spree_core 5.6.0 → 5.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 94ccab22a509de44665fb66add2dccdd315ac57a6d377320c9ab758fc1a7db1e
-  data.tar.gz: 17dd4678e3435b928d8b03e2045de1f1e53f3b5cd6589cf89008272e1286f09e
+  metadata.gz: 102686daa285991fed8a91b768781fb7a3433411ffbc854cd2ef758c8c8687c7
+  data.tar.gz: 3c17b1e08025e190848c4699a5e6bbef00a66314b91054092d44c22971e3dbd2
 SHA512:
-  metadata.gz: 850e850532de4436f179e4703ea1903e2e59512191c23369a7505650aad1988de58977127ee8aa78be9f8d831b1e61e835bb0ad7a3bce1bdc5460a11124d7458
-  data.tar.gz: b7adf2ce0ccb80a24c11c98a007ce3f334fbfcebea342e1bb811d407e19b90753512d45c9ebb2959c0d18aee492a1737bd0db5a3878c9a29d00c32a646568a39
+  metadata.gz: 24354241aa89fcd8129c48e6ffacb1325334a17d6bc65d7481e3a8c0a7816365f7a73d9fd853831bcbe20a4373697be39c8e49f666d41d52409bd78d170575c1
+  data.tar.gz: 7a11fb6dd5229cab6f45019d3ba94b2820c1a00a477ce13efdf9bf5e0af819cc40df37179caded829a169706de110bcf5cebdc8371dee704fe1d9cbaaf897750

data/app/jobs/spree/imports/process_group_job.rb

@@ -25,6 +25,12 @@ module Spree
         import = Spree::Import.find(import_id)
         Spree::Current.store = import.store
 
+        process_group(import, row_ids)
+      end
+
+      private
+
+      def process_group(import, row_ids)
         with_store_content_locale(import.store) do
           mappings = import.mappings.mapped.to_a
           schema_fields = import.schema_fields
@@ -33,40 +39,53 @@ module Spree
           started_at = Time.current
           processed_rows = []
 
-          row_ids.each_slice(ROWS_BATCH_SIZE) do |ids|
-            # Skip rows already completed on a prior attempt so retries don't double-process them.
-            rows = import.rows.where(id: ids).pending_and_failed.order(:row_number).to_a
-            # Share the already-loaded import across rows: each row's processor reads
-            # `row.import` (store, ability, lookup cache), and without this every row
-            # lazily loads its own Import instance and rebuilds all of that per row.
-            rows.each { |row| row.association(:import).target = import }
-
-            if large
-              Spree::Events.disable do
-                rows.each { |row| row.bulk_process!(mappings: mappings, schema_fields: schema_fields) }
-              end
-            elsif grouped
-              # A group is one product plus its variants: per-record lifecycle
-              # events (variant.created, price.created, product.updated per
-              # touch) are noise to subscribers — one product event is published
-              # for the whole group below. import_row.* events still flow.
-              Spree::Events.disable_lifecycle do
-                rows.each { |row| row.process!(mappings: mappings, schema_fields: schema_fields) }
-              end
-            else
-              rows.each do |row|
-                row.process!(mappings: mappings, schema_fields: schema_fields)
+          skipping_row_events(import) do
+            row_ids.each_slice(ROWS_BATCH_SIZE) do |ids|
+              # Skip rows already completed on a prior attempt so retries don't double-process them.
+              rows = import.rows.where(id: ids).pending_and_failed.order(:row_number).to_a
+              # Share the already-loaded import across rows: each row's processor reads
+              # `row.import` (store, ability, lookup cache), and without this every row
+              # lazily loads its own Import instance and rebuilds all of that per row.
+              rows.each { |row| row.association(:import).target = import }
+
+              if large
+                Spree::Events.disable do
+                  rows.each { |row| row.bulk_process!(mappings: mappings, schema_fields: schema_fields) }
+                end
+              elsif grouped
+                # A group is one product plus its variants: per-record lifecycle
+                # events (variant.created, price.created, product.updated per
+                # touch) are noise to subscribers — one product event is published
+                # for the whole group below. import_row.* events still flow.
+                Spree::Events.disable_lifecycle do
+                  rows.each { |row| row.process!(mappings: mappings, schema_fields: schema_fields) }
+                end
+              else
+                rows.each do |row|
+                  row.process!(mappings: mappings, schema_fields: schema_fields)
+                end
               end
+              processed_rows.concat(rows)
             end
-            processed_rows.concat(rows)
+
+            publish_group_events(processed_rows, started_at) if grouped
           end
 
