hr_lite 0.61.0 → 0.62.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d57f2981c5062477e62d5cf7518fb074dfedccd73de6338d3263ce57143dd824
-  data.tar.gz: eb27ceb943445189d60db425d2fd7250d89fbb6e118f48b456d0a33eb22dfc4b
+  metadata.gz: 7f779cdbd416cb664617888bbb71b2c6866742b52e3ad5525ac2c5819a9b9908
+  data.tar.gz: 346563b5b820eabc5aec4d83076cb1a3dd37f6309c159ad15c7a3f70698032a3
 SHA512:
-  metadata.gz: 128a548490e3eb5c3028c197eb352e14419d200bbff36c79c7237bb4f355b666dd525ad7a0e54a7d1c8f6814d3b8165e3311215ab8f17dd81ac20460ae47b926
-  data.tar.gz: 84179555ec4cf9ea6623071e0f72da671ff3f17f69f9d4771fbe6a833e6ba77ca6edcab85bbeebbf835d6aee2d2a23ee1f61d1cba42f7f26186e6d61d246ca14
+  metadata.gz: 682e1b50a140c01d357a77666d721629e713dc8c1f97465ea8943c92b8d0cee5a5e47933c98f9451d5e80019bdc548879a27f1c72002279a19ab051500873ce6
+  data.tar.gz: 57fa8aa33593a9f4ac0d88abf82dcc47dd32f666872924038ffb1de4754cb981312fec76e23fcd9706bc31b2aa75a3dc40a42bd25b8d4c947d26705b2f356f2c

data/CHANGELOG.md

@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.62.0] - 2026-10-22
+
+Hiring replies per round, an AI draft button and the sender's signature. Two migrations: a new `hr_lite_hiring_replies` table, and `allow_sunday` on campaigns.
+
+- **Reply links per round.** `@round1_link`, `@round2_link` and `@round3_link` each open the candidate's own `/apply/:token` page for that round, with no login, one reply per link. Every round asks for one of the next ten interview days and one 2-hour slot (10–12, 12–2, 2–4, 4–6, 6–8; at most 4 candidates per slot per day), plus an optional alternate phone. Round 1 also asks for interest, joining time and four yes/no questions. Round 2 asks for a CV and photo ID. Round 3 collects the joining details: marksheets, an Aadhaar number and card, and a PAN number and card. A candidate without a PAN can tick "I don't have a PAN yet", and HR sees "PAN pending". Salary slips for the last 3 months are optional; a fresher ticks "I have no salary slips". A consent box is required. Documents must be PDF, JPG or PNG, checked from the file's bytes, at most 5 MB each. They are encrypted before they reach storage, so a leaked blob is unreadable, and HR downloads them only through an audit-logged route that decrypts them. Aadhaar and PAN numbers are encrypted. HR sees them masked (XXXX XXXX 1234, XXXXX1234X), and "Show full" is an audit-logged POST that shows the number once. Sunday is off unless the campaign ticks "Allow Sunday interviews". A reply moves round 1 candidates to interested or not interested, goes on the timeline, notifies the HR sender, and prefills "Schedule round N". The campaign page shows linked count tiles: invited, replied, interested, and booked for rounds 1, 2 and 3.
+- **Write with AI** on the template form, when the host adds `config.hiring.draft_email(text:, placeholders:)`. It rewrites what HR typed into a template name (if empty), subject and message that use only known @fields, and saves nothing. Output with an unknown field is refused. It is limited to 20 drafts an hour per person and is audit-logged. It posts the same form with `ai=1`, because `formaction` would break per-form CSRF tokens.
+- **Signature preview.** The template preview shows `config.hiring.signature` (sanitized) when the host provides it.
+- **Select all ticks the rows.** "All N in this filter" now ticks and unticks every row, through `select_all.js`.
+
 ## [0.61.0] - 2026-10-21
 
 Hiring panel. Six migrations: five new tables and one that grants `hiring.manage` to HR, Leadership and Super Admin and seeds the first outreach email.

data/README.md

@@ -386,8 +386,12 @@ send_email(to:, subject:, body:)               # => { message_id:, thread_id: }
 create_event(summary:, description:, attendee:, starts_at:, ends_at:) # => { event_id:, meet_link: }
 update_event(event_id:, starts_at:, ends_at:)
 cancel_event(event_id:)
+draft_email(text:, placeholders:)              # optional => { subject:, body: } for "Write with AI"
+signature                                      # optional => the sender's HTML signature, for the preview
 ```
 
+`@round1_link`, `@round2_link` and `@round3_link` point each candidate at their own `/apply/:token` page for that round, on `public_url_base`. The page needs no login. Round 1 asks for interest, joining time and four yes/no questions. Every round asks for a day, one 2-hour slot and an optional alternate phone. Rounds 2 and 3 ask for documents. Sunday is offered only when the campaign allows it.
+
 Raise `HrLite::HiringDeliveryFailed` when nothing was sent and `HrLite::HiringDeliveryUnknown` when the provider may have acted (timeouts, 5xx). Never put the recipient in the error text: it is stored. `config.read_sheet = ->(path, filename) { rows }` reads uploads (default: .csv).
 
 ## Recurring jobs

data/app/assets/javascripts/hr_lite/select_all.js

@@ -0,0 +1,21 @@
+// "Select all" for a list of checkboxes in one form.
+// Markup contract: <input type="checkbox" data-hrl-select-all="candidate_ids[]">.
+// Ticking it ticks every box of that name in the same form; unticking any row
+// unticks it again. The server still reads the box itself, so it works without JS.
+(function () {
+  "use strict";
+
+  document.addEventListener("change", function (event) {
+    var box = event.target;
+    var form = box.form;
+    if (!form) return;
+    var all = form.querySelector("[data-hrl-select-all]");
+    if (!all) return;
+    var rows = form.querySelectorAll('input[name="' + all.getAttribute("data-hrl-select-all") + '"]');
+    if (box === all) {
+      rows.forEach(function (row) { row.checked = all.checked; });
+    } else if (box.name === all.getAttribute("data-hrl-select-all") && !box.checked) {
+      all.checked = false;
+    }
+  });
+})();

data/app/assets/stylesheets/hr_lite/hr_lite.css

@@ -673,3 +673,9 @@ a.hrl-tree__name { display: inline-flex; align-items: center; min-height: var(--
 .hrl-steps .is-now .hrl-steps__dot { background: var(--hrl-accent); border-color: var(--hrl-accent); color: var(--hrl-accent-ink); }
 .hrl-steps .is-now { font-weight: 700; color: var(--hrl-accent); }
 .hrl-mail__head { display: grid; gap: var(--hrl-s-2); padding-bottom: var(--hrl-s-3); margin-bottom: var(--hrl-s-3); border-bottom: 1px solid var(--hrl-line); overflow-wrap: anywhere; }
+/* The candidate reply page: no staff shell, one readable column. */
+.hrl-public { max-width: 40rem; margin: 0 auto; padding: var(--hrl-s-6) var(--hrl-gutter) calc(var(--hrl-s-10) + env(safe-area-inset-bottom)); }
+.hrl-hiring-signature { margin-top: var(--hrl-s-3); padding-top: var(--hrl-s-3); border-top: 1px dashed var(--hrl-line); font-size: var(--hrl-t-small); overflow-wrap: anywhere; }
+.hrl-public__logo { display: block; height: 40px; width: auto; margin-bottom: var(--hrl-s-4); }
+.hrl-kpi--link { display: block; min-height: var(--hrl-target); color: inherit; text-decoration: none; }
+.hrl-kpi--link:hover { border-color: var(--hrl-accent); }

data/app/controllers/hr_lite/admin/hiring_campaigns_controller.rb

