cloudflare / cloudflare/cloudflare-prometheus-exporter

Network Analytics: one denied dataset null-bubbles and drops all NAv2 metrics for the account

Open
#44 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
181
Forks
39
Avg merge
11h 28m
Merged PRs (30d)
3

Description

### Summary
For accounts entitled to *some but not all* Network Analytics (NAv2) datasets, the exporter returns **zero** NAv2 metrics — even for datasets the account is fully entitled to.

### Root cause
`getAccountMetrics("network-analytics")` issues a single combined GraphQL query that selects six NAv2 datasets in one `viewer { accounts { … } }` document (magicTransit, magicFirewall, dosd/L3 DoS, advanced TCP protection, advanced DNS protection, IDPS). If the account lacks entitlement to **any one** of them, the GraphQL API returns an authorization error for that field; because the fields are non-nullable, the error **null-bubbles** up to `data.viewer` and nulls the entire response — so entitled datasets (e.g. Magic Transit) come back empty too.

Since #42, `getAccountMetrics` throws on that access-denied response rather than silently reporting an empty refresh, but the practical outcome for a partially entitled account is still 0 NAv2 metrics per refresh.

### Impact
Common on Enterprise accounts that have, e.g., Magic Transit + Magic Firewall but not Advanced TCP/DNS Protection. They get no Network Analytics metrics at all.

### Proposed fix
Split the combined query into one query per NAv2 dataset and collect them independently, so a denial on one dataset can't null-bubble the others. Denied datasets are skipped (and can reuse the hourly denied-product retry window from #42); entitled datasets still return.

I have this implemented and tested against a partially-entitled account and am happy to open a PR if you're open to the approach.

Contributor guide

Open the contributing guide

Research direction

Start at getAccountMetrics("network-analytics") and trace the combined GraphQL query for the six NAv2 datasets, including the denied-product retry behavior from #42. Verify the datasets are collected independently: an authorization denial skips only that dataset, while entitled datasets still produce NAv2 metrics for a partially entitled account.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql, prometheus, typescript
Domain
api, backend-api-design, observability-sre
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
65/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.