zyket 1.2.17 → 1.2.19

package/src/templates/saas-multitenant/.env.example

@@ -0,0 +1,22 @@
+# --- saas-multitenant template ---
+DEBUG=true
+PORT=3000
+
+DISABLE_EXPRESS=false
+DISABLE_SOCKET=true
+DISABLE_VITE=false
+VITE_ROOT=./frontend
+VITE_PORT=5173
+VITE_API_BASE=http://localhost:3000
+
+DATABASE_URL=./database.sqlite
+DATABASE_DIALECT=sqlite
+
+HTTP_JSON_LIMIT=10mb
+
+# Set true only when frontend and backend live on different domains (needs HTTPS).
+# AUTH_CROSS_DOMAIN=false
+
+# AUTH_SECRET is generated automatically on first run.
+# BETTER_AUTH_URL=http://localhost:3000
+# TRUSTED_ORIGINS=http://localhost:3000

package/src/templates/saas-multitenant/README.md

@@ -0,0 +1,71 @@
+# saas-multitenant template
+
+Multi-tenant SaaS starter built on better-auth's **organization** plugin
+(organizations, members, roles, invitations) plus the **admin** plugin.
+
+User/session/organization endpoints are all provided by better-auth — this
+template focuses on the **config and the reusable gates** you need for your own
+routes, not on re-implementing what better-auth already exposes.
+
+## What's included
+- `src/services/auth/` — auth service with organizations enabled, invitation email hook, and `allowUserToCreateOrganization`.
+- `src/middlewares/RequireOrganization.js` — reusable gate that requires an active organization in the session.
+- `src/models/Project.js` + `src/routes/projects` — a **tenant-scoped** resource: data isolated by organization (the core multi-tenant pattern).
+- `src/routes/admin/stats` — minimal example of protecting a route with `RequireAdminMiddleware`.
+- `frontend/` — React + Vite dashboard: sign in, create/switch organizations, and manage tenant-scoped projects.
+
+## Org & auth endpoints (provided by better-auth, under `/api/auth`)
+| Action | Endpoint |
+|--------|----------|
+| Sign up / in | `POST /api/auth/sign-up/email`, `POST /api/auth/sign-in/email` |
+| Create organization | `POST /api/auth/organization/create` |
+| Set active organization | `POST /api/auth/organization/set-active` |
+| Invite member | `POST /api/auth/organization/invite-member` |
+| Accept invitation | `POST /api/auth/organization/accept-invitation` |
+
+## Setup
+```bash
+npm install
+npx @better-auth/cli migrate   # creates user/session/organization/member tables
+node index.js
+```
+This starts the API on `:3000` and the Vite dashboard on `:5173`. Open
+http://localhost:5173, sign up, create an organization, set it active, and add
+projects (scoped to that organization).
+
+### Cookies & local dev
+Cookie security is environment-aware (framework auth service): local dev uses
+`sameSite=lax` (works over `http://localhost`, frontend `:5173` + API `:3000` are
+same-site). For cross-domain production set `AUTH_CROSS_DOMAIN=true` (needs HTTPS).
+
+## Typical flow
+1. `POST /api/auth/sign-up/email` → creates a user (session cookie returned).
+2. `POST /api/auth/organization/create` `{ "name": "Acme", "slug": "acme" }`.
+3. `POST /api/auth/organization/set-active` `{ "organizationId": "..." }`.
+4. `GET /api/auth/get-session` → confirms the user and `activeOrganizationId`.
+5. Invite teammates with `POST /api/auth/organization/invite-member` (the invite link is logged by `sendInvitationEmail`).
+
+## Tenant-scoped routes (see `src/routes/projects`)
+Compose the framework's `RequireAuthMiddleware` with this template's
+`RequireOrganization` gate. After both run, `request.organizationId` is set and
+every query is isolated to the active organization:
+
+```bash
+# with an active organization set on the session
+curl -X POST http://localhost:3000/projects -b cookies.txt \
+  -H "Content-Type: application/json" -d '{"name":"Website redesign"}'
+
+curl http://localhost:3000/projects -b cookies.txt   # only this org's projects
+```
+
+That isolation by `organizationId` — not the auth endpoints — is what better-auth
+leaves to you; this route is the pattern to copy for your own resources.
+
+## Roles
+- Global roles (admin plugin): `user.role` — used by `RequireAdminMiddleware`. Promote with `POST /api/auth/admin/set-role`.
+- Organization roles (owner/admin/member): stored per membership. Check them in your own middleware by querying the member record for `request.organizationId`.
+
+## Notes
+- Configure organization custom fields in `organizationAdditionalFields` (e.g. a `plan`).
+- Wire a real email provider in `sendInvitationEmail` / `sendVerificationEmail`.
+- See the framework `SECURITY.md` before going to production (CSRF/cookies/CORS).

