FlaskTester 1.4__tar.gz → 3.0__tar.gz

{FlaskTester-1.4 → FlaskTester-3.0}/FlaskTester.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: FlaskTester
-Version: 1.4
+Version: 3.0
 Summary: Pytest fixtures for Flask internal and external authenticated tests
 Author-email: Fabien Coelho <flask.tester@coelho.net>
 License: CC0
@@ -32,7 +32,7 @@ Requires-Dist: twine; extra == "dev"
 Requires-Dist: wheel; extra == "dev"
 Requires-Dist: types-flask; extra == "dev"
 Requires-Dist: types-requests; extra == "dev"
-Requires-Dist: FlaskSimpleAuth; extra == "dev"
+Requires-Dist: FlaskSimpleAuth>=29.5; extra == "dev"
 Requires-Dist: passlib; extra == "dev"
 Provides-Extra: doc
 Requires-Dist: sphinx; extra == "doc"
@@ -52,7 +52,7 @@ Only one set of tests is needed, switching from internal to external is
 achieved through environment variables.
 
 ![Status](https://github.com/zx80/flask-tester/actions/workflows/package.yml/badge.svg?branch=main&style=flat)
-![Tests](https://img.shields.io/badge/tests-10%20✓-success)
+![Tests](https://img.shields.io/badge/tests-11%20✓-success)
 ![Coverage](https://img.shields.io/badge/coverage-100%25-success)
 ![Issues](https://img.shields.io/github/issues/zx80/flask-tester?style=flat)
 ![Python](https://img.shields.io/badge/python-3-informational)
@@ -86,6 +86,9 @@ def app(ft_client):
     res = ft_client.post("/login", login="hobbes", auth="param", status=201)
     assert res.is_json
     ft_client.setToken("hobbes", res.json["token"])
+    # also set a cookie
+    ft_client.setCookie("hobbes", "lang", "fr_FR")
+    ft_client.setCookie("calvin", "lang", "en_EN")
     # return working client
     yield ft_client
 
@@ -133,7 +136,7 @@ The package provides two fixtures:
 - `ft_authenticator` for app authentication, which depends on environment variables:
 
   - `FLASK_TESTER_ALLOW` space-separated list of allowed authentication schemes,
-    default is `["bearer", "basic", "param"]`.
+    default is `["bearer", "basic", "param", "none"]`.
   - `FLASK_TESTER_AUTH` comma-separated list of _login:password_ credentials.
   - `FLASK_TESTER_USER` user login parameter for `param` password authentication,
     default is `USER`.
@@ -155,7 +158,8 @@ The package provides two fixtures:
   The fixture has 3 main methods:
   - `setPass` to associate a password to a user, set to _None_ to remove credential.
   - `setToken` to associate a token to a user, set to _None_ to remove credential.
-  - `setAuth` to add authentication data to a request `kwargs`.
+  - `setCookie` to add a cookie to a user, set value to _None_ to remove cookie.
+  - `setAuth` to add authentication data to a request `kwargs` and `cookies`.
 
 - `ft_client` for app testing, which depends on the previous fixture, plus
   environment variables which allow to find the application, at least one must
@@ -175,7 +179,7 @@ The package provides two fixtures:
   The fixture then provides test methods to issue test requests against a Flask application:
   - `request` generic request with `login`, `auth`, `status` end `content` extensions.
   - `get post put patch delete` methods with `login`, `auth` and `status` extensions.
-  Moreover, `setPass` and `setToken` are forwarded to the internal authenticator.
+  Moreover, `setPass`, `setToken` and `setCookie` are forwarded to the internal authenticator.
 
 Authenticator environment variables can be set from the pytest Python test file by
 assigning them through `os.environ`.
@@ -238,6 +242,16 @@ Packages are distributed from [PyPI](https://pypi.org/project/FlaskTester/),
 see also the [documentation](https://zx80.github.io/flask-tester/),
 please report any [issues](https://github.com/zx80/flask-tester/issues).
 
+### 3.0 on 2024-03-23
+
+Add support for `none` authentication, with only cookies.
+
+### 2.0 on 2024-03-23
+
+Add support for cookies.
+Improved documentation and code.
+Improved tests.
+
 ### 1.4 on 2024-03-19
 
 Test expected assert failures.

