diff --git a/.gitignore b/.gitignore
index 48fb168..ca7f410 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,6 +4,8 @@
 # or operating system, you probably want to add a global ignore instead:
 #   git config --global core.excludesfile '~/.gitignore_global'
 
+.env
+
 # Ignore bundler config.
 /.bundle
 
diff --git a/Gemfile b/Gemfile
index 24756e7..048b408 100644
--- a/Gemfile
+++ b/Gemfile
@@ -1,12 +1,15 @@
 source 'https://rubygems.org'
 
-ruby '2.4.0'
+ruby '2.4.1'
 
 git_source(:github) do |repo_name|
   repo_name = "#{repo_name}/#{repo_name}" unless repo_name.include?("/")
   "https://github.com/#{repo_name}.git"
 end
 
+gem 'omniauth'
+gem 'omniauth-github'
+
 # Bundle edge Rails instead: gem 'rails', github: 'rails/rails'
 gem 'rails', '~> 5.0.2'
 # Use postgresql as the database for Active Record
@@ -44,10 +47,12 @@ group :development, :test do
   gem 'byebug', platform: :mri
 
   # Improve the error message you get in the browser
-  gem 'better_errors'
+  # gem 'better_errors'
 
   # Use pry for rails console
   gem 'pry-rails'
+
+  gem 'dotenv-rails'
 end
 
 group :test do
diff --git a/Gemfile.lock b/Gemfile.lock
index 4d99ffe..ec67149 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -44,10 +44,6 @@ GEM
     babel-transpiler (0.7.0)
       babel-source (>= 4.0, < 6)
       execjs (~> 2.0)
-    better_errors (2.1.1)
-      coderay (>= 1.0.0)
-      erubis (>= 2.6.6)
-      rack (>= 0.9.0)
     bindex (0.5.0)
     builder (3.2.3)
     byebug (9.0.6)
@@ -60,8 +56,14 @@ GEM
       execjs
     coffee-script-source (1.12.2)
     concurrent-ruby (1.0.5)
+    dotenv (2.2.1)
+    dotenv-rails (2.2.1)
+      dotenv (= 2.2.1)
+      railties (>= 3.2, < 5.2)
     erubis (2.7.0)
     execjs (2.7.0)
+    faraday (0.12.2)
+      multipart-post (>= 1.2, < 3)
     ffi (1.9.18)
     foundation-rails (6.3.0.0)
       railties (>= 3.1.0)
@@ -69,6 +71,7 @@ GEM
       sprockets-es6 (>= 0.9.0)
     globalid (0.3.7)
       activesupport (>= 4.1.0)
+    hashie (3.5.6)
     i18n (0.8.1)
     jbuilder (2.6.3)
       activesupport (>= 3.0.0, < 5.2)
@@ -77,6 +80,7 @@ GEM
       rails-dom-testing (>= 1, < 3)
       railties (>= 4.2.0)
       thor (>= 0.14, < 2.0)
+    jwt (1.5.6)
     listen (3.0.8)
       rb-fsevent (~> 0.9, >= 0.9.4)
       rb-inotify (~> 0.9, >= 0.9.7)
@@ -104,9 +108,26 @@ GEM
       minitest (~> 5.0)
       rails (>= 4.1)
     multi_json (1.12.1)
+    multi_xml (0.6.0)
+    multipart-post (2.0.0)
     nio4r (2.0.0)
     nokogiri (1.7.1)
       mini_portile2 (~> 2.1.0)
+    oauth2 (1.4.0)
+      faraday (>= 0.8, < 0.13)
+      jwt (~> 1.0)
+      multi_json (~> 1.3)
+      multi_xml (~> 0.5)
+      rack (>= 1.2, < 3)
+    omniauth (1.7.1)
+      hashie (>= 3.4.6, < 3.6.0)
+      rack (>= 1.6.2, < 3)
+    omniauth-github (1.3.0)
+      omniauth (~> 1.5)
+      omniauth-oauth2 (>= 1.4.0, < 2.0)
+    omniauth-oauth2 (1.4.0)
+      oauth2 (~> 1.0)
+      omniauth (~> 1.2)
     pg (0.20.0)
     pry (0.10.4)
       coderay (~> 1.1.0)
@@ -193,9 +214,9 @@ PLATFORMS
   ruby
 