@@ -2,7 +2,7 @@ module HrLite
   module Admin
     # Hiring drives: the list, one campaign's pipeline, and its sheet import.
     class HiringCampaignsController < ApplicationController
-      FIELDS = %i[title position programme stipend ctc location schedule status].freeze
+      FIELDS = %i[title position programme stipend ctc location schedule status allow_sunday].freeze
 
       before_action { hr_require_permission!("hiring.manage", scope: :all) }
       before_action :set_campaign, except: %i[index new create]
@@ -15,9 +15,17 @@ module HrLite
       def show
         @stage = params[:stage].presence_in(HiringCandidate::STAGES)
         @campus = params[:campus].presence
+        @replied = params[:replied].presence
+        @round = params[:round].to_i.presence_in([ 1, 2, 3 ])
         @stage_counts = @campaign.candidates.group(:stage).count
+        replies = HiringReply.responded.where(candidate_id: @campaign.candidates.select(:id))
+        # Each tile's count is exactly what its link lists.
+        @kpis = { "Awaiting reply" => [ @stage_counts["invited"].to_i, { stage: "invited" } ],
+                  "Replied" => [ replies.distinct.count(:candidate_id), { replied: 1 } ],
+                  "Interested" => [ @stage_counts["interested"].to_i, { stage: "interested" } ] }
+        (1..3).each { |r| @kpis["Booked round #{r}"] = [ replies.where(round: r).where.not(preferred_slot: nil).count, { round: r } ] }
         @campuses = @campaign.candidates.where.not(campus: [ nil, "" ]).distinct.order(:campus).pluck(:campus)
-        @candidates = paginate(@campaign.pipeline(stage: @stage, campus: @campus))
+        @candidates = paginate(@campaign.pipeline(stage: @stage, campus: @campus, replied: @replied, round: @round))
         @templates = HiringTemplate.alphabetical
         @attention = HiringMessage.joins(:candidate).where(hr_lite_hiring_candidates: { campaign_id: @campaign.id })
                                   .where(status: %w[failed unknown sending]).includes(:candidate, :template).limit(50)

data/app/controllers/hr_lite/admin/hiring_candidates_controller.rb

@@ -13,6 +13,29 @@ module HrLite
         @messages = @candidate.messages.includes(:template).order(:created_at)
         @interviews = @candidate.interviews.order(:round, :created_at)
         @timeline = @candidate.timeline.limit(100)
+        @replies = @candidate.replies.responded.order(:round).with_attached_documents
+        next_round = [ @candidate.round, *@interviews.select { |i| %w[scheduled unknown].include?(i.status) }.map(&:round) ].max + 1
+        @next_reply = @replies.find { |r| r.round == next_round && r.preferred_slot }
+      end
+
+      # A document from the candidate's reply, streamed only to hiring.manage and audit-logged.
+      def document
+        attachment = ActiveStorage::Attachment.find_by!(id: params[:attachment_id], record_type: "HrLite::HiringReply",
+                                                        record_id: @candidate.replies.select(:id))
+        AuditLog.record!(action: "hiring.document_viewed", subject: @candidate, changes: { "attachment" => attachment.id })
+        bytes = attachment.record.read_document(attachment)
+        send_data bytes, filename: attachment.filename.to_s.split("--", 2).last, disposition: "attachment",
+                         type: Marcel::MimeType.for(StringIO.new(bytes), name: attachment.filename.to_s)
+      end
+
+      # The full Aadhaar or PAN, shown once on this render, audit-logged; never stored in the session.
+      def reveal
+        reply = @candidate.replies.find(params[:reply_id])
+        field = params[:field].presence_in(%w[aadhaar pan]) or raise ActiveRecord::RecordNotFound
+        AuditLog.record!(action: "hiring.kyc_revealed", subject: @candidate, changes: { "field" => field, "round" => reply.round })
+        @revealed = { reply.id => { field => (field == "aadhaar" ? reply.aadhaar_number : reply.pan_number) } }
+        show
+        render :show
       end
 
       def stage

data/app/controllers/hr_lite/admin/hiring_sends_controller.rb

@@ -48,7 +48,7 @@ module HrLite
         @campaign = HiringCampaign.find(params[:hiring_campaign_id])
         @template = HiringTemplate.find(params[:template_id])
         @sender = HrLite.config.hiring&.sender
-        scope = params[:all].present? ? @campaign.pipeline(stage: params[:stage], campus: params[:campus]) : @campaign.pipeline.where(id: Array(params[:candidate_ids]))
+        scope = params[:all].present? ? @campaign.pipeline(stage: params[:stage], campus: params[:campus], replied: params[:replied], round: params[:round].to_i.presence_in([ 1, 2, 3 ])) : @campaign.pipeline.where(id: Array(params[:candidate_ids]))
         already = HiringMessage.where(template: @template, candidate_id: scope.select(:id)).pluck(:candidate_id).to_set
         @recipients, @left_out = [], []
         scope.includes(:campaign, :interviews).each do |candidate|

data/app/controllers/hr_lite/admin/hiring_templates_controller.rb

@@ -5,12 +5,16 @@ module HrLite
     class HiringTemplatesController < ApplicationController
       before_action { hr_require_permission!("hiring.manage", scope: :all) }
       before_action(only: %i[edit update]) { @template = HiringTemplate.find(params[:id]) }
+      # "Write with AI" posts the same form with ai=1 (formaction would break per-form CSRF tokens).
+      rate_limit to: 20, within: 1.hour, only: %i[create update], if: -> { params[:ai].present? }, name: "hiring_ai_draft", by: -> { hr_current_user.id },
+                 with: -> { redirect_to hr_lite.admin_hiring_templates_path, alert: "Twenty AI drafts an hour is the limit. Try again later." }
 
       def index = @templates = HiringTemplate.alphabetical
       def new = @template = HiringTemplate.new
 
       def create
         @template = HiringTemplate.new(template_params)
+        return draft if params[:ai].present?
         return render(:new, status: :unprocessable_entity) unless @template.save
 
         redirect_to hr_lite.edit_admin_hiring_template_path(@template), notice: "Saved."
@@ -19,6 +23,7 @@ module HrLite
       def edit = load_preview
 
       def update
+        return draft if params[:ai].present?
         return load_preview && render(:edit, status: :unprocessable_entity) unless @template.update(template_params)
 
         redirect_to hr_lite.edit_admin_hiring_template_path(@template), notice: "Saved."
@@ -26,6 +31,27 @@ module HrLite
 
       private
 
+      # "Write with AI": rewrites what HR typed into a clean email that uses
+      # only known @fields. Nothing is saved; HR reviews it, then saves.
