Screen Lever applications with HireLayer

import { createHmac, timingSafeEqual } from 'node:crypto'

const LEVER = 'https://api.lever.co/v1'
const HIRELAYER = 'https://hirelayer.co'
const headers = { 'X-API-Key': process.env.HIRELAYER_API_KEY! }
type Resume = { id: string; file: { name: string; uploadedAt: number } }
// Lever: Basic auth, API key as username and an empty password
const lever = {
  Authorization: 'Basic ' + Buffer.from(process.env.LEVER_API_KEY + ':').toString('base64'),
  'Content-Type': 'application/json',
}
const call = (path: string, body?: object) => fetch(LEVER + path,
  body ? { method: 'POST', headers: lever, body: JSON.stringify(body) } : { headers: lever })

export async function handle(rawBody: string) {
  const { token, triggeredAt, signature, data } = JSON.parse(rawBody)
  // HMAC SHA-256 of token + triggeredAt, keyed with the webhook's signature token
  const expected = createHmac('sha256', process.env.LEVER_SIGNATURE_TOKEN!)
    .update(token + triggeredAt).digest('hex')
  if (expected.length !== signature.length ||
    !timingSafeEqual(Buffer.from(expected), Buffer.from(signature))) return 401
  const opp = `/opportunities/${data.opportunityId}`

  // 1. The event has IDs only: find the posting, then the latest resume
  const { data: opportunity } = await call(`${opp}?expand=applications`).then((r) => r.json())
  const posting = opportunity.applications
    .find((a: { id: string }) => a.id === data.applicationId)?.posting
  const { data: resumes } = await call(`${opp}/resumes`).then((r) => r.json())
  const resume = resumes.sort((a: Resume, b: Resume) => b.file.uploadedAt - a.file.uploadedAt)[0]
  if (!posting || !resume) return 200

  // 2. Download through the API and parse (about 35 s)
  const form = new FormData()
  form.append('file', await call(`${opp}/resumes/${resume.id}/download`)
    .then((r) => r.blob()), resume.file.name)
  form.append('application_id', data.applicationId)
  const parsed = await fetch(`${HIRELAYER}/api/v3/parser`, {
    method: 'POST', headers, body: form, signal: AbortSignal.timeout(150_000),
  }).then((r) => r.json())

  // 3. Score with the criteria stored for this posting
  const criteria = await loadCriteria(posting)
  const match = await fetch(`${HIRELAYER}/api/v1/matching/job-candidate`, {
    method: 'POST',
    headers: { ...headers, 'Content-Type': 'application/json' },
    body: JSON.stringify({
      job_text: criteria.jobText,
      candidate_text: parsed.info_resume.text,
      matching_criteria: criteria.items,
    }),
  }).then((r) => r.json())

  // 4. Note and tag on the opportunity
  await call(`${opp}/notes`, {
    value: `HireLayer score: ${Math.round(match.score * 100)}/100\n${match.summary}`,
  })
  if (match.score >= 0.7) await call(`${opp}/addTags`, { tags: ['HireLayer: strong match'] })
  return 200
}