Implement Stripe portal to allow usage-based customers to manage their billing details

[jankeromnes]

Description

• Implement Stripe portal to allow usage-based customers to manage their subscription.

Related Issue(s)

Fixes #10327

How to test

1. Create a team called "Gitpod", or "Gitpod1", "Gitpod2" ...
2. Navigate to Team Settings > Team Billing
3. Wait for the Usage-Based Billing UI to appear
4. Upgrade to Usage-Based Billing by adding a credit card (e.g. 4242 4242 4242 4242, 4/24, 424)
5. Once upgraded, clicking on Manage Billing should open the Stripe Portal
6. (The Stripe Portal also has a link that takes you back to Gitpod)

Click on Manage Billing	View Stripe Portal

Release Notes

NONE

Documentation

• /werft with-payment

[werft-gitpod-dev-com]

started the job as gitpod-build-jx-stripe-portal.2 because the annotations in the pull request description changed
(with .werft/ from main)

[easyCZ]

@jankeromnes Thanks for the PR. I haven't had a chance to dig into the details of Stripe API yet but to give you a faster review, how does the authentication and authorization against Stripe work from our link? Specifically:

1. Does the user in effect need to create an account to access teh dashboard? Or are we generating a one-time sign-in link which we're exposing in our dashboard?
2. What guarantees that a user outside a team is not given access to another teams portal?

[jankeromnes]

Thanks @easyCZ! Good questions. The answers are in the code, but to give you fast answers:

1. Does the user in effect need to create an account to access teh dashboard?

Yes, you need both a Gitpod account and a Stripe customer account before you can see the Stripe Portal button, let alone open it.

Or are we generating a one-time sign-in link which we're exposing in our dashboard?

We are indeed generating a one-time sign-in link server-side to allow specifically one customer to open their own Stripe Portal.

2. What guarantees that a user outside a team is not given access to another teams portal?

We do not give a one-time sign-in link to users who are not an Owner of the Team that is the Stripe Customer (standard team-ownership access control check before generating the one-time sign-in link).

Also, FYI from the portal, you can only see a semi-censored version of your own customer details, and update them to new values.

[easyCZ]

Thanks. And last one:

We are indeed generating a one-time sign-in link server-side to allow specifically one customer to open their own Stripe Portal.

From the code, I understand we generate the portal link based on the user. Is this correct? Should it instead be the team? I'm asking because it's unclear if you're in multiple teams, which link to the portal you should receive.

[jankeromnes]

From the code, I understand we generate the portal link based on the user. Is this correct? Should it instead be the team? I'm asking because it's unclear if you're in multiple teams, which link to the portal you should receive.

No, we actually generate the portal link based on the Stripe Customer, which currently can only be a Team.

Note: The getStripePortalUrlForTeam API has a required teamId parameter.

[easyCZ]

Thanks for the info @jankeromnes. LGTM