 DEPENDENCIES
-  better_errors
   byebug
   coffee-rails (~> 4.2)
+  dotenv-rails
   foundation-rails
   jbuilder (~> 2.5)
   jquery-rails
@@ -204,6 +225,8 @@ DEPENDENCIES
   minitest-reporters
   minitest-skip
   minitest-spec-rails
+  omniauth
+  omniauth-github
   pg (~> 0.18)
   pry-rails
   puma (~> 3.0)
@@ -217,7 +240,7 @@ DEPENDENCIES
   web-console (>= 3.3.0)
 
 RUBY VERSION
-   ruby 2.4.0p0
+   ruby 2.4.1p111
 
 BUNDLED WITH
-   1.14.4
+   1.16.0.pre.3
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 087352a..581ac10 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -4,14 +4,22 @@ class ApplicationController < ActionController::Base
   before_action :find_user
 
   def render_404
-    # DPR: supposedly this will actually render a 404 page in production
-    raise ActionController::RoutingError.new('Not Found')
+    # # DPR: supposedly this will actually render a 404 page in production
+    # raise ActionController::RoutingError.new('Not Found')
+    # Above code does not seem to pass test?
+
+    render file: "#{Rails.root}/public/404.html" , status: :not_found
   end
 
 private
   def find_user
     if session[:user_id]
       @login_user = User.find_by(id: session[:user_id])
+    else
+      #if not a registered user, redirect to homepage
+      flash[:status] = :failure
+      flash[:result_text] = "You must be logged in"
+      redirect_to root_path
     end
   end
 end
diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index 5bce99e..7fb4b3e 100644
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -1,4 +1,6 @@
 class SessionsController < ApplicationController
+  skip_before_action :find_user
+
   def login_form
   end
 
@@ -31,4 +33,25 @@ def logout
     flash[:result_text] = "Successfully logged out"
     redirect_to root_path
   end
+
+  def create
+    @auth_hash = request.env['omniauth.auth']
+
+    @user = User.find_by(uid: @auth_hash['uid'], provider: @auth_hash['provider'])
+
+    if @user
+      session[:user_id] = @user.id
+      flash[:success] = "#{@user.username} is now logged in"
+    else
+      @user = User.new(uid: @auth_hash['uid'], provider: @auth_hash['provider'], username: @auth_hash['info']['nickname'], email: @auth_hash['info']['email'])
+
+      if @user.save
+        session[:user_id] = @user.id
+        flash[:success] = "Welcome #{@user.username}"
+      else
+        flash[:error] = "Unable to save user!"
+      end
+    end
+    redirect_to root_path
+  end
 end
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 73b4265..0b2557e 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -1,4 +1,5 @@
 class UsersController < ApplicationController
+
   def index
     @users = User.all
   end
diff --git a/app/controllers/works_controller.rb b/app/controllers/works_controller.rb
index 1293d1d..8176040 100644
--- a/app/controllers/works_controller.rb
+++ b/app/controllers/works_controller.rb
@@ -1,9 +1,14 @@
 class WorksController < ApplicationController
   # We should always be able to tell what category
   # of work we're dealing with
+  skip_before_action :find_user, only: [:root]
   before_action :category_from_work, except: [:root, :index, :new, :create]
 
   def root
+    if session[:user_id]
+      @login_user = User.find_by(id: session[:user_id])
+    end
+
     @albums = Work.best_albums
     @books = Work.best_books
     @movies = Work.best_movies
@@ -20,6 +25,7 @@ def new
 
   def create
     @work = Work.new(media_params)
+    @work.user = @login_user
     @media_category = @work.category
     if @work.save
       flash[:status] = :success
@@ -41,24 +47,39 @@ def edit
   end
 
   def update
-    @work.update_attributes(media_params)
-    if @work.save
-      flash[:status] = :success
-      flash[:result_text] = "Successfully updated #{@media_category.singularize} #{@work.id}"
-      redirect_to work_path(@work)
+
+    if @work.user == @login_user
+      @work.update_attributes(media_params)
+      if @work.save
+        flash[:status] = :success
+        flash[:result_text] = "Successfully updated #{@media_category.singularize} #{@work.id}"
+        redirect_to work_path(@work)
+      else
+        flash.now[:status] = :failure
+        flash.now[:result_text] = "Could not update #{@media_category.singularize}"
+        flash.now[:messages] = @work.errors.messages
+        render :edit, status: :not_found
+      end
     else
-      flash.now[:status] = :failure
-      flash.now[:result_text] = "Could not update #{@media_category.singularize}"
-      flash.now[:messages] = @work.errors.messages
-      render :edit, status: :not_found
+      flash[:status] = :failure
+      flash[:result_text] = "Sorry, you cannot edit this work. Only the user who added the work can edit this work."
+      flash[:messages] = @work.errors.messages
+      redirect_to work_path(@work)
     end
   end
 
