Java 类org.apache.hadoop.hbase.coprocessor.RegionCoprocessorEnvironment 实例源码

@Override
public void start(CoprocessorEnvironment environment) {
  // make sure we are on a region server
  if (!(environment instanceof RegionCoprocessorEnvironment)) {
    throw new IllegalArgumentException(
        "Constraints only act on regions - started in an environment that was not a region");
  }
  RegionCoprocessorEnvironment env = (RegionCoprocessorEnvironment) environment;
  HTableDescriptor desc = env.getRegion().getTableDesc();
  // load all the constraints from the HTD
  try {
    this.constraints = Constraints.getConstraints(desc, classloader);
  } catch (IOException e) {
    throw new IllegalArgumentException(e);
  }

  if (LOG.isInfoEnabled()) {
    LOG.info("Finished loading " + constraints.size()
        + " user Constraints on table: " + desc.getTableName());
  }

}

/****************************** Region related hooks ******************************/

  @Override
  public void postOpen(ObserverContext<RegionCoprocessorEnvironment> e) {
    // Read the entire labels table and populate the zk
    if (e.getEnvironment().getRegion().getRegionInfo().getTable().equals(LABELS_TABLE_NAME)) {
      this.labelsRegion = true;
      synchronized (this) {
        this.accessControllerAvailable = CoprocessorHost.getLoadedCoprocessors()
          .contains(AccessController.class.getName());
      }
      // Defer the init of VisibilityLabelService on labels region until it is in recovering state.
      if (!e.getEnvironment().getRegion().isRecovering()) {
        initVisibilityLabelService(e.getEnvironment());
      }
    } else {
      checkAuths = e.getEnvironment().getConfiguration()
          .getBoolean(VisibilityConstants.CHECK_AUTHS_FOR_MUTATION, false);
      initVisibilityLabelService(e.getEnvironment());
    }
  }

@Override
public boolean postScannerNext(ObserverContext<RegionCoprocessorEnvironment> e,
    InternalScanner s, List<Result> results, int limit, boolean hasMore) throws IOException {
  if (checkTagPresence) {
    if (results.size() > 0) {
      // Check tag presence in the 1st cell in 1st Result
      Result result = results.get(0);
      CellScanner cellScanner = result.cellScanner();
      if (cellScanner.advance()) {
        Cell cell = cellScanner.current();
        tags = Tag.asList(cell.getTagsArray(), cell.getTagsOffset(),
            cell.getTagsLength());
      }
    }
  }
  return hasMore;
}

@Override
public void preGetOp(final ObserverContext<RegionCoprocessorEnvironment> e,
                     final Get get, final List<Cell> results) throws IOException {

  if (e.getEnvironment().getRegion().getRegionInfo().getReplicaId() == 0) {
    CountDownLatch latch = cdl.get();
    try {
      if (sleepTime.get() > 0) {
        LOG.info("Sleeping for " + sleepTime.get() + " ms");
        Thread.sleep(sleepTime.get());
      } else if (latch.getCount() > 0) {
        LOG.info("Waiting for the counterCountDownLatch");
        latch.await(2, TimeUnit.MINUTES); // To help the tests to finish.
        if (latch.getCount() > 0) {
          throw new RuntimeException("Can't wait more");
        }
      }
    } catch (InterruptedException e1) {
      LOG.error(e1);
    }
  } else {
    LOG.info("We're not the primary replicas.");
  }
}

@Override
public InternalScanner preFlushScannerOpen(
    final ObserverContext<RegionCoprocessorEnvironment> c,
    Store store, KeyValueScanner memstoreScanner, InternalScanner s) throws IOException {
  Long newTtl = ttls.get(store.getTableName());
  if (newTtl != null) {
    System.out.println("PreFlush:" + newTtl);
  }
  Integer newVersions = versions.get(store.getTableName());
  ScanInfo oldSI = store.getScanInfo();
  HColumnDescriptor family = store.getFamily();
  ScanInfo scanInfo = new ScanInfo(TEST_UTIL.getConfiguration(),
      family.getName(), family.getMinVersions(),
      newVersions == null ? family.getMaxVersions() : newVersions,
      newTtl == null ? oldSI.getTtl() : newTtl, family.getKeepDeletedCells(),
      oldSI.getTimeToPurgeDeletes(), oldSI.getComparator());
  Scan scan = new Scan();
  scan.setMaxVersions(newVersions == null ? oldSI.getMaxVersions() : newVersions);
  return new StoreScanner(store, scanInfo, scan, Collections.singletonList(memstoreScanner),
      ScanType.COMPACT_RETAIN_DELETES, store.getSmallestReadPoint(),
      HConstants.OLDEST_TIMESTAMP);
}