package/src/templates/saas-multitenant/frontend/.env.example

@@ -0,0 +1,3 @@
+# Vite reads env from the frontend folder. Copy to frontend/.env if your
+# backend is not on http://localhost:3000.
+VITE_API_BASE=http://localhost:3000

package/src/templates/saas-multitenant/frontend/index.html

@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Zyket SaaS</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="./main.jsx"></script>
+  </body>
+</html>

package/src/templates/saas-multitenant/frontend/main.jsx

@@ -0,0 +1,18 @@
+import { createRoot } from 'react-dom/client'
+import { BrowserRouter, Routes, Route, Navigate } from 'react-router-dom'
+import './styles.css'
+import AuthView from './src/views/AuthView'
+import DashboardView from './src/views/DashboardView'
+import LoggedMiddleware from './src/middlewares/LoggedMiddleware'
+import NotLoggedMiddleware from './src/middlewares/NotLoggedMiddleware'
+
+createRoot(document.getElementById('root')).render(
+  <BrowserRouter>
+    <Routes>
+      <Route path="/" element={<Navigate to="/dashboard" replace />} />
+      <Route path="/auth" element={<NotLoggedMiddleware><AuthView /></NotLoggedMiddleware>} />
+      <Route path="/dashboard" element={<LoggedMiddleware><DashboardView /></LoggedMiddleware>} />
+      <Route path="*" element={<Navigate to="/dashboard" replace />} />
+    </Routes>
+  </BrowserRouter>
+)

package/src/templates/saas-multitenant/frontend/src/hooks/useAuth.jsx

@@ -0,0 +1,27 @@
+import { useStoreAuth } from "../store/storeAuth";
+
+export default function useAuth() {
+  const context = useStoreAuth();
+  const sessionContext = context?.client?.useSession();
+  const { isPending, refetch } = sessionContext || {};
+  const { user, session } = sessionContext?.data || {};
+
+  const login = async (email, password) => {
+    const { data, error } = await context.client.signIn.email({ email, password });
+    if (error) throw error;
+    return data;
+  };
+
+  const register = async ({ email, password, name }) => {
+    const { data, error } = await context.client.signUp.email({ email, password, name });
+    if (error) throw error;
+    return data;
+  };
+
+  const logout = async () => {
+    await context.client.signOut();
+    window.location.href = "/auth";
+  };
+
+  return { ...context, login, register, logout, isPending, refetch, user, session };
+}

package/src/templates/saas-multitenant/frontend/src/hooks/useProjects.jsx

@@ -0,0 +1,41 @@
+import { useCallback, useEffect, useState } from "react";
+import { useStoreAuth } from "../store/storeAuth";
+
+// Talks to the tenant-scoped /projects API (cookies sent with credentials).
+// Only loads when there is an active organization.
+export default function useProjects(activeOrganizationId) {
+  const { apiBase } = useStoreAuth();
+  const [projects, setProjects] = useState([]);
+  const [error, setError] = useState(null);
+
+  const load = useCallback(async () => {
+    setError(null);
+    const res = await fetch(`${apiBase}/projects`, { credentials: "include" });
+    const json = await res.json();
+    if (!res.ok) {
+      setError(json.message || "Failed to load projects");
+      setProjects([]);
+      return;
+    }
+    setProjects(json.projects || []);
+  }, [apiBase]);
+
+  useEffect(() => {
+    if (activeOrganizationId) load();
+    else setProjects([]);
+  }, [activeOrganizationId, load]);
+
+  const create = async (name) => {
+    const res = await fetch(`${apiBase}/projects`, {
+      method: "POST",
+      credentials: "include",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ name }),
+    });
+    const json = await res.json();
+    if (!res.ok) throw new Error(json.message || "Failed to create project");
+    await load();
+  };
+
+  return { projects, error, create, reload: load };
+}

package/src/templates/saas-multitenant/frontend/src/middlewares/LoggedMiddleware.jsx