   def destroy
-    @work.destroy
-    flash[:status] = :success
-    flash[:result_text] = "Successfully destroyed #{@media_category.singularize} #{@work.id}"
-    redirect_to root_path
+    if @work.user == @login_user
+      @work.destroy
+      flash[:status] = :success
+      flash[:result_text] = "Successfully destroyed #{@media_category.singularize} #{@work.id}"
+      redirect_to root_path
+    else
+      flash[:status] = :failure
+      flash[:result_text] = "Sorry, you cannot delete this work. Only the user who added the work can delete this work."
+      flash[:messages] = @work.errors.messages
+      redirect_to work_path(@work)
+    end
   end
 
   def upvote
diff --git a/app/models/user.rb b/app/models/user.rb
index 4cac8fe..1140e09 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -1,4 +1,5 @@
 class User < ApplicationRecord
+  has_many :works
   has_many :votes
   has_many :ranked_works, through: :votes, source: :work
 
diff --git a/app/models/work.rb b/app/models/work.rb
index 2fd3e66..d88d288 100644
--- a/app/models/work.rb
+++ b/app/models/work.rb
@@ -1,5 +1,8 @@
 class Work < ApplicationRecord
   CATEGORIES = %w(album book movie)
+
+  belongs_to :user
+  
   has_many :votes, dependent: :destroy
   has_many :ranking_users, through: :votes, source: :user
 
diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb
index 0180f1b..1fe5009 100644
--- a/app/views/layouts/application.html.erb
+++ b/app/views/layouts/application.html.erb
@@ -51,5 +51,6 @@
   <main class="row">
     <%= yield %>
   </main>
+
 </body>
 </html>
diff --git a/app/views/sessions/create.html.erb b/app/views/sessions/create.html.erb
new file mode 100644
index 0000000..1447e01
--- /dev/null
+++ b/app/views/sessions/create.html.erb
@@ -0,0 +1 @@
+<h2>Create</h2>
diff --git a/app/views/sessions/login_form.html.erb b/app/views/sessions/login_form.html.erb
index b94d620..8fd052c 100644
--- a/app/views/sessions/login_form.html.erb
+++ b/app/views/sessions/login_form.html.erb
@@ -1,8 +1,11 @@
 <h2>Log In</h2>
+
+
 <%= form_tag do %>
   <%= label_tag(:username, "Username") %>
   <%= text_field_tag(:username) %>
-  <%= submit_tag("Log In", class: "button") %>
+  <%= submit_tag("Log In[Temp. Disabled]", class: "button") %>
+  <%= link_to("Log in with Github", "/auth/github", class: "button") %>
 <% end %>
 