{FlaskTester-1.4 → FlaskTester-3.0}/FlaskTester.egg-info/requires.txt

@@ -13,7 +13,7 @@ twine
 wheel
 types-flask
 types-requests
-FlaskSimpleAuth
+FlaskSimpleAuth>=29.5
 passlib
 
 [doc]

{FlaskTester-1.4 → FlaskTester-3.0}/FlaskTester.py

@@ -36,11 +36,12 @@ class Authenticator:
     - ``cookie``: token in a cookie
     - ``tparam``: token in a parameter
     - ``fake``: fake scheme, login directly passed as a parameter
+    - ``none``: no authentication, only cookies
 
     Constructor parameters:
 
     - ``allow``: list of allowed schemes.
-      default is ``["bearer", "basic", "param"]``
+      default is ``["bearer", "basic", "param", "none"]``
     - ``user``: parameter for user on ``param`` password authentication,
       default is ``USER``
     - ``pwd``: parameter for password on ``param`` password authentication,
@@ -60,12 +61,13 @@ class Authenticator:
     _TOKEN_SCHEMES = {"bearer", "header", "cookie", "tparam"}
     _PASS_SCHEMES = {"basic", "param"}
 
-    _AUTH_SCHEMES = {"fake"}
+    # all supported authentication schemes
+    _AUTH_SCHEMES = {"fake", "none"}
     _AUTH_SCHEMES.update(_TOKEN_SCHEMES)
     _AUTH_SCHEMES.update(_PASS_SCHEMES)
 
     def __init__(self,
-             allow: list[str] = ["bearer", "basic", "param"],
+             allow: list[str] = ["bearer", "basic", "param", "none"],
              # parameter names for "basic" and "param"
              user: str = "USER",
              pwd: str = "PASS",
@@ -96,21 +98,25 @@ class Authenticator:
         self._cookie = cookie
         self._tparam = tparam
 
-        # password and token credentials
+        # password and token credentials, cookies
         self._passes: dict[str, str] = {}
         self._tokens: dict[str, str] = {}
+        self._cookies: dict[str, dict[str, str]] = {}
 
-    def _set(self, login: str, val: str|None, store: dict[str, str]):
+    def _set(self, key: str, val: str|None, store: dict[str, str]):
         """Set a key/value in a directory, with None for delete."""
         if val is None:
-            if login in store:
-                del store[login]
+            if key in store:
+                del store[key]
         else:
             assert isinstance(val, str)
-            store[login] = val
+            store[key] = val
 
     def setPass(self, login: str, pw: str|None):
-        """Associate a password to a user."""
+        """Associate a password to a user.
+
+        Set to *None* to remove the password entry.
+        """
         if not self._has_pass:
             raise AuthError("cannot set password, no password scheme allowed")
         self._set(login, pw, self._passes)
@@ -122,11 +128,20 @@ class Authenticator:
             self.setPass(login, pw)
 
     def setToken(self, login: str, token: str|None):
-        """Associate a token to a user."""
+        """Associate a token to a user.
+
+        Set to *None* to remove the token entry.
+        """
         if not self._has_token:
             raise AuthError("cannot set token, no token scheme allowed")
         self._set(login, token, self._tokens)
 
+    def setCookie(self, login: str, name: str, val: str|None = None):
+        """Associate a cookie and its value to a login, *None* to remove."""
+        if login not in self._cookies:
+            self._cookies[login] = {}
+        self._set(name, val, self._cookies[login])
+
     def _param(self, kwargs: dict[str, Any], key: str, val: Any):
         """Add request parameter to "json" or "data"."""
 
@@ -143,12 +158,16 @@ class Authenticator:
         """Whether to try this authentication scheme."""
         return auth in (None, scheme) and scheme in self._allow
 
-    def setAuth(self, login: str|None, kwargs: dict[str, Any], auth: str|None = None):
+    def setAuth(self, login: str|None, kwargs: dict[str, Any], cookies: dict[str, str], auth: str|None = None):
         """Set request authentication.
 