-          publish_group_events(processed_rows, started_at) if grouped
+          # Outside `skipping_row_events` on purpose: the import's own
+          # lifecycle (`import.progress`, `import.completed`) is a handful of
+          # events per run and stays observable even for seeded data.
           check_import_completion(import, large)
         end
       end
 
-      private
+      # Seeded catalogs (sample/demo data) shouldn't reach webhooks or
+      # analytics. Scoped to the rows: the import's own lifecycle events stay
+      # observable.
+      def skipping_row_events(import, &block)
+        return Spree::Events.disable(&block) if import.preferred_skip_events
+
+        block.call
+      end
 
       # One event per product touched by this group: `product.created` when the
       # product came into existence during this run, `product.updated` otherwise

data/app/jobs/spree/imports/process_rows_job.rb

@@ -23,6 +23,14 @@ module Spree
         end
       end
 
+      # Inline callers need the group finished before `perform` returns; the
+      # group job's completion bookkeeping works either way.
+      def dispatch_group(import, row_ids)
+        return ProcessGroupJob.perform_now(import.id, row_ids) if import.preferred_inline
+
+        ProcessGroupJob.perform_later(import.id, row_ids)
+      end
+
       def dispatch_grouped(import, file_column)
         groups = Hash.new { |h, k| h[k] = [] }
 
@@ -48,7 +56,7 @@ module Spree
           updated_at: Time.current
         )
 
-        batches.each { |row_ids| ProcessGroupJob.perform_later(import.id, row_ids) }
+        batches.each { |row_ids| dispatch_group(import, row_ids) }
       end
 
       def dispatch_batched(import)
@@ -64,7 +72,7 @@ module Spree
           updated_at: Time.current
         )
 
-        row_id_batches.each { |row_ids| ProcessGroupJob.perform_later(import.id, row_ids) }
+        row_id_batches.each { |row_ids| dispatch_group(import, row_ids) }
       end
     end
   end

