FlaskTester 1.3__tar.gz → 2.0__tar.gz

{FlaskTester-1.3 → FlaskTester-2.0}/FlaskTester.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: FlaskTester
-Version: 1.3
+Version: 2.0
 Summary: Pytest fixtures for Flask internal and external authenticated tests
 Author-email: Fabien Coelho <flask.tester@coelho.net>
 License: CC0
@@ -32,7 +32,7 @@ Requires-Dist: twine; extra == "dev"
 Requires-Dist: wheel; extra == "dev"
 Requires-Dist: types-flask; extra == "dev"
 Requires-Dist: types-requests; extra == "dev"
-Requires-Dist: FlaskSimpleAuth; extra == "dev"
+Requires-Dist: FlaskSimpleAuth>=29.4; extra == "dev"
 Requires-Dist: passlib; extra == "dev"
 Provides-Extra: doc
 Requires-Dist: sphinx; extra == "doc"
@@ -65,7 +65,7 @@ achieved through environment variables.
 Install package with `pip install FlaskTester` or equivalent.
 
 The following test creates a local fixture with 2 users identified by a
-password, and retrieves a token for the first user using a `/login` route
+password, and retrieves tokens for both users using a `/login` route
 provided by the application.
 It then proceeds to run authenticated requests against the `/admin` route.
 
@@ -86,6 +86,9 @@ def app(ft_client):
     res = ft_client.post("/login", login="hobbes", auth="param", status=201)
     assert res.is_json
     ft_client.setToken("hobbes", res.json["token"])
+    # also set a cookie
+    ft_client.setCookie("hobbes", "lang", "fr_FR")
+    ft_client.setCookie("calvin", "lang", "en_EN")
     # return working client
     yield ft_client
 
@@ -155,6 +158,7 @@ The package provides two fixtures:
   The fixture has 3 main methods:
   - `setPass` to associate a password to a user, set to _None_ to remove credential.
   - `setToken` to associate a token to a user, set to _None_ to remove credential.
+  - `setCookie` to add a cookie to a user, set value to _None_ to remove cookie.
   - `setAuth` to add authentication data to a request `kwargs`.
 
 - `ft_client` for app testing, which depends on the previous fixture, plus
@@ -175,7 +179,7 @@ The package provides two fixtures:
   The fixture then provides test methods to issue test requests against a Flask application:
   - `request` generic request with `login`, `auth`, `status` end `content` extensions.
   - `get post put patch delete` methods with `login`, `auth` and `status` extensions.
-  Moreover, `setPass` and `setToken` are forwarded to the internal authenticator.
+  Moreover, `setPass`, `setToken` and `setCookie` are forwarded to the internal authenticator.
 
 Authenticator environment variables can be set from the pytest Python test file by
 assigning them through `os.environ`.
@@ -225,14 +229,30 @@ The implementation of these fixtures is based on five classes plus exceptions:
 
 ## License
 
-This code is public domain.
+This code is [Public Domain](https://creativecommons.org/publicdomain/zero/1.0/).
+
+All software has bug, this is software, hence… Beware that you may lose your
+hairs or your friends because of it. If you like it, feel free to send a
+postcard to the author.
+
+## Versions
 
 Packages are distributed from [PyPI](https://pypi.org/project/FlaskTester/),
 [sources](https://github.com/zx80/flask-tester) are available on GitHub,
 see also the [documentation](https://zx80.github.io/flask-tester/),
 please report any [issues](https://github.com/zx80/flask-tester/issues).
 
-## Versions
+### 2.0 on 2024-03-23
+
+Add support for cookies.
+Improved documentation and code.
+Improved tests.
+
+### 1.4 on 2024-03-19
+
+Test expected assert failures.
+Improved API documentation.
+Keep first found app.
 
 ### 1.3 on 2024-03-16
 

{FlaskTester-1.3 → FlaskTester-2.0}/FlaskTester.egg-info/requires.txt

@@ -13,7 +13,7 @@ twine
 wheel
 types-flask
 types-requests
-FlaskSimpleAuth
+FlaskSimpleAuth>=29.4
 passlib
 
 [doc]

{FlaskTester-1.3 → FlaskTester-2.0}/FlaskTester.py

@@ -1,3 +1,8 @@
+"""FlaskTester - Pytest fixtures for Flask authenticated internal and external tests.
+
+Pytest: PYTEST_DONT_REWRITE
+"""
+
 import os
 import io
 import re
@@ -55,6 +60,7 @@ class Authenticator:
     _TOKEN_SCHEMES = {"bearer", "header", "cookie", "tparam"}
     _PASS_SCHEMES = {"basic", "param"}
 
