['status']);
         $this->assertSame('Setup process finished successfully.', $json['message']);
 
         Queue::size(1);
 
         // Test case for when the verify job is dispatched to the worker
         $john->refresh();
         $john->status ^= User::STATUS_IMAP_READY;
         $john->save();
 
         \config(['imap.admin_password' => null]);
 
         $response = $this->actingAs($john)->get("/api/v4/users/{$john->id}/status?refresh=1");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertFalse($json['isImapReady']);
         $this->assertFalse($json['isReady']);
         $this->assertSame('success', $json['status']);
         $this->assertSame('waiting', $json['processState']);
         $this->assertSame('Setup process has been pushed. Please wait.', $json['message']);
 
         Queue::assertPushed(\App\Jobs\User\VerifyJob::class, 1);
     }
 
     /**
      * Test UsersController::statusInfo()
      */
     public function testStatusInfo(): void
     {
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $domain = $this->getTestDomain('userscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
 
         $user->created_at = Carbon::now();
         $user->status = User::STATUS_NEW;
         $user->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertFalse($result['isReady']);
         $this->assertSame([], $result['skus']);
         $this->assertCount(3, $result['process']);
         $this->assertSame('user-new', $result['process'][0]['label']);
         $this->assertSame(true, $result['process'][0]['state']);
         $this->assertSame('user-ldap-ready', $result['process'][1]['label']);
         $this->assertSame(false, $result['process'][1]['state']);
         $this->assertSame('user-imap-ready', $result['process'][2]['label']);
         $this->assertSame(false, $result['process'][2]['state']);
         $this->assertSame('running', $result['processState']);
 
         $user->created_at = Carbon::now()->subSeconds(181);
         $user->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertSame('failed', $result['processState']);
 
         $user->status |= User::STATUS_LDAP_READY | User::STATUS_IMAP_READY;
         $user->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertTrue($result['isReady']);
         $this->assertCount(3, $result['process']);
         $this->assertSame('user-new', $result['process'][0]['label']);
         $this->assertSame(true, $result['process'][0]['state']);
         $this->assertSame('user-ldap-ready', $result['process'][1]['label']);
         $this->assertSame(true, $result['process'][1]['state']);
         $this->assertSame('user-imap-ready', $result['process'][2]['label']);
         $this->assertSame(true, $result['process'][2]['state']);
         $this->assertSame('done', $result['processState']);
 
         $domain->status |= Domain::STATUS_VERIFIED;
         $domain->type = Domain::TYPE_EXTERNAL;
         $domain->save();
 
         $result = UsersController::statusInfo($user);
 
         $this->assertFalse($result['isReady']);
         $this->assertSame([], $result['skus']);
         $this->assertCount(7, $result['process']);
         $this->assertSame('user-new', $result['process'][0]['label']);
         $this->assertSame(true, $result['process'][0]['state']);
         $this->assertSame('user-ldap-ready', $result['process'][1]['label']);
         $this->assertSame(true, $result['process'][1]['state']);
         $this->assertSame('user-imap-ready', $result['process'][2]['label']);
         $this->assertSame(true, $result['process'][2]['state']);
         $this->assertSame('domain-new', $result['process'][3]['label']);
         $this->assertSame(true, $result['process'][3]['state']);
         $this->assertSame('domain-ldap-ready', $result['process'][4]['label']);
         $this->assertSame(false, $result['process'][4]['state']);
         $this->assertSame('domain-verified', $result['process'][5]['label']);
         $this->assertSame(true, $result['process'][5]['state']);
         $this->assertSame('domain-confirmed', $result['process'][6]['label']);
         $this->assertSame(false, $result['process'][6]['state']);
 
         // Test 'skus' property
         $user->assignSku(Sku::withEnvTenantContext()->where('title', 'beta')->first());
 
         $result = UsersController::statusInfo($user);
 
         $this->assertSame(['beta'], $result['skus']);
 
         $user->assignSku(Sku::withEnvTenantContext()->where('title', 'meet')->first());
 
