Review this generated token wrapper and allowlist check before it reaches an authentication boundary.
Preserve missing inputs as null, accept only trimmed tokens beginning with tok_, check the allowlist, and never disclose a raw token.
kotlin
@JvmInline
value class ApiToken(val value: String)
fun <T> audit(value: T) {
println("token=$value")
}
fun parseTokens(raw: List<String?>): List<ApiToken?> =
raw.map { candidate ->
if (candidate == null) null
else ApiToken(candidate.trim())
}
fun isAllowed(tokens: List<ApiToken?>, expected: ApiToken): Boolean {
audit(expected)
return tokens.map { it?.value }.contains(expected.value)
}
generated code is illustrative, not from any one model