@Override
public long preIncrementColumnValue(final ObserverContext<RegionCoprocessorEnvironment> c,
    final byte [] row, final byte [] family, final byte [] qualifier,
    final long amount, final boolean writeToWAL)
    throws IOException {
  // Require WRITE permission to the table, CF, and the KV to be replaced by the
  // incremented value
  RegionCoprocessorEnvironment env = c.getEnvironment();
  Map<byte[],? extends Collection<byte[]>> families = makeFamilyMap(family, qualifier);
  User user = getActiveUser();
  AuthResult authResult = permissionGranted(OpType.INCREMENT_COLUMN_VALUE, user, env, families,
    Action.WRITE);
  if (!authResult.isAllowed() && cellFeaturesEnabled && !compatibleEarlyTermination) {
    authResult.setAllowed(checkCoveringPermission(OpType.INCREMENT_COLUMN_VALUE, env, row,
      families, HConstants.LATEST_TIMESTAMP, Action.WRITE));
    authResult.setReason("Covering cell set");
  }
  logResult(authResult);
  if (authorizationEnabled && !authResult.isAllowed()) {
    throw new AccessDeniedException("Insufficient permissions " + authResult.toContextString());
  }
  return -1;
}

@Override
public Result preIncrementAfterRowLock(final ObserverContext<RegionCoprocessorEnvironment> c,
    final Increment increment) throws IOException {
  if (increment.getAttribute(CHECK_COVERING_PERM) != null) {
    // We had failure with table, cf and q perm checks and now giving a chance for cell
    // perm check
    TableName table = c.getEnvironment().getRegion().getRegionInfo().getTable();
    AuthResult authResult = null;
    if (checkCoveringPermission(OpType.INCREMENT, c.getEnvironment(), increment.getRow(),
        increment.getFamilyCellMap(), increment.getTimeRange().getMax(), Action.WRITE)) {
      authResult = AuthResult.allow(OpType.INCREMENT.toString(), "Covering cell set",
          getActiveUser(), Action.WRITE, table, increment.getFamilyCellMap());
    } else {
      authResult = AuthResult.deny(OpType.INCREMENT.toString(), "Covering cell set",
          getActiveUser(), Action.WRITE, table, increment.getFamilyCellMap());
    }
    logResult(authResult);
    if (authorizationEnabled && !authResult.isAllowed()) {
      throw new AccessDeniedException("Insufficient permissions " +
        authResult.toContextString());
    }
  }
  return null;
}

@Override
public KeyValueScanner preStoreScannerOpen(
    final ObserverContext<RegionCoprocessorEnvironment> c, Store store, final Scan scan,
    final NavigableSet<byte[]> targetCols, KeyValueScanner s) throws IOException {
  TableName tn = store.getTableName();
  if (!tn.isSystemTable()) {
    Long newTtl = ttls.get(store.getTableName());
    Integer newVersions = versions.get(store.getTableName());
    ScanInfo oldSI = store.getScanInfo();
    HColumnDescriptor family = store.getFamily();
    ScanInfo scanInfo = new ScanInfo(TEST_UTIL.getConfiguration(),
        family.getName(), family.getMinVersions(),
        newVersions == null ? family.getMaxVersions() : newVersions,
        newTtl == null ? oldSI.getTtl() : newTtl, family.getKeepDeletedCells(),
        oldSI.getTimeToPurgeDeletes(), oldSI.getComparator());
    return new StoreScanner(store, scanInfo, scan, targetCols,
        ((HStore) store).getHRegion().getReadpoint(IsolationLevel.READ_COMMITTED));
  } else {
    return s;
  }
}