 <article>
diff --git a/config/initializers/omniauth.rb b/config/initializers/omniauth.rb
new file mode 100644
index 0000000..fd44161
--- /dev/null
+++ b/config/initializers/omniauth.rb
@@ -0,0 +1,3 @@
+Rails.application.config.middleware.use OmniAuth::Builder do
+  provider :github, ENV["GITHUB_CLIENT_ID"], ENV["GITHUB_CLIENT_SECRET"], scope: "user:email"
+end
diff --git a/config/routes.rb b/config/routes.rb
index a7e8af1..155068e 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -1,6 +1,9 @@
 Rails.application.routes.draw do
   # For details on the DSL available within this file, see http://guides.rubyonrails.org/routing.html
   root 'works#root'
+
+  get "/auth/github/callback", to: "sessions#create", as: 'auth_callback_github'
+
   get '/login', to: 'sessions#login_form', as: 'login'
   post '/login', to: 'sessions#login'
   post '/logout', to: 'sessions#logout', as: 'logout'
diff --git a/db/migrate/20171016203516_add_ui_dand_provider.rb b/db/migrate/20171016203516_add_ui_dand_provider.rb
new file mode 100644
index 0000000..9d41a66
--- /dev/null
+++ b/db/migrate/20171016203516_add_ui_dand_provider.rb
@@ -0,0 +1,6 @@
+class AddUiDandProvider < ActiveRecord::Migration[5.0]
+  def change
+    add_column :users, :uid, :integer, null: false
+    add_column :users, :provider, :string,  null: false
+  end
+end
diff --git a/db/migrate/20171016205024_add_emailto_user.rb b/db/migrate/20171016205024_add_emailto_user.rb
new file mode 100644
index 0000000..ce19f62
--- /dev/null
+++ b/db/migrate/20171016205024_add_emailto_user.rb
@@ -0,0 +1,5 @@
+class AddEmailtoUser < ActiveRecord::Migration[5.0]
+  def change
+    add_column :users, :email, :string
+  end
+end
diff --git a/db/migrate/20171016224038_add_user_i_dto_work.rb b/db/migrate/20171016224038_add_user_i_dto_work.rb
new file mode 100644
index 0000000..8c74cee
--- /dev/null
+++ b/db/migrate/20171016224038_add_user_i_dto_work.rb
@@ -0,0 +1,5 @@
+class AddUserIDtoWork < ActiveRecord::Migration[5.0]
+  def change
+    add_reference :works, :user, foreign_key: true
+  end
+end
diff --git a/db/migrate/20171016224423_remove_user_integerfrom_works.rb b/db/migrate/20171016224423_remove_user_integerfrom_works.rb
new file mode 100644
index 0000000..88867a0
--- /dev/null
+++ b/db/migrate/20171016224423_remove_user_integerfrom_works.rb
@@ -0,0 +1,5 @@
+class RemoveUserIntegerfromWorks < ActiveRecord::Migration[5.0]
+  def change
+    remove_column :works, :user_id
+  end
+end
diff --git a/db/migrate/20171016224619_add_user_i_dto_work2ndtime.rb b/db/migrate/20171016224619_add_user_i_dto_work2ndtime.rb
new file mode 100644
index 0000000..524218f
--- /dev/null
+++ b/db/migrate/20171016224619_add_user_i_dto_work2ndtime.rb
@@ -0,0 +1,5 @@
+class AddUserIDtoWork2ndtime < ActiveRecord::Migration[5.0]
+  def change
+    add_reference :works, :user, foreign_key: true
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 6bc8ba5..aa3c1ab 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20170407164321) do
+ActiveRecord::Schema.define(version: 20171016224619) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
@@ -19,6 +19,9 @@
     t.string   "username"
     t.datetime "created_at", null: false
     t.datetime "updated_at", null: false
+    t.integer  "uid",        null: false
+    t.string   "provider",   null: false
+    t.string   "email"
   end
 
   create_table "votes", force: :cascade do |t|
@@ -39,8 +42,11 @@
     t.datetime "updated_at",                   null: false
     t.integer  "vote_count",       default: 0
     t.integer  "publication_year"
+    t.integer  "user_id"
+    t.index ["user_id"], name: "index_works_on_user_id", using: :btree
   end
 
   add_foreign_key "votes", "users"
   add_foreign_key "votes", "works"
+  add_foreign_key "works", "users"
 end
diff --git a/test/controllers/sessions_controller_test.rb b/test/controllers/sessions_controller_test.rb
index 9efd128..70cd248 100644
--- a/test/controllers/sessions_controller_test.rb
+++ b/test/controllers/sessions_controller_test.rb
@@ -1,15 +1,18 @@
 require "test_helper"
 
 describe SessionsController do
-  describe "login_form" do
-    # The login form is a static page - no real way to make it fail
-    it "succeeds" do
-      get login_path
-      must_respond_with :success
-    end
-  end
 
-  describe "login" do
+  let(:user) {users(:dan)}
+
+  # describe "login_form" do
+  #   # The login form is a static page - no real way to make it fail
+  #   it "succeeds" do
+  #     get login_path
+  #     must_respond_with :success
+  #   end
+  # end
+
+  describe "login oauth through github" do
     # This functionality is complex!
     # There are definitely interesting cases I haven't covered
     # here, but these are the cases I could think of that are
@@ -20,47 +23,97 @@
     # under the works controller, since that's the only place
     # where there's an interesting difference between a logged-in
     # and not-logged-in user.
-    it "succeeds for a new user" do
-      username = "test_user"
-      # Precondition: no user with this username exists
-      User.find_by(username: username).must_be_nil
 