data/app/models/concerns/spree/metafield_filterable.rb

@@ -0,0 +1,162 @@
+# frozen_string_literal: true
+
+module Spree
+  # Resolves `cf_*` custom-field predicates (e.g. +cf_custom_material_i_cont+)
+  # into scopes. Ransack has no such attributes, so callers split them out of a
+  # filter hash with {with_metafield_filters} before handing the rest to
+  # Ransack. Lives on the model rather than in a SearchProvider so every
+  # consumer — the search providers, CSV export, any other Ransack entry
+  # point — resolves the same vocabulary.
+  module MetafieldFilterable
+    extend ActiveSupport::Concern
+
+    # Arel comparison methods for numeric predicates.
+    NUMERIC_OPERATORS = {
+      'eq' => :eq,
+      'gt' => :gt,
+      'gteq' => :gteq,
+      'lt' => :lt,
+      'lteq' => :lteq
+    }.freeze
+
+    # Wraps a value in the LIKE pattern its predicate implies.
+    LIKE_PATTERNS = {
+      'cont' => ->(value) { "%#{value}%" },
+      'i_cont' => ->(value) { "%#{value}%" },
+      'start' => ->(value) { "#{value}%" },
+      'end' => ->(value) { "%#{value}" }
+    }.freeze
+
+    class_methods do
+      # Applies every `cf_*` predicate in +filters+ and returns the resulting
+      # scope alongside the filters Ransack should still handle. Predicates
+      # that don't apply (unknown key, wrong type, unparseable value) are
+      # dropped rather than raising, so a stale bookmarked filter degrades to
+      # "no filter" instead of a 500.
+      #
+      # @param filters [Hash]
+      # @param schema [Spree::SearchProvider::MetafieldSchema, nil]
+      # @return [Array(ActiveRecord::Relation, Hash)] scoped relation + remaining filters
+      def with_metafield_filters(filters, schema: nil)
+        return [all, filters] if filters.blank?
+        # Skip the schema's DB query entirely for the common case of a filter
+        # hash with no custom-field predicates at all.
+        return [all, filters] unless filters.any? { |key, _| key.to_s.start_with?('cf_') }
+
+        schema ||= Spree::SearchProvider::MetafieldSchema.new
+        scope = all
+
+        remaining = filters.reject do |key, value|
+          parsed = schema.parse_filter(key)
+          next false unless parsed
+
+          condition = metafield_filter_condition(parsed[:definition], parsed[:predicate], value)
+          scope = scope.where(condition) if condition
+          true
+        end
+
+        [scope, remaining]
+      end
+
+      # One EXISTS / NOT EXISTS subquery per predicate — composes with other
+      # filters without duplicating rows the way a join would.
+      #
+      # @param definition [Spree::MetafieldDefinition]
+      # @param predicate [String]
+      # @param value [Object]
+      # @return [Arel::Nodes::Node, nil] nil when the value is unusable
+      def metafield_filter_condition(definition, predicate, value)
+        case predicate
+        when 'present'
+          metafield_exists(definition)
+        when 'blank'
+          metafield_exists(definition).not
+        else
+          value_condition = metafield_value_condition(definition.field_type, predicate, value)
+          value_condition && metafield_exists(definition, value_condition)
+        end
+      end
+
+      # Type-casts a metafield value column so numeric fields compare
+      # numerically rather than lexicographically. Public because metafield
+      # sorting in Spree::SearchProvider::Database applies the same cast to a
+      # differently-aliased join.
+      #
+      # @param column [Arel::Attributes::Attribute] value column
+      # @param field_type [String]
+      # @return [Arel::Nodes::Node] castable expression
+      def metafield_value_expression(column, field_type)
+        return column unless field_type == 'number'
+
+        Arel::Nodes::NamedFunction.new('CAST', [column.as(metafield_numeric_cast_type)])
+      end
+
+      private
+
+      # `CAST(... AS <type>)` target for numeric metafield comparisons. SQLite
+      # has no DECIMAL affinity and PostgreSQL rejects MySQL's precision form,
+      # so the type is per-adapter.
+      def metafield_numeric_cast_type
+        case connection.adapter_name
+        when /PostgreSQL/i then 'numeric'
+        when /Mysql|Trilogy/i then 'DECIMAL(30, 10)'
+        else 'REAL'
+        end
+      end
+
+      # `EXISTS (SELECT 1 FROM spree_metafields WHERE …)` correlated against
+      # this model's rows, optionally narrowed by a value condition.
+      def metafield_exists(definition, value_condition = nil)
+        metafields = metafield_filter_table
+        subquery = Arel::SelectManager.new(metafields).
+                   project(Arel.sql('1')).
+                   where(metafields[:resource_type].eq(name)).
+                   where(metafields[:resource_id].eq(arel_table[primary_key])).
+                   where(metafields[:metafield_definition_id].eq(definition.id))
+
+        subquery = subquery.where(value_condition) if value_condition
+
+        # `.ast`, not the SelectManager — Exists adds its own parentheses, and
+        # a manager contributes a second set, yielding invalid `EXISTS ((…))`.
+        Arel::Nodes::Exists.new(subquery.ast)
+      end
+
+      # Aliased so the correlated subquery can't collide with an outer join on
+      # the same table (metafield sorting joins it as `sort_cf`).
+      def metafield_filter_table
+        @metafield_filter_table ||= Spree::Metafield.arel_table.alias('filter_cf')
+      end
+
+      def metafield_value_condition(field_type, predicate, value)
+        column = metafield_filter_table[:value]
+
+        if field_type == 'number'
+          operator = NUMERIC_OPERATORS[predicate]
+          return nil unless operator
+
+          numeric = begin
+            BigDecimal(value.to_s)
+          rescue ArgumentError, TypeError
+            return nil
+          end
+
+          metafield_value_expression(column, field_type).public_send(operator, numeric)
+        elsif (pattern = LIKE_PATTERNS[predicate])
+          escaped = sanitize_sql_like(value.to_s)
+          # LIKE is already case-insensitive under MySQL's default collation
+          # and for ASCII on SQLite, but not on PostgreSQL — lower both sides
+          # so `i_cont` behaves the same everywhere.
+          if predicate == 'i_cont'
+            column.lower.matches(pattern.call(escaped.downcase), nil, true)
+          else
+            column.matches(pattern.call(escaped), nil, true)
+          end
+        elsif predicate == 'eq'
+          column.eq(value.to_s)
+        elsif predicate == 'not_eq'
+          column.not_eq(value.to_s)
+        end
+      end
+    end
+  end
+end

