diff --git a/src/app/Http/Controllers/API/V4/UsersController.php b/src/app/Http/Controllers/API/V4/UsersController.php
index 0ea1a612..c08c469e 100644
--- a/src/app/Http/Controllers/API/V4/UsersController.php
+++ b/src/app/Http/Controllers/API/V4/UsersController.php
@@ -1,767 +1,769 @@
 <?php
 
 namespace App\Http\Controllers\API\V4;
 
 use App\Http\Controllers\RelationController;
 use App\Domain;
 use App\License;
 use App\Plan;
 use App\Rules\Password;
 use App\Rules\UserEmailDomain;
 use App\Rules\UserEmailLocal;
 use App\Sku;
 use App\User;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Support\Str;
 
 class UsersController extends RelationController
 {
     /** @const array List of user setting keys available for modification in UI */
     public const USER_SETTINGS = [
         'billing_address',
         'country',
         'currency',
         'external_email',
         'first_name',
         'last_name',
         'organization',
         'phone',
     ];
 
     /**
      * On user create it is filled with a user or group object to force-delete
      * before the creation of a new user record is possible.
      *
      * @var \App\User|\App\Group|null
      */
     protected $deleteBeforeCreate;
 
     /** @var string Resource localization label */
     protected $label = 'user';
 
     /** @var string Resource model name */
     protected $model = User::class;
 
     /** @var array Common object properties in the API response */
     protected $objectProps = ['email'];
 
     /** @var ?\App\VerificationCode Password reset code to activate on user create/update */
     protected $passCode;
 
     /**
      * Listing of users.
      *
      * The user-entitlements billed to the current user wallet(s)
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function index()
     {
         $user = $this->guard()->user();
         $search = trim(request()->input('search'));
         $page = intval(request()->input('page')) ?: 1;
         $pageSize = 20;
         $hasMore = false;
 
         $result = $user->users();
 
         // Search by user email, alias or name
         if (strlen($search) > 0) {
             // thanks to cloning we skip some extra queries in $user->users()
             $allUsers1 = clone $result;
             $allUsers2 = clone $result;
 
             $result->whereLike('email', $search)
                 ->union(
                     $allUsers1->join('user_aliases', 'users.id', '=', 'user_aliases.user_id')
                         ->whereLike('alias', $search)
                 )
                 ->union(
                     $allUsers2->join('user_settings', 'users.id', '=', 'user_settings.user_id')
                         ->whereLike('value', $search)
                         ->whereIn('key', ['first_name', 'last_name'])
                 );
         }
 
         $result = $result->orderBy('email')
             ->limit($pageSize + 1)
             ->offset($pageSize * ($page - 1))
             ->get();
 
         if (count($result) > $pageSize) {
             $result->pop();
             $hasMore = true;
         }
 
         // Process the result
         $result = $result->map(
             function ($user) {
                 return $this->objectToClient($user);
             }
         );
 
         $result = [
             'list' => $result,
             'count' => count($result),
             'hasMore' => $hasMore,
         ];
 
         return response()->json($result);
     }
 
     /**
      * Get a license information.
      *
      * @param string $id   The account to get licenses for
      * @param string $type License type
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function licenses(string $id, string $type)
     {
         $user = User::find($id);
 
         if (!$this->checkTenant($user)) {
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canRead($user)) {
             return $this->errorResponse(403);
         }
 
         $licenses = $user->licenses()->where('type', $type)->orderBy('created_at')->get();
 
         // No licenses for the user, take one if available
         if (!count($licenses)) {
             DB::beginTransaction();
 
             $license = License::withObjectTenantContext($user)
                 ->where('type', $type)
                 ->whereNull('user_id')
                 ->limit(1)
                 ->lockForUpdate()
                 ->first();
 
             if ($license) {
                 $license->user_id = $user->id;
                 $license->save();
 
                 $licenses = \collect([$license]);
             }
 
             DB::commit();
         }
 
         // Slim down the result set
         $licenses = $licenses->map(function ($license) {
                 return [
                     'key' => $license->key,
                     'type' => $license->type,
                 ];
         });
 
         return response()->json([
             'list' => $licenses,
             'count' => count($licenses),
             'hasMore' => false, // TODO
         ]);
     }
 
