docs: public PortletDefinitionForm createPortletDefinitionForm(IPerson person, String portletId) {
  
          IPortletDefinition def = portletDefinitionRegistry.getPortletDefinition(portletId);
  
          // create the new form
          final PortletDefinitionForm form;
          if (def != null) {
              // if this is a pre-existing portlet, set the category and permissions
              form = new PortletDefinitionForm(def);
              form.setId(def.getPortletDefinitionId().getStringId());
  
              // create a JsonEntityBean for each current category and add it
              // to our form bean's category list
              Set<PortletCategory> categories = portletCategoryRegistry.getParentCategories(def);
              for (PortletCategory cat : categories) {
                  form.addCategory(new JsonEntityBean(cat));
              }
  
              addPrincipalPermissionsToForm(def, form);
          } else {
              form = createNewPortletDefinitionForm();
          }
  
          /* TODO:  Service-Layer Security Reboot (great need of refactoring with a community-approved plan in place) */
          // User must have SOME FORM of lifecycle permission over AT LEAST ONE
          // category in which this portlet resides;  lifecycle permissions are
          // hierarchical, so we'll test with the weakest.
          if (!hasLifecyclePermission(person, PortletLifecycleState.CREATED, form.getCategories())) {
              logger.warn(
                      "User '"
                              + person.getUserName()
                              + "' attempted to edit the following portlet without MANAGE permission:  "
                              + def);
              throw new SecurityException("Not Authorized");
          }
  
          return form;
      }