# TiCDC Upstream Debug Logging

## Background

The TiCDC metadata handler currently logs authorization and aggregate request
outcomes, but does not identify which Dataflow/Dataflow-NG gRPC call failed or
what safe request/response summary was observed. This makes upstream timeout
and authentication diagnosis difficult.

## Goal

Add structured, request-scoped logs for each TiCDC business and internal gRPC
call, including the architecture, RPC operation, cluster/request identifiers,
pagination parameters, duration, gRPC status code, and bounded response counts.
Log the Dataflow authentication mechanism and metadata shape at injection
time so authentication failures can be diagnosed without exposing secrets.

## Scope and compatibility

- Apply to existing internal and public TiCDC List/Detail routes through the
  shared `pkg/ticdc` service.
- Preserve API responses, timeout behavior, upstream selection, and error
  mapping.
- Log only safe metadata: authentication mechanism, metadata key, tenant and
  project IDs, impersonation flag, RPC names, bounded counts, and status.
- Never log API keys, Authorization headers, encoded Dataflow user metadata,
  passwords, tokens, or complete protobuf requests/responses.

## Implementation

1. Add an authentication-metadata log when Clinic replaces the outgoing
   Dataflow user context.
2. Add start/completion/failure logs around Dedicated and Dataflow-NG business
   and internal List/Detail calls.
3. Include elapsed duration, gRPC status code, error class, request cluster or
   changefeed IDs, pagination values, and response counts where available.
4. Add focused tests for authentication logging safety and the existing RPC
   behavior; run the package tests and formatting checks.

## Deployment impact

The change belongs to the `clinic_data_service` Go module, entrypoint
`cmd/api/main.go`, and image `clinic/data-service`. It requires deployment of
Clinic CD component `clinic-data-service`, app-delivery application
`clinic-data-service`, and Kubernetes workload `Deployment/clinic-data-service`
in the target environment. No root Clinic, Gateway, or other workload changes
are required.

## Non-goals

- Do not change upstream authentication, routing, timeout values, or API
  contracts.
- Do not enable verbose wire/protobuf dumps or credential logging.
- Do not add new metrics or modify Gateway configuration.