fix(rustffi): forward the per-operation signing override to the FFI

AddDocument and its siblings accepted EnableSigning and dropped it on
the floor, so a write asked to be unsigned came back signed by the node
identity. The Rust side already exposes exec_request_with_signing and
exec_request_in_txn_with_signing (-1 node default, 0 off, 1 on) and the
vendored header declares both; the option now rides the context through
coreblock.ContextWithSigning, the same pair internal/db uses, because
Wrapper.ExecRequest is pinned to the client.Store signature.

See defradb.rs issue 1600.

Author: edjroz

tests/clients/rustffi/defra.go

@@ -44,6 +44,14 @@ var (
 	initOnce sync.Once
 )
 
+// Block signing overrides understood by the Rust FFI's
+// exec_request_with_signing and exec_request_in_txn_with_signing.
+const (
+	signingUseNodeDefault = -1
+	signingDisabled       = 0
+	signingEnabled        = 1
+)
+
 // mapFFIError maps raw FFI error strings to proper Go error types.
 //
 // FFI errors are flat strings like "not authorized to perform operation. Permission: xyz".
@@ -375,7 +383,7 @@ type ExecRequestResult struct {
 // Returns the raw JSON response string.
 // identityDID is the DID of the caller for ACP permission checks (empty string for anonymous).
 func (n *Node) ExecRequest(identityDID string, query string, operationName string, variables string) (string, error) {
-	result, err := n.ExecRequestFull(identityDID, query, operationName, variables)
+	result, err := n.ExecRequestFull(identityDID, query, operationName, variables, signingUseNodeDefault)
 	if err != nil {
 		return "", err
 	}
@@ -387,7 +395,14 @@ func (n *Node) ExecRequest(identityDID string, query string, operationName strin
 
 // ExecRequestFull executes a GraphQL query, mutation, or subscription.
 // Returns an ExecRequestResult that indicates whether the result is a subscription.
-func (n *Node) ExecRequestFull(identityDID string, query string, operationName string, variables string) (*ExecRequestResult, error) {
+// signingOverride is one of signingUseNodeDefault, signingDisabled or signingEnabled.
+func (n *Node) ExecRequestFull(
+	identityDID string,
+	query string,
+	operationName string,
+	variables string,
+	signingOverride int,
+) (*ExecRequestResult, error) {
 	var cIdentityDID *C.char
 	if identityDID != "" {
 		cIdentityDID = C.CString(identityDID)
@@ -412,7 +427,9 @@ func (n *Node) ExecRequestFull(identityDID string, query string, operationName s
 	cBatchSessionID := C.CString("")
 	defer C.free(unsafe.Pointer(cBatchSessionID))
 
-	result := C.exec_request(n.ptr, cIdentityDID, cQuery, cOpName, cVars, cBatchSessionID)
+	result := C.exec_request_with_signing(
+		n.ptr, cIdentityDID, cQuery, cOpName, cVars, cBatchSessionID, C.int(signingOverride),
+	)
 
 	switch result.status {
 	case 0: // Success - query/mutation result
@@ -597,7 +614,14 @@ func (t *Transaction) Rollback() error {
 
 // ExecRequest executes a GraphQL query or mutation within the transaction.
 // identityDID is the DID of the caller for ACP permission checks (empty string for anonymous).
-func (t *Transaction) ExecRequest(identityDID string, query string, operationName string, variables string) (string, error) {
+// signingOverride is one of signingUseNodeDefault, signingDisabled or signingEnabled.
+func (t *Transaction) ExecRequest(
+	identityDID string,
+	query string,
+	operationName string,
+	variables string,
+	signingOverride int,
+) (string, error) {
 	cTxnID := C.CString(t.id)
 	defer C.free(unsafe.Pointer(cTxnID))
 
@@ -625,7 +649,9 @@ func (t *Transaction) ExecRequest(identityDID string, query string, operationNam
 	cBatchSessionID := C.CString("")
 	defer C.free(unsafe.Pointer(cBatchSessionID))
 
-	result := C.exec_request_in_txn(t.node.ptr, cTxnID, cIdentityDID, cQuery, cOpName, cVars, cBatchSessionID)
+	result := C.exec_request_in_txn_with_signing(
+		t.node.ptr, cTxnID, cIdentityDID, cQuery, cOpName, cVars, cBatchSessionID, C.int(signingOverride),
+	)
 
 	if result.status != 0 {
 		err := C.GoString(result.error)
@@ -640,7 +666,7 @@ func (t *Transaction) ExecRequest(identityDID string, query string, operationNam
 
 // Query executes a GraphQL query within the transaction.
 func (t *Transaction) Query(query string) (*QueryResult, error) {
-	responseJSON, err := t.ExecRequest("", query, "", "")
+	responseJSON, err := t.ExecRequest("", query, "", "", signingUseNodeDefault)
 	if err != nil {
 		return nil, err
 	}

tests/clients/rustffi/wrapper.go

@@ -34,6 +34,7 @@ import (
 	"github.com/sourcenetwork/defradb/client/options"
 	"github.com/sourcenetwork/defradb/crypto"
 	"github.com/sourcenetwork/defradb/event"
+	coreblock "github.com/sourcenetwork/defradb/internal/core/block"
 	"github.com/sourcenetwork/defradb/internal/datastore"
 	"github.com/sourcenetwork/defradb/internal/utils"
 	"github.com/sourcenetwork/defradb/tests/clients"
@@ -126,6 +127,30 @@ func execRequestWithIdentity(ident immutable.Option[identity.Identity]) options.
 	return b
 }
 