data/app/models/concerns/spree/stores/setup.rb

@@ -52,8 +52,13 @@ module Spree
         (setup_tasks_done / setup_tasks_total.to_f * 100).to_i
       end
 
+      # Payments count as set up only once customers can actually pay at
+      # storefront checkout: admin-only (back_end) methods and store credit
+      # don't complete the task.
+      #
+      # @return [Boolean]
       def payment_method_setup?
-        payment_methods.active.where.not(type: Spree::PaymentMethod::StoreCredit.to_s).any?
+        payment_methods.active.storefront_visible.where.not(type: Spree::PaymentMethod::StoreCredit.to_s).any?
       end
 
       # A storefront counts as set up once the merchant has saved the storefront

data/app/models/spree/base.rb

@@ -92,6 +92,41 @@ class Spree::Base < ApplicationRecord
     api_type
   end
 
+  # `.api_type` for an STI `type` column value, without instantiating the
+  # subclass — use this in serializers instead of `record.class.api_type`,
+  # which reports the *loaded* class and so returns the base type for a record
+  # read through the parent (a plain `Spree::Export` row, a factory that sets
+  # `type` as an attribute, a query on the base relation).
+  #
+  # Resolves against `available_types` where the class defines it, so an
+  # unrecognized column value passes through untouched rather than being
+  # constantized.
+  #
+  # @param type [String, nil] value of the STI `type` column
+  # @return [String]
+  def self.api_type_for(type)
+    return api_type if type.blank?
+
+    type = type.to_s
+    return type unless respond_to?(:available_types)
+
+    available_types.find { |klass| klass.to_s == type }&.api_type || type
+  end
+
+  # Shorthand for a *polymorphic* `*_type` column (`owner_type`,
+  # `viewable_type`, …), where the value names an arbitrary model rather than a
+  # subclass of the serialized one — so `api_type_for`'s registry lookup does
+  # not apply. Demodulizes and underscores the same way `api_type` does, giving
+  # `"Spree::Product"` => `"product"`.
+  #
+  # @param type [String, Class, nil] value of the polymorphic type column
+  # @return [String, nil]
+  def self.polymorphic_api_type(type)
+    return nil if type.blank?
+
+    type.to_s.demodulize.underscore
+  end
+
   def self.to_tom_select_json
     pluck(:name, :id).map do |name, id|
       {

data/app/models/spree/channel/gating.rb

@@ -14,10 +14,10 @@ module Spree
       STOREFRONT_ACCESS = %w[public prices_hidden login_required].freeze
 