+      def draft
+        @template.assign_attributes(template_params)
+        apply_ai_draft
+        @template.persisted? ? load_preview && render(:edit) : render(:new)
+      end
+
+      def apply_ai_draft
+        out = HrLite.config.hiring.draft_email(text: "Subject: #{@template.subject}\n\n#{@template.body}", placeholders: HiringMerge::RESERVED)
+        unknown = HiringMerge.tokens("#{out[:subject]} #{out[:body]}") - HiringMerge::RESERVED
+        raise HrLite::HiringDeliveryFailed, "it used unknown fields (#{unknown.map { |t| "@#{t}" }.join(', ')})" if unknown.any?
+
+        @template.assign_attributes(subject: out[:subject], body: out[:body])
+        @template.name = out[:name] if @template.name.blank? && out[:name].present?
+        AuditLog.record!(action: "hiring.ai_draft", subject: @template)
+        flash.now[:notice] = "AI draft ready. Check it, then save."
+      rescue HrLite::HiringDeliveryFailed, HrLite::HiringDeliveryUnknown => e
+        flash.now[:alert] = "AI could not draft this: #{e.message}"
+      end
+
       def load_preview
         @sample = HiringCandidate.includes(:campaign, :interviews).order(updated_at: :desc).limit(200).to_a
         @preview_for = @sample.find { |c| c.id == params[:candidate_id].to_i } || @sample.first

data/app/controllers/hr_lite/hiring_replies_controller.rb

@@ -0,0 +1,32 @@
+module HrLite
+  # The candidate's own page for one interview round, from @round1_link …
+  # @round3_link: their day and slot, round 1's interest questions, and from
+  # round 2 their documents. One reply per link.
+  class HiringRepliesController < ApplicationController
+    # WHY no login: candidates have no account. The unguessable 24-character
+    # token in their link is the key, and it opens only that one reply.
+    skip_before_action :hr_authenticate!
+    skip_before_action HrLite.config.authenticate_method, raise: false
+    layout "hr_lite/public"
+    rate_limit to: 10, within: 1.hour, only: :create, name: "hiring_reply",
+               with: -> { redirect_to hr_lite.hiring_reply_path(params[:token]), alert: "Too many tries. Please try again in an hour." }
+
+    before_action do
+      @reply = HiringReply.includes(candidate: :campaign).find_by!(token: params[:token].to_s)
+      @candidate = @reply.candidate
+    end
+
+    def show; end
+
+    def create
+      @reply.submit!(interested: params[:interested].to_s, date: params[:date], slot: params[:slot], joining: params[:joining],
+                     yes_no: params.permit(*HiringReply::YES_NO.keys).to_h, alternate_phone: params[:alternate_phone].to_s.strip,
+                     files: params.fetch(:documents, {}).permit(*HiringReply::DOCUMENTS.fetch(@reply.round, {}).keys).to_h,
+                     kyc: params.permit(:aadhaar_number, :pan_number, :pan_pending, :no_salary_slips, :consent).to_h.symbolize_keys)
+      redirect_to hr_lite.hiring_reply_path(@reply.token)
+    rescue ArgumentError => e
+      flash.now[:alert] = e.message
+      render :show, status: :unprocessable_entity
+    end
+  end
+end

data/app/models/hr_lite/hiring_campaign.rb

@@ -11,8 +11,10 @@ module HrLite
     scope :newest_first, -> { order(created_at: :desc) }
 
     # The pipeline list and "select all" on it are the same filter.
-    def pipeline(stage: nil, campus: nil)
+    def pipeline(stage: nil, campus: nil, replied: nil, round: nil)
       scope = candidates
+      scope = scope.where(id: HiringReply.responded.select(:candidate_id)) if replied.present?
+      scope = scope.where(id: HiringReply.responded.where(round: round).where.not(preferred_slot: nil).select(:candidate_id)) if round.present?
       scope = scope.where(stage: stage) if stage.presence_in(HiringCandidate::STAGES)
       scope = scope.where(campus: campus) if campus.present?
       scope.order(:name, :id)

data/app/models/hr_lite/hiring_candidate.rb

@@ -19,6 +19,7 @@ module HrLite
     belongs_to :campaign, class_name: "HrLite::HiringCampaign", inverse_of: :candidates
     has_many :messages, class_name: "HrLite::HiringMessage", foreign_key: :candidate_id, dependent: :restrict_with_error
     has_many :interviews, class_name: "HrLite::HiringInterview", foreign_key: :candidate_id, dependent: :restrict_with_error
+    has_many :replies, class_name: "HrLite::HiringReply", foreign_key: :candidate_id, inverse_of: :candidate, dependent: :restrict_with_error
 
     encrypts :phone, :date_of_birth
     normalizes :email, with: ->(email) { email.to_s.strip.downcase }
@@ -33,7 +34,7 @@ module HrLite
 
     # The one door for a stage change: refuses a move the pipeline does not
     # allow, needs a listed reason to reject, and writes the timeline row.
-    def move_to!(to, reason: nil, note: nil, round: self.round)
+    def move_to!(to, reason: nil, note: nil, round: self.round, actor: HrLite::Current.actor)
       raise ArgumentError, "#{stage_label} cannot move to #{to.humanize}." unless MOVES.fetch(stage).include?(to)
       raise ArgumentError, "Pick a rejection reason." if to == "rejected" && !REJECTION_REASONS.include?(reason)
       raise ArgumentError, "Write a note for “Other”." if reason == "Other" && note.blank?
@@ -41,10 +42,13 @@ module HrLite
       transaction do
         from = stage
         update!(stage: to, round: round, rejection_reason: (to == "rejected" ? [ reason, note.presence ].compact.join(": ") : rejection_reason))
-        log!("stage", from: from, to: to, reason: (reason if to == "rejected"))
+        log!("stage", actor: actor, from: from, to: to, reason: (reason if to == "rejected"))
       end
     end
 
+    # This round's reply link, made on first use (a template that names it).
+    def reply_for(round) = replies.find_or_create_by!(round: round)
+
     def log!(action, actor: HrLite::Current.actor, **changes)
       AuditLog.record!(action: "hiring.#{action}", subject: self, actor: actor, changes: changes.compact)
     end

data/app/models/hr_lite/hiring_reply.rb

@@ -0,0 +1,144 @@
+module HrLite
+  # A candidate's reply link for one interview round (@round1_link … @round3_link):
+  # the day and 2-hour slot they can do, an optional alternate phone, round 1's
+  # interest questions, and from round 2 their documents. One reply per link.
