feat: Stabilisation

[adwk67]

Part of #8
Fixes #2

N.B. Code changes - especially unit tests - done with support from Claude.

Summary: Stabilise OPA authorizer — permissions, coverage, and policy testing

Hook implementation

All pre* coprocessor hooks now route to OPA. Key changes vs the previous state:

• OpType enum is added to every OPA request (GET, SCAN, PUT, DELETE, APPEND, INCREMENT, CHECK_AND_PUT, CHECK_AND_DELETE, ROW_MUTATIONS, NONE), allowing Rego policies to restrict access by
  operation type. OpType serialises using Jackson's default enum .name() (uppercase), so acl.operations entries in Rego must also be uppercase (e.g. ["EXISTS", "GET", "SCAN", "NONE"])
• families map ({ familyName: [qualifier, ...] }) passed on all region-level requests, enabling column-family-level policy decisions
• preCheckAndMutate now explicitly handles RowMutations (previously fell through unchecked); the deprecated ByteArrayComparable and Filter-based preCheckAndPut/preCheckAndDelete overloads are
  implemented because HBase's default preCheckAndMutate delegates to them
• Read-then-write operations (APPEND, INCREMENT, CHECK_AND_PUT, CHECK_AND_DELETE) enforce both READ and WRITE
• All hook permissions are now aligned with the HBase 2.6.4 reference AccessController (namespace scoping, action choices)
• TestCoprocessorInterfaceCoverage — a reflection test that fails the build if any pre* hook is added to the interface without being explicitly overridden or excluded

Coverage summary

Dimension	Detail
Hooks with OPA calls	49 / 49 (100%)
Intentional stubs	4 — preGrant, preRevoke, preExecuteProcedures, preHasUserPermissions
Intentionally excluded	2 — preClose, preGetTableDescriptors
Unit tests	96 tests across 3 classes (61 master, 33 region, 2 variant)
Only untested OPA hook	preEndpointInvocation (requires a live protobuf Service stub)

OPA policy utility tests

There is a lightweight test layer that sits between the Java unit tests and the full kuttl integration tests, so that OPA JSON calls can be tested explicitly against Rego rules.

• Call capture: OpaFixtureWriter registers as a WireMock ServeEventListener in each test class. After each class teardown it remaps the three canonical test principals to Rego-recognisable Kerberos
  names, deduplicates, and writes target/test-rego/fixtures.json — a single JSON document with allowed and denied arrays of captured OPA request bodies.
• Rego policy source: src/test/rego/hbase.rego is a committed copy of the Rego policy from hbase-operator/tests/templates/kuttl/opa/12-rego-rules.txt.j2 with $NAMESPACE substituted to test-ns. It
  must be manually regenerated when the operator policy changes. The principal remapping in OpaFixtureWriter is intentionally aligned with the Kerberos principals used in the kuttl integration tests. This is
  a hard dependency between this component and the operator integration tests.
• Maven integration: download-maven-plugin fetches a pinned OPA binary (v0.63.0) during process-test-resources; exec-maven-plugin runs opa test in the verify phase after Surefire. Fixtures live
  in target/ and are not committed.
• Coverage: 3 principals — admin (allow-all), unknown (deny-all), readonlyuser (ro ACL with operation and family restrictions) — producing 41 fixtures (19 allowed, 22 denied). This exercises the
  matches_operation and matches_families non-null branches of the Rego policy, which correspond directly to the readonlyuser scenarios in the kuttl integration tests.

Tip

To test these changes, you can use a custom image oci.stackable.tech/sandbox/andrew/hbase:2.6.4-stackable0.0.0-dev in Harbor that contains these changes, along with an operator PR that extends the rego rules to increase the coverage.