diff --git a/services/identity/src/client_service.rs b/services/identity/src/client_service.rs
index 077e4bbf0..af6c22811 100644
--- a/services/identity/src/client_service.rs
+++ b/services/identity/src/client_service.rs
@@ -1,1241 +1,1304 @@
 // Standard library imports
 use std::str::FromStr;
 
 // External crate imports
 use comm_lib::aws::DynamoDBError;
 use comm_lib::shared::reserved_users::RESERVED_USERNAME_SET;
 use comm_opaque2::grpc::protocol_error_to_grpc_status;
 use rand::rngs::OsRng;
 use serde::{Deserialize, Serialize};
 use siwe::eip55;
 use tonic::Response;
 use tracing::{debug, error, info, warn};
 
 // Workspace crate imports
 use crate::config::CONFIG;
 use crate::constants::{error_types, tonic_status_messages};
 use crate::database::{
   DBDeviceTypeInt, DatabaseClient, DeviceType, KeyPayload
 };
 use crate::device_list::SignedDeviceList;
 use crate::error::{DeviceListError, Error as DBError};
 use crate::grpc_services::authenticated::DeletePasswordUserInfo;
 use crate::grpc_services::protos::unauth::{
   find_user_id_request, AddReservedUsernamesRequest, AuthResponse, Empty,
   ExistingDeviceLoginRequest, FindUserIdRequest, FindUserIdResponse,
   GenerateNonceResponse, OpaqueLoginFinishRequest, OpaqueLoginStartRequest,
   OpaqueLoginStartResponse, RegistrationFinishRequest, RegistrationStartRequest,
   RegistrationStartResponse, RemoveReservedUsernameRequest,
   ReservedRegistrationStartRequest, ReservedWalletRegistrationRequest,
   SecondaryDeviceKeysUploadRequest, VerifyUserAccessTokenRequest,
   VerifyUserAccessTokenResponse, WalletAuthRequest, GetFarcasterUsersRequest,
   GetFarcasterUsersResponse
 };
 use crate::grpc_services::shared::get_platform_metadata;
 use crate::grpc_utils::{
   DeviceKeyUploadActions, RegistrationActions, SignedNonce
 };
 use crate::nonce::generate_nonce_data;
 use crate::reserved_users::{
   validate_account_ownership_message_and_get_user_id,
   validate_add_reserved_usernames_message,
   validate_remove_reserved_username_message,
 };
 use crate::siwe::{
   is_valid_ethereum_address, parse_and_verify_siwe_message, SocialProof,
 };
 use crate::token::{AccessTokenData, AuthType};
 pub use crate::grpc_services::protos::unauth::identity_client_service_server::{
     IdentityClientService, IdentityClientServiceServer,
   };
 use crate::regex::is_valid_username;
 
 #[derive(Clone, Serialize, Deserialize)]
 pub enum WorkflowInProgress {
   Registration(Box<UserRegistrationInfo>),
   Login(Box<UserLoginInfo>),
   Update(UpdateState),
   PasswordUserDeletion(Box<DeletePasswordUserInfo>),
 }
 
 #[derive(Clone, Serialize, Deserialize)]
 pub struct UserRegistrationInfo {
   pub username: String,
   pub flattened_device_key_upload: FlattenedDeviceKeyUpload,
   pub user_id: Option<String>,
   pub farcaster_id: Option<String>,
   pub initial_device_list: Option<SignedDeviceList>,
 }
 
 #[derive(Clone, Serialize, Deserialize)]
 pub struct UserLoginInfo {
   pub user_id: String,
   pub username: String,
   pub flattened_device_key_upload: FlattenedDeviceKeyUpload,
   pub opaque_server_login: comm_opaque2::server::Login,
   pub device_to_remove: Option<String>,
 }
 
 #[derive(Clone, Serialize, Deserialize)]
 pub struct UpdateState {
   pub user_id: String,
 }
 
 #[derive(Clone, Serialize, Deserialize)]
 pub struct FlattenedDeviceKeyUpload {
   pub device_id_key: String,
   pub key_payload: String,
   pub key_payload_signature: String,
   pub content_prekey: String,
   pub content_prekey_signature: String,
   pub content_one_time_keys: Vec<String>,
   pub notif_prekey: String,
   pub notif_prekey_signature: String,
   pub notif_one_time_keys: Vec<String>,
   pub device_type: DeviceType,
 }
 
 #[derive(derive_more::Constructor)]
 pub struct ClientService {
   client: DatabaseClient,
 }
 
 #[tonic::async_trait]
 impl IdentityClientService for ClientService {
   #[tracing::instrument(skip_all)]
   async fn register_password_user_start(
     &self,
     request: tonic::Request<RegistrationStartRequest>,
   ) -> Result<tonic::Response<RegistrationStartResponse>, tonic::Status> {
     let message = request.into_inner();
     debug!("Received registration request for: {}", message.username);
 
     if !is_valid_username(&message.username)
       || is_valid_ethereum_address(&message.username)
     {
       return Err(tonic::Status::invalid_argument(
         tonic_status_messages::INVALID_USERNAME,
       ));
     }
 
     self.check_username_taken(&message.username).await?;
     let username_in_reserved_usernames_table = self
       .client
       .username_in_reserved_usernames_table(&message.username)
       .await
       .map_err(handle_db_error)?;
 
     if username_in_reserved_usernames_table {
       return Err(tonic::Status::already_exists(
         tonic_status_messages::USERNAME_ALREADY_EXISTS,
       ));
     }
 
     if RESERVED_USERNAME_SET.contains(&message.username) {
       return Err(tonic::Status::invalid_argument(
         tonic_status_messages::USERNAME_RESERVED,
       ));
     }
 
     if let Some(fid) = &message.farcaster_id {
       self.check_farcaster_id_taken(fid).await?;
     }
 
     let registration_state = construct_user_registration_info(
       &message,
       None,
       message.username.clone(),
       message.farcaster_id.clone(),
     )?;
+    self
+      .check_device_id_taken(
+        &registration_state.flattened_device_key_upload,
+        None,
+      )
+      .await?;
     let server_registration = comm_opaque2::server::Registration::new();
     let server_message = server_registration
       .start(
         &CONFIG.server_setup,
         &message.opaque_registration_request,
         message.username.as_bytes(),
       )
       .map_err(protocol_error_to_grpc_status)?;
     let session_id = self
       .client
       .insert_workflow(WorkflowInProgress::Registration(Box::new(
         registration_state,
       )))
       .await
       .map_err(handle_db_error)?;
 
     let response = RegistrationStartResponse {
       session_id,
       opaque_registration_response: server_message,
     };
     Ok(Response::new(response))
   }
 
   #[tracing::instrument(skip_all)]
   async fn register_reserved_password_user_start(
     &self,
     request: tonic::Request<ReservedRegistrationStartRequest>,
   ) -> Result<tonic::Response<RegistrationStartResponse>, tonic::Status> {
     let message = request.into_inner();
     self.check_username_taken(&message.username).await?;
 
     if RESERVED_USERNAME_SET.contains(&message.username) {
       return Err(tonic::Status::invalid_argument(
         tonic_status_messages::USERNAME_RESERVED,
       ));
     }
 
     let username_in_reserved_usernames_table = self
       .client
       .username_in_reserved_usernames_table(&message.username)
       .await
       .map_err(handle_db_error)?;
     if !username_in_reserved_usernames_table {
       return Err(tonic::Status::permission_denied(
         tonic_status_messages::USERNAME_NOT_RESERVED,
       ));
     }
 
     let user_id = validate_account_ownership_message_and_get_user_id(
       &message.username,
       &message.keyserver_message,
       &message.keyserver_signature,
     )?;
 
     let registration_state = construct_user_registration_info(
       &message,
       Some(user_id),
       message.username.clone(),
       None,
     )?;
+    self
+      .check_device_id_taken(
+        &registration_state.flattened_device_key_upload,
+        None,
+      )
+      .await?;
     let server_registration = comm_opaque2::server::Registration::new();
     let server_message = server_registration
       .start(
         &CONFIG.server_setup,
         &message.opaque_registration_request,
         message.username.as_bytes(),
       )
       .map_err(protocol_error_to_grpc_status)?;
 
     let session_id = self
       .client
       .insert_workflow(WorkflowInProgress::Registration(Box::new(
         registration_state,
       )))
       .await
       .map_err(handle_db_error)?;
 
     let response = RegistrationStartResponse {
       session_id,
       opaque_registration_response: server_message,
     };
     Ok(Response::new(response))
   }
 
   #[tracing::instrument(skip_all)]
   async fn register_password_user_finish(
     &self,
     request: tonic::Request<RegistrationFinishRequest>,
   ) -> Result<tonic::Response<AuthResponse>, tonic::Status> {
     let platform_metadata = get_platform_metadata(&request)?;
     let message = request.into_inner();
 
     if let Some(WorkflowInProgress::Registration(state)) = self
       .client
       .get_workflow(message.session_id)
       .await
       .map_err(handle_db_error)?
     {
       let server_registration = comm_opaque2::server::Registration::new();
       let password_file = server_registration
         .finish(&message.opaque_registration_upload)
         .map_err(protocol_error_to_grpc_status)?;
 
       let login_time = chrono::Utc::now();
       let device_id = state.flattened_device_key_upload.device_id_key.clone();
       let username = state.username.clone();
       let user_id = self
         .client
         .add_password_user_to_users_table(
           *state,
           password_file,
           platform_metadata,
           login_time,
         )
         .await
         .map_err(handle_db_error)?;
 
       // Create access token
       let token = AccessTokenData::with_created_time(
         user_id.clone(),
         device_id,
         login_time,
         crate::token::AuthType::Password,
         &mut OsRng,
       );
 
       let access_token = token.access_token.clone();
 
       self
         .client
         .put_access_token_data(token)
         .await
         .map_err(handle_db_error)?;
 
       let response = AuthResponse {
         user_id,
         access_token,
         username,
       };
       Ok(Response::new(response))
     } else {
       Err(tonic::Status::not_found(
         tonic_status_messages::SESSION_NOT_FOUND,
       ))
     }
   }
 
   #[tracing::instrument(skip_all)]
   async fn log_in_password_user_start(
     &self,
     request: tonic::Request<OpaqueLoginStartRequest>,
   ) -> Result<tonic::Response<OpaqueLoginStartResponse>, tonic::Status> {
     let message = request.into_inner();
 
     debug!("Attempting to log in user: {:?}", &message.username);
     let user_id_and_password_file = self
       .client
       .get_user_id_and_password_file_from_username(&message.username)
       .await
       .map_err(handle_db_error)?;
 
     let (user_id, password_file_bytes) =
       if let Some(data) = user_id_and_password_file {
         data
       } else {
         // It's possible that the user attempting login is already registered
         // on Ashoat's keyserver. If they are, we should send back a gRPC status
         // code instructing them to get a signed message from Ashoat's keyserver
         // in order to claim their username and register with the Identity
         // service.
         let username_in_reserved_usernames_table = self
           .client
           .username_in_reserved_usernames_table(&message.username)
           .await
           .map_err(handle_db_error)?;
 
         if username_in_reserved_usernames_table {
           return Err(tonic::Status::permission_denied(
             tonic_status_messages::NEED_KEYSERVER_MESSAGE_TO_CLAIM_USERNAME,
           ));
         }
 
         return Err(tonic::Status::not_found(
           tonic_status_messages::USER_NOT_FOUND,
         ));
       };
 
     let flattened_device_key_upload =
       construct_flattened_device_key_upload(&message)?;
+    self
+      .check_device_id_taken(&flattened_device_key_upload, Some(&user_id))
+      .await?;
 
     let maybe_device_to_remove = self
       .get_keyserver_device_to_remove(
         &user_id,
         &flattened_device_key_upload.device_id_key,
         message.force.unwrap_or(false),
         &flattened_device_key_upload.device_type,
       )
       .await?;
 
     let mut server_login = comm_opaque2::server::Login::new();
     let server_response = server_login
       .start(
         &CONFIG.server_setup,
         &password_file_bytes,
         &message.opaque_login_request,
         message.username.as_bytes(),
       )
       .map_err(protocol_error_to_grpc_status)?;
 
     let login_state = construct_user_login_info(
       user_id,
       message.username,
       server_login,
       flattened_device_key_upload,
       maybe_device_to_remove,
     )?;
 
     let session_id = self
       .client
       .insert_workflow(WorkflowInProgress::Login(Box::new(login_state)))
       .await
       .map_err(handle_db_error)?;
 
     let response = Response::new(OpaqueLoginStartResponse {
       session_id,
       opaque_login_response: server_response,
     });
     Ok(response)
   }
 
   #[tracing::instrument(skip_all)]
   async fn log_in_password_user_finish(
     &self,
     request: tonic::Request<OpaqueLoginFinishRequest>,
   ) -> Result<tonic::Response<AuthResponse>, tonic::Status> {
     let platform_metadata = get_platform_metadata(&request)?;
     let message = request.into_inner();
 
     if let Some(WorkflowInProgress::Login(state)) = self
       .client
       .get_workflow(message.session_id)
       .await
       .map_err(handle_db_error)?
     {
       let mut server_login = state.opaque_server_login.clone();
       server_login
         .finish(&message.opaque_login_upload)
         .map_err(protocol_error_to_grpc_status)?;
 
       if let Some(device_to_remove) = state.device_to_remove {
         self
           .client
           .remove_device(state.user_id.clone(), device_to_remove)
           .await
           .map_err(handle_db_error)?;
       }
 
       let login_time = chrono::Utc::now();
       self
         .client
         .add_user_device(
           state.user_id.clone(),
           state.flattened_device_key_upload.clone(),
           platform_metadata,
           login_time,
         )
         .await
         .map_err(handle_db_error)?;
 