@Override
public void prepareBulkLoad(RpcController controller,
                                               PrepareBulkLoadRequest request,
                                               RpcCallback<PrepareBulkLoadResponse> done){
  try {
    List<BulkLoadObserver> bulkLoadObservers = getBulkLoadObservers();

    if(bulkLoadObservers != null) {
      ObserverContext<RegionCoprocessorEnvironment> ctx =
                                         new ObserverContext<RegionCoprocessorEnvironment>();
      ctx.prepare(env);

      for(BulkLoadObserver bulkLoadObserver : bulkLoadObservers) {
        bulkLoadObserver.prePrepareBulkLoad(ctx, request);
      }
    }

    String bulkToken = createStagingDir(baseStagingDir,
        getActiveUser(), ProtobufUtil.toTableName(request.getTableName())).toString();
    done.run(PrepareBulkLoadResponse.newBuilder().setBulkToken(bulkToken).build());
  } catch (IOException e) {
    ResponseConverter.setControllerException(controller, e);
  }
  done.run(null);
}

@Override
public void prePut(final ObserverContext<RegionCoprocessorEnvironment> e, final Put put,
    final WALEdit edit, final Durability durability) throws IOException {
  byte[] attribute = put.getAttribute("visibility");
  byte[] cf = null;
  List<Cell> updatedCells = new ArrayList<Cell>();
  if (attribute != null) {
    for (List<? extends Cell> edits : put.getFamilyCellMap().values()) {
      for (Cell cell : edits) {
        KeyValue kv = KeyValueUtil.ensureKeyValue(cell);
        if (cf == null) {
          cf = kv.getFamily();
        }
        Tag tag = new Tag(TAG_TYPE, attribute);
        List<Tag> tagList = new ArrayList<Tag>();
        tagList.add(tag);

        KeyValue newKV = new KeyValue(kv.getRow(), 0, kv.getRowLength(), kv.getFamily(), 0,
            kv.getFamilyLength(), kv.getQualifier(), 0, kv.getQualifierLength(),
            kv.getTimestamp(), KeyValue.Type.codeToType(kv.getType()), kv.getValue(), 0,
            kv.getValueLength(), tagList);
        ((List<Cell>) updatedCells).add(newKV);
      }
    }
    put.getFamilyCellMap().remove(cf);
    // Update the family map
    put.getFamilyCellMap().put(cf, updatedCells);
  }
}

protected ScanInfo getScanInfo(Store store, RegionCoprocessorEnvironment e) {
  byte[] data = ((ZKWatcher)e.getSharedData().get(zkkey)).getData();
  if (data == null) {
    return null;
  }
  ScanInfo oldSI = store.getScanInfo();
  if (oldSI.getTtl() == Long.MAX_VALUE) {
    return null;
  }
  long ttl = Math.max(EnvironmentEdgeManager.currentTime() -
      Bytes.toLong(data), oldSI.getTtl());
  return new ScanInfo(oldSI.getConfiguration(), store.getFamily(), ttl,
      oldSI.getTimeToPurgeDeletes(), oldSI.getComparator());
}

@Override
public void preSplitAfterPONR(ObserverContext<RegionCoprocessorEnvironment> ctx)
    throws IOException {
  RegionCoprocessorEnvironment environment = ctx.getEnvironment();
  HRegionServer rs = (HRegionServer) environment.getRegionServerServices();
  st.stepsAfterPONR(rs, rs, daughterRegions, null);
}

/**
 * @param s the scanner
 * @param results the result set returned by the region server
 * @param limit the maximum number of results to return
 * @param hasMore
 * @return 'has more' indication to give to client
 * @exception IOException Exception
 */
public boolean postScannerNext(final InternalScanner s,
    final List<Result> results, final int limit, boolean hasMore)
    throws IOException {
  return execOperationWithResult(hasMore,
      coprocessors.isEmpty() ? null : new RegionOperationWithResult<Boolean>() {
    @Override
    public void call(RegionObserver oserver, ObserverContext<RegionCoprocessorEnvironment> ctx)
        throws IOException {
      setResult(oserver.postScannerNext(ctx, s, results, limit, getResult()));
    }
  });
}