         - login: login target, None means no authentication
         - kwargs: request parameters
-        - auth: authentication method, default None is to try allowed schemes, tokens first.
+        - cookies: request cookies
+        - auth: authentication method, default is None
+
+        The default behavior is to try allowed schemes: tokens first,
+        then password, then fake.
         """
 
         log.debug(f"setAuth: login={login} auth={auth} allow={self._allow}")
@@ -156,29 +175,29 @@ class Authenticator:
         if login is None:  # not needed
             return
 
+        cookies.update(self._cookies.get(login, {}))
+
         if auth is not None:
             if auth not in self._AUTH_SCHEMES:
                 raise AuthError(f"unexpected auth: {auth}")
             if auth not in self._allow:
                 raise AuthError(f"auth is not allowed: {auth}")
 
+        headers = kwargs.get("headers", {})
+
         # use token if available and allowed
         if login in self._tokens and auth in (None, "bearer", "header", "cookie", "tparam"):
 
             token = self._tokens[login]
 
-            if "headers" not in kwargs:
-                kwargs["headers"] = {}
-
             if self._try_auth(auth, "bearer"):
-                kwargs["headers"]["Authorization"] = self._bearer + " " + token
+                headers["Authorization"] = self._bearer + " " + token
             elif self._try_auth(auth, "header"):
-                kwargs["headers"][self._header] = token
+                headers[self._header] = token
             elif self._try_auth(auth, "tparam"):
                 self._param(kwargs, self._tparam, token)
             elif self._try_auth(auth, "cookie"):
-                # FIXME cookie?
-                kwargs["headers"]["Cookie"] = self._cookie + "=" + token
+                cookies[self._cookie] = token
             else:
                 raise AuthError(f"no token carrier: login={login} auth={auth} allow={self._allow}")
 
@@ -196,10 +215,17 @@ class Authenticator:
 
             self._param(kwargs, self._login, login)
 
+        elif self._try_auth(auth, "none"):
+
+            pass
+
         else:
 
             raise AuthError(f"no authentication for login={login} auth={auth} allow={self._allow}")
 
+        if headers:  # put headers back if needed
+            kwargs["headers"] = headers
+
 
 class RequestFlaskResponse:
     """Wrapper to return a Flask-looking response from a request response.
@@ -238,16 +264,17 @@ class RequestFlaskResponse:
 
 
 class Client:
-    """Common class for flask authenticated testing.
+    """Common (partial) class for flask authenticated testing.
 
     Constructor parameters:
 
     - ``auth`` authenticator
-    - ``default_login`` if not ``login`` is set.
+    - ``default_login`` if ``login`` is not set.
     """
 
     def __init__(self, auth: Authenticator, default_login: str|None = None):
         self._auth = auth
+        self._cookies: dict[str, dict[str, str]] = {}  # login -> name -> value
         self._default_login = default_login
 
     def setToken(self, login: str, token: str|None):
@@ -258,7 +285,11 @@ class Client:
         """Associate a password to a login, *None* to remove."""
         self._auth.setPass(login, password)
 
-    def _request(self, method: str, path: str, **kwargs):
+    def setCookie(self, login: str, name: str, val: str|None):
+        """Associate a cookie to a login, *None* name to remove."""
+        self._auth.setCookie(login, name, val)
+
+    def _request(self, method: str, path: str, cookies: dict[str, str], **kwargs):
         """Run a request and return response."""
         raise NotImplementedError()
 
@@ -274,7 +305,7 @@ class Client:
 
         - ``status``: expected HTTP status, *None* to skip status check
         - ``login``: authenticated user, use **explicit** *None* to skip
-        - ``auth``: authentication scheme to use
+        - ``auth``: authentication scheme to use instead of default behavior
         - ``**kwargs``: more request parameters (headers, data, json…)
         """
 
@@ -284,8 +315,13 @@ class Client:
         else:  # if unset, use default
             login = self._default_login
 
-        self._auth.setAuth(login, kwargs, auth=auth)
-        res = self._request(method, path, **kwargs)  # type: ignore
+        cookies: dict[str, str] = {}
+        if "cookies" in kwargs:
+            cookies.update(kwargs["cookies"])
+            del kwargs["cookies"]
+
+        self._auth.setAuth(login, kwargs, cookies, auth=auth)
+        res = self._request(method, path, cookies, **kwargs)  # type: ignore
 
         if status is not None:
             if res.status_code != status:  # show error before aborting
@@ -349,7 +385,7 @@ class RequestClient(Client):
 
     - ``auth`` authenticator
     - ``base_url`` target server
-    - ``default_login`` if not ``login`` is set.
+    - ``default_login`` if ``login`` is not set.
     """
 
     def __init__(self, auth: Authenticator, base_url: str, default_login=None):
@@ -359,7 +395,7 @@ class RequestClient(Client):
         from requests import Session
         self._requests = Session()
 
-    def _request(self, method: str, path: str, **kwargs):
+    def _request(self, method: str, path: str, cookies: dict[str, str], **kwargs):
         """Actual request handling."""
 
         if "data" in kwargs:
@@ -383,7 +419,7 @@ class RequestClient(Client):
             # sanity
             assert not (files and "json" in kwargs), "cannot mix file upload and json?"
 
