Issue Summary

Two calls at the same time to PUT /wiki/rest/api/content/

/restriction/byOperation/update/byGroupId/{groupId} both return 200, but only one group is kept (lost update)

Steps to Reproduce

1. Create a page.
2. Set the edit restriction to the calling user: PUT /content/{id}/restriction.
3. At the same time, send PUT …/byOperation/update/byGroupId/{G1} and PUT …/byOperation/update/byGroupId/{G2}

4. Read the edit restriction: GET /content/{id}/restriction/byOperation/update?expand=restrictions.group.

Expected Results

both G1 and G2 are on the edit restriction, because the endpoint is documented as adding a group.

Actual Results

in about 30% of runs (3/10), one group is missing even though both calls returned 200. The same calls sent one after another worked 10/10 times.

Workaround

Currently there is no known workaround for this behavior. A workaround will be added here when available