decidim-core 0.31.6 → 0.31.8

data/config/locales/tr-TR.yml

@@ -419,13 +419,9 @@ tr:
           affected_user:
             email_intro: '%{amendable_title}için bir ödeme kabul edildi. Bu sayfadan görebilirsiniz:'
             email_outro: Bu bildirimi aldınız, çünkü %{amendable_title}yazarı sizsiniz.
-            email_subject: '%{emendation_author_nickname}%{amendable_title} bir değişiklik kabul edildi'
-            notification_title: <a href="%{emendation_author_path}">%{emendation_author_nickname}</a> tarafından yaratılan <a href="%{emendation_path}">değişiklik</a> <a href="%{amendable_path}">%{amendable_title}</a>için kabul edilmiştir.
           follower:
             email_intro: '%{amendable_title}için bir ödeme kabul edildi. Bu sayfadan görebilirsiniz:'
             email_outro: Bu bildirimi, %{amendable_title}izlediğiniz için aldınız. Önceki bağlantıyı takip ederek bildirimleri almayı durdurabilirsiniz.
-            email_subject: '%{emendation_author_nickname}%{amendable_title} bir değişiklik kabul edildi'
-            notification_title: <a href="%{emendation_author_path}">%{emendation_author_nickname}</a> tarafından yaratılan <a href="%{emendation_path}">değişiklik</a> <a href="%{amendable_path}">%{amendable_title}</a>için kabul edilmiştir.
         amendment_created:
           affected_user:
             email_intro: '%{amendable_title}için yeni bir emendation oluşturuldu. Bu sayfadan görebilirsiniz:'
@@ -441,24 +437,16 @@ tr:
           affected_user:
             email_intro: '%{amendable_title} için reddedilen bir tahliye, bağımsız %{amendable_type} yükseltilmiştir. Bu sayfadan görebilirsiniz:'
             email_outro: Bu bildirimi aldınız, çünkü %{amendable_title} yazarı sizsiniz.
-            email_subject: '%{emendation_author_nickname} bir değişiklik yeni olarak yayınlandı %{amendable_type}'
-            notification_title: Bir <a href="%{emendation_path}">değişikliğini reddetmiştir</a> için <a href="%{amendable_path}">%{amendable_title}</a>, yeni olarak yayınlanmış %{amendable_type} ile <a href="%{emendation_author_path}">%{emendation_author_nickname}</a>.
           follower:
             email_intro: '%{amendable_title} için reddedilen bir tahliye, bağımsız %{amendable_type} yükseltilmiştir. Bu sayfadan görebilirsiniz:'
             email_outro: Bu bildirimi, %{amendable_title} izlediğiniz için aldınız. Önceki bağlantıyı takip ederek bildirimleri almayı durdurabilirsiniz.
-            email_subject: '%{emendation_author_nickname} bir değişiklik yeni olarak yayınlandı %{amendable_type}'
-            notification_title: Bir <a href="%{emendation_path}">değişikliğini reddetmiştir</a> için <a href="%{amendable_path}">%{amendable_title}</a>, yeni olarak yayınlanmış %{amendable_type} ile <a href="%{emendation_author_path}">%{emendation_author_nickname}</a>.
         amendment_rejected:
           affected_user:
             email_intro: 'Bir emendation %{amendable_title} için reddedildi. Bu sayfadan görebilirsiniz:'
             email_outro: Bu bildirimi aldınız, çünkü %{amendable_title} yazarı sizsiniz.
-            email_subject: Bir değişiklik %{emendation_author_nickname}%{amendable_title} için reddedildi
-            notification_title: <a href="%{emendation_path}">değişiklik</a> tarafından oluşturulan <a href="%{emendation_author_path}">%{emendation_author_nickname}</a> reddedildi <a href="%{amendable_path}">%{amendable_title}</a>.
           follower:
             email_intro: 'Bir emendation %{amendable_title} için reddedildi. Bu sayfadan görebilirsiniz:'
             email_outro: Bu bildirimi, %{amendable_title} izlediğiniz için aldınız. Önceki bağlantıyı takip ederek bildirimleri almayı durdurabilirsiniz.
-            email_subject: Bir değişiklik %{emendation_author_nickname}%{amendable_title} için reddedildi
-            notification_title: <a href="%{emendation_path}">değişiklik</a> tarafından oluşturulan <a href="%{emendation_author_path}">%{emendation_author_nickname}</a> reddedildi <a href="%{amendable_path}">%{amendable_title}</a>.
       attachments:
         attachment_created:
           email_intro: '%{resource_title} yeni bir belge eklendi. Bu sayfadan görebilirsiniz:'
@@ -489,12 +477,6 @@ tr:
           notification_title: |-
             Bir yönetici, %{resource_type}'nizi %{report_reasons} olarak bildirildiği için kaldırdı. </br>
             <i>%{resource_content} </i>
-      users:
-        profile_updated:
-          email_intro: <a href="%{resource_url}">profil sayfası</a> arasında %{name} (%{nickname} izlediğiniz), güncellendi.
-          email_outro: Bu bildirimi, %{nickname} izlediğiniz için aldınız. Önceki bağlantıyı takip ederek bildirimleri almayı durdurabilirsiniz.
-          email_subject: "%{nickname} profilini güncelledi"
-          notification_title: <a href="%{resource_path}">profil sayfası</a> arasında %{name} (%{nickname} izlediğiniz), güncellendi.
     export_mailer:
       download_your_data_export:
         download: İndir
@@ -986,8 +968,6 @@ tr:
     timestamp_error_message: Üzgünüm, bu çok hızlıydı! Lütfen yeniden gönderin.
   layouts:
     decidim:
-      announcements:
-        view_less: Daha Az Göster
       data_consent:
         details:
           columns:

