feat(audience): mirror server-side event validation client-side

Brings client-side validation to parity with the ingest API so bad
events are caught and dropped locally instead of round-tripping to
the server just to be rejected.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: nattb8

examples/audience/Assets/SampleApp/Scripts/AudienceSample.cs

@@ -237,10 +237,10 @@ private void OnAlias() => RunAndLog("alias()", () =>
         {
             var f = CaptureAliasForm();
             ImmutableAudience.Alias(f.FromId, ParseIdentityType(f.FromType), f.ToId, ParseIdentityType(f.ToType));
-            // SDK drops via Log.Warn when fromId/toId is empty or consent < Full.
-            // The IsAliasReady gate keeps empty endpoints unreachable from the
-            // UI; this post-call check is defense-in-depth.
-            var accepted = !string.IsNullOrEmpty(f.FromId) && !string.IsNullOrEmpty(f.ToId);
+            // SDK drops via Log.Warn when fromId/toId is empty, identical, or
+            // consent < Full. The IsAliasReady gate keeps empty endpoints
+            // unreachable from the UI; this post-call check is defense-in-depth.
+            var accepted = !string.IsNullOrEmpty(f.FromId) && !string.IsNullOrEmpty(f.ToId) && f.FromId != f.ToId;
             if (accepted)
             {
                 _mirrorAliases.Add($"{f.FromType}:{f.FromId} → {f.ToType}:{f.ToId}");

examples/audience/Assets/SampleApp/Tests/Runtime/SampleAppLiveFireTests.cs

@@ -280,6 +280,22 @@ public IEnumerator Alias_AndFlush_FlushReportsOk()
             yield return FlushAndAssertNoErrors();
         }
 
+        [UnityTest]
+        public IEnumerator Alias_SameId_WarnsAndDropsCall()
+        {
+            // Type-independence (same id, different identityType is still
+            // dropped) is covered by the fast unit test
+            // Alias_IdenticalIdsDifferentTypes_StillWarnsAndDropsCall; this
+            // only needs to prove the UI path wires up to that same check.
+            yield return LoadAndInit(initialConsent: SampleAppUi.Consent.Full);
+
+            var sameId = "email|same-" + DateTime.UtcNow.Ticks;
+            _root!.Q<TextField>(SampleAppUi.IdentityFields.AliasFromId).value = sameId;
+            _root.Q<TextField>(SampleAppUi.IdentityFields.AliasToId).value = sameId;
+            _root.Q<Button>(SampleAppUi.Buttons.Alias).Click();
+            yield return SampleAppTestHelpers.WaitForLogEntry(_root, SampleAppUi.LogLabels.Sdk, LogLevels.Warn, 5f);
+        }
+
         [UnityTest]
         public IEnumerator SetConsent_None_KeepsQueueAndPersists()
         {

src/Packages/Audience/Runtime/Core/Constants.cs

@@ -14,6 +14,7 @@ internal static class Constants
         internal const int DefaultFlushSize = 20;
         internal const int MaxBatchSize = 100;
         internal const int StaleEventDays = 30;
+        internal const int MaxClockSkewFutureHours = 24; // Backend rejects eventTimestamp further ahead than this.
         internal const int MaxFieldLength = 256; // Backend schema limit.
         internal const int ControlPlaneRequestTimeoutSeconds = 30;
 

src/Packages/Audience/Runtime/ImmutableAudience.cs

@@ -482,7 +482,8 @@ private static bool IsValidPassportId(string id)
         }
 
         /// <summary>
-        /// Links two user IDs for the same player. When either side's identity
+        /// Links two user IDs for the same player. <paramref name="fromId"/> and
+        /// <paramref name="toId"/> must differ. When either side's identity
         /// type is <see cref="IdentityType.Passport"/>, that side's id must look
         /// like a real Passport ID (<c>connection|id</c> or a UUID) — otherwise
         /// the call is dropped and a warning is logged.
@@ -505,6 +506,12 @@ public static void Alias(string fromId, IdentityType fromType, string toId, Iden
             fromId = fromId.Trim();
             toId = toId.Trim();
 
+            if (fromId == toId)
+            {
+                Log.Warn(AudienceLogs.AliasIdenticalIds);
+                return;
+            }
+
             if (fromType == IdentityType.Passport && !IsValidPassportId(fromId))
             {
                 Log.Warn(AudienceLogs.AliasPassportIdInvalidFormat("from", fromId));

src/Packages/Audience/Runtime/Transport/DiskStore.cs

@@ -39,16 +39,21 @@ internal void Write(string json)
             }
         }
 
-        // Returns up to maxSize file paths, oldest first. Stale files
-        // (older than Constants.StaleEventDays) are deleted and excluded.
+        // Returns up to maxSize file paths, oldest first. Files outside the
+        // backend's accepted eventTimestamp window (more than StaleEventDays
+        // in the past, or more than MaxClockSkewFutureHours in the future --
+        // e.g. from a device with a badly-skewed system clock) are deleted
+        // and excluded: the backend would reject them anyway.
         internal IReadOnlyList<string> ReadBatch(int maxSize)
         {
             if (maxSize <= 0)
                 return Array.Empty<string>();
 
             maxSize = Math.Min(maxSize, Constants.MaxBatchSize);
 