+    # all supported authentication schemes
     _AUTH_SCHEMES = {"fake"}
     _AUTH_SCHEMES.update(_TOKEN_SCHEMES)
     _AUTH_SCHEMES.update(_PASS_SCHEMES)
@@ -91,21 +97,25 @@ class Authenticator:
         self._cookie = cookie
         self._tparam = tparam
 
-        # password and token credentials
+        # password and token credentials, cookies
         self._passes: dict[str, str] = {}
         self._tokens: dict[str, str] = {}
+        self._cookies: dict[str, dict[str, str]] = {}
 
-    def _set(self, login: str, val: str|None, store: dict[str, str]):
+    def _set(self, key: str, val: str|None, store: dict[str, str]):
         """Set a key/value in a directory, with None for delete."""
         if val is None:
-            if login in store:
-                del store[login]
+            if key in store:
+                del store[key]
         else:
             assert isinstance(val, str)
-            store[login] = val
+            store[key] = val
 
     def setPass(self, login: str, pw: str|None):
-        """Associate a password to a user."""
+        """Associate a password to a user.
+
+        Set to *None* to remove the password entry.
+        """
         if not self._has_pass:
             raise AuthError("cannot set password, no password scheme allowed")
         self._set(login, pw, self._passes)
@@ -117,11 +127,20 @@ class Authenticator:
             self.setPass(login, pw)
 
     def setToken(self, login: str, token: str|None):
-        """Associate a token to a user."""
+        """Associate a token to a user.
+
+        Set to *None* to remove the token entry.
+        """
         if not self._has_token:
             raise AuthError("cannot set token, no token scheme allowed")
         self._set(login, token, self._tokens)
 
+    def setCookie(self, login: str, name: str, val: str|None = None):
+        """Associate a cookie and its value to a login, *None* to remove."""
+        if login not in self._cookies:
+            self._cookies[login] = {}
+        self._set(name, val, self._cookies[login])
+
     def _param(self, kwargs: dict[str, Any], key: str, val: Any):
         """Add request parameter to "json" or "data"."""
 
@@ -138,12 +157,16 @@ class Authenticator:
         """Whether to try this authentication scheme."""
         return auth in (None, scheme) and scheme in self._allow
 
-    def setAuth(self, login: str|None, kwargs: dict[str, Any], auth: str|None = None):
+    def setAuth(self, login: str|None, kwargs: dict[str, Any], cookies: dict[str, str], auth: str|None = None):
         """Set request authentication.
 
         - login: login target, None means no authentication
         - kwargs: request parameters
-        - auth: authentication method, default None is to try allowed schemes, tokens first.
+        - cookies: request cookies
+        - auth: authentication method, default is None
+
+        The default behavior is to try allowed schemes: tokens first,
+        then password, then fake.
         """
 
         log.debug(f"setAuth: login={login} auth={auth} allow={self._allow}")
@@ -151,29 +174,29 @@ class Authenticator:
         if login is None:  # not needed
             return
 
+        cookies.update(self._cookies.get(login, {}))
+
         if auth is not None:
             if auth not in self._AUTH_SCHEMES:
                 raise AuthError(f"unexpected auth: {auth}")
             if auth not in self._allow:
                 raise AuthError(f"auth is not allowed: {auth}")
 
+        headers = kwargs.get("headers", {})
+
         # use token if available and allowed
         if login in self._tokens and auth in (None, "bearer", "header", "cookie", "tparam"):
 
             token = self._tokens[login]
 
-            if "headers" not in kwargs:
-                kwargs["headers"] = {}
-
             if self._try_auth(auth, "bearer"):
-                kwargs["headers"]["Authorization"] = self._bearer + " " + token
+                headers["Authorization"] = self._bearer + " " + token
             elif self._try_auth(auth, "header"):
-                kwargs["headers"][self._header] = token
+                headers[self._header] = token
             elif self._try_auth(auth, "tparam"):
                 self._param(kwargs, self._tparam, token)
             elif self._try_auth(auth, "cookie"):
-                # FIXME cookie?
-                kwargs["headers"]["Cookie"] = self._cookie + "=" + token
+                cookies[self._cookie] = token
             else:
                 raise AuthError(f"no token carrier: login={login} auth={auth} allow={self._allow}")
 
@@ -195,6 +218,9 @@ class Authenticator:
 
             raise AuthError(f"no authentication for login={login} auth={auth} allow={self._allow}")
 
+        if headers:  # put headers back if needed
+            kwargs["headers"] = headers
+
 
 class RequestFlaskResponse:
     """Wrapper to return a Flask-looking response from a request response.
@@ -233,16 +259,17 @@ class RequestFlaskResponse:
 
 
 class Client:
-    """Common class for flask authenticated testing.
+    """Common (partial) class for flask authenticated testing.
 