data/config/locales/uk.yml

@@ -250,12 +250,6 @@ uk:
         email_intro: '"%{resource_title}" було оновлено. Ви можете переглянути його на сторінці:'
         email_outro: Ви отримали це сповіщення, тому що ви стежите за "%{resource_title}". Ви можете припинити стежити за ним, перейшовши за наведеним вище посиланням.
         email_subject: Оновлення до %{resource_title}
-      users:
-        profile_updated:
-          email_intro: Сторінка <a href="%{resource_url}">профілю</a> учасника %{name} (%{nickname}), за яким ви стежите, була оновлена.
-          email_outro: Ви отримали це сповіщення, тому що ви стежите за %{nickname}. Ви можете відписатися від цих сповіщень, перейшовши за наведеним вище посиланням.
-          email_subject: "%{nickname} оновив свій профіль"
-          notification_title: Сторінка <a href="%{resource_path}">профілю</a> учасника %{name} (%{nickname}), за яким ви стежите, була оновлена.
     export_mailer:
       download_your_data_export:
         download: Завантажити

data/config/locales/zh-CN.yml

@@ -351,13 +351,9 @@ zh-CN:
           affected_user:
             email_intro: '%{amendable_title}的修改已被接受。您可以从这个页面查看：'
             email_outro: 您收到此通知是因为您是 %{amendable_title} 的作者。
-            email_subject: 接受来自 %{amendable_title} 的 %{emendation_author_nickname} 修正案
-            notification_title: 由 <a href="%{emendation_author_path}">%{emendation_author_nickname}</a> 创建的 <a href="%{emendation_path}">修正</a> 已被接受 <a href="%{amendable_path}">%{amendable_title}</a>。
           follower:
             email_intro: '%{amendable_title}的修改已被接受。您可以从这个页面查看：'
             email_outro: 您收到此通知是因为您正在关注 %{amendable_title}。您可以停止收到跟随上一个链接的通知。
-            email_subject: 接受来自 %{amendable_title} 的 %{emendation_author_nickname} 修正案
-            notification_title: 由 <a href="%{emendation_author_path}">%{emendation_author_nickname}</a> 创建的 <a href="%{emendation_path}">修正</a> 已被接受 <a href="%{amendable_path}">%{amendable_title}</a>。
         amendment_created:
           affected_user:
             email_intro: '已经为 %{amendable_title}创建了一个新的版本。您可以从这个页面查看它：'
@@ -373,22 +369,16 @@ zh-CN:
           affected_user:
             email_intro: '%{amendable_title} 的被拒绝的修订已经发布为新的 %{amendable_type}。您可以从这个页面查看：'
             email_outro: 您收到此通知是因为您是 %{amendable_title} 的作者。
-            email_subject: 来自 %{emendation_author_nickname} 的修订已经发布为新的 %{amendable_type}
           follower:
             email_intro: '%{amendable_title} 的被拒绝的修订已经发布为新的 %{amendable_type}。您可以从这个页面查看：'
             email_outro: 您收到此通知是因为您正在关注 %{amendable_title}。您可以停止收到跟随上一个链接的通知。
-            email_subject: 来自 %{emendation_author_nickname} 的修订已经发布为新的 %{amendable_type}
         amendment_rejected:
           affected_user:
             email_intro: '%{amendable_title}的修订已被拒绝。您可以从这个页面查看：'
             email_outro: 您收到此通知是因为您是 %{amendable_title} 的作者。
-            email_subject: '%{amendable_title} 的 %{emendation_author_nickname} 修正案被拒绝'
-            notification_title: 由 <a href="%{emendation_author_path}">%{emendation_author_nickname}</a> 创建的 <a href="%{emendation_path}">项修正</a> 已被 <a href="%{amendable_path}">%{amendable_title}</a> 拒绝。
           follower:
             email_intro: '%{amendable_title}的修订已被拒绝。您可以从这个页面查看：'
             email_outro: 您收到此通知是因为您正在关注 %{amendable_title}。您可以停止收到跟随上一个链接的通知。
-            email_subject: '%{amendable_title} 的 %{emendation_author_nickname} 修正案被拒绝'
-            notification_title: 由 <a href="%{emendation_author_path}">%{emendation_author_nickname}</a> 创建的 <a href="%{emendation_path}">项修正</a> 已被 <a href="%{amendable_path}">%{amendable_title}</a> 拒绝。
       attachments:
         attachment_created:
           email_intro: '一个新文档已添加到 %{resource_title}。您可以从这个页面查看：'
@@ -411,12 +401,6 @@ zh-CN:
           email_outro: 您收到此通知是因为您在我们的网站上进行了活动。
         level_up:
           email_outro: 您收到此通知是因为您在我们的网站上进行了活动。
-      users:
-        profile_updated:
-          email_intro: 您关注的 %{name} (%{nickname}) 的 <a href="%{resource_url}">个人资料页面</a> 已经更新。
-          email_outro: 您收到此通知是因为您正在关注 %{nickname}。您可以停止收到跟随上一个链接的通知。
-          email_subject: "%{nickname} 更新了他们的个人资料"
-          notification_title: 您关注的 %{name} (%{nickname}) 的 <a href="%{resource_path}">个人资料页面</a> 已经更新。
     export_mailer:
       download_your_data_export:
         download: 下载

