Bump mail container for managesieve fix

Add more changes
Trigger a re-configure
2018-05-18 18:26:19 -07:00 · 2018-05-17 20:17:24 -07:00 · 2018-05-17 20:16:51 -07:00 · 2018-05-17 19:48:57 -07:00 · 2018-05-17 10:00:00 -07:00 · 2018-05-17 10:00:00 -07:00
85 changed files with 4685 additions and 2933 deletions
@@ -1248,3 +1248,36 @@
 * Add CSP header for dashboard
 * Add support for installing private docker images

+[2.1.1]
+* Make S3 backend work reliably with slow internet connections
+* Update docker to 18.03.0-ce
+* Finalize the Email and Mailbox API
+* Move mailbox settings from users to email view
+* mail: fix issue where hosts with valid SPF for a Cloudron domain are unable to send mail to Cloudron
+* mail: fix crash when bounce emails have a null sender
+* Add CSP header for dashboard
+* Add support for installing private docker images
+
+[2.2.0]
+* Add 2FA support for the admin dashboard
+* Cleanup scope management in REST API
+* Enhance user creation API to take a password
+* Relax restriction on mailbox names now that it is decoupled from user management
+
+[2.2.1]
+* Add 2FA support for the admin dashboard
+* Add Gandi & GoDaddy DNS providers
+* Fix zone detection logic on Route53 accounts with more than 100 zones
+* Warn using when disabling email
+* Cleanup scope management in REST API
+* Enhance user creation API to take a password
+* Relax restriction on mailbox names now that it is decoupled from user management
+* Fix issue where mail container incorrectly advertised CRAM-MD5 support
+
+[2.3.0]
+* Add Name.com DNS provider
+* Fix issue where account setup page was crashing
+* Add advanced DNS configuration UI
+* Preserve addon/database configuration across app updates and restores
+* ManageSieve port now offers STARTTLS
+
@@ -17,7 +17,7 @@ exports.up = function(db, callback) {
                    } else if (mailbox.membersJson) {
                        type = 'list';
                    }
-                    db.runSql('UPDATE mailboxes SET type = ? WHERE name = ?', [ type, mailbox.name ], iteratorCallback);
+                    db.runSql('UPDATE mailboxes SET type = ? WHERE name = ? AND domain = ?', [ type, mailbox.name, mailbox.domain ], iteratorCallback);
                }, done);
            });
        },
@@ -0,0 +1,15 @@
+'use strict';
+
+exports.up = function(db, callback) {
+    db.runSql('ALTER TABLE users ADD COLUMN twoFactorAuthenticationSecret VARCHAR(128) DEFAULT "", ADD COLUMN twoFactorAuthenticationEnabled BOOLEAN DEFAULT false', function (error) {
+        if (error) console.error(error);
+        callback(error);
+    });
+};
+
+exports.down = function(db, callback) {
+    db.runSql('ALTER TABLE users DROP twoFactorAuthenticationSecret, DROP twoFactorAuthenticationEnabled', function (error) {
+        if (error) console.error(error);
+        callback(error);
+    });
+};
@@ -0,0 +1,21 @@
+'use strict';
+
+exports.up = function(db, callback) {
+    db.runSql('UPDATE clients SET scope=? WHERE id=? OR id=? OR id=?', ['*', 'cid-webadmin', 'cid-sdk', 'cid-cli'], function (error) {
+        if (error) console.error(error);
+
+        db.runSql('UPDATE tokens SET scope=? WHERE scope LIKE ?', ['*', '%*%'], function (error) { // remove the roleSdk
+            if (error) console.error(error);
+
+            db.runSql('UPDATE tokens SET expires=? WHERE clientId=?', [ 1525636734905, 'cid-webadmin' ], function (error) { // force webadmin to get a new token
+                if (error) console.error(error);
+
+                callback(error);
+            });
+        });
+    });
+};
+
+exports.down = function(db, callback) {
+    callback();
+};
@@ -21,9 +21,10 @@ CREATE TABLE IF NOT EXISTS users(
    salt VARCHAR(512) NOT NULL,
    createdAt VARCHAR(512) NOT NULL,
    modifiedAt VARCHAR(512) NOT NULL,
-    admin INTEGER NOT NULL,
-    displayName VARCHAR(512) DEFAULT '',
-    fallbackEmail VARCHAR(512) DEFAULT ""
+    displayName VARCHAR(512) DEFAULT "",
+    fallbackEmail VARCHAR(512) DEFAULT "",
+    twoFactorAuthenticationSecret VARCHAR(128) DEFAULT "",
+    twoFactorAuthenticationEnabled BOOLEAN DEFAULT false,

    PRIMARY KEY(id));

@@ -275,6 +275,11 @@
      "version": "https://registry.npmjs.org/balanced-match/-/balanced-match-0.4.2.tgz",
      "integrity": "sha1-yz8+PHMtwPAe5wtAPzAuYddwmDg="
    },
+    "base32.js": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/base32.js/-/base32.js-0.0.1.tgz",
+      "integrity": "sha1-0EVzalex9sE58MffQlGKhOkbsro="
+    },
    "base64-js": {
      "version": "1.2.3",
      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.2.3.tgz",
@@ -392,8 +397,7 @@
    },
    "builtin-modules": {
      "version": "https://registry.npmjs.org/builtin-modules/-/builtin-modules-1.1.1.tgz",
-      "integrity": "sha1-Jw8HbFpywC9bZaR9+Uxf46J4iS8=",
-      "dev": true
+      "integrity": "sha1-Jw8HbFpywC9bZaR9+Uxf46J4iS8="
    },
    "bunyan": {
      "version": "https://registry.npmjs.org/bunyan/-/bunyan-1.8.12.tgz",
@@ -431,6 +435,14 @@
        }
      }
    },
+    "can-promise": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/can-promise/-/can-promise-0.0.1.tgz",
+      "integrity": "sha512-gzVrHyyrvgt0YpDm7pn04MQt8gjh0ZAhN4ZDyCRtGl6YnuuK6b4aiUTD7G52r9l4YNmxfTtEscb92vxtAlL6XQ==",
+      "requires": {
+        "window-or-global": "1.0.1"
+      }
+    },
    "capture-stack-trace": {
      "version": "https://registry.npmjs.org/capture-stack-trace/-/capture-stack-trace-1.0.0.tgz",
      "integrity": "sha1-Sm+gc5nCa7pH8LJJa00PtAjFVQ0="
@@ -487,7 +499,6 @@
    "cliui": {
      "version": "https://registry.npmjs.org/cliui/-/cliui-3.2.0.tgz",
      "integrity": "sha1-EgYBU3qRbSmUD5NNo7SNWFo5IT0=",
-      "dev": true,
      "requires": {
        "string-width": "1.0.2",
        "strip-ansi": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-3.0.1.tgz",
@@ -498,7 +509,6 @@
          "version": "1.0.2",
          "resolved": "https://registry.npmjs.org/string-width/-/string-width-1.0.2.tgz",
          "integrity": "sha1-EYvfW4zcUaKn5w0hHgfisLmxB9M=",
-          "dev": true,
          "requires": {
            "code-point-at": "https://registry.npmjs.org/code-point-at/-/code-point-at-1.1.0.tgz",
            "is-fullwidth-code-point": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-1.0.0.tgz",
@@ -917,6 +927,11 @@
      "integrity": "sha1-qoVnpu7QPFMfyJ0/cRzQ5SWd7HU=",
      "dev": true
    },
+    "dijkstrajs": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/dijkstrajs/-/dijkstrajs-1.0.1.tgz",
+      "integrity": "sha1-082BIh4+pAdCz83lVtTpnpjdxxs="
+    },
    "dns-zonefile": {
      "version": "https://registry.npmjs.org/dns-zonefile/-/dns-zonefile-0.2.2.tgz",
      "integrity": "sha1-PqIQoYmgD3Zn93Cnl0KNjmYnJn8="
@@ -1130,7 +1145,6 @@
    "error-ex": {
      "version": "https://registry.npmjs.org/error-ex/-/error-ex-1.3.1.tgz",
      "integrity": "sha1-+FWobOYa3E6GIcPNoh56dhLDqNw=",
-      "dev": true,
      "requires": {
        "is-arrayish": "https://registry.npmjs.org/is-arrayish/-/is-arrayish-0.2.1.tgz"
      }
@@ -1751,8 +1765,7 @@
    },
    "hosted-git-info": {
      "version": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.5.0.tgz",
-      "integrity": "sha1-bWDjSzq7yDEwYsO3mO+NkBoHrzw=",
-      "dev": true
+      "integrity": "sha1-bWDjSzq7yDEwYsO3mO+NkBoHrzw="
    },
    "http-errors": {
      "version": "https://registry.npmjs.org/http-errors/-/http-errors-1.6.2.tgz",
@@ -1854,8 +1867,7 @@
    },
    "is-arrayish": {
      "version": "https://registry.npmjs.org/is-arrayish/-/is-arrayish-0.2.1.tgz",
-      "integrity": "sha1-d8mYQFJ6qOyxqLppe4BkWnqSap0=",
-      "dev": true
+      "integrity": "sha1-d8mYQFJ6qOyxqLppe4BkWnqSap0="
    },
    "is-buffer": {
      "version": "https://registry.npmjs.org/is-buffer/-/is-buffer-1.1.6.tgz",
@@ -1864,7 +1876,6 @@
    "is-builtin-module": {
      "version": "https://registry.npmjs.org/is-builtin-module/-/is-builtin-module-1.0.0.tgz",
      "integrity": "sha1-VAVy0096wxGfj3bDDLwbHgN6/74=",
-      "dev": true,
      "requires": {
        "builtin-modules": "https://registry.npmjs.org/builtin-modules/-/builtin-modules-1.1.1.tgz"
      }
@@ -2379,7 +2390,6 @@
    },
    "mock-aws-s3": {
      "version": "git+https://github.com/cloudron-io/mock-aws-s3.git#1306f1722b82897382a2339d52a94ded15003d8c",
-      "integrity": "sha1-5W5RGZIHuBv3yNtEMoJC61YzyYA=",
      "dev": true,
      "requires": {
        "fs-extra": "https://registry.npmjs.org/fs-extra/-/fs-extra-0.6.4.tgz",
@@ -2789,7 +2799,6 @@
    "normalize-package-data": {
      "version": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-2.4.0.tgz",
      "integrity": "sha1-EvlaMH1YNSB1oEkHuErIvpisAS8=",
-      "dev": true,
      "requires": {
        "hosted-git-info": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.5.0.tgz",
        "is-builtin-module": "https://registry.npmjs.org/is-builtin-module/-/is-builtin-module-1.0.0.tgz",
@@ -2980,7 +2989,6 @@
    "parse-json": {
      "version": "https://registry.npmjs.org/parse-json/-/parse-json-2.2.0.tgz",
      "integrity": "sha1-9ID0BDTvgHQfhGkJn43qGPVaTck=",
-      "dev": true,
      "requires": {
        "error-ex": "https://registry.npmjs.org/error-ex/-/error-ex-1.3.1.tgz"
      }
@@ -3111,6 +3119,11 @@
      "version": "https://registry.npmjs.org/pkginfo/-/pkginfo-0.4.1.tgz",
      "integrity": "sha1-tUGO8EOd5UJfxJlQQtztFPsqhP8="
    },
+    "pngjs": {
+      "version": "3.3.3",
+      "resolved": "https://registry.npmjs.org/pngjs/-/pngjs-3.3.3.tgz",
+      "integrity": "sha512-1n3Z4p3IOxArEs1VRXnZ/RXdfEniAUS9jb68g58FIXMNkPJeZd+Qh4Uq7/e0LVxAQGos1eIUrqrt4FpjdnEd+Q=="
+    },
    "precond": {
      "version": "https://registry.npmjs.org/precond/-/precond-0.2.3.tgz",
      "integrity": "sha1-qpWRvKokkj8eD0hJ0kD0fvwQdaw="
@@ -3198,6 +3211,96 @@
      "version": "https://registry.npmjs.org/punycode/-/punycode-1.4.1.tgz",
      "integrity": "sha1-wNWmOycYgArY4esPpSachN1BhF4="
    },
+    "qrcode": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/qrcode/-/qrcode-1.2.0.tgz",
+      "integrity": "sha512-wZK0Z0eYmOUDP2tOGzmLdeBn5Npa+4wms9GdvzH7HrywvGUq/Stz0BKUhW4DfmBf1PSrm9dNfdnVDq683Zxvag==",
+      "requires": {
+        "can-promise": "0.0.1",
+        "dijkstrajs": "1.0.1",
+        "isarray": "2.0.4",
+        "pngjs": "3.3.3",
+        "yargs": "8.0.2"
+      },
+      "dependencies": {
+        "isarray": {
+          "version": "2.0.4",
+          "resolved": "https://registry.npmjs.org/isarray/-/isarray-2.0.4.tgz",
+          "integrity": "sha512-GMxXOiUirWg1xTKRipM0Ek07rX+ubx4nNVElTJdNLYmNO/2YrDkgJGw9CljXn+r4EWiDQg/8lsRdHyg2PJuUaA=="
+        },
+        "load-json-file": {
+          "version": "2.0.0",
+          "resolved": "https://registry.npmjs.org/load-json-file/-/load-json-file-2.0.0.tgz",
+          "integrity": "sha1-eUfkIUmvgNaWy/eXvKq8/h/inKg=",
+          "requires": {
+            "graceful-fs": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.1.11.tgz",
+            "parse-json": "https://registry.npmjs.org/parse-json/-/parse-json-2.2.0.tgz",
+            "pify": "2.3.0",
+            "strip-bom": "3.0.0"
+          }
+        },
+        "path-type": {
+          "version": "2.0.0",
+          "resolved": "https://registry.npmjs.org/path-type/-/path-type-2.0.0.tgz",
+          "integrity": "sha1-8BLMuEFbcJb8LaoQVMPXI4lZTHM=",
+          "requires": {
+            "pify": "2.3.0"
+          }
+        },
+        "pify": {
+          "version": "2.3.0",
+          "resolved": "https://registry.npmjs.org/pify/-/pify-2.3.0.tgz",
+          "integrity": "sha1-7RQaasBDqEnqWISY59yosVMw6Qw="
+        },
+        "read-pkg": {
+          "version": "2.0.0",
+          "resolved": "https://registry.npmjs.org/read-pkg/-/read-pkg-2.0.0.tgz",
+          "integrity": "sha1-jvHAYjxqbbDcZxPEv6xGMysjaPg=",
+          "requires": {
+            "load-json-file": "2.0.0",
+            "normalize-package-data": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-2.4.0.tgz",
+            "path-type": "2.0.0"
+          }
+        },
+        "read-pkg-up": {
+          "version": "2.0.0",
+          "resolved": "https://registry.npmjs.org/read-pkg-up/-/read-pkg-up-2.0.0.tgz",
+          "integrity": "sha1-a3KoBImE4MQeeVEP1en6mbO1Sb4=",
+          "requires": {
+            "find-up": "2.1.0",
+            "read-pkg": "2.0.0"
+          }
+        },
+        "yargs": {
+          "version": "8.0.2",
+          "resolved": "https://registry.npmjs.org/yargs/-/yargs-8.0.2.tgz",
+          "integrity": "sha1-YpmpBVsc78lp/355wdkY3Osiw2A=",
+          "requires": {
+            "camelcase": "4.1.0",
+            "cliui": "https://registry.npmjs.org/cliui/-/cliui-3.2.0.tgz",
+            "decamelize": "https://registry.npmjs.org/decamelize/-/decamelize-1.2.0.tgz",
+            "get-caller-file": "https://registry.npmjs.org/get-caller-file/-/get-caller-file-1.0.2.tgz",
+            "os-locale": "https://registry.npmjs.org/os-locale/-/os-locale-2.1.0.tgz",
+            "read-pkg-up": "2.0.0",
+            "require-directory": "https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz",
+            "require-main-filename": "https://registry.npmjs.org/require-main-filename/-/require-main-filename-1.0.1.tgz",
+            "set-blocking": "https://registry.npmjs.org/set-blocking/-/set-blocking-2.0.0.tgz",
+            "string-width": "2.1.1",
+            "which-module": "https://registry.npmjs.org/which-module/-/which-module-2.0.0.tgz",
+            "y18n": "https://registry.npmjs.org/y18n/-/y18n-3.2.1.tgz",
+            "yargs-parser": "7.0.0"
+          }
+        },
+        "yargs-parser": {
+          "version": "7.0.0",
+          "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-7.0.0.tgz",
+          "integrity": "sha1-jQrELxbqVd69MyyvTEA4s+P139k=",
+          "requires": {
+            "camelcase": "4.1.0"
+          }
+        }
+      }
+    },
    "qs": {
      "version": "https://registry.npmjs.org/qs/-/qs-6.5.1.tgz",
      "integrity": "sha1-NJzfbu+J7EXBLX1es/wMhwNDptg="
@@ -3424,7 +3527,7 @@
    "rimraf": {
      "version": "2.6.2",
      "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-2.6.2.tgz",
-      "integrity": "sha512-lreewLK/BlghmxtfH36YYVg1i8IAce4TI7oao75I1g245+6BctqTVQiBP3YUJ9C6DQOXJmkYR9X9fCLtCOJc5w==",
+      "integrity": "sha1-LtgVDSShbqhlHm1u8PR8QVjOejY=",
      "requires": {
        "glob": "https://registry.npmjs.org/glob/-/glob-7.1.2.tgz"
      }
@@ -3658,20 +3761,25 @@
    "spdx-correct": {
      "version": "https://registry.npmjs.org/spdx-correct/-/spdx-correct-1.0.2.tgz",
      "integrity": "sha1-SzBz2TP/UfORLwOsVRlJikFQ20A=",
-      "dev": true,
      "requires": {
        "spdx-license-ids": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-1.2.2.tgz"
      }
    },
    "spdx-expression-parse": {
      "version": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-1.0.4.tgz",
-      "integrity": "sha1-m98vIOH0DtRH++JzJmGR/O1RYmw=",
-      "dev": true
+      "integrity": "sha1-m98vIOH0DtRH++JzJmGR/O1RYmw="
    },
    "spdx-license-ids": {
      "version": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-1.2.2.tgz",
-      "integrity": "sha1-yd96NCRZSt5r0RkA1ZZpbcBrrFc=",
-      "dev": true
+      "integrity": "sha1-yd96NCRZSt5r0RkA1ZZpbcBrrFc="
+    },
+    "speakeasy": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/speakeasy/-/speakeasy-2.0.0.tgz",
+      "integrity": "sha1-hckaBxsJpcuGQlkNmDVmFl9XYTo=",
+      "requires": {
+        "base32.js": "0.0.1"
+      }
    },
    "speedometer": {
      "version": "https://registry.npmjs.org/speedometer/-/speedometer-1.0.0.tgz",
@@ -3818,6 +3926,11 @@
        "ansi-regex": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-2.1.1.tgz"
      }
    },
+    "strip-bom": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/strip-bom/-/strip-bom-3.0.0.tgz",
+      "integrity": "sha1-IzTBjpx1n3vdVv3vfprj1YjmjtM="
+    },
    "strip-eof": {
      "version": "https://registry.npmjs.org/strip-eof/-/strip-eof-1.0.0.tgz",
      "integrity": "sha1-u0P/VZim6wXYm1n80SnJgzE2Br8="
@@ -4135,7 +4248,6 @@
    "validate-npm-package-license": {
      "version": "https://registry.npmjs.org/validate-npm-package-license/-/validate-npm-package-license-3.0.1.tgz",
      "integrity": "sha1-KAS6vnEq0zeUWaz74kdGqywwP7w=",
-      "dev": true,
      "requires": {
        "spdx-correct": "https://registry.npmjs.org/spdx-correct/-/spdx-correct-1.0.2.tgz",
        "spdx-expression-parse": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-1.0.4.tgz"
@@ -4216,6 +4328,11 @@
        }
      }
    },
+    "window-or-global": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/window-or-global/-/window-or-global-1.0.1.tgz",
+      "integrity": "sha1-2+RboqKRqrxW1iz2bEW3+jIpRt4="
+    },
    "window-size": {
      "version": "https://registry.npmjs.org/window-size/-/window-size-0.1.0.tgz",
      "integrity": "sha1-VDjNLqk7IC76Ohn+iIeu58lPnJ0=",
@@ -58,12 +58,14 @@
    "password-generator": "^2.2.0",
    "progress-stream": "^2.0.0",
    "proxy-middleware": "^0.15.0",
+    "qrcode": "^1.2.0",
    "recursive-readdir": "^2.2.1",
    "request": "^2.83.0",
    "s3-block-read-stream": "^0.2.0",
    "safetydance": "^0.7.1",
    "semver": "^5.5.0",
    "showdown": "^1.8.2",
+    "speakeasy": "^2.0.0",
    "split": "^1.0.0",
    "superagent": "^3.8.1",
    "supererror": "^0.7.1",
@@ -54,6 +54,12 @@ if [[ $(docker version --format {{.Client.Version}}) != "18.03.0-ce" ]]; then
        sleep 1
    done

+    # the latest docker might need newer packages
+    while ! apt update -y; do
+        echo "==> installer: Failed to update packages. Retry"
+        sleep 1
+    done
+
    while ! apt install -y /tmp/docker.deb; do
        echo "==> installer: Failed to install docker. Retry"
        sleep 1
@@ -0,0 +1,190 @@
+'use strict';
+
+exports = module.exports = {
+    SCOPE_APPS: 'apps',
+    SCOPE_CLIENTS: 'clients',
+    SCOPE_CLOUDRON: 'cloudron',
+    SCOPE_DOMAINS: 'domains',
+    SCOPE_MAIL: 'mail',
+    SCOPE_PROFILE: 'profile',
+    SCOPE_SETTINGS: 'settings',
+    SCOPE_USERS: 'users',
+    VALID_SCOPES: [ 'apps', 'clients', 'cloudron', 'domains', 'mail', 'profile', 'settings', 'users' ],
+
+    SCOPE_ANY: '*',
+
+    initialize: initialize,
+    uninitialize: uninitialize,
+
+    accessTokenAuth: accessTokenAuth,
+
+    validateScope: validateScope,
+    validateRequestedScopes: validateRequestedScopes,
+    normalizeScope: normalizeScope,
+    canonicalScope: canonicalScope
+};
+
+var assert = require('assert'),
+    BasicStrategy = require('passport-http').BasicStrategy,
+    BearerStrategy = require('passport-http-bearer').Strategy,
+    clients = require('./clients'),
+    ClientPasswordStrategy = require('passport-oauth2-client-password').Strategy,
+    ClientsError = clients.ClientsError,
+    DatabaseError = require('./databaseerror'),
+    debug = require('debug')('box:accesscontrol'),
+    LocalStrategy = require('passport-local').Strategy,
+    passport = require('passport'),
+    tokendb = require('./tokendb'),
+    users = require('./users.js'),
+    UsersError = users.UsersError,
+    _ = require('underscore');
+
+function initialize(callback) {
+    assert.strictEqual(typeof callback, 'function');
+
+    passport.serializeUser(function (user, callback) {
+        callback(null, user.id);
+    });
+
+    passport.deserializeUser(function(userId, callback) {
+        users.get(userId, function (error, result) {
+            if (error) return callback(error);
+
+            callback(null, result);
+        });
+    });
+
+    passport.use(new LocalStrategy(function (username, password, callback) {
+        if (username.indexOf('@') === -1) {
+            users.verifyWithUsername(username, password, function (error, result) {
+                if (error && error.reason === UsersError.NOT_FOUND) return callback(null, false);
+                if (error && error.reason === UsersError.WRONG_PASSWORD) return callback(null, false);
+                if (error) return callback(error);
+                if (!result) return callback(null, false);
+                callback(null, result);
+            });
+        } else {
+            users.verifyWithEmail(username, password, function (error, result) {
+                if (error && error.reason === UsersError.NOT_FOUND) return callback(null, false);
+                if (error && error.reason === UsersError.WRONG_PASSWORD) return callback(null, false);
+                if (error) return callback(error);
+                if (!result) return callback(null, false);
+                callback(null, result);
+            });
+        }
+    }));
+
+    passport.use(new BasicStrategy(function (username, password, callback) {
+        if (username.indexOf('cid-') === 0) {
+            debug('BasicStrategy: detected client id %s instead of username:password', username);
+            // username is actually client id here
+            // password is client secret
+            clients.get(username, function (error, client) {
+                if (error && error.reason === ClientsError.NOT_FOUND) return callback(null, false);
+                if (error) return callback(error);
+                if (client.clientSecret != password) return callback(null, false);
+                return callback(null, client);
+            });
+        } else {
+            users.verifyWithUsername(username, password, function (error, result) {
+                if (error && error.reason === UsersError.NOT_FOUND) return callback(null, false);
+                if (error && error.reason === UsersError.WRONG_PASSWORD) return callback(null, false);
+                if (error) return callback(error);
+                if (!result) return callback(null, false);
+                callback(null, result);
+            });
+        }
+    }));
+
+    passport.use(new ClientPasswordStrategy(function (clientId, clientSecret, callback) {
+        clients.get(clientId, function(error, client) {
+            if (error && error.reason === ClientsError.NOT_FOUND) return callback(null, false);
+            if (error) { return callback(error); }
+            if (client.clientSecret != clientSecret) { return callback(null, false); }
+            return callback(null, client);
+        });
+    }));
+
+    passport.use(new BearerStrategy(accessTokenAuth));
+
+    callback(null);
+}
+
+function uninitialize(callback) {
+    assert.strictEqual(typeof callback, 'function');
+
+    callback(null);
+}
+
+function canonicalScope(scope) {
+    return scope.replace(exports.SCOPE_ANY, exports.VALID_SCOPES.join(','));
+}
+
+function normalizeScope(allowedScope, wantedScope) {
+    assert.strictEqual(typeof allowedScope, 'string');
+    assert.strictEqual(typeof wantedScope, 'string');
+
+    const allowedScopes = allowedScope.split(',');
+    const wantedScopes = wantedScope.split(',');
+
+    if (allowedScopes.indexOf(exports.SCOPE_ANY) !== -1) return canonicalScope(wantedScope);
+    if (wantedScopes.indexOf(exports.SCOPE_ANY) !== -1) return canonicalScope(allowedScope);
+
+    return _.intersection(allowedScopes, wantedScopes).join(',');
+}
+
+function accessTokenAuth(accessToken, callback) {
+    assert.strictEqual(typeof accessToken, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    tokendb.get(accessToken, function (error, token) {
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(null, false);
+        if (error) return callback(error);
+
+        users.get(token.identifier, function (error, user) {
+            if (error && error.reason === UsersError.NOT_FOUND) return callback(null, false);
+            if (error) return callback(error);
+
+            // scopes here can define what capabilities that token carries
+            // passport put the 'info' object into req.authInfo, where we can further validate the scopes
+            var scope = normalizeScope(user.scope, token.scope);
+            var info = { scope: scope, clientId: token.clientId };
+
+            callback(null, user, info);
+        });
+    });
+}
+
+function validateScope(scope) {
+    assert.strictEqual(typeof scope, 'string');
+
+    if (scope === '') return new Error('Empty scope not allowed');
+
+    // NOTE: this function intentionally does not allow '*'. This is only allowed in the db to allow
+    // us not write a migration script every time we add a new scope
+    var allValid = scope.split(',').every(function (s) { return exports.VALID_SCOPES.indexOf(s) !== -1; });
+    if (!allValid) return new Error('Invalid scope. Available scopes are ' + exports.VALID_SCOPES.join(', '));
+
+    return null;
+}
+
+// tests if all requestedScopes are attached to the request
+function validateRequestedScopes(authInfo, requestedScopes) {
+    assert.strictEqual(typeof authInfo, 'object');
+    assert(Array.isArray(requestedScopes));
+
+    if (!authInfo || !authInfo.scope) return new Error('No scope found');
+
+    var scopes = authInfo.scope.split(',');
+
+    if (scopes.indexOf(exports.SCOPE_ANY) !== -1) return null;
+
+    for (var i = 0; i < requestedScopes.length; ++i) {
+        if (scopes.indexOf(requestedScopes[i]) === -1) {
+            debug('scope: missing scope "%s".', requestedScopes[i]);
+            return new Error('Missing required scope "' + requestedScopes[i] + '"');
+        }
+    }
+
+    return null;
+}
@@ -15,17 +15,19 @@ exports = module.exports = {
    _teardownOauth: teardownOauth
 };

-var appdb = require('./appdb.js'),
+var accesscontrol = require('./accesscontrol.js'),
+    appdb = require('./appdb.js'),
    assert = require('assert'),
    async = require('async'),
    clients = require('./clients.js'),
    config = require('./config.js'),
    ClientsError = clients.ClientsError,
+    crypto = require('crypto'),
+    DatabaseError = require('./databaseerror.js'),
    debug = require('debug')('box:addons'),
    docker = require('./docker.js'),
    dockerConnection = docker.connection,
    fs = require('fs'),
-    generatePassword = require('password-generator'),
    hat = require('hat'),
    infra = require('./infra_version.js'),
    mail = require('./mail.js'),
@@ -251,7 +253,7 @@ function setupOauth(app, options, callback) {

    var appId = app.id;
    var redirectURI = 'https://' + app.fqdn;
-    var scope = 'profile';
+    var scope = accesscontrol.SCOPE_PROFILE;

    clients.delByAppIdAndType(appId, clients.TYPE_OAUTH, function (error) { // remove existing creds
        if (error && error.reason !== ClientsError.NOT_FOUND) return callback(error);
@@ -363,23 +365,28 @@ function setupSendMail(app, options, callback) {

    debugApp(app, 'Setting up SendMail');

-    mailboxdb.getByOwnerId(app.id, function (error, results) {
-        if (error) return callback(error);
+    appdb.getAddonConfigByName(app.id, 'sendmail', 'MAIL_SMTP_PASSWORD', function (error, existingPassword) {
+        if (error && error.reason !== DatabaseError.NOT_FOUND) return callback(error);

-        var mailbox = results.filter(function (r) { return !r.aliasTarget; })[0];
-        var password = generatePassword(128, false /* memorable */, /[\w\d_]/);
+        var password = error ? hat(4 * 128) : existingPassword;

-        var env = [
-            { name: 'MAIL_SMTP_SERVER', value: 'mail' },
-            { name: 'MAIL_SMTP_PORT', value: '2525' },
-            { name: 'MAIL_SMTPS_PORT', value: '2465' },
-            { name: 'MAIL_SMTP_USERNAME', value: mailbox.name + '@' + app.domain },
-            { name: 'MAIL_SMTP_PASSWORD', value: password },
-            { name: 'MAIL_FROM', value: mailbox.name + '@' + app.domain },
-            { name: 'MAIL_DOMAIN', value: app.domain }
-        ];
-        debugApp(app, 'Setting sendmail addon config to %j', env);
-        appdb.setAddonConfig(app.id, 'sendmail', env, callback);
+        mailboxdb.getByOwnerId(app.id, function (error, results) {
+            if (error) return callback(error);
+
+            var mailbox = results.filter(function (r) { return !r.aliasTarget; })[0];
+
+            var env = [
+                { name: 'MAIL_SMTP_SERVER', value: 'mail' },
+                { name: 'MAIL_SMTP_PORT', value: '2525' },
+                { name: 'MAIL_SMTPS_PORT', value: '2465' },
+                { name: 'MAIL_SMTP_USERNAME', value: mailbox.name + '@' + app.domain },
+                { name: 'MAIL_SMTP_PASSWORD', value: password },
+                { name: 'MAIL_FROM', value: mailbox.name + '@' + app.domain },
+                { name: 'MAIL_DOMAIN', value: app.domain }
+            ];
+            debugApp(app, 'Setting sendmail addon config to %j', env);
+            appdb.setAddonConfig(app.id, 'sendmail', env, callback);
+        });
    });
 }

@@ -400,23 +407,28 @@ function setupRecvMail(app, options, callback) {

    debugApp(app, 'Setting up recvmail');

-    mailboxdb.getByOwnerId(app.id, function (error, results) {
-        if (error) return callback(error);
+    appdb.getAddonConfigByName(app.id, 'recvmail', 'MAIL_IMAP_PASSWORD', function (error, existingPassword) {
+        if (error && error.reason !== DatabaseError.NOT_FOUND) return callback(error);

-        var mailbox = results.filter(function (r) { return !r.aliasTarget; })[0];
-        var password = generatePassword(128, false /* memorable */, /[\w\d_]/);
+        var password = error ? hat(4 * 128) : existingPassword;

-        var env = [
-            { name: 'MAIL_IMAP_SERVER', value: 'mail' },
-            { name: 'MAIL_IMAP_PORT', value: '9993' },
-            { name: 'MAIL_IMAP_USERNAME', value: mailbox.name + '@' + app.domain },
-            { name: 'MAIL_IMAP_PASSWORD', value: password },
-            { name: 'MAIL_TO', value: mailbox.name + '@' + app.domain },
-            { name: 'MAIL_DOMAIN', value: app.domain }
-        ];
+        mailboxdb.getByOwnerId(app.id, function (error, results) {
+            if (error) return callback(error);

-        debugApp(app, 'Setting sendmail addon config to %j', env);
-        appdb.setAddonConfig(app.id, 'recvmail', env, callback);
+            var mailbox = results.filter(function (r) { return !r.aliasTarget; })[0];
+
+            var env = [
+                { name: 'MAIL_IMAP_SERVER', value: 'mail' },
+                { name: 'MAIL_IMAP_PORT', value: '9993' },
+                { name: 'MAIL_IMAP_USERNAME', value: mailbox.name + '@' + app.domain },
+                { name: 'MAIL_IMAP_PASSWORD', value: password },
+                { name: 'MAIL_TO', value: mailbox.name + '@' + app.domain },
+                { name: 'MAIL_DOMAIN', value: app.domain }
+            ];
+
+            debugApp(app, 'Setting sendmail addon config to %j', env);
+            appdb.setAddonConfig(app.id, 'recvmail', env, callback);
+        });
    });
 }

@@ -430,6 +442,15 @@ function teardownRecvMail(app, options, callback) {
    appdb.unsetAddonConfig(app.id, 'recvmail', callback);
 }

+function mysqlDatabaseName(appId, prefix) {
+    assert.strictEqual(typeof appId, 'string');
+
+    var md5sum = crypto.createHash('md5'); // get rid of "-"
+    md5sum.update(appId);
+    var dbname = md5sum.digest('hex').substring(0, 16);  // max length of mysql usernames is 16
+    return prefix ? `${dbname}_` : dbname;
+}
+
 function setupMySql(app, options, callback) {
    assert.strictEqual(typeof app, 'object');
    assert.strictEqual(typeof options, 'object');
@@ -437,16 +458,36 @@ function setupMySql(app, options, callback) {

    debugApp(app, 'Setting up mysql');

-    var cmd = [ '/addons/mysql/service.sh', options.multipleDatabases ? 'add-prefix' : 'add', app.id ];
+    appdb.getAddonConfigByName(app.id, 'mysql', 'MYSQL_PASSWORD', function (error, existingPassword) {
+        if (error && error.reason !== DatabaseError.NOT_FOUND) return callback(error);

-    docker.execContainer('mysql', cmd, { bufferStdout: true }, function (error, stdout) {
-        if (error) return callback(error);
+        const dbname = mysqlDatabaseName(app.id, options.multipleDatabases);
+        const password = error ? hat(4 * 48) : existingPassword; // see box#362 for password length

-        var result = stdout.toString('utf8').split('\n').slice(0, -1); // remove trailing newline
-        var env = result.map(function (r) { var idx = r.indexOf('='); return { name: r.substr(0, idx), value: r.substr(idx + 1) }; });
+        var cmd = [ '/addons/mysql/service.sh', options.multipleDatabases ? 'add-prefix' : 'add', dbname, password ];

-        debugApp(app, 'Setting mysql addon config to %j', env);
-        appdb.setAddonConfig(app.id, 'mysql', env, callback);
+        docker.execContainer('mysql', cmd, { bufferStdout: true }, function (error) {
+            if (error) return callback(error);
+
+            var env = [
+                { name: 'MYSQL_USERNAME', value: dbname },
+                { name: 'MYSQL_PASSWORD', value: password },
+                { name: 'MYSQL_HOST', value: 'mysql' },
+                { name: 'MYSQL_PORT', value: '3306' }
+            ];
+
+            if (options.multipleDatabases) {
+                env = env.concat({ name: 'MYSQL_DATABASE_PREFIX', value: dbname });
+            } else {
+                env = env.concat(
+                    { name: 'MYSQL_URL', value: `mysql://${dbname}:${password}@mysql/${dbname}` },
+                    { name: 'MYSQL_DATABASE', value: dbname }
+                );
+            }
+
+            debugApp(app, 'Setting mysql addon config to %j', env);
+            appdb.setAddonConfig(app.id, 'mysql', env, callback);
+        });
    });
 }

@@ -455,7 +496,8 @@ function teardownMySql(app, options, callback) {
    assert.strictEqual(typeof options, 'object');
    assert.strictEqual(typeof callback, 'function');

-    var cmd = [ '/addons/mysql/service.sh', options.multipleDatabases ? 'remove-prefix' : 'remove', app.id ];
+    const dbname = mysqlDatabaseName(app.id, options.multipleDatabases);
+    var cmd = [ '/addons/mysql/service.sh', options.multipleDatabases ? 'remove-prefix' : 'remove', dbname ];

    debugApp(app, 'Tearing down mysql');

@@ -478,7 +520,8 @@ function backupMySql(app, options, callback) {
    var output = fs.createWriteStream(path.join(paths.APPS_DATA_DIR, app.id, 'mysqldump'));
    output.on('error', callback);

-    var cmd = [ '/addons/mysql/service.sh', options.multipleDatabases ? 'backup-prefix' : 'backup', app.id ];
+    const dbname = mysqlDatabaseName(app.id, options.multipleDatabases);
+    var cmd = [ '/addons/mysql/service.sh', options.multipleDatabases ? 'backup-prefix' : 'backup', dbname ];

    docker.execContainer('mysql', cmd, { stdout: output }, callback);
 }
@@ -498,7 +541,8 @@ function restoreMySql(app, options, callback) {
        var input = fs.createReadStream(path.join(paths.APPS_DATA_DIR, app.id, 'mysqldump'));
        input.on('error', callback);

-        var cmd = [ '/addons/mysql/service.sh', options.multipleDatabases ? 'restore-prefix' : 'restore', app.id ];
+        const dbname = mysqlDatabaseName(app.id, options.multipleDatabases);
+        var cmd = [ '/addons/mysql/service.sh', options.multipleDatabases ? 'restore-prefix' : 'restore', dbname ];
        docker.execContainer('mysql', cmd, { stdin: input }, callback);
    });
 }
@@ -510,16 +554,29 @@ function setupPostgreSql(app, options, callback) {

    debugApp(app, 'Setting up postgresql');

-    var cmd = [ '/addons/postgresql/service.sh', 'add', app.id ];
+    appdb.getAddonConfigByName(app.id, 'postgresql', 'POSTGRESQL_PASSWORD', function (error, existingPassword) {
+        if (error && error.reason !== DatabaseError.NOT_FOUND) return callback(error);

-    docker.execContainer('postgresql', cmd, { bufferStdout: true }, function (error, stdout) {
-        if (error) return callback(error);
+        const password = error ? hat(4 * 128) : existingPassword;
+        const appId = app.id.replace(/-/g, '');

-        var result = stdout.toString('utf8').split('\n').slice(0, -1); // remove trailing newline
-        var env = result.map(function (r) { var idx = r.indexOf('='); return { name: r.substr(0, idx), value: r.substr(idx + 1) }; });
+        var cmd = [ '/addons/postgresql/service.sh', 'add', appId, password ];

-        debugApp(app, 'Setting postgresql addon config to %j', env);
-        appdb.setAddonConfig(app.id, 'postgresql', env, callback);
+        docker.execContainer('postgresql', cmd, { bufferStdout: true }, function (error) {
+            if (error) return callback(error);
+
+            var env = [
+                { name: 'POSTGRESQL_URL', value: `postgres://user${appId}:${password}@postgresql/db${appId}` },
+                { name: 'POSTGRESQL_USERNAME', value: `user${appId}` },
+                { name: 'POSTGRESQL_PASSWORD', value: password },
+                { name: 'POSTGRESQL_HOST', value: 'postgresql' },
+                { name: 'POSTGRESQL_PORT', value: '5432' },
+                { name: 'POSTGRESQL_DATABASE', value: `db${appId}` }
+            ];
+
+            debugApp(app, 'Setting postgresql addon config to %j', env);
+            appdb.setAddonConfig(app.id, 'postgresql', env, callback);
+        });
    });
 }

@@ -528,7 +585,9 @@ function teardownPostgreSql(app, options, callback) {
    assert.strictEqual(typeof options, 'object');
    assert.strictEqual(typeof callback, 'function');

-    var cmd = [ '/addons/postgresql/service.sh', 'remove', app.id ];
+    const appId = app.id.replace(/-/g, '');
+
+    var cmd = [ '/addons/postgresql/service.sh', 'remove', appId ];

    debugApp(app, 'Tearing down postgresql');

@@ -551,7 +610,8 @@ function backupPostgreSql(app, options, callback) {
    var output = fs.createWriteStream(path.join(paths.APPS_DATA_DIR, app.id, 'postgresqldump'));
    output.on('error', callback);

-    var cmd = [ '/addons/postgresql/service.sh', 'backup', app.id ];
+    const appId = app.id.replace(/-/g, '');
+    var cmd = [ '/addons/postgresql/service.sh', 'backup', appId ];

    docker.execContainer('postgresql', cmd, { stdout: output }, callback);
 }
@@ -571,7 +631,8 @@ function restorePostgreSql(app, options, callback) {
        var input = fs.createReadStream(path.join(paths.APPS_DATA_DIR, app.id, 'postgresqldump'));
        input.on('error', callback);

-        var cmd = [ '/addons/postgresql/service.sh', 'restore', app.id ];
+        const appId = app.id.replace(/-/g, '');
+        var cmd = [ '/addons/postgresql/service.sh', 'restore', appId ];

        docker.execContainer('postgresql', cmd, { stdin: input }, callback);
    });
@@ -584,16 +645,30 @@ function setupMongoDb(app, options, callback) {

    debugApp(app, 'Setting up mongodb');

-    var cmd = [ '/addons/mongodb/service.sh', 'add', app.id ];
+    appdb.getAddonConfigByName(app.id, 'mongodb', 'MONGODB_PASSWORD', function (error, existingPassword) {
+        if (error && error.reason !== DatabaseError.NOT_FOUND) return callback(error);

-    docker.execContainer('mongodb', cmd, { bufferStdout: true }, function (error, stdout) {
-        if (error) return callback(error);
+        const password = error ? hat(4 * 128) : existingPassword;

-        var result = stdout.toString('utf8').split('\n').slice(0, -1); // remove trailing newline
-        var env = result.map(function (r) { var idx = r.indexOf('='); return { name: r.substr(0, idx), value: r.substr(idx + 1) }; });
+        const dbname = app.id;

-        debugApp(app, 'Setting mongodb addon config to %j', env);
-        appdb.setAddonConfig(app.id, 'mongodb', env, callback);
+        var cmd = [ '/addons/mongodb/service.sh', 'add', dbname, password ];
+
+        docker.execContainer('mongodb', cmd, { bufferStdout: true }, function (error) {
+            if (error) return callback(error);
+
+            var env = [
+                { name: 'MONGODB_URL', value : `mongodb://${dbname}:${password}@mongodb/${dbname}` },
+                { name: 'MONGODB_USERNAME', value : dbname },
+                { name: 'MONGODB_PASSWORD', value: password },
+                { name: 'MONGODB_HOST', value : 'mongodb' },
+                { name: 'MONGODB_PORT', value : '27017' },
+                { name: 'MONGODB_DATABASE', value : dbname }
+            ];
+
+            debugApp(app, 'Setting mongodb addon config to %j', env);
+            appdb.setAddonConfig(app.id, 'mongodb', env, callback);
+        });
    });
 }

@@ -602,7 +677,8 @@ function teardownMongoDb(app, options, callback) {
    assert.strictEqual(typeof options, 'object');
    assert.strictEqual(typeof callback, 'function');

-    var cmd = [ '/addons/mongodb/service.sh', 'remove', app.id ];
+    const dbname = app.id;
+    var cmd = [ '/addons/mongodb/service.sh', 'remove', dbname ];

    debugApp(app, 'Tearing down mongodb');

@@ -625,7 +701,8 @@ function backupMongoDb(app, options, callback) {
    var output = fs.createWriteStream(path.join(paths.APPS_DATA_DIR, app.id, 'mongodbdump'));
    output.on('error', callback);

-    var cmd = [ '/addons/mongodb/service.sh', 'backup', app.id ];
+    const dbname = app.id;
+    var cmd = [ '/addons/mongodb/service.sh', 'backup', dbname ];

    docker.execContainer('mongodb', cmd, { stdout: output }, callback);
 }
@@ -645,7 +722,9 @@ function restoreMongoDb(app, options, callback) {
        var input = fs.createReadStream(path.join(paths.APPS_DATA_DIR, app.id, 'mongodbdump'));
        input.on('error', callback);

-        var cmd = [ '/addons/mongodb/service.sh', 'restore', app.id ];
+        const dbname = app.id;
+        var cmd = [ '/addons/mongodb/service.sh', 'restore', dbname ];
+
        docker.execContainer('mongodb', cmd, { stdin: input }, callback);
    });
 }
@@ -656,58 +735,63 @@ function setupRedis(app, options, callback) {
    assert.strictEqual(typeof options, 'object');
    assert.strictEqual(typeof callback, 'function');

-    var redisPassword = generatePassword(128, false /* memorable */, /[\w\d_]/); // ensure no / in password for being sed friendly (and be uri friendly)
-    var redisVarsFile = path.join(paths.ADDON_CONFIG_DIR, 'redis-' + app.id + '_vars.sh');
-    var redisDataDir = path.join(paths.APPS_DATA_DIR, app.id + '/redis');
+    appdb.getAddonConfigByName(app.id, 'redis', 'REDIS_PASSWORD', function (error, existingPassword) {
+        if (error && error.reason !== DatabaseError.NOT_FOUND) return callback(error);

-    if (!safe.fs.writeFileSync(redisVarsFile, 'REDIS_PASSWORD=' + redisPassword)) {
-        return callback(new Error('Error writing redis config'));
-    }
+        const redisPassword = error ? hat(4 * 48) : existingPassword; // see box#362 for password length

-    if (!safe.fs.mkdirSync(redisDataDir) && safe.error.code !== 'EEXIST') return callback(new Error('Error creating redis data dir:' + safe.error));
+        var redisVarsFile = path.join(paths.ADDON_CONFIG_DIR, 'redis-' + app.id + '_vars.sh');
+        var redisDataDir = path.join(paths.APPS_DATA_DIR, app.id + '/redis');

-    // Compute redis memory limit based on app's memory limit (this is arbitrary)
-    var memoryLimit = app.memoryLimit || app.manifest.memoryLimit || 0;
+        if (!safe.fs.writeFileSync(redisVarsFile, 'REDIS_PASSWORD=' + redisPassword)) {
+            return callback(new Error('Error writing redis config'));
+        }

-    if (memoryLimit === -1) { // unrestricted (debug mode)
-        memoryLimit = 0;
-    } else if (memoryLimit === 0 || memoryLimit <= (2 * 1024 * 1024 * 1024)) { // less than 2G (ram+swap)
-        memoryLimit = 150 * 1024 * 1024; // 150m
-    } else {
-        memoryLimit = 600 * 1024 * 1024; // 600m
-    }
+        if (!safe.fs.mkdirSync(redisDataDir) && safe.error.code !== 'EEXIST') return callback(new Error('Error creating redis data dir:' + safe.error));

-    const tag = infra.images.redis.tag, redisName = 'redis-' + app.id;
-    const label = app.fqdn;
-    // note that we do not add appId label because this interferes with the stop/start app logic
-    const cmd = `docker run --restart=always -d --name=${redisName} \
-                --label=location=${label} \
-                --net cloudron \
-                --net-alias ${redisName} \
-                -m ${memoryLimit/2} \
-                --memory-swap ${memoryLimit} \
-                --dns 172.18.0.1 \
-                --dns-search=. \
-                -v ${redisVarsFile}:/etc/redis/redis_vars.sh:ro \
-                -v ${redisDataDir}:/var/lib/redis:rw \
-                --read-only -v /tmp -v /run ${tag}`;
+        // Compute redis memory limit based on app's memory limit (this is arbitrary)
+        var memoryLimit = app.memoryLimit || app.manifest.memoryLimit || 0;

-    var env = [
-        { name: 'REDIS_URL', value: 'redis://redisuser:' + redisPassword + '@redis-' + app.id },
-        { name: 'REDIS_PASSWORD', value: redisPassword },
-        { name: 'REDIS_HOST', value: redisName },
-        { name: 'REDIS_PORT', value: '6379' }
-    ];
+        if (memoryLimit === -1) { // unrestricted (debug mode)
+            memoryLimit = 0;
+        } else if (memoryLimit === 0 || memoryLimit <= (2 * 1024 * 1024 * 1024)) { // less than 2G (ram+swap)
+            memoryLimit = 150 * 1024 * 1024; // 150m
+        } else {
+            memoryLimit = 600 * 1024 * 1024; // 600m
+        }

-    async.series([
-        // stop so that redis can flush itself with SIGTERM
-        shell.execSync.bind(null, 'stopRedis', `docker stop --time=10 ${redisName} 2>/dev/null || true`),
-        shell.execSync.bind(null, 'stopRedis', `docker rm --volumes ${redisName} 2>/dev/null || true`),
-        shell.execSync.bind(null, 'startRedis', cmd),
-        appdb.setAddonConfig.bind(null, app.id, 'redis', env)
-    ], function (error) {
-        if (error) debug('Error setting up redis: ', error);
-        callback(error);
+        const tag = infra.images.redis.tag, redisName = 'redis-' + app.id;
+        const label = app.fqdn;
+        // note that we do not add appId label because this interferes with the stop/start app logic
+        const cmd = `docker run --restart=always -d --name=${redisName} \
+                    --label=location=${label} \
+                    --net cloudron \
+                    --net-alias ${redisName} \
+                    -m ${memoryLimit/2} \
+                    --memory-swap ${memoryLimit} \
+                    --dns 172.18.0.1 \
+                    --dns-search=. \
+                    -v ${redisVarsFile}:/etc/redis/redis_vars.sh:ro \
+                    -v ${redisDataDir}:/var/lib/redis:rw \
+                    --read-only -v /tmp -v /run ${tag}`;
+
+        var env = [
+            { name: 'REDIS_URL', value: 'redis://redisuser:' + redisPassword + '@redis-' + app.id },
+            { name: 'REDIS_PASSWORD', value: redisPassword },
+            { name: 'REDIS_HOST', value: redisName },
+            { name: 'REDIS_PORT', value: '6379' }
+        ];
+
+        async.series([
+            // stop so that redis can flush itself with SIGTERM
+            shell.execSync.bind(null, 'stopRedis', `docker stop --time=10 ${redisName} 2>/dev/null || true`),
+            shell.execSync.bind(null, 'stopRedis', `docker rm --volumes ${redisName} 2>/dev/null || true`),
+            shell.execSync.bind(null, 'startRedis', cmd),
+            appdb.setAddonConfig.bind(null, app.id, 'redis', env)
+        ], function (error) {
+            if (error) debug('Error setting up redis: ', error);
+            callback(error);
+        });
    });
 }

@@ -4,6 +4,7 @@ exports = module.exports = {
    AppsError: AppsError,

    hasAccessTo: hasAccessTo,
+    removeInternalAppFields: removeInternalAppFields,

    get: get,
    getByIpAddress: getByIpAddress,
@@ -61,7 +62,7 @@ var addons = require('./addons.js'),
    docker = require('./docker.js'),
    domaindb = require('./domaindb.js'),
    domains = require('./domains.js'),
-    DomainError = require('./domains.js').DomainError,
+    DomainsError = require('./domains.js').DomainsError,
    eventlog = require('./eventlog.js'),
    fs = require('fs'),
    groups = require('./groups.js'),
@@ -83,7 +84,8 @@ var addons = require('./addons.js'),
    url = require('url'),
    util = require('util'),
    uuid = require('uuid'),
-    validator = require('validator');
+    validator = require('validator'),
+    _ = require('underscore');

 // http://dustinsenos.com/articles/customErrorsInNode
 // http://code.google.com/p/v8/wiki/JavaScriptStackTraceApi
@@ -322,6 +324,13 @@ function getAppConfig(app) {
    };
 }

+function removeInternalAppFields(app) {
+    return _.pick(app, 'id', 'appStoreId', 'installationState', 'installationProgress', 'runState', 'health',
+        'location', 'domain', 'fqdn',
+        'accessRestriction', 'manifest', 'portBindings', 'iconUrl', 'memoryLimit', 'xFrameOptions',
+        'sso', 'debugMode', 'robotsTxt', 'enableBackup', 'creationTime', 'updateTime');
+}
+
 function getIconUrlSync(app) {
    var iconPath = paths.APP_ICONS_DIR + '/' + app.id + '.png';
    return fs.existsSync(iconPath) ? '/api/v1/apps/' + app.id + '/icon' : null;
@@ -519,7 +528,7 @@ function install(data, auditSource, callback) {
        }

        domains.get(domain, function (error, domainObject) {
-            if (error && error.reason === DomainError.NOT_FOUND) return callback(new AppsError(AppsError.NOT_FOUND, 'No such domain'));
+            if (error && error.reason === DomainsError.NOT_FOUND) return callback(new AppsError(AppsError.NOT_FOUND, 'No such domain'));
            if (error) return callback(new AppsError(AppsError.INTERNAL_ERROR, 'Could not get domain info:' + error.message));

            var fqdn = domains.fqdn(location, domain, domainObject.provider);
@@ -534,28 +543,38 @@ function install(data, auditSource, callback) {

            debug('Will install app with id : ' + appId);

-            appstore.purchase(appId, appStoreId, function (error) {
-                if (error && error.reason === AppstoreError.NOT_FOUND) return callback(new AppsError(AppsError.NOT_FOUND));
-                if (error && error.reason === AppstoreError.BILLING_REQUIRED) return callback(new AppsError(AppsError.BILLING_REQUIRED, error.message));
-                if (error && error.reason === AppstoreError.EXTERNAL_ERROR) return callback(new AppsError(AppsError.EXTERNAL_ERROR, error.message));
+            var data = {
+                accessRestriction: accessRestriction,
+                memoryLimit: memoryLimit,
+                xFrameOptions: xFrameOptions,
+                sso: sso,
+                debugMode: debugMode,
+                mailboxName: (location ? location : manifest.title.toLowerCase().replace(/[^a-zA-Z0-9]/g, '')) + '.app',
+                restoreConfig: backupId ? { backupId: backupId, backupFormat: backupFormat } : null,
+                enableBackup: enableBackup,
+                robotsTxt: robotsTxt
+            };
+
+            appdb.add(appId, appStoreId, manifest, location, domain, portBindings, data, function (error) {
+                if (error && error.reason === DatabaseError.ALREADY_EXISTS) return callback(getDuplicateErrorDetails(location, portBindings, error));
+                if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new AppsError(AppsError.NOT_FOUND, error.message));
                if (error) return callback(new AppsError(AppsError.INTERNAL_ERROR, error));

-                var data = {
-                    accessRestriction: accessRestriction,
-                    memoryLimit: memoryLimit,
-                    xFrameOptions: xFrameOptions,
-                    sso: sso,
-                    debugMode: debugMode,
-                    mailboxName: (location ? location : manifest.title.toLowerCase().replace(/[^a-zA-Z0-9]/g, '')) + '.app',
-                    restoreConfig: backupId ? { backupId: backupId, backupFormat: backupFormat } : null,
-                    enableBackup: enableBackup,
-                    robotsTxt: robotsTxt
-                };
+                appstore.purchase(appId, appStoreId, function (appstoreError) {
+                    // if purchase failed, rollback the appdb record
+                    if (appstoreError) {
+                        appdb.del(appId, function (error) {
+                            if (error) console.error('Failed to rollback app installation.', error);

-                appdb.add(appId, appStoreId, manifest, location, domain, portBindings, data, function (error) {
-                    if (error && error.reason === DatabaseError.ALREADY_EXISTS) return callback(getDuplicateErrorDetails(location, portBindings, error));
-                    if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new AppsError(AppsError.NOT_FOUND, error.message));
-                    if (error) return callback(new AppsError(AppsError.INTERNAL_ERROR, error));
+                            if (appstoreError.reason === AppstoreError.NOT_FOUND) return callback(new AppsError(AppsError.NOT_FOUND, appstoreError.message));
+                            if (appstoreError && appstoreError.reason === AppstoreError.BILLING_REQUIRED) return callback(new AppsError(AppsError.BILLING_REQUIRED, appstoreError.message));
+                            if (appstoreError && appstoreError.reason === AppstoreError.EXTERNAL_ERROR) return callback(new AppsError(AppsError.EXTERNAL_ERROR, appstoreError.message));
+
+                            callback(new AppsError(AppsError.INTERNAL_ERROR, appstoreError));
+                        });
+
+                        return;
+                    }

                    // save cert to boxdata/certs
                    if (cert && key) {
@@ -634,7 +653,7 @@ function configure(appId, data, auditSource, callback) {
        }

        domains.get(domain, function (error, domainObject) {
-            if (error && error.reason === DomainError.NOT_FOUND) return callback(new AppsError(AppsError.NOT_FOUND, 'No such domain'));
+            if (error && error.reason === DomainsError.NOT_FOUND) return callback(new AppsError(AppsError.NOT_FOUND, 'No such domain'));
            if (error) return callback(new AppsError(AppsError.INTERNAL_ERROR, 'Could not get domain info:' + error.message));

            var fqdn = domains.fqdn(location, domain, domainObject.provider);
@@ -892,7 +911,7 @@ function clone(appId, data, auditSource, callback) {
            if (error) return callback(error);

            domains.get(domain, function (error, domainObject) {
-                if (error && error.reason === DomainError.NOT_FOUND) return callback(new AppsError(AppsError.EXTERNAL_ERROR, 'No such domain'));
+                if (error && error.reason === DomainsError.NOT_FOUND) return callback(new AppsError(AppsError.EXTERNAL_ERROR, 'No such domain'));
                if (error) return callback(new AppsError(AppsError.INTERNAL_ERROR, 'Could not get domain info:' + error.message));

                error = validateHostname(location, domain, domains.fqdn(location, domain, domainObject.provider));
@@ -900,27 +919,37 @@ function clone(appId, data, auditSource, callback) {

                var newAppId = uuid.v4(), manifest = backupInfo.manifest;

-                appstore.purchase(newAppId, app.appStoreId, function (error) {
-                    if (error && error.reason === AppstoreError.NOT_FOUND) return callback(new AppsError(AppsError.NOT_FOUND, error.message));
-                    if (error && error.reason === AppstoreError.BILLING_REQUIRED) return callback(new AppsError(AppsError.BILLING_REQUIRED, error.message));
-                    if (error && error.reason === AppstoreError.EXTERNAL_ERROR) return callback(new AppsError(AppsError.EXTERNAL_ERROR, error.message));
+                var data = {
+                    installationState: appdb.ISTATE_PENDING_CLONE,
+                    memoryLimit: app.memoryLimit,
+                    accessRestriction: app.accessRestriction,
+                    xFrameOptions: app.xFrameOptions,
+                    restoreConfig: { backupId: backupId, backupFormat: backupInfo.format },
+                    sso: !!app.sso,
+                    mailboxName: (location ? location : manifest.title.toLowerCase().replace(/[^a-zA-Z0-9]/g, '')) + '.app',
+                    enableBackup: app.enableBackup,
+                    robotsTxt: app.robotsTxt
+                };
+
+                appdb.add(newAppId, app.appStoreId, manifest, location, domain, portBindings, data, function (error) {
+                    if (error && error.reason === DatabaseError.ALREADY_EXISTS) return callback(getDuplicateErrorDetails(location, portBindings, error));
                    if (error) return callback(new AppsError(AppsError.INTERNAL_ERROR, error));

-                    var data = {
-                        installationState: appdb.ISTATE_PENDING_CLONE,
-                        memoryLimit: app.memoryLimit,
-                        accessRestriction: app.accessRestriction,
-                        xFrameOptions: app.xFrameOptions,
-                        restoreConfig: { backupId: backupId, backupFormat: backupInfo.format },
-                        sso: !!app.sso,
-                        mailboxName: (location ? location : manifest.title.toLowerCase().replace(/[^a-zA-Z0-9]/g, '')) + '.app',
-                        enableBackup: app.enableBackup,
-                        robotsTxt: app.robotsTxt
-                    };
+                    appstore.purchase(newAppId, app.appStoreId, function (appstoreError) {
+                        // if purchase failed, rollback the appdb record
+                        if (appstoreError) {
+                            appdb.del(newAppId, function (error) {
+                                if (error) console.error('Failed to rollback app installation.', error);

-                    appdb.add(newAppId, app.appStoreId, manifest, location, domain, portBindings, data, function (error) {
-                        if (error && error.reason === DatabaseError.ALREADY_EXISTS) return callback(getDuplicateErrorDetails(location, portBindings, error));
-                        if (error) return callback(new AppsError(AppsError.INTERNAL_ERROR, error));
+                                if (appstoreError.reason === AppstoreError.NOT_FOUND) return callback(new AppsError(AppsError.NOT_FOUND, appstoreError.message));
+                                if (appstoreError && appstoreError.reason === AppstoreError.BILLING_REQUIRED) return callback(new AppsError(AppsError.BILLING_REQUIRED, appstoreError.message));
+                                if (appstoreError && appstoreError.reason === AppstoreError.EXTERNAL_ERROR) return callback(new AppsError(AppsError.EXTERNAL_ERROR, appstoreError.message));
+
+                                callback(new AppsError(AppsError.INTERNAL_ERROR, appstoreError));
+                            });
+
+                            return;
+                        }

                        taskmanager.restartAppTask(newAppId);

@@ -37,7 +37,7 @@ var addons = require('./addons.js'),
    debug = require('debug')('box:apptask'),
    docker = require('./docker.js'),
    domains = require('./domains.js'),
-    DomainError = domains.DomainError,
+    DomainsError = domains.DomainsError,
    ejs = require('ejs'),
    fs = require('fs'),
    manifestFormat = require('cloudron-manifestformat'),
@@ -274,7 +274,7 @@ function registerSubdomain(app, overwrite, callback) {
                if (values.length !== 0 && !overwrite) return retryCallback(null, new Error('DNS Record already exists'));

                domains.upsertDnsRecords(app.location, app.domain, 'A', [ ip ], function (error, changeId) {
-                    if (error && (error.reason === DomainError.STILL_BUSY || error.reason === DomainError.EXTERNAL_ERROR)) return retryCallback(error); // try again
+                    if (error && (error.reason === DomainsError.STILL_BUSY || error.reason === DomainsError.EXTERNAL_ERROR)) return retryCallback(error); // try again

                    retryCallback(null, error || changeId);
                });
@@ -306,8 +306,8 @@ function unregisterSubdomain(app, location, domain, callback) {
            debugApp(app, 'Unregistering subdomain: %s', app.fqdn);

            domains.removeDnsRecords(location, domain, 'A', [ ip ], function (error) {
-                if (error && error.reason === DomainError.NOT_FOUND) return retryCallback(null, null); // domain can be not found if oldConfig.domain or restoreConfig.domain was removed
-                if (error && (error.reason === DomainError.STILL_BUSY || error.reason === DomainError.EXTERNAL_ERROR)) return retryCallback(error); // try again
+                if (error && error.reason === DomainsError.NOT_FOUND) return retryCallback(null, null); // domain can be not found if oldConfig.domain or restoreConfig.domain was removed
+                if (error && (error.reason === DomainsError.STILL_BUSY || error.reason === DomainsError.EXTERNAL_ERROR)) return retryCallback(error); // try again

                retryCallback(null, error);
            });
@@ -341,7 +341,7 @@ function waitForDnsPropagation(app, callback) {
    sysinfo.getPublicIp(function (error, ip) {
        if (error) return callback(error);

-        domains.waitForDnsRecord(app.fqdn, app.domain, ip, { interval: 5000, times: 120 }, callback);
+        domains.waitForDnsRecord(app.fqdn, app.domain, ip, { interval: 5000, times: 240 }, callback);
    });
 }