     /**
      * Display information on the user account specified by $id.
      *
      * @param string $id The account to show information for.
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function show($id)
     {
         $user = User::find($id);
 
         if (!$this->checkTenant($user)) {
+            \Log::info("Tenant mismatch");
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canRead($user)) {
             return $this->errorResponse(403);
         }
 
         $response = $this->userResponse($user);
 
         $response['skus'] = \App\Entitlement::objectEntitlementsSummary($user);
         $response['config'] = $user->getConfig();
         $response['aliases'] = $user->aliases()->pluck('alias')->all();
 
         $code = $user->verificationcodes()->where('active', true)
             ->where('expires_at', '>', \Carbon\Carbon::now())
             ->first();
 
         if ($code) {
             $response['passwordLinkCode'] = $code->short_code . '-' . $code->code;
         }
 
         return response()->json($response);
     }
 
     /**
      * User status (extended) information
      *
      * @param \App\User $user User object
      *
      * @return array Status information
      */
     public static function statusInfo($user): array
     {
         $process = self::processStateInfo(
             $user,
             [
                 'user-new' => true,
                 'user-ldap-ready' => $user->isLdapReady(),
                 'user-imap-ready' => $user->isImapReady(),
             ]
         );
 
         $wallet = $user->wallet();
         $isController = $wallet->isController($user);
         $isDegraded = $user->isDegraded();
 
         $plan = $isController ? $wallet->plan() : null;
 
         $allSkus = Sku::withObjectTenantContext($user)->pluck('title')->all();
 
         // Get user's entitlements titles
         $skus = $user->entitlements()->distinct()
             ->join('skus', 'skus.id', '=', 'entitlements.sku_id')
             ->pluck('title')
             ->sort()
             ->values()
             ->all();
 
         $hasBeta = in_array('beta', $skus) || !in_array('beta', $allSkus);
         $hasMeet = !$isDegraded && \config('app.with_meet') && in_array('room', $allSkus);
         $hasCustomDomain = $wallet->entitlements()->where('entitleable_type', Domain::class)->count() > 0
             // Enable all features if there are no skus for domain-hosting
             || !in_array('domain-hosting', $allSkus);
 
         $result = [
             'skus' => $skus,
             'enableBeta' => $hasBeta,
             // TODO: This will change when we enable all users to create domains
             'enableDomains' => $isController && $hasCustomDomain,
             'enableDistlists' => $isController && $hasCustomDomain && \config('app.with_distlists'),
             'enableFiles' => !$isDegraded && $hasBeta && \config('app.with_files'),
             'enableFolders' => $isController && $hasCustomDomain && \config('app.with_shared_folders'),
             'enableResources' => $isController && $hasCustomDomain && $hasBeta && \config('app.with_resources'),
             'enableRooms' => $hasMeet,
             'enableSettings' => $isController,
             'enableSubscriptions' => $isController && \config('app.with_subscriptions'),
             'enableUsers' => $isController,
             'enableWallets' => $isController && \config('app.with_wallet'),
             'enableWalletMandates' => $isController,
             'enableWalletPayments' => $isController && (!$plan || $plan->mode != Plan::MODE_MANDATE),
             'enableCompanionapps' => $hasBeta && \config('app.with_companion_app'),
         ];
 
         return array_merge($process, $result);
     }
 
     /**
      * Create a new user record.
      *
      * @param \Illuminate\Http\Request $request The API request.
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function store(Request $request)
     {
         $current_user = $this->guard()->user();
         $owner = $current_user->walletOwner();
 
         if ($owner->id != $current_user->id) {
             return $this->errorResponse(403);
         }
 
         $this->deleteBeforeCreate = null;
 
         if ($error_response = $this->validateUserRequest($request, null, $settings)) {
             return $error_response;
         }
 
         if (
             empty($request->package)
             || !($package = \App\Package::withObjectTenantContext($owner)->find($request->package))
         ) {
             $errors = ['package' => self::trans('validation.packagerequired')];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         if ($package->isDomain()) {
             $errors = ['package' => self::trans('validation.packageinvalid')];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         DB::beginTransaction();
 
         // @phpstan-ignore-next-line
         if ($this->deleteBeforeCreate) {
             $this->deleteBeforeCreate->forceDelete();
         }
 
         // Create user record
         $user = User::create([
                 'email' => $request->email,
                 'password' => $request->password,
                 'status' => $owner->isRestricted() ? User::STATUS_RESTRICTED : 0,
         ]);
 
