diff --git a/lib/extensions/index.js b/lib/extensions/index.js
index 2a57926..86ac086 100644
--- a/lib/extensions/index.js
+++ b/lib/extensions/index.js
@@ -36,46 +36,64 @@ DB._load = function () {
   DB._byPpid = {};
   DB._byId = {};
   DB._grants = {};
+  DB._grantsMap = {};
   DB._perms.forEach(function (acc) {
     if (acc.id) {
+      // if account has an id
       DB._byId[acc.id] = acc;
       if (!DB._grants[acc.id]) {
+        DB._grantsMap[acc.id] = {};
         DB._grants[acc.id] = [];
       }
       acc.domains.forEach(function (d) {
         DB._grants[d.name + '|id|' + acc.id] = true
-        DB._grants[acc.id].push(d);
+        if (!DB._grantsMap[acc.id][d.name]) {
+          DB._grantsMap[acc.id][d.name] = d;
+          DB._grants[acc.id].push(d);
+        }
       });
       acc.ports.forEach(function (p) {
         DB._grants[p.number + '|id|' + acc.id] = true
-        DB._grants[acc.id].push(p);
+        if (!DB._grantsMap[acc.id][p.number]) {
+          DB._grantsMap[acc.id][p.number] = p;
+          DB._grants[acc.id].push(p);
+        }
       });
+    } else if (acc.nodes[0] && 'email' === acc.nodes[0].type) {
+      // if primary (first) node is email
+      //console.log("XXXX email", acc.nodes[0].name);
+      if (!DB._byEmail[acc.nodes[0].name]) {
+        DB._byEmail[acc.nodes[0].name] = {
+          account: acc
+        , node: acc.nodes[0]
+        };
+      }
     }
+    // map domains to all nodes that have permission
+    // (which permission could be granted by more than one account)
     acc.nodes.forEach(function (node) {
       if ('mailto' === node.scheme || 'email' === node.type) {
-        if (!DB._grants[node.email]) {
-          DB._grants[node.email] = [];
+        if (!DB._grants[node.name]) {
+          DB._grantsMap[node.name] = {};
+          DB._grants[node.name] = [];
         }
         acc.domains.forEach(function (d) {
           DB._grants[d.name + '|' + (node.scheme||node.type) + '|' + node.name] = true
-          DB._grants[node.email].push(d);
+          if (!DB._grantsMap[node.name][d.name]) {
+            DB._grantsMap[node.name][d.name] = d;
+            DB._grants[node.name].push(d);
+          }
         });
-        acc.ports.forEach(function (d) {
-          DB._grants[d.name + '|' + (node.scheme||node.type) + '|' + node.name] = true
-          DB._grants[node.email].push(p);
+        acc.ports.forEach(function (p) {
+          DB._grants[p.number + '|' + (node.scheme||node.type) + '|' + node.name] = true
+          if (!DB._grantsMap[node.name][p.number]) {
+            DB._grantsMap[node.name][p.number] = p;
+            DB._grants[node.name].push(p);
+          }
         });
-        DB._byEmail[node.name] = {
-          account: acc
-        , node: node
-        }
-      }
-    });
-    acc.ppids.forEach(function (node) {
-      DB._byPpid[node.name] = {
-        account: acc
-      , node: node
       }
     });
+    // TODO this also should be maps/arrays (... or just normal database)
     acc.domains.forEach(function (domain) {
       if (DB._byDomain[domain.name]) {
         console.warn("duplicate domain '" + domain.name + "'");
@@ -93,7 +111,7 @@ DB._load = function () {
         console.warn("::existing account '" + acc.nodes.map(function (node) { return node.name; }) + "'");
         console.warn("::new account '" + DB._byPort[port.number].account.nodes.map(function (node) { return node.name; }) + "'");
       }
-      DB._byPort[domain.name] = {
+      DB._byPort[port.number] = {
         account: acc
       , port: port
       };
@@ -104,7 +122,8 @@ DB._load();
 DB.accounts = {};
 DB.accounts.get = function (obj) {
   return PromiseA.resolve().then(function () {
-    return DB._byId[obj.name] || (DB._byEmail[obj.name] || {}).acc || null;
+    //console.log('XXXX obj.name', DB._byEmail[obj.name]);
+    return DB._byId[obj.name] || (DB._byEmail[obj.name] || {}).account || null;
   });
 };
 DB.accounts.add = function (obj) {
@@ -348,7 +367,7 @@ Accounts.getOrCreate = function (req) {
   var idNode = { type: 'ppid', name: id };
 
   return DB.accounts.get(idNode).then(function (acc) {
-    if (acc) { return _acc; }
+    if (acc) { return acc; }
     acc = { id: id, sub: req.auth.sub, iss: req.auth.iss, domains: [], ports: [], nodes: [ idNode ] };
     return DB.accounts.add(acc).then(function () {
       // intentionally not returned to the promise chain
@@ -946,8 +965,11 @@ app.get('/api/telebit.cloud/account', function (req, res) {
     });
     function getAllGrants() {
       return PromiseA.all(acc.nodes.map(function (node) {
+        //console.log('XXXX node', node);
         return DB.accounts.get(node);
       })).then(function (grants) {
+        //console.log('XXXX grants');
+        //console.log(grants);
         var domainsMap = {};
         var portsMap = {};
         var result = JSON.parse(JSON.stringify(acc));