From bac4b2fc36fe9fb9aef4cf5384c66f1e752bf095 Mon Sep 17 00:00:00 2001
From: Natalie Bunduwongse <natalie.bunduwongse@immutable.com>
Date: Fri, 10 Jul 2026 11:30:56 +1200
Subject: [PATCH] feat(audience): warn and drop Identify()/Alias() calls with a
 malformed passport id

Studios sometimes call Identify() or Alias() with IdentityType.Passport
but pass their own internal user id instead of a real Passport id,
which silently pollutes downstream analytics. Reject the call (no-op,
no event sent) and log a warning when the id doesn't look like a
Passport id, using the same connection|id or UUID shape Passport
actually issues. Also adds sample-app coverage for the new behaviour.
---
 .../Tests/Runtime/SampleAppLiveFireTests.cs   |  29 ++-
 .../SampleApp/Tests/Runtime/SampleAppUi.cs    |   3 +
 .../Audience/Runtime/ImmutableAudience.cs     |  51 ++++-
 src/Packages/Audience/Runtime/Utility/Log.cs  |  10 +
 .../Tests/Runtime/ImmutableAudienceTests.cs   | 206 +++++++++++++++++-
 5 files changed, 287 insertions(+), 12 deletions(-)

diff --git a/examples/audience/Assets/SampleApp/Tests/Runtime/SampleAppLiveFireTests.cs b/examples/audience/Assets/SampleApp/Tests/Runtime/SampleAppLiveFireTests.cs
index 0210ad0e..aeb763f0 100644
--- a/examples/audience/Assets/SampleApp/Tests/Runtime/SampleAppLiveFireTests.cs
+++ b/examples/audience/Assets/SampleApp/Tests/Runtime/SampleAppLiveFireTests.cs
@@ -245,20 +245,35 @@ public IEnumerator Identify_AndFlush_FlushReportsOk()
             // dropdown before Init rather than upgrading mid-test.
             yield return LoadAndInit(initialConsent: SampleAppUi.Consent.Full);
 
-            _root!.Q<TextField>(SampleAppUi.IdentityFields.Id).value = "il2cpp-test-user-" + DateTime.UtcNow.Ticks;
+            _root!.Q<TextField>(SampleAppUi.IdentityFields.Id).value = "email|il2cpp-test-user-" + DateTime.UtcNow.Ticks;
             _root.Q<Button>(SampleAppUi.Buttons.Identify).Click();
             yield return null;
 
             yield return FlushAndAssertNoErrors();
         }
 
+        [UnityTest]
+        public IEnumerator Identify_PassportWithInvalidIdFormat_WarnsAndDropsCall()
+        {
+            // Identity type dropdown defaults to Passport; "12345" isn't Passport-shaped.
+            yield return LoadAndInit(initialConsent: SampleAppUi.Consent.Full);
+
+            _root!.Q<TextField>(SampleAppUi.IdentityFields.Id).value = "12345";
+            _root.Q<Button>(SampleAppUi.Buttons.Identify).Click();
+            yield return SampleAppTestHelpers.WaitForLogEntry(_root, SampleAppUi.LogLabels.Sdk, LogLevels.Warn, 5f);
+
+            Assert.IsNull(ImmutableAudience.UserId,
+                "an invalid Passport ID must be a full no-op, not just logged");
+        }
+
         [UnityTest]
         public IEnumerator Alias_AndFlush_FlushReportsOk()
         {
             yield return LoadAndInit(initialConsent: SampleAppUi.Consent.Full);
 
-            _root!.Q<TextField>(SampleAppUi.IdentityFields.AliasFromId).value = "anon-" + DateTime.UtcNow.Ticks;
-            _root.Q<TextField>(SampleAppUi.IdentityFields.AliasToId).value = "user-" + DateTime.UtcNow.Ticks;
+            // Identity dropdowns default to Passport for both sides.
+            _root!.Q<TextField>(SampleAppUi.IdentityFields.AliasFromId).value = "email|anon-" + DateTime.UtcNow.Ticks;
+            _root.Q<TextField>(SampleAppUi.IdentityFields.AliasToId).value = "email|user-" + DateTime.UtcNow.Ticks;
             _root.Q<Button>(SampleAppUi.Buttons.Alias).Click();
             yield return null;
 