@@ -0,0 +1,12 @@
+import PropTypes from "prop-types";
+import { Navigate } from "react-router-dom";
+import useAuth from "../hooks/useAuth";
+
+export default function LoggedMiddleware({ children }) {
+  const { user, isPending } = useAuth();
+  if (isPending) return null;
+  if (!user) return <Navigate to="/auth" replace />;
+  return children;
+}
+
+LoggedMiddleware.propTypes = { children: PropTypes.node.isRequired };

package/src/templates/saas-multitenant/frontend/src/middlewares/NotLoggedMiddleware.jsx

@@ -0,0 +1,12 @@
+import PropTypes from "prop-types";
+import { Navigate } from "react-router-dom";
+import useAuth from "../hooks/useAuth";
+
+export default function NotLoggedMiddleware({ children }) {
+  const { user, isPending } = useAuth();
+  if (isPending) return null;
+  if (user) return <Navigate to="/dashboard" replace />;
+  return children;
+}
+
+NotLoggedMiddleware.propTypes = { children: PropTypes.node.isRequired };

package/src/templates/saas-multitenant/frontend/src/store/storeAuth.jsx

@@ -0,0 +1,13 @@
+import { create } from "zustand";
+import { createAuthClient } from "better-auth/react";
+import { organizationClient, adminClient } from "better-auth/client/plugins";
+
+const API_BASE = import.meta.env.VITE_API_BASE || "http://localhost:3000";
+
+export const useStoreAuth = create(() => ({
+  apiBase: API_BASE,
+  client: createAuthClient({
+    baseURL: `${API_BASE}/api/auth/`,
+    plugins: [organizationClient(), adminClient()],
+  }),
+}));

package/src/templates/saas-multitenant/frontend/src/views/AuthView.jsx

@@ -0,0 +1,70 @@
+import { useState } from "react";
+import { useNavigate } from "react-router-dom";
+import useAuth from "../hooks/useAuth";
+
+export default function AuthView() {
+  const { login, register } = useAuth();
+  const navigate = useNavigate();
+  const [mode, setMode] = useState("login");
+  const [form, setForm] = useState({ name: "", email: "", password: "" });
+  const [error, setError] = useState(null);
+  const [loading, setLoading] = useState(false);
+
+  const submit = async (e) => {
+    e.preventDefault();
+    setError(null);
+    setLoading(true);
+    try {
+      if (mode === "login") await login(form.email, form.password);
+      else await register(form);
+      navigate("/dashboard", { replace: true });
+    } catch (err) {
+      setError(err?.message || "Authentication failed");
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  const field = (key, type = "text", placeholder = "") => (
+    <input
+      type={type}
+      placeholder={placeholder}
+      value={form[key]}
+      onChange={(e) => setForm({ ...form, [key]: e.target.value })}
+      className="w-full px-4 py-2 rounded-lg bg-zinc-800 border border-zinc-700 text-white outline-none focus:border-indigo-500"
+      required
+    />
+  );
+
+  return (
+    <div className="min-h-screen bg-zinc-950 text-white flex items-center justify-center p-4">
+      <form onSubmit={submit} className="w-full max-w-sm space-y-4 bg-zinc-900 p-8 rounded-2xl border border-zinc-800">
+        <h1 className="text-2xl font-bold text-center">
+          {mode === "login" ? "Sign in" : "Create account"}
+        </h1>
+
+        {mode === "register" && field("name", "text", "Name")}
+        {field("email", "email", "Email")}
+        {field("password", "password", "Password")}
+
+        {error && <p className="text-sm text-red-400">{error}</p>}
+
+        <button
+          type="submit"
+          disabled={loading}
+          className="w-full py-2 rounded-lg bg-indigo-500 text-white font-semibold disabled:opacity-50"
+        >
+          {loading ? "..." : mode === "login" ? "Sign in" : "Sign up"}
+        </button>
+
+        <button
+          type="button"
+          onClick={() => setMode(mode === "login" ? "register" : "login")}
+          className="w-full text-sm text-zinc-400 hover:text-white"
+        >
+          {mode === "login" ? "Need an account? Sign up" : "Have an account? Sign in"}
+        </button>
+      </form>
+    </div>
+  );
+}