-        res = self._requests.request(method, self._base_url + path, **kwargs)
+        res = self._requests.request(method, self._base_url + path, cookies=cookies, **kwargs)
 
         return RequestFlaskResponse(res)
 
@@ -394,16 +430,29 @@ class FlaskClient(Client):
     Constructor parameters:
 
     - ``auth`` authenticator
-    - ``client`` Flask ``test_client``
-    - ``default_login`` if not ``login`` is set.
+    - ``client`` Flask actual ``test_client``
+    - ``default_login`` if ``login`` is not set.
+
+    Note: this client handles `cookies`.
     """
 
     def __init__(self, auth: Authenticator, client, default_login=None):
         super().__init__(auth, default_login)
         self._client = client
+        self._cookie_names: set[str] = set()  # FIXME all encountered cookies for cleanup :-/
 
-    def _request(self, method: str, path: str, **kwargs):
+    def _request(self, method: str, path: str, cookies: dict[str, str], **kwargs):
         """Actual request handling."""
+
+        # hack to cleanup client state :-/
+        for cookie in self._cookie_names:
+            self._client.delete_cookie(cookie)
+
+        for cookie, val in cookies.items():
+            if cookie not in self._cookie_names:
+                self._cookie_names.add(cookie)
+            self._client.set_cookie(cookie, val)
+
         return self._client.open(method=method, path=path, **kwargs)
 
 
@@ -415,8 +464,9 @@ def ft_authenticator():
 
     - ``FLASK_TESTER_LOG_LEVEL``: package log level in
       ``DEBUG INFO WARNING ERROR CRITICAL NOSET``.
+      Default is ``NOTSET``.
     - ``FLASK_TESTER_ALLOW``: allowed space-separated authentication schemes, in
-      ``basic param bearer header cookie tparam fake``.
+      ``basic param bearer header cookie tparam fake none``.
       Default is ``bearer basic param``.
     - ``FLASK_TESTER_USER``: user login parameter for ``param`` authentication.
       Default is ``USER``.
@@ -433,6 +483,7 @@ def ft_authenticator():
     - ``FLASK_TESTER_TPARAM``: parameter for *token* authentication.
       Default is ``AUTH``.
     - ``FLASK_TESTER_AUTH``: initial comma-separated list of *login:password*.
+      Default is not set.
     """
 
     level = os.environ.get("FLASK_TESTER_LOG_LEVEL", "NOTSET")

{FlaskTester-1.4 → FlaskTester-3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: FlaskTester
-Version: 1.4
+Version: 3.0
 Summary: Pytest fixtures for Flask internal and external authenticated tests
 Author-email: Fabien Coelho <flask.tester@coelho.net>
 License: CC0
@@ -32,7 +32,7 @@ Requires-Dist: twine; extra == "dev"
 Requires-Dist: wheel; extra == "dev"
 Requires-Dist: types-flask; extra == "dev"
 Requires-Dist: types-requests; extra == "dev"
-Requires-Dist: FlaskSimpleAuth; extra == "dev"
+Requires-Dist: FlaskSimpleAuth>=29.5; extra == "dev"
 Requires-Dist: passlib; extra == "dev"
 Provides-Extra: doc
 Requires-Dist: sphinx; extra == "doc"
@@ -52,7 +52,7 @@ Only one set of tests is needed, switching from internal to external is
 achieved through environment variables.
 
