From 2182853fd7e7678728c8b6f5782f3ab697814d91 Mon Sep 17 00:00:00 2001
From: Natalie Bunduwongse <natalie.bunduwongse@immutable.com>
Date: Mon, 27 Jul 2026 11:04:21 +1200
Subject: [PATCH] fix(audience): remove insecure client-side data-deletion

ImmutableAudience.DeleteData let any caller holding the (public)
publishable key request deletion of another player's data, with no
way to prove ownership. Removed the method along with its now-dead
constants, tests, and sample-app usage; erasure must go through the
backend with secret-key auth instead.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .../SampleApp/Resources/AudienceSample.uxml   |   5 -
 .../SampleApp/Scripts/AudienceSample.UI.cs    |   6 +-
 .../SampleApp/Scripts/AudienceSample.cs       |  14 --
 .../Tests/Runtime/SampleAppLiveFireTests.cs   |  14 --
 .../SampleApp/Tests/Runtime/SampleAppUi.cs    |   2 -
 .../Audience/Runtime/Core/Constants.cs        |   3 -
 .../Audience/Runtime/Core/Identity.cs         |   2 +-
 .../Audience/Runtime/ImmutableAudience.cs     |  61 ------
 .../Tests/Runtime/Core/IdentityTests.cs       |   2 +-
 .../Audience/Tests/Runtime/DeleteDataTests.cs | 200 ------------------
 .../Tests/Runtime/DeleteDataTests.cs.meta     |  11 -
 11 files changed, 4 insertions(+), 316 deletions(-)
 delete mode 100644 src/Packages/Audience/Tests/Runtime/DeleteDataTests.cs
 delete mode 100644 src/Packages/Audience/Tests/Runtime/DeleteDataTests.cs.meta

diff --git a/examples/audience/Assets/SampleApp/Resources/AudienceSample.uxml b/examples/audience/Assets/SampleApp/Resources/AudienceSample.uxml
index ffe03aa5f..3c7182b98 100644
--- a/examples/audience/Assets/SampleApp/Resources/AudienceSample.uxml
+++ b/examples/audience/Assets/SampleApp/Resources/AudienceSample.uxml
@@ -158,11 +158,6 @@
                                 <ui:Label class="btn-label" text="Shutdown" />
                                 <ui:Label class="btn-sig" text="shutdown()" />
                             </ui:Button>
-
-                            <ui:Button name="btn-delete-data" class="with-sig">
-                                <ui:Label class="btn-label" text="Delete data" />
-                                <ui:Label class="btn-sig" text="deleteData()" />
-                            </ui:Button>
                         </ui:VisualElement>
 
                     </ui:VisualElement>
diff --git a/examples/audience/Assets/SampleApp/Scripts/AudienceSample.UI.cs b/examples/audience/Assets/SampleApp/Scripts/AudienceSample.UI.cs
index 059bf91fb..ee8d1b099 100644
--- a/examples/audience/Assets/SampleApp/Scripts/AudienceSample.UI.cs
+++ b/examples/audience/Assets/SampleApp/Scripts/AudienceSample.UI.cs
@@ -54,7 +54,7 @@ private static readonly (string TabId, string PanelId)[] Tabs =
         private Toggle _testMode;
         private DropdownField _initialConsent;
         private Toggle _debug, _enableMobileAttribution;
-        private Button _btnInit, _btnFlush, _btnReset, _btnShutdown, _btnDeleteData, _btnRequestAtt;
+        private Button _btnInit, _btnFlush, _btnReset, _btnShutdown, _btnRequestAtt;
 
         // ---- UXML element fields (Consent tab) ----
 
@@ -203,7 +203,6 @@ private void BindElements()
             _btnFlush       = Require<Button>("btn-flush");
             _btnReset       = Require<Button>("btn-reset");
             _btnShutdown    = Require<Button>("btn-shutdown");
-            _btnDeleteData  = Require<Button>("btn-delete-data");
             _btnRequestAtt  = Require<Button>("btn-request-att");
 