     Constructor parameters:
 
     - ``auth`` authenticator
-    - ``default_login`` if not ``login`` is set.
+    - ``default_login`` if ``login`` is not set.
     """
 
     def __init__(self, auth: Authenticator, default_login: str|None = None):
         self._auth = auth
+        self._cookies: dict[str, dict[str, str]] = {}  # login -> name -> value
         self._default_login = default_login
 
     def setToken(self, login: str, token: str|None):
@@ -253,7 +280,11 @@ class Client:
         """Associate a password to a login, *None* to remove."""
         self._auth.setPass(login, password)
 
-    def _request(self, method: str, path: str, **kwargs):
+    def setCookie(self, login: str, name: str, val: str|None):
+        """Associate a cookie to a login, *None* name to remove."""
+        self._auth.setCookie(login, name, val)
+
+    def _request(self, method: str, path: str, cookies: dict[str, str], **kwargs):
         """Run a request and return response."""
         raise NotImplementedError()
 
@@ -269,7 +300,7 @@ class Client:
 
         - ``status``: expected HTTP status, *None* to skip status check
         - ``login``: authenticated user, use **explicit** *None* to skip
-        - ``auth``: authentication scheme to use
+        - ``auth``: authentication scheme to use instead of default behavior
         - ``**kwargs``: more request parameters (headers, data, json…)
         """
 
@@ -279,13 +310,18 @@ class Client:
         else:  # if unset, use default
             login = self._default_login
 
-        self._auth.setAuth(login, kwargs, auth=auth)
-        res = self._request(method, path, **kwargs)  # type: ignore
+        cookies: dict[str, str] = {}
+        if "cookies" in kwargs:
+            cookies.update(kwargs["cookies"])
+            del kwargs["cookies"]
+
+        self._auth.setAuth(login, kwargs, cookies, auth=auth)
+        res = self._request(method, path, cookies, **kwargs)  # type: ignore
 
         if status is not None:
-            if res.status_code != status:  # pragma: no cover  # show error before aborting
+            if res.status_code != status:  # show error before aborting
                 log.error(f"bad {status} result: {res.status_code} {res.text[:512]}")
-            assert res.status_code == status
+            assert res.status_code == status, f"unexpected status {res.status_code}, expecting {status}"
 
         return res
 
@@ -330,9 +366,9 @@ class Client:
 
         # check contents
         if content is not None:
-            if not re.search(content, res.text, re.DOTALL):  # pragma: no cover
+            if not re.search(content, res.text, re.DOTALL):
                 log.error(f"cannot find {content} in {res.text}")
-                assert False, "content not found"
+                assert False, f"expected content {content} not found in {res.text}"
 
         return res
 
@@ -344,7 +380,7 @@ class RequestClient(Client):
 
     - ``auth`` authenticator
     - ``base_url`` target server
-    - ``default_login`` if not ``login`` is set.
+    - ``default_login`` if ``login`` is not set.
     """
 
     def __init__(self, auth: Authenticator, base_url: str, default_login=None):
@@ -354,7 +390,7 @@ class RequestClient(Client):
         from requests import Session
         self._requests = Session()
 
-    def _request(self, method: str, path: str, **kwargs):
+    def _request(self, method: str, path: str, cookies: dict[str, str], **kwargs):
         """Actual request handling."""
 
         if "data" in kwargs:
@@ -378,7 +414,7 @@ class RequestClient(Client):
             # sanity
             assert not (files and "json" in kwargs), "cannot mix file upload and json?"
 
