Activate Gitea OAuth for CMS pilot

docs/decap-cms-gitea-setup.md

@@ -1,8 +1,8 @@
-# Decap CMS pilot: unapplied Gitea settings
+# Decap CMS pilot: Gitea settings
 
-Status: repository-side review specification only. Nothing in this document
-authorizes a Gitea restart, OAuth application creation, branch-protection
-change, branch push, preview deployment, or merge.
+Status: applied to the preview-only pilot on 2026-09-04. The stable preview,
+narrow CORS policy, public PKCE OAuth application, and both branch-protection
+rules are active. Nothing has been merged to `main`.
 
 The repository implementation targets these fixed public values:
 
@@ -16,18 +16,17 @@ The repository implementation targets these fixed public values:
 | Exact OAuth redirect URI | `https://cms-pilot-3031023-xyz-www.ksloan90.workers.dev/admin/` |
 | Required status context | `CMS content validation / cms-content-validation (pull_request)` |
 
-The predicted Workers alias must be confirmed after the first explicitly
-approved preview deployment. If Cloudflare assigns a different stable origin,
+The Workers alias was confirmed after the first approved preview deployment.
+If Cloudflare later assigns a different stable origin,
 update the repository configuration, CORS origin, and OAuth redirect URI
 together through review before enabling login.
 
-## Unapplied CORS change
+## Applied CORS policy
 
 The tracked Gitea service in
-`/home/sloan/gitRepos/SloanOps/infrastructure/docker-compose.yml` currently has
-no `[cors]` environment overrides. After separate approval, add these entries
-to the existing `gitea.environment` list and redeploy only through the normal
-infrastructure change process:
+`/home/sloan/gitRepos/SloanOps/infrastructure/docker-compose.yml` contains
+these entries in the existing `gitea.environment` list and was deployed
+through the normal infrastructure change process:
 
 ```yaml
 - GITEA__cors__ENABLED=true
@@ -59,10 +58,10 @@ headers. Repeat with an unrelated origin and confirm that Gitea does not grant
 it cross-origin access. Also verify normal Git, web UI, API, and Actions
 behavior before continuing.
 
-## OAuth application to create later
+## OAuth application
 
-Create one Gitea OAuth2 application only after the stable preview origin and
-CORS response have been reviewed:
+The Gitea OAuth2 application was created after the stable preview origin and
+CORS response were verified:
 
 - Application name: `3031023.xyz Decap CMS pilot`.
 - Confidential client: **unchecked**. The browser client must use PKCE.
@@ -80,7 +79,7 @@ The CMS account still needs repository write access; the branch rules below
 are the security boundary that reduces that write access to pilot content and
 media paths.
 
-## Branch protection rules to apply together
+## Applied branch protection rules
 
 Create both rules before granting a CMS/client account write access or testing
 login. Gitea uses only the first matching rule, so the order is material.

docs/decap-cms-pilot.md

@@ -1,8 +1,9 @@
 # Decap CMS Gitea pilot
 
-Status: repository implementation prepared for review; no OAuth application,
-Gitea CORS change, branch protection, branch push, preview deployment, or
-production merge has been performed.
+Status: preview-only pilot infrastructure is active on `cms/pilot`: the stable
+preview, narrow Gitea CORS policy, public PKCE OAuth application, and two
+repository protection rules are configured. Nothing has been merged to
+`main`, and production remains unchanged.
 
 Updated: 2026-09-04
 
@@ -32,9 +33,8 @@ activation, repository invitation, or removal of a rollback resource.
   Astro/Zod validation and are suitable for a bounded Decap pilot.
 - The live Gitea instance reported version `1.27.3` during the Phase 9 review.
   Decap's Gitea backend requires Gitea 1.20 or newer.
-- A preflight request from the proposed CMS origin currently returns `405`
-  without an access-control origin header. Gitea CORS must be configured before
-  browser-based Decap authentication or repository access will work.
+- Credential-free preflight verification grants the exact stable CMS origin
+  and does not grant an unrelated origin.
 - Decap authenticates to Gitea with a non-confidential PKCE OAuth application.
   Its Gitea backend currently has no editorial pull-request workflow, so it
   writes directly to the configured branch.
@@ -50,10 +50,10 @@ References:
 - <https://docs.gitea.com/usage/access-control/protected-branches/>
 - <https://github.com/decaporg/decap-cms/issues/7115>
 
-The exact, unapplied Gitea CORS, OAuth, and two-rule branch-protection settings
-are recorded in [Decap CMS pilot: unapplied Gitea settings](decap-cms-gitea-setup.md).
+The exact Gitea CORS, OAuth, and two-rule branch-protection settings are
+recorded in [Decap CMS pilot: Gitea settings](decap-cms-gitea-setup.md).
 
-## Repository implementation under review
+## Repository implementation
 
 The `review/decap-cms-pilot` branch now contains the repository-side portion of
 the pilot:
@@ -62,9 +62,8 @@ the pilot:
   configuration for both site builds.
 - The shell pins Decap CMS `3.15.1` by exact URL and verified SHA-384 integrity
   value rather than a floating release range.
-- The backend is fixed to `SloanOps/3031023-xyz` and `cms/pilot`. Its public
-  OAuth client ID remains an explicit placeholder until the separately
-  approved non-confidential Gitea application exists.
+- The backend is fixed to `SloanOps/3031023-xyz` and `cms/pilot` and contains
+  only the public client ID for the non-confidential Gitea PKCE application.
 - All four Markdown collections and every persisted frontmatter field are
   modeled with the current Astro/Zod bounds. Markdown controls are text-first;
   image embedding and general file widgets are absent.

public/admin/config.yml

@@ -2,7 +2,7 @@ backend:
   name: gitea
   repo: SloanOps/3031023-xyz
   branch: cms/pilot
-  app_id: REPLACE_WITH_GITEA_OAUTH_CLIENT_ID
+  app_id: c07dba05-eb09-48f0-8da4-6df775a13995
   api_root: https://git.sloanops.com/api/v1
   base_url: https://git.sloanops.com
   auth_endpoint: https://git.sloanops.com/login/oauth/authorize