data/config/locales/zh-TW.yml

@@ -550,13 +550,9 @@ zh-TW:
           affected_user:
             email_intro: '已接受對於 %{amendable_title} 的修正案。您可以從此頁面中查看：'
             email_outro: 你收到此通知，是因為你是%{amendable_title} 的作者。
-            email_subject: 已接受對於 %{amendable_title} 的修正案，來自於 %{emendation_author_nickname}
-            notification_title: <a href="%{emendation_path}">修正案</a>由<a href="%{emendation_author_path}">%{emendation_author_nickname}</a>創建，已被接受適用於<a href="%{amendable_path}">%{amendable_title}</a>。
           follower:
             email_intro: '已接受對於 %{amendable_title} 的修正案。您可以從此頁面中查看：'
             email_outro: 您收到此通知，是因為您正在關注 %{amendable_title}。您可以使用上面的連結停止接收通知。
-            email_subject: 已接受對於 %{amendable_title} 的修正案，來自於 %{emendation_author_nickname}
-            notification_title: <a href="%{emendation_path}">修正案</a>由<a href="%{emendation_author_path}">%{emendation_author_nickname}</a>創建，已被接受適用於<a href="%{amendable_path}">%{amendable_title}</a>。
         amendment_created:
           affected_user:
             email_intro: '已為 %{amendable_title} 創建一個新的修正案。您可以從此頁面查看：'
@@ -572,24 +568,16 @@ zh-TW:
           affected_user:
             email_intro: '一個被拒絕的修正案已被發佈為新的 %{amendable_type}，針對 %{amendable_title}。您可以從此頁面查看：'
             email_outro: 你收到此通知，是因為你是%{amendable_title} 的作者。
-            email_subject: 來自 %{emendation_author_nickname} 的修正案已被發佈為新的 %{amendable_type}
-            notification_title: 一個<a href="%{emendation_path}">被拒絕的修正案</a>已由<a href="%{emendation_author_path}">%{emendation_author_nickname}</a>發佈為新的 %{amendable_type}，針對<a href="%{amendable_path}">%{amendable_title}</a>。
           follower:
             email_intro: '一個被拒絕的修正案已被發佈為新的 %{amendable_type}，針對 %{amendable_title}。您可以從此頁面查看：'
             email_outro: 您收到此通知，是因為您正在關注 %{amendable_title}。您可以使用上面的連結停止接收通知。
-            email_subject: 來自 %{emendation_author_nickname} 的修正案已被發佈為新的 %{amendable_type}
-            notification_title: 一個<a href="%{emendation_path}">被拒絕的修正案</a>已由<a href="%{emendation_author_path}">%{emendation_author_nickname}</a>發佈為新的 %{amendable_type}，針對<a href="%{amendable_path}">%{amendable_title}</a>。
         amendment_rejected:
           affected_user:
             email_intro: '一個修正案已被拒絕，針對 %{amendable_title}。您可以從此頁面查看：'
             email_outro: 你收到此通知，是因為你是%{amendable_title} 的作者。
-            email_subject: 修正案由 %{emendation_author_nickname} 提交，針對 %{amendable_title}，已被拒絕。
-            notification_title: <a href="%{emendation_path}">%{emendation_author_nickname}</a>創建的<a href="%{emendation_path}">修正案</a>已被拒絕，針對<a href="%{amendable_path}">%{amendable_title}</a>。
           follower:
             email_intro: '一個修正案已被拒絕，針對 %{amendable_title}。您可以從此頁面查看：'
             email_outro: 您收到此通知，是因為您正在關注 %{amendable_title}。您可以使用上面的連結停止接收通知。
-            email_subject: 修正案由 %{emendation_author_nickname} 提交，針對 %{amendable_title}，已被拒絕。
