@rebasepro/admin 0.13.0 → 0.13.1-canary.g1822133

package/src/data_export/export/export.ts

@@ -154,6 +154,24 @@ function getHeaders(property: Property, propertyKey: string, prefix = ""): Heade
     }
 }
 
+/**
+ * Read whatever a `date` column actually arrived as into a `Date`.
+ *
+ * The driver/WebSocket path revives `{ __type: "date" }` into a `Date`; the REST
+ * path — which is the one the admin is on — leaves an ISO string, and an epoch
+ * number is what a re-imported export carries. Returns `undefined` for anything
+ * that is not a date, so the caller can pass the raw value through.
+ */
+function toExportableDate(inputValue: unknown): Date | undefined {
+    if (inputValue instanceof Date) return Number.isNaN(inputValue.getTime()) ? undefined : inputValue;
+    if (typeof inputValue === "number" && Number.isFinite(inputValue)) return new Date(inputValue);
+    if (typeof inputValue === "string" && inputValue.trim() !== "") {
+        const parsed = new Date(inputValue);
+        return Number.isNaN(parsed.getTime()) ? undefined : parsed;
+    }
+    return undefined;
+}
+
 function processValueForExport(inputValue: unknown,
     property: Property,
     exportType: "csv" | "json",
@@ -181,8 +199,17 @@ function processValueForExport(inputValue: unknown,
     } else if (property.type === "reference" && inputValue && typeof inputValue === "object" && "isEntityReference" in inputValue && typeof (inputValue as EntityReference).isEntityReference === "function" && (inputValue as EntityReference).isEntityReference()) {
         const ref = inputValue ? inputValue as EntityReference : undefined;
         value = ref ? ref.fullPath : null;
-    } else if (property.type === "date" && inputValue instanceof Date) {
-        value = inputValue ? (dateExportType === "timestamp" ? inputValue.getTime() : inputValue.toISOString()) : null;
+    } else if (property.type === "date") {
+        // Not `instanceof Date`: the admin reads over REST, and the REST row
+        // pipeline hands dates back as the database wrote them — a string. That
+        // made this branch dead on every live export, so both radio options
+        // produced identical files. Normalise here, where the declared type says
+        // the column is a date, and leave anything unparseable untouched rather
+        // than exporting an invalid date as `null`.
+        const date = toExportableDate(inputValue);
+        value = date
+            ? (dateExportType === "timestamp" ? date.getTime() : date.toISOString())
+            : inputValue;
     } else {
         value = inputValue;
     }
@@ -209,15 +236,40 @@ function processValuesForExport<M extends Record<string, unknown>>
 ...updatedValues };
 }
 
-function entryToCSVRow(entry: unknown[]) {
+/**
+ * Characters that make a spreadsheet read a cell as a formula rather than text.
+ *
+ * Quoting is CSV *escaping* and is not enough: Excel, LibreOffice Calc and
+ * Sheets strip the CSV quoting at parse time and then evaluate a cell whose
+ * first character is one of these — `=HYPERLINK(…)` exfiltrates neighbouring
+ * cells on click, `=cmd|'…'!A0` is worse.
+ */
+const FORMULA_TRIGGERS = ["=", "+", "-", "@", "\t", "\r"];
+
+/**
+ * Neutralise a cell that a spreadsheet would otherwise evaluate, by prefixing a
+ * single quote — the standard OWASP mitigation. The apostrophe is consumed by
+ * the spreadsheet as "treat the rest as text", so the value reads back intact.
+ */
+export function escapeCsvFormula(value: string): string {
+    const first = value.charAt(0);
+    if (!FORMULA_TRIGGERS.includes(first)) return value;
+    // A signed number is not a formula, and prefixing it would turn every
+    // negative amount in the file into text. `-1+1` is still neutralised,
+    // because it is not a number.
+    if ((first === "-" || first === "+") && value.trim() !== "" && Number.isFinite(Number(value))) return value;
+    return "'" + value;
+}
+
+function toCSVCell(v: unknown): string {
+    if (v === null || v === undefined) return "";
+    const s = Array.isArray(v) ? JSON.stringify(v) : String(v);
+    return "\"" + escapeCsvFormula(s).replaceAll("\"", "\"\"") + "\"";
+}
+
+export function entryToCSVRow(entry: unknown[]) {
     return entry
-        .map((v: unknown) => {
-            if (v === null || v === undefined) return "";
-            if (Array.isArray(v))
-                return "\"" + JSON.stringify(v).replaceAll("\"", "\"\"") + "\"";
-            const s = String(v);
-            return "\"" + s.replaceAll("\"", "\"\"") + "\"";
-        })
+        .map(toCSVCell)
         .join(",") + "\r\n";
 }
 
