feature: pki.extended_key_usages adds custom extended key usages by their OIDs, which templates give by name, and a template's policies put certificate policy OIDs into its certificates.

debian-package/src/usr/lib/vpn-router/web

@@ -781,10 +781,11 @@ def backup(method, path, body):
 def ca(method, path, body):
     """Answer a /ca request with vpnrouter_pki: the HTTP status and the JSON document.
 
-      GET  /ca                                  {"settings", "templates", "status", "certificates"}: the pki section,
-                                                the templates with the built-in ones, the root, the issuing CAs, the
-                                                retired CAs and the warnings (vpnrouter_pki.status), and the
-                                                certificates issued, newest first
+      GET  /ca                                  {"settings", "templates", "extended_key_usages", "status",
+                                                "certificates"}: the pki section, the templates with the built-in
+                                                ones, the extended key usages, each {oid, builtin}, the root, the
+                                                issuing CAs, the retired CAs and the warnings (vpnrouter_pki.status),
+                                                and the certificates issued, newest first
       PUT  /ca                                  change any of the settings of the pki section
       POST /ca/certificates                     issue a certificate: {"ca", "template", "csr"} answers {"serial",
                                                 "certificate", "chain"}; {"ca", "template", "subject", "sans",
@@ -811,6 +812,8 @@ def ca(method, path, body):
             return 200, vpnrouter_pki.bundle(route[2])
         if route == ('GET',):
             return 200, {'settings': cfg['pki'], 'templates': vpnrouter.pki_templates(cfg),
+                         'extended_key_usages': {name: {'oid': oid, 'builtin': name in vpnrouter.EXTENDED_KEY_USAGES}
+                                                 for name, oid in vpnrouter.extended_key_usages(cfg).items()},
                          'status': vpnrouter_pki.status(cfg), 'certificates': vpnrouter_pki.certificates()}
         if route == ('PUT',):
             settings = {option: body[option] for option in vpnrouter.SCHEMA['pki'] if option in body}