@@ -292,7 +307,7 @@ public IEnumerator SetConsent_FullAfterAnonymous_AcceptsIdentify()
 
             yield return SetConsentVia(SampleAppUi.Buttons.ConsentFull);
 
-            _root!.Q<TextField>(SampleAppUi.IdentityFields.Id).value = "consent-test-" + DateTime.UtcNow.Ticks;
+            _root!.Q<TextField>(SampleAppUi.IdentityFields.Id).value = "email|consent-test-" + DateTime.UtcNow.Ticks;
             _root.Q<Button>(SampleAppUi.Buttons.Identify).Click();
             yield return null;
 
@@ -406,7 +421,7 @@ public IEnumerator SetConsent_AnonymousFromFull_StripsUserIdFromTrack()
             // appear, which means the strip path is intact under IL2CPP.
             yield return LoadAndInit(initialConsent: SampleAppUi.Consent.Full);
 
-            _root!.Q<TextField>(SampleAppUi.IdentityFields.Id).value = "downgrade-user-" + DateTime.UtcNow.Ticks;
+            _root!.Q<TextField>(SampleAppUi.IdentityFields.Id).value = "email|downgrade-user-" + DateTime.UtcNow.Ticks;
             _root.Q<Button>(SampleAppUi.Buttons.Identify).Click();
             yield return SampleAppTestHelpers.WaitForLogEntry(_root, SampleAppUi.LogLabels.Identify, LogLevels.Ok, 5f);
 
@@ -426,7 +441,7 @@ public IEnumerator IdentifyTraits_AfterIdentify_FlushReportsOk()
             // a different reflection/serialiser path than Identify(id) alone.
             yield return LoadAndInit(initialConsent: SampleAppUi.Consent.Full);
 
-            _root!.Q<TextField>(SampleAppUi.IdentityFields.Id).value = "traits-user-" + DateTime.UtcNow.Ticks;
+            _root!.Q<TextField>(SampleAppUi.IdentityFields.Id).value = "email|traits-user-" + DateTime.UtcNow.Ticks;
             _root.Q<Button>(SampleAppUi.Buttons.Identify).Click();
             yield return SampleAppTestHelpers.WaitForLogEntry(_root, SampleAppUi.LogLabels.Identify, LogLevels.Ok, 5f);
 
@@ -735,7 +750,7 @@ public IEnumerator IdentityPanel_PopulatesUserIdAfterIdentify()
         {
             yield return LoadAndInit(initialConsent: SampleAppUi.Consent.Full);
 
-            var userId = "panel-user-" + DateTime.UtcNow.Ticks;
+            var userId = "email|panel-user-" + DateTime.UtcNow.Ticks;
             _root!.Q<TextField>(SampleAppUi.IdentityFields.Id).value = userId;
             _root.Q<Button>(SampleAppUi.Buttons.Identify).Click();
             yield return SampleAppTestHelpers.WaitForLogEntry(_root, SampleAppUi.LogLabels.Identify, LogLevels.Ok, 5f);
diff --git a/examples/audience/Assets/SampleApp/Tests/Runtime/SampleAppUi.cs b/examples/audience/Assets/SampleApp/Tests/Runtime/SampleAppUi.cs
index 52dc9f8e..14e7a11d 100644
--- a/examples/audience/Assets/SampleApp/Tests/Runtime/SampleAppUi.cs
+++ b/examples/audience/Assets/SampleApp/Tests/Runtime/SampleAppUi.cs
@@ -154,6 +154,9 @@ internal static class LogLabels
             internal const string Identify = "identify()";
             internal const string IdentifyTraits = "identify(traits)";
             internal const string Alias = "alias()";
+
+            // Label AudienceSample.cs.RouteSdkLogToPane gives every mirrored SDK log line.
+            internal const string Sdk = "sdk";
         }
 
