diff --git a/seed_permissions_rbac.py b/seed_permissions_rbac.py index 1b810a3..a4c407a 100755 --- a/seed_permissions_rbac.py +++ b/seed_permissions_rbac.py @@ -2,7 +2,7 @@ """ Permission Seeding Script for Dynamic RBAC System -This script populates the database with 59 granular permissions and assigns them +This script populates the database with 65 granular permissions and assigns them to the appropriate dynamic roles (not the old enum roles). Usage: @@ -33,7 +33,7 @@ engine = create_engine(DATABASE_URL) SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine) # ============================================================ -# Permission Definitions (59 permissions across 10 modules) +# Permission Definitions (65 permissions across 11 modules) # ============================================================ PERMISSIONS = [ @@ -116,6 +116,13 @@ PERMISSIONS = [ {"code": "permissions.assign", "name": "Assign Permissions", "description": "Assign permissions to roles", "module": "permissions"}, {"code": "permissions.manage_roles", "name": "Manage Roles", "description": "Create and manage user roles", "module": "permissions"}, {"code": "permissions.audit", "name": "View Permission Audit Log", "description": "View permission change audit logs", "module": "permissions"}, + + # ========== PAYMENT METHODS MODULE (5) ========== + {"code": "payment_methods.view", "name": "View Payment Methods", "description": "View user payment methods (masked)", "module": "payment_methods"}, + {"code": "payment_methods.view_sensitive", "name": "View Sensitive Payment Details", "description": "View full Stripe payment method IDs (requires password)", "module": "payment_methods"}, + {"code": "payment_methods.create", "name": "Create Payment Methods", "description": "Add payment methods on behalf of users", "module": "payment_methods"}, + {"code": "payment_methods.delete", "name": "Delete Payment Methods", "description": "Remove user payment methods", "module": "payment_methods"}, + {"code": "payment_methods.set_default", "name": "Set Default Payment Method", "description": "Set default payment method for users", "module": "payment_methods"}, ] # Default system roles that must exist @@ -170,6 +177,9 @@ DEFAULT_ROLE_PERMISSIONS = { "subscriptions.cancel", "subscriptions.activate", "subscriptions.plans", "subscriptions.export", "donations.view", "donations.export", + # Payment methods - finance can view sensitive details + "payment_methods.view", "payment_methods.view_sensitive", + "payment_methods.create", "payment_methods.delete", "payment_methods.set_default", ], "admin": [ @@ -191,6 +201,9 @@ DEFAULT_ROLE_PERMISSIONS = { "gallery.view", "gallery.upload", "gallery.edit", "gallery.delete", "gallery.moderate", "settings.view", "settings.edit", "settings.email_templates", "settings.storage", "settings.logs", + # Payment methods - admin can manage but not view sensitive details + "payment_methods.view", "payment_methods.create", + "payment_methods.delete", "payment_methods.set_default", ], "superadmin": [