       included do
-        # Empty -> falls back to the Store-level preference. `guest_checkout` is
-        # `nullable` so a blank write stays nil (inherit) rather than coercing to
-        # false, while an explicit true/false remains a channel override.
-        preference :storefront_access, :string, default: nil
+        # Empty -> falls back to the Store-level preference. Both are `nullable`
+        # so a blank write stays nil (inherit) rather than coercing to "" or
+        # false, while an explicit value remains a channel override.
+        preference :storefront_access, :string, default: nil, nullable: true
         preference :guest_checkout, :boolean, default: nil, nullable: true
 
         validate :storefront_access_must_be_valid

data/app/models/spree/export.rb

@@ -138,12 +138,20 @@ module Spree
     end
 
     def records_to_export
-      if search_params.present?
-        params = search_params.is_a?(String) ? JSON.parse(search_params.to_s).to_h : search_params
-        scope.ransack(decode_prefixed_id_filters(params))
-      else
-        scope.ransack
-      end.result
+      return scope.ransack.result if search_params.blank?
+
+      params = search_params.is_a?(String) ? JSON.parse(search_params.to_s).to_h : search_params
+      params = decode_prefixed_id_filters(params)
+
+      # `cf_*` custom-field predicates aren't Ransack attributes — resolve them
+      # first so an export of a filtered list matches what the admin sees.
+      filtered_scope, params = if scope.respond_to?(:with_metafield_filters)
+                                scope.with_metafield_filters(params)
+                              else
+                                [scope, params]
+                              end
+
+      filtered_scope.ransack(params).result
     end
 
     # Replace any prefixed IDs in `search_params` with their raw DB IDs so

data/app/models/spree/import.rb

@@ -7,6 +7,15 @@ module Spree
     include Spree::NumberIdentifier
     include Spree::Core::NumberGenerator.new(prefix: 'IM')
 
+    # Where the downloadable example CSVs are served from — see `sample_csv_url`.
+    #
+    # Pinned to the installed version's tag rather than `main`: whether a type
+    # *has* an example is answered by the local `db/sample_data`, so pointing
+    # elsewhere would let a released install link to a newer, incompatible
+    # schema (or a file that has since been removed).
+    SAMPLE_DATA_BASE_URL_TEMPLATE =
+      'https://raw.githubusercontent.com/spree/spree/refs/tags/v%<version>s/spree/core/db/sample_data'.freeze
+
     publishes_lifecycle_events
 
     # Set event prefix for all Import subclasses
@@ -88,11 +97,58 @@ module Spree
     # Preferences
     #
     preference :delimiter, :string, default: ','
+    # Run the pipeline in-process instead of enqueuing it. For rake tasks, seeds
+    # and the console, where the caller needs the data to exist when the call
+    # returns and there may be no worker attached. Never set it from a request:
+    # a large CSV blocks for minutes.
+    #
+    # A preference, not a virtual attribute, so it survives the `Import.find`
+    # each processing job does — otherwise every job would have to take (and
+    # forward) an `inline:` argument.
+    preference :inline, :boolean, default: false
+    # Suppress the events the *rows* publish — a `product.created` per imported
+    # product, plus `import_row.*`. The import's own `import.*` events still
+    # fire: a handful per import is useful, thousands from a seeded catalog are
+    # not.
+    #
+    # For seeding demo or sample data, where subscribers would otherwise deliver
+    # webhooks and analytics for a catalog nobody actually created. A preference
+    # rather than a virtual attribute because the processing jobs each reload
+    # the record, so it has to outlive the enqueue. Independent of `inline`: a
+    # background import can still be silent, and an inline one observed.
+    preference :skip_events, :boolean, default: false
     # Absolute URL of the dashboard's imports view, captured at create and
     # validated against the store's allowed origins — the import-done email
     # links back to it. Blank for legacy-admin or app-created imports.
     preference :results_url, :string, default: nil
 