@Override
public RegionScanner preScannerOpen(ObserverContext<RegionCoprocessorEnvironment> e, Scan scan,
    RegionScanner s) throws IOException {
  if (!initialized) {
    throw new VisibilityControllerNotReadyException("VisibilityController not yet initialized!");
  }
  // Nothing to do if authorization is not enabled
  if (!authorizationEnabled) {
    return s;
  }
  Region region = e.getEnvironment().getRegion();
  Authorizations authorizations = null;
  try {
    authorizations = scan.getAuthorizations();
  } catch (DeserializationException de) {
    throw new IOException(de);
  }
  if (authorizations == null) {
    // No Authorizations present for this scan/Get!
    // In case of system tables other than "labels" just scan with out visibility check and
    // filtering. Checking visibility labels for META and NAMESPACE table is not needed.
    TableName table = region.getRegionInfo().getTable();
    if (table.isSystemTable() && !table.equals(LABELS_TABLE_NAME)) {
      return s;
    }
  }

  Filter visibilityLabelFilter = VisibilityUtils.createVisibilityLabelFilter(region,
      authorizations);
  if (visibilityLabelFilter != null) {
    Filter filter = scan.getFilter();
    if (filter != null) {
      scan.setFilter(new FilterList(filter, visibilityLabelFilter));
    } else {
      scan.setFilter(visibilityLabelFilter);
    }
  }
  return s;
}

/**
 * @exception IOException Exception
 */
public void postScannerClose(final InternalScanner s) throws IOException {
  execOperation(coprocessors.isEmpty() ? null : new RegionOperation() {
    @Override
    public void call(RegionObserver oserver, ObserverContext<RegionCoprocessorEnvironment> ctx)
        throws IOException {
      oserver.postScannerClose(ctx, s);
    }
  });
}

@Override
public RegionScanner postScannerOpen(final ObserverContext<RegionCoprocessorEnvironment> c,
    final Scan scan, final RegionScanner s) throws IOException {
  User user = VisibilityUtils.getActiveUser();
  if (user != null && user.getShortName() != null) {
    scannerOwners.put(s, user.getShortName());
  }
  return s;
}

@Override
public boolean preScannerNext(final ObserverContext<RegionCoprocessorEnvironment> c,
    final InternalScanner s, final List<Result> result, final int limit, final boolean hasNext)
    throws IOException {
  requireScannerOwner(s);
  return hasNext;
}

@Override
public boolean preScannerNext(final ObserverContext<RegionCoprocessorEnvironment> e,
    final InternalScanner s, final List<Result> results,
    final int limit, final boolean hasMore) throws IOException {
  //this will slow down a certain next operation if the conditions are met. The slowness
  //will allow the call to go to a replica
  countOfNext.incrementAndGet();
  if (countOfNext.get() == 0 || countOfNext.get() == 4) {
    slowdownCode(e);
  }
  return true;
}

@Override
public void start(CoprocessorEnvironment env) throws IOException {
  if (env instanceof RegionCoprocessorEnvironment) {
    this.env = (RegionCoprocessorEnvironment) env;
  } else {
    throw new CoprocessorException("Must be loaded on a table region!");
  }
}

@Override
public Result preAppend(ObserverContext<RegionCoprocessorEnvironment> e, Append append)
    throws IOException {
  // If authorization is not enabled, we don't care about reserved tags
  if (!authorizationEnabled) {
    return null;
  }
  for (CellScanner cellScanner = append.cellScanner(); cellScanner.advance();) {
    if (!checkForReservedVisibilityTagPresence(cellScanner.current())) {
      throw new FailedSanityCheckException("Append contains cell with reserved type tag");
    }
  }
  return null;
}

@Override
public Result preIncrement(ObserverContext<RegionCoprocessorEnvironment> e, Increment increment)
    throws IOException {
  // If authorization is not enabled, we don't care about reserved tags
  if (!authorizationEnabled) {
    return null;
  }
  for (CellScanner cellScanner = increment.cellScanner(); cellScanner.advance();) {
    if (!checkForReservedVisibilityTagPresence(cellScanner.current())) {
      throw new FailedSanityCheckException("Increment contains cell with reserved type tag");
    }
  }
  return null;
}

@Override
public void start(CoprocessorEnvironment env) {
  // if running at region
  if (env instanceof RegionCoprocessorEnvironment) {
    RegionCoprocessorEnvironment regionEnv =
        (RegionCoprocessorEnvironment)env;
    RpcServerInterface server = regionEnv.getRegionServerServices().getRpcServer();
    SecretManager<?> mgr = ((RpcServer)server).getSecretManager();
    if (mgr instanceof AuthenticationTokenSecretManager) {
      secretManager = (AuthenticationTokenSecretManager)mgr;
    }
  }
}

