the API v0.1 should stop you POSTing a membership with objects in an ID field

[mhl]

This is possible to do quite easily if you've got your memberships through a query that uses the embed parameter. If you do then POST a membership with a person_id (say) that's an object instead of a string, like:

{
    "foo": "bar",
    "person_id": {
        "id": "123",
        "name": "Fozzie Bear"
    },
    "post_id": {
         "id": "456",
         "name": "Member of Parliament for Manhattan"
    },
    "organization_id": {
        "id": "789",
        "name": "The Muppet Show"
    }
}

... then the POST will appear to succeed, but you'll subsequently get 5xx errors from PopIt for many operations - the error will often look like:

/home/mark/popit/popit/node_modules/popit-api/src/transform.js:60
  var images = doc.get('images');
                   ^
TypeError: Object #<Object> has no method 'get'
    at setImage (/home/mark/popit/popit/node_modules/popit-api/src/transform.js:60:20)
    at transform (/home/mark/popit/popit/node_modules/popit-api/src/transform.js:137:9)
    at /home/mark/popit/popit/node_modules/popit-api/src/mongoose/embed.js:60:14
    at Array.map (native)
    at Promise.<anonymous> (/home/mark/popit/popit/node_modules/popit-api/src/mongoose/embed.js:59:43)
    at Promise.<anonymous> (/home/mark/popit/popit/node_modules/popit-api/node_modules/mongoose/node_modules/mpromise/lib/promise.js:177:8)
    at Promise.EventEmitter.emit (events.js:95:17)
    at Promise.emit (/home/mark/popit/popit/node_modules/popit-api/node_modules/mongoose/node_modules/mpromise/lib/promise.js:84:38)
    at Promise.fulfill (/home/mark/popit/popit/node_modules/popit-api/node_modules/mongoose/node_modules/mpromise/lib/promise.js:97:20)
    at Promise.resolve (/home/mark/popit/popit/node_modules/popit-api/node_modules/mongoose/lib/promise.js:114:23)

... because the pseudo-embedded objects that you'll then get back when populating embedded attributions aren't Mongoose models (?) I think.

PopIt should stop you from doing this in v0.1 - it may be different in the next version where PUT / POST of embeddeded objects is allowed, if I understand correctly.