SUCCEEDED/FAILED (not "APPROVED"/"REJECTED"); live Paynamics flows are untestable now (no prod credentials, events currently free).
URLs in this section were NOT migrated to the staging-subdomain form (
stg-rcme.membervu.com) in the 2026-06-10 env pass — they will be corrected during the rewrite.
Reference:
_bmad-output/test-artifacts/test-reviews/test-guide-html-staleness-audit-2026-06-10.md
Test Cases: Payment Method Management
Module: Payments - Payment Methods
Backend Endpoints:
GET /api/billing/payment-methodsPOST /api/billing/payment-methodsDELETE /api/billing/payment-methods/:id
Frontend Page: mmp/frontend/pwa-app/src/pages/PaymentMethodsPage.tsx
Prerequisites
- User logged in with MEMBER or higher role.
- Payment gateway (TraxionPay) integration enabled for card storage tests.
Test Data
| Field | Value |
|---|---|
| User | Maria Cruz (MEMBER) |
| Card Number (Test) | 4111 1111 1111 1111 |
| Expiry | 12/25 |
| CVV | 123 |
| Cardholder | Maria Cruz |
Test Cases
TC-PAY-013: View Payment Methods List
| Step | Action | Expected Result |
|---|---|---|
| 1 | Login as Maria Cruz (MEMBER). | Dashboard displayed. |
| 2 | Navigate to Account > Payment Methods. | Payment methods page displayed. |
| 3 | Verify existing methods listed. | Any saved methods shown (or empty state). |
| 4 | Verify card masking. | Card numbers masked: ** 1111. |
| 5 | Verify expiry displayed. | Expiry date shown for cards. |
TC-PAY-014: Add Credit Card Payment Method
| Step | Action | Expected Result |
|---|---|---|
| 1 | Navigate to Payment Methods page. | Page displayed. |
| 2 | Click "Add Payment Method". | Form/modal opens. |
| 3 | Select "Credit/Debit Card". | Card form displayed. |
| 4 | Enter card number: 4111 1111 1111 1111. | Card number accepted (Visa test card). |
| 5 | Enter expiry: 12/25. | Expiry accepted. |
| 6 | Enter CVV: 123. | CVV accepted. |
| 7 | Enter cardholder name: Maria Cruz. | Name entered. |
| 8 | Click "Save Card". | API POST /api/billing/payment-methods called. |
| 9 | Verify success. | "Payment method added" message displayed. |
| 10 | Verify card listed. | New card appears in payment methods list. |
| 11 | Verify secure storage. | Full card number NOT returned from API. |
TC-PAY-015: Add Card - Invalid Card Number
| Step | Action | Expected Result |
|---|---|---|
| 1 | Open add card form. | - |
| 2 | Enter invalid card: 1234567890123456. | - |
| 3 | Attempt to save. | Validation error: "Invalid card number". |
| 4 | Enter card failing Luhn check. | Validation error displayed. |
TC-PAY-016: Add Card - Expired Card
| Step | Action | Expected Result |
|---|---|---|
| 1 | Open add card form. | - |
| 2 | Enter valid card number. | - |
| 3 | Enter expiry: 01/20 (past date). | - |
| 4 | Attempt to save. | Validation error: "Card has expired". |
TC-PAY-017: Add Card - Invalid CVV
| Step | Action | Expected Result |
|---|---|---|
| 1 | Open add card form. | - |
| 2 | Enter valid card and expiry. | - |
| 3 | Enter CVV: 12 (only 2 digits). | Validation error: "Invalid CVV". |
| 4 | Enter CVV: 1234 (4 digits for non-Amex). | Validation error. |
TC-PAY-018: Delete Payment Method
| Step | Action | Expected Result |
|---|---|---|
| 1 | View payment methods list with existing card. | Card displayed. |
| 2 | Click "Delete" or trash icon on a card. | Confirmation dialog appears. |
| 3 | Confirm deletion. | API DELETE /api/billing/payment-methods/:id called. |
| 4 | Verify success. | "Payment method removed" message. |
| 5 | Verify list updated. | Deleted card no longer appears. |
TC-PAY-019: Delete Payment Method - Cancel Deletion
| Step | Action | Expected Result |
|---|---|---|
| 1 | Click delete on a payment method. | Confirmation dialog appears. |
| 2 | Click "Cancel". | Dialog closes, card not deleted. |
| 3 | Verify card still listed. | Payment method remains. |
TC-PAY-020: Add Duplicate Payment Method
| Step | Action | Expected Result |
|---|---|---|
| 1 | Add card ending in 1111. | Card added. |
| 2 | Attempt to add same card again. | Warning: "Card already exists" or allowed (duplicate detection). |
TC-PAY-021: Payment Method - Empty State
| Step | Action | Expected Result |
|---|---|---|
| 1 | Login as member with no saved payment methods. | - |
| 2 | Navigate to Payment Methods. | Empty state displayed. |
| 3 | Verify message. | "No payment methods saved" or similar. |
| 4 | Verify CTA. | "Add Payment Method" button prominent. |
TC-PAY-022: Set Default Payment Method
| Step | Action | Expected Result |
|---|---|---|
| 1 | Have multiple payment methods saved. | - |
| 2 | Click "Set as Default" on non-default method. | API called to update default. |
| 3 | Verify default badge. | Selected method shows "Default" indicator. |
| 4 | Verify previous default removed. | Only one default at a time. |
TC-PAY-023: Use Saved Payment Method at Checkout
| Step | Action | Expected Result |
|---|---|---|
| 1 | Register for paid event. | Checkout page displayed. |
| 2 | View payment options. | Saved payment methods displayed. |
| 3 | Select saved card (** 1111). | Card selected. |
| 4 | Complete payment. | Payment processed with saved card. |
| 5 | Verify no re-entry of card details. | CVV may be requested for security. |
TC-PAY-024: Payment Methods - Access Other User's Methods
| Step | Action | Expected Result |
|---|---|---|
| 1 | Login as Maria Cruz. | - |
| 2 | Attempt API call to list another user's methods. | - |
| 3 | Verify response. | Status 403 Forbidden or only own methods returned. |
API Test Cases
TC-PAY-API-005: GET /api/billing/payment-methods
Request: GET /api/billing/payment-methods (as Maria Cruz)
Expected Response: 200 OK
{
"paymentMethods": [
{
"id": "pm_12345",
"type": "CARD",
"last4": "1111",
"brand": "VISA",
"expiryMonth": 12,
"expiryYear": 2025,
"isDefault": true,
"createdAt": "timestamp"
}
]
}
TC-PAY-API-006: POST /api/billing/payment-methods
Request:
{
"type": "CARD",
"cardNumber": "4111111111111111",
"expiryMonth": 12,
"expiryYear": 2025,
"cvv": "123",
"cardholderName": "Maria Cruz"
}
Expected Response: 201 Created
{
"id": "pm_67890",
"type": "CARD",
"last4": "1111",
"brand": "VISA",
"expiryMonth": 12,
"expiryYear": 2025,
"isDefault": false
}
Note: Full card number should NEVER be returned in response.
TC-PAY-API-007: DELETE /api/billing/payment-methods/:id
Request: DELETE /api/billing/payment-methods/pm_12345
Expected Response: 200 OK
{
"success": true,
"message": "Payment method deleted"
}
TC-PAY-API-008: DELETE /api/billing/payment-methods/:id - Not Owner
Request: DELETE /api/billing/payment-methods/pm_other_user (as Juan)
Expected Response: 403 Forbidden or 404 Not Found