             ApplyMobilePlatformVisibility();
@@ -334,7 +333,6 @@ private void RegisterHandlers()
             _btnFlush.clicked += async () => await OnFlushAsync();
             _btnReset.clicked += OnReset;
             _btnShutdown.clicked += OnShutdown;
-            _btnDeleteData.clicked += async () => await OnDeleteDataAsync();
             _btnRequestAtt.clicked += async () => await OnRequestAttAsync();
             _btnIdentify.clicked += OnIdentify;
             _btnIdentifyTraits.clicked += OnIdentifyTraits;
@@ -635,7 +633,7 @@ private void RefreshConsentPills()
 
         private void RefreshInitState()
         {
-            foreach (var b in new[] { _btnFlush, _btnReset, _btnShutdown, _btnDeleteData, _btnCustomEvent, _btnIdentify, _btnIdentifyTraits })
+            foreach (var b in new[] { _btnFlush, _btnReset, _btnShutdown, _btnCustomEvent, _btnIdentify, _btnIdentifyTraits })
                 b.SetEnabled(_initialised);
             foreach (var p in _consentPills.Values) p.SetEnabled(_initialised);
             foreach (var btn in _typedEventsHost.Query<Button>().ToList()) btn.SetEnabled(_initialised);
diff --git a/examples/audience/Assets/SampleApp/Scripts/AudienceSample.cs b/examples/audience/Assets/SampleApp/Scripts/AudienceSample.cs
index 7ebd273d9..36e3fc7ee 100644
--- a/examples/audience/Assets/SampleApp/Scripts/AudienceSample.cs
+++ b/examples/audience/Assets/SampleApp/Scripts/AudienceSample.cs
@@ -99,20 +99,6 @@ private async Task OnFlushAsync()
             catch (Exception ex) { AppendLog("flush()", ex.Message, LogLevel.Err, LogSource.App); }
         }
 
-        private async Task OnDeleteDataAsync()
-        {
-            AppendLog("deleteData()", "erasure request dispatched", LogLevel.Info, LogSource.App);
-            try
-            {
-                await ImmutableAudience.DeleteData();
-                AppendLog("deleteData()", "backend acknowledged", LogLevel.Ok, LogSource.App);
-            }
-            catch (Exception ex)
-            {
-                AppendLog("deleteData()", ex.Message, LogLevel.Err, LogSource.App);
-            }
-        }
-
         private async Task OnRequestAttAsync()
         {
             AppendLog("requestTrackingAuthorizationAsync()", "ATT request dispatched", LogLevel.Info, LogSource.App);
diff --git a/examples/audience/Assets/SampleApp/Tests/Runtime/SampleAppLiveFireTests.cs b/examples/audience/Assets/SampleApp/Tests/Runtime/SampleAppLiveFireTests.cs
index d949d28bd..3a9ef544e 100644
--- a/examples/audience/Assets/SampleApp/Tests/Runtime/SampleAppLiveFireTests.cs
+++ b/examples/audience/Assets/SampleApp/Tests/Runtime/SampleAppLiveFireTests.cs
@@ -388,20 +388,6 @@ public IEnumerator Reset_RegeneratesAnonymousIdAndAcceptsTrack()
             yield return FlushAndAssertNoErrors();
         }
 
