autoenv.zsh            |  4 ++--
 tests/.zshenv          |  2 ++
 tests/_autoenv_utils.t | 58 +++++++++++++++++++++++++++++++++++++++++++++++++++++

diff --git a/autoenv.zsh b/autoenv.zsh
index c710389be506ace2ca25ec2971953715b3d3c7ca..14e8159432c6e285225342ddd65f880f04ae4ee1 100644
--- a/autoenv.zsh
+++ b/autoenv.zsh
@@ -154,8 +154,8 @@ }
 
 _autoenv_deauthorize() {
   local env_file=$1
-  if [[ -f $AUTOENV_ENV_FILENAME ]]; then
-    echo $(\grep -vF $env_file $AUTOENV_ENV_FILENAME) > $AUTOENV_ENV_FILENAME
+  if [[ -s $AUTOENV_ENV_FILENAME ]]; then
+    echo "$(\grep -vF $env_file $AUTOENV_ENV_FILENAME)" > $AUTOENV_ENV_FILENAME
   fi
 }
 
diff --git a/tests/.zshenv b/tests/.zshenv
index 2311e2addf7cf46882409d6348b7c341eb116081..029e73d0af419b9fb479f1f695a77027ca99ad5a 100644
--- a/tests/.zshenv
+++ b/tests/.zshenv
@@ -4,3 +4,5 @@ AUTOENV_DEBUG=0
 
 source "$TESTDIR/../autoenv.plugin.zsh"
 export AUTOENV_ENV_FILENAME="$PWD/.env_auth"
+
+echo -n > $AUTOENV_ENV_FILENAME
diff --git a/tests/_autoenv_utils.t b/tests/_autoenv_utils.t
index 79c4bf13f208b622e14844503c54338b361fd299..c8c4a8c4e5ff3170cdf1090d83869f297b7612ba 100644
--- a/tests/_autoenv_utils.t
+++ b/tests/_autoenv_utils.t
@@ -8,8 +8,66 @@   $ mkdir -p sub/sub2
   $ touch file sub/file sub/sub2/file
 
 Should not get the file from the current dir.
+
   $ _autoenv_get_file_upwards . file
 
   $ cd sub/sub2
   $ _autoenv_get_file_upwards . file
   */_autoenv_utils.t/sub/file (glob)
+
+
+Tests for _autoenv_authorize. {{{
+
+Auth file is empty.
+
+  $ cd ../..
+  $ cat $AUTOENV_ENV_FILENAME
+
+Failed authorization should keep the auth file empty.
+
+  $ _autoenv_authorize does-not-exist
+  Missing file argument for _autoenv_hash_pair!
+  [1]
+  $ cat $AUTOENV_ENV_FILENAME
+
+Now adding some auth pair.
+
+  $ echo first > first
+  $ _autoenv_authorize first
+  $ cat $AUTOENV_ENV_FILENAME
+  /tmp/cramtests-*/_autoenv_utils.t/first:271ac93c44ac198d92e706c6d6f1d84aefcfa337:1 (glob)
+
+And a second one.
+
+  $ echo second > second
+  $ _autoenv_authorize second
+  $ cat $AUTOENV_ENV_FILENAME
+  /tmp/cramtests-*/_autoenv_utils.t/first:271ac93c44ac198d92e706c6d6f1d84aefcfa337:1 (glob)
+  /tmp/cramtests-*/_autoenv_utils.t/second:7bee8f3b184e1e141ff76efe369c3b8bfc50e64c:1 (glob)
+
+And a third.
+
+  $ echo third > third
+  $ _autoenv_authorize third
+  $ cat $AUTOENV_ENV_FILENAME
+  /tmp/cramtests-*/_autoenv_utils.t/first:271ac93c44ac198d92e706c6d6f1d84aefcfa337:1 (glob)
+  /tmp/cramtests-*/_autoenv_utils.t/second:7bee8f3b184e1e141ff76efe369c3b8bfc50e64c:1 (glob)
+  /tmp/cramtests-*/_autoenv_utils.t/third:ad180453bf8a374a15df3e90a78c180230146a7c:1 (glob)
+
+Re-add the second one, with the same hash.
+
+  $ _autoenv_authorize second
+  $ cat $AUTOENV_ENV_FILENAME
+  /tmp/cramtests-*/_autoenv_utils.t/first:271ac93c44ac198d92e706c6d6f1d84aefcfa337:1 (glob)
+  /tmp/cramtests-*/_autoenv_utils.t/third:ad180453bf8a374a15df3e90a78c180230146a7c:1 (glob)
+  /tmp/cramtests-*/_autoenv_utils.t/second:7bee8f3b184e1e141ff76efe369c3b8bfc50e64c:1 (glob)
+
+Re-add the first one, with a new hash.
+
+  $ echo one more line >> first
+  $ _autoenv_authorize first
+  $ cat $AUTOENV_ENV_FILENAME
+  /tmp/cramtests-*/_autoenv_utils.t/third:ad180453bf8a374a15df3e90a78c180230146a7c:1 (glob)
+  /tmp/cramtests-*/_autoenv_utils.t/second:7bee8f3b184e1e141ff76efe369c3b8bfc50e64c:1 (glob)
+  /tmp/cramtests-*/_autoenv_utils.t/first:65eb010197b73ddc109b7210080f97a87f53451e:1 (glob)
+}}}