         // ---- Consent dropdown / status values ----
diff --git a/src/Packages/Audience/Runtime/ImmutableAudience.cs b/src/Packages/Audience/Runtime/ImmutableAudience.cs
index 4c8c075e..750f3520 100644
--- a/src/Packages/Audience/Runtime/ImmutableAudience.cs
+++ b/src/Packages/Audience/Runtime/ImmutableAudience.cs
@@ -4,6 +4,7 @@
 using System.Collections.Generic;
 using System.IO;
 using System.Net.Http;
+using System.Text.RegularExpressions;
 using System.Threading;
 using System.Threading.Tasks;
 
@@ -40,6 +41,15 @@ public static class ImmutableAudience
         // Gate against overlapping timer ticks (Timer callbacks run on independent ThreadPool threads).
         private static int _sendInFlight;
 
+        // Passport IDs are "<connection>|<id>" (e.g. "email|abc123", "google-oauth2|123")
+        // or, for some accounts, a bare UUID with no connection prefix.
+        // Not RegexOptions.Compiled: that needs Reflection.Emit, unavailable under IL2CPP/AOT.
+        private static readonly Regex PassportIdPattern = new(@"^[^|]+\|[^|]+$");
+
+        private static readonly Regex PassportUuidPattern = new(
+            @"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
+            RegexOptions.IgnoreCase);
+
         // volatile: assigned on the Unity main thread at SubsystemRegistration,
         // read from the drain thread in Track / Identify paths.
         // The assignments happen before any event can fire in practice, but
@@ -411,7 +421,10 @@ private static void TrackFromSession(string eventName, Dictionary<string, object
         // -----------------------------------------------------------------
 
         /// <summary>
-        /// Attaches a known user ID to subsequent events.
+        /// Attaches a known user ID to subsequent events. When <paramref name="identityType"/> is
+        /// <see cref="IdentityType.Passport"/>, <paramref name="userId"/> must look like a real
+        /// Passport ID (<c>connection|id</c> or a UUID) — otherwise the call is dropped and a
+        /// warning is logged.
         /// </summary>
         /// <param name="userId">The player's identifier within the chosen provider.</param>
         /// <param name="identityType">The identity provider that issued <paramref name="userId"/>.</param>
@@ -427,6 +440,15 @@ public static void Identify(string userId, IdentityType identityType, Dictionary
                 return;
             }
 
+            // Trim once: the validated id and the stored/sent id must match.
+            userId = userId.Trim();
+
+            if (identityType == IdentityType.Passport && !IsValidPassportId(userId))
+            {
+                Log.Warn(AudienceLogs.IdentifyPassportIdInvalidFormat(userId));
+                return;
+            }
+
             AudienceConfig? config;
             ConsentLevel level;
             // Update consent + userId under the init lock so they always move
@@ -453,8 +475,17 @@ public static void Identify(string userId, IdentityType identityType, Dictionary
             EnqueueIdentity(msg);
         }
 
+        private static bool IsValidPassportId(string id)
+        {
+            var trimmed = id.Trim();
+            return PassportIdPattern.IsMatch(trimmed) || PassportUuidPattern.IsMatch(trimmed);
+        }
+
         /// <summary>
-        /// Links two user IDs for the same player.
+        /// Links two user IDs for the same player. When either side's identity
+        /// type is <see cref="IdentityType.Passport"/>, that side's id must look
+        /// like a real Passport ID (<c>connection|id</c> or a UUID) — otherwise
+        /// the call is dropped and a warning is logged.
         /// </summary>
         /// <param name="fromId">The previously-known identifier.</param>
         /// <param name="fromType">Identity provider for <paramref name="fromId"/>.</param>
@@ -469,6 +500,22 @@ public static void Alias(string fromId, IdentityType fromType, string toId, Iden
                 Log.Warn(AudienceLogs.AliasEmptyIds);
                 return;
             }
+
+            // Trim once: the validated ids and the sent ids must match.
+            fromId = fromId.Trim();
+            toId = toId.Trim();
+
+            if (fromType == IdentityType.Passport && !IsValidPassportId(fromId))
+            {
+                Log.Warn(AudienceLogs.AliasPassportIdInvalidFormat("from", fromId));
+                return;
+            }
+            if (toType == IdentityType.Passport && !IsValidPassportId(toId))
+            {
+                Log.Warn(AudienceLogs.AliasPassportIdInvalidFormat("to", toId));
+                return;
+            }
+
             var state = _state;
             if (!state.Level.CanIdentify())
             {
diff --git a/src/Packages/Audience/Runtime/Utility/Log.cs b/src/Packages/Audience/Runtime/Utility/Log.cs
index 94104ae9..b2fe30fe 100644
--- a/src/Packages/Audience/Runtime/Utility/Log.cs
+++ b/src/Packages/Audience/Runtime/Utility/Log.cs
@@ -76,9 +76,19 @@ internal static string TrackIEventEmptyName(string evtTypeName) =>
         internal static string IdentifyDiscarded(ConsentLevel current) =>
             $"Identify discarded. Requires Full consent, current is {current}.";
 