@@ -236,12 +288,7 @@ export function downloadDataAsCsv(data: object[], name: string) {
     const headers = Object.keys(data[0]);
     const csvContent = [
         headers.join(","),
-        ...data.map(row => headers.map(header => {
-            const value = (row as Record<string, unknown>)[header];
-            if (value === null || value === undefined) return "";
-            if (Array.isArray(value)) return `"${JSON.stringify(value).replace(/"/g, '""')}"`;
-            return `"${String(value).replace(/"/g, '""')}"`;
-        }).join(","))
+        ...data.map(row => headers.map(header => toCSVCell((row as Record<string, unknown>)[header])).join(","))
     ].join("\r\n");
 
     downloadBlob([csvContent], `${name}.csv`, "text/csv");

package/src/data_export/export/fetch_export_data.ts

@@ -0,0 +1,90 @@
+import { Entity, FindParams, FindResponse } from "@rebasepro/types";
+
+/**
+ * Rows asked for per request.
+ *
+ * Kept at or below the server's `MAX_LIST_LIMIT`, which is now the largest page
+ * a read will serve *and refuses* anything larger — it used to clamp silently,
+ * and asking for 100 000 while receiving 1 000 looked exactly like a collection
+ * with 1 000 rows in it. The walk still never trusts the page size it asked for:
+ * it advances by the rows it was actually handed.
+ */
+export const EXPORT_PAGE_SIZE = 500;
+
+/**
+ * Most rows one browser-side export will materialise.
+ *
+ * Everything here is built in memory and handed to a Blob, so there is a
+ * ceiling whether or not it is named. Naming it means going over it **throws**
+ * instead of writing a short file that reads like the whole collection.
+ */
+export const MAX_EXPORT_ROWS = 100_000;
+
+export interface FetchAllForExportParams<M extends Record<string, unknown>> {
+    /** The collection accessor to read through — `dataClient.collection(path)`. */
+    accessor: { find(params?: FindParams<M>): Promise<FindResponse<M>> };
+    /** Query to export. The window (`limit` / `offset` / `page`) is owned by the walk. */
+    params?: Omit<FindParams<M>, "limit" | "offset" | "page">;
+    pageSize?: number;
+    maxRows?: number;
+    /** Called after every page with the rows so far, and the total when the server reports one. */
+    onProgress?: (loaded: number, total: number | undefined) => void;
+}
+
+/**
+ * Read **every** row matching a query, one page at a time.
+ *
+ * `find({})` sends no `limit`, and an absent limit is resolved server-side to
+ * `DEFAULT_LIST_LIMIT` — 50 rows. The export used to hand those 50 rows back as
+ * `<collection>.csv` with nothing saying it was a sample, next to a dialog
+ * warning that the collection had 100 000 documents.
+ *
+ * Termination is driven by the server's `meta.hasMore` where it is reported and
+ * by an empty page otherwise — never by comparing a page's length against the
+ * requested limit, since a final page that happens to be exactly full is
+ * indistinguishable that way and a walk that stops there drops rows.
+ *
+ * @throws When more than `maxRows` rows match. A truncated export is worse than
+ * no export: it is indistinguishable from a complete one.
+ */
+export async function fetchAllEntitiesForExport<M extends Record<string, unknown>>({
+    accessor,
+    params,
+    pageSize = EXPORT_PAGE_SIZE,
+    maxRows = MAX_EXPORT_ROWS,
+    onProgress
+}: FetchAllForExportParams<M>): Promise<Entity<M>[]> {
+
+    const rows: Entity<M>[] = [];
+    let offset = 0;
+
+    for (;;) {
+        const res = await accessor.find({
+            ...params,
+            limit: pageSize,
+            offset
+        } as FindParams<M>);
+
+        const page = res?.data ?? [];
+        rows.push(...page);
+        onProgress?.(rows.length, res?.meta?.total);
+
+        if (rows.length > maxRows) {
+            throw new Error(
+                `This export would contain more than ${maxRows.toLocaleString()} rows, which is more than the ` +
+                "browser can build in one file. Filter the collection down, or export it from the server."
+            );
+        }
+
+        // An empty page ends the walk whatever the metadata says, so a server
+        // that keeps answering `hasMore` cannot spin forever.
+        if (page.length === 0) break;
+        if (res?.meta && !res.meta.hasMore) break;
+
+        // By rows received, not by `pageSize`: a server whose ceiling is lower
+        // than the page we asked for would otherwise skip everything it clamped.
+        offset += page.length;
+    }
+
+    return rows;
+}