         $result = UsersController::statusInfo($user);
 
         $this->assertSame(['beta', 'meet'], $result['skus']);
 
         $user->assignSku(Sku::withEnvTenantContext()->where('title', 'meet')->first());
 
         $result = UsersController::statusInfo($user);
 
         $this->assertSame(['beta', 'meet'], $result['skus']);
     }
 
     /**
      * Test user config update (POST /api/v4/users/<user>/config)
      */
     public function testSetConfig(): void
     {
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
 
         $john->setSetting('greylist_enabled', null);
         $john->setSetting('password_policy', null);
 
         // Test unknown user id
         $post = ['greylist_enabled' => 1];
         $response = $this->actingAs($john)->post("/api/v4/users/123/config", $post);
         $json = $response->json();
 
         $response->assertStatus(404);
 
         // Test access by user not being a wallet controller
         $post = ['greylist_enabled' => 1];
         $response = $this->actingAs($jack)->post("/api/v4/users/{$john->id}/config", $post);
         $json = $response->json();
 
         $response->assertStatus(403);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Access denied", $json['message']);
         $this->assertCount(2, $json);
 
         // Test some invalid data
-        $post = ['grey' => 1, 'password_policy' => 'min:1'];
+        $post = ['grey' => 1, 'password_policy' => 'min:1,max:255'];
         $response = $this->actingAs($john)->post("/api/v4/users/{$john->id}/config", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertCount(2, $json['errors']);
         $this->assertSame("The requested configuration parameter is not supported.", $json['errors']['grey']);
         $this->assertSame("Minimum password length cannot be less than 6.", $json['errors']['password_policy']);
 
         $this->assertNull($john->fresh()->getSetting('greylist_enabled'));
 
         // Test some valid data
         $post = ['greylist_enabled' => 1, 'password_policy' => 'min:10,max:255,upper,lower,digit,special'];
         $response = $this->actingAs($john)->post("/api/v4/users/{$john->id}/config", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(2, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame('User settings updated successfully.', $json['message']);
 
         $this->assertSame('true', $john->fresh()->getSetting('greylist_enabled'));
         $this->assertSame('min:10,max:255,upper,lower,digit,special', $john->fresh()->getSetting('password_policy'));
 
         // Test some valid data, acting as another account controller
         $ned = $this->getTestUser('ned@kolab.org');
         $post = ['greylist_enabled' => 0, 'password_policy' => 'min:10,max:255,upper,last:1'];
         $response = $this->actingAs($ned)->post("/api/v4/users/{$john->id}/config", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(2, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame('User settings updated successfully.', $json['message']);
 
         $this->assertSame('false', $john->fresh()->getSetting('greylist_enabled'));
         $this->assertSame('min:10,max:255,upper,last:1', $john->fresh()->getSetting('password_policy'));
     }
 
     /**
      * Test user creation (POST /api/v4/users)
      */
     public function testStore(): void
     {
         Queue::fake();
 
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $john->setSetting('password_policy', 'min:8,max:100,digit');
         $deleted_priv = $this->getTestUser('deleted@kolab.org');
         $deleted_priv->delete();
 
         // Test empty request
         $response = $this->actingAs($john)->post("/api/v4/users", []);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("The email field is required.", $json['errors']['email']);
         $this->assertSame("The password field is required.", $json['errors']['password'][0]);
         $this->assertCount(2, $json);
 
         // Test access by user not being a wallet controller
         $post = ['first_name' => 'Test'];
         $response = $this->actingAs($jack)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(403);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Access denied", $json['message']);
         $this->assertCount(2, $json);
 
         // Test some invalid data
         $post = ['password' => '12345678', 'email' => 'invalid'];
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertSame('The password confirmation does not match.', $json['errors']['password'][0]);
         $this->assertSame('The specified email is invalid.', $json['errors']['email']);
 
         // Test existing user email
         $post = [
             'password' => 'simple123',
             'password_confirmation' => 'simple123',
             'first_name' => 'John2',
             'last_name' => 'Doe2',
             'email' => 'jack.daniels@kolab.org',
         ];
 