-        res = self._requests.request(method, self._base_url + path, **kwargs)
+        res = self._requests.request(method, self._base_url + path, cookies=cookies, **kwargs)
 
         return RequestFlaskResponse(res)
 
@@ -389,22 +425,61 @@ class FlaskClient(Client):
     Constructor parameters:
 
     - ``auth`` authenticator
-    - ``client`` Flask ``test_client``
-    - ``default_login`` if not ``login`` is set.
+    - ``client`` Flask actual ``test_client``
+    - ``default_login`` if ``login`` is not set.
+
+    Note: this client handles `cookies`.
     """
 
     def __init__(self, auth: Authenticator, client, default_login=None):
         super().__init__(auth, default_login)
         self._client = client
+        self._cookie_names: set[str] = set()  # FIXME all encountered cookies for cleanup :-/
 
-    def _request(self, method: str, path: str, **kwargs):
+    def _request(self, method: str, path: str, cookies: dict[str, str], **kwargs):
         """Actual request handling."""
+
+        # hack to cleanup client state :-/
+        for cookie in self._cookie_names:
+            self._client.delete_cookie(cookie)
+
+        for cookie, val in cookies.items():
+            if cookie not in self._cookie_names:
+                self._cookie_names.add(cookie)
+            self._client.set_cookie(cookie, val)
+
         return self._client.open(method=method, path=path, **kwargs)
 
 
 @pytest.fixture
 def ft_authenticator():
-    """Pytest Fixture: ft_authenticator."""
+    """Pytest Fixture: ft_authenticator.
+
+    Environment variables:
+
+    - ``FLASK_TESTER_LOG_LEVEL``: package log level in
+      ``DEBUG INFO WARNING ERROR CRITICAL NOSET``.
+      Default is ``NOTSET``.
+    - ``FLASK_TESTER_ALLOW``: allowed space-separated authentication schemes, in
+      ``basic param bearer header cookie tparam fake``.
+      Default is ``bearer basic param``.
+    - ``FLASK_TESTER_USER``: user login parameter for ``param`` authentication.
+      Default is ``USER``.
+    - ``FLASK_TESTER_PASS``: user password parameter for ``param`` authentication.
+      Default is ``PASS``.
+    - ``FLASK_TESTER_LOGIN``: user login parameter for ``fake`` authentication.
+      Default is ``LOGIN``.
+    - ``FLASK_TESTER_BEARER``: bearer name for *token* authentication.
+      Default is ``Bearer``.
+    - ``FLASK_TESTER_HEADER``: header name for *token* authentication.
+      Default is ``Auth``.
+    - ``FLASK_TESTER_COOKIE``: cookie name for *token* authentication.
+      Default is ``auth``.
+    - ``FLASK_TESTER_TPARAM``: parameter for *token* authentication.
+      Default is ``AUTH``.
+    - ``FLASK_TESTER_AUTH``: initial comma-separated list of *login:password*.
+      Default is not set.
+    """
 
     level = os.environ.get("FLASK_TESTER_LOG_LEVEL", "NOTSET")
     log.setLevel(logging.DEBUG if level == "DEBUG" else
@@ -436,7 +511,18 @@ def ft_authenticator():
 
 @pytest.fixture
 def ft_client(ft_authenticator):
-    """Pytest Fixture: ft_client."""
+    """Pytest Fixture: ft_client.
+
+    Target environment variable, one **must** be defined:
+
+    - ``FLASK_TESTER_URL``: application HTTP base URL.
+    - ``FLASK_TESTER_APP``: Flask application, eg ``app:create_app``.
+
+    Other environment variable:
+
+    - ``FLASK_TESTER_DEFAULT``: Default client login, default is *None* for no
+      default.
+    """
 
     default_login = os.environ.get("FLASK_TESTER_DEFAULT", None)
     client: Client
@@ -461,6 +547,7 @@ def ft_client(ft_authenticator):
                 app = getattr(pkg, name)
                 if callable(app) and not hasattr(app, "test_client"):
                     app = app()
+                break
         if not app:  # pragma: no cover
             raise FlaskTesterError(f"cannot find Flask app in {pkg_name}")
         client = FlaskClient(ft_authenticator, app.test_client(), default_login)

{FlaskTester-1.3 → FlaskTester-2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: FlaskTester
-Version: 1.3
+Version: 2.0
 Summary: Pytest fixtures for Flask internal and external authenticated tests
 Author-email: Fabien Coelho <flask.tester@coelho.net>
 License: CC0
@@ -32,7 +32,7 @@ Requires-Dist: twine; extra == "dev"
 Requires-Dist: wheel; extra == "dev"
 Requires-Dist: types-flask; extra == "dev"
 Requires-Dist: types-requests; extra == "dev"
-Requires-Dist: FlaskSimpleAuth; extra == "dev"
+Requires-Dist: FlaskSimpleAuth>=29.4; extra == "dev"
 Requires-Dist: passlib; extra == "dev"
 Provides-Extra: doc
 Requires-Dist: sphinx; extra == "doc"
@@ -65,7 +65,7 @@ achieved through environment variables.
 Install package with `pip install FlaskTester` or equivalent.
 
