Arvados

• user A creates a collection and shares (read+write) with the "all users" role group
• user B gets the collection
• user B's uuid is missing from writable_by

This is correct because the collection is not, in fact, writable by user B. The "all users" role membership (added by user setup) is read-only.

Since this seems to be the only known case, it seems the real bug is that "share R+W with All Users" just doesn't do what it sounds like, because the "All Users" role is a special role that intentionally behaves differently from other roles (multi-tenant means users can't necessarily see one another merely because they have been setup).

The solution may be to prevent Workbench from offering to share with the special All Users role beyond read-only.