Ref: App Ideas Permissions and #2007

We want applications to be able to define the permissions they require to work. These permissions cover api / acl style CRUD permissions on models, like add post, edit user, and also potentially more general permissions on non-objects like 'add route'.

These permissions are used in two ways:

1. for implementing access control throughout Ghost see ACL for Apps #2059
2. to present to the user when installing a theme, to give the user visibility on what an app might be doing.

We need a way for apps to define what permissions it needs. This needs to be accessible throughout the application so that the ACL tools can read & check against them.

User ACL exists in the form of roles, permissions, user_roles, user_permissions, and role_permissions tables in the database.

The first problem that we need to solve is how should apps define their permissions? Is having their own config.js as suggested by App Ideas Permissions the best solution? Or could this be done in package.json?
The main difference being that a .js file can contain JavaScript, and that a package.json has a specified format and is used by other things, so might end up with its own permissions option which would clash.

The second problem is how to make these permissions available to the application. Is loading the permissions object / array into memory enough or should we load these into the database?

As a result of this issue, I'd like to see a defined spec for a basic set of app permissions and how to define them on the wiki, as well as implementing the loading of these permissions in the app loader.