diff --git a/.gitignore b/.gitignore
index 48fb168f..5a111e4e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,3 +15,5 @@
 
 # Ignore Byebug command history file.
 .byebug_history
+
+.env
diff --git a/Gemfile b/Gemfile
index c029c6da..7a0d3c2b 100644
--- a/Gemfile
+++ b/Gemfile
@@ -8,6 +8,9 @@ git_source(:github) do |repo_name|
 end
 
 # Bundle edge Rails instead: gem 'rails', github: 'rails/rails'
+gem "omniauth"
+gem "omniauth-github"
+
 gem 'rails', '~> 5.0.2'
 # Use postgresql as the database for Active Record
 gem 'pg', '~> 0.18'
@@ -65,6 +68,8 @@ group :development do
   # Spring speeds up development by keeping your application running in the background. Read more: https://github.com/rails/spring
   gem 'spring'
   gem 'spring-watcher-listen', '~> 2.0.0'
+  gem 'dotenv-rails'
+  gem "binding_of_caller"
 end
 
 # Windows does not include zoneinfo files, so bundle the tzinfo-data gem
diff --git a/Gemfile.lock b/Gemfile.lock
index f03db854..a8a75516 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -51,6 +51,8 @@ GEM
       erubi (>= 1.0.0)
       rack (>= 0.9.0)
     bindex (0.5.0)
+    binding_of_caller (0.8.0)
+      debug_inspector (>= 0.0.1)
     builder (3.2.3)
     byebug (10.0.2)
     coderay (1.1.2)
@@ -63,9 +65,16 @@ GEM
     coffee-script-source (1.12.2)
     concurrent-ruby (1.0.5)
     crass (1.0.3)
+    debug_inspector (0.0.3)
+    dotenv (2.2.2)
+    dotenv-rails (2.2.2)
+      dotenv (= 2.2.2)
+      railties (>= 3.2, < 6.0)
     erubi (1.7.1)
     erubis (2.7.0)
     execjs (2.7.0)
+    faraday (0.12.2)
+      multipart-post (>= 1.2, < 3)
     ffi (1.9.23)
     foundation-rails (6.4.3.0)
       railties (>= 3.1.0)
@@ -73,6 +82,7 @@ GEM
       sprockets-es6 (>= 0.9.0)
     globalid (0.4.1)
       activesupport (>= 4.2.0)
+    hashie (3.5.7)
     i18n (1.0.0)
       concurrent-ruby (~> 1.0)
     jbuilder (2.7.0)
@@ -82,6 +92,7 @@ GEM
       rails-dom-testing (>= 1, < 3)
       railties (>= 4.2.0)
       thor (>= 0.14, < 2.0)
+    jwt (1.5.6)
     listen (3.0.8)
       rb-fsevent (~> 0.9, >= 0.9.4)
       rb-inotify (~> 0.9, >= 0.9.7)
@@ -108,9 +119,26 @@ GEM
       minitest (~> 5.0)
       rails (>= 4.1)
     multi_json (1.13.1)
+    multi_xml (0.6.0)
+    multipart-post (2.0.0)
     nio4r (2.3.0)
     nokogiri (1.8.2)
       mini_portile2 (~> 2.3.0)
+    oauth2 (1.4.0)
+      faraday (>= 0.8, < 0.13)
+      jwt (~> 1.0)
+      multi_json (~> 1.3)
+      multi_xml (~> 0.5)
+      rack (>= 1.2, < 3)
+    omniauth (1.8.1)
+      hashie (>= 3.4.6, < 3.6.0)
+      rack (>= 1.6.2, < 3)
+    omniauth-github (1.3.0)
+      omniauth (~> 1.5)
+      omniauth-oauth2 (>= 1.4.0, < 2.0)
+    omniauth-oauth2 (1.5.0)
+      oauth2 (~> 1.1)
+      omniauth (~> 1.2)
     pg (0.21.0)
     pry (0.11.3)
       coderay (~> 1.1.0)
@@ -197,8 +225,10 @@ PLATFORMS
 DEPENDENCIES
   autoprefixer-rails
   better_errors
+  binding_of_caller
   byebug
   coffee-rails (~> 4.2)
+  dotenv-rails
   foundation-rails
   jbuilder (~> 2.5)
   jquery-rails
@@ -207,6 +237,8 @@ DEPENDENCIES
   minitest-reporters
   minitest-skip
   minitest-spec-rails
+  omniauth
+  omniauth-github
   pg (~> 0.18)
   pry-rails
   puma (~> 3.0)
diff --git a/README.md b/README.md
index 189815e9..02b96ea5 100644
--- a/README.md
+++ b/README.md
@@ -42,7 +42,7 @@ Take some time to understand what each controller is doing. Add tests to the exi
 - Tests custom controller logic and custom routes when appropriate
   - Tests positive, negative, nominal and edge cases
 