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertSame('The specified email is not available.', $json['errors']['email']);
 
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_domain = \App\Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
 
         $post = [
             'password' => 'simple123',
             'password_confirmation' => 'simple123',
             'first_name' => 'John2',
             'last_name' => 'Doe2',
             'email' => 'john2.doe2@kolab.org',
             'organization' => 'TestOrg',
             'aliases' => ['useralias1@kolab.org', 'deleted@kolab.org'],
         ];
 
         // Missing package
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Package is required.", $json['errors']['package']);
         $this->assertCount(2, $json);
 
         // Invalid package
         $post['package'] = $package_domain->id;
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Invalid package selected.", $json['errors']['package']);
         $this->assertCount(2, $json);
 
         // Test password policy checking
         $post['package'] = $package_kolab->id;
         $post['password'] = 'password';
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("The password confirmation does not match.", $json['errors']['password'][0]);
         $this->assertSame("Specified password does not comply with the policy.", $json['errors']['password'][1]);
         $this->assertCount(2, $json);
 
         // Test password confirmation
         $post['password_confirmation'] = 'password';
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Specified password does not comply with the policy.", $json['errors']['password'][0]);
         $this->assertCount(2, $json);
 
         // Test full and valid data
         $post['password'] = 'password123';
         $post['password_confirmation'] = 'password123';
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User created successfully.", $json['message']);
         $this->assertCount(2, $json);
 
         $user = User::where('email', 'john2.doe2@kolab.org')->first();
         $this->assertInstanceOf(User::class, $user);
         $this->assertSame('John2', $user->getSetting('first_name'));
         $this->assertSame('Doe2', $user->getSetting('last_name'));
         $this->assertSame('TestOrg', $user->getSetting('organization'));
         $aliases = $user->aliases()->orderBy('alias')->get();
         $this->assertCount(2, $aliases);
         $this->assertSame('deleted@kolab.org', $aliases[0]->alias);
         $this->assertSame('useralias1@kolab.org', $aliases[1]->alias);
         // Assert the new user entitlements
         $this->assertEntitlements($user, ['groupware', 'mailbox',
             'storage', 'storage', 'storage', 'storage', 'storage']);
         // Assert the wallet to which the new user should be assigned to
         $wallet = $user->wallet();
         $this->assertSame($john->wallets->first()->id, $wallet->id);
 
         // Attempt to create a user previously deleted
         $user->delete();
 
         $post['package'] = $package_kolab->id;
         $post['aliases'] = [];
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User created successfully.", $json['message']);
         $this->assertCount(2, $json);
 
         $user = User::where('email', 'john2.doe2@kolab.org')->first();
         $this->assertInstanceOf(User::class, $user);
         $this->assertSame('John2', $user->getSetting('first_name'));
         $this->assertSame('Doe2', $user->getSetting('last_name'));
         $this->assertSame('TestOrg', $user->getSetting('organization'));
         $this->assertCount(0, $user->aliases()->get());
         $this->assertEntitlements($user, ['groupware', 'mailbox',
             'storage', 'storage', 'storage', 'storage', 'storage']);
 
         // Test password reset link "mode"
         $code = new \App\VerificationCode(['mode' => 'password-reset', 'active' => false]);
         $john->verificationcodes()->save($code);
 
         $post = [
             'first_name' => 'John2',
             'last_name' => 'Doe2',
             'email' => 'deleted@kolab.org',
             'organization' => '',
             'aliases' => [],
             'passwordLinkCode' => $code->short_code . '-' . $code->code,
             'package' => $package_kolab->id,
         ];
 
         $response = $this->actingAs($john)->post("/api/v4/users", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User created successfully.", $json['message']);
         $this->assertCount(2, $json);
 
         $user = $this->getTestUser('deleted@kolab.org');
         $code->refresh();
 
         $this->assertSame($user->id, $code->user_id);
         $this->assertTrue($code->active);
         $this->assertTrue(is_string($user->password) && strlen($user->password) >= 60);
 
