Problem Description

In XPageContainerComponentResource changes are made directly to the internal workflowSession as we need to write directly to the unpublished version (which is only allowed by the workflow session)

When something fails halfway, for example the Jackrabbit version checkout, the finally in PageComposerSecurityValve containing

if (jcrSession.hasPendingChanges()) {
       log.warn("JcrSession '{}' had pending changes at the end of the page composer request. This should never be the case. Removing the changes now because the session will be reused.", jcrSession.getUserID());
        jcrSession.refresh(false);
}

will be triggered. However, the changes on the internal workflow session won't be refreshed. This is problematic, as all consecutive attempted saves for the user related to workflow operations using the same internal workflow session will fail

Solution

In the PageComposerSecurityValve finally, we also have to refresh the internal workflow session if it contains any pending changes