-            notification_title: <a href="%{emendation_path}">%{emendation_author_nickname}</a>創建的<a href="%{emendation_path}">修正案</a>已被拒絕，針對<a href="%{amendable_path}">%{amendable_title}</a>。
       attachments:
         attachment_created:
           email_intro: '已新增一個文件至 %{resource_title}。您可以從此頁面查看：'
@@ -626,16 +614,9 @@ zh-TW:
           notification_title: |-
             一位管理員因為 %{report_reasons} 的舉報，移除了您的%{resource_type}。</br> <i>%{resource_content}</i>
       users:
-        profile_updated:
-          email_intro: 你正在追蹤的 %{name}(%{nickname}) 的<a href="%{resource_path}">個人資料頁面</a>已被更新。
-          email_outro: 您收到此通知是因為您正在關注 %{nickname}。您可以點擊上方的連結停止接收通知。
-          email_subject: "%{nickname} 更新了他們的個人資料。"
-          notification_title: 你正在追蹤的 %{name}(%{nickname}) 的<a href="%{resource_path}">個人資料頁面</a>已被更新。
         user_officialized:
-          email_intro: 參與者 %{name} (%{nickname}) 已被官方認證。
           email_outro: 您收到此通知是因為您是該組織的管理員。
           email_subject: "%{name} 已被官方認證。"
-          notification_title: 參與者 %{name} (%{nickname}) 已被官方認證。
     export_mailer:
       download_your_data_export:
         download: 下載

data/db/migrate/20250217192438_convert_user_groups_into_users.rb

@@ -33,8 +33,8 @@ class ConvertUserGroupsIntoUsers < ActiveRecord::Migration[7.0]
   def up
     User.old_group.find_each do |group|
       if group.email.blank? || another_user_with_same_email_in_organization?(group)
-        group.update_attribute(:email, "user_group_#{group.id}@#{group.organization.host}.invalid")
         group.update_attribute(:extended_data, (group.extended_data || {}).merge("patched" => true, "previous_email" => group.email))
+        group.update_attribute(:email, "user_group_#{group.id}@#{group.organization.host}.invalid")
 
         group.reload
       end
@@ -49,7 +49,8 @@ class ConvertUserGroupsIntoUsers < ActiveRecord::Migration[7.0]
     User.new_group.find_each do |group|
       group.update_attribute(:officialized_at, nil)
       group.update_attribute(:type, "Decidim::UserGroup")
-      group.update_attribute(:extended_data, (group.extended_data || {}).except("group"))
+      group.update_attribute(:email, group.extended_data["previous_email"]) if group.extended_data["previous_email"].present?
+      group.update_attribute(:extended_data, (group.extended_data || {}).except("group", "patched", "previous_email"))
     end
   end
   # rubocop:enable Rails/SkipsModelValidations

data/db/migrate/20260909000000_add_failed_attempts_and_locked_at_to_decidim_authorizations.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+class AddFailedAttemptsAndLockedAtToDecidimAuthorizations < ActiveRecord::Migration[7.0]
+  def change
+    add_column :decidim_authorizations, :failed_attempts, :integer, default: 0, null: false
+    add_column :decidim_authorizations, :locked_at, :datetime
+  end
+end

