Login that works with twitter and facebook Requires that users have facebook_id and twitter_id

session_helpers.rb

def our_login(arguments)
    if arguments['facebook_access_token']
        facebook_user = User.get_facebook_user(arguments['facebook_access_token'])
        user = User.first(:facebook_id=>facebook_user["id"])
        if user.nil? && !facebook_user["email"].blank?
            user = User.first(:email=>facebook_user["email"]) 
            if user.nil?
                return false
            else
                user.facebook_id = facebook_user["id"]
                return false unless user.valid?
                user.save
            end
        end
        authenticate(user) if user
    elsif arguments['twitter_access_token'] && arguments['twitter_access_token_secret']
        twitter_user = User.get_twitter_user(arguments['twitter_access_token'], arguments['twitter_access_token_secret'])
        user = User.first(:twitter_id=>twitter_user[:id].to_s) if twitter_user && twitter_user[:id]
        authenticate(user) if user
    else
        login(User, arguments['username'], arguments['password'])
    end
    is_logged_in?
end 

User.rb

class User < Sequel::Model
   def facebook_access_token=(value)
        return if value.nil?
        facebook_user       = User.get_facebook_user(value)
        self.email          = facebook_user["email"] if self.email.nil? && !facebook_user["email"].blank?
        self.facebook_id    = facebook_user["id"]
    end

    def self.get_facebook_user(access_token)
        facebook_user_request = RestClient.get "https://graph.facebook.com/me", {:params=> {:access_token => access_token } }
        raise InvalidAccessTokenError, access_token unless facebook_user_request.code == 200
        JSON.parse(facebook_user_request.to_s)
    end
    
    def self.get_twitter_user(access_token, access_token_secret)
        begin
            return nil if access_token.nil? || access_token_secret.nil?

            Twitter.configure do |config|
                config.consumer_key = ENV['TWITTER_CONSUMER_KEY']
                config.consumer_secret = ENV['TWITTER_CONSUMER_SECRET']
                config.oauth_token = access_token
                config.oauth_token_secret = access_token_secret
            end

            return Twitter.user
        rescue => exception
            Raven.capture_exception( exception )
            return nil
        end
    end
end

Because if someone hit the API manually and sent up someone's facebook_id (which is public data) they could sign in without actually having facebook access.