feat(plugin-import-export): adds new exportLimit, importLimit and per collection limit control (#15405)

This PR adds `exportLimit`, `importLimit` and per collection `limit`
control and fixes a few reported bugs around preview behaviour and data
exports to CSV and expands the test coverage to all fields except
uploads as those will be expanded upon in another PR. Some of these bugs
are reported directly, not on Github.

## New limits control

Adds new exportLimit, importLimit and per collection limit control so
you can force a limit per user if necessary for how many documents can
be exported or imported in a single operation. This allows you to
prevent certain users from causing excessive server/resource usage.

The config can be added top level to affect all operations or you can
override on a per collection and per operation level, defaults to 0
(unlimited).

```ts
importExportPlugin({
  exportLimit: ({ req }) => 500, // function with req
  importLimit: 100,  // hardcoded number
  collections: [
    {
      slug: 'posts',
      // per collection per operation overrides
      export: {
        limit: ({ req }) => 5,
      },
      import: {
        limit: 5,
      },
    },
  ],
}),
```

Bugs fixed:
- Timezones being wrongly exported without being selected (but date is
selected)
- Timezones being duplicated when selected
- `disableSave` and `format` having no effect on the collection's export
configuration

Chores:
- Removed an internal utility in favour of a `payload/shared` one
- Added new e2e tests for `format`
- Int tests for `point`, `checkbox`, `select`, `radio`, `email`,
`textarea` and `code`

Author: paulpopus

docs/plugins/import-export.mdx

@@ -55,12 +55,14 @@ export default config
 
 ## Options
 
-| Property                   | Type     | Description                                                                                                                 |
-| -------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------- |
-| `collections`              | array    | Collections to include Import/Export controls in. Array of collection configs with per-collection options. Defaults to all. |
-| `debug`                    | boolean  | If true, enables debug logging.                                                                                             |
-| `overrideExportCollection` | function | Function to override the default export collection. Receives `{ collection }` and returns modified collection config.       |
-| `overrideImportCollection` | function | Function to override the default import collection. Receives `{ collection }` and returns modified collection config.       |
+| Property                   | Type             | Description                                                                                                                 |
+| -------------------------- | ---------------- | --------------------------------------------------------------------------------------------------------------------------- |
+| `collections`              | array            | Collections to include Import/Export controls in. Array of collection configs with per-collection options. Defaults to all. |
+| `debug`                    | boolean          | If true, enables debug logging.                                                                                             |
+| `exportLimit`              | number\|function | Global maximum documents for export operations. Set to `0` for unlimited (default). Per-collection limits take precedence.  |
+| `importLimit`              | number\|function | Global maximum documents for import operations. Set to `0` for unlimited (default). Per-collection limits take precedence.  |
+| `overrideExportCollection` | function         | Function to override the default export collection. Receives `{ collection }` and returns modified collection config.       |
+| `overrideImportCollection` | function         | Function to override the default import collection. Receives `{ collection }` and returns modified collection config.       |
 
 ### Per-Collection Configuration
 
@@ -74,23 +76,25 @@ Each item in the `collections` array can have the following properties:
 
 ### ExportConfig Options
 
-| Property             | Type     | Description                                                     |
-| -------------------- | -------- | --------------------------------------------------------------- |
-| `batchSize`          | number   | Documents per batch during export. Default: `100`.              |
-| `disableDownload`    | boolean  | Disable download button for this collection.                    |
-| `disableJobsQueue`   | boolean  | Run exports synchronously for this collection.                  |
-| `disableSave`        | boolean  | Disable save button for this collection.                        |
-| `format`             | string   | Force format (`csv` or `json`) for this collection.             |
-| `overrideCollection` | function | Override the export collection config for this specific target. |
+| Property             | Type             | Description                                                                                      |
+| -------------------- | ---------------- | ------------------------------------------------------------------------------------------------ |
+| `batchSize`          | number           | Documents per batch during export. Default: `100`.                                               |
+| `disableDownload`    | boolean          | Disable download button for this collection.                                                     |
+| `disableJobsQueue`   | boolean          | Run exports synchronously for this collection.                                                   |
+| `disableSave`        | boolean          | Disable save button for this collection.                                                         |
+| `format`             | string           | Force format (`csv` or `json`) for this collection.                                              |
+| `limit`              | number\|function | Maximum documents to export. Set to `0` for unlimited (default). Overrides global `exportLimit`. |
+| `overrideCollection` | function         | Override the export collection config for this specific target.                                  |
 
