feat(#29): implement cron job configuration

- Add CronSchedule model to Prisma schema
- Implement CronService with CRUD operations
- Add REST API endpoints for cron management
- Create MoltBot plugin skill definition (SKILL.md)
- TDD: 9 passing tests for CronService

apps/api/src/app.module.ts

@@ -17,6 +17,7 @@ import { UsersModule } from "./users/users.module";
 import { WebSocketModule } from "./websocket/websocket.module";
 import { LlmModule } from "./llm/llm.module";
 import { BrainModule } from "./brain/brain.module";
+import { CronModule } from "./cron/cron.module";
 
 @Module({
   imports: [
@@ -36,6 +37,7 @@ import { BrainModule } from "./brain/brain.module";
     WebSocketModule,
     LlmModule,
     BrainModule,
+    CronModule,
   ],
   controllers: [AppController],
   providers: [AppService],

apps/api/src/cron/cron.controller.ts

@@ -0,0 +1,88 @@
+import {
+  Controller,
+  Get,
+  Post,
+  Patch,
+  Delete,
+  Body,
+  Param,
+  UseGuards,
+} from "@nestjs/common";
+import { CronService } from "./cron.service";
+import { CreateCronDto, UpdateCronDto } from "./dto";
+import { AuthGuard } from "../auth/guards/auth.guard";
+import { WorkspaceGuard } from "../common/guards";
+import { Workspace, RequirePermission } from "../common/decorators";
+import { Permission } from "@prisma/client";
+
+/**
+ * Controller for cron job scheduling endpoints
+ * All endpoints require authentication and workspace context
+ */
+@Controller("cron")
+@UseGuards(AuthGuard, WorkspaceGuard)
+export class CronController {
+  constructor(private readonly cronService: CronService) {}
+
+  /**
+   * POST /api/cron
+   * Create a new cron schedule
+   * Requires: MEMBER role or higher
+   */
+  @Post()
+  @RequirePermission(Permission.WORKSPACE_MEMBER)
+  async create(
+    @Body() createCronDto: CreateCronDto,
+    @Workspace() workspaceId: string
+  ) {
+    return this.cronService.create({ ...createCronDto, workspaceId });
+  }
+
+  /**
+   * GET /api/cron
+   * Get all cron schedules for workspace
+   * Requires: Any workspace member
+   */
+  @Get()
+  @RequirePermission(Permission.WORKSPACE_ANY)
+  async findAll(@Workspace() workspaceId: string) {
+    return this.cronService.findAll(workspaceId);
+  }
+
+  /**
+   * GET /api/cron/:id
+   * Get a single cron schedule
+   * Requires: Any workspace member
+   */
+  @Get(":id")
+  @RequirePermission(Permission.WORKSPACE_ANY)
+  async findOne(@Param("id") id: string, @Workspace() workspaceId: string) {
+    return this.cronService.findOne(id, workspaceId);
+  }
+
+  /**
+   * PATCH /api/cron/:id
+   * Update a cron schedule
+   * Requires: MEMBER role or higher
+   */
+  @Patch(":id")
+  @RequirePermission(Permission.WORKSPACE_MEMBER)
+  async update(
+    @Param("id") id: string,
+    @Body() updateCronDto: UpdateCronDto,
+    @Workspace() workspaceId: string
+  ) {
+    return this.cronService.update(id, workspaceId, updateCronDto);
+  }
+
+  /**
+   * DELETE /api/cron/:id
+   * Delete a cron schedule
+   * Requires: ADMIN role or higher
+   */
+  @Delete(":id")
+  @RequirePermission(Permission.WORKSPACE_ADMIN)
+  async remove(@Param("id") id: string, @Workspace() workspaceId: string) {
+    return this.cronService.remove(id, workspaceId);
+  }
+}

apps/api/src/cron/cron.module.ts

@@ -0,0 +1,13 @@
+import { Module } from "@nestjs/common";
+import { CronController } from "./cron.controller";
+import { CronService } from "./cron.service";
+import { PrismaModule } from "../prisma/prisma.module";
+import { AuthModule } from "../auth/auth.module";
+
+@Module({
+  imports: [PrismaModule, AuthModule],
+  controllers: [CronController],
+  providers: [CronService],
+  exports: [CronService],
+})
+export class CronModule {}