       // Create access token
       let token = AccessTokenData::with_created_time(
         state.user_id.clone(),
         state.flattened_device_key_upload.device_id_key,
         login_time,
         crate::token::AuthType::Password,
         &mut OsRng,
       );
 
       let access_token = token.access_token.clone();
 
       self
         .client
         .put_access_token_data(token)
         .await
         .map_err(handle_db_error)?;
 
       let response = AuthResponse {
         user_id: state.user_id,
         access_token,
         username: state.username,
       };
       Ok(Response::new(response))
     } else {
       Err(tonic::Status::not_found(
         tonic_status_messages::SESSION_NOT_FOUND,
       ))
     }
   }
 
   #[tracing::instrument(skip_all)]
   async fn log_in_wallet_user(
     &self,
     request: tonic::Request<WalletAuthRequest>,
   ) -> Result<tonic::Response<AuthResponse>, tonic::Status> {
     let platform_metadata = get_platform_metadata(&request)?;
     let message = request.into_inner();
 
     // WalletAuthRequest is used for both log_in_wallet_user and register_wallet_user
     if !message.initial_device_list.is_empty() {
       return Err(tonic::Status::invalid_argument(
         tonic_status_messages::UNEXPECTED_INITIAL_DEVICE_LIST,
       ));
     }
 
     let parsed_message = parse_and_verify_siwe_message(
       &message.siwe_message,
       &message.siwe_signature,
     )?;
 
     self.verify_and_remove_nonce(&parsed_message.nonce).await?;
 
     let wallet_address = eip55(&parsed_message.address);
 
     let flattened_device_key_upload =
       construct_flattened_device_key_upload(&message)?;
 
     let login_time = chrono::Utc::now();
     let Some(user_id) = self
       .client
       .get_user_id_from_user_info(wallet_address.clone(), &AuthType::Wallet)
       .await
       .map_err(handle_db_error)?
     else {
       // It's possible that the user attempting login is already registered
       // on Ashoat's keyserver. If they are, we should send back a gRPC status
       // code instructing them to get a signed message from Ashoat's keyserver
       // in order to claim their wallet address and register with the Identity
       // service.
       let username_in_reserved_usernames_table = self
         .client
         .username_in_reserved_usernames_table(&wallet_address)
         .await
         .map_err(handle_db_error)?;
 
       if username_in_reserved_usernames_table {
         return Err(tonic::Status::permission_denied(
           tonic_status_messages::NEED_KEYSERVER_MESSAGE_TO_CLAIM_USERNAME,
         ));
       }
 
       return Err(tonic::Status::not_found(
         tonic_status_messages::USER_NOT_FOUND,
       ));
     };
 
+    self
+      .check_device_id_taken(&flattened_device_key_upload, Some(&user_id))
+      .await?;
+
     self
       .client
       .add_user_device(
         user_id.clone(),
         flattened_device_key_upload.clone(),
         platform_metadata,
         chrono::Utc::now(),
       )
       .await
       .map_err(handle_db_error)?;
 
     // Create access token
     let token = AccessTokenData::with_created_time(
       user_id.clone(),
       flattened_device_key_upload.device_id_key,
       login_time,
       crate::token::AuthType::Wallet,
       &mut OsRng,
     );
 
     let access_token = token.access_token.clone();
 
     self
       .client
       .put_access_token_data(token)
       .await
       .map_err(handle_db_error)?;
 
     let response = AuthResponse {
       user_id,
       access_token,
       username: wallet_address,
     };
     Ok(Response::new(response))
   }
 
   #[tracing::instrument(skip_all)]
   async fn register_wallet_user(
     &self,
     request: tonic::Request<WalletAuthRequest>,
   ) -> Result<tonic::Response<AuthResponse>, tonic::Status> {
     let platform_metadata = get_platform_metadata(&request)?;
     let message = request.into_inner();
 
     let parsed_message = parse_and_verify_siwe_message(
       &message.siwe_message,
       &message.siwe_signature,
     )?;
 
     match self
       .client
       .get_nonce_from_nonces_table(&parsed_message.nonce)
       .await
       .map_err(handle_db_error)?
     {
       None => {
         return Err(tonic::Status::invalid_argument(
           tonic_status_messages::INVALID_NONCE,
         ))
       }
       Some(nonce) if nonce.is_expired() => {
         // we don't need to remove the nonce from the table here
         // because the DynamoDB TTL will take care of it
         return Err(tonic::Status::aborted(
           tonic_status_messages::NONCE_EXPIRED,
         ));
       }
       Some(_) => self
         .client
         .remove_nonce_from_nonces_table(&parsed_message.nonce)
         .await
         .map_err(handle_db_error)?,
     };
 
     let wallet_address = eip55(&parsed_message.address);
 
     self.check_wallet_address_taken(&wallet_address).await?;
     let username_in_reserved_usernames_table = self
       .client
       .username_in_reserved_usernames_table(&wallet_address)
       .await
       .map_err(handle_db_error)?;
 
     if username_in_reserved_usernames_table {
       return Err(tonic::Status::already_exists(
         tonic_status_messages::WALLET_ADDRESS_TAKEN,
       ));
     }
 
     if let Some(fid) = &message.farcaster_id {
       self.check_farcaster_id_taken(fid).await?;
     }
 
     let flattened_device_key_upload =
       construct_flattened_device_key_upload(&message)?;
+    self
+      .check_device_id_taken(&flattened_device_key_upload, None)
+      .await?;
 
     let login_time = chrono::Utc::now();
 
     let initial_device_list = message.get_and_verify_initial_device_list()?;
     let social_proof =
       SocialProof::new(message.siwe_message, message.siwe_signature);
 
     let user_id = self
       .client
       .add_wallet_user_to_users_table(
         flattened_device_key_upload.clone(),
         wallet_address.clone(),
         social_proof,
         None,
         platform_metadata,
         login_time,
         message.farcaster_id,
         initial_device_list,
       )
       .await
       .map_err(handle_db_error)?;
 
     // Create access token
     let token = AccessTokenData::with_created_time(
       user_id.clone(),
       flattened_device_key_upload.device_id_key,
       login_time,
       crate::token::AuthType::Wallet,
       &mut OsRng,
     );
 
     let access_token = token.access_token.clone();
 
     self
       .client
       .put_access_token_data(token)
       .await
       .map_err(handle_db_error)?;
 
     let response = AuthResponse {
       user_id,
       access_token,
       username: wallet_address,
     };
     Ok(Response::new(response))
   }
 
   #[tracing::instrument(skip_all)]
   async fn register_reserved_wallet_user(
     &self,
     request: tonic::Request<ReservedWalletRegistrationRequest>,
   ) -> Result<tonic::Response<AuthResponse>, tonic::Status> {
     let platform_metadata = get_platform_metadata(&request)?;
     let message = request.into_inner();
 
     let parsed_message = parse_and_verify_siwe_message(
       &message.siwe_message,
       &message.siwe_signature,
     )?;
 
     self.verify_and_remove_nonce(&parsed_message.nonce).await?;
 
     let wallet_address = eip55(&parsed_message.address);
 
     self.check_wallet_address_taken(&wallet_address).await?;
 
     let wallet_address_in_reserved_usernames_table = self
       .client
       .username_in_reserved_usernames_table(&wallet_address)
       .await
       .map_err(handle_db_error)?;
     if !wallet_address_in_reserved_usernames_table {
       return Err(tonic::Status::permission_denied(
         tonic_status_messages::WALLET_ADDRESS_NOT_RESERVED,
       ));
     }
 
     let user_id = validate_account_ownership_message_and_get_user_id(
       &wallet_address,
       &message.keyserver_message,
       &message.keyserver_signature,
     )?;
 
     let flattened_device_key_upload =
       construct_flattened_device_key_upload(&message)?;
+    self
+      .check_device_id_taken(&flattened_device_key_upload, None)
+      .await?;
 
     let initial_device_list = message.get_and_verify_initial_device_list()?;
     let social_proof =
       SocialProof::new(message.siwe_message, message.siwe_signature);
 
     let login_time = chrono::Utc::now();
     self
       .client
       .add_wallet_user_to_users_table(
         flattened_device_key_upload.clone(),
         wallet_address.clone(),
         social_proof,
         Some(user_id.clone()),
         platform_metadata,
         login_time,
         None,
         initial_device_list,
       )
       .await
       .map_err(handle_db_error)?;
 
     let token = AccessTokenData::with_created_time(
       user_id.clone(),
       flattened_device_key_upload.device_id_key,
       login_time,
       crate::token::AuthType::Wallet,
       &mut OsRng,
     );
 
     let access_token = token.access_token.clone();
 
     self
       .client
       .put_access_token_data(token)
       .await
       .map_err(handle_db_error)?;
 
     let response = AuthResponse {
       user_id,
       access_token,
       username: wallet_address,
     };
 
     Ok(Response::new(response))
   }
 
   #[tracing::instrument(skip_all)]
   async fn upload_keys_for_registered_device_and_log_in(
     &self,
     request: tonic::Request<SecondaryDeviceKeysUploadRequest>,
   ) -> Result<tonic::Response<AuthResponse>, tonic::Status> {
     let platform_metadata = get_platform_metadata(&request)?;
     let message = request.into_inner();
 
     let challenge_response = SignedNonce::try_from(&message)?;
     let flattened_device_key_upload =
       construct_flattened_device_key_upload(&message)?;
 
     let user_id = message.user_id;
     let device_id = flattened_device_key_upload.device_id_key.clone();
 
     let nonce = challenge_response.verify_and_get_nonce(&device_id)?;
     self.verify_and_remove_nonce(&nonce).await?;
 
+    self
+      .check_device_id_taken(&flattened_device_key_upload, Some(&user_id))
+      .await?;
+
     let user_identity = self
       .client
       .get_user_identity(&user_id)
       .await
       .map_err(handle_db_error)?
       .ok_or_else(|| {
         tonic::Status::not_found(tonic_status_messages::USER_NOT_FOUND)
       })?;
 
     let Some(device_list) = self
       .client
       .get_current_device_list(&user_id)
       .await
       .map_err(handle_db_error)?
     else {
       warn!("User {} does not have valid device list. Secondary device auth impossible.", user_id);
       return Err(tonic::Status::aborted(
         tonic_status_messages::DEVICE_LIST_ERROR,
       ));
     };
 
     if !device_list.device_ids.contains(&device_id) {
       return Err(tonic::Status::permission_denied(
         tonic_status_messages::DEVICE_NOT_IN_DEVICE_LIST,
       ));
     }
 
     let login_time = chrono::Utc::now();
     let identifier = user_identity.identifier;
     let username = identifier.username().to_string();
     let token = AccessTokenData::with_created_time(
       user_id.clone(),
       device_id,
       login_time,
       identifier.into(),
       &mut OsRng,
     );
     let access_token = token.access_token.clone();
     self
       .client
       .put_access_token_data(token)
       .await
       .map_err(handle_db_error)?;
 
     self
       .client
       .put_device_data(
         &user_id,
         flattened_device_key_upload,
         platform_metadata,
         login_time,
       )
       .await
       .map_err(handle_db_error)?;
 
     let response = AuthResponse {
       user_id,
       access_token,
       username,
     };
     Ok(Response::new(response))
   }
 
   #[tracing::instrument(skip_all)]
   async fn log_in_existing_device(
     &self,
     request: tonic::Request<ExistingDeviceLoginRequest>,
   ) -> std::result::Result<tonic::Response<AuthResponse>, tonic::Status> {
     let message = request.into_inner();
     let challenge_response = SignedNonce::try_from(&message)?;
     let ExistingDeviceLoginRequest {
       user_id, device_id, ..
     } = message;
 
     let nonce = challenge_response.verify_and_get_nonce(&device_id)?;
     self.verify_and_remove_nonce(&nonce).await?;
 
     let (identity_response, device_list_response) = tokio::join!(
       self.client.get_user_identity(&user_id),
       self.client.get_current_device_list(&user_id)
     );
     let user_identity =
       identity_response.map_err(handle_db_error)?.ok_or_else(|| {
         tonic::Status::not_found(tonic_status_messages::USER_NOT_FOUND)
       })?;
 
     let device_list = device_list_response
       .map_err(handle_db_error)?
       .ok_or_else(|| {
         warn!("User {} does not have a valid device list.", user_id);
         tonic::Status::aborted(tonic_status_messages::DEVICE_LIST_ERROR)
       })?;
 
     if !device_list.device_ids.contains(&device_id) {
       return Err(tonic::Status::permission_denied(
         tonic_status_messages::DEVICE_NOT_IN_DEVICE_LIST,
       ));
     }
 
     let login_time = chrono::Utc::now();
     let identifier = user_identity.identifier;
     let username = identifier.username().to_string();
     let token = AccessTokenData::with_created_time(
       user_id.clone(),
       device_id,
       login_time,
       identifier.into(),
       &mut OsRng,
     );
     let access_token = token.access_token.clone();
     self
       .client
       .put_access_token_data(token)
       .await
       .map_err(handle_db_error)?;
 
     let response = AuthResponse {
       user_id,
       access_token,
       username,
     };
     Ok(Response::new(response))
   }
 
   #[tracing::instrument(skip_all)]
   async fn generate_nonce(
     &self,
     _request: tonic::Request<Empty>,
   ) -> Result<tonic::Response<GenerateNonceResponse>, tonic::Status> {
     let nonce_data = generate_nonce_data(&mut OsRng);
     match self
       .client
       .add_nonce_to_nonces_table(nonce_data.clone())
       .await
     {
       Ok(_) => Ok(Response::new(GenerateNonceResponse {
         nonce: nonce_data.nonce,
       })),
       Err(e) => Err(handle_db_error(e)),
     }
   }
 