 ![Status](https://github.com/zx80/flask-tester/actions/workflows/package.yml/badge.svg?branch=main&style=flat)
-![Tests](https://img.shields.io/badge/tests-10%20✓-success)
+![Tests](https://img.shields.io/badge/tests-11%20✓-success)
 ![Coverage](https://img.shields.io/badge/coverage-100%25-success)
 ![Issues](https://img.shields.io/github/issues/zx80/flask-tester?style=flat)
 ![Python](https://img.shields.io/badge/python-3-informational)
@@ -86,6 +86,9 @@ def app(ft_client):
     res = ft_client.post("/login", login="hobbes", auth="param", status=201)
     assert res.is_json
     ft_client.setToken("hobbes", res.json["token"])
+    # also set a cookie
+    ft_client.setCookie("hobbes", "lang", "fr_FR")
+    ft_client.setCookie("calvin", "lang", "en_EN")
     # return working client
     yield ft_client
 
@@ -133,7 +136,7 @@ The package provides two fixtures:
 - `ft_authenticator` for app authentication, which depends on environment variables:
 
   - `FLASK_TESTER_ALLOW` space-separated list of allowed authentication schemes,
-    default is `["bearer", "basic", "param"]`.
+    default is `["bearer", "basic", "param", "none"]`.
   - `FLASK_TESTER_AUTH` comma-separated list of _login:password_ credentials.
   - `FLASK_TESTER_USER` user login parameter for `param` password authentication,
     default is `USER`.
@@ -155,7 +158,8 @@ The package provides two fixtures:
   The fixture has 3 main methods:
   - `setPass` to associate a password to a user, set to _None_ to remove credential.
   - `setToken` to associate a token to a user, set to _None_ to remove credential.
-  - `setAuth` to add authentication data to a request `kwargs`.
+  - `setCookie` to add a cookie to a user, set value to _None_ to remove cookie.
+  - `setAuth` to add authentication data to a request `kwargs` and `cookies`.
 
 - `ft_client` for app testing, which depends on the previous fixture, plus
   environment variables which allow to find the application, at least one must
@@ -175,7 +179,7 @@ The package provides two fixtures:
   The fixture then provides test methods to issue test requests against a Flask application:
   - `request` generic request with `login`, `auth`, `status` end `content` extensions.
   - `get post put patch delete` methods with `login`, `auth` and `status` extensions.
-  Moreover, `setPass` and `setToken` are forwarded to the internal authenticator.
+  Moreover, `setPass`, `setToken` and `setCookie` are forwarded to the internal authenticator.
 
 Authenticator environment variables can be set from the pytest Python test file by
 assigning them through `os.environ`.
@@ -238,6 +242,16 @@ Packages are distributed from [PyPI](https://pypi.org/project/FlaskTester/),
 see also the [documentation](https://zx80.github.io/flask-tester/),
 please report any [issues](https://github.com/zx80/flask-tester/issues).
 
+### 3.0 on 2024-03-23
+
+Add support for `none` authentication, with only cookies.
+
+### 2.0 on 2024-03-23
+
+Add support for cookies.
+Improved documentation and code.
+Improved tests.
+
 ### 1.4 on 2024-03-19
 
 Test expected assert failures.

{FlaskTester-1.4 → FlaskTester-3.0}/README.md

@@ -9,7 +9,7 @@ Only one set of tests is needed, switching from internal to external is
 achieved through environment variables.
 
 ![Status](https://github.com/zx80/flask-tester/actions/workflows/package.yml/badge.svg?branch=main&style=flat)
-![Tests](https://img.shields.io/badge/tests-10%20✓-success)
+![Tests](https://img.shields.io/badge/tests-11%20✓-success)
 ![Coverage](https://img.shields.io/badge/coverage-100%25-success)
 ![Issues](https://img.shields.io/github/issues/zx80/flask-tester?style=flat)
 ![Python](https://img.shields.io/badge/python-3-informational)
@@ -43,6 +43,9 @@ def app(ft_client):
     res = ft_client.post("/login", login="hobbes", auth="param", status=201)
     assert res.is_json
     ft_client.setToken("hobbes", res.json["token"])
+    # also set a cookie
+    ft_client.setCookie("hobbes", "lang", "fr_FR")
+    ft_client.setCookie("calvin", "lang", "en_EN")
     # return working client
     yield ft_client
 
@@ -90,7 +93,7 @@ The package provides two fixtures:
 - `ft_authenticator` for app authentication, which depends on environment variables:
 
   - `FLASK_TESTER_ALLOW` space-separated list of allowed authentication schemes,
-    default is `["bearer", "basic", "param"]`.
+    default is `["bearer", "basic", "param", "none"]`.
   - `FLASK_TESTER_AUTH` comma-separated list of _login:password_ credentials.
   - `FLASK_TESTER_USER` user login parameter for `param` password authentication,
     default is `USER`.
@@ -112,7 +115,8 @@ The package provides two fixtures:
   The fixture has 3 main methods:
   - `setPass` to associate a password to a user, set to _None_ to remove credential.
   - `setToken` to associate a token to a user, set to _None_ to remove credential.
-  - `setAuth` to add authentication data to a request `kwargs`.
+  - `setCookie` to add a cookie to a user, set value to _None_ to remove cookie.
+  - `setAuth` to add authentication data to a request `kwargs` and `cookies`.
 