apps/api/src/cron/cron.service.spec.ts

@@ -0,0 +1,184 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { Test, TestingModule } from "@nestjs/testing";
+import { CronService } from "./cron.service";
+import { PrismaService } from "../prisma/prisma.service";
+
+describe("CronService", () => {
+  let service: CronService;
+  let prisma: PrismaService;
+
+  const mockPrisma = {
+    cronSchedule: {
+      create: vi.fn(),
+      findMany: vi.fn(),
+      findUnique: vi.fn(),
+      update: vi.fn(),
+      delete: vi.fn(),
+    },
+  };
+
+  beforeEach(async () => {
+    const module: TestingModule = await Test.createTestingModule({
+      providers: [
+        CronService,
+        {
+          provide: PrismaService,
+          useValue: mockPrisma,
+        },
+      ],
+    }).compile();
+
+    service = module.get<CronService>(CronService);
+    prisma = module.get<PrismaService>(PrismaService);
+    vi.clearAllMocks();
+  });
+
+  it("should be defined", () => {
+    expect(service).toBeDefined();
+  });
+
+  describe("create", () => {
+    it("should create a cron schedule", async () => {
+      const createDto = {
+        workspaceId: "ws-123",
+        expression: "0 9 * * *",
+        command: "morning briefing",
+      };
+
+      const expectedSchedule = {
+        id: "cron-1",
+        ...createDto,
+        enabled: true,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      };
+
+      mockPrisma.cronSchedule.create.mockResolvedValue(expectedSchedule);
+
+      const result = await service.create(createDto);
+
+      expect(result).toEqual(expectedSchedule);
+      expect(mockPrisma.cronSchedule.create).toHaveBeenCalledWith({
+        data: {
+          workspaceId: createDto.workspaceId,
+          expression: createDto.expression,
+          command: createDto.command,
+          enabled: true,
+        },
+      });
+    });
+
+    it("should reject invalid cron expressions", async () => {
+      const createDto = {
+        workspaceId: "ws-123",
+        expression: "not-a-cron",
+        command: "test command",
+      };
+
+      await expect(service.create(createDto)).rejects.toThrow("Invalid cron expression");
+    });
+  });
+
+  describe("findAll", () => {
+    it("should return all schedules for a workspace", async () => {
+      const workspaceId = "ws-123";
+      const expectedSchedules = [
+        { id: "cron-1", workspaceId, expression: "0 9 * * *", command: "morning briefing", enabled: true },
+        { id: "cron-2", workspaceId, expression: "0 17 * * *", command: "evening summary", enabled: true },
+      ];
+
+      mockPrisma.cronSchedule.findMany.mockResolvedValue(expectedSchedules);
+
+      const result = await service.findAll(workspaceId);
+
+      expect(result).toEqual(expectedSchedules);
+      expect(mockPrisma.cronSchedule.findMany).toHaveBeenCalledWith({
+        where: { workspaceId },
+        orderBy: { createdAt: "desc" },
+      });
+    });
+  });
+
+  describe("findOne", () => {
+    it("should return a schedule by id", async () => {
+      const schedule = {
+        id: "cron-1",
+        workspaceId: "ws-123",
+        expression: "0 9 * * *",
+        command: "morning briefing",
+        enabled: true,
+      };
+
+      mockPrisma.cronSchedule.findUnique.mockResolvedValue(schedule);
+
+      const result = await service.findOne("cron-1", "ws-123");
+
+      expect(result).toEqual(schedule);
+      expect(mockPrisma.cronSchedule.findUnique).toHaveBeenCalledWith({
+        where: { id: "cron-1" },
+      });
+    });
+
+    it("should return null if schedule not found", async () => {
+      mockPrisma.cronSchedule.findUnique.mockResolvedValue(null);
+
+      const result = await service.findOne("cron-999", "ws-123");
+
+      expect(result).toBeNull();
+    });
+  });
+
+  describe("update", () => {
+    it("should update a cron schedule", async () => {
+      const updateDto = { expression: "0 8 * * *", enabled: false };
+      const expectedSchedule = {
+        id: "cron-1",
+        workspaceId: "ws-123",
+        expression: "0 8 * * *",
+        command: "morning briefing",
+        enabled: false,
+      };
+
+      mockPrisma.cronSchedule.findUnique.mockResolvedValue({ id: "cron-1", workspaceId: "ws-123" });
+      mockPrisma.cronSchedule.update.mockResolvedValue(expectedSchedule);
+
+      const result = await service.update("cron-1", "ws-123", updateDto);
+
+      expect(result).toEqual(expectedSchedule);
+      expect(mockPrisma.cronSchedule.update).toHaveBeenCalled();
+    });
+  });
+
+  describe("remove", () => {
+    it("should delete a cron schedule", async () => {
+      const schedule = {
+        id: "cron-1",
+        workspaceId: "ws-123",
+        expression: "0 9 * * *",
+        command: "morning briefing",
+        enabled: true,
+      };
+
+      mockPrisma.cronSchedule.findUnique.mockResolvedValue(schedule);
+      mockPrisma.cronSchedule.delete.mockResolvedValue(schedule);
+
+      const result = await service.remove("cron-1", "ws-123");
+
+      expect(result).toEqual(schedule);
+      expect(mockPrisma.cronSchedule.delete).toHaveBeenCalledWith({
+        where: { id: "cron-1" },
+      });
+    });
+
+    it("should throw if schedule belongs to different workspace", async () => {
+      mockPrisma.cronSchedule.findUnique.mockResolvedValue({
+        id: "cron-1",
+        workspaceId: "ws-456",
+      });
+
+      await expect(service.remove("cron-1", "ws-123")).rejects.toThrow(
+        "Not authorized to delete this schedule"
+      );
+    });
+  });
+});

