Connect a form

// Forward a validated form submission to the ATS ingest endpoint.
const enc = new TextEncoder();
const hex = (buf) => [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, "0")).join("");
const sha256 = async (bytes) => hex(await crypto.subtle.digest("SHA-256", bytes));

async function hmacHex(secret, message) {
  const key = await crypto.subtle.importKey(
    "raw", enc.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
  return hex(await crypto.subtle.sign("HMAC", key, enc.encode(message)));
}

/**
 * @param {{ url: string, secret: string }} ats  url like "https://ats.example.com/ats"
 * @param {object} payload  IngestPayload without `files`
 * @param {{ field: string, file: File }[]} uploads
 * @returns {Promise<{ applicationId: string, candidateId: string, duplicate: boolean }>}
 */
export async function sendToAts(ats, payload, uploads = []) {
  const parts = [];
  for (const { field, file } of uploads) {
    const bytes = new Uint8Array(await file.arrayBuffer());
    const meta = { field, filename: file.name || field, contentType: file.type || "application/octet-stream",
                   size: bytes.byteLength, sha256: await sha256(bytes) };
    parts.push({ meta, bytes });
  }
  const json = JSON.stringify({ ...payload, files: parts.map((p) => p.meta) });
  const ts = String(Math.floor(Date.now() / 1000));
  const signature = await hmacHex(ats.secret, `${ts}.${await sha256(enc.encode(json))}`);

  const body = new FormData();
  body.set("payload", json);
  for (const { meta, bytes } of parts) {
    body.append(meta.field, new Blob([bytes], { type: meta.contentType }), meta.filename);
  }
  const res = await fetch(`${ats.url.replace(/\/+$/, "")}/ingest`, {
    method: "POST",
    body,
    headers: { "X-ATS-Timestamp": ts, "X-ATS-Signature": signature },
    signal: AbortSignal.timeout(8000),
  });
  if (!res.ok) throw new Error(`ATS ingest failed: ${res.status} ${await res.text()}`);
  return res.json();
}

import { sendToAts } from "./ats-client.js";

const result = await sendToAts(
  { url: process.env.ATS_URL, secret: process.env.ATS_INGEST_SECRET },
  {
    externalId: submissionId,              // the same id on every retry of this submission
    source: "website",
    site: { id: "main-office", name: "Main office" },
    positionTitle: form.get("position") || undefined,
    applicant: {
      email: form.get("email"),
      firstName: form.get("first_name"),
      lastName: form.get("last_name"),
      phone: form.get("phone") || undefined,
    },
    talentPoolConsent: form.get("talent_pool") === "yes",
    answers: [
      { title: "About you", rows: [
        { key: "first_name", label: "First name", value: form.get("first_name") },
        { key: "work_auth_us", label: "Are you authorized to work in the U.S.?", value: form.get("work_auth_us") },
      ] },
    ],
    submittedAt: new Date().toISOString(),
  },
  [{ field: "resume", file: form.get("resume") }].filter((u) => u.file && u.file.size > 0),
);

SECRET='paste-your-ingest-secret'
URL='https://ats.example.com/ats/ingest'

cat > payload.json <<'EOF'
{"externalId":"curl-test-0001","source":"curl",
 "site":{"id":"main-office","name":"Main office"},
 "positionTitle":"Test role",
 "applicant":{"email":"test.applicant@example.com","firstName":"Test","lastName":"Applicant"},
 "answers":[{"title":"About you","rows":[{"key":"why","label":"Why us?","value":"Testing the integration."}]}]}
EOF

TS=$(date +%s)
PAYLOAD_SHA=$(openssl dgst -sha256 -r payload.json | cut -d' ' -f1)
SIG=$(printf '%s.%s' "$TS" "$PAYLOAD_SHA" | openssl dgst -sha256 -hmac "$SECRET" -r | cut -d' ' -f1)

curl -sS "$URL" \
  -H "X-ATS-Timestamp: $TS" \
  -H "X-ATS-Signature: $SIG" \
  -F "payload=<payload.json"

SIZE=$(wc -c < resume.pdf | tr -d ' ')
FILE_SHA=$(openssl dgst -sha256 -r resume.pdf | cut -d' ' -f1)
cat > payload.json <<EOF
{"externalId":"curl-test-0002","site":{"id":"main-office","name":"Main office"},
 "applicant":{"email":"test.applicant@example.com","firstName":"Test","lastName":"Applicant"},
 "answers":[],
 "files":[{"field":"resume","filename":"resume.pdf","contentType":"application/pdf","size":$SIZE,"sha256":"$FILE_SHA"}]}
EOF
TS=$(date +%s)
PAYLOAD_SHA=$(openssl dgst -sha256 -r payload.json | cut -d' ' -f1)
SIG=$(printf '%s.%s' "$TS" "$PAYLOAD_SHA" | openssl dgst -sha256 -hmac "$SECRET" -r | cut -d' ' -f1)
curl -sS "$URL" -H "X-ATS-Timestamp: $TS" -H "X-ATS-Signature: $SIG" \
  -F "payload=<payload.json" -F "resume=@resume.pdf;type=application/pdf"