-            var cutoff = DateTime.UtcNow.AddDays(-Constants.StaleEventDays);
+            var now = DateTime.UtcNow;
+            var pastCutoff = now.AddDays(-Constants.StaleEventDays);
+            var futureCutoff = now.AddHours(Constants.MaxClockSkewFutureHours);
 
             var result = new List<string>();
 
@@ -65,13 +70,13 @@ internal IReadOnlyList<string> ReadBatch(int maxSize)
                 if (result.Count >= maxSize)
                     break;
 
-                // Stale check: parse ticks from filename prefix
+                // Window check: parse ticks from filename prefix
                 var name = Path.GetFileNameWithoutExtension(path);
                 var underscoreIdx = name.IndexOf('_');
                 if (underscoreIdx > 0 && long.TryParse(name.Substring(0, underscoreIdx), out var ticks))
                 {
                     var fileTime = new DateTime(ticks, DateTimeKind.Utc);
-                    if (fileTime < cutoff)
+                    if (fileTime < pastCutoff || fileTime > futureCutoff)
                     {
                         TryDelete(path);
                         continue;

src/Packages/Audience/Runtime/Utility/Log.cs

@@ -73,6 +73,9 @@ internal static string TrackIEventEmptyName(string evtTypeName) =>
         internal const string AliasEmptyIds =
             "Alias called with null or empty fromId/toId. Dropping.";
 
+        internal const string AliasIdenticalIds =
+            "Alias called with identical fromId and toId. Dropping.";
+
         internal static string IdentifyDiscarded(ConsentLevel current) =>
             $"Identify discarded. Requires Full consent, current is {current}.";
 

src/Packages/Audience/Tests/Runtime/ImmutableAudienceTests.cs

@@ -933,6 +933,63 @@ public void Alias_PassportFromWithInvalidIdFormat_WarnsAndDropsCall()
             }
         }
 
+        [Test]
+        public void Alias_IdenticalIds_WarnsAndDropsCall()
+        {
+            var lines = new List<string>();
+            Log.Writer = lines.Add;
+            try
+            {
+                ImmutableAudience.Init(MakeConfig(ConsentLevel.Full));
+
+                ImmutableAudience.Alias("same_id", IdentityType.Steam, "same_id", IdentityType.Steam);
+                ImmutableAudience.Shutdown();
+
+                Assert.That(lines, Has.Some.Contains("identical fromId and toId"),
+                    "identical ids should surface a warning");
+
+                var queueDir = AudiencePaths.QueueDir(_testDir);
+                var contents = Directory.GetFiles(queueDir, "*.json")
+                    .Select(File.ReadAllText).ToList();
+                Assert.IsFalse(contents.Any(c => c.Contains("\"alias\"")),
+                    "the event should be dropped, not just flagged");
+            }
+            finally
+            {
+                Log.Writer = null;
+            }
+        }
+
+        [Test]
+        public void Alias_IdenticalIdsDifferentTypes_StillWarnsAndDropsCall()
+        {
+            // Matches the backend: it rejects on id equality alone, ignoring
+            // identityType, so the client must reject this case too instead
+            // of sending something the backend will bounce.
+            var lines = new List<string>();
+            Log.Writer = lines.Add;
+            try
+            {
+                ImmutableAudience.Init(MakeConfig(ConsentLevel.Full));
+
+                ImmutableAudience.Alias("same_id", IdentityType.Steam, "same_id", IdentityType.Email);
+                ImmutableAudience.Shutdown();
+
+                Assert.That(lines, Has.Some.Contains("identical fromId and toId"),
+                    "identical ids should surface a warning even with different identityTypes");
+
+                var queueDir = AudiencePaths.QueueDir(_testDir);
+                var contents = Directory.GetFiles(queueDir, "*.json")
+                    .Select(File.ReadAllText).ToList();
+                Assert.IsFalse(contents.Any(c => c.Contains("\"alias\"")),
+                    "the event should be dropped, not just flagged");
+            }
+            finally
+            {
+                Log.Writer = null;
+            }
+        }
+
         [Test]
         public void Alias_NonPassportIdentityTypes_DoesNotWarn()
         {

src/Packages/Audience/Tests/Runtime/Transport/DiskStoreTests.cs

@@ -106,6 +106,22 @@ public void ReadBatch_ExcludesAndDeletesStaleFiles()
             Assert.IsFalse(File.Exists(Path.Combine(queueDir, staleName)), "stale file should be deleted");
         }
 
+        [Test]
+        public void ReadBatch_ExcludesAndDeletesFutureSkewedFiles()
+        {
+            _store.Write("{\"fresh\":true}");
+
+            var skewedTime = DateTime.UtcNow.AddHours(Constants.MaxClockSkewFutureHours + 1);
+            var skewedName = $"{skewedTime.Ticks}_{Guid.NewGuid():N}.json";
+            var queueDir = AudiencePaths.QueueDir(_testDir);
+            File.WriteAllText(Path.Combine(queueDir, skewedName), "{\"skewed\":true}");
+
+            var batch = _store.ReadBatch(10);
+
+            Assert.AreEqual(1, batch.Count, "future-skewed file should be excluded from batch");
+            Assert.IsFalse(File.Exists(Path.Combine(queueDir, skewedName)), "future-skewed file should be deleted");
+        }
+
         [Test]
         public void Delete_RemovesSpecifiedFiles()
         {