         // Test acting as account controller not owner, which is not yet supported
         $john->wallets->first()->addController($user);
 
         $response = $this->actingAs($user)->post("/api/v4/users", []);
         $response->assertStatus(403);
     }
 
     /**
      * Test user update (PUT /api/v4/users/<user-id>)
      */
     public function testUpdate(): void
     {
         $userA = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $userA->setSetting('password_policy', 'min:8,digit');
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $domain = $this->getTestDomain(
             'userscontroller.com',
             ['status' => Domain::STATUS_NEW, 'type' => Domain::TYPE_EXTERNAL]
         );
 
         // Test unauthorized update of other user profile
         $response = $this->actingAs($jack)->get("/api/v4/users/{$userA->id}", []);
         $response->assertStatus(403);
 
         // Test authorized update of account owner by account controller
         $response = $this->actingAs($ned)->get("/api/v4/users/{$john->id}", []);
         $response->assertStatus(200);
 
         // Test updating of self (empty request)
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", []);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User data updated successfully.", $json['message']);
         $this->assertTrue(!empty($json['statusInfo']));
         $this->assertCount(3, $json);
 
         // Test some invalid data
         $post = ['password' => '1234567', 'currency' => 'invalid'];
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertSame("The password confirmation does not match.", $json['errors']['password'][0]);
         $this->assertSame("Specified password does not comply with the policy.", $json['errors']['password'][1]);
         $this->assertSame("The currency must be 3 characters.", $json['errors']['currency'][0]);
 
         // Test full profile update including password
         $post = [
             'password' => 'simple123',
             'password_confirmation' => 'simple123',
             'first_name' => 'John2',
             'last_name' => 'Doe2',
             'organization' => 'TestOrg',
             'phone' => '+123 123 123',
             'external_email' => 'external@gmail.com',
             'billing_address' => 'billing',
             'country' => 'CH',
             'currency' => 'CHF',
             'aliases' => ['useralias1@' . \config('app.domain'), 'useralias2@' . \config('app.domain')]
         ];
 
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User data updated successfully.", $json['message']);
         $this->assertTrue(!empty($json['statusInfo']));
         $this->assertCount(3, $json);
         $this->assertTrue($userA->password != $userA->fresh()->password);
         unset($post['password'], $post['password_confirmation'], $post['aliases']);
         foreach ($post as $key => $value) {
             $this->assertSame($value, $userA->getSetting($key));
         }
         $aliases = $userA->aliases()->orderBy('alias')->get();
         $this->assertCount(2, $aliases);
         $this->assertSame('useralias1@' . \config('app.domain'), $aliases[0]->alias);
         $this->assertSame('useralias2@' . \config('app.domain'), $aliases[1]->alias);
 
         // Test unsetting values
         $post = [
             'first_name' => '',
             'last_name' => '',
             'organization' => '',
             'phone' => '',
             'external_email' => '',
             'billing_address' => '',
             'country' => '',
             'currency' => '',
             'aliases' => ['useralias2@' . \config('app.domain')]
         ];
 
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User data updated successfully.", $json['message']);
         $this->assertTrue(!empty($json['statusInfo']));
         $this->assertCount(3, $json);
         unset($post['aliases']);
         foreach ($post as $key => $value) {
             $this->assertNull($userA->getSetting($key));
         }
         $aliases = $userA->aliases()->get();
         $this->assertCount(1, $aliases);
         $this->assertSame('useralias2@' . \config('app.domain'), $aliases[0]->alias);
 
         // Test error on some invalid aliases missing password confirmation
         $post = [
             'password' => 'simple123',
             'aliases' => [
                 'useralias2@' . \config('app.domain'),
                 'useralias1@kolab.org',
                 '@kolab.org',
             ]
         ];
 
         $response = $this->actingAs($userA)->put("/api/v4/users/{$userA->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertCount(2, $json['errors']['aliases']);
         $this->assertSame("The specified domain is not available.", $json['errors']['aliases'][1]);
         $this->assertSame("The specified alias is invalid.", $json['errors']['aliases'][2]);
         $this->assertSame("The password confirmation does not match.", $json['errors']['password'][0]);
 