-        [UnityTest]
-        public IEnumerator DeleteData_AcknowledgesFromBackend()
-        {
-            // DeleteData hits the control-plane HTTP endpoint, distinct from
-            // the event-batch POST. Catches IL2CPP strips on the control HttpClient
-            // path that the regular Flush tests don't exercise.
-            yield return LoadAndInit();
-
-            _root!.Q<Button>(SampleAppUi.Buttons.DeleteData).Click();
-            yield return SampleAppTestHelpers.WaitForLogEntry(_root, SampleAppUi.LogLabels.DeleteData, LogLevels.Ok, 30f);
-
-            AssertNoErrors();
-        }
-
         [UnityTest]
         public IEnumerator ReInit_AfterShutdown_AcceptsTrack()
         {
diff --git a/examples/audience/Assets/SampleApp/Tests/Runtime/SampleAppUi.cs b/examples/audience/Assets/SampleApp/Tests/Runtime/SampleAppUi.cs
index 14e7a11d9..4b7aae03a 100644
--- a/examples/audience/Assets/SampleApp/Tests/Runtime/SampleAppUi.cs
+++ b/examples/audience/Assets/SampleApp/Tests/Runtime/SampleAppUi.cs
@@ -52,7 +52,6 @@ internal static class Buttons
             internal const string Flush = "btn-flush";
             internal const string Reset = "btn-reset";
             internal const string Shutdown = "btn-shutdown";
-            internal const string DeleteData = "btn-delete-data";
             internal const string ConsentNone = "btn-consent-none";
             internal const string ConsentAnon = "btn-consent-anon";
             internal const string ConsentFull = "btn-consent-full";
@@ -148,7 +147,6 @@ internal static class LogLabels
             internal const string Flush = "flush()";
             internal const string Reset = "reset()";
             internal const string Shutdown = "shutdown()";
-            internal const string DeleteData = "deleteData()";
             internal const string Track = "track()";
             internal const string SetConsent = "setConsent()";
             internal const string Identify = "identify()";
diff --git a/src/Packages/Audience/Runtime/Core/Constants.cs b/src/Packages/Audience/Runtime/Core/Constants.cs
index f2b22c077..fe61c9722 100644
--- a/src/Packages/Audience/Runtime/Core/Constants.cs
+++ b/src/Packages/Audience/Runtime/Core/Constants.cs
@@ -8,7 +8,6 @@ internal static class Constants
 
         internal const string MessagesPath = "/v1/audience/messages";
         internal const string ConsentPath = "/v1/audience/tracking-consent";
-        internal const string DataPath = "/v1/audience/data";
 
         internal const int DefaultFlushIntervalSeconds = 5;
         internal const int DefaultFlushSize = 20;
@@ -29,8 +28,6 @@ internal static string MessagesUrl(string? baseUrlOverride = null) =>
             BaseUrl(baseUrlOverride) + MessagesPath;
         internal static string ConsentUrl(string? baseUrlOverride = null) =>
             BaseUrl(baseUrlOverride) + ConsentPath;
-        internal static string DataUrl(string? baseUrlOverride = null) =>
-            BaseUrl(baseUrlOverride) + DataPath;
 
         internal static string BaseUrl(string? baseUrlOverride = null)
         {
diff --git a/src/Packages/Audience/Runtime/Core/Identity.cs b/src/Packages/Audience/Runtime/Core/Identity.cs
index 0d987576f..02af1f33e 100644
--- a/src/Packages/Audience/Runtime/Core/Identity.cs
+++ b/src/Packages/Audience/Runtime/Core/Identity.cs
@@ -17,7 +17,7 @@ internal sealed class Identity
         private static volatile string? _cachedDeviceId;
         private static readonly object _sync = new object();
 
-        // Returns the existing anonymous ID without creating one. Used by DeleteData.
+        // Returns the existing anonymous ID without creating one.
         internal static string? Get(string persistentDataPath)
         {
             if (_cachedAnonId != null) return _cachedAnonId;
diff --git a/src/Packages/Audience/Runtime/ImmutableAudience.cs b/src/Packages/Audience/Runtime/ImmutableAudience.cs
index 5420610e6..5ea2b2d83 100644
--- a/src/Packages/Audience/Runtime/ImmutableAudience.cs
+++ b/src/Packages/Audience/Runtime/ImmutableAudience.cs
@@ -580,67 +580,6 @@ public static void Reset()
             newSession?.Start();
         }
 
