cloudflare / cloudflare/cloudflare-prometheus-exporter
Network Analytics: one denied dataset null-bubbles and drops all NAv2 metrics for the account
- Dominant language
- TypeScript
- Stars
- 181
- Forks
- 39
- Avg merge
- 11h 28m
- Merged PRs (30d)
- 3
Description
### Summary
For accounts entitled to *some but not all* Network Analytics (NAv2) datasets, the exporter returns **zero** NAv2 metrics — even for datasets the account is fully entitled to.
### Root cause
`getAccountMetrics("network-analytics")` issues a single combined GraphQL query that selects six NAv2 datasets in one `viewer { accounts { … } }` document (magicTransit, magicFirewall, dosd/L3 DoS, advanced TCP protection, advanced DNS protection, IDPS). If the account lacks entitlement to **any one** of them, the GraphQL API returns an authorization error for that field; because the fields are non-nullable, the error **null-bubbles** up to `data.viewer` and nulls the entire response — so entitled datasets (e.g. Magic Transit) come back empty too.
Since #42, `getAccountMetrics` throws on that access-denied response rather than silently reporting an empty refresh, but the practical outcome for a partially entitled account is still 0 NAv2 metrics per refresh.
### Impact
Common on Enterprise accounts that have, e.g., Magic Transit + Magic Firewall but not Advanced TCP/DNS Protection. They get no Network Analytics metrics at all.
### Proposed fix
Split the combined query into one query per NAv2 dataset and collect them independently, so a denial on one dataset can't null-bubble the others. Denied datasets are skipped (and can reuse the hourly denied-product retry window from #42); entitled datasets still return.
I have this implemented and tested against a partially-entitled account and am happy to open a PR if you're open to the approach.
Contributor guide
Research direction
Start at getAccountMetrics("network-analytics") and trace the combined GraphQL query for the six NAv2 datasets, including the denied-product retry behavior from #42. Verify the datasets are collected independently: an authorization denial skips only that dataset, while entitled datasets still produce NAv2 metrics for a partially entitled account.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql, prometheus, typescript
- Domain
- api, backend-api-design, observability-sre
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 65/100