-<!-- ## Wave 2: Authentication via OAuth
+## Wave 2: Authentication via OAuth
 
 Following the steps in the Textbook curriculum, add OAuth to your Media Ranker Application and enable a user to log in.
 
@@ -53,8 +53,7 @@ Following the steps in the Textbook curriculum, add OAuth to your Media Ranker A
 - All other requirements from in-class notes apply:
   - Managed via `session`
   - `SessionsController`
-  - `User` model -->
-
+  - `User` model
 
 <!-- ## Wave 3: Basic Authorization (Page Access)
 
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index c12c7c17..90f35afb 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -2,16 +2,25 @@ class ApplicationController < ActionController::Base
   protect_from_forgery with: :exception
 
   before_action :find_user
+  before_action :require_login
+  skip_before_action :require_login, only: [:login_form, :create]
 
   def render_404
     # DPR: this will actually render a 404 page in production
     raise ActionController::RoutingError.new('Not Found')
   end
 
+  def require_login
+    redirect_to root_path, status: :bad_request if session[:user_id].nil?
+    flash[:error] = "Log in to see that"
+  end
+
+
 private
   def find_user
     if session[:user_id]
       @login_user = User.find_by(id: session[:user_id])
     end
+
   end
 end
diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index 5bce99e6..379febff 100644
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -1,28 +1,47 @@
 class SessionsController < ApplicationController
   def login_form
+    # login through internal site using this method, not login
+    # flash[:status] = :success
+    # flash[:result_text] = "Successfully logged in"
+    # redirect_to root_path
   end
 
-  def login
-    username = params[:username]
-    if username and user = User.find_by(username: username)
-      session[:user_id] = user.id
-      flash[:status] = :success
-      flash[:result_text] = "Successfully logged in as existing user #{user.username}"
-    else
-      user = User.new(username: username)
-      if user.save
-        session[:user_id] = user.id
-        flash[:status] = :success
-        flash[:result_text] = "Successfully created new user #{user.username} with ID #{user.id}"
+  def create
+    # controller responsible for the errors & redirect
+    auth_hash = request.env['omniauth.auth']
+
+    if auth_hash['uid']
+      # raise
+      @user = User.find_by(uid: auth_hash[:uid], provider: 'github')
+      if @user.nil?
+        puts "No user found! Creating new username"
+
+        @user = User.get_user_info(auth_hash)
+
+        if @user.save
+          # saved successfully
+          session[:user_id] = @user.id
+          flash[:status] = :success
+          flash[:result_text] = "Logged in successfully"
+          redirect_to root_path
+        else
+          # not saved successfully
+          flash[:status] = :failure
+          flash[:result_text] = "Could not log in"
+          redirect_to root_path
+        end
+
       else
-        flash.now[:status] = :failure
-        flash.now[:result_text] = "Could not log in"
-        flash.now[:messages] = user.errors.messages
-        render "login_form", status: :bad_request
-        return
+        session[:user_id] = @user.id
+        flash[:status] = :success
+        flash[:result_text] = "Logged in successfully"
+        redirect_to root_path
       end
+    else
+      flash[:status] = :failure
+      flash[:result_text] = "NOT WORKING"
+      redirect_to root_path
     end
-    redirect_to root_path
   end
 
   def logout
@@ -31,4 +50,11 @@ def logout
     flash[:result_text] = "Successfully logged out"
     redirect_to root_path
   end
+
+  def destroy
+    session[:user_id] = nil
+    redirect_to root_path, notice: 'Logged out!'
+  end
+
+
 end
diff --git a/app/controllers/works_controller.rb b/app/controllers/works_controller.rb
index 2020bee4..2b1434ca 100644
--- a/app/controllers/works_controller.rb
+++ b/app/controllers/works_controller.rb
@@ -3,6 +3,8 @@ class WorksController < ApplicationController
   # of work we're dealing with
   before_action :category_from_work, except: [:root, :index, :new, :create]
 