         $this->activatePassCode($user);
 
         $owner->assignPackage($package, $user);
 
         if (!empty($settings)) {
             $user->setSettings($settings);
         }
 
         if (!empty($request->aliases)) {
             $user->setAliases($request->aliases);
         }
 
         DB::commit();
 
         return response()->json([
                 'status' => 'success',
                 'message' => self::trans('app.user-create-success'),
         ]);
     }
 
     /**
      * Update user data.
      *
      * @param \Illuminate\Http\Request $request The API request.
      * @param string                   $id      User identifier
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function update(Request $request, $id)
     {
         $user = User::find($id);
 
         if (!$this->checkTenant($user)) {
+            \Log::info("Tenant mismatch");
             return $this->errorResponse(404);
         }
 
         $current_user = $this->guard()->user();
         $requires_controller = $request->skus !== null || $request->aliases !== null;
         $can_update = $requires_controller ? $current_user->canDelete($user) : $current_user->canUpdate($user);
 
         // Only wallet controller can set subscriptions and aliases
         // TODO: Consider changes in canUpdate() or introduce isController()
         if (!$can_update) {
             return $this->errorResponse(403);
         }
 
         if ($error_response = $this->validateUserRequest($request, $user, $settings)) {
             return $error_response;
         }
 
         DB::beginTransaction();
 
         SkusController::updateEntitlements($user, $request->skus);
 
         if (!empty($settings)) {
             $user->setSettings($settings);
         }
 
         if (!empty($request->password)) {
             $user->password = $request->password;
             $user->save();
         }
 
         $this->activatePassCode($user);
 
         if (isset($request->aliases)) {
             $user->setAliases($request->aliases);
         }
 
         DB::commit();
 
         $response = [
             'status' => 'success',
             'message' => self::trans('app.user-update-success'),
         ];
 
         // For self-update refresh the statusInfo in the UI
         if ($user->id == $current_user->id) {
             $response['statusInfo'] = self::statusInfo($user);
         }
 
         return response()->json($response);
     }
 
     /**
      * Create a response data array for specified user.
      *
      * @param \App\User $user User object
      *
      * @return array Response data
      */
     public static function userResponse(User $user): array
     {
         $response = array_merge($user->toArray(), self::objectState($user));
 
         $wallet = $user->wallet();
 
         // IsLocked flag to lock the user to the Wallet page only
         $response['isLocked'] = (!$user->isActive() && ($plan = $wallet->plan()) && $plan->mode == Plan::MODE_MANDATE);
 
         // Settings
         $response['settings'] = [];
         foreach ($user->settings()->whereIn('key', self::USER_SETTINGS)->get() as $item) {
             $response['settings'][$item->key] = $item->value;
         }
 
         // Status info
         $response['statusInfo'] = self::statusInfo($user);
 
         // Add more info to the wallet object output
         $map_func = function ($wallet) use ($user) {
             $result = $wallet->toArray();
 
             if ($wallet->discount) {
                 $result['discount'] = $wallet->discount->discount;
                 $result['discount_description'] = $wallet->discount->description;
             }
 
             if ($wallet->user_id != $user->id) {
                 $result['user_email'] = $wallet->owner->email;
             }
 
             $provider = \App\Providers\PaymentProvider::factory($wallet);
             $result['provider'] = $provider->name();
 
             return $result;
         };
 
         // Information about wallets and accounts for access checks
         $response['wallets'] = $user->wallets->map($map_func)->toArray();
         $response['accounts'] = $user->accounts->map($map_func)->toArray();
         $response['wallet'] = $map_func($wallet);
 
         return $response;
     }
 
     /**
      * Prepare user statuses for the UI
      *
      * @param \App\User $user User object
      *
      * @return array Statuses array
      */
     protected static function objectState($user): array
     {
         $state = parent::objectState($user);
 
         $state['isAccountDegraded'] = $user->isDegraded(true);
 
         return $state;
     }
 
     /**
      * Validate user input
      *
      * @param \Illuminate\Http\Request $request  The API request.
      * @param \App\User|null           $user     User identifier
      * @param array                    $settings User settings (from the request)
      *
      * @return \Illuminate\Http\JsonResponse|null The error response on error
      */
     protected function validateUserRequest(Request $request, $user, &$settings = [])
     {
         $rules = [
             'external_email' => 'nullable|email',
             'phone' => 'string|nullable|max:64|regex:/^[0-9+() -]+$/',
             'first_name' => 'string|nullable|max:128',
             'last_name' => 'string|nullable|max:128',
             'organization' => 'string|nullable|max:512',
             'billing_address' => 'string|nullable|max:1024',
             'country' => 'string|nullable|alpha|size:2',
             'currency' => 'string|nullable|alpha|size:3',
             'aliases' => 'array|nullable',
         ];
 