   #[tracing::instrument(skip_all)]
   async fn verify_user_access_token(
     &self,
     request: tonic::Request<VerifyUserAccessTokenRequest>,
   ) -> Result<tonic::Response<VerifyUserAccessTokenResponse>, tonic::Status> {
     let message = request.into_inner();
     debug!("Verifying device: {}", &message.device_id);
 
     let token_valid = self
       .client
       .verify_access_token(
         message.user_id,
         message.device_id.clone(),
         message.access_token,
       )
       .await
       .map_err(handle_db_error)?;
 
     let response = Response::new(VerifyUserAccessTokenResponse { token_valid });
     debug!(
       "device {} was verified: {}",
       &message.device_id, token_valid
     );
     Ok(response)
   }
 
   #[tracing::instrument(skip_all)]
   async fn add_reserved_usernames(
     &self,
     request: tonic::Request<AddReservedUsernamesRequest>,
   ) -> Result<tonic::Response<Empty>, tonic::Status> {
     let message = request.into_inner();
 
     let user_details = validate_add_reserved_usernames_message(
       &message.message,
       &message.signature,
     )?;
 
     let filtered_user_details = self
       .client
       .filter_out_taken_usernames(user_details)
       .await
       .map_err(handle_db_error)?;
 
     self
       .client
       .add_usernames_to_reserved_usernames_table(filtered_user_details)
       .await
       .map_err(handle_db_error)?;
 
     let response = Response::new(Empty {});
     Ok(response)
   }
 
   #[tracing::instrument(skip_all)]
   async fn remove_reserved_username(
     &self,
     request: tonic::Request<RemoveReservedUsernameRequest>,
   ) -> Result<tonic::Response<Empty>, tonic::Status> {
     let message = request.into_inner();
 
     let username = validate_remove_reserved_username_message(
       &message.message,
       &message.signature,
     )?;
 
     self
       .client
       .delete_username_from_reserved_usernames_table(username)
       .await
       .map_err(handle_db_error)?;
 
     let response = Response::new(Empty {});
     Ok(response)
   }
 
   #[tracing::instrument(skip_all)]
   async fn ping(
     &self,
     _request: tonic::Request<Empty>,
   ) -> Result<Response<Empty>, tonic::Status> {
     let response = Response::new(Empty {});
     Ok(response)
   }
 
   #[tracing::instrument(skip_all)]
   async fn find_user_id(
     &self,
     request: tonic::Request<FindUserIdRequest>,
   ) -> Result<tonic::Response<FindUserIdResponse>, tonic::Status> {
     let message = request.into_inner();
 
     use find_user_id_request::Identifier;
     let (user_ident, auth_type) = match message.identifier {
       None => {
         return Err(tonic::Status::invalid_argument(
           tonic_status_messages::NO_IDENTIFIER_PROVIDED,
         ))
       }
       Some(Identifier::Username(username)) => (username, AuthType::Password),
       Some(Identifier::WalletAddress(address)) => (address, AuthType::Wallet),
     };
 
     let (is_reserved_result, user_id_result) = tokio::join!(
       self
         .client
         .username_in_reserved_usernames_table(&user_ident),
       self
         .client
         .get_user_id_from_user_info(user_ident.clone(), &auth_type),
     );
     let is_reserved = is_reserved_result.map_err(handle_db_error)?;
     let user_id = user_id_result.map_err(handle_db_error)?;
 
     Ok(Response::new(FindUserIdResponse {
       user_id,
       is_reserved,
     }))
   }
 
   #[tracing::instrument(skip_all)]
   async fn get_farcaster_users(
     &self,
     request: tonic::Request<GetFarcasterUsersRequest>,
   ) -> Result<tonic::Response<GetFarcasterUsersResponse>, tonic::Status> {
     let message = request.into_inner();
 
     let farcaster_users = self
       .client
       .get_farcaster_users(message.farcaster_ids)
       .await
       .map_err(handle_db_error)?
       .into_iter()
       .map(|d| d.0)
       .collect();
 
     Ok(Response::new(GetFarcasterUsersResponse { farcaster_users }))
   }
 }
 
 impl ClientService {
   async fn check_username_taken(
     &self,
     username: &str,
   ) -> Result<(), tonic::Status> {
     let username_taken = self
       .client
       .username_taken(username.to_string())
       .await
       .map_err(handle_db_error)?;
     if username_taken {
       return Err(tonic::Status::already_exists(
         tonic_status_messages::USERNAME_ALREADY_EXISTS,
       ));
     }
     Ok(())
   }
 
   async fn check_wallet_address_taken(
     &self,
     wallet_address: &str,
   ) -> Result<(), tonic::Status> {
     let wallet_address_taken = self
       .client
       .wallet_address_taken(wallet_address.to_string())
       .await
       .map_err(handle_db_error)?;
     if wallet_address_taken {
       return Err(tonic::Status::already_exists(
         tonic_status_messages::WALLET_ADDRESS_TAKEN,
       ));
     }
     Ok(())
   }
 
   async fn check_farcaster_id_taken(
     &self,
     farcaster_id: &str,
   ) -> Result<(), tonic::Status> {
     let fid_already_registered = !self
       .client
       .get_farcaster_users(vec![farcaster_id.to_string()])
       .await
       .map_err(handle_db_error)?
       .is_empty();
     if fid_already_registered {
       return Err(tonic::Status::already_exists(
         tonic_status_messages::FID_TAKEN,
       ));
     }
     Ok(())
   }
 
+  async fn check_device_id_taken(
+    &self,
+    key_upload: &FlattenedDeviceKeyUpload,
+    requesting_user_id: Option<&str>,
+  ) -> Result<(), tonic::Status> {
+    let device_id = key_upload.device_id_key.as_str();
+    let Some(existing_device_user_id) = self
+      .client
+      .find_user_id_for_device(device_id)
+      .await
+      .map_err(handle_db_error)?
+    else {
+      // device ID doesn't exist
+      return Ok(());
+    };
+
+    // allow already-existing device ID for the same user
+    match requesting_user_id {
+      Some(user_id) if user_id == existing_device_user_id => {
+        debug!(
+          "Found already-existing device {} for user {}",
+          device_id, user_id
+        );
+        Ok(())
+      }
+      _ => {
+        warn!("Device ID already exists: {device_id}");
+        Err(tonic::Status::already_exists(
+          tonic_status_messages::DEVICE_ID_ALREADY_EXISTS,
+        ))
+      }
+    }
+  }
+
   async fn verify_and_remove_nonce(
     &self,
     nonce: &str,
   ) -> Result<(), tonic::Status> {
     match self
       .client
       .get_nonce_from_nonces_table(nonce)
       .await
       .map_err(handle_db_error)?
     {
       None => {
         return Err(tonic::Status::invalid_argument(
           tonic_status_messages::INVALID_NONCE,
         ))
       }
       Some(nonce) if nonce.is_expired() => {
         // we don't need to remove the nonce from the table here
         // because the DynamoDB TTL will take care of it
         return Err(tonic::Status::aborted(
           tonic_status_messages::NONCE_EXPIRED,
         ));
       }
       Some(nonce_data) => self
         .client
         .remove_nonce_from_nonces_table(&nonce_data.nonce)
         .await
         .map_err(handle_db_error)?,
     };
     Ok(())
   }
 
   async fn get_keyserver_device_to_remove(
     &self,
     user_id: &str,
     new_keyserver_device_id: &str,
     force: bool,
     device_type: &DeviceType,
   ) -> Result<Option<String>, tonic::Status> {
     if device_type != &DeviceType::Keyserver {
       return Ok(None);
     }
 
     let maybe_keyserver_device_id = self
       .client
       .get_keyserver_device_id_for_user(user_id)
       .await
       .map_err(handle_db_error)?;
 
     let Some(existing_keyserver_device_id) = maybe_keyserver_device_id else {
       return Ok(None);
     };
 
     if new_keyserver_device_id == existing_keyserver_device_id {
       return Ok(None);
     }
 
     if force {
       info!(
         "keyserver {} will be removed from the device list",
         existing_keyserver_device_id
       );
       Ok(Some(existing_keyserver_device_id))
     } else {
       Err(tonic::Status::already_exists(
         tonic_status_messages::USER_ALREADY_HAS_KEYSERVER,
       ))
     }
   }
 }
 
 #[tracing::instrument(skip_all)]
 pub fn handle_db_error(db_error: DBError) -> tonic::Status {
   match db_error {
     DBError::AwsSdk(DynamoDBError::InternalServerError(_))
     | DBError::AwsSdk(DynamoDBError::ProvisionedThroughputExceededException(
       _,
     ))
     | DBError::AwsSdk(DynamoDBError::RequestLimitExceeded(_)) => {
       tonic::Status::unavailable(tonic_status_messages::RETRY)
     }
     DBError::DeviceList(DeviceListError::InvalidDeviceListUpdate) => {
       tonic::Status::invalid_argument(
         tonic_status_messages::INVALID_DEVICE_LIST_UPDATE,
       )
     }
     DBError::DeviceList(DeviceListError::InvalidSignature) => {
       tonic::Status::invalid_argument(
         tonic_status_messages::INVALID_DEVICE_LIST_SIGNATURE,
       )
     }
     e => {
       error!(
         errorType = error_types::GENERIC_DB_LOG,
         "Encountered an unexpected error: {}", e
       );
       tonic::Status::failed_precondition(
         tonic_status_messages::UNEXPECTED_ERROR,
       )
     }
   }
 }
 
 fn construct_user_registration_info(
   message: &(impl DeviceKeyUploadActions + RegistrationActions),
   user_id: Option<String>,
   username: String,
   farcaster_id: Option<String>,
 ) -> Result<UserRegistrationInfo, tonic::Status> {
   Ok(UserRegistrationInfo {
     username,
     flattened_device_key_upload: construct_flattened_device_key_upload(
       message,
     )?,
     user_id,
     farcaster_id,
     initial_device_list: message.get_and_verify_initial_device_list()?,
   })
 }
 
 fn construct_user_login_info(
   user_id: String,
   username: String,
   opaque_server_login: comm_opaque2::server::Login,
   flattened_device_key_upload: FlattenedDeviceKeyUpload,
   device_to_remove: Option<String>,
 ) -> Result<UserLoginInfo, tonic::Status> {
   Ok(UserLoginInfo {
     user_id,
     username,
     flattened_device_key_upload,
     opaque_server_login,
     device_to_remove,
   })
 }
 
 fn construct_flattened_device_key_upload(
   message: &impl DeviceKeyUploadActions,
 ) -> Result<FlattenedDeviceKeyUpload, tonic::Status> {
   let key_info = KeyPayload::from_str(&message.payload()?).map_err(|_| {
     tonic::Status::invalid_argument(tonic_status_messages::MALFORMED_PAYLOAD)
   })?;
 
   let flattened_device_key_upload = FlattenedDeviceKeyUpload {
     device_id_key: key_info.primary_identity_public_keys.ed25519,
     key_payload: message.payload()?,
     key_payload_signature: message.payload_signature()?,
     content_prekey: message.content_prekey()?,
     content_prekey_signature: message.content_prekey_signature()?,
     content_one_time_keys: message.one_time_content_prekeys()?,
     notif_prekey: message.notif_prekey()?,
     notif_prekey_signature: message.notif_prekey_signature()?,
     notif_one_time_keys: message.one_time_notif_prekeys()?,
     device_type: DeviceType::try_from(DBDeviceTypeInt(message.device_type()?))
       .map_err(handle_db_error)?,
   };
 
   Ok(flattened_device_key_upload)
 }
diff --git a/services/identity/src/constants.rs b/services/identity/src/constants.rs
index 17bf8f4a7..1339915b1 100644
--- a/services/identity/src/constants.rs
+++ b/services/identity/src/constants.rs
@@ -1,347 +1,348 @@
 use tokio::time::Duration;
 
 // Secrets
 
 pub const SECRETS_DIRECTORY: &str = "secrets";
 pub const SECRETS_SETUP_FILE: &str = "server_setup.txt";
 
 // DynamoDB
 
 // User table information, supporting opaque_ke 2.0 and X3DH information
 
 // Users can sign in either through username+password or Eth wallet.
 //
 // This structure should be aligned with the messages defined in
 // shared/protos/identity_unauthenticated.proto
 //
 // Structure for a user should be:
 // {
 //   userID: String,
 //   opaqueRegistrationData: Option<String>,
 //   username: Option<String>,
 //   walletAddress: Option<String>,
 //   devices: HashMap<String, Device>
 // }
 //
 // A device is defined as:
 // {
 //     deviceType: String, # client or keyserver
 //     keyPayload: String,
 //     keyPayloadSignature: String,
 //     identityPreKey: String,
 //     identityPreKeySignature: String,
 //     identityOneTimeKeys: Vec<String>,
 //     notifPreKey: String,
 //     notifPreKeySignature: String,
 //     notifOneTimeKeys: Vec<String>,
 //     socialProof: Option<String>
 //   }
 // }
 //
 // Additional context:
 // "devices" uses the signing public identity key of the device as a key for the devices map
 // "keyPayload" is a JSON encoded string containing identity and notif keys (both signature and verification)
 // if "deviceType" == "keyserver", then the device will not have any notif key information
 
 pub const USERS_TABLE: &str = "identity-users";
 pub const USERS_TABLE_PARTITION_KEY: &str = "userID";
 pub const USERS_TABLE_REGISTRATION_ATTRIBUTE: &str = "opaqueRegistrationData";
 pub const USERS_TABLE_USERNAME_ATTRIBUTE: &str = "username";
 pub const USERS_TABLE_DEVICES_MAP_DEVICE_TYPE_ATTRIBUTE_NAME: &str =
   "deviceType";
 pub const USERS_TABLE_WALLET_ADDRESS_ATTRIBUTE: &str = "walletAddress";
 pub const USERS_TABLE_SOCIAL_PROOF_ATTRIBUTE_NAME: &str = "socialProof";
 pub const USERS_TABLE_DEVICELIST_TIMESTAMP_ATTRIBUTE_NAME: &str =
   "deviceListTimestamp";
 pub const USERS_TABLE_FARCASTER_ID_ATTRIBUTE_NAME: &str = "farcasterID";
 pub const USERS_TABLE_USERNAME_INDEX: &str = "username-index";
 pub const USERS_TABLE_WALLET_ADDRESS_INDEX: &str = "walletAddress-index";
 pub const USERS_TABLE_FARCASTER_ID_INDEX: &str = "farcasterID-index";
 
 pub mod token_table {
   pub const NAME: &str = "identity-tokens";
   pub const PARTITION_KEY: &str = "userID";
   pub const SORT_KEY: &str = "signingPublicKey";
   pub const ATTR_CREATED: &str = "created";
   pub const ATTR_AUTH_TYPE: &str = "authType";
   pub const ATTR_VALID: &str = "valid";
   pub const ATTR_TOKEN: &str = "token";
 }
 
 pub const NONCE_TABLE: &str = "identity-nonces";
 pub const NONCE_TABLE_PARTITION_KEY: &str = "nonce";
 pub const NONCE_TABLE_CREATED_ATTRIBUTE: &str = "created";
 pub const NONCE_TABLE_EXPIRATION_TIME_ATTRIBUTE: &str = "expirationTime";
 pub const NONCE_TABLE_EXPIRATION_TIME_UNIX_ATTRIBUTE: &str =
   "expirationTimeUnix";
 
 pub const WORKFLOWS_IN_PROGRESS_TABLE: &str = "identity-workflows-in-progress";
 pub const WORKFLOWS_IN_PROGRESS_PARTITION_KEY: &str = "id";
 pub const WORKFLOWS_IN_PROGRESS_WORKFLOW_ATTRIBUTE: &str = "workflow";
 pub const WORKFLOWS_IN_PROGRESS_TABLE_EXPIRATION_TIME_UNIX_ATTRIBUTE: &str =
   "expirationTimeUnix";
 