data/decidim-core.gemspec

@@ -74,6 +74,9 @@ Gem::Specification.new do |s|
   s.add_dependency "premailer-rails", "~> 1.10"
   s.add_dependency "rack", "~> 2.2", ">= 2.2.8.1"
   s.add_dependency "rack-attack", "~> 6.0"
+  # Workaround until shakapacker releases a new version compatible with rack-proxy v1.0
+  # @see https://github.com/shakacode/shakapacker/issues/1220
+  s.add_dependency "rack-proxy", "~> 0.8.3", "< 1.0"
   s.add_dependency "rails", "~> 7.2.0", ">= 7.2.2.2"
   s.add_dependency "rails-i18n", "~> 7.0"
   s.add_dependency "ransack", "~> 4.2.0"

data/lib/decidim/core/test/shared_examples/amendable/amendment_event_examples.rb

@@ -8,7 +8,7 @@ shared_examples "amendment event" do
   it_behaves_like "a simple event email"
   it_behaves_like "a simple event notification"
 
-  let(:emendation_author_nickname) { "@#{emendation.creator_author.nickname}" }
+  let(:emendation_author_name) { emendation.creator_author.name }
   let(:emendation_path) { Decidim::ResourceLocatorPresenter.new(emendation).path }
   let(:emendation_author_path) { Decidim::UserPresenter.new(emendation.creator_author).profile_path }
   let(:amendable_path) { Decidim::ResourceLocatorPresenter.new(amendable).path }
@@ -16,5 +16,5 @@ shared_examples "amendment event" do
   let(:email_intro) { "An amendment has been #{amendment_type} for #{amendable_title}. You can see it from this page:" }
   let(:email_outro) { "You have received this notification because you are following #{amendable_title}. You can stop receiving notifications following the previous link." }
 
-  let(:notification_title) { "The <a href=\"#{emendation_path}\">amendment</a> created by <a href=\"#{emendation_author_path}\">#{emendation_author_nickname}</a> has been #{amendment_type} for <a href=\"#{amendable_path}\">#{amendable_title}</a>." } # rubocop:disable Layout/LineLength
+  let(:notification_title) { "The <a href=\"#{emendation_path}\">amendment</a> created by <a href=\"#{emendation_author_path}\">#{emendation_author_name}</a> has been #{amendment_type} for <a href=\"#{amendable_path}\">#{amendable_title}</a>." } # rubocop:disable Layout/LineLength
 end

data/lib/decidim/core/test/shared_examples/amendable/amendment_promoted_event_examples.rb

@@ -10,15 +10,15 @@ shared_examples "amendment promoted event" do
   it_behaves_like "a simple event email"
   it_behaves_like "a simple event notification"
 
-  let(:emendation_author_nickname) { "@#{emendation.creator_author.nickname}" }
+  let(:emendation_author_name) { emendation.creator_author.name }
   let(:emendation_path) { Decidim::ResourceLocatorPresenter.new(emendation).path }
   let(:emendation_author_path) { Decidim::UserPresenter.new(emendation.creator_author).profile_path }
   let(:amendable_path) { Decidim::ResourceLocatorPresenter.new(amendable).path }
 
-  let(:email_subject) { "An amendment from #{emendation_author_nickname} has been published as a new proposal" }
+  let(:email_subject) { "An amendment from #{emendation_author_name} has been published as a new proposal" }
   let(:email_intro) { "A rejected amendment for #{amendable_title} has been published as a new #{amendable_type}. You can see it from this page:" }
   let(:email_outro) { "You have received this notification because you are following #{amendable_title}. You can stop receiving notifications following the previous link." }
   # rubocop:disable Layout/LineLength
-  let(:notification_title) { "A <a href=\"#{emendation_path}\">rejected amendment</a> for <a href=\"#{amendable_path}\">#{amendable_title}</a> has been published as a new #{amendable_type} by <a href=\"#{emendation_author_path}\">#{emendation_author_nickname}</a>." }
+  let(:notification_title) { "A <a href=\"#{emendation_path}\">rejected amendment</a> for <a href=\"#{amendable_path}\">#{amendable_title}</a> has been published as a new #{amendable_type} by <a href=\"#{emendation_author_path}\">#{emendation_author_name}</a>." }
   # rubocop:enable Layout/LineLength
 end

data/lib/decidim/core/test/shared_examples/comments_examples.rb

@@ -147,6 +147,16 @@ shared_examples "comments" do
       expect(page).to have_css(".comment-thread")
     end
 