@Override
public void init(RegionCoprocessorEnvironment e) throws IOException {
  this.scanLabelGenerators = VisibilityUtils.getScanLabelGenerators(this.conf);
  if (e.getRegion().getRegionInfo().getTable().equals(LABELS_TABLE_NAME)) {
    this.labelsRegion = e.getRegion();
  }
}

public Message preEndpointInvocation(final Service service, final String methodName,
    Message request) throws IOException {
  return execOperationWithResult(request,
      coprocessors.isEmpty() ? null : new EndpointOperationWithResult<Message>() {
    @Override
    public void call(EndpointObserver oserver, ObserverContext<RegionCoprocessorEnvironment> ctx)
        throws IOException {
      setResult(oserver.preEndpointInvocation(ctx, service, methodName, getResult()));
    }
  });
}

@Override
public void prePut(ObserverContext<RegionCoprocessorEnvironment> e, Put m, WALEdit edit,
    Durability durability) throws IOException {
  byte[] attribute = m.getAttribute(NON_VISIBILITY);
  byte[] cf = null;
  List<Cell> updatedCells = new ArrayList<Cell>();
  if (attribute != null) {
    for (List<? extends Cell> edits : m.getFamilyCellMap().values()) {
      for (Cell cell : edits) {
        KeyValue kv = KeyValueUtil.ensureKeyValue(cell);
        if (cf == null) {
          cf = kv.getFamily();
        }
        Tag tag = new Tag((byte) NON_VIS_TAG_TYPE, attribute);
        List<Tag> tagList = new ArrayList<Tag>();
        tagList.add(tag);
        tagList.addAll(kv.getTags());
        byte[] fromList = Tag.fromList(tagList);
        TagRewriteCell newcell = new TagRewriteCell(kv, fromList);
        KeyValue newKV = new KeyValue(kv.getRow(), 0, kv.getRowLength(), kv.getFamily(), 0,
            kv.getFamilyLength(), kv.getQualifier(), 0, kv.getQualifierLength(),
            kv.getTimestamp(), KeyValue.Type.codeToType(kv.getType()), kv.getValue(), 0,
            kv.getValueLength(), tagList);
        ((List<Cell>) updatedCells).add(newcell);
      }
    }
    m.getFamilyCellMap().remove(cf);
    // Update the family map
    m.getFamilyCellMap().put(cf, updatedCells);
  }
}

@Override
public void postLogReplay(ObserverContext<RegionCoprocessorEnvironment> c) {
  if (aclRegion) {
    try {
      initialize(c.getEnvironment());
    } catch (IOException ex) {
      // if we can't obtain permissions, it's better to fail
      // than perform checks incorrectly
      throw new RuntimeException("Failed to initialize permissions cache", ex);
    }
  }
}

@Override
public InternalScanner preCompact(ObserverContext<RegionCoprocessorEnvironment> e,
    final Store store, final InternalScanner scanner, final ScanType scanType)
        throws IOException {
  requirePermission("compact", getTableName(e.getEnvironment()), null, null, Action.ADMIN,
      Action.CREATE);
  return scanner;
}

/**
 * @param s the scanner
 * @return true if default behavior should be bypassed, false otherwise
 * @exception IOException Exception
 */
public boolean preScannerClose(final InternalScanner s) throws IOException {
  return execOperation(coprocessors.isEmpty() ? null : new RegionOperation() {
    @Override
    public void call(RegionObserver oserver, ObserverContext<RegionCoprocessorEnvironment> ctx)
        throws IOException {
      oserver.preScannerClose(ctx, s);
    }
  });
}

/**
 * @param row row to check
 * @param family column family
 * @param qualifier column qualifier
 * @param compareOp the comparison operation
 * @param comparator the comparator
 * @param put data to put if check succeeds
 * @throws IOException e
 */
public boolean postCheckAndPut(final byte [] row, final byte [] family,
    final byte [] qualifier, final CompareOp compareOp,
    final ByteArrayComparable comparator, final Put put,
    boolean result) throws IOException {
  return execOperationWithResult(result,
      coprocessors.isEmpty() ? null : new RegionOperationWithResult<Boolean>() {
    @Override
    public void call(RegionObserver oserver, ObserverContext<RegionCoprocessorEnvironment> ctx)
        throws IOException {
      setResult(oserver.postCheckAndPut(ctx, row, family, qualifier,
        compareOp, comparator, put, getResult()));
    }
  });
}