 - `ft_client` for app testing, which depends on the previous fixture, plus
   environment variables which allow to find the application, at least one must
@@ -132,7 +136,7 @@ The package provides two fixtures:
   The fixture then provides test methods to issue test requests against a Flask application:
   - `request` generic request with `login`, `auth`, `status` end `content` extensions.
   - `get post put patch delete` methods with `login`, `auth` and `status` extensions.
-  Moreover, `setPass` and `setToken` are forwarded to the internal authenticator.
+  Moreover, `setPass`, `setToken` and `setCookie` are forwarded to the internal authenticator.
 
 Authenticator environment variables can be set from the pytest Python test file by
 assigning them through `os.environ`.
@@ -195,6 +199,16 @@ Packages are distributed from [PyPI](https://pypi.org/project/FlaskTester/),
 see also the [documentation](https://zx80.github.io/flask-tester/),
 please report any [issues](https://github.com/zx80/flask-tester/issues).
 
+### 3.0 on 2024-03-23
+
+Add support for `none` authentication, with only cookies.
+
+### 2.0 on 2024-03-23
+
+Add support for cookies.
+Improved documentation and code.
+Improved tests.
+
 ### 1.4 on 2024-03-19
 
 Test expected assert failures.

{FlaskTester-1.4 → FlaskTester-3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "FlaskTester"
-version = "1.4"
+version = "3.0"
 authors = [ { name = "Fabien Coelho", email = "flask.tester@coelho.net" } ]
 description = "Pytest fixtures for Flask internal and external authenticated tests"
 readme = "README.md"
@@ -33,7 +33,7 @@ package = "https://pypi.org/project/FlaskTester/"
 
 [project.optional-dependencies]
 # various dev tools
-dev = ["mypy", "pyright", "ruff", "coverage", "pymarkdownlnt!=0.9.5", "build", "twine", "wheel", "types-flask", "types-requests", "FlaskSimpleAuth", "passlib"]
+dev = ["mypy", "pyright", "ruff", "coverage", "pymarkdownlnt!=0.9.5", "build", "twine", "wheel", "types-flask", "types-requests", "FlaskSimpleAuth>=29.5", "passlib"]
 # documentation generation
 doc = ["sphinx", "sphinx_rtd_theme", "sphinx-autoapi", "sphinx-lint", "myst_parser"]
 

{FlaskTester-1.4 → FlaskTester-3.0}/tests/test.py

@@ -10,16 +10,19 @@ import io
 import logging
 
 logging.basicConfig(level=logging.INFO)
+# logging.basicConfig(level=logging.DEBUG)
+# log = logging.getLogger("test")
 
 # set authn for ft_authenticator
 os.environ.update(
-    FLASK_TESTER_ALLOW="bearer basic param",
+    FLASK_TESTER_ALLOW="bearer basic param none",
     FLASK_TESTER_AUTH=",".join(f"{l}:{p}" for l, p in secret.PASSES.items()),
 )
 
 def test_sanity():
     # must provide url or package of Flask application to test
     assert "FLASK_TESTER_URL" in os.environ or "FLASK_TESTER_APP" in os.environ
+    # log.debug(f"TEST_SEED={os.environ.get('TEST_SEED')}")
 
 # example from README.md
 @pytest.fixture
@@ -34,6 +37,9 @@ def app(ft_client):
     res = ft_client.post("/login", login="hobbes", auth="param", status=201)
     assert res.is_json
     ft_client.setToken("hobbes", res.json["token"])
+    # also set a cookie
+    ft_client.setCookie("hobbes", "lang", "fr_FR")
+    ft_client.setCookie("calvin", "lang", "en_EN")
     # return working client
     yield ft_client
 