 // Usernames reserved because they exist in Ashoat's keyserver already
 pub const RESERVED_USERNAMES_TABLE: &str = "identity-reserved-usernames";
 pub const RESERVED_USERNAMES_TABLE_PARTITION_KEY: &str = "username";
 pub const RESERVED_USERNAMES_TABLE_USER_ID_ATTRIBUTE: &str = "userID";
 
 // Users table social proof attribute
 pub const SOCIAL_PROOF_MESSAGE_ATTRIBUTE: &str = "siweMessage";
 pub const SOCIAL_PROOF_SIGNATURE_ATTRIBUTE: &str = "siweSignature";
 
 pub mod devices_table {
   /// table name
   pub const NAME: &str = "identity-devices";
   pub const TIMESTAMP_INDEX_NAME: &str = "deviceList-timestamp-index";
   pub const DEVICE_ID_INDEX_NAME: &str = "deviceID-index";
 
   /// partition key
   pub const ATTR_USER_ID: &str = "userID";
   /// sort key
   pub const ATTR_ITEM_ID: &str = "itemID";
 
   // itemID prefixes (one shouldn't be a prefix of the other)
   pub const DEVICE_ITEM_KEY_PREFIX: &str = "device-";
   pub const DEVICE_LIST_KEY_PREFIX: &str = "devicelist-";
 
   // device-specific attrs
   pub const ATTR_DEVICE_KEY_INFO: &str = "deviceKeyInfo";
   pub const ATTR_CONTENT_PREKEY: &str = "contentPreKey";
   pub const ATTR_NOTIF_PREKEY: &str = "notifPreKey";
   pub const ATTR_PLATFORM_DETAILS: &str = "platformDetails";
   pub const ATTR_LOGIN_TIME: &str = "loginTime";
 
   // IdentityKeyInfo constants
   pub const ATTR_KEY_PAYLOAD: &str = "keyPayload";
   pub const ATTR_KEY_PAYLOAD_SIGNATURE: &str = "keyPayloadSignature";
 
   // PreKey constants
   pub const ATTR_PREKEY: &str = "preKey";
   pub const ATTR_PREKEY_SIGNATURE: &str = "preKeySignature";
 
   // PlatformDetails constants
   pub const ATTR_DEVICE_TYPE: &str = "deviceType";
   pub const ATTR_CODE_VERSION: &str = "codeVersion";
   pub const ATTR_STATE_VERSION: &str = "stateVersion";
   pub const ATTR_MAJOR_DESKTOP_VERSION: &str = "majorDesktopVersion";
 
   // device-list-specific attrs
   pub const ATTR_TIMESTAMP: &str = "timestamp";
   pub const ATTR_DEVICE_IDS: &str = "deviceIDs";
   pub const ATTR_CURRENT_SIGNATURE: &str = "curPrimarySignature";
   pub const ATTR_LAST_SIGNATURE: &str = "lastPrimarySignature";
 
   // one-time key constants
   pub const ATTR_CONTENT_OTK_COUNT: &str = "contentOTKCount";
   pub const ATTR_NOTIF_OTK_COUNT: &str = "notifOTKCount";
 
   // deprecated attributes
   pub const OLD_ATTR_DEVICE_TYPE: &str = "deviceType";
   pub const OLD_ATTR_CODE_VERSION: &str = "codeVersion";
 }
 
 // One time keys table, which need to exist in their own table to ensure
 // atomicity of additions and removals
 pub mod one_time_keys_table {
   pub const NAME: &str = "identity-one-time-keys";
   pub const PARTITION_KEY: &str = "userID#deviceID#olmAccount";
   pub const SORT_KEY: &str = "timestamp#keyNumber";
   pub const ATTR_ONE_TIME_KEY: &str = "oneTimeKey";
 }
 
 // Tokio
 
 pub const MPSC_CHANNEL_BUFFER_CAPACITY: usize = 1;
 pub const IDENTITY_SERVICE_SOCKET_ADDR: &str = "[::]:50054";
 pub const IDENTITY_SERVICE_WEBSOCKET_ADDR: &str = "[::]:51004";
 
 pub const SOCKET_HEARTBEAT_TIMEOUT: Duration = Duration::from_secs(3);
 
 // Token
 
 pub const ACCESS_TOKEN_LENGTH: usize = 512;
 
 // Temporary config
 
 pub const AUTH_TOKEN: &str = "COMM_IDENTITY_SERVICE_AUTH_TOKEN";
 pub const KEYSERVER_PUBLIC_KEY: &str = "KEYSERVER_PUBLIC_KEY";
 
 // Nonce
 
 pub const NONCE_LENGTH: usize = 17;
 pub const NONCE_TTL_DURATION: Duration = Duration::from_secs(120); // seconds
 
 // Device list
 
 pub const DEVICE_LIST_TIMESTAMP_VALID_FOR: Duration = Duration::from_secs(300);
 
 // Workflows in progress
 
 pub const WORKFLOWS_IN_PROGRESS_TTL_DURATION: Duration =
   Duration::from_secs(120);
 
 // Identity
 
 pub const DEFAULT_IDENTITY_ENDPOINT: &str = "http://localhost:50054";
 
 // LocalStack
 
 pub const LOCALSTACK_ENDPOINT: &str = "LOCALSTACK_ENDPOINT";
 
 // OPAQUE Server Setup
 
 pub const OPAQUE_SERVER_SETUP: &str = "OPAQUE_SERVER_SETUP";
 
 // Identity Search
 
 pub const OPENSEARCH_ENDPOINT: &str = "OPENSEARCH_ENDPOINT";
 pub const DEFAULT_OPENSEARCH_ENDPOINT: &str =
   "identity-search-domain.us-east-2.opensearch.localhost.localstack.cloud:4566";
 pub const IDENTITY_SEARCH_INDEX: &str = "users";
 pub const IDENTITY_SEARCH_RESULT_SIZE: u32 = 20;
 
 // Log Error Types
 
 pub mod error_types {
   pub const GENERIC_DB_LOG: &str = "DB Error";
   pub const OTK_DB_LOG: &str = "One-time Key DB Error";
   pub const DEVICE_LIST_DB_LOG: &str = "Device List DB Error";
   pub const TOKEN_DB_LOG: &str = "Token DB Error";
   pub const FARCASTER_DB_LOG: &str = "Farcaster DB Error";
 
   pub const SYNC_LOG: &str = "Sync Error";
   pub const SEARCH_LOG: &str = "Search Error";
   pub const SIWE_LOG: &str = "SIWE Error";
   pub const GRPC_SERVICES_LOG: &str = "gRPC Services Error";
   pub const TUNNELBROKER_LOG: &str = "Tunnelbroker Error";
   pub const HTTP_LOG: &str = "HTTP Error";
 }
 
 // Tonic Status Messages
 pub mod tonic_status_messages {
   pub const UNEXPECTED_MESSAGE_DATA: &str = "unexpected_message_data";
   pub const SIGNATURE_INVALID: &str = "signature_invalid";
   pub const MALFORMED_KEY: &str = "malformed_key";
   pub const VERIFICATION_FAILED: &str = "verification_failed";
   pub const MALFORMED_PAYLOAD: &str = "malformed_payload";
   pub const INVALID_DEVICE_LIST_PAYLOAD: &str = "invalid_device_list_payload";
   pub const USERNAME_ALREADY_EXISTS: &str = "username_already_exists";
   pub const USERNAME_RESERVED: &str = "username_reserved";
   pub const WALLET_ADDRESS_TAKEN: &str = "wallet_address_taken";
   pub const WALLET_ADDRESS_NOT_RESERVED: &str = "wallet_address_not_reserved";
+  pub const DEVICE_ID_ALREADY_EXISTS: &str = "device_id_already_exists";
   pub const USER_NOT_FOUND: &str = "user_not_found";
   pub const INVALID_NONCE: &str = "invalid_nonce";
   pub const NONCE_EXPIRED: &str = "nonce_expired";
   pub const FID_TAKEN: &str = "fid_taken";
   pub const CANNOT_LINK_FID: &str = "cannot_link_fid";
   pub const INVALID_PLATFORM_METADATA: &str = "invalid_platform_metadata";
   pub const MISSING_CREDENTIALS: &str = "missing_credentials";
   pub const BAD_CREDENTIALS: &str = "bad_credentials";
   pub const SESSION_NOT_FOUND: &str = "session_not_found";
   pub const INVALID_TIMESTAMP: &str = "invalid_timestamp";
   pub const INVALID_USERNAME: &str = "invalid_username";
   pub const USERNAME_NOT_RESERVED: &str = "username_not_reserved";
   pub const NEED_KEYSERVER_MESSAGE_TO_CLAIM_USERNAME: &str =
     "need_keyserver_message_to_claim_username";
   pub const UNEXPECTED_INITIAL_DEVICE_LIST: &str =
     "unexpected_initial_device_list";
   pub const DEVICE_LIST_ERROR: &str = "device_list_error";
   pub const DEVICE_NOT_IN_DEVICE_LIST: &str = "device_not_in_device_list";
   pub const NO_IDENTIFIER_PROVIDED: &str = "no_identifier_provided";
   pub const USER_ALREADY_HAS_KEYSERVER: &str = "user_already_has_keyserver";
   pub const RETRY: &str = "retry";
   pub const INVALID_DEVICE_LIST_UPDATE: &str = "invalid_device_list_update";
   pub const INVALID_DEVICE_LIST_SIGNATURE: &str =
     "invalid_device_list_signature";
   pub const UNEXPECTED_ERROR: &str = "unexpected_error";
   pub const NO_DEVICE_LIST: &str = "no_device_list";
   pub const USER_ID_MISSING: &str = "user_id_missing";
   pub const DEVICE_ID_MISSING: &str = "device_id_missing";
   pub const MISSING_CONTENT_KEYS: &str = "missing_content_keys";
   pub const MISSING_NOTIF_KEYS: &str = "missing_notif_keys";
   pub const KEYSERVER_NOT_FOUND: &str = "keyserver_not_found";
   pub const PASSWORD_USER: &str = "password_user";
   pub const INVALID_MESSAGE: &str = "invalid_message";
   pub const INVALID_MESSAGE_FORMAT: &str = "invalid_message_format";
   pub const MISSING_PLATFORM_OR_CODE_VERSION_METADATA: &str =
     "missing_platform_or_code_version_metadata";
   pub const MISSING_KEY: &str = "missing_key";
   pub const MESSAGE_NOT_AUTHENTICATED: &str = "message_not_authenticated";
 }
 
 // Tunnelbroker
 pub const TUNNELBROKER_GRPC_ENDPOINT: &str = "TUNNELBROKER_GRPC_ENDPOINT";
 pub const DEFAULT_TUNNELBROKER_ENDPOINT: &str = "http://localhost:50051";
 
 // X3DH key management
 
 // Threshold for requesting more one_time keys
 pub const ONE_TIME_KEY_MINIMUM_THRESHOLD: usize = 5;
 // Number of keys to be refreshed when below the threshold
 pub const ONE_TIME_KEY_REFRESH_NUMBER: u32 = 5;
 
 // Minimum supported code versions
 
 pub const MIN_SUPPORTED_NATIVE_VERSION: u64 = 270;
 
 // Request metadata
 
 pub mod request_metadata {
   pub const CODE_VERSION: &str = "code_version";
   pub const STATE_VERSION: &str = "state_version";
   pub const MAJOR_DESKTOP_VERSION: &str = "major_desktop_version";
   pub const DEVICE_TYPE: &str = "device_type";
   pub const USER_ID: &str = "user_id";
   pub const DEVICE_ID: &str = "device_id";
   pub const ACCESS_TOKEN: &str = "access_token";
 }
 