+  before_action :require_login, except: [:root]
+
   def root
     @albums = Work.best_albums
     @books = Work.best_books
@@ -50,7 +52,7 @@ def update
       flash.now[:status] = :failure
       flash.now[:result_text] = "Could not update #{@media_category.singularize}"
       flash.now[:messages] = @work.errors.messages
-      render :edit, status: :not_found
+      render :edit, status: :bad_request
     end
   end
 
@@ -81,7 +83,7 @@ def upvote
     redirect_back fallback_location: work_path(@work)
   end
 
-private
+  private
   def media_params
     params.require(:work).permit(:title, :category, :creator, :description, :publication_year)
   end
@@ -91,4 +93,5 @@ def category_from_work
     render_404 unless @work
     @media_category = @work.category.downcase.pluralize
   end
+
 end
diff --git a/app/models/user.rb b/app/models/user.rb
index 4cac8fe0..4d0556d6 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -1,6 +1,16 @@
 class User < ApplicationRecord
-  has_many :votes
+  has_many :votes, dependent: :destroy 
   has_many :ranked_works, through: :votes, source: :work
 
   validates :username, uniqueness: true, presence: true
+
+  def self.get_user_info(auth_hash)
+      @user = User.new(
+        username: auth_hash['info']['name'],
+        email: auth_hash['info']['email'],
+        uid: auth_hash['uid'],
+        provider: auth_hash['provider'])
+        # raise
+        return @user
+  end
 end
diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb
index 82ca0fdc..18007369 100644
--- a/app/views/layouts/application.html.erb
+++ b/app/views/layouts/application.html.erb
@@ -25,29 +25,33 @@
         <%= link_to "View all users", users_path, class: "button" %>
       </div>
       <div class="user-nav">
+
         <% if @login_user %>
-          <%= link_to "Logged in as #{@login_user.username}", user_path(@login_user), class: "button" %>
-          <%= link_to "Log Out", logout_path, method: :post, class: "button" %>
+        <%= link_to "Logged in as #{@login_user.username}", user_path(@login_user), class: "button" %>
+
+        <%= link_to "Log Out", logout_path, method: :destroy, class: "button" %>
+
         <% else %>
-          <%= link_to "Log In", login_path, class: "button" %>
+
+        <%= link_to "Log In", login_path, class: "button" %>
         <% end %>
       </div>
     </nav>
   </header>
 
   <% if flash[:result_text] or flash[:messages] %>
-    <section class="status <%= flash[:status] %>">
-      <h3><%= flash[:status] == :failure ? "A problem occurred: " : "" %><%= flash[:result_text] %></h3>
-      <% if flash[:messages] %>
-        <ul>
-          <% flash[:messages].each do |name, problems| %>
-            <% problems.each do |problem| %>
-              <li><%= name %>: <%= problem %></li>
-            <% end %>
-          <% end %>
-        </ul>
+  <section class="status <%= flash[:status] %>">
+    <h3><%= flash[:status] == :failure ? "A problem occurred: " : "" %><%= flash[:result_text] %></h3>
+    <% if flash[:messages] %>
+    <ul>
+      <% flash[:messages].each do |name, problems| %>
+      <% problems.each do |problem| %>
+      <li><%= name %>: <%= problem %></li>
+      <% end %>
       <% end %>
-    </section>
+    </ul>
+    <% end %>
+  </section>
   <% end %>
 
   <main>
diff --git a/app/views/sessions/login_form.html.erb b/app/views/sessions/login_form.html.erb
index b94d6208..179c219d 100644
--- a/app/views/sessions/login_form.html.erb
+++ b/app/views/sessions/login_form.html.erb
@@ -2,7 +2,7 @@
 <%= form_tag do %>
   <%= label_tag(:username, "Username") %>
   <%= text_field_tag(:username) %>
-  <%= submit_tag("Log In", class: "button") %>
+  <%= link_to("Log In", connect_provider_path, class: "button") %>
 <% end %>
 