@@ -59,6 +65,9 @@ def api(ft_client):
     ft_client.setToken("moe", None)
     ft_client.setPass("moe", "bad password")
     ft_client.setToken("moe", "bad token")
+    # cookies
+    ft_client.setCookie("calvin", "lang", "en")
+    ft_client.setCookie("hobbes", "lang", "fr")
     # get valid tokens using password authn
     res = ft_client.get("/login", login="calvin", auth="basic", status=200)
     assert res.json["user"] == "calvin"
@@ -69,13 +78,14 @@ def api(ft_client):
     res = ft_client.post("/login", login="susie", auth="param", status=201, json={})
     assert res.json["user"] == "susie"
     ft_client._auth.setToken("susie", res.json["token"])
-    # check that token auth is ok
+    ft_client.get("/login", login="calvin", auth="none", status=401)
+    # check that token auth and cookie is ok
     res = ft_client.get("/who-am-i", login="calvin", status=200, auth="bearer")
-    assert res.json["user"] == "calvin"
+    assert res.json["user"] == "calvin" and res.json["lang"] == "en"
     res = ft_client.get("/who-am-i", login="hobbes", status=200, auth="bearer")
-    assert res.json["user"] == "hobbes"
+    assert res.json["user"] == "hobbes" and res.json["lang"] == "fr"
     res = ft_client.get("/who-am-i", login="susie", status=200, auth="bearer")
-    assert res.json["user"] == "susie"
+    assert res.json["user"] == "susie" and res.json["lang"] is None
     # with defaults
     res = ft_client.get("/who-am-i", auth="basic", status=200)
     assert res.json["user"] == "calvin"
@@ -108,6 +118,7 @@ def test_admin(api):
             assert "NOT THERE" in str(e)
 
 def test_errors(api):
+    # these schemes are not allowed
     for scheme in ("header", "cookie", "fake", "tparam", "unexpected"):
         try:
             api.get("/login", login="calvin", auth=scheme)
@@ -116,12 +127,27 @@ def test_errors(api):
             assert True, "expected error"
 
 def test_methods(api):
-    api.get("/who-am-i", login="hobbes", status=200)
+    res = api.get("/who-am-i", login="susie", status=200, cookies={"lang": "it"})
+    assert res.json["lang"] == "it"
     api.post("/who-am-i", login="hobbes", status=405)
     api.put("/who-am-i", login="hobbes", status=405)
     api.patch("/who-am-i", login="hobbes", status=405)
     api.delete("/who-am-i", login="hobbes", status=405)
 
