# Local Login Flow

This skill is designed for the Local Clinic workflow where there is no separate API-key auth setup.
Authentication must come from a real browser login session.

Host default:
- if the target is `clinic.pingcap.com/portal`, first run the `clinic-api`
  metadata preflight
- if that preflight says `clusterType=cloud`, hand off to the TiDB Cloud
  Clinic analysis flow outside this skill
- if that preflight is not `clusterType=cloud`, continue with the
  local Google Chrome Clinic login session plus the matching Chrome profile
- if the target is `clinic.pingcap.com.cn/portal`, use the local Google Chrome
  Clinic login session plus the matching Chrome profile directly

## Required User Action

Before any analysis step:

1. Open the Local Clinic URL in Google Chrome
2. Log in once with the target user account
3. Keep using the same macOS account and Chrome profile that performed the login

After that, the skill can reuse the browser cookie `clinic.session_id`.

## Preflight

Run:

```bash
python3 scripts/check_login.py --base-url "https://clinic.pingcap.com.cn"
```

If the user logged in with a non-default Chrome profile:

```bash
python3 scripts/check_login.py --base-url "https://clinic.pingcap.com.cn" --profile "Profile 3"
```

For `clinic.pingcap.com/portal`, the Chrome-profile reuse path starts only
after the `clinic-api` metadata preflight keeps the case inside this skill.

For `clinic.pingcap.com.cn/portal`, this Chrome-profile reuse flow is the
default preflight path.

## What The Preflight Confirms

- a usable Chrome profile exists
- the cookie DB can be read from the current machine account
- `clinic.session_id` exists
- the cookie payload still contains a usable CSRF token
- the browser session is not already expired
- the script can confirm readiness without printing the raw cookie, CSRF token, account email, or local cookie DB path

## Common Failure Modes

| Symptom | Likely Cause | What To Do |
|---------|--------------|------------|
| `clinic.session_id was not found` | User has not logged in yet, or used the wrong Chrome profile | Ask the user to log in once, then rerun with `--profile` if needed |
| `No Chrome profiles were found` | Running on a machine without Chrome profile data | Log in through Google Chrome on the same machine |
| `csrf token not found` | Cookie is stale or malformed | Log out and log back in to Local Clinic |
| HTTP `401` or `403` from dashboard or metrics fetch | Session expired after preflight | Ask the user to refresh the browser login and rerun |

## Recommended Script Order

1. `scripts/check_login.py`
2. `scripts/dispatch_access.py`
3. `scripts/analyze_cluster.py` only when you need the Clinic-only access layer directly
4. `scripts/download_bundle.py` only when you need the bundle-only extraction path directly; it now auto-discovers the bundle item from Clinic `data_status`
5. `scripts/analyze_online_grafana.py` only when you need the Grafana-only access path directly
6. `scripts/metrics_only_perf_diagnosis.py` or `scripts/deep_tikv_write_path_rca.py` only after access evidence is ready and a caller explicitly wants downstream diagnosis

## Scope Note

This file covers the Local Clinic browser-login requirement for access and bundle routes. `scripts/analyze_cluster.py` is now access-only; deeper diagnosis is a separate follow-up layer.