fix: validate cron expression before writing to crontab

tests/test_api.py

@@ -164,6 +164,22 @@ def test_set_alarm_rejects_custom_command():
     assert "command" in str(res.json()["errors"])
 
 
+def test_set_alarm_rejects_invalid_cron_expression():
+    """Invalid cron expressions must be rejected at the API boundary."""
+    headers = {"X-API-Key": "test-secret"}
+    mutation = """
+    mutation {
+      setAlarm(cronExpression: "definitely not valid") {
+        id
+      }
+    }
+    """
+    res = client.post("/graphql", json={"query": mutation}, headers=headers)
+    assert res.status_code == 200
+    assert "errors" in res.json()
+    assert "Invalid cron expression" in str(res.json()["errors"])
+
+
 def test_graphql_workflow():
     headers = {"X-API-Key": "test-secret"}
 

tests/test_crontab.py

@@ -66,3 +66,9 @@ def test_delete_alarm(crontab_file):
 
     manager.delete_alarm(alarm_id)
     assert len(manager.get_alarms()) == 0
+
+
+def test_set_alarm_rejects_invalid_cron_expression(crontab_file):
+    manager = CrontabManager(tabfile=crontab_file)
+    with pytest.raises(ValueError, match="Invalid cron expression"):
+        manager.set_alarm("test-id", "not-a-cron-expression", "cmd", True)