@Override
public void postPut(final ObserverContext<RegionCoprocessorEnvironment> c,
    final Put put, final WALEdit edit, final Durability durability) {
  if (aclRegion) {
    updateACL(c.getEnvironment(), put.getFamilyCellMap());
  }
}

@Override
public void preDelete(final ObserverContext<RegionCoprocessorEnvironment> c,
    final Delete delete, final WALEdit edit, final Durability durability)
    throws IOException {
  // An ACL on a delete is useless, we shouldn't allow it
  if (delete.getAttribute(AccessControlConstants.OP_ATTRIBUTE_ACL) != null) {
    throw new DoNotRetryIOException("ACL on delete has no effect: " + delete.toString());
  }
  // Require WRITE permissions on all cells covered by the delete. Unlike
  // for Puts we need to check all visible prior versions, because a major
  // compaction could remove them. If the user doesn't have permission to
  // overwrite any of the visible versions ('visible' defined as not covered
  // by a tombstone already) then we have to disallow this operation.
  RegionCoprocessorEnvironment env = c.getEnvironment();
  Map<byte[],? extends Collection<Cell>> families = delete.getFamilyCellMap();
  User user = getActiveUser();
  AuthResult authResult = permissionGranted(OpType.DELETE, user, env, families, Action.WRITE);
  logResult(authResult);
  if (!authResult.isAllowed()) {
    if (cellFeaturesEnabled && !compatibleEarlyTermination) {
      delete.setAttribute(CHECK_COVERING_PERM, TRUE);
    } else if (authorizationEnabled) {
      throw new AccessDeniedException("Insufficient permissions " +
        authResult.toContextString());
    }
  }
}

/**
 * @param append append object
 * @return result to return to client if default operation should be
 * bypassed, null otherwise
 * @throws IOException if an error occurred on the coprocessor
 */
public Result preAppend(final Append append) throws IOException {
  return execOperationWithResult(true, null,
      coprocessors.isEmpty() ? null : new RegionOperationWithResult<Result>() {
    @Override
    public void call(RegionObserver oserver, ObserverContext<RegionCoprocessorEnvironment> ctx)
        throws IOException {
      setResult(oserver.preAppend(ctx, append));
    }
  });
}

@Override
public void postDelete(final ObserverContext<RegionCoprocessorEnvironment> c,
    final Delete delete, final WALEdit edit, final Durability durability)
    throws IOException {
  if (aclRegion) {
    updateACL(c.getEnvironment(), delete.getFamilyCellMap());
  }
}

@Override
public InternalScanner preFlushScannerOpen(final ObserverContext<RegionCoprocessorEnvironment> c,
    Store store, KeyValueScanner memstoreScanner, InternalScanner s) throws IOException {
  ScanInfo scanInfo = getScanInfo(store, c.getEnvironment());
  if (scanInfo == null) {
    // take default action
    return null;
  }
  Scan scan = new Scan();
  scan.setMaxVersions(scanInfo.getMaxVersions());
  return new StoreScanner(store, scanInfo, scan, Collections.singletonList(memstoreScanner),
      ScanType.COMPACT_RETAIN_DELETES, store.getSmallestReadPoint(), HConstants.OLDEST_TIMESTAMP);
}

@Override
public boolean preCheckAndDelete(final ObserverContext<RegionCoprocessorEnvironment> c,
    final byte [] row, final byte [] family, final byte [] qualifier,
    final CompareFilter.CompareOp compareOp,
    final ByteArrayComparable comparator, final Delete delete,
    final boolean result) throws IOException {
  // An ACL on a delete is useless, we shouldn't allow it
  if (delete.getAttribute(AccessControlConstants.OP_ATTRIBUTE_ACL) != null) {
    throw new DoNotRetryIOException("ACL on checkAndDelete has no effect: " +
        delete.toString());
  }
  // Require READ and WRITE permissions on the table, CF, and the KV covered
  // by the delete
  RegionCoprocessorEnvironment env = c.getEnvironment();
  Map<byte[],? extends Collection<byte[]>> families = makeFamilyMap(family, qualifier);
  User user = getActiveUser();
  AuthResult authResult = permissionGranted(OpType.CHECK_AND_DELETE, user, env, families,
    Action.READ, Action.WRITE);
  logResult(authResult);
  if (!authResult.isAllowed()) {
    if (cellFeaturesEnabled && !compatibleEarlyTermination) {
      delete.setAttribute(CHECK_COVERING_PERM, TRUE);
    } else if (authorizationEnabled) {
      throw new AccessDeniedException("Insufficient permissions " +
        authResult.toContextString());
    }
  }
  return result;
}

