Close XCA parity gaps: advanced extensions, CA/revocation UI, imports, ZIP export, E2E

README.md

@@ -83,12 +83,20 @@ explicit/mandatory DN entries, default key type/size, default validity).
   CRL distribution points, authority information access, name constraints,
   certificate policies, policy constraints, inhibit-any-policy, OCSP no-check,
   TLS feature (OCSP stapling), Netscape legacy extensions and raw
-  OID/DER extensions. OpenSSL config text is available on export.
+  OID/DER extensions. The SPA exposes typed controls for the common and
+  advanced extensions plus an advanced JSON editor for raw/less common
+  extensions, and a server-side **Validate extensions** action. OpenSSL config
+  text is available on export.
 - Certificate details show subject/issuer, serial, validity, signatures,
   MD5/SHA-1/SHA-256 fingerprints, parsed extensions, OpenSSL validation
   errors, purposes and the issuer chain.
 - Renew with a new or kept serial, optionally revoke/replace the old
-  certificate. Revoke with a reason; manage the CA's revocation list manually.
+  certificate. Revoke with a reason; manage the CA's revocation list manually,
+  including revocation dates and invalidity dates. CA properties (CRL days and
+  default signing template, including built-ins) are editable from the CA
+  detail page.
+- Absolute validity dates and XCA's "no well-defined expiration" mode are
+  supported alongside duration-based validity.
 - Transform certificates to a public key, a CSR or a template.
 - Export PEM, PEM chain, PEM+key, PEM+encrypted PKCS#8, PKCS#7, PKCS#7 chain,
   DER, PKCS#12, PKCS#12 chain, OpenVPN, OpenSSL config, certificate index,
@@ -113,7 +121,11 @@ server-side.
 
 - Paste PEM or upload files: PEM bundles, DER certificates/requests/CRLs/keys,
   PKCS#7, PKCS#12, SSH keys and XCA templates.
-- Preview imports before committing; duplicates are skipped.
+- Preview imports with per-item selection before committing; duplicates are
+  skipped by default.
+- Dump a whole vault as a ZIP (`POST /api/vaults/{id}/export`): manifest,
+  certificate/request/CRL PEM, public keys and optionally encrypted private
+  keys.
 - Import XCA SQLite `.xdb` databases (schema 7/8): software keys, certificates,
   requests, CRLs, revocations, authorities and templates. PKCS#11 token items
   are skipped, and private keys encrypted with individual passwords are only
@@ -133,10 +145,10 @@ OpenAPI JSON is at `/api/openapi.json`; Swagger UI at `/api/docs`.
 | Area | Endpoints |
 |---|---|
 | Identity | `GET /api/health`, `GET /api/me`, `GET /api/auth/providers`, `GET/POST/DELETE /api/tokens` |
-| Vaults | `GET/POST /api/vaults`, `GET/PATCH/DELETE /api/vaults/{id}`, `GET/PATCH /api/vaults/{id}/settings`, `GET /api/vaults/{id}/summary`, `GET /api/vaults/{id}/options`, `GET /api/vaults/{id}/search` |
+| Vaults | `GET/POST /api/vaults`, `GET/PATCH/DELETE /api/vaults/{id}`, `GET/PATCH /api/vaults/{id}/settings`, `GET /api/vaults/{id}/summary`, `GET /api/vaults/{id}/options`, `GET /api/vaults/{id}/search`, `POST /api/vaults/{id}/export` |
 | Keys | `GET/POST /api/vaults/{id}/keys`, `GET/PATCH/DELETE .../keys/{key_id}`, `POST .../keys/{key_id}/export` |
 | Requests | `GET/POST /api/vaults/{id}/requests`, `GET/PATCH/DELETE .../{id}`, `POST .../{id}/export`, `POST .../{id}/transform/open-key`, `POST .../{id}/transform/template` |
-| Certificates | `GET/POST /api/vaults/{id}/certificates`, `GET/PATCH/DELETE .../{id}`, `POST .../{id}/export`, `POST .../{id}/renew`, `POST .../{id}/revoke`, `GET/PATCH .../{id}/ca`, `GET/POST .../{id}/revocations`, `PATCH/DELETE .../revocations/{rev_id}`, `POST .../{id}/crl`, `POST .../{id}/tls-auth`, transforms |
+| Certificates | `GET/POST /api/vaults/{id}/certificates`, `POST /api/vaults/{id}/certificates/preview`, `GET/PATCH/DELETE .../{id}`, `POST .../{id}/export`, `POST .../{id}/renew`, `POST .../{id}/revoke`, `GET/PATCH .../{id}/ca`, `GET/POST .../{id}/revocations`, `PATCH/DELETE .../revocations/{rev_id}`, `POST .../{id}/crl`, `POST .../{id}/tls-auth`, transforms |
 | CRLs | `GET /api/vaults/{id}/crls`, `GET/DELETE .../{crl_id}`, `POST .../{crl_id}/export` |
 | Templates | `GET/POST /api/vaults/{id}/templates`, `GET/PATCH/DELETE .../{template_id}`, `POST .../{template_id}/apply`, `POST .../{template_id}/export` |
 | Import | `POST /api/vaults/{id}/import` (`dry_run`, `selected`, `xca_db`) |
@@ -159,6 +171,18 @@ uv run mypy -p kca.core -p kca
 Tests run in-process with in-memory sqlite, the in-memory session store and a
 fake OIDC user, exactly like the spendwise reference app.
 
+Browser end-to-end tests (from the repository root, with the Compose stack up):
+
+```sh
+cd e2e
+npm install
+npx playwright install chromium
+npm test
+```
+
+They use Playwright Chromium. Set `KCA_BASE_URL` to target another port, e.g.
+`KCA_BASE_URL=http://localhost:8083 npm test`. See `e2e/README.md`.
+
 Frontend (from `web/`, with the backend running on `:8080`):
 
 ```sh
@@ -189,6 +213,7 @@ web/
   src/components/      # nav, toast, shared UI
   src/{api,auth,model,dom}.rs
   pwa/                 # manifest + app-shell assets
+e2e/                   # Playwright browser suite (Node)
 ```
 
 ## Limits
@@ -202,7 +227,8 @@ web/
   output is not available. Legacy inputs are imported when the library
   supports them.
 - XCA's OpenSSL-config "Advanced" text editor is replaced by typed extension
-  fields plus raw OID/DER rows. OpenSSL config remains an export format.
+  fields plus an advanced JSON editor carrying raw OID/DER and other less
+  common extensions. OpenSSL config remains an export format.
 - The PWA service worker is intentionally not registered: certificate and key
   data must never be served stale from a cache. The manifest and icons are
   still available for installation.