feat(identity): El Almacén de macOS no lista las identidades con clave en un token

rfirma-app/src-tauri/src/identity/application/certificates.rs

@@ -103,7 +103,9 @@ pub fn on_the_desktop(found: Vec<TokenCertificate>) -> Vec<TokenCertificate> {
 fn holders_only(found: Vec<TokenCertificate>) -> Vec<TokenCertificate> {
     found
         .into_iter()
-        .filter(|certificate| !certificate.is_an_authority())
+        .filter(|certificate| {
+            !certificate.is_an_authority() && !certificate.is_a_macos_token_identity()
+        })
         .collect()
 }
 
@@ -115,9 +117,12 @@ pub fn certificates_by_class(
 ) -> Vec<(StoreClass, usize)> {
     let mut counted: Vec<(StoreClass, usize)> = Vec::new();
     for store in stores {
-        let found = token
-            .list(store)
-            .map_or(0, |certificates| certificates.len());
+        let found = token.list(store).map_or(0, |certificates| {
+            certificates
+                .iter()
+                .filter(|certificate| !certificate.is_a_macos_token_identity())
+                .count()
+        });
         if found == 0 {
             continue;
         }

rfirma-app/src-tauri/src/identity/application/certificates/tests/macos_store.rs

@@ -121,3 +121,47 @@ fn without_a_card_the_macos_copy_is_the_one_behind_the_row() {
     assert_eq!(rows.len(), 1);
     assert_eq!(rows[0].store, StoreClass::Macos);
 }
+
+fn in_the_keychain_on_a_token(label: &str, der: &[u8]) -> TokenCertificate {
+    let certificate = in_the_keychain(label, der);
+    TokenCertificate::new(
+        certificate
+            .reference()
+            .clone()
+            .with_key_provider("com.apple.setoken:Card"),
+        der.to_vec(),
+    )
+}
+
+#[test]
+fn a_keychain_certificate_with_its_key_in_a_token_is_not_listed() {
+    let home = tempfile::tempdir().expect("deberia haber directorio temporal");
+    let found = [
+        in_the_keychain("EN-SOFTWARE", &TestAuthority::root("EN SOFTWARE").der()),
+        in_the_keychain_on_a_token("EN-TOKEN", &TestAuthority::root("EN TOKEN").der()),
+    ];
+
+    let rows = listed_on_the_mac(&found, &[the_macos_store()], home.path());
+
+    assert_eq!(rows.len(), 1);
+    assert_eq!(rows[0].store, StoreClass::Macos);
+}
+
+#[test]
+fn a_card_certificate_reaching_the_keychain_on_a_token_is_listed_once_by_pkcs11() {
+    let home = tempfile::tempdir().expect("deberia haber directorio temporal");
+    let der = TestAuthority::root("EIDAS CERTIFICADO PRUEBAS - 99999999R").der();
+    let found = [
+        a_copy_in(&Store::module(CARD), "COPIA-TARJETA", &der),
+        in_the_keychain_on_a_token("COPIA-LLAVERO", &der),
+    ];
+
+    let rows = listed_on_the_mac(
+        &found,
+        &[Store::module(CARD), the_macos_store()],
+        home.path(),
+    );
+
+    assert_eq!(rows.len(), 1);
+    assert_eq!(rows[0].store, StoreClass::Card);
+}

rfirma-app/src-tauri/src/identity/domain/certificate.rs

@@ -335,6 +335,12 @@ impl TokenCertificate {
         })
     }
 
+    /// Si es del Almacén de macOS con la clave en un token del sistema, que se queda para las tarjetas.
+    pub fn is_a_macos_token_identity(&self) -> bool {
+        self.reference().store().class() == StoreClass::Macos
+            && self.reference().key_provider().is_some()
+    }
+
     /// Si es de una autoridad, con `CA:TRUE`.
     pub fn is_an_authority(&self) -> bool {
         Certificate::from_der(&self.der).is_ok_and(|certificate| {