 <article>
diff --git a/config/initializers/omniauth.rb b/config/initializers/omniauth.rb
new file mode 100644
index 00000000..fd441612
--- /dev/null
+++ b/config/initializers/omniauth.rb
@@ -0,0 +1,3 @@
+Rails.application.config.middleware.use OmniAuth::Builder do
+  provider :github, ENV["GITHUB_CLIENT_ID"], ENV["GITHUB_CLIENT_SECRET"], scope: "user:email"
+end
diff --git a/config/routes.rb b/config/routes.rb
index a7e8af1d..324ea85a 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -2,11 +2,16 @@
   # For details on the DSL available within this file, see http://guides.rubyonrails.org/routing.html
   root 'works#root'
   get '/login', to: 'sessions#login_form', as: 'login'
-  post '/login', to: 'sessions#login'
+  # post '/login', to: 'sessions#login'
   post '/logout', to: 'sessions#logout', as: 'logout'
 
   resources :works
   post '/works/:id/upvote', to: 'works#upvote', as: 'upvote'
 
   resources :users, only: [:index, :show]
+
+  get '/auth/github', as: 'connect_provider'
+
+  get "/auth/github/callback", to: "sessions#create", as: 'auth_callback'
+
 end
diff --git a/db/migrate/20180417192951_add_user_email_user_id_provider_columns.rb b/db/migrate/20180417192951_add_user_email_user_id_provider_columns.rb
new file mode 100644
index 00000000..f7a97a47
--- /dev/null
+++ b/db/migrate/20180417192951_add_user_email_user_id_provider_columns.rb
@@ -0,0 +1,8 @@
+class AddUserEmailUserIdProviderColumns < ActiveRecord::Migration[5.0]
+  def change
+    # add_column :products, :part_number, :string
+    add_column :users, :email, :string
+    add_column :users, :uid, :integer
+    add_column :users, :provider, :string
+  end
+end
diff --git a/db/migrate/20180417203102_add_default_to_user_columns.rb b/db/migrate/20180417203102_add_default_to_user_columns.rb
new file mode 100644
index 00000000..d07a31d9
--- /dev/null
+++ b/db/migrate/20180417203102_add_default_to_user_columns.rb
@@ -0,0 +1,6 @@
+class AddDefaultToUserColumns < ActiveRecord::Migration[5.0]
+  def change
+    change_column :users, :uid, :integer, :null => false
+    change_column :users, :provider, :string, :null => false
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 6bc8ba5c..86dd629c 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20170407164321) do
+ActiveRecord::Schema.define(version: 20180417203102) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
@@ -19,6 +19,9 @@
     t.string   "username"
     t.datetime "created_at", null: false
     t.datetime "updated_at", null: false
+    t.string   "email"
+    t.integer  "uid",        null: false
+    t.string   "provider",   null: false
   end
 
   create_table "votes", force: :cascade do |t|
@@ -44,3 +47,9 @@
   add_foreign_key "votes", "users"
   add_foreign_key "votes", "works"
 end
+
+
+# TODO:
+  #   <div>
+  #   <%=render partial: "reviews/form", locals: { actions_name: "Save My Review"} %>
+  # </div>
diff --git a/test/controllers/sessions_controller_test.rb b/test/controllers/sessions_controller_test.rb
index f641d15c..b15c65d2 100644
--- a/test/controllers/sessions_controller_test.rb
+++ b/test/controllers/sessions_controller_test.rb
@@ -1,5 +1,61 @@
 require "test_helper"
 