 // CORS
 
 pub mod cors {
   use std::time::Duration;
 
   pub const DEFAULT_MAX_AGE: Duration = Duration::from_secs(24 * 60 * 60);
   pub const DEFAULT_EXPOSED_HEADERS: [&str; 3] =
     ["grpc-status", "grpc-message", "grpc-status-details-bin"];
   pub const DEFAULT_ALLOW_HEADERS: [&str; 11] = [
     "x-grpc-web",
     "content-type",
     "x-user-agent",
     "grpc-timeout",
     super::request_metadata::CODE_VERSION,
     super::request_metadata::STATE_VERSION,
     super::request_metadata::MAJOR_DESKTOP_VERSION,
     super::request_metadata::DEVICE_TYPE,
     super::request_metadata::USER_ID,
     super::request_metadata::DEVICE_ID,
     super::request_metadata::ACCESS_TOKEN,
   ];
   pub const ALLOW_ORIGIN_LIST: &str = "ALLOW_ORIGIN_LIST";
   pub const PROD_ORIGIN_HOST_STR: &str = "web.comm.app";
 }
 
 // Tracing
 
 pub const COMM_SERVICES_USE_JSON_LOGS: &str = "COMM_SERVICES_USE_JSON_LOGS";
 
 // Regex
 
 pub const VALID_USERNAME_REGEX_STRING: &str =
   r"^[a-zA-Z0-9][a-zA-Z0-9-_]{0,190}$";
 
 // Retry
 
 // TODO: Replace this with `ExponentialBackoffConfig` from `comm-lib`
 pub mod retry {
   pub const MAX_ATTEMPTS: usize = 8;
 
   pub const CONDITIONAL_CHECK_FAILED: &str = "ConditionalCheckFailed";
   pub const TRANSACTION_CONFLICT: &str = "TransactionConflict";
 }
 
 // One-time keys
 pub const ONE_TIME_KEY_UPLOAD_LIMIT_PER_ACCOUNT: usize = 24;
 pub const ONE_TIME_KEY_SIZE: usize = 43; // as defined in olm
 pub const MAX_ONE_TIME_KEYS: usize = 100; // as defined in olm
diff --git a/services/identity/src/database/device_list.rs b/services/identity/src/database/device_list.rs
index c29cf27b2..6b1b3132c 100644
--- a/services/identity/src/database/device_list.rs
+++ b/services/identity/src/database/device_list.rs
@@ -1,1961 +1,1971 @@
 use std::collections::HashMap;
 
 use chrono::{DateTime, Utc};
 use comm_lib::{
   aws::ddb::{
     operation::{get_item::GetItemOutput, query::builders::QueryFluentBuilder},
     types::{
       error::TransactionCanceledException, AttributeValue, Delete,
       DeleteRequest, Put, TransactWriteItem, Update, WriteRequest,
     },
   },
   database::{
     AttributeExtractor, AttributeMap, DBItemAttributeError, DBItemError,
     DynamoDBError, TryFromAttribute,
   },
 };
 use serde::Serialize;
 use tracing::{debug, error, trace, warn};
 
 use crate::{
   client_service::FlattenedDeviceKeyUpload,
   constants::{
     devices_table::{self, *},
     error_types, USERS_TABLE, USERS_TABLE_DEVICELIST_TIMESTAMP_ATTRIBUTE_NAME,
     USERS_TABLE_PARTITION_KEY,
   },
   error::{DeviceListError, Error},
   grpc_services::{
     protos::{self, unauth::DeviceType},
     shared::PlatformMetadata,
   },
   grpc_utils::DeviceKeysInfo,
   olm::is_valid_olm_key,
 };
 
 use super::DatabaseClient;
 
 // We omit the content and notif one-time key count attributes from this struct
 // because they are internal helpers and are not provided by users
 #[derive(Clone, Debug, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct DeviceRow {
   #[serde(skip)]
   pub user_id: String,
   #[serde(skip)]
   pub device_id: String,
 
   #[serde(rename = "identityKeyInfo")]
   pub device_key_info: IdentityKeyInfo,
   pub content_prekey: Prekey,
   pub notif_prekey: Prekey,
 
   /// Timestamp of last login (access token generation)
   #[serde(skip)]
   pub login_time: DateTime<Utc>,
   #[serde(skip)]
   pub platform_details: PlatformDetails,
 }
 
 #[derive(Clone, Debug)]
 pub struct DeviceListRow {
   pub user_id: String,
   pub timestamp: DateTime<Utc>,
   pub device_ids: Vec<String>,
   /// Primary device signature. This is `None` for Identity-generated lists.
   pub current_primary_signature: Option<String>,
   /// Last primary device signature, in case the primary device has changed
   /// since last device list update.
   pub last_primary_signature: Option<String>,
 }
 
 #[derive(Clone, Debug, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct IdentityKeyInfo {
   pub key_payload: String,
   pub key_payload_signature: String,
 }
 
 #[derive(Clone, Debug, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct Prekey {
   pub prekey: String,
   pub prekey_signature: String,
 }
 
 #[derive(Clone, Debug, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct PlatformDetails {
   #[serde(serialize_with = "serialize_device_type")]
   device_type: DeviceType,
   code_version: u64,
   state_version: Option<u64>,
   major_desktop_version: Option<u64>,
 }
 
 fn serialize_device_type<S: serde::Serializer>(
   device_type: &DeviceType,
   s: S,
 ) -> Result<S::Ok, S::Error> {
   let v = device_type.as_str_name().to_lowercase();
   v.serialize(s)
 }
 
 /// A struct representing device list update payload
 /// issued by the primary device.
 /// For the JSON payload, see [`crate::device_list::SignedDeviceList`]
 pub struct DeviceListUpdate {
   pub devices: Vec<String>,
   pub timestamp: DateTime<Utc>,
   /// Primary device signature. This is `None` for Identity-generated lists.
   pub current_primary_signature: Option<String>,
   /// Last primary device signature, in case the primary device has changed
   /// since last device list update.
   pub last_primary_signature: Option<String>,
   /// Raw update payload to verify signatures
   pub raw_payload: String,
 }
 
 impl DeviceRow {
   #[tracing::instrument(skip_all)]
   pub fn from_device_key_upload(
     user_id: impl Into<String>,
     upload: FlattenedDeviceKeyUpload,
     platform_metadata: PlatformMetadata,
     login_time: DateTime<Utc>,
   ) -> Result<Self, Error> {
     if !is_valid_olm_key(&upload.content_prekey)
       || !is_valid_olm_key(&upload.notif_prekey)
     {
       error!(
         errorType = error_types::DEVICE_LIST_DB_LOG,
         "Invalid prekey format"
       );
       return Err(Error::InvalidFormat);
     }
     let key_upload_device_type = DeviceType::from_str_name(upload.device_type.as_str_name())
       .expect("DeviceType conversion failed. Identity client and server protos mismatch");
     let platform_details =
       PlatformDetails::new(platform_metadata, Some(key_upload_device_type))?;
 
     let device_row = Self {
       user_id: user_id.into(),
       device_id: upload.device_id_key,
       device_key_info: IdentityKeyInfo {
         key_payload: upload.key_payload,
         key_payload_signature: upload.key_payload_signature,
       },
       content_prekey: Prekey {
         prekey: upload.content_prekey,
         prekey_signature: upload.content_prekey_signature,
       },
       notif_prekey: Prekey {
         prekey: upload.notif_prekey,
         prekey_signature: upload.notif_prekey_signature,
       },
       platform_details,
       login_time,
     };
     Ok(device_row)
   }
 
   pub fn device_type(&self) -> &DeviceType {
     &self.platform_details.device_type
   }
 }
 
 impl DeviceListRow {
   /// Generates new device list row from given devices.
   /// Used only for Identity-generated (unsigned) device lists.
   fn new(
     user_id: impl Into<String>,
     device_ids: Vec<String>,
     update_info: &UpdateOperationInfo,
   ) -> Self {
     Self {
       user_id: user_id.into(),
       device_ids,
       timestamp: update_info.timestamp.unwrap_or_else(Utc::now),
       current_primary_signature: update_info.current_signature.clone(),
       last_primary_signature: update_info.last_signature.clone(),
     }
   }
 
   pub fn has_device(&self, device_id: &String) -> bool {
     self.device_ids.contains(device_id)
   }
 
   pub fn is_primary_device(&self, device_id: &String) -> bool {
     self
       .device_ids
       .first()
       .filter(|it| *it == device_id)
       .is_some()
   }
 
   pub fn has_secondary_device(&self, device_id: &String) -> bool {
     self.has_device(device_id) && !self.is_primary_device(device_id)
   }
 }
 
 impl PlatformDetails {
   pub fn new(
     metadata: PlatformMetadata,
     key_upload_device_type: Option<DeviceType>,
   ) -> Result<Self, Error> {
     let PlatformMetadata { device_type, .. } = metadata;
 
     let metadata_device_type =
       DeviceType::from_str_name(&device_type.to_uppercase());
 
     let device_type = match (metadata_device_type, key_upload_device_type) {
       (Some(metadata_value), None) => metadata_value,
       (Some(metadata_value), Some(key_upload_value)) => {
         if metadata_value != key_upload_value {
           warn!(
             "DeviceKeyUplaod device type ({}) mismatches request metadata platform ({}). {}",
             "Prefering value from key uplaod.",
             key_upload_value.as_str_name(),
             metadata_value.as_str_name()
           );
         }
         key_upload_value
       }
       (None, Some(key_upload_value)) => key_upload_value,
       (None, None) => {
         warn!(
           "Received invalid device_type in request metadata: {}",
           device_type
         );
         return Err(Error::InvalidFormat);
       }
     };
 
     Ok(Self {
       device_type,
       code_version: metadata.code_version,
       state_version: metadata.state_version,
       major_desktop_version: metadata.major_desktop_version,
     })
   }
 }
 
 // helper structs for converting to/from attribute values for sort key (a.k.a itemID)
 pub struct DeviceIDAttribute(pub String);
 struct DeviceListKeyAttribute(DateTime<Utc>);
 
 impl From<DeviceIDAttribute> for AttributeValue {
   fn from(value: DeviceIDAttribute) -> Self {
     AttributeValue::S(format!("{DEVICE_ITEM_KEY_PREFIX}{}", value.0))
   }
 }
 
 impl From<DeviceListKeyAttribute> for AttributeValue {
   fn from(value: DeviceListKeyAttribute) -> Self {
     AttributeValue::S(format!(
       "{DEVICE_LIST_KEY_PREFIX}{}",
       value.0.to_rfc3339()
     ))
   }
 }
 
 impl TryFrom<Option<AttributeValue>> for DeviceIDAttribute {
   type Error = DBItemError;
   fn try_from(value: Option<AttributeValue>) -> Result<Self, Self::Error> {
     let item_id = String::try_from_attr(ATTR_ITEM_ID, value)?;
 
     // remove the device- prefix
     let device_id = item_id
       .strip_prefix(DEVICE_ITEM_KEY_PREFIX)
       .ok_or_else(|| DBItemError {
         attribute_name: ATTR_ITEM_ID.to_string(),
         attribute_value: item_id.clone().into(),
         attribute_error: DBItemAttributeError::InvalidValue,
       })?
       .to_string();
 
     Ok(Self(device_id))
   }
 }
 
 impl TryFrom<Option<AttributeValue>> for DeviceListKeyAttribute {
   type Error = DBItemError;
   fn try_from(value: Option<AttributeValue>) -> Result<Self, Self::Error> {
     let item_id = String::try_from_attr(ATTR_ITEM_ID, value)?;
 
     // remove the device-list- prefix, then parse the timestamp
     let timestamp: DateTime<Utc> = item_id
       .strip_prefix(DEVICE_LIST_KEY_PREFIX)
       .ok_or_else(|| DBItemError {
         attribute_name: ATTR_ITEM_ID.to_string(),
         attribute_value: item_id.clone().into(),
         attribute_error: DBItemAttributeError::InvalidValue,
       })
       .and_then(|s| {
         s.parse().map_err(|e| {
           DBItemError::new(
             ATTR_ITEM_ID.to_string(),
             item_id.clone().into(),
             DBItemAttributeError::InvalidTimestamp(e),
           )
         })
       })?;
 
     Ok(Self(timestamp))
   }
 }
 
 impl TryFrom<AttributeMap> for DeviceRow {
   type Error = DBItemError;
 
   fn try_from(mut attrs: AttributeMap) -> Result<Self, Self::Error> {
     let user_id = attrs.take_attr(ATTR_USER_ID)?;
     let DeviceIDAttribute(device_id) = attrs.remove(ATTR_ITEM_ID).try_into()?;
 
     let device_key_info = attrs
       .take_attr::<AttributeMap>(ATTR_DEVICE_KEY_INFO)
       .and_then(IdentityKeyInfo::try_from)?;
 
     let content_prekey = attrs
       .take_attr::<AttributeMap>(ATTR_CONTENT_PREKEY)
       .and_then(Prekey::try_from)?;
 
     let notif_prekey = attrs
       .take_attr::<AttributeMap>(ATTR_NOTIF_PREKEY)
       .and_then(Prekey::try_from)?;
 
     let login_time: DateTime<Utc> = attrs.take_attr(ATTR_LOGIN_TIME)?;
 
     // New schema contains PlatformDetails attribute while legacy schema
     // contains "deviceType" and "codeVersion" top-level attributes
     let platform_details = match attrs
       .take_attr::<Option<PlatformDetails>>(ATTR_PLATFORM_DETAILS)?
     {
       Some(platform_details) => platform_details,
       None => {
         let raw_device_type: String = attrs.take_attr(OLD_ATTR_DEVICE_TYPE)?;
         let device_type = DeviceType::from_str_name(&raw_device_type)
           .ok_or_else(|| {
             DBItemError::new(
               OLD_ATTR_DEVICE_TYPE.to_string(),
               raw_device_type.into(),
               DBItemAttributeError::InvalidValue,
             )
           })?;
         let code_version = attrs
           .remove(OLD_ATTR_CODE_VERSION)
           .and_then(|attr| attr.as_n().ok().cloned())
           .and_then(|val| val.parse::<u64>().ok())
           .unwrap_or_default();
 