-        /// <summary>
-        /// Asks the backend to erase this player's data.
-        /// </summary>
-        /// <param name="userId">
-        /// Optional. The known user ID to delete. When null, the SDK uses
-        /// the device's persisted anonymous ID.
-        /// </param>
-        /// <returns>A task that completes when the backend has responded.</returns>
-        public static Task DeleteData(string? userId = null)
-        {
-            if (!_initialized) return Task.CompletedTask;
-
-            var config = _config;
-            var client = _controlClient;
-            if (config == null || client == null) return Task.CompletedTask;
-
-            string query;
-            if (!string.IsNullOrEmpty(userId))
-            {
-                query = "userId=" + Uri.EscapeDataString(userId);
-            }
-            else
-            {
-                // Get (not GetOrCreate): a fresh install must not register an id just to delete it.
-                var anonymousId = Identity.Get(config.PersistentDataPath!);
-                if (string.IsNullOrEmpty(anonymousId))
-                    return Task.CompletedTask;
-                query = "anonymousId=" + Uri.EscapeDataString(anonymousId);
-            }
-
-            var url = Constants.DataUrl(config.BaseUrl) + "?" + query;
-            var onError = config.OnError;
-            var publishableKey = config.PublishableKey;
-            var cancellationToken = _shutdownCancellationSource?.Token ?? CancellationToken.None;
-
-            return Task.Run(async () =>
-            {
-                try
-                {
-                    using var request = new HttpRequestMessage(HttpMethod.Delete, url);
-                    request.Headers.Add(Constants.PublishableKeyHeader, publishableKey);
-                    using var response = await client.SendAsync(request, cancellationToken).ConfigureAwait(false);
-
-                    if (!response.IsSuccessStatusCode)
-                    {
-                        NotifyErrorCallback(onError, AudienceErrorCode.NetworkError,
-                            $"Data delete failed with status {(int)response.StatusCode}");
-                    }
-                }
-                catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
-                {
-                    // Shutdown cancelled; caller is tearing down, no error fired.
-                }
-                catch (Exception ex)
-                {
-                    NotifyErrorCallback(onError, AudienceErrorCode.NetworkError,
-                        $"Data delete threw: {ex.Message}");
-                }
-            });
-        }
-
         private static void NotifyErrorCallback(Action<AudienceError>? onError, AudienceErrorCode code, string message)
         {
             if (onError == null) return;
diff --git a/src/Packages/Audience/Tests/Runtime/Core/IdentityTests.cs b/src/Packages/Audience/Tests/Runtime/Core/IdentityTests.cs
index d0e87abf7..28884cc41 100644
--- a/src/Packages/Audience/Tests/Runtime/Core/IdentityTests.cs
+++ b/src/Packages/Audience/Tests/Runtime/Core/IdentityTests.cs
@@ -222,7 +222,7 @@ public void Reset_DeletesFile()
         }
 
         // -----------------------------------------------------------------
-        // Get (non-creating read for DeleteData)
+        // Get (non-creating read)
         // -----------------------------------------------------------------
 