 The following test creates a local fixture with 2 users identified by a
-password, and retrieves a token for the first user using a `/login` route
+password, and retrieves tokens for both users using a `/login` route
 provided by the application.
 It then proceeds to run authenticated requests against the `/admin` route.
 
@@ -86,6 +86,9 @@ def app(ft_client):
     res = ft_client.post("/login", login="hobbes", auth="param", status=201)
     assert res.is_json
     ft_client.setToken("hobbes", res.json["token"])
+    # also set a cookie
+    ft_client.setCookie("hobbes", "lang", "fr_FR")
+    ft_client.setCookie("calvin", "lang", "en_EN")
     # return working client
     yield ft_client
 
@@ -155,6 +158,7 @@ The package provides two fixtures:
   The fixture has 3 main methods:
   - `setPass` to associate a password to a user, set to _None_ to remove credential.
   - `setToken` to associate a token to a user, set to _None_ to remove credential.
+  - `setCookie` to add a cookie to a user, set value to _None_ to remove cookie.
   - `setAuth` to add authentication data to a request `kwargs`.
 
 - `ft_client` for app testing, which depends on the previous fixture, plus
@@ -175,7 +179,7 @@ The package provides two fixtures:
   The fixture then provides test methods to issue test requests against a Flask application:
   - `request` generic request with `login`, `auth`, `status` end `content` extensions.
   - `get post put patch delete` methods with `login`, `auth` and `status` extensions.
-  Moreover, `setPass` and `setToken` are forwarded to the internal authenticator.
+  Moreover, `setPass`, `setToken` and `setCookie` are forwarded to the internal authenticator.
 
 Authenticator environment variables can be set from the pytest Python test file by
 assigning them through `os.environ`.
@@ -225,14 +229,30 @@ The implementation of these fixtures is based on five classes plus exceptions:
 
 ## License
 
-This code is public domain.
+This code is [Public Domain](https://creativecommons.org/publicdomain/zero/1.0/).
+
+All software has bug, this is software, hence… Beware that you may lose your
+hairs or your friends because of it. If you like it, feel free to send a
+postcard to the author.
+
+## Versions
 
 Packages are distributed from [PyPI](https://pypi.org/project/FlaskTester/),
 [sources](https://github.com/zx80/flask-tester) are available on GitHub,
 see also the [documentation](https://zx80.github.io/flask-tester/),
 please report any [issues](https://github.com/zx80/flask-tester/issues).
 
-## Versions
+### 2.0 on 2024-03-23
+
+Add support for cookies.
+Improved documentation and code.
+Improved tests.
+
+### 1.4 on 2024-03-19
+
+Test expected assert failures.
+Improved API documentation.
+Keep first found app.
 
 ### 1.3 on 2024-03-16
 

{FlaskTester-1.3 → FlaskTester-2.0}/README.md

@@ -22,7 +22,7 @@ achieved through environment variables.
 Install package with `pip install FlaskTester` or equivalent.
 
 The following test creates a local fixture with 2 users identified by a
-password, and retrieves a token for the first user using a `/login` route
+password, and retrieves tokens for both users using a `/login` route
 provided by the application.
 It then proceeds to run authenticated requests against the `/admin` route.
 
@@ -43,6 +43,9 @@ def app(ft_client):
     res = ft_client.post("/login", login="hobbes", auth="param", status=201)
     assert res.is_json
     ft_client.setToken("hobbes", res.json["token"])
+    # also set a cookie
+    ft_client.setCookie("hobbes", "lang", "fr_FR")
+    ft_client.setCookie("calvin", "lang", "en_EN")
     # return working client
     yield ft_client
 
@@ -112,6 +115,7 @@ The package provides two fixtures:
   The fixture has 3 main methods:
   - `setPass` to associate a password to a user, set to _None_ to remove credential.
   - `setToken` to associate a token to a user, set to _None_ to remove credential.
+  - `setCookie` to add a cookie to a user, set value to _None_ to remove cookie.
   - `setAuth` to add authentication data to a request `kwargs`.
 