+    # Publicly downloadable example CSV for this import's type, or nil when the
+    # type has no sample file. Resolved from the `type` column rather than the
+    # instance's class, so it works on a record built as the base
+    # `Spree::Import` with `type` assigned (which is how the admin's new-import
+    # form builds it).
+    #
+    # @return [String, nil]
+    def sample_csv_url
+      self.class.available_types.find { |klass| klass.to_s == type.to_s }&.sample_csv_url
+    end
+
+    # Header-only CSV for this import's schema — the blank counterpart to
+    # `sample_csv_url`. One line, so callers can inline it (e.g. as a `data:`
+    # URI) instead of round-tripping to the server for it.
+    #
+    # @return [String]
+    def template_csv
+      ::CSV.generate_line(schema_fields.map { |field| field[:name] })
+    end
+
+    # Suggested filename for `template_csv`, e.g. "products_import_template.csv".
+    #
+    # @return [String]
+    def template_csv_filename
+      "#{self.class.api_type_for(type)}_import_template.csv"
+    end
+
     # Returns true if the import has more rows than the large import threshold.
     # Large imports skip per-row UI broadcasts and use bulk processing.
     # @return [Boolean]
@@ -289,12 +345,18 @@ module Spree
     # Creates rows asynchronously
     # @return [void]
     def create_rows_async
+      # The 2s delay lets the attachment settle before the job reads it; running
+      # inline there is nothing to wait for.
+      return Spree::Imports::CreateRowsJob.perform_now(id) if preferred_inline
+
       Spree::Imports::CreateRowsJob.set(wait: 2.seconds).perform_later(id)
     end
 
     # Processes rows asynchronously
     # @return [void]
     def process_rows_async
+      return Spree::Imports::ProcessRowsJob.perform_now(id) if preferred_inline
+
       Spree::Imports::ProcessRowsJob.perform_later(id)
     end
 
@@ -360,6 +422,36 @@ module Spree
         to_s.demodulize.underscore.to_sym
       end
 
+      # Publicly downloadable example CSV for this import type — the same file
+      # `rake spree:load_sample_data` feeds through this very pipeline, so it is
+      # a working example rather than a hand-maintained sample that can drift
+      # from the schema.
+      #
+      # Whether a type *has* an example is answered by `db/sample_data` itself,
+      # so adding or removing a CSV there needs no change here; a type with no
+      # sample file returns nil and the UI omits the link. The URL is pinned to
+      # the installed version's tag so the file served always matches the schema
+      # that check was made against.
+      #
+      # @return [String, nil]
+      def sample_csv_url
+        return nil if self == Spree::Import
+        return nil unless Spree::Core::Engine.root.join('db', 'sample_data', sample_csv_filename).exist?
+
+        [sample_data_base_url, sample_csv_filename].join('/')
+      end
+
+      # @return [String]
+      def sample_data_base_url
+        format(SAMPLE_DATA_BASE_URL_TEMPLATE, version: Spree.version)
+      end
+
+      # eg. Spree::Imports::ProductTranslations => "product_translations.csv"
+      # @return [String]
+      def sample_csv_filename
+        "#{api_type}.csv"
+      end
+
       # eg. Spree::Imports::Orders => Spree::Order
       def model_class
         return Spree.user_class if to_s == 'Spree::Imports::Customers'

data/app/models/spree/metafield.rb

@@ -21,6 +21,17 @@ module Spree
     # in OpenAPI (string-array form was added in typelizer 0.10.0).
     FIELD_TYPE_TOKENS = TYPE_TOKENS.keys.freeze
 
+    # Whether MetafieldDefinition may enable `searchable` / `sortable` for this
+    # STI type. Used only by definition validations (not by SearchProvider
+    # indexing). Defaults to false; subclasses override (e.g. ShortText).
+    def self.searchable?
+      false
+    end
+
+    def self.sortable?
+      false
+    end
+
     has_prefix_id :cf
 
