feat: require payment plans to provision spaces (#268)

Most of the heavy lifting here is done by upgrading the
`@web3-storage/upload-api` dependency. There is a new "feature flag" in
the context that changes whether payment plans are required for
provisioning - I'm going to set it to `false` for now in production and
we can flip it once we're ready to turn this on.

I spent a bit of time working toward extending our integration tests to
exercise the Stripe webhook handler, but it turned into a big enough
project that I decided to defer and recorded what I learned in an issue
here:

#267

.env.tpl

@@ -38,3 +38,5 @@ SATNAV_BUCKET_NAME = ''
 MAILSLURP_API_KEY = ''
 MAILSLURP_TIMEOUT = '120000'
 
+# Feature flags
+REQUIRE_PAYMENT_PLAN = 'true'

stacks/upload-api-stack.js

@@ -101,6 +101,7 @@ export function UploadApiStack({ stack, app }) {
           R2_DUDEWHERE_BUCKET_NAME: process.env.R2_DUDEWHERE_BUCKET_NAME ?? '',
           R2_DELEGATION_BUCKET_NAME: process.env.R2_DELEGATION_BUCKET_NAME ?? '',
           R2_ENDPOINT: process.env.R2_ENDPOINT ?? '',
+          REQUIRE_PAYMENT_PLAN: process.env.REQUIRE_PAYMENT_PLAN ?? '',
           UPLOAD_API_DID: process.env.UPLOAD_API_DID ?? '',
         },
         bind: [

upload-api/functions/ucan-invocation-router.js

@@ -119,6 +119,7 @@ export async function ucanInvocationRouter(request) {
     aggregatorDid,
     pieceOfferQueueUrl,
     filecoinSubmitQueueUrl,
+    requirePaymentPlan,
     // set for testing
     dbEndpoint,
     accessServiceURL,
@@ -195,6 +196,7 @@ export async function ucanInvocationRouter(request) {
       skipFilecoinSubmitQueue: true
     },
     plansStorage,
+    requirePaymentPlan,
     usageStorage,
   })
 
@@ -303,6 +305,7 @@ function getLambdaEnv () {
     providers: mustGetEnv('PROVIDERS'),
     accessServiceURL: mustGetEnv('ACCESS_SERVICE_URL'),
     aggregatorDid: mustGetEnv('AGGREGATOR_DID'),
+    requirePaymentPlan: (process.env.REQUIRE_PAYMENT_PLAN === 'true'),
     // set for testing
     dbEndpoint: process.env.DYNAMO_DB_ENDPOINT,
   }