 describe SessionsController do
+	describe "create" do
+		it "succeeds and redirects user upon logging in" do
+			# Arrange
+			user = User.first
+
+			OmniAuth.config.mock_auth[:github] = OmniAuth::AuthHash.new(mock_auth_hash(user))
+
+      get auth_callback_path(:github)
+
+			# Act
+			proc {
+				post login_path
+			}
+
+			# Assert
+      must_redirect_to root_path
+      session[:user_id].must_equal user.id
+		end
+
+		# it "redirects user if log in fails" do
+		# 	# Arrange
+		# 	user = User.first
+		#
+		# 	OmniAuth.config.mock_auth[:github] = OmniAuth::AuthHash.new(mock_auth_hash(user))
+		#
+		# 	OmniAuth.config.mock_auth[:github] = OmniAuth::AuthHash.new(mock_auth_hash(user))
+		#
+		# 	get auth_callback_path(:github)
+		#
+		# 	# Assert
+		# 	must_redirect_to root_path
+		# 	flash[:status].must_equal :failure
+		# end
+	end
+
+	describe "logout" do
+		describe "redirects user upon logging out" do
+			it "logs user out if they exist" do
+				# Arrange
+				user = User.first
+
+				OmniAuth.config.mock_auth[:github] = OmniAuth::AuthHash.new(mock_auth_hash(user))
+
+				get auth_callback_path(:github)
+
+				# Act
+				proc {
+					post logout_path
+				}
+
+				# Assert
+				must_redirect_to root_path
+				# session[:user_id].must_equal nil
+			end
+		end
+	end
 
 end
diff --git a/test/controllers/users_controller_test.rb b/test/controllers/users_controller_test.rb
index d2c5cfbb..a617694b 100644
--- a/test/controllers/users_controller_test.rb
+++ b/test/controllers/users_controller_test.rb
@@ -1,5 +1,43 @@
 require 'test_helper'
 
 describe UsersController do
+	describe "index" do
+		it "succeeds when there are users" do
+			# Arrange - get users
+			User.all.count.must_be :>, 0
+			get users_path
 
+			must_respond_with :success
+		end
+
+		it "succeeds when there are no users" do
+			# Arrange
+			User.destroy_all
+			User.all.length.must_equal 0
+			# Act
+			get users_path
+			# Assert
+			must_respond_with :success
+		end
+	end
+
+	describe "show" do
+		it "finds a user if they exist" do
+			# Arrange
+			user = User.first
+			# Arrange
+      get user_path(user)
+      # Assert
+      must_respond_with :success
+		end
+
+		it "succeeds if a user doesn't exist" do
+			# Arrange
+			user = User.last.id + 1
+			# Arrange
+			get user_path(user)
+			# Assert
+			must_respond_with :not_found
+ 		end
+	end
 end
diff --git a/test/controllers/works_controller_test.rb b/test/controllers/works_controller_test.rb
index 0945ca47..985df4a2 100644
--- a/test/controllers/works_controller_test.rb
+++ b/test/controllers/works_controller_test.rb
@@ -4,16 +4,41 @@
   describe "root" do
     it "succeeds with all media types" do
       # Precondition: there is at least one media of each category
-
+      # Arrange
+      Work.where(category: "album").count.must_be :>, 0
+      Work.where(category: "book").count.must_be :>, 0
+      Work.where(category: "movie").count.must_be :>, 0
+
+      # #Act
+      get root_path
+      # # Assert
+      must_respond_with :success
     end
 
     it "succeeds with one media type absent" do
       # Precondition: there is at least one media in two of the categories
-
+      # Arrange
+      Work.where(category: "album").count.must_be :>, 0
+      Work.where(category: "book").count.must_be :>, 0
+      # must delete all movies so that none exit in that category
+      Work.where(category: "movie").destroy_all
+
+      Work.where(category: "movie").count.must_be :==, 0
+
+      # Act
+      get root_path
+      # Assert
+      must_respond_with :success
     end
 
     it "succeeds with no media" do
-
+      # Arrange
+      Work.destroy_all
+      Work.all.length.must_equal 0
+      # Act
+      get works_path
+      # Assert
+      must_respond_with :success
     end
   end
 
@@ -22,95 +47,280 @@
 
   describe "index" do
     it "succeeds when there are works" do
-
+      # get works
+      Work.all.count.must_be :>, 0
+      get works_path
+      must_respond_with :success
     end
 
     it "succeeds when there are no works" do
-
+      # Arrange
+      Work.destroy_all
+      Work.all.length.must_equal 0
+      # Act
+      get works_path
+      # Assert
+      must_respond_with :success
     end
   end
 
   describe "new" do
     it "succeeds" do
-
+      # Arrange & Act
+      get new_work_path
+      # Assert
+      must_respond_with :success
     end
   end
 
   describe "create" do
     it "creates a work with valid data for a real category" do
+      # Arrange-store data and test it
+      new_work = { title: 'Island Under The Sea',
+        creator:'You',
+        description: 'Chile',
+        publication_year: 1999-11-01,
+        category: 'book'
+      }
 