-      post login_path, params: { username: username }
-      must_redirect_to root_path
-    end
+    describe "#create" do
+      it "should update the session with user ID" do
+        login_github(user)
 
-    it "succeeds for a returning user" do
-      username = User.first.username
-      post login_path, params: { username: username }
-      must_redirect_to root_path
-    end
+        session[:user_id].must_equal user.id
+        flash.keys.must_include "success"
+        must_redirect_to root_path
+      end
+
+      it "should create a new user upon first login" do
+        proc {
+          login_github
+        }.must_change "User.count", 1
+      end
 
-    it "renders 400 bad_request if the username is blank" do
-      post login_path, params: { username: "" }
-      must_respond_with :bad_request
+      it "should not create a new user on repeat logins" do
+        proc {
+          3.times do
+            login_github(user)
+          end
+        }.wont_change "User.count"
+      end
     end
 
-    it "succeeds if a different user is already logged in" do
-      username = "user_1"
-      post login_path, params: { username: username }
-      must_redirect_to root_path
+    # describe "#login" do
+    #   it "responds with bad request if given invalid user data" do
+    #
+    #     start_count = User.count
+    #     user1 = User.new(uid: 99998, provider: 'not-github')
+    #
+    #     login_github(user1)
+    #     must_respond_with :bad_request
+    #     User.count.must_equal start_count
+    #
+    #   end
+    # end
+    
+    #DAN'S TESTS:
+    # it "succeeds for a new user" do
+    #   username = "test_user"
+    #   # Precondition: no user with this username exists
+    #   User.find_by(username: username).must_be_nil
+    #
+    #   post login_path, params: { username: username }
+    #   must_redirect_to root_path
+    # end
 
-      username = "user_2"
-      post login_path, params: { username: username }
-      must_redirect_to root_path
-    end
+    # it "succeeds for a returning user" do
+    #   username = User.first.username
+    #   post login_path, params: { username: username }
+    #   must_redirect_to root_path
+    # end
+    #
+    # it "renders 400 bad_request if the username is blank" do
+    #   post login_path, params: { username: "" }
+    #   must_respond_with :bad_request
+    # end
+    #
+    # it "succeeds if a different user is already logged in" do
+    #   username = "user_1"
+    #   post login_path, params: { username: username }
+    #   must_redirect_to root_path
+    #
+    #   username = "user_2"
+    #   post login_path, params: { username: username }
+    #   must_redirect_to root_path
+    # end
   end
 
-  describe "logout" do
-    it "succeeds if the user is logged in" do
-      # Gotta be logged in first
-      post login_path, params: { username: "test user" }
-      must_redirect_to root_path
+  describe "#logout" do
+
+    it "logged-in user can log out" do
 
+      login_github(user)
       post logout_path
+      session[:user_id].must_be_nil
       must_redirect_to root_path
     end
 
+
+    #DAN'S TEST:
+    # it "succeeds if the user is logged in" do
+    #   # Gotta be logged in first
+    #   post login_path, params: { username: "test user" }
+    #   must_redirect_to root_path
+    #
+    #   post logout_path
+    #   must_redirect_to root_path
+    # end
+
     it "succeeds if the user is not logged in" do
       post logout_path
       must_redirect_to root_path
diff --git a/test/controllers/users_controller_test.rb b/test/controllers/users_controller_test.rb
index 0b06515..0430bfe 100644
--- a/test/controllers/users_controller_test.rb
+++ b/test/controllers/users_controller_test.rb
@@ -1,36 +1,59 @@
 require 'test_helper'
 
 describe UsersController do
-  describe "index" do
-    it "succeeds with many users" do
-      # Assumption: there are many users in the DB
-      User.count.must_be :>, 0
+  let(:user) { users(:dan) }
 
-      get users_path
-      must_respond_with :success
+  describe "when logged in" do
+
+    describe "index" do
+      it "succeeds with many users" do
+        login_github(user)
+        # Assumption: there are many users in the DB
+        User.count.must_be :>, 0
+
+        get users_path
+        must_respond_with :success
+      end
+
+      it "succeeds with no users" do
+        login_github(user)
+        # Start with a clean slate
+        Vote.destroy_all # for fk constraint
+        User.destroy_all
+
+        login_github(user)
+
+        get users_path
+        must_respond_with :success
+      end
     end
 