package/src/templates/saas-multitenant/frontend/src/views/DashboardView.jsx

@@ -0,0 +1,131 @@
+import { useState } from "react";
+import useAuth from "../hooks/useAuth";
+import useProjects from "../hooks/useProjects";
+
+export default function DashboardView() {
+  const { user, logout, client } = useAuth();
+  const { data: organizations } = client.useListOrganizations();
+  const { data: activeOrg } = client.useActiveOrganization();
+
+  const { projects, error: projectsError, create: createProject } = useProjects(activeOrg?.id);
+
+  const [orgName, setOrgName] = useState("");
+  const [projectName, setProjectName] = useState("");
+  const [busy, setBusy] = useState(false);
+
+  const createOrg = async (e) => {
+    e.preventDefault();
+    if (!orgName.trim()) return;
+    setBusy(true);
+    try {
+      const slug = orgName.trim().toLowerCase().replace(/\s+/g, "-");
+      await client.organization.create({ name: orgName.trim(), slug });
+      setOrgName("");
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  const setActive = async (organizationId) => {
+    await client.organization.setActive({ organizationId });
+  };
+
+  const addProject = async (e) => {
+    e.preventDefault();
+    if (!projectName.trim()) return;
+    setBusy(true);
+    try {
+      await createProject(projectName.trim());
+      setProjectName("");
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  return (
+    <div className="min-h-screen bg-zinc-950 text-white">
+      <header className="flex items-center justify-between px-6 py-4 border-b border-zinc-800">
+        <span className="font-bold">Zyket SaaS</span>
+        <div className="flex items-center gap-3 text-sm">
+          <span className="text-zinc-400">{user?.name || user?.email}</span>
+          <button onClick={logout} className="text-zinc-400 hover:text-white">Logout</button>
+        </div>
+      </header>
+
+      <main className="max-w-3xl mx-auto p-6 grid gap-6 md:grid-cols-2">
+        {/* Organizations */}
+        <section className="bg-zinc-900 border border-zinc-800 rounded-2xl p-5 space-y-4">
+          <h2 className="font-semibold">Organizations</h2>
+
+          <ul className="space-y-2">
+            {(organizations || []).map((org) => {
+              const isActive = org.id === activeOrg?.id;
+              return (
+                <li key={org.id} className="flex items-center justify-between">
+                  <span className={isActive ? "text-indigo-400" : ""}>
+                    {org.name} {isActive && "• active"}
+                  </span>
+                  {!isActive && (
+                    <button
+                      onClick={() => setActive(org.id)}
+                      className="text-xs px-2 py-1 rounded bg-zinc-800 hover:bg-zinc-700"
+                    >
+                      Set active
+                    </button>
+                  )}
+                </li>
+              );
+            })}
+            {(!organizations || organizations.length === 0) && (
+              <li className="text-sm text-zinc-600">No organizations yet.</li>
+            )}
+          </ul>
+
+          <form onSubmit={createOrg} className="flex gap-2">
+            <input
+              value={orgName}
+              onChange={(e) => setOrgName(e.target.value)}
+              placeholder="New organization"
+              className="flex-1 px-3 py-2 rounded-lg bg-zinc-800 border border-zinc-700 outline-none focus:border-indigo-500 text-sm"
+            />
+            <button disabled={busy} className="px-3 py-2 rounded-lg bg-indigo-500 text-white text-sm font-semibold disabled:opacity-50">
+              Create
+            </button>
+          </form>
+        </section>
+
+        {/* Projects (tenant-scoped) */}
+        <section className="bg-zinc-900 border border-zinc-800 rounded-2xl p-5 space-y-4">
+          <h2 className="font-semibold">Projects</h2>
+
+          {!activeOrg ? (
+            <p className="text-sm text-zinc-600">Set an active organization to manage projects.</p>
+          ) : (
+            <>
+              <ul className="space-y-2">
+                {projects.map((p) => (
+                  <li key={p.id} className="text-sm">• {p.name}</li>
+                ))}
+                {projects.length === 0 && <li className="text-sm text-zinc-600">No projects yet.</li>}
+              </ul>
+
+              {projectsError && <p className="text-sm text-red-400">{projectsError}</p>}
+
+              <form onSubmit={addProject} className="flex gap-2">
+                <input
+                  value={projectName}
+                  onChange={(e) => setProjectName(e.target.value)}
+                  placeholder="New project"
+                  className="flex-1 px-3 py-2 rounded-lg bg-zinc-800 border border-zinc-700 outline-none focus:border-indigo-500 text-sm"
+                />
+                <button disabled={busy} className="px-3 py-2 rounded-lg bg-indigo-500 text-white text-sm font-semibold disabled:opacity-50">
+                  Add
+                </button>
+              </form>
+            </>
+          )}
+        </section>
+      </main>
+    </div>
+  );
+}