         $controller = ($user ?: $this->guard()->user())->walletOwner();
 
         // Handle generated password reset code
         if ($code = $request->input('passwordLinkCode')) {
             // Accept <short-code>-<code> input
             if (strpos($code, '-')) {
                 $code = explode('-', $code)[1];
             }
 
             $this->passCode = $this->guard()->user()->verificationcodes()
                 ->where('code', $code)->where('active', false)->first();
 
             // Generate a password for a new user with password reset link
             // FIXME: Should/can we have a user with no password set?
             if ($this->passCode && empty($user)) {
                 $request->password = $request->password_confirmation = Str::random(16);
                 $ignorePassword = true;
             }
         }
 
         if (empty($user) || !empty($request->password) || !empty($request->password_confirmation)) {
             if (empty($ignorePassword)) {
                 $rules['password'] = ['required', 'confirmed', new Password($controller)];
             }
         }
 
         $errors = [];
 
         // Validate input
         $v = Validator::make($request->all(), $rules);
 
         if ($v->fails()) {
             $errors = $v->errors()->toArray();
         }
 
         // For new user validate email address
         if (empty($user)) {
             $email = $request->email;
 
             if (empty($email)) {
                 $errors['email'] = self::trans('validation.required', ['attribute' => 'email']);
             } elseif ($error = self::validateEmail($email, $controller, $this->deleteBeforeCreate)) {
                 $errors['email'] = $error;
             }
         }
 
         // Validate aliases input
         if (isset($request->aliases)) {
             $aliases = [];
             $existing_aliases = $user ? $user->aliases()->get()->pluck('alias')->toArray() : [];
 
             foreach ($request->aliases as $idx => $alias) {
                 if (is_string($alias) && !empty($alias)) {
                     // Alias cannot be the same as the email address (new user)
                     if (!empty($email) && Str::lower($alias) == Str::lower($email)) {
                         continue;
                     }
 
                     // validate new aliases
                     if (
                         !in_array($alias, $existing_aliases)
                         && ($error = self::validateAlias($alias, $controller))
                     ) {
                         if (!isset($errors['aliases'])) {
                             $errors['aliases'] = [];
                         }
                         $errors['aliases'][$idx] = $error;
                         continue;
                     }
 
                     $aliases[] = $alias;
                 }
             }
 
             $request->aliases = $aliases;
         }
 
         if (!empty($errors)) {
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         // Update user settings
         $settings = $request->only(array_keys($rules));
         unset($settings['password'], $settings['aliases'], $settings['email']);
 
         return null;
     }
 
     /**
      * Execute (synchronously) specified step in a user setup process.
      *
      * @param \App\User $user User object
      * @param string    $step Step identifier (as in self::statusInfo())
      *
      * @return bool|null True if the execution succeeded, False if not, Null when
      *                   the job has been sent to the worker (result unknown)
      */
     public static function execProcessStep(User $user, string $step): ?bool
     {
         try {
             if (strpos($step, 'domain-') === 0) {
                 return DomainsController::execProcessStep($user->domain(), $step);
             }
 
             switch ($step) {
                 case 'user-ldap-ready':
                 case 'user-imap-ready':
                     // Use worker to do the job, frontend might not have the IMAP admin credentials
                     \App\Jobs\User\CreateJob::dispatch($user->id);
                     return null;
             }
         } catch (\Exception $e) {
             \Log::error($e);
         }
 
         return false;
     }
 
     /**
      * Email address validation for use as a user mailbox (login).
      *
      * @param string                    $email   Email address
      * @param \App\User                 $user    The account owner
      * @param null|\App\User|\App\Group $deleted Filled with an instance of a deleted user or group
      *                                           with the specified email address, if exists
      *
      * @return ?string Error message on validation error
      */
     public static function validateEmail(string $email, \App\User $user, &$deleted = null): ?string
     {
         $deleted = null;
 
         if (strpos($email, '@') === false) {
             return self::trans('validation.entryinvalid', ['attribute' => 'email']);
         }
 
         list($login, $domain) = explode('@', Str::lower($email));
 
         if (strlen($login) === 0 || strlen($domain) === 0) {
             return self::trans('validation.entryinvalid', ['attribute' => 'email']);
         }
 
