feat: Allow SaaS users to manage subscription within the dashboard (#5059)

enterprise/app/controllers/enterprise/api/v1/accounts_controller.rb

@@ -0,0 +1,47 @@
+class Enterprise::Api::V1::AccountsController < Api::BaseController
+  before_action :fetch_account
+  before_action :check_authorization
+
+  def subscription
+    Enterprise::CreateStripeCustomerJob.perform_later(@account) if stripe_customer_id.blank?
+    head :no_content
+  end
+
+  def checkout
+    return create_stripe_billing_session(stripe_customer_id) if stripe_customer_id.present?
+
+    render_invalid_billing_details
+  end
+
+  private
+
+  def fetch_account
+    @account = current_user.accounts.find(params[:id])
+    @current_account_user = @account.account_users.find_by(user_id: current_user.id)
+  end
+
+  def stripe_customer_id
+    @account.custom_attributes['stripe_customer_id']
+  end
+
+  def render_invalid_billing_details
+    render_could_not_create_error('Please subscribe to a plan before viewing the billing details')
+  end
+
+  def create_stripe_billing_session(customer_id)
+    session = Enterprise::Billing::CreateSessionService.new.create_session(customer_id)
+    render_redirect_url(session.url)
+  end
+
+  def render_redirect_url(redirect_url)
+    render json: { redirect_url: redirect_url }
+  end
+
+  def pundit_user
+    {
+      user: current_user,
+      account: @account,
+      account_user: @current_account_user
+    }
+  end
+end

enterprise/app/controllers/enterprise/api/v1/webhooks/stripe_controller.rb

@@ -0,0 +1,21 @@
+class Enterprise::Api::V1::Webhooks::StripeController < ActionController::API
+  def process_payload
+    # Get the event payload and signature
+    payload = request.body.read
+    sig_header = request.headers['Stripe-Signature']
+
+    # Attempt to verify the signature. If successful, we'll handle the event
+    begin
+      event = Stripe::Webhook.construct_event(payload, sig_header, ENV.fetch('STRIPE_WEBHOOK_SECRET', nil))
+      ::Enterprise::Billing::HandleStripeEventService.new.perform(event: event)
+    # If we fail to verify the signature, then something was wrong with the request
+    rescue JSON::ParserError, Stripe::SignatureVerificationError
+      # Invalid payload
+      head :bad_request
+      return
+    end
+
+    # We've successfully processed the event without blowing up
+    head :ok
+  end
+end