         // Test authorized update of other user
         $response = $this->actingAs($ned)->put("/api/v4/users/{$jack->id}", []);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertTrue(empty($json['statusInfo']));
 
         // TODO: Test error on aliases with invalid/non-existing/other-user's domain
 
         // Create entitlements and additional user for following tests
         $owner = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $user = $this->getTestUser('UsersControllerTest2@userscontroller.com');
         $package_domain = Package::withEnvTenantContext()->where('title', 'domain-hosting')->first();
         $package_kolab = Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $package_lite = Package::withEnvTenantContext()->where('title', 'lite')->first();
         $sku_mailbox = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();
         $sku_storage = Sku::withEnvTenantContext()->where('title', 'storage')->first();
         $sku_groupware = Sku::withEnvTenantContext()->where('title', 'groupware')->first();
 
         $domain = $this->getTestDomain(
             'userscontroller.com',
             [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_EXTERNAL,
             ]
         );
 
         $domain->assignPackage($package_domain, $owner);
         $owner->assignPackage($package_kolab);
         $owner->assignPackage($package_lite, $user);
 
         // Non-controller cannot update his own entitlements
         $post = ['skus' => []];
         $response = $this->actingAs($user)->put("/api/v4/users/{$user->id}", $post);
         $response->assertStatus(422);
 
         // Test updating entitlements
         $post = [
             'skus' => [
                 $sku_mailbox->id => 1,
                 $sku_storage->id => 6,
                 $sku_groupware->id => 1,
             ],
         ];
 
         $response = $this->actingAs($owner)->put("/api/v4/users/{$user->id}", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $storage_cost = $user->entitlements()
             ->where('sku_id', $sku_storage->id)
             ->orderBy('cost')
             ->pluck('cost')->all();
 
         $this->assertEntitlements(
             $user,
             ['groupware', 'mailbox', 'storage', 'storage', 'storage', 'storage', 'storage', 'storage']
         );
 
         $this->assertSame([0, 0, 0, 0, 0, 25], $storage_cost);
         $this->assertTrue(empty($json['statusInfo']));
 
         // Test password reset link "mode"
         $code = new \App\VerificationCode(['mode' => 'password-reset', 'active' => false]);
         $owner->verificationcodes()->save($code);
 
         $post = ['passwordLinkCode' => $code->short_code . '-' . $code->code];
 
         $response = $this->actingAs($owner)->put("/api/v4/users/{$user->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $code->refresh();
 
         $this->assertSame($user->id, $code->user_id);
         $this->assertTrue($code->active);
         $this->assertSame($user->password, $user->fresh()->password);
     }
 
     /**
      * Test UsersController::updateEntitlements()
      */
     public function testUpdateEntitlements(): void
     {
         $jane = $this->getTestUser('jane@kolabnow.com');
 
         $kolab = Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $storage = Sku::withEnvTenantContext()->where('title', 'storage')->first();
         $activesync = Sku::withEnvTenantContext()->where('title', 'activesync')->first();
         $groupware = Sku::withEnvTenantContext()->where('title', 'groupware')->first();
         $mailbox = Sku::withEnvTenantContext()->where('title', 'mailbox')->first();
 
         // standard package, 1 mailbox, 1 groupware, 2 storage
         $jane->assignPackage($kolab);
 
         // add 2 storage, 1 activesync
         $post = [
             'skus' => [
                 $mailbox->id => 1,
                 $groupware->id => 1,
                 $storage->id => 7,
                 $activesync->id => 1
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(200);
 
         $this->assertEntitlements(
             $jane,
             [
                 'activesync',
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
 
         // add 2 storage, remove 1 activesync
         $post = [
             'skus' => [
                 $mailbox->id => 1,
                 $groupware->id => 1,
                 $storage->id => 9,
                 $activesync->id => 0
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(200);
 
         $this->assertEntitlements(
             $jane,
             [
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
 