package/src/data_export/export/index.ts

@@ -1,3 +1,4 @@
 export * from "./export";
+export * from "./fetch_export_data";
 export * from "./BasicExportAction";
 export * from "./ExportCollectionAction";

package/src/data_import/components/DataNewPropertiesMapping.tsx

@@ -17,6 +17,7 @@ import {
     Typography
 } from "@rebasepro/ui";
 import { getIn, setIn } from "@rebasepro/forms";
+import { useTranslation } from "@rebasepro/app";
 import { ImportConfig } from "../types";
 
 export interface DataPropertyMappingProps {
@@ -36,6 +37,7 @@ export function DataNewPropertiesMapping({
     buildPropertyView
 }: DataPropertyMappingProps) {
 
+    const { t } = useTranslation();
     const headersMapping = importConfig.headersMapping;
     const headingsOrder = importConfig.headingsOrder;
     const idColumn = importConfig.idColumn;
@@ -117,7 +119,7 @@ export function DataNewPropertiesMapping({
                         <TableCell header={true}>
                         </TableCell>
                         <TableCell header={true} style={{ width: "65%" }}>
-                            Default value
+                            {t("default_value")}
                         </TableCell>
                     </TableHeader>
                     <TableBody>
@@ -205,16 +207,31 @@ function DefaultValuesField({
     onValueChange,
     defaultValue
 }: { property: Property, onValueChange: (value: any) => void, defaultValue?: any }) {
+    const { t } = useTranslation();
+    const defaultValueLabel = t("default_value");
+    // Named fields stay distinguishable from each other — several of these sit
+    // in one table, and an aria-label repeated verbatim tells a screen reader
+    // nothing about which row it is on.
+    //
+    // Composed with a separator rather than a phrase: there is no key for the
+    // possessive form, and `t` returns the key itself for one that does not
+    // exist, so inventing `default_value_for` here would read out the literal
+    // string "default_value_for" in every locale, English included.
+    const ariaLabel = property.name
+        ? `${defaultValueLabel}: ${property.name}`
+        : defaultValueLabel;
     if (property.type === "string") {
         return <TextField size={"medium"}
-            placeholder={"Default value"}
+            aria-label={ariaLabel}
+            placeholder={defaultValueLabel}
             value={defaultValue ?? ""}
             onChange={(event) => onValueChange(event.target.value)}/>;
     } else if (property.type === "number") {
         return <TextField size={"medium"}
             type={"number"}
+            aria-label={ariaLabel}
             value={defaultValue ?? ""}
-            placeholder={"Default value"}
+            placeholder={defaultValueLabel}
             onChange={(event) => onValueChange(event.target.value)}/>;
     } else if (property.type === "boolean") {
         return <BooleanSwitchWithLabel

package/src/data_import/components/ImportNewPropertyFieldPreview.tsx

@@ -38,6 +38,7 @@ export function ImportNewPropertyFieldPreview({
                     {includeName &&
                         <TextField
                             size={"medium"}
+                            aria-label={propertyKey ? `Name of property ${propertyKey}` : "Property name"}
                             className={"text-base grow"}
                             value={property?.name ?? ""}
                             onChange={(e) => {

package/src/data_import/components/ImportSaveInProgress.tsx

@@ -1,10 +1,9 @@
 import { useData } from "@rebasepro/app";
-import { Entity } from "@rebasepro/types";
-import { RebaseData } from "@rebasepro/types";
 import { Button, CenteredView, CircularProgress, Typography } from "@rebasepro/ui";
 import { useEffect, useRef, useState } from "react";
 import { ImportConfig } from "../types";
 import type { AdminCollection } from "@rebasepro/admin-types";
+import { IMPORT_BATCH_SIZE, ImportSaveError, saveImportedEntities } from "../utils/save_entities";
 
 export function ImportSaveInProgress<C extends AdminCollection<any>>
     ({
@@ -20,11 +19,16 @@ export function ImportSaveInProgress<C extends AdminCollection<any>>
             onImportSuccess: (collection: C) => void
         }) {
 