+  class HiringReply < ApplicationRecord
+    SLOTS = { "10-12" => "10 AM – 12 PM", "12-2" => "12 – 2 PM", "2-4" => "2 – 4 PM", "4-6" => "4 – 6 PM", "6-8" => "6 – 8 PM" }.freeze
+    SLOT_START = { "10-12" => "10:00", "12-2" => "12:00", "2-4" => "14:00", "4-6" => "16:00", "6-8" => "18:00" }.freeze
+    SLOT_CAPACITY = 4 # candidates per slot per day; HR calls each to confirm
+    JOINING = { "immediately" => "Immediately", "two_weeks" => "Within 2 weeks", "one_month" => "Within a month" }.freeze
+    YES_NO = { "stipend_ok" => "Fine with the stipend", "location_ok" => "Fine with the office location",
+               "schedule_ok" => "Fine with the schedule", "programme_ok" => "Commits to the programme" }.freeze
+    DOCUMENTS = { 2 => { "cv" => "CV", "photo_id" => "Photo ID" },
+                  3 => { "marksheets" => "Marksheets", "aadhaar" => "Aadhaar card", "pan" => "PAN card",
+                         "salary_slip_1" => "Salary slip (last month)", "salary_slip_2" => "Salary slip (2 months ago)",
+                         "salary_slip_3" => "Salary slip (3 months ago)" } }.freeze
+    PAN_FORMAT = /\A[A-Z]{5}[0-9]{4}[A-Z]\z/
+    # Verhoeff tables, for the Aadhaar check digit.
+    VERHOEFF_D = [ [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9 ], [ 1, 2, 3, 4, 0, 6, 7, 8, 9, 5 ], [ 2, 3, 4, 0, 1, 7, 8, 9, 5, 6 ],
+                   [ 3, 4, 0, 1, 2, 8, 9, 5, 6, 7 ], [ 4, 0, 1, 2, 3, 9, 5, 6, 7, 8 ], [ 5, 9, 8, 7, 6, 0, 4, 3, 2, 1 ],
+                   [ 6, 5, 9, 8, 7, 1, 0, 4, 3, 2 ], [ 7, 6, 5, 9, 8, 2, 1, 0, 4, 3 ], [ 8, 7, 6, 5, 9, 3, 2, 1, 0, 4 ],
+                   [ 9, 8, 7, 6, 5, 4, 3, 2, 1, 0 ] ].freeze
+    VERHOEFF_P = [ [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9 ], [ 1, 5, 7, 6, 2, 8, 3, 0, 9, 4 ], [ 5, 8, 0, 3, 7, 9, 6, 1, 4, 2 ],
+                   [ 8, 9, 1, 6, 0, 4, 3, 5, 2, 7 ], [ 9, 4, 5, 3, 1, 2, 6, 8, 7, 0 ], [ 4, 2, 8, 6, 5, 7, 3, 9, 0, 1 ],
+                   [ 2, 7, 9, 3, 8, 0, 6, 4, 1, 5 ], [ 7, 0, 4, 6, 9, 1, 3, 2, 5, 8 ] ].freeze
+    DOCUMENT_TYPES = %w[application/pdf image/jpeg image/png].freeze
+    DOCUMENT_MAX = 5.megabytes
+
+    belongs_to :candidate, class_name: "HrLite::HiringCandidate", inverse_of: :replies
+    has_many_attached :documents
+    encrypts :alternate_phone, :aadhaar_number, :pan_number
+    has_secure_token :token, length: 24
+
+    validates :round, inclusion: { in: 1..3 }
+
+    scope :responded, -> { where.not(responded_at: nil) }
+
+    def self.slot_full?(date, slot) = responded.where(preferred_date: date, preferred_slot: slot).count >= SLOT_CAPACITY
+
+    # The next ten interview days. Sunday is off unless the campaign allows it.
+    def self.dates(allow_sunday:, from: Date.current) = (1..20).map { |i| from + i }.reject { |d| d.sunday? && !allow_sunday }.first(10)
+
+    def self.aadhaar_valid?(number)
+      number.to_s.match?(/\A[2-9]\d{11}\z/) &&
+        number.reverse.chars.each_with_index.reduce(0) { |c, (digit, i)| VERHOEFF_D[c][VERHOEFF_P[i % 8][digit.to_i]] }.zero?
+    end
+
+    # What this round asks for; round 3 skips PAN and slips the candidate says they lack.
+    def documents_asked
+      asked = DOCUMENTS.fetch(round, {})
+      asked = asked.except("pan") if pan_pending
+      asked = asked.except("salary_slip_1", "salary_slip_2", "salary_slip_3") if no_salary_slips
+      asked
+    end
+
+    def masked_aadhaar = aadhaar_number && "XXXX XXXX #{aadhaar_number.last(4)}"
+    def masked_pan = pan_number && "XXXXX#{pan_number[5, 4]}X"
+
+    # Documents are stored encrypted; this is the only way back to the bytes.
+    def read_document(attachment) = ActiveRecord::Encryption.encryptor.decrypt(attachment.download)
+    def document_label(attachment) = documents_asked[attachment.filename.to_s.split("--").first] || "Document"
+
+    # Saves the reply, moves round 1's candidate to interested / not interested,
+    # puts it on their timeline and rings the HR person who emailed them.
+    def submit!(interested: nil, date: nil, slot: nil, joining: nil, yes_no: {}, alternate_phone: nil, files: {}, kyc: {})
+      raise ArgumentError, "You have already replied. Thank you." if responded_at
+
+      assign_kyc!(kyc) if round == 3
+
+      declined = round == 1 && interested == "no"
+      raise ArgumentError, "Tell us whether you want to go ahead." if round == 1 && !%w[yes no].include?(interested)
+
+      answers = round == 1 ? { "interested" => interested } : {}
+      unless declined
+        date = self.class.dates(allow_sunday: candidate.campaign.allow_sunday).find { |day| day.iso8601 == date.to_s }
+        raise ArgumentError, "Pick a day for the interview." unless date
+        raise ArgumentError, "Pick a time slot." unless SLOTS.key?(slot)
+        raise ArgumentError, "That slot just filled up. Pick another one." if self.class.slot_full?(date, slot)
+        raise ArgumentError, "That phone number does not look right." if alternate_phone.present? && !alternate_phone.to_s.gsub(/[\s-]/, "").match?(/\A\+?\d{7,15}\z/)
+
+        if round == 1
+          raise ArgumentError, "Tell us how soon you can join." unless JOINING.key?(joining)
+
+          answers.merge!("joining" => joining, **YES_NO.keys.to_h { |key| [ key, yes_no[key] == "yes" ? "yes" : "no" ] })
+        end
+        check_files!(files)
+      end
+
+      transaction do
+        update!(responded_at: Time.current, answers: answers, alternate_phone: alternate_phone.presence,
+                preferred_date: (date unless declined), preferred_slot: (slot unless declined))
+        files.slice(*documents_asked.keys).each do |kind, file|
+          # Encrypted before it reaches storage: a leaked blob is ciphertext.
+          cipher = ActiveRecord::Encryption.encryptor.encrypt(file.tempfile.read.b)
+          documents.attach(io: StringIO.new(cipher), filename: "#{kind}--#{file.original_filename}", content_type: "application/octet-stream",
+                           identify: false)
+        end
+        if round == 1
+          to = declined ? "not_interested" : "interested"
+          candidate.move_to!(to, actor: nil) if HiringCandidate::MOVES.fetch(candidate.stage).include?(to)
+        end
+        candidate.log!("replied", actor: nil, round: round, interested: answers["interested"],
+                                  slot: ([ date.strftime("%-d %b"), SLOTS[slot] ].join(", ") unless declined))
+      end
+      notify_sender
+    end
+
+    private
+
+    # Round 3's joining KYC. Errors name the field, never the number.