+        internal static string IdentifyPassportIdInvalidFormat(string userId) =>
+            $"Identify called with identityType Passport but userId \"{userId}\" doesn't look like a " +
+            "Passport ID (expected a format like \"email|123\" or a UUID). Check you're passing the " +
+            "Passport user ID, not your own internal user ID. Call ignored.";
+
         internal static string AliasDiscarded(ConsentLevel current) =>
             $"Alias discarded. Requires Full consent, current is {current}.";
 
+        internal static string AliasPassportIdInvalidFormat(string side, string id) =>
+            $"Alias called with {side}Type Passport but {side}Id \"{id}\" doesn't look like a " +
+            "Passport ID (expected a format like \"email|123\" or a UUID). Check you're passing the " +
+            "Passport user ID, not your own internal user ID. Call ignored.";
+
         // ---- Consent / Shutdown ----
 
         internal static string ConsentPersistFailed(Exception ex) =>
diff --git a/src/Packages/Audience/Tests/Runtime/ImmutableAudienceTests.cs b/src/Packages/Audience/Tests/Runtime/ImmutableAudienceTests.cs
index 52a9f178..f4e66f45 100644
--- a/src/Packages/Audience/Tests/Runtime/ImmutableAudienceTests.cs
+++ b/src/Packages/Audience/Tests/Runtime/ImmutableAudienceTests.cs
@@ -737,12 +737,139 @@ public void Identify_AnonymousConsent_IsIgnored()
                 "identify should be discarded at Anonymous consent");
         }
 
