1. Models (backend/models.py)- Added PaymentMethodType enum (card, cash, bank_transfer, check)- Added stripe_customer_id column to User model- Created new PaymentMethod model with all fields specified in the plan2. Alembic Migration (backend/alembic/versions/add_payment_methods.py)- Creates payment_methods table- Adds stripe_customer_id to users table- Creates appropriate indexes3. API Endpoints (backend/server.py)Added 12 new endpoints:Member Endpoints:- GET /api/payment-methods - List user's payment methods- POST /api/payment-methods/setup-intent - Create Stripe SetupIntent- POST /api/payment-methods - Save payment method after setup- PUT /api/payment-methods/{id}/default - Set as default- DELETE /api/payment-methods/{id} - Remove payment methodAdmin Endpoints:- GET /api/admin/users/{user_id}/payment-methods - List user's methods (masked)- POST /api/admin/users/{user_id}/payment-methods/reveal - Reveal sensitive details (requires password)- POST /api/admin/users/{user_id}/payment-methods/setup-intent - Create SetupIntent for user- POST /api/admin/users/{user_id}/payment-methods - Save method on behalf- POST /api/admin/users/{user_id}/payment-methods/manual - Record manual method (cash/check)- PUT /api/admin/users/{user_id}/payment-methods/{id}/default - Set default- DELETE /api/admin/users/{user_id}/payment-methods/{id} - Delete method4. Permissions (backend/permissions_seed.py)Added 5 new permissions:- payment_methods.view- payment_methods.view_sensitive- payment_methods.create- payment_methods.delete- payment_methods.set_default

permissions_seed.py

@@ -327,6 +327,38 @@ PERMISSIONS = [
         "module": "gallery"
     },
 
+    # ========== PAYMENT METHODS MODULE ==========
+    {
+        "code": "payment_methods.view",
+        "name": "View Payment Methods",
+        "description": "View user payment methods (masked)",
+        "module": "payment_methods"
+    },
+    {
+        "code": "payment_methods.view_sensitive",
+        "name": "View Sensitive Payment Details",
+        "description": "View full payment method details including Stripe IDs (requires password)",
+        "module": "payment_methods"
+    },
+    {
+        "code": "payment_methods.create",
+        "name": "Create Payment Methods",
+        "description": "Add payment methods on behalf of users",
+        "module": "payment_methods"
+    },
+    {
+        "code": "payment_methods.delete",
+        "name": "Delete Payment Methods",
+        "description": "Delete user payment methods",
+        "module": "payment_methods"
+    },
+    {
+        "code": "payment_methods.set_default",
+        "name": "Set Default Payment Method",
+        "description": "Set a user's default payment method",
+        "module": "payment_methods"
+    },
+
     # ========== SETTINGS MODULE ==========
     {
         "code": "settings.view",
@@ -453,6 +485,10 @@ DEFAULT_ROLE_PERMISSIONS = {
         "gallery.edit",
         "gallery.delete",
         "gallery.moderate",
+        "payment_methods.view",
+        "payment_methods.create",
+        "payment_methods.delete",
+        "payment_methods.set_default",
         "settings.view",
         "settings.edit",
         "settings.email_templates",
@@ -460,6 +496,36 @@ DEFAULT_ROLE_PERMISSIONS = {
         "settings.logs",
     ],
 
+    UserRole.finance: [
+        # Finance role has all admin permissions plus sensitive payment access
+        "users.view",
+        "users.export",
+        "events.view",
+        "events.rsvps",
+        "events.calendar_export",
+        "subscriptions.view",
+        "subscriptions.create",
+        "subscriptions.edit",
+        "subscriptions.cancel",
+        "subscriptions.activate",
+        "subscriptions.plans",
+        "financials.view",
+        "financials.create",
+        "financials.edit",
+        "financials.delete",
+        "financials.export",
+        "financials.payments",
+        "newsletters.view",
+        "bylaws.view",
+        "gallery.view",
+        "payment_methods.view",
+        "payment_methods.view_sensitive",  # Finance can view sensitive payment details
+        "payment_methods.create",
+        "payment_methods.delete",
+        "payment_methods.set_default",
+        "settings.view",
+    ],
+
     # Superadmin gets all permissions automatically in code,
     # so we don't need to explicitly assign them
     UserRole.superadmin: []