Fix permission rbac

seed_permissions_rbac.py

@@ -2,7 +2,7 @@
 """
 Permission Seeding Script for Dynamic RBAC System
 
-This script populates the database with 59 granular permissions and assigns them
+This script populates the database with 65 granular permissions and assigns them
 to the appropriate dynamic roles (not the old enum roles).
 
 Usage:
@@ -33,7 +33,7 @@ engine = create_engine(DATABASE_URL)
 SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
 
 # ============================================================
-# Permission Definitions (59 permissions across 10 modules)
+# Permission Definitions (65 permissions across 11 modules)
 # ============================================================
 
 PERMISSIONS = [
@@ -116,6 +116,13 @@ PERMISSIONS = [
     {"code": "permissions.assign", "name": "Assign Permissions", "description": "Assign permissions to roles", "module": "permissions"},
     {"code": "permissions.manage_roles", "name": "Manage Roles", "description": "Create and manage user roles", "module": "permissions"},
     {"code": "permissions.audit", "name": "View Permission Audit Log", "description": "View permission change audit logs", "module": "permissions"},
+
+    # ========== PAYMENT METHODS MODULE (5) ==========
+    {"code": "payment_methods.view", "name": "View Payment Methods", "description": "View user payment methods (masked)", "module": "payment_methods"},
+    {"code": "payment_methods.view_sensitive", "name": "View Sensitive Payment Details", "description": "View full Stripe payment method IDs (requires password)", "module": "payment_methods"},
+    {"code": "payment_methods.create", "name": "Create Payment Methods", "description": "Add payment methods on behalf of users", "module": "payment_methods"},
+    {"code": "payment_methods.delete", "name": "Delete Payment Methods", "description": "Remove user payment methods", "module": "payment_methods"},
+    {"code": "payment_methods.set_default", "name": "Set Default Payment Method", "description": "Set default payment method for users", "module": "payment_methods"},
 ]
 
 # Default system roles that must exist
@@ -170,6 +177,9 @@ DEFAULT_ROLE_PERMISSIONS = {
         "subscriptions.cancel", "subscriptions.activate", "subscriptions.plans",
         "subscriptions.export",
         "donations.view", "donations.export",
+        # Payment methods - finance can view sensitive details
+        "payment_methods.view", "payment_methods.view_sensitive",
+        "payment_methods.create", "payment_methods.delete", "payment_methods.set_default",
     ],
 
     "admin": [
@@ -191,6 +201,9 @@ DEFAULT_ROLE_PERMISSIONS = {
         "gallery.view", "gallery.upload", "gallery.edit", "gallery.delete", "gallery.moderate",
         "settings.view", "settings.edit", "settings.email_templates", "settings.storage",
         "settings.logs",
+        # Payment methods - admin can manage but not view sensitive details
+        "payment_methods.view", "payment_methods.create",
+        "payment_methods.delete", "payment_methods.set_default",
     ],
 
     "superadmin": [