-    end
+      old_work_count = Work.count
 
-    it "renders bad_request and does not update the DB for bogus data" do
+      Work.new(new_work).must_be :valid?
+
+      # Act
+      post works_path, params: { work: new_work }
+      # Assert
 
+      # Assert
+      must_respond_with :redirect
+      must_redirect_to work_path(Work.last)
+
+      Work.count.must_equal old_work_count + 1
+      Work.last.title.must_equal new_work[:title]
     end
 
-    it "renders 400 bad_request for bogus categories" do
+    it "renders bad_request and does not update the DB for bogus data" do
+      # Arrange
+      bad = {
+        creator:'You',
+        description: 'Chile',
+        publication_year: 1999-11-01,
+        category: 'book'
+      }
+      old_work_count = Work.count
+
+      Work.new(bad).wont_be :valid?
+      # Act
+      post works_path, params: { work: bad }
+      # Assert
+      Work.count.must_equal old_work_count
+      must_respond_with :bad_request
+    end
 
+    it "renders 400 bad_request for bogus categories" do #for every category
+      # Arrange
+      bad = {
+        creator:'You',
+        description: 'Chile',
+        publication_year: 1999-11-01,
+        category: 'book'
+      }
+      old_work_count = Work.count
+
+      Work.new(bad).wont_be :valid?
+      # Act
+      post works_path, params: { work: bad }
+      # Assert
+      Work.count.must_equal old_work_count
+      must_respond_with :bad_request
     end
 
   end
 
   describe "show" do
     it "succeeds for an extant work ID" do
-
+      # Arrange & Act - get path
+      get work_path(Work.first)
+      # Assert - :success
+      must_respond_with :success
     end
 
     it "renders 404 not_found for a bogus work ID" do
-
+      # Arrange
+      work_id = Work.last.id + 1
+      # Act - get path
+      get work_path(work_id)
+      # Assert
+      must_respond_with :not_found
     end
   end
 
   describe "edit" do
     it "succeeds for an extant work ID" do
-
+      # Arrange & Act
+      get edit_work_path(Work.first)
+      # Assert
+      must_respond_with :success
     end
 
     it "renders 404 not_found for a bogus work ID" do
-
+      work_id = Work.last.id + 1
+      # Act - get path
+      get edit_work_path(work_id)
+      # Assert
+      must_respond_with :not_found
     end
   end
 
   describe "update" do
     it "succeeds for valid data and an extant work ID" do
+      # Arrange
+      work = Work.first
+      work_data = work.attributes
+      work_data[:title] = "Deep Sleeper"
+
+      # Assumptions
+      work.assign_attributes(work_data)
+      work.must_be :valid?
+
+      # Act - send to instance in db w/ the right parameters
+      patch work_path(work), params: { work: work_data }
+
+      # Assert
+      must_redirect_to work_path(work)
+      work.reload
+      work.title.must_equal work_data[:title]
 
     end
 
     it "renders bad_request for bogus data" do
+      # Arrange - use a current entry & update w/ bad data??
+      work = Work.first
+      work_data = work.attributes
+      work_data[:title] = ""
+
+      # Assumptions
+      work.assign_attributes(work_data)
+      work.wont_be :valid?
+      # Act
+      patch work_path(work), params: { work: work_data }
+      # Assert
+      must_respond_with :bad_request
 
     end
 
     it "renders 404 not_found for a bogus work ID" do
-
+      # Arrange -
+      work_id = Work.last.id + 1
+      # Act
+      patch work_path(work_id)
+      # Assert
+      must_respond_with :not_found
     end
   end
 
   describe "destroy" do
     it "succeeds for an extant work ID" do
+      # Arrange
+      work = Work.last
+
+      # Act
+      proc {
+        delete work_path(work)
+      }.must_change 'Work.count', -1
 
+      # Assert
+      must_redirect_to root_path
     end
 
     it "renders 404 not_found and does not update the DB for a bogus work ID" do
+      # Arrange
+      work = Work.last.id + 1
 