@@ -1,125 +0,0 @@
-'use strict';
-
-exports = module.exports = {
-    initialize: initialize,
-    uninitialize: uninitialize,
-
-    accessTokenAuth: accessTokenAuth
-};
-
-var assert = require('assert'),
-    BasicStrategy = require('passport-http').BasicStrategy,
-    BearerStrategy = require('passport-http-bearer').Strategy,
-    clients = require('./clients'),
-    ClientPasswordStrategy = require('passport-oauth2-client-password').Strategy,
-    ClientsError = clients.ClientsError,
-    DatabaseError = require('./databaseerror'),
-    debug = require('debug')('box:auth'),
-    LocalStrategy = require('passport-local').Strategy,
-    crypto = require('crypto'),
-    passport = require('passport'),
-    tokendb = require('./tokendb'),
-    user = require('./user'),
-    UserError = user.UserError,
-    _ = require('underscore');
-
-function initialize(callback) {
-    assert.strictEqual(typeof callback, 'function');
-
-    passport.serializeUser(function (user, callback) {
-        callback(null, user.id);
-    });
-
-    passport.deserializeUser(function(userId, callback) {
-        user.get(userId, function (error, result) {
-            if (error) return callback(error);
-
-            var md5 = crypto.createHash('md5').update(result.email).digest('hex');
-            result.gravatar = 'https://www.gravatar.com/avatar/' + md5 + '.jpg?s=24&d=mm';
-
-            callback(null, result);
-        });
-    });
-
-    passport.use(new LocalStrategy(function (username, password, callback) {
-        if (username.indexOf('@') === -1) {
-            user.verifyWithUsername(username, password, function (error, result) {
-                if (error && error.reason === UserError.NOT_FOUND) return callback(null, false);
-                if (error && error.reason === UserError.WRONG_PASSWORD) return callback(null, false);
-                if (error) return callback(error);
-                if (!result) return callback(null, false);
-                callback(null, _.pick(result, 'id', 'username', 'email', 'admin'));
-            });
-        } else {
-            user.verifyWithEmail(username, password, function (error, result) {
-                if (error && error.reason === UserError.NOT_FOUND) return callback(null, false);
-                if (error && error.reason === UserError.WRONG_PASSWORD) return callback(null, false);
-                if (error) return callback(error);
-                if (!result) return callback(null, false);
-                callback(null, _.pick(result, 'id', 'username', 'email', 'admin'));
-            });
-        }
-    }));
-
-    passport.use(new BasicStrategy(function (username, password, callback) {
-        if (username.indexOf('cid-') === 0) {
-            debug('BasicStrategy: detected client id %s instead of username:password', username);
-            // username is actually client id here
-            // password is client secret
-            clients.get(username, function (error, client) {
-                if (error && error.reason === ClientsError.NOT_FOUND) return callback(null, false);
-                if (error) return callback(error);
-                if (client.clientSecret != password) return callback(null, false);
-                return callback(null, client);
-            });
-        } else {
-            user.verifyWithUsername(username, password, function (error, result) {
-                if (error && error.reason === UserError.NOT_FOUND) return callback(null, false);
-                if (error && error.reason === UserError.WRONG_PASSWORD) return callback(null, false);
-                if (error) return callback(error);
-                if (!result) return callback(null, false);
-                callback(null, result);
-            });
-        }
-    }));
-
-    passport.use(new ClientPasswordStrategy(function (clientId, clientSecret, callback) {
-        clients.get(clientId, function(error, client) {
-            if (error && error.reason === ClientsError.NOT_FOUND) return callback(null, false);
-            if (error) { return callback(error); }
-            if (client.clientSecret != clientSecret) { return callback(null, false); }
-            return callback(null, client);
-        });
-    }));
-
-    passport.use(new BearerStrategy(accessTokenAuth));
-
-    callback(null);
-}
-
-function uninitialize(callback) {
-    assert.strictEqual(typeof callback, 'function');
-
-    callback(null);
-}
-
-function accessTokenAuth(accessToken, callback) {
-    assert.strictEqual(typeof accessToken, 'string');
-    assert.strictEqual(typeof callback, 'function');
-
-    tokendb.get(accessToken, function (error, token) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(null, false);
-        if (error) return callback(error);
-
-        // scopes here can define what capabilities that token carries
-        // passport put the 'info' object into req.authInfo, where we can further validate the scopes
-        var info = { scope: token.scope };
-
-        user.get(token.identifier, function (error, user) {
-            if (error && error.reason === UserError.NOT_FOUND) return callback(null, false);
-            if (error) return callback(error);
-
-            callback(null, user, info);
-        });
-    });
-}
@@ -182,8 +182,8 @@ function clear(callback) {

 function addDefaultClients(callback) {
    async.series([
-        add.bind(null, 'cid-webadmin', 'Settings', 'built-in', 'secret-webadmin', 'https://admin-localhost', 'cloudron,profile,users,apps,settings'),
-        add.bind(null, 'cid-sdk', 'SDK', 'built-in', 'secret-sdk', 'https://admin-localhost', '*,roleSdk'),
-        add.bind(null, 'cid-cli', 'Cloudron Tool', 'built-in', 'secret-cli', 'https://admin-localhost', '*,roleSdk')
+        add.bind(null, 'cid-webadmin', 'Settings', 'built-in', 'secret-webadmin', 'https://admin-localhost', '*'),
+        add.bind(null, 'cid-sdk', 'SDK', 'built-in', 'secret-sdk', 'https://admin-localhost', '*'),
+        add.bind(null, 'cid-cli', 'Cloudron Tool', 'built-in', 'secret-cli', 'https://admin-localhost', '*')
    ], callback);
 }
@@ -8,26 +8,16 @@ exports = module.exports = {
    del: del,
    getAll: getAll,
    getByAppIdAndType: getByAppIdAndType,
-    getClientTokensByUserId: getClientTokensByUserId,
-    delClientTokensByUserId: delClientTokensByUserId,
+    getTokensByUserId: getTokensByUserId,
+    delTokensByUserId: delTokensByUserId,
    delByAppIdAndType: delByAppIdAndType,
-    addClientTokenByUserId: addClientTokenByUserId,
+    addTokenByUserId: addTokenByUserId,
    delToken: delToken,

+    issueDeveloperToken: issueDeveloperToken,
+
    addDefaultClients: addDefaultClients,

-    // keep this in sync with start.sh ADMIN_SCOPES that generates the cid-webadmin
-    SCOPE_APPS: 'apps',
-    SCOPE_DEVELOPER: 'developer', // obsolete
-    SCOPE_PROFILE: 'profile',
-    SCOPE_CLOUDRON: 'cloudron',
-    SCOPE_SETTINGS: 'settings',
-    SCOPE_USERS: 'users',
-
-    // roles are handled just like the above scopes, they are parallel to scopes
-    // scopes enclose API groups, roles specify the usage role
-    SCOPE_ROLE_SDK: 'roleSdk',
-
    // client type enums
    TYPE_EXTERNAL: 'external',
    TYPE_BUILT_IN: 'built-in',
@@ -39,10 +29,14 @@ var apps = require('./apps.js'),
    assert = require('assert'),
    async = require('async'),
    clientdb = require('./clientdb.js'),
+    constants = require('./constants.js'),
    DatabaseError = require('./databaseerror.js'),
    debug = require('debug')('box:clients'),
+    eventlog = require('./eventlog.js'),
    hat = require('hat'),
+    accesscontrol = require('./accesscontrol.js'),
    tokendb = require('./tokendb.js'),
+    users = require('./users.js'),
    util = require('util'),
    uuid = require('uuid');

@@ -84,28 +78,6 @@ function validateName(name) {
    return null;
 }

-function validateScope(scope) {
-    assert.strictEqual(typeof scope, 'string');
-
-    var VALID_SCOPES = [
-        exports.SCOPE_APPS,
-        exports.SCOPE_DEVELOPER,
-        exports.SCOPE_PROFILE,
-        exports.SCOPE_CLOUDRON,
-        exports.SCOPE_SETTINGS,
-        exports.SCOPE_USERS,
-        '*',    // includes all scopes, but not roles
-        exports.SCOPE_ROLE_SDK
-    ];
-
-    if (scope === '') return new ClientsError(ClientsError.INVALID_SCOPE, 'Empty scope not allowed');
-
-    var allValid = scope.split(',').every(function (s) { return VALID_SCOPES.indexOf(s) !== -1; });
-    if (!allValid) return new ClientsError(ClientsError.INVALID_SCOPE, 'Invalid scope. Available scopes are ' + VALID_SCOPES.join(', '));
-
-    return null;
-}
-
 function add(appId, type, redirectURI, scope, callback) {
    assert.strictEqual(typeof appId, 'string');
    assert.strictEqual(typeof type, 'string');
@@ -113,13 +85,9 @@ function add(appId, type, redirectURI, scope, callback) {
    assert.strictEqual(typeof scope, 'string');
    assert.strictEqual(typeof callback, 'function');

-    // allow whitespace
-    scope = scope.split(',').map(function (s) { return s.trim(); }).join(',');
+    var error = accesscontrol.validateScope(scope);
+    if (error) return callback(new ClientsError(ClientsError.INVALID_SCOPE, error.message));

-    var error = validateScope(scope);
-    if (error) return callback(error);
-
-    // appId is also client name
    error = validateName(appId);
    if (error) return callback(error);

@@ -216,7 +184,7 @@ function getByAppIdAndType(appId, type, callback) {
    });
 }

-function getClientTokensByUserId(clientId, userId, callback) {
+function getTokensByUserId(clientId, userId, callback) {
    assert.strictEqual(typeof clientId, 'string');
    assert.strictEqual(typeof userId, 'string');
    assert.strictEqual(typeof callback, 'function');
@@ -235,7 +203,7 @@ function getClientTokensByUserId(clientId, userId, callback) {
    });
 }

-function delClientTokensByUserId(clientId, userId, callback) {
+function delTokensByUserId(clientId, userId, callback) {
    assert.strictEqual(typeof clientId, 'string');
    assert.strictEqual(typeof userId, 'string');
    assert.strictEqual(typeof callback, 'function');
@@ -275,7 +243,7 @@ function delByAppIdAndType(appId, type, callback) {
    });
 }

-function addClientTokenByUserId(clientId, userId, expiresAt, callback) {
+function addTokenByUserId(clientId, userId, expiresAt, callback) {
    assert.strictEqual(typeof clientId, 'string');
    assert.strictEqual(typeof userId, 'string');
    assert.strictEqual(typeof expiresAt, 'number');
@@ -285,21 +253,39 @@ function addClientTokenByUserId(clientId, userId, expiresAt, callback) {
        if (error) return callback(error);

        var token = tokendb.generateToken();
+        var scope = accesscontrol.canonicalScope(result.scope);

-        tokendb.add(token, userId, result.id, expiresAt, result.scope, function (error) {
+        tokendb.add(token, userId, result.id, expiresAt, scope, function (error) {
            if (error) return callback(new ClientsError(ClientsError.INTERNAL_ERROR, error));

            callback(null, {
                accessToken: token,
                identifier: userId,
                clientId: result.id,
-                scope: result.id,
+                scope: result.scope,
                expires: expiresAt
            });
        });
    });
 }

+// this issues a cid-cli token that does not require a password in various routes
+function issueDeveloperToken(userObject, ip, callback) {
+    assert.strictEqual(typeof userObject, 'object');
+    assert.strictEqual(typeof ip, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    const expiresAt = Date.now() + constants.DEFAULT_TOKEN_EXPIRATION;
+
+    addTokenByUserId('cid-cli', userObject.id, expiresAt, function (error, result) {
+        if (error) return callback(error);
+
+        eventlog.add(eventlog.ACTION_USER_LOGIN, { authType: 'cli', ip: ip }, { userId: userObject.id, user: users.removePrivateFields(userObject) });
+
+        callback(null, result);
+    });
+}
+
 function delToken(clientId, tokenId, callback) {
    assert.strictEqual(typeof clientId, 'string');
    assert.strictEqual(typeof tokenId, 'string');
@@ -324,13 +310,10 @@ function addDefaultClients(origin, callback) {
    debug('Adding default clients');

    // The domain might have changed, therefor we have to update the record
-    // !!! This needs to be in sync with the webadmin, specifically login_callback.js
-    const ADMIN_SCOPES = 'cloudron,developer,profile,users,apps,settings';
-
    // id, appId, type, clientSecret, redirectURI, scope
    async.series([
-        clientdb.upsert.bind(null, 'cid-webadmin', 'Settings', 'built-in', 'secret-webadmin', origin, ADMIN_SCOPES),
-        clientdb.upsert.bind(null, 'cid-sdk', 'SDK', 'built-in', 'secret-sdk', origin, '*,roleSdk'),
-        clientdb.upsert.bind(null, 'cid-cli', 'Cloudron Tool', 'built-in', 'secret-cli', origin, '*, roleSdk')
+        clientdb.upsert.bind(null, 'cid-webadmin', 'Settings', 'built-in', 'secret-webadmin', origin, '*'),
+        clientdb.upsert.bind(null, 'cid-sdk', 'SDK', 'built-in', 'secret-sdk', origin, '*'),
+        clientdb.upsert.bind(null, 'cid-cli', 'Cloudron Tool', 'built-in', 'secret-cli', origin, '*')
    ], callback);
 }
@@ -40,7 +40,7 @@ var assert = require('assert'),
    spawn = require('child_process').spawn,
    split = require('split'),
    updateChecker = require('./updatechecker.js'),
-    user = require('./user.js'),
+    users = require('./users.js'),
    util = require('util'),
    _ = require('underscore');

@@ -103,7 +103,7 @@ function onActivated(callback) {
    // Starting the platform after a user is available means:
    // 1. mail bounces can now be sent to the cloudron owner
    // 2. the restore code path can run without sudo (since mail/ is non-root)
-    user.count(function (error, count) {
+    users.count(function (error, count) {
        if (error) return callback(new CloudronError(CloudronError.INTERNAL_ERROR, error));
        if (!count) return callback(); // not activated

@@ -1,57 +0,0 @@
-/* jslint node: true */
-
-'use strict';
-
-exports = module.exports = {
-    DeveloperError: DeveloperError,
-
-    issueDeveloperToken: issueDeveloperToken
-};
-
-var assert = require('assert'),
-    clients = require('./clients.js'),
-    constants = require('./constants.js'),
-    eventlog = require('./eventlog.js'),
-    tokendb = require('./tokendb.js'),
-    user = require('./user.js'),
-    util = require('util');
-
-function DeveloperError(reason, errorOrMessage) {
-    assert.strictEqual(typeof reason, 'string');
-    assert(errorOrMessage instanceof Error || typeof errorOrMessage === 'string' || typeof errorOrMessage === 'undefined');
-
-    Error.call(this);
-    Error.captureStackTrace(this, this.constructor);
-
-    this.name = this.constructor.name;
-    this.reason = reason;
-    if (typeof errorOrMessage === 'undefined') {
-        this.message = reason;
-    } else if (typeof errorOrMessage === 'string') {
-        this.message = errorOrMessage;
-    } else {
-        this.message = 'Internal error';
-        this.nestedError = errorOrMessage;
-    }
-}
-util.inherits(DeveloperError, Error);
-DeveloperError.INTERNAL_ERROR = 'Internal Error';
-DeveloperError.EXTERNAL_ERROR = 'External Error';
-
-function issueDeveloperToken(userObject, ip, callback) {
-    assert.strictEqual(typeof userObject, 'object');
-    assert.strictEqual(typeof ip, 'string');
-    assert.strictEqual(typeof callback, 'function');
-
-    var token = tokendb.generateToken();
-    var expiresAt = Date.now() + constants.DEFAULT_TOKEN_EXPIRATION;
-    var scopes = '*,' + clients.SCOPE_ROLE_SDK;
-
-    tokendb.add(token, userObject.id, 'cid-cli', expiresAt, scopes, function (error) {
-        if (error) return callback(new DeveloperError(DeveloperError.INTERNAL_ERROR, error));
-
-        eventlog.add(eventlog.ACTION_USER_LOGIN, { authType: 'cli', ip: ip }, { userId: userObject.id, user: user.removePrivateFields(userObject) });
-
-        callback(null, { token: token, expiresAt: new Date(expiresAt).toISOString() });
-    });
-}
@@ -11,7 +11,7 @@ exports = module.exports = {
 var assert = require('assert'),
    config = require('../config.js'),
    debug = require('debug')('box:dns/caas'),
-    DomainError = require('../domains.js').DomainError,
+    DomainsError = require('../domains.js').DomainsError,
    superagent = require('superagent'),
    util = require('util');

@@ -45,10 +45,10 @@ function add(dnsConfig, zoneName, subdomain, type, values, callback) {
        .send(data)
        .timeout(30 * 1000)
        .end(function (error, result) {
-            if (error && !error.response) return callback(new DomainError(DomainError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
-            if (result.statusCode === 400) return callback(new DomainError(DomainError.BAD_FIELD, result.body.message));
-            if (result.statusCode === 420) return callback(new DomainError(DomainError.STILL_BUSY));
-            if (result.statusCode !== 201) return callback(new DomainError(DomainError.EXTERNAL_ERROR, util.format('%s %j', result.statusCode, result.body)));
+            if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
+            if (result.statusCode === 400) return callback(new DomainsError(DomainsError.BAD_FIELD, result.body.message));
+            if (result.statusCode === 420) return callback(new DomainsError(DomainsError.STILL_BUSY));
+            if (result.statusCode !== 201) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('%s %j', result.statusCode, result.body)));

            return callback(null, result.body.changeId);
        });
@@ -70,8 +70,8 @@ function get(dnsConfig, zoneName, subdomain, type, callback) {
        .query({ token: dnsConfig.token, type: type })
        .timeout(30 * 1000)
        .end(function (error, result) {
-            if (error && !error.response) return callback(new DomainError(DomainError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
-            if (result.statusCode !== 200) return callback(new DomainError(DomainError.EXTERNAL_ERROR, util.format('%s %j', result.statusCode, result.body)));
+            if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
+            if (result.statusCode !== 200) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('%s %j', result.statusCode, result.body)));

            return callback(null, result.body.values);
        });
@@ -109,11 +109,11 @@ function del(dnsConfig, zoneName, subdomain, type, values, callback) {
        .send(data)
        .timeout(30 * 1000)
        .end(function (error, result) {
-            if (error && !error.response) return callback(new DomainError(DomainError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
-            if (result.statusCode === 400) return callback(new DomainError(DomainError.BAD_FIELD, result.body.message));
-            if (result.statusCode === 420) return callback(new DomainError(DomainError.STILL_BUSY));
-            if (result.statusCode === 404) return callback(new DomainError(DomainError.NOT_FOUND));
-            if (result.statusCode !== 204) return callback(new DomainError(DomainError.EXTERNAL_ERROR, util.format('%s %j', result.statusCode, result.body)));
+            if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
+            if (result.statusCode === 400) return callback(new DomainsError(DomainsError.BAD_FIELD, result.body.message));
+            if (result.statusCode === 420) return callback(new DomainsError(DomainsError.STILL_BUSY));
+            if (result.statusCode === 404) return callback(new DomainsError(DomainsError.NOT_FOUND));
+            if (result.statusCode !== 204) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('%s %j', result.statusCode, result.body)));

            return callback(null);
        });
@@ -12,7 +12,7 @@ var assert = require('assert'),
    async = require('async'),
    debug = require('debug')('box:dns/cloudflare'),
    dns = require('../native-dns.js'),
-    DomainError = require('../domains.js').DomainError,
+    DomainsError = require('../domains.js').DomainsError,
    superagent = require('superagent'),
    util = require('util'),
    _ = require('underscore');
@@ -24,8 +24,8 @@ function translateRequestError(result, callback) {
    assert.strictEqual(typeof result, 'object');
    assert.strictEqual(typeof callback, 'function');

-    if (result.statusCode === 404) return callback(new DomainError(DomainError.NOT_FOUND, util.format('%s %j', result.statusCode, 'API does not exist')));
-    if (result.statusCode === 422) return callback(new DomainError(DomainError.BAD_FIELD, result.body.message));
+    if (result.statusCode === 404) return callback(new DomainsError(DomainsError.NOT_FOUND, util.format('%s %j', result.statusCode, 'API does not exist')));
+    if (result.statusCode === 422) return callback(new DomainsError(DomainsError.BAD_FIELD, result.body.message));
    if ((result.statusCode === 400 || result.statusCode === 401 || result.statusCode === 403) && result.body.errors.length > 0) {
        let error = result.body.errors[0];
        let message = error.message;
@@ -34,10 +34,10 @@ function translateRequestError(result, callback) {
            else message = 'Invalid credentials';
        }

-        return callback(new DomainError(DomainError.ACCESS_DENIED, message));
+        return callback(new DomainsError(DomainsError.ACCESS_DENIED, message));
    }

-    callback(new DomainError(DomainError.EXTERNAL_ERROR, util.format('%s %j', result.statusCode, result.body)));
+    callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('%s %j', result.statusCode, result.body)));
 }

 function getZoneByName(dnsConfig, zoneName, callback) {
@@ -52,7 +52,7 @@ function getZoneByName(dnsConfig, zoneName, callback) {
        .end(function (error, result) {
            if (error && !error.response) return callback(error);
            if (result.statusCode !== 200 || result.body.success !== true) return translateRequestError(result, callback);
-            if (!result.body.result.length) return callback(new DomainError(DomainError.NOT_FOUND, util.format('%s %j', result.statusCode, result.body)));
+            if (!result.body.result.length) return callback(new DomainsError(DomainsError.NOT_FOUND, util.format('%s %j', result.statusCode, result.body)));

            callback(null, result.body.result[0]);
        });
@@ -233,8 +233,8 @@ function verifyDnsConfig(dnsConfig, fqdn, zoneName, ip, callback) {
    assert.strictEqual(typeof ip, 'string');
    assert.strictEqual(typeof callback, 'function');

-    if (!dnsConfig.token || typeof dnsConfig.token !== 'string') return callback(new DomainError(DomainError.BAD_FIELD, 'token must be a non-empty string'));
-    if (!dnsConfig.email || typeof dnsConfig.email !== 'string') return callback(new DomainError(DomainError.BAD_FIELD, 'email must be a non-empty string'));
+    if (!dnsConfig.token || typeof dnsConfig.token !== 'string') return callback(new DomainsError(DomainsError.BAD_FIELD, 'token must be a non-empty string'));
+    if (!dnsConfig.email || typeof dnsConfig.email !== 'string') return callback(new DomainsError(DomainsError.BAD_FIELD, 'email must be a non-empty string'));

    var credentials = {
        token: dnsConfig.token,
@@ -244,15 +244,15 @@ function verifyDnsConfig(dnsConfig, fqdn, zoneName, ip, callback) {
    if (process.env.BOX_ENV === 'test') return callback(null, credentials); // this shouldn't be here

    dns.resolve(zoneName, 'NS', { timeout: 5000 }, function (error, nameservers) {
-        if (error && error.code === 'ENOTFOUND') return callback(new DomainError(DomainError.BAD_FIELD, 'Unable to resolve nameservers for this domain'));
-        if (error || !nameservers) return callback(new DomainError(DomainError.BAD_FIELD, error ? error.message : 'Unable to get nameservers'));
+        if (error && error.code === 'ENOTFOUND') return callback(new DomainsError(DomainsError.BAD_FIELD, 'Unable to resolve nameservers for this domain'));
+        if (error || !nameservers) return callback(new DomainsError(DomainsError.BAD_FIELD, error ? error.message : 'Unable to get nameservers'));

        getZoneByName(dnsConfig, zoneName, function(error, result) {
            if (error) return callback(error);

            if (!_.isEqual(result.name_servers.sort(), nameservers.sort())) {
                debug('verifyDnsConfig: %j and %j do not match', nameservers, result.name_servers);
-                return callback(new DomainError(DomainError.BAD_FIELD, 'Domain nameservers are not set to Cloudflare'));
+                return callback(new DomainsError(DomainsError.BAD_FIELD, 'Domain nameservers are not set to Cloudflare'));
            }

            const testSubdomain = 'cloudrontestdns';
@@ -12,7 +12,7 @@ var assert = require('assert'),
    async = require('async'),
    debug = require('debug')('box:dns/digitalocean'),
    dns = require('../native-dns.js'),
-    DomainError = require('../domains.js').DomainError,
+    DomainsError = require('../domains.js').DomainsError,
    safe = require('safetydance'),
    superagent = require('superagent'),
    util = require('util');
@@ -39,10 +39,10 @@ function getInternal(dnsConfig, zoneName, subdomain, type, callback) {
            .set('Authorization', 'Bearer ' + dnsConfig.token)
            .timeout(30 * 1000)
            .end(function (error, result) {
-                if (error && !error.response) return callback(new DomainError(DomainError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
-                if (result.statusCode === 404) return callback(new DomainError(DomainError.NOT_FOUND, formatError(result)));
-                if (result.statusCode === 403 || result.statusCode === 401) return callback(new DomainError(DomainError.ACCESS_DENIED, formatError(result)));
-                if (result.statusCode !== 200) return callback(new DomainError(DomainError.EXTERNAL_ERROR, formatError(result)));
+                if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
+                if (result.statusCode === 404) return callback(new DomainsError(DomainsError.NOT_FOUND, formatError(result)));
+                if (result.statusCode === 403 || result.statusCode === 401) return callback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
+                if (result.statusCode !== 200) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));

                matchingRecords = matchingRecords.concat(result.body.domain_records.filter(function (record) {
                    return (record.type === type && record.name === subdomain);
@@ -101,10 +101,10 @@ function upsert(dnsConfig, zoneName, subdomain, type, values, callback) {
                    .send(data)
                    .timeout(30 * 1000)
                    .end(function (error, result) {
-                        if (error && !error.response) return iteratorCallback(new DomainError(DomainError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
-                        if (result.statusCode === 403 || result.statusCode === 401) return iteratorCallback(new DomainError(DomainError.ACCESS_DENIED, formatError(result)));
-                        if (result.statusCode === 422) return iteratorCallback(new DomainError(DomainError.BAD_FIELD, result.body.message));
-                        if (result.statusCode !== 201) return iteratorCallback(new DomainError(DomainError.EXTERNAL_ERROR, formatError(result)));
+                        if (error && !error.response) return iteratorCallback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
+                        if (result.statusCode === 403 || result.statusCode === 401) return iteratorCallback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
+                        if (result.statusCode === 422) return iteratorCallback(new DomainsError(DomainsError.BAD_FIELD, result.body.message));
+                        if (result.statusCode !== 201) return iteratorCallback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));

                        recordIds.push(safe.query(result.body, 'domain_record.id'));

@@ -119,10 +119,10 @@ function upsert(dnsConfig, zoneName, subdomain, type, values, callback) {
                    // increment, as we have consumed the record
                        ++i;

-                        if (error && !error.response) return iteratorCallback(new DomainError(DomainError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
-                        if (result.statusCode === 403 || result.statusCode === 401) return iteratorCallback(new DomainError(DomainError.ACCESS_DENIED, formatError(result)));
-                        if (result.statusCode === 422) return iteratorCallback(new DomainError(DomainError.BAD_FIELD, result.body.message));
-                        if (result.statusCode !== 200) return iteratorCallback(new DomainError(DomainError.EXTERNAL_ERROR, formatError(result)));
+                        if (error && !error.response) return iteratorCallback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
+                        if (result.statusCode === 403 || result.statusCode === 401) return iteratorCallback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
+                        if (result.statusCode === 422) return iteratorCallback(new DomainsError(DomainsError.BAD_FIELD, result.body.message));
+                        if (result.statusCode !== 200) return iteratorCallback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));

                        recordIds.push(safe.query(result.body, 'domain_record.id'));

@@ -185,10 +185,10 @@ function del(dnsConfig, zoneName, subdomain, type, values, callback) {
            .set('Authorization', 'Bearer ' + dnsConfig.token)
            .timeout(30 * 1000)
            .end(function (error, result) {
-                if (error && !error.response) return callback(new DomainError(DomainError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
+                if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
                if (result.statusCode === 404) return callback(null);
-                if (result.statusCode === 403 || result.statusCode === 401) return callback(new DomainError(DomainError.ACCESS_DENIED, formatError(result)));
-                if (result.statusCode !== 204) return callback(new DomainError(DomainError.EXTERNAL_ERROR, formatError(result)));
+                if (result.statusCode === 403 || result.statusCode === 401) return callback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
+                if (result.statusCode !== 204) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));

                debug('del: done');

@@ -211,12 +211,12 @@ function verifyDnsConfig(dnsConfig, fqdn, zoneName, ip, callback) {
    if (process.env.BOX_ENV === 'test') return callback(null, credentials); // this shouldn't be here

    dns.resolve(zoneName, 'NS', { timeout: 5000 }, function (error, nameservers) {
-        if (error && error.code === 'ENOTFOUND') return callback(new DomainError(DomainError.BAD_FIELD, 'Unable to resolve nameservers for this domain'));
-        if (error || !nameservers) return callback(new DomainError(DomainError.BAD_FIELD, error ? error.message : 'Unable to get nameservers'));
+        if (error && error.code === 'ENOTFOUND') return callback(new DomainsError(DomainsError.BAD_FIELD, 'Unable to resolve nameservers for this domain'));
+        if (error || !nameservers) return callback(new DomainsError(DomainsError.BAD_FIELD, error ? error.message : 'Unable to get nameservers'));

        if (nameservers.map(function (n) { return n.toLowerCase(); }).indexOf('ns1.digitalocean.com') === -1) {
            debug('verifyDnsConfig: %j does not contains DO NS', nameservers);
-            return callback(new DomainError(DomainError.BAD_FIELD, 'Domain nameservers are not set to Digital Ocean'));
+            return callback(new DomainsError(DomainsError.BAD_FIELD, 'Domain nameservers are not set to Digital Ocean'));
        }

        const testSubdomain = 'cloudrontestdns';
@@ -0,0 +1,146 @@
+'use strict';
+
+exports = module.exports = {
+    upsert: upsert,
+    get: get,
+    del: del,
+    waitForDns: require('./waitfordns.js'),
+    verifyDnsConfig: verifyDnsConfig
+};
+
+var assert = require('assert'),
+    debug = require('debug')('box:dns/gandi'),
+    dns = require('../native-dns.js'),
+    DomainsError = require('../domains.js').DomainsError,
+    superagent = require('superagent'),
+    util = require('util');
+
+var GANDI_API = 'https://dns.api.gandi.net/api/v5';
+
+function formatError(response) {
+    return util.format(`Gandi DNS error [${response.statusCode}] ${response.body.message}`);
+}
+
+function upsert(dnsConfig, zoneName, subdomain, type, values, callback) {
+    assert.strictEqual(typeof dnsConfig, 'object');
+    assert.strictEqual(typeof zoneName, 'string');
+    assert.strictEqual(typeof subdomain, 'string');
+    assert.strictEqual(typeof type, 'string');
+    assert(util.isArray(values));
+    assert.strictEqual(typeof callback, 'function');
+
+    subdomain = subdomain || '@';
+
+    debug(`upsert: ${subdomain} in zone ${zoneName} of type ${type} with values ${JSON.stringify(values)}`);
+
+    var data = {
+        'rrset_ttl': 300, // this is the minimum allowed
+        'rrset_values': values // for mx records, value is already of the '<priority> <server>' format
+    };
+
+    superagent.put(`${GANDI_API}/domains/${zoneName}/records/${subdomain}/${type}`)
+        .set('X-Api-Key', dnsConfig.token)
+        .timeout(30 * 1000)
+        .send(data)
+        .end(function (error, result) {
+            if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
+            if (result.statusCode === 403 || result.statusCode === 401) return callback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
+            if (result.statusCode === 400) return callback(new DomainsError(DomainsError.BAD_FIELD, formatError(result)));
+            if (result.statusCode !== 201) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));
+
+            return callback(null, 'unused-id');
+        });
+}
+
+function get(dnsConfig, zoneName, subdomain, type, callback) {
+    assert.strictEqual(typeof dnsConfig, 'object');
+    assert.strictEqual(typeof zoneName, 'string');
+    assert.strictEqual(typeof subdomain, 'string');
+    assert.strictEqual(typeof type, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    subdomain = subdomain || '@';
+
+    debug(`get: ${subdomain} in zone ${zoneName} of type ${type}`);
+
+    superagent.get(`${GANDI_API}/domains/${zoneName}/records/${subdomain}/${type}`)
+        .set('X-Api-Key', dnsConfig.token)
+        .timeout(30 * 1000)
+        .end(function (error, result) {
+            if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
+            if (result.statusCode === 403 || result.statusCode === 401) return callback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
+            if (result.statusCode === 404) return callback(null, [ ]);
+            if (result.statusCode !== 200) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));
+
+            debug('get: %j', result.body);
+
+            return callback(null, result.body.rrset_values);
+        });
+}
+
+function del(dnsConfig, zoneName, subdomain, type, values, callback) {
+    assert.strictEqual(typeof dnsConfig, 'object');
+    assert.strictEqual(typeof zoneName, 'string');
+    assert.strictEqual(typeof subdomain, 'string');
+    assert.strictEqual(typeof type, 'string');
+    assert(util.isArray(values));
+    assert.strictEqual(typeof callback, 'function');
+
+    subdomain = subdomain || '@';
+
+    debug(`del: ${subdomain} in zone ${zoneName} of type ${type} with values ${JSON.stringify(values)}`);
+
+    superagent.del(`${GANDI_API}/domains/${zoneName}/records/${subdomain}/${type}`)
+        .set('X-Api-Key', dnsConfig.token)
+        .timeout(30 * 1000)
+        .end(function (error, result) {
+            if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
+            if (result.statusCode === 404) return callback(null);
+            if (result.statusCode === 403 || result.statusCode === 401) return callback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
+            if (result.statusCode !== 204) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));
+
+            debug('del: done');
+
+            return callback(null);
+        });
+}
+
+function verifyDnsConfig(dnsConfig, fqdn, zoneName, ip, callback) {
+    assert.strictEqual(typeof dnsConfig, 'object');
+    assert.strictEqual(typeof fqdn, 'string');
+    assert.strictEqual(typeof zoneName, 'string');
+    assert.strictEqual(typeof ip, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    var credentials = {
+        token: dnsConfig.token
+    };
+
+    if (process.env.BOX_ENV === 'test') return callback(null, credentials); // this shouldn't be here
+
+    dns.resolve(zoneName, 'NS', { timeout: 5000 }, function (error, nameservers) {
+        if (error && error.code === 'ENOTFOUND') return callback(new DomainsError(DomainsError.BAD_FIELD, 'Unable to resolve nameservers for this domain'));
+        if (error || !nameservers) return callback(new DomainsError(DomainsError.BAD_FIELD, error ? error.message : 'Unable to get nameservers'));
+
+        if (!nameservers.every(function (n) { return n.toLowerCase().indexOf('.gandi.net') !== -1; })) {
+            debug('verifyDnsConfig: %j does not contain Gandi NS', nameservers);
+            return callback(new DomainsError(DomainsError.BAD_FIELD, 'Domain nameservers are not set to Gandi'));
+        }
+
+        const testSubdomain = 'cloudrontestdns';
+
+        upsert(credentials, zoneName, testSubdomain, 'A', [ ip ], function (error, changeId) {
+            if (error) return callback(error);
+
+            debug('verifyDnsConfig: Test A record added with change id %s', changeId);
+
+            del(dnsConfig, zoneName, testSubdomain, 'A', [ ip ], function (error) {
+                if (error) return callback(error);
+
+                debug('verifyDnsConfig: Test A record removed again');
+
+                callback(null, credentials);
+            });
+        });
+    });
+}
@@ -11,7 +11,7 @@ exports = module.exports = {
 var assert = require('assert'),
    debug = require('debug')('box:dns/gcdns'),
    dns = require('../native-dns.js'),
-    DomainError = require('../domains.js').DomainError,
+    DomainsError = require('../domains.js').DomainsError,
    GCDNS = require('@google-cloud/dns'),
    util = require('util'),
    _ = require('underscore');
@@ -42,20 +42,20 @@ function getZoneByName(dnsConfig, zoneName, callback) {
    var gcdns = GCDNS(getDnsCredentials(dnsConfig));

    gcdns.getZones(function (error, zones) {
-        if (error && error.message === 'invalid_grant') return callback(new DomainError(DomainError.ACCESS_DENIED, 'The key was probably revoked'));
-        if (error && error.reason === 'No such domain') return callback(new DomainError(DomainError.NOT_FOUND, error.message));
-        if (error && error.code === 403) return callback(new DomainError(DomainError.ACCESS_DENIED, error.message));
-        if (error && error.code === 404) return callback(new DomainError(DomainError.NOT_FOUND, error.message));
+        if (error && error.message === 'invalid_grant') return callback(new DomainsError(DomainsError.ACCESS_DENIED, 'The key was probably revoked'));
+        if (error && error.reason === 'No such domain') return callback(new DomainsError(DomainsError.NOT_FOUND, error.message));
+        if (error && error.code === 403) return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
+        if (error && error.code === 404) return callback(new DomainsError(DomainsError.NOT_FOUND, error.message));
        if (error) {
            debug('gcdns.getZones', error);
-            return callback(new DomainError(DomainError.EXTERNAL_ERROR, error));
+            return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, error));
        }

        var zone = zones.filter(function (zone) {
            return zone.metadata.dnsName.slice(0, -1) === zoneName;     // the zone name contains a '.' at the end
        })[0];

-        if (!zone) return callback(new DomainError(DomainError.NOT_FOUND, 'no such zone'));
+        if (!zone) return callback(new DomainsError(DomainsError.NOT_FOUND, 'no such zone'));

        callback(null, zone); //zone.metadata ~= {name="", dnsName="", nameServers:[]}
    });
@@ -77,10 +77,10 @@ function upsert(dnsConfig, zoneName, subdomain, type, values, callback) {
        var domain = (subdomain ? subdomain + '.' : '') + zoneName + '.';

        zone.getRecords({ type: type, name: domain }, function (error, oldRecords) {
-            if (error && error.code === 403) return callback(new DomainError(DomainError.ACCESS_DENIED, error.message));
+            if (error && error.code === 403) return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
            if (error) {
                debug('upsert->zone.getRecords', error);
-                return callback(new DomainError(DomainError.EXTERNAL_ERROR, error.message));
+                return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, error.message));
            }

            var newRecord = zone.record(type, {
@@ -90,11 +90,11 @@ function upsert(dnsConfig, zoneName, subdomain, type, values, callback) {
            });

            zone.createChange({ delete: oldRecords, add: newRecord }, function(error, change) {
-                if (error && error.code === 403) return callback(new DomainError(DomainError.ACCESS_DENIED, error.message));
-                if (error && error.code === 412) return callback(new DomainError(DomainError.STILL_BUSY, error.message));
+                if (error && error.code === 403) return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
+                if (error && error.code === 412) return callback(new DomainsError(DomainsError.STILL_BUSY, error.message));
                if (error) {
                    debug('upsert->zone.createChange', error);
-                    return callback(new DomainError(DomainError.EXTERNAL_ERROR, error.message));
+                    return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, error.message));
                }

                callback(null, change.id);
@@ -119,8 +119,8 @@ function get(dnsConfig, zoneName, subdomain, type, callback) {
        };

        zone.getRecords(params, function (error, records) {
-            if (error && error.code === 403) return callback(new DomainError(DomainError.ACCESS_DENIED, error.message));
-            if (error) return callback(new DomainError(DomainError.EXTERNAL_ERROR, error));
+            if (error && error.code === 403) return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
+            if (error) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, error));
            if (records.length === 0) return callback(null, [ ]);

            return callback(null, records[0].data);
@@ -142,18 +142,18 @@ function del(dnsConfig, zoneName, subdomain, type, values, callback) {
        var domain = (subdomain ? subdomain + '.' : '') + zoneName + '.';

        zone.getRecords({ type: type, name: domain }, function(error, oldRecords) {
-            if (error && error.code === 403) return callback(new DomainError(DomainError.ACCESS_DENIED, error.message));
+            if (error && error.code === 403) return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
            if (error) {
                debug('del->zone.getRecords', error);
-                return callback(new DomainError(DomainError.EXTERNAL_ERROR, error.message));
+                return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, error.message));
            }

            zone.deleteRecords(oldRecords, function (error, change) {
-                if (error && error.code === 403) return callback(new DomainError(DomainError.ACCESS_DENIED, error.message));
-                if (error && error.code === 412) return callback(new DomainError(DomainError.STILL_BUSY, error.message));
+                if (error && error.code === 403) return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
+                if (error && error.code === 412) return callback(new DomainsError(DomainsError.STILL_BUSY, error.message));
                if (error) {
                    debug('del->zone.createChange', error);
-                    return callback(new DomainError(DomainError.EXTERNAL_ERROR, error.message));
+                    return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, error.message));
                }

                callback(null, change.id);
@@ -173,16 +173,16 @@ function verifyDnsConfig(dnsConfig, fqdn, zoneName, ip, callback) {
    if (process.env.BOX_ENV === 'test') return callback(null, credentials); // this shouldn't be here

    dns.resolve(zoneName, 'NS', { timeout: 5000 }, function (error, nameservers) {
-        if (error && error.code === 'ENOTFOUND') return callback(new DomainError(DomainError.BAD_FIELD, 'Unable to resolve nameservers for this domain'));
-        if (error || !resolvedNS) return callback(new DomainError(DomainError.BAD_FIELD, error ? error.message : 'Unable to get nameservers'));
+        if (error && error.code === 'ENOTFOUND') return callback(new DomainsError(DomainsError.BAD_FIELD, 'Unable to resolve nameservers for this domain'));
+        if (error || !nameservers) return callback(new DomainsError(DomainsError.BAD_FIELD, error ? error.message : 'Unable to get nameservers'));

        getZoneByName(credentials, zoneName, function (error, zone) {
            if (error) return callback(error);

            var definedNS = zone.metadata.nameServers.sort().map(function(r) { return r.replace(/\.$/, ''); });
-            if (!_.isEqual(definedNS, resolvedNS.sort())) {
-                debug('verifyDnsConfig: %j and %j do not match', resolvedNS, definedNS);
-                return callback(new DomainError(DomainError.BAD_FIELD, 'Domain nameservers are not set to Google Cloud DNS'));
+            if (!_.isEqual(definedNS, nameservers.sort())) {
+                debug('verifyDnsConfig: %j and %j do not match', nameservers, definedNS);
+                return callback(new DomainsError(DomainsError.BAD_FIELD, 'Domain nameservers are not set to Google Cloud DNS'));
            }

            const testSubdomain = 'cloudrontestdns';
@@ -0,0 +1,181 @@
+'use strict';
+
+exports = module.exports = {
+    upsert: upsert,
+    get: get,
+    del: del,
+    waitForDns: require('./waitfordns.js'),
+    verifyDnsConfig: verifyDnsConfig
+};
+
+var assert = require('assert'),
+    debug = require('debug')('box:dns/godaddy'),
+    dns = require('../native-dns.js'),
+    DomainsError = require('../domains.js').DomainsError,
+    superagent = require('superagent'),
+    util = require('util');
+
+// const GODADDY_API_OTE = 'https://api.ote-godaddy.com/v1/domains';
+const GODADDY_API = 'https://api.godaddy.com/v1/domains';
+
+// this is a workaround for godaddy not having a delete API
+// https://stackoverflow.com/questions/39347464/delete-record-libcloud-godaddy-api
+const GODADDY_INVALID_IP = '0.0.0.0';
+
+function formatError(response) {
+    return util.format(`GoDaddy DNS error [${response.statusCode}] ${response.body.message}`);
+}
+
+function upsert(dnsConfig, zoneName, subdomain, type, values, callback) {
+    assert.strictEqual(typeof dnsConfig, 'object');
+    assert.strictEqual(typeof zoneName, 'string');
+    assert.strictEqual(typeof subdomain, 'string');
+    assert.strictEqual(typeof type, 'string');
+    assert(util.isArray(values));
+    assert.strictEqual(typeof callback, 'function');
+
+    subdomain = subdomain || '@';
+
+    debug(`upsert: ${subdomain} in zone ${zoneName} of type ${type} with values ${JSON.stringify(values)}`);
+
+    var records = [ ];
+    values.forEach(function (value) {
+        var record = { ttl: 600 }; // 600 is the min ttl
+
+        if (type === 'MX') {
+            record.priority = parseInt(value.split(' ')[0], 10);
+            record.data = value.split(' ')[1];
+        } else {
+            record.data = value;
+        }
+
+        records.push(record);
+    });
+
+    superagent.put(`${GODADDY_API}/${zoneName}/records/${type}/${subdomain}`)
+        .set('Authorization', `sso-key ${dnsConfig.apiKey}:${dnsConfig.apiSecret}`)
+        .timeout(30 * 1000)
+        .send(records)
+        .end(function (error, result) {
+            if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
+            if (result.statusCode === 403 || result.statusCode === 401) return callback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
+            if (result.statusCode === 400) return callback(new DomainsError(DomainsError.BAD_FIELD, formatError(result))); // no such zone
+            if (result.statusCode === 422) return callback(new DomainsError(DomainsError.BAD_FIELD, formatError(result))); // conflict
+            if (result.statusCode !== 200) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));
+
+            return callback(null, 'unused-id');
+        });
+}
+
+function get(dnsConfig, zoneName, subdomain, type, callback) {
+    assert.strictEqual(typeof dnsConfig, 'object');
+    assert.strictEqual(typeof zoneName, 'string');
+    assert.strictEqual(typeof subdomain, 'string');
+    assert.strictEqual(typeof type, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    subdomain = subdomain || '@';
+
+    debug(`get: ${subdomain} in zone ${zoneName} of type ${type}`);
+
+    superagent.get(`${GODADDY_API}/${zoneName}/records/${type}/${subdomain}`)
+        .set('Authorization', `sso-key ${dnsConfig.apiKey}:${dnsConfig.apiSecret}`)
+        .timeout(30 * 1000)
+        .end(function (error, result) {
+            if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
+            if (result.statusCode === 403 || result.statusCode === 401) return callback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
+            if (result.statusCode === 404) return callback(null, [ ]);
+            if (result.statusCode !== 200) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));
+
+            debug('get: %j', result.body);
+
+            var values = result.body.map(function (record) { return record.data; });
+
+            if (values.length === 1 && values[0] === GODADDY_INVALID_IP) return callback(null, [ ]); // pretend this record doesn't exist
+
+            return callback(null, values);
+        });
+}
+
+function del(dnsConfig, zoneName, subdomain, type, values, callback) {
+    assert.strictEqual(typeof dnsConfig, 'object');
+    assert.strictEqual(typeof zoneName, 'string');
+    assert.strictEqual(typeof subdomain, 'string');
+    assert.strictEqual(typeof type, 'string');
+    assert(util.isArray(values));
+    assert.strictEqual(typeof callback, 'function');
+
+    subdomain = subdomain || '@';
+
+    debug(`get: ${subdomain} in zone ${zoneName} of type ${type} with values ${JSON.stringify(values)}`);
+
+    if (type !== 'A') return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, new Error('Not supported by GoDaddy API'))); // can never happen
+
+    // check if the record exists at all so that we don't insert the "Dead" record for no reason
+    get(dnsConfig, zoneName, subdomain, type, function (error, values) {
+        if (error) return callback(error);
+        if (values.length === 0) return callback();
+
+        // godaddy does not have a delete API. so fill it up with an invalid IP that we can ignore in future get()
+        var records = [{
+            ttl: 600,
+            data: GODADDY_INVALID_IP
+        }];
+
+        superagent.put(`${GODADDY_API}/${zoneName}/records/${type}/${subdomain}`)
+            .set('Authorization', `sso-key ${dnsConfig.apiKey}:${dnsConfig.apiSecret}`)
+            .send(records)
+            .timeout(30 * 1000)
+            .end(function (error, result) {
+                if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
+                if (result.statusCode === 404) return callback(null);
+                if (result.statusCode === 403 || result.statusCode === 401) return callback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
+                if (result.statusCode !== 200) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));
+
+                debug('del: done');
+
+                return callback(null);
+            });
+    });
+}
+
+function verifyDnsConfig(dnsConfig, fqdn, zoneName, ip, callback) {
+    assert.strictEqual(typeof dnsConfig, 'object');
+    assert.strictEqual(typeof fqdn, 'string');
+    assert.strictEqual(typeof zoneName, 'string');
+    assert.strictEqual(typeof ip, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    var credentials = {
+        apiKey: dnsConfig.apiKey,
+        apiSecret: dnsConfig.apiSecret
+    };
+
+    if (process.env.BOX_ENV === 'test') return callback(null, credentials); // this shouldn't be here
+
+    dns.resolve(zoneName, 'NS', { timeout: 5000 }, function (error, nameservers) {
+        if (error && error.code === 'ENOTFOUND') return callback(new DomainsError(DomainsError.BAD_FIELD, 'Unable to resolve nameservers for this domain'));
+        if (error || !nameservers) return callback(new DomainsError(DomainsError.BAD_FIELD, error ? error.message : 'Unable to get nameservers'));
+
+        if (!nameservers.every(function (n) { return n.toLowerCase().indexOf('.domaincontrol.com') !== -1; })) {
+            debug('verifyDnsConfig: %j does not contain GoDaddy NS', nameservers);
+            return callback(new DomainsError(DomainsError.BAD_FIELD, 'Domain nameservers are not set to GoDaddy'));
+        }
+
+        const testSubdomain = 'cloudrontestdns';
+
+        upsert(credentials, zoneName, testSubdomain, 'A', [ ip ], function (error, changeId) {
+            if (error) return callback(error);
+
+            debug('verifyDnsConfig: Test A record added with change id %s', changeId);
+
+            del(dnsConfig, zoneName, testSubdomain, 'A', [ ip ], function (error) {
+                if (error) return callback(error);
+
+                debug('verifyDnsConfig: Test A record removed again');
+
+                callback(null, credentials);
+            });
+        });
+    });
+}
@@ -15,7 +15,7 @@ exports = module.exports = {
 };

 var assert = require('assert'),
-    DomainError = require('../domains.js').DomainError,
+    DomainsError = require('../domains.js').DomainsError,
    util = require('util');

 function upsert(dnsConfig, zoneName, subdomain, type, values, callback) {
@@ -11,7 +11,7 @@ exports = module.exports = {
 var assert = require('assert'),
    debug = require('debug')('box:dns/manual'),
    dns = require('../native-dns.js'),
-    DomainError = require('../domains.js').DomainError,
+    DomainsError = require('../domains.js').DomainsError,
    util = require('util');

 function upsert(dnsConfig, zoneName, subdomain, type, values, callback) {
@@ -57,7 +57,8 @@ function verifyDnsConfig(dnsConfig, domain, zoneName, ip, callback) {

    // Very basic check if the nameservers can be fetched
    dns.resolve(zoneName, 'NS', { timeout: 5000 }, function (error, nameservers) {
-        if (error || !nameservers) return callback(new DomainError(DomainError.BAD_FIELD, 'Unable to get nameservers'));
+        if (error && error.code === 'ENOTFOUND') return callback(new DomainsError(DomainsError.BAD_FIELD, 'Unable to resolve nameservers for this domain'));
+        if (error || !nameservers) return callback(new DomainsError(DomainsError.BAD_FIELD, error ? error.message : 'Unable to get nameservers'));

        callback(null, { wildcard: !!dnsConfig.wildcard });
    });
@@ -0,0 +1,231 @@
+'use strict';
+
+exports = module.exports = {
+    upsert: upsert,
+    get: get,
+    del: del,
+    waitForDns: require('./waitfordns.js'),
+    verifyDnsConfig: verifyDnsConfig
+};
+
+var assert = require('assert'),
+    debug = require('debug')('box:dns/namecom'),
+    dns = require('../native-dns.js'),
+    safe = require('safetydance'),
+    DomainsError = require('../domains.js').DomainsError,
+    superagent = require('superagent');
+
+const NAMECOM_API = 'https://api.name.com/v4';
+
+function formatError(response) {
+    return `Name.com DNS error [${response.statusCode}] ${response.text}`;
+}
+
+function addRecord(dnsConfig, zoneName, subdomain, type, values, callback) {
+    assert.strictEqual(typeof dnsConfig, 'object');
+    assert.strictEqual(typeof zoneName, 'string');
+    assert.strictEqual(typeof subdomain, 'string');
+    assert.strictEqual(typeof type, 'string');
+    assert(Array.isArray(values));
+    assert.strictEqual(typeof callback, 'function');
+
+    debug(`add: ${subdomain} in zone ${zoneName} of type ${type} with values ${JSON.stringify(values)}`);
+
+    var data = {
+        host: subdomain,
+        type: type,
+        answer: values[0],
+        ttl: 300    // 300 is the lowest
+    };
+
+    superagent.post(`${NAMECOM_API}/domains/${zoneName}/records`)
+        .auth(dnsConfig.username, dnsConfig.token)
+        .timeout(30 * 1000)
+        .send(data)
+        .end(function (error, result) {
+            if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, `Network error ${error.message}`));
+            if (result.statusCode === 403) return callback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
+            if (result.statusCode !== 200) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));
+
+            return callback(null, 'unused-id');
+        });
+    }
+
+function updateRecord(dnsConfig, zoneName, recordId, subdomain, type, values, callback) {
+    assert.strictEqual(typeof dnsConfig, 'object');
+    assert.strictEqual(typeof zoneName, 'string');
+    assert.strictEqual(typeof recordId, 'number');
+    assert.strictEqual(typeof subdomain, 'string');
+    assert.strictEqual(typeof type, 'string');
+    assert(Array.isArray(values));
+    assert.strictEqual(typeof callback, 'function');
+
+    debug(`update:${recordId} on ${subdomain} in zone ${zoneName} of type ${type} with values ${JSON.stringify(values)}`);
+
+    var data = {
+        host: subdomain,
+        type: type,
+        answer: values[0],
+        ttl: 300    // 300 is the lowest
+    };
+
+    superagent.put(`${NAMECOM_API}/domains/${zoneName}/records/${recordId}`)
+        .auth(dnsConfig.username, dnsConfig.token)
+        .timeout(30 * 1000)
+        .send(data)
+        .end(function (error, result) {
+            if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, `Network error ${error.message}`));
+            if (result.statusCode === 403) return callback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
+            if (result.statusCode !== 200) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));
+
+            return callback(null, 'unused-id');
+        });
+}
+
+function getInternal(dnsConfig, zoneName, subdomain, type, callback) {
+    assert.strictEqual(typeof dnsConfig, 'object');
+    assert.strictEqual(typeof zoneName, 'string');
+    assert.strictEqual(typeof subdomain, 'string');
+    assert.strictEqual(typeof type, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    subdomain = subdomain || '@';
+
+    debug(`getInternal: ${subdomain} in zone ${zoneName} of type ${type}`);
+
+    superagent.get(`${NAMECOM_API}/domains/${zoneName}/records`)
+        .auth(dnsConfig.username, dnsConfig.token)
+        .timeout(30 * 1000)
+        .end(function (error, result) {
+            if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, `Network error ${error.message}`));
+            if (result.statusCode === 403) return callback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
+            if (result.statusCode !== 200) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));
+
+            // name.com does not return the correct content-type
+            result.body = safe.JSON.parse(result.text);
+            if (!result.body.records) result.body.records = [];
+
+            result.body.records.forEach(function (r) {
+                // name.com api simply strips empty properties
+                r.host = r.host || '@';
+            });
+
+            var results = result.body.records.filter(function (r) {
+                return (r.host === subdomain && r.type === type);
+            });
+
+            debug('getInternal: %j', results);
+
+            return callback(null, results);
+        });
+}
+
+function upsert(dnsConfig, zoneName, subdomain, type, values, callback) {
+    assert.strictEqual(typeof dnsConfig, 'object');
+    assert.strictEqual(typeof zoneName, 'string');
+    assert.strictEqual(typeof subdomain, 'string');
+    assert.strictEqual(typeof type, 'string');
+    assert(Array.isArray(values));
+    assert.strictEqual(typeof callback, 'function');
+
+    subdomain = subdomain || '@';
+
+    debug(`upsert: ${subdomain} in zone ${zoneName} of type ${type} with values ${JSON.stringify(values)}`);
+
+    getInternal(dnsConfig, zoneName, subdomain, type, function (error, result) {
+        if (error) return callback(error);
+
+        if (result.length === 0) return addRecord(dnsConfig, zoneName, subdomain, type, values, callback);
+
+        return updateRecord(dnsConfig, zoneName, result[0].id, subdomain, type, values, callback);
+    });
+}
+
+function get(dnsConfig, zoneName, subdomain, type, callback) {
+    assert.strictEqual(typeof dnsConfig, 'object');
+    assert.strictEqual(typeof zoneName, 'string');
+    assert.strictEqual(typeof subdomain, 'string');
+    assert.strictEqual(typeof type, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    getInternal(dnsConfig, zoneName, subdomain, type, function (error, result) {
+        if (error) return callback(error);
+
+        var tmp = result.map(function (record) { return record.answer; });
+
+        debug('get: %j', tmp);
+
+        return callback(null, tmp);
+    });
+}
+
+function del(dnsConfig, zoneName, subdomain, type, values, callback) {
+    assert.strictEqual(typeof dnsConfig, 'object');
+    assert.strictEqual(typeof zoneName, 'string');
+    assert.strictEqual(typeof subdomain, 'string');
+    assert.strictEqual(typeof type, 'string');
+    assert(Array.isArray(values));
+    assert.strictEqual(typeof callback, 'function');
+
+    subdomain = subdomain || '@';
+
+    debug(`del: ${subdomain} in zone ${zoneName} of type ${type} with values ${JSON.stringify(values)}`);
+
+    getInternal(dnsConfig, zoneName, subdomain, type, function (error, result) {
+        if (error) return callback(error);
+
+        if (result.length === 0) return callback();
+
+        superagent.del(`${NAMECOM_API}/domains/${zoneName}/records/${result[0].id}`)
+            .auth(dnsConfig.username, dnsConfig.token)
+            .timeout(30 * 1000)
+            .end(function (error, result) {
+                if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, `Network error ${error.message}`));
+                if (result.statusCode === 403) return callback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
+                if (result.statusCode !== 200) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));
+
+                return callback(null);
+            });
+    });
+}
+
+function verifyDnsConfig(dnsConfig, fqdn, zoneName, ip, callback) {
+    assert.strictEqual(typeof dnsConfig, 'object');
+    assert.strictEqual(typeof fqdn, 'string');
+    assert.strictEqual(typeof zoneName, 'string');
+    assert.strictEqual(typeof ip, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    var credentials = {
+        username: dnsConfig.username,
+        token: dnsConfig.token
+    };
+
+    if (process.env.BOX_ENV === 'test') return callback(null, credentials); // this shouldn't be here
+
+    dns.resolve(zoneName, 'NS', { timeout: 5000 }, function (error, nameservers) {
+        if (error && error.code === 'ENOTFOUND') return callback(new DomainsError(DomainsError.BAD_FIELD, 'Unable to resolve nameservers for this domain'));
+        if (error || !nameservers) return callback(new DomainsError(DomainsError.BAD_FIELD, error ? error.message : 'Unable to get nameservers'));
+
+        if (!nameservers.every(function (n) { return n.toLowerCase().indexOf('.name.com') !== -1; })) {
+            debug('verifyDnsConfig: %j does not contain Name.com NS', nameservers);
+            return callback(new DomainsError(DomainsError.BAD_FIELD, 'Domain nameservers are not set to Name.com'));
+        }
+
+        const testSubdomain = 'cloudrontestdns';
+
+        upsert(credentials, zoneName, testSubdomain, 'A', [ ip ], function (error, changeId) {
+            if (error) return callback(error);
+
+            debug('verifyDnsConfig: Test A record added with change id %s', changeId);
+
+            del(dnsConfig, zoneName, testSubdomain, 'A', [ ip ], function (error) {
+                if (error) return callback(error);
+
+                debug('verifyDnsConfig: Test A record removed again');
+
+                callback(null, credentials);
+            });
+        });
+    });
+}
@@ -15,7 +15,7 @@ var assert = require('assert'),
    AWS = require('aws-sdk'),
    debug = require('debug')('box:dns/route53'),
    dns = require('../native-dns.js'),
-    DomainError = require('../domains.js').DomainError,
+    DomainsError = require('../domains.js').DomainsError,
    util = require('util'),
    _ = require('underscore');

@@ -39,16 +39,25 @@ function getZoneByName(dnsConfig, zoneName, callback) {
    assert.strictEqual(typeof callback, 'function');

    var route53 = new AWS.Route53(getDnsCredentials(dnsConfig));
-    route53.listHostedZones({}, function (error, result) {
-        if (error && error.code === 'AccessDenied') return callback(new DomainError(DomainError.ACCESS_DENIED, error.message));
-        if (error && error.code === 'InvalidClientTokenId') return callback(new DomainError(DomainError.ACCESS_DENIED, error.message));
-        if (error) return callback(new DomainError(DomainError.EXTERNAL_ERROR, error.message));
+
+    // backward compat for 2.2, where we only required access to "listHostedZones"
+    let listHostedZones;
+    if (dnsConfig.listHostedZonesByName) {
+        listHostedZones = route53.listHostedZonesByName.bind(route53, { MaxItems: '1', DNSName: zoneName + '.' });
+    } else {
+        listHostedZones = route53.listHostedZones.bind(route53, {}); // currently, this route does not support > 100 zones
+    }
+
+    listHostedZones(function (error, result) {
+        if (error && error.code === 'AccessDenied') return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
+        if (error && error.code === 'InvalidClientTokenId') return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
+        if (error) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, error.message));

        var zone = result.HostedZones.filter(function (zone) {
            return zone.Name.slice(0, -1) === zoneName;     // aws zone name contains a '.' at the end
        })[0];

-        if (!zone) return callback(new DomainError(DomainError.NOT_FOUND, 'no such zone'));
+        if (!zone) return callback(new DomainsError(DomainsError.NOT_FOUND, 'no such zone'));

        callback(null, zone);
    });
@@ -64,9 +73,9 @@ function getHostedZone(dnsConfig, zoneName, callback) {

        var route53 = new AWS.Route53(getDnsCredentials(dnsConfig));
        route53.getHostedZone({ Id: zone.Id }, function (error, result) {
-            if (error && error.code === 'AccessDenied') return callback(new DomainError(DomainError.ACCESS_DENIED, error.message));
-            if (error && error.code === 'InvalidClientTokenId') return callback(new DomainError(DomainError.ACCESS_DENIED, error.message));
-            if (error) return callback(new DomainError(DomainError.EXTERNAL_ERROR, error.message));
+            if (error && error.code === 'AccessDenied') return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
+            if (error && error.code === 'InvalidClientTokenId') return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
+            if (error) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, error.message));

            callback(null, result);
        });
@@ -87,7 +96,7 @@ function add(dnsConfig, zoneName, subdomain, type, values, callback) {
        if (error) return callback(error);

        var fqdn = subdomain === '' ? zoneName : subdomain + '.' + zoneName;
-        var records = values.map(function (v) { return { Value: v }; });
+        var records = values.map(function (v) { return { Value: v }; });  // for mx records, value is already of the '<priority> <server>' format

        var params = {
            ChangeBatch: {
@@ -106,11 +115,11 @@ function add(dnsConfig, zoneName, subdomain, type, values, callback) {

        var route53 = new AWS.Route53(getDnsCredentials(dnsConfig));
        route53.changeResourceRecordSets(params, function(error, result) {
-            if (error && error.code === 'AccessDenied') return callback(new DomainError(DomainError.ACCESS_DENIED, error.message));
-            if (error && error.code === 'InvalidClientTokenId') return callback(new DomainError(DomainError.ACCESS_DENIED, error.message));
-            if (error && error.code === 'PriorRequestNotComplete') return callback(new DomainError(DomainError.STILL_BUSY, error.message));
-            if (error && error.code === 'InvalidChangeBatch') return callback(new DomainError(DomainError.BAD_FIELD, error.message));
-            if (error) return callback(new DomainError(DomainError.EXTERNAL_ERROR, error.message));
+            if (error && error.code === 'AccessDenied') return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
+            if (error && error.code === 'InvalidClientTokenId') return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
+            if (error && error.code === 'PriorRequestNotComplete') return callback(new DomainsError(DomainsError.STILL_BUSY, error.message));
+            if (error && error.code === 'InvalidChangeBatch') return callback(new DomainsError(DomainsError.BAD_FIELD, error.message));
+            if (error) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, error.message));

            callback(null, result.ChangeInfo.Id);
        });
@@ -147,9 +156,9 @@ function get(dnsConfig, zoneName, subdomain, type, callback) {

        var route53 = new AWS.Route53(getDnsCredentials(dnsConfig));
        route53.listResourceRecordSets(params, function (error, result) {
-            if (error && error.code === 'AccessDenied') return callback(new DomainError(DomainError.ACCESS_DENIED, error.message));
-            if (error && error.code === 'InvalidClientTokenId') return callback(new DomainError(DomainError.ACCESS_DENIED, error.message));
-            if (error) return callback(new DomainError(DomainError.EXTERNAL_ERROR, error.message));
+            if (error && error.code === 'AccessDenied') return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
+            if (error && error.code === 'InvalidClientTokenId') return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
+            if (error) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, error.message));
            if (result.ResourceRecordSets.length === 0) return callback(null, [ ]);
            if (result.ResourceRecordSets[0].Name !== params.StartRecordName || result.ResourceRecordSets[0].Type !== params.StartRecordType) return callback(null, [ ]);