 ### ImportConfig Options
 
-| Property               | Type     | Description                                                     |
-| ---------------------- | -------- | --------------------------------------------------------------- |
-| `batchSize`            | number   | Documents per batch during import. Default: `100`.              |
-| `defaultVersionStatus` | string   | Default status for imported docs (`draft` or `published`).      |
-| `disableJobsQueue`     | boolean  | Run imports synchronously for this collection.                  |
-| `overrideCollection`   | function | Override the import collection config for this specific target. |
+| Property               | Type             | Description                                                                                      |
+| ---------------------- | ---------------- | ------------------------------------------------------------------------------------------------ |
+| `batchSize`            | number           | Documents per batch during import. Default: `100`.                                               |
+| `defaultVersionStatus` | string           | Default status for imported docs (`draft` or `published`).                                       |
+| `disableJobsQueue`     | boolean          | Run imports synchronously for this collection.                                                   |
+| `limit`                | number\|function | Maximum documents to import. Set to `0` for unlimited (default). Overrides global `importLimit`. |
+| `overrideCollection`   | function         | Override the import collection config for this specific target.                                  |
 
 ### Example Configuration
 
@@ -102,6 +106,10 @@ export default buildConfig({
     importExportPlugin({
       debug: true,
 
+      // Global limits (0 = unlimited, which is the default)
+      exportLimit: 10000,
+      importLimit: 5000,
+
       // Override default export collection (e.g., add access control)
       // This will be used by all collections unless they further override the config
       overrideExportCollection: ({ collection }) => {
@@ -119,9 +127,11 @@ export default buildConfig({
           export: {
             format: 'csv',
             disableDownload: true,
+            limit: 1000, // Override global exportLimit for this collection
           },
           import: {
             defaultVersionStatus: 'draft',
+            limit: 500, // Override global importLimit for this collection
           },
         },
         {
@@ -134,6 +144,39 @@ export default buildConfig({
 })
 ```
 
+## Limiting Import and Export Size
+
+You can limit the number of documents that can be imported or exported in a single operation. This helps prevent DDOS-style abuse and protects server resources during large data operations.
+
+Limits can be set globally via `exportLimit` and `importLimit`, or per-collection using the `limit` option in export/import config. Per-collection limits take precedence over global limits. Set to `0` for unlimited (the default).
+
+### Dynamic Limits
+
+Limits can be a function that receives the request context, allowing dynamic limits based on user roles or other factors:
+
+```ts
+importExportPlugin({
+  // Dynamic global limit based on user role
+  exportLimit: ({ req }) => {
+    return req.user?.role === 'admin' ? 50000 : 1000
+  },
+
+  collections: [
+    {
+      slug: 'sensitive-data',
+      import: {
+        // Per-collection dynamic limit
+        limit: ({ req }) => {
+          if (req.user?.subscription === 'enterprise') return 100000
+          if (req.user?.subscription === 'pro') return 10000
+          return 1000
+        },
+      },
+    },
+  ],
+})
+```
+
 ## Collection-Specific Import and Export targets
 
 By default, the plugin creates a single `exports` collection and a single `imports` collection that handle all import/export operations across your enabled collections. However, you can create separate import and export targets for specific collections by overriding the collection slug.

packages/plugin-import-export/src/components/ExportPreview/index.scss

@@ -7,11 +7,23 @@
       margin-bottom: 10px;
     }
 
+    &__export-info {
+      display: flex;
+      flex-direction: column;
+      align-items: flex-end;
+      gap: 2px;
+    }
+
     &__export-count {
       font-size: var(--font-size-small);
       color: var(--theme-elevation-500);
     }
 
+    &__limit-capped {
+      font-size: var(--font-size-small);
+      color: var(--theme-warning-500);