+    it "opens the login modal when clicking the comment button" do
+      visit resource_path
+
+      expect(page).to have_no_css("#loginModal-content", visible: :visible)
+
+      find(".add-comment-mobile").click
+
+      expect(page).to have_css("#loginModal-content", visible: :visible)
+    end
+
     context "when user visit a mobile browser" do
       before do
         driven_by(:iphone)
@@ -176,6 +186,22 @@ shared_examples "comments" do
       expect(page).to have_css(".add-comment form")
     end
 
+    it "does not show login modal when clicking the comment button" do
+      visit resource_path
+
+      find("a.add-comment-mobile").click
+
+      expect(page).to have_no_css("#loginModal-content", visible: :visible)
+    end
+
+    it "guides the user to the comment form when clicking the comment button" do
+      visit resource_path
+
+      find("a.add-comment-mobile").click
+
+      expect(page).to have_css("#add-comment-anchor")
+    end
+
     context "when user visit a computer browser" do
       before do
         switch_to_host(organization.host)

data/lib/decidim/core/test/shared_examples/has_space_in_mcell_examples.rb

@@ -8,7 +8,8 @@ shared_examples_for "has space in m-cell" do
     let(:show_space) { true }
 
     it "renders the space where the model belongs to" do
-      expect(cell_html).to have_content(decidim_escape_translated(model.component.participatory_space.title))
+      expect(cell_html).to have_content(translated_attribute(model.component.participatory_space.title))
+      expect(cell_html.to_s).to include(decidim_escape_translated(model.component.participatory_space.title).gsub(""", "\""))
     end
   end
 end

data/lib/decidim/core/test/shared_examples/participatory_space_members_page_examples.rb

@@ -42,5 +42,82 @@ shared_examples "participatory space members page examples" do
         end
       end
     end
+
+    context "when participatory space has paginated members" do
+      let(:users) { create_list(:user, 30, organization: privatable_to.organization) }
+      let!(:members) do
+        users.map do |user|
+          create(:participatory_space_private_user, privatable_to:, user:, published: true)
+        end
+      end
+
+      context "with default pagination" do
+        it "returns first page with 25 members" do
+          get :index, params: { slug_param => slug, :locale => I18n.locale }
+
+          expect(assigns(:members).count).to eq(25)
+          expect(assigns(:members).current_page).to eq(1)
+          expect(assigns(:members).total_count).to eq(30)
+        end
+      end
+
+      context "with page parameter" do
+        it "returns second page with remaining members" do
+          get :index, params: { slug_param => slug, :locale => I18n.locale, :page => 2 }
+
+          expect(assigns(:members).count).to eq(5)
+          expect(assigns(:members).current_page).to eq(2)
+          expect(assigns(:members).total_count).to eq(30)
+        end
+
+        it "returns empty collection for out-of-range page" do
+          get :index, params: { slug_param => slug, :locale => I18n.locale, :page => 999 }
+
+          expect(assigns(:members).count).to eq(0)
+          expect(assigns(:members).current_page).to eq(999)
+          expect(assigns(:members).total_count).to eq(30)
+        end
+      end
+
+      context "with per_page parameter" do
+        it "returns all members when per_page is 50" do
+          get :index, params: { slug_param => slug, :locale => I18n.locale, :per_page => 50 }
+
+          expect(assigns(:members).count).to eq(30)
+          expect(assigns(:members).current_page).to eq(1)
+          expect(assigns(:members).limit_value).to eq(50)
+          expect(assigns(:members).total_count).to eq(30)
+        end
+
+        it "returns first 25 members when per_page is 25" do
+          get :index, params: { slug_param => slug, :locale => I18n.locale, :per_page => 25 }
+
+          expect(assigns(:members).count).to eq(25)
+          expect(assigns(:members).limit_value).to eq(25)
+        end
+
+        it "limits per_page to maximum allowed value" do
+          get :index, params: { slug_param => slug, :locale => I18n.locale, :per_page => 200 }
+
+          expect(assigns(:members).limit_value).to eq(100)
+        end
+
+        it "limit per_page to minimum allowed value" do
+          get :index, params: { slug_param => slug, :locale => I18n.locale, :per_page => 5 }
+
+          expect(assigns(:members).limit_value).to eq(25)
+        end
+      end
+
+      context "with both page and per_page parameters" do
+        it "returns correct page with custom per_page" do
+          get :index, params: { slug_param => slug, :locale => I18n.locale, :page => 2, :per_page => 50 }
+
+          expect(assigns(:members).count).to eq(0)
+          expect(assigns(:members).current_page).to eq(2)
+          expect(assigns(:members).limit_value).to eq(50)
+        end
+      end
+    end
   end
 end

data/lib/decidim/core/test/shared_examples/participatory_space_members_shared_examples.rb