package/src/templates/saas-multitenant/frontend/styles.css

@@ -0,0 +1 @@
+@import "tailwindcss";

package/src/templates/saas-multitenant/frontend/vite.config.js

@@ -0,0 +1,7 @@
+import { defineConfig } from 'vite'
+import react from '@vitejs/plugin-react'
+import tailwindcss from '@tailwindcss/vite'
+
+export default defineConfig({
+  plugins: [react(), tailwindcss()],
+})

package/src/templates/saas-multitenant/index.js

@@ -0,0 +1,14 @@
+const { Kernel } = require('zyket');
+
+const kernel = new Kernel({
+  services: [
+    ['auth', require('./src/services/auth'), ['@service_container']],
+  ],
+});
+
+kernel.boot().then(async () => {
+  await kernel.container.get('database').sync();
+  kernel.container.get('logger').info('saas-multitenant template ready');
+}).catch((error) => {
+  console.error('Error booting kernel:', error);
+});

package/src/templates/saas-multitenant/src/middlewares/RequireOrganization.js

@@ -0,0 +1,22 @@
+const { Middleware } = require('zyket');
+
+/**
+ * Requires an authenticated user that has an ACTIVE organization in the
+ * current session. Run it AFTER RequireAuthMiddleware (which attaches
+ * `request.session`). Attaches `request.organizationId`.
+ */
+module.exports = class RequireOrganization extends Middleware {
+  async handle({ request, response, next }) {
+    const activeOrganizationId = request.session?.activeOrganizationId;
+
+    if (!activeOrganizationId) {
+      return response.status(403).json({
+        success: false,
+        message: 'No active organization. Set one via POST /api/auth/organization/set-active',
+      });
+    }
+
+    request.organizationId = activeOrganizationId;
+    next();
+  }
+};

package/src/templates/saas-multitenant/src/models/Project.js

@@ -0,0 +1,17 @@
+module.exports = ({ sequelize, Sequelize }) => {
+  // A tenant-scoped resource: every project belongs to one organization.
+  const Project = sequelize.define('Project', {
+    name: {
+      type: Sequelize.STRING,
+      allowNull: false,
+    },
+    organizationId: {
+      type: Sequelize.STRING,
+      allowNull: false,
+    },
+  }, {
+    indexes: [{ fields: ['organizationId'] }],
+  });
+
+  return Project;
+};

package/src/templates/saas-multitenant/src/routes/admin/stats.js

@@ -0,0 +1,15 @@
+const { Route, RequireAdminMiddleware } = require('zyket');
+
+// Global admin-only endpoint (better-auth admin plugin role === 'admin').
+module.exports = class AdminStatsRoute extends Route {
+  middlewares = {
+    get: [new RequireAdminMiddleware()],
+  };
+
+  async get() {
+    return {
+      message: 'Admin-only data',
+      // ...gather real stats here
+    };
+  }
+};

