fix problem with capability checking / displaying when parent not checked

internal/server/web/static/js/capabilities.js

@@ -61,6 +61,18 @@ function subtokenCapabilities(prefix = "") {
     return $('#' + prefix + 'subtokenCapabilities');
 }
 
+function enableCapability(cap, prefix = "") {
+    // This function should be called after initCapabilities to preselect / check capabilities
+    // We do it with a click instead of prop("checked", true) because click handles sub-/parent- capabilities correctly.
+    // We first set checked to false ensuring that it was not previously selected
+    let $c = $(prefixId(cap, prefix));
+    let disabled = $c.prop('disabled');
+    $c.prop('disabled', false);
+    $c.prop("checked", false);
+    $c.click();
+    $c.prop('disabled', disabled);
+}
+
 
 const rPrefix = "read@";
 
@@ -304,7 +316,7 @@ function checkCapability(cap, typePrefix, prefix = "") {
     if (rCap) {
         cap = cap.substring(rPrefix.length);
     }
-    $('#' + prefix + typePrefix + '-' + escapeSelector(cap)).prop("checked", true);
+    enableCapability(typePrefix + '-' + cap, prefix);
     let $mode = $('#' + prefix + typePrefix + '-' + escapeSelector(rPrefix + cap) + '-mode');
     let disabled = $mode.prop('disabled');
     $mode.prop('disabled', false);

internal/server/web/static/js/consent.js

@@ -9,13 +9,13 @@ $(document).ready(function () {
         rotationAutoRevoke().prop("disabled", !rot_onAT && !rot_onOther);
     }
     updateRotationIcon();
+    initCapabilities();
     checkedCapabilities.forEach(function (value) {
         checkCapability(value, 'cp');
     })
     checkedSubtokenCapabilities.forEach(function (value) {
         checkCapability(value, 'sub-cp');
     })
-    initCapabilities();
     chainFunctions(
         discovery,
         function (...next) {

internal/server/web/static/js/create-mt.js

@@ -15,9 +15,9 @@ const $mtInstructions = $('#mt-instructions');
 const mtPrefix = "createMT-";
 
 function initCreateMT(...next) {
-    capabilityAT(mtPrefix).prop('checked', true);
-    $('#' + mtPrefix + 'cp-tokeninfo').prop('checked', true);
     initCapabilities(mtPrefix);
+    checkCapability("tokeninfo", "cp", mtPrefix);
+    checkCapability("AT", "cp", mtPrefix);
     updateRotationIcon(mtPrefix);
     initRestr(mtPrefix);
     doNext(...next);

internal/server/web/static/js/ssh.js

@@ -41,6 +41,8 @@ disableGrantCallbacks['ssh'] = function disableSSHCallback() {
 function initSSH(...next) {
     initRestr();
     initCapabilities();
+    checkCapability("tokeninfo", "cp", mtPrefix);
+    checkCapability("AT", "cp", mtPrefix);
     clearSSHKeyTable();
     useSettingsToken(function (token) {
         $.ajax({

internal/server/web/static/js/tokeninfo.js

@@ -50,6 +50,7 @@ function fillTokenInfo(tokenPayload) {
     copy.removeClass('d-none');
 
     // capabilities
+    initCapabilities(tokeninfoPrefix);
     capabilityChecks(tokeninfoPrefix).prop("checked", false);
     subtokenCapabilityChecks(tokeninfoPrefix).prop("checked", false);
     for (let c of tokenPayload['capabilities']) {
@@ -60,11 +61,10 @@ function fillTokenInfo(tokenPayload) {
             checkCapability(c, 'sub-cp', tokeninfoPrefix);
         }
     }
-    initCapabilities(tokeninfoPrefix);
     capabilityChecks(tokeninfoPrefix).not(":checked").closest('.capability').hideB();
     subtokenCapabilityChecks(tokeninfoPrefix).not(":checked").closest('.capability').hideB();
-    capabilityChecks(tokeninfoPrefix).filter(":checked").closest('.capability').showB();
-    subtokenCapabilityChecks(tokeninfoPrefix).filter(":checked").closest('.capability').showB();
+    capabilityChecks(tokeninfoPrefix).filter(":checked").parents('.capability').showB();
+    subtokenCapabilityChecks(tokeninfoPrefix).filter(":checked").parents('.capability').showB();
 
     // rotation
     let rot = tokenPayload['rotation'] || {};