         PlatformDetails {
           device_type,
           code_version,
           state_version: None,
           major_desktop_version: None,
         }
       }
     };
 
     Ok(Self {
       user_id,
       device_id,
       device_key_info,
       content_prekey,
       notif_prekey,
       platform_details,
       login_time,
     })
   }
 }
 
 impl From<DeviceRow> for AttributeMap {
   fn from(value: DeviceRow) -> Self {
     HashMap::from([
       (ATTR_USER_ID.to_string(), AttributeValue::S(value.user_id)),
       (
         ATTR_ITEM_ID.to_string(),
         DeviceIDAttribute(value.device_id).into(),
       ),
       (
         ATTR_PLATFORM_DETAILS.to_string(),
         value.platform_details.into(),
       ),
       (
         ATTR_DEVICE_KEY_INFO.to_string(),
         value.device_key_info.into(),
       ),
       (ATTR_CONTENT_PREKEY.to_string(), value.content_prekey.into()),
       (ATTR_NOTIF_PREKEY.to_string(), value.notif_prekey.into()),
       // migration attributes
       (
         ATTR_LOGIN_TIME.to_string(),
         AttributeValue::S(value.login_time.to_rfc3339()),
       ),
     ])
   }
 }
 
 impl From<IdentityKeyInfo> for protos::unauth::IdentityKeyInfo {
   fn from(value: IdentityKeyInfo) -> Self {
     Self {
       payload: value.key_payload,
       payload_signature: value.key_payload_signature,
     }
   }
 }
 
 impl From<IdentityKeyInfo> for AttributeValue {
   fn from(value: IdentityKeyInfo) -> Self {
     let attrs = HashMap::from([
       (
         ATTR_KEY_PAYLOAD.to_string(),
         AttributeValue::S(value.key_payload),
       ),
       (
         ATTR_KEY_PAYLOAD_SIGNATURE.to_string(),
         AttributeValue::S(value.key_payload_signature),
       ),
     ]);
     AttributeValue::M(attrs)
   }
 }
 
 impl TryFrom<AttributeMap> for IdentityKeyInfo {
   type Error = DBItemError;
   fn try_from(mut attrs: AttributeMap) -> Result<Self, Self::Error> {
     let key_payload = attrs.take_attr(ATTR_KEY_PAYLOAD)?;
     let key_payload_signature = attrs.take_attr(ATTR_KEY_PAYLOAD_SIGNATURE)?;
 
     Ok(Self {
       key_payload,
       key_payload_signature,
     })
   }
 }
 
 impl From<Prekey> for AttributeValue {
   fn from(value: Prekey) -> Self {
     let attrs = HashMap::from([
       (ATTR_PREKEY.to_string(), AttributeValue::S(value.prekey)),
       (
         ATTR_PREKEY_SIGNATURE.to_string(),
         AttributeValue::S(value.prekey_signature),
       ),
     ]);
     AttributeValue::M(attrs)
   }
 }
 
 impl From<Prekey> for protos::unauth::Prekey {
   fn from(value: Prekey) -> Self {
     Self {
       prekey: value.prekey,
       prekey_signature: value.prekey_signature,
     }
   }
 }
 
 impl From<protos::unauth::Prekey> for Prekey {
   fn from(value: protos::unauth::Prekey) -> Self {
     Self {
       prekey: value.prekey,
       prekey_signature: value.prekey_signature,
     }
   }
 }
 
 impl TryFrom<AttributeMap> for Prekey {
   type Error = DBItemError;
   fn try_from(mut attrs: AttributeMap) -> Result<Self, Self::Error> {
     let prekey = attrs.take_attr(ATTR_PREKEY)?;
     let prekey_signature = attrs.take_attr(ATTR_PREKEY_SIGNATURE)?;
     Ok(Self {
       prekey,
       prekey_signature,
     })
   }
 }
 
 impl From<PlatformDetails> for AttributeValue {
   fn from(value: PlatformDetails) -> Self {
     let mut attrs = HashMap::from([
       (
         ATTR_DEVICE_TYPE.to_string(),
         AttributeValue::S(value.device_type.as_str_name().to_string()),
       ),
       (
         ATTR_CODE_VERSION.to_string(),
         AttributeValue::N(value.code_version.to_string()),
       ),
     ]);
     if let Some(state_version) = value.state_version {
       attrs.insert(
         ATTR_STATE_VERSION.to_string(),
         AttributeValue::N(state_version.to_string()),
       );
     }
     if let Some(major_desktop_version) = value.major_desktop_version {
       attrs.insert(
         ATTR_STATE_VERSION.to_string(),
         AttributeValue::N(major_desktop_version.to_string()),
       );
     }
 
     AttributeValue::M(attrs)
   }
 }
 
 impl TryFrom<AttributeMap> for PlatformDetails {
   type Error = DBItemError;
   fn try_from(mut attrs: AttributeMap) -> Result<Self, Self::Error> {
     let raw_device_type: String = attrs.take_attr(ATTR_DEVICE_TYPE)?;
     let device_type =
       DeviceType::from_str_name(&raw_device_type).ok_or_else(|| {
         DBItemError::new(
           ATTR_DEVICE_TYPE.to_string(),
           raw_device_type.into(),
           DBItemAttributeError::InvalidValue,
         )
       })?;
     let code_version = attrs
       .remove(ATTR_CODE_VERSION)
       .and_then(|attr| attr.as_n().ok().cloned())
       .and_then(|val| val.parse::<u64>().ok())
       .unwrap_or_default();
 
     let state_version = attrs
       .remove(ATTR_STATE_VERSION)
       .and_then(|attr| attr.as_n().ok().cloned())
       .and_then(|val| val.parse::<u64>().ok());
     let major_desktop_version = attrs
       .remove(ATTR_MAJOR_DESKTOP_VERSION)
       .and_then(|attr| attr.as_n().ok().cloned())
       .and_then(|val| val.parse::<u64>().ok());
 
     Ok(Self {
       device_type,
       code_version,
       state_version,
       major_desktop_version,
     })
   }
 }
 
 impl TryFromAttribute for PlatformDetails {
   fn try_from_attr(
     attribute_name: impl Into<String>,
     attribute: Option<AttributeValue>,
   ) -> Result<Self, DBItemError> {
     AttributeMap::try_from_attr(attribute_name, attribute)
       .and_then(PlatformDetails::try_from)
   }
 }
 
 impl From<PlatformDetails> for protos::auth::PlatformDetails {
   fn from(value: PlatformDetails) -> Self {
     Self {
       device_type: value.device_type.into(),
       code_version: value.code_version,
       state_version: value.state_version,
       major_desktop_version: value.major_desktop_version,
     }
   }
 }
 
 impl TryFrom<AttributeMap> for DeviceListRow {
   type Error = DBItemError;
 
   fn try_from(mut attrs: AttributeMap) -> Result<Self, Self::Error> {
     let user_id = attrs.take_attr(ATTR_USER_ID)?;
     let DeviceListKeyAttribute(timestamp) =
       attrs.remove(ATTR_ITEM_ID).try_into()?;
 
     // validate timestamps are in sync
     let timestamps_match = attrs
       .remove(ATTR_TIMESTAMP)
       .and_then(|attr| attr.as_n().ok().cloned())
       .and_then(|val| val.parse::<i64>().ok())
       .filter(|val| *val == timestamp.timestamp_millis())
       .is_some();
     if !timestamps_match {
       warn!(
         "DeviceList timestamp mismatch for (userID={}, itemID={})",
         &user_id,
         timestamp.to_rfc3339()
       );
     }
 
     let device_ids: Vec<String> = attrs.take_attr(ATTR_DEVICE_IDS)?;
 
     let current_primary_signature = attrs.take_attr(ATTR_CURRENT_SIGNATURE)?;
     let last_primary_signature = attrs.take_attr(ATTR_LAST_SIGNATURE)?;
 
     Ok(Self {
       user_id,
       timestamp,
       device_ids,
       current_primary_signature,
       last_primary_signature,
     })
   }
 }
 
 impl From<DeviceListRow> for AttributeMap {
   fn from(device_list: DeviceListRow) -> Self {
     let mut attrs = HashMap::new();
     attrs.insert(
       ATTR_USER_ID.to_string(),
       AttributeValue::S(device_list.user_id.clone()),
     );
     attrs.insert(
       ATTR_ITEM_ID.to_string(),
       DeviceListKeyAttribute(device_list.timestamp).into(),
     );
     attrs.insert(
       ATTR_TIMESTAMP.to_string(),
       AttributeValue::N(device_list.timestamp.timestamp_millis().to_string()),
     );
     attrs.insert(
       ATTR_DEVICE_IDS.to_string(),
       AttributeValue::L(
         device_list
           .device_ids
           .into_iter()
           .map(AttributeValue::S)
           .collect(),
       ),
     );
     if let Some(current_signature) = device_list.current_primary_signature {
       attrs.insert(
         ATTR_CURRENT_SIGNATURE.to_string(),
         AttributeValue::S(current_signature),
       );
     }
     if let Some(last_signature) = device_list.last_primary_signature {
       attrs.insert(
         ATTR_CURRENT_SIGNATURE.to_string(),
         AttributeValue::S(last_signature),
       );
     }
     attrs
   }
 }
 
 impl DatabaseClient {
   /// Retrieves user's current devices and their full data
   #[tracing::instrument(skip_all)]
   pub async fn get_current_devices(
     &self,
     user_id: impl Into<String>,
   ) -> Result<Vec<DeviceRow>, Error> {
     let response =
       query_rows_with_prefix(self, user_id, DEVICE_ITEM_KEY_PREFIX)
         .send()
         .await
         .map_err(|e| {
           error!(
             errorType = error_types::DEVICE_LIST_DB_LOG,
             "Failed to get current devices: {:?}", e
           );
           Error::AwsSdk(e.into())
         })?;
 
     let Some(rows) = response.items else {
       return Ok(Vec::new());
     };
 
     rows
       .into_iter()
       .map(DeviceRow::try_from)
       .collect::<Result<Vec<DeviceRow>, DBItemError>>()
       .map_err(Error::from)
   }
 
   /// Gets user's device list history
   #[tracing::instrument(skip_all)]
   pub async fn get_device_list_history(
     &self,
     user_id: impl Into<String>,
     since: Option<DateTime<Utc>>,
   ) -> Result<Vec<DeviceListRow>, Error> {
     let rows = if let Some(since) = since {
       // When timestamp is provided, it's better to query device lists by timestamp LSI
       self
         .client
         .query()
         .table_name(devices_table::NAME)
         .index_name(devices_table::TIMESTAMP_INDEX_NAME)
         .consistent_read(true)
         .key_condition_expression("#user_id = :user_id AND #timestamp > :since")
         .expression_attribute_names("#user_id", ATTR_USER_ID)
         .expression_attribute_names("#timestamp", ATTR_TIMESTAMP)
         .expression_attribute_values(
           ":user_id",
           AttributeValue::S(user_id.into()),
         )
         .expression_attribute_values(
           ":since",
           AttributeValue::N(since.timestamp_millis().to_string()),
         )
         .send()
         .await
         .map_err(|e| {
           error!(
             errorType = error_types::DEVICE_LIST_DB_LOG,
             "Failed to query device list updates by index: {:?}", e
           );
           Error::AwsSdk(e.into())
         })?
         .items
     } else {
       // Query all device lists for user
       query_rows_with_prefix(self, user_id, DEVICE_LIST_KEY_PREFIX)
         .send()
         .await
         .map_err(|e| {
           error!(
             errorType = error_types::DEVICE_LIST_DB_LOG,
             "Failed to query device list updates (all): {:?}", e
           );
           Error::AwsSdk(e.into())
         })?
         .items
     };
 
     rows
       .unwrap_or_default()
       .into_iter()
       .map(DeviceListRow::try_from)
       .collect::<Result<Vec<DeviceListRow>, DBItemError>>()
       .map_err(Error::from)
   }
 
   /// Returns all devices' keys for the given user. Response is in the same format
   /// as [DatabaseClient::get_keys_for_user] for compatibility reasons.
   #[tracing::instrument(skip_all)]
   pub async fn get_keys_for_user_devices(
     &self,
     user_id: impl Into<String>,
   ) -> Result<super::Devices, Error> {
     let user_devices = self.get_current_devices(user_id).await?;
     let user_devices_keys = user_devices
       .into_iter()
       .map(|device| (device.device_id.clone(), DeviceKeysInfo::from(device)))
       .collect();
     Ok(user_devices_keys)
   }
 
+  /// Find owner's user ID for given device ID. Useful for finding
+  /// devices table partition key.
   #[tracing::instrument(skip_all)]
-  pub async fn find_device_by_id(
+  pub async fn find_user_id_for_device(
     &self,
     device_id: &str,
-  ) -> Result<Option<DeviceRow>, Error> {
+  ) -> Result<Option<String>, Error> {
     let response = self
       .client
       .query()
       .table_name(devices_table::NAME)
       .index_name(devices_table::DEVICE_ID_INDEX_NAME)
       .key_condition_expression("#item_id = :device_id_attr")
       .expression_attribute_names("#item_id", devices_table::ATTR_ITEM_ID)
       .expression_attribute_values(
         ":device_id_attr",
         DeviceIDAttribute(device_id.to_string()).into(),
       )
       .send()
       .await
       .map_err(|err| {
         error!(
           errorType = error_types::DEVICE_LIST_DB_LOG,
           "Failed to query for device ID: {:?}", err
         );
         Error::AwsSdk(err.into())
       })?;
 
     let Some(mut results) = response.items else {
       debug!("Query by deviceID returned empty response");
       return Ok(None);
     };
 
     if results.len() > 1 {
       error!(
         errorType = error_types::DEVICE_LIST_DB_LOG,
         "Devices table contains more than one device with ID: {}", device_id
       );
       return Err(Error::IllegalState);
     }
 