 - `ft_client` for app testing, which depends on the previous fixture, plus
@@ -132,7 +136,7 @@ The package provides two fixtures:
   The fixture then provides test methods to issue test requests against a Flask application:
   - `request` generic request with `login`, `auth`, `status` end `content` extensions.
   - `get post put patch delete` methods with `login`, `auth` and `status` extensions.
-  Moreover, `setPass` and `setToken` are forwarded to the internal authenticator.
+  Moreover, `setPass`, `setToken` and `setCookie` are forwarded to the internal authenticator.
 
 Authenticator environment variables can be set from the pytest Python test file by
 assigning them through `os.environ`.
@@ -182,14 +186,30 @@ The implementation of these fixtures is based on five classes plus exceptions:
 
 ## License
 
-This code is public domain.
+This code is [Public Domain](https://creativecommons.org/publicdomain/zero/1.0/).
+
+All software has bug, this is software, hence… Beware that you may lose your
+hairs or your friends because of it. If you like it, feel free to send a
+postcard to the author.
+
+## Versions
 
 Packages are distributed from [PyPI](https://pypi.org/project/FlaskTester/),
 [sources](https://github.com/zx80/flask-tester) are available on GitHub,
 see also the [documentation](https://zx80.github.io/flask-tester/),
 please report any [issues](https://github.com/zx80/flask-tester/issues).
 
-## Versions
+### 2.0 on 2024-03-23
+
+Add support for cookies.
+Improved documentation and code.
+Improved tests.
+
+### 1.4 on 2024-03-19
+
+Test expected assert failures.
+Improved API documentation.
+Keep first found app.
 
 ### 1.3 on 2024-03-16
 

{FlaskTester-1.3 → FlaskTester-2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "FlaskTester"
-version = "1.3"
+version = "2.0"
 authors = [ { name = "Fabien Coelho", email = "flask.tester@coelho.net" } ]
 description = "Pytest fixtures for Flask internal and external authenticated tests"
 readme = "README.md"
@@ -33,7 +33,7 @@ package = "https://pypi.org/project/FlaskTester/"
 
 [project.optional-dependencies]
 # various dev tools
-dev = ["mypy", "pyright", "ruff", "coverage", "pymarkdownlnt!=0.9.5", "build", "twine", "wheel", "types-flask", "types-requests", "FlaskSimpleAuth", "passlib"]
+dev = ["mypy", "pyright", "ruff", "coverage", "pymarkdownlnt!=0.9.5", "build", "twine", "wheel", "types-flask", "types-requests", "FlaskSimpleAuth>=29.4", "passlib"]
 # documentation generation
 doc = ["sphinx", "sphinx_rtd_theme", "sphinx-autoapi", "sphinx-lint", "myst_parser"]
 

{FlaskTester-1.3 → FlaskTester-2.0}/tests/test.py

@@ -10,6 +10,8 @@ import io
 import logging
 
 logging.basicConfig(level=logging.INFO)
+# logging.basicConfig(level=logging.DEBUG)
+# log = logging.getLogger("test")
 
 # set authn for ft_authenticator
 os.environ.update(
@@ -20,6 +22,7 @@ os.environ.update(
 def test_sanity():
     # must provide url or package of Flask application to test
     assert "FLASK_TESTER_URL" in os.environ or "FLASK_TESTER_APP" in os.environ
+    # log.debug(f"TEST_SEED={os.environ.get('TEST_SEED')}")
 
 # example from README.md
 @pytest.fixture
@@ -34,6 +37,9 @@ def app(ft_client):
     res = ft_client.post("/login", login="hobbes", auth="param", status=201)
     assert res.is_json
     ft_client.setToken("hobbes", res.json["token"])
+    # also set a cookie
+    ft_client.setCookie("hobbes", "lang", "fr_FR")
+    ft_client.setCookie("calvin", "lang", "en_EN")
     # return working client
     yield ft_client
 