         [Test]
diff --git a/src/Packages/Audience/Tests/Runtime/DeleteDataTests.cs b/src/Packages/Audience/Tests/Runtime/DeleteDataTests.cs
deleted file mode 100644
index 54233e1ce..000000000
--- a/src/Packages/Audience/Tests/Runtime/DeleteDataTests.cs
+++ /dev/null
@@ -1,200 +0,0 @@
-using System;
-using System.Collections.Generic;
-using System.IO;
-using System.Linq;
-using System.Net;
-using System.Net.Http;
-using System.Threading;
-using System.Threading.Tasks;
-using NUnit.Framework;
-
-namespace Immutable.Audience.Tests
-{
-    [TestFixture]
-    internal class DeleteDataTests
-    {
-        private string _testDir;
-
-        [SetUp]
-        public void SetUp()
-        {
-            _testDir = Path.Combine(Path.GetTempPath(), Path.GetRandomFileName());
-            Directory.CreateDirectory(_testDir);
-        }
-
-        [TearDown]
-        public void TearDown()
-        {
-            ImmutableAudience.ResetState();
-            Identity.Reset(_testDir);
-            if (Directory.Exists(_testDir))
-                Directory.Delete(_testDir, recursive: true);
-        }
-
-        private AudienceConfig MakeConfig(CapturingHandler handler, ConsentLevel consent = ConsentLevel.Full)
-        {
-            return new AudienceConfig
-            {
-                PublishableKey = "pk_imapik-test-key1",
-                Consent = consent,
-                PersistentDataPath = _testDir,
-                FlushIntervalSeconds = 600,
-                FlushSize = 1000,
-                HttpHandler = handler
-            };
-        }
-
-        /// <summary>
-        /// Records every request and returns a caller-configurable status.
-        /// Signals when a request lands so tests can await the async Task.Run path.
-        /// </summary>
-        private class CapturingHandler : HttpMessageHandler
-        {
-            internal readonly List<HttpRequestMessage> Requests = new List<HttpRequestMessage>();
-            internal readonly ManualResetEventSlim RequestSent = new ManualResetEventSlim(false);
-            internal HttpStatusCode Status { get; set; } = HttpStatusCode.Accepted;
-
-            protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken ct)
-            {
-                Requests.Add(request);
-                RequestSent.Set();
-                return Task.FromResult(new HttpResponseMessage(Status));
-            }
-        }
-
-        private static void WaitForRequest(CapturingHandler handler)
-        {
-            Assert.IsTrue(handler.RequestSent.Wait(TimeSpan.FromSeconds(5)),
-                "DeleteData's background HTTP call never fired");
-        }
-
-        [Test]
-        public void DeleteData_WithUserId_FiresDelete_WithUserIdQuery()
-        {
-            var handler = new CapturingHandler();
-            ImmutableAudience.Init(MakeConfig(handler));
-
-            ImmutableAudience.DeleteData(userId: "player-42");
-            WaitForRequest(handler);
-
-            // Filter out the game_launch POST from Init.
-            HttpRequestMessage deleteRequest = null;
-            foreach (var r in handler.Requests)
-                if (r.Method == HttpMethod.Delete) { deleteRequest = r; break; }
-
-            Assert.IsNotNull(deleteRequest, "expected a DELETE request");
-            StringAssert.Contains(Constants.DataPath, deleteRequest.RequestUri!.ToString());
-            StringAssert.Contains("userId=player-42", deleteRequest.RequestUri.Query);
-            Assert.IsTrue(deleteRequest.Headers.Contains("x-immutable-publishable-key"),
-                "publishable key header must be attached");
-        }
-
-        [Test]
-        public void DeleteData_NoUserId_WithExistingAnonymousId_FiresDelete_WithAnonymousIdQuery()
-        {
-            // Seed an anonymousId as if the player had tracked in a prior session.
-            var seeded = Identity.GetOrCreate(_testDir, ConsentLevel.Anonymous);
-            Assert.IsNotNull(seeded);
-
-            var handler = new CapturingHandler();
-            ImmutableAudience.Init(MakeConfig(handler));
-
-            ImmutableAudience.DeleteData();
-            WaitForRequest(handler);
-
-            HttpRequestMessage deleteRequest = null;
-            foreach (var r in handler.Requests)