-    it "succeeds with no users" do
-      # Start with a clean slate
-      Vote.destroy_all # for fk constraint
-      User.destroy_all
+    describe "show" do
+      it "succeeds for an existing user" do
+        login_github(user)
+        get user_path(user.id)
+        must_respond_with :success
+      end
 
-      get users_path
-      must_respond_with :success
+      it "renders 404 not_found for a bogus user" do
+        login_github(user)
+        # User.last gives the user with the highest ID
+        bogus_user_id = User.last.id + 1
+        get user_path(bogus_user_id)
+        must_respond_with :not_found
+      end
     end
   end
 
-  describe "show" do
-    it "succeeds for an extant user" do
-      get user_path(User.first)
-      must_respond_with :success
+  describe "when not logged in" do
+    it "index" do
+      get users_path
+      must_redirect_to root_path
     end
 
-    it "renders 404 not_found for a bogus user" do
-      # User.last gives the user with the highest ID
-      bogus_user_id = User.last.id + 1
-      get user_path(bogus_user_id)
-      must_respond_with :not_found
+    it "show" do
+      get user_path(User.last)
+      must_redirect_to root_path
     end
   end
 end
diff --git a/test/controllers/works_controller_test.rb b/test/controllers/works_controller_test.rb
index dbb28eb..a2bfcb7 100644
--- a/test/controllers/works_controller_test.rb
+++ b/test/controllers/works_controller_test.rb
@@ -1,6 +1,8 @@
 require 'test_helper'
 
 describe WorksController do
+  let(:user) { users(:dan) }
+
   describe "root" do
     it "succeeds with all media types" do
       # Precondition: there is at least one media of each category
@@ -37,12 +39,16 @@
 
   describe "index" do
     it "succeeds when there are works" do
+      login_github(user)
+
       Work.count.must_be :>, 0, "No works in the test fixtures"
       get works_path
       must_respond_with :success
     end
 
     it "succeeds when there are no works" do
+      login_github(user)
+
       Work.destroy_all
       get works_path
       must_respond_with :success
@@ -51,6 +57,7 @@
 
   describe "new" do
     it "works" do
+      login_github(user)
       get new_work_path
       must_respond_with :success
     end
@@ -58,6 +65,7 @@
 
   describe "create" do
     it "creates a work with valid data for a real category" do
+      login_github(user)
       work_data = {
         work: {
           title: "test work"
@@ -76,6 +84,7 @@
     end
 
     it "renders bad_request and does not update the DB for bogus data" do
+      login_github(user)
       work_data = {
         work: {
           title: ""
@@ -94,6 +103,7 @@
     end
 
     it "renders 400 bad_request for bogus categories" do
+      login_github(user)
       work_data = {
         work: {
           title: "test work"
@@ -114,11 +124,13 @@
 
   describe "show" do
     it "succeeds for an extant work ID" do
+      login_github(user)
       get work_path(Work.first)
       must_respond_with :success
     end
 
     it "renders 404 not_found for a bogus work ID" do
+      login_github(user)
       bogus_work_id = Work.last.id + 1
       get work_path(bogus_work_id)
       must_respond_with :not_found
@@ -127,11 +139,13 @@
 
   describe "edit" do
     it "succeeds for an extant work ID" do
+      login_github(user)
       get edit_work_path(Work.first)
       must_respond_with :success
     end
 
     it "renders 404 not_found for a bogus work ID" do
+      login_github(user)
       bogus_work_id = Work.last.id + 1
       get edit_work_path(bogus_work_id)
       must_respond_with :not_found
@@ -140,6 +154,7 @@
 
   describe "update" do
     it "succeeds for valid data and an extant work ID" do
+      login_github(user)
       work = Work.first
       work_data = {
         work: {
@@ -155,6 +170,7 @@
     end
 
     it "renders bad_request for bogus data" do
+      login_github(user)
       work = Work.first
       work_data = {
         work: {
@@ -170,6 +186,7 @@
     end
 
     it "renders 404 not_found for a bogus work ID" do
+      login_github(user)
       bogus_work_id = Work.last.id + 1
       get work_path(bogus_work_id)
       must_respond_with :not_found
@@ -177,8 +194,11 @@
   end
 