-    const [errorSaving, setErrorSaving] = useState<Error | undefined>(undefined);
+    const [errorSaving, setErrorSaving] = useState<ImportSaveError | undefined>(undefined);
     const dataClient = useData();
 
     const savingRef = useRef<boolean>(false);
 
+    // Rows confirmed as written. A retry resumes here rather than re-sending
+    // rows that now exist and conflicting on its first batch, forever.
+    const committedRef = useRef<number>(0);
+    const bulkUnsupportedRef = useRef<{ current: boolean }>({ current: false });
+
     const [processedEntities, setProcessedEntities] = useState<number>(0);
 
     function save() {
@@ -33,20 +37,29 @@ export function ImportSaveInProgress<C extends AdminCollection<any>>
             return;
 
         savingRef.current = true;
+        setErrorSaving(undefined);
 
-        saveDataBatch(
+        saveImportedEntities(
             dataClient,
-            collection,
             path,
             importConfig.entities,
-            0,
-            25,
-            setProcessedEntities
+            {
+                offset: committedRef.current,
+                batchSize: IMPORT_BATCH_SIZE,
+                onBatchCommitted: (written) => {
+                    committedRef.current = written;
+                    setProcessedEntities(written);
+                },
+                bulkUnsupported: bulkUnsupportedRef.current
+            }
         ).then(() => {
             onImportSuccess(collection);
             savingRef.current = false;
         }).catch((e) => {
-            setErrorSaving(e);
+            const error = e as ImportSaveError;
+            committedRef.current = error.committed ?? committedRef.current;
+            setProcessedEntities(committedRef.current);
+            setErrorSaving(error);
             savingRef.current = false;
         });
     }
@@ -56,6 +69,10 @@ export function ImportSaveInProgress<C extends AdminCollection<any>>
     }, []);
 
     if (errorSaving) {
+        const total = importConfig.entities.length;
+        const failedRows = errorSaving.failedTo - errorSaving.failedFrom > 1
+            ? `rows ${errorSaving.failedFrom + 1}–${errorSaving.failedTo}`
+            : `row ${errorSaving.failedFrom + 1}`;
         return (
             <CenteredView className={"flex flex-col gap-4 items-center"}>
                 <Typography variant={"h6"}>
@@ -65,10 +82,18 @@ export function ImportSaveInProgress<C extends AdminCollection<any>>
                 <Typography variant={"body2"} color={"error"}>
                     {errorSaving.message}
                 </Typography>
+
+                <Typography variant={"body2"}>
+                    {errorSaving.committed} of {total} rows were imported.
+                    The import stopped on {failedRows}, which {errorSaving.failedTo - errorSaving.failedFrom > 1 ? "were" : "was"} not written.
+                </Typography>
+
                 <Button
                     onClick={save}
                 >
-                    Retry
+                    {errorSaving.committed > 0
+                        ? `Retry from row ${errorSaving.committed + 1}`
+                        : "Retry"}
                 </Button>
             </CenteredView>
         );
@@ -94,29 +119,3 @@ export function ImportSaveInProgress<C extends AdminCollection<any>>
     );
 
 }
-
-function saveDataBatch(dataClient: RebaseData,
-    collection: AdminCollection,
-    path: string,
-    data: Partial<Entity<any>>[],
-    offset = 0,
-    batchSize = 25,
-    onProgressUpdate: (progress: number) => void): Promise<void> {
-
-    console.debug("Saving imported data", offset, batchSize);
-
-    const batch = data.slice(offset, offset + batchSize);
-    return Promise.all(batch.map(d =>
-        dataClient.collection(path).create(
-            d.values,
-            d.id
-        )))
-        .then(() => {
-            if (offset + batchSize < data.length) {
-                onProgressUpdate(offset + batchSize);
-                return saveDataBatch(dataClient, collection, path, data, offset + batchSize, batchSize, onProgressUpdate);
-            }
-            onProgressUpdate(data.length);
-            return Promise.resolve();
-        });
-}

package/src/data_import/import/ImportCollectionAction.tsx

@@ -35,7 +35,7 @@ import { DataNewPropertiesMapping } from "../components/DataNewPropertiesMapping
 import { ImportFileUpload } from "../components/ImportFileUpload";
 import { ImportSaveInProgress } from "../components/ImportSaveInProgress";
 import { ImportConfig } from "../types";
-import { slugify } from "@rebasepro/utils";
+import { isPrototypePollutingKey, slugify } from "@rebasepro/utils";
 
 type ImportState = "initial" | "mapping" | "preview" | "import_data_saving";
 