@@ -193,23 +202,23 @@ function del(dnsConfig, zoneName, subdomain, type, values, callback) {

        var route53 = new AWS.Route53(getDnsCredentials(dnsConfig));
        route53.changeResourceRecordSets(params, function(error) {
-            if (error && error.code === 'AccessDenied') return callback(new DomainError(DomainError.ACCESS_DENIED, error.message));
-            if (error && error.code === 'InvalidClientTokenId') return callback(new DomainError(DomainError.ACCESS_DENIED, error.message));
+            if (error && error.code === 'AccessDenied') return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
+            if (error && error.code === 'InvalidClientTokenId') return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
            if (error && error.message && error.message.indexOf('it was not found') !== -1) {
                debug('del: resource record set not found.', error);
-                return callback(new DomainError(DomainError.NOT_FOUND, error.message));
+                return callback(new DomainsError(DomainsError.NOT_FOUND, error.message));
            } else if (error && error.code === 'NoSuchHostedZone') {
                debug('del: hosted zone not found.', error);
-                return callback(new DomainError(DomainError.NOT_FOUND, error.message));
+                return callback(new DomainsError(DomainsError.NOT_FOUND, error.message));
            } else if (error && error.code === 'PriorRequestNotComplete') {
                debug('del: resource is still busy', error);
-                return callback(new DomainError(DomainError.STILL_BUSY, error.message));
+                return callback(new DomainsError(DomainsError.STILL_BUSY, error.message));
            } else if (error && error.code === 'InvalidChangeBatch') {
                debug('del: invalid change batch. No such record to be deleted.');
-                return callback(new DomainError(DomainError.NOT_FOUND, error.message));
+                return callback(new DomainsError(DomainsError.NOT_FOUND, error.message));
            } else if (error) {
                debug('del: error', error);
-                return callback(new DomainError(DomainError.EXTERNAL_ERROR, error.message));
+                return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, error.message));
            }

            callback(null);
@@ -228,21 +237,22 @@ function verifyDnsConfig(dnsConfig, fqdn, zoneName, ip, callback) {
        accessKeyId: dnsConfig.accessKeyId,
        secretAccessKey: dnsConfig.secretAccessKey,
        region: dnsConfig.region || 'us-east-1',
-        endpoint: dnsConfig.endpoint || null
+        endpoint: dnsConfig.endpoint || null,
+        listHostedZonesByName: true // new/updated creds require this perm
    };

    if (process.env.BOX_ENV === 'test') return callback(null, credentials); // this shouldn't be here

    dns.resolve(zoneName, 'NS', { timeout: 5000 }, function (error, nameservers) {
-        if (error && error.code === 'ENOTFOUND') return callback(new DomainError(DomainError.BAD_FIELD, 'Unable to resolve nameservers for this domain'));
-        if (error || !nameservers) return callback(new DomainError(DomainError.BAD_FIELD, error ? error.message : 'Unable to get nameservers'));
+        if (error && error.code === 'ENOTFOUND') return callback(new DomainsError(DomainsError.BAD_FIELD, 'Unable to resolve nameservers for this domain'));
+        if (error || !nameservers) return callback(new DomainsError(DomainsError.BAD_FIELD, error ? error.message : 'Unable to get nameservers'));

        getHostedZone(credentials, zoneName, function (error, zone) {
            if (error) return callback(error);

            if (!_.isEqual(zone.DelegationSet.NameServers.sort(), nameservers.sort())) {
                debug('verifyDnsConfig: %j and %j do not match', nameservers, zone.DelegationSet.NameServers);
-                return callback(new DomainError(DomainError.BAD_FIELD, 'Domain nameservers are not set to Route53'));
+                return callback(new DomainsError(DomainsError.BAD_FIELD, 'Domain nameservers are not set to Route53'));
            }

            const testSubdomain = 'cloudrontestdns';
@@ -252,7 +262,7 @@ function verifyDnsConfig(dnsConfig, fqdn, zoneName, ip, callback) {

                debug('verifyDnsConfig: Test A record added with change id %s', changeId);

-                del(dnsConfig, zoneName, testSubdomain, 'A', [ ip ], function (error) {
+                del(credentials, zoneName, testSubdomain, 'A', [ ip ], function (error) {
                    if (error) return callback(error);

                    debug('verifyDnsConfig: Test A record removed again');
@@ -6,7 +6,7 @@ var assert = require('assert'),
    async = require('async'),
    debug = require('debug')('box:dns/waitfordns'),
    dns = require('../native-dns.js'),
-    DomainError = require('../domains.js').DomainError;
+    DomainsError = require('../domains.js').DomainsError;

 function resolveIp(hostname, options, callback) {
    assert.strictEqual(typeof hostname, 'string');
@@ -80,12 +80,12 @@ function waitForDns(domain, zoneName, value, options, callback) {
        debug(`waitForDns (try ${attempt}): ${domain} to be ${value} in zone ${zoneName}`);

        dns.resolve(zoneName, 'NS', { timeout: 5000 }, function (error, nameservers) {
-            if (error || !nameservers) return retryCallback(error || new DomainError(DomainError.EXTERNAL_ERROR, 'Unable to get nameservers'));
+            if (error || !nameservers) return retryCallback(error || new DomainsError(DomainsError.EXTERNAL_ERROR, 'Unable to get nameservers'));

            async.every(nameservers, isChangeSynced.bind(null, domain, value), function (error, synced) {
                debug('waitForDns: %s %s ns: %j', domain, synced ? 'done' : 'not done', nameservers);

-                retryCallback(synced ? null : new DomainError(DomainError.EXTERNAL_ERROR, 'ETRYAGAIN'));
+                retryCallback(synced ? null : new DomainsError(DomainsError.EXTERNAL_ERROR, 'ETRYAGAIN'));
            });
        });
    }, function retryDone(error) {
@@ -16,7 +16,9 @@ module.exports = exports = {

    waitForDnsRecord: waitForDnsRecord,

-    DomainError: DomainError
+    removePrivateFields: removePrivateFields,
+
+    DomainsError: DomainsError
 };

 var assert = require('assert'),
@@ -32,12 +34,13 @@ var assert = require('assert'),
    shell = require('./shell.js'),
    sysinfo = require('./sysinfo.js'),
    tld = require('tldjs'),
-    util = require('util');
+    util = require('util'),
+    _ = require('underscore');

 var RESTART_CMD = path.join(__dirname, 'scripts/restart.sh');
 var NOOP_CALLBACK = function (error) { if (error) debug(error); };

-function DomainError(reason, errorOrMessage) {
+function DomainsError(reason, errorOrMessage) {
    assert.strictEqual(typeof reason, 'string');
    assert(errorOrMessage instanceof Error || typeof errorOrMessage === 'string' || typeof errorOrMessage === 'undefined');

@@ -55,17 +58,17 @@ function DomainError(reason, errorOrMessage) {
        this.nestedError = errorOrMessage;
    }
 }
-util.inherits(DomainError, Error);
+util.inherits(DomainsError, Error);

-DomainError.NOT_FOUND = 'No such domain';
-DomainError.ALREADY_EXISTS = 'Domain already exists';
-DomainError.EXTERNAL_ERROR = 'External error';
-DomainError.BAD_FIELD = 'Bad Field';
-DomainError.STILL_BUSY = 'Still busy';
-DomainError.IN_USE = 'In Use';
-DomainError.INTERNAL_ERROR = 'Internal error';
-DomainError.ACCESS_DENIED = 'Access denied';
-DomainError.INVALID_PROVIDER = 'provider must be route53, gcdns, digitalocean, cloudflare, noop, manual or caas';
+DomainsError.NOT_FOUND = 'No such domain';
+DomainsError.ALREADY_EXISTS = 'Domain already exists';
+DomainsError.EXTERNAL_ERROR = 'External error';
+DomainsError.BAD_FIELD = 'Bad Field';
+DomainsError.STILL_BUSY = 'Still busy';
+DomainsError.IN_USE = 'In Use';
+DomainsError.INTERNAL_ERROR = 'Internal error';
+DomainsError.ACCESS_DENIED = 'Access denied';
+DomainsError.INVALID_PROVIDER = 'provider must be route53, gcdns, digitalocean, gandi, cloudflare, namecom, noop, manual or caas';

 // choose which subdomain backend we use for test purpose we use route53
 function api(provider) {
@@ -77,6 +80,9 @@ function api(provider) {
    case 'route53': return require('./dns/route53.js');
    case 'gcdns': return require('./dns/gcdns.js');
    case 'digitalocean': return require('./dns/digitalocean.js');
+    case 'gandi': return require('./dns/gandi.js');
+    case 'godaddy': return require('./dns/godaddy.js');
+    case 'namecom': return require('./dns/namecom.js');
    case 'noop': return require('./dns/noop.js');
    case 'manual': return require('./dns/manual.js');
    default: return null;
@@ -92,7 +98,7 @@ function verifyDnsConfig(config, domain, zoneName, provider, ip, callback) {
    assert.strictEqual(typeof callback, 'function');

    var backend = api(provider);
-    if (!backend) return callback(new DomainError(DomainError.INVALID_PROVIDER));
+    if (!backend) return callback(new DomainsError(DomainsError.INVALID_PROVIDER));

    api(provider).verifyDnsConfig(config, domain, zoneName, ip, callback);
 }
@@ -107,40 +113,40 @@ function add(domain, zoneName, provider, config, fallbackCertificate, tlsConfig,
    assert.strictEqual(typeof tlsConfig, 'object');
    assert.strictEqual(typeof callback, 'function');

-    if (!tld.isValid(domain)) return callback(new DomainError(DomainError.BAD_FIELD, 'Invalid domain'));
+    if (!tld.isValid(domain)) return callback(new DomainsError(DomainsError.BAD_FIELD, 'Invalid domain'));

    if (zoneName) {
-        if (!tld.isValid(zoneName)) return callback(new DomainError(DomainError.BAD_FIELD, 'Invalid zoneName'));
+        if (!tld.isValid(zoneName)) return callback(new DomainsError(DomainsError.BAD_FIELD, 'Invalid zoneName'));
    } else {
        zoneName = tld.getDomain(domain) || domain;
    }

    if (fallbackCertificate) {
        let error = reverseProxy.validateCertificate(`test.${domain}`, fallbackCertificate.cert, fallbackCertificate.key);
-        if (error) return callback(new DomainError(DomainError.BAD_FIELD, error.message));
+        if (error) return callback(new DomainsError(DomainsError.BAD_FIELD, error.message));
    }

    if (tlsConfig.provider !== 'fallback' && tlsConfig.provider !== 'caas' && tlsConfig.provider.indexOf('letsencrypt-') !== 0) {
-        return callback(new DomainError(DomainError.BAD_FIELD, 'tlsConfig.provider must be caas, fallback or le-*'));
+        return callback(new DomainsError(DomainsError.BAD_FIELD, 'tlsConfig.provider must be caas, fallback or le-*'));
    }

    sysinfo.getPublicIp(function (error, ip) {
-        if (error) return callback(new DomainError(DomainError.INTERNAL_ERROR, 'Error getting IP:' + error.message));
+        if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, 'Error getting IP:' + error.message));

        verifyDnsConfig(config, domain, zoneName, provider, ip, function (error, result) {
-            if (error && error.reason === DomainError.ACCESS_DENIED) return callback(new DomainError(DomainError.BAD_FIELD, 'Error adding A record. Access denied'));
-            if (error && error.reason === DomainError.NOT_FOUND) return callback(new DomainError(DomainError.BAD_FIELD, 'Zone not found'));
-            if (error && error.reason === DomainError.EXTERNAL_ERROR) return callback(new DomainError(DomainError.BAD_FIELD, 'Error adding A record:' + error.message));
-            if (error && error.reason === DomainError.BAD_FIELD) return callback(new DomainError(DomainError.BAD_FIELD, error.message));
-            if (error && error.reason === DomainError.INVALID_PROVIDER) return callback(new DomainError(DomainError.BAD_FIELD, error.message));
-            if (error) return callback(new DomainError(DomainError.INTERNAL_ERROR, error));
+            if (error && error.reason === DomainsError.ACCESS_DENIED) return callback(new DomainsError(DomainsError.BAD_FIELD, 'Error adding A record. Access denied'));
+            if (error && error.reason === DomainsError.NOT_FOUND) return callback(new DomainsError(DomainsError.BAD_FIELD, 'Zone not found'));
+            if (error && error.reason === DomainsError.EXTERNAL_ERROR) return callback(new DomainsError(DomainsError.BAD_FIELD, 'Error adding A record: ' + error.message));
+            if (error && error.reason === DomainsError.BAD_FIELD) return callback(new DomainsError(DomainsError.BAD_FIELD, error.message));
+            if (error && error.reason === DomainsError.INVALID_PROVIDER) return callback(new DomainsError(DomainsError.BAD_FIELD, error.message));
+            if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));

            domaindb.add(domain, { zoneName: zoneName, provider: provider, config: result, tlsConfig: tlsConfig }, function (error) {
-                if (error && error.reason === DatabaseError.ALREADY_EXISTS) return callback(new DomainError(DomainError.ALREADY_EXISTS));
-                if (error) return callback(new DomainError(DomainError.INTERNAL_ERROR, error));
+                if (error && error.reason === DatabaseError.ALREADY_EXISTS) return callback(new DomainsError(DomainsError.ALREADY_EXISTS));
+                if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));

                reverseProxy.setFallbackCertificate(domain, fallbackCertificate, function (error) {
-                    if (error) return callback(new DomainError(DomainError.INTERNAL_ERROR, error));
+                    if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));

                    callback();
                });
@@ -155,16 +161,16 @@ function get(domain, callback) {

    domaindb.get(domain, function (error, result) {
        // TODO try to find subdomain entries maybe based on zoneNames or so
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new DomainError(DomainError.NOT_FOUND));
-        if (error) return callback(new DomainError(DomainError.INTERNAL_ERROR, error));
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new DomainsError(DomainsError.NOT_FOUND));
+        if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));

        reverseProxy.getFallbackCertificate(domain, function (error, bundle) {
-            if (error && error.reason !== ReverseProxyError.NOT_FOUND) return callback(new DomainError(DomainError.INTERNAL_ERROR, error));
+            if (error && error.reason !== ReverseProxyError.NOT_FOUND) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));

            var cert = safe.fs.readFileSync(bundle.certFilePath, 'utf-8');
            var key = safe.fs.readFileSync(bundle.keyFilePath, 'utf-8');

-            if (!cert || !key) return callback(new DomainError(DomainError.INTERNAL_ERROR, 'unable to read certificates from disk'));
+            if (!cert || !key) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, 'unable to read certificates from disk'));

            result.fallbackCertificate = { cert: cert, key: key };

@@ -177,14 +183,15 @@ function getAll(callback) {
    assert.strictEqual(typeof callback, 'function');

    domaindb.getAll(function (error, result) {
-        if (error) return callback(new DomainError(DomainError.INTERNAL_ERROR, error));
+        if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));

        return callback(null, result);
    });
 }

-function update(domain, provider, config, fallbackCertificate, tlsConfig, callback) {
+function update(domain, zoneName, provider, config, fallbackCertificate, tlsConfig, callback) {
    assert.strictEqual(typeof domain, 'string');
+    assert.strictEqual(typeof zoneName, 'string');
    assert.strictEqual(typeof provider, 'string');
    assert.strictEqual(typeof config, 'object');
    assert.strictEqual(typeof fallbackCertificate, 'object');
@@ -192,37 +199,43 @@ function update(domain, provider, config, fallbackCertificate, tlsConfig, callba
    assert.strictEqual(typeof callback, 'function');

    domaindb.get(domain, function (error, result) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new DomainError(DomainError.NOT_FOUND));
-        if (error) return callback(new DomainError(DomainError.INTERNAL_ERROR, error));
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new DomainsError(DomainsError.NOT_FOUND));
+        if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));
+
+        if (zoneName) {
+            if (!tld.isValid(zoneName)) return callback(new DomainsError(DomainsError.BAD_FIELD, 'Invalid zoneName'));
+        } else {
+            zoneName = result.zoneName;
+        }

        if (fallbackCertificate) {
            let error = reverseProxy.validateCertificate(`test.${domain}`, fallbackCertificate.cert, fallbackCertificate.key);
-            if (error) return callback(new DomainError(DomainError.BAD_FIELD, error.message));
+            if (error) return callback(new DomainsError(DomainsError.BAD_FIELD, error.message));
        }

        if (tlsConfig.provider !== 'fallback' && tlsConfig.provider !== 'caas' && tlsConfig.provider.indexOf('letsencrypt-') !== 0) {
-            return callback(new DomainError(DomainError.BAD_FIELD, 'tlsConfig.provider must be caas, fallback or letsencrypt-*'));
+            return callback(new DomainsError(DomainsError.BAD_FIELD, 'tlsConfig.provider must be caas, fallback or letsencrypt-*'));
        }

        sysinfo.getPublicIp(function (error, ip) {
-            if (error) return callback(new DomainError(DomainError.INTERNAL_ERROR, 'Error getting IP:' + error.message));
+            if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, 'Error getting IP:' + error.message));

-            verifyDnsConfig(config, domain, result.zoneName, provider, ip, function (error, result) {
-                if (error && error.reason === DomainError.ACCESS_DENIED) return callback(new DomainError(DomainError.BAD_FIELD, 'Error adding A record. Access denied'));
-                if (error && error.reason === DomainError.NOT_FOUND) return callback(new DomainError(DomainError.BAD_FIELD, 'Zone not found'));
-                if (error && error.reason === DomainError.EXTERNAL_ERROR) return callback(new DomainError(DomainError.BAD_FIELD, 'Error adding A record:' + error.message));
-                if (error && error.reason === DomainError.BAD_FIELD) return callback(new DomainError(DomainError.BAD_FIELD, error.message));
-                if (error && error.reason === DomainError.INVALID_PROVIDER) return callback(new DomainError(DomainError.BAD_FIELD, error.message));
-                if (error) return callback(new DomainError(DomainError.INTERNAL_ERROR, error));
+            verifyDnsConfig(config, domain, zoneName, provider, ip, function (error, result) {
+                if (error && error.reason === DomainsError.ACCESS_DENIED) return callback(new DomainsError(DomainsError.BAD_FIELD, 'Error adding A record. Access denied'));
+                if (error && error.reason === DomainsError.NOT_FOUND) return callback(new DomainsError(DomainsError.BAD_FIELD, 'Zone not found'));
+                if (error && error.reason === DomainsError.EXTERNAL_ERROR) return callback(new DomainsError(DomainsError.BAD_FIELD, 'Error adding A record:' + error.message));
+                if (error && error.reason === DomainsError.BAD_FIELD) return callback(new DomainsError(DomainsError.BAD_FIELD, error.message));
+                if (error && error.reason === DomainsError.INVALID_PROVIDER) return callback(new DomainsError(DomainsError.BAD_FIELD, error.message));
+                if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));

-                domaindb.update(domain, { provider: provider, config: result, tlsConfig: tlsConfig }, function (error) {
-                    if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new DomainError(DomainError.NOT_FOUND));
-                    if (error) return callback(new DomainError(DomainError.INTERNAL_ERROR, error));
+                domaindb.update(domain, { zoneName: zoneName, provider: provider, config: result, tlsConfig: tlsConfig }, function (error) {
+                    if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new DomainsError(DomainsError.NOT_FOUND));
+                    if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));

                    if (!fallbackCertificate) return callback();

                    reverseProxy.setFallbackCertificate(domain, fallbackCertificate, function (error) {
-                        if (error) return callback(new DomainError(DomainError.INTERNAL_ERROR, error));
+                        if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));

                        callback();
                    });
@@ -237,9 +250,9 @@ function del(domain, callback) {
    assert.strictEqual(typeof callback, 'function');

    domaindb.del(domain, function (error) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new DomainError(DomainError.NOT_FOUND));
-        if (error && error.reason === DatabaseError.IN_USE) return callback(new DomainError(DomainError.IN_USE));
-        if (error) return callback(new DomainError(DomainError.INTERNAL_ERROR, error));
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new DomainsError(DomainsError.NOT_FOUND));
+        if (error && error.reason === DatabaseError.IN_USE) return callback(new DomainsError(DomainsError.IN_USE));
+        if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));

        return callback(null);
    });
@@ -263,7 +276,7 @@ function getDnsRecords(subdomain, domain, type, callback) {
    assert.strictEqual(typeof callback, 'function');

    get(domain, function (error, result) {
-        if (error) return callback(new DomainError(DomainError.INTERNAL_ERROR, error));
+        if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));

        api(result.provider).get(result.config, result.zoneName, getName(result, subdomain), type, function (error, values) {
            if (error) return callback(error);
@@ -283,7 +296,7 @@ function upsertDnsRecords(subdomain, domain, type, values, callback) {
    debug('upsertDNSRecord: %s on %s type %s values', subdomain, domain, type, values);

    get(domain, function (error, result) {
-        if (error) return callback(new DomainError(DomainError.INTERNAL_ERROR, error));
+        if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));

        api(result.provider).upsert(result.config, result.zoneName, getName(result, subdomain), type, values, function (error, changeId) {
            if (error) return callback(error);
@@ -306,7 +319,7 @@ function removeDnsRecords(subdomain, domain, type, values, callback) {
        if (error) return callback(error);

        api(result.provider).del(result.config, result.zoneName, getName(result, subdomain), type, values, function (error) {
-            if (error && error.reason !== DomainError.NOT_FOUND) return callback(error);
+            if (error && error.reason !== DomainsError.NOT_FOUND) return callback(error);

            callback(null);
        });
@@ -340,7 +353,7 @@ function setAdmin(domain, callback) {
        var setPtrRecord = config.provider() === 'caas' ? caas.setPtrRecord : function (d, next) { next(); };

        setPtrRecord(domain, function (error) {
-            if (error) return callback(new DomainError(DomainError.EXTERNAL_ERROR, 'Error setting PTR record:' + error.message));
+            if (error) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, 'Error setting PTR record:' + error.message));

            config.setAdminDomain(result.domain);
            config.setAdminLocation('my');
@@ -357,3 +370,8 @@ function fqdn(location, domain, provider) {
    return location + (location ? (provider !== 'caas' ? '.' : '-') : '') + domain;
 }

+function removePrivateFields(domain) {
+    var result = _.pick(domain, 'domain', 'zoneName', 'provider', 'config', 'tlsConfig', 'fallbackCertificate');
+    if (result.fallbackCertificate) delete result.fallbackCertificate.key;  // do not return the 'key'. in caas, this is private
+    return result;
+}
@@ -1,7 +1,7 @@
 'use strict';

 exports = module.exports = {
-    GroupError: GroupError,
+    GroupsError: GroupsError,

    create: create,
    remove: remove,
@@ -29,7 +29,7 @@ var assert = require('assert'),

 // http://dustinsenos.com/articles/customErrorsInNode
 // http://code.google.com/p/v8/wiki/JavaScriptStackTraceApi
-function GroupError(reason, errorOrMessage) {
+function GroupsError(reason, errorOrMessage) {
    assert.strictEqual(typeof reason, 'string');
    assert(errorOrMessage instanceof Error || typeof errorOrMessage === 'string' || typeof errorOrMessage === 'undefined');

@@ -47,28 +47,28 @@ function GroupError(reason, errorOrMessage) {
        this.nestedError = errorOrMessage;
    }
 }
-util.inherits(GroupError, Error);
-GroupError.INTERNAL_ERROR = 'Internal Error';
-GroupError.ALREADY_EXISTS = 'Already Exists';
-GroupError.NOT_FOUND = 'Not Found';
-GroupError.BAD_FIELD = 'Field error';
-GroupError.NOT_EMPTY = 'Not Empty';
-GroupError.NOT_ALLOWED = 'Not Allowed';
+util.inherits(GroupsError, Error);
+GroupsError.INTERNAL_ERROR = 'Internal Error';
+GroupsError.ALREADY_EXISTS = 'Already Exists';
+GroupsError.NOT_FOUND = 'Not Found';
+GroupsError.BAD_FIELD = 'Field error';
+GroupsError.NOT_EMPTY = 'Not Empty';
+GroupsError.NOT_ALLOWED = 'Not Allowed';

 // keep this in sync with validateUsername
 function validateGroupname(name) {
    assert.strictEqual(typeof name, 'string');

-    if (name.length < 1) return new GroupError(GroupError.BAD_FIELD, 'name must be atleast 1 char');
-    if (name.length >= 200) return new GroupError(GroupError.BAD_FIELD, 'name too long');
+    if (name.length < 1) return new GroupsError(GroupsError.BAD_FIELD, 'name must be atleast 1 char');
+    if (name.length >= 200) return new GroupsError(GroupsError.BAD_FIELD, 'name too long');

-    if (constants.RESERVED_NAMES.indexOf(name) !== -1) return new GroupError(GroupError.BAD_FIELD, 'name is reserved');
+    if (constants.RESERVED_NAMES.indexOf(name) !== -1) return new GroupsError(GroupsError.BAD_FIELD, 'name is reserved');

    // +/- can be tricky in emails. also need to consider valid LDAP characters here (e.g '+' is reserved)
-    if (/[^a-zA-Z0-9.]/.test(name)) return new GroupError(GroupError.BAD_FIELD, 'name can only contain alphanumerals and dot');
+    if (/[^a-zA-Z0-9.]/.test(name)) return new GroupsError(GroupsError.BAD_FIELD, 'name can only contain alphanumerals and dot');

    // app emails are sent using the .app suffix
-    if (name.indexOf('.app') !== -1) return new GroupError(GroupError.BAD_FIELD, 'name pattern is reserved for apps');
+    if (name.indexOf('.app') !== -1) return new GroupsError(GroupsError.BAD_FIELD, 'name pattern is reserved for apps');

    return null;
 }
@@ -85,8 +85,8 @@ function create(name, callback) {

    var id = 'gid-' + uuid.v4();
    groupdb.add(id, name, function (error) {
-        if (error && error.reason === DatabaseError.ALREADY_EXISTS) return callback(new GroupError(GroupError.ALREADY_EXISTS));
-        if (error) return callback(new GroupError(GroupError.INTERNAL_ERROR, error));
+        if (error && error.reason === DatabaseError.ALREADY_EXISTS) return callback(new GroupsError(GroupsError.ALREADY_EXISTS));
+        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));

        callback(null, { id: id, name: name });
    });
@@ -97,11 +97,11 @@ function remove(id, callback) {
    assert.strictEqual(typeof callback, 'function');

    // never allow admin group to be deleted
-    if (id === constants.ADMIN_GROUP_ID) return callback(new GroupError(GroupError.NOT_ALLOWED));
+    if (id === constants.ADMIN_GROUP_ID) return callback(new GroupsError(GroupsError.NOT_ALLOWED));

    groupdb.del(id, function (error) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupError(GroupError.NOT_FOUND));
-        if (error) return callback(new GroupError(GroupError.INTERNAL_ERROR, error));
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupsError(GroupsError.NOT_FOUND));
+        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));

        callback(null);
    });
@@ -112,8 +112,8 @@ function get(id, callback) {
    assert.strictEqual(typeof callback, 'function');

    groupdb.get(id, function (error, result) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupError(GroupError.NOT_FOUND));
-        if (error) return callback(new GroupError(GroupError.INTERNAL_ERROR, error));
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupsError(GroupsError.NOT_FOUND));
+        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));

        return callback(null, result);
    });
@@ -124,8 +124,8 @@ function getWithMembers(id, callback) {
    assert.strictEqual(typeof callback, 'function');

    groupdb.getWithMembers(id, function (error, result) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupError(GroupError.NOT_FOUND));
-        if (error) return callback(new GroupError(GroupError.INTERNAL_ERROR, error));
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupsError(GroupsError.NOT_FOUND));
+        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));

        return callback(null, result);
    });
@@ -135,7 +135,7 @@ function getAll(callback) {
    assert.strictEqual(typeof callback, 'function');

    groupdb.getAll(function (error, result) {
-        if (error) return callback(new GroupError(GroupError.INTERNAL_ERROR, error));
+        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));

        return callback(null, result);
    });
@@ -145,7 +145,7 @@ function getAllWithMembers(callback) {
    assert.strictEqual(typeof callback, 'function');

    groupdb.getAllWithMembers(function (error, result) {
-        if (error) return callback(new GroupError(GroupError.INTERNAL_ERROR, error));
+        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));

        return callback(null, result);
    });
@@ -156,8 +156,8 @@ function getMembers(groupId, callback) {
    assert.strictEqual(typeof callback, 'function');

    groupdb.getMembers(groupId, function (error, result) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupError(GroupError.NOT_FOUND));
-        if (error) return callback(new GroupError(GroupError.INTERNAL_ERROR, error));
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupsError(GroupsError.NOT_FOUND));
+        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));

        return callback(null, result);
    });
@@ -168,8 +168,8 @@ function getGroups(userId, callback) {
    assert.strictEqual(typeof callback, 'function');

    groupdb.getGroups(userId, function (error, result) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupError(GroupError.NOT_FOUND));
-        if (error) return callback(new GroupError(GroupError.INTERNAL_ERROR, error));
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupsError(GroupsError.NOT_FOUND));
+        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));

        return callback(null, result);
    });
@@ -181,8 +181,8 @@ function setGroups(userId, groupIds, callback) {
    assert.strictEqual(typeof callback, 'function');

    groupdb.setGroups(userId, groupIds, function (error) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupError(GroupError.NOT_FOUND));
-        if (error) return callback(new GroupError(GroupError.INTERNAL_ERROR, error));
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupsError(GroupsError.NOT_FOUND));
+        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));

        return callback(null);
    });
@@ -194,8 +194,8 @@ function addMember(groupId, userId, callback) {
    assert.strictEqual(typeof callback, 'function');

    groupdb.addMember(groupId, userId, function (error) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupError(GroupError.NOT_FOUND));
-        if (error) return callback(new GroupError(GroupError.INTERNAL_ERROR, error));
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupsError(GroupsError.NOT_FOUND));
+        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));

        return callback(null);
    });
@@ -207,8 +207,8 @@ function setMembers(groupId, userIds, callback) {
    assert.strictEqual(typeof callback, 'function');

    groupdb.setMembers(groupId, userIds, function (error) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupError(GroupError.NOT_FOUND, 'Invalid group or user id'));
-        if (error) return callback(new GroupError(GroupError.INTERNAL_ERROR, error));
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupsError(GroupsError.NOT_FOUND, 'Invalid group or user id'));
+        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));

        return callback(null);
    });
@@ -220,8 +220,8 @@ function removeMember(groupId, userId, callback) {
    assert.strictEqual(typeof callback, 'function');

    groupdb.removeMember(groupId, userId, function (error) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupError(GroupError.NOT_FOUND));
-        if (error) return callback(new GroupError(GroupError.INTERNAL_ERROR, error));
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupsError(GroupsError.NOT_FOUND));
+        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));

        return callback(null);
    });
@@ -233,8 +233,8 @@ function isMember(groupId, userId, callback) {
    assert.strictEqual(typeof callback, 'function');

    groupdb.isMember(groupId, userId, function (error, result) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupError(GroupError.NOT_FOUND));
-        if (error) return callback(new GroupError(GroupError.INTERNAL_ERROR, error));
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupsError(GroupsError.NOT_FOUND));
+        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));

        return callback(null, result);
    });
@@ -7,18 +7,18 @@
 exports = module.exports = {
    // a major version makes all apps restore from backup. #451 must be fixed before we do this.
    // a minor version makes all apps re-configure themselves
-    'version': '48.9.0',
+    'version': '48.10.0',

    'baseImages': [ 'cloudron/base:0.10.0' ],

    // Note that if any of the databases include an upgrade, bump the infra version above
    // This is because we upgrade using dumps instead of mysql_upgrade, pg_upgrade etc
    'images': {
-        'mysql': { repo: 'cloudron/mysql', tag: 'cloudron/mysql:1.0.0' },
-        'postgresql': { repo: 'cloudron/postgresql', tag: 'cloudron/postgresql:1.0.0' },
-        'mongodb': { repo: 'cloudron/mongodb', tag: 'cloudron/mongodb:1.0.1' },
+        'mysql': { repo: 'cloudron/mysql', tag: 'cloudron/mysql:1.1.0' },
+        'postgresql': { repo: 'cloudron/postgresql', tag: 'cloudron/postgresql:1.1.0' },
+        'mongodb': { repo: 'cloudron/mongodb', tag: 'cloudron/mongodb:1.1.0' },
        'redis': { repo: 'cloudron/redis', tag: 'cloudron/redis:1.0.0' },
-        'mail': { repo: 'cloudron/mail', tag: 'cloudron/mail:1.2.2' },
+        'mail': { repo: 'cloudron/mail', tag: 'cloudron/mail:1.3.0' },
        'graphite': { repo: 'cloudron/graphite', tag: 'cloudron/graphite:1.0.0' }
    }
 };
@@ -13,8 +13,8 @@ var assert = require('assert'),
    DatabaseError = require('./databaseerror.js'),
    debug = require('debug')('box:ldap'),
    eventlog = require('./eventlog.js'),
-    user = require('./user.js'),
-    UserError = user.UserError,
+    users = require('./users.js'),
+    UsersError = users.UsersError,
    ldap = require('ldapjs'),
    mail = require('./mail.js'),
    MailError = mail.MailError,
@@ -51,7 +51,7 @@ function getUsersWithAccessToApp(req, callback) {
    getAppByRequest(req, function (error, app) {
        if (error) return callback(error);

-        user.list(function (error, result){
+        users.list(function (error, result){
            if (error) return callback(new ldap.OperationsError(error.toString()));

            async.filter(result, apps.hasAccessTo.bind(null, app), function (error, result) {
@@ -258,38 +258,83 @@ function groupAdminsCompare(req, res, next) {
 function mailboxSearch(req, res, next) {
    debug('mailbox search: dn %s, scope %s, filter %s (from %s)', req.dn.toString(), req.scope, req.filter.toString(), req.connection.ldap.id);

-    if (!req.dn.rdns[0].attrs.cn) return next(new ldap.NoSuchObjectError(req.dn.toString()));
+    // if cn is set we only search for one mailbox specifically
+    if (req.dn.rdns[0].attrs.cn) {
+        var email = req.dn.rdns[0].attrs.cn.value.toLowerCase();
+        var parts = email.split('@');
+        if (parts.length !== 2) return next(new ldap.NoSuchObjectError(req.dn.toString()));

-    var email = req.dn.rdns[0].attrs.cn.value.toLowerCase();
-    var parts = email.split('@');
-    if (parts.length !== 2) return next(new ldap.NoSuchObjectError(req.dn.toString()));
+        mailboxdb.getMailbox(parts[0], parts[1], function (error, mailbox) {
+            if (error && error.reason === DatabaseError.NOT_FOUND) return next(new ldap.NoSuchObjectError(req.dn.toString()));
+            if (error) return next(new ldap.OperationsError(error.toString()));

-    mailboxdb.getMailbox(parts[0], parts[1], function (error, mailbox) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return next(new ldap.NoSuchObjectError(req.dn.toString()));
-        if (error) return next(new ldap.OperationsError(error.toString()));
+            var obj = {
+                dn: req.dn.toString(),
+                attributes: {
+                    objectclass: ['mailbox'],
+                    objectcategory: 'mailbox',
+                    cn: `${mailbox.name}@${mailbox.domain}`,
+                    uid: `${mailbox.name}@${mailbox.domain}`,
+                    mail: `${mailbox.name}@${mailbox.domain}`,
+                    ownerType: mailbox.ownerType,
+                    displayname: 'Max Mustermann',
+                    givenName: 'Max',
+                    username: 'mmustermann',
+                    samaccountname: 'mmustermann'
+                }
+            };

-        var obj = {
-            dn: req.dn.toString(),
-            attributes: {
-                objectclass: ['mailbox'],
-                objectcategory: 'mailbox',
-                cn: `${mailbox.name}@${mailbox.domain}`,
-                uid: `${mailbox.name}@${mailbox.domain}`,
-                mail: `${mailbox.name}@${mailbox.domain}`,
-                ownerType: mailbox.ownerType
+            // ensure all filter values are also lowercase
+            var lowerCaseFilter = safe(function () { return ldap.parseFilter(req.filter.toString().toLowerCase()); }, null);
+            if (!lowerCaseFilter) return next(new ldap.OperationsError(safe.error.toString()));
+
+            if (lowerCaseFilter.matches(obj.attributes)) {
+                finalSend([ obj ], req, res, next);
+            } else {
+                res.end();
            }
-        };
+        });
+    } else if (req.dn.rdns[0].attrs.domain) {
+        var domain = req.dn.rdns[0].attrs.domain.value.toLowerCase();

-        // ensure all filter values are also lowercase
-        var lowerCaseFilter = safe(function () { return ldap.parseFilter(req.filter.toString().toLowerCase()); }, null);
-        if (!lowerCaseFilter) return next(new ldap.OperationsError(safe.error.toString()));
+        mailboxdb.listMailboxes(domain, function (error, result) {
+            if (error) return next(new ldap.OperationsError(error.toString()));

-        if (lowerCaseFilter.matches(obj.attributes)) {
-            finalSend([ obj ], req, res, next);
-        } else {
-            res.end();
-        }
-    });
+            var results = [];
+
+            // only send user mailboxes
+            result = result.filter(function (m) { return m.ownerType === mailboxdb.OWNER_TYPE_USER; });
+
+            // send mailbox objects
+            result.forEach(function (mailbox) {
+                var dn = ldap.parseDN(`cn=${mailbox.name}@${domain},domain=${domain},ou=mailboxes,dc=cloudron`);
+
+                var obj = {
+                    dn: dn.toString(),
+                    attributes: {
+                        objectclass: ['mailbox'],
+                        objectcategory: 'mailbox',
+                        cn: `${mailbox.name}@${domain}`,
+                        uid: `${mailbox.name}@${domain}`,
+                        mail: `${mailbox.name}@${domain}`,
+                        ownerType: mailbox.ownerType
+                    }
+                };
+
+                // ensure all filter values are also lowercase
+                var lowerCaseFilter = safe(function () { return ldap.parseFilter(req.filter.toString().toLowerCase()); }, null);
+                if (!lowerCaseFilter) return next(new ldap.OperationsError(safe.error.toString()));
+
+                if ((req.dn.equals(dn) || req.dn.parentOf(dn)) && lowerCaseFilter.matches(obj.attributes)) {
+                    results.push(obj);
+                }
+            });
+
+            finalSend(results, req, res, next);
+        });
+    } else {
+        return next(new ldap.NoSuchObjectError(req.dn.toString()));
+    }
 }

 function mailAliasSearch(req, res, next) {
@@ -378,18 +423,18 @@ function authenticateUser(req, res, next) {

    var api;
    if (attributeName === 'mail') {
-        api = user.verifyWithEmail;
+        api = users.verifyWithEmail;
    } else if (commonName.indexOf('@') !== -1) { // if mail is specified, enforce mail check
-        api = user.verifyWithEmail;
+        api = users.verifyWithEmail;
    } else if (commonName.indexOf('uid-') === 0) {
-        api = user.verify;
+        api = users.verify;
    } else {
-        api = user.verifyWithUsername;
+        api = users.verifyWithUsername;
    }

    api(commonName, req.credentials || '', function (error, user) {
-        if (error && error.reason === UserError.NOT_FOUND) return next(new ldap.NoSuchObjectError(req.dn.toString()));
-        if (error && error.reason === UserError.WRONG_PASSWORD) return next(new ldap.InvalidCredentialsError(req.dn.toString()));
+        if (error && error.reason === UsersError.NOT_FOUND) return next(new ldap.NoSuchObjectError(req.dn.toString()));
+        if (error && error.reason === UsersError.WRONG_PASSWORD) return next(new ldap.InvalidCredentialsError(req.dn.toString()));
        if (error) return next(new ldap.OperationsError(error.message));

        req.user = user;
@@ -410,7 +455,7 @@ function authorizeUserForApp(req, res, next) {
            // we return no such object, to avoid leakage of a users existence
            if (!result) return next(new ldap.NoSuchObjectError(req.dn.toString()));

-            eventlog.add(eventlog.ACTION_USER_LOGIN, { authType: 'ldap', appId: app.id, app: app }, { userId: req.user.id, user: user.removePrivateFields(req.user) });
+            eventlog.add(eventlog.ACTION_USER_LOGIN, { authType: 'ldap', appId: app.id, app: app }, { userId: req.user.id, user: users.removePrivateFields(req.user) });

            res.end();
        });
@@ -451,12 +496,12 @@ function authenticateMailbox(req, res, next) {
            } else if (mailbox.ownerType === mailboxdb.OWNER_TYPE_USER) {
                if (!domain.enabled) return next(new ldap.NoSuchObjectError(req.dn.toString()));

-                user.verify(mailbox.ownerId, req.credentials || '', function (error, result) {
-                    if (error && error.reason === UserError.NOT_FOUND) return next(new ldap.NoSuchObjectError(req.dn.toString()));
-                    if (error && error.reason === UserError.WRONG_PASSWORD) return next(new ldap.InvalidCredentialsError(req.dn.toString()));
+                users.verify(mailbox.ownerId, req.credentials || '', function (error, result) {
+                    if (error && error.reason === UsersError.NOT_FOUND) return next(new ldap.NoSuchObjectError(req.dn.toString()));
+                    if (error && error.reason === UsersError.WRONG_PASSWORD) return next(new ldap.InvalidCredentialsError(req.dn.toString()));
                    if (error) return next(new ldap.OperationsError(error.message));

-                    eventlog.add(eventlog.ACTION_USER_LOGIN, { authType: 'ldap', mailboxId: email }, { userId: result.id, user: user.removePrivateFields(result) });
+                    eventlog.add(eventlog.ACTION_USER_LOGIN, { authType: 'ldap', mailboxId: email }, { userId: result.id, user: users.removePrivateFields(result) });
                    res.end();
                });
            } else {
@@ -489,6 +534,7 @@ function start(callback) {
    gServer.search('ou=mailaliases,dc=cloudron', mailAliasSearch);
    gServer.search('ou=mailinglists,dc=cloudron', mailingListSearch);

+    gServer.bind('ou=mailboxes,dc=cloudron', authenticateMailbox);
    gServer.bind('ou=recvmail,dc=cloudron', authenticateMailbox);
    gServer.bind('ou=sendmail,dc=cloudron', authenticateMailbox);

@@ -65,7 +65,7 @@ var assert = require('assert'),
    shell = require('./shell.js'),
    smtpTransport = require('nodemailer-smtp-transport'),
    sysinfo = require('./sysinfo.js'),
-    user = require('./user.js'),
+    users = require('./users.js'),
    util = require('util'),
    _ = require('underscore');

@@ -103,8 +103,6 @@ function validateName(name) {
    if (name.length < 1) return new MailError(MailError.BAD_FIELD, 'mailbox name must be atleast 1 char');
    if (name.length >= 200) return new MailError(MailError.BAD_FIELD, 'mailbox name too long');

-    if (constants.RESERVED_NAMES.indexOf(name) !== -1) return new MailError(MailError.BAD_FIELD, `mailbox name ${name} is reserved`);
-
    // +/- can be tricky in emails. also need to consider valid LDAP characters here (e.g '+' is reserved)
    if (/[^a-zA-Z0-9.]/.test(name)) return new MailError(MailError.BAD_FIELD, 'mailbox name can only contain alphanumerals and dot');

@@ -480,7 +478,7 @@ function createMailConfig(callback) {
    getDomains(function (error, mailDomains) {
        if (error) return callback(error);

-        user.getOwner(function (error, owner) {
+        users.getOwner(function (error, owner) {
            const mailFqdn = config.mailFqdn();
            const defaultDomain = config.adminDomain();
            const alertsFrom = `no-reply@${defaultDomain}`;
@@ -46,6 +46,4 @@ Sent at: <%= new Date().toUTCString() %>

    </center>

-    <img src="https://analytics.cloudron.io/piwik.php?idsite=2&rec=1&e_c=CloudronEmail&e_a=update" style="border:0" alt="" />
-
 <% } %>
@@ -52,7 +52,5 @@ Sent at: <%= new Date().toUTCString() %>

 </center>

-<img src="https://analytics.cloudron.io/piwik.php?idsite=2&rec=1&e_c=CloudronEmail&e_a=update" style="border:0" alt="" />
-
 <% } %>

@@ -174,5 +174,4 @@ Sent at: <%= new Date().toUTCString() %>
    </div>
 </center>

-<img src="https://analytics.cloudron.io/piwik.php?idsite=2&rec=1&e_c=CloudronEmail&e_a=digest" style="border:0" alt="" />
 <% } %>
@@ -38,6 +38,4 @@ Powered by https://cloudron.io

 </center>

-<img src="https://analytics.cloudron.io/piwik.php?idsite=2&rec=1&e_c=CloudronEmail&e_a=passwordReset" style="border:0" alt="" />
-
 <% } %>
@@ -44,6 +44,4 @@ Powered by https://cloudron.io

 </center>

-<img src="https://analytics.cloudron.io/piwik.php?idsite=2&rec=1&e_c=CloudronEmail&e_a=userAdded" style="border:0" alt="" />
-
 <% } %>
@@ -43,6 +43,4 @@ Powered by https://cloudron.io

 </center>

-<img src="https://analytics.cloudron.io/piwik.php?idsite=2&rec=1&e_c=CloudronEmail&e_a=welcomeUser" style="border:0" alt="" />
-
 <% } %>
@@ -39,7 +39,7 @@ var assert = require('assert'),
    settings = require('./settings.js'),
    showdown = require('showdown'),
    smtpTransport = require('nodemailer-smtp-transport'),
-    users = require('./user.js'),
+    users = require('./users.js'),
    util = require('util'),
    _ = require('underscore');

@@ -24,13 +24,17 @@
        <form id="loginForm" action="" method="post">
          <input type="hidden" name="_csrf" value="<%= csrf %>"/>
          <div class="form-group">
-            <label class="control-label" for="inputUsername">Username or Email</label>
+            <label class="control-label" for="inputUsername">Username</label>
            <input type="text" class="form-control" id="inputUsername" name="username" value="<%= username %>" autofocus required>
          </div>
          <div class="form-group">
            <label class="control-label" for="inputPassword">Password</label>
            <input type="password" class="form-control" name="password" id="inputPassword" value="<%= password %>" required>
          </div>
+          <div class="form-group">
+            <label class="control-label" for="inputPassword">2FA Token (if enabled)</label>
+            <input type="text" class="form-control" name="totpToken" id="inputTotpToken" value="">
+          </div>
          <input class="btn btn-primary btn-outline pull-right" type="submit" value="Sign in"/>
        </form>
        <a href="/api/v1/session/password/resetRequest.html">Reset password</a>
@@ -42,7 +42,7 @@ app.controller('Controller', [function () {}]);
            </div>
            <input type="password" class="form-control" id="inputPasswordRepeat" ng-model="passwordRepeat" name="passwordRepeat" required>
          </div>
-          <input class="btn btn-primary btn-outline pull-right" type="submit" value="Create" ng-disabled="resetForm.$invalid || password !== passwordRepeat"/>
+          <input class="btn btn-primary btn-outline pull-right" type="submit" value="Set New Password" ng-disabled="resetForm.$invalid || password !== passwordRepeat"/>
        </form>
      </div>
    </div>
@@ -16,7 +16,7 @@
        <form action="/api/v1/session/password/resetRequest" method="post" autocomplete="off">
          <input type="hidden" name="_csrf" value="<%= csrf %>"/>
          <div class="form-group">
-            <label class="control-label" for="inputIdentifier">Username or Email</label>
+            <label class="control-label" for="inputIdentifier">Username</label>
            <input type="text" class="form-control" id="inputIdentifier" name="identifier" autofocus required>
          </div>
          <input class="btn btn-primary btn-outline pull-right" type="submit" value="Reset"/>
@@ -22,6 +22,7 @@ var apps = require('./apps.js'),
    reverseProxy = require('./reverseproxy.js'),
    safe = require('safetydance'),
    semver = require('semver'),
+    settings = require('./settings.js'),
    shell = require('./shell.js'),
    taskmanager = require('./taskmanager.js'),
    util = require('util'),
@@ -47,8 +48,15 @@ function start(callback) {
    // short-circuit for the restart case
    if (_.isEqual(infra, existingInfra)) {
        debug('platform is uptodate at version %s', infra.version);
-        emitPlatformReady();
-        return callback();
+
+        updateAddons(function (error) {
+            if (error) return callback(error);
+
+            emitPlatformReady();
+
+            callback();
+        });
+        return;
    }

    debug('Updating infrastructure from %s to %s', existingInfra.version, infra.version);
@@ -61,7 +69,8 @@ function start(callback) {
        startAddons.bind(null, existingInfra),
        removeOldImages,
        startApps.bind(null, existingInfra),
-        fs.writeFile.bind(fs, paths.INFRA_VERSION_FILE, JSON.stringify(infra))
+        fs.writeFile.bind(fs, paths.INFRA_VERSION_FILE, JSON.stringify(infra, null, 4)),
+        updateAddons
    ], function (error) {
        if (error) return callback(error);

@@ -80,6 +89,24 @@ function stop(callback) {
    taskmanager.pauseTasks(callback);
 }

+function updateAddons(callback) {
+    settings.getPlatformConfig(function (error, platformConfig) {
+        if (error) return callback(error);
+
+        for (var containerName of [ 'mysql', 'postgresql', 'mail', 'mongodb' ]) {
+            const containerConfig = platformConfig[containerName];
+            if (!containerConfig) continue;
+
+            if (!containerConfig.memory || !containerConfig.memorySwap) continue;
+
+            const cmd = `docker update --memory ${containerConfig.memory} --memory-swap ${containerConfig.memorySwap} ${containerName}`;
+            shell.execSync(`update${containerName}`, cmd);
+        }
+
+        callback();
+    });
+}
+
 function emitPlatformReady() {
    // give some time for the platform to "settle". For example, mysql might still be initing the
    // database dir and we cannot call service scripts until that's done.
@@ -46,7 +46,7 @@ var acme = require('./cert/acme.js'),
    platform = require('./platform.js'),
    safe = require('safetydance'),
    shell = require('./shell.js'),
-    user = require('./user.js'),
+    users = require('./users.js'),
    util = require('util');

 var NGINX_APPCONFIG_EJS = fs.readFileSync(__dirname + '/../setup/start/nginx/appconfig.ejs', { encoding: 'utf8' }),
@@ -98,7 +98,7 @@ function getApi(app, callback) {
        // we cannot use admin@fqdn because the user might not have set it up.
        // we simply update the account with the latest email we have each time when getting letsencrypt certs
        // https://github.com/ietf-wg-acme/acme/issues/30
-        user.getOwner(function (error, owner) {
+        users.getOwner(function (error, owner) {
            options.email = error ? 'support@cloudron.io' : (owner.fallbackEmail || owner.email); // can error if not activated yet

            callback(null, api, options);
@@ -0,0 +1,56 @@
+'use strict';
+
+exports = module.exports = {
+    scope: scope,
+    websocketAuth: websocketAuth
+};
+
+var accesscontrol = require('../accesscontrol.js'),
+    assert = require('assert'),
+    HttpError = require('connect-lastmile').HttpError,
+    passport = require('passport');
+
+//  The scope middleware provides an auth middleware for routes.
+//
+//  It is used for API routes, which are authenticated using accesstokens.
+//  Those accesstokens carry OAuth scopes and the middleware takes the required
+//  scope as an argument and will verify the accesstoken against it.
+//
+//  See server.js:
+//    var profileScope = routes.oauth2.scope('profile');
+//
+function scope(requestedScope) {
+    assert.strictEqual(typeof requestedScope, 'string');
+
+    var requestedScopes = requestedScope.split(',');
+
+    return [
+        passport.authenticate(['bearer'], { session: false }),
+
+        function (req, res, next) {
+            var error = accesscontrol.validateRequestedScopes(req.authInfo || null, requestedScopes);
+            if (error) return next(new HttpError(403, error.message));
+
+            next();
+        }
+    ];
+}
+
+function websocketAuth(requestedScopes, req, res, next) {
+    assert(Array.isArray(requestedScopes));
+
+    if (typeof req.query.access_token !== 'string') return next(new HttpError(401, 'Unauthorized'));
+
+    accesscontrol.accessTokenAuth(req.query.access_token, function (error, user, info) {
+        if (error) return next(new HttpError(500, error.message));
+        if (!user) return next(new HttpError(401, 'Unauthorized'));
+
+        req.user = user;
+        req.authInfo = info;
+
+        var e = accesscontrol.validateRequestedScopes(req.authInfo, requestedScopes);
+        if (e) return next(new HttpError(401, e.message));
+
+        next();
+    });
+}
@@ -3,6 +3,7 @@
 exports = module.exports = {
    getApp: getApp,
    getApps: getApps,
+    getAllByUser: getAllByUser,
    getAppIcon: getAppIcon,
    installApp: installApp,
    configureApp: configureApp,
@@ -42,32 +43,6 @@ function auditSource(req) {
    return { ip: ip, username: req.user ? req.user.username : null, userId: req.user ? req.user.id : null };
 }

-function removeInternalAppFields(app) {
-    return {
-        id: app.id,
-        appStoreId: app.appStoreId,
-        installationState: app.installationState,
-        installationProgress: app.installationProgress,
-        runState: app.runState,
-        health: app.health,
-        location: app.location,
-        domain: app.domain,
-        accessRestriction: app.accessRestriction,
-        manifest: app.manifest,
-        portBindings: app.portBindings,
-        iconUrl: app.iconUrl,
-        fqdn: app.fqdn,
-        memoryLimit: app.memoryLimit,
-        xFrameOptions: app.xFrameOptions,
-        sso: app.sso,
-        debugMode: app.debugMode,
-        robotsTxt: app.robotsTxt,
-        enableBackup: app.enableBackup,
-        creationTime: app.creationTime.toISOString(),
-        updateTime: app.updateTime.toISOString()
-    };
-}
-
 function getApp(req, res, next) {
    assert.strictEqual(typeof req.params.id, 'string');

@@ -75,18 +50,29 @@ function getApp(req, res, next) {
        if (error && error.reason === AppsError.NOT_FOUND) return next(new HttpError(404, 'No such app'));
        if (error) return next(new HttpError(500, error));

-        next(new HttpSuccess(200, removeInternalAppFields(app)));
+        next(new HttpSuccess(200, apps.removeInternalAppFields(app)));
    });
 }

 function getApps(req, res, next) {
    assert.strictEqual(typeof req.user, 'object');

-    var func = req.user.admin ? apps.getAll : apps.getAllByUser.bind(null, req.user);
-    func(function (error, allApps) {
+    apps.getAll(function (error, allApps) {
        if (error) return next(new HttpError(500, error));

-        allApps = allApps.map(removeInternalAppFields);
+        allApps = allApps.map(apps.removeInternalAppFields);
+
+        next(new HttpSuccess(200, { apps: allApps }));
+    });
+}
+
+function getAllByUser(req, res, next) {
+    assert.strictEqual(typeof req.user, 'object');
+
+    apps.getAllByUser(req.user, function (error, allApps) {
+        if (error) return next(new HttpError(500, error));
+
+        allApps = allApps.map(apps.removeInternalAppFields);

        next(new HttpSuccess(200, { apps: allApps }));
    });
@@ -5,9 +5,9 @@ exports = module.exports = {
    get: get,
    del: del,
    getAll: getAll,
-    addClientToken: addClientToken,
-    getClientTokens: getClientTokens,
-    delClientTokens: delClientTokens,
+    addToken: addToken,
+    getTokens: getTokens,
+    delTokens: delTokens,
    delToken: delToken
 };

@@ -72,36 +72,38 @@ function getAll(req, res, next) {
    });
 }

-function addClientToken(req, res, next) {
+function addToken(req, res, next) {
    assert.strictEqual(typeof req.params.clientId, 'string');
    assert.strictEqual(typeof req.user, 'object');
+    assert.strictEqual(typeof req.body, 'object');

-    var expiresAt = req.query.expiresAt ? parseInt(req.query.expiresAt, 10) : Date.now() + constants.DEFAULT_TOKEN_EXPIRATION;
+    var data = req.body;
+    var expiresAt = data.expiresAt ? parseInt(data.expiresAt, 10) : Date.now() + constants.DEFAULT_TOKEN_EXPIRATION;
    if (isNaN(expiresAt) || expiresAt <= Date.now()) return next(new HttpError(400, 'expiresAt must be a timestamp in the future'));

-    clients.addClientTokenByUserId(req.params.clientId, req.user.id, expiresAt, function (error, result) {
+    clients.addTokenByUserId(req.params.clientId, req.user.id, expiresAt, function (error, result) {
        if (error && error.reason === ClientsError.NOT_FOUND) return next(new HttpError(404, error.message));
        if (error) return next(new HttpError(500, error));
        next(new HttpSuccess(201, { token: result }));
    });
 }

-function getClientTokens(req, res, next) {
+function getTokens(req, res, next) {
    assert.strictEqual(typeof req.params.clientId, 'string');
    assert.strictEqual(typeof req.user, 'object');

-    clients.getClientTokensByUserId(req.params.clientId, req.user.id, function (error, result) {
+    clients.getTokensByUserId(req.params.clientId, req.user.id, function (error, result) {
        if (error && error.reason === ClientsError.NOT_FOUND) return next(new HttpError(404, error.message));
        if (error) return next(new HttpError(500, error));
        next(new HttpSuccess(200, { tokens: result }));
    });
 }

-function delClientTokens(req, res, next) {
+function delTokens(req, res, next) {
    assert.strictEqual(typeof req.params.clientId, 'string');
    assert.strictEqual(typeof req.user, 'object');

-    clients.delClientTokensByUserId(req.params.clientId, req.user.id, function (error) {
+    clients.delTokensByUserId(req.params.clientId, req.user.id, function (error) {
        if (error && error.reason === ClientsError.NOT_FOUND) return next(new HttpError(404, error.message));
        if (error) return next(new HttpError(500, error));
        next(new HttpSuccess(204));
@@ -44,10 +44,6 @@ function getConfig(req, res, next) {
    cloudron.getConfig(function (error, cloudronConfig) {
        if (error) return next(new HttpError(500, error));

-        if (!req.user.admin) {
-            cloudronConfig = _.pick(cloudronConfig, 'apiServerOrigin', 'webServerOrigin', 'fqdn', 'adminFqdn', 'version', 'progress', 'isDemo', 'cloudronName', 'provider');
-        }
-
        next(new HttpSuccess(200, cloudronConfig));
    });
 }
@@ -4,10 +4,11 @@ exports = module.exports = {
    login: login
 };

-var developer = require('../developer.js'),
+var clients = require('../clients.js'),
    passport = require('passport'),
    HttpError = require('connect-lastmile').HttpError,
-    HttpSuccess = require('connect-lastmile').HttpSuccess;
+    HttpSuccess = require('connect-lastmile').HttpSuccess,
+    speakeasy = require('speakeasy');

 function login(req, res, next) {
    passport.authenticate('local', function (error, user) {
@@ -16,11 +17,18 @@ function login(req, res, next) {

        var ip = req.headers['x-forwarded-for'] || req.connection.remoteAddress || null;

-        developer.issueDeveloperToken(user, ip, function (error, result) {
+        if (!user.ghost && user.twoFactorAuthenticationEnabled) {
+            if (!req.body.totpToken) return next(new HttpError(401, 'A totpToken must be provided'));
+
+            let verified = speakeasy.totp.verify({ secret: user.twoFactorAuthenticationSecret, encoding: 'base32', token: req.body.totpToken });
+            if (!verified) return next(new HttpError(401, 'Invalid totpToken'));
+        }
+
+        clients.issueDeveloperToken(user, ip, function (error, result) {
            if (error) return next(new HttpError(500, error));

-            next(new HttpSuccess(200, { token: result.token, expiresAt: result.expiresAt }));
+            next(new HttpSuccess(200, result));
        });
-  })(req, res, next);
+    })(req, res, next);
 }

@@ -5,14 +5,12 @@ exports = module.exports = {
    get: get,
    getAll: getAll,
    update: update,
-    del: del,
-
-    setAdmin: setAdmin
+    del: del
 };

 var assert = require('assert'),
    domains = require('../domains.js'),
-    DomainError = domains.DomainError,
+    DomainsError = domains.DomainsError,
    HttpError = require('connect-lastmile').HttpError,
    HttpSuccess = require('connect-lastmile').HttpSuccess;

@@ -33,9 +31,9 @@ function add(req, res, next) {
    req.clearTimeout();

    domains.add(req.body.domain, req.body.zoneName || '', req.body.provider, req.body.config, req.body.fallbackCertificate || null, req.body.tlsConfig || { provider: 'letsencrypt-prod' }, function (error) {
-        if (error && error.reason === DomainError.ALREADY_EXISTS) return next(new HttpError(409, error.message));
-        if (error && error.reason === DomainError.BAD_FIELD) return next(new HttpError(400, error.message));
-        if (error && error.reason === DomainError.INVALID_PROVIDER) return next(new HttpError(400, error.message));
+        if (error && error.reason === DomainsError.ALREADY_EXISTS) return next(new HttpError(409, error.message));
+        if (error && error.reason === DomainsError.BAD_FIELD) return next(new HttpError(400, error.message));
+        if (error && error.reason === DomainsError.INVALID_PROVIDER) return next(new HttpError(400, error.message));
        if (error) return next(new HttpError(500, error));

        next(new HttpSuccess(201, { domain: req.body.domain, config: req.body.config }));
@@ -46,12 +44,10 @@ function get(req, res, next) {
    assert.strictEqual(typeof req.params.domain, 'string');

    domains.get(req.params.domain, function (error, result) {
-        if (error && error.reason === DomainError.NOT_FOUND) return next(new HttpError(404, error.message));
+        if (error && error.reason === DomainsError.NOT_FOUND) return next(new HttpError(404, error.message));
        if (error) return next(new HttpError(500, error));

-        delete result.fallbackCertificate.key; // do not return the 'key'. in caas, this is private
-
-        next(new HttpSuccess(200, result));
+        next(new HttpSuccess(200, domains.removePrivateFields(result)));
    });
 }

@@ -59,6 +55,8 @@ function getAll(req, res, next) {
    domains.getAll(function (error, result) {
        if (error) return next(new HttpError(500, error));

+        result = result.map(domains.removePrivateFields);
+
        next(new HttpSuccess(200, { domains: result }));
    });
 }
@@ -69,6 +67,7 @@ function update(req, res, next) {

    if (typeof req.body.provider !== 'string') return next(new HttpError(400, 'provider must be an object'));
    if (typeof req.body.config !== 'object') return next(new HttpError(400, 'config must be an object'));
+    if ('zoneName' in req.body && typeof req.body.zoneName !== 'string') return next(new HttpError(400, 'zoneName must be a string'));
    if ('fallbackCertificate' in req.body && typeof req.body.fallbackCertificate !== 'object') return next(new HttpError(400, 'fallbackCertificate must be a object with cert and key strings'));
    if (req.body.fallbackCertificate && (!req.body.fallbackCertificate.cert || typeof req.body.fallbackCertificate.cert !== 'string')) return next(new HttpError(400, 'fallbackCertificate.cert must be a string'));
    if (req.body.fallbackCertificate && (!req.body.fallbackCertificate.key || typeof req.body.fallbackCertificate.key !== 'string')) return next(new HttpError(400, 'fallbackCertificate.key must be a string'));
@@ -78,10 +77,10 @@ function update(req, res, next) {
    // some DNS providers like DigitalOcean take a really long time to verify credentials (https://github.com/expressjs/timeout/issues/26)
    req.clearTimeout();

-    domains.update(req.params.domain, req.body.provider, req.body.config, req.body.fallbackCertificate || null, req.body.tlsConfig || { provider: 'letsencrypt-prod' }, function (error) {
-        if (error && error.reason === DomainError.NOT_FOUND) return next(new HttpError(404, error.message));
-        if (error && error.reason === DomainError.BAD_FIELD) return next(new HttpError(400, error.message));
-        if (error && error.reason === DomainError.INVALID_PROVIDER) return next(new HttpError(400, error.message));
+    domains.update(req.params.domain, req.body.zoneName || '', req.body.provider, req.body.config, req.body.fallbackCertificate || null, req.body.tlsConfig || { provider: 'letsencrypt-prod' }, function (error) {
+        if (error && error.reason === DomainsError.NOT_FOUND) return next(new HttpError(404, error.message));
+        if (error && error.reason === DomainsError.BAD_FIELD) return next(new HttpError(400, error.message));
+        if (error && error.reason === DomainsError.INVALID_PROVIDER) return next(new HttpError(400, error.message));
        if (error) return next(new HttpError(500, error));

        next(new HttpSuccess(204, {}));
@@ -92,21 +91,11 @@ function del(req, res, next) {
    assert.strictEqual(typeof req.params.domain, 'string');

    domains.del(req.params.domain, function (error) {
-        if (error && error.reason === DomainError.NOT_FOUND) return next(new HttpError(404, error.message));
-        if (error && error.reason === DomainError.IN_USE) return next(new HttpError(409, 'Domain is still in use. Remove all apps and mailboxes using this domain'));
+        if (error && error.reason === DomainsError.NOT_FOUND) return next(new HttpError(404, error.message));
+        if (error && error.reason === DomainsError.IN_USE) return next(new HttpError(409, 'Domain is still in use. Remove all apps and mailboxes using this domain'));
        if (error) return next(new HttpError(500, error));

        next(new HttpSuccess(204));
    });
 }

-function setAdmin(req, res, next) {
-    assert.strictEqual(typeof req.params.domain, 'string');
-
-    domains.setAdmin(req.params.domain.toLowerCase(), function (error) {
-        if (error && error.reason === DomainError.NOT_FOUND) return next(new HttpError(404, error.message));
-        if (error) return next(new HttpError(500, error));
-
-        next(new HttpSuccess(202, {}));
-    });
-}
@@ -13,7 +13,7 @@ var assert = require('assert'),
    HttpError = require('connect-lastmile').HttpError,
    HttpSuccess = require('connect-lastmile').HttpSuccess,
    groups = require('../groups.js'),
-    GroupError = groups.GroupError;
+    GroupsError = groups.GroupsError;

 function create(req, res, next) {
    assert.strictEqual(typeof req.body, 'object');
@@ -21,8 +21,8 @@ function create(req, res, next) {
    if (typeof req.body.name !== 'string') return next(new HttpError(400, 'name must be string'));

    groups.create(req.body.name, function (error, group) {
-        if (error && error.reason === GroupError.BAD_FIELD) return next(new HttpError(400, error.message));
-        if (error && error.reason === GroupError.ALREADY_EXISTS) return next(new HttpError(409, 'Already exists'));
+        if (error && error.reason === GroupsError.BAD_FIELD) return next(new HttpError(400, error.message));
+        if (error && error.reason === GroupsError.ALREADY_EXISTS) return next(new HttpError(409, 'Already exists'));
        if (error) return next(new HttpError(500, error));

        var groupInfo = {
@@ -38,7 +38,7 @@ function get(req, res, next) {
    assert.strictEqual(typeof req.params.groupId, 'string');

    groups.getWithMembers(req.params.groupId, function (error, result) {
-        if (error && error.reason === GroupError.NOT_FOUND) return next(new HttpError(404, 'No such group'));
+        if (error && error.reason === GroupsError.NOT_FOUND) return next(new HttpError(404, 'No such group'));
        if (error) return next(new HttpError(500, error));

        next(new HttpSuccess(200, result));
@@ -52,7 +52,7 @@ function updateMembers(req, res, next) {
    if (!Array.isArray(req.body.userIds)) return next(new HttpError(404, 'userIds must be an array'));

    groups.setMembers(req.params.groupId, req.body.userIds, function (error) {
-        if (error && error.reason === GroupError.NOT_FOUND) return next(new HttpError(404, 'Invalid group or user id'));
+        if (error && error.reason === GroupsError.NOT_FOUND) return next(new HttpError(404, 'Invalid group or user id'));
        if (error) return next(new HttpError(500, error));

        next(new HttpSuccess(200));
@@ -71,8 +71,8 @@ function remove(req, res, next) {
    assert.strictEqual(typeof req.params.groupId, 'string');

    groups.remove(req.params.groupId, function (error) {
-        if (error && error.reason === GroupError.NOT_FOUND) return next(new HttpError(404, 'Group not found'));
-        if (error && error.reason === GroupError.NOT_ALLOWED) return next(new HttpError(409, 'Group deletion not allowed'));
+        if (error && error.reason === GroupsError.NOT_FOUND) return next(new HttpError(404, 'Group not found'));
+        if (error && error.reason === GroupsError.NOT_ALLOWED) return next(new HttpError(409, 'Group deletion not allowed'));
        if (error) return next(new HttpError(500, error));

        next(new HttpSuccess(204));
@@ -1,6 +1,7 @@
 'use strict';

 exports = module.exports = {
+    accesscontrol: require('./accesscontrol.js'),
    apps: require('./apps.js'),
    backups: require('./backups.js'),
    caas: require('./caas.js'),
@@ -18,5 +19,6 @@ exports = module.exports = {
    sysadmin: require('./sysadmin.js'),
    settings: require('./settings.js'),
    ssh: require('./ssh.js'),
-    user: require('./user.js')
+    user: require('./user.js'),
+    users: require('./users.js')
 };
@@ -1,14 +1,33 @@
 'use strict';

-var apps = require('../apps'),
+exports = module.exports = {
+    initialize: initialize,
+    uninitialize: uninitialize,
+    loginForm: loginForm,
+    login: login,
+    logout: logout,
+    sessionCallback: sessionCallback,
+    passwordResetRequestSite: passwordResetRequestSite,
+    passwordResetRequest: passwordResetRequest,
+    passwordSentSite: passwordSentSite,
+    passwordResetSite: passwordResetSite,
+    passwordReset: passwordReset,
+    accountSetupSite: accountSetupSite,
+    accountSetup: accountSetup,
+    authorization: authorization,
+    token: token,
+    csrf: csrf
+};
+
+var accesscontrol = require('../accesscontrol.js'),
+    apps = require('../apps.js'),
    assert = require('assert'),
-    auth = require('../auth.js'),
-    authcodedb = require('../authcodedb'),
+    authcodedb = require('../authcodedb.js'),
    clients = require('../clients'),
    ClientsError = clients.ClientsError,
    config = require('../config.js'),
-    constants = require('../constants'),
-    DatabaseError = require('../databaseerror'),
+    constants = require('../constants.js'),
+    DatabaseError = require('../databaseerror.js'),
    debug = require('debug')('box:routes/oauth2'),
    eventlog = require('../eventlog.js'),
    hat = require('hat'),
@@ -18,11 +37,12 @@ var apps = require('../apps'),
    passport = require('passport'),
    querystring = require('querystring'),
    session = require('connect-ensure-login'),
-    settings = require('../settings'),
-    tokendb = require('../tokendb'),
+    settings = require('../settings.js'),
+    speakeasy = require('speakeasy'),
+    tokendb = require('../tokendb.js'),
    url = require('url'),
-    user = require('../user.js'),
-    UserError = user.UserError,
+    users = require('../users.js'),
+    UsersError = users.UsersError,
    util = require('util'),
    _ = require('underscore');

@@ -33,110 +53,122 @@ function auditSource(req, appId, appObject) {
 }

 // create OAuth 2.0 server
-var gServer = oauth2orize.createServer();
+var gServer = null;

-// Register serialialization and deserialization functions.
-//
-// The client id is stored in the session and can thus be retrieved for each
-// step in the oauth flow transaction, which involves multiple http requests.
+function initialize() {
+    assert(gServer === null);

-gServer.serializeClient(function (client, callback) {
-    return callback(null, client.id);
-});
+    gServer = oauth2orize.createServer();

-gServer.deserializeClient(function (id, callback) {
-    clients.get(id, callback);
-});
+    // Register serialialization and deserialization functions.
+    //
+    // The client id is stored in the session and can thus be retrieved for each
+    // step in the oauth flow transaction, which involves multiple http requests.