         // Check if domain exists
         $domain = Domain::withObjectTenantContext($user)->where('namespace', $domain)->first();
 
         if (empty($domain)) {
             return self::trans('validation.domaininvalid');
         }
 
         // Validate login part alone
         $v = Validator::make(
             ['email' => $login],
             ['email' => ['required', new UserEmailLocal(!$domain->isPublic())]]
         );
 
         if ($v->fails()) {
             return $v->errors()->toArray()['email'][0];
         }
 
         // Check if it is one of domains available to the user
         if (!$domain->isPublic() && $user->id != $domain->walletOwner()->id) {
             return self::trans('validation.entryexists', ['attribute' => 'domain']);
         }
 
         // Check if a user/group/resource/shared folder with specified address already exists
         if (
             ($existing = User::emailExists($email, true))
             || ($existing = \App\Group::emailExists($email, true))
             || ($existing = \App\Resource::emailExists($email, true))
             || ($existing = \App\SharedFolder::emailExists($email, true))
         ) {
             // If this is a deleted user/group/resource/folder in the same custom domain
             // we'll force delete it before creating the target user
             if (!$domain->isPublic() && $existing->trashed()) {
                 $deleted = $existing;
             } else {
                 return self::trans('validation.entryexists', ['attribute' => 'email']);
             }
         }
 
         // Check if an alias with specified address already exists.
         if (User::aliasExists($email) || \App\SharedFolder::aliasExists($email)) {
             return self::trans('validation.entryexists', ['attribute' => 'email']);
         }
 
         return null;
     }
 
     /**
      * Email address validation for use as an alias.
      *
      * @param string    $email Email address
      * @param \App\User $user  The account owner
      *
      * @return ?string Error message on validation error
      */
     public static function validateAlias(string $email, \App\User $user): ?string
     {
         if (strpos($email, '@') === false) {
             return self::trans('validation.entryinvalid', ['attribute' => 'alias']);
         }
 
         list($login, $domain) = explode('@', Str::lower($email));
 
         if (strlen($login) === 0 || strlen($domain) === 0) {
             return self::trans('validation.entryinvalid', ['attribute' => 'alias']);
         }
 
         // Check if domain exists
         $domain = Domain::withObjectTenantContext($user)->where('namespace', $domain)->first();
 
         if (empty($domain)) {
             return self::trans('validation.domaininvalid');
         }
 
         // Validate login part alone
         $v = Validator::make(
             ['alias' => $login],
             ['alias' => ['required', new UserEmailLocal(!$domain->isPublic())]]
         );
 
         if ($v->fails()) {
             return $v->errors()->toArray()['alias'][0];
         }
 
         // Check if it is one of domains available to the user
         if (!$domain->isPublic() && $user->id != $domain->walletOwner()->id) {
             return self::trans('validation.entryexists', ['attribute' => 'domain']);
         }
 
         // Check if a user with specified address already exists
         if ($existing_user = User::emailExists($email, true)) {
             // Allow an alias in a custom domain to an address that was a user before
             if ($domain->isPublic() || !$existing_user->trashed()) {
                 return self::trans('validation.entryexists', ['attribute' => 'alias']);
             }
         }
 
         // Check if a group/resource/shared folder with specified address already exists
         if (
             \App\Group::emailExists($email)
             || \App\Resource::emailExists($email)
             || \App\SharedFolder::emailExists($email)
         ) {
             return self::trans('validation.entryexists', ['attribute' => 'alias']);
         }
 