+        [Test]
+        public void Identify_PassportWithInvalidIdFormat_WarnsAndDropsCall()
+        {
+            var lines = new List<string>();
+            Log.Writer = lines.Add;
+            try
+            {
+                ImmutableAudience.Init(MakeConfig(ConsentLevel.Full));
+
+                ImmutableAudience.Identify("12345", IdentityType.Passport);
+                ImmutableAudience.Shutdown();
+
+                Assert.That(lines, Has.Some.Contains("doesn't look like a"),
+                    "a malformed passport id should surface a warning so a developer notices the mismatch");
+                Assert.IsNull(ImmutableAudience.UserId,
+                    "the call must be a full no-op so later Track/Page calls don't inherit the bad id");
+
+                var queueDir = AudiencePaths.QueueDir(_testDir);
+                var contents = Directory.GetFiles(queueDir, "*.json")
+                    .Select(File.ReadAllText).ToList();
+                Assert.IsFalse(contents.Any(c => c.Contains("\"identify\"")),
+                    "the event should be dropped, not just flagged; a warning alone isn't enough to " +
+                    "stop the bad id from reaching downstream analytics");
+            }
+            finally
+            {
+                Log.Writer = null;
+            }
+        }
+
+        [TestCase("email|abc123")]
+        [TestCase("google-oauth2|11261203362550278288455")]
+        [TestCase("550e8400-e29b-41d4-a716-446655440000")]
+        [TestCase(" 550e8400-e29b-41d4-a716-446655440000\n")]
+        public void Identify_PassportWithValidIdFormat_DoesNotWarn(string userId)
+        {
+            var lines = new List<string>();
+            Log.Writer = lines.Add;
+            try
+            {
+                ImmutableAudience.Init(MakeConfig(ConsentLevel.Full));
+
+                ImmutableAudience.Identify(userId, IdentityType.Passport);
+
+                Assert.IsEmpty(lines);
+            }
+            finally
+            {
+                Log.Writer = null;
+            }
+        }
+
+        [Test]
+        public void Identify_PassportWithWhitespaceOnlyPadding_StillWarns()
+        {
+            var lines = new List<string>();
+            Log.Writer = lines.Add;
+            try
+            {
+                ImmutableAudience.Init(MakeConfig(ConsentLevel.Full));
+
+                ImmutableAudience.Identify("  12345  ", IdentityType.Passport);
+
+                Assert.That(lines, Has.Some.Contains("doesn't look like a"),
+                    "surrounding whitespace alone must not turn an invalid id into a valid one");
+            }
+            finally
+            {
+                Log.Writer = null;
+            }
+        }
+
+        [Test]
+        public void Identify_PassportWithPaddedValidId_StoresAndSendsTrimmedId()
+        {
+            ImmutableAudience.Init(MakeConfig(ConsentLevel.Full));
+
+            ImmutableAudience.Identify(" email|abc123\n", IdentityType.Passport);
+
+            Assert.AreEqual("email|abc123", ImmutableAudience.UserId,
+                "the id validated and the id stored must be the same trimmed value");
+
+            ImmutableAudience.Shutdown();
+
+            var queueDir = AudiencePaths.QueueDir(_testDir);
+            var contents = Directory.GetFiles(queueDir, "*.json").Select(File.ReadAllText).ToList();
+            Assert.IsTrue(contents.Any(c => c.Contains("\"email|abc123\"")),
+                "the enqueued event must carry the trimmed id, not the padded one");
+            Assert.IsFalse(contents.Any(c => c.Contains("email|abc123\\n")),
+                "the enqueued event must not carry the untrimmed padding");
+        }
+
+        [Test]
+        public void Alias_PassportWithPaddedValidId_SendsTrimmedId()
+        {
+            ImmutableAudience.Init(MakeConfig(ConsentLevel.Full));
+
+            ImmutableAudience.Alias("steam123", IdentityType.Steam, " email|user_456\n", IdentityType.Passport);
+            ImmutableAudience.Shutdown();
+
+            var queueDir = AudiencePaths.QueueDir(_testDir);
+            var contents = Directory.GetFiles(queueDir, "*.json").Select(File.ReadAllText).ToList();
+            Assert.IsTrue(contents.Any(c => c.Contains("\"email|user_456\"")),
+                "the enqueued event must carry the trimmed id, not the padded one");
+            Assert.IsFalse(contents.Any(c => c.Contains("email|user_456\\n")),
+                "the enqueued event must not carry the untrimmed padding");
+        }
+
+        [Test]
+        public void Identify_NonPassportWithNumericId_DoesNotWarn()
+        {
+            var lines = new List<string>();
+            Log.Writer = lines.Add;
+            try
+            {
+                ImmutableAudience.Init(MakeConfig(ConsentLevel.Full));
+
+                ImmutableAudience.Identify("12345", IdentityType.Steam);
+
+                Assert.IsEmpty(lines);
+            }
+            finally
+            {
+                Log.Writer = null;
+            }
+        }
+
         [Test]
         public void Alias_FullConsent_WritesAliasEvent()
         {
             ImmutableAudience.Init(MakeConfig(ConsentLevel.Full));
 
-            ImmutableAudience.Alias("steam123", IdentityType.Steam, "user_456", IdentityType.Passport);
+            ImmutableAudience.Alias("steam123", IdentityType.Steam, "email|user_456", IdentityType.Passport);
             ImmutableAudience.Shutdown();
 
             var queueDir = AudiencePaths.QueueDir(_testDir);
@@ -752,6 +879,79 @@ public void Alias_FullConsent_WritesAliasEvent()
                 c.Contains("\"alias\"") && c.Contains("\"steam123\"")));
         }
 