   describe "destroy" do
+    let(:dans_work) { works(:thrill) }
+
     it "succeeds for an extant work ID" do
-      work_id = Work.first.id
+      login_github(user)
+      work_id = dans_work.id
 
       delete work_path(work_id)
       must_redirect_to root_path
@@ -188,6 +208,7 @@
     end
 
     it "renders 404 not_found and does not update the DB for a bogus work ID" do
+      login_github(user)
       start_count = Work.count
 
       bogus_work_id = Work.last.id + 1
@@ -199,13 +220,15 @@
   end
 
   describe "upvote" do
-    let(:user) { User.create!(username: "test_user") }
+    # let(:user) { User.create!(username: "test_user") }
     let(:work) { Work.first }
 
-    def login
-      post login_path, params: { username: user.username }
-      must_respond_with :redirect
-    end
+    # def login
+    #   # post login_path, params: { username: user.username }
+    #
+    #   login_github(user)
+    #   must_respond_with :redirect
+    # end
 
     def logout
       post logout_path
@@ -224,7 +247,7 @@ def logout
     it "returns 401 unauthorized after the user has logged out" do
       start_vote_count = work.votes.count
 
-      login
+      login_github(user)
       logout
 
       post upvote_path(work)
@@ -234,9 +257,9 @@ def logout
     end
 
     it "succeeds for a logged-in user and a fresh user-vote pair" do
-      start_vote_count = work.votes.count
 
-      login
+      login_github(user)
+      start_vote_count = work.votes.count
 
       post upvote_path(work)
       # Should be a redirect_back
@@ -247,8 +270,8 @@ def logout
     end
 
     it "returns 409 conflict if the user has already voted for that work" do
-      login
-      Vote.create!(user: user, work: work)
+      login_github(user)
+      # Vote.create!(user: user, work: work)
 
       start_vote_count = work.votes.count
 
diff --git a/test/fixtures/users.yml b/test/fixtures/users.yml
index e2968d7..2351187 100644
--- a/test/fixtures/users.yml
+++ b/test/fixtures/users.yml
@@ -2,6 +2,12 @@
 
 dan:
   username: dan
+  email: dan@adadev.org
+  uid: 99999
+  provider: github
 
 kari:
   username: kari
+  email: kari@adadev.org
+  uid: 10000
+  provider: github
diff --git a/test/fixtures/works.yml b/test/fixtures/works.yml
index bc0a939..523011e 100644
--- a/test/fixtures/works.yml
+++ b/test/fixtures/works.yml
@@ -6,6 +6,7 @@ mariner:
   description: Collaboration w/ Julie Christmas
   publication_year: 2016-04-08
   category: album
+  user: dan
 
 thrill:
   title: Can't Buy a Thrill
@@ -13,6 +14,7 @@ thrill:
   description: Dark, cryptic lyrics and catchy 70s hooks!
   publication_year: 1972-11-01
   category: album
+  user: dan
 
 poodr:
   title: Practical Object Oriented Design in Ruby
@@ -20,7 +22,9 @@ poodr:
   description: programming!
   publication_year: 2012
   category: book
+  user: kari
 
 movie:
   title: test movie - has only required fields
   category: movie
+  user: kari
diff --git a/test/test_helper.rb b/test/test_helper.rb
index 5b4fb66..decaffc 100644
--- a/test/test_helper.rb
+++ b/test/test_helper.rb
@@ -22,5 +22,36 @@
 class ActiveSupport::TestCase
   # Setup all fixtures in test/fixtures/*.yml for all tests in alphabetical order.
   fixtures :all
+
   # Add more helper methods to be used by all tests here...
+
+  def setup
+    OmniAuth.config.test_mode = true
+  end
+
+  def auth_hash_github
+    return {
+      provider: "github",
+      uid: 987654321,
+      info: {
+        email: "test-github-user@example.com",
+        nickname: "Test GitHub User"
+      }
+    }
+  end
+
+  def auth_hash(user)
+    return {
+      provider: user.provider,
+      uid: user.uid,
+      info: auth_hash_github[:info]
+    }
+  end
+
+  def login_github(user = nil)
+    auth_hash = user ? auth_hash(user) : auth_hash_github
+    OmniAuth.config.mock_auth[:github] = OmniAuth::AuthHash.new(auth_hash)
+
+    get auth_callback_github_path
+  end
 end