@@ -59,6 +65,9 @@ def api(ft_client):
     ft_client.setToken("moe", None)
     ft_client.setPass("moe", "bad password")
     ft_client.setToken("moe", "bad token")
+    # cookies
+    ft_client.setCookie("calvin", "lang", "en_EN")
+    ft_client.setCookie("hobbes", "lang", "fr_FR")
     # get valid tokens using password authn
     res = ft_client.get("/login", login="calvin", auth="basic", status=200)
     assert res.json["user"] == "calvin"
@@ -69,13 +78,13 @@ def api(ft_client):
     res = ft_client.post("/login", login="susie", auth="param", status=201, json={})
     assert res.json["user"] == "susie"
     ft_client._auth.setToken("susie", res.json["token"])
-    # check that token auth is ok
+    # check that token auth and cookie is ok
     res = ft_client.get("/who-am-i", login="calvin", status=200, auth="bearer")
-    assert res.json["user"] == "calvin"
+    assert res.json["user"] == "calvin" and res.json["lang"] == "en_EN"
     res = ft_client.get("/who-am-i", login="hobbes", status=200, auth="bearer")
-    assert res.json["user"] == "hobbes"
+    assert res.json["user"] == "hobbes" and res.json["lang"] == "fr_FR"
     res = ft_client.get("/who-am-i", login="susie", status=200, auth="bearer")
-    assert res.json["user"] == "susie"
+    assert res.json["user"] == "susie" and res.json["lang"] is None
     # with defaults
     res = ft_client.get("/who-am-i", auth="basic", status=200)
     assert res.json["user"] == "calvin"
@@ -96,17 +105,28 @@ def test_admin(api):
         api.check("GET", "/admin", 403, login="hobbes", auth=auth)
         api.check("GET", "/admin", 401, login="moe", auth=auth)
         api.check("GET", "/admin", 401, login=None, auth=auth)
+        try:
+            api.check("GET", "/admin", status=599, login="calvin", auth=auth)
+            pytest.fail("assert on status must fail")  # pragma: no cover
+        except AssertionError as e:
+            assert "200" in str(e)
+        try:
+            api.check("GET", "/admin", status=200, login="calvin", auth=auth, content="NOT THERE")
+            pytest.fail("assert on content must fail")  # pragma: no cover
+        except AssertionError as e:
+            assert "NOT THERE" in str(e)
 
 def test_errors(api):
     for scheme in ("header", "cookie", "fake", "tparam", "unexpected"):
         try:
             api.get("/login", login="calvin", auth=scheme)
-            assert False, "must raise an exception"  # pragma: no cover
+            pytest.fail("must raise an exception")  # pragma: no cover
         except ft.AuthError as e:
             assert True, "expected error"
 
 def test_methods(api):
-    api.get("/who-am-i", login="hobbes", status=200)
+    res = api.get("/who-am-i", login="susie", status=200, cookies={"lang": "python"})
+    assert res.json["lang"] == "python"
     api.post("/who-am-i", login="hobbes", status=405)
     api.put("/who-am-i", login="hobbes", status=405)
     api.patch("/who-am-i", login="hobbes", status=405)
@@ -119,41 +139,47 @@ def test_authenticator_token():
     auth.setToken("susie", "ss-token")
     auth.setToken("hobbes", "hbs-token")
     auth.setToken("moe", "m-token")
-    kwargs = {}
-    auth.setAuth("calvin", kwargs, auth="bearer")
+    auth.setCookie("calvin", "what", "clv-cookie")
+    kwargs, cookies = {}, {}
+    auth.setAuth("calvin", kwargs, cookies, auth="bearer")
     assert kwargs["headers"]["Authorization"] == "Bearer clv-token"
-    kwargs = {}
-    auth.setAuth("susie", kwargs, auth="header")
+    assert cookies["what"] == "clv-cookie"
+    kwargs, cookies = {}, {}
+    auth.setAuth("susie", kwargs, cookies, auth="header")
     assert kwargs["headers"]["Auth"] == "ss-token"
-    kwargs = {"data": {}}
-    auth.setAuth("hobbes", kwargs, auth="tparam")
+    assert not cookies
+    kwargs, cookies = {"data": {}}, {}
+    auth.setAuth("hobbes", kwargs, cookies, auth="tparam")
     assert kwargs["data"]["AUTH"] == "hbs-token"
-    kwargs = {"json": {}}
-    auth.setAuth("hobbes", kwargs, auth="tparam")
+    assert not cookies
+    kwargs, cookies = {"json": {}}, {}
+    auth.setAuth("hobbes", kwargs, cookies, auth="tparam")
     assert kwargs["json"]["AUTH"] == "hbs-token"
-    kwargs = {}
-    auth.setAuth("moe", kwargs, auth="cookie")
-    assert kwargs["headers"]["Cookie"] == "auth=m-token"
+    assert not cookies
+    kwargs, cookies = {}, {}
+    auth.setAuth("moe", kwargs, cookies, auth="cookie")
+    assert not kwargs
+    assert cookies["auth"] == "m-token"
     # dad does not have a token
     try:
-        kwargs = {}
-        auth.setAuth("dad", kwargs)
-        assert False, "must raise an error"  # pragma: no cover
+        kwargs, cookies = {}, {}
+        auth.setAuth("dad", kwargs, cookies)
+        pytest.fail("must raise an error")  # pragma: no cover
     except ft.FlaskTesterError:
         assert True, "error raised"
     # rosalyn as a password, but no password carrier is allowed
     try:
         auth.setPass("rosalyn", "rsln-pass")
-        assert False, "must raise an error"  # pragma: no cover
+        pytest.fail("must raise an error")  # pragma: no cover
     except ft.AuthError:
         assert True, "error raised"
     # force to trigger later errors
     auth._has_pass = True
     auth.setPass("rosalyn", "rsln-pass")
     try:
-        kwargs={}
-        auth.setAuth("rosalyn", kwargs)
-        assert False, "must raise an error"  # pragma: no cover
+        kwargs, cookies = {}, {}
+        auth.setAuth("rosalyn", kwargs, cookies)
+        pytest.fail("must raise an error")  # pragma: no cover
     except ft.FlaskTesterError:
         assert True, "error raised"
 