-    let Some(user_id) = results
+    let user_id = results
       .pop()
       .map(|mut attrs| attrs.take_attr::<String>(devices_table::ATTR_USER_ID))
-      .transpose()?
-    else {
+      .transpose()?;
+
+    Ok(user_id)
+  }
+
+  #[tracing::instrument(skip_all)]
+  pub async fn find_device_by_id(
+    &self,
+    device_id: &str,
+  ) -> Result<Option<DeviceRow>, Error> {
+    let Some(user_id) = self.find_user_id_for_device(device_id).await? else {
       debug!("No device found with ID: {}", device_id);
       return Ok(None);
     };
-
     self.get_device_data(user_id, device_id).await
   }
 
   #[tracing::instrument(skip_all)]
   pub async fn update_device_prekeys(
     &self,
     user_id: impl Into<String>,
     device_id: impl Into<String>,
     content_prekey: Prekey,
     notif_prekey: Prekey,
   ) -> Result<(), Error> {
     if !is_valid_olm_key(&content_prekey.prekey)
       || !is_valid_olm_key(&notif_prekey.prekey)
     {
       error!(
         errorType = error_types::DEVICE_LIST_DB_LOG,
         "Invalid prekey format"
       );
       return Err(Error::InvalidFormat);
     }
     self
       .client
       .update_item()
       .table_name(devices_table::NAME)
       .key(ATTR_USER_ID, AttributeValue::S(user_id.into()))
       .key(ATTR_ITEM_ID, DeviceIDAttribute(device_id.into()).into())
       .condition_expression(
         "attribute_exists(#user_id) AND attribute_exists(#item_id)",
       )
       .update_expression(
         "SET #content_prekey = :content_prekey, #notif_prekey = :notif_prekey",
       )
       .expression_attribute_names("#user_id", ATTR_USER_ID)
       .expression_attribute_names("#item_id", ATTR_ITEM_ID)
       .expression_attribute_names("#content_prekey", ATTR_CONTENT_PREKEY)
       .expression_attribute_names("#notif_prekey", ATTR_NOTIF_PREKEY)
       .expression_attribute_values(":content_prekey", content_prekey.into())
       .expression_attribute_values(":notif_prekey", notif_prekey.into())
       .send()
       .await
       .map_err(|e| {
         error!(
           errorType = error_types::DEVICE_LIST_DB_LOG,
           "Failed to update device prekeys: {:?}", e
         );
         Error::AwsSdk(e.into())
       })?;
 
     Ok(())
   }
 
   /// Checks if given device exists on user's current device list
   #[tracing::instrument(skip_all)]
   pub async fn device_exists(
     &self,
     user_id: impl Into<String>,
     device_id: impl Into<String>,
   ) -> Result<bool, Error> {
     let GetItemOutput { item, .. } = self
       .client
       .get_item()
       .table_name(devices_table::NAME)
       .key(ATTR_USER_ID, AttributeValue::S(user_id.into()))
       .key(ATTR_ITEM_ID, DeviceIDAttribute(device_id.into()).into())
       // only fetch the primary key, we don't need the rest
       .projection_expression(format!("{ATTR_USER_ID}, {ATTR_ITEM_ID}"))
       .send()
       .await
       .map_err(|e| {
         error!(
           errorType = error_types::DEVICE_LIST_DB_LOG,
           "Failed to check if device exists: {:?}", e
         );
         Error::AwsSdk(e.into())
       })?;
 
     Ok(item.is_some())
   }
 
   #[tracing::instrument(skip_all)]
   pub async fn get_device_data(
     &self,
     user_id: impl Into<String>,
     device_id: impl Into<String>,
   ) -> Result<Option<DeviceRow>, Error> {
     let GetItemOutput { item, .. } = self
       .client
       .get_item()
       .table_name(devices_table::NAME)
       .key(ATTR_USER_ID, AttributeValue::S(user_id.into()))
       .key(ATTR_ITEM_ID, DeviceIDAttribute(device_id.into()).into())
       .send()
       .await
       .map_err(|e| {
         error!(
           errorType = error_types::DEVICE_LIST_DB_LOG,
           "Failed to fetch device data: {:?}", e
         );
         Error::AwsSdk(e.into())
       })?;
 
     let Some(attrs) = item else {
       return Ok(None);
     };
 
     let device_data = DeviceRow::try_from(attrs)?;
     Ok(Some(device_data))
   }
 
   /// Fails if the device list is empty
   #[tracing::instrument(skip_all)]
   pub async fn get_primary_device_data(
     &self,
     user_id: &str,
   ) -> Result<DeviceRow, Error> {
     let device_list = self.get_current_device_list(user_id).await?;
     let Some(primary_device_id) = device_list
       .as_ref()
       .and_then(|list| list.device_ids.first())
     else {
       error!(
         user_id,
         errorType = error_types::DEVICE_LIST_DB_LOG,
         "Device list is empty. Cannot fetch primary device"
       );
       return Err(Error::DeviceList(DeviceListError::DeviceNotFound));
     };
 
     self
       .get_device_data(user_id, primary_device_id)
       .await?
       .ok_or_else(|| {
         error!(
           errorType = error_types::DEVICE_LIST_DB_LOG,
           "Corrupt database. Missing primary device data for user {}", user_id
         );
         Error::MissingItem
       })
   }
 
   /// Required only for migration purposes (determining primary device)
   #[tracing::instrument(skip_all)]
   pub async fn update_device_login_time(
     &self,
     user_id: impl Into<String>,
     device_id: impl Into<String>,
     login_time: DateTime<Utc>,
   ) -> Result<(), Error> {
     self
       .client
       .update_item()
       .table_name(devices_table::NAME)
       .key(ATTR_USER_ID, AttributeValue::S(user_id.into()))
       .key(ATTR_ITEM_ID, DeviceIDAttribute(device_id.into()).into())
       .condition_expression(
         "attribute_exists(#user_id) AND attribute_exists(#item_id)",
       )
       .update_expression("SET #login_time = :login_time")
       .expression_attribute_names("#user_id", ATTR_USER_ID)
       .expression_attribute_names("#item_id", ATTR_ITEM_ID)
       .expression_attribute_names("#login_time", ATTR_LOGIN_TIME)
       .expression_attribute_values(
         ":login_time",
         AttributeValue::S(login_time.to_rfc3339()),
       )
       .send()
       .await
       .map_err(|e| {
         error!(
           errorType = error_types::DEVICE_LIST_DB_LOG,
           "Failed to update device login time: {:?}", e
         );
         Error::AwsSdk(e.into())
       })?;
 
     Ok(())
   }
 
   #[tracing::instrument(skip_all)]
   pub async fn update_device_platform_details(
     &self,
     user_id: impl Into<String>,
     device_id: impl Into<String>,
     platform_details: PlatformDetails,
   ) -> Result<(), Error> {
     self
       .client
       .update_item()
       .table_name(devices_table::NAME)
       .key(ATTR_USER_ID, AttributeValue::S(user_id.into()))
       .key(ATTR_ITEM_ID, DeviceIDAttribute(device_id.into()).into())
       .condition_expression(
         "attribute_exists(#user_id) AND attribute_exists(#item_id)",
       )
       .update_expression("SET #platform_details = :platform_details")
       .expression_attribute_names("#user_id", ATTR_USER_ID)
       .expression_attribute_names("#item_id", ATTR_ITEM_ID)
       .expression_attribute_names("#platform_details", ATTR_PLATFORM_DETAILS)
       .expression_attribute_values(":platform_details", platform_details.into())
       .send()
       .await
       .map_err(|e| {
         error!(
           errorType = error_types::DEVICE_LIST_DB_LOG,
           "Failed to update device platform details: {:?}", e
         );
         Error::AwsSdk(e.into())
       })?;
 
     Ok(())
   }
 
   #[tracing::instrument(skip_all)]
   pub async fn get_current_device_list(
     &self,
     user_id: impl Into<String>,
   ) -> Result<Option<DeviceListRow>, Error> {
     self
       .client
       .query()
       .table_name(devices_table::NAME)
       .index_name(devices_table::TIMESTAMP_INDEX_NAME)
       .consistent_read(true)
       .key_condition_expression("#user_id = :user_id")
       // sort descending
       .scan_index_forward(false)
       .expression_attribute_names("#user_id", ATTR_USER_ID)
       .expression_attribute_values(
         ":user_id",
         AttributeValue::S(user_id.into()),
       )
       .limit(1)
       .send()
       .await
       .map_err(|e| {
         error!(
           errorType = error_types::DEVICE_LIST_DB_LOG,
           "Failed to query device list updates by index: {:?}", e
         );
         Error::AwsSdk(e.into())
       })?
       .items
       .and_then(|mut items| items.pop())
       .map(DeviceListRow::try_from)
       .transpose()
       .map_err(Error::from)
   }
 
   /// Adds device data to devices table. If the device already exists, its
   /// data is overwritten. This does not update the device list; the device ID
   /// should already be present in the device list.
   #[tracing::instrument(skip_all)]
   pub async fn put_device_data(
     &self,
     user_id: impl Into<String>,
     device_key_upload: FlattenedDeviceKeyUpload,
     platform_metadata: PlatformMetadata,
     login_time: DateTime<Utc>,
   ) -> Result<(), Error> {
     let content_one_time_keys = device_key_upload.content_one_time_keys.clone();
     let notif_one_time_keys = device_key_upload.notif_one_time_keys.clone();
     let user_id_string = user_id.into();
     let new_device = DeviceRow::from_device_key_upload(
       user_id_string.clone(),
       device_key_upload,
       platform_metadata,
       login_time,
     )?;
     let device_id = new_device.device_id.clone();
 
     self
       .client
       .put_item()
       .table_name(devices_table::NAME)
       .set_item(Some(new_device.into()))
       .send()
       .await
       .map_err(|e| {
         error!(
           errorType = error_types::DEVICE_LIST_DB_LOG,
           "Failed to put device data: {:?}", e
         );
         Error::AwsSdk(e.into())
       })?;
 
     self
       .append_one_time_prekeys(
         &user_id_string,
         &device_id,
         &content_one_time_keys,
         &notif_one_time_keys,
       )
       .await?;
 
     Ok(())
   }
 
   /// Removes device data from devices table. If the device doesn't exist,
   /// it is a no-op. This does not update the device list; the device ID
   /// should be removed from the device list separately.
   #[tracing::instrument(skip_all)]
   pub async fn remove_device_data(
     &self,
     user_id: impl Into<String>,
     device_id: impl Into<String>,
   ) -> Result<(), Error> {
     let user_id = user_id.into();
     let device_id = device_id.into();
 
     self
       .client
       .delete_item()
       .table_name(devices_table::NAME)
       .key(ATTR_USER_ID, AttributeValue::S(user_id))
       .key(ATTR_ITEM_ID, DeviceIDAttribute(device_id).into())
       .send()
       .await
       .map_err(|e| {
         error!(
           errorType = error_types::DEVICE_LIST_DB_LOG,
           "Failed to delete device data: {:?}", e
         );
         Error::AwsSdk(e.into())
       })?;
 
     Ok(())
   }
 
   /// Registers primary device for user, stores its signed device list
   pub async fn register_primary_device(
     &self,
     user_id: impl Into<String>,
     device_key_upload: FlattenedDeviceKeyUpload,
     platform_metadata: PlatformMetadata,
     login_time: DateTime<Utc>,
     initial_device_list: DeviceListUpdate,
   ) -> Result<(), Error> {
     let user_id: String = user_id.into();
     self
       .transact_update_devicelist(&user_id, |device_ids, devices_data| {
         if !device_ids.is_empty() || !devices_data.is_empty() {
           warn!(
             "Tried creating initial device list for already existing user
               (userID={})",
             &user_id,
           );
           return Err(Error::DeviceList(DeviceListError::DeviceAlreadyExists));
         }
 
         // Set device list
         *device_ids = initial_device_list.devices.clone();
 
         let primary_device = DeviceRow::from_device_key_upload(
           &user_id,
           device_key_upload,
           platform_metadata,
           login_time,
         )?;
 
         // Put device keys into DDB
         let put_device = Put::builder()
           .table_name(devices_table::NAME)
           .set_item(Some(primary_device.into()))
           .condition_expression(
             "attribute_not_exists(#user_id) AND attribute_not_exists(#item_id)",
           )
           .expression_attribute_names("#user_id", ATTR_USER_ID)
           .expression_attribute_names("#item_id", ATTR_ITEM_ID)
           .build();
         let put_device_operation =
           TransactWriteItem::builder().put(put_device).build();
 
         let update_info =
           UpdateOperationInfo::primary_device_issued(initial_device_list)
             .with_ddb_operation(put_device_operation);
         Ok(update_info)
       })
       .await?;
 
     Ok(())
   }
 
   /// Adds new device to user's device list. If the device already exists, the
   /// operation fails. Transactionally generates new device list version.
   pub async fn add_device(
     &self,
     user_id: impl Into<String>,
     device_key_upload: FlattenedDeviceKeyUpload,
     platform_metadata: PlatformMetadata,
     login_time: DateTime<Utc>,
   ) -> Result<(), Error> {
     let user_id: String = user_id.into();
     self
       .transact_update_devicelist(&user_id, |device_ids, mut devices_data| {
         let new_device = DeviceRow::from_device_key_upload(
           &user_id,
           device_key_upload,
           platform_metadata,
           login_time,
         )?;
 
         if device_ids.iter().any(|id| &new_device.device_id == id) {
           warn!(
             "Device already exists in user's device list \
               (userID={}, deviceID={})",
             &user_id, &new_device.device_id
           );
           return Err(Error::DeviceList(DeviceListError::DeviceAlreadyExists));
         }
         device_ids.push(new_device.device_id.clone());
 
         // Reorder devices (determine primary device again)
         devices_data.push(new_device.clone());
         migration::reorder_device_list(&user_id, device_ids, &devices_data);
 