+    def assign_kyc!(kyc)
+      raise ArgumentError, "Tick the consent box to share your documents." unless kyc[:consent] == "1"
+
+      aadhaar = kyc[:aadhaar_number].to_s.gsub(/\s/, "")
+      raise ArgumentError, "That Aadhaar number does not look right." unless self.class.aadhaar_valid?(aadhaar)
+
+      self.pan_pending = kyc[:pan_pending] == "1"
+      pan = kyc[:pan_number].to_s.strip.upcase
+      raise ArgumentError, "That PAN does not look right." unless pan_pending || pan.match?(PAN_FORMAT)
+
+      self.no_salary_slips = kyc[:no_salary_slips] == "1"
+      self.aadhaar_number = aadhaar
+      self.pan_number = (pan unless pan_pending)
+    end
+
+    # Every asked document, a real PDF/JPG/PNG (read from the bytes, not the
+    # browser's claim), at most 5 MB.
+    def check_files!(files)
+      documents_asked.each do |kind, label|
+        file = files[kind]
+        raise ArgumentError, "Attach your #{label}." unless file.respond_to?(:original_filename)
+        raise ArgumentError, "#{label} must be a PDF, JPG or PNG." unless DOCUMENT_TYPES.include?(sniff(file))
+        raise ArgumentError, "#{label} must be 5 MB or smaller." if file.size > DOCUMENT_MAX
+      end
+    end
+
+    def sniff(file) = Marcel::MimeType.for(file.tempfile, name: file.original_filename).tap { file.tempfile.rewind }
+
+    def notify_sender
+      user = candidate.messages.where(status: "sent").order(:sent_at).last&.sent_by or return
+      HrLite.notify(user: user, kind: "hiring.reply", body: candidate.campaign.title, path: "/admin/hiring_candidates/#{candidate_id}",
+                    title: "#{candidate.name} replied to round #{round}#{": #{answers['interested'] == 'yes' ? 'interested' : 'not interested'}" if round == 1}")
+    end
+  end
+end

data/app/services/hr_lite/hiring_merge.rb

@@ -6,11 +6,14 @@ module HrLite
     TOKEN = /(?<![\w.@])@([a-z][a-z0-9_]*)/
     GROUPS = { "Candidate" => %w[first_name name course branch campus],
                "Offer" => %w[position programme stipend ctc location schedule],
-               "Interview" => %w[interview_date interview_time meet_link sender_name] }.freeze
+               "Interview" => %w[interview_date interview_time meet_link sender_name],
+               "Reply links" => %w[round1_link round2_link round3_link] }.freeze
     RESERVED = GROUPS.values.flatten.freeze
 
     Result = Data.define(:subject, :body, :missing)
 
+    def self.tokens(text) = text.to_s.scan(TOKEN).flatten.uniq
+
     def initialize(candidate, sender_name:)
       @extra = candidate.extra.to_h.transform_keys(&:to_s)
       @values = @extra.merge(reserved(candidate, sender_name))
@@ -21,7 +24,8 @@ module HrLite
       fill = ->(text) {
         text.to_s.gsub(TOKEN) do
           key = Regexp.last_match(1)
-          value = @values[key].to_s.strip
+          value = @values[key]
+          value = (value.respond_to?(:call) ? value.call : value).to_s.strip
           next value unless value.empty?
 
           missing << "@#{key} (#{RESERVED.include?(key) || @extra.key?(key) ? 'empty' : 'unknown'})"
@@ -42,7 +46,9 @@ module HrLite
         "programme" => campaign.programme, "stipend" => campaign.stipend, "ctc" => campaign.ctc,
         "location" => campaign.location, "schedule" => campaign.schedule,
         "interview_date" => at&.strftime("%-d %B %Y"), "interview_time" => at&.strftime("%-l:%M %p"),
-        "meet_link" => interview&.meet_link, "sender_name" => sender_name }
+        "meet_link" => interview&.meet_link, "sender_name" => sender_name,
+        # Lazy: a round's link (and its row) is made only when a template names it.
+        **(1..3).to_h { |r| [ "round#{r}_link", -> { HrLite.public_url("/apply/#{candidate.reply_for(r).token}") } ] } }
     end
   end
 end

data/app/views/hr_lite/admin/hiring_campaigns/_form.html.erb

@@ -8,6 +8,7 @@
   <div class="hrl-field"><%= f.label :ctc, "Full-time CTC" %><%= f.text_field :ctc %></div>
   <div class="hrl-field"><%= f.label :location, "Work location" %><%= f.text_area :location, rows: 2 %></div>
   <div class="hrl-field"><%= f.label :schedule, "Work schedule" %><%= f.text_field :schedule %></div>
+  <div class="hrl-field"><label class="hrl-field--check"><%= f.check_box :allow_sunday %> Allow Sunday interviews (Sunday is off by default)</label></div>
   <% if campaign.persisted? %>
     <div class="hrl-field"><%= f.label :status %><%= f.select :status, [ %w[Open open], %w[Closed closed] ] %></div>
   <% end %>

data/app/views/hr_lite/admin/hiring_campaigns/show.html.erb

@@ -17,6 +17,12 @@
   </section>
 <% end %>
 
+<div class="hrl-kpis">
+  <% @kpis.each do |label, (count, filter)| %>
+    <a class="hrl-kpi hrl-kpi--link" href="<%= hr_lite.admin_hiring_campaign_path(@campaign, filter) %>"><div class="hrl-kpi__value"><%= count %></div><div class="hrl-kpi__label"><%= label %></div></a>
+  <% end %>
+</div>
+
 <% if @attention.any? %>
   <section class="hrl-card hrl-card--warn">
     <h2 class="hrl-card__title">Emails that need a look</h2>
@@ -56,6 +62,8 @@
         </select>
       </div>
     <% end %>
+    <label class="hrl-field--check"><input type="checkbox" name="replied" value="1" <%= "checked" if @replied %>> Replied via link</label>
+    <input type="hidden" name="round" value="<%= @round %>">
     <div class="hrl-form-actions"><button class="hrl-btn" type="submit">Filter</button></div>
   </form>
 </section>
@@ -72,8 +80,8 @@
             <% @templates.each do |template| %><option value="<%= template.id %>"><%= template.name %></option><% end %>
           </select>
         </div>
-        <label class="hrl-field--check"><input type="checkbox" name="all" value="1"> All <%= @total_count %> in this filter</label>
-        <input type="hidden" name="stage" value="<%= @stage %>"><input type="hidden" name="campus" value="<%= @campus %>">
+        <label class="hrl-field--check"><input type="checkbox" name="all" value="1" data-hrl-select-all="candidate_ids[]"> All <%= @total_count %> in this filter</label>
+        <input type="hidden" name="stage" value="<%= @stage %>"><input type="hidden" name="campus" value="<%= @campus %>"><input type="hidden" name="replied" value="<%= @replied %>"><input type="hidden" name="round" value="<%= @round %>">
         <div class="hrl-form-actions"><button class="hrl-btn hrl-btn--primary" type="submit">Review email</button></div>
       </div>
       <div class="hrl-table-wrap">

data/app/views/hr_lite/admin/hiring_candidates/show.html.erb

@@ -33,8 +33,10 @@
         <p class="hrl-small hrl-muted">Next step</p>
         <h2 class="hrl-card__title">Schedule round <%= @interviews.select { |i| %w[scheduled unknown].include?(i.status) }.map(&:round).max.to_i + 1 %></h2>
         <%= form_with url: hr_lite.admin_hiring_candidate_hiring_interviews_path(@candidate), method: :post, local: true do %>
-          <div class="hrl-field"><label for="date">Date</label><input type="date" name="date" id="date" required></div>