-
-// Register supported grant types.
-
-// Grant authorization codes.  The callback takes the `client` requesting
-// authorization, the `redirectURI` (which is used as a verifier in the
-// subsequent exchange), the authenticated `user` granting access, and
-// their response, which contains approved scope, duration, etc. as parsed by
-// the application.  The application issues a code, which is bound to these
-// values, and will be exchanged for an access token.
-
-gServer.grant(oauth2orize.grant.code({ scopeSeparator: ',' }, function (client, redirectURI, user, ares, callback) {
-    debug('grant code:', client.id, redirectURI, user.id, ares);
-
-    var code = hat(256);
-    var expiresAt = Date.now() + 60 * 60000; // 1 hour
-
-    authcodedb.add(code, client.id, user.id, expiresAt, function (error) {
-        if (error) return callback(error);
-
-        debug('grant code: new auth code for client %s code %s', client.id, code);
-
-        callback(null, code);
+    gServer.serializeClient(function (client, callback) {
+        return callback(null, client.id);
    });
-}));

-
-gServer.grant(oauth2orize.grant.token({ scopeSeparator: ',' }, function (client, user, ares, callback) {
-    debug('grant token:', client.id, user.id, ares);
-
-    var token = tokendb.generateToken();
-    var expires = Date.now() + constants.DEFAULT_TOKEN_EXPIRATION;
-
-    tokendb.add(token, user.id, client.id, expires, client.scope, function (error) {
-        if (error) return callback(error);
-
-        debug('grant token: new access token for client %s token %s', client.id, token);
-
-        callback(null, token);
+    gServer.deserializeClient(function (id, callback) {
+        clients.get(id, callback);
    });
-}));


-// Exchange authorization codes for access tokens.  The callback accepts the
-// `client`, which is exchanging `code` and any `redirectURI` from the
-// authorization request for verification.  If these values are validated, the
-// application issues an access token on behalf of the user who authorized the
-// code.
+    // Register supported grant types.

-gServer.exchange(oauth2orize.exchange.code(function (client, code, redirectURI, callback) {
-    debug('exchange:', client, code, redirectURI);
+    // Grant authorization codes.  The callback takes the `client` requesting
+    // authorization, the `redirectURI` (which is used as a verifier in the
+    // subsequent exchange), the authenticated `user` granting access, and
+    // their response, which contains approved scope, duration, etc. as parsed by
+    // the application.  The application issues a code, which is bound to these
+    // values, and will be exchanged for an access token.

-    authcodedb.get(code, function (error, authCode) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(null, false);
-        if (error) return callback(error);
-        if (client.id !== authCode.clientId) return callback(null, false);
+    gServer.grant(oauth2orize.grant.code({ scopeSeparator: ',' }, function (client, redirectURI, user, ares, callback) {
+        debug('grant code:', client.id, redirectURI, user.id, ares);

-        authcodedb.del(code, function (error) {
-            if(error) return callback(error);
+        var code = hat(256);
+        var expiresAt = Date.now() + 60 * 60000; // 1 hour

-            var token = tokendb.generateToken();
-            var expires = Date.now() + constants.DEFAULT_TOKEN_EXPIRATION;
+        authcodedb.add(code, client.id, user.id, expiresAt, function (error) {
+            if (error) return callback(error);

-            tokendb.add(token, authCode.userId, authCode.clientId, expires, client.scope, function (error) {
-                if (error) return callback(error);
+            debug('grant code: new auth code for client %s code %s', client.id, code);

-                debug('exchange: new access token for client %s token %s', client.id, token);
+            callback(null, code);
+        });
+    }));

-                callback(null, token);
+
+    gServer.grant(oauth2orize.grant.token({ scopeSeparator: ',' }, function (client, user, ares, callback) {
+        debug('grant token:', client.id, user.id, ares);
+
+        var token = tokendb.generateToken();
+        var expires = Date.now() + constants.DEFAULT_TOKEN_EXPIRATION;
+        var scope = accesscontrol.normalizeScope(user.scope, client.scope);
+
+        tokendb.add(token, user.id, client.id, expires, scope, function (error) {
+            if (error) return callback(error);
+
+            debug('grant token: new access token for client %s token %s', client.id, token);
+
+            callback(null, token);
+        });
+    }));
+
+
+    // Exchange authorization codes for access tokens.  The callback accepts the
+    // `client`, which is exchanging `code` and any `redirectURI` from the
+    // authorization request for verification.  If these values are validated, the
+    // application issues an access token on behalf of the user who authorized the
+    // code.
+
+    gServer.exchange(oauth2orize.exchange.code(function (client, code, redirectURI, callback) {
+        debug('exchange:', client, code, redirectURI);
+
+        authcodedb.get(code, function (error, authCode) {
+            if (error && error.reason === DatabaseError.NOT_FOUND) return callback(null, false);
+            if (error) return callback(error);
+            if (client.id !== authCode.clientId) return callback(null, false);
+
+            authcodedb.del(code, function (error) {
+                if(error) return callback(error);
+
+                var token = tokendb.generateToken();
+                var expires = Date.now() + constants.DEFAULT_TOKEN_EXPIRATION;
+                var scope = accesscontrol.canonicalScope(client.scope);
+
+                tokendb.add(token, authCode.userId, authCode.clientId, expires, client.scope, function (error) {
+                    if (error) return callback(error);
+
+                    debug('exchange: new access token for client %s token %s', client.id, token);
+
+                    callback(null, token);
+                });
            });
        });
-    });
-}));
+    }));

-// overwrite the session.ensureLoggedIn to not use res.redirect() due to a chrome bug not sending cookies on redirects
-session.ensureLoggedIn = function (redirectTo) {
-    assert.strictEqual(typeof redirectTo, 'string');
+    // overwrite the session.ensureLoggedIn to not use res.redirect() due to a chrome bug not sending cookies on redirects
+    session.ensureLoggedIn = function (redirectTo) {
+        assert.strictEqual(typeof redirectTo, 'string');

-    return function (req, res, next) {
-        if (!req.isAuthenticated || !req.isAuthenticated()) {
-            if (req.session) {
-                req.session.returnTo = req.originalUrl || req.url;
+        return function (req, res, next) {
+            if (!req.isAuthenticated || !req.isAuthenticated()) {
+                if (req.session) {
+                    req.session.returnTo = req.originalUrl || req.url;
+                }
+
+                res.status(200).send(util.format('<script>window.location.href = "%s";</script>', redirectTo));
+            } else {
+                next();
            }
-
-            res.status(200).send(util.format('<script>window.location.href = "%s";</script>', redirectTo));
-        } else {
-            next();
-        }
+        };
    };
-};
+}
+
+function uninitialize() {
+    gServer = null;
+}

 function renderTemplate(res, template, data) {
    assert.strictEqual(typeof res, 'object');
@@ -232,9 +264,9 @@ function loginForm(req, res) {
        if (error) return sendError(req, res, 'Unknown OAuth client');

        switch (result.type) {
-            case clients.TYPE_BUILT_IN: return renderBuiltIn();
-            case clients.TYPE_EXTERNAL: return render(result.appId, '/api/v1/cloudron/avatar');
-            default: break;
+        case clients.TYPE_BUILT_IN: return renderBuiltIn();
+        case clients.TYPE_EXTERNAL: return render(result.appId, '/api/v1/cloudron/avatar');
+        default: break;
        }

        apps.get(result.appId, function (error, result) {
@@ -254,6 +286,19 @@ function login(req, res) {
    passport.authenticate('local', {
        failureRedirect: '/api/v1/session/login?' + failureQuery
    })(req, res, function () {
+        if (!req.user.ghost && req.user.twoFactorAuthenticationEnabled) {
+            if (!req.body.totpToken) {
+                let failureQuery = querystring.stringify({ error: 'A 2FA token is required', returnTo: returnTo });
+                return res.redirect('/api/v1/session/login?' + failureQuery);
+            }
+
+            let verified = speakeasy.totp.verify({ secret: req.user.twoFactorAuthenticationSecret, encoding: 'base32', token: req.body.totpToken });
+            if (!verified) {
+                let failureQuery = querystring.stringify({ error: 'The 2FA token is invalid', returnTo: returnTo });
+                return res.redirect('/api/v1/session/login?' + failureQuery);
+            }
+        }
+
        res.redirect(returnTo);
    });
 }
@@ -286,8 +331,8 @@ function passwordResetRequest(req, res, next) {

    debug('passwordResetRequest: email or username %s.', req.body.identifier);

-    user.resetPasswordByIdentifier(req.body.identifier, function (error) {
-        if (error && error.reason !== UserError.NOT_FOUND) {
+    users.resetPasswordByIdentifier(req.body.identifier, function (error) {
+        if (error && error.reason !== UsersError.NOT_FOUND) {
            console.error(error);
            return sendErrorPageOrRedirect(req, res, 'User not found');
        }
@@ -315,7 +360,7 @@ function renderAccountSetupSite(res, req, userObject, error) {
 function accountSetupSite(req, res) {
    if (!req.query.reset_token) return sendError(req, res, 'Missing Reset Token');

-    user.getByResetToken(req.query.reset_token, function (error, userObject) {
+    users.getByResetToken(req.query.reset_token, function (error, userObject) {
        if (error) return sendError(req, res, 'Invalid Reset Token');

        renderAccountSetupSite(res, req, userObject, '');
@@ -333,26 +378,26 @@ function accountSetup(req, res, next) {

    debug('acountSetup: with token %s.', req.body.resetToken);

-    user.getByResetToken(req.body.resetToken, function (error, userObject) {
+    users.getByResetToken(req.body.resetToken, function (error, userObject) {
        if (error) return sendError(req, res, 'Invalid Reset Token');

        var data = _.pick(req.body, 'username', 'displayName');
-        user.update(userObject.id, data, auditSource(req), function (error) {
-            if (error && error.reason === UserError.ALREADY_EXISTS) return renderAccountSetupSite(res, req, userObject, 'Username already exists');
-            if (error && error.reason === UserError.BAD_FIELD) return renderAccountSetupSite(res, req, userObject, error.message);
-            if (error && error.reason === UserError.NOT_FOUND) return renderAccountSetupSite(res, req, userObject, 'No such user');
+        users.update(userObject.id, data, auditSource(req), function (error) {
+            if (error && error.reason === UsersError.ALREADY_EXISTS) return renderAccountSetupSite(res, req, userObject, 'Username already exists');
+            if (error && error.reason === UsersError.BAD_FIELD) return renderAccountSetupSite(res, req, userObject, error.message);
+            if (error && error.reason === UsersError.NOT_FOUND) return renderAccountSetupSite(res, req, userObject, 'No such user');
            if (error) return next(new HttpError(500, error));

            userObject.username = req.body.username;
            userObject.displayName = req.body.displayName;

            // setPassword clears the resetToken
-            user.setPassword(userObject.id, req.body.password, function (error, result) {
-                if (error && error.reason === UserError.BAD_FIELD) return renderAccountSetupSite(res, req, userObject, error.message);
+            users.setPassword(userObject.id, req.body.password, function (error, result) {
+                if (error && error.reason === UsersError.BAD_FIELD) return renderAccountSetupSite(res, req, userObject, error.message);

                if (error) return next(new HttpError(500, error));

-                res.redirect(util.format('%s?accessToken=%s&expiresAt=%s', config.adminOrigin(), result.token, result.expiresAt));
+                res.redirect(config.adminOrigin());
            });
        });
    });
@@ -362,7 +407,7 @@ function accountSetup(req, res, next) {
 function passwordResetSite(req, res, next) {
    if (!req.query.reset_token) return next(new HttpError(400, 'Missing reset_token'));

-    user.getByResetToken(req.query.reset_token, function (error, user) {
+    users.getByResetToken(req.query.reset_token, function (error, user) {
        if (error) return next(new HttpError(401, 'Invalid reset_token'));

        renderTemplate(res, 'password_reset', {
@@ -383,17 +428,17 @@ function passwordReset(req, res, next) {

    debug('passwordReset: with token %s.', req.body.resetToken);

-    user.getByResetToken(req.body.resetToken, function (error, userObject) {
+    users.getByResetToken(req.body.resetToken, function (error, userObject) {
        if (error) return next(new HttpError(401, 'Invalid resetToken'));

        if (!userObject.username) return next(new HttpError(401, 'No username set'));

        // setPassword clears the resetToken
-        user.setPassword(userObject.id, req.body.password, function (error, result) {
-            if (error && error.reason === UserError.BAD_FIELD) return next(new HttpError(406, error.message));
+        users.setPassword(userObject.id, req.body.password, function (error) {
+            if (error && error.reason === UsersError.BAD_FIELD) return next(new HttpError(406, error.message));
            if (error) return next(new HttpError(500, error));

-            res.redirect(util.format('%s?accessToken=%s&expiresAt=%s', config.adminOrigin(), result.token, result.expiresAt));
+            res.redirect(config.adminOrigin());
        });
    });
 }
@@ -402,13 +447,14 @@ function passwordReset(req, res, next) {
 // The callback page takes the redirectURI and the authCode and redirects the browser accordingly
 //
 // -> GET /api/v1/session/callback
-var callback = [
-    session.ensureLoggedIn('/api/v1/session/login'),
-    function (req, res) {
-        renderTemplate(res, 'callback', { callbackServer: req.query.redirectURI });
-    }
-];
-
+function sessionCallback() {
+    return [
+        session.ensureLoggedIn('/api/v1/session/login'),
+        function (req, res) {
+            renderTemplate(res, 'callback', { callbackServer: req.query.redirectURI });
+        }
+    ];
+}

 // The authorization endpoint is the entry point for an OAuth login.
 //
@@ -420,54 +466,55 @@ var callback = [
 //  - Then it will redirect the browser to the given <callbackURL> containing the authcode in the query
 //
 // -> GET /api/v1/oauth/dialog/authorize
-var authorization = [
-    function (req, res, next) {
-        if (!req.query.redirect_uri) return sendErrorPageOrRedirect(req, res, 'Invalid request. redirect_uri query param is not set.');
-        if (!req.query.client_id) return sendErrorPageOrRedirect(req, res, 'Invalid request. client_id query param is not set.');
-        if (!req.query.response_type) return sendErrorPageOrRedirect(req, res, 'Invalid request. response_type query param is not set.');
-        if (req.query.response_type !== 'code' && req.query.response_type !== 'token') return sendErrorPageOrRedirect(req, res, 'Invalid request. Only token and code response types are supported.');
+function authorization() {
+    return [
+        function (req, res, next) {
+            if (!req.query.redirect_uri) return sendErrorPageOrRedirect(req, res, 'Invalid request. redirect_uri query param is not set.');
+            if (!req.query.client_id) return sendErrorPageOrRedirect(req, res, 'Invalid request. client_id query param is not set.');
+            if (!req.query.response_type) return sendErrorPageOrRedirect(req, res, 'Invalid request. response_type query param is not set.');
+            if (req.query.response_type !== 'code' && req.query.response_type !== 'token') return sendErrorPageOrRedirect(req, res, 'Invalid request. Only token and code response types are supported.');

-        session.ensureLoggedIn('/api/v1/session/login?returnTo=' + req.query.redirect_uri)(req, res, next);
-    },
-    gServer.authorization({}, function (clientId, redirectURI, callback) {
-        debug('authorization: client %s with callback to %s.', clientId, redirectURI);
+            session.ensureLoggedIn('/api/v1/session/login?returnTo=' + req.query.redirect_uri)(req, res, next);
+        },
+        gServer.authorization({}, function (clientId, redirectURI, callback) {
+            debug('authorization: client %s with callback to %s.', clientId, redirectURI);

-        clients.get(clientId, function (error, client) {
-            if (error && error.reason === ClientsError.NOT_FOUND) return callback(null, false);
-            if (error) return callback(error);
+            clients.get(clientId, function (error, client) {
+                if (error && error.reason === ClientsError.NOT_FOUND) return callback(null, false);
+                if (error) return callback(error);

-            // ignore the origin passed into form the client, but use the one from the clientdb
-            var redirectPath = url.parse(redirectURI).path;
-            var redirectOrigin = client.redirectURI;
+                // ignore the origin passed into form the client, but use the one from the clientdb
+                var redirectPath = url.parse(redirectURI).path;
+                var redirectOrigin = client.redirectURI;

-            callback(null, client, '/api/v1/session/callback?redirectURI=' + encodeURIComponent(url.resolve(redirectOrigin, redirectPath)));
-        });
-    }),
-    function (req, res, next) {
-        // Handle our different types of oauth clients
-        var type = req.oauth2.client.type;
-
-        if (type === clients.TYPE_EXTERNAL || type === clients.TYPE_BUILT_IN) {
-            eventlog.add(eventlog.ACTION_USER_LOGIN, auditSource(req, req.oauth2.client.appId), { userId: req.oauth2.user.id, user: user.removePrivateFields(req.oauth2.user) });
-            return next();
-        }
-
-        apps.get(req.oauth2.client.appId, function (error, appObject) {
-            if (error) return sendErrorPageOrRedirect(req, res, 'Invalid request. Unknown app for this client_id.');
-
-            apps.hasAccessTo(appObject, req.oauth2.user, function (error, access) {
-                if (error) return sendError(req, res, 'Internal error');
-                if (!access) return sendErrorPageOrRedirect(req, res, 'No access to this app.');
-
-                eventlog.add(eventlog.ACTION_USER_LOGIN, auditSource(req, appObject.id, appObject), { userId: req.oauth2.user.id, user: user.removePrivateFields(req.oauth2.user) });
-
-                next();
+                callback(null, client, '/api/v1/session/callback?redirectURI=' + encodeURIComponent(url.resolve(redirectOrigin, redirectPath)));
            });
-        });
-    },
-    gServer.decision({ loadTransaction: false })
-];
+        }),
+        function (req, res, next) {
+            // Handle our different types of oauth clients
+            var type = req.oauth2.client.type;

+            if (type === clients.TYPE_EXTERNAL || type === clients.TYPE_BUILT_IN) {
+                eventlog.add(eventlog.ACTION_USER_LOGIN, auditSource(req, req.oauth2.client.appId), { userId: req.oauth2.user.id, user: users.removePrivateFields(req.oauth2.user) });
+                return next();
+            }
+
+            apps.get(req.oauth2.client.appId, function (error, appObject) {
+                if (error) return sendErrorPageOrRedirect(req, res, 'Invalid request. Unknown app for this client_id.');
+
+                apps.hasAccessTo(appObject, req.oauth2.user, function (error, access) {
+                    if (error) return sendError(req, res, 'Internal error');
+                    if (!access) return sendErrorPageOrRedirect(req, res, 'No access to this app.');
+
+                    eventlog.add(eventlog.ACTION_USER_LOGIN, auditSource(req, appObject.id, appObject), { userId: req.oauth2.user.id, user: users.removePrivateFields(req.oauth2.user) });
+
+                    next();
+                });
+            });
+        },
+        gServer.decision({ loadTransaction: false })
+    ];
+}

 //  The token endpoint allows an OAuth client to exchange an authcode with an accesstoken.
 //
@@ -476,109 +523,22 @@ var authorization = [
 //  An authcode is only good for one such exchange to an accesstoken.
 //
 // -> POST /api/v1/oauth/token
-var token = [
-    passport.authenticate(['basic', 'oauth2-client-password'], { session: false }),
-    gServer.token(),
-    gServer.errorHandler()
-];
-
-// tests if all requestedScopes are attached to the request
-function validateRequestedScopes(req, requestedScopes) {
-    assert.strictEqual(typeof req, 'object');
-    assert(Array.isArray(requestedScopes));
-
-    if (!req.authInfo || !req.authInfo.scope) return new Error('No scope found');
-
-    var scopes = req.authInfo.scope.split(',');
-
-    // check for roles separately
-    if (requestedScopes.indexOf(clients.SCOPE_ROLE_SDK) !== -1 && scopes.indexOf(clients.SCOPE_ROLE_SDK) === -1) {
-        return new Error('Missing required scope role "' + clients.SCOPE_ROLE_SDK + '"');
-    }
-
-    if (scopes.indexOf('*') !== -1) return null;
-
-    for (var i = 0; i < requestedScopes.length; ++i) {
-        if (scopes.indexOf(requestedScopes[i]) === -1) {
-            debug('scope: missing scope "%s".', requestedScopes[i]);
-            return new Error('Missing required scope "' + requestedScopes[i] + '"');
-        }
-    }
-
-    return null;
-}
-
-//  The scope middleware provides an auth middleware for routes.
-//
-//  It is used for API routes, which are authenticated using accesstokens.
-//  Those accesstokens carry OAuth scopes and the middleware takes the required
-//  scope as an argument and will verify the accesstoken against it.
-//
-//  See server.js:
-//    var profileScope = routes.oauth2.scope('profile');
-//
-function scope(requestedScope) {
-    assert.strictEqual(typeof requestedScope, 'string');
-
-    var requestedScopes = requestedScope.split(',');
-    debug('scope: add routes with requested scopes', requestedScopes);
-
+function token() {
    return [
-        passport.authenticate(['bearer'], { session: false }),
-        function (req, res, next) {
-            var error = validateRequestedScopes(req, requestedScopes);
-            if (error) return next(new HttpError(401, error.message));
-
-            next();
-        }
+        passport.authenticate(['basic', 'oauth2-client-password'], { session: false }),
+        gServer.token(),
+        gServer.errorHandler()
    ];
 }

-function websocketAuth(requestedScopes, req, res, next) {
-    assert(Array.isArray(requestedScopes));
-
-    if (typeof req.query.access_token !== 'string') return next(new HttpError(401, 'Unauthorized'));
-
-    auth.accessTokenAuth(req.query.access_token, function (error, user, info) {
-        if (error) return next(new HttpError(500, error.message));
-        if (!user) return next(new HttpError(401, 'Unauthorized'));
-
-        req.user = user;
-        req.authInfo = info;
-
-        var error = validateRequestedScopes(req, requestedScopes);
-        if (error) return next(new HttpError(401, error.message));
-
-        next();
-    });
-}
-
 // Cross-site request forgery protection middleware for login form
-var csrf = [
-    middleware.csrf(),
-    function (err, req, res, next) {
-        if (err.code !== 'EBADCSRFTOKEN') return next(err);
+function csrf() {
+    return [
+        middleware.csrf(),
+        function (err, req, res, next) {
+            if (err.code !== 'EBADCSRFTOKEN') return next(err);

-        sendErrorPageOrRedirect(req, res, 'Form expired');
-    }
-];
-
-exports = module.exports = {
-    loginForm: loginForm,
-    login: login,
-    logout: logout,
-    callback: callback,
-    passwordResetRequestSite: passwordResetRequestSite,
-    passwordResetRequest: passwordResetRequest,
-    passwordSentSite: passwordSentSite,
-    passwordResetSite: passwordResetSite,
-    passwordReset: passwordReset,
-    accountSetupSite: accountSetupSite,
-    accountSetup: accountSetup,
-    authorization: authorization,
-    token: token,
-    validateRequestedScopes: validateRequestedScopes,
-    scope: scope,
-    websocketAuth: websocketAuth,
-    csrf: csrf
-};
+            sendErrorPageOrRedirect(req, res, 'Form expired');
+        }
+    ];
+}
@@ -3,14 +3,18 @@
 exports = module.exports = {
    get: get,
    update: update,
-    changePassword: changePassword
+    changePassword: changePassword,
+    setTwoFactorAuthenticationSecret: setTwoFactorAuthenticationSecret,
+    enableTwoFactorAuthentication: enableTwoFactorAuthentication,
+    disableTwoFactorAuthentication: disableTwoFactorAuthentication
 };

-var assert = require('assert'),
+var accesscontrol = require('../accesscontrol.js'),
+    assert = require('assert'),
    HttpError = require('connect-lastmile').HttpError,
    HttpSuccess = require('connect-lastmile').HttpSuccess,
-    user = require('../user.js'),
-    UserError = user.UserError,
+    users = require('../users.js'),
+    UsersError = users.UsersError,
    _ = require('underscore');

 function auditSource(req) {
@@ -27,7 +31,9 @@ function get(req, res, next) {
        email: req.user.email,
        fallbackEmail: req.user.fallbackEmail,
        admin: req.user.admin,
-        displayName: req.user.displayName
+        scope: accesscontrol.canonicalScope(req.authInfo.scope), // this returns the token scope and not the user's scope
+        displayName: req.user.displayName,
+        twoFactorAuthenticationEnabled: req.user.twoFactorAuthenticationEnabled
    }));
 }

@@ -41,10 +47,10 @@ function update(req, res, next) {

    var data = _.pick(req.body, 'email', 'fallbackEmail', 'displayName');

-    user.update(req.user.id, data, auditSource(req), function (error) {
-        if (error && error.reason === UserError.BAD_FIELD) return next(new HttpError(400, error.message));
-        if (error && error.reason === UserError.ALREADY_EXISTS) return next(new HttpError(409, error.message));
-        if (error && error.reason === UserError.NOT_FOUND) return next(new HttpError(404, 'User not found'));
+    users.update(req.user.id, data, auditSource(req), function (error) {
+        if (error && error.reason === UsersError.BAD_FIELD) return next(new HttpError(400, error.message));
+        if (error && error.reason === UsersError.ALREADY_EXISTS) return next(new HttpError(409, error.message));
+        if (error && error.reason === UsersError.NOT_FOUND) return next(new HttpError(404, 'User not found'));
        if (error) return next(new HttpError(500, error));

        next(new HttpSuccess(204));
@@ -57,11 +63,48 @@ function changePassword(req, res, next) {

    if (typeof req.body.newPassword !== 'string') return next(new HttpError(400, 'newPassword must be a string'));

-    user.setPassword(req.user.id, req.body.newPassword, function (error) {
-        if (error && error.reason === UserError.BAD_FIELD) return next(new HttpError(400, error.message));
-        if (error && error.reason === UserError.NOT_FOUND) return next(new HttpError(403, 'Wrong password'));
+    users.setPassword(req.user.id, req.body.newPassword, function (error) {
+        if (error && error.reason === UsersError.BAD_FIELD) return next(new HttpError(400, error.message));
+        if (error && error.reason === UsersError.NOT_FOUND) return next(new HttpError(403, 'Wrong password'));
        if (error) return next(new HttpError(500, error));

        next(new HttpSuccess(204));
    });
 }
+
+function setTwoFactorAuthenticationSecret(req, res, next) {
+    assert.strictEqual(typeof req.user, 'object');
+
+    users.setTwoFactorAuthenticationSecret(req.user.id, function (error, result) {
+        if (error && error.reason === UsersError.ALREADY_EXISTS) return next(new HttpError(409, 'TwoFactor Authentication is enabled, disable first'));
+        if (error) return next(new HttpError(500, error));
+
+        next(new HttpSuccess(201, { secret: result.secret, qrcode: result.qrcode }));
+    });
+}
+
+function enableTwoFactorAuthentication(req, res, next) {
+    assert.strictEqual(typeof req.body, 'object');
+    assert.strictEqual(typeof req.user, 'object');
+
+    if (!req.body.totpToken || typeof req.body.totpToken !== 'string') return next(new HttpError(400, 'totpToken must be a nonempty string'));
+
+    users.enableTwoFactorAuthentication(req.user.id, req.body.totpToken, function (error) {
+        if (error && error.reason === UsersError.NOT_FOUND) return next(new HttpError(404, 'User not found'));
+        if (error && error.reason === UsersError.BAD_TOKEN) return next(new HttpError(403, 'Invalid token'));
+        if (error && error.reason === UsersError.ALREADY_EXISTS) return next(new HttpError(409, 'TwoFactor Authentication is already enabled'));
+        if (error) return next(new HttpError(500, error));
+
+        next(new HttpSuccess(202, {}));
+    });
+}
+
+function disableTwoFactorAuthentication(req, res, next) {
+    assert.strictEqual(typeof req.user, 'object');
+
+    users.disableTwoFactorAuthentication(req.user.id, function (error) {
+        if (error) return next(new HttpError(500, error));
+
+        next(new HttpSuccess(202, {}));
+    });
+}
@@ -0,0 +1,117 @@
+/* jslint node:true */
+/* global it:false */
+/* global describe:false */
+/* global before:false */
+/* global after:false */
+
+'use strict';
+
+var accesscontrol = require('../accesscontrol.js'),
+    expect = require('expect.js'),
+    HttpError = require('connect-lastmile').HttpError,
+    passport = require('passport');
+
+describe('scopes middleware', function () {
+    var passportAuthenticateSave = null;
+
+    before(function () {
+        passportAuthenticateSave = passport.authenticate;
+        passport.authenticate = function () {
+            return function (req, res, next) { next(); };
+        };
+    });
+
+    after(function () {
+        passport.authenticate = passportAuthenticateSave;
+    });
+
+    it('fails due to missing authInfo', function (done) {
+        var mw = accesscontrol.scope('admin')[1];
+        var req = {};
+
+        mw(req, null, function (error) {
+            expect(error).to.be.a(HttpError);
+            done();
+        });
+    });
+
+    it('fails due to missing scope property in authInfo', function (done) {
+        var mw = accesscontrol.scope('admin')[1];
+        var req = { authInfo: {} };
+
+        mw(req, null, function (error) {
+            expect(error).to.be.a(HttpError);
+            done();
+        });
+    });
+
+    it('fails due to missing scope in request', function (done) {
+        var mw = accesscontrol.scope('admin')[1];
+        var req = { authInfo: { scope: '' } };
+
+        mw(req, null, function (error) {
+            expect(error).to.be.a(HttpError);
+            done();
+        });
+    });
+
+    it('fails due to wrong scope in request', function (done) {
+        var mw = accesscontrol.scope('admin')[1];
+        var req = { authInfo: { scope: 'foobar,something' } };
+
+        mw(req, null, function (error) {
+            expect(error).to.be.a(HttpError);
+            done();
+        });
+    });
+
+    it('fails due to wrong scope in request', function (done) {
+        var mw = accesscontrol.scope('admin,users')[1];
+        var req = { authInfo: { scope: 'foobar,admin' } };
+
+        mw(req, null, function (error) {
+            expect(error).to.be.a(HttpError);
+            done();
+        });
+    });
+
+    it('succeeds with one requested scope and one provided scope', function (done) {
+        var mw = accesscontrol.scope('admin')[1];
+        var req = { authInfo: { scope: 'admin' } };
+
+        mw(req, null, function (error) {
+            expect(error).to.not.be.ok();
+            done();
+        });
+    });
+
+    it('succeeds with one requested scope and two provided scopes', function (done) {
+        var mw = accesscontrol.scope('admin')[1];
+        var req = { authInfo: { scope: 'foobar,admin' } };
+
+        mw(req, null, function (error) {
+            expect(error).to.not.be.ok();
+            done();
+        });
+    });
+
+    it('succeeds with two requested scope and two provided scopes', function (done) {
+        var mw = accesscontrol.scope('admin,foobar')[1];
+        var req = { authInfo: { scope: 'foobar,admin' } };
+
+        mw(req, null, function (error) {
+            expect(error).to.not.be.ok();
+            done();
+        });
+    });
+
+    it('succeeds with two requested scope and provided wildcard scope', function (done) {
+        var mw = accesscontrol.scope('admin,foobar')[1];
+        var req = { authInfo: { scope: '*' } };
+
+        mw(req, null, function (error) {
+            expect(error).to.not.be.ok();
+            done();
+        });
+    });
+});
@@ -6,7 +6,8 @@
 /* global before:false */
 /* global after:false */

-var appdb = require('../../appdb.js'),
+var accesscontrol = require('../../accesscontrol.js'),
+    appdb = require('../../appdb.js'),
    apps = require('../../apps.js'),
    assert = require('assert'),
    async = require('async'),
@@ -175,47 +176,47 @@ function startBox(done) {

        function (callback) {
            superagent.post(SERVER_URL + '/api/v1/cloudron/dns_setup')
-                   .send({ provider: 'noop', domain: DOMAIN_0.domain, adminFqdn: 'my.' + DOMAIN_0.domain, config: DOMAIN_0.config, tlsConfig: DOMAIN_0.tlsConfig })
-                   .end(function (error, result) {
-                expect(result).to.be.ok();
-                expect(result.statusCode).to.eql(200);
+                .send({ provider: 'noop', domain: DOMAIN_0.domain, adminFqdn: 'my.' + DOMAIN_0.domain, config: DOMAIN_0.config, tlsConfig: DOMAIN_0.tlsConfig })
+                .end(function (error, result) {
+                    expect(result).to.be.ok();
+                    expect(result.statusCode).to.eql(200);

-                callback();
-            });
+                    callback();
+                });
        },

        function (callback) {
            superagent.post(SERVER_URL + '/api/v1/cloudron/activate')
-                   .send({ username: USERNAME, password: PASSWORD, email: EMAIL })
-                   .end(function (error, result) {
-                expect(result).to.be.ok();
-                expect(result.statusCode).to.eql(201);
+                .send({ username: USERNAME, password: PASSWORD, email: EMAIL })
+                .end(function (error, result) {
+                    expect(result).to.be.ok();
+                    expect(result.statusCode).to.eql(201);

-                // stash for further use
-                token = result.body.token;
+                    // stash for further use
+                    token = result.body.token;

-                callback();
-            });
+                    callback();
+                });
        },

        function (callback) {
            superagent.post(SERVER_URL + '/api/v1/users')
-                   .query({ access_token: token })
-                   .send({ username: USERNAME_1, email: EMAIL_1, invite: false })
-                   .end(function (err, res) {
-                expect(res.statusCode).to.equal(201);
+                .query({ access_token: token })
+                .send({ username: USERNAME_1, email: EMAIL_1, invite: false })
+                .end(function (err, res) {
+                    expect(res.statusCode).to.equal(201);

-                user_1_id = res.body.id;
+                    user_1_id = res.body.id;

-                callback(null);
-            });
+                    callback(null);
+                });
        },

        function (callback) {
            token_1 = tokendb.generateToken();

            // HACK to get a token for second user (passwords are generated and the user should have gotten a password setup link...)
-            tokendb.add(token_1, user_1_id, 'test-client-id',  Date.now() + 1000000, '*', callback);
+            tokendb.add(token_1, user_1_id, 'test-client-id',  Date.now() + 1000000, accesscontrol.SCOPE_ANY, callback);
        },

        function (callback) {
@@ -268,179 +269,179 @@ describe('App API', function () {

    it('app install fails - missing manifest', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/install')
-               .query({ access_token: token })
-               .end(function (err, res) {
-            expect(res.statusCode).to.equal(400);
-            expect(res.body.message).to.eql('appStoreId or manifest is required');
-            done();
-        });
+            .query({ access_token: token })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(400);
+                expect(res.body.message).to.eql('appStoreId or manifest is required');
+                done();
+            });
    });

    it('app install fails - null manifest', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/install')
-               .query({ access_token: token })
-               .send({ manifest: null })
-               .end(function (err, res) {
-            expect(res.statusCode).to.equal(400);
-            expect(res.body.message).to.eql('appStoreId or manifest is required');
-            done();
-        });
+            .query({ access_token: token })
+            .send({ manifest: null })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(400);
+                expect(res.body.message).to.eql('appStoreId or manifest is required');
+                done();
+            });
    });

    it('app install fails - bad manifest format', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/install')
-               .query({ access_token: token })
-               .send({ manifest: 'epic' })
-               .end(function (err, res) {
-            expect(res.statusCode).to.equal(400);
-            expect(res.body.message).to.eql('manifest must be an object');
-            done();
-        });
+            .query({ access_token: token })
+            .send({ manifest: 'epic' })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(400);
+                expect(res.body.message).to.eql('manifest must be an object');
+                done();
+            });
    });

    it('app install fails - empty appStoreId format', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/install')
-               .query({ access_token: token })
-               .send({ manifest: null, appStoreId: '' })
-               .end(function (err, res) {
-            expect(res.statusCode).to.equal(400);
-            expect(res.body.message).to.eql('appStoreId or manifest is required');
-            done();
-        });
+            .query({ access_token: token })
+            .send({ manifest: null, appStoreId: '' })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(400);
+                expect(res.body.message).to.eql('appStoreId or manifest is required');
+                done();
+            });
    });

-   it('app install fails - invalid json', function (done) {
+    it('app install fails - invalid json', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/install')
-               .query({ access_token: token })
-               .send('garbage')
-               .end(function (err, res) {
-            expect(res.statusCode).to.equal(400);
-            done();
-        });
+            .query({ access_token: token })
+            .send('garbage')
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(400);
+                done();
+            });
    });

    it('app install fails - missing domain', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/install')
-               .query({ access_token: token })
-               .send({ manifest: APP_MANIFEST, location: 'some', accessRestriction: null })
-               .end(function (err, res) {
-            expect(res.statusCode).to.equal(400);
-            expect(res.body.message).to.eql('domain is required');
-            done();
-        });
+            .query({ access_token: token })
+            .send({ manifest: APP_MANIFEST, location: 'some', accessRestriction: null })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(400);
+                expect(res.body.message).to.eql('domain is required');
+                done();
+            });
    });

    it('app install fails - non-existing domain', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/install')
-               .query({ access_token: token })
-               .send({ manifest: APP_MANIFEST, location: 'some', accessRestriction: null, domain: 'doesnotexist.com' })
-               .end(function (err, res) {
-            expect(res.statusCode).to.equal(404);
-            expect(res.body.message).to.eql('No such domain');
-            done();
-        });
+            .query({ access_token: token })
+            .send({ manifest: APP_MANIFEST, location: 'some', accessRestriction: null, domain: 'doesnotexist.com' })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(404);
+                expect(res.body.message).to.eql('No such domain');
+                done();
+            });
    });

    it('app install fails - invalid location type', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/install')
-               .query({ access_token: token })
-               .send({ manifest: APP_MANIFEST, location: 42, accessRestriction: null, domain: DOMAIN_0.domain })
-               .end(function (err, res) {
-            expect(res.statusCode).to.equal(400);
-            expect(res.body.message).to.eql('location is required');
-            done();
-        });
+            .query({ access_token: token })
+            .send({ manifest: APP_MANIFEST, location: 42, accessRestriction: null, domain: DOMAIN_0.domain })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(400);
+                expect(res.body.message).to.eql('location is required');
+                done();
+            });
    });

    it('app install fails - reserved admin location', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/install')
-               .query({ access_token: token })
-               .send({ manifest: APP_MANIFEST, location: 'my', accessRestriction: null, domain: DOMAIN_0.domain })
-               .end(function (err, res) {
-            expect(res.statusCode).to.equal(400);
-            expect(res.body.message).to.eql('my is reserved');
-            done();
-        });
+            .query({ access_token: token })
+            .send({ manifest: APP_MANIFEST, location: 'my', accessRestriction: null, domain: DOMAIN_0.domain })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(400);
+                expect(res.body.message).to.eql('my is reserved');
+                done();
+            });
    });

    it('app install fails - reserved api location', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/install')
-               .query({ access_token: token })
-               .send({ manifest: APP_MANIFEST, location: constants.API_LOCATION, accessRestriction: null, domain: DOMAIN_0.domain })
-               .end(function (err, res) {
-            expect(res.statusCode).to.equal(400);
-            expect(res.body.message).to.eql(constants.API_LOCATION + ' is reserved');
-            done();
-        });
+            .query({ access_token: token })
+            .send({ manifest: APP_MANIFEST, location: constants.API_LOCATION, accessRestriction: null, domain: DOMAIN_0.domain })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(400);
+                expect(res.body.message).to.eql(constants.API_LOCATION + ' is reserved');
+                done();
+            });
    });

    it('app install fails - portBindings must be object', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/install')
-               .query({ access_token: token })
-               .send({ manifest: APP_MANIFEST, location: APP_LOCATION, portBindings: 23, accessRestriction: null, domain: DOMAIN_0.domain })
-               .end(function (err, res) {
-            expect(res.statusCode).to.equal(400);
-            expect(res.body.message).to.eql('portBindings must be an object');
-            done();
-        });
+            .query({ access_token: token })
+            .send({ manifest: APP_MANIFEST, location: APP_LOCATION, portBindings: 23, accessRestriction: null, domain: DOMAIN_0.domain })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(400);
+                expect(res.body.message).to.eql('portBindings must be an object');
+                done();
+            });
    });

    it('app install fails - accessRestriction is required', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/install')
-               .query({ access_token: token })
-               .send({ manifest: APP_MANIFEST, location: APP_LOCATION, portBindings: {}, domain: DOMAIN_0.domain })
-               .end(function (err, res) {
-            expect(res.statusCode).to.equal(400);
-            expect(res.body.message).to.eql('accessRestriction is required');
-            done();
-        });
+            .query({ access_token: token })
+            .send({ manifest: APP_MANIFEST, location: APP_LOCATION, portBindings: {}, domain: DOMAIN_0.domain })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(400);
+                expect(res.body.message).to.eql('accessRestriction is required');
+                done();
+            });
    });

    it('app install fails - accessRestriction type is wrong', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/install')
-               .query({ access_token: token })
-               .send({ manifest: APP_MANIFEST, location: APP_LOCATION, portBindings: {}, accessRestriction: '', domain: DOMAIN_0.domain })
-               .end(function (err, res) {
-            expect(res.statusCode).to.equal(400);
-            expect(res.body.message).to.eql('accessRestriction is required');
-            done();
-        });
+            .query({ access_token: token })
+            .send({ manifest: APP_MANIFEST, location: APP_LOCATION, portBindings: {}, accessRestriction: '', domain: DOMAIN_0.domain })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(400);
+                expect(res.body.message).to.eql('accessRestriction is required');
+                done();
+            });
    });

    it('app install fails for non admin', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/install')
-               .query({ access_token: token_1 })
-               .send({ manifest: APP_MANIFEST, location: APP_LOCATION, portBindings: null, accessRestriction: null, domain: DOMAIN_0.domain })
-               .end(function (err, res) {
-            expect(res.statusCode).to.equal(403);
-            done();
-        });
+            .query({ access_token: token_1 })
+            .send({ manifest: APP_MANIFEST, location: APP_LOCATION, portBindings: null, accessRestriction: null, domain: DOMAIN_0.domain })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(403);
+                done();
+            });
    });

    it('app install fails because manifest download fails', function (done) {
        var fake = nock(config.apiServerOrigin()).get('/api/v1/apps/test').reply(404, {});

        superagent.post(SERVER_URL + '/api/v1/apps/install')
-               .query({ access_token: token })
-               .send({ appStoreId: APP_STORE_ID, location: APP_LOCATION, portBindings: null, domain: DOMAIN_0.domain, accessRestriction: { users: [ 'someuser' ], groups: [] } })
-               .end(function (err, res) {
-            expect(res.statusCode).to.equal(404);
-            expect(fake.isDone()).to.be.ok();
-            done();
-        });
+            .query({ access_token: token })
+            .send({ appStoreId: APP_STORE_ID, location: APP_LOCATION, portBindings: null, domain: DOMAIN_0.domain, accessRestriction: { users: [ 'someuser' ], groups: [] } })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(404);
+                expect(fake.isDone()).to.be.ok();
+                done();
+            });
    });

    it('app install fails due to purchase failure', function (done) {
        var fake1 = nock(config.apiServerOrigin()).get('/api/v1/apps/test').reply(200, { manifest: APP_MANIFEST });

        superagent.post(SERVER_URL + '/api/v1/apps/install')
-               .query({ access_token: token })
-               .send({ appStoreId: APP_STORE_ID, location: APP_LOCATION, domain: DOMAIN_0.domain, portBindings: null, accessRestriction: null })
-               .end(function (err, res) {
-            expect(res.statusCode).to.equal(402);
-            expect(fake1.isDone()).to.be.ok();
-            done();
-        });
+            .query({ access_token: token })
+            .send({ appStoreId: APP_STORE_ID, location: APP_LOCATION, domain: DOMAIN_0.domain, portBindings: null, accessRestriction: null })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(402);
+                expect(fake1.isDone()).to.be.ok();
+                done();
+            });
    });

    it('app install succeeds with purchase', function (done) {
@@ -454,70 +455,70 @@ describe('App API', function () {
            expect(fake1.isDone()).to.be.ok();

            superagent.post(SERVER_URL + '/api/v1/apps/install')
-                   .query({ access_token: token })
-                   .send({ appStoreId: APP_STORE_ID, location: APP_LOCATION, domain: DOMAIN_0.domain, portBindings: null, accessRestriction: { users: [ 'someuser' ], groups: [] } })
-                   .end(function (err, res) {
-                expect(res.statusCode).to.equal(202);
-                expect(res.body.id).to.be.a('string');
-                APP_ID = res.body.id;
-                expect(fake2.isDone()).to.be.ok();
-                expect(fake3.isDone()).to.be.ok();
-                done();
-            });
+                .query({ access_token: token })
+                .send({ appStoreId: APP_STORE_ID, location: APP_LOCATION, domain: DOMAIN_0.domain, portBindings: null, accessRestriction: { users: [ 'someuser' ], groups: [] } })
+                .end(function (err, res) {
+                    expect(res.statusCode).to.equal(202);
+                    expect(res.body.id).to.be.a('string');
+                    APP_ID = res.body.id;
+                    expect(fake2.isDone()).to.be.ok();
+                    expect(fake3.isDone()).to.be.ok();
+                    done();
+                });
        });
    });

    it('app install fails because of conflicting location', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/install')
-               .query({ access_token: token })
-               .send({ manifest: APP_MANIFEST, location: APP_LOCATION, domain: DOMAIN_0.domain, portBindings: null, accessRestriction: null })
-               .end(function (err, res) {
-            expect(res.statusCode).to.equal(409);
-            done();
-        });
+            .query({ access_token: token })
+            .send({ manifest: APP_MANIFEST, location: APP_LOCATION, domain: DOMAIN_0.domain, portBindings: null, accessRestriction: null })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(409);
+                done();
+            });
    });

    it('can get app status', function (done) {
        superagent.get(SERVER_URL + '/api/v1/apps/' + APP_ID)
-               .query({ access_token: token })
-               .end(function (err, res) {
-            expect(res.statusCode).to.equal(200);
-            expect(res.body.id).to.eql(APP_ID);
-            expect(res.body.installationState).to.be.ok();
-            done();
-         });
+            .query({ access_token: token })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(200);
+                expect(res.body.id).to.eql(APP_ID);
+                expect(res.body.installationState).to.be.ok();
+                done();
+            });
    });

    it('cannot get invalid app status', function (done) {
        superagent.get(SERVER_URL + '/api/v1/apps/kubachi')
-               .query({ access_token: token })
-               .end(function (err, res) {
-            expect(res.statusCode).to.equal(404);
-            done();
-         });
+            .query({ access_token: token })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(404);
+                done();
+            });
    });

    it('can get all apps', function (done) {
        superagent.get(SERVER_URL + '/api/v1/apps')
-               .query({ access_token: token })
-               .end(function (err, res) {
-            expect(res.statusCode).to.equal(200);
-            expect(res.body.apps).to.be.an('array');
-            expect(res.body.apps[0].id).to.eql(APP_ID);
-            expect(res.body.apps[0].installationState).to.be.ok();
-            done();
-         });
+            .query({ access_token: token })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(200);
+                expect(res.body.apps).to.be.an('array');
+                expect(res.body.apps[0].id).to.eql(APP_ID);
+                expect(res.body.apps[0].installationState).to.be.ok();
+                done();
+            });
    });

    it('non admin cannot see the app due to accessRestriction', function (done) {
        superagent.get(SERVER_URL + '/api/v1/apps')
-               .query({ access_token: token_1 })
-               .end(function (err, res) {
-            expect(res.statusCode).to.equal(200);
-            expect(res.body.apps).to.be.an('array');
-            expect(res.body.apps.length).to.equal(0);
-            done();
-         });
+            .query({ access_token: token_1 })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(200);
+                expect(res.body.apps).to.be.an('array');
+                expect(res.body.apps.length).to.equal(0);
+                done();
+            });
    });

    it('cannot uninstall invalid app', function (done) {
@@ -525,18 +526,18 @@ describe('App API', function () {
            .send({ password: PASSWORD })
            .query({ access_token: token })
            .end(function (err, res) {
-            expect(res.statusCode).to.equal(404);
-            done();
-        });
+                expect(res.statusCode).to.equal(404);
+                done();
+            });
    });

    it('cannot uninstall app without password', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/uninstall')
            .query({ access_token: token })
            .end(function (err, res) {
-            expect(res.statusCode).to.equal(400);
-            done();
-        });
+                expect(res.statusCode).to.equal(400);
+                done();
+            });
    });

    it('cannot uninstall app with wrong password', function (done) {
@@ -544,9 +545,9 @@ describe('App API', function () {
            .send({ password: PASSWORD+PASSWORD })
            .query({ access_token: token })
            .end(function (err, res) {
-            expect(res.statusCode).to.equal(403);
-            done();
-        });
+                expect(res.statusCode).to.equal(403);
+                done();
+            });
    });

    it('non admin cannot uninstall app', function (done) {
@@ -554,9 +555,9 @@ describe('App API', function () {
            .send({ password: PASSWORD })
            .query({ access_token: token_1 })
            .end(function (err, res) {
-            expect(res.statusCode).to.equal(403);
-            done();
-        });
+                expect(res.statusCode).to.equal(403);
+                done();
+            });
    });

    it('can uninstall app', function (done) {
@@ -567,11 +568,11 @@ describe('App API', function () {
            .send({ password: PASSWORD })
            .query({ access_token: token })
            .end(function (err, res) {
-            expect(res.statusCode).to.equal(202);
-            expect(fake1.isDone()).to.be.ok();
-            expect(fake2.isDone()).to.be.ok();
-            done();
-        });
+                expect(res.statusCode).to.equal(202);
+                expect(fake1.isDone()).to.be.ok();
+                expect(fake2.isDone()).to.be.ok();
+                done();
+            });
    });

    it('app install succeeds again', function (done) {
@@ -579,56 +580,56 @@ describe('App API', function () {
        var fake2 = nock(config.apiServerOrigin()).post(function (uri) { return uri.indexOf('/api/v1/users/' + user_1_id + '/cloudrons/' + CLOUDRON_ID + '/apps/') >= 0; }, { 'appstoreId': APP_STORE_ID }).reply(201, { });

        superagent.post(SERVER_URL + '/api/v1/apps/install')
-               .query({ access_token: token })
-               .send({ appStoreId: APP_STORE_ID, location: APP_LOCATION_2, domain: DOMAIN_0.domain, portBindings: null, accessRestriction: null })
-               .end(function (err, res) {
-            expect(res.statusCode).to.equal(202);
-            expect(res.body.id).to.be.a('string');
-            APP_ID = res.body.id;
-            expect(fake1.isDone()).to.be.ok();
-            expect(fake2.isDone()).to.be.ok();
-            done();
-        });
+            .query({ access_token: token })
+            .send({ appStoreId: APP_STORE_ID, location: APP_LOCATION_2, domain: DOMAIN_0.domain, portBindings: null, accessRestriction: null })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(202);
+                expect(res.body.id).to.be.a('string');
+                APP_ID = res.body.id;
+                expect(fake1.isDone()).to.be.ok();
+                expect(fake2.isDone()).to.be.ok();
+                done();
+            });
    });

    it('app install succeeds without password but developer token', function (done) {
        superagent.post(SERVER_URL + '/api/v1/developer/login')
-                .send({ username: USERNAME, password: PASSWORD })
-                .end(function (error, result) {
-            expect(error).to.not.be.ok();
-            expect(result.statusCode).to.equal(200);
-            expect(new Date(result.body.expiresAt).toString()).to.not.be('Invalid Date');
-            expect(result.body.token).to.be.a('string');
+            .send({ username: USERNAME, password: PASSWORD })
+            .end(function (error, result) {
+                expect(error).to.not.be.ok();
+                expect(result.statusCode).to.equal(200);
+                expect(new Date(result.body.expiresAt).toString()).to.not.be('Invalid Date');
+                expect(result.body.token).to.be.a('string');

-            // overwrite non dev token
-            token = result.body.token;
+                // overwrite non dev token
+                token = result.body.token;

-            superagent.post(SERVER_URL + '/api/v1/apps/install')
+                superagent.post(SERVER_URL + '/api/v1/apps/install')
                    .query({ access_token: token })
                    .send({ manifest: APP_MANIFEST, location: APP_LOCATION+APP_LOCATION, domain: DOMAIN_0.domain, portBindings: null, accessRestriction: null })
                    .end(function (err, res) {
-                expect(res.statusCode).to.equal(202);
-                expect(res.body.id).to.be.a('string');
-                APP_ID = res.body.id;
-                done();
+                        expect(res.statusCode).to.equal(202);
+                        expect(res.body.id).to.be.a('string');
+                        APP_ID = res.body.id;
+                        done();
+                    });
            });
-        });
    });

    it('can uninstall app without password but developer token', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/uninstall')
            .query({ access_token: token })
            .end(function (err, res) {
-            expect(res.statusCode).to.equal(202);
-            done();
-        });
+                expect(res.statusCode).to.equal(202);
+                done();
+            });
    });
 });

 describe('App installation', function () {
    this.timeout(100000);

-    var apiHockInstance = hock.createHock({ throwOnUnmatched: false }), apiHockServer;
+    var apiHockInstance = hock.createHock({ throwOnUnmatched: false });

    var validCert1, validKey1;

@@ -676,26 +677,26 @@ describe('App installation', function () {
        var count = 0;
        function checkInstallStatus() {
            superagent.get(SERVER_URL + '/api/v1/apps/' + APP_ID)
-               .query({ access_token: token })
-               .end(function (err, res) {
-                expect(res.statusCode).to.equal(200);
-                if (res.body.installationState === appdb.ISTATE_INSTALLED) { appResult = res.body; return done(null); }
-                if (res.body.installationState === appdb.ISTATE_ERROR) return done(new Error('Install error'));
-                if (++count > 50) return done(new Error('Timedout'));
-                setTimeout(checkInstallStatus, 1000);
-            });
+                .query({ access_token: token })
+                .end(function (err, res) {
+                    expect(res.statusCode).to.equal(200);
+                    if (res.body.installationState === appdb.ISTATE_INSTALLED) { appResult = res.body; return done(null); }
+                    if (res.body.installationState === appdb.ISTATE_ERROR) return done(new Error('Install error'));
+                    if (++count > 50) return done(new Error('Timedout'));
+                    setTimeout(checkInstallStatus, 1000);
+                });
        }

        superagent.post(SERVER_URL + '/api/v1/apps/install')
-              .query({ access_token: token })
-              .send({ appStoreId: APP_STORE_ID, location: APP_LOCATION, domain: DOMAIN_0.domain, portBindings: { ECHO_SERVER_PORT: 7171 }, accessRestriction: null })
-              .end(function (err, res) {
-            expect(res.statusCode).to.equal(202);
-            expect(fake1.isDone()).to.be.ok();
-            expect(fake2.isDone()).to.be.ok();
-            APP_ID = res.body.id;
-            checkInstallStatus();
-        });
+            .query({ access_token: token })
+            .send({ appStoreId: APP_STORE_ID, location: APP_LOCATION, domain: DOMAIN_0.domain, portBindings: { ECHO_SERVER_PORT: 7171 }, accessRestriction: null })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(202);
+                expect(fake1.isDone()).to.be.ok();
+                expect(fake2.isDone()).to.be.ok();
+                APP_ID = res.body.id;
+                checkInstallStatus();
+            });
    });

    it('installation - image created', function (done) {
@@ -752,18 +753,18 @@ describe('App installation', function () {
        (function healthCheck() {
            superagent.get('http://localhost:' + appEntry.httpPort + appResult.manifest.healthCheckPath)
                .end(function (err, res) {
-                if (err || res.statusCode !== 200) {
-                    if (--tryCount === 0) {
-                        console.log('Unable to curl http://localhost:' + appEntry.httpPort + appResult.manifest.healthCheckPath);
-                        return done(new Error('Timedout'));
+                    if (err || res.statusCode !== 200) {
+                        if (--tryCount === 0) {
+                            console.log('Unable to curl http://localhost:' + appEntry.httpPort + appResult.manifest.healthCheckPath);
+                            return done(new Error('Timedout'));
+                        }
+                        return setTimeout(healthCheck, 2000);
                    }
-                    return setTimeout(healthCheck, 2000);
-                }

-                expect(!err).to.be.ok();
-                expect(res.statusCode).to.equal(200);
-                done();
-            });
+                    expect(!err).to.be.ok();
+                    expect(res.statusCode).to.equal(200);
+                    done();
+                });
        })();
    });

@@ -841,23 +842,23 @@ describe('App installation', function () {
        superagent.get(SERVER_URL + '/api/v1/apps/' + APP_ID + '/logs')
            .query({ access_token: token })
            .end(function (err, res) {
-            var data = '';
-            res.on('data', function (d) { data += d.toString('utf8'); });
-            res.on('end', function () {
-                expect(data.length).to.not.be(0);
-                done();
+                var data = '';
+                res.on('data', function (d) { data += d.toString('utf8'); });
+                res.on('end', function () {
+                    expect(data.length).to.not.be(0);
+                    done();
+                });
+                res.on('error', done);
            });
-            res.on('error', done);
-        });
    });

    xit('logStream - requires event-stream accept header', function (done) {
        superagent.get(SERVER_URL + '/api/v1/apps/' + APP_ID + '/logstream')
            .query({ access_token: token, fromLine: 0 })
            .end(function (err, res) {
-            expect(res.statusCode).to.be(400);
-            done();
-        });
+                expect(res.statusCode).to.be(400);
+                done();
+            });
    });


