Screen Greenhouse applications with HireLayer

import { createHmac, timingSafeEqual } from 'node:crypto'

const HIRELAYER = 'https://hirelayer.co'
const headers = { 'X-API-Key': process.env.HIRELAYER_API_KEY! }

export async function handle(rawBody: string, signature: string) {
  // Greenhouse: "sha256 <hex>" over the raw body
  const expected = 'sha256 ' + createHmac('sha256', process.env.GH_WEBHOOK_SECRET!)
    .update(rawBody).digest('hex')
  const valid = signature.length === expected.length &&
    timingSafeEqual(Buffer.from(signature), Buffer.from(expected))
  if (!valid) return 401

  const { payload } = JSON.parse(rawBody)
  const application = payload.application
  const resume = application.candidate.attachments
    .find((a: { type: string }) => a.type === 'resume')
  if (!resume) return 200

  // 1. Parse the resume (about 35 s)
  const file = await fetch(resume.url).then((r) => r.blob())
  const form = new FormData()
  form.append('file', file, resume.filename)
  form.append('application_id', String(application.id))
  const parsed = await fetch(`${HIRELAYER}/api/v3/parser`, {
    method: 'POST', headers, body: form, signal: AbortSignal.timeout(150_000),
  }).then((r) => r.json())

  // 2. Score with the criteria stored for this job
  const criteria = await loadCriteria(application.jobs[0].id)
  const match = await fetch(`${HIRELAYER}/api/v1/matching/job-candidate`, {
    method: 'POST',
    headers: { ...headers, 'Content-Type': 'application/json' },
    body: JSON.stringify({
      job_text: criteria.jobText,
      candidate_text: parsed.info_resume.text,
      matching_criteria: criteria.items,
    }),
  }).then((r) => r.json())

  // 3. Write back to Greenhouse (Harvest v3)
  await fetch('https://harvest.greenhouse.io/v3/notes', {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${await greenhouseToken()}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      candidate_id: application.candidate.id,
      body: `HireLayer score: ${match.score}\n${match.summary}`,
      visibility: 'private',
      note_type: 'NOTE',
    }),
  })
  return 200
}