diff --git a/autoenv.zsh b/autoenv.zsh
index 23866f3..b8a8f05 100644
--- a/autoenv.zsh
+++ b/autoenv.zsh
@@ -122,15 +122,21 @@ _autoenv_debug() {
 zmodload -F zsh/stat b:zstat
 
 
+# Generate hash pair for a given file ($1).
+# A fixed hash value can be given as 2nd arg, but is used with tests only.
 _autoenv_hash_pair() {
   local env_file=${1:A}
   local env_shasum
   if [[ -n $2 ]]; then
     env_shasum=$2
   else
+    if ! [[ -e $env_file ]]; then
+      echo "Missing file argument for _autoenv_hash_pair!" >&2
+      return 1
+    fi
     env_shasum=$(shasum $env_file | cut -d' ' -f1)
   fi
-  echo "$env_file:$env_shasum:1"
+  echo ":${env_file}:${env_shasum}:1"
 }
 
 _autoenv_authorized_env_file() {
@@ -141,15 +147,18 @@ _autoenv_authorized_env_file() {
 }
 
 _autoenv_authorize() {
-  local env_file=$1
+  local env_file=${1:A}
   _autoenv_deauthorize $env_file
   _autoenv_hash_pair $env_file >> $AUTOENV_ENV_FILENAME
 }
 
+# Deauthorize a given filename, by removing it from the auth file.
+# This uses `test -s` to only handle non-empty files, and a subshell to
+# allow for writing to the same file again.
 _autoenv_deauthorize() {
-  local env_file=$1
-  if [[ -f $AUTOENV_ENV_FILENAME ]]; then
-    echo $(\grep -vF $env_file $AUTOENV_ENV_FILENAME) > $AUTOENV_ENV_FILENAME
+  local env_file=${1:A}
+  if [[ -s $AUTOENV_ENV_FILENAME ]]; then
+    echo "$(\grep -vF :${env_file}: $AUTOENV_ENV_FILENAME)" > $AUTOENV_ENV_FILENAME
   fi
 }
 
diff --git a/tests/.zshenv b/tests/.zshenv
index 2311e2a..029e73d 100644
--- a/tests/.zshenv
+++ b/tests/.zshenv
@@ -4,3 +4,5 @@ AUTOENV_DEBUG=0
 
 source "$TESTDIR/../autoenv.plugin.zsh"
 export AUTOENV_ENV_FILENAME="$PWD/.env_auth"
+
+echo -n > $AUTOENV_ENV_FILENAME
diff --git a/tests/_autoenv_utils.t b/tests/_autoenv_utils.t
index 79c4bf1..3da1fde 100644
--- a/tests/_autoenv_utils.t
+++ b/tests/_autoenv_utils.t
@@ -8,8 +8,66 @@ Non-existing entries are allowed and handled without error.
   $ touch file sub/file sub/sub2/file
 
 Should not get the file from the current dir.
+
   $ _autoenv_get_file_upwards . file
 
   $ cd sub/sub2
   $ _autoenv_get_file_upwards . file
   */_autoenv_utils.t/sub/file (glob)
+
+
+Tests for _autoenv_authorize. {{{
+
+Auth file is empty.
+
+  $ cd ../..
+  $ cat $AUTOENV_ENV_FILENAME
+
+Failed authorization should keep the auth file empty.
+
+  $ _autoenv_authorize does-not-exist
+  Missing file argument for _autoenv_hash_pair!
+  [1]
+  $ cat $AUTOENV_ENV_FILENAME
+
+Now adding some auth pair.
+
+  $ echo first > first
+  $ _autoenv_authorize first
+  $ cat $AUTOENV_ENV_FILENAME
+  :/tmp/cramtests-*/_autoenv_utils.t/first:271ac93c44ac198d92e706c6d6f1d84aefcfa337:1 (glob)
+
+And a second one.
+
+  $ echo second > second
+  $ _autoenv_authorize second
+  $ cat $AUTOENV_ENV_FILENAME
+  :/tmp/cramtests-*/_autoenv_utils.t/first:271ac93c44ac198d92e706c6d6f1d84aefcfa337:1 (glob)
+  :/tmp/cramtests-*/_autoenv_utils.t/second:7bee8f3b184e1e141ff76efe369c3b8bfc50e64c:1 (glob)
+
+And a third.
+
+  $ echo third > third
+  $ _autoenv_authorize third
+  $ cat $AUTOENV_ENV_FILENAME
+  :/tmp/cramtests-*/_autoenv_utils.t/first:271ac93c44ac198d92e706c6d6f1d84aefcfa337:1 (glob)
+  :/tmp/cramtests-*/_autoenv_utils.t/second:7bee8f3b184e1e141ff76efe369c3b8bfc50e64c:1 (glob)
+  :/tmp/cramtests-*/_autoenv_utils.t/third:ad180453bf8a374a15df3e90a78c180230146a7c:1 (glob)
+
+Re-add the second one, with the same hash.
+
+  $ _autoenv_authorize second
+  $ cat $AUTOENV_ENV_FILENAME
+  :/tmp/cramtests-*/_autoenv_utils.t/first:271ac93c44ac198d92e706c6d6f1d84aefcfa337:1 (glob)
+  :/tmp/cramtests-*/_autoenv_utils.t/third:ad180453bf8a374a15df3e90a78c180230146a7c:1 (glob)
+  :/tmp/cramtests-*/_autoenv_utils.t/second:7bee8f3b184e1e141ff76efe369c3b8bfc50e64c:1 (glob)
+
+Re-add the first one, with a new hash.
+
+  $ echo one more line >> first
+  $ _autoenv_authorize first
+  $ cat $AUTOENV_ENV_FILENAME
+  :/tmp/cramtests-*/_autoenv_utils.t/third:ad180453bf8a374a15df3e90a78c180230146a7c:1 (glob)
+  :/tmp/cramtests-*/_autoenv_utils.t/second:7bee8f3b184e1e141ff76efe369c3b8bfc50e64c:1 (glob)
+  :/tmp/cramtests-*/_autoenv_utils.t/first:65eb010197b73ddc109b7210080f97a87f53451e:1 (glob)
+}}}