@@ -894,18 +895,18 @@ describe('App installation', function () {
        superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/stop')
            .query({ access_token: token_1 })
            .end(function (err, res) {
-            expect(res.statusCode).to.equal(403);
-            done();
-        });
+                expect(res.statusCode).to.equal(403);
+                done();
+            });
    });

    it('can stop app', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/stop')
            .query({ access_token: token })
            .end(function (err, res) {
-            expect(res.statusCode).to.equal(202);
-            done();
-        });
+                expect(res.statusCode).to.equal(202);
+                done();
+            });
    });

    it('did stop the app', function (done) {
@@ -928,18 +929,18 @@ describe('App installation', function () {
        superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/start')
            .query({ access_token: token_1 })
            .end(function (err, res) {
-            expect(res.statusCode).to.equal(403);
-            done();
-        });
+                expect(res.statusCode).to.equal(403);
+                done();
+            });
    });

    it('can start app', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/start')
            .query({ access_token: token })
            .end(function (err, res) {
-            expect(res.statusCode).to.equal(202);
-            done();
-        });
+                expect(res.statusCode).to.equal(202);
+                done();
+            });
    });

    it('did start the app', function (done) {
@@ -947,10 +948,10 @@ describe('App installation', function () {
        function checkStartState() {
            superagent.get('http://localhost:' + appEntry.httpPort + appResult.manifest.healthCheckPath)
                .end(function (err, res) {
-                if (res && res.statusCode === 200) return done();
-                if (++count > 50) return done(new Error('Timedout'));
-                setTimeout(checkStartState, 500);
-            });
+                    if (res && res.statusCode === 200) return done();
+                    if (++count > 50) return done(new Error('Timedout'));
+                    setTimeout(checkStartState, 500);
+                });
        }

        checkStartState();
@@ -967,94 +968,94 @@ describe('App installation', function () {
        assert.strictEqual(typeof done, 'function');

        superagent.get(SERVER_URL + '/api/v1/apps/' + APP_ID)
-           .query({ access_token: token })
-           .end(function (err, res) {
-            expect(res.statusCode).to.equal(200);
-            if (res.body.installationState === appdb.ISTATE_INSTALLED) { appResult = res.body; expect(appResult).to.be.ok(); return done(null); }
-            if (res.body.installationState === appdb.ISTATE_ERROR) return done(new Error('Install error'));
-            if (++count > 50) return done(new Error('Timedout'));
-            setTimeout(checkConfigureStatus.bind(null, count, done), 1000);
-        });
+            .query({ access_token: token })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(200);
+                if (res.body.installationState === appdb.ISTATE_INSTALLED) { appResult = res.body; expect(appResult).to.be.ok(); return done(null); }
+                if (res.body.installationState === appdb.ISTATE_ERROR) return done(new Error('Install error'));
+                if (++count > 50) return done(new Error('Timedout'));
+                setTimeout(checkConfigureStatus.bind(null, count, done), 1000);
+            });
    }

    it('cannot reconfigure app with bad location', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/configure')
-              .query({ access_token: token })
-              .send({ location: 1234, portBindings: { ECHO_SERVER_PORT: 7172 }, accessRestriction: null })
-              .end(function (err, res) {
-            expect(res.statusCode).to.equal(400);
-            done();
-        });
+            .query({ access_token: token })
+            .send({ location: 1234, portBindings: { ECHO_SERVER_PORT: 7172 }, accessRestriction: null })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(400);
+                done();
+            });
    });

    it('cannot reconfigure app with bad accessRestriction', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/configure')
-              .query({ access_token: token })
-              .send({ portBindings: { ECHO_SERVER_PORT: 7172 }, accessRestriction: false })
-              .end(function (err, res) {
-            expect(res.statusCode).to.equal(400);
-            done();
-        });
+            .query({ access_token: token })
+            .send({ portBindings: { ECHO_SERVER_PORT: 7172 }, accessRestriction: false })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(400);
+                done();
+            });
    });

    it('cannot reconfigure app with only the cert, no key', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/configure')
-              .query({ access_token: token })
-              .send({ location: APP_LOCATION_NEW, portBindings: { ECHO_SERVER_PORT: 7172 }, accessRestriction: null, cert: validCert1 })
-              .end(function (err, res) {
-            expect(res.statusCode).to.equal(400);
-            done();
-        });
+            .query({ access_token: token })
+            .send({ location: APP_LOCATION_NEW, portBindings: { ECHO_SERVER_PORT: 7172 }, accessRestriction: null, cert: validCert1 })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(400);
+                done();
+            });
    });

    it('cannot reconfigure app with only the key, no cert', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/configure')
-              .query({ access_token: token })
-              .send({ location: APP_LOCATION_NEW, portBindings: { ECHO_SERVER_PORT: 7172 }, key: validKey1 })
-              .end(function (err, res) {
-            expect(res.statusCode).to.equal(400);
-            done();
-        });
+            .query({ access_token: token })
+            .send({ location: APP_LOCATION_NEW, portBindings: { ECHO_SERVER_PORT: 7172 }, key: validKey1 })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(400);
+                done();
+            });
    });

    it('cannot reconfigure app with cert not being a string', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/configure')
-              .query({ access_token: token })
-              .send({ location: APP_LOCATION_NEW, portBindings: { ECHO_SERVER_PORT: 7172 }, accessRestriction: null, cert: 1234, key: validKey1 })
-              .end(function (err, res) {
-            expect(res.statusCode).to.equal(400);
-            done();
-        });
+            .query({ access_token: token })
+            .send({ location: APP_LOCATION_NEW, portBindings: { ECHO_SERVER_PORT: 7172 }, accessRestriction: null, cert: 1234, key: validKey1 })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(400);
+                done();
+            });
    });

    it('cannot reconfigure app with key not being a string', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/configure')
-              .query({ access_token: token })
-              .send({ location: APP_LOCATION_NEW, portBindings: { ECHO_SERVER_PORT: 7172 }, cert: validCert1, key: 1234 })
-              .end(function (err, res) {
-            expect(res.statusCode).to.equal(400);
-            done();
-        });
+            .query({ access_token: token })
+            .send({ location: APP_LOCATION_NEW, portBindings: { ECHO_SERVER_PORT: 7172 }, cert: validCert1, key: 1234 })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(400);
+                done();
+            });
    });

    it('non admin cannot reconfigure app', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/configure')
-              .query({ access_token: token_1 })
-              .send({ location: APP_LOCATION_NEW, portBindings: { ECHO_SERVER_PORT: 7172 }, accessRestriction: null })
-              .end(function (err, res) {
-            expect(res.statusCode).to.equal(403);
-            done();
-        });
+            .query({ access_token: token_1 })
+            .send({ location: APP_LOCATION_NEW, portBindings: { ECHO_SERVER_PORT: 7172 }, accessRestriction: null })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(403);
+                done();
+            });
    });

    it('can reconfigure app', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/configure')
-              .query({ access_token: token })
-              .send({ location: APP_LOCATION_NEW, portBindings: { ECHO_SERVER_PORT: 7172 } })
-              .end(function (err, res) {
-            expect(res.statusCode).to.equal(202);
-            checkConfigureStatus(0, done);
-        });
+            .query({ access_token: token })
+            .send({ location: APP_LOCATION_NEW, portBindings: { ECHO_SERVER_PORT: 7172 } })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(202);
+                checkConfigureStatus(0, done);
+            });
    });

    it('changed container id after reconfigure', function (done) {
@@ -1091,12 +1092,12 @@ describe('App installation', function () {

    it('can reconfigure app with custom certificate', function (done) {
        superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/configure')
-              .query({ access_token: token })
-              .send({ location: APP_LOCATION_NEW, portBindings: { ECHO_SERVER_PORT: 7172 }, accessRestriction: null, cert: validCert1, key: validKey1 })
-              .end(function (err, res) {
-            expect(res.statusCode).to.equal(202);
-            checkConfigureStatus(0, done);
-        });
+            .query({ access_token: token })
+            .send({ location: APP_LOCATION_NEW, portBindings: { ECHO_SERVER_PORT: 7172 }, accessRestriction: null, cert: validCert1, key: validKey1 })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(202);
+                checkConfigureStatus(0, done);
+            });
    });

    it('can uninstall app', function (done) {
@@ -1106,25 +1107,25 @@ describe('App installation', function () {
        var count = 0;
        function checkUninstallStatus() {
            superagent.get(SERVER_URL + '/api/v1/apps/' + APP_ID)
-               .query({ access_token: token })
-               .end(function (err, res) {
-                if (res.statusCode === 404) return done(null);
-                if (++count > 50) return done(new Error('Timedout'));
-                setTimeout(checkUninstallStatus, 1000);
-            });
+                .query({ access_token: token })
+                .end(function (err, res) {
+                    if (res.statusCode === 404) return done(null);
+                    if (++count > 50) return done(new Error('Timedout'));
+                    setTimeout(checkUninstallStatus, 1000);
+                });
        }

        superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/uninstall')
            .send({ password: PASSWORD })
            .query({ access_token: token })
            .end(function (err, res) {
-            expect(res.statusCode).to.equal(202);
+                expect(res.statusCode).to.equal(202);

-            expect(fake1.isDone()).to.be.ok();
-            expect(fake2.isDone()).to.be.ok();
+                expect(fake1.isDone()).to.be.ok();
+                expect(fake2.isDone()).to.be.ok();

-            checkUninstallStatus();
-        });
+                checkUninstallStatus();
+            });
    });

    it('uninstalled - container destroyed', function (done) {
@@ -5,7 +5,8 @@
 /* global before:false */
 /* global after:false */

-var async = require('async'),
+var accesscontrol = require('../../accesscontrol.js'),
+    async = require('async'),
    config = require('../../config.js'),
    clients = require('../../clients.js'),
    database = require('../../database.js'),
@@ -60,8 +61,8 @@ describe('OAuth Clients API', function () {
        after(cleanup);

        it('fails without token', function (done) {
-            superagent.post(SERVER_URL + '/api/v1/oauth/clients')
-                .send({ appId: 'someApp', redirectURI: 'http://foobar.com', scope: 'profile' })
+            superagent.post(SERVER_URL + '/api/v1/clients')
+                .send({ appId: 'someApp', redirectURI: 'http://foobar.com', scope: accesscontrol.SCOPE_PROFILE })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(401);
                    done();
@@ -69,9 +70,9 @@ describe('OAuth Clients API', function () {
        });

        it('fails without appId', function (done) {
-            superagent.post(SERVER_URL + '/api/v1/oauth/clients')
+            superagent.post(SERVER_URL + '/api/v1/clients')
                .query({ access_token: token })
-                .send({ redirectURI: 'http://foobar.com', scope: 'profile' })
+                .send({ redirectURI: 'http://foobar.com', scope: accesscontrol.SCOPE_PROFILE })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(400);
                    done();
@@ -79,9 +80,9 @@ describe('OAuth Clients API', function () {
        });

        it('fails with empty appId', function (done) {
-            superagent.post(SERVER_URL + '/api/v1/oauth/clients')
+            superagent.post(SERVER_URL + '/api/v1/clients')
                .query({ access_token: token })
-                .send({ appId: '', redirectURI: 'http://foobar.com', scope: 'profile' })
+                .send({ appId: '', redirectURI: 'http://foobar.com', scope: accesscontrol.SCOPE_PROFILE })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(400);
                    done();
@@ -89,7 +90,7 @@ describe('OAuth Clients API', function () {
        });

        it('fails without scope', function (done) {
-            superagent.post(SERVER_URL + '/api/v1/oauth/clients')
+            superagent.post(SERVER_URL + '/api/v1/clients')
                .query({ access_token: token })
                .send({ appId: 'someApp', redirectURI: 'http://foobar.com' })
                .end(function (error, result) {
@@ -99,7 +100,7 @@ describe('OAuth Clients API', function () {
        });

        it('fails with empty scope', function (done) {
-            superagent.post(SERVER_URL + '/api/v1/oauth/clients')
+            superagent.post(SERVER_URL + '/api/v1/clients')
                .query({ access_token: token })
                .send({ appId: 'someApp', redirectURI: 'http://foobar.com', scope: '' })
                .end(function (error, result) {
@@ -109,9 +110,9 @@ describe('OAuth Clients API', function () {
        });

        it('fails without redirectURI', function (done) {
-            superagent.post(SERVER_URL + '/api/v1/oauth/clients')
+            superagent.post(SERVER_URL + '/api/v1/clients')
                .query({ access_token: token })
-                .send({ appId: 'someApp', scope: 'profile' })
+                .send({ appId: 'someApp', scope: accesscontrol.SCOPE_PROFILE })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(400);
                    done();
@@ -119,9 +120,9 @@ describe('OAuth Clients API', function () {
        });

        it('fails with empty redirectURI', function (done) {
-            superagent.post(SERVER_URL + '/api/v1/oauth/clients')
+            superagent.post(SERVER_URL + '/api/v1/clients')
                .query({ access_token: token })
-                .send({ appId: 'someApp', redirectURI: '', scope: 'profile' })
+                .send({ appId: 'someApp', redirectURI: '', scope: accesscontrol.SCOPE_PROFILE })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(400);
                    done();
@@ -129,9 +130,9 @@ describe('OAuth Clients API', function () {
        });

        it('fails with malformed redirectURI', function (done) {
-            superagent.post(SERVER_URL + '/api/v1/oauth/clients')
+            superagent.post(SERVER_URL + '/api/v1/clients')
                .query({ access_token: token })
-                .send({ appId: 'someApp', redirectURI: 'foobar', scope: 'profile' })
+                .send({ appId: 'someApp', redirectURI: 'foobar', scope: accesscontrol.SCOPE_PROFILE })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(400);
                    done();
@@ -139,9 +140,9 @@ describe('OAuth Clients API', function () {
        });

        it('fails with invalid name', function (done) {
-            superagent.post(SERVER_URL + '/api/v1/oauth/clients')
+            superagent.post(SERVER_URL + '/api/v1/clients')
                .query({ access_token: token })
-                .send({ appId: '$"$%^45asdfasdfadf.adf.', redirectURI: 'http://foobar.com', scope: 'profile' })
+                .send({ appId: '$"$%^45asdfasdfadf.adf.', redirectURI: 'http://foobar.com', scope: accesscontrol.SCOPE_PROFILE })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(400);
                    done();
@@ -149,9 +150,9 @@ describe('OAuth Clients API', function () {
        });

        it('succeeds with dash', function (done) {
-            superagent.post(SERVER_URL + '/api/v1/oauth/clients')
+            superagent.post(SERVER_URL + '/api/v1/clients')
                .query({ access_token: token })
-                .send({ appId: 'fo-1234-bar', redirectURI: 'http://foobar.com', scope: 'profile' })
+                .send({ appId: 'fo-1234-bar', redirectURI: 'http://foobar.com', scope: accesscontrol.SCOPE_PROFILE })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(201);
                    done();
@@ -159,9 +160,9 @@ describe('OAuth Clients API', function () {
        });

        it('succeeds', function (done) {
-            superagent.post(SERVER_URL + '/api/v1/oauth/clients')
+            superagent.post(SERVER_URL + '/api/v1/clients')
                .query({ access_token: token })
-                .send({ appId: 'someApp', redirectURI: 'http://foobar.com', scope: 'profile' })
+                .send({ appId: 'someApp', redirectURI: 'http://foobar.com', scope: accesscontrol.SCOPE_PROFILE })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(201);
                    expect(result.body.id).to.be.a('string');
@@ -181,7 +182,7 @@ describe('OAuth Clients API', function () {
            id: '',
            appId: 'someAppId-0',
            redirectURI: 'http://some.callback0',
-            scope: 'profile'
+            scope: accesscontrol.SCOPE_PROFILE
        };

        before(function (done) {
@@ -189,7 +190,7 @@ describe('OAuth Clients API', function () {
                setup,

                function (callback) {
-                    superagent.post(SERVER_URL + '/api/v1/oauth/clients')
+                    superagent.post(SERVER_URL + '/api/v1/clients')
                        .query({ access_token: token })
                        .send({ appId: CLIENT_0.appId, redirectURI: CLIENT_0.redirectURI, scope: CLIENT_0.scope })
                        .end(function (error, result) {
@@ -206,7 +207,7 @@ describe('OAuth Clients API', function () {
        after(cleanup);

        it('fails without token', function (done) {
-            superagent.get(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_0.id)
+            superagent.get(SERVER_URL + '/api/v1/clients/' + CLIENT_0.id)
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(401);
                    done();
@@ -215,7 +216,7 @@ describe('OAuth Clients API', function () {


        it('fails with unknown id', function (done) {
-            superagent.get(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_0.id.toUpperCase())
+            superagent.get(SERVER_URL + '/api/v1/clients/' + CLIENT_0.id.toUpperCase())
                .query({ access_token: token })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(404);
@@ -224,7 +225,7 @@ describe('OAuth Clients API', function () {
        });

        it('succeeds', function (done) {
-            superagent.get(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_0.id)
+            superagent.get(SERVER_URL + '/api/v1/clients/' + CLIENT_0.id)
                .query({ access_token: token })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(200);
@@ -239,14 +240,14 @@ describe('OAuth Clients API', function () {
            id: '',
            appId: 'someAppId-0',
            redirectURI: 'http://some.callback0',
-            scope: 'profile'
+            scope: accesscontrol.SCOPE_PROFILE
        };

        var CLIENT_1 = {
            id: '',
            appId: 'someAppId-1',
            redirectURI: 'http://some.callback1',
-            scope: 'profile',
+            scope: accesscontrol.SCOPE_PROFILE,
            type: clients.TYPE_OAUTH
        };

@@ -255,7 +256,7 @@ describe('OAuth Clients API', function () {
                setup,

                function (callback) {
-                    superagent.post(SERVER_URL + '/api/v1/oauth/clients')
+                    superagent.post(SERVER_URL + '/api/v1/clients')
                        .query({ access_token: token })
                        .send({ appId: CLIENT_0.appId, redirectURI: CLIENT_0.redirectURI, scope: CLIENT_0.scope })
                        .end(function (error, result) {
@@ -272,7 +273,7 @@ describe('OAuth Clients API', function () {
        after(cleanup);

        it('fails without token', function (done) {
-            superagent.del(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_0.id)
+            superagent.del(SERVER_URL + '/api/v1/clients/' + CLIENT_0.id)
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(401);
                    done();
@@ -281,7 +282,7 @@ describe('OAuth Clients API', function () {


        it('fails with unknown id', function (done) {
-            superagent.del(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_0.id.toUpperCase())
+            superagent.del(SERVER_URL + '/api/v1/clients/' + CLIENT_0.id.toUpperCase())
                .query({ access_token: token })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(404);
@@ -290,12 +291,12 @@ describe('OAuth Clients API', function () {
        });

        it('succeeds', function (done) {
-            superagent.del(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_0.id)
+            superagent.del(SERVER_URL + '/api/v1/clients/' + CLIENT_0.id)
                .query({ access_token: token })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(204);

-                    superagent.get(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_0.id)
+                    superagent.get(SERVER_URL + '/api/v1/clients/' + CLIENT_0.id)
                        .query({ access_token: token })
                        .end(function (error, result) {
                            expect(result.statusCode).to.equal(404);
@@ -306,12 +307,12 @@ describe('OAuth Clients API', function () {
        });

        it('fails for cid-webadmin', function (done) {
-            superagent.del(SERVER_URL + '/api/v1/oauth/clients/cid-webadmin')
+            superagent.del(SERVER_URL + '/api/v1/clients/cid-webadmin')
                .query({ access_token: token })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(405);

-                    superagent.get(SERVER_URL + '/api/v1/oauth/clients/cid-webadmin')
+                    superagent.get(SERVER_URL + '/api/v1/clients/cid-webadmin')
                        .query({ access_token: token })
                        .end(function (error, result) {
                            expect(result.statusCode).to.equal(200);
@@ -327,12 +328,12 @@ describe('OAuth Clients API', function () {

                CLIENT_1.id = result.id;

-                superagent.del(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_1.id)
+                superagent.del(SERVER_URL + '/api/v1/clients/' + CLIENT_1.id)
                    .query({ access_token: token })
                    .end(function (error, result) {
                        expect(result.statusCode).to.equal(405);

-                        superagent.get(SERVER_URL + '/api/v1/oauth/clients/' + CLIENT_1.id)
+                        superagent.get(SERVER_URL + '/api/v1/clients/' + CLIENT_1.id)
                            .query({ access_token: token })
                            .end(function (error, result) {
                                expect(result.statusCode).to.equal(200);
@@ -359,9 +360,11 @@ describe('Clients', function () {
    };

    // make csrf always succeed for testing
-    oauth2.csrf = function (req, res, next) {
-        req.csrfToken = function () { return hat(256); };
-        next();
+    oauth2.csrf = function () {
+        return function (req, res, next) {
+            req.csrfToken = function () { return hat(256); };
+            next();
+        };
    };

    function setup2(done) {
@@ -388,7 +391,7 @@ describe('Clients', function () {
        after(cleanup);

        it('fails due to missing token', function (done) {
-            superagent.get(SERVER_URL + '/api/v1/oauth/clients')
+            superagent.get(SERVER_URL + '/api/v1/clients')
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(401);
                    done();
@@ -396,7 +399,7 @@ describe('Clients', function () {
        });

        it('fails due to empty token', function (done) {
-            superagent.get(SERVER_URL + '/api/v1/oauth/clients')
+            superagent.get(SERVER_URL + '/api/v1/clients')
                .query({ access_token: '' })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(401);
@@ -405,7 +408,7 @@ describe('Clients', function () {
        });

        it('fails due to wrong token', function (done) {
-            superagent.get(SERVER_URL + '/api/v1/oauth/clients')
+            superagent.get(SERVER_URL + '/api/v1/clients')
                .query({ access_token: token.toUpperCase() })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(401);
@@ -414,7 +417,7 @@ describe('Clients', function () {
        });

        it('succeeds', function (done) {
-            superagent.get(SERVER_URL + '/api/v1/oauth/clients')
+            superagent.get(SERVER_URL + '/api/v1/clients')
                .query({ access_token: token })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(200);
@@ -431,7 +434,7 @@ describe('Clients', function () {
        after(cleanup);

        it('fails due to missing token', function (done) {
-            superagent.get(SERVER_URL + '/api/v1/oauth/clients/cid-webadmin/tokens')
+            superagent.get(SERVER_URL + '/api/v1/clients/cid-webadmin/tokens')
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(401);
                    done();
@@ -439,7 +442,7 @@ describe('Clients', function () {
        });

        it('fails due to empty token', function (done) {
-            superagent.get(SERVER_URL + '/api/v1/oauth/clients/cid-webadmin/tokens')
+            superagent.get(SERVER_URL + '/api/v1/clients/cid-webadmin/tokens')
                .query({ access_token: '' })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(401);
@@ -448,7 +451,7 @@ describe('Clients', function () {
        });

        it('fails due to wrong token', function (done) {
-            superagent.get(SERVER_URL + '/api/v1/oauth/clients/cid-webadmin/tokens')
+            superagent.get(SERVER_URL + '/api/v1/clients/cid-webadmin/tokens')
                .query({ access_token: token.toUpperCase() })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(401);
@@ -457,7 +460,7 @@ describe('Clients', function () {
        });

        it('fails due to unkown client', function (done) {
-            superagent.get(SERVER_URL + '/api/v1/oauth/clients/CID-WEBADMIN/tokens')
+            superagent.get(SERVER_URL + '/api/v1/clients/CID-WEBADMIN/tokens')
                .query({ access_token: token })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(404);
@@ -466,7 +469,7 @@ describe('Clients', function () {
        });

        it('succeeds', function (done) {
-            superagent.get(SERVER_URL + '/api/v1/oauth/clients/cid-webadmin/tokens')
+            superagent.get(SERVER_URL + '/api/v1/clients/cid-webadmin/tokens')
                .query({ access_token: token })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(200);
@@ -484,7 +487,7 @@ describe('Clients', function () {
        after(cleanup);

        it('fails due to missing token', function (done) {
-            superagent.del(SERVER_URL + '/api/v1/oauth/clients/cid-webadmin/tokens')
+            superagent.del(SERVER_URL + '/api/v1/clients/cid-webadmin/tokens')
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(401);
                    done();
@@ -492,7 +495,7 @@ describe('Clients', function () {
        });

        it('fails due to empty token', function (done) {
-            superagent.del(SERVER_URL + '/api/v1/oauth/clients/cid-webadmin/tokens')
+            superagent.del(SERVER_URL + '/api/v1/clients/cid-webadmin/tokens')
                .query({ access_token: '' })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(401);
@@ -501,7 +504,7 @@ describe('Clients', function () {
        });

        it('fails due to wrong token', function (done) {
-            superagent.del(SERVER_URL + '/api/v1/oauth/clients/cid-webadmin/tokens')
+            superagent.del(SERVER_URL + '/api/v1/clients/cid-webadmin/tokens')
                .query({ access_token: token.toUpperCase() })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(401);
@@ -510,7 +513,7 @@ describe('Clients', function () {
        });

        it('fails due to unkown client', function (done) {
-            superagent.del(SERVER_URL + '/api/v1/oauth/clients/CID-WEBADMIN/tokens')
+            superagent.del(SERVER_URL + '/api/v1/clients/CID-WEBADMIN/tokens')
                .query({ access_token: token })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(404);
@@ -519,7 +522,7 @@ describe('Clients', function () {
        });

        it('succeeds', function (done) {
-            superagent.get(SERVER_URL + '/api/v1/oauth/clients/cid-webadmin/tokens')
+            superagent.get(SERVER_URL + '/api/v1/clients/cid-webadmin/tokens')
                .query({ access_token: token })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(200);
@@ -527,7 +530,7 @@ describe('Clients', function () {
                    expect(result.body.tokens.length).to.eql(1);
                    expect(result.body.tokens[0].identifier).to.eql(USER_0.id);

-                    superagent.del(SERVER_URL + '/api/v1/oauth/clients/cid-webadmin/tokens')
+                    superagent.del(SERVER_URL + '/api/v1/clients/cid-webadmin/tokens')
                        .query({ access_token: token })
                        .end(function (error, result) {
                            expect(result.statusCode).to.equal(204);
@@ -5,7 +5,8 @@
 /* global before:false */
 /* global after:false */

-var async = require('async'),
+var accesscontrol = require('../../accesscontrol.js'),
+    async = require('async'),
    config = require('../../config.js'),
    database = require('../../database.js'),
    expect = require('expect.js'),
@@ -166,7 +167,7 @@ describe('Cloudron', function () {
                            userId_1 = result.body.id;

                            // HACK to get a token for second user (passwords are generated and the user should have gotten a password setup link...)
-                            tokendb.add(token_1, userId_1, 'test-client-id',  Date.now() + 100000, '*', callback);
+                            tokendb.add(token_1, userId_1, 'test-client-id',  Date.now() + 100000, accesscontrol.SCOPE_ANY, callback);
                        });
                }
            ], done);
@@ -202,25 +203,11 @@ describe('Cloudron', function () {
                });
        });

-        it('succeeds (non-admin)', function (done) {
+        it('fails (non-admin)', function (done) {
            superagent.get(SERVER_URL + '/api/v1/cloudron/config')
                .query({ access_token: token_1 })
                .end(function (error, result) {
-                    expect(result.statusCode).to.equal(200);
-
-                    expect(result.body.apiServerOrigin).to.eql('http://localhost:6060');
-                    expect(result.body.webServerOrigin).to.eql(null);
-                    expect(result.body.adminFqdn).to.eql(config.adminFqdn());
-                    expect(result.body.progress).to.be.an('object');
-                    expect(result.body.version).to.eql(config.version());
-                    expect(result.body.cloudronName).to.be.a('string');
-                    expect(result.body.provider).to.be.a('string');
-
-                    expect(result.body.update).to.be(undefined);
-                    expect(result.body.size).to.be(undefined);
-                    expect(result.body.region).to.be(undefined);
-                    expect(result.body.memory).to.be(undefined);
-
+                    expect(result.statusCode).to.equal(403);
                    done();
                });
        });
@@ -10,6 +10,7 @@ var async = require('async'),
    config = require('../../config.js'),
    database = require('../../database.js'),
    expect = require('expect.js'),
+    speakeasy = require('speakeasy'),
    superagent = require('superagent'),
    server = require('../../server.js');

@@ -36,6 +37,8 @@ function cleanup(done) {
 }

 describe('Developer API', function () {
+    this.timeout(20000);
+
    describe('login', function () {
        before(function (done) {
            async.series([
@@ -131,8 +134,8 @@ describe('Developer API', function () {
                .send({ username: USERNAME, password: PASSWORD })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(200);
-                    expect(new Date(result.body.expiresAt).toString()).to.not.be('Invalid Date');
-                    expect(result.body.token).to.be.a('string');
+                    expect(new Date(result.body.expires).toString()).to.not.be('Invalid Date');
+                    expect(result.body.accessToken).to.be.a('string');
                    done();
                });
        });
@@ -142,8 +145,8 @@ describe('Developer API', function () {
                .send({ username: USERNAME.toUpperCase(), password: PASSWORD })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(200);
-                    expect(new Date(result.body.expiresAt).toString()).to.not.be('Invalid Date');
-                    expect(result.body.token).to.be.a('string');
+                    expect(new Date(result.body.expires).toString()).to.not.be('Invalid Date');
+                    expect(result.body.accessToken).to.be.a('string');
                    done();
                });
        });
@@ -153,8 +156,8 @@ describe('Developer API', function () {
                .send({ username: EMAIL, password: PASSWORD })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(200);
-                    expect(new Date(result.body.expiresAt).toString()).to.not.be('Invalid Date');
-                    expect(result.body.token).to.be.a('string');
+                    expect(new Date(result.body.expires).toString()).to.not.be('Invalid Date');
+                    expect(result.body.accessToken).to.be.a('string');
                    done();
                });
        });
@@ -164,13 +167,90 @@ describe('Developer API', function () {
                .send({ username: EMAIL.toUpperCase(), password: PASSWORD })
                .end(function (error, result) {
                    expect(result.statusCode).to.equal(200);
-                    expect(new Date(result.body.expiresAt).toString()).to.not.be('Invalid Date');
-                    expect(result.body.token).to.be.a('string');
+                    expect(new Date(result.body.expires).toString()).to.not.be('Invalid Date');
+                    expect(result.body.accessToken).to.be.a('string');
                    done();
                });
        });
    });

+    describe('2fa login', function () {
+        var secret, accessToken;
+
+        before(function (done) {
+            async.series([
+                setup,
+                function (callback) {
+                    superagent.post(`${SERVER_URL}/api/v1/cloudron/activate`).query({ setupToken: 'somesetuptoken' }).send({ username: USERNAME, password: PASSWORD, email: EMAIL }).end(function (error, result) {
+                        callback(error);
+                    });
+                },
+                function (callback) {
+                    superagent.post(`${SERVER_URL}/api/v1/developer/login`).send({ username: USERNAME, password: PASSWORD }).end(function (error, result) {
+                        accessToken = result.body.accessToken;
+                        callback(error);
+                    });
+                },
+                function (callback) {
+                    superagent.post(`${SERVER_URL}/api/v1/profile/twofactorauthentication`).query({ access_token: accessToken }).end(function (error, result) {
+                        secret = result.body.secret;
+                        callback(error);
+                    });
+                },
+                function (callback) {
+                    var totpToken = speakeasy.totp({
+                        secret: secret,
+                        encoding: 'base32'
+                    });
+
+                    superagent.post(`${SERVER_URL}/api/v1/profile/twofactorauthentication/enable`).query({ access_token: accessToken }).send({ totpToken: totpToken }).end(function (error, result) {
+                        callback(error);
+                    });
+                }
+            ], done);
+        });
+
+        after(function (done) {
+            async.series([
+                function (callback) {
+                    superagent.post(`${SERVER_URL}/api/v1/profile/twofactorauthentication/disable`).query({ access_token: accessToken }).send({ password: PASSWORD }).end(function (error, result) {
+                        callback(error);
+                    });
+                },
+                cleanup
+            ], done);
+        });
+
+        it('fails due to missing token', function (done) {
+            superagent.post(`${SERVER_URL}/api/v1/developer/login`).send({ username: USERNAME, password: PASSWORD }).end(function (error, result) {
+                expect(result.statusCode).to.equal(401);
+                done();
+            });
+        });
+
+        it('fails due to wrong token', function (done) {
+            superagent.post(`${SERVER_URL}/api/v1/developer/login`).send({ username: USERNAME, password: PASSWORD }).send({ totpToken: 'wrongtoken' }).end(function (error, result) {
+                expect(result.statusCode).to.equal(401);
+                done();
+            });
+        });
+
+        it('succeeds', function (done) {
+            var totpToken = speakeasy.totp({
+                secret: secret,
+                encoding: 'base32'
+            });
+
+            superagent.post(`${SERVER_URL}/api/v1/developer/login`).send({ username: USERNAME, password: PASSWORD }).send({ totpToken: totpToken }).end(function (error, result) {
+                expect(error).to.be(null);
+                expect(result.statusCode).to.equal(200);
+                expect(result.body).to.be.an(Object);
+                expect(result.body.accessToken).to.be.a('string');
+                done();
+            });
+        });
+    });
+
    describe('sdk tokens are valid without password checks', function () {
        var token_normal, token_sdk;

@@ -184,16 +264,16 @@ describe('Developer API', function () {
                        .end(function (error, result) {
                            expect(result).to.be.ok();

-                            token_normal = result.body.token;
+                            token_normal = result.body.accessToken;

                            superagent.post(SERVER_URL + '/api/v1/developer/login')
                                .send({ username: USERNAME, password: PASSWORD })
                                .end(function (error, result) {
                                    expect(result.statusCode).to.equal(200);
-                                    expect(new Date(result.body.expiresAt).toString()).to.not.be('Invalid Date');
-                                    expect(result.body.token).to.be.a('string');
+                                    expect(new Date(result.body.expires).toString()).to.not.be('Invalid Date');
+                                    expect(result.body.accessToken).to.be.a('string');

-                                    token_sdk = result.body.token;
+                                    token_sdk = result.body.accessToken;

                                    callback();
                                });
@@ -206,7 +286,7 @@ describe('Developer API', function () {

        it('fails with non sdk token', function (done) {
            superagent.post(SERVER_URL + '/api/v1/profile/password').query({ access_token: token_normal }).send({ newPassword: 'Some?$123' }).end(function (error, result) {
-                expect(result.statusCode).to.equal(400);
+                expect(result.statusCode).to.equal(401);
                done();
            });
        });
@@ -6,7 +6,8 @@

 'use strict';

-var async = require('async'),
+var accesscontrol = require('../../accesscontrol.js'),
+    async = require('async'),
    config = require('../../config.js'),
    database = require('../../database.js'),
    expect = require('expect.js'),
@@ -62,7 +63,7 @@ function setup(done) {
            token_1 = tokendb.generateToken();

            // HACK to get a token for second user (passwords are generated and the user should have gotten a password setup link...)
-            tokendb.add(token_1, USER_1_ID, 'test-client-id',  Date.now() + 100000, '*', callback);
+            tokendb.add(token_1, USER_1_ID, 'test-client-id',  Date.now() + 100000, accesscontrol.SCOPE_PROFILE, callback);
        }

    ], done);
@@ -6,7 +6,8 @@

 'use strict';

-var async = require('async'),
+var accesscontrol = require('../../accesscontrol.js'),
+    async = require('async'),
    config = require('../../config.js'),
    database = require('../../database.js'),
    expect = require('expect.js'),
@@ -69,7 +70,7 @@ function setup(done) {
                    userId_1 = result.body.id;

                    // HACK to get a token for second user (passwords are generated and the user should have gotten a password setup link...)
-                    tokendb.add(token_1, userId_1, 'test-client-id',  Date.now() + 100000, '*', callback);
+                    tokendb.add(token_1, userId_1, 'test-client-id',  Date.now() + 100000, accesscontrol.SCOPE_PROFILE, callback);
                });
        }
    ], done);
@@ -279,6 +280,20 @@ describe('Groups API', function () {
                });
        });

+        it('can add user_1 to admin', function (done) {
+            superagent.put(SERVER_URL + '/api/v1/users/' + userId_1 + '/groups')
+                .query({ access_token: token })
+                .send({ groupIds: [ 'admin' ]})
+                .end(function (error, result) {
+                    expect(result.statusCode).to.equal(204);
+
+                    token_1 = tokendb.generateToken();
+
+                    // HACK to get a token for second user (passwords are generated and the user should have gotten a password setup link...)
+                    tokendb.add(token_1, userId_1, 'test-client-id',  Date.now() + 100000, accesscontrol.SCOPE_ANY, done);
+                });
+        });
+
        it('remove activation user from admin', function (done) {
            superagent.put(SERVER_URL + '/api/v1/users/' + userId + '/groups')
                .query({ access_token: token_1 })
@@ -938,16 +938,6 @@ describe('Mail API', function () {
                });
        });

-        it('cannot add reserved group', function (done) {
-            superagent.post(SERVER_URL + '/api/v1/mail/' + DOMAIN_0.domain + '/lists')
-                .send({ name: LIST_NAME, members: [ 'Admin', USERNAME ]})
-                .query({ access_token: token })
-                .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
-                    done();
-                });
-        });
-
        it('add succeeds', function (done) {
            superagent.post(SERVER_URL + '/api/v1/mail/' + DOMAIN_0.domain + '/lists')
                .send({ name: LIST_NAME, members: [ 'admin2', USERNAME ]})
@@ -6,137 +6,32 @@

 'use strict';

-var expect = require('expect.js'),
-    uuid = require('uuid'),
+var accesscontrol = require('../../accesscontrol.js'),
+    appdb = require('../../appdb.js'),
    async = require('async'),
-    hat = require('hat'),
-    urlParse = require('url').parse,
-    nock = require('nock'),
-    HttpError = require('connect-lastmile').HttpError,
-    oauth2 = require('../oauth2.js'),
-    server = require('../../server.js'),
-    querystring = require('querystring'),
-    database = require('../../database.js'),
-    domains = require('../../domains.js'),
    clientdb = require('../../clientdb.js'),
    clients = require('../../clients.js'),
-    userdb = require('../../userdb.js'),
-    user = require('../../user.js'),
-    appdb = require('../../appdb.js'),
    config = require('../../config.js'),
+    database = require('../../database.js'),
+    domains = require('../../domains.js'),
+    expect = require('expect.js'),
+    hat = require('hat'),
+    nock = require('nock'),
+    oauth2 = require('../oauth2.js'),
+    querystring = require('querystring'),
    request = require('request'),
+    server = require('../../server.js'),
+    speakeasy = require('speakeasy'),
    superagent = require('superagent'),
-    passport = require('passport');
+    urlParse = require('url').parse,
+    userdb = require('../../userdb.js'),
+    users = require('../../users.js'),
+    uuid = require('uuid');

 var SERVER_URL = 'http://localhost:' + config.get('port');

 describe('OAuth2', function () {

-    describe('scopes middleware', function () {
-        var passportAuthenticateSave = null;
-
-        before(function () {
-            passportAuthenticateSave = passport.authenticate;
-            passport.authenticate = function () {
-                return function (req, res, next) { next(); };
-            };
-        });
-
-        after(function () {
-            passport.authenticate = passportAuthenticateSave;
-        });
-
-        it('fails due to missing authInfo', function (done) {
-            var mw = oauth2.scope('admin')[1];
-            var req = {};
-
-            mw(req, null, function (error) {
-                expect(error).to.be.a(HttpError);
-                done();
-            });
-        });
-
-        it('fails due to missing scope property in authInfo', function (done) {
-            var mw = oauth2.scope('admin')[1];
-            var req = { authInfo: {} };
-
-            mw(req, null, function (error) {
-                expect(error).to.be.a(HttpError);
-                done();
-            });
-        });
-
-        it('fails due to missing scope in request', function (done) {
-            var mw = oauth2.scope('admin')[1];
-            var req = { authInfo: { scope: '' } };
-
-            mw(req, null, function (error) {
-                expect(error).to.be.a(HttpError);
-                done();
-            });
-        });
-
-        it('fails due to wrong scope in request', function (done) {
-            var mw = oauth2.scope('admin')[1];
-            var req = { authInfo: { scope: 'foobar,something' } };
-
-            mw(req, null, function (error) {
-                expect(error).to.be.a(HttpError);
-                done();
-            });
-        });
-
-        it('fails due to wrong scope in request', function (done) {
-            var mw = oauth2.scope('admin,users')[1];
-            var req = { authInfo: { scope: 'foobar,admin' } };
-
-            mw(req, null, function (error) {
-                expect(error).to.be.a(HttpError);
-                done();
-            });
-        });
-
-        it('succeeds with one requested scope and one provided scope', function (done) {
-            var mw = oauth2.scope('admin')[1];
-            var req = { authInfo: { scope: 'admin' } };
-
-            mw(req, null, function (error) {
-                expect(error).to.not.be.ok();
-                done();
-            });
-        });
-
-        it('succeeds with one requested scope and two provided scopes', function (done) {
-            var mw = oauth2.scope('admin')[1];
-            var req = { authInfo: { scope: 'foobar,admin' } };
-
-            mw(req, null, function (error) {
-                expect(error).to.not.be.ok();
-                done();
-            });
-        });
-
-        it('succeeds with two requested scope and two provided scopes', function (done) {
-            var mw = oauth2.scope('admin,foobar')[1];
-            var req = { authInfo: { scope: 'foobar,admin' } };
-
-            mw(req, null, function (error) {
-                expect(error).to.not.be.ok();
-                done();
-            });
-        });
-
-        it('succeeds with two requested scope and provided wildcard scope', function (done) {
-            var mw = oauth2.scope('admin,foobar')[1];
-            var req = { authInfo: { scope: '*' } };
-
-            mw(req, null, function (error) {
-                expect(error).to.not.be.ok();
-                done();
-            });
-        });
-    });
-
    describe('flow', function () {
        const DOMAIN_0 = {
            domain: 'example.com',
@@ -210,7 +105,7 @@ describe('OAuth2', function () {
            type: clients.TYPE_OAUTH,
            clientSecret: 'secret0',
            redirectURI: 'http://redirect0',
-            scope: 'profile'
+            scope: accesscontrol.SCOPE_PROFILE
        };

        // unknown app through addon
@@ -220,7 +115,7 @@ describe('OAuth2', function () {
            type: clients.TYPE_OAUTH,
            clientSecret: 'secret1',
            redirectURI: 'http://redirect1',
-            scope: 'profile'
+            scope: accesscontrol.SCOPE_PROFILE
        };

        // known app
@@ -230,7 +125,7 @@ describe('OAuth2', function () {
            type: clients.TYPE_OAUTH,
            clientSecret: 'secret2',
            redirectURI: 'http://redirect2',
-            scope: 'profile'
+            scope: accesscontrol.SCOPE_PROFILE
        };

        // known app through addon
@@ -240,7 +135,7 @@ describe('OAuth2', function () {
            type: clients.TYPE_OAUTH,
            clientSecret: 'secret3',
            redirectURI: 'http://redirect1',
-            scope: 'profile'
+            scope: accesscontrol.SCOPE_PROFILE
        };

        // unknown app through proxy
@@ -250,7 +145,7 @@ describe('OAuth2', function () {
            type: clients.TYPE_PROXY,
            clientSecret: 'secret4',
            redirectURI: 'http://redirect4',
-            scope: 'profile'
+            scope: accesscontrol.SCOPE_PROFILE
        };

        // known app through proxy
@@ -260,7 +155,7 @@ describe('OAuth2', function () {
            type: clients.TYPE_PROXY,
            clientSecret: 'secret5',
            redirectURI: 'http://redirect5',
-            scope: 'profile'
+            scope: accesscontrol.SCOPE_PROFILE
        };

        // app with accessRestriction not allowing user
@@ -270,7 +165,7 @@ describe('OAuth2', function () {
            type: clients.TYPE_OAUTH,
            clientSecret: 'secret6',
            redirectURI: 'http://redirect6',
-            scope: 'profile'
+            scope: accesscontrol.SCOPE_PROFILE
        };

        // app with accessRestriction allowing user
@@ -280,7 +175,7 @@ describe('OAuth2', function () {
            type: clients.TYPE_OAUTH,
            clientSecret: 'secret7',
            redirectURI: 'http://redirect7',
-            scope: 'profile'
+            scope: accesscontrol.SCOPE_PROFILE
        };

        // app with accessRestriction allowing group
@@ -290,13 +185,15 @@ describe('OAuth2', function () {
            type: clients.TYPE_OAUTH,
            clientSecret: 'secret9',
            redirectURI: 'http://redirect9',
-            scope: 'profile'
+            scope: accesscontrol.SCOPE_PROFILE
        };

        // make csrf always succeed for testing
-        oauth2.csrf = function (req, res, next) {
-            req.csrfToken = function () { return hat(256); };
-            next();
+        oauth2.csrf = function () {
+            return function (req, res, next) {
+                req.csrfToken = function () { return hat(256); };
+                next();
+            };
        };

        function setup(done) {
@@ -322,7 +219,7 @@ describe('OAuth2', function () {
                appdb.add.bind(null, APP_2.id, APP_2.appStoreId, APP_2.manifest, APP_2.location, APP_2.domain, APP_2.portBindings, APP_2),
                appdb.add.bind(null, APP_3.id, APP_3.appStoreId, APP_3.manifest, APP_3.location, APP_3.domain, APP_3.portBindings, APP_3),
                function (callback) {
-                    user.create(USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, null /* source */, function (error, userObject) {
+                    users.create(USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, null /* source */, function (error, userObject) {
                        expect(error).to.not.be.ok();

                        // update the global objects to reflect the new user id
@@ -349,60 +246,60 @@ describe('OAuth2', function () {

            it('fails due to missing redirect_uri param', function (done) {
                superagent.get(SERVER_URL + '/api/v1/oauth/dialog/authorize')
-                .end(function (error, result) {
-                    expect(result.text.indexOf('<!-- error tester -->')).to.not.equal(-1);
-                    expect(result.text.indexOf('Invalid request. redirect_uri query param is not set.')).to.not.equal(-1);
-                    expect(result.statusCode).to.equal(200);
-                    done();
-                });
+                    .end(function (error, result) {
+                        expect(result.text.indexOf('<!-- error tester -->')).to.not.equal(-1);
+                        expect(result.text.indexOf('Invalid request. redirect_uri query param is not set.')).to.not.equal(-1);
+                        expect(result.statusCode).to.equal(200);
+                        done();
+                    });
            });

            it('fails due to missing client_id param', function (done) {
                superagent.get(SERVER_URL + '/api/v1/oauth/dialog/authorize?redirect_uri=http://someredirect')
-                .end(function (error, result) {
-                    expect(result.text.indexOf('<!-- error tester -->')).to.not.equal(-1);
-                    expect(result.text.indexOf('Invalid request. client_id query param is not set.')).to.not.equal(-1);
-                    expect(result.statusCode).to.equal(200);
-                    done();
-                });
+                    .end(function (error, result) {
+                        expect(result.text.indexOf('<!-- error tester -->')).to.not.equal(-1);
+                        expect(result.text.indexOf('Invalid request. client_id query param is not set.')).to.not.equal(-1);
+                        expect(result.statusCode).to.equal(200);
+                        done();
+                    });
            });

            it('fails due to missing response_type param', function (done) {
                superagent.get(SERVER_URL + '/api/v1/oauth/dialog/authorize?redirect_uri=http://someredirect&client_id=someclientid')
-                .end(function (error, result) {
-                    expect(result.text.indexOf('<!-- error tester -->')).to.not.equal(-1);
-                    expect(result.text.indexOf('Invalid request. response_type query param is not set.')).to.not.equal(-1);
-                    expect(result.statusCode).to.equal(200);
-                    done();
-                });
+                    .end(function (error, result) {
+                        expect(result.text.indexOf('<!-- error tester -->')).to.not.equal(-1);
+                        expect(result.text.indexOf('Invalid request. response_type query param is not set.')).to.not.equal(-1);
+                        expect(result.statusCode).to.equal(200);
+                        done();
+                    });
            });

            it('fails for unkown grant type', function (done) {
                superagent.get(SERVER_URL + '/api/v1/oauth/dialog/authorize?redirect_uri=http://someredirect&client_id=someclientid&response_type=foobar')
-                .end(function (error, result) {
-                    expect(result.text.indexOf('<!-- error tester -->')).to.not.equal(-1);
-                    expect(result.text.indexOf('Invalid request. Only token and code response types are supported.')).to.not.equal(-1);
-                    expect(result.statusCode).to.equal(200);
-                    done();
-                });
+                    .end(function (error, result) {
+                        expect(result.text.indexOf('<!-- error tester -->')).to.not.equal(-1);
+                        expect(result.text.indexOf('Invalid request. Only token and code response types are supported.')).to.not.equal(-1);
+                        expect(result.statusCode).to.equal(200);
+                        done();
+                    });
            });

            it('succeeds for grant type code', function (done) {
                superagent.get(SERVER_URL + '/api/v1/oauth/dialog/authorize?redirect_uri=http://someredirect&client_id=someclientid&response_type=code')
-                .end(function (error, result) {
-                    expect(result.text).to.eql('<script>window.location.href = "/api/v1/session/login?returnTo=http://someredirect";</script>');
-                    expect(result.statusCode).to.equal(200);
-                    done();
-                });
+                    .end(function (error, result) {
+                        expect(result.text).to.eql('<script>window.location.href = "/api/v1/session/login?returnTo=http://someredirect";</script>');
+                        expect(result.statusCode).to.equal(200);
+                        done();
+                    });
            });

            it('succeeds for grant type token', function (done) {
                superagent.get(SERVER_URL + '/api/v1/oauth/dialog/authorize?redirect_uri=http://someredirect&client_id=someclientid&response_type=token')
-                .end(function (error, result) {
-                    expect(result.text).to.eql('<script>window.location.href = "/api/v1/session/login?returnTo=http://someredirect";</script>');
-                    expect(result.statusCode).to.equal(200);
-                    done();
-                });
+                    .end(function (error, result) {
+                        expect(result.text).to.eql('<script>window.location.href = "/api/v1/session/login?returnTo=http://someredirect";</script>');
+                        expect(result.statusCode).to.equal(200);
+                        done();
+                    });
            });
        });

@@ -412,36 +309,36 @@ describe('OAuth2', function () {

            it('fails without prior authentication call and not returnTo query', function (done) {
                superagent.get(SERVER_URL + '/api/v1/session/login')
-                .end(function (error, result) {
-                    expect(result.text.indexOf('<!-- error tester -->')).to.not.equal(-1);
-                    expect(result.text.indexOf('Invalid login request. No returnTo provided.')).to.not.equal(-1);
-                    expect(result.statusCode).to.equal(200);
+                    .end(function (error, result) {
+                        expect(result.text.indexOf('<!-- error tester -->')).to.not.equal(-1);
+                        expect(result.text.indexOf('Invalid login request. No returnTo provided.')).to.not.equal(-1);
+                        expect(result.statusCode).to.equal(200);

-                    done();
-                });
+                        done();
+                    });
            });

            it('redirects without prior authentication call', function (done) {
                superagent.get(SERVER_URL + '/api/v1/session/login?returnTo=http://someredirect')
-                .redirects(0)
-                .end(function (error, result) {
-                    expect(result.statusCode).to.equal(302);
-                    expect(result.headers.location).to.eql('http://someredirect');
+                    .redirects(0)
+                    .end(function (error, result) {
+                        expect(result.statusCode).to.equal(302);
+                        expect(result.headers.location).to.eql('http://someredirect');

-                    done();
-                });
+                        done();
+                    });
            });

            it('fails due to unknown missing client_id', function (done) {
                superagent.get(SERVER_URL + '/api/v1/oauth/dialog/authorize?redirect_uri=http://someredirect&response_type=code')
-                .redirects(0)
-                .end(function (error, result) {
-                    expect(result.text.indexOf('<!-- error tester -->')).to.not.equal(-1);
-                    expect(result.text.indexOf('Invalid request. client_id query param is not set.')).to.not.equal(-1);
-                    expect(result.statusCode).to.equal(200);
+                    .redirects(0)
+                    .end(function (error, result) {
+                        expect(result.text.indexOf('<!-- error tester -->')).to.not.equal(-1);
+                        expect(result.text.indexOf('Invalid request. client_id query param is not set.')).to.not.equal(-1);
+                        expect(result.statusCode).to.equal(200);

-                    done();
-                });
+                        done();
+                    });
            });

            it('fails due to unknown oauth client', function (done) {
@@ -691,6 +588,129 @@ describe('OAuth2', function () {
            });
        });

+        describe('loginForm 2FA submit', function () {
+            var secret, accessToken;
+
+            before(function (done) {
+                async.series([
+                    setup,
+                    function (callback) {
+                        superagent.post(`${SERVER_URL}/api/v1/developer/login`).send({ username: USER_0.username, password: USER_0.password }).end(function (error, result) {
+                            accessToken = result.body.accessToken;
+                            callback(error);
+                        });
+                    },
+                    function (callback) {
+                        superagent.post(`${SERVER_URL}/api/v1/profile/twofactorauthentication`).query({ access_token: accessToken }).end(function (error, result) {
+                            secret = result.body.secret;
+                            callback(error);
+                        });
+                    },
+                    function (callback) {
+                        var totpToken = speakeasy.totp({
+                            secret: secret,
+                            encoding: 'base32'
+                        });
+
+                        superagent.post(`${SERVER_URL}/api/v1/profile/twofactorauthentication/enable`).query({ access_token: accessToken }).send({ totpToken: totpToken }).end(function (error, result) {
+                            callback(error);
+                        });
+                    }
+                ], done);
+            });
+
+            after(cleanup);
+
+            function startAuthorizationFlow(client, callback) {
+                var jar = request.jar();
+                var url = SERVER_URL + '/api/v1/oauth/dialog/authorize?redirect_uri=' + client.redirectURI + '&client_id=' + client.id + '&response_type=code';
+
+                request.get(url, { jar: jar }, function (error, response, body) {
+                    expect(error).to.not.be.ok();
+                    expect(response.statusCode).to.eql(200);
+                    expect(body).to.eql('<script>window.location.href = "/api/v1/session/login?returnTo=' + client.redirectURI + '";</script>');
+
+                    request.get(SERVER_URL + '/api/v1/session/login?returnTo=' + client.redirectURI, { jar: jar, followRedirect: false }, function (error, response, body) {
+                        expect(error).to.not.be.ok();
+                        expect(response.statusCode).to.eql(200);
+                        expect(body.indexOf('<!-- login tester -->')).to.not.equal(-1);
+
+                        callback(jar);
+                    });
+                });
+            }
+
+            it('fails due to missing token', function (done) {
+                startAuthorizationFlow(CLIENT_2, function (jar) {
+                    var url = SERVER_URL + '/api/v1/session/login?returnTo=' + CLIENT_2.redirectURI;
+                    var data = {
+                        username: USER_0.username,
+                        password: USER_0.password
+                    };
+
+                    request.post({ url: url, jar: jar, form: data }, function (error, response, body) {
+                        expect(error).to.not.be.ok();
+                        expect(response.statusCode).to.eql(302);
+
+                        var tmp = urlParse(response.headers.location, true);
+                        expect(tmp.query.error).to.eql('A 2FA token is required');
+                        expect(tmp.query.returnTo).to.eql('/api/v1/oauth/dialog/authorize?redirect_uri=' + CLIENT_2.redirectURI + '&client_id=' + CLIENT_2.id + '&response_type=code');
+
+                        done();
+                    });
+                });
+            });
+
+            it('fails due to wrong token', function (done) {
+                startAuthorizationFlow(CLIENT_2, function (jar) {
+                    var url = SERVER_URL + '/api/v1/session/login?returnTo=' + CLIENT_2.redirectURI;
+                    var data = {
+                        username: USER_0.username,
+                        password: USER_0.password,
+                        totpToken: 'wrongtoken'
+                    };
+
+                    request.post({ url: url, jar: jar, form: data }, function (error, response, body) {
+                        expect(error).to.not.be.ok();
+                        expect(response.statusCode).to.eql(302);
+
+                        var tmp = urlParse(response.headers.location, true);
+                        expect(tmp.query.error).to.eql('The 2FA token is invalid');
+                        expect(tmp.query.returnTo).to.eql('/api/v1/oauth/dialog/authorize?redirect_uri=' + CLIENT_2.redirectURI + '&client_id=' + CLIENT_2.id + '&response_type=code');
+
+                        done();
+                    });
+                });
+            });
+
+            it('succeeds', function (done) {
+                startAuthorizationFlow(CLIENT_2, function (jar) {
+                    var totpToken = speakeasy.totp({
+                        secret: secret,
+                        encoding: 'base32'
+                    });
+                    var url = SERVER_URL + '/api/v1/session/login?returnTo=' + CLIENT_2.redirectURI;
+                    var data = {
+                        username: USER_0.username,
+                        password: USER_0.password,
+                        totpToken: totpToken
+                    };
+
+                    request.post({ url: url, jar: jar, form: data }, function (error, response, body) {
+                        expect(error).to.not.be.ok();
+                        expect(response.statusCode).to.eql(302);
+
+                        var tmp = urlParse(response.headers.location, true);
+                        expect(tmp.query.redirect_uri).to.eql(CLIENT_2.redirectURI);
+                        expect(tmp.query.client_id).to.eql(CLIENT_2.id);
+                        expect(tmp.query.response_type).to.eql('code');
+
+                        done();
+                    });
+                });
+            });
+        });
+
        describe('authorization with valid session', function () {
            before(setup);
            after(cleanup);
@@ -1263,9 +1283,11 @@ describe('Password', function () {
    };

    // make csrf always succeed for testing
-    oauth2.csrf = function (req, res, next) {
-        req.csrfToken = function () { return hat(256); };
-        next();
+    oauth2.csrf = function () {
+        return function (req, res, next) {
+            req.csrfToken = function () { return hat(256); };
+            next();
+        };
    };

    function setup(done) {
@@ -1293,76 +1315,76 @@ describe('Password', function () {

        it('reset request succeeds', function (done) {
            superagent.get(SERVER_URL + '/api/v1/session/password/resetRequest.html')
-            .end(function (error, result) {
-                expect(result.statusCode).to.equal(200);
-                expect(result.text.indexOf('<!-- tester -->')).to.not.equal(-1);
-                done();
-            });
+                .end(function (error, result) {
+                    expect(result.statusCode).to.equal(200);
+                    expect(result.text.indexOf('<!-- tester -->')).to.not.equal(-1);
+                    done();
+                });
        });

        it('setup fails due to missing reset_token', function (done) {
            superagent.get(SERVER_URL + '/api/v1/session/account/setup.html')
-            .end(function (error, result) {
-                expect(result.statusCode).to.equal(200);
-                expect(result.text.indexOf('<!-- error tester -->')).to.not.equal(-1);
-                done();
-            });
+                .end(function (error, result) {
+                    expect(result.statusCode).to.equal(200);
+                    expect(result.text.indexOf('<!-- error tester -->')).to.not.equal(-1);
+                    done();
+                });
        });

        it('setup fails due to invalid reset_token', function (done) {
            superagent.get(SERVER_URL + '/api/v1/session/account/setup.html')
-            .query({ reset_token: hat(256) })
-            .end(function (error, result) {
-                expect(result.statusCode).to.equal(200);
-                expect(result.text.indexOf('<!-- error tester -->')).to.not.equal(-1);
-                done();
-            });
+                .query({ reset_token: hat(256) })
+                .end(function (error, result) {
+                    expect(result.statusCode).to.equal(200);
+                    expect(result.text.indexOf('<!-- error tester -->')).to.not.equal(-1);
+                    done();
+                });
        });

        it('setup succeeds', function (done) {
            superagent.get(SERVER_URL + '/api/v1/session/account/setup.html')
-            .query({ reset_token: USER_0.resetToken })
-            .end(function (error, result) {
-                expect(result.statusCode).to.equal(200);
-                expect(result.text.indexOf('<!-- tester -->')).to.not.equal(-1);
-                done();
-            });
+                .query({ reset_token: USER_0.resetToken })
+                .end(function (error, result) {
+                    expect(result.statusCode).to.equal(200);
+                    expect(result.text.indexOf('<!-- tester -->')).to.not.equal(-1);
+                    done();
+                });
        });

        it('reset fails due to missing reset_token', function (done) {
            superagent.get(SERVER_URL + '/api/v1/session/password/reset.html')
-            .end(function (error, result) {
-                expect(result.statusCode).to.equal(400);
-                done();
-            });
+                .end(function (error, result) {
+                    expect(result.statusCode).to.equal(400);
+                    done();
+                });
        });

        it('reset fails due to invalid reset_token', function (done) {
            superagent.get(SERVER_URL + '/api/v1/session/password/reset.html')
-            .query({ reset_token: hat(256) })
-            .end(function (error, result) {
-                expect(result.statusCode).to.equal(401);
-                done();
-            });
+                .query({ reset_token: hat(256) })
+                .end(function (error, result) {
+                    expect(result.statusCode).to.equal(401);
+                    done();
+                });
        });

        it('reset succeeds', function (done) {
            superagent.get(SERVER_URL + '/api/v1/session/password/reset.html')
-            .query({ reset_token: USER_0.resetToken })
-            .end(function (error, result) {
-                expect(result.text.indexOf('<!-- tester -->')).to.not.equal(-1);
-                expect(result.statusCode).to.equal(200);
-                done();
-            });
+                .query({ reset_token: USER_0.resetToken })
+                .end(function (error, result) {
+                    expect(result.text.indexOf('<!-- tester -->')).to.not.equal(-1);
+                    expect(result.statusCode).to.equal(200);
+                    done();
+                });
        });

        it('sent succeeds', function (done) {
            superagent.get(SERVER_URL + '/api/v1/session/password/sent.html')
-            .end(function (error, result) {
-                expect(result.text.indexOf('<!-- tester -->')).to.not.equal(-1);
-                expect(result.statusCode).to.equal(200);
-                done();
-            });
+                .end(function (error, result) {
+                    expect(result.text.indexOf('<!-- tester -->')).to.not.equal(-1);
+                    expect(result.statusCode).to.equal(200);
+                    done();
+                });
        });
    });

@@ -1372,12 +1394,12 @@ describe('Password', function () {

        it('succeeds', function (done) {
            superagent.post(SERVER_URL + '/api/v1/session/password/resetRequest')
-            .send({ identifier: USER_0.email })
-            .end(function (error, result) {
-                expect(result.text.indexOf('<!-- tester -->')).to.not.equal(-1);
-                expect(result.statusCode).to.equal(200);
-                done();
-            });
+                .send({ identifier: USER_0.email })
+                .end(function (error, result) {
+                    expect(result.text.indexOf('<!-- tester -->')).to.not.equal(-1);
+                    expect(result.statusCode).to.equal(200);
+                    done();
+                });
        });
    });

@@ -1387,65 +1409,63 @@ describe('Password', function () {

        it('fails due to missing resetToken', function (done) {
            superagent.post(SERVER_URL + '/api/v1/session/password/reset')
-            .send({ password: 'somepassword' })
-            .end(function (error, result) {
-                expect(result.statusCode).to.equal(400);
-                done();
-            });
+                .send({ password: 'somepassword' })
+                .end(function (error, result) {
+                    expect(result.statusCode).to.equal(400);
+                    done();
+                });
        });

        it('fails due to missing password', function (done) {
            superagent.post(SERVER_URL + '/api/v1/session/password/reset')
-            .send({ resetToken: hat(256) })
-            .end(function (error, result) {
-                expect(result.statusCode).to.equal(400);
-                done();
-            });
+                .send({ resetToken: hat(256) })
+                .end(function (error, result) {
+                    expect(result.statusCode).to.equal(400);
+                    done();
+                });
        });

        it('fails due to empty password', function (done) {
            superagent.post(SERVER_URL + '/api/v1/session/password/reset')
-            .send({ password: '', resetToken: hat(256) })
-            .end(function (error, result) {
-                expect(result.statusCode).to.equal(401);
-                done();
-            });
+                .send({ password: '', resetToken: hat(256) })
+                .end(function (error, result) {
+                    expect(result.statusCode).to.equal(401);
+                    done();
+                });
        });

        it('fails due to empty resetToken', function (done) {
            superagent.post(SERVER_URL + '/api/v1/session/password/reset')
-            .send({ password: '', resetToken: '' })
-            .end(function (error, result) {
-                expect(result.statusCode).to.equal(401);
-                done();
-            });
+                .send({ password: '', resetToken: '' })
+                .end(function (error, result) {
+                    expect(result.statusCode).to.equal(401);
+                    done();
+                });
        });

        it('fails due to weak password', function (done) {
            superagent.post(SERVER_URL + '/api/v1/session/password/reset')
-            .send({ password: 'foobar', resetToken: USER_0.resetToken })
-            .end(function (error, result) {
-                expect(result.statusCode).to.equal(406);
-                done();
-            });
+                .send({ password: 'foobar', resetToken: USER_0.resetToken })
+                .end(function (error, result) {
+                    expect(result.statusCode).to.equal(406);
+                    done();
+                });
        });

        it('succeeds', function (done) {
            var scope = nock(config.adminOrigin())
                .filteringPath(function (path) {
-                    path = path.replace(/accessToken=[^&]*/, 'accessToken=token');
-                    path = path.replace(/expiresAt=[^&]*/, 'expiresAt=1234');
                    return path;
                })
-                .get('/?accessToken=token&expiresAt=1234').reply(200, {});
+                .get('/').reply(200, {});

            superagent.post(SERVER_URL + '/api/v1/session/password/reset')
-            .send({ password: 'ASF23$%somepassword', resetToken: USER_0.resetToken })
-            .end(function (error, result) {
-                expect(scope.isDone()).to.be.ok();
-                expect(result.statusCode).to.equal(200);
-                done();
-            });
+                .send({ password: 'ASF23$%somepassword', resetToken: USER_0.resetToken })
+                .end(function (error, result) {
+                    expect(scope.isDone()).to.be.ok();
+                    expect(result.statusCode).to.equal(200);
+                    done();
+                });
        });
    });
 });
@@ -6,13 +6,14 @@

 'use strict';

-var config = require('../../config.js'),
+var accesscontrol = require('../../accesscontrol.js'),
+    config = require('../../config.js'),
    database = require('../../database.js'),
-    tokendb = require('../../tokendb.js'),
    expect = require('expect.js'),
    mailer = require('../../mailer.js'),
    superagent = require('superagent'),
-    server = require('../../server.js');
+    server = require('../../server.js'),
+    tokendb = require('../../tokendb.js');

 const SERVER_URL = 'http://localhost:' + config.get('port');

@@ -116,7 +117,7 @@ describe('Profile API', function () {
            var token = tokendb.generateToken();
            var expires = Date.now() - 2000; // 1 sec

-            tokendb.add(token, user_0.id, null, expires, '*', function (error) {
+            tokendb.add(token, user_0.id, null, expires, accesscontrol.SCOPE_ANY, function (error) {
                expect(error).to.not.be.ok();

                superagent.get(SERVER_URL + '/api/v1/profile').query({ access_token: token }).end(function (error, result) {
@@ -1,659 +1,121 @@
+'use strict';
+
 /* global it:false */
 /* global describe:false */
 /* global before:false */
 /* global after:false */

-'use strict';
-
-var async = require('async'),
+var accesscontrol = require('../../accesscontrol.js'),
+    async = require('async'),
    config = require('../../config.js'),
-    constants = require('../../constants.js'),
    database = require('../../database.js'),
-    domains = require('../../domains.js'),
-    tokendb = require('../../tokendb.js'),
    expect = require('expect.js'),
-    groups = require('../../groups.js'),
-    mail = require('../../mail.js'),
-    mailer = require('../../mailer.js'),
+    nock = require('nock'),
    superagent = require('superagent'),
-    server = require('../../server.js');
+    server = require('../../server.js'),
+    settings = require('../../settings.js'),
+    settingsdb = require('../../settingsdb.js'),
+    tokendb = require('../../tokendb.js');

-const SERVER_URL = 'http://localhost:' + config.get('port');
+var SERVER_URL = 'http://localhost:' + config.get('port');

