simplfy logic

Signed-off-by: Javier Rodriguez <javier@chainloop.dev>

Author: javirln

app/cli/cmd/config_save.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2023-2025 The Chainloop Authors.
+// Copyright 2023-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -30,8 +30,12 @@ func newConfigSaveCmd() *cobra.Command {
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			// Process CA flags - read file contents and encode to base64 if needed
-			processCAFlag(confOptions.controlplaneCA)
-			processCAFlag(confOptions.CASCA)
+			if err := processCAFlag(confOptions.controlplaneCA); err != nil {
+				return err
+			}
+			if err := processCAFlag(confOptions.CASCA); err != nil {
+				return err
+			}
 			return viper.WriteConfig()
 		},
 	}

app/cli/cmd/root.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024-2025 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -125,8 +125,8 @@ func NewRootCmd(l zerolog.Logger) *cobra.Command {
 			}
 
 			if caValue := viper.GetString(confOptions.controlplaneCA.viperKey); caValue != "" {
-				// Check if it's a file path or base64/PEM content
-				if grpcconn.IsFilePath(caValue) {
+				// Check if the value is a file path, if it is we read the content and encode it to base64, if not we assume it's the content already
+				if _, err := os.Stat(caValue); err == nil {
 					opts = append(opts, grpcconn.WithCAFile(caValue))
 				} else {
 					opts = append(opts, grpcconn.WithCAContent(caValue))
@@ -503,23 +503,23 @@ func getConfigDir(appName string) string {
 }
 
 // processCAFlag reads CA file content and encodes it to base64 if value is a file path
-func processCAFlag(opt *confOpt) {
+func processCAFlag(opt *confOpt) error {
 	value := viper.GetString(opt.viperKey)
 	if value == "" {
-		return
+		return nil
 	}
 
 	// If it's a file path, read and encode
-	if grpcconn.IsFilePath(value) {
+	if _, err := os.Stat(value); err == nil {
 		content, err := os.ReadFile(value)
 		if err != nil {
-			// Log warning but don't fail
-			logger.Warn().Err(err).Str("file", value).Msg("Failed to read CA file")
-			return
+			return fmt.Errorf("failed to read CA file %s: %w", value, err)
 		}
 
 		// Store base64-encoded content in viper (will be persisted by config save)
 		encoded := base64.StdEncoding.EncodeToString(content)
 		viper.Set(opt.viperKey, encoded)
 	}
+
+	return nil
 }

app/cli/pkg/action/action.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024-2025 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -142,8 +142,8 @@ func getCASBackend(ctx context.Context, client pb.AttestationServiceClient, work
 
 	opts := []grpcconn.Option{grpcconn.WithInsecure(casConnectionInsecure)}
 	if casCAPath != "" {
-		// Check if it's a file path or base64/PEM content
-		if grpcconn.IsFilePath(casCAPath) {
+		// Check if it's a file path or content. If it's a file path, it should exist. If not, treat it as content.
+		if _, err := os.Stat(casCAPath); err == nil {
 			opts = append(opts, grpcconn.WithCAFile(casCAPath))
 		} else {
 			opts = append(opts, grpcconn.WithCAContent(casCAPath))

pkg/grpcconn/grpcconn.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024-2025 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -21,7 +21,6 @@ import (
 	"encoding/base64"
 	"fmt"
 	"os"
-	"strings"
 
 	grpc_retry "github.com/grpc-ecosystem/go-grpc-middleware/retry"
 	"google.golang.org/grpc"
@@ -177,30 +176,3 @@ func (t tokenAuth) GetRequestMetadata(_ context.Context, _ ...string) (map[strin
 func (t tokenAuth) RequireTransportSecurity() bool {
 	return !t.insecure
 }
-
-// IsFilePath checks if a value looks like a file path (vs base64/PEM content).
-// It returns true if the value appears to be a file path, false if it appears to be content.
-func IsFilePath(value string) bool {
-	// Check if value looks like a file path
-	// If it starts with /, ./, ../, or ~/, it's a path
-	// If it contains a newline, it's likely PEM content
-	// If it's valid base64 without path separators, assume it's content
-
-	if strings.HasPrefix(value, "/") ||
-		strings.HasPrefix(value, "./") ||
-		strings.HasPrefix(value, "../") ||
-		strings.HasPrefix(value, "~/") {
-		return true
-	}
-
-	if strings.Contains(value, "\n") {
-		return false // PEM content
-	}
-
-	// Check if file exists
-	if _, err := os.Stat(value); err == nil {
-		return true
-	}
-
-	return false
-}