+        [Test]
+        public void Alias_PassportToWithInvalidIdFormat_WarnsAndDropsCall()
+        {
+            var lines = new List<string>();
+            Log.Writer = lines.Add;
+            try
+            {
+                ImmutableAudience.Init(MakeConfig(ConsentLevel.Full));
+
+                ImmutableAudience.Alias("steam123", IdentityType.Steam, "12345", IdentityType.Passport);
+                ImmutableAudience.Shutdown();
+
+                Assert.That(lines, Has.Some.Contains("doesn't look like a"),
+                    "a malformed passport id on the to side should surface a warning");
+
+                var queueDir = AudiencePaths.QueueDir(_testDir);
+                var contents = Directory.GetFiles(queueDir, "*.json")
+                    .Select(File.ReadAllText).ToList();
+                Assert.IsFalse(contents.Any(c => c.Contains("\"alias\"")),
+                    "the event should be dropped, not just flagged");
+            }
+            finally
+            {
+                Log.Writer = null;
+            }
+        }
+
+        [Test]
+        public void Alias_PassportFromWithInvalidIdFormat_WarnsAndDropsCall()
+        {
+            var lines = new List<string>();
+            Log.Writer = lines.Add;
+            try
+            {
+                ImmutableAudience.Init(MakeConfig(ConsentLevel.Full));
+
+                ImmutableAudience.Alias("12345", IdentityType.Passport, "steam123", IdentityType.Steam);
+                ImmutableAudience.Shutdown();
+
+                Assert.That(lines, Has.Some.Contains("doesn't look like a"),
+                    "a malformed passport id on the from side should surface a warning");
+
+                var queueDir = AudiencePaths.QueueDir(_testDir);
+                var contents = Directory.GetFiles(queueDir, "*.json")
+                    .Select(File.ReadAllText).ToList();
+                Assert.IsFalse(contents.Any(c => c.Contains("\"alias\"")),
+                    "the event should be dropped, not just flagged");
+            }
+            finally
+            {
+                Log.Writer = null;
+            }
+        }
+
+        [Test]
+        public void Alias_NonPassportIdentityTypes_DoesNotWarn()
+        {
+            var lines = new List<string>();
+            Log.Writer = lines.Add;
+            try
+            {
+                ImmutableAudience.Init(MakeConfig(ConsentLevel.Full));
+
+                ImmutableAudience.Alias("12345", IdentityType.Steam, "67890", IdentityType.Epic);
+
+                Assert.IsEmpty(lines);
+            }
+            finally
+            {
+                Log.Writer = null;
+            }
+        }
+
         // -----------------------------------------------------------------
         // sessionId envelope field
         // -----------------------------------------------------------------
@@ -820,7 +1020,7 @@ public void Alias_ActiveSession_EnvelopeIncludesSessionId()
             var sessionId = ImmutableAudience.SessionId;
             Assert.IsFalse(string.IsNullOrEmpty(sessionId), "sanity: a session should be active after Init");
 
-            ImmutableAudience.Alias("steam123", IdentityType.Steam, "user_456", IdentityType.Passport);
+            ImmutableAudience.Alias("steam123", IdentityType.Steam, "email|user_456", IdentityType.Passport);
             ImmutableAudience.FlushQueueToDiskForTesting();
 
             var queueDir = AudiencePaths.QueueDir(_testDir);
@@ -2065,7 +2265,7 @@ public void FullToAnonymous_KeepsQueuedIdentifyAliasAndUserId()
             ImmutableAudience.Init(MakeConfig(ConsentLevel.Full));
 
             ImmutableAudience.Identify("player_steam", IdentityType.Steam);
-            ImmutableAudience.Alias("player_steam", IdentityType.Steam, "player_passport", IdentityType.Passport);
+            ImmutableAudience.Alias("player_steam", IdentityType.Steam, "email|player_passport", IdentityType.Passport);
             ImmutableAudience.Track("tracked_before_downgrade");
 
             ImmutableAudience.FlushQueueToDiskForTesting();