@@ -400,7 +400,15 @@ export function ImportDataPreview<M extends Record<string, unknown>>({
     return <CollectionTableBinding
         title={<div>
             <Typography variant={"subtitle2"}>Imported data preview</Typography>
-            <Typography variant={"caption"}>Entities with the same id will be overwritten</Typography>
+            {/* Conditional because it is only true when a column was chosen as
+                the id: without one, every row is created and nothing can be
+                overwritten. With one, the import asks for an upsert — which it
+                did not, back when this sentence was unconditional and false. */}
+            <Typography variant={"caption"}>
+                {importConfig.idColumn
+                    ? "Entities with the same id will be overwritten"
+                    : "All rows will be imported as new entities"}
+            </Typography>
         </div>}
         tableController={{
             data: importConfig.entities,
@@ -421,6 +429,9 @@ function buildHeadersMappingFromData(objArr: object[], properties?: Properties)
     const headersMapping: Record<string, string> = {};
     objArr.filter(Boolean).forEach((obj) => {
         Object.keys(obj).forEach((key) => {
+            // The keys are the uploaded file's header row; `headersMapping[key] = …`
+            // is the same setter the import pipeline refuses elsewhere.
+            if (isPrototypePollutingKey(key)) return;
             const child = (obj as Record<string, unknown>)[key];
             if (child != null && typeof child === "object" && !Array.isArray(child)) {
                 const childProperty = properties?.[key];

package/src/data_import/utils/csv.ts

@@ -0,0 +1,153 @@
+import { isPrototypePollutingKey } from "@rebasepro/utils";
+
+/**
+ * Delimiters sniffed from the header row, most common first.
+ *
+ * A spreadsheet saved as "CSV" in a locale that uses the comma as a decimal
+ * separator is semicolon-delimited, and a tab-separated file saved as `.csv`
+ * happens often enough to be worth reading.
+ */
+const CANDIDATE_DELIMITERS = [",", ";", "\t"];
+
+/**
+ * Split CSV text into rows of raw cells, RFC 4180 style.
+ *
+ * Quoted fields may contain the delimiter, newlines and doubled quotes; this is
+ * the exact inverse of what the export's `entryToCSVRow` writes, so a file this
+ * admin produced reads back into the cells it was built from.
+ */
+export function parseCsvRows(text: string, delimiter = ","): string[][] {
+    const rows: string[][] = [];
+    let row: string[] = [];
+    let field = "";
+    let quoted = false;
+    let inQuotes = false;
+    let i = 0;
+
+    const endField = () => {
+        row.push(field);
+        field = "";
+        quoted = false;
+    };
+
+    while (i < text.length) {
+        const char = text[i];
+
+        if (inQuotes) {
+            if (char === "\"") {
+                // A doubled quote is a literal one; a single quote closes the field.
+                if (text[i + 1] === "\"") {
+                    field += "\"";
+                    i += 2;
+                    continue;
+                }
+                inQuotes = false;
+                i++;
+                continue;
+            }
+            field += char;
+            i++;
+            continue;
+        }
+
+        if (char === "\"" && field === "") {
+            inQuotes = true;
+            quoted = true;
+            i++;
+            continue;
+        }
+        if (char === delimiter) {
+            endField();
+            i++;
+            continue;
+        }
+        if (char === "\r") {
+            // CRLF: the line ends on the \n. A lone CR outside quotes is dropped.
+            i++;
+            continue;
+        }
+        if (char === "\n") {
+            endField();
+            rows.push(row);
+            row = [];
+            i++;
+            continue;
+        }
+        field += char;
+        i++;
+    }
+
+    // A file that does not end in a newline still has a last row.
+    if (field !== "" || quoted || row.length > 0) {
+        endField();
+        rows.push(row);
+    }
+
+    return rows;
+}
+
+/**
+ * Pick the delimiter that splits the header row into the most cells. A
+ * single-column file matches nothing and stays on the comma.
+ */
+export function detectCsvDelimiter(text: string): string {
+    const sample = text.slice(0, 64 * 1024);
+    let best = CANDIDATE_DELIMITERS[0];
+    let bestCount = 1;
+    for (const candidate of CANDIDATE_DELIMITERS) {
+        const count = parseCsvRows(sample, candidate)[0]?.length ?? 0;
+        if (count > bestCount) {
+            best = candidate;
+            bestCount = count;
+        }
+    }
+    return best;
+}
+
+export interface ParsedCsv {
+    headers: string[];
+    data: Record<string, string>[];
+}
+
+/**
+ * Parse CSV text into one object per row, keyed by the header row.
+ *
+ * The picker accepts `.csv` and the dialog promises "Upload a CSV, Excel or JSON
+ * file", but every non-JSON file used to be handed to ExcelJS'
+ * `workbook.xlsx.load`, which is a zip reader — so every CSV failed with
+ * "Can't find end of central directory : is this a zip file ?". The export
+ * writes CSV by default, so the round trip could not close.
+ *
+ * A blank header keeps its column rather than collapsing it, so the cells to its
+ * right stay under their own names.
+ */
+export function parseCsvToObjects(text: string): ParsedCsv {
+    // A BOM is one character of the first header, and Excel writes one.
+    const cleaned = text.charCodeAt(0) === 0xFEFF ? text.slice(1) : text;
+    const delimiter = detectCsvDelimiter(cleaned);
+    const rows = parseCsvRows(cleaned, delimiter)
+        .filter(row => row.some(cell => cell.trim() !== ""));
+
+    if (rows.length === 0) {
+        return { headers: [],
+            data: [] };
+    }
+
+    const headers = rows[0].map((header, index) => header.trim() || `Column${index + 1}`);
+
+    const data = rows.slice(1).map((cells) => {
+        const obj: Record<string, string> = {};
+        headers.forEach((header, index) => {
+            // The header row is uploaded data: `obj["__proto__"] = …` is the
+            // prototype setter, not a column. Refused, as elsewhere in import.
+            if (isPrototypePollutingKey(header)) return;
+            const cell = cells[index];
+            if (cell === undefined) return;
+            obj[header] = cell;
+        });
+        return obj;
+    });
+
+    return { headers,
+        data };
+}