@@ -3,8 +3,16 @@
 shared_examples "participatory space members" do
   let(:blocks_manifests) { [] }
   let(:organization) { create(:organization) }
-  let(:user) { create(:user, organization: participatory_space.organization) }
+  let(:user) { create(:user, :confirmed, organization: participatory_space.organization) }
   let(:unpublished_user) { create(:user, organization: participatory_space.organization) }
+  # A visitor allowed to reach the space homepage even when the space is
+  # private (e.g. an organization admin). Homepage checks use it so that they
+  # inspect the actual homepage instead of a redirect target.
+  let(:allowed_visitor) { create(:user, :admin, :confirmed, organization: participatory_space.organization) }
+  # Spaces whose members page is not publicly accessible (e.g. private
+  # participatory processes) require a logged in member. Host specs can opt in
+  # by overriding this to true.
+  let(:login_as_member) { false }
 
   before do
     switch_to_host(organization.host)
@@ -17,10 +25,15 @@ shared_examples "participatory space members" do
   end
 
   context "when there are no members and accessing from the space homepage" do
+    before do
+      login_as allowed_visitor, scope: :user
+    end
+
     context "and the main data content block is disabled" do
       it "the menu nav is not shown" do
         visit participatory_space_homepage_path
 
+        expect(page).to have_current_path participatory_space_homepage_path
         expect(page).to have_no_css(".participatory-space__nav-container")
       end
     end
@@ -31,6 +44,7 @@ shared_examples "participatory space members" do
       it "the menu link is not shown" do
         visit participatory_space_homepage_path
 
+        expect(page).to have_current_path participatory_space_homepage_path
         expect(page).to have_no_content("Members")
       end
     end
@@ -44,7 +58,7 @@ shared_examples "participatory space members" do
 
   context "when there are some members and all are unpublished" do
     before do
-      create(:member, user:, participatory_space:, published: false)
+      create(:participatory_space_private_user, user:, privatable_to: participatory_space, published: false)
     end
 
     context "and directly accessing from URL" do
@@ -54,10 +68,15 @@ shared_examples "participatory space members" do
     end
 
     context "and accessing from the homepage" do
+      before do
+        login_as allowed_visitor, scope: :user
+      end
+
       context "and the main data content block is disabled" do
         it "the menu nav is not shown" do
           visit participatory_space_homepage_path
 
+          expect(page).to have_current_path participatory_space_homepage_path
           expect(page).to have_no_css(".participatory-space__nav-container")
         end
       end
@@ -68,6 +87,7 @@ shared_examples "participatory space members" do
         it "the menu link is not shown" do
           visit participatory_space_homepage_path
 
+          expect(page).to have_current_path participatory_space_homepage_path
           expect(page).to have_no_content("Members")
         end
       end
@@ -75,10 +95,11 @@ shared_examples "participatory space members" do
   end
 
   context "when there are some published members" do
-    let!(:member) { create(:member, user:, participatory_space:, published: true) }
-    let!(:unpublished_member) { create(:member, user: unpublished_user, participatory_space:, published: false) }
+    let!(:member) { create(:participatory_space_private_user, user:, privatable_to: participatory_space, published: true) }
+    let!(:unpublished_member) { create(:participatory_space_private_user, user: unpublished_user, privatable_to: participatory_space, published: false) }
 
     before do
+      login_as(member.user, scope: :user) if login_as_member
       visit members_path
     end
 
@@ -107,9 +128,9 @@ shared_examples "participatory space members" do
       end
 
       it "lists all the members" do
-        within ".layout-main__section" do
+        within "#assembly_members-grid" do
           expect(page).to have_css(".profile__user", count: 1)
-          expect(page).to have_no_content(Decidim::ParticipatorySpace::MemberPresenter.new(unpublished_member).name)
+          expect(page).to have_no_content(Decidim::ParticipatorySpacePrivateUserPresenter.new(unpublished_member).name)
         end
 