         // add mailbox
         $post = [
             'skus' => [
                 $mailbox->id => 2,
                 $groupware->id => 1,
                 $storage->id => 9,
                 $activesync->id => 0
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(500);
 
         $this->assertEntitlements(
             $jane,
             [
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
 
         // remove mailbox
         $post = [
             'skus' => [
                 $mailbox->id => 0,
                 $groupware->id => 1,
                 $storage->id => 9,
                 $activesync->id => 0
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(500);
 
         $this->assertEntitlements(
             $jane,
             [
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
 
         // less than free storage
         $post = [
             'skus' => [
                 $mailbox->id => 1,
                 $groupware->id => 1,
                 $storage->id => 1,
                 $activesync->id => 0
             ]
         ];
 
         $response = $this->actingAs($jane)->put("/api/v4/users/{$jane->id}", $post);
         $response->assertStatus(200);
 
         $this->assertEntitlements(
             $jane,
             [
                 'groupware',
                 'mailbox',
                 'storage',
                 'storage',
                 'storage',
                 'storage',
                 'storage'
             ]
         );
     }
 
     /**
      * Test user data response used in show and info actions
      */
     public function testUserResponse(): void
     {
         $provider = \config('services.payment_provider') ?: 'mollie';
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
         $wallet->setSettings(['mollie_id' => null, 'stripe_id' => null]);
         $result = $this->invokeMethod(new UsersController(), 'userResponse', [$user]);
 
         $this->assertEquals($user->id, $result['id']);
         $this->assertEquals($user->email, $result['email']);
         $this->assertEquals($user->status, $result['status']);
         $this->assertTrue(is_array($result['statusInfo']));
 
         $this->assertTrue(is_array($result['aliases']));
         $this->assertCount(1, $result['aliases']);
         $this->assertSame('john.doe@kolab.org', $result['aliases'][0]);
 
         $this->assertTrue(is_array($result['settings']));
         $this->assertSame('US', $result['settings']['country']);
         $this->assertSame('USD', $result['settings']['currency']);
 
         $this->assertTrue(is_array($result['accounts']));
         $this->assertTrue(is_array($result['wallets']));
         $this->assertCount(0, $result['accounts']);
         $this->assertCount(1, $result['wallets']);
         $this->assertSame($wallet->id, $result['wallet']['id']);
         $this->assertArrayNotHasKey('discount', $result['wallet']);
 
         $this->assertTrue($result['statusInfo']['enableDomains']);
         $this->assertTrue($result['statusInfo']['enableWallets']);
         $this->assertTrue($result['statusInfo']['enableUsers']);
         $this->assertTrue($result['statusInfo']['enableSettings']);
 
         // Ned is John's wallet controller
         $ned = $this->getTestUser('ned@kolab.org');
         $ned_wallet = $ned->wallets()->first();
         $result = $this->invokeMethod(new UsersController(), 'userResponse', [$ned]);
 
         $this->assertEquals($ned->id, $result['id']);
         $this->assertEquals($ned->email, $result['email']);
         $this->assertTrue(is_array($result['accounts']));
         $this->assertTrue(is_array($result['wallets']));
         $this->assertCount(1, $result['accounts']);
         $this->assertCount(1, $result['wallets']);
         $this->assertSame($wallet->id, $result['wallet']['id']);
         $this->assertSame($wallet->id, $result['accounts'][0]['id']);
         $this->assertSame($ned_wallet->id, $result['wallets'][0]['id']);
         $this->assertSame($provider, $result['wallet']['provider']);
         $this->assertSame($provider, $result['wallets'][0]['provider']);
 
         $this->assertTrue($result['statusInfo']['enableDomains']);
         $this->assertTrue($result['statusInfo']['enableWallets']);
         $this->assertTrue($result['statusInfo']['enableUsers']);
         $this->assertTrue($result['statusInfo']['enableSettings']);
 
         // Test discount in a response
         $discount = Discount::where('code', 'TEST')->first();
         $wallet->discount()->associate($discount);
         $wallet->save();
         $mod_provider = $provider == 'mollie' ? 'stripe' : 'mollie';
         $wallet->setSetting($mod_provider . '_id', 123);
         $user->refresh();
 