     #

data/app/models/spree/metafield_definition/search_capabilities.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+module Spree
+  class MetafieldDefinition
+    module SearchCapabilities
+      extend ActiveSupport::Concern
+
+      included do
+        attribute :searchable, :boolean, default: false
+        attribute :sortable, :boolean, default: false
+
+        validate :search_sort_capabilities_compatible_with_type
+        validate :filter_key_must_be_unique
+
+        scope :searchable, -> { where(searchable: true) }
+        scope :sortable, -> { where(sortable: true) }
+      end
+
+      class_methods do
+        # @return [Array<String>] API field_type tokens whose STI class is searchable
+        def searchable_field_type_tokens
+          @searchable_field_type_tokens ||= build_field_type_tokens(&:searchable?)
+        end
+
+        # @return [Array<String>] API field_type tokens whose STI class is sortable
+        def sortable_field_type_tokens
+          @sortable_field_type_tokens ||= build_field_type_tokens(&:sortable?)
+        end
+
+        private
+
+        # Builds API tokens from {Spree::MetafieldDefinition.available_types}
+        # (`Spree.metafields.types` — in-memory registry, not a DB query).
+        def build_field_type_tokens(&block)
+          available_types.filter_map do |klass|
+            next unless block.call(klass)
+
+            Spree::Metafield::TYPE_CLASS_TO_TOKEN[klass.to_s] || klass.to_s
+          end
+        end
+      end
+
+      # Public identifier for sorting and filtering product listings by this
+      # custom field (+sort=cf_specs_material+,
+      # +q[cf_specs_material_i_cont]=wool+).
+      #
+      # @return [String] e.g. +cf_custom_label+
+      def filter_key
+        "cf_#{namespace}_#{key}"
+      end
+
+      private
+
+      # `key` is already unique per (resource_type, namespace), but both
+      # segments normalize to underscored slugs, so two different splits
+      # ("a_b"/"c" vs "a"/"b_c") flatten to one filter_key — which would make
+      # one of them unaddressable as a sort/filter param.
+      def filter_key_must_be_unique
+        return if namespace.blank? || key.blank? || resource_type.blank?
+        return unless new_record? || namespace_changed? || key_changed? || resource_type_changed?
+
+        table = self.class.arel_table
+        concatenated = Arel::Nodes::NamedFunction.new(
+          'CONCAT', [table[:namespace], Arel::Nodes.build_quoted('_'), table[:key]]
+        )
+
+        scope = self.class.
+                for_resource_type(resource_type).
+                where(concatenated.eq("#{namespace}_#{key}")).
+                where(self.class.spree_base_uniqueness_scope.index_with { |attr| public_send(attr) })
+        scope = scope.where.not(id: id) if persisted?
+
+        errors.add(:key, :taken) if scope.exists?
+      end
+
+      def metafield_type_class
+        metafield_type.presence&.safe_constantize
+      end
+
+      def search_sort_capabilities_compatible_with_type
+        return unless searchable? || sortable?
+
+        klass = metafield_type_class
+        return if klass.nil?
+
+        %i[searchable sortable].each do |capability|
+          next unless public_send("#{capability}?")
+          next if klass.public_send("#{capability}?")
+
+          errors.add(capability, capability_error_message(capability))
+        end
+      end
+
+      def capability_error_message(capability)
+        labels = self.class
+                     .public_send("#{capability}_field_type_tokens")
+                     .map { |token| token.tr('_', ' ') }
+                     .join(', ')
+
+        "is only supported for field types: #{labels}"
+      end
+    end
+  end
+end

data/app/models/spree/metafield_definition.rb

@@ -3,6 +3,7 @@ module Spree
     has_prefix_id :cfdef
 
     include Spree::DisplayOn
+    include Spree::MetafieldDefinition::SearchCapabilities
 
     DISPLAY = [:both, :back_end]
 
@@ -49,7 +50,7 @@ module Spree
     #
     # Ransack
     #
-    self.whitelisted_ransackable_attributes = %w[key namespace name resource_type display_on]
+    self.whitelisted_ransackable_attributes = %w[key namespace name resource_type display_on searchable sortable]
     self.whitelisted_ransackable_scopes = %w[search multi_search]
 
     # API naming bridge — internal columns rename in 6.0. `label` matches