Quoted message:

The API will need a few endpoints for user/perm stuff, but I have no clue how to design them at all. Here's what I have in mind so far:

User management

GET /api/users - Returns a list of user objects in this shape, one for every user:

{
id: number,
username: string,
permissions: {
permission_tag: Pretty Permission Label,
other_permission: Other Label
}
}

GET /api/users/me - Returns a user object but for the currently logged in user
PUT /api/users/permissions/[UID] - Replace a user's permissions with an array of permission tags:
```
// The permissions to replace the user's permissions with
[permission_tag]
```
DELETE /api/users/[UID] - Deletes the specified user

Group management

GET /api/groups - List of group objects in the below shape:

{
id: number
name: string
permissions: {
permission_tag: Pretty Permission Label
}
members: [LIST OF USER OBJECTS]
}

POST /api/groups - Create a new group, accepts the following object, returns the newly created group
PUT /api/[GID]/permissions - Replace the group's list of permissions with the provided list of permission tags
DELETE /api/groups/[GID] - Delete a group