-const DOMAIN_0 = {
-    domain: 'example-user-test.com',
-    zoneName: 'example-user-test.com',
-    config: {},
-    provider: 'noop',
-    fallbackCertificate: null,
-    tlsConfig: { provider: 'fallback' }
-};
-
-const USERNAME_0 = 'superaDmIn', PASSWORD = 'Foobar?1337', EMAIL_0 = 'silLY@me.com', EMAIL_0_NEW = 'stupID@me.com', DISPLAY_NAME_0_NEW = 'New Name';
-const USERNAME_1 = 'userTheFirst', EMAIL_1 = 'taO@zen.mac';
-const USERNAME_2 = 'userTheSecond', EMAIL_2 = 'USER@foo.bar', EMAIL_2_NEW = 'happy@ME.com';
-const USERNAME_3 = 'ut', EMAIL_3 = 'user3@FOO.bar';
-
-var groupObject;
+var USERNAME = 'superadmin', PASSWORD = 'Foobar?1337', EMAIL ='silly@me.com';
+var token = null; // authentication token
+var USERNAME_1 = 'userTheFirst', EMAIL_1 = 'taO@zen.mac', userId_1, token_1;

 function setup(done) {
+    nock.cleanAll();
    config._reset();
+    config.setFqdn('example-cloudron-test.com');
+    config.setAdminFqdn('my.example-cloudron-test.com');

    async.series([
-        server.start,
+        server.start.bind(server),
        database._clear,
-        mailer._clearMailQueue,
-        domains.add.bind(null, DOMAIN_0.domain, DOMAIN_0.zoneName, DOMAIN_0.provider, DOMAIN_0.config, DOMAIN_0.fallbackCertificate, DOMAIN_0.tlsConfig),
-        mail.addDomain.bind(null, DOMAIN_0.domain)
-    ], function (error) {
-        expect(error).to.not.be.ok();
-
-        groups.create('somegroupname', function (error, result) {
-            expect(error).to.not.be.ok();
-
-            groupObject = result;
-
-            done();
-        });
-    });
+        settings.setBackupConfig.bind(null, { provider: 'filesystem', backupFolder: '/tmp', format: 'tgz' }),
+        settingsdb.set.bind(null, settings.APPSTORE_CONFIG_KEY, JSON.stringify({ userId: 'USER_ID', cloudronId: 'CLOUDRON_ID', token: 'ACCESS_TOKEN' }))
+    ], done);
 }

 function cleanup(done) {
    database._clear(function (error) {
-        expect(!error).to.be.ok();
+        expect(error).to.not.be.ok();

-        mailer._clearMailQueue();
+        config._reset();

        server.stop(done);
    });
 }

-function checkMails(number, done) {
-    // mails are enqueued async
-    setTimeout(function () {
-        expect(mailer._getMailQueue().length).to.equal(number);
-        mailer._clearMailQueue();
-        done();
-    }, 500);
-}
+describe('User test', function () {
+    describe('get config', function () {
+        before(function (done) {
+            async.series([
+                setup,

-describe('User API', function () {
-    this.timeout(5000);
+                function (callback) {
+                    superagent.post(SERVER_URL + '/api/v1/cloudron/activate')
+                        .query({ setupToken: 'somesetuptoken' })
+                        .send({ username: USERNAME, password: PASSWORD, email: EMAIL })
+                        .end(function (error, result) {
+                            expect(result).to.be.ok();

-    var user_0, user_1, user_2;
-    var token = null;
-    var token_1 = tokendb.generateToken();
+                            // stash token for further use
+                            token = result.body.token;

-    before(setup);
-    after(cleanup);
+                            callback();
+                        });
+                },

-    it('device is in first time mode', function (done) {
-        superagent.get(SERVER_URL + '/api/v1/cloudron/status')
-            .end(function (err, res) {
-                expect(res.statusCode).to.equal(200);
-                expect(res.body.activated).to.not.be.ok();
-                done(err);
-            });
-    });
+                function (callback) {
+                    superagent.post(SERVER_URL + '/api/v1/users')
+                        .query({ access_token: token })
+                        .send({ username: USERNAME_1, email: EMAIL_1, invite: false })
+                        .end(function (error, result) {
+                            expect(result).to.be.ok();
+                            expect(result.statusCode).to.eql(201);

-    it('create admin fails due to missing parameters', function (done) {
-        superagent.post(SERVER_URL + '/api/v1/cloudron/activate')
-            .query({ setupToken: 'somesetuptoken' })
-            .send({ username: USERNAME_0 })
-            .end(function (err, res) {
-                expect(res.statusCode).to.equal(400);
-                done();
-            });
-    });
+                            token_1 = tokendb.generateToken();
+                            userId_1 = result.body.id;

-    it('create admin fails because only POST is allowed', function (done) {
-        superagent.get(SERVER_URL + '/api/v1/cloudron/activate')
-            .end(function (err, res) {
-                expect(res.statusCode).to.equal(404);
-                done();
-            });
-    });
+                            // HACK to get a token for second user (passwords are generated and the user should have gotten a password setup link...)
+                            tokendb.add(token_1, userId_1, 'test-client-id',  Date.now() + 100000, accesscontrol.SCOPE_ANY, callback);
+                        });
+                }
+            ], done);
+        });

-    it('create admin', function (done) {
-        superagent.post(SERVER_URL + '/api/v1/cloudron/activate')
-            .query({ setupToken: 'somesetuptoken' })
-            .send({ username: USERNAME_0, password: PASSWORD, email: EMAIL_0 })
-            .end(function (err, res) {
-                expect(err).to.eql(null);
-                expect(res.statusCode).to.equal(201);
+        after(cleanup);

-                // stash for later use
-                token = res.body.token;
+        it('cannot get without token', function (done) {
+            superagent.get(SERVER_URL + '/api/v1/user/cloudron_config')
+                .end(function (error, result) {
+                    expect(result.statusCode).to.equal(401);
+                    done();
+                });
+        });

-                superagent.get(SERVER_URL + '/api/v1/profile').query({ access_token: token }).end(function (error, result) {
-                    expect(error).to.eql(null);
-                    expect(result.status).to.equal(200);
+        it('succeeds', function (done) {
+            superagent.get(SERVER_URL + '/api/v1/user/cloudron_config')
+                .query({ access_token: token_1 })
+                .end(function (error, result) {
+                    expect(result.statusCode).to.equal(200);

-                    // stash for further use
-                    user_0 = result.body;
+                    expect(result.body.apiServerOrigin).to.eql('http://localhost:6060');
+                    expect(result.body.webServerOrigin).to.eql(null);
+                    expect(result.body.adminFqdn).to.eql(config.adminFqdn());
+                    expect(result.body.progress).to.be.an('object');
+                    expect(result.body.version).to.eql(config.version());
+                    expect(result.body.cloudronName).to.be.a('string');
+                    expect(result.body.provider).to.be.a('string');
+
+                    expect(result.body.update).to.be(undefined);
+                    expect(result.body.size).to.be(undefined);
+                    expect(result.body.region).to.be(undefined);
+                    expect(result.body.memory).to.be(undefined);

                    done();
                });
-            });
-    });
-
-    it('device left first time mode', function (done) {
-        superagent.get(SERVER_URL + '/api/v1/cloudron/status')
-            .end(function (err, res) {
-                expect(res.statusCode).to.equal(200);
-                expect(res.body.activated).to.be.ok();
-                done();
-            });
-    });
-
-    it('cannot get userInfo by username', function (done) {
-        superagent.get(SERVER_URL + '/api/v1/users/' + USERNAME_0)
-            .query({ access_token: token })
-            .end(function (err, res) {
-                expect(res.statusCode).to.equal(404);
-
-                done();
-            });
-    });
-
-    it('can get userInfo with token', function (done) {
-        superagent.get(SERVER_URL + '/api/v1/users/' + user_0.id)
-            .query({ access_token: token })
-            .end(function (err, res) {
-                expect(res.statusCode).to.equal(200);
-                expect(res.body.username).to.equal(USERNAME_0.toLowerCase());
-                expect(res.body.email).to.equal(EMAIL_0.toLowerCase());
-                expect(res.body.admin).to.be.ok();
-
-                done();
-            });
-    });
-
-    it('cannot get userInfo with expired token', function (done) {
-        var token = tokendb.generateToken();
-        var expires = Date.now() + 2000; // 1 sec
-
-        tokendb.add(token, user_0.id, null, expires, '*', function (error) {
-            expect(error).to.not.be.ok();
-
-            setTimeout(function () {
-                superagent.get(SERVER_URL + '/api/v1/users/' + user_0.username)
-                    .query({ access_token: token })
-                    .end(function (error, result) {
-                        expect(result.statusCode).to.equal(401);
-                        done();
-                    });
-            }, 2000);
        });
    });
-
-    it('can get userInfo with token', function (done) {
-        superagent.get(SERVER_URL + '/api/v1/users/' + user_0.id)
-            .query({ access_token: token })
-            .end(function (err, res) {
-                expect(res.statusCode).to.equal(200);
-                expect(res.body.username).to.equal(USERNAME_0.toLowerCase());
-                expect(res.body.email).to.equal(EMAIL_0.toLowerCase());
-                expect(res.body.admin).to.be.ok();
-                done();
-            });
-    });
-
-    it('cannot get userInfo only with basic auth', function (done) {
-        superagent.get(SERVER_URL + '/api/v1/users/' + user_0.id)
-            .auth(USERNAME_0, PASSWORD)
-            .end(function (err, res) {
-                expect(res.statusCode).to.equal(401);
-                done();
-            });
-    });
-
-    it('cannot get userInfo with invalid token (token length)', function (done) {
-        superagent.get(SERVER_URL + '/api/v1/users/' + user_0.id)
-            .query({ access_token: 'x' + token })
-            .end(function (err, res) {
-                expect(res.statusCode).to.equal(401);
-                done();
-            });
-    });
-
-    it('cannot get userInfo with invalid token (wrong token)', function (done) {
-        superagent.get(SERVER_URL + '/api/v1/users/' + user_0.id)
-            .query({ access_token: token.toUpperCase() })
-            .end(function (err, res) {
-                expect(res.statusCode).to.equal(401);
-                done();
-            });
-    });
-
-    it('can get userInfo with token in auth header', function (done) {
-        superagent.get(SERVER_URL + '/api/v1/users/' + user_0.id)
-            .set('Authorization', 'Bearer ' + token)
-            .end(function (err, res) {
-                expect(res.statusCode).to.equal(200);
-                expect(res.body.username).to.equal(USERNAME_0.toLowerCase());
-                expect(res.body.email).to.equal(EMAIL_0.toLowerCase());
-                expect(res.body.admin).to.be.ok();
-                expect(res.body.displayName).to.be.a('string');
-                expect(res.body.password).to.not.be.ok();
-                expect(res.body.salt).to.not.be.ok();
-                done();
-            });
-    });
-
-    it('cannot get userInfo with invalid token in auth header', function (done) {
-        superagent.get(SERVER_URL + '/api/v1/users/' + user_0.id)
-            .set('Authorization', 'Bearer ' + 'x' + token)
-            .end(function (err, res) {
-                expect(res.statusCode).to.equal(401);
-                done();
-            });
-    });
-
-    it('cannot get userInfo with invalid token (wrong token)', function (done) {
-        superagent.get(SERVER_URL + '/api/v1/users/' + user_0.id)
-            .set('Authorization', 'Bearer ' + 'x' + token.toUpperCase())
-            .end(function (err, res) {
-                expect(res.statusCode).to.equal(401);
-                done();
-            });
-    });
-
-    it('create second user succeeds', function (done) {
-        mailer._clearMailQueue();
-
-        superagent.post(SERVER_URL + '/api/v1/users')
-            .query({ access_token: token })
-            .send({ username: USERNAME_1, email: EMAIL_1, invite: true })
-            .end(function (error, result) {
-                expect(error).to.not.be.ok();
-                expect(result.statusCode).to.equal(201);
-
-                user_1 = result.body;
-
-                checkMails(2, function () {
-                    // HACK to get a token for second user (passwords are generated and the user should have gotten a password setup link...)
-                    tokendb.add(token_1, user_1.id, 'test-client-id',  Date.now() + 10000, '*', done);
-                });
-            });
-    });
-
-    it('reinvite unknown user fails', function (done) {
-        mailer._clearMailQueue();
-
-        superagent.post(SERVER_URL + '/api/v1/users/' + USERNAME_1+USERNAME_1 + '/invite')
-            .query({ access_token: token })
-            .send({})
-            .end(function (err, res) {
-                expect(err).to.be.an(Error);
-                expect(res.statusCode).to.equal(404);
-                checkMails(0, done);
-            });
-    });
-
-    it('reinvite second user succeeds', function (done) {
-        mailer._clearMailQueue();
-
-        superagent.post(SERVER_URL + '/api/v1/users/' + user_1.id + '/invite')
-            .query({ access_token: token })
-            .send({})
-            .end(function (err, res) {
-                expect(err).to.not.be.ok();
-                expect(res.statusCode).to.equal(200);
-                checkMails(1, done);
-            });
-    });
-
-    it('set second user as admin succeeds', function (done) {
-        superagent.put(SERVER_URL + '/api/v1/users/' + user_1.id + '/groups')
-            .query({ access_token: token })
-            .send({ groupIds: [ constants.ADMIN_GROUP_ID ] })
-            .end(function (err, res) {
-                expect(res.statusCode).to.equal(204);
-
-                superagent.get(SERVER_URL + '/api/v1/users/' + user_1.id)
-                    .query({ access_token: token })
-                    .end(function (err, res) {
-                        expect(res.statusCode).to.equal(200);
-                        expect(res.body.admin).to.equal(true);
-
-                        done();
-                    });
-            });
-    });
-
-    it('list groupIds when listing users', function (done) {
-        superagent.get(SERVER_URL + '/api/v1/users')
-            .query({ access_token: token })
-            .end(function (error, res) {
-                expect(error).to.be(null);
-                expect(res.statusCode).to.equal(200);
-                expect(res.body.users).to.be.an('array');
-
-                res.body.users.forEach(function (user) {
-                    expect(user.admin).to.be(true);
-                    expect(user.groupIds).to.eql([ constants.ADMIN_GROUP_ID ]);
-                });
-                done();
-            });
-    });
-
-    it('remove itself from admins fails', function (done) {
-        superagent.put(SERVER_URL + '/api/v1/users/' + user_0.id + '/groups')
-            .query({ access_token: token })
-            .send({ groupIds: [ groupObject.id ] })
-            .end(function (err, res) {
-                expect(res.statusCode).to.equal(403);
-                done();
-            });
-    });
-
-    it('remove second user from admins succeeds', function (done) {
-        superagent.put(SERVER_URL + '/api/v1/users/' + user_1.id + '/groups')
-            .query({ access_token: token })
-            .send({ groupIds: [ groupObject.id ] })
-            .end(function (err, res) {
-                expect(res.statusCode).to.equal(204);
-
-                superagent.get(SERVER_URL + '/api/v1/users/' + user_1.id)
-                    .query({ access_token: token })
-                    .end(function (err, res) {
-                        expect(res.statusCode).to.equal(200);
-                        expect(res.body.admin).to.equal(false);
-
-                        done();
-                    });
-            });
-    });
-
-    it('create user missing username fails', function (done) {
-        superagent.post(SERVER_URL + '/api/v1/users')
-            .query({ access_token: token })
-            .send({ email: EMAIL_2 })
-            .end(function (error, result) {
-                expect(result.statusCode).to.equal(400);
-                done();
-            });
-    });
-
-    it('create user missing email fails', function (done) {
-        superagent.post(SERVER_URL + '/api/v1/users')
-            .query({ access_token: token })
-            .send({ username: USERNAME_2 })
-            .end(function (error, result) {
-                expect(result.statusCode).to.equal(400);
-                done();
-            });
-    });
-
-    it('create user missing invite fails', function (done) {
-        superagent.post(SERVER_URL + '/api/v1/users')
-            .query({ access_token: token })
-            .send({ username: USERNAME_2, email: EMAIL_2 })
-            .end(function (error, result) {
-                expect(result.statusCode).to.equal(400);
-                done();
-            });
-    });
-
-    it('create user reserved name fails', function (done) {
-        superagent.post(SERVER_URL + '/api/v1/users')
-            .query({ access_token: token })
-            .send({ username: 'no-reply' })
-            .end(function (error, result) {
-                expect(result.statusCode).to.equal(400);
-                done();
-            });
-    });
-
-    it('create user with short name fails', function (done) {
-        superagent.post(SERVER_URL + '/api/v1/users')
-            .query({ access_token: token })
-            .send({ username: 'n' })
-            .end(function (error, result) {
-                expect(result.statusCode).to.equal(400);
-                done();
-            });
-    });
-
-    it('create second and third user', function (done) {
-        mailer._clearMailQueue();
-
-        superagent.post(SERVER_URL + '/api/v1/users')
-            .query({ access_token: token })
-            .send({ username: USERNAME_2, email: EMAIL_2, invite: false })
-            .end(function (error, result) {
-                expect(result.statusCode).to.equal(201);
-
-                user_2 = result.body;
-
-                superagent.post(SERVER_URL + '/api/v1/users')
-                    .query({ access_token: token })
-                    .send({ username: USERNAME_3, email: EMAIL_3, invite: true })
-                    .end(function (error, result) {
-                        expect(result.statusCode).to.equal(201);
-
-                        // one mail for first user creation, two mails for second user creation (see 'invite' flag)
-                        checkMails(3, done);
-                    });
-            });
-    });
-
-    it('get userInfo succeeds for second user', function (done) {
-        superagent.get(SERVER_URL + '/api/v1/users/' + user_2.id)
-            .query({ access_token: token })
-            .end(function (error, result) {
-                expect(result.statusCode).to.equal(200);
-                expect(result.body.username).to.equal(USERNAME_2.toLowerCase());
-                expect(result.body.email).to.equal(EMAIL_2.toLowerCase());
-                expect(result.body.admin).to.not.be.ok();
-
-                done();
-            });
-    });
-
-    it('create user with same username should fail', function (done) {
-        superagent.post(SERVER_URL + '/api/v1/users')
-            .query({ access_token: token })
-            .send({ username: USERNAME_2, email: EMAIL_0, invite: false })
-            .end(function (err, res) {
-                expect(res.statusCode).to.equal(409);
-                done();
-            });
-    });
-
-    it('list users fails for normal user', function (done) {
-        superagent.get(SERVER_URL + '/api/v1/users')
-            .query({ access_token: token_1 })
-            .end(function (error, res) {
-                expect(res.statusCode).to.equal(403);
-                done();
-            });
-    });
-
-    it('list users succeeds for admin', function (done) {
-        superagent.get(SERVER_URL + '/api/v1/users')
-            .query({ access_token: token })
-            .end(function (error, res) {
-                expect(error).to.be(null);
-                expect(res.statusCode).to.equal(200);
-                expect(res.body.users).to.be.an('array');
-                expect(res.body.users.length).to.equal(4);
-
-                res.body.users.forEach(function (user) {
-                    expect(user).to.be.an('object');
-                    expect(user.id).to.be.ok();
-                    expect(user.username).to.be.ok();
-                    expect(user.email).to.be.ok();
-                    expect(user.password).to.not.be.ok();
-                    expect(user.salt).to.not.be.ok();
-                    expect(user.groupIds).to.be.an(Array);
-                    expect(user.admin).to.be.a('boolean');
-                });
-
-                done();
-            });
-    });
-
-    it('remove random user fails', function (done) {
-        superagent.del(SERVER_URL + '/api/v1/users/randomid')
-            .query({ access_token: token })
-            .send({ password: PASSWORD })
-            .end(function (err, res) {
-                expect(res.statusCode).to.equal(404);
-                done();
-            });
-    });
-
-    it('user removes himself is not allowed', function (done) {
-        superagent.del(SERVER_URL + '/api/v1/users/' + user_0.id)
-            .query({ access_token: token })
-            .send({ password: PASSWORD })
-            .end(function (err, res) {
-                expect(res.statusCode).to.equal(403);
-                done();
-            });
-    });
-
-    it('admin cannot remove normal user without giving a password', function (done) {
-        superagent.del(SERVER_URL + '/api/v1/users/' + user_1.id)
-            .query({ access_token: token })
-            .end(function (err, res) {
-                expect(res.statusCode).to.equal(400);
-                done();
-            });
-    });
-
-    it('admin cannot remove normal user with empty password', function (done) {
-        superagent.del(SERVER_URL + '/api/v1/users/' + user_1.id)
-            .query({ access_token: token })
-            .send({ password: '' })
-            .end(function (err, res) {
-                expect(res.statusCode).to.equal(403);
-                done();
-            });
-    });
-
-    it('admin cannot remove normal user with giving wrong password', function (done) {
-        superagent.del(SERVER_URL + '/api/v1/users/' + user_1.id)
-            .query({ access_token: token })
-            .send({ password: PASSWORD + PASSWORD })
-            .end(function (err, res) {
-                expect(res.statusCode).to.equal(403);
-                done();
-            });
-    });
-
-    it('admin removes normal user', function (done) {
-        superagent.del(SERVER_URL + '/api/v1/users/' + user_1.id)
-            .query({ access_token: token })
-            .send({ password: PASSWORD })
-            .end(function (err, res) {
-                expect(res.statusCode).to.equal(204);
-                done();
-            });
-    });
-
-    it('admin removes himself should not be allowed', function (done) {
-        superagent.del(SERVER_URL + '/api/v1/users/' + user_0.id)
-            .query({ access_token: token })
-            .send({ password: PASSWORD })
-            .end(function (err, res) {
-                expect(res.statusCode).to.equal(403);
-                done();
-            });
-    });
-
-    // Change email
-    it('change email fails due to missing token', function (done) {
-        superagent.post(SERVER_URL + '/api/v1/users/' + user_0.id)
-            .send({ email: EMAIL_0_NEW })
-            .end(function (error, result) {
-                expect(result.statusCode).to.equal(401);
-                done();
-            });
-    });
-
-    it('change email fails due to invalid email', function (done) {
-        superagent.post(SERVER_URL + '/api/v1/users/' + user_0.id)
-            .query({ access_token: token })
-            .send({ email: 'foo@bar' })
-            .end(function (error, result) {
-                expect(result.statusCode).to.equal(400);
-                done();
-            });
-    });
-
-    it('change user succeeds without email nor displayName', function (done) {
-        superagent.post(SERVER_URL + '/api/v1/users/' + user_0.id)
-            .query({ access_token: token })
-            .send({})
-            .end(function (error, result) {
-                expect(result.statusCode).to.equal(204);
-                done();
-            });
-    });
-
-    it('change email succeeds', function (done) {
-        superagent.post(SERVER_URL + '/api/v1/users/' + user_2.id)
-            .query({ access_token: token })
-            .send({ email: EMAIL_2_NEW })
-            .end(function (error, result) {
-                expect(result.statusCode).to.equal(204);
-
-                superagent.get(SERVER_URL + '/api/v1/users/' + user_2.id)
-                    .query({ access_token: token })
-                    .end(function (err, res) {
-                        expect(res.statusCode).to.equal(200);
-                        expect(res.body.username).to.equal(USERNAME_2.toLowerCase());
-                        expect(res.body.email).to.equal(EMAIL_2_NEW.toLowerCase());
-                        expect(res.body.admin).to.equal(false);
-                        expect(res.body.displayName).to.equal('');
-
-                        done();
-                    });
-            });
-    });
-
-    it('change email as admin for other user succeeds', function (done) {
-        superagent.post(SERVER_URL + '/api/v1/users/' + user_2.id)
-            .query({ access_token: token })
-            .send({ email: EMAIL_2 })
-            .end(function (error, result) {
-                expect(result.statusCode).to.equal(204);
-
-                superagent.get(SERVER_URL + '/api/v1/users/' + user_2.id)
-                    .query({ access_token: token })
-                    .end(function (err, res) {
-                        expect(res.statusCode).to.equal(200);
-                        expect(res.body.username).to.equal(USERNAME_2.toLowerCase());
-                        expect(res.body.email).to.equal(EMAIL_2.toLowerCase());
-                        expect(res.body.admin).to.equal(false);
-                        expect(res.body.displayName).to.equal('');
-
-                        done();
-                    });
-            });
-    });
-
-    it('change displayName succeeds', function (done) {
-        superagent.post(SERVER_URL + '/api/v1/users/' + user_0.id)
-            .query({ access_token: token })
-            .send({ displayName: DISPLAY_NAME_0_NEW })
-            .end(function (error, result) {
-                expect(result.statusCode).to.equal(204);
-
-                superagent.get(SERVER_URL + '/api/v1/users/' + user_0.id)
-                    .query({ access_token: token })
-                    .end(function (err, res) {
-                        expect(res.statusCode).to.equal(200);
-                        expect(res.body.username).to.equal(USERNAME_0.toLowerCase());
-                        expect(res.body.email).to.equal(EMAIL_0.toLowerCase());
-                        expect(res.body.admin).to.be.ok();
-                        expect(res.body.displayName).to.equal(DISPLAY_NAME_0_NEW);
-
-                        done();
-                    });
-            });
-    });
 });
@@ -0,0 +1,717 @@
+/* global it:false */
+/* global describe:false */
+/* global before:false */
+/* global after:false */
+
+'use strict';
+
+var accesscontrol = require('../../accesscontrol.js'),
+    async = require('async'),
+    config = require('../../config.js'),
+    constants = require('../../constants.js'),
+    database = require('../../database.js'),
+    domains = require('../../domains.js'),
+    tokendb = require('../../tokendb.js'),
+    expect = require('expect.js'),
+    groups = require('../../groups.js'),
+    mail = require('../../mail.js'),
+    mailer = require('../../mailer.js'),
+    superagent = require('superagent'),
+    server = require('../../server.js');
+
+const SERVER_URL = 'http://localhost:' + config.get('port');
+
+const DOMAIN_0 = {
+    domain: 'example-user-test.com',
+    zoneName: 'example-user-test.com',
+    config: {},
+    provider: 'noop',
+    fallbackCertificate: null,
+    tlsConfig: { provider: 'fallback' }
+};
+
+const USERNAME_0 = 'superaDmIn', PASSWORD = 'Foobar?1337', EMAIL_0 = 'silLY@me.com', EMAIL_0_NEW = 'stupID@me.com', DISPLAY_NAME_0_NEW = 'New Name';
+const USERNAME_1 = 'userTheFirst', EMAIL_1 = 'taO@zen.mac';
+const USERNAME_2 = 'userTheSecond', EMAIL_2 = 'USER@foo.bar', EMAIL_2_NEW = 'happy@ME.com';
+const USERNAME_3 = 'ut', EMAIL_3 = 'user3@FOO.bar';
+const USERNAME_4 = 'importedUser', EMAIL_4 = 'import@external.com';
+
+var groupObject;
+
+function setup(done) {
+    config._reset();
+
+    async.series([
+        server.start,
+        database._clear,
+        mailer._clearMailQueue,
+        domains.add.bind(null, DOMAIN_0.domain, DOMAIN_0.zoneName, DOMAIN_0.provider, DOMAIN_0.config, DOMAIN_0.fallbackCertificate, DOMAIN_0.tlsConfig),
+        mail.addDomain.bind(null, DOMAIN_0.domain)
+    ], function (error) {
+        expect(error).to.not.be.ok();
+
+        groups.create('somegroupname', function (error, result) {
+            expect(error).to.not.be.ok();
+
+            groupObject = result;
+
+            done();
+        });
+    });
+}
+
+function cleanup(done) {
+    database._clear(function (error) {
+        expect(!error).to.be.ok();
+
+        mailer._clearMailQueue();
+
+        server.stop(done);
+    });
+}
+
+function checkMails(number, done) {
+    // mails are enqueued async
+    setTimeout(function () {
+        expect(mailer._getMailQueue().length).to.equal(number);
+        mailer._clearMailQueue();
+        done();
+    }, 500);
+}
+
+describe('Users API', function () {
+    this.timeout(5000);
+
+    var user_0, user_1, user_2, user_4;
+    var token = null;
+    var token_1 = tokendb.generateToken();
+
+    before(setup);
+    after(cleanup);
+
+    it('device is in first time mode', function (done) {
+        superagent.get(SERVER_URL + '/api/v1/cloudron/status')
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(200);
+                expect(res.body.activated).to.not.be.ok();
+                done(err);
+            });
+    });
+
+    it('create admin fails due to missing parameters', function (done) {
+        superagent.post(SERVER_URL + '/api/v1/cloudron/activate')
+            .query({ setupToken: 'somesetuptoken' })
+            .send({ username: USERNAME_0 })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(400);
+                done();
+            });
+    });
+
+    it('create admin fails because only POST is allowed', function (done) {
+        superagent.get(SERVER_URL + '/api/v1/cloudron/activate')
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(404);
+                done();
+            });
+    });
+
+    it('create admin', function (done) {
+        superagent.post(SERVER_URL + '/api/v1/cloudron/activate')
+            .query({ setupToken: 'somesetuptoken' })
+            .send({ username: USERNAME_0, password: PASSWORD, email: EMAIL_0 })
+            .end(function (err, res) {
+                expect(err).to.eql(null);
+                expect(res.statusCode).to.equal(201);
+
+                // stash for later use
+                token = res.body.token;
+
+                superagent.get(SERVER_URL + '/api/v1/profile').query({ access_token: token }).end(function (error, result) {
+                    expect(error).to.eql(null);
+                    expect(result.status).to.equal(200);
+
+                    // stash for further use
+                    user_0 = result.body;
+
+                    done();
+                });
+            });
+    });
+
+    it('device left first time mode', function (done) {
+        superagent.get(SERVER_URL + '/api/v1/cloudron/status')
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(200);
+                expect(res.body.activated).to.be.ok();
+                done();
+            });
+    });
+
+    it('cannot get userInfo by username', function (done) {
+        superagent.get(SERVER_URL + '/api/v1/users/' + USERNAME_0)
+            .query({ access_token: token })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(404);
+
+                done();
+            });
+    });
+
+    it('can get userInfo with token', function (done) {
+        superagent.get(SERVER_URL + '/api/v1/users/' + user_0.id)
+            .query({ access_token: token })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(200);
+                expect(res.body.username).to.equal(USERNAME_0.toLowerCase());
+                expect(res.body.email).to.equal(EMAIL_0.toLowerCase());
+                expect(res.body.admin).to.be.ok();
+
+                done();
+            });
+    });
+
+    it('cannot get userInfo with expired token', function (done) {
+        var token = tokendb.generateToken();
+        var expires = Date.now() + 2000; // 1 sec
+
+        tokendb.add(token, user_0.id, null, expires, accesscontrol.SCOPE_PROFILE, function (error) {
+            expect(error).to.not.be.ok();
+
+            setTimeout(function () {
+                superagent.get(SERVER_URL + '/api/v1/users/' + user_0.username)
+                    .query({ access_token: token })
+                    .end(function (error, result) {
+                        expect(result.statusCode).to.equal(401);
+                        done();
+                    });
+            }, 2000);
+        });
+    });
+
+    it('can get userInfo with token', function (done) {
+        superagent.get(SERVER_URL + '/api/v1/users/' + user_0.id)
+            .query({ access_token: token })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(200);
+                expect(res.body.username).to.equal(USERNAME_0.toLowerCase());
+                expect(res.body.email).to.equal(EMAIL_0.toLowerCase());
+                expect(res.body.admin).to.be.ok();
+                done();
+            });
+    });
+
+    it('cannot get userInfo only with basic auth', function (done) {
+        superagent.get(SERVER_URL + '/api/v1/users/' + user_0.id)
+            .auth(USERNAME_0, PASSWORD)
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(401);
+                done();
+            });
+    });
+
+    it('cannot get userInfo with invalid token (token length)', function (done) {
+        superagent.get(SERVER_URL + '/api/v1/users/' + user_0.id)
+            .query({ access_token: 'x' + token })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(401);
+                done();
+            });
+    });
+
+    it('cannot get userInfo with invalid token (wrong token)', function (done) {
+        superagent.get(SERVER_URL + '/api/v1/users/' + user_0.id)
+            .query({ access_token: token.toUpperCase() })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(401);
+                done();
+            });
+    });
+
+    it('can get userInfo with token in auth header', function (done) {
+        superagent.get(SERVER_URL + '/api/v1/users/' + user_0.id)
+            .set('Authorization', 'Bearer ' + token)
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(200);
+                expect(res.body.username).to.equal(USERNAME_0.toLowerCase());
+                expect(res.body.email).to.equal(EMAIL_0.toLowerCase());
+                expect(res.body.admin).to.be.ok();
+                expect(res.body.displayName).to.be.a('string');
+                expect(res.body.password).to.not.be.ok();
+                expect(res.body.salt).to.not.be.ok();
+                done();
+            });
+    });
+
+    it('cannot get userInfo with invalid token in auth header', function (done) {
+        superagent.get(SERVER_URL + '/api/v1/users/' + user_0.id)
+            .set('Authorization', 'Bearer ' + 'x' + token)
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(401);
+                done();
+            });
+    });
+
+    it('cannot get userInfo with invalid token (wrong token)', function (done) {
+        superagent.get(SERVER_URL + '/api/v1/users/' + user_0.id)
+            .set('Authorization', 'Bearer ' + 'x' + token.toUpperCase())
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(401);
+                done();
+            });
+    });
+
+    it('cannot create user without email', function (done) {
+        mailer._clearMailQueue();
+
+        superagent.post(SERVER_URL + '/api/v1/users')
+            .query({ access_token: token })
+            .send({ username: USERNAME_1, invite: true })
+            .end(function (error, result) {
+                expect(error).to.be.ok();
+                expect(result.statusCode).to.equal(400);
+                done();
+            });
+    });
+
+    it('create second user succeeds', function (done) {
+        mailer._clearMailQueue();
+
+        superagent.post(SERVER_URL + '/api/v1/users')
+            .query({ access_token: token })
+            .send({ username: USERNAME_1, email: EMAIL_1, invite: true })
+            .end(function (error, result) {
+                expect(error).to.not.be.ok();
+                expect(result.statusCode).to.equal(201);
+
+                user_1 = result.body;
+
+                checkMails(2, function () {
+                    // HACK to get a token for second user (passwords are generated and the user should have gotten a password setup link...)
+                    tokendb.add(token_1, user_1.id, 'test-client-id',  Date.now() + 10000, accesscontrol.SCOPE_PROFILE, done);
+                });
+            });
+    });
+
+    it('reinvite unknown user fails', function (done) {
+        mailer._clearMailQueue();
+
+        superagent.post(SERVER_URL + '/api/v1/users/' + USERNAME_1+USERNAME_1 + '/invite')
+            .query({ access_token: token })
+            .send({})
+            .end(function (err, res) {
+                expect(err).to.be.an(Error);
+                expect(res.statusCode).to.equal(404);
+                checkMails(0, done);
+            });
+    });
+
+    it('reinvite second user succeeds', function (done) {
+        mailer._clearMailQueue();
+
+        superagent.post(SERVER_URL + '/api/v1/users/' + user_1.id + '/invite')
+            .query({ access_token: token })
+            .send({})
+            .end(function (err, res) {
+                expect(err).to.not.be.ok();
+                expect(res.statusCode).to.equal(200);
+                checkMails(1, done);
+            });
+    });
+
+    it('set second user as admin succeeds', function (done) {
+        superagent.put(SERVER_URL + '/api/v1/users/' + user_1.id + '/groups')
+            .query({ access_token: token })
+            .send({ groupIds: [ constants.ADMIN_GROUP_ID ] })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(204);
+
+                superagent.get(SERVER_URL + '/api/v1/users/' + user_1.id)
+                    .query({ access_token: token })
+                    .end(function (err, res) {
+                        expect(res.statusCode).to.equal(200);
+                        expect(res.body.admin).to.equal(true);
+
+                        done();
+                    });
+            });
+    });
+
+    it('list groupIds when listing users', function (done) {
+        superagent.get(SERVER_URL + '/api/v1/users')
+            .query({ access_token: token })
+            .end(function (error, res) {
+                expect(error).to.be(null);
+                expect(res.statusCode).to.equal(200);
+                expect(res.body.users).to.be.an('array');
+
+                res.body.users.forEach(function (user) {
+                    expect(user.admin).to.be(true);
+                    expect(user.groupIds).to.eql([ constants.ADMIN_GROUP_ID ]);
+                });
+                done();
+            });
+    });
+
+    it('remove itself from admins fails', function (done) {
+        superagent.put(SERVER_URL + '/api/v1/users/' + user_0.id + '/groups')
+            .query({ access_token: token })
+            .send({ groupIds: [ groupObject.id ] })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(403);
+                done();
+            });
+    });
+
+    it('remove second user from admins succeeds', function (done) {
+        superagent.put(SERVER_URL + '/api/v1/users/' + user_1.id + '/groups')
+            .query({ access_token: token })
+            .send({ groupIds: [ groupObject.id ] })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(204);
+
+                superagent.get(SERVER_URL + '/api/v1/users/' + user_1.id)
+                    .query({ access_token: token })
+                    .end(function (err, res) {
+                        expect(res.statusCode).to.equal(200);
+                        expect(res.body.admin).to.equal(false);
+
+                        done();
+                    });
+            });
+    });
+
+    it('create user missing username fails', function (done) {
+        superagent.post(SERVER_URL + '/api/v1/users')
+            .query({ access_token: token })
+            .send({ email: EMAIL_2 })
+            .end(function (error, result) {
+                expect(result.statusCode).to.equal(400);
+                done();
+            });
+    });
+
+    it('create user missing email fails', function (done) {
+        superagent.post(SERVER_URL + '/api/v1/users')
+            .query({ access_token: token })
+            .send({ username: USERNAME_2 })
+            .end(function (error, result) {
+                expect(result.statusCode).to.equal(400);
+                done();
+            });
+    });
+
+    it('create user missing invite fails', function (done) {
+        superagent.post(SERVER_URL + '/api/v1/users')
+            .query({ access_token: token })
+            .send({ username: USERNAME_2, email: EMAIL_2 })
+            .end(function (error, result) {
+                expect(result.statusCode).to.equal(400);
+                done();
+            });
+    });
+
+    it('create user reserved name fails', function (done) {
+        superagent.post(SERVER_URL + '/api/v1/users')
+            .query({ access_token: token })
+            .send({ username: 'no-reply' })
+            .end(function (error, result) {
+                expect(result.statusCode).to.equal(400);
+                done();
+            });
+    });
+
+    it('create user with short name fails', function (done) {
+        superagent.post(SERVER_URL + '/api/v1/users')
+            .query({ access_token: token })
+            .send({ username: 'n' })
+            .end(function (error, result) {
+                expect(result.statusCode).to.equal(400);
+                done();
+            });
+    });
+
+    it('create second and third user', function (done) {
+        mailer._clearMailQueue();
+
+        superagent.post(SERVER_URL + '/api/v1/users')
+            .query({ access_token: token })
+            .send({ username: USERNAME_2, email: EMAIL_2, invite: false })
+            .end(function (error, result) {
+                expect(result.statusCode).to.equal(201);
+
+                user_2 = result.body;
+
+                superagent.post(SERVER_URL + '/api/v1/users')
+                    .query({ access_token: token })
+                    .send({ username: USERNAME_3, email: EMAIL_3, invite: true })
+                    .end(function (error, result) {
+                        expect(result.statusCode).to.equal(201);
+
+                        // one mail for first user creation, two mails for second user creation (see 'invite' flag)
+                        checkMails(3, done);
+                    });
+            });
+    });
+
+    it('get userInfo succeeds for second user', function (done) {
+        superagent.get(SERVER_URL + '/api/v1/users/' + user_2.id)
+            .query({ access_token: token })
+            .end(function (error, result) {
+                expect(result.statusCode).to.equal(200);
+                expect(result.body.username).to.equal(USERNAME_2.toLowerCase());
+                expect(result.body.email).to.equal(EMAIL_2.toLowerCase());
+                expect(result.body.admin).to.not.be.ok();
+
+                done();
+            });
+    });
+
+    it('create user with same username should fail', function (done) {
+        superagent.post(SERVER_URL + '/api/v1/users')
+            .query({ access_token: token })
+            .send({ username: USERNAME_2, email: EMAIL_0, invite: false })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(409);
+                done();
+            });
+    });
+
+    it('list users fails for normal user', function (done) {
+        superagent.get(SERVER_URL + '/api/v1/users')
+            .query({ access_token: token_1 })
+            .end(function (error, res) {
+                expect(res.statusCode).to.equal(403);
+                done();
+            });
+    });
+
+    it('list users succeeds for admin', function (done) {
+        superagent.get(SERVER_URL + '/api/v1/users')
+            .query({ access_token: token })
+            .end(function (error, res) {
+                expect(error).to.be(null);
+                expect(res.statusCode).to.equal(200);
+                expect(res.body.users).to.be.an('array');
+                expect(res.body.users.length).to.equal(4);
+
+                res.body.users.forEach(function (user) {
+                    expect(user).to.be.an('object');
+                    expect(user.id).to.be.ok();
+                    expect(user.username).to.be.ok();
+                    expect(user.email).to.be.ok();
+                    expect(user.password).to.not.be.ok();
+                    expect(user.salt).to.not.be.ok();
+                    expect(user.groupIds).to.be.an(Array);
+                    expect(user.admin).to.be.a('boolean');
+                });
+
+                done();
+            });
+    });
+
+    it('remove random user fails', function (done) {
+        superagent.del(SERVER_URL + '/api/v1/users/randomid')
+            .query({ access_token: token })
+            .send({ password: PASSWORD })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(404);
+                done();
+            });
+    });
+
+    it('user removes himself is not allowed', function (done) {
+        superagent.del(SERVER_URL + '/api/v1/users/' + user_0.id)
+            .query({ access_token: token })
+            .send({ password: PASSWORD })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(403);
+                done();
+            });
+    });
+
+    it('admin cannot remove normal user without giving a password', function (done) {
+        superagent.del(SERVER_URL + '/api/v1/users/' + user_1.id)
+            .query({ access_token: token })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(400);
+                done();
+            });
+    });
+
+    it('admin cannot remove normal user with empty password', function (done) {
+        superagent.del(SERVER_URL + '/api/v1/users/' + user_1.id)
+            .query({ access_token: token })
+            .send({ password: '' })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(403);
+                done();
+            });
+    });
+
+    it('admin cannot remove normal user with giving wrong password', function (done) {
+        superagent.del(SERVER_URL + '/api/v1/users/' + user_1.id)
+            .query({ access_token: token })
+            .send({ password: PASSWORD + PASSWORD })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(403);
+                done();
+            });
+    });
+
+    it('admin removes normal user', function (done) {
+        superagent.del(SERVER_URL + '/api/v1/users/' + user_1.id)
+            .query({ access_token: token })
+            .send({ password: PASSWORD })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(204);
+                done();
+            });
+    });
+
+    it('admin removes himself should not be allowed', function (done) {
+        superagent.del(SERVER_URL + '/api/v1/users/' + user_0.id)
+            .query({ access_token: token })
+            .send({ password: PASSWORD })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(403);
+                done();
+            });
+    });
+
+    // Change email
+    it('change email fails due to missing token', function (done) {
+        superagent.post(SERVER_URL + '/api/v1/users/' + user_0.id)
+            .send({ email: EMAIL_0_NEW })
+            .end(function (error, result) {
+                expect(result.statusCode).to.equal(401);
+                done();
+            });
+    });
+
+    it('change email fails due to invalid email', function (done) {
+        superagent.post(SERVER_URL + '/api/v1/users/' + user_0.id)
+            .query({ access_token: token })
+            .send({ email: 'foo@bar' })
+            .end(function (error, result) {
+                expect(result.statusCode).to.equal(400);
+                done();
+            });
+    });
+
+    it('change user succeeds without email nor displayName', function (done) {
+        superagent.post(SERVER_URL + '/api/v1/users/' + user_0.id)
+            .query({ access_token: token })
+            .send({})
+            .end(function (error, result) {
+                expect(result.statusCode).to.equal(204);
+                done();
+            });
+    });
+
+    it('change email succeeds', function (done) {
+        superagent.post(SERVER_URL + '/api/v1/users/' + user_2.id)
+            .query({ access_token: token })
+            .send({ email: EMAIL_2_NEW })
+            .end(function (error, result) {
+                expect(result.statusCode).to.equal(204);
+
+                superagent.get(SERVER_URL + '/api/v1/users/' + user_2.id)
+                    .query({ access_token: token })
+                    .end(function (err, res) {
+                        expect(res.statusCode).to.equal(200);
+                        expect(res.body.username).to.equal(USERNAME_2.toLowerCase());
+                        expect(res.body.email).to.equal(EMAIL_2_NEW.toLowerCase());
+                        expect(res.body.admin).to.equal(false);
+                        expect(res.body.displayName).to.equal('');
+
+                        done();
+                    });
+            });
+    });
+
+    it('change email as admin for other user succeeds', function (done) {
+        superagent.post(SERVER_URL + '/api/v1/users/' + user_2.id)
+            .query({ access_token: token })
+            .send({ email: EMAIL_2 })
+            .end(function (error, result) {
+                expect(result.statusCode).to.equal(204);
+
+                superagent.get(SERVER_URL + '/api/v1/users/' + user_2.id)
+                    .query({ access_token: token })
+                    .end(function (err, res) {
+                        expect(res.statusCode).to.equal(200);
+                        expect(res.body.username).to.equal(USERNAME_2.toLowerCase());
+                        expect(res.body.email).to.equal(EMAIL_2.toLowerCase());
+                        expect(res.body.admin).to.equal(false);
+                        expect(res.body.displayName).to.equal('');
+
+                        done();
+                    });
+            });
+    });
+
+    it('change displayName succeeds', function (done) {
+        superagent.post(SERVER_URL + '/api/v1/users/' + user_0.id)
+            .query({ access_token: token })
+            .send({ displayName: DISPLAY_NAME_0_NEW })
+            .end(function (error, result) {
+                expect(result.statusCode).to.equal(204);
+
+                superagent.get(SERVER_URL + '/api/v1/users/' + user_0.id)
+                    .query({ access_token: token })
+                    .end(function (err, res) {
+                        expect(res.statusCode).to.equal(200);
+                        expect(res.body.username).to.equal(USERNAME_0.toLowerCase());
+                        expect(res.body.email).to.equal(EMAIL_0.toLowerCase());
+                        expect(res.body.admin).to.be.ok();
+                        expect(res.body.displayName).to.equal(DISPLAY_NAME_0_NEW);
+
+                        done();
+                    });
+            });
+    });
+
+    it('cannot create user with bad password', function (done) {
+        mailer._clearMailQueue();
+
+        superagent.post(SERVER_URL + '/api/v1/users')
+            .query({ access_token: token })
+            .send({ username: USERNAME_4, email: EMAIL_4, invite: false, password: 'tooweak' })
+            .end(function (error, result) {
+                expect(error).to.be.ok();
+                expect(result.statusCode).to.equal(400);
+                done();
+            });
+    });
+
+    it('can create user with a password', function (done) {
+        superagent.post(SERVER_URL + '/api/v1/users')
+            .query({ access_token: token })
+            .send({ username: USERNAME_4, email: EMAIL_4, invite: false, password: 'Secret1#' })
+            .end(function (error, result) {
+                expect(error).to.not.be.ok();
+                expect(result.statusCode).to.equal(201);
+
+                user_4 = result.body;
+
+                token = tokendb.generateToken();
+                var expires = Date.now() + 2000; // 1 sec
+
+                tokendb.add(token, user_4.id, null, expires, accesscontrol.SCOPE_PROFILE, done);
+            });
+    });
+
+    it('can get profile of user with pre-set password', function (done) {
+        superagent.get(SERVER_URL + '/api/v1/profile')
+            .query({ access_token: token })
+            .end(function (err, res) {
+                expect(res.statusCode).to.equal(200);
+
+                expect(res.body.email).to.be(EMAIL_4);
+
+                done();
+            });
+    });
+});
+
@@ -1,186 +1,20 @@
 'use strict';

 exports = module.exports = {
-    get: get,
-    update: update,
-    list: list,
-    create: create,
-    remove: remove,
-    verifyPassword: verifyPassword,
-    requireAdmin: requireAdmin,
-    sendInvite: sendInvite,
-    setGroups: setGroups
+    getCloudronConfig: getCloudronConfig
 };

-var assert = require('assert'),
-    clients = require('../clients.js'),
-    constants = require('../constants.js'),
-    generatePassword = require('../password.js').generate,
+var cloudron = require('../cloudron.js'),
    HttpError = require('connect-lastmile').HttpError,
    HttpSuccess = require('connect-lastmile').HttpSuccess,
-    oauth2 = require('./oauth2.js'),
-    user = require('../user.js'),
-    UserError = user.UserError;
+    _ = require('underscore');

-function auditSource(req) {
-    var ip = req.headers['x-forwarded-for'] || req.connection.remoteAddress || null;
-    return { ip: ip, username: req.user ? req.user.username : null, userId: req.user ? req.user.id : null };
-}
-
-function create(req, res, next) {
-    assert.strictEqual(typeof req.body, 'object');
-
-    if (typeof req.body.email !== 'string') return next(new HttpError(400, 'email must be string'));
-    if (typeof req.body.invite !== 'boolean') return next(new HttpError(400, 'invite must be boolean'));
-    if ('username' in req.body && typeof req.body.username !== 'string') return next(new HttpError(400, 'username must be string'));
-    if ('displayName' in req.body && typeof req.body.displayName !== 'string') return next(new HttpError(400, 'displayName must be string'));
-
-    var password = generatePassword();
-    var email = req.body.email;
-    var sendInvite = req.body.invite;
-    var username = 'username' in req.body ? req.body.username : null;
-    var displayName = req.body.displayName || '';
-
-    user.create(username, password, email, displayName, auditSource(req), { invitor: req.user, sendInvite: sendInvite }, function (error, user) {
-        if (error && error.reason === UserError.BAD_FIELD) return next(new HttpError(400, error.message));
-        if (error && error.reason === UserError.ALREADY_EXISTS) return next(new HttpError(409, error.message));
+function getCloudronConfig(req, res, next) {
+    cloudron.getConfig(function (error, cloudronConfig) {
        if (error) return next(new HttpError(500, error));

-        var userInfo = {
-            id: user.id,
-            username: user.username,
-            displayName: user.displayName,
-            email: user.email,
-            fallbackEmail: user.fallbackEmail,
-            admin: user.admin,
-            groupIds: [ ],
-            resetToken: user.resetToken
-        };
+        var result = _.pick(cloudronConfig, 'apiServerOrigin', 'webServerOrigin', 'fqdn', 'adminFqdn', 'version', 'progress', 'isDemo', 'cloudronName', 'provider');

-        next(new HttpSuccess(201, userInfo ));
-    });
-}
-
-function update(req, res, next) {
-    assert.strictEqual(typeof req.params.userId, 'string');
-    assert.strictEqual(typeof req.user, 'object');
-    assert.strictEqual(typeof req.body, 'object');
-
-    if ('email' in req.body && typeof req.body.email !== 'string') return next(new HttpError(400, 'email must be string'));
-    if ('fallbackEmail' in req.body && typeof req.body.fallbackEmail !== 'string') return next(new HttpError(400, 'fallbackEmail must be string'));
-    if ('displayName' in req.body && typeof req.body.displayName !== 'string') return next(new HttpError(400, 'displayName must be string'));
-    if ('username' in req.body && typeof req.body.username !== 'string') return next(new HttpError(400, 'username must be a string'));
-
-    if (req.user.id !== req.params.userId && !req.user.admin) return next(new HttpError(403, 'Not allowed'));
-
-    user.update(req.params.userId, req.body, auditSource(req), function (error) {
-        if (error && error.reason === UserError.BAD_FIELD) return next(new HttpError(400, error.message));
-        if (error && error.reason === UserError.ALREADY_EXISTS) return next(new HttpError(409, error.message));
-        if (error && error.reason === UserError.NOT_FOUND) return next(new HttpError(404, 'User not found'));
-        if (error) return next(new HttpError(500, error));
-
-        next(new HttpSuccess(204));
-    });
-}
-
-function list(req, res, next) {
-    user.list(function (error, results) {
-        if (error) return next(new HttpError(500, error));
-
-        var users = results.map(user.removePrivateFields);
-
-        next(new HttpSuccess(200, { users: users }));
-    });
-}
-
-function get(req, res, next) {
-    assert.strictEqual(typeof req.params.userId, 'string');
-    assert.strictEqual(typeof req.user, 'object');
-
-    if (req.user.id !== req.params.userId && !req.user.admin) return next(new HttpError(403, 'Not allowed'));
-
-    user.get(req.params.userId, function (error, result) {
-        if (error && error.reason === UserError.NOT_FOUND) return next(new HttpError(404, 'No such user'));
-        if (error) return next(new HttpError(500, error));
-
-        next(new HttpSuccess(200, user.removePrivateFields(result)));
-    });
-}
-
-function remove(req, res, next) {
-    assert.strictEqual(typeof req.params.userId, 'string');
-
-    // rules:
-    // - admin can remove any user
-    // - admin cannot remove admin
-    // - user cannot remove himself <- TODO should this actually work?
-
-    if (req.user.id === req.params.userId) return next(new HttpError(403, 'Not allowed to remove yourself.'));
-
-    user.remove(req.params.userId, auditSource(req), function (error) {
-        if (error && error.reason === UserError.BAD_FIELD) return next(new HttpError(400, error.message));
-        if (error && error.reason === UserError.NOT_FOUND) return next(new HttpError(404, 'No such user'));
-        if (error) return next(new HttpError(500, error));
-
-        next(new HttpSuccess(204));
-    });
-}
-
-function verifyPassword(req, res, next) {
-    assert.strictEqual(typeof req.body, 'object');
-
-    // using an 'sdk' token we skip password checks
-    var error = oauth2.validateRequestedScopes(req, [ clients.SCOPE_ROLE_SDK ]);
-    if (!error) return next();
-
-    if (typeof req.body.password !== 'string') return next(new HttpError(400, 'API call requires user password'));
-
-    user.verifyWithUsername(req.user.username, req.body.password, function (error) {
-        if (error && error.reason === UserError.WRONG_PASSWORD) return next(new HttpError(403, 'Password incorrect'));
-        if (error && error.reason === UserError.NOT_FOUND) return next(new HttpError(403, 'Password incorrect'));
-        if (error) return next(new HttpError(500, error));
-
-        req.body.password = '<redacted>'; // this will prevent logs from displaying plain text password
-
-        next();
-    });
-}
-
-/*
-    Middleware which makes the route only accessable for the admin user.
-*/
-function requireAdmin(req, res, next) {
-    assert.strictEqual(typeof req.user, 'object');
-
-    if (!req.user.admin) return next(new HttpError(403, 'API call requires admin rights.'));
-
-    next();
-}
-
-function sendInvite(req, res, next) {
-    assert.strictEqual(typeof req.params.userId, 'string');
-
-    user.sendInvite(req.params.userId, { invitor: req.user }, function (error, result) {
-        if (error && error.reason === UserError.NOT_FOUND) return next(new HttpError(404, 'User not found'));
-        if (error) return next(new HttpError(500, error));
-
-        next(new HttpSuccess(200, { resetToken: result }));
-    });
-}
-
-function setGroups(req, res, next) {
-    assert.strictEqual(typeof req.body, 'object');
-    assert.strictEqual(typeof req.params.userId, 'string');
-
-    if (!Array.isArray(req.body.groupIds)) return next(new HttpError(400, 'API call requires a groups array.'));
-
-    // this route is only allowed for admins, so req.user has to be an admin
-    if (req.user.id === req.params.userId && req.body.groupIds.indexOf(constants.ADMIN_GROUP_ID) === -1) return next(new HttpError(403, 'Admin removing itself from admins is not allowed'));
-
-    user.setGroups(req.params.userId, req.body.groupIds, function (error) {
-        if (error && error.reason === UserError.NOT_FOUND) return next(new HttpError(404, 'One or more groups not found'));
-        if (error) return next(new HttpError(500, error));
-
-        next(new HttpSuccess(204));
+        next(new HttpSuccess(200, result));
    });
 }
@@ -0,0 +1,172 @@
+'use strict';
+
+exports = module.exports = {
+    get: get,
+    update: update,
+    list: list,
+    create: create,
+    remove: remove,
+    verifyPassword: verifyPassword,
+    sendInvite: sendInvite,
+    setGroups: setGroups
+};
+
+var assert = require('assert'),
+    constants = require('../constants.js'),
+    generatePassword = require('../password.js').generate,
+    HttpError = require('connect-lastmile').HttpError,
+    HttpSuccess = require('connect-lastmile').HttpSuccess,
+    users = require('../users.js'),
+    UsersError = users.UsersError;
+
+function auditSource(req) {
+    var ip = req.headers['x-forwarded-for'] || req.connection.remoteAddress || null;
+    return { ip: ip, username: req.user ? req.user.username : null, userId: req.user ? req.user.id : null };
+}
+
+function create(req, res, next) {
+    assert.strictEqual(typeof req.body, 'object');
+
+    if (typeof req.body.email !== 'string') return next(new HttpError(400, 'email must be string'));
+    if (typeof req.body.invite !== 'boolean') return next(new HttpError(400, 'invite must be boolean'));
+    if ('username' in req.body && typeof req.body.username !== 'string') return next(new HttpError(400, 'username must be string'));
+    if ('displayName' in req.body && typeof req.body.displayName !== 'string') return next(new HttpError(400, 'displayName must be string'));
+    if ('password' in req.body && typeof req.body.password !== 'string') return next(new HttpError(400, 'password must be string'));
+
+    var password = req.body.password || generatePassword();
+    var email = req.body.email;
+    var sendInvite = req.body.invite;
+    var username = 'username' in req.body ? req.body.username : null;
+    var displayName = req.body.displayName || '';
+
+    users.create(username, password, email, displayName, auditSource(req), { invitor: req.user, sendInvite: sendInvite }, function (error, user) {
+        if (error && error.reason === UsersError.BAD_FIELD) return next(new HttpError(400, error.message));
+        if (error && error.reason === UsersError.ALREADY_EXISTS) return next(new HttpError(409, error.message));
+        if (error) return next(new HttpError(500, error));
+
+        var userInfo = {
+            id: user.id,
+            username: user.username,
+            displayName: user.displayName,
+            email: user.email,
+            fallbackEmail: user.fallbackEmail,
+            admin: user.admin,
+            groupIds: [ ],
+            resetToken: user.resetToken
+        };
+
+        next(new HttpSuccess(201, userInfo ));
+    });
+}
+
+function update(req, res, next) {
+    assert.strictEqual(typeof req.params.userId, 'string');
+    assert.strictEqual(typeof req.user, 'object');
+    assert.strictEqual(typeof req.body, 'object');
+
+    if ('email' in req.body && typeof req.body.email !== 'string') return next(new HttpError(400, 'email must be string'));
+    if ('fallbackEmail' in req.body && typeof req.body.fallbackEmail !== 'string') return next(new HttpError(400, 'fallbackEmail must be string'));
+    if ('displayName' in req.body && typeof req.body.displayName !== 'string') return next(new HttpError(400, 'displayName must be string'));
+    if ('username' in req.body && typeof req.body.username !== 'string') return next(new HttpError(400, 'username must be a string'));
+
+    if (req.user.id !== req.params.userId && !req.user.admin) return next(new HttpError(403, 'Not allowed'));
+
+    users.update(req.params.userId, req.body, auditSource(req), function (error) {
+        if (error && error.reason === UsersError.BAD_FIELD) return next(new HttpError(400, error.message));
+        if (error && error.reason === UsersError.ALREADY_EXISTS) return next(new HttpError(409, error.message));
+        if (error && error.reason === UsersError.NOT_FOUND) return next(new HttpError(404, 'User not found'));
+        if (error) return next(new HttpError(500, error));
+
+        next(new HttpSuccess(204));
+    });
+}
+
+function list(req, res, next) {
+    users.list(function (error, results) {
+        if (error) return next(new HttpError(500, error));
+
+        results = results.map(users.removePrivateFields);
+
+        next(new HttpSuccess(200, { users: results }));
+    });
+}
+
+function get(req, res, next) {
+    assert.strictEqual(typeof req.params.userId, 'string');
+    assert.strictEqual(typeof req.user, 'object');
+
+    if (req.user.id !== req.params.userId && !req.user.admin) return next(new HttpError(403, 'Not allowed'));
+
+    users.get(req.params.userId, function (error, result) {
+        if (error && error.reason === UsersError.NOT_FOUND) return next(new HttpError(404, 'No such user'));
+        if (error) return next(new HttpError(500, error));
+
+        next(new HttpSuccess(200, users.removePrivateFields(result)));
+    });
+}
+
+function remove(req, res, next) {
+    assert.strictEqual(typeof req.params.userId, 'string');
+
+    // rules:
+    // - admin can remove any user
+    // - admin cannot remove admin
+    // - user cannot remove himself <- TODO should this actually work?
+
+    if (req.user.id === req.params.userId) return next(new HttpError(403, 'Not allowed to remove yourself.'));
+
+    users.remove(req.params.userId, auditSource(req), function (error) {
+        if (error && error.reason === UsersError.BAD_FIELD) return next(new HttpError(400, error.message));
+        if (error && error.reason === UsersError.NOT_FOUND) return next(new HttpError(404, 'No such user'));
+        if (error) return next(new HttpError(500, error));
+
+        next(new HttpSuccess(204));
+    });
+}
+
+function verifyPassword(req, res, next) {
+    assert.strictEqual(typeof req.body, 'object');
+
+    // using an 'sdk' token we skip password checks
+    if (req.authInfo.clientId === 'cid-sdk' || req.authInfo.clientId === 'cid-cli') return next();
+
+    if (typeof req.body.password !== 'string') return next(new HttpError(400, 'API call requires user password'));
+
+    users.verifyWithUsername(req.user.username, req.body.password, function (error) {
+        if (error && error.reason === UsersError.WRONG_PASSWORD) return next(new HttpError(403, 'Password incorrect'));
+        if (error && error.reason === UsersError.NOT_FOUND) return next(new HttpError(403, 'Password incorrect'));
+        if (error) return next(new HttpError(500, error));
+
+        req.body.password = '<redacted>'; // this will prevent logs from displaying plain text password
+
+        next();
+    });
+}
+
+function sendInvite(req, res, next) {
+    assert.strictEqual(typeof req.params.userId, 'string');
+
+    users.sendInvite(req.params.userId, { invitor: req.user }, function (error, result) {
+        if (error && error.reason === UsersError.NOT_FOUND) return next(new HttpError(404, 'User not found'));
+        if (error) return next(new HttpError(500, error));
+
+        next(new HttpSuccess(200, { resetToken: result }));
+    });
+}
+
+function setGroups(req, res, next) {
+    assert.strictEqual(typeof req.body, 'object');
+    assert.strictEqual(typeof req.params.userId, 'string');
+
+    if (!Array.isArray(req.body.groupIds)) return next(new HttpError(400, 'API call requires a groups array.'));
+
+    // this route is only allowed for admins, so req.user has to be an admin
+    if (req.user.id === req.params.userId && req.body.groupIds.indexOf(constants.ADMIN_GROUP_ID) === -1) return next(new HttpError(403, 'Admin removing itself from admins is not allowed'));
+
+    users.setGroups(req.params.userId, req.body.groupIds, function (error) {
+        if (error && error.reason === UsersError.NOT_FOUND) return next(new HttpError(404, 'One or more groups not found'));
+        if (error) return next(new HttpError(500, error));
+
+        next(new HttpSuccess(204));
+    });
+}
@@ -5,10 +5,9 @@ exports = module.exports = {
    stop: stop
 };

-var assert = require('assert'),
+var accesscontrol = require('./accesscontrol.js'),
+    assert = require('assert'),
    async = require('async'),
-    auth = require('./auth.js'),
-    clients = require('./clients.js'),
    cloudron = require('./cloudron.js'),
    config = require('./config.js'),
    database = require('./database.js'),
@@ -90,14 +89,17 @@ function initializeExpressSync() {
    var multipart = middleware.multipart({ maxFieldsSize: FIELD_LIMIT, limit: FILE_SIZE_LIMIT, timeout: FILE_TIMEOUT });

    // scope middleware implicitly also adds bearer token verification
-    var cloudronScope = routes.oauth2.scope(clients.SCOPE_CLOUDRON);
-    var profileScope = routes.oauth2.scope(clients.SCOPE_PROFILE);
-    var usersScope = routes.oauth2.scope(clients.SCOPE_USERS);
-    var appsScope = routes.oauth2.scope(clients.SCOPE_APPS);
-    var settingsScope = routes.oauth2.scope(clients.SCOPE_SETTINGS);
+    var cloudronScope = routes.accesscontrol.scope(accesscontrol.SCOPE_CLOUDRON);
+    var profileScope = routes.accesscontrol.scope(accesscontrol.SCOPE_PROFILE);
+    var usersScope = routes.accesscontrol.scope(accesscontrol.SCOPE_USERS);
+    var appsScope = routes.accesscontrol.scope(accesscontrol.SCOPE_APPS);
+    var settingsScope = routes.accesscontrol.scope(accesscontrol.SCOPE_SETTINGS);
+    var mailScope = routes.accesscontrol.scope(accesscontrol.SCOPE_MAIL);
+    var clientsScope = routes.accesscontrol.scope(accesscontrol.SCOPE_CLIENTS);
+    var domainsScope = routes.accesscontrol.scope(accesscontrol.SCOPE_DOMAINS);

    // csrf protection
-    var csrf = routes.oauth2.csrf;
+    var csrf = routes.oauth2.csrf();

    // public routes
    router.post('/api/v1/cloudron/dns_setup', routes.setup.providerTokenAuth, routes.setup.dnsSetup);    // only available until no-domain
@@ -113,45 +115,50 @@ function initializeExpressSync() {