+    }
+
     &__pagination {
       display: flex;
       align-items: center;

packages/plugin-import-export/src/components/ExportPreview/index.tsx

@@ -50,6 +50,7 @@ export const ExportPreview: React.FC = () => {
   })
   const [dataToRender, setDataToRender] = useState<any[]>([])
   const [exportTotalDocs, setExportTotalDocs] = useState<number>(0)
+  const [maxLimit, setMaxLimit] = useState<number | undefined>(undefined)
   const [columns, setColumns] = useState<Column[]>([])
   const { i18n, t } = useTranslation<
     PluginImportExportTranslations,
@@ -128,6 +129,7 @@ export const ExportPreview: React.FC = () => {
             hasNextPage,
             hasPrevPage,
             limit: responseLimit,
+            maxLimit: serverMaxLimit,
             page: responsePage,
             totalPages,
           }: ExportPreviewResponse = await res.json()
@@ -166,6 +168,7 @@ export const ExportPreview: React.FC = () => {
           }))
 
           setExportTotalDocs(serverExportTotalDocs)
+          setMaxLimit(serverMaxLimit)
           setPaginationData({
             hasNextPage,
             hasPrevPage,
@@ -224,17 +227,34 @@ export const ExportPreview: React.FC = () => {
           <Translation i18nKey="version:preview" t={t} />
         </h3>
         {exportTotalDocs > 0 && !isPending && (
-          <span className={`${baseClass}__export-count`}>
-            <Translation
-              // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-              // @ts-expect-error
-              i18nKey="plugin-import-export:documentsToExport"
-              t={t}
-              variables={{
-                count: exportTotalDocs,
-              }}
-            />
-          </span>
+          <div className={`${baseClass}__export-info`}>
+            <span className={`${baseClass}__export-count`}>
+              <Translation
+                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+                // @ts-expect-error
+                i18nKey="plugin-import-export:documentsToExport"
+                t={t}
+                variables={{
+                  count: exportTotalDocs,
+                }}
+              />
+            </span>
+            {typeof maxLimit === 'number' &&
+              maxLimit > 0 &&
+              typeof limit === 'number' &&
+              limit > maxLimit && (
+                <span className={`${baseClass}__limit-capped`}>
+                  <Translation
+                    // @ts-expect-error - plugin translations not typed
+                    i18nKey="plugin-import-export:limitCapped"
+                    t={t}
+                    variables={{
+                      limit: maxLimit,
+                    }}
+                  />
+                </span>
+              )}
+          </div>
         )}
       </div>
       {isPending && !dataToRender && (

packages/plugin-import-export/src/components/ImportPreview/index.tsx

@@ -16,7 +16,7 @@ import {
   useTranslation,
 } from '@payloadcms/ui'
 import { formatDocTitle } from '@payloadcms/ui/shared'
-import { fieldAffectsData } from 'payload/shared'
+import { fieldAffectsData, getObjectDotNotation } from 'payload/shared'
 import React, { useState, useTransition } from 'react'
 
 import type {
@@ -211,7 +211,7 @@ export const ImportPreview: React.FC = () => {
 
               // Skip if this field doesn't exist in any document
               const hasData = docs.some((doc) => {
-                const value = getValueAtPath(doc, fieldPath)
+                const value = getObjectDotNotation(doc, fieldPath)
                 return value !== undefined && value !== null
               })
 
@@ -225,7 +225,7 @@ export const ImportPreview: React.FC = () => {
                 field,
                 Heading: label,
                 renderedCells: docs.map((doc) => {
-                  const value = getValueAtPath(doc, fieldPath)
+                  const value = getObjectDotNotation(doc, fieldPath)
 
                   if (value === undefined || value === null) {
                     return null
@@ -626,18 +626,3 @@ export const ImportPreview: React.FC = () => {
     </div>
   )
 }
-
-// Helper function to get nested values
-const getValueAtPath = (obj: Record<string, unknown>, path: string): unknown => {
-  const segments = path.split('.')
-  let current: any = obj
-
-  for (const segment of segments) {
-    if (current === null || current === undefined) {
-      return undefined
-    }
-    current = current[segment]
-  }
-
-  return current
-}