The auth check that passed every test and failed every user

import java.util.*;

/**
 * Root cause: `allowed == token` compares object identity, not text.
 *
 * The allow-list entries are string literals, so javac interned them into the
 * JVM-wide pool. The unit test also passes literals — the very same pooled
 * objects — so == is true and the test passes. Production parses the token out
 * of a request header, which builds a brand new String at runtime that was
 * never interned. Same characters, different object, == is false, every request
 * rejected.
 *
 * The test could not have caught this, because the test's inputs were literals.
 * That is the whole lesson: == on strings is a bug that passes its own tests.
 *
 * Why intern() "fixed" it: intern() returns the pooled instance for that text,
 * so the parsed token becomes the same object as the literal and == starts
 * working again. It is still the wrong fix, for two reasons:
 *
 *   1. It leaves a correctness landmine in place. The next comparison someone
 *      writes against a non-interned string breaks the same way.
 *   2. It interns attacker-controlled input. Every distinct token ever
 *      presented — including garbage from a scanner — is added to the string
 *      pool. Before Java 7 that filled PermGen and produced
 *      "OutOfMemoryError: PermGen space". Since Java 7 the pool is on the heap,
 *      so instead you get a table that grows without bound, is expensive to
 *      resize, and has no eviction API. You cannot remove an entry from the
 *      string pool. That is the GC behaviour they saw six weeks later.
 *
 * The fix is to compare the text.
 */
public class Solution {

    private static final String[] ALLOW_LIST_RAW = {
        "tok_live_a91f", "tok_live_b7c2", "tok_live_c503"
    };

    /**
     * A Set does the comparison with equals() and hashCode(), so identity never
     * enters into it — and it turns a linear scan into one hash lookup, which
     * is what "written for speed" should have meant in the first place.
     */
    private static final Set<String> ALLOW_LIST = Set.of(ALLOW_LIST_RAW);

    static boolean authorised(String token) {
        return token != null && ALLOW_LIST.contains(token);
    }

    static String fromHeader(String headerValue) {
        StringBuilder sb = new StringBuilder();
        for (char c : headerValue.substring("Bearer ".length()).toCharArray()) {
            sb.append(c);
        }
        return sb.toString();
    }

    public static void main(String[] args) {
        System.out.println("--- as the unit test calls it (literal token) ---");
        int devOk = 0;
        for (String t : new String[] { "tok_live_a91f", "tok_live_b7c2", "tok_live_c503" }) {
            boolean ok = authorised(t);
            devOk += ok ? 1 : 0;
            System.out.println("  " + t + " -> " + (ok ? "authorised" : "REJECTED"));
        }
        System.out.println("  passed " + devOk + "/3");

        System.out.println("--- as production calls it (token parsed from a header) ---");
        int prodOk = 0;
        int requests = 0;
        for (String t : ALLOW_LIST_RAW) {
            String parsed = fromHeader("Bearer " + t);
            requests++;
            boolean ok = authorised(parsed);
            prodOk += ok ? 1 : 0;
            System.out.println("  " + parsed + " -> " + (ok ? "authorised" : "REJECTED")
                + "   (identical object? " + (parsed == t) + ")");
        }
        System.out.println("  passed " + prodOk + "/" + requests);

        // The token that must still be rejected.
        System.out.println("unknown token   = "
            + (authorised("tok_live_dead") ? "authorised" : "REJECTED"));

        System.out.println();
        System.out.println("dev  authorised = " + devOk + "/3");
        System.out.println("prod authorised = " + prodOk + "/" + requests);
        System.out.println(devOk == 3 && prodOk == requests
            && !authorised("tok_live_dead") ? "PASS" : "FAIL");
    }
}