-          <div class="hrl-field"><label for="time">Time</label><input type="time" name="time" id="time" required></div>
+          <% picked = @next_reply %>
+          <% if picked %><p class="hrl-small">They picked <strong><%= picked.preferred_date.strftime("%A, %-d %B") %>, <%= HrLite::HiringReply::SLOTS[picked.preferred_slot] %></strong>. Call to confirm, then send the invite.</p><% end %>
+          <div class="hrl-field"><label for="date">Date</label><input type="date" name="date" id="date" required value="<%= picked&.preferred_date&.iso8601 %>"></div>
+          <div class="hrl-field"><label for="time">Time</label><input type="time" name="time" id="time" required value="<%= HrLite::HiringReply::SLOT_START[picked&.preferred_slot] %>"></div>
           <div class="hrl-field">
             <label for="minutes">Length</label>
             <select name="minutes" id="minutes"><% HrLite::Admin::HiringInterviewsController::LENGTHS.each do |m| %><option value="<%= m %>"><%= m %> minutes</option><% end %></select>
@@ -80,6 +82,45 @@
     <% end %>
   </div>
 
+  <% @replies.each do |reply| %>
+    <section class="hrl-card">
+      <h2 class="hrl-card__title">Round <%= reply.round %> reply</h2>
+      <dl class="hrl-deflist">
+        <% if reply.round == 1 %><dt>Interested</dt><dd><%= reply.answers["interested"] == "yes" ? "Yes" : "No" %></dd><% end %>
+        <% if reply.preferred_slot %><dt>Slot</dt><dd><%= reply.preferred_date.strftime("%A, %-d %B") %>, <%= HrLite::HiringReply::SLOTS[reply.preferred_slot] %></dd><% end %>
+        <% if reply.answers["joining"] %>
+          <dt>Can join</dt><dd><%= HrLite::HiringReply::JOINING[reply.answers["joining"]] %></dd>
+          <% HrLite::HiringReply::YES_NO.each do |key, label| %><dt><%= label %></dt><dd><%= reply.answers[key] == "yes" ? "Yes" : "No" %></dd><% end %>
+        <% end %>
+        <% if reply.round == 3 %>
+          <% { "aadhaar" => [ "Aadhaar", reply.masked_aadhaar ], "pan" => [ "PAN", reply.masked_pan ] }.each do |field, (label, masked)| %>
+            <dt><%= label %></dt>
+            <dd>
+              <% if (full = @revealed&.dig(reply.id, field)) %>
+                <strong><%= full %></strong>
+              <% elsif masked %>
+                <%= masked %>
+                <%= button_to "Show full #{label}", hr_lite.reveal_admin_hiring_candidate_path(@candidate), params: { reply_id: reply.id, field: field }, class: "hrl-btn" %>
+              <% else %>
+                <span class="hrl-badge hrl-badge--warn">PAN pending: collect at joining</span>
+              <% end %>
+            </dd>
+          <% end %>
+          <% if reply.no_salary_slips %><dt>Salary slips</dt><dd>None (fresher)</dd><% end %>
+        <% end %>
+        <% if reply.alternate_phone.present? %><dt>Alternate phone</dt><dd><a class="hrl-btn" href="tel:<%= reply.alternate_phone.gsub(/[^\d+]/, "") %>">Call <%= reply.alternate_phone %></a></dd><% end %>
+        <dt>Replied</dt><dd><%= reply.responded_at.strftime("%-d %b %Y, %-l:%M %p") %></dd>
+      </dl>
+      <% if reply.documents.attached? %>
+        <div class="hrl-form-actions">
+          <% reply.documents.each do |doc| %>
+            <a class="hrl-btn" href="<%= hr_lite.document_admin_hiring_candidate_path(@candidate, attachment_id: doc.id) %>"><%= reply.document_label(doc) %></a>
+          <% end %>
+        </div>
+      <% end %>
+    </section>
+  <% end %>
+
   <section class="hrl-card">
     <h2 class="hrl-card__title">Profile from the sheet</h2>
     <dl class="hrl-deflist">

data/app/views/hr_lite/admin/hiring_templates/_form.html.erb

@@ -1,8 +1,12 @@
 <%= form_with model: template, url: (template.persisted? ? hr_lite.admin_hiring_template_path(template) : hr_lite.admin_hiring_templates_path), local: true do |f| %>
   <%= render "hr_lite/shared/form_errors", record: template %>
-  <div class="hrl-field"><%= f.label :name %><%= f.text_field :name, required: true %></div>
+  <div class="hrl-field"><%= f.label :name, "Template name" %><%= f.text_field :name, required: true %></div>
   <div class="hrl-field"><%= f.label :subject %><%= f.text_field :subject, required: true %></div>
   <div class="hrl-field"><%= f.label :body, "Message" %><%= f.text_area :body, rows: 16, required: true %></div>
+  <% if HrLite.config.hiring.respond_to?(:draft_email) %>
+    <button class="hrl-btn" type="submit" name="ai" value="1" formnovalidate>Write with AI</button>
+    <p class="hrl-small hrl-muted">Paste or type the email the way you would write it to one person. AI fixes the format, names the template if it has no name yet, writes the subject, and swaps names and offer details for the fields below. Nothing is saved until you click Save.</p>
+  <% end %>
   <h3 class="hrl-small"><strong>Fields, filled per candidate</strong></h3>
   <% HrLite::HiringMerge::GROUPS.each do |group, names| %>
     <p class="hrl-small hrl-muted"><%= group %></p>

data/app/views/hr_lite/admin/hiring_templates/edit.html.erb

@@ -31,6 +31,9 @@
           <span class="hrl-small hrl-muted"><%= HrLite.config.hiring&.sender&.dig(:email) || "The hiring mailbox" %> to <%= @preview_for.email %></span>
         </div>
         <div class="hrl-hiring-preview"><%= @preview.body %></div>
+        <% if (signature = HrLite.config.hiring.try(:signature)).present? %>
+          <div class="hrl-hiring-signature"><%= sanitize(signature) %></div>
+        <% end %>
       </article>
       <p class="hrl-small hrl-muted">Sent as plain text through Gmail, so it lands in the mailbox's Sent folder.</p>
     <% else %>

data/app/views/hr_lite/hiring_replies/show.html.erb

@@ -0,0 +1,105 @@
+<% campaign = @candidate.campaign %>
+<% round = @reply.round %>
+<% content_for(:page_title) { campaign.position } %>
+<div class="hrl-page__head">
+  <h1 class="hrl-page__title"><%= campaign.position %></h1>
+  <p class="hrl-page__sub">Hi <%= @candidate.first_name %>, <%= round == 1 ? "thank you for your interest." : "congratulations on reaching round #{round}." %></p>
+</div>
+
+<% if @reply.responded_at %>
+  <section class="hrl-card">
+    <h2 class="hrl-card__title">Thanks, we have your answers</h2>
+    <p><%= @reply.answers["interested"] == "no" ? "We have noted that you do not want to go ahead. All the best." : "Our HR team will call you to confirm your round #{round} interview slot." %></p>
+  </section>
+<% else %>
+  <%= form_with url: hr_lite.hiring_reply_path(@reply.token), method: :post, local: true, multipart: true do %>
+    <% if round == 1 %>
+      <section class="hrl-card">
+        <fieldset class="hrl-field">
+          <legend><strong>Do you want to go ahead with the interview?</strong></legend>
+          <label class="hrl-field--check"><input type="radio" name="interested" value="yes" required <%= "checked" if params[:interested] == "yes" %>> Yes, I am interested</label>
+          <label class="hrl-field--check"><input type="radio" name="interested" value="no" <%= "checked" if params[:interested] == "no" %>> No, not now</label>
+        </fieldset>