         click_on(member.name)
@@ -117,5 +138,63 @@ shared_examples "participatory space members" do
         expect(page).to have_content("Profile")
       end
     end
+
+    context "when there are more members than the pagination per_page limit" do
+      let(:per_page) { Decidim::Paginable::OPTIONS.first }
+      let(:users) { create_list(:user, per_page + 5, organization: participatory_space.organization) }
+      let!(:extra_members) do
+        users.map do |user|
+          create(:participatory_space_private_user, privatable_to: participatory_space, user:, published: true)
+        end
+      end
+
+      before do
+        visit members_path
+      end
+
+      it "paginates the members list" do
+        within "#assembly_members-grid" do
+          expect(page).to have_css(".profile__user", count: per_page)
+        end
+      end
+
+      it "shows pagination controls" do
+        within("div[data-pagination]") do
+          expect(page).to have_css('nav[aria-label="Pagination"]')
+        end
+      end
+
+      it "navigates to the next page" do
+        within "nav[aria-label=\"Pagination\"]" do
+          click_on "Next"
+        end
+
+        within "#assembly_members-grid" do
+          expect(page).to have_css(".profile__user", count: 6)
+        end
+      end
+
+      it "maintains pagination when navigating back" do
+        within "nav[aria-label=\"Pagination\"]" do
+          click_on "Next"
+        end
+
+        within "nav[aria-label=\"Pagination\"]" do
+          click_on "Prev"
+        end
+
+        within "#assembly_members-grid" do
+          expect(page).to have_css(".profile__user", count: per_page)
+        end
+      end
+
+      it "shows the correct page number in the URL" do
+        within "nav[aria-label=\"Pagination\"]" do
+          click_on "Next"
+        end
+
+        expect(page).to have_current_path(/page=2/)
+      end
+    end
   end
 end

data/lib/decidim/core/test/shared_examples/resource_liked_event_examples.rb

@@ -30,7 +30,7 @@ shared_examples_for "resource liked event" do
 
   describe "email_subject" do
     it "is generated correctly" do
-      expect(subject.email_subject).to eq("#{author_presenter.nickname} has performed a new like")
+      expect(subject.email_subject).to eq("#{author_presenter.name} has performed a new like")
     end
   end
 
@@ -38,7 +38,7 @@ shared_examples_for "resource liked event" do
     let(:resource_title) { decidim_sanitize_translated(resource.title) }
     it "is generated correctly" do
       expect(subject.email_intro)
-        .to eq("#{author.name} #{author_presenter.nickname}, who you are following, " \
+        .to eq("#{author.name}, who you are following, " \
                "has just liked \"#{resource_title}\" and we think it may be interesting to you. Check it out and contribute:")
     end
   end
@@ -51,7 +51,7 @@ shared_examples_for "resource liked event" do
         .to include("The <a href=\"#{resource_path}\">#{resource_title}</a> #{resource_type} has been liked by ")
 
       expect(subject.notification_title)
-        .to include("<a href=\"/profiles/#{author.nickname}\">#{author.name} #{author_presenter.nickname}</a>.")
+        .to include("<a href=\"/profiles/#{author.nickname}\">#{author.name}</a>.")
     end
   end
 

data/lib/decidim/core/test/shared_examples/versions_controller_examples.rb

@@ -28,7 +28,7 @@ shared_examples "a version of a hidden object" do
   end
 end
 
-shared_examples "versions controller" do
+shared_context "versions controller resource" do
   let(:base_params) do
     if resource.is_a?(Decidim::Participable)
       { :"#{resource.model_name.singular_route_key}_slug" => resource.slug }
@@ -45,6 +45,10 @@ shared_examples "versions controller" do
       request.env["decidim.current_component"] = resource.component
     end
   end
+end
+
+shared_examples "versions controller" do
+  include_context "versions controller resource"
 
   describe "GET show" do
     context "with an existing version" do
@@ -64,3 +68,21 @@ shared_examples "versions controller" do
     end
   end
 end
+
+# The versions of a resource must be readable with the same `:read` permission
+# as the resource itself. This ensures that a resource that is hidden, private,
+# deleted or unpublished cannot be reached through its versions.
+#
+# Requires a `resource` that is not readable through its public `:read`
+# permission.
+shared_examples "versions controller denying unreadable resources" do
+  include_context "versions controller resource"
+
+  it "does not expose the versions" do
+    get :show, params: base_params.merge(id: 1)
+
+    expect(response).not_to have_http_status(:ok)
+  rescue ActiveRecord::RecordNotFound
+    # The resource is filtered out before the permission is evaluated.
+  end
+end

data/lib/decidim/core/version.rb

@@ -4,7 +4,7 @@ module Decidim
   # This holds the decidim-core version.
   module Core
     def self.version
-      "0.31.6"
+      "0.31.8"
     end
   end
 end