+      # Act
+      proc {
+        delete work_path(work)
+      }.must_change 'Work.count', 0
+
+      # Assert
+      must_respond_with :not_found
     end
   end
 
   describe "upvote" do
-
     it "redirects to the work page if no user is logged in" do
+      # Arrange -
+      work = Work.last
+      # Act - path
+      proc {
+        post upvote_path(work)
+      }.must_change 'Vote.count', 0
+
+      # Assert
+      must_redirect_to work_path(work)
 
     end
 
-    it "redirects to the work page after the user has logged out" do
+    it "redirects to the work page after the user has voted" do
+      # Arrange
+      work_data = Work.first.attributes
+      work_data[:id] = nil
+      work_data[:title] = "New Awesome Work"
+
+      work = Work.create(work_data)
+
+      user = User.first
+
+      OmniAuth.config.mock_auth[:github] = OmniAuth::AuthHash.new(mock_auth_hash(user))
+
+      get auth_callback_path(:github)
+
+      must_redirect_to root_path
+
+      session[:user_id].must_equal user.id
+
+      # Act
+      proc {
+        post upvote_path(work)
+      }.must_change 'Vote.count', 1
+
+      # Assert
+      must_redirect_to work_path(work)
 
     end
 
     it "succeeds for a logged-in user and a fresh user-vote pair" do
+      # Arrange - user can vote if they haven't voted for work before
+      work = Work.first
+      user = User.first
+
+      OmniAuth.config.mock_auth[:github] = OmniAuth::AuthHash.new(mock_auth_hash(user))
 
+      get auth_callback_path(:github)
+      # Act - check assumptions?
+      proc {
+        post upvote_path(work)
+      }.must_change 'Vote.count', 1
+
+      # Assert - need to render same page?
+      session[:user_id].must_equal user.id
     end
 
     it "redirects to the work page if the user has already voted for that work" do
-
+      # Arrange
+      work = Work.last
+      user = User.first
+
+      OmniAuth.config.mock_auth[:github] = OmniAuth::AuthHash.new(mock_auth_hash(user))
+
+      get auth_callback_path(:github)
+      # Act
+      proc {
+        post upvote_path(work)
+      }.must_change 'Vote.count', 0
+      # Assert
+      must_redirect_to work_path(work)
+      # must_respond_with :failure
     end
   end
 end
diff --git a/test/fixtures/users.yml b/test/fixtures/users.yml
index e2968d78..5131d599 100644
--- a/test/fixtures/users.yml
+++ b/test/fixtures/users.yml
@@ -2,6 +2,13 @@
 
 dan:
   username: dan
+  uid: 3222222
+  email:
+  provider: github
+
 
 kari:
   username: kari
+  uid: 5888888
+  email:
+  provider: github
diff --git a/test/models/user_test.rb b/test/models/user_test.rb
index 793ce7e6..cc19842c 100644
--- a/test/models/user_test.rb
+++ b/test/models/user_test.rb
@@ -39,6 +39,9 @@
       user2.errors.messages.must_include :username
     end
 
+    it "gets user info from auth hash" do
+
+    end
 
   end
 end
diff --git a/test/test_helper.rb b/test/test_helper.rb
index 5b4fb667..f9cbe223 100644
--- a/test/test_helper.rb
+++ b/test/test_helper.rb
@@ -12,6 +12,7 @@
   Minitest.backtrace_filter
 )
 
+
 # To add Capybara feature tests add `gem "minitest-rails-capybara"`
 # to the test group in the Gemfile and uncomment the following:
 # require "minitest/rails/capybara"
@@ -23,4 +24,27 @@ class ActiveSupport::TestCase
   # Setup all fixtures in test/fixtures/*.yml for all tests in alphabetical order.
   fixtures :all
   # Add more helper methods to be used by all tests here...
+  def setup
+    # Once you have enabled test mode, all requests
+    # to OmniAuth will be short circuited to use the mock authentication hash.
+    # A request to /auth/provider will redirect immediately to /auth/provider/callback.
+    OmniAuth.config.test_mode = true
+  end
+
+  def mock_auth_hash(user)
+    return {
+      provider: user.provider,
+      uid: user.uid,
+      info: {
+        email: user.email,
+        nickname: user.username
+      }
+    }
+  end
+
+  def login(user)
+    OmniAuth.config.mock_auth[:github] = OmniAuth::AuthHash.new(mock_auth_hash(user))
+    get auth_callback_path(:github)
+  end
+
 end