         $result = $this->invokeMethod(new UsersController(), 'userResponse', [$user]);
 
         $this->assertEquals($user->id, $result['id']);
         $this->assertSame($discount->id, $result['wallet']['discount_id']);
         $this->assertSame($discount->discount, $result['wallet']['discount']);
         $this->assertSame($discount->description, $result['wallet']['discount_description']);
         $this->assertSame($mod_provider, $result['wallet']['provider']);
         $this->assertSame($discount->id, $result['wallets'][0]['discount_id']);
         $this->assertSame($discount->discount, $result['wallets'][0]['discount']);
         $this->assertSame($discount->description, $result['wallets'][0]['discount_description']);
         $this->assertSame($mod_provider, $result['wallets'][0]['provider']);
 
         // Jack is not a John's wallet controller
         $jack = $this->getTestUser('jack@kolab.org');
         $result = $this->invokeMethod(new UsersController(), 'userResponse', [$jack]);
 
         $this->assertFalse($result['statusInfo']['enableDomains']);
         $this->assertFalse($result['statusInfo']['enableWallets']);
         $this->assertFalse($result['statusInfo']['enableUsers']);
         $this->assertFalse($result['statusInfo']['enableSettings']);
     }
 
     /**
      * List of email address validation cases for testValidateEmail()
      *
      * @return array Arguments for testValidateEmail()
      */
     public function dataValidateEmail(): array
     {
         $this->refreshApplication();
         $public_domains = Domain::getPublicDomains();
         $domain = reset($public_domains);
 
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
 
         return [
             // Invalid format
             ["$domain", $john, 'The specified email is invalid.'],
             [".@$domain", $john, 'The specified email is invalid.'],
             ["test123456@localhost", $john, 'The specified domain is invalid.'],
             ["test123456@unknown-domain.org", $john, 'The specified domain is invalid.'],
 
             ["$domain", $john, 'The specified email is invalid.'],
             [".@$domain", $john, 'The specified email is invalid.'],
 
             // forbidden local part on public domains
             ["admin@$domain", $john, 'The specified email is not available.'],
             ["administrator@$domain", $john, 'The specified email is not available.'],
 
             // forbidden (other user's domain)
             ["testtest@kolab.org", $user, 'The specified domain is not available.'],
 
             // existing alias of other user, to be a user email
             ["jack.daniels@kolab.org", $john, 'The specified email is not available.'],
 
             // valid (user domain)
             ["admin@kolab.org", $john, null],
 
             // valid (public domain)
             ["test.test@$domain", $john, null],
         ];
     }
 
     /**
      * User email address validation.
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      *
      * @dataProvider dataValidateEmail
      */
     public function testValidateEmail($email, $user, $expected_result): void
     {
         $result = UsersController::validateEmail($email, $user);
         $this->assertSame($expected_result, $result);
     }
 
     /**
      * User email validation - tests for $deleted argument
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      */
     public function testValidateEmailDeleted(): void
     {
         Queue::fake();
 
         $john = $this->getTestUser('john@kolab.org');
         $deleted_priv = $this->getTestUser('deleted@kolab.org');
         $deleted_priv->delete();
         $deleted_pub = $this->getTestUser('deleted@kolabnow.com');
         $deleted_pub->delete();
 
         $result = UsersController::validateEmail('deleted@kolab.org', $john, $deleted);
         $this->assertSame(null, $result);
         $this->assertSame($deleted_priv->id, $deleted->id);
 
         $result = UsersController::validateEmail('deleted@kolabnow.com', $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertSame(null, $deleted);
 
         $result = UsersController::validateEmail('jack@kolab.org', $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertSame(null, $deleted);
     }
 
     /**
      * User email validation - tests for an address being a group email address
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      */
     public function testValidateEmailGroup(): void
     {
         Queue::fake();
 
         $john = $this->getTestUser('john@kolab.org');
         $pub_group = $this->getTestGroup('group-test@kolabnow.com');
         $priv_group = $this->getTestGroup('group-test@kolab.org');
 
