fix(dash0): the live demo's deep link, editing your own demo check, and the untranslated dashboard

CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## Unreleased
+
+
+### Bug Fixes
+
+* **demo:** the live demo's deep link now works from every address anyone would naturally write, and wins against a session you already have. `?demo=true` was only honoured on an organization-scoped login page (`/dash0/orgs/default/login?demo=true`) — the link that reads naturally, **`https://solidping.io/dash0/login?demo=true`**, dropped the flag and landed on an ordinary login form, as did `/dash0/?demo=true` and `/dash0/orgs/<anything>?demo=true`. All four now enter the demo on load, `1` and `true` alike, whatever organization the path happens to name. And the flag now outranks an existing session: following a demo link while signed into your own organization used to leave you in *your* dashboard, and following it while already in the demo dropped you on an organization the demo account is not a member of — a permission-denied page. Now the first re-enters the demo (your previous session is replaced, which is what the link asks for) and the second simply takes you there without signing in a second time. The canonical link is published in the documentation ([Try the live demo](https://solidping.io/docs/#try-the-live-demo))
+* **checks:** saving a check no longer rewrites its notification channels when you did not change them. Every save issued a "replace the bindings" call carrying exactly what was already stored — invisible for most people, but in the live demo that route is deliberately closed, so the no-op write was refused and took the whole edit down with it: renaming a check you had just created showed a red "this is the shared read-only live demo" toast and left you stuck on the form, *even though the rename had gone through*. The write now happens only when the selection actually differs, and a demo visitor is no longer offered the notification and dependency pickers they would only be refused. Editing a check you created in the demo now behaves like editing any other check
+* **dash0:** the check form and the incident page's Status updates, Notifications and "Published on" cards no longer switch back to English inside an otherwise-translated French, German or Spanish dashboard. Around 25 labels on the check form (its title, Identity & target, Enabled, Type, Notifications, Advanced, Cancel, the numeric default placeholders, and its interval/timeout validation messages) and every string on the incident page's status-update and notification cards were never wired up to a locale; the standalone status-update form had no translations at all
+* **demo:** the shared live demo's write refusal is now a single, localized message instead of three different costumes of the same English sentence. It used to surface as an untranslated blue toast on some pages, a second red banner underneath it on the check form, and a separate red toast on the status-page section dialog — and its wording ("editing your own checks is allowed") contradicted what a visitor saw when the server actually refused for *ownership* of a seeded check. There is now exactly one toast, translated into the dashboard's language, and the wording covers both cases. The check edit page also no longer lets a visitor fill out a form for a check they cannot save — it shows the same explanation and a Clone button, the way the check's detail page already did
+* **dash0:** the incident "Published on" panel and the status-page incident editor are translated too. The editor was almost entirely English — the autopilot notice, both card headers, the Title/Severity/Kind/Message labels, the severity and update-kind pickers, the timeline copy and its three toasts — and the state badge on both screens printed the raw value ("investigating", "monitoring") whatever language the dashboard was in. The severity and state labels now come from one shared helper, so a picker and the badge beside it can no longer disagree, and an unknown value coming from a newer server renders readably instead of leaking a translation key
+* **dash0:** the dashboard is now translated throughout. Around 500 strings across 55 components and pages still rendered English inside an otherwise French, German or Spanish dashboard — most of the check form (the database, mail, game, web, ClickHouse, infrastructure, messaging and network panels had no translations at all), the account device and OAuth consent pages, the status-page and integration forms, the notification detail page, the sidebar and the dashboard tiles. Relative timestamps ("just now", "3d ago") were English everywhere, as were the values in an incident's notification history. A further 129 strings looked translated but were not: they carried an English fallback and no entry in any locale file, so every language got the English. The private locations feature was entirely in that state. A new test now fails the build if a string is left that way again
+
 ## [0.25.1](https://github.com/fclairamb/solidping/compare/v0.25.0...v0.25.1) (2026-09-07)
 
 

server/internal/handlers/auth/demo_guard.go

@@ -9,9 +9,16 @@ import (
 // still do, so a curl user or a CLI reading only the JSON body understands why
 // a perfectly valid credential was refused (a bare "Forbidden" would read as a
 // permission bug).
-const DemoWriteMessage = "This is the shared read-only live demo. " +
-	"Creating and editing your own checks is allowed; everything else is not. " +
-	"Sign up for a free account to make changes."
+//
+// The wording has to be true for BOTH refusal paths that reuse it: the
+// route-level guard here (an endpoint entirely outside the allowlist) and the
+// ownership check in checks.ErrDemoReadOnly (an allowlisted endpoint refusing
+// because this particular check was not created by this session). "Only
+// checks you create here can be changed" covers both without contradicting
+// either — see the dashboard's localized org:demo.writeRefused key, which must
+// stay in sync with this string.
+const DemoWriteMessage = "This is the shared live demo. " +
+	"Only checks you create here can be changed — sign up free to change anything else."
 
 // Route patterns a demo session may write to. These are chi's RESOLVED route
 // patterns (httpx.RoutePattern), never raw request paths: matching on the raw