         // Check if an alias with specified address already exists
         if (User::aliasExists($email) || \App\SharedFolder::aliasExists($email)) {
             // Allow assigning the same alias to a user in the same group account,
             // but only for non-public domains
             if ($domain->isPublic()) {
                 return self::trans('validation.entryexists', ['attribute' => 'alias']);
             }
         }
 
         return null;
     }
 
     /**
      * Activate password reset code (if set), and assign it to a user.
      *
      * @param \App\User $user The user
      */
     protected function activatePassCode(User $user): void
     {
         // Activate the password reset code
         if ($this->passCode) {
             $this->passCode->user_id = $user->id;
             $this->passCode->active = true;
             $this->passCode->save();
         }
     }
 }
diff --git a/src/app/Http/Controllers/RelationController.php b/src/app/Http/Controllers/RelationController.php
index 8242f836..4f324111 100644
--- a/src/app/Http/Controllers/RelationController.php
+++ b/src/app/Http/Controllers/RelationController.php
@@ -1,412 +1,417 @@
 <?php
 
 namespace App\Http\Controllers;
 
 use Illuminate\Support\Str;
 
 class RelationController extends ResourceController
 {
     /** @var array Common object properties in the API response */
     protected $objectProps = [];
 
     /** @var string Resource localization label */
     protected $label = '';
 
     /** @var string Resource model name */
     protected $model = '';
 
     /** @var array Resource listing order (column names) */
     protected $order = [];
 
     /** @var array Resource relation method arguments */
     protected $relationArgs = [];
 
     /**
      * Delete a resource.
      *
      * @param string $id Resource identifier
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function destroy($id)
     {
         $resource = $this->model::find($id);
 
         if (!$this->checkTenant($resource)) {
+            \Log::info("Tenant mismatch");
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canDelete($resource)) {
             return $this->errorResponse(403);
         }
 
         $resource->delete();
 
         return response()->json([
                 'status' => 'success',
                 'message' => \trans("app.{$this->label}-delete-success"),
         ]);
     }
 
     /**
      * Listing of resources belonging to the authenticated user.
      *
      * The resource entitlements billed to the current user wallet(s)
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function index()
     {
         $user = $this->guard()->user();
 
         $method = Str::plural(\lcfirst(\class_basename($this->model)));
 
         $query = call_user_func_array([$user, $method], $this->relationArgs);
 
         if (!empty($this->order)) {
             foreach ($this->order as $col) {
                 $query->orderBy($col);
             }
         }
 
         // TODO: Search and paging
 
         $result = $query->get()
             ->map(function ($resource) {
                 return $this->objectToClient($resource);
             });
 
         $result = [
             'list' => $result,
             'count' => count($result),
             'hasMore' => false,
             'message' => \trans("app.search-foundx{$this->label}s", ['x' => count($result)]),
         ];
 
         return response()->json($result);
     }
 
     /**
      * Prepare resource statuses for the UI
      *
      * @param object $resource Resource object
      *
      * @return array Statuses array
      */
     protected static function objectState($resource): array
     {
         $state = [];
 
         $reflect = new \ReflectionClass(get_class($resource));
 
         foreach (array_keys($reflect->getConstants()) as $const) {
             if (strpos($const, 'STATUS_') === 0 && $const != 'STATUS_NEW') {
                 $method = Str::camel('is_' . strtolower(substr($const, 7)));
                 $state[$method] = $resource->{$method}();
             }
         }
 
         $with_ldap = \config('app.with_ldap');
 
         $state['isReady'] = (!isset($state['isActive']) || $state['isActive'])
             && (!isset($state['isImapReady']) || $state['isImapReady'])
             && (!$with_ldap || !isset($state['isLdapReady']) || $state['isLdapReady'])
             && (!isset($state['isVerified']) || $state['isVerified'])
             && (!isset($state['isConfirmed']) || $state['isConfirmed']);
 
         if (!$with_ldap) {
             unset($state['isLdapReady']);
         }
 
         if (empty($state['isDeleted']) && method_exists($resource, 'trashed')) {
             $state['isDeleted'] = $resource->trashed();
         }
 
         return $state;
     }
 
     /**
      * Prepare a resource object for the UI.
      *
      * @param object $object An object
      * @param bool   $full   Include all object properties
      *
      * @return array Object information
      */
     protected function objectToClient($object, bool $full = false): array
     {
         if ($full) {
             $result = $object->toArray();
 
             unset($result['tenant_id']);
         } else {
             $result = ['id' => $object->id];
 
             foreach ($this->objectProps as $prop) {
                 $result[$prop] = $object->{$prop};
             }
         }
 
         $result = array_merge($result, $this->objectState($object));
 
         return $result;
     }
 
     /**
      * Object status' process information.
      *
      * @param object $object The object to process
      * @param array  $steps  The steps definition
      *
      * @return array Process state information
      */
     protected static function processStateInfo($object, array $steps): array
     {
         $process = [];
         $withLdap = \config('app.with_ldap');
 