-                if (r.Method == HttpMethod.Delete) { deleteRequest = r; break; }
-
-            Assert.IsNotNull(deleteRequest);
-            StringAssert.Contains($"anonymousId={seeded}", deleteRequest.RequestUri!.Query);
-        }
-
-        [Test]
-        public void DeleteData_NoUserId_NoAnonymousId_DoesNotFireRequest()
-        {
-            // Use Consent.None so Init's game_launch is suppressed: the only way
-            // to guarantee no HTTP request fires at all.
-            var handler = new CapturingHandler();
-            ImmutableAudience.Init(MakeConfig(handler, ConsentLevel.None));
-
-            Assert.IsFalse(handler.RequestSent.IsSet,
-                "precondition: no request yet");
-
-            ImmutableAudience.DeleteData();
-
-            // Give any errant background task a moment to fire.
-            Thread.Sleep(250);
-
-            Assert.IsFalse(handler.RequestSent.IsSet,
-                "no anonymousId and no userId must mean no request");
-        }
-
-        [Test]
-        public void DeleteData_DoesNotCreateAnonymousIdFile()
-        {
-            var handler = new CapturingHandler();
-            ImmutableAudience.Init(MakeConfig(handler, ConsentLevel.None));
-
-            ImmutableAudience.DeleteData(userId: "some-user");
-            // Even with a userId request, the anonymousId file must not materialise.
-            Thread.Sleep(250);
-
-            var identityPath = AudiencePaths.IdentityFile(_testDir);
-            Assert.IsFalse(File.Exists(identityPath),
-                "DeleteData must not create the anonymousId file as a side effect");
-        }
-
-        [Test]
-        public async Task DeleteData_ReturnsTask_ThatCompletesAfterRequest()
-        {
-            var handler = new CapturingHandler();
-            ImmutableAudience.Init(MakeConfig(handler));
-
-            var task = ImmutableAudience.DeleteData(userId: "player-42");
-            Assert.IsNotNull(task, "DeleteData must return a non-null Task");
-
-            // Await directly: no need for the RequestSent gate when the task
-            // already represents completion.
-            await task;
-
-            Assert.IsTrue(handler.Requests.Any(r => r.Method == HttpMethod.Delete),
-                "DELETE request must have been sent by the time the task completes");
-        }
-
-        [Test]
-        public void DeleteData_BeforeInit_ReturnsCompletedTask()
-        {
-            // Not initialised: must not throw, must return a completed Task.
-            ImmutableAudience.ResetState();
-
-            var task = ImmutableAudience.DeleteData(userId: "player-42");
-
-            Assert.IsNotNull(task);
-            Assert.IsTrue(task.IsCompleted, "DeleteData before Init must return an already-completed Task");
-        }
-
-        [Test]
-        public void DeleteData_ServerError_InvokesOnError()
-        {
-            var handler = new CapturingHandler { Status = HttpStatusCode.InternalServerError };
-            var received = new ManualResetEventSlim(false);
-            AudienceError captured = null;
-
-            var config = MakeConfig(handler);
-            config.OnError = err =>
-            {
-                captured = err;
-                received.Set();
-            };
-            ImmutableAudience.Init(config);
-
-            ImmutableAudience.DeleteData(userId: "player-42");
-
-            Assert.IsTrue(received.Wait(TimeSpan.FromSeconds(5)),
-                "OnError should fire when DeleteData's response is non-2xx");
-            Assert.AreEqual(AudienceErrorCode.NetworkError, captured.Code);
-            StringAssert.Contains("500", captured.Message);
-        }
-    }
-}
diff --git a/src/Packages/Audience/Tests/Runtime/DeleteDataTests.cs.meta b/src/Packages/Audience/Tests/Runtime/DeleteDataTests.cs.meta
deleted file mode 100644
index ad82cebac..000000000
--- a/src/Packages/Audience/Tests/Runtime/DeleteDataTests.cs.meta
+++ /dev/null
@@ -1,11 +0,0 @@
-fileFormatVersion: 2
-guid: 35e76d7540e6f474bbfba9b1a9589e40
-MonoImporter:
-  externalObjects: {}
-  serializedVersion: 2
-  defaultReferences: []
-  executionOrder: 0
-  icon: {instanceID: 0}
-  userData: 
-  assetBundleName: 
-  assetBundleVariant: