@rebasepro/admin 0.13.1-canary.gef9608c → 0.14.0

package/src/components/UserSelector.tsx

@@ -14,7 +14,7 @@ import {
     PopoverPrimitive,
     SearchIcon,
     Separator,
-    useInjectStyles,
+    usePortalContainer,
     XIcon
 } from "@rebasepro/ui";
 import * as React from "react";
@@ -23,6 +23,7 @@ import { Command as CommandPrimitive } from "cmdk";
 import { User } from "@rebasepro/types";
 import { apiBaseOf, useRebaseClient, useAuthController, UserDisplay } from "@rebasepro/app";
 import { EmptyValue } from "../preview";
+import { useResolvedUser } from "../hooks/useResolvedUsers";
 
 interface UserSelectorItem {
     uid: string;
@@ -46,10 +47,19 @@ function useUserSelector({ pageSize = DEFAULT_PAGE_SIZE }: { pageSize?: number }
     const [currentSearch, setCurrentSearch] = useState("");
     const offsetRef = useRef(0);
     const userCacheRef = useRef<Map<string, User>>(new Map());
+    // Stamped by every request; only the newest one is allowed to write state.
+    // Typing "alice" issues one request per keystroke and nothing cancels them,
+    // so the response for "al" landing after the response for "alice" replaced
+    // the list — and `offsetRef` — with results for a string the user had
+    // already moved past. Same shape as `useRelationSelector`.
+    const requestIdRef = useRef(0);
+    const searchTimeoutRef = useRef<ReturnType<typeof setTimeout> | null>(null);
 
     const fetchUsers = useCallback(async (searchStr: string, offset: number, append: boolean) => {
         const apiBase = apiBaseOf(client);
         if (!apiBase) return;
+        const requestId = ++requestIdRef.current;
+        const superseded = () => requestId !== requestIdRef.current;
         setIsLoading(true);
         try {
             const token = await getAuthToken?.();
@@ -68,6 +78,7 @@ function useUserSelector({ pageSize = DEFAULT_PAGE_SIZE }: { pageSize?: number }
             });
             if (!response.ok) throw new Error("Failed to fetch users");
             const data = await response.json();
+            if (superseded()) return;
             const rows: Record<string, unknown>[] = data.data ?? data.users ?? [];
             const newItems: UserSelectorItem[] = rows.map((r: Record<string, unknown>) => {
                 const user: User = {
@@ -88,9 +99,10 @@ user };
             setHasMore(newItems.length >= pageSize);
             offsetRef.current = offset + newItems.length;
         } catch {
+            if (superseded()) return;
             setHasMore(false);
         } finally {
-            setIsLoading(false);
+            if (!superseded()) setIsLoading(false);
         }
     }, [client?.baseUrl, client?.apiPath, getAuthToken, pageSize]);
 
@@ -100,11 +112,23 @@ user };
     }, [fetchUsers]);
 
     const search = useCallback((searchStr: string) => {
-        setCurrentSearch(searchStr);
-        offsetRef.current = 0;
-        fetchUsers(searchStr, 0, false);
+        // Debounced like the relation picker's type-ahead: a request per
+        // keystroke is both wasteful and the thing that makes an out-of-order
+        // response likely in the first place.
+        if (searchTimeoutRef.current) clearTimeout(searchTimeoutRef.current);
+        searchTimeoutRef.current = setTimeout(() => {
+            setCurrentSearch(searchStr);
+            offsetRef.current = 0;
+            fetchUsers(searchStr, 0, false);
+        }, searchStr.trim() ? 300 : 0);
     }, [fetchUsers]);
 
+    useEffect(() => {
+        return () => {
+            if (searchTimeoutRef.current) clearTimeout(searchTimeoutRef.current);
+        };
+    }, []);
+
     const loadMore = useCallback(() => {
         fetchUsers(currentSearch, offsetRef.current, true);
     }, [fetchUsers, currentSearch]);
@@ -178,6 +202,7 @@ export const UserSelector = React.forwardRef<
 
         const [isPopoverOpen, setIsPopoverOpen] = useState(false);
         const [searchString, setSearchString] = useState<string>("");
+        const contextPortalContainer = usePortalContainer();
 
         const scrollContainerRef = useRef<HTMLDivElement>(null);
         const sentinelRef = useRef<HTMLDivElement>(null);
@@ -199,9 +224,19 @@ export const UserSelector = React.forwardRef<
         const selectedUser: User | null = value ? getUser(value) ?? null : null;
 
         // If the user isn't in the cache, try to find in available items
-        const resolvedUser: User | null = selectedUser
+        const listedUser: User | null = selectedUser
             ?? (value ? availableItems.find(i => i.uid === value)?.user ?? null : null);
 
+        // Neither the loaded page nor the cache holds it: ask for that uid
+        // specifically. The list is one page of ten, so any installation with
+        // more users than that rendered an assigned field as *empty* — and an
+        // editor who is shown "no value" sets one, overwriting an assignment
+        // the UI never admitted was there. Lookups are coalesced and cached
+        // per API base by `useResolvedUser`, so a table of these costs one
+        // request.
+        const fetchedUser = useResolvedUser(value && !listedUser ? value : undefined);
+        const resolvedUser: User | null = listedUser ?? fetchedUser;
+
         // IntersectionObserver for infinite scroll
         const sentinelCallbackRef = useCallback((node: HTMLDivElement | null) => {
             if (observerRef.current) {
@@ -301,10 +336,10 @@ export const UserSelector = React.forwardRef<
             };
         }, [isPopoverOpen]);
 
-        useInjectStyles("UserSelector", " [cmdk-group] { max-height: 40vh; overflow-y: auto; } ");
-
         const resolvedPlaceholder = placeholder || <EmptyValue className={"ml-2"}/>;
-        const portalContainer = (typeof document !== "undefined" ? document.body : undefined);
+        // See RelationSelector: a modal dialog cancels wheel events outside its
+        // own content, so a list portaled to the body opens unscrollable.
+        const portalContainer = (contextPortalContainer ?? (typeof document !== "undefined" ? document.body : undefined)) ?? undefined;
 
         return (
             <>
@@ -341,6 +376,14 @@ export const UserSelector = React.forwardRef<
                                     <div className="flex flex-row items-center gap-1 truncate flex-1 min-w-0 mr-2">
                                         <UserDisplay user={resolvedUser}/>
                                     </div>
+                                ) : value ? (
+                                    // A uid we could not resolve — deleted, or
+                                    // hidden from this viewer. Show it raw: the
+                                    // placeholder here would claim the field is
+                                    // unset, which is the one thing it is not.
+                                    <span className="text-sm truncate text-text-primary dark:text-text-primary-dark">
+                                        {value}
+                                    </span>
                                 ) : (
                                     <span className="text-sm text-text-secondary dark:text-text-secondary-dark">
                                         {resolvedPlaceholder}

package/src/components/history/LastEditedByIndicator.tsx

@@ -3,22 +3,17 @@ import React, { useEffect, useState, useCallback } from "react";
 ;
 import { useApiBase, useApiConfig } from "@rebasepro/app";
 import { useAuthController } from "@rebasepro/app";
+import { formatRelativeTime } from "@rebasepro/utils";
 import { HistoryEntryData } from "../../hooks";
 import type { AdminCollection } from "@rebasepro/admin-types";
 
-function getRelativeTimeString(date: Date): string {
-    const now = new Date();
-    const diffMs = now.getTime() - date.getTime();
-    const diffSeconds = Math.floor(diffMs / 1000);
-    const diffMinutes = Math.floor(diffSeconds / 60);
-    const diffHours = Math.floor(diffMinutes / 60);
-    const diffDays = Math.floor(diffHours / 24);
+const THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1000;
 
-    if (diffSeconds < 60) return "just now";
-    if (diffMinutes < 60) return `${diffMinutes}m ago`;
-    if (diffHours < 24) return `${diffHours}h ago`;
-    if (diffDays < 30) return `${diffDays}d ago`;
-    return date.toLocaleDateString();
+function getRelativeTimeString(date: Date): string {
+    // An edit is in the past, but the timestamp comes from the server and the
+    // phrase is rendered against the browser's clock — a few seconds of skew
+    // used to be enough to make a fresh edit read as the wrong thing entirely.
+    return formatRelativeTime(date, { maxMs: THIRTY_DAYS_MS }) ?? date.toLocaleDateString();
 }
 
 /**

package/src/data_export/export/ExportCollectionAction.tsx

@@ -29,9 +29,26 @@ import {
     Tooltip
 } from "@rebasepro/ui";
 import { downloadEntitiesExport } from "./export";
+import { fetchAllEntitiesForExport, MAX_EXPORT_ROWS } from "./fetch_export_data";
 
 const DOCS_LIMIT = 500;
 
+/**
+ * Additional-field builders run per row and may do I/O, so a `Promise.all` over
+ * the whole export is one request per row all at once. That was bounded only by
+ * the 50-row cap the export used to have; now that the read is paginated, it is
+ * bounded here instead.
+ */
+const ADDITIONAL_FIELDS_CONCURRENCY = 50;
+
+async function mapInChunks<T, R>(items: T[], fn: (item: T) => Promise<R>, chunkSize = ADDITIONAL_FIELDS_CONCURRENCY): Promise<R[]> {
+    const results: R[] = [];
+    for (let i = 0; i < items.length; i += chunkSize) {
+        results.push(...await Promise.all(items.slice(i, i + chunkSize).map(fn)));
+    }
+    return results;
+}
+
 export function ExportCollectionAction<M extends Record<string, unknown>, USER extends User>({
     collection,
     path,
@@ -59,6 +76,11 @@ export function ExportCollectionAction<M extends Record<string, unknown>, USER e
     const context = useAdminContext<USER>();
     const dataClient = useData();
 
+    // Said before the download starts, not discovered halfway through it: the
+    // walk refuses rather than writing a short file, so the dialog has to name
+    // the ceiling it is about to hit.
+    const tooManyToExport = collectionEntitiesCount !== undefined && collectionEntitiesCount > MAX_EXPORT_ROWS;
+
     const canExport = !exportAllowed || exportAllowed({
         collectionEntitiesCount: collectionEntitiesCount ?? 0,
         path,
@@ -67,6 +89,7 @@ export function ExportCollectionAction<M extends Record<string, unknown>, USER e
 
     const [dataLoading, setDataLoading] = React.useState<boolean>(false);
     const [dataLoadingError, setDataLoadingError] = React.useState<Error | undefined>();
+    const [progress, setProgress] = React.useState<{ loaded: number, total?: number }>({ loaded: 0 });
 
     const [open, setOpen] = React.useState(false);
 
@@ -84,7 +107,7 @@ export function ExportCollectionAction<M extends Record<string, unknown>, USER e
         const additionalFields = collection.additionalFields;
 
         const resolvedExportColumnsValues: Record<string, any>[] = additionalExportFields
-            ? await Promise.all(entities.map(async (entity) => {
+            ? await mapInChunks(entities, async (entity) => {
                 return (await Promise.all(additionalExportFields.map(async (column) => {
                     return {
                         [column.key]: await column.builder({
@@ -94,11 +117,11 @@ export function ExportCollectionAction<M extends Record<string, unknown>, USER e
                     };
                 }))).reduce((a, b) => ({ ...a,
 ...b }), {});
-            }))
+            })
             : [];
 
         const resolvedColumnsValues: Record<string, any>[] = additionalFields
-            ? await Promise.all(entities.map(async (entity) => {
+            ? await mapInChunks(entities, async (entity) => {
                 return (await Promise.all(additionalFields
                     .map(async (field) => {
                         if (!field.value)
@@ -111,64 +134,74 @@ export function ExportCollectionAction<M extends Record<string, unknown>, USER e
                         };
                     }))).reduce((a, b) => ({ ...a,
 ...b }), {});
-            }))
+            })
             : [];
         return [...resolvedExportColumnsValues, ...resolvedColumnsValues];
     }, [exportConfig?.additionalFields]);
 
     const doDownload = useCallback(async (collection: AdminCollection<M>,
-        exportConfig: ExportConfig<any> | undefined) => {
+        exportConfig: ExportConfig<any> | undefined): Promise<boolean> => {
 
         onAnalyticsEvent?.("export_collection", {
             collection: collection.slug
         });
         setDataLoading(true);
-        dataClient.collection(path).find({})
-            .then(async (res) => {
-                const data = res.data as Entity<M>[];
-                setDataLoadingError(undefined);
-                const additionalData = await fetchAdditionalFields(data);
-                const additionalHeaders = [
-                    ...exportConfig?.additionalFields?.map(column => column.key) ?? [],
-                    ...collection.additionalFields?.map(field => field.key) ?? []
-                ];
-
-                const dataWithDefaults = includeUndefinedValues
-                    ? data.map(entity => {
-                        const defaultValues = getDefaultValuesFor(collection.properties);
-                        return {
-                            ...entity,
-                            values: { ...defaultValues,
+        setDataLoadingError(undefined);
+        setProgress({ loaded: 0 });
+        try {
+            // Paginated, not `find({})`: an absent limit resolves to 50 rows
+            // server-side, so the export used to be the first page of the
+            // collection under a filename that read like all of it.
+            const data = await fetchAllEntitiesForExport<M>({
+                accessor: dataClient.collection(path) as { find: (params?: any) => Promise<any> },
+                onProgress: (loaded, total) => setProgress({ loaded,
+                    total })
+            });
+            const additionalData = await fetchAdditionalFields(data);
+            const additionalHeaders = [
+                ...exportConfig?.additionalFields?.map(column => column.key) ?? [],
+                ...collection.additionalFields?.map(field => field.key) ?? []
+            ];
+
+            const defaultValues = includeUndefinedValues ? getDefaultValuesFor(collection.properties) : undefined;
+            const dataWithDefaults = defaultValues
+                ? data.map(entity => ({
+                    ...entity,
+                    values: { ...defaultValues,
 ...entity.values }
-                        };
-                    })
-                    : data;
-                downloadEntitiesExport({
-                    data: dataWithDefaults,
-                    additionalData,
-                    properties: collection.properties,
-                    propertiesOrder: collection.propertiesOrder,
-                    name: collection.name,
-                    flattenArrays,
-                    additionalHeaders,
-                    exportType,
-                    dateExportType
-                });
-                onAnalyticsEvent?.("export_collection_success", {
-                    collection: collection.slug
-                });
-            })
-            .catch((e) => {
-                console.error("Error loading export data", e);
-                setDataLoadingError(e);
-            })
-            .finally(() => setDataLoading(false));
+                }))
+                : data;
+            downloadEntitiesExport({
+                data: dataWithDefaults,
+                additionalData,
+                properties: collection.properties,
+                propertiesOrder: collection.propertiesOrder,
+                name: collection.name,
+                flattenArrays,
+                additionalHeaders,
+                exportType,
+                dateExportType
+            });
+            onAnalyticsEvent?.("export_collection_success", {
+                collection: collection.slug
+            });
+            return true;
+        } catch (e) {
+            console.error("Error loading export data", e);
+            setDataLoadingError(e as Error);
+            return false;
+        } finally {
+            setDataLoading(false);
+        }
 
     }, [onAnalyticsEvent, dataClient, path, fetchAdditionalFields, includeUndefinedValues, flattenArrays, exportType, dateExportType]);
 
     const onOkClicked = useCallback(() => {
-        doDownload(collection, exportConfig);
-        handleClose();
+        // The dialog stays open until the walk finishes: it is the only place a
+        // multi-page export reports progress, or reports that it failed.
+        doDownload(collection, exportConfig).then((downloaded) => {
+            if (downloaded) handleClose();
+        });
     }, [doDownload, collection, exportConfig, handleClose]);
 
     return <>
@@ -194,13 +227,23 @@ export function ExportCollectionAction<M extends Record<string, unknown>, USER e
 
                 <div>{t("download_table_csv")}</div>
 
-                {collectionEntitiesCount !== undefined && collectionEntitiesCount > DOCS_LIMIT &&
+                {collectionEntitiesCount !== undefined && collectionEntitiesCount > DOCS_LIMIT && !tooManyToExport &&
                     <Alert color={"warning"}>
                         <div>
                             {t("large_number_of_documents", { count: collectionEntitiesCount.toString() })}
                         </div>
                     </Alert>}
 
+                {tooManyToExport &&
+                    <Alert color={"error"}>
+                        <div>
+                            {t("too_many_documents_to_export", {
+                                count: (collectionEntitiesCount ?? 0).toString(),
+                                limit: MAX_EXPORT_ROWS.toString()
+                            })}
+                        </div>
+                    </Alert>}
+
                 <div className={"flex flex-row gap-4"}>
                     <div className={"p-4 flex flex-col"}>
                         <RadioGroup value={exportType} onValueChange={(v) => setExportType(v as "csv" | "json")}>
@@ -242,6 +285,10 @@ export function ExportCollectionAction<M extends Record<string, unknown>, USER e
                     onValueChange={setIncludeUndefinedValues}
                     label={t("include_undefined_values")}/>
 
+                {dataLoadingError && <Alert color={"error"}>
+                    <div>{dataLoadingError.message}</div>
+                </Alert>}
+
                 {!canExport && notAllowedView}
 
             </DialogContent>
@@ -250,13 +297,19 @@ export function ExportCollectionAction<M extends Record<string, unknown>, USER e
 
                 {dataLoading && <CircularProgress size={"smallest"}/>}
 
+                {dataLoading && <Label>
+                    {progress.total !== undefined
+                        ? `${progress.loaded} / ${progress.total}`
+                        : `${progress.loaded}`}
+                </Label>}
+
                 <Button onClick={handleClose}
                     variant={"text"}>
                     {t("cancel")}
                 </Button>
 
                 <Button onClick={onOkClicked}
-                    disabled={dataLoading || !canExport}>
+                    disabled={dataLoading || !canExport || tooManyToExport}>
                     {t("download")}
                 </Button>
 

package/src/data_export/export/export.ts

@@ -154,6 +154,24 @@ function getHeaders(property: Property, propertyKey: string, prefix = ""): Heade
     }
 }
 
+/**
+ * Read whatever a `date` column actually arrived as into a `Date`.
+ *
+ * The driver/WebSocket path revives `{ __type: "date" }` into a `Date`; the REST
+ * path — which is the one the admin is on — leaves an ISO string, and an epoch
+ * number is what a re-imported export carries. Returns `undefined` for anything
+ * that is not a date, so the caller can pass the raw value through.
+ */
+function toExportableDate(inputValue: unknown): Date | undefined {
+    if (inputValue instanceof Date) return Number.isNaN(inputValue.getTime()) ? undefined : inputValue;
+    if (typeof inputValue === "number" && Number.isFinite(inputValue)) return new Date(inputValue);
+    if (typeof inputValue === "string" && inputValue.trim() !== "") {
+        const parsed = new Date(inputValue);
+        return Number.isNaN(parsed.getTime()) ? undefined : parsed;
+    }
+    return undefined;
+}
+
 function processValueForExport(inputValue: unknown,
     property: Property,
     exportType: "csv" | "json",
@@ -181,8 +199,17 @@ function processValueForExport(inputValue: unknown,
     } else if (property.type === "reference" && inputValue && typeof inputValue === "object" && "isEntityReference" in inputValue && typeof (inputValue as EntityReference).isEntityReference === "function" && (inputValue as EntityReference).isEntityReference()) {
         const ref = inputValue ? inputValue as EntityReference : undefined;
         value = ref ? ref.fullPath : null;
-    } else if (property.type === "date" && inputValue instanceof Date) {
-        value = inputValue ? (dateExportType === "timestamp" ? inputValue.getTime() : inputValue.toISOString()) : null;
+    } else if (property.type === "date") {
+        // Not `instanceof Date`: the admin reads over REST, and the REST row
+        // pipeline hands dates back as the database wrote them — a string. That
+        // made this branch dead on every live export, so both radio options
+        // produced identical files. Normalise here, where the declared type says
+        // the column is a date, and leave anything unparseable untouched rather
+        // than exporting an invalid date as `null`.
+        const date = toExportableDate(inputValue);
+        value = date
+            ? (dateExportType === "timestamp" ? date.getTime() : date.toISOString())
+            : inputValue;
     } else {
         value = inputValue;
     }
@@ -209,15 +236,40 @@ function processValuesForExport<M extends Record<string, unknown>>
 ...updatedValues };
 }
 
-function entryToCSVRow(entry: unknown[]) {
+/**
+ * Characters that make a spreadsheet read a cell as a formula rather than text.
+ *
+ * Quoting is CSV *escaping* and is not enough: Excel, LibreOffice Calc and
+ * Sheets strip the CSV quoting at parse time and then evaluate a cell whose
+ * first character is one of these — `=HYPERLINK(…)` exfiltrates neighbouring
+ * cells on click, `=cmd|'…'!A0` is worse.
+ */
+const FORMULA_TRIGGERS = ["=", "+", "-", "@", "\t", "\r"];
+
+/**
+ * Neutralise a cell that a spreadsheet would otherwise evaluate, by prefixing a
+ * single quote — the standard OWASP mitigation. The apostrophe is consumed by
+ * the spreadsheet as "treat the rest as text", so the value reads back intact.
+ */
+export function escapeCsvFormula(value: string): string {
+    const first = value.charAt(0);
+    if (!FORMULA_TRIGGERS.includes(first)) return value;
+    // A signed number is not a formula, and prefixing it would turn every
+    // negative amount in the file into text. `-1+1` is still neutralised,
+    // because it is not a number.
+    if ((first === "-" || first === "+") && value.trim() !== "" && Number.isFinite(Number(value))) return value;
+    return "'" + value;
+}
+
+function toCSVCell(v: unknown): string {
+    if (v === null || v === undefined) return "";
+    const s = Array.isArray(v) ? JSON.stringify(v) : String(v);
+    return "\"" + escapeCsvFormula(s).replaceAll("\"", "\"\"") + "\"";
+}
+
+export function entryToCSVRow(entry: unknown[]) {
     return entry
-        .map((v: unknown) => {
-            if (v === null || v === undefined) return "";
-            if (Array.isArray(v))
-                return "\"" + JSON.stringify(v).replaceAll("\"", "\"\"") + "\"";
-            const s = String(v);
-            return "\"" + s.replaceAll("\"", "\"\"") + "\"";
-        })
+        .map(toCSVCell)
         .join(",") + "\r\n";
 }
 
@@ -236,12 +288,7 @@ export function downloadDataAsCsv(data: object[], name: string) {
     const headers = Object.keys(data[0]);
     const csvContent = [
         headers.join(","),
-        ...data.map(row => headers.map(header => {
-            const value = (row as Record<string, unknown>)[header];
-            if (value === null || value === undefined) return "";
-            if (Array.isArray(value)) return `"${JSON.stringify(value).replace(/"/g, '""')}"`;
-            return `"${String(value).replace(/"/g, '""')}"`;
-        }).join(","))
+        ...data.map(row => headers.map(header => toCSVCell((row as Record<string, unknown>)[header])).join(","))
     ].join("\r\n");
 
     downloadBlob([csvContent], `${name}.csv`, "text/csv");

package/src/data_export/export/fetch_export_data.ts

@@ -0,0 +1,90 @@
+import { Entity, FindParams, FindResponse } from "@rebasepro/types";
+
+/**
+ * Rows asked for per request.
+ *
+ * Kept at or below the server's `MAX_LIST_LIMIT`, which is now the largest page
+ * a read will serve *and refuses* anything larger — it used to clamp silently,
+ * and asking for 100 000 while receiving 1 000 looked exactly like a collection
+ * with 1 000 rows in it. The walk still never trusts the page size it asked for:
+ * it advances by the rows it was actually handed.
+ */
+export const EXPORT_PAGE_SIZE = 500;
+
+/**
+ * Most rows one browser-side export will materialise.
+ *
+ * Everything here is built in memory and handed to a Blob, so there is a
+ * ceiling whether or not it is named. Naming it means going over it **throws**
+ * instead of writing a short file that reads like the whole collection.
+ */
+export const MAX_EXPORT_ROWS = 100_000;
+
+export interface FetchAllForExportParams<M extends Record<string, unknown>> {
+    /** The collection accessor to read through — `dataClient.collection(path)`. */
+    accessor: { find(params?: FindParams<M>): Promise<FindResponse<M>> };
+    /** Query to export. The window (`limit` / `offset` / `page`) is owned by the walk. */
+    params?: Omit<FindParams<M>, "limit" | "offset" | "page">;
+    pageSize?: number;
+    maxRows?: number;
+    /** Called after every page with the rows so far, and the total when the server reports one. */
+    onProgress?: (loaded: number, total: number | undefined) => void;
+}
+
+/**
+ * Read **every** row matching a query, one page at a time.
+ *
+ * `find({})` sends no `limit`, and an absent limit is resolved server-side to
+ * `DEFAULT_LIST_LIMIT` — 50 rows. The export used to hand those 50 rows back as
+ * `<collection>.csv` with nothing saying it was a sample, next to a dialog
+ * warning that the collection had 100 000 documents.
+ *
+ * Termination is driven by the server's `meta.hasMore` where it is reported and
+ * by an empty page otherwise — never by comparing a page's length against the
+ * requested limit, since a final page that happens to be exactly full is
+ * indistinguishable that way and a walk that stops there drops rows.
+ *
+ * @throws When more than `maxRows` rows match. A truncated export is worse than
+ * no export: it is indistinguishable from a complete one.
+ */
+export async function fetchAllEntitiesForExport<M extends Record<string, unknown>>({
+    accessor,
+    params,
+    pageSize = EXPORT_PAGE_SIZE,
+    maxRows = MAX_EXPORT_ROWS,
+    onProgress
+}: FetchAllForExportParams<M>): Promise<Entity<M>[]> {
+
+    const rows: Entity<M>[] = [];
+    let offset = 0;
+
+    for (;;) {
+        const res = await accessor.find({
+            ...params,
+            limit: pageSize,
+            offset
+        } as FindParams<M>);
+
+        const page = res?.data ?? [];
+        rows.push(...page);
+        onProgress?.(rows.length, res?.meta?.total);
+
+        if (rows.length > maxRows) {
+            throw new Error(
+                `This export would contain more than ${maxRows.toLocaleString()} rows, which is more than the ` +
+                "browser can build in one file. Filter the collection down, or export it from the server."
+            );
+        }
+
+        // An empty page ends the walk whatever the metadata says, so a server
+        // that keeps answering `hasMore` cannot spin forever.
+        if (page.length === 0) break;
+        if (res?.meta && !res.meta.hasMore) break;
+
+        // By rows received, not by `pageSize`: a server whose ceiling is lower
+        // than the page we asked for would otherwise skip everything it clamped.
+        offset += page.length;
+    }
+
+    return rows;
+}

package/src/data_export/export/index.ts

@@ -1,3 +1,4 @@
 export * from "./export";
+export * from "./fetch_export_data";
 export * from "./BasicExportAction";
 export * from "./ExportCollectionAction";