         // Create a process check list
         foreach ($steps as $step_name => $state) {
             // Remove LDAP related steps if the backend is disabled
             if (!$withLdap && strpos($step_name, '-ldap-')) {
                 continue;
             }
 
             $step = [
                 'label' => $step_name,
                 'title' => \trans("app.process-{$step_name}"),
             ];
 
             if (is_array($state)) {
                 $step['link'] = $state[1];
                 $state = $state[0];
             }
 
             $step['state'] = $state;
 
             $process[] = $step;
         }
 
         // Add domain specific steps
         if (method_exists($object, 'domain')) {
             $domain = $object->domain();
 
             // If that is not a public domain
             if ($domain && !$domain->isPublic()) {
                 $domain_status = API\V4\DomainsController::statusInfo($domain);
                 $process = array_merge($process, $domain_status['process']);
             }
         }
 
         $all = count($process);
         $checked = count(array_filter($process, function ($v) {
                 return $v['state'];
         }));
 
         $state = $all === $checked ? 'done' : 'running';
 
         // After 180 seconds assume the process is in failed state,
         // this should unlock the Refresh button in the UI
         if ($all !== $checked && $object->created_at->diffInSeconds(\Carbon\Carbon::now()) > 180) {
             $state = 'failed';
         }
 
         return [
             'process' => $process,
             'processState' => $state,
             'isDone' => $all === $checked,
         ];
     }
 
     /**
      * Object status' process information update.
      *
      * @param object $object The object to process
      *
      * @return array Process state information
      */
     protected function processStateUpdate($object): array
     {
         $response = $this->statusInfo($object);
 
         if (!empty(request()->input('refresh'))) {
             $updated = false;
             $async = false;
             $last_step = 'none';
 
             foreach ($response['process'] as $idx => $step) {
                 $last_step = $step['label'];
 
                 if (!$step['state']) {
                     $exec = $this->execProcessStep($object, $step['label']); // @phpstan-ignore-line
 
                     if (!$exec) {
                         if ($exec === null) {
                             $async = true;
                         }
 
                         break;
                     }
 
                     $updated = true;
                 }
             }
 
             if ($updated) {
                 $response = $this->statusInfo($object);
             }
 
             $success = $response['isDone'];
             $suffix = $success ? 'success' : 'error-' . $last_step;
 
             $response['status'] = $success ? 'success' : 'error';
             $response['message'] = \trans('app.process-' . $suffix);
 
             if ($async && !$success) {
                 $response['processState'] = 'waiting';
                 $response['status'] = 'success';
                 $response['message'] = \trans('app.process-async');
             }
         }
 
         return $response;
     }
 
     /**
      * Set the resource configuration.
      *
      * @param int $id Resource identifier
      *
      * @return \Illuminate\Http\JsonResponse|void
      */
     public function setConfig($id)
     {
         $resource = $this->model::find($id);
 
         if (!method_exists($this->model, 'setConfig')) {
+            \Log::info("Tenant mismatch");
             return $this->errorResponse(404);
         }
 
         if (!$this->checkTenant($resource)) {
             return $this->errorResponse(404);
         }
 
         // Only wallet controller can do this, therefor canDelete() not canUpdate()
         // TODO: Consider changes in canUpdate() or introduce isController()
         if (!$this->guard()->user()->canDelete($resource)) {
             return $this->errorResponse(403);
         }
 
         $errors = $resource->setConfig(request()->input());
 
         if (!empty($errors)) {
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         return response()->json([
                 'status' => 'success',
                 'message' => \trans("app.{$this->label}-setconfig-success"),
         ]);
     }
 
     /**
      * Display information of a resource specified by $id.
      *
      * @param string $id The resource to show information for.
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function show($id)
     {
         $resource = $this->model::find($id);
 
         if (!$this->checkTenant($resource)) {
+            \Log::info("Tenant mismatch");
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canRead($resource)) {
             return $this->errorResponse(403);
         }
 
         $response = $this->objectToClient($resource, true);
 
         if (!empty($statusInfo = $this->statusInfo($resource))) {
             $response['statusInfo'] = $statusInfo;
         }
 
