# clinic-grafana

Obtain Clinic/Grafana API credentials in one pass using a browser DevTools
console snippet — no Playwright or headless browser needed.

Produces two files:
- **`clinic_credentials.json`** — `CLINIC_COOKIE` + `CLINIC_CSRF_TOKEN` for Clinic HTTP access
- **`grafana_storage_state.json`** — Playwright-compatible storage state for Grafana browser access

## Workflow

```bash
cd tools/connection-api-key/clinic-grafana

# Print step-by-step instructions
make credentials
```

### Step-by-step

1. Open <https://clinic.pingcap.com/portal/> in your browser and log in.
2. **Wait until the Clusters page is fully loaded** (Grafana must be ready so that localStorage is populated).
3. Open DevTools (`F12`) → **Console** tab.
4. Paste the contents of `get_credentials.js` and press **Enter**.
5. Two files download automatically — done.

### Place the downloaded files

| Downloaded file | Copy to |
|-----------------|---------|
| `clinic_credentials.json` | `platform/investibook/backend/data/config/clinic_credentials.json` |
| `grafana_storage_state.json` | `aiops/service/diagnostic/config/grafana_storage_state.json` |

The paths above are relative to the **monorepo root** (`../../..` from `platform/investibook/`).

### Verify

```bash
make verify
```

This validates both files and makes a live HTTP call to the Clinic API to confirm the
credentials actually work. Exit code 0 = all good; non-zero = see the printed errors.

## Targets

| Command | Description |
|---------|-------------|
| `make credentials` | Print step-by-step instructions |
| `make verify` | Validate files and test Clinic API authentication |
| `make clean` | Delete generated files |

## Output

`clinic_credentials.json`:
```json
{
  "clinic": {
    "CLINIC_COOKIE": "clinic.session_id=<jwt>",
    "CLINIC_CSRF_TOKEN": "<csrf_token>"
  }
}
```

`grafana_storage_state.json`:
```json
{
  "cookies": [{ "name": "clinic.session_id", "value": "...", "domain": "clinic.pingcap.com", ... }],
  "origins": [{ "origin": "https://clinic.pingcap.com", "localStorage": [...] }]
}
```

> **Note:** JavaScript cannot read `HttpOnly` cookies. If Grafana browser auth fails to
> authenticate, it may need an HttpOnly cookie that is absent here. In that case, use
> the Playwright-based `generate_grafana_storage_state.py` script in the diagnostic service.

## Next step

After saving, sync both files to the K8s Pod:

```bash
sh ../../scripts/sync-pod-credentials.sh
```