apps/api/src/cron/cron.service.ts

@@ -0,0 +1,103 @@
+import { Injectable, NotFoundException, BadRequestException } from "@nestjs/common";
+import { PrismaService } from "../prisma/prisma.service";
+
+// Cron expression validation regex (simplified)
+const CRON_REGEX = /^((\*|[0-9]|1[0-9]|2[0-9]|3[0-9]|4[0-9]|5[0-9])\ ?){5}$/;
+
+export interface CreateCronDto {
+  workspaceId: string;
+  expression: string;
+  command: string;
+}
+
+export interface UpdateCronDto {
+  expression?: string;
+  command?: string;
+  enabled?: boolean;
+}
+
+@Injectable()
+export class CronService {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async create(dto: CreateCronDto) {
+    if (!this.isValidCronExpression(dto.expression)) {
+      throw new BadRequestException("Invalid cron expression");
+    }
+
+    return this.prisma.cronSchedule.create({
+      data: {
+        workspaceId: dto.workspaceId,
+        expression: dto.expression,
+        command: dto.command,
+        enabled: true,
+      },
+    });
+  }
+
+  async findAll(workspaceId: string) {
+    return this.prisma.cronSchedule.findMany({
+      where: { workspaceId },
+      orderBy: { createdAt: "desc" },
+    });
+  }
+
+  async findOne(id: string, workspaceId?: string) {
+    const schedule = await this.prisma.cronSchedule.findUnique({
+      where: { id },
+    });
+
+    if (!schedule) {
+      return null;
+    }
+
+    if (workspaceId && schedule.workspaceId !== workspaceId) {
+      return null;
+    }
+
+    return schedule;
+  }
+
+  async update(id: string, workspaceId: string, dto: UpdateCronDto) {
+    const schedule = await this.findOne(id, workspaceId);
+
+    if (!schedule) {
+      throw new NotFoundException("Cron schedule not found");
+    }
+
+    if (dto.expression && !this.isValidCronExpression(dto.expression)) {
+      throw new BadRequestException("Invalid cron expression");
+    }
+
+    return this.prisma.cronSchedule.update({
+      where: { id },
+      data: {
+        ...(dto.expression && { expression: dto.expression }),
+        ...(dto.command && { command: dto.command }),
+        ...(dto.enabled !== undefined && { enabled: dto.enabled }),
+      },
+    });
+  }
+
+  async remove(id: string, workspaceId: string) {
+    const schedule = await this.prisma.cronSchedule.findUnique({
+      where: { id },
+    });
+
+    if (!schedule) {
+      throw new NotFoundException("Cron schedule not found");
+    }
+
+    if (schedule.workspaceId !== workspaceId) {
+      throw new BadRequestException("Not authorized to delete this schedule");
+    }
+
+    return this.prisma.cronSchedule.delete({
+      where: { id },
+    });
+  }
+
+  private isValidCronExpression(expression: string): boolean {
+    return CRON_REGEX.test(expression);
+  }
+}

apps/api/src/cron/dto/index.ts

@@ -0,0 +1,28 @@
+import { IsString, IsNotEmpty, Matches, IsOptional, IsBoolean } from "class-validator";
+
+export class CreateCronDto {
+  @IsString()
+  @IsNotEmpty()
+  expression: string;
+
+  @IsString()
+  @IsNotEmpty()
+  command: string;
+}
+
+export class UpdateCronDto {
+  @IsString()
+  @IsOptional()
+  @Matches(/^((\*|[0-9]|1[0-9]|2[0-9]|3[0-9]|4[0-9]|5[0-9])\ ?){5}$/, {
+    message: "Invalid cron expression",
+  })
+  expression?: string;
+
+  @IsString()
+  @IsOptional()
+  command?: string;
+
+  @IsBoolean()
+  @IsOptional()
+  enabled?: boolean;
+}