+      </section>
+    <% end %>
+
+    <section class="hrl-card">
+      <h2 class="hrl-card__title"><%= round == 1 ? "If yes: pick" : "Pick" %> a day and one time slot for round <%= round %></h2>
+      <p class="hrl-small hrl-muted">Each slot is 2 hours. HR will call you to confirm.</p>
+      <fieldset class="hrl-field">
+        <legend>Day</legend>
+        <% HrLite::HiringReply.dates(allow_sunday: campaign.allow_sunday).each do |day| %>
+          <label class="hrl-field--check"><input type="radio" name="date" value="<%= day.iso8601 %>" <%= "checked" if params[:date] == day.iso8601 %>> <%= day.strftime("%A, %-d %B") %></label>
+        <% end %>
+      </fieldset>
+      <fieldset class="hrl-field">
+        <legend>Time slot</legend>
+        <% HrLite::HiringReply::SLOTS.each do |key, label| %>
+          <label class="hrl-field--check"><input type="radio" name="slot" value="<%= key %>" <%= "checked" if params[:slot] == key %>> <%= label %></label>
+        <% end %>
+      </fieldset>
+      <div class="hrl-field">
+        <label for="alternate_phone">Alternate phone number (optional)</label>
+        <input type="tel" name="alternate_phone" id="alternate_phone" inputmode="tel" autocomplete="tel" value="<%= params[:alternate_phone] %>">
+      </div>
+    </section>
+
+    <% if round == 1 %>
+      <section class="hrl-card">
+        <fieldset class="hrl-field">
+          <legend>How soon can you join?</legend>
+          <% HrLite::HiringReply::JOINING.each do |key, label| %>
+            <label class="hrl-field--check"><input type="radio" name="joining" value="<%= key %>" <%= "checked" if params[:joining] == key %>> <%= label %></label>
+          <% end %>
+        </fieldset>
+        <% { "stipend_ok" => "Are you fine with the monthly stipend#{" of #{campaign.stipend}" if campaign.stipend.present?}?",
+             "location_ok" => "Can you work from our office#{" at #{campaign.location}" if campaign.location.present?}?",
+             "schedule_ok" => "Are you fine with the work schedule#{": #{campaign.schedule}" if campaign.schedule.present?}?",
+             "programme_ok" => "Can you commit to the full programme#{" (#{campaign.programme})" if campaign.programme.present?}?" }.each do |key, question| %>
+          <fieldset class="hrl-field">
+            <legend><%= question %></legend>
+            <label class="hrl-field--check"><input type="radio" name="<%= key %>" value="yes" <%= "checked" if params[key] == "yes" %>> Yes</label>
+            <label class="hrl-field--check"><input type="radio" name="<%= key %>" value="no" <%= "checked" if params[key] == "no" %>> No</label>
+          </fieldset>
+        <% end %>
+      </section>
+    <% end %>
+
+    <% if round == 3 %>
+      <section class="hrl-card">
+        <h2 class="hrl-card__title">Joining details</h2>
+        <p class="hrl-small hrl-muted">Stored encrypted. Only our HR team can see them.</p>
+        <div class="hrl-field">
+          <label for="aadhaar_number">Aadhaar number</label>
+          <input type="text" name="aadhaar_number" id="aadhaar_number" inputmode="numeric" autocomplete="off" maxlength="14" required>
+        </div>
+        <div class="hrl-field">
+          <label for="pan_number">PAN</label>
+          <input type="text" name="pan_number" id="pan_number" autocomplete="off" maxlength="10" autocapitalize="characters">
+        </div>
+        <label class="hrl-field--check"><input type="checkbox" name="pan_pending" value="1" <%= "checked" if params[:pan_pending] == "1" %>> I don't have a PAN yet (HR will ask for it when you join)</label>
+        <label class="hrl-field--check"><input type="checkbox" name="no_salary_slips" value="1" <%= "checked" if params[:no_salary_slips] == "1" %>> I have no salary slips (fresher)</label>
+      </section>
+    <% end %>
+
+    <% kinds = HrLite::HiringReply::DOCUMENTS.fetch(round, {}) %>
+    <% if kinds.any? %>
+      <section class="hrl-card">
+        <h2 class="hrl-card__title">Your documents</h2>
+        <p class="hrl-small hrl-muted">PDF, JPG or PNG, up to 5 MB each. Stored encrypted.<%= " Skip PAN or salary slips if you ticked the box above." if round == 3 %></p>
+        <% kinds.each do |kind, label| %>
+          <div class="hrl-field">
+            <label for="doc_<%= kind %>"><%= label %><%= " (if you have it)" if kind.start_with?("salary_slip", "pan") %></label>
+            <input type="file" name="documents[<%= kind %>]" id="doc_<%= kind %>" accept=".pdf,.jpg,.jpeg,.png" <%= "required" unless kind.start_with?("salary_slip", "pan") %>>
+          </div>
+        <% end %>
+      </section>
+    <% end %>
+
+    <% if round == 3 %>
+      <label class="hrl-field--check"><input type="checkbox" name="consent" value="1" required> I agree to share these details and documents with <%= HrLite.config.company.call[:brand].presence || "the company" %> for hiring and joining.</label>
+    <% end %>
+
+    <div class="hrl-form-actions"><button class="hrl-btn hrl-btn--primary" type="submit">Send my answers</button></div>
+  <% end %>
+<% end %>

data/app/views/layouts/hr_lite/application.html.erb

@@ -121,6 +121,7 @@
   <%= javascript_include_tag "hr_lite/mention", defer: true %>
   <%= javascript_include_tag "hr_lite/nav", defer: true %>
 <%= javascript_include_tag "hr_lite/select_filter", defer: true %>
+<%= javascript_include_tag "hr_lite/select_all", defer: true %>
 <%= javascript_include_tag "hr_lite/search", defer: true %>
 <dialog class="hrl-search" data-hrl-search aria-label="Search">
   <form method="dialog" class="hrl-search__close"><button class="hrl-btn" type="submit">Close</button></form>

data/app/views/layouts/hr_lite/public.html.erb

@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <% company = HrLite.config.company.call %>
+  <title><%= [ content_for(:page_title), company[:brand].presence || company[:name] ].compact.join(" · ") %></title>
+  <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
+  <meta name="robots" content="noindex, nofollow">
+  <%= csrf_meta_tags %>
+  <%= csp_meta_tag %>
+  <%= stylesheet_link_tag "hr_lite/hr_lite", media: "all" %>
+  <% HrLite.config.extra_stylesheets.each do |sheet| %><%= stylesheet_link_tag sheet, media: "all" %><% end %>
+</head>
+<body class="hrl-body">
+  <main id="hrl-main" class="hrl-public">
+    <% if company[:logo_url].present? %><img class="hrl-public__logo" src="<%= company[:logo_url] %>" alt="<%= company[:brand].presence || company[:name] %>"><% end %>
+    <% if flash[:alert].present? %><div class="hrl-flash hrl-flash--warn" role="alert"><%= flash[:alert] %></div><% end %>
+    <%= yield %>
+  </main>
+  <%= javascript_include_tag "hr_lite/confirm", defer: true %>
+</body>
+</html>

data/config/routes.rb

@@ -69,6 +69,10 @@ HrLite::Engine.routes.draw do
   get "career", to: "career#show"
   resources :appraisals, only: %i[index show]
 
+  # A candidate's reply page for one round, from @round1_link … @round3_link (no login: the token is the key).