package/src/data_import/utils/data.ts

@@ -5,7 +5,7 @@ import { isPropertyBuilder } from "@rebasepro/common";
 import { unflattenObject } from "./file_to_json";
 import { getIn } from "@rebasepro/forms";
 import { inferTypeFromValue } from "@rebasepro/inference";
-import { mergeDeep } from "@rebasepro/utils";
+import { isPrototypePollutingKey, mergeDeep } from "@rebasepro/utils";
 
 export function convertDataToEntity(authController: AuthController,
     navigation: CollectionRegistryController,
@@ -57,6 +57,12 @@ export function convertDataToEntity(authController: AuthController,
 
 export function flattenEntry(obj: Record<string, unknown>, parent = ""): Record<string, unknown> {
     return Object.keys(obj).reduce<Record<string, unknown>>((acc, key) => {
+        // Keys come from the uploaded file, so `acc[key] = …` is the class-22
+        // primitive when the key is `__proto__`; refuse the column instead.
+        if (isPrototypePollutingKey(key)) {
+            console.warn(`Skipping column "${key}": a header may not reach the prototype chain`);
+            return acc;
+        }
         const prefixedKey = parent ? `${parent}.${key}` : key;
 
         if (typeof obj[key] === "object" && !(obj[key] instanceof Date) && obj[key] !== null && !Array.isArray(obj[key])) {
@@ -100,7 +106,15 @@ export function processValueMapping(authController: AuthController, value: any,
     if (from === "array" && to === "array" && Array.isArray(value) && usedProperty.of && !Array.isArray(usedProperty.of) && !isPropertyBuilder(usedProperty.of)) {
         return value.map(v => processValueMapping(authController, v, navigation, usedProperty.of as Property));
     } else if (from === "string" && to === "number" && typeof value === "string") {
-        return Number(value);
+        // `Number("")` is 0, so a blank cell used to import as a real zero — a
+        // price of nothing rather than a price nobody filled in — and `Number`
+        // of anything unreadable imported as NaN. Both are absent values, and
+        // saying so lets the importer's own validation see them. The `vector`
+        // branch above already draws the same distinction.
+        const trimmed = value.trim();
+        if (trimmed === "") return null;
+        const num = Number(trimmed);
+        return Number.isNaN(num) ? null : num;
     } else if (from === "string" && to === "array" && typeof value === "string" && usedProperty.of && !Array.isArray(usedProperty.of) && !isPropertyBuilder(usedProperty.of)) {
         return value.split(",").map((v: string) => processValueMapping(authController, v, navigation, usedProperty.of as Property));
     } else if (from === "string" && to === "boolean") {