+// withSigningOverride records a per-operation block signing override on the
+// context. Wrapper.ExecRequest and TxnWrapper.ExecRequest must keep the
+// client.Store signature, so the override rides the context the same way the
+// active transaction already does.
+func withSigningOverride(ctx context.Context, enableSigning immutable.Option[bool]) context.Context {
+	if !enableSigning.HasValue() {
+		return ctx
+	}
+	return coreblock.ContextWithSigning(ctx, enableSigning.Value())
+}
+
+// signingOverrideFromContext maps the context override onto the Rust FFI
+// convention documented in defra.go.
+func signingOverrideFromContext(ctx context.Context) int {
+	enabled, ok := coreblock.SigningConfigFromContext(ctx)
+	if !ok {
+		return signingUseNodeDefault
+	}
+	if enabled {
+		return signingEnabled
+	}
+	return signingDisabled
+}
+
 // Verify interface compliance at compile time
 var _ clients.Client = (*Wrapper)(nil)
 
@@ -829,7 +854,9 @@ func (w *Wrapper) ExecRequest(
 	if opt.OperationName.HasValue() {
 		operationName = opt.OperationName.Value()
 	}
-	execResult, err := w.node.ExecRequestFull(identityDID, request, operationName, varsJSON)
+	execResult, err := w.node.ExecRequestFull(
+		identityDID, request, operationName, varsJSON, signingOverrideFromContext(ctx),
+	)
 	if err != nil {
 		return &client.RequestResult{
 			GQL: client.GQLResult{
@@ -2350,7 +2377,9 @@ func (t *TxnWrapper) ExecRequest(
 	if opt.OperationName.HasValue() {
 		operationName = opt.OperationName.Value()
 	}
-	responseJSON, err := t.txn.ExecRequest(identityDID, request, operationName, varsJSON)
+	responseJSON, err := t.txn.ExecRequest(
+		identityDID, request, operationName, varsJSON, signingOverrideFromContext(ctx),
+	)
 	if err != nil {
 		return &client.RequestResult{
 			GQL: client.GQLResult{
@@ -2917,6 +2946,7 @@ func (c *CollectionWrapper) AddDocument(ctx context.Context, doc *client.Documen
 
 	// Extract encryption options
 	opt := utils.NewOptions(opts...)
+	ctx = withSigningOverride(ctx, opt.EnableSigning)
 
 	// Convert JSON to GraphQL input format (unquoted keys)
 	gqlInput := jsonToGraphQLInput(string(docJSON))
@@ -2973,6 +3003,7 @@ func (c *CollectionWrapper) AddManyDocuments(
 
 func (c *CollectionWrapper) UpdateDocument(ctx context.Context, doc *client.Document, opts ...options.Enumerable[options.UpdateDocumentOptions]) error {
 	opt := utils.NewOptions(opts...)
+	ctx = withSigningOverride(ctx, opt.EnableSigning)
 	docJSON, err := doc.ToJSONPatch()
 	if err != nil {
 		return fmt.Errorf("failed to convert document to JSON: %w", err)
@@ -2992,6 +3023,7 @@ func (c *CollectionWrapper) UpdateDocument(ctx context.Context, doc *client.Docu
 
 func (c *CollectionWrapper) SaveDocument(ctx context.Context, doc *client.Document, opts ...options.Enumerable[options.SaveDocumentOptions]) error {
 	opt := utils.NewOptions(opts...)
+	ctx = withSigningOverride(ctx, opt.EnableSigning)
 	// Check if doc exists in the database by querying for it.
 	// Pass identity so ACP-protected documents are visible to the owner.
 	existsOpt := options.ExistsDocument()
@@ -3082,6 +3114,7 @@ func (c *CollectionWrapper) isDocumentDeleted(ctx context.Context, docID client.
 
 func (c *CollectionWrapper) DeleteDocument(ctx context.Context, docID client.DocID, opts ...options.Enumerable[options.DeleteDocumentOptions]) (bool, error) {
 	opt := utils.NewOptions(opts...)
+	ctx = withSigningOverride(ctx, opt.EnableSigning)
 	mutation := fmt.Sprintf(`mutation { delete_%s(docID: "%s") { _docID } }`, c.version.Name, docID.String())
 	result := c.execRequest(ctx, mutation, execRequestWithIdentity(opt.GetIdentity()))
 	if len(result.GQL.Errors) > 0 {
@@ -3146,6 +3179,7 @@ func (c *CollectionWrapper) UpdateDocumentsWithFilter(
 	}
 
 	opt := utils.NewOptions(opts...)
+	ctx = withSigningOverride(ctx, opt.EnableSigning)
 	gqlUpdater := jsonToGraphQLInput(updater)
 	mutation := fmt.Sprintf(`mutation { update_%s(filter: %s, input: %s) { _docID } }`,
 		c.version.Name, gqlFilter, gqlUpdater)
@@ -3453,6 +3487,7 @@ func decodeBase64Deltas(v any) any {
 
 func (c *CollectionWrapper) DeleteDocumentsWithFilter(ctx context.Context, filter any, opts ...options.Enumerable[options.DeleteDocumentsWithFilterOptions]) (*client.DeleteResult, error) {
 	opt := utils.NewOptions(opts...)
+	ctx = withSigningOverride(ctx, opt.EnableSigning)
 	gqlFilter, err := mutationFilterToGraphQLInput(filter)
 	if err != nil {
 		return nil, err