         // A group in a public domain, existing
         $result = UsersController::validateEmail($pub_group->email, $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertNull($deleted);
 
         $pub_group->delete();
 
         // A group in a public domain, deleted
         $result = UsersController::validateEmail($pub_group->email, $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertNull($deleted);
 
         // A group in a private domain, existing
         $result = UsersController::validateEmail($priv_group->email, $john, $deleted);
         $this->assertSame('The specified email is not available.', $result);
         $this->assertNull($deleted);
 
         $priv_group->delete();
 
         // A group in a private domain, deleted
         $result = UsersController::validateEmail($priv_group->email, $john, $deleted);
         $this->assertSame(null, $result);
         $this->assertSame($priv_group->id, $deleted->id);
     }
 
     /**
      * List of alias validation cases for testValidateAlias()
      *
      * @return array Arguments for testValidateAlias()
      */
     public function dataValidateAlias(): array
     {
         $this->refreshApplication();
         $public_domains = Domain::getPublicDomains();
         $domain = reset($public_domains);
 
         $john = $this->getTestUser('john@kolab.org');
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
 
         return [
             // Invalid format
             ["$domain", $john, 'The specified alias is invalid.'],
             [".@$domain", $john, 'The specified alias is invalid.'],
             ["test123456@localhost", $john, 'The specified domain is invalid.'],
             ["test123456@unknown-domain.org", $john, 'The specified domain is invalid.'],
 
             ["$domain", $john, 'The specified alias is invalid.'],
             [".@$domain", $john, 'The specified alias is invalid.'],
 
             // forbidden local part on public domains
             ["admin@$domain", $john, 'The specified alias is not available.'],
             ["administrator@$domain", $john, 'The specified alias is not available.'],
 
             // forbidden (other user's domain)
             ["testtest@kolab.org", $user, 'The specified domain is not available.'],
 
             // existing alias of other user, to be an alias, user in the same group account
             ["jack.daniels@kolab.org", $john, null],
 
             // existing user
             ["jack@kolab.org", $john, 'The specified alias is not available.'],
 
             // valid (user domain)
             ["admin@kolab.org", $john, null],
 
             // valid (public domain)
             ["test.test@$domain", $john, null],
         ];
     }
 
     /**
      * User email alias validation.
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      *
      * @dataProvider dataValidateAlias
      */
     public function testValidateAlias($alias, $user, $expected_result): void
     {
         $result = UsersController::validateAlias($alias, $user);
         $this->assertSame($expected_result, $result);
     }
 
     /**
      * User alias validation - more cases.
      *
      * Note: Technically these include unit tests, but let's keep it here for now.
      * FIXME: Shall we do a http request for each case?
      */
     public function testValidateAlias2(): void
     {
         Queue::fake();
 
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $deleted_priv = $this->getTestUser('deleted@kolab.org');
         $deleted_priv->setAliases(['deleted-alias@kolab.org']);
         $deleted_priv->delete();
         $deleted_pub = $this->getTestUser('deleted@kolabnow.com');
         $deleted_pub->setAliases(['deleted-alias@kolabnow.com']);
         $deleted_pub->delete();
         $group = $this->getTestGroup('group-test@kolabnow.com');
 
         // An alias that was a user email before is allowed, but only for custom domains
         $result = UsersController::validateAlias('deleted@kolab.org', $john);
         $this->assertSame(null, $result);
 
         $result = UsersController::validateAlias('deleted-alias@kolab.org', $john);
         $this->assertSame(null, $result);
 
         $result = UsersController::validateAlias('deleted@kolabnow.com', $john);
         $this->assertSame('The specified alias is not available.', $result);
 
         $result = UsersController::validateAlias('deleted-alias@kolabnow.com', $john);
         $this->assertSame('The specified alias is not available.', $result);
 
         // A grpoup with the same email address exists
         $result = UsersController::validateAlias($group->email, $john);
         $this->assertSame('The specified alias is not available.', $result);
     }
 }