HireZoot Application Fees

Optional application fees for HireZoot (WP Job Openings).

Applicants use the normal HireZoot form. If the job has a fee, the application is saved as payment pending, the candidate is redirected to a payment page, and emails are sent (receipt, paid confirmation, abandoned-payment reminder).

Version: 1.1.1
Requires: WordPress 6.0+, PHP 7.4+, HireZoot (WP Job Openings) active

---

Developer

Sandip Das
Fiverr: www.fiverr.com/sandy5rr

If needed, please connect for customization, support, or further development.

---

Why a separate plugin (not the theme)?

• Survives theme switches
• Keeps design themes focused on layout
• Safe place for payment keys, webhooks, and fee logic
• Reusable on any HireZoot site

---

Features

Area	What you get
Job edit	“Application Fee” meta box — enable, amount, label
Applications	Status: none / pending / paid / failed / waived
Admin	List column + side meta box; manual status override
Redirect	After apply → /job-application-pay/{id}/?token=…
Emails	Receipt + pay link; paid confirmation (applicant + admin); hourly reminder if still pending
Razorpay	Order create + Checkout.js + HMAC signature verify → paid
Manual UPI	UPI ID, browser-side QR (no third-party QR API), deep link, UTR form
Security	Pay token, rate-limited UTR, optional auto-complete off by default
Settings	Job Openings → Application Fees

---

Installation

1. Copy hirezoot-application-fees into wp-content/plugins/
2. Activate HireZoot Application Fees
3. Activate HireZoot (WP Job Openings) if not already
4. Job Openings → Application Fees — currency + Razorpay or Manual UPI
5. Edit a job → enable fee + amount
6. If payment links 404: Settings → Permalinks → Save

---

Payment flow

Apply (HireZoot form)
        ↓
awsm_job_application_submitted
        ↓
Fee job? ──no──► status: none (normal)
        │
       yes
        ↓
status: pending + deadline (5 min window) + pay token
        ↓
Redirect to payment page + receipt email (pay link)
        ↓
┌───────────────────┬────────────────────────────┐
│ Razorpay success  │ Manual: scan QR / pay UPI  │
│ (signature OK)    │ then submit UTR            │
└─────────┬─────────┴──────────────┬─────────────┘
          ↓                        ↓
     status: paid          UTR stored; paid only if
     + confirmation        “auto-complete” is enabled
     emails                AND within window (or HR marks paid)
          │
          ↓
If still pending after ~1 hour → reminder email (cron)

---

Configuration

Razorpay (recommended for real auto-confirm)

1. Create keys in the Razorpay Dashboard
2. Paste Key ID and Key Secret under Application Fees
3. Use test keys first
4. Currency INR for UPI

Manual UPI

1. Payment mode → Manual UPI + UTR
2. Enter UPI ID (VPA) and instructions
3. QR is generated in the applicant’s browser from a standard upi://pay?… intent
   • Amount comes from server-side application meta
   • Note (tn) looks like HZ{appId}{token} for bank-statement matching
4. Manual UTR auto-complete (optional, off by default):
   • If enabled, UTR submitted within 5 minutes marks the application paid
   • Security risk: a fake UTR can be typed — prefer HR verification or Razorpay

---

Security notes (QR & UTR)

Topic	Behaviour in 1.1.1
Third-party QR image APIs	Disabled — UPI payload is not sent to external QR hosts
Client-side QR	Drawn in-browser (qrcodejs); data stays on the page
Pay URL token	Required for page access (when set) and UTR POST
UTR rate limit	Max 8 attempts / 15 minutes per IP + application
UTR format	Normalized; length bounds enforced
Auto-complete on UTR	Default off; explicit setting + filter hzaf_manual_utr_auto_paid
True “paid?” detection	Only via Razorpay signature (or future webhooks). Banks do not notify WordPress on plain UPI

Recommendation: use Razorpay for production fees; use manual UPI + HR verify when you need a simple QR collect flow.

---

Emails

Event	Recipient	Content
Application + fee required	Applicant	Receipt, amount, payment link
Marked paid	Applicant	Confirmation + txn/UTR if present
Marked paid	Site admin	Who paid, job, amount
Still pending (~1h+)	Applicant	Reminder + payment link (once)

Uses wp_mail. For reliability, configure SMTP (e.g. FluentSMTP).

---

File structure

hirezoot-application-fees/
├── hirezoot-application-fees.php   # Bootstrap v1.1.1
├── readme.txt                      # WordPress.org-style readme
├── README.md                       # This file
├── includes/
│   ├── class-hzaf-plugin.php       # Settings helpers
│   ├── class-hzaf-job-meta.php     # Job fee meta box
│   ├── class-hzaf-application.php  # Status, redirect, 5-min deadline
│   ├── class-hzaf-payment.php      # Rewrite, Razorpay, UPI intent, UTR
│   ├── class-hzaf-emails.php       # Receipt / paid / reminder
│   ├── class-hzaf-admin.php        # Settings UI, columns, meta
│   └── class-hzaf-frontend.php     # Fee notice on apply form
├── templates/
│   └── payment-page.php            # Checkout + QR + timer
└── assets/
    ├── css/frontend.css
    └── js/frontend.js

---

Hooks (for developers)

Hook	When
hzaf_application_pending_payment	Application marked pending fee
hzaf_application_paid	Fee marked paid
hzaf_payment_url	Filter payment page URL
hzaf_manual_utr_auto_paid	Filter whether UTR auto-marks paid
hzaf_payment_window_seconds	Default 300 (5 minutes)
hzaf_reminder_delay_seconds	Default HOUR_IN_SECONDS
hzaf_email_sent	After each plugin email attempt

---

Changelog

1.1.1

• Security: stop using third-party QR image APIs; browser-side QR only
• Security: manual UTR auto-complete off by default (admin setting)
• Security: pay token on UTR POST, rate limit, UTR sanitisation
• Stronger UPI tn reference (HZ{id}{token}) + VPA validation
• README / readme.txt updated

1.1.0

• Redirect to payment page after fee applications
• Applicant receipt, paid confirmation, abandoned-payment reminder emails
• Manual UPI QR + 5-minute window
• Razorpay verify → paid + emails

1.0.0

• Initial release: job fees, Razorpay + manual UPI, application status, settings

---

License

GPL-2.0-or-later