@@ -164,34 +190,40 @@ def test_authenticator_password():
     auth.setPass("hobbes", "hbs-pass")
     auth.setPass("moe", "m-pass")
     auth.setPass("rosalyn", "rsln-pass")
-    kwargs = {}
-    auth.setAuth("calvin", kwargs, auth="basic")
+    auth.setCookie("moe", "hello", "world!")
+    kwargs, cookies = {}, {}
+    auth.setAuth("calvin", kwargs, cookies, auth="basic")
     assert kwargs["auth"] == ("calvin", "clv-pass")
-    kwargs = {"data": {}}
-    auth.setAuth("hobbes", kwargs, auth="param")
+    assert not cookies
+    kwargs, cookies = {"data": {}}, {}
+    auth.setAuth("hobbes", kwargs, cookies, auth="param")
     assert kwargs["data"]["USER"] == "hobbes" and kwargs["data"]["PASS"] == "hbs-pass"
-    kwargs = {"json": {}}
-    auth.setAuth("moe", kwargs, auth="param")
+    assert not cookies
+    kwargs, cookies = {"json": {}}, {}
+    auth.setAuth("moe", kwargs, cookies, auth="param")
     assert kwargs["json"]["USER"] == "moe" and kwargs["json"]["PASS"] == "m-pass"
-    kwargs = {"data": {}}
-    auth.setAuth("rosalyn", kwargs, auth="fake")
+    assert cookies["hello"] == "world!"
+    kwargs, cookies = {"data": {}}, {}
+    auth.setAuth("rosalyn", kwargs, cookies, auth="fake")
     assert kwargs["data"]["LOGIN"] == "rosalyn"
-    kwargs = {"json": {}}
-    auth.setAuth("hobbes", kwargs, auth="fake")
+    assert not cookies
+    kwargs, cookies = {"json": {}}, {}
+    auth.setAuth("hobbes", kwargs, cookies, auth="fake")
     assert kwargs["json"]["LOGIN"] == "hobbes"
+    assert not cookies
     # susie as a token, but no token carrier is allowed
     try:
         auth.setToken("susie", "ss-token")
-        assert False, "must raise an error"  # pragma: no cover
+        pytest.fail("must raise an error")  # pragma: no cover
     except ft.FlaskTesterError:
         assert True, "error raised"
     # force to trigger later error
     auth._has_token = True
     auth.setToken("susie", "ss-token")
     try:
-        kwargs={}
-        auth.setAuth("susie", kwargs)
-        assert False, "must raise an error"  # pragma: no cover
+        kwargs, cookies = {}, {}
+        auth.setAuth("susie", kwargs, cookies)
+        pytest.fail("must raise an error")  # pragma: no cover
     except ft.FlaskTesterError:
         assert True, "error raised"
 
@@ -223,10 +255,10 @@ def test_request_flask_response():
 def test_client():
     client = ft.Client(ft.Authenticator())
     try:
-        client._request("GET", "/")
-        assert False, "must raise an error"  # pragma: no cover
+        client._request("GET", "/", {})
+        pytest.fail("must raise an error")  # pragma: no cover
     except NotImplementedError:
-        assert True, "error raised"
+        assert True, "expected error raised"
 
 def test_request_client():
     httpd = htsv.HTTPServer(("", 8888), htsv.SimpleHTTPRequestHandler)