How about a public `PermissionHelper`?  30b42788de16b1961298600aabcbc52683935216 , refactoring the various places that compute those portlet target ID Strings to use it.