    // cloudron routes
    router.get ('/api/v1/cloudron/config', cloudronScope, routes.cloudron.getConfig);
-    router.post('/api/v1/cloudron/update', cloudronScope, routes.user.requireAdmin, routes.cloudron.update);
-    router.post('/api/v1/cloudron/check_for_updates', cloudronScope, routes.user.requireAdmin, routes.cloudron.checkForUpdates);
-    router.post('/api/v1/cloudron/reboot', cloudronScope, routes.user.requireAdmin, routes.cloudron.reboot);
-    router.get ('/api/v1/cloudron/graphs', cloudronScope, routes.user.requireAdmin, routes.graphs.getGraphs);
-    router.get ('/api/v1/cloudron/disks', cloudronScope, routes.user.requireAdmin, routes.cloudron.getDisks);
-    router.get ('/api/v1/cloudron/logs', cloudronScope, routes.user.requireAdmin, routes.cloudron.getLogs);
-    router.get ('/api/v1/cloudron/logstream', cloudronScope, routes.user.requireAdmin, routes.cloudron.getLogStream);
-    router.get ('/api/v1/cloudron/ssh/authorized_keys', cloudronScope, routes.user.requireAdmin, routes.ssh.getAuthorizedKeys);
-    router.put ('/api/v1/cloudron/ssh/authorized_keys', cloudronScope, routes.user.requireAdmin, routes.ssh.addAuthorizedKey);
-    router.get ('/api/v1/cloudron/ssh/authorized_keys/:identifier', cloudronScope, routes.user.requireAdmin, routes.ssh.getAuthorizedKey);
-    router.del ('/api/v1/cloudron/ssh/authorized_keys/:identifier', cloudronScope, routes.user.requireAdmin, routes.ssh.delAuthorizedKey);
-    router.get ('/api/v1/cloudron/eventlog', cloudronScope, routes.user.requireAdmin, routes.eventlog.get);
+    router.post('/api/v1/cloudron/update', cloudronScope, routes.cloudron.update);
+    router.post('/api/v1/cloudron/check_for_updates', cloudronScope, routes.cloudron.checkForUpdates);
+    router.post('/api/v1/cloudron/reboot', cloudronScope, routes.cloudron.reboot);
+    router.get ('/api/v1/cloudron/graphs', cloudronScope, routes.graphs.getGraphs);
+    router.get ('/api/v1/cloudron/disks', cloudronScope, routes.cloudron.getDisks);
+    router.get ('/api/v1/cloudron/logs', cloudronScope, routes.cloudron.getLogs);
+    router.get ('/api/v1/cloudron/logstream', cloudronScope, routes.cloudron.getLogStream);
+    router.get ('/api/v1/cloudron/ssh/authorized_keys', cloudronScope, routes.ssh.getAuthorizedKeys);
+    router.put ('/api/v1/cloudron/ssh/authorized_keys', cloudronScope, routes.ssh.addAuthorizedKey);
+    router.get ('/api/v1/cloudron/ssh/authorized_keys/:identifier', cloudronScope, routes.ssh.getAuthorizedKey);
+    router.del ('/api/v1/cloudron/ssh/authorized_keys/:identifier', cloudronScope, routes.ssh.delAuthorizedKey);
+    router.get ('/api/v1/cloudron/eventlog', cloudronScope, routes.eventlog.get);

-    // profile api, working off the user behind the provided token
+    // working off the user behind the provided token
+    router.get ('/api/v1/user/apps', profileScope, routes.apps.getAllByUser);
+    router.get ('/api/v1/user/cloudron_config', profileScope, routes.user.getCloudronConfig);
    router.get ('/api/v1/profile', profileScope, routes.profile.get);
    router.post('/api/v1/profile', profileScope, routes.profile.update);
-    router.post('/api/v1/profile/password', profileScope, routes.user.verifyPassword, routes.profile.changePassword);
+    router.post('/api/v1/profile/password', profileScope, routes.users.verifyPassword, routes.profile.changePassword);
+    router.post('/api/v1/profile/twofactorauthentication', profileScope, routes.profile.setTwoFactorAuthenticationSecret);
+    router.post('/api/v1/profile/twofactorauthentication/enable', profileScope, routes.profile.enableTwoFactorAuthentication);
+    router.post('/api/v1/profile/twofactorauthentication/disable', profileScope, routes.users.verifyPassword, routes.profile.disableTwoFactorAuthentication);

    // user routes
-    router.get ('/api/v1/users', usersScope, routes.user.requireAdmin, routes.user.list);
-    router.post('/api/v1/users', usersScope, routes.user.requireAdmin, routes.user.create);
-    router.get ('/api/v1/users/:userId', usersScope, routes.user.requireAdmin, routes.user.get);
-    router.del ('/api/v1/users/:userId', usersScope, routes.user.requireAdmin, routes.user.verifyPassword, routes.user.remove);
-    router.post('/api/v1/users/:userId', usersScope, routes.user.requireAdmin, routes.user.update);
-    router.put ('/api/v1/users/:userId/groups', usersScope, routes.user.requireAdmin, routes.user.setGroups);
-    router.post('/api/v1/users/:userId/invite', usersScope, routes.user.requireAdmin, routes.user.sendInvite);
+    router.get ('/api/v1/users', usersScope, routes.users.list);
+    router.post('/api/v1/users', usersScope, routes.users.create);
+    router.get ('/api/v1/users/:userId', usersScope, routes.users.get);
+    router.del ('/api/v1/users/:userId', usersScope, routes.users.verifyPassword, routes.users.remove);
+    router.post('/api/v1/users/:userId', usersScope, routes.users.update);
+    router.put ('/api/v1/users/:userId/groups', usersScope, routes.users.setGroups);
+    router.post('/api/v1/users/:userId/invite', usersScope, routes.users.sendInvite);

    // Group management
-    router.get ('/api/v1/groups', usersScope, routes.user.requireAdmin, routes.groups.list);
-    router.post('/api/v1/groups', usersScope, routes.user.requireAdmin, routes.groups.create);
-    router.get ('/api/v1/groups/:groupId', usersScope, routes.user.requireAdmin, routes.groups.get);
-    router.put ('/api/v1/groups/:groupId/members', usersScope, routes.user.requireAdmin, routes.groups.updateMembers);
-    router.del ('/api/v1/groups/:groupId', usersScope, routes.user.requireAdmin, routes.user.verifyPassword, routes.groups.remove);
+    router.get ('/api/v1/groups', usersScope, routes.groups.list);
+    router.post('/api/v1/groups', usersScope, routes.groups.create);
+    router.get ('/api/v1/groups/:groupId', usersScope, routes.groups.get);
+    router.put ('/api/v1/groups/:groupId/members', usersScope, routes.groups.updateMembers);
+    router.del ('/api/v1/groups/:groupId', usersScope, routes.users.verifyPassword, routes.groups.remove);

    // form based login routes used by oauth2 frame
    router.get ('/api/v1/session/login', csrf, routes.oauth2.loginForm);
    router.post('/api/v1/session/login', csrf, routes.oauth2.login);
    router.get ('/api/v1/session/logout', routes.oauth2.logout);
-    router.get ('/api/v1/session/callback', routes.oauth2.callback);
+    router.get ('/api/v1/session/callback', routes.oauth2.sessionCallback());
    router.get ('/api/v1/session/password/resetRequest.html', csrf, routes.oauth2.passwordResetRequestSite);
    router.post('/api/v1/session/password/resetRequest', csrf, routes.oauth2.passwordResetRequest);
    router.get ('/api/v1/session/password/sent.html', routes.oauth2.passwordSentSite);
@@ -161,101 +168,102 @@ function initializeExpressSync() {
    router.post('/api/v1/session/account/setup', csrf, routes.oauth2.accountSetup);

    // oauth2 routes
-    router.get ('/api/v1/oauth/dialog/authorize', routes.oauth2.authorization);
-    router.post('/api/v1/oauth/token', routes.oauth2.token);
-    router.get ('/api/v1/oauth/clients', settingsScope, routes.clients.getAll);
-    router.post('/api/v1/oauth/clients', settingsScope, routes.clients.add);
-    router.get ('/api/v1/oauth/clients/:clientId', settingsScope, routes.clients.get);
-    router.post('/api/v1/oauth/clients/:clientId', settingsScope, routes.clients.add);
-    router.del ('/api/v1/oauth/clients/:clientId', settingsScope, routes.clients.del);
-    router.get ('/api/v1/oauth/clients/:clientId/tokens', settingsScope, routes.clients.getClientTokens);
-    router.post('/api/v1/oauth/clients/:clientId/tokens', settingsScope, routes.clients.addClientToken);
-    router.del ('/api/v1/oauth/clients/:clientId/tokens', settingsScope, routes.clients.delClientTokens);
-    router.del ('/api/v1/oauth/clients/:clientId/tokens/:tokenId', settingsScope, routes.clients.delToken);
+    router.get ('/api/v1/oauth/dialog/authorize', routes.oauth2.authorization());
+    router.post('/api/v1/oauth/token', routes.oauth2.token());
+
+    // client/token routes
+    router.get ('/api/v1/clients', clientsScope, routes.clients.getAll);
+    router.post('/api/v1/clients', clientsScope, routes.clients.add);
+    router.get ('/api/v1/clients/:clientId', clientsScope, routes.clients.get);
+    router.post('/api/v1/clients/:clientId', clientsScope, routes.clients.add);
+    router.del ('/api/v1/clients/:clientId', clientsScope, routes.clients.del);
+    router.get ('/api/v1/clients/:clientId/tokens', clientsScope, routes.clients.getTokens);
+    router.post('/api/v1/clients/:clientId/tokens', clientsScope, routes.clients.addToken);
+    router.del ('/api/v1/clients/:clientId/tokens', clientsScope, routes.clients.delTokens);
+    router.del ('/api/v1/clients/:clientId/tokens/:tokenId', clientsScope, routes.clients.delToken);

    // app routes
    router.get ('/api/v1/apps',          appsScope, routes.apps.getApps);
    router.get ('/api/v1/apps/:id',      appsScope, routes.apps.getApp);
    router.get ('/api/v1/apps/:id/icon', routes.apps.getAppIcon);

-    router.post('/api/v1/apps/install',       appsScope, routes.user.requireAdmin, routes.apps.installApp);
-    router.post('/api/v1/apps/:id/uninstall', appsScope, routes.user.requireAdmin, routes.user.verifyPassword, routes.apps.uninstallApp);
-    router.post('/api/v1/apps/:id/configure', appsScope, routes.user.requireAdmin, routes.apps.configureApp);
-    router.post('/api/v1/apps/:id/update',    appsScope, routes.user.requireAdmin, routes.apps.updateApp);
-    router.post('/api/v1/apps/:id/restore',   appsScope, routes.user.requireAdmin, routes.user.verifyPassword, routes.apps.restoreApp);
-    router.post('/api/v1/apps/:id/backup',    appsScope, routes.user.requireAdmin, routes.apps.backupApp);
-    router.get ('/api/v1/apps/:id/backups',   appsScope, routes.user.requireAdmin, routes.apps.listBackups);
-    router.post('/api/v1/apps/:id/stop',      appsScope, routes.user.requireAdmin, routes.apps.stopApp);
-    router.post('/api/v1/apps/:id/start',     appsScope, routes.user.requireAdmin, routes.apps.startApp);
-    router.get ('/api/v1/apps/:id/logstream', appsScope, routes.user.requireAdmin, routes.apps.getLogStream);
-    router.get ('/api/v1/apps/:id/logs',      appsScope, routes.user.requireAdmin, routes.apps.getLogs);
-    router.get ('/api/v1/apps/:id/exec',      appsScope, routes.user.requireAdmin, routes.apps.exec);
+    router.post('/api/v1/apps/install',       appsScope, routes.apps.installApp);
+    router.post('/api/v1/apps/:id/uninstall', appsScope, routes.users.verifyPassword, routes.apps.uninstallApp);
+    router.post('/api/v1/apps/:id/configure', appsScope, routes.apps.configureApp);
+    router.post('/api/v1/apps/:id/update',    appsScope, routes.apps.updateApp);
+    router.post('/api/v1/apps/:id/restore',   appsScope, routes.users.verifyPassword, routes.apps.restoreApp);
+    router.post('/api/v1/apps/:id/backup',    appsScope, routes.apps.backupApp);
+    router.get ('/api/v1/apps/:id/backups',   appsScope, routes.apps.listBackups);
+    router.post('/api/v1/apps/:id/stop',      appsScope, routes.apps.stopApp);
+    router.post('/api/v1/apps/:id/start',     appsScope, routes.apps.startApp);
+    router.get ('/api/v1/apps/:id/logstream', appsScope, routes.apps.getLogStream);
+    router.get ('/api/v1/apps/:id/logs',      appsScope, routes.apps.getLogs);
+    router.get ('/api/v1/apps/:id/exec',      appsScope, routes.apps.exec);
    // websocket cannot do bearer authentication
-    router.get ('/api/v1/apps/:id/execws',    routes.oauth2.websocketAuth.bind(null, [ clients.SCOPE_APPS ]), routes.user.requireAdmin, routes.apps.execWebSocket);
-    router.post('/api/v1/apps/:id/clone',     appsScope, routes.user.requireAdmin, routes.apps.cloneApp);
-    router.get ('/api/v1/apps/:id/download',  appsScope, routes.user.requireAdmin, routes.apps.downloadFile);
-    router.post('/api/v1/apps/:id/upload',    appsScope, routes.user.requireAdmin, multipart, routes.apps.uploadFile);
+    router.get ('/api/v1/apps/:id/execws',    routes.accesscontrol.websocketAuth.bind(null, [ accesscontrol.SCOPE_APPS ]), routes.apps.execWebSocket);
+    router.post('/api/v1/apps/:id/clone',     appsScope, routes.apps.cloneApp);
+    router.get ('/api/v1/apps/:id/download',  appsScope, routes.apps.downloadFile);
+    router.post('/api/v1/apps/:id/upload',    appsScope, multipart, routes.apps.uploadFile);

    // settings routes (these are for the settings tab - avatar & name have public routes for normal users. see above)
-    router.get ('/api/v1/settings/app_autoupdate_pattern', settingsScope, routes.user.requireAdmin, routes.settings.getAppAutoupdatePattern);
-    router.post('/api/v1/settings/app_autoupdate_pattern', settingsScope, routes.user.requireAdmin, routes.settings.setAppAutoupdatePattern);
-    router.get ('/api/v1/settings/box_autoupdate_pattern', settingsScope, routes.user.requireAdmin, routes.settings.getBoxAutoupdatePattern);
-    router.post('/api/v1/settings/box_autoupdate_pattern', settingsScope, routes.user.requireAdmin, routes.settings.setBoxAutoupdatePattern);
-    router.get ('/api/v1/settings/cloudron_name',      settingsScope, routes.user.requireAdmin, routes.settings.getCloudronName);
-    router.post('/api/v1/settings/cloudron_name',      settingsScope, routes.user.requireAdmin, routes.settings.setCloudronName);
-    router.get ('/api/v1/settings/cloudron_avatar',    settingsScope, routes.user.requireAdmin, routes.settings.getCloudronAvatar);
-    router.post('/api/v1/settings/cloudron_avatar',    settingsScope, routes.user.requireAdmin, multipart, routes.settings.setCloudronAvatar);
-    router.get ('/api/v1/settings/backup_config',      settingsScope, routes.user.requireAdmin, routes.settings.getBackupConfig);
-    router.post('/api/v1/settings/backup_config',      settingsScope, routes.user.requireAdmin, routes.settings.setBackupConfig);
+    router.get ('/api/v1/settings/app_autoupdate_pattern', settingsScope, routes.settings.getAppAutoupdatePattern);
+    router.post('/api/v1/settings/app_autoupdate_pattern', settingsScope, routes.settings.setAppAutoupdatePattern);
+    router.get ('/api/v1/settings/box_autoupdate_pattern', settingsScope, routes.settings.getBoxAutoupdatePattern);
+    router.post('/api/v1/settings/box_autoupdate_pattern', settingsScope, routes.settings.setBoxAutoupdatePattern);
+    router.get ('/api/v1/settings/cloudron_name',      settingsScope, routes.settings.getCloudronName);
+    router.post('/api/v1/settings/cloudron_name',      settingsScope, routes.settings.setCloudronName);
+    router.get ('/api/v1/settings/cloudron_avatar',    settingsScope, routes.settings.getCloudronAvatar);
+    router.post('/api/v1/settings/cloudron_avatar',    settingsScope, multipart, routes.settings.setCloudronAvatar);
+    router.get ('/api/v1/settings/backup_config',      settingsScope, routes.settings.getBackupConfig);
+    router.post('/api/v1/settings/backup_config',      settingsScope, routes.settings.setBackupConfig);

-    router.get ('/api/v1/settings/time_zone',          settingsScope, routes.user.requireAdmin, routes.settings.getTimeZone);
-    router.post('/api/v1/settings/time_zone',          settingsScope, routes.user.requireAdmin, routes.settings.setTimeZone);
-    router.get ('/api/v1/settings/appstore_config',    settingsScope, routes.user.requireAdmin, routes.settings.getAppstoreConfig);
-    router.post('/api/v1/settings/appstore_config',    settingsScope, routes.user.requireAdmin, routes.settings.setAppstoreConfig);
+    router.get ('/api/v1/settings/time_zone',          settingsScope, routes.settings.getTimeZone);
+    router.post('/api/v1/settings/time_zone',          settingsScope, routes.settings.setTimeZone);
+    router.get ('/api/v1/settings/appstore_config',    settingsScope, routes.settings.getAppstoreConfig);
+    router.post('/api/v1/settings/appstore_config',    settingsScope, routes.settings.setAppstoreConfig);

    // email routes
-    router.get ('/api/v1/mail/:domain',       settingsScope, routes.user.requireAdmin, routes.mail.getDomain);
-    router.post('/api/v1/mail/:domain',       settingsScope, routes.user.requireAdmin, routes.mail.updateDomain);
-    router.post('/api/v1/mail',               settingsScope, routes.user.requireAdmin, routes.mail.addDomain);
-    router.get ('/api/v1/mail/:domain/stats', settingsScope, routes.user.requireAdmin, routes.user.verifyPassword, routes.mail.getDomainStats);
-    router.del ('/api/v1/mail/:domain',       settingsScope, routes.user.requireAdmin, routes.user.verifyPassword, routes.mail.removeDomain);
-    router.get ('/api/v1/mail/:domain/status',       settingsScope, routes.user.requireAdmin, routes.mail.getStatus);
-    router.post('/api/v1/mail/:domain/mail_from_validation', settingsScope, routes.user.requireAdmin, routes.mail.setMailFromValidation);
-    router.post('/api/v1/mail/:domain/catch_all',  settingsScope, routes.user.requireAdmin, routes.mail.setCatchAllAddress);
-    router.post('/api/v1/mail/:domain/relay',         settingsScope, routes.user.requireAdmin, routes.mail.setMailRelay);
-    router.post('/api/v1/mail/:domain/enable',        settingsScope, routes.user.requireAdmin, routes.mail.setMailEnabled);
-    router.post('/api/v1/mail/:domain/send_test_mail',  settingsScope, routes.user.requireAdmin, routes.mail.sendTestMail);
-    router.get ('/api/v1/mail/:domain/mailboxes',  settingsScope, routes.user.requireAdmin, routes.mail.getMailboxes);
-    router.get ('/api/v1/mail/:domain/mailboxes/:name',  settingsScope, routes.user.requireAdmin, routes.mail.getMailbox);
-    router.post('/api/v1/mail/:domain/mailboxes',  settingsScope, routes.user.requireAdmin, routes.mail.addMailbox);
-    router.post('/api/v1/mail/:domain/mailboxes/:name',  settingsScope, routes.user.requireAdmin, routes.mail.updateMailbox);
-    router.del ('/api/v1/mail/:domain/mailboxes/:name',  settingsScope, routes.user.requireAdmin, routes.mail.removeMailbox);
-    router.get ('/api/v1/mail/:domain/aliases', settingsScope, routes.user.requireAdmin, routes.mail.listAliases);
-    router.get ('/api/v1/mail/:domain/aliases/:name', settingsScope, routes.user.requireAdmin, routes.mail.getAliases);
-    router.put ('/api/v1/mail/:domain/aliases/:name', settingsScope, routes.user.requireAdmin, routes.mail.setAliases);
-    router.get ('/api/v1/mail/:domain/lists', settingsScope, routes.user.requireAdmin, routes.mail.getLists);
-    router.post('/api/v1/mail/:domain/lists', settingsScope, routes.user.requireAdmin, routes.mail.addList);
-    router.get ('/api/v1/mail/:domain/lists/:name', settingsScope, routes.user.requireAdmin, routes.mail.getList);
-    router.post('/api/v1/mail/:domain/lists/:name', settingsScope, routes.user.requireAdmin, routes.mail.updateList);
-    router.del ('/api/v1/mail/:domain/lists/:name', settingsScope, routes.user.requireAdmin, routes.mail.removeList);
+    router.get ('/api/v1/mail/:domain',       mailScope, routes.mail.getDomain);
+    router.post('/api/v1/mail/:domain',       mailScope, routes.mail.updateDomain);
+    router.post('/api/v1/mail',               mailScope, routes.mail.addDomain);
+    router.get ('/api/v1/mail/:domain/stats', mailScope, routes.users.verifyPassword, routes.mail.getDomainStats);
+    router.del ('/api/v1/mail/:domain',       mailScope, routes.users.verifyPassword, routes.mail.removeDomain);
+    router.get ('/api/v1/mail/:domain/status',       mailScope, routes.mail.getStatus);
+    router.post('/api/v1/mail/:domain/mail_from_validation', mailScope, routes.mail.setMailFromValidation);
+    router.post('/api/v1/mail/:domain/catch_all',  mailScope, routes.mail.setCatchAllAddress);
+    router.post('/api/v1/mail/:domain/relay',         mailScope, routes.mail.setMailRelay);
+    router.post('/api/v1/mail/:domain/enable',        mailScope, routes.mail.setMailEnabled);
+    router.post('/api/v1/mail/:domain/send_test_mail',  mailScope, routes.mail.sendTestMail);
+    router.get ('/api/v1/mail/:domain/mailboxes',  mailScope, routes.mail.getMailboxes);
+    router.get ('/api/v1/mail/:domain/mailboxes/:name',  mailScope, routes.mail.getMailbox);
+    router.post('/api/v1/mail/:domain/mailboxes',  mailScope, routes.mail.addMailbox);
+    router.post('/api/v1/mail/:domain/mailboxes/:name',  mailScope, routes.mail.updateMailbox);
+    router.del ('/api/v1/mail/:domain/mailboxes/:name',  mailScope, routes.mail.removeMailbox);
+    router.get ('/api/v1/mail/:domain/aliases', mailScope, routes.mail.listAliases);
+    router.get ('/api/v1/mail/:domain/aliases/:name', mailScope, routes.mail.getAliases);
+    router.put ('/api/v1/mail/:domain/aliases/:name', mailScope, routes.mail.setAliases);
+    router.get ('/api/v1/mail/:domain/lists', mailScope, routes.mail.getLists);
+    router.post('/api/v1/mail/:domain/lists', mailScope, routes.mail.addList);
+    router.get ('/api/v1/mail/:domain/lists/:name', mailScope, routes.mail.getList);
+    router.post('/api/v1/mail/:domain/lists/:name', mailScope, routes.mail.updateList);
+    router.del ('/api/v1/mail/:domain/lists/:name', mailScope, routes.mail.removeList);

    // feedback
    router.post('/api/v1/feedback', usersScope, routes.cloudron.feedback);

    // backup routes
-    router.get ('/api/v1/backups', settingsScope, routes.user.requireAdmin, routes.backups.get);
-    router.post('/api/v1/backups', settingsScope, routes.user.requireAdmin, routes.backups.create);
+    router.get ('/api/v1/backups', settingsScope, routes.backups.get);
+    router.post('/api/v1/backups', settingsScope, routes.backups.create);

    // domain routes
-    router.post('/api/v1/domains', settingsScope, routes.user.requireAdmin, routes.domains.add);
-    router.get ('/api/v1/domains', settingsScope, routes.user.requireAdmin, routes.domains.getAll);
-    router.get ('/api/v1/domains/:domain', settingsScope, routes.user.requireAdmin, routes.domains.get);
-    router.put ('/api/v1/domains/:domain', settingsScope, routes.user.requireAdmin, routes.domains.update);
-    router.post('/api/v1/domains/:domain/set_admin', settingsScope, routes.user.requireAdmin, routes.domains.setAdmin);
-    router.del ('/api/v1/domains/:domain', settingsScope, routes.user.requireAdmin, routes.user.verifyPassword, routes.domains.del);
+    router.post('/api/v1/domains', domainsScope, routes.domains.add);
+    router.get ('/api/v1/domains', domainsScope, routes.domains.getAll);
+    router.get ('/api/v1/domains/:domain', domainsScope, routes.domains.get);
+    router.put ('/api/v1/domains/:domain', domainsScope, routes.domains.update);
+    router.del ('/api/v1/domains/:domain', domainsScope, routes.users.verifyPassword, routes.domains.del);

    // caas routes
-    router.post('/api/v1/caas/change_plan', cloudronScope, routes.user.requireAdmin, routes.user.verifyPassword, routes.caas.changePlan);
+    router.post('/api/v1/caas/change_plan', cloudronScope, routes.users.verifyPassword, routes.caas.changePlan);

    // disable server socket "idle" timeout. we use the timeout middleware to handle timeouts on a route level
    // we rely on nginx for timeouts on the TCP level (see client_header_timeout)
@@ -323,11 +331,13 @@ function start(callback) {
    assert.strictEqual(typeof callback, 'function');
    assert.strictEqual(gHttpServer, null, 'Server is already up and running.');

+    routes.oauth2.initialize(); // init's the oauth server
+
    gHttpServer = initializeExpressSync();
    gSysadminHttpServer = initializeSysadminExpressSync();

    async.series([
-        auth.initialize,
+        accesscontrol.initialize,  // hooks up authentication strategies into passport
        database.initialize,
        cloudron.initialize,
        setup.configureWebadmin,
@@ -345,12 +355,14 @@ function stop(callback) {
    async.series([
        cloudron.uninitialize,
        database.uninitialize,
-        auth.uninitialize,
+        accesscontrol.uninitialize,
        gHttpServer.close.bind(gHttpServer),
        gSysadminHttpServer.close.bind(gSysadminHttpServer)
    ], function (error) {
        if (error) console.error(error);

+        routes.oauth2.uninitialize();
+
        gHttpServer = null;
        gSysadminHttpServer = null;

@@ -35,6 +35,9 @@ exports = module.exports = {
    getEmailDigest: getEmailDigest,
    setEmailDigest: setEmailDigest,

+    getPlatformConfig: getPlatformConfig,
+    setPlatformConfig: setPlatformConfig,
+
    getAll: getAll,

    // booleans. if you add an entry here, be sure to fix getAll
@@ -46,6 +49,7 @@ exports = module.exports = {
    UPDATE_CONFIG_KEY: 'update_config',
    APPSTORE_CONFIG_KEY: 'appstore_config',
    CAAS_CONFIG_KEY: 'caas_config',
+    PLATFORM_CONFIG_KEY: 'platform_config',

    // strings
    APP_AUTOUPDATE_PATTERN_KEY: 'app_autoupdate_pattern',
@@ -88,6 +92,7 @@ var gDefaults = (function () {
    result[exports.APPSTORE_CONFIG_KEY] = {};
    result[exports.CAAS_CONFIG_KEY] = {};
    result[exports.EMAIL_DIGEST] = true;
+    result[exports.PLATFORM_CONFIG_KEY] = {};

    return result;
 })();
@@ -371,6 +376,29 @@ function getAppstoreConfig(callback) {
    });
 }

+function getPlatformConfig(callback) {
+    assert.strictEqual(typeof callback, 'function');
+
+    settingsdb.get(exports.PLATFORM_CONFIG_KEY, function (error, value) {
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(null, gDefaults[exports.PLATFORM_CONFIG_KEY]);
+        if (error) return callback(new SettingsError(SettingsError.INTERNAL_ERROR, error));
+
+        callback(null, JSON.parse(value));
+    });
+}
+
+function setPlatformConfig(platformConfig, callback) {
+    assert.strictEqual(typeof callback, 'function');
+
+    settingsdb.set(exports.PLATFORM_CONFIG_KEY, JSON.stringify(platformConfig), function (error) {
+        if (error) return callback(new SettingsError(SettingsError.INTERNAL_ERROR, error));
+
+        exports.events.emit(exports.PLATFORM_CONFIG_KEY, platformConfig);
+
+        callback(null);
+    });
+}
+
 function setAppstoreConfig(appstoreConfig, callback) {
    assert.strictEqual(typeof appstoreConfig, 'object');
    assert.strictEqual(typeof callback, 'function');
@@ -443,7 +471,7 @@ function getAll(callback) {
        result[exports.DYNAMIC_DNS_KEY] = !!result[exports.DYNAMIC_DNS_KEY];

        // convert JSON objects
-        [exports.BACKUP_CONFIG_KEY, exports.UPDATE_CONFIG_KEY, exports.APPSTORE_CONFIG_KEY ].forEach(function (key) {
+        [exports.BACKUP_CONFIG_KEY, exports.UPDATE_CONFIG_KEY, exports.APPSTORE_CONFIG_KEY, exports.PLATFORM_CONFIG_KEY ].forEach(function (key) {
            result[key] = typeof result[key] === 'object' ? result[key] : safe.JSON.parse(result[key]);
        });

@@ -11,7 +11,8 @@ exports = module.exports = {
    SetupError: SetupError
 };

-var assert = require('assert'),
+var accesscontrol = require('./accesscontrol.js'),
+    assert = require('assert'),
    async = require('async'),
    backups = require('./backups.js'),
    BackupsError = require('./backups.js').BackupsError,
@@ -21,7 +22,7 @@ var assert = require('assert'),
    cloudron = require('./cloudron.js'),
    debug = require('debug')('box:setup'),
    domains = require('./domains.js'),
-    DomainError = domains.DomainError,
+    DomainsError = domains.DomainsError,
    eventlog = require('./eventlog.js'),
    fs = require('fs'),
    mail = require('./mail.js'),
@@ -37,8 +38,8 @@ var assert = require('assert'),
    superagent = require('superagent'),
    sysinfo = require('./sysinfo.js'),
    tokendb = require('./tokendb.js'),
-    user = require('./user.js'),
-    UserError = user.UserError,
+    users = require('./users.js'),
+    UsersError = users.UsersError,
    tld = require('tldjs'),
    util = require('util');

@@ -174,7 +175,7 @@ function dnsSetup(adminFqdn, domain, zoneName, provider, dnsConfig, tlsConfig, c
    debug(`dnsSetup: Setting up Cloudron with domain ${domain} and zone ${zoneName} using admin fqdn ${adminFqdn}`);

    function done(error) {
-        if (error && error.reason === DomainError.BAD_FIELD) return callback(new SetupError(SetupError.BAD_FIELD, error.message));
+        if (error && error.reason === DomainsError.BAD_FIELD) return callback(new SetupError(SetupError.BAD_FIELD, error.message));
        if (error) return callback(new SetupError(SetupError.INTERNAL_ERROR, error));

        config.setAdminDomain(domain); // set fqdn only after dns config is valid, otherwise cannot re-setup if we failed
@@ -191,7 +192,7 @@ function dnsSetup(adminFqdn, domain, zoneName, provider, dnsConfig, tlsConfig, c
    }

    domains.get(domain, function (error, result) {
-        if (error && error.reason !== DomainError.NOT_FOUND) return callback(new SettingsError(SettingsError.INTERNAL_ERROR, error));
+        if (error && error.reason !== DomainsError.NOT_FOUND) return callback(new SettingsError(SettingsError.INTERNAL_ERROR, error));

        if (result) return callback(new SettingsError(SettingsError.ALREADY_EXISTS, 'domain already exists'));

@@ -240,9 +241,9 @@ function activate(username, password, email, displayName, ip, auditSource, callb

    setTimeZone(ip, function () { }); // TODO: get this from user. note that timezone is detected based on the browser location and not the cloudron region

-    user.createOwner(username, password, email, displayName, auditSource, function (error, userObject) {
-        if (error && error.reason === UserError.ALREADY_EXISTS) return callback(new SetupError(SetupError.ALREADY_PROVISIONED));
-        if (error && error.reason === UserError.BAD_FIELD) return callback(new SetupError(SetupError.BAD_FIELD, error.message));
+    users.createOwner(username, password, email, displayName, auditSource, function (error, userObject) {
+        if (error && error.reason === UsersError.ALREADY_EXISTS) return callback(new SetupError(SetupError.ALREADY_PROVISIONED));
+        if (error && error.reason === UsersError.BAD_FIELD) return callback(new SetupError(SetupError.BAD_FIELD, error.message));
        if (error) return callback(new SetupError(SetupError.INTERNAL_ERROR, error));

        clients.get('cid-webadmin', function (error, result) {
@@ -252,7 +253,7 @@ function activate(username, password, email, displayName, ip, auditSource, callb
            var token = tokendb.generateToken();
            var expires = Date.now() + constants.DEFAULT_TOKEN_EXPIRATION;

-            tokendb.add(token, userObject.id, result.id, expires, '*', function (error) {
+            tokendb.add(token, userObject.id, result.id, expires, result.scope, function (error) {
                if (error) return callback(new SetupError(SetupError.INTERNAL_ERROR, error));

                eventlog.add(eventlog.ACTION_ACTIVATE, auditSource, { });
@@ -276,7 +277,7 @@ function restore(backupConfig, backupId, version, callback) {

    if (gWebadminStatus.configuring || gWebadminStatus.restoring) return callback(new SetupError(SetupError.BAD_STATE, 'Already restoring or configuring'));

-    user.count(function (error, count) {
+    users.count(function (error, count) {
        if (error) return callback(new SetupError(SetupError.INTERNAL_ERROR, error));
        if (count) return callback(new SetupError(SetupError.ALREADY_PROVISIONED, 'Already activated'));

@@ -309,7 +310,7 @@ function restore(backupConfig, backupId, version, callback) {
 function getStatus(callback) {
    assert.strictEqual(typeof callback, 'function');

-    user.count(function (error, count) {
+    users.count(function (error, count) {
        if (error) return callback(new SetupError(SetupError.INTERNAL_ERROR, error));

        settings.getCloudronName(function (error, cloudronName) {
@@ -10,7 +10,6 @@ exports = module.exports = {
 var assert = require('assert'),
    child_process = require('child_process'),
    debug = require('debug')('box:shell'),
-    fs = require('fs'),
    once = require('once'),
    util = require('util');

@@ -239,7 +239,7 @@ describe('apptask', function () {
        nock.cleanAll();

        var awsScope = nock('http://localhost:5353')
-            .get('/2013-04-01/hostedzone')
+            .get('/2013-04-01/hostedzonesbyname?dnsname=example.com.&maxitems=1')
            .times(2)
            .reply(200, js2xml('ListHostedZonesResponse', awsHostedZones, { wrapHandlers: { HostedZones: () => 'HostedZone'} }))
            .get('/2013-04-01/hostedzone/ZONEID/rrset?maxitems=1&name=applocation.' + DOMAIN_0.domain + '.&type=A')
@@ -258,7 +258,7 @@ describe('apptask', function () {
        nock.cleanAll();

        var awsScope = nock('http://localhost:5353')
-            .get('/2013-04-01/hostedzone')
+            .get('/2013-04-01/hostedzonesbyname?dnsname=example.com.&maxitems=1')
            .reply(200, js2xml('ListHostedZonesResponse', awsHostedZones, { wrapHandlers: { HostedZones: () => 'HostedZone'} }))
            .post('/2013-04-01/hostedzone/ZONEID/rrset/')
            .reply(200, js2xml('ChangeResourceRecordSetsResponse', { ChangeInfo: { Id: 'RRID', Status: 'INSYNC' } }));
@@ -35,7 +35,9 @@ var USER_0 = {
    createdAt: 'sometime back',
    modifiedAt: 'now',
    resetToken: hat(256),
-    displayName: ''
+    displayName: '',
+    twoFactorAuthenticationEnabled: false,
+    twoFactorAuthenticationSecret: ''
 };

 var USER_1 = {
@@ -48,7 +50,9 @@ var USER_1 = {
    createdAt: 'sometime back',
    modifiedAt: 'now',
    resetToken: '',
-    displayName: 'Herbert 1'
+    displayName: 'Herbert 1',
+    twoFactorAuthenticationEnabled: false,
+    twoFactorAuthenticationSecret: ''
 };

 var USER_2 = {
@@ -61,7 +65,9 @@ var USER_2 = {
    createdAt: 'sometime back',
    modifiedAt: 'now',
    resetToken: '',
-    displayName: 'Herbert 2'
+    displayName: 'Herbert 2',
+    twoFactorAuthenticationEnabled: false,
+    twoFactorAuthenticationSecret: ''
 };

 const DOMAIN_0 = {
@@ -89,6 +95,8 @@ const TEST_DOMAIN = {
 };

 describe('database', function () {
+    this.timeout(5000);
+
    before(function (done) {
        config._reset();
        config.setFqdn(TEST_DOMAIN.domain);
@@ -19,8 +19,8 @@ var async = require('async'),
    safe = require('safetydance'),
    settings = require('../settings.js'),
    updatechecker = require('../updatechecker.js'),
-    user = require('../user.js'),
-    userdb = require('../userdb.js');
+    userdb = require('../userdb.js'),
+    users = require('../users.js');

 // owner
 var USER_0 = {
@@ -73,14 +73,14 @@ describe('digest', function () {
            settings.initialize,
            domains.add.bind(null, DOMAIN_0.domain, DOMAIN_0.zoneName, DOMAIN_0.provider, DOMAIN_0.config, DOMAIN_0.fallbackCertificate, DOMAIN_0.tlsConfig),
            mail.addDomain.bind(null, DOMAIN_0.domain),
-            user.createOwner.bind(null, USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, AUDIT_SOURCE),
+            users.createOwner.bind(null, USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, AUDIT_SOURCE),
            function (callback) {
                userdb.getByUsername(USER_0.username, function (error, result) {
                    if (error) return callback(error);

                    USER_0.id = result.id;

-                    user.update(USER_0.id, { fallbackEmail: USER_0.fallbackEmail }, AUDIT_SOURCE, callback);
+                    users.update(USER_0.id, { fallbackEmail: USER_0.fallbackEmail }, AUDIT_SOURCE, callback);
                });
            },
            eventlog.add.bind(null, eventlog.ACTION_UPDATE, AUDIT_SOURCE, { boxUpdateInfo: { sourceTarballUrl: 'xx', version: '1.2.3', changelog: [ 'good stuff' ] } }),
@@ -51,7 +51,7 @@ describe('dns provider', function () {
            DOMAIN_0.provider = 'noop';
            DOMAIN_0.config = {};

-            domains.update(DOMAIN_0.domain, DOMAIN_0.provider, DOMAIN_0.config, null, DOMAIN_0.tlsConfig, done);
+            domains.update(DOMAIN_0.domain, DOMAIN_0.zoneName, DOMAIN_0.provider, DOMAIN_0.config, null, DOMAIN_0.tlsConfig, done);
        });

        it('upsert succeeds', function (done) {
@@ -92,7 +92,7 @@ describe('dns provider', function () {
                token: TOKEN
            };

-            domains.update(DOMAIN_0.domain, DOMAIN_0.provider, DOMAIN_0.config, null, DOMAIN_0.tlsConfig, done);
+            domains.update(DOMAIN_0.domain, '', DOMAIN_0.provider, DOMAIN_0.config, null, DOMAIN_0.tlsConfig, done);
        });

        it('upsert non-existing record succeeds', function (done) {
@@ -341,6 +341,262 @@ describe('dns provider', function () {
        });
    });

+    describe('godaddy', function () {
+        var KEY = 'somekey', SECRET = 'somesecret';
+        var GODADDY_API = 'https://api.godaddy.com/v1/domains';
+
+        before(function (done) {
+            DOMAIN_0.provider = 'godaddy';
+            DOMAIN_0.config = {
+                apiKey: KEY,
+                apiSecret: SECRET
+            };
+
+            domains.update(DOMAIN_0.domain, '', DOMAIN_0.provider, DOMAIN_0.config, null, DOMAIN_0.tlsConfig, done);
+        });
+
+        it('upsert record succeeds', function (done) {
+            nock.cleanAll();
+
+            var DOMAIN_RECORD_0 = [{
+                ttl: 600,
+                data: '1.2.3.4'
+            }];
+
+            var req1 = nock(GODADDY_API)
+                .put('/' + DOMAIN_0.zoneName + '/records/A/test', DOMAIN_RECORD_0)
+                .reply(200, { });
+
+            domains.upsertDnsRecords('test', DOMAIN_0.domain, 'A', [ '1.2.3.4' ], function (error) {
+                expect(error).to.eql(null);
+                expect(req1.isDone()).to.be.ok();
+
+                done();
+            });
+        });
+
+        it('get succeeds', function (done) {
+            nock.cleanAll();
+
+            var DOMAIN_RECORD_0 = [{
+                ttl: 600,
+                data: '1.2.3.4'
+            }];
+
+            var req1 = nock(GODADDY_API)
+                .get('/' + DOMAIN_0.zoneName + '/records/A/test')
+                .reply(200, DOMAIN_RECORD_0);
+
+            domains.getDnsRecords('test', DOMAIN_0.domain, 'A', function (error, result) {
+                expect(error).to.eql(null);
+                expect(result).to.be.an(Array);
+                expect(result.length).to.eql(1);
+                expect(result[0]).to.eql(DOMAIN_RECORD_0[0].data);
+                expect(req1.isDone()).to.be.ok();
+
+                done();
+            });
+        });
+
+        it('del succeeds', function (done) {
+            nock.cleanAll();
+
+            var DOMAIN_RECORD_0 = [{ // existing
+                ttl: 600,
+                data: '1.2.3.4'
+            }];
+
+            var DOMAIN_RECORD_1 = [{ // replaced
+                ttl: 600,
+                data: '0.0.0.0'
+            }];
+
+            var req1 = nock(GODADDY_API)
+                .get('/' + DOMAIN_0.zoneName + '/records/A/test')
+                .reply(200, DOMAIN_RECORD_0);
+
+            var req2 = nock(GODADDY_API)
+                .put('/' + DOMAIN_0.zoneName + '/records/A/test', DOMAIN_RECORD_1)
+                .reply(200, { });
+
+            domains.removeDnsRecords('test', DOMAIN_0.domain, 'A', ['1.2.3.4'], function (error) {
+                expect(error).to.eql(null);
+                expect(req1.isDone()).to.be.ok();
+                expect(req2.isDone()).to.be.ok();
+
+                done();
+            });
+        });
+    });
+
+    describe('gandi', function () {
+        var TOKEN = 'sometoken';
+        var GANDI_API = 'https://dns.api.gandi.net/api/v5';
+
+        before(function (done) {
+            DOMAIN_0.provider = 'gandi';
+            DOMAIN_0.config = {
+                token: TOKEN
+            };
+
+            domains.update(DOMAIN_0.domain, DOMAIN_0.zoneName, DOMAIN_0.provider, DOMAIN_0.config, null, DOMAIN_0.tlsConfig, done);
+        });
+
+        it('upsert record succeeds', function (done) {
+            nock.cleanAll();
+
+            var DOMAIN_RECORD_0 = {
+                'rrset_ttl': 300,
+                'rrset_values': [ '1.2.3.4' ]
+            };
+
+            var req1 = nock(GANDI_API)
+                .put('/domains/' + DOMAIN_0.zoneName + '/records/test/A', DOMAIN_RECORD_0)
+                .reply(201, { message: 'Zone Record Created' });
+
+            domains.upsertDnsRecords('test', DOMAIN_0.domain, 'A', [ '1.2.3.4' ], function (error) {
+                expect(error).to.eql(null);
+                expect(req1.isDone()).to.be.ok();
+
+                done();
+            });
+        });
+
+        it('get succeeds', function (done) {
+            nock.cleanAll();
+
+            var DOMAIN_RECORD_0 = {
+                'rrset_type': 'A',
+                'rrset_ttl': 600,
+                'rrset_name': 'test',
+                'rrset_values': [ '1.2.3.4' ]
+            };
+
+            var req1 = nock(GANDI_API)
+                .get('/domains/' + DOMAIN_0.zoneName + '/records/test/A')
+                .reply(200, DOMAIN_RECORD_0);
+
+            domains.getDnsRecords('test', DOMAIN_0.domain, 'A', function (error, result) {
+                expect(error).to.eql(null);
+                expect(result).to.be.an(Array);
+                expect(result.length).to.eql(1);
+                expect(result[0]).to.eql(DOMAIN_RECORD_0.rrset_values[0]);
+                expect(req1.isDone()).to.be.ok();
+
+                done();
+            });
+        });
+
+        it('del succeeds', function (done) {
+            nock.cleanAll();
+
+            var req2 = nock(GANDI_API)
+                .delete('/domains/' + DOMAIN_0.zoneName + '/records/test/A')
+                .reply(204, { });
+
+            domains.removeDnsRecords('test', DOMAIN_0.domain, 'A', ['1.2.3.4'], function (error) {
+                expect(error).to.eql(null);
+                expect(req2.isDone()).to.be.ok();
+
+                done();
+            });
+        });
+    });
+
+    describe('name.com', function () {
+        const TOKEN = 'sometoken';
+        const NAMECOM_API = 'https://api.name.com/v4';
+
+        before(function (done) {
+            DOMAIN_0.provider = 'namecom';
+            DOMAIN_0.config = {
+                token: TOKEN
+            };
+
+            domains.update(DOMAIN_0.domain, '', DOMAIN_0.provider, DOMAIN_0.config, null, DOMAIN_0.tlsConfig, done);
+        });
+
+        it('upsert record succeeds', function (done) {
+            nock.cleanAll();
+
+            var DOMAIN_RECORD_0 = {
+                host: 'test',
+                type: 'A',
+                answer: '1.2.3.4',
+                ttl: 300
+            };
+
+            var req1 = nock(NAMECOM_API)
+                .get(`/domains/${DOMAIN_0.zoneName}/records`)
+                .reply(200, { records: [] });
+
+            var req2 = nock(NAMECOM_API)
+                .post(`/domains/${DOMAIN_0.zoneName}/records`, DOMAIN_RECORD_0)
+                .reply(200, {});
+
+            domains.upsertDnsRecords('test', DOMAIN_0.domain, 'A', [ '1.2.3.4' ], function (error) {
+                expect(error).to.eql(null);
+                expect(req1.isDone()).to.be.ok();
+                expect(req2.isDone()).to.be.ok();
+
+                done();
+            });
+        });
+
+        it('get succeeds', function (done) {
+            nock.cleanAll();
+
+            var DOMAIN_RECORD_0 = {
+                host: 'test',
+                type: 'A',
+                answer: '1.2.3.4',
+                ttl: 300
+            };
+
+            var req1 = nock(NAMECOM_API)
+                .get(`/domains/${DOMAIN_0.zoneName}/records`)
+                .reply(200, { records: [ DOMAIN_RECORD_0 ] });
+
+            domains.getDnsRecords('test', DOMAIN_0.domain, 'A', function (error, result) {
+                expect(error).to.eql(null);
+                expect(result).to.be.an(Array);
+                expect(result.length).to.eql(1);
+                expect(result[0]).to.eql(DOMAIN_RECORD_0.answer);
+                expect(req1.isDone()).to.be.ok();
+
+                done();
+            });
+        });
+
+        it('del succeeds', function (done) {
+            nock.cleanAll();
+
+            var DOMAIN_RECORD_0 = {
+                id: 'someid',
+                host: 'test',
+                type: 'A',
+                answer: '1.2.3.4',
+                ttl: 300
+            };
+
+            var req1 = nock(NAMECOM_API)
+                .get(`/domains/${DOMAIN_0.zoneName}/records`)
+                .reply(200, { records: [ DOMAIN_RECORD_0 ] });
+
+            var req2 = nock(NAMECOM_API)
+                .delete(`/domains/${DOMAIN_0.zoneName}/records/${DOMAIN_RECORD_0.id}`)
+                .reply(200, {});
+
+            domains.removeDnsRecords('test', DOMAIN_0.domain, 'A', ['1.2.3.4'], function (error) {
+                expect(error).to.eql(null);
+                expect(req1.isDone()).to.be.ok();
+                expect(req2.isDone()).to.be.ok();
+
+                done();
+            });
+        });
+    });
+
    describe('route53', function () {
        // do not clear this with [] but .length = 0 so we don't loose the reference in mockery
        var awsAnswerQueue = [];
@@ -412,14 +668,14 @@ describe('dns provider', function () {
            Route53Mock.prototype.getChange = mockery(awsAnswerQueue);
            Route53Mock.prototype.changeResourceRecordSets = mockery(awsAnswerQueue);
            Route53Mock.prototype.listResourceRecordSets = mockery(awsAnswerQueue);
-            Route53Mock.prototype.listHostedZones = mockery(awsAnswerQueue);
+            Route53Mock.prototype.listHostedZonesByName = mockery(awsAnswerQueue);

            // override route53 in AWS
            // Comment this out and replace the config with real tokens to test against AWS proper
            AWS._originalRoute53 = AWS.Route53;
            AWS.Route53 = Route53Mock;

-            domains.update(DOMAIN_0.domain, DOMAIN_0.provider, DOMAIN_0.config, null, DOMAIN_0.tlsConfig, done);
+            domains.update(DOMAIN_0.domain, '', DOMAIN_0.provider, DOMAIN_0.config, null, DOMAIN_0.tlsConfig, done);
        });

        after(function () {
@@ -575,7 +831,7 @@ describe('dns provider', function () {
            _OriginalGCDNS = GCDNS.prototype.getZones;
            GCDNS.prototype.getZones = mockery(zoneQueue);

-            domains.update(DOMAIN_0.domain, DOMAIN_0.provider, DOMAIN_0.config, null, DOMAIN_0.tlsConfig, done);
+            domains.update(DOMAIN_0.domain, DOMAIN_0.zoneName, DOMAIN_0.provider, DOMAIN_0.config, null, DOMAIN_0.tlsConfig, done);
        });

        after(function () {
@@ -13,7 +13,7 @@ var async = require('async'),
    DatabaseError = require('../databaseerror.js'),
    expect = require('expect.js'),
    groups = require('../groups.js'),
-    GroupError = groups.GroupError,
+    GroupsError = groups.GroupsError,
    hat = require('hat'),
    mailboxdb = require('../mailboxdb.js'),
    userdb = require('../userdb.js');
@@ -81,35 +81,35 @@ describe('Groups', function () {

    it('cannot create group - too small', function (done) {
        groups.create('', function (error) {
-            expect(error.reason).to.be(GroupError.BAD_FIELD);
+            expect(error.reason).to.be(GroupsError.BAD_FIELD);
            done();
        });
    });

    it('cannot create group - too big', function (done) {
        groups.create(new Array(256).join('a'), function (error) {
-            expect(error.reason).to.be(GroupError.BAD_FIELD);
+            expect(error.reason).to.be(GroupsError.BAD_FIELD);
            done();
        });
    });

    it('cannot create group - bad name', function (done) {
        groups.create('bad:name', function (error) {
-            expect(error.reason).to.be(GroupError.BAD_FIELD);
+            expect(error.reason).to.be(GroupsError.BAD_FIELD);
            done();
        });
    });

    it('cannot create group - reserved', function (done) {
        groups.create('users', function (error) {
-            expect(error.reason).to.be(GroupError.BAD_FIELD);
+            expect(error.reason).to.be(GroupsError.BAD_FIELD);
            done();
        });
    });

    it('cannot create group - invalid', function (done) {
        groups.create('cloudron-admin', function (error) {
-            expect(error.reason).to.be(GroupError.BAD_FIELD);
+            expect(error.reason).to.be(GroupsError.BAD_FIELD);
            done();
        });
    });
@@ -125,21 +125,21 @@ describe('Groups', function () {
    it('cannot create existing group with mixed case', function (done) {
        var name = GROUP0_NAME[0].toUpperCase() + GROUP0_NAME.substr(1);
        groups.create(name, function (error, result) {
-            expect(error.reason).to.be(GroupError.ALREADY_EXISTS);
+            expect(error.reason).to.be(GroupsError.ALREADY_EXISTS);
            done();
        });
    });

    it('cannot add existing group', function (done) {
        groups.create(GROUP0_NAME, function (error) {
-            expect(error.reason).to.be(GroupError.ALREADY_EXISTS);
+            expect(error.reason).to.be(GroupsError.ALREADY_EXISTS);
            done();
        });
    });

    it('cannot get invalid group', function (done) {
        groups.get('sometrandom', function (error) {
-            expect(error.reason).to.be(GroupError.NOT_FOUND);
+            expect(error.reason).to.be(GroupsError.NOT_FOUND);
            done();
        });
    });
@@ -154,7 +154,7 @@ describe('Groups', function () {

    it('cannot delete invalid group', function (done) {
        groups.remove('random', function (error) {
-            expect(error.reason).to.be(GroupError.NOT_FOUND);
+            expect(error.reason).to.be(GroupsError.NOT_FOUND);
            done();
        });
    });
@@ -193,14 +193,14 @@ describe('Group membership', function () {

    it('cannot add non-existent user', function (done) {
        groups.addMember(group0Object.id, 'randomuser', function (error) {
-            expect(error.reason).to.be(GroupError.NOT_FOUND);
+            expect(error.reason).to.be(GroupsError.NOT_FOUND);
            done();
        });
    });

    it('cannot add non-existent group', function (done) {
        groups.addMember('randomgroup', USER_0.id, function (error) {
-            expect(error.reason).to.be(GroupError.NOT_FOUND);
+            expect(error.reason).to.be(GroupsError.NOT_FOUND);
            done();
        });
    });
@@ -254,14 +254,14 @@ describe('Group membership', function () {

    it('cannot remove non-existent user', function (done) {
        groups.removeMember(group0Object.id, 'randomuser', function (error) {
-            expect(error.reason).to.be(GroupError.NOT_FOUND);
+            expect(error.reason).to.be(GroupsError.NOT_FOUND);
            done();
        });
    });

    it('cannot remove non-existent group', function (done) {
        groups.removeMember('randomgroup', USER_0.id, function (error) {
-            expect(error.reason).to.be(GroupError.NOT_FOUND);
+            expect(error.reason).to.be(GroupsError.NOT_FOUND);
            done();
        });
    });
@@ -373,7 +373,7 @@ describe('Admin group', function () {

    it('cannot delete admin group ever', function (done) {
        groups.remove(constants.ADMIN_GROUP_ID, function (error) {
-            expect(error.reason).to.equal(GroupError.NOT_ALLOWED);
+            expect(error.reason).to.equal(GroupsError.NOT_ALLOWED);

            done();
        });
@@ -20,7 +20,7 @@ var appdb = require('../appdb.js'),
    maildb = require('../maildb.js'),
    mailboxdb = require('../mailboxdb.js'),
    ldap = require('ldapjs'),
-    user = require('../user.js');
+    users = require('../users.js');

 const DOMAIN_0 = {
    domain: 'example.com',
@@ -106,7 +106,7 @@ function setup(done) {
        mailboxdb.addMailbox.bind(null, APP_0.location + '.app', APP_0.domain, APP_0.id, mailboxdb.OWNER_TYPE_APP),

        function (callback) {
-            user.createOwner(USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, AUDIT_SOURCE, function (error, result) {
+            users.createOwner(USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, AUDIT_SOURCE, function (error, result) {
                if (error) return callback(error);

                USER_0.id = result.id;
@@ -115,7 +115,7 @@ function setup(done) {
            });
        },
        function (callback) {
-            user.create(USER_1.username, USER_1.password, USER_1.email, USER_0.displayName, AUDIT_SOURCE, { invitor: USER_0 }, function (error, result) {
+            users.create(USER_1.username, USER_1.password, USER_1.email, USER_0.displayName, AUDIT_SOURCE, { invitor: USER_0 }, function (error, result) {
                if (error) return callback(error);

                USER_1.id = result.id;
@@ -124,7 +124,7 @@ function setup(done) {
            });
        },
        function (callback) {
-            user.create(USER_2.username, USER_2.password, USER_2.email, USER_0.displayName, AUDIT_SOURCE, { invitor: USER_0 }, function (error, result) {
+            users.create(USER_2.username, USER_2.password, USER_2.email, USER_0.displayName, AUDIT_SOURCE, { invitor: USER_0 }, function (error, result) {
                if (error) return callback(error);

                USER_2.id = result.id;
@@ -121,7 +121,7 @@ describe('Certificates', function () {

            async.series([
                setup,
-                domains.update.bind(null, DOMAIN_0.domain, DOMAIN_0.provider, DOMAIN_0.config, DOMAIN_0.fallbackCertificate, DOMAIN_0.tlsConfig)
+                domains.update.bind(null, DOMAIN_0.domain, DOMAIN_0.zoneName, DOMAIN_0.provider, DOMAIN_0.config, DOMAIN_0.fallbackCertificate, DOMAIN_0.tlsConfig)
            ], done);
        });

@@ -152,7 +152,7 @@ describe('Certificates', function () {

            async.series([
                setup,
-                domains.update.bind(null, DOMAIN_0.domain, DOMAIN_0.provider, DOMAIN_0.config, DOMAIN_0.fallbackCertificate, DOMAIN_0.tlsConfig)
+                domains.update.bind(null, DOMAIN_0.domain, DOMAIN_0.zoneName, DOMAIN_0.provider, DOMAIN_0.config, DOMAIN_0.fallbackCertificate, DOMAIN_0.tlsConfig)
            ], done);
        });

@@ -183,7 +183,7 @@ describe('Certificates', function () {

            async.series([
                setup,
-                domains.update.bind(null, DOMAIN_0.domain, DOMAIN_0.provider, DOMAIN_0.config, DOMAIN_0.fallbackCertificate, DOMAIN_0.tlsConfig)
+                domains.update.bind(null, DOMAIN_0.domain, DOMAIN_0.zoneName, DOMAIN_0.provider, DOMAIN_0.config, DOMAIN_0.fallbackCertificate, DOMAIN_0.tlsConfig)
            ], done);
        });

@@ -20,7 +20,7 @@ var appdb = require('../appdb.js'),
    settings = require('../settings.js'),
    settingsdb = require('../settingsdb.js'),
    updatechecker = require('../updatechecker.js'),
-    user = require('../user.js');
+    users = require('../users.js');

 // owner
 var USER_0 = {
@@ -77,7 +77,7 @@ describe('updatechecker - box - manual (email)', function () {
            settings.initialize,
            domains.add.bind(null, DOMAIN_0.domain, DOMAIN_0.zoneName, DOMAIN_0.provider, DOMAIN_0.config, DOMAIN_0.fallbackCertificate, DOMAIN_0.tlsConfig),
            mail.addDomain.bind(null, DOMAIN_0.domain),
-            user.createOwner.bind(null, USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, AUDIT_SOURCE),
+            users.createOwner.bind(null, USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, AUDIT_SOURCE),
            settings.setBoxAutoupdatePattern.bind(null, constants.AUTOUPDATE_PATTERN_NEVER),
            settingsdb.set.bind(null, settings.APPSTORE_CONFIG_KEY, JSON.stringify({ userId: 'uid', cloudronId: 'cid', token: 'token' })),
            mailer._clearMailQueue
@@ -180,7 +180,7 @@ describe('updatechecker - box - automatic (no email)', function () {
            domains.add.bind(null, DOMAIN_0.domain, DOMAIN_0.zoneName, DOMAIN_0.provider, DOMAIN_0.config, DOMAIN_0.fallbackCertificate, DOMAIN_0.tlsConfig),
            mail.addDomain.bind(null, DOMAIN_0.domain),
            mailer._clearMailQueue,
-            user.createOwner.bind(null, USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, AUDIT_SOURCE),
+            users.createOwner.bind(null, USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, AUDIT_SOURCE),
            settingsdb.set.bind(null, settings.APPSTORE_CONFIG_KEY, JSON.stringify({ userId: 'uid', cloudronId: 'cid', token: 'token' }))
        ], done);
    });
@@ -224,7 +224,7 @@ describe('updatechecker - box - automatic free (email)', function () {
            domains.add.bind(null, DOMAIN_0.domain, DOMAIN_0.zoneName, DOMAIN_0.provider, DOMAIN_0.config, DOMAIN_0.fallbackCertificate, DOMAIN_0.tlsConfig),
            mail.addDomain.bind(null, DOMAIN_0.domain),
            mailer._clearMailQueue,
-            user.createOwner.bind(null, USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, AUDIT_SOURCE),
+            users.createOwner.bind(null, USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, AUDIT_SOURCE),
            settingsdb.set.bind(null, settings.APPSTORE_CONFIG_KEY, JSON.stringify({ userId: 'uid', cloudronId: 'cid', token: 'token' }))
        ], done);
    });
@@ -295,7 +295,7 @@ describe('updatechecker - app - manual (email)', function () {
            mail.addDomain.bind(null, DOMAIN_0.domain),
            mailer._clearMailQueue,
            appdb.add.bind(null, APP_0.id, APP_0.appStoreId, APP_0.manifest, APP_0.location, APP_0.domain, APP_0.portBindings, APP_0),
-            user.createOwner.bind(null, USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, AUDIT_SOURCE),
+            users.createOwner.bind(null, USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, AUDIT_SOURCE),
            settings.setAppAutoupdatePattern.bind(null, constants.AUTOUPDATE_PATTERN_NEVER),
            settingsdb.set.bind(null, settings.APPSTORE_CONFIG_KEY, JSON.stringify({ userId: 'uid', cloudronId: 'cid', token: 'token' }))
        ], done);
@@ -411,7 +411,7 @@ describe('updatechecker - app - automatic (no email)', function () {
            mail.addDomain.bind(null, DOMAIN_0.domain),
            mailer._clearMailQueue,
            appdb.add.bind(null, APP_0.id, APP_0.appStoreId, APP_0.manifest, APP_0.location, APP_0.domain, APP_0.portBindings, APP_0),
-            user.createOwner.bind(null, USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, AUDIT_SOURCE),
+            users.createOwner.bind(null, USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, AUDIT_SOURCE),
            settings.setAppAutoupdatePattern.bind(null, '00 00 1,3,5,23 * * *'),
            settingsdb.set.bind(null, settings.APPSTORE_CONFIG_KEY, JSON.stringify({ userId: 'uid', cloudronId: 'cid', token: 'token' }))
        ], done);
@@ -477,7 +477,7 @@ describe('updatechecker - app - automatic free (email)', function () {
            mail.addDomain.bind(null, DOMAIN_0.domain),
            mailer._clearMailQueue,
            appdb.add.bind(null, APP_0.id, APP_0.appStoreId, APP_0.manifest, APP_0.location, APP_0.domain, APP_0.portBindings, APP_0),
-            user.createOwner.bind(null, USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, AUDIT_SOURCE),
+            users.createOwner.bind(null, USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, AUDIT_SOURCE),
            settings.setAppAutoupdatePattern.bind(null, '00 00 1,3,5,23 * * *'),
            settingsdb.set.bind(null, settings.APPSTORE_CONFIG_KEY, JSON.stringify({ userId: 'uid', cloudronId: 'cid', token: 'token' }))
        ], done);
@@ -18,9 +18,9 @@ var async = require('async'),
    mailboxdb = require('../mailboxdb.js'),
    maildb = require('../maildb.js'),
    mailer = require('../mailer.js'),
-    user = require('../user.js'),
    userdb = require('../userdb.js'),
-    UserError = user.UserError;
+    users = require('../users.js'),
+    UsersError = users.UsersError;

 var USERNAME = 'noBody';
 var USERNAME_NEW = 'noBodyNew';
@@ -59,7 +59,7 @@ function cleanupUsers(done) {

 function createOwner(done) {
    groups.create('admin', function () { // ignore error since it might already exist
-        user.createOwner(USERNAME, PASSWORD, EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
+        users.createOwner(USERNAME, PASSWORD, EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
            expect(error).to.not.be.ok();
            expect(result).to.be.ok();

@@ -119,97 +119,97 @@ describe('User', function () {
        after(cleanupUsers);

        it('fails due to short password', function (done) {
-            user.create(USERNAME, 'Fo$%23', EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
+            users.create(USERNAME, 'Fo$%23', EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
                expect(error).to.be.ok();
                expect(result).to.not.be.ok();
-                expect(error.reason).to.equal(UserError.BAD_FIELD);
+                expect(error.reason).to.equal(UsersError.BAD_FIELD);

                done();
            });
        });

        it('fails due to missing upper case password', function (done) {
-            user.create(USERNAME, 'thisiseightch%$234arslong', EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
+            users.create(USERNAME, 'thisiseightch%$234arslong', EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
                expect(error).to.be.ok();
                expect(result).to.not.be.ok();
-                expect(error.reason).to.equal(UserError.BAD_FIELD);
+                expect(error.reason).to.equal(UsersError.BAD_FIELD);

                done();
            });
        });

        it('fails due to missing numerics in password', function (done) {
-            user.create(USERNAME, 'foobaRASDF%', EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
+            users.create(USERNAME, 'foobaRASDF%', EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
                expect(error).to.be.ok();
                expect(result).to.not.be.ok();
-                expect(error.reason).to.equal(UserError.BAD_FIELD);
+                expect(error.reason).to.equal(UsersError.BAD_FIELD);

                done();
            });
        });

        it('fails due to missing special chars in password', function (done) {
-            user.create(USERNAME, 'foobaRASDF23423', EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
+            users.create(USERNAME, 'foobaRASDF23423', EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
                expect(error).to.be.ok();
                expect(result).to.not.be.ok();
-                expect(error.reason).to.equal(UserError.BAD_FIELD);
+                expect(error.reason).to.equal(UsersError.BAD_FIELD);

                done();
            });
        });

        it('fails due to reserved username', function (done) {
-            user.create('admin', PASSWORD, EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
+            users.create('admin', PASSWORD, EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
                expect(error).to.be.ok();
                expect(result).to.not.be.ok();
-                expect(error.reason).to.equal(UserError.BAD_FIELD);
+                expect(error.reason).to.equal(UsersError.BAD_FIELD);

                done();
            });
        });

        it('fails due to invalid username', function (done) {
-            user.create('moo-daemon', PASSWORD, EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
+            users.create('moo+daemon', PASSWORD, EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
                expect(error).to.be.ok();
                expect(result).to.not.be.ok();
-                expect(error.reason).to.equal(UserError.BAD_FIELD);
+                expect(error.reason).to.equal(UsersError.BAD_FIELD);

                done();
            });
        });

        it('fails due to short username', function (done) {
-            user.create('', PASSWORD, EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
+            users.create('', PASSWORD, EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
                expect(error).to.be.ok();
                expect(result).to.not.be.ok();
-                expect(error.reason).to.equal(UserError.BAD_FIELD);
+                expect(error.reason).to.equal(UsersError.BAD_FIELD);

                done();
            });
        });

        it('fails due to long username', function (done) {
-            user.create(new Array(257).fill('Z').join(''), PASSWORD, EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
+            users.create(new Array(257).fill('Z').join(''), PASSWORD, EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
                expect(error).to.be.ok();
                expect(result).to.not.be.ok();
-                expect(error.reason).to.equal(UserError.BAD_FIELD);
+                expect(error.reason).to.equal(UsersError.BAD_FIELD);

                done();
            });
        });

