Arvados

If you add the same person to the sharing dialog a bunch of times, you can end up with duplicated permission links, even though the API server de-duplicates permission links.

At first I was afraid that de-duplication wasn't working at all. On further examination, I am pretty sure what's happening is that workbench2 makes all the requests at once, and there's a race:

So the de-duplication doesn't work if the permission create requests are in separate transactions that don't see the duplicate permission links being created.

So I'm satisfied that as far as the API server is concerned this is a wacky edge case. However, it would probably be a good idea to de-duplicate on the Workbench 2 side before sending out the requests.