/**
 * @param scan the Scan specification
 * @return scanner id to return to client if default operation should be
 * bypassed, false otherwise
 * @exception IOException Exception
 */
public RegionScanner preScannerOpen(final Scan scan) throws IOException {
  return execOperationWithResult(true, null,
      coprocessors.isEmpty() ? null : new RegionOperationWithResult<RegionScanner>() {
    @Override
    public void call(RegionObserver oserver, ObserverContext<RegionCoprocessorEnvironment> ctx)
        throws IOException {
      setResult(oserver.preScannerOpen(ctx, scan, getResult()));
    }
  });
}

@Override
public Result preAppend(ObserverContext<RegionCoprocessorEnvironment> c, Append append)
    throws IOException {
  User user = getActiveUser();
  checkForReservedTagPresence(user, append);

  // Require WRITE permission to the table, CF, and the KV to be appended
  RegionCoprocessorEnvironment env = c.getEnvironment();
  Map<byte[],? extends Collection<Cell>> families = append.getFamilyCellMap();
  AuthResult authResult = permissionGranted(OpType.APPEND, user, env, families, Action.WRITE);
  logResult(authResult);
  if (!authResult.isAllowed()) {
    if (cellFeaturesEnabled && !compatibleEarlyTermination) {
      append.setAttribute(CHECK_COVERING_PERM, TRUE);
    } else if (authorizationEnabled)  {
      throw new AccessDeniedException("Insufficient permissions " +
        authResult.toContextString());
    }
  }

  byte[] bytes = append.getAttribute(AccessControlConstants.OP_ATTRIBUTE_ACL);
  if (bytes != null) {
    if (cellFeaturesEnabled) {
      addCellPermissions(bytes, append.getFamilyCellMap());
    } else {
      throw new DoNotRetryIOException("Cell ACLs cannot be persisted");
    }
  }

  return null;
}

/**
 * @param row row to check
 * @param family column family
 * @param qualifier column qualifier
 * @param compareOp the comparison operation
 * @param comparator the comparator
 * @param delete delete to commit if check succeeds
 * @return true or false to return to client if default processing should
 * be bypassed, or null otherwise
 * @throws IOException e
 */
public Boolean preCheckAndDeleteAfterRowLock(final byte[] row, final byte[] family,
    final byte[] qualifier, final CompareOp compareOp, final ByteArrayComparable comparator,
    final Delete delete) throws IOException {
  return execOperationWithResult(true, false,
      coprocessors.isEmpty() ? null : new RegionOperationWithResult<Boolean>() {
    @Override
    public void call(RegionObserver oserver, ObserverContext<RegionCoprocessorEnvironment> ctx)
        throws IOException {
      setResult(oserver.preCheckAndDeleteAfterRowLock(ctx, row,
            family, qualifier, compareOp, comparator, delete, getResult()));
    }
  });
}

@Override
public void prePut(ObserverContext<RegionCoprocessorEnvironment> e, Put put, WALEdit edit,
    Durability durability) throws IOException {
  Region region = e.getEnvironment().getRegion();
  if (!region.getRegionInfo().isMetaTable()
      && !region.getRegionInfo().getTable().isSystemTable()) {
    if (put.getAttribute(TEST_ATR_KEY) != null) {
      LOG.debug("allow any put to happen " + region.getRegionInfo().getRegionNameAsString());
    } else {
      e.bypass();
    }
  }
}

@Override
public boolean preScannerNext(final ObserverContext<RegionCoprocessorEnvironment> c,
    final InternalScanner s, final List<Result> result,
    final int limit, final boolean hasNext) throws IOException {
  requireScannerOwner(s);
  return hasNext;
}