-        it('fails due to reserved pattern', function (done) {
-            user.create('maybe-app', PASSWORD, EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
+        it('fails due to reserved app pattern', function (done) {
+            users.create('maybe.app', PASSWORD, EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
                expect(error).to.be.ok();
                expect(result).to.not.be.ok();
-                expect(error.reason).to.equal(UserError.BAD_FIELD);
+                expect(error.reason).to.equal(UsersError.BAD_FIELD);

                done();
            });
        });

        it('succeeds and attempts to send invite', function (done) {
-            user.createOwner(USERNAME, PASSWORD, EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
+            users.createOwner(USERNAME, PASSWORD, EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
                expect(error).not.to.be.ok();
                expect(result).to.be.ok();
                expect(result.username).to.equal(USERNAME.toLowerCase());
@@ -223,42 +223,42 @@ describe('User', function () {

        it('fails because of invalid BAD_FIELD', function (done) {
            expect(function () {
-                user.create(EMAIL, {}, function () {});
+                users.create(EMAIL, {}, function () {});
            }).to.throwException();
            expect(function () {
-                user.create(12345, PASSWORD, EMAIL, function () {});
+                users.create(12345, PASSWORD, EMAIL, function () {});
            }).to.throwException();
            expect(function () {
-                user.create(USERNAME, PASSWORD, EMAIL, {});
+                users.create(USERNAME, PASSWORD, EMAIL, {});
            }).to.throwException();
            expect(function () {
-                user.create(USERNAME, PASSWORD, EMAIL, {}, function () {});
+                users.create(USERNAME, PASSWORD, EMAIL, {}, function () {});
            }).to.throwException();
            expect(function () {
-                user.create(USERNAME, PASSWORD, EMAIL, {});
+                users.create(USERNAME, PASSWORD, EMAIL, {});
            }).to.throwException();
            expect(function () {
-                user.create(USERNAME, PASSWORD, EMAIL, false, null, 'foobar');
+                users.create(USERNAME, PASSWORD, EMAIL, false, null, 'foobar');
            }).to.throwException();

            done();
        });

        it('fails because user exists', function (done) {
-            user.create(USERNAME, PASSWORD, EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
+            users.create(USERNAME, PASSWORD, EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
                expect(error).to.be.ok();
                expect(result).not.to.be.ok();
-                expect(error.reason).to.equal(UserError.ALREADY_EXISTS);
+                expect(error.reason).to.equal(UsersError.ALREADY_EXISTS);

                done();
            });
        });

        it('fails because password is empty', function (done) {
-            user.create(USERNAME, '', EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
+            users.create(USERNAME, '', EMAIL, DISPLAY_NAME, AUDIT_SOURCE, function (error, result) {
                expect(error).to.be.ok();
                expect(result).not.to.be.ok();
-                expect(error.reason).to.equal(UserError.BAD_FIELD);
+                expect(error.reason).to.equal(UsersError.BAD_FIELD);

                done();
            });
@@ -269,7 +269,7 @@ describe('User', function () {
            maildb.update(DOMAIN_0.domain, { enabled: true }, function (error) {
                expect(error).not.to.be.ok();

-                user.create(USERNAME_1, PASSWORD_1, EMAIL_1, DISPLAY_NAME_1, AUDIT_SOURCE, { sendInvite: true }, function (error, result) {
+                users.create(USERNAME_1, PASSWORD_1, EMAIL_1, DISPLAY_NAME_1, AUDIT_SOURCE, { sendInvite: true }, function (error, result) {
                    expect(error).not.to.be.ok();
                    expect(result).to.be.ok();
                    expect(result.username).to.equal(USERNAME_1.toLowerCase());
@@ -292,8 +292,8 @@ describe('User', function () {
        after(cleanupUsers);

        it('fails because there is no owner', function (done) {
-            user.getOwner(function (error) {
-                expect(error.reason).to.be(UserError.NOT_FOUND);
+            users.getOwner(function (error) {
+                expect(error.reason).to.be(UsersError.NOT_FOUND);
                done();
            });
        });
@@ -302,7 +302,7 @@ describe('User', function () {
            createOwner(function (error) {
                if (error) return done(error);

-                user.getOwner(function (error, owner) {
+                users.getOwner(function (error, owner) {
                    expect(error).to.be(null);
                    expect(owner.email).to.be(EMAIL.toLowerCase());
                    done();
@@ -316,37 +316,37 @@ describe('User', function () {
        after(cleanupUsers);

        it('fails due to non existing user', function (done) {
-            user.verify('somerandomid', PASSWORD, function (error, result) {
+            users.verify('somerandomid', PASSWORD, function (error, result) {
                expect(error).to.be.ok();
                expect(result).to.not.be.ok();
-                expect(error.reason).to.equal(UserError.NOT_FOUND);
+                expect(error.reason).to.equal(UsersError.NOT_FOUND);

                done();
            });
        });

        it('fails due to empty password', function (done) {
-            user.verify(userObject.id, '', function (error, result) {
+            users.verify(userObject.id, '', function (error, result) {
                expect(error).to.be.ok();
                expect(result).to.not.be.ok();
-                expect(error.reason).to.equal(UserError.WRONG_PASSWORD);
+                expect(error.reason).to.equal(UsersError.WRONG_PASSWORD);

                done();
            });
        });

        it('fails due to wrong password', function (done) {
-            user.verify(userObject.id, PASSWORD+PASSWORD, function (error, result) {
+            users.verify(userObject.id, PASSWORD+PASSWORD, function (error, result) {
                expect(error).to.be.ok();
                expect(result).to.not.be.ok();
-                expect(error.reason).to.equal(UserError.WRONG_PASSWORD);
+                expect(error.reason).to.equal(UsersError.WRONG_PASSWORD);

                done();
            });
        });

        it('succeeds', function (done) {
-            user.verify(userObject.id, PASSWORD, function (error, result) {
+            users.verify(userObject.id, PASSWORD, function (error, result) {
                expect(error).to.not.be.ok();
                expect(result).to.be.ok();

@@ -355,9 +355,9 @@ describe('User', function () {
        });

        it('fails for ghost if not enabled', function (done) {
-            user.verify(userObject.id, 'foobar', function (error) {
-                expect(error).to.be.a(UserError);
-                expect(error.reason).to.equal(UserError.WRONG_PASSWORD);
+            users.verify(userObject.id, 'foobar', function (error) {
+                expect(error).to.be.a(UsersError);
+                expect(error.reason).to.equal(UsersError.WRONG_PASSWORD);
                done();
            });
        });
@@ -367,11 +367,11 @@ describe('User', function () {
            ghost[userObject.username] = 'testpassword';
            fs.writeFileSync(constants.GHOST_USER_FILE, JSON.stringify(ghost), 'utf8');

-            user.verify(userObject.id, 'foobar', function (error) {
+            users.verify(userObject.id, 'foobar', function (error) {
                fs.unlinkSync(constants.GHOST_USER_FILE);

-                expect(error).to.be.a(UserError);
-                expect(error.reason).to.equal(UserError.WRONG_PASSWORD);
+                expect(error).to.be.a(UsersError);
+                expect(error.reason).to.equal(UsersError.WRONG_PASSWORD);
                done();
            });
        });
@@ -381,7 +381,7 @@ describe('User', function () {
            ghost[userObject.username] = 'testpassword';
            fs.writeFileSync(constants.GHOST_USER_FILE, JSON.stringify(ghost), 'utf8');

-            user.verify(userObject.id, 'testpassword', function (error, result) {
+            users.verify(userObject.id, 'testpassword', function (error, result) {
                fs.unlinkSync(constants.GHOST_USER_FILE);

                expect(error).to.equal(null);
@@ -399,7 +399,7 @@ describe('User', function () {
            ghost[userObject.username] = 'testpassword';
            fs.writeFileSync(constants.GHOST_USER_FILE, JSON.stringify(ghost), 'utf8');

-            user.verify(userObject.id, PASSWORD, function (error, result) {
+            users.verify(userObject.id, PASSWORD, function (error, result) {
                fs.unlinkSync(constants.GHOST_USER_FILE);

                expect(error).to.not.be.ok();
@@ -416,37 +416,37 @@ describe('User', function () {
        after(cleanupUsers);

        it('fails due to non existing username', function (done) {
-            user.verifyWithUsername(USERNAME+USERNAME, PASSWORD, function (error, result) {
+            users.verifyWithUsername(USERNAME+USERNAME, PASSWORD, function (error, result) {
                expect(error).to.be.ok();
                expect(result).to.not.be.ok();
-                expect(error.reason).to.equal(UserError.NOT_FOUND);
+                expect(error.reason).to.equal(UsersError.NOT_FOUND);

                done();
            });
        });

        it('fails due to empty password', function (done) {
-            user.verifyWithUsername(USERNAME, '', function (error, result) {
+            users.verifyWithUsername(USERNAME, '', function (error, result) {
                expect(error).to.be.ok();
                expect(result).to.not.be.ok();
-                expect(error.reason).to.equal(UserError.WRONG_PASSWORD);
+                expect(error.reason).to.equal(UsersError.WRONG_PASSWORD);

                done();
            });
        });

        it('fails due to wrong password', function (done) {
-            user.verifyWithUsername(USERNAME, PASSWORD+PASSWORD, function (error, result) {
+            users.verifyWithUsername(USERNAME, PASSWORD+PASSWORD, function (error, result) {
                expect(error).to.be.ok();
                expect(result).to.not.be.ok();
-                expect(error.reason).to.equal(UserError.WRONG_PASSWORD);
+                expect(error.reason).to.equal(UsersError.WRONG_PASSWORD);

                done();
            });
        });

        it('succeeds', function (done) {
-            user.verifyWithUsername(USERNAME, PASSWORD, function (error, result) {
+            users.verifyWithUsername(USERNAME, PASSWORD, function (error, result) {
                expect(error).to.not.be.ok();
                expect(result).to.be.ok();

@@ -455,7 +455,7 @@ describe('User', function () {
        });

        it('succeeds for different username case', function (done) {
-            user.verifyWithUsername(USERNAME.toUpperCase(), PASSWORD, function (error, result) {
+            users.verifyWithUsername(USERNAME.toUpperCase(), PASSWORD, function (error, result) {
                expect(error).to.not.be.ok();
                expect(result).to.be.ok();

@@ -469,11 +469,11 @@ describe('User', function () {

            fs.writeFileSync(constants.GHOST_USER_FILE, JSON.stringify(ghost), 'utf8');

-            user.verifyWithUsername(USERNAME, 'foobar', function (error) {
+            users.verifyWithUsername(USERNAME, 'foobar', function (error) {
                fs.unlinkSync(constants.GHOST_USER_FILE);

-                expect(error).to.be.a(UserError);
-                expect(error.reason).to.equal(UserError.WRONG_PASSWORD);
+                expect(error).to.be.a(UsersError);
+                expect(error.reason).to.equal(UsersError.WRONG_PASSWORD);
                done();
            });
        });
@@ -484,7 +484,7 @@ describe('User', function () {

            fs.writeFileSync(constants.GHOST_USER_FILE, JSON.stringify(ghost), 'utf8');

-            user.verifyWithUsername(USERNAME, 'testpassword', function (error, result) {
+            users.verifyWithUsername(USERNAME, 'testpassword', function (error, result) {
                fs.unlinkSync(constants.GHOST_USER_FILE);

                expect(error).to.equal(null);
@@ -503,37 +503,37 @@ describe('User', function () {
        after(cleanupUsers);

        it('fails due to non existing user', function (done) {
-            user.verifyWithEmail(EMAIL+EMAIL, PASSWORD, function (error, result) {
+            users.verifyWithEmail(EMAIL+EMAIL, PASSWORD, function (error, result) {
                expect(error).to.be.ok();
                expect(result).to.not.be.ok();
-                expect(error.reason).to.equal(UserError.NOT_FOUND);
+                expect(error.reason).to.equal(UsersError.NOT_FOUND);

                done();
            });
        });

        it('fails due to empty password', function (done) {
-            user.verifyWithEmail(EMAIL, '', function (error, result) {
+            users.verifyWithEmail(EMAIL, '', function (error, result) {
                expect(error).to.be.ok();
                expect(result).to.not.be.ok();
-                expect(error.reason).to.equal(UserError.WRONG_PASSWORD);
+                expect(error.reason).to.equal(UsersError.WRONG_PASSWORD);

                done();
            });
        });

        it('fails due to wrong password', function (done) {
-            user.verifyWithEmail(EMAIL, PASSWORD+PASSWORD, function (error, result) {
+            users.verifyWithEmail(EMAIL, PASSWORD+PASSWORD, function (error, result) {
                expect(error).to.be.ok();
                expect(result).to.not.be.ok();
-                expect(error.reason).to.equal(UserError.WRONG_PASSWORD);
+                expect(error.reason).to.equal(UsersError.WRONG_PASSWORD);

                done();
            });
        });

        it('succeeds', function (done) {
-            user.verifyWithEmail(EMAIL, PASSWORD, function (error, result) {
+            users.verifyWithEmail(EMAIL, PASSWORD, function (error, result) {
                expect(error).to.not.be.ok();
                expect(result).to.be.ok();

@@ -542,7 +542,7 @@ describe('User', function () {
        });

        it('succeeds for different email case', function (done) {
-            user.verifyWithEmail(EMAIL.toUpperCase(), PASSWORD, function (error, result) {
+            users.verifyWithEmail(EMAIL.toUpperCase(), PASSWORD, function (error, result) {
                expect(error).to.not.be.ok();
                expect(result).to.be.ok();

@@ -556,11 +556,11 @@ describe('User', function () {

            fs.writeFileSync(constants.GHOST_USER_FILE, JSON.stringify(ghost), 'utf8');

-            user.verifyWithEmail(EMAIL, 'foobar', function (error) {
+            users.verifyWithEmail(EMAIL, 'foobar', function (error) {
                fs.unlinkSync(constants.GHOST_USER_FILE);

-                expect(error).to.be.a(UserError);
-                expect(error.reason).to.equal(UserError.WRONG_PASSWORD);
+                expect(error).to.be.a(UsersError);
+                expect(error.reason).to.equal(UsersError.WRONG_PASSWORD);
                done();
            });
        });
@@ -571,7 +571,7 @@ describe('User', function () {

            fs.writeFileSync(constants.GHOST_USER_FILE, JSON.stringify(ghost), 'utf8');

-            user.verifyWithEmail(EMAIL, 'testpassword', function (error, result) {
+            users.verifyWithEmail(EMAIL, 'testpassword', function (error, result) {
                fs.unlinkSync(constants.GHOST_USER_FILE);

                expect(error).to.equal(null);
@@ -590,7 +590,7 @@ describe('User', function () {
        after(cleanupUsers);

        it('fails due to non existing user', function (done) {
-            user.get('some non existing username', function (error, result) {
+            users.get('some non existing username', function (error, result) {
                expect(error).to.be.ok();
                expect(result).to.not.be.ok();

@@ -599,7 +599,7 @@ describe('User', function () {
        });

        it('succeeds', function (done) {
-            user.get(userObject.id, function (error, result) {
+            users.get(userObject.id, function (error, result) {
                expect(error).to.not.be.ok();
                expect(result).to.be.ok();
                expect(result.id).to.equal(userObject.id);
@@ -617,7 +617,7 @@ describe('User', function () {
            maildb.update(DOMAIN_0.domain, { enabled: true }, function (error) {
                expect(error).not.to.be.ok();

-                user.get(userObject.id, function (error, result) {
+                users.get(userObject.id, function (error, result) {
                    expect(error).to.not.be.ok();
                    expect(result).to.be.ok();
                    expect(result.id).to.equal(userObject.id);
@@ -638,9 +638,9 @@ describe('User', function () {

        it('fails due to unknown userid', function (done) {
            var data = { username: USERNAME_NEW, email: EMAIL_NEW, displayName: DISPLAY_NAME_NEW };
-            user.update(USERNAME, data, AUDIT_SOURCE, function (error) {
-                expect(error).to.be.a(UserError);
-                expect(error.reason).to.equal(UserError.NOT_FOUND);
+            users.update(USERNAME, data, AUDIT_SOURCE, function (error) {
+                expect(error).to.be.a(UsersError);
+                expect(error.reason).to.equal(UsersError.NOT_FOUND);

                done();
            });
@@ -648,9 +648,9 @@ describe('User', function () {

        it('fails due to invalid email', function (done) {
            var data = { username: USERNAME_NEW, email: 'brokenemailaddress', displayName: DISPLAY_NAME_NEW };
-            user.update(userObject.id, data, AUDIT_SOURCE, function (error) {
-                expect(error).to.be.a(UserError);
-                expect(error.reason).to.equal(UserError.BAD_FIELD);
+            users.update(userObject.id, data, AUDIT_SOURCE, function (error) {
+                expect(error).to.be.a(UsersError);
+                expect(error.reason).to.equal(UsersError.BAD_FIELD);

                done();
            });
@@ -659,10 +659,10 @@ describe('User', function () {
        it('succeeds', function (done) {
            var data = { username: USERNAME_NEW, email: EMAIL_NEW, displayName: DISPLAY_NAME_NEW };

-            user.update(userObject.id, data, AUDIT_SOURCE, function (error) {
+            users.update(userObject.id, data, AUDIT_SOURCE, function (error) {
                expect(error).to.not.be.ok();

-                user.get(userObject.id, function (error, result) {
+                users.get(userObject.id, function (error, result) {
                    expect(error).to.not.be.ok();
                    expect(result).to.be.ok();
                    expect(result.email).to.equal(EMAIL_NEW.toLowerCase());
@@ -677,10 +677,10 @@ describe('User', function () {
        it('succeeds with same data', function (done) {
            var data = { username: USERNAME_NEW, email: EMAIL_NEW, displayName: DISPLAY_NAME_NEW };

-            user.update(userObject.id, data, AUDIT_SOURCE, function (error) {
+            users.update(userObject.id, data, AUDIT_SOURCE, function (error) {
                expect(error).to.not.be.ok();

-                user.get(userObject.id, function (error, result) {
+                users.get(userObject.id, function (error, result) {
                    expect(error).to.not.be.ok();
                    expect(result).to.be.ok();
                    expect(result.email).to.equal(EMAIL_NEW.toLowerCase());
@@ -720,13 +720,13 @@ describe('User', function () {
        it('make second user admin succeeds', function (done) {

            var invitor = { username: USERNAME, email: EMAIL };
-            user.create(user1.username, user1.password, user1.email, DISPLAY_NAME, AUDIT_SOURCE, { invitor: invitor }, function (error, result) {
+            users.create(user1.username, user1.password, user1.email, DISPLAY_NAME, AUDIT_SOURCE, { invitor: invitor }, function (error, result) {
                expect(error).to.not.be.ok();
                expect(result).to.be.ok();

                user1.id = result.id;

-                user.setGroups(user1.id, [ constants.ADMIN_GROUP_ID ], function (error) {
+                users.setGroups(user1.id, [ constants.ADMIN_GROUP_ID ], function (error) {
                    expect(error).to.not.be.ok();

                    // one mail for user creation, one mail for admin change
@@ -736,7 +736,7 @@ describe('User', function () {
        });

        it('add user to non admin group does not trigger admin mail', function (done) {
-            user.setGroups(user1.id, [ constants.ADMIN_GROUP_ID, groupObject.id ], function (error) {
+            users.setGroups(user1.id, [ constants.ADMIN_GROUP_ID, groupObject.id ], function (error) {
                expect(error).to.equal(null);

                checkMails(0, done);
@@ -744,7 +744,7 @@ describe('User', function () {
        });

        it('succeeds to remove admin flag', function (done) {
-            user.setGroups(user1.id, [ groupObject.id ], function (error) {
+            users.setGroups(user1.id, [ groupObject.id ], function (error) {
                expect(error).to.eql(null);

                checkMails(1, done);
@@ -757,7 +757,7 @@ describe('User', function () {
        after(cleanupUsers);

        it('succeeds for one admins', function (done) {
-            user.getAllAdmins(function (error, admins) {
+            users.getAllAdmins(function (error, admins) {
                expect(error).to.eql(null);
                expect(admins.length).to.equal(1);
                expect(admins[0].username).to.equal(USERNAME.toLowerCase());
@@ -773,7 +773,7 @@ describe('User', function () {
            };

            var invitor = { username: USERNAME, email: EMAIL };
-            user.create(user1.username, user1.password, user1.email, DISPLAY_NAME, AUDIT_SOURCE, { invitor: invitor }, function (error, result) {
+            users.create(user1.username, user1.password, user1.email, DISPLAY_NAME, AUDIT_SOURCE, { invitor: invitor }, function (error, result) {
                expect(error).to.eql(null);
                expect(result).to.be.ok();

@@ -782,7 +782,7 @@ describe('User', function () {
                groups.setGroups(user1.id, [ constants.ADMIN_GROUP_ID ], function (error) {
                    expect(error).to.eql(null);

-                    user.getAllAdmins(function (error, admins) {
+                    users.getAllAdmins(function (error, admins) {
                        expect(error).to.eql(null);
                        expect(admins.length).to.equal(2);
                        expect(admins[0].username).to.equal(USERNAME.toLowerCase());
@@ -801,7 +801,7 @@ describe('User', function () {
        after(cleanupUsers);

        it('succeeds', function (done) {
-            user.count(function (error, count) {
+            users.count(function (error, count) {
                expect(error).to.not.be.ok();
                expect(count).to.be(1);
                done();
@@ -814,44 +814,44 @@ describe('User', function () {
        after(cleanupUsers);

        it('fails due to unknown user', function (done) {
-            user.setPassword('doesnotexist', NEW_PASSWORD, function (error) {
+            users.setPassword('doesnotexist', NEW_PASSWORD, function (error) {
                expect(error).to.be.ok();
                done();
            });
        });

        it('fails due to empty password', function (done) {
-            user.setPassword(userObject.id, '', function (error) {
+            users.setPassword(userObject.id, '', function (error) {
                expect(error).to.be.ok();
                done();
            });
        });

        it('fails due to invalid password', function (done) {
-            user.setPassword(userObject.id, 'foobar', function (error) {
+            users.setPassword(userObject.id, 'foobar', function (error) {
                expect(error).to.be.ok();
                done();
            });
        });

        it('succeeds', function (done) {
-            user.setPassword(userObject.id, NEW_PASSWORD, function (error) {
+            users.setPassword(userObject.id, NEW_PASSWORD, function (error) {
                expect(error).to.not.be.ok();
                done();
            });
        });

        it('actually changed the password (unable to login with old pasword)', function (done) {
-            user.verify(userObject.id, PASSWORD, function (error, result) {
+            users.verify(userObject.id, PASSWORD, function (error, result) {
                expect(error).to.be.ok();
                expect(result).to.not.be.ok();
-                expect(error.reason).to.equal(UserError.WRONG_PASSWORD);
+                expect(error.reason).to.equal(UsersError.WRONG_PASSWORD);
                done();
            });
        });

        it('actually changed the password (login with new password)', function (done) {
-            user.verify(userObject.id, NEW_PASSWORD, function (error, result) {
+            users.verify(userObject.id, NEW_PASSWORD, function (error, result) {
                expect(error).to.not.be.ok();
                expect(result).to.be.ok();
                done();
@@ -864,30 +864,30 @@ describe('User', function () {
        after(cleanupUsers);

        it('fails due to unkown email', function (done) {
-            user.resetPasswordByIdentifier('unknown@mail.com', function (error) {
-                expect(error).to.be.an(UserError);
-                expect(error.reason).to.eql(UserError.NOT_FOUND);
+            users.resetPasswordByIdentifier('unknown@mail.com', function (error) {
+                expect(error).to.be.an(UsersError);
+                expect(error.reason).to.eql(UsersError.NOT_FOUND);
                done();
            });
        });

        it('fails due to unkown username', function (done) {
-            user.resetPasswordByIdentifier('unknown', function (error) {
-                expect(error).to.be.an(UserError);
-                expect(error.reason).to.eql(UserError.NOT_FOUND);
+            users.resetPasswordByIdentifier('unknown', function (error) {
+                expect(error).to.be.an(UsersError);
+                expect(error.reason).to.eql(UsersError.NOT_FOUND);
                done();
            });
        });

        it('succeeds with email', function (done) {
-            user.resetPasswordByIdentifier(EMAIL, function (error) {
+            users.resetPasswordByIdentifier(EMAIL, function (error) {
                expect(error).to.not.be.ok();
                checkMails(1, done);
            });
        });

        it('succeeds with username', function (done) {
-            user.resetPasswordByIdentifier(USERNAME, function (error) {
+            users.resetPasswordByIdentifier(USERNAME, function (error) {
                expect(error).to.not.be.ok();
                checkMails(1, done);
            });
@@ -899,16 +899,16 @@ describe('User', function () {
        after(cleanupUsers);

        it('fails for unknown user', function (done) {
-            user.sendInvite('unknown user', { }, function (error) {
-                expect(error).to.be.a(UserError);
-                expect(error.reason).to.equal(UserError.NOT_FOUND);
+            users.sendInvite('unknown user', { }, function (error) {
+                expect(error).to.be.a(UsersError);
+                expect(error.reason).to.equal(UsersError.NOT_FOUND);

                checkMails(0, done);
            });
        });

        it('succeeds', function (done) {
-            user.sendInvite(userObject.id, { }, function (error) {
+            users.sendInvite(userObject.id, { }, function (error) {
                expect(error).to.eql(null);
                checkMails(1, done);
            });
@@ -920,14 +920,14 @@ describe('User', function () {
        after(cleanupUsers);

        it('fails for unknown user', function (done) {
-            user.remove('unknown', { }, function (error) {
-                expect(error.reason).to.be(UserError.NOT_FOUND);
+            users.remove('unknown', { }, function (error) {
+                expect(error.reason).to.be(UsersError.NOT_FOUND);
                done();
            });
        });

        it('can remove valid user', function (done) {
-            user.remove(userObject.id, { }, function (error) {
+            users.remove(userObject.id, { }, function (error) {
                expect(!error).to.be.ok();
                done();
            });
@@ -50,12 +50,12 @@ function add(accessToken, identifier, clientId, expires, scope, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('INSERT INTO tokens (accessToken, identifier, clientId, expires, scope) VALUES (?, ?, ?, ?, ?)',
-           [ accessToken, identifier, clientId, expires, scope ], function (error, result) {
-        if (error && error.code === 'ER_DUP_ENTRY') return callback(new DatabaseError(DatabaseError.ALREADY_EXISTS));
-        if (error || result.affectedRows !== 1) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        [ accessToken, identifier, clientId, expires, scope ], function (error, result) {
+            if (error && error.code === 'ER_DUP_ENTRY') return callback(new DatabaseError(DatabaseError.ALREADY_EXISTS));
+            if (error || result.affectedRows !== 1) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));

-        callback(null);
-    });
+            callback(null);
+        });
 }

 function del(accessToken, callback) {
@@ -23,11 +23,13 @@ var assert = require('assert'),
    debug = require('debug')('box:userdb'),
    DatabaseError = require('./databaseerror');

-var USERS_FIELDS = [ 'id', 'username', 'email', 'fallbackEmail', 'password', 'salt', 'createdAt', 'modifiedAt', 'resetToken', 'displayName' ].join(',');
+var USERS_FIELDS = [ 'id', 'username', 'email', 'fallbackEmail', 'password', 'salt', 'createdAt', 'modifiedAt', 'resetToken', 'displayName', 'twoFactorAuthenticationEnabled', 'twoFactorAuthenticationSecret' ].join(',');

 function postProcess(result) {
    assert.strictEqual(typeof result, 'object');

+    result.twoFactorAuthenticationEnabled = !!result.twoFactorAuthenticationEnabled;
+
    return result;
 }

@@ -209,6 +211,9 @@ function update(userId, user, callback) {
        } else if (k === 'fallbackEmail') {
            assert.strictEqual(typeof user.fallbackEmail, 'string');
            args.push(user.fallbackEmail);
+        } else if (k === 'twoFactorAuthenticationEnabled') {
+            assert.strictEqual(typeof user.twoFactorAuthenticationEnabled, 'boolean');
+            args.push(user.twoFactorAuthenticationEnabled ? 1 : 0);
        } else {
            args.push(user[k]);
        }
@@ -1,7 +1,7 @@
 'use strict';

 exports = module.exports = {
-    UserError: UserError,
+    UsersError: UsersError,

    removePrivateFields: removePrivateFields,

@@ -21,11 +21,13 @@ exports = module.exports = {
    createOwner: createOwner,
    getOwner: getOwner,
    sendInvite: sendInvite,
-    setGroups: setGroups
+    setGroups: setGroups,
+    setTwoFactorAuthenticationSecret: setTwoFactorAuthenticationSecret,
+    enableTwoFactorAuthentication: enableTwoFactorAuthentication,
+    disableTwoFactorAuthentication: disableTwoFactorAuthentication
 };

 var assert = require('assert'),
-    clients = require('./clients.js'),
    crypto = require('crypto'),
    config = require('./config.js'),
    constants = require('./constants.js'),
@@ -34,11 +36,12 @@ var assert = require('assert'),
    eventlog = require('./eventlog.js'),
    groupdb = require('./groupdb.js'),
    groups = require('./groups.js'),
-    GroupError = groups.GroupError,
+    GroupsError = groups.GroupsError,
    hat = require('hat'),
    mailer = require('./mailer.js'),
+    qrcode = require('qrcode'),
    safe = require('safetydance'),
-    tokendb = require('./tokendb.js'),
+    speakeasy = require('speakeasy'),
    userdb = require('./userdb.js'),
    util = require('util'),
    uuid = require('uuid'),
@@ -53,7 +56,7 @@ var CRYPTO_DIGEST = 'sha1'; // used to be the default in node 4.1.1 cannot chang

 // http://dustinsenos.com/articles/customErrorsInNode
 // http://code.google.com/p/v8/wiki/JavaScriptStackTraceApi
-function UserError(reason, errorOrMessage) {
+function UsersError(reason, errorOrMessage) {
    assert.strictEqual(typeof reason, 'string');
    assert(errorOrMessage instanceof Error || typeof errorOrMessage === 'string' || typeof errorOrMessage === 'undefined');

@@ -71,28 +74,28 @@ function UserError(reason, errorOrMessage) {
        this.nestedError = errorOrMessage;
    }
 }
-util.inherits(UserError, Error);
-UserError.INTERNAL_ERROR = 'Internal Error';
-UserError.ALREADY_EXISTS = 'Already Exists';
-UserError.NOT_FOUND = 'Not Found';
-UserError.WRONG_PASSWORD = 'Wrong User or Password';
-UserError.BAD_FIELD = 'Bad field';
-UserError.BAD_TOKEN = 'Bad token';
+util.inherits(UsersError, Error);
+UsersError.INTERNAL_ERROR = 'Internal Error';
+UsersError.ALREADY_EXISTS = 'Already Exists';
+UsersError.NOT_FOUND = 'Not Found';
+UsersError.WRONG_PASSWORD = 'Wrong User or Password';
+UsersError.BAD_FIELD = 'Bad field';
+UsersError.BAD_TOKEN = 'Bad token';

 // keep this in sync with validateGroupname and validateAlias
 function validateUsername(username) {
    assert.strictEqual(typeof username, 'string');

-    if (username.length < 1) return new UserError(UserError.BAD_FIELD, 'Username must be atleast 1 char');
-    if (username.length >= 200) return new UserError(UserError.BAD_FIELD, 'Username too long');
+    if (username.length < 1) return new UsersError(UsersError.BAD_FIELD, 'Username must be atleast 1 char');
+    if (username.length >= 200) return new UsersError(UsersError.BAD_FIELD, 'Username too long');

-    if (constants.RESERVED_NAMES.indexOf(username) !== -1) return new UserError(UserError.BAD_FIELD, 'Username is reserved');
+    if (constants.RESERVED_NAMES.indexOf(username) !== -1) return new UsersError(UsersError.BAD_FIELD, 'Username is reserved');

-    // +/- can be tricky in emails. also need to consider valid LDAP characters here (e.g '+' is reserved)
-    if (/[^a-zA-Z0-9.]/.test(username)) return new UserError(UserError.BAD_FIELD, 'Username can only contain alphanumerals and dot');
+    // also need to consider valid LDAP characters here (e.g '+' is reserved)
+    if (/[^a-zA-Z0-9.-]/.test(username)) return new UsersError(UsersError.BAD_FIELD, 'Username can only contain alphanumerals, dot and -');

    // app emails are sent using the .app suffix
-    if (username.indexOf('.app') !== -1) return new UserError(UserError.BAD_FIELD, 'Username pattern is reserved for apps');
+    if (username.indexOf('.app') !== -1) return new UsersError(UsersError.BAD_FIELD, 'Username pattern is reserved for apps');

    return null;
 }
@@ -100,7 +103,7 @@ function validateUsername(username) {
 function validateEmail(email) {
    assert.strictEqual(typeof email, 'string');

-    if (!validator.isEmail(email)) return new UserError(UserError.BAD_FIELD, 'Invalid email');
+    if (!validator.isEmail(email)) return new UsersError(UsersError.BAD_FIELD, 'Invalid email');

    return null;
 }
@@ -108,7 +111,7 @@ function validateEmail(email) {
 function validateToken(token) {
    assert.strictEqual(typeof token, 'string');

-    if (token.length !== 64) return new UserError(UserError.BAD_TOKEN, 'Invalid token'); // 256-bit hex coded token
+    if (token.length !== 64) return new UsersError(UsersError.BAD_TOKEN, 'Invalid token'); // 256-bit hex coded token

    return null;
 }
@@ -148,7 +151,7 @@ function createUser(username, password, email, displayName, auditSource, options
    }

    error = validatePassword(password);
-    if (error) return callback(new UserError(UserError.BAD_FIELD, error.message));
+    if (error) return callback(new UsersError(UsersError.BAD_FIELD, error.message));

    email = email.toLowerCase();
    error = validateEmail(email);
@@ -158,10 +161,10 @@ function createUser(username, password, email, displayName, auditSource, options
    if (error) return callback(error);

    crypto.randomBytes(CRYPTO_SALT_SIZE, function (error, salt) {
-        if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+        if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

        crypto.pbkdf2(password, salt, CRYPTO_ITERATIONS, CRYPTO_KEY_LENGTH, CRYPTO_DIGEST, function (error, derivedKey) {
-            if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+            if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

            var now = (new Date()).toISOString();
            var user = {
@@ -178,8 +181,8 @@ function createUser(username, password, email, displayName, auditSource, options
            };

            userdb.add(user.id, user, function (error) {
-                if (error && error.reason === DatabaseError.ALREADY_EXISTS) return callback(new UserError(UserError.ALREADY_EXISTS, error.message));
-                if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+                if (error && error.reason === DatabaseError.ALREADY_EXISTS) return callback(new UsersError(UsersError.ALREADY_EXISTS, error.message));
+                if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

                callback(null, user);

@@ -217,14 +220,17 @@ function verify(userId, password, callback) {
        if (error) return callback(error);

        // for just invited users the username may be still null
-        if (user.username && verifyGhost(user.username, password)) return callback(null, user);
+        if (user.username && verifyGhost(user.username, password)) {
+            user.ghost = true;
+            return callback(null, user);
+        }

        var saltBinary = new Buffer(user.salt, 'hex');
        crypto.pbkdf2(password, saltBinary, CRYPTO_ITERATIONS, CRYPTO_KEY_LENGTH, CRYPTO_DIGEST, function (error, derivedKey) {
-            if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+            if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

            var derivedKeyHex = new Buffer(derivedKey, 'binary').toString('hex');
-            if (derivedKeyHex !== user.password) return callback(new UserError(UserError.WRONG_PASSWORD));
+            if (derivedKeyHex !== user.password) return callback(new UsersError(UsersError.WRONG_PASSWORD));

            callback(null, user);
        });
@@ -237,8 +243,8 @@ function verifyWithUsername(username, password, callback) {
    assert.strictEqual(typeof callback, 'function');

    userdb.getByUsername(username.toLowerCase(), function (error, user) {
-        if (error && error.reason == DatabaseError.NOT_FOUND) return callback(new UserError(UserError.NOT_FOUND));
-        if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+        if (error && error.reason == DatabaseError.NOT_FOUND) return callback(new UsersError(UsersError.NOT_FOUND));
+        if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

        verify(user.id, password, callback);
    });
@@ -250,8 +256,8 @@ function verifyWithEmail(email, password, callback) {
    assert.strictEqual(typeof callback, 'function');

    userdb.getByEmail(email.toLowerCase(), function (error, user) {
-        if (error && error.reason == DatabaseError.NOT_FOUND) return callback(new UserError(UserError.NOT_FOUND));
-        if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+        if (error && error.reason == DatabaseError.NOT_FOUND) return callback(new UsersError(UsersError.NOT_FOUND));
+        if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

        verify(user.id, password, callback);
    });
@@ -265,11 +271,11 @@ function removeUser(userId, auditSource, callback) {
    getUser(userId, function (error, user) {
        if (error) return callback(error);

-        if (config.isDemo() && user.username === constants.DEMO_USERNAME) return callback(new UserError(UserError.BAD_FIELD, 'Not allowed in demo mode'));
+        if (config.isDemo() && user.username === constants.DEMO_USERNAME) return callback(new UsersError(UsersError.BAD_FIELD, 'Not allowed in demo mode'));

        userdb.del(userId, function (error) {
-            if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UserError(UserError.NOT_FOUND));
-            if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+            if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UsersError(UsersError.NOT_FOUND));
+            if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

            eventlog.add(eventlog.ACTION_USER_REMOVE, auditSource, { userId: userId, user: removePrivateFields(user) });

@@ -284,7 +290,7 @@ function listUsers(callback) {
    assert.strictEqual(typeof callback, 'function');

    userdb.getAllWithGroupIds(function (error, results) {
-        if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+        if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

        results.forEach(function (result) {
            result.admin = result.groupIds.indexOf(constants.ADMIN_GROUP_ID) !== -1;
@@ -298,7 +304,7 @@ function count(callback) {
    assert.strictEqual(typeof callback, 'function');

    userdb.count(function (error, count) {
-        if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+        if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

        callback(null, count);
    });
@@ -309,14 +315,15 @@ function getUser(userId, callback) {
    assert.strictEqual(typeof callback, 'function');

    userdb.get(userId, function (error, result) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UserError(UserError.NOT_FOUND));
-        if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UsersError(UsersError.NOT_FOUND));
+        if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

        groups.getGroups(userId, function (error, groupIds) {
-            if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+            if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

            result.groupIds = groupIds;
            result.admin = groupIds.indexOf(constants.ADMIN_GROUP_ID) !== -1;
+            result.scope = result.admin ? '*' : 'profile';

            return callback(null, result);
        });
@@ -331,8 +338,8 @@ function getByResetToken(resetToken, callback) {
    if (error) return callback(error);

    userdb.getByResetToken(resetToken, function (error, result) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UserError(UserError.NOT_FOUND));
-        if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UsersError(UsersError.NOT_FOUND));
+        if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

        getUser(result.id, callback);
    });
@@ -368,13 +375,13 @@ function updateUser(userId, data, auditSource, callback) {
    }

    userdb.get(userId, function (error) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UserError(UserError.NOT_FOUND));
-        if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UsersError(UsersError.NOT_FOUND));
+        if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

        userdb.update(userId, data, function (error) {
-            if (error && error.reason === DatabaseError.ALREADY_EXISTS) return callback(new UserError(UserError.ALREADY_EXISTS, error.message));
-            if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UserError(UserError.NOT_FOUND, error));
-            if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+            if (error && error.reason === DatabaseError.ALREADY_EXISTS) return callback(new UsersError(UsersError.ALREADY_EXISTS, error.message));
+            if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UsersError(UsersError.NOT_FOUND, error));
+            if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

            callback();

@@ -393,13 +400,13 @@ function setGroups(userId, groupIds, callback) {
    assert.strictEqual(typeof callback, 'function');

    groups.getGroups(userId, function (error, oldGroupIds) {
-        if (error && error.reason !== GroupError.NOT_FOUND) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+        if (error && error.reason !== GroupsError.NOT_FOUND) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

        oldGroupIds = oldGroupIds || [];

        groups.setGroups(userId, groupIds, function (error) {
-            if (error && error.reason === GroupError.NOT_FOUND) return callback(new UserError(UserError.NOT_FOUND, 'One or more groups not found'));
-            if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+            if (error && error.reason === GroupsError.NOT_FOUND) return callback(new UsersError(UsersError.NOT_FOUND, 'One or more groups not found'));
+            if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

            var isAdmin = groupIds.some(function (g) { return g === constants.ADMIN_GROUP_ID; });
            var wasAdmin = oldGroupIds.some(function (g) { return g === constants.ADMIN_GROUP_ID; });
@@ -421,7 +428,7 @@ function getAllAdmins(callback) {
    assert.strictEqual(typeof callback, 'function');

    userdb.getAllAdmins(function (error, admins) {
-        if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+        if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

        callback(null, admins);
    });
@@ -436,14 +443,14 @@ function resetPasswordByIdentifier(identifier, callback) {
    else getter = userdb.getByEmail;

    getter(identifier.toLowerCase(), function (error, result) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UserError(UserError.NOT_FOUND));
-        if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UsersError(UsersError.NOT_FOUND));
+        if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

        result.resetToken = hat(256);

        userdb.update(result.id, result, function (error) {
-            if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UserError(UserError.NOT_FOUND));
-            if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+            if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UsersError(UsersError.NOT_FOUND));
+            if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

            mailer.passwordReset(result);

@@ -458,39 +465,27 @@ function setPassword(userId, newPassword, callback) {
    assert.strictEqual(typeof callback, 'function');

    var error = validatePassword(newPassword);
-    if (error) return callback(new UserError(UserError.BAD_FIELD, error.message));
+    if (error) return callback(new UsersError(UsersError.BAD_FIELD, error.message));

    userdb.get(userId, function (error, user) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UserError(UserError.NOT_FOUND));
-        if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UsersError(UsersError.NOT_FOUND));
+        if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

-        if (config.isDemo() && user.username === constants.DEMO_USERNAME) return callback(new UserError(UserError.BAD_FIELD, 'Not allowed in demo mode'));
+        if (config.isDemo() && user.username === constants.DEMO_USERNAME) return callback(new UsersError(UsersError.BAD_FIELD, 'Not allowed in demo mode'));

        var saltBuffer = new Buffer(user.salt, 'hex');
        crypto.pbkdf2(newPassword, saltBuffer, CRYPTO_ITERATIONS, CRYPTO_KEY_LENGTH, CRYPTO_DIGEST, function (error, derivedKey) {
-            if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+            if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

            user.modifiedAt = (new Date()).toISOString();
            user.password = new Buffer(derivedKey, 'binary').toString('hex');
            user.resetToken = '';

            userdb.update(userId, user, function (error) {
-                if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UserError(UserError.NOT_FOUND));
-                if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+                if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UsersError(UsersError.NOT_FOUND));
+                if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

-                // Also generate a token so the new user can get logged in immediately
-                clients.get('cid-webadmin', function (error, result) {
-                    if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
-
-                    var token = tokendb.generateToken();
-                    var expiresAt = Date.now() + constants.DEFAULT_TOKEN_EXPIRATION;
-
-                    tokendb.add(token, user.id, result.id, expiresAt, '*', function (error) {
-                        if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
-
-                        callback(null, { token: token, expiresAt: expiresAt });
-                    });
-                });
+                callback();
            });
        });
    });
@@ -505,22 +500,22 @@ function createOwner(username, password, email, displayName, auditSource, callba
    assert.strictEqual(typeof callback, 'function');

    // This is only not allowed for the owner
-    if (username === '') return callback(new UserError(UserError.BAD_FIELD, 'Username cannot be empty'));
+    if (username === '') return callback(new UsersError(UsersError.BAD_FIELD, 'Username cannot be empty'));

    userdb.count(function (error, count) {
-        if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
-        if (count !== 0) return callback(new UserError(UserError.ALREADY_EXISTS, 'Owner already exists'));
+        if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));
+        if (count !== 0) return callback(new UsersError(UsersError.ALREADY_EXISTS, 'Owner already exists'));

        // have to provide the group id explicitly so using db layer directly
        groupdb.add(constants.ADMIN_GROUP_ID, constants.ADMIN_GROUP_NAME, function (error) {
            // we proceed if it already exists so we can re-create the owner if need be
-            if (error && error.reason !== DatabaseError.ALREADY_EXISTS) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+            if (error && error.reason !== DatabaseError.ALREADY_EXISTS) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

            createUser(username, password, email, displayName, auditSource, { owner: true }, function (error, user) {
                if (error) return callback(error);

                groups.addMember(constants.ADMIN_GROUP_ID, user.id, function (error) {
-                    if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+                    if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

                    callback(null, user);
                });
@@ -531,8 +526,8 @@ function createOwner(username, password, email, displayName, auditSource, callba

 function getOwner(callback) {
    userdb.getOwner(function (error, owner) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UserError(UserError.NOT_FOUND));
-        if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UsersError(UsersError.NOT_FOUND));
+        if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

        return callback(null, owner);
    });
@@ -544,14 +539,14 @@ function sendInvite(userId, options, callback) {
    assert.strictEqual(typeof callback, 'function');

    userdb.get(userId, function (error, userObject) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UserError(UserError.NOT_FOUND));
-        if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UsersError(UsersError.NOT_FOUND));
+        if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

        userObject.resetToken = hat(256);

        userdb.update(userId, userObject, function (error) {
-            if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UserError(UserError.NOT_FOUND));
-            if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
+            if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UsersError(UsersError.NOT_FOUND));
+            if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));

            mailer.sendInvite(userObject, options.invitor || null);

@@ -560,3 +555,59 @@ function sendInvite(userId, options, callback) {
    });
 }

+function setTwoFactorAuthenticationSecret(userId, callback) {
+    assert.strictEqual(typeof userId, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    userdb.get(userId, function (error, result) {
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UsersError(UsersError.NOT_FOUND));
+        if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));
+
+        if (result.twoFactorAuthenticationEnabled) return callback(new UsersError(UsersError.ALREADY_EXISTS));
+
+        var secret = speakeasy.generateSecret({ name: `Cloudron (${config.adminFqdn()})` });
+
+        userdb.update(userId, { twoFactorAuthenticationSecret: secret.base32, twoFactorAuthenticationEnabled: false }, function (error) {
+            if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));
+
+            qrcode.toDataURL(secret.otpauth_url, function (error, dataUrl) {
+                if (error) console.error(error);
+
+                callback(null, { secret: secret.base32, qrcode: dataUrl });
+            });
+        });
+    });
+}
+
+function enableTwoFactorAuthentication(userId, totpToken, callback) {
+    assert.strictEqual(typeof userId, 'string');
+    assert.strictEqual(typeof totpToken, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    userdb.get(userId, function (error, result) {
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UsersError(UsersError.NOT_FOUND));
+        if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));
+
+        var verified = speakeasy.totp.verify({ secret: result.twoFactorAuthenticationSecret, encoding: 'base32', token: totpToken });
+        if (!verified) return callback(new UsersError(UsersError.BAD_TOKEN));
+
+        if (result.twoFactorAuthenticationEnabled) return callback(new UsersError(UsersError.ALREADY_EXISTS));
+
+        userdb.update(userId, { twoFactorAuthenticationEnabled: true }, function (error) {
+            if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));
+
+            callback(null);
+        });
+    });
+}
+
+function disableTwoFactorAuthentication(userId, callback) {
+    assert.strictEqual(typeof userId, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    userdb.update(userId, { twoFactorAuthenticationEnabled: false, twoFactorAuthenticationSecret: '' }, function (error) {
+        if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));
+
+        callback(null);
+    });
+}
Author	SHA1	Message	Date
Girish Ramakrishnan	8b3edf6efc	Bump mail container for managesieve fix	2018-05-18 18:26:19 -07:00
Girish Ramakrishnan	07e649a2d3	Add more changes	2018-05-17 20:17:24 -07:00
Girish Ramakrishnan	8c63b6716d	Trigger a re-configure	2018-05-17 20:16:51 -07:00
Girish Ramakrishnan	6fd314fe82	Do not change password on app update Fixes #554	2018-05-17 19:48:57 -07:00
Girish Ramakrishnan	0c7eaf09a9	bump container versions	2018-05-17 10:00:00 -07:00
Girish Ramakrishnan	d0988e2d61	Generate password for mongodb on platform side Part of #554	2018-05-17 10:00:00 -07:00
Girish Ramakrishnan	4bedbd7167	Generate password for postgresql on platform side Part of #554	2018-05-17 10:00:00 -07:00
Girish Ramakrishnan	7ca7901a73	Generate password for mysql on platform side Part of #554	2018-05-17 09:59:57 -07:00
Girish Ramakrishnan	d28dfdbd03	Add 2.3.0 changes	2018-05-17 09:24:47 -07:00
Girish Ramakrishnan	c85ca3c6e2	account setup simply redirects to main page now	2018-05-17 09:17:08 -07:00
Girish Ramakrishnan	da934d26af	call callback	2018-05-17 09:16:32 -07:00
Girish Ramakrishnan	f7cc49c5f4	move platform config to db this way it can be tied up to some REST API later part of #555	2018-05-16 17:34:56 -07:00
Girish Ramakrishnan	27e263e7fb	lint	2018-05-16 14:08:54 -07:00
Girish Ramakrishnan	052050f48b	Add a way to persist addon memory configuration Fixes #555	2018-05-16 14:00:55 -07:00
Girish Ramakrishnan	81e29c7c2b	Make the INFRA_VERSION_FILE more readable	2018-05-16 09:54:42 -07:00
Girish Ramakrishnan	c3fbead658	Allow zoneName to be changed in domain update route	2018-05-15 15:39:30 -07:00
Girish Ramakrishnan	36f5b6d678	manual dns: handle ENOTFOUND Fixes #548	2018-05-15 15:39:18 -07:00
Girish Ramakrishnan	a45b1449de	Allow ghost users to skip 2fa	2018-05-14 15:07:01 -07:00
Girish Ramakrishnan	a1020ec6b8	remove /user from profile route	2018-05-13 21:53:06 -07:00
Johannes Zellner	d384284ec8	Add name.com DNS provider in the CHANGES file	2018-05-11 10:03:58 +02:00
Girish Ramakrishnan	bd29447a7f	gcdns: Fix typo	2018-05-10 10:05:42 -07:00
Johannes Zellner	aa5952fe0b	Wait longer for dns in apptask name.com often takes longer to sync all nameservers, which means we timeout too early for them	2018-05-10 15:37:47 +02:00
Johannes Zellner	39dc5da05a	We have to return a value on dns record upserting	2018-05-09 18:58:09 +02:00
Johannes Zellner	d0e07d995a	Add name.com dns tests	2018-05-09 18:13:21 +02:00
Johannes Zellner	94408c1c3d	Add name.com DNS provider	2018-05-09 18:13:14 +02:00
Girish Ramakrishnan	66f032a7ee	route53: use credentials instead of dnsConfig	2018-05-07 23:41:03 -07:00
Girish Ramakrishnan	4356df3676	bump timeout	2018-05-07 16:28:11 -07:00
Girish Ramakrishnan	1e730d2fc0	route53: more test fixing	2018-05-07 16:20:03 -07:00
Girish Ramakrishnan	e8875ccd2e	godaddy: add tests	2018-05-07 16:09:00 -07:00
Girish Ramakrishnan	2b3656404b	route53: fix tests	2018-05-07 15:53:08 -07:00
Girish Ramakrishnan	60b5e6f711	gandi: add tests	2018-05-07 15:51:51 -07:00
Girish Ramakrishnan	b9166b382d	route53: set listHostedZonesByName for new/updated domains	2018-05-07 13:42:10 -07:00
Girish Ramakrishnan	d0c427b0df	Add more 2.2 changes	2018-05-07 11:46:27 -07:00
Girish Ramakrishnan	da5d0c61b4	godaddy: workaround issue where there is no del record API	2018-05-07 11:41:37 -07:00
Girish Ramakrishnan	1f75c2cc48	route53: add backward compat for pre-2.2 IAM perms backward compat for 2.2, where we only required access to "listHostedZones"	2018-05-07 11:24:34 -07:00
Girish Ramakrishnan	d0197aab15	Revert "No need to iterate over the hosted zones anymore" This reverts commit `e4a70b95f5`. We will add backward compat route for pre-2.2 cloudrons	2018-05-07 11:23:28 -07:00
Johannes Zellner	e4a70b95f5	No need to iterate over the hosted zones anymore	2018-05-07 16:35:32 +02:00
Johannes Zellner	f4d3d79922	Query only requested Route53 zone Fixes #550	2018-05-07 16:30:42 +02:00
Girish Ramakrishnan	e3827ee25f	Add more 2.2 changes	2018-05-06 23:52:02 -07:00
Girish Ramakrishnan	9981ff2495	Add GoDaddy Domain API	2018-05-06 23:07:52 -07:00
Girish Ramakrishnan	722b14b13d	Add note on MX records	2018-05-06 22:14:39 -07:00
Girish Ramakrishnan	eb2fb6491c	gandi: more fixes	2018-05-06 21:16:47 -07:00
Girish Ramakrishnan	a53afbce91	Add Gandi LiveDNS backend	2018-05-06 19:48:51 -07:00
Girish Ramakrishnan	31af6c64d0	Expire existing webadmin token so that the UI gets a new token	2018-05-06 13:08:22 -07:00
Girish Ramakrishnan	e8efc5a1b2	Fix test	2018-05-06 12:58:39 -07:00
Girish Ramakrishnan	0c07c6e4d0	Allow "-" in usernames now that username and mailboxes are totally separate, we can allow '-'. '+' is still reserved because LDAP it. Fixes #509	2018-05-05 09:56:21 -07:00
Girish Ramakrishnan	da5fd71aaa	Bump mail container for CRAM-MD5 login fix	2018-05-04 21:57:26 -07:00
Girish Ramakrishnan	d57d590363	2.2.0 changes	2018-05-04 10:30:24 -07:00
Johannes Zellner	d6e49415d4	Only list user mailboxes in ldap search	2018-05-04 17:02:04 +02:00
Johannes Zellner	cb73eb61d4	Allow binds against mailboxes	2018-05-04 17:02:04 +02:00
Johannes Zellner	4ce3a262a3	Allow search for mailboxes over ldap for a specific domain	2018-05-04 17:02:04 +02:00
Girish Ramakrishnan	d18d1a977a	Add duplicate profile route for compat with old apps using oauth addon	2018-05-03 09:29:46 -07:00
Girish Ramakrishnan	616e38189c	Revert "x" This reverts commit `182ea3dac3`.	2018-05-03 09:29:23 -07:00
Johannes Zellner	726cafcee4	Rollback appdb record on clone and install if appstore purchase fails	2018-05-03 13:20:34 +02:00
Girish Ramakrishnan	e5c43e9acd	Remove debug	2018-05-02 12:41:22 -07:00
Girish Ramakrishnan	f09e8664d1	Return canonical scope in REST responses The '*' scope is purely an implementation detail. It cannot be requested as such.	2018-05-02 12:36:41 -07:00
Girish Ramakrishnan	182ea3dac3	x	2018-05-01 15:17:48 -07:00
Girish Ramakrishnan	97acd40829	remove obsolete roleSdk from the database the file is renamed because cloudron.io was patched by mistake and we want to run this migration there	2018-05-01 14:53:46 -07:00
Girish Ramakrishnan	f1abb2149d	gravatar url is already generated client side	2018-05-01 14:30:48 -07:00
Girish Ramakrishnan	8c4015851a	merge auth.js into accesscontrol.js	2018-05-01 14:03:10 -07:00
Girish Ramakrishnan	a545bdd574	merge developer.js into clients.js	2018-05-01 14:02:59 -07:00
Girish Ramakrishnan	d1135accbd	lint	2018-05-01 13:58:13 -07:00
Girish Ramakrishnan	d5b594fade	return the scope as part of the user profile send canonical scope in the profile response	2018-05-01 13:25:47 -07:00
Girish Ramakrishnan	c5ffb65563	Fix usage of normalizeScope	2018-05-01 13:21:53 -07:00
Girish Ramakrishnan	f76a5a7ba7	Move the clients API out of oauth prefix	2018-05-01 11:30:51 -07:00
Girish Ramakrishnan	17bcd95961	typo: return the scope as the scope	2018-05-01 10:59:46 -07:00
Girish Ramakrishnan	23bc0e8db7	Remove SDK Role Just compare with the token's clientId instead	2018-04-30 23:03:30 -07:00
Girish Ramakrishnan	240ee5f563	Ensure we hand out max user.scope The token.scope was valid at token creation time. The user's scope could since have changed (maybe we got kicked out of a group).	2018-04-30 22:51:57 -07:00
Girish Ramakrishnan	200f43a58e	lint	2018-04-30 22:41:23 -07:00
Girish Ramakrishnan	61d803f528	Use SCOPE_ANY everywhere	2018-04-30 21:44:24 -07:00
Girish Ramakrishnan	e7c8791356	lint	2018-04-30 21:41:09 -07:00
Girish Ramakrishnan	bc4f9cf596	Remove redundant requireAdmin We already hand out scopes based on the user's access control	2018-04-30 21:38:48 -07:00
Girish Ramakrishnan	9789966017	Set the scope for a token basedon what the user has access to	2018-04-30 21:21:18 -07:00
Girish Ramakrishnan	1432d90f37	lint	2018-04-30 21:13:23 -07:00
Girish Ramakrishnan	68317a89cb	remove the analytics hooks	2018-04-30 15:33:25 -07:00
Girish Ramakrishnan	c84f984205	No need to create a token on password reset	2018-04-30 15:15:05 -07:00
Johannes Zellner	6e19153350	Remove now unused result argument	2018-04-30 20:37:12 +02:00
Johannes Zellner	4dc778f7c2	Change reset password button text	2018-04-30 20:17:56 +02:00
Johannes Zellner	c5c3748aa9	Do not auto login on password reset	2018-04-30 19:55:59 +02:00
Girish Ramakrishnan	f809e359c9	refactor the global variables as functions	2018-04-29 20:17:45 -07:00
Girish Ramakrishnan	91e846d976	Add SCOPE_DOMAINS	2018-04-29 18:11:33 -07:00
Girish Ramakrishnan	b5f8ca6c16	Fix nasssty typo	2018-04-29 17:50:12 -07:00
Girish Ramakrishnan	922ab3bde1	lint	2018-04-29 17:50:12 -07:00
Girish Ramakrishnan	3b7bcc1f61	refactor scopes into accesscontrol.js this will be our authorization layer for oauth and non-oauth tokens.	2018-04-29 17:50:07 -07:00
Girish Ramakrishnan	6e3b060615	Use SCOPE_PROFILE constant	2018-04-29 17:12:30 -07:00
Girish Ramakrishnan	cc113d0bb5	Add SCOPE_CLIENTS for oauth clients API	2018-04-29 17:03:10 -07:00
Girish Ramakrishnan	3e22d513eb	Add SCOPE_MAIL for mail APIs	2018-04-29 17:01:12 -07:00
Girish Ramakrishnan	9cf51ef680	Update cid-webadmin to have all the scopes possible	2018-04-29 16:57:49 -07:00
Girish Ramakrishnan	1c55a3e310	typo	2018-04-29 11:29:21 -07:00
Girish Ramakrishnan	d8acf92929	UserError -> UsersError	2018-04-29 11:22:15 -07:00
Girish Ramakrishnan	7bb8d059b5	GroupError -> GroupsError	2018-04-29 11:21:01 -07:00
Girish Ramakrishnan	863afc68cb	DomainError -> DomainsError	2018-04-29 11:20:12 -07:00
Girish Ramakrishnan	4fd58fb46b	Rename user.js to users.js	2018-04-29 11:19:04 -07:00
Girish Ramakrishnan	b1b664ceca	Move removeInternalAppFields to model code	2018-04-29 10:47:34 -07:00
Girish Ramakrishnan	1a27009fb5	Make expiresAt a body parameter	2018-04-28 22:02:07 -07:00
Girish Ramakrishnan	6c8c206e89	Move input validation logic to routes	2018-04-28 21:58:56 -07:00
Girish Ramakrishnan	82207c3ccd	Keep naming consistent with delToken	2018-04-28 21:55:57 -07:00
Girish Ramakrishnan	6768994bbe	Capitalize the 2fa text	2018-04-28 10:20:33 -07:00
Girish Ramakrishnan	b72efb1018	Remove private fields when listing domains Currently, domains list route does not return the fallback cert. make it future proof, just in case.	2018-04-27 11:41:30 -07:00
Johannes Zellner	7a8c525beb	Add 2fa Oauth route tests	2018-04-27 14:08:22 +02:00
Johannes Zellner	9372d8797a	Add 2fa tests for developer login api	2018-04-27 12:29:11 +02:00
Johannes Zellner	faeb89b258	Add 2fa token login to oauth login form	2018-04-27 11:46:41 +02:00
Johannes Zellner	50d7ade0d9	Remove unused property on set 2fa secret	2018-04-27 08:20:12 +02:00
Johannes Zellner	497c76a905	Add 2fa token check to developer login	2018-04-27 08:18:13 +02:00
Johannes Zellner	bbc434dc21	Attach the whole user object also for basic authed routes	2018-04-27 08:18:13 +02:00
Girish Ramakrishnan	a7bb5d6b5c	add route to query apps specific to user it's not nice to overload a route to mean different things depending on who queries it.	2018-04-26 20:07:12 -07:00
Girish Ramakrishnan	e0da6679e9	Move user routes to /api/v1/user	2018-04-26 19:57:44 -07:00
Girish Ramakrishnan	561d2d9f8b	admin column is no more in users table	2018-04-26 19:55:26 -07:00
Girish Ramakrishnan	7549b3e837	enhance user creation API to take a password	2018-04-26 14:13:40 -07:00
Girish Ramakrishnan	7756c07bc6	Add better text for the secret	2018-04-26 09:39:35 -07:00
Johannes Zellner	0d58a6bf33	Send 2fa auth status with profile info	2018-04-26 16:29:40 +02:00
Johannes Zellner	fbba636fb3	Handle more 2fa route errors	2018-04-26 16:14:37 +02:00
Johannes Zellner	9cd6333cf7	2fa routest work with the req.user object	2018-04-26 15:12:14 +02:00
Johannes Zellner	eb02c182e5	Avoid linter issue	2018-04-26 14:45:12 +02:00
Johannes Zellner	6574b22cf6	Add 2fa routest and business logic	2018-04-26 08:46:35 +02:00
Girish Ramakrishnan	d1ed2aa2ce	remove untested route set_admin	2018-04-25 21:43:21 -07:00
Girish Ramakrishnan	c2a762cb29	Do not reserve mailbox names Now that user management is split from mailboxes, we don't need to reserve mailbox names anymore.	2018-04-25 21:14:33 -07:00
Girish Ramakrishnan	34d40edef4	Fix issue where docker needs more recent packages The following packages have unmet dependencies: docker-ce : Depends: libseccomp2 (>= 2.3.0) but 2.2.3-3ubuntu3 is to be installed E: Unable to correct problems, you have held broken packages.	2018-04-25 13:44:53 -07:00
Johannes Zellner	5ceb14cbca	Add required 2fa node modules qrcode and speakeasy	2018-04-25 17:03:16 +02:00
Johannes Zellner	38668937ad	Fixup database tests	2018-04-25 17:03:16 +02:00
Johannes Zellner	0167f83d4a	Handle 2fa fields in userdb code	2018-04-25 17:03:16 +02:00
Johannes Zellner	9e66adb6d0	Add 2fa db record fields to users table	2018-04-25 17:03:16 +02:00
Girish Ramakrishnan	0a537029bc	add mailbox domain to the constraint	2018-04-23 10:14:16 -07:00
Girish Ramakrishnan	c0716e86a7	Remove the "or Email" The email here can be confused with the Cloudron email which it is not. The preferred approach is to login via username anyway.	2018-04-22 18:29:10 -07:00
Girish Ramakrishnan	50185adcf4	Add 2.1.1 changes	2018-04-18 12:49:11 -07:00