diff --git a/controllers/share.js b/controllers/share.js
index 9e0f1b3a..1a266826 100644
--- a/controllers/share.js
+++ b/controllers/share.js
@@ -155,6 +155,7 @@ exports.createOrUpdate = function (request, response) {
   var stories = {};
   var submitted = request.body;
 
+  // #TODO: don't assume any stories have been submitted
   for (var i = 0; i < submitted.stories.length; i++)
     if (submitted.stories[i]) stories[i] = submitted.stories[i];
 
diff --git a/test/share-controller-test.js b/test/share-controller-test.js
deleted file mode 100644
index d29c4a17..00000000
--- a/test/share-controller-test.js
+++ /dev/null
@@ -1,79 +0,0 @@
-var vows = require('vows')
-var assert = require('assert')
-var should = require('should')
-var conmock = require('./conmock.js')
-var sharecontroller = require('../controllers/share.js')
-
-var User = require('../models/user.js')
-var Badge = require('../models/badge.js')
-var Group = require('../models/group.js')
-var Portfolio = require('../models/portfolio.js')
-
-var user, otherUser, badge, group, otherGroup, portfolio;
-function setupDatabase (callback) {
-  var mysql = require('../lib/mysql.js')
-  var badgedata = require('../lib/utils').fixture({recipient: 'brian@example.com'})
-  mysql.prepareTesting();
-  function saver (m, cb) { m.save(cb) };
-  
-  user = new User({ email: 'brian@example.com' })
-  otherUser = new User({ email: 'lolwut@example.com' })
-  badge = new Badge({
-    user_id: 1,
-    type: 'hosted',
-    endpoint: 'endpoint',
-    image_path: 'image_path',
-    body_hash: 'body_hash',
-    body: badgedata
-  });
-  group = new Group({
-    user_id: 1,
-    name: 'name',
-    url: 'url',
-    'public': 0,
-    badges: [1]
-  });
-  otherGroup = new Group({
-    user_id: 1,
-    name: 'name',
-    url: 'url2',
-    'public': 1,
-    badges: []
-  });
-  portfolio = new Portfolio({
-    group_id: 2,
-    url: 'url',
-    title: 'wut',
-    stories: '{"1": "oh hey"}'
-  });
-  map.async(saver, [user, otherUser, badge, group, otherGroup, portfolio], callback);
-}
-
-vows.describe('group controller test').addBatch({
-  'setup' : {
-    topic: function () {
-      setupDatabase(this.callback);
-    },
-    '#createOrUpdate': {
-      topic : function () { return sharecontroller.createOrUpdate },
-      'when given no user' : {
-        topic : function (route) {
-          var req = { }
-          conmock(route, req, this.callback)
-        },
-        'respond with 403' : function (err, mock) {
-          mock.status.should.equal(403);
-        },
-      },
-      'when given the wrong user for the group': {
-        topic : function (route) {
-          var req = { user: otherUser, group: group }
-          conmock(route, req, this.callback)
-        },
-        'respond with 403' : function (err, mock) {
-          mock.status.should.equal(403);
-        },
-      },
-    }
-  },
-}).export(module);
\ No newline at end of file
diff --git a/test/share-controller.test.js b/test/share-controller.test.js
new file mode 100644
index 00000000..50f1d17c
--- /dev/null
+++ b/test/share-controller.test.js
@@ -0,0 +1,52 @@
+const test = require('tap').test;
+const testUtils = require('./');
+const conmock = require('./conmock');
+const share = require('../controllers/share');
+
+const User = require('../models/user');
+const Badge = require('../models/badge');
+const Group = require('../models/group');
+
+testUtils.prepareDatabase({
+  '1-user': new User({ email: 'brian@example.com' }),
+  '2-other-user': new User({ email: 'lolwut@example.com' }),
+  '3-badge': new Badge({
+    user_id: 1,
+    type: 'hosted',
+    endpoint: 'endpoint',
+    image_path: 'image_path',
+    body_hash: 'body_hash',
+    body: testUtils.makeAssertion()
+  }),
+  '4-group': new Group({
+    user_id: 1,
+    name: 'name',
+    url: 'url',
+    'public': 0,
+    badges: [1]
+  }),
+}, function (fixtures) {
+  test('share#createOrUpdate: no user', function (t) {
+    conmock(share.createOrUpdate, function (err, mock) {
+      t.same(mock.status, 403, 'should be forbidden');
+      t.end();
+    });
+  });
+
+  test('share#createOrUpdate: wrong user', function (t) {
+    const user = fixtures['2-other-user'];
+    const group = fixtures['4-group'];
+    const request = { user: user, group: group }
+    conmock({
+      handler: share.createOrUpdate,
+      request: request,
+    }, function (err, mock) {
+      t.same(mock.status, 403, 'should be forbidden');
+      t.end();
+    });
+  });
+
+  testUtils.finish(test);
+});
+
+