pkg/grpcconn/grpcconn_test.go

@@ -20,7 +20,6 @@ import (
 	"crypto/x509"
 	"encoding/base64"
 	"os"
-	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -54,68 +53,6 @@ func TestRequireTransportSecurity(t *testing.T) {
 	}
 }
 
-func TestIsFilePath(t *testing.T) {
-	// Create a temporary file for testing
-	tmpDir := t.TempDir()
-	tmpFile := filepath.Join(tmpDir, "test.pem")
-	err := os.WriteFile(tmpFile, []byte("test content"), 0600)
-	require.NoError(t, err)
-
-	testCases := []struct {
-		name  string
-		value string
-		want  bool
-	}{
-		{
-			name:  "absolute path",
-			value: "/path/to/ca.pem",
-			want:  true,
-		},
-		{
-			name:  "relative path with ./",
-			value: "./ca.pem",
-			want:  true,
-		},
-		{
-			name:  "relative path with ../",
-			value: "../ca.pem",
-			want:  true,
-		},
-		{
-			name:  "home directory path",
-			value: "~/ca.pem",
-			want:  true,
-		},
-		{
-			name:  "existing file",
-			value: tmpFile,
-			want:  true,
-		},
-		{
-			name:  "PEM content with newlines",
-			value: "-----BEGIN CERTIFICATE-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A\n-----END CERTIFICATE-----",
-			want:  false,
-		},
-		{
-			name:  "base64 encoded content",
-			value: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=",
-			want:  false,
-		},
-		{
-			name:  "non-existent file without path prefix",
-			value: "nonexistent.pem",
-			want:  false,
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			got := IsFilePath(tc.value)
-			assert.Equal(t, tc.want, got, "IsFilePath(%q) = %v, want %v", tc.value, got, tc.want)
-		})
-	}
-}
-
 func TestAppendCAFromFile(t *testing.T) {
 	// Check if the file exists, skip test if not
 	if _, err := os.Stat(caPath); os.IsNotExist(err) {
@@ -210,7 +147,8 @@ func TestBackwardCompatibility_StoredFilePath(t *testing.T) {
 	storedValue := caPath
 
 	// Verify IsFilePath detects it as a file path
-	assert.True(t, IsFilePath(storedValue), "stored file path should be detected as a file path")
+	_, err := os.Stat(storedValue)
+	assert.Nil(t, err, "stored file path should be detected as a file path")
 
 	// Verify it can be loaded using the file path method
 	certsPool, err := x509.SystemCertPool()
@@ -233,7 +171,7 @@ func TestBackwardCompatibility_NewClientOldConfig(t *testing.T) {
 
 	// New client logic: detect and load appropriately
 	var opts []Option
-	if IsFilePath(oldConfigValue) {
+	if _, err := os.Stat(oldConfigValue); err == nil {
 		opts = append(opts, WithCAFile(oldConfigValue))
 	} else {
 		opts = append(opts, WithCAContent(oldConfigValue))
@@ -273,7 +211,7 @@ func TestBackwardCompatibility_OldClientNewConfig(t *testing.T) {
 	assert.NoError(t, err, "old client should load file path")
 
 	// New client behavior: detect then use file path
-	if IsFilePath(configValue) {
+	if _, statErr := os.Stat(configValue); statErr == nil {
 		err = appendCAFromFile(configValue, certsPool2)
 	} else {
 		err = appendCAFromContent(configValue, certsPool2)