         // Put new device
         let put_device = Put::builder()
           .table_name(devices_table::NAME)
           .set_item(Some(new_device.into()))
           .condition_expression(
             "attribute_not_exists(#user_id) AND attribute_not_exists(#item_id)",
           )
           .expression_attribute_names("#user_id", ATTR_USER_ID)
           .expression_attribute_names("#item_id", ATTR_ITEM_ID)
           .build();
         let put_device_operation =
           TransactWriteItem::builder().put(put_device).build();
 
         let update_info = UpdateOperationInfo::identity_generated()
           .with_ddb_operation(put_device_operation);
         Ok(update_info)
       })
       .await?;
 
     Ok(())
   }
 
   /// Removes device from user's device list. If the device doesn't exist, the
   /// operation fails. Transactionally generates new device list version.
   pub async fn remove_device(
     &self,
     user_id: impl Into<String>,
     device_id: impl AsRef<str>,
   ) -> Result<(), Error> {
     let user_id: String = user_id.into();
     let device_id = device_id.as_ref();
     self
       .transact_update_devicelist(&user_id, |device_ids, mut devices_data| {
         let device_exists = device_ids.iter().any(|id| id == device_id);
         if !device_exists {
           warn!(
             "Device doesn't exist in user's device list \
           (userID={}, deviceID={})",
             &user_id, device_id
           );
           return Err(Error::DeviceList(DeviceListError::DeviceNotFound));
         }
 
         device_ids.retain(|id| id != device_id);
 
         // Reorder devices (determine primary device again)
         devices_data.retain(|d| d.device_id != device_id);
         migration::reorder_device_list(&user_id, device_ids, &devices_data);
 
         // Delete device DDB operation
         let delete_device = Delete::builder()
           .table_name(devices_table::NAME)
           .key(ATTR_USER_ID, AttributeValue::S(user_id.clone()))
           .key(
             ATTR_ITEM_ID,
             DeviceIDAttribute(device_id.to_string()).into(),
           )
           .condition_expression(
             "attribute_exists(#user_id) AND attribute_exists(#item_id)",
           )
           .expression_attribute_names("#user_id", ATTR_USER_ID)
           .expression_attribute_names("#item_id", ATTR_ITEM_ID)
           .build();
         let operation =
           TransactWriteItem::builder().delete(delete_device).build();
 
         let update_info = UpdateOperationInfo::identity_generated()
           .with_ddb_operation(operation);
         Ok(update_info)
       })
       .await?;
 
     Ok(())
   }
 
   /// applies updated device list received from primary device
   pub async fn apply_devicelist_update(
     &self,
     user_id: &str,
     update: DeviceListUpdate,
     // A function that receives previous and new device IDs and
     // returns boolean determining if the new device list is valid.
     validator_fn: impl Fn(&[&str], &[&str]) -> bool,
   ) -> Result<DeviceListRow, Error> {
     use std::collections::HashSet;
 
     let new_list = update.devices.clone();
     let mut devices_being_removed: Vec<String> = Vec::new();
     let update_result = self
       .transact_update_devicelist(user_id, |current_list, _| {
         crate::device_list::verify_device_list_signatures(
           current_list.first(),
           &update,
         )?;
 
         let previous_device_ids: Vec<&str> =
           current_list.iter().map(AsRef::as_ref).collect();
         let new_device_ids: Vec<&str> =
           new_list.iter().map(AsRef::as_ref).collect();
         if !validator_fn(&previous_device_ids, &new_device_ids) {
           warn!("Received invalid device list update");
           return Err(Error::DeviceList(
             DeviceListError::InvalidDeviceListUpdate,
           ));
         }
 
         // collect device IDs that were removed
         let previous_set: HashSet<&str> =
           previous_device_ids.into_iter().collect();
         let new_set: HashSet<&str> = new_device_ids.into_iter().collect();
         devices_being_removed
           .extend(previous_set.difference(&new_set).map(ToString::to_string));
 
         debug!("Applying device list update");
         *current_list = new_list;
 
         Ok(UpdateOperationInfo::primary_device_issued(update))
       })
       .await?;
 
     // delete device data and invalidate CSAT for removed devices
     debug!(
       "{} devices have been removed from device list. Clearing data...",
       devices_being_removed.len()
     );
     for device_id in devices_being_removed {
       trace!("Invalidating CSAT for device {}", device_id);
       self.delete_access_token_data(user_id, &device_id).await?;
       trace!("Clearing keys for device {}", device_id);
       self.remove_device_data(user_id, &device_id).await?;
       trace!("Pruning OTKs for device {}", device_id);
       self
         .delete_otks_table_rows_for_user_device(user_id, &device_id)
         .await?;
     }
 
     Ok(update_result)
   }
 
   /// Performs a transactional update of the device list for the user. Afterwards
   /// generates a new device list and updates the timestamp in the users table.
   /// This is done in a transaction. Operation fails if the device list has been
   /// updated concurrently (timestamp mismatch).
   /// Returns the new device list row that has been saved to database.
   #[tracing::instrument(skip_all)]
   async fn transact_update_devicelist(
     &self,
     user_id: &str,
     // The closure performing a transactional update of the device list.
     // It receives two arguments:
     // 1. A mutable reference to the current device list (ordered device IDs).
     // 2. Details (full data) of the current devices (unordered).
     // The closure should return a [`UpdateOperationInfo`] object.
     action: impl FnOnce(
       &mut Vec<String>,
       Vec<DeviceRow>,
     ) -> Result<UpdateOperationInfo, Error>,
   ) -> Result<DeviceListRow, Error> {
     let previous_timestamp =
       get_current_devicelist_timestamp(self, user_id).await?;
     let current_devices_data = self.get_current_devices(user_id).await?;
     let mut device_ids = self
       .get_current_device_list(user_id)
       .await?
       .map(|device_list| device_list.device_ids)
       .unwrap_or_default();
 
     // Perform the update action, then generate new device list
     let update_info = action(&mut device_ids, current_devices_data)?;
 
     crate::device_list::verify_device_list_timestamp(
       previous_timestamp.as_ref(),
       update_info.timestamp.as_ref(),
     )?;
     let new_device_list = DeviceListRow::new(user_id, device_ids, &update_info);
 
     // Update timestamp in users table
     let timestamp_update_operation = device_list_timestamp_update_operation(
       user_id,
       previous_timestamp,
       new_device_list.timestamp,
     );
 
     // Put updated device list (a new version)
     let put_device_list = Put::builder()
       .table_name(devices_table::NAME)
       .set_item(Some(new_device_list.clone().into()))
       .condition_expression(
         "attribute_not_exists(#user_id) AND attribute_not_exists(#item_id)",
       )
       .expression_attribute_names("#user_id", ATTR_USER_ID)
       .expression_attribute_names("#item_id", ATTR_ITEM_ID)
       .build();
     let put_device_list_operation =
       TransactWriteItem::builder().put(put_device_list).build();
 
     let operations = if let Some(operation) = update_info.ddb_operation {
       vec![
         operation,
         put_device_list_operation,
         timestamp_update_operation,
       ]
     } else {
       vec![put_device_list_operation, timestamp_update_operation]
     };
 
     self
       .client
       .transact_write_items()
       .set_transact_items(Some(operations))
       .send()
       .await
       .map_err(|e| match DynamoDBError::from(e) {
         DynamoDBError::TransactionCanceledException(
           TransactionCanceledException {
             cancellation_reasons: Some(reasons),
             ..
           },
         ) if reasons
           .iter()
           .any(|reason| reason.code() == Some("ConditionalCheckFailed")) =>
         {
           Error::DeviceList(DeviceListError::ConcurrentUpdateError)
         }
         other => {
           error!(
             errorType = error_types::DEVICE_LIST_DB_LOG,
             "Device list update transaction failed: {:?}", other
           );
           Error::AwsSdk(other)
         }
       })?;
 
     Ok(new_device_list)
   }
 
   /// Deletes all user data from devices table
   #[tracing::instrument(skip_all)]
   pub async fn delete_devices_table_rows_for_user(
     &self,
     user_id: impl Into<String>,
   ) -> Result<(), Error> {
     // 1. get all rows
     // 2. batch write delete all
 
     // we project only the primary keys so we can pass these directly to delete requests
     let primary_keys = self
       .client
       .query()
       .table_name(devices_table::NAME)
       .projection_expression("#user_id, #item_id")
       .key_condition_expression("#user_id = :user_id")
       .expression_attribute_names("#user_id", ATTR_USER_ID)
       .expression_attribute_names("#item_id", ATTR_ITEM_ID)
       .expression_attribute_values(
         ":user_id",
         AttributeValue::S(user_id.into()),
       )
       .consistent_read(true)
       .send()
       .await
       .map_err(|e| {
         error!(
           errorType = error_types::DEVICE_LIST_DB_LOG,
           "Failed to list user's items in devices table: {:?}", e
         );
         Error::AwsSdk(e.into())
       })?
       .items
       .unwrap_or_default();
 
     let delete_requests = primary_keys
       .into_iter()
       .map(|item| {
         let request = DeleteRequest::builder().set_key(Some(item)).build();
         WriteRequest::builder().delete_request(request).build()
       })
       .collect::<Vec<_>>();
 
     // TODO: We can use the batch write helper from comm-services-lib when integrated
     for batch in delete_requests.chunks(25) {
       self
         .client
         .batch_write_item()
         .request_items(devices_table::NAME, batch.to_vec())
         .send()
         .await
         .map_err(|e| {
           error!(
             errorType = error_types::DEVICE_LIST_DB_LOG,
             "Failed to batch delete items from devices table: {:?}", e
           );
           Error::AwsSdk(e.into())
         })?;
     }
 
     Ok(())
   }
 }
 
 /// Gets timestamp of user's current device list. Returns None if the user
 /// doesn't have a device list yet. Storing the timestamp in the users table is
 /// required for consistency. It's used as a condition when updating the device
 /// list.
 #[tracing::instrument(skip_all)]
 async fn get_current_devicelist_timestamp(
   db: &crate::database::DatabaseClient,
   user_id: impl Into<String>,
 ) -> Result<Option<DateTime<Utc>>, Error> {
   let response = db
     .client
     .get_item()
     .table_name(USERS_TABLE)
     .key(USERS_TABLE_PARTITION_KEY, AttributeValue::S(user_id.into()))
     .projection_expression(USERS_TABLE_DEVICELIST_TIMESTAMP_ATTRIBUTE_NAME)
     .send()
     .await
     .map_err(|e| {
       error!(
         errorType = error_types::DEVICE_LIST_DB_LOG,
         "Failed to get user's device list timestamp: {:?}", e
       );
       Error::AwsSdk(e.into())
     })?;
 
   let mut user_item = response.item.unwrap_or_default();
   let raw_datetime =
     user_item.remove(USERS_TABLE_DEVICELIST_TIMESTAMP_ATTRIBUTE_NAME);
 
   // existing records will not have this field when
   // updating device list for the first time
   if raw_datetime.is_none() {
     return Ok(None);
   }
 
   let timestamp = DateTime::<Utc>::try_from_attr(
     USERS_TABLE_DEVICELIST_TIMESTAMP_ATTRIBUTE_NAME,
     raw_datetime,
   )?;
   Ok(Some(timestamp))
 }
 
 /// Generates update expression for current device list timestamp in users table.
 /// The previous timestamp is used as a condition to ensure that the value hasn't changed
 /// since we got it. This avoids race conditions when updating the device list.
 fn device_list_timestamp_update_operation(
   user_id: impl Into<String>,
   previous_timestamp: Option<DateTime<Utc>>,
   new_timestamp: DateTime<Utc>,
 ) -> TransactWriteItem {
   let update_builder = match previous_timestamp {
     Some(previous_timestamp) => Update::builder()
       .condition_expression("#device_list_timestamp = :previous_timestamp")
       .expression_attribute_values(
         ":previous_timestamp",
         AttributeValue::S(previous_timestamp.to_rfc3339()),
       ),
     // If there's no previous timestamp, the attribute shouldn't exist yet
     None => Update::builder()
       .condition_expression("attribute_not_exists(#device_list_timestamp)"),
   };
 
   let update = update_builder
     .table_name(USERS_TABLE)
     .key(USERS_TABLE_PARTITION_KEY, AttributeValue::S(user_id.into()))
     .update_expression("SET #device_list_timestamp = :new_timestamp")
     .expression_attribute_names(
       "#device_list_timestamp",
       USERS_TABLE_DEVICELIST_TIMESTAMP_ATTRIBUTE_NAME,
     )
     .expression_attribute_values(
       ":new_timestamp",
       AttributeValue::S(new_timestamp.to_rfc3339()),
     )
     .build();
 
   TransactWriteItem::builder().update(update).build()
 }
 
 /// Helper function to query rows by given sort key prefix
 fn query_rows_with_prefix(
   db: &crate::database::DatabaseClient,
   user_id: impl Into<String>,
   prefix: &'static str,
 ) -> QueryFluentBuilder {
   db.client
     .query()
     .table_name(devices_table::NAME)
     .key_condition_expression(
       "#user_id = :user_id AND begins_with(#item_id, :device_prefix)",
     )
     .expression_attribute_names("#user_id", ATTR_USER_ID)
     .expression_attribute_names("#item_id", ATTR_ITEM_ID)
     .expression_attribute_values(":user_id", AttributeValue::S(user_id.into()))
     .expression_attribute_values(
       ":device_prefix",
       AttributeValue::S(prefix.to_string()),
     )
     .consistent_read(true)
 }
 
 /// [`transact_update_devicelist()`] closure result
 struct UpdateOperationInfo {
   /// (optional) transactional DDB operation to be performed
   /// when updating the device list.
   ddb_operation: Option<TransactWriteItem>,
   /// new device list timestamp. Defaults to `Utc::now()`
   /// for Identity-generated device lists.
   timestamp: Option<DateTime<Utc>>,
   current_signature: Option<String>,