+def test_hello(api):
+    res = api.get("/hello", login="calvin", auth="none", status=200)
+    assert res.json["hello"] == "Hi"
+    assert res.headers["FSA-User"] == "None (None)"
+    res = api.get("/hello", login="hobbes", auth="none", status=200)
+    assert res.json["hello"] == "Salut"
+    assert res.headers["FSA-User"] == "None (None)"
+    res = api.get("/hello", login="susie", auth="none", status=200, cookies={"lang": "it"})
+    assert res.json["hello"] == "Ciao"
+    assert res.headers["FSA-User"] == "None (None)"
+    res = api.get("/hello", login="moe", auth="none", status=200)
+    assert res.json["hello"] == "Hi"
+    assert res.headers["FSA-User"] == "None (None)"
+
 def test_authenticator_token():
     # all token carriers
     auth = ft.Authenticator(allow=["bearer", "header", "tparam", "cookie"])
@@ -129,25 +155,31 @@ def test_authenticator_token():
     auth.setToken("susie", "ss-token")
     auth.setToken("hobbes", "hbs-token")
     auth.setToken("moe", "m-token")
-    kwargs = {}
-    auth.setAuth("calvin", kwargs, auth="bearer")
+    auth.setCookie("calvin", "what", "clv-cookie")
+    kwargs, cookies = {}, {}
+    auth.setAuth("calvin", kwargs, cookies, auth="bearer")
     assert kwargs["headers"]["Authorization"] == "Bearer clv-token"
-    kwargs = {}
-    auth.setAuth("susie", kwargs, auth="header")
+    assert cookies["what"] == "clv-cookie"
+    kwargs, cookies = {}, {}
+    auth.setAuth("susie", kwargs, cookies, auth="header")
     assert kwargs["headers"]["Auth"] == "ss-token"
-    kwargs = {"data": {}}
-    auth.setAuth("hobbes", kwargs, auth="tparam")
+    assert not cookies
+    kwargs, cookies = {"data": {}}, {}
+    auth.setAuth("hobbes", kwargs, cookies, auth="tparam")
     assert kwargs["data"]["AUTH"] == "hbs-token"
-    kwargs = {"json": {}}
-    auth.setAuth("hobbes", kwargs, auth="tparam")
+    assert not cookies
+    kwargs, cookies = {"json": {}}, {}
+    auth.setAuth("hobbes", kwargs, cookies, auth="tparam")
     assert kwargs["json"]["AUTH"] == "hbs-token"
-    kwargs = {}
-    auth.setAuth("moe", kwargs, auth="cookie")
-    assert kwargs["headers"]["Cookie"] == "auth=m-token"
+    assert not cookies
+    kwargs, cookies = {}, {}
+    auth.setAuth("moe", kwargs, cookies, auth="cookie")
+    assert not kwargs
+    assert cookies["auth"] == "m-token"
     # dad does not have a token
     try:
-        kwargs = {}
-        auth.setAuth("dad", kwargs)
+        kwargs, cookies = {}, {}
+        auth.setAuth("dad", kwargs, cookies)
         pytest.fail("must raise an error")  # pragma: no cover
     except ft.FlaskTesterError:
         assert True, "error raised"
@@ -161,8 +193,8 @@ def test_authenticator_token():
     auth._has_pass = True
     auth.setPass("rosalyn", "rsln-pass")
     try:
-        kwargs={}
-        auth.setAuth("rosalyn", kwargs)
+        kwargs, cookies = {}, {}
+        auth.setAuth("rosalyn", kwargs, cookies)
         pytest.fail("must raise an error")  # pragma: no cover
     except ft.FlaskTesterError:
         assert True, "error raised"
@@ -174,21 +206,27 @@ def test_authenticator_password():
     auth.setPass("hobbes", "hbs-pass")
     auth.setPass("moe", "m-pass")
     auth.setPass("rosalyn", "rsln-pass")
-    kwargs = {}
-    auth.setAuth("calvin", kwargs, auth="basic")
+    auth.setCookie("moe", "hello", "world!")
+    kwargs, cookies = {}, {}
+    auth.setAuth("calvin", kwargs, cookies, auth="basic")
     assert kwargs["auth"] == ("calvin", "clv-pass")
-    kwargs = {"data": {}}
-    auth.setAuth("hobbes", kwargs, auth="param")
+    assert not cookies
+    kwargs, cookies = {"data": {}}, {}
+    auth.setAuth("hobbes", kwargs, cookies, auth="param")
     assert kwargs["data"]["USER"] == "hobbes" and kwargs["data"]["PASS"] == "hbs-pass"
-    kwargs = {"json": {}}
-    auth.setAuth("moe", kwargs, auth="param")
+    assert not cookies
+    kwargs, cookies = {"json": {}}, {}
+    auth.setAuth("moe", kwargs, cookies, auth="param")
     assert kwargs["json"]["USER"] == "moe" and kwargs["json"]["PASS"] == "m-pass"
-    kwargs = {"data": {}}
-    auth.setAuth("rosalyn", kwargs, auth="fake")
+    assert cookies["hello"] == "world!"
+    kwargs, cookies = {"data": {}}, {}
+    auth.setAuth("rosalyn", kwargs, cookies, auth="fake")
     assert kwargs["data"]["LOGIN"] == "rosalyn"
-    kwargs = {"json": {}}
-    auth.setAuth("hobbes", kwargs, auth="fake")
+    assert not cookies
+    kwargs, cookies = {"json": {}}, {}
+    auth.setAuth("hobbes", kwargs, cookies, auth="fake")
     assert kwargs["json"]["LOGIN"] == "hobbes"
+    assert not cookies
     # susie as a token, but no token carrier is allowed
     try:
         auth.setToken("susie", "ss-token")
@@ -199,8 +237,8 @@ def test_authenticator_password():
     auth._has_token = True
     auth.setToken("susie", "ss-token")
     try:
-        kwargs={}
-        auth.setAuth("susie", kwargs)
+        kwargs, cookies = {}, {}
+        auth.setAuth("susie", kwargs, cookies)
         pytest.fail("must raise an error")  # pragma: no cover
     except ft.FlaskTesterError:
         assert True, "error raised"
@@ -233,7 +271,7 @@ def test_request_flask_response():
 def test_client():
     client = ft.Client(ft.Authenticator())
     try:
-        client._request("GET", "/")
+        client._request("GET", "/", {})
         pytest.fail("must raise an error")  # pragma: no cover
     except NotImplementedError:
         assert True, "expected error raised"