Automate page locking in AEM Sites Cloud with a custom Universal Editor extension

Build a custom Universal Editor extension.

• Use the Universal Editor’s extensibility points to listen for the first intentional or persisted content change event. Do not trigger locking on page open or selection.
• Example (pseudo-code):

editor.on('contentChanged', (event) => {
    if (!pageLocked) {
        lockPage(event.pagePath);
        pageLocked = true;
    }
});

Implement a customer-owned AEM service.

• Create a server-side OSGi service or Sling servlet in AEM that exposes endpoints for:
• Checking current lock status
• Acquiring a page lock
• Releasing a page lock
• Use the AEM WCM PageManager API for lock and unlock operations. Example (Java):

PageManager pageManager = resourceResolver.adaptTo(PageManager.class);
Page page = pageManager.getPage(pagePath);

if (page != null && !page.isLocked()) {
    page.lock();
}

Authenticate requests with the editor’s identity.

• The Universal Editor extension should forward the current editor’s IMS bearer token to the AEM endpoint as an Authorization header.
• Ensure AEM’s Granite Bearer Authentication Handler is enabled and configured to accept the OAuth client ID present in the token.
• The AEM service must use the request’s ResourceResolver (for example, request.getResourceResolver()) to ensure the lock is attributed to the editor, not a service user.

Handle lock conflicts and permissions.

• Validate the page path and resolve the page.
• Check if the page is already locked and by whom.
• Return a clear response if the lock cannot be acquired (for example, already locked by another author).
• Enforce AEM permissions and CSRF protections.

Update the editor state.

• After a successful lock operation, update the Universal Editor UI to reflect the new lock state.
• Display a clear message if the page is already locked by another author.

Unlock the page before publishing.

• Authors should manually unlock the page before publishing to allow workflow processes to proceed.