         // Resource configuration, e.g. sender_policy, invitation_policy, acl
         if (method_exists($resource, 'getConfig')) {
             $response['config'] = $resource->getConfig();
         }
 
         if (method_exists($resource, 'aliases')) {
             $response['aliases'] = $resource->aliases()->pluck('alias')->all();
         }
 
         // Entitlements/Wallet info
         if (method_exists($resource, 'wallet')) {
             API\V4\SkusController::objectEntitlements($resource, $response);
         }
 
         return response()->json($response);
     }
 
     /**
      * Get a list of SKUs available to the resource.
      *
      * @param int $id Resource identifier
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function skus($id)
     {
         $resource = $this->model::find($id);
 
         if (!$this->checkTenant($resource)) {
+            \Log::info("Tenant mismatch");
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canRead($resource)) {
             return $this->errorResponse(403);
         }
 
         return API\V4\SkusController::objectSkus($resource);
     }
 
     /**
      * Fetch resource status (and reload setup process)
      *
      * @param int $id Resource identifier
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function status($id)
     {
         $resource = $this->model::find($id);
 
         if (!$this->checkTenant($resource)) {
+            \Log::info("Tenant mismatch");
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canRead($resource)) {
             return $this->errorResponse(403);
         }
 
         $response = $this->processStateUpdate($resource);
         $response = array_merge($response, $this->objectState($resource));
 
         return response()->json($response);
     }
 
     /**
      * Resource status (extended) information
      *
      * @param object $resource Resource object
      *
      * @return array Status information
      */
     public static function statusInfo($resource): array
     {
         return [];
     }
 }
diff --git a/src/app/Http/Controllers/ResourceController.php b/src/app/Http/Controllers/ResourceController.php
index 7b298531..494cc481 100644
--- a/src/app/Http/Controllers/ResourceController.php
+++ b/src/app/Http/Controllers/ResourceController.php
@@ -1,91 +1,98 @@
 <?php
 
 namespace App\Http\Controllers;
 
 use Illuminate\Http\Request;
 
 class ResourceController extends Controller
 {
     /**
      * Show the form for creating a new resource.
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function create()
     {
+        \Log::info("Not implemented");
         return $this->errorResponse(404);
     }
 
     /**
      * Delete a resource.
      *
      * @param string $id Resource identifier
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function destroy($id)
     {
+        \Log::info("Not implemented");
         return $this->errorResponse(404);
     }
 
     /**
      * Show the form for editing the specified resource.
      *
      * @param string $id Resource identifier
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function edit($id)
     {
+        \Log::info("Not implemented");
         return $this->errorResponse(404);
     }
 
     /**
      * Listing of resources belonging to the authenticated user.
      *
      * The resource entitlements billed to the current user wallet(s)
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function index()
     {
+        \Log::info("Not implemented");
         return $this->errorResponse(404);
     }
 
     /**
      * Display information of a resource specified by $id.
      *
      * @param string $id The resource to show information for.
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function show($id)
     {
+        \Log::info("Not implemented");
         return $this->errorResponse(404);
     }
 
     /**
      * Create a new resource.
      *
      * @param \Illuminate\Http\Request $request The API request.
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function store(Request $request)
     {
+        \Log::info("Not implemented");
         return $this->errorResponse(404);
     }
 
     /**
      * Update a resource.
      *
      * @param \Illuminate\Http\Request $request The API request.
      * @param string                   $id      Resource identifier
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function update(Request $request, $id)
     {
+        \Log::info("Not implemented");
         return $this->errorResponse(404);
     }
 }
diff --git a/src/app/Http/Middleware/AllowedHosts.php b/src/app/Http/Middleware/AllowedHosts.php
index 0029951e..b987e998 100644
--- a/src/app/Http/Middleware/AllowedHosts.php
+++ b/src/app/Http/Middleware/AllowedHosts.php
@@ -1,26 +1,27 @@
 <?php
 
 namespace App\Http\Middleware;
 
 use Closure;
 
 class AllowedHosts
 {
     /**
      * Handle an incoming request.
      *
      * @param \Illuminate\Http\Request $request
      * @param \Closure                 $next
      *
      * @return mixed
      */
     public function handle($request, Closure $next)
     {
         $allowedDomains = \config('app.services_allowed_domains');
         if (!in_array(request()->getHost(), $allowedDomains)) {
+            \Log::info("Host not allowed " . request()->getHost());
             abort(404);
         }
 
         return $next($request);
     }
 }