Add Stripe webhook to public api server

Author: Andrew Farries

components/public-api-server/pkg/server/server.go

@@ -6,12 +6,15 @@ package server
 
 import (
 	"fmt"
-	"github.com/gitpod-io/gitpod/public-api/config"
 	"net/url"
 
+	"github.com/gitpod-io/gitpod/public-api/config"
+	"github.com/gorilla/handlers"
+
 	"github.com/gitpod-io/gitpod/common-go/baseserver"
 	"github.com/gitpod-io/gitpod/public-api-server/pkg/apiv1"
 	"github.com/gitpod-io/gitpod/public-api-server/pkg/proxy"
+	"github.com/gitpod-io/gitpod/public-api-server/pkg/webhooks"
 	v1 "github.com/gitpod-io/gitpod/public-api/v1"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/sirupsen/logrus"
@@ -36,6 +39,10 @@ func Start(logger *logrus.Entry, cfg *config.Configuration) error {
 		return fmt.Errorf("failed to initialize public api server: %w", err)
 	}
 
+	srv.HTTPMux().Handle("/stripe/invoices/webhook",
+		handlers.ContentTypeHandler(webhooks.NewStripeWebhookHandler(), "application/json"),
+	)
+
 	if registerErr := register(srv, gitpodAPI, registry); registerErr != nil {
 		return fmt.Errorf("failed to register services: %w", registerErr)
 	}

components/public-api-server/pkg/webhooks/stripe.go

@@ -0,0 +1,39 @@
+// Copyright (c) 2022 Gitpod GmbH. All rights reserved.
+// Licensed under the GNU Affero General Public License (AGPL).
+// See License-AGPL.txt in the project root for license information.
+
+package webhooks
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+
+	"github.com/gitpod-io/gitpod/common-go/log"
+	"github.com/stripe/stripe-go/v72"
+)
+
+type webhookHandler struct{}
+
+func NewStripeWebhookHandler() *webhookHandler {
+	return &webhookHandler{}
+}
+
+func (h *webhookHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
+	const maxBodyBytes = int64(65536)
+
+	req.Body = http.MaxBytesReader(w, req.Body, maxBodyBytes)
+
+	event := stripe.Event{}
+	err := json.NewDecoder(req.Body).Decode(&event)
+	if err != nil {
+		log.WithError(err).Error("Stripe webhook error while parsing event payload")
+		w.WriteHeader(http.StatusBadRequest)
+		return
+	}
+
+	// TODO: verify webhook signature.
+	// Conditional on there being a secret configured.
+
+	fmt.Fprintf(w, "event type: %s", event.Type)
+}