+  get "apply/:token", to: "hiring_replies#show", as: :hiring_reply
+  post "apply/:token", to: "hiring_replies#create"
+
   namespace :admin do
     resources :policies, only: %i[index new create]
     resources :hiring_campaigns, except: %i[destroy] do
@@ -76,7 +80,7 @@ HrLite::Engine.routes.draw do
       resources :hiring_sends, path: "send", only: %i[new create]
     end
     resources :hiring_candidates, only: %i[show] do
-      member { patch :stage }
+      member { patch :stage; get :document; post :reveal }
       resources :hiring_interviews, path: "interviews", only: %i[create update destroy]
     end
     resources :hiring_templates, except: %i[show destroy]

data/db/migrate/20261022090000_create_hr_lite_hiring_replies.rb

@@ -0,0 +1,26 @@
+class CreateHrLiteHiringReplies < ActiveRecord::Migration[8.1]
+  # One reply link per candidate per interview round: their answers, the day
+  # and 2-hour slot they picked, an optional alternate phone, and (from round
+  # 2) their documents through Active Storage, stored encrypted. Round 3 adds
+  # the joining KYC: Aadhaar, PAN (or "PAN pending") and salary slips.
+  def change
+    create_table :hr_lite_hiring_replies do |t|
+      t.references :candidate, null: false, foreign_key: { to_table: :hr_lite_hiring_candidates }
+      t.integer :round, null: false
+      t.string :token, null: false
+      t.json :answers, null: false, default: {}
+      t.text :alternate_phone
+      t.text :aadhaar_number
+      t.text :pan_number
+      t.boolean :pan_pending, null: false, default: false
+      t.boolean :no_salary_slips, null: false, default: false
+      t.date :preferred_date
+      t.string :preferred_slot
+      t.datetime :responded_at
+      t.timestamps
+    end
+    add_index :hr_lite_hiring_replies, :token, unique: true
+    add_index :hr_lite_hiring_replies, %i[candidate_id round], unique: true
+    add_index :hr_lite_hiring_replies, %i[preferred_date preferred_slot]
+  end
+end

data/db/migrate/20261022090100_add_allow_sunday_to_hr_lite_hiring_campaigns.rb

@@ -0,0 +1,6 @@
+class AddAllowSundayToHrLiteHiringCampaigns < ActiveRecord::Migration[8.1]
+  # Sunday is off; HR can open it for one campaign's interview slots.
+  def change
+    add_column :hr_lite_hiring_campaigns, :allow_sunday, :boolean, null: false, default: false
+  end
+end

data/lib/hr_lite/version.rb

@@ -1,3 +1,3 @@
 module HrLite
-  VERSION = "0.61.0"
+  VERSION = "0.62.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hr_lite
 version: !ruby/object:Gem::Version
-  version: 0.61.0
+  version: 0.62.0
 platform: ruby
 authors:
 - kshitiz sinha
@@ -75,6 +75,7 @@ files:
 - app/assets/javascripts/hr_lite/photo_crop.js
 - app/assets/javascripts/hr_lite/print.js
 - app/assets/javascripts/hr_lite/search.js
+- app/assets/javascripts/hr_lite/select_all.js
 - app/assets/javascripts/hr_lite/select_filter.js
 - app/assets/javascripts/hr_lite/share.js
 - app/assets/javascripts/hr_lite/tax_preview.js
@@ -141,6 +142,7 @@ files:
 - app/controllers/hr_lite/documents_controller.rb
 - app/controllers/hr_lite/employee_profiles_controller.rb
 - app/controllers/hr_lite/expenses_controller.rb
+- app/controllers/hr_lite/hiring_replies_controller.rb
 - app/controllers/hr_lite/holidays_controller.rb
 - app/controllers/hr_lite/home_controller.rb
 - app/controllers/hr_lite/hr_requests_controller.rb
@@ -215,6 +217,7 @@ files:
 - app/models/hr_lite/hiring_candidate.rb
 - app/models/hr_lite/hiring_interview.rb
 - app/models/hr_lite/hiring_message.rb
+- app/models/hr_lite/hiring_reply.rb
 - app/models/hr_lite/hiring_template.rb
 - app/models/hr_lite/holiday.rb
 - app/models/hr_lite/hr_request.rb
@@ -407,6 +410,7 @@ files:
 - app/views/hr_lite/event_mailer/leadership.text.erb
 - app/views/hr_lite/expenses/index.html.erb
 - app/views/hr_lite/expenses/new.html.erb
+- app/views/hr_lite/hiring_replies/show.html.erb
 - app/views/hr_lite/holidays/_next_holiday.html.erb
 - app/views/hr_lite/holidays/index.html.erb
 - app/views/hr_lite/home/_today_checkins.html.erb
@@ -457,6 +461,7 @@ files:
 - app/views/layouts/hr_lite/mailer.html.erb
 - app/views/layouts/hr_lite/mailer.text.erb
 - app/views/layouts/hr_lite/pdf.html.erb
+- app/views/layouts/hr_lite/public.html.erb
 - config/routes.rb
 - db/migrate/20260718190726_create_hr_lite_kudos.rb
 - db/migrate/20260718190727_create_hr_lite_kudo_mentions.rb
@@ -540,6 +545,8 @@ files:
 - db/migrate/20261021100300_create_hr_lite_hiring_messages.rb
 - db/migrate/20261021100400_create_hr_lite_hiring_interviews.rb
 - db/migrate/20261021100500_seed_hr_lite_hiring.rb
+- db/migrate/20261022090000_create_hr_lite_hiring_replies.rb
+- db/migrate/20261022090100_add_allow_sunday_to_hr_lite_hiring_campaigns.rb
 - lib/generators/hr_lite/install/install_generator.rb
 - lib/generators/hr_lite/install/templates/AFTER_INSTALL
 - lib/generators/hr_lite/install/templates/initializer.rb