package/src/templates/saas-multitenant/src/routes/projects/index.js

@@ -0,0 +1,34 @@
+const { Route, RequireAuthMiddleware } = require('zyket');
+const RequireOrganization = require('../../middlewares/RequireOrganization');
+
+// Tenant-scoped CRUD. RequireOrganization guarantees an active org and sets
+// `request.organizationId`; every query is isolated to that organization.
+module.exports = class ProjectsRoute extends Route {
+  middlewares = {
+    get: [new RequireAuthMiddleware(), new RequireOrganization()],
+    post: [new RequireAuthMiddleware(), new RequireOrganization()],
+  };
+
+  async get({ container, request }) {
+    const { Project } = container.get('database').models;
+    const projects = await Project.findAll({
+      where: { organizationId: request.organizationId },
+      order: [['createdAt', 'DESC']],
+    });
+    return { projects };
+  }
+
+  async post({ container, request }) {
+    const { name } = request.body || {};
+    if (!name) {
+      return { success: false, message: 'name is required', status: 400 };
+    }
+
+    const { Project } = container.get('database').models;
+    const project = await Project.create({
+      name,
+      organizationId: request.organizationId,
+    });
+    return { project, status: 201 };
+  }
+};

package/src/templates/saas-multitenant/src/services/auth/auth.js

@@ -0,0 +1,8 @@
+// Used by the better-auth CLI (`npx @better-auth/cli generate|migrate`).
+const AuthService = require('./index.js');
+
+const auth = new AuthService({
+  get: () => {},
+});
+
+module.exports = auth.auth;

package/src/templates/saas-multitenant/src/services/auth/index.js

@@ -0,0 +1,43 @@
+const { AuthService } = require('zyket');
+
+module.exports = class CustomAuthService extends AuthService {
+  // Multi-tenancy is the whole point of this template.
+  get organizationEnabled() {
+    return true;
+  }
+
+  get requireEmailVerification() {
+    return false;
+  }
+
+  get organizationAdditionalFields() {
+    return {
+      // Example custom field on the organization:
+      // plan: { type: 'string', required: false, defaultValue: 'free' },
+    };
+  }
+
+  get memberAdditionalFields() {
+    return {};
+  }
+
+  // Decide who is allowed to create new organizations.
+  async allowUserToCreateOrganization(/* user */) {
+    return true;
+  }
+
+  async sendInvitationEmail(data) {
+    // TODO: send a real email with the invite link.
+    // `data` contains { id, email, organization, inviter, role, ... }
+    const acceptUrl = `${process.env.BETTER_AUTH_URL || 'http://localhost:3000'}/accept-invitation/${data.id}`;
+    console.log(`[auth] Invite ${data.email} to "${data.organization?.name}" -> ${acceptUrl}`);
+  }
+
+  async sendResetPasswordEmail({ user, url }) {
+    console.log(`[auth] Reset password for ${user.email}: ${url}`);
+  }
+
+  async sendVerificationEmail({ user, url }) {
+    console.log(`[auth] Verify email for ${user.email}: ${url}`);
+  }
+};

package/src/utils/EnvManager.js

@@ -18,8 +18,12 @@ module.exports = class EnvManager {
     const envsToCreate = {
       DEBUG: true,
       PORT: 3000,
+      HTTP_JSON_LIMIT: '10mb',
+      SOCKET_MAX_HTTP_BUFFER_SIZE: 10 * 1024 * 1024,
       DISABLE_SOCKET: true,
       DISABLE_EXPRESS: false,
+      DISABLE_SWAGGER: false,
+      SWAGGER_PASSWORD: '',
       DISABLE_EVENTS: true,
       DISABLE_BULLMQ: true,
       DISABLE_SCHEDULER: true,
@@ -66,4 +70,23 @@ module.exports = class EnvManager {
     fs.writeFileSync(secretsPath, envContent);
     return true; // Key added successfully
   }
+
+  // Upsert: replace the value if the key exists, otherwise append it.
+  static setEnvVariable(secretsPath, key, value) {
+    if (!fs.existsSync(secretsPath)) {
+      this.createEnvFile(secretsPath);
+    }
+
+    let envContent = fs.readFileSync(secretsPath, 'utf-8');
+    const keyRegex = new RegExp(`^${key}=.*$`, 'm');
+
+    if (keyRegex.test(envContent)) {
+      envContent = envContent.replace(keyRegex, `${key}=${value}`);
+    } else {
+      if (envContent.length && !envContent.endsWith('\n')) envContent += '\n';
+      envContent += `${key}=${value}\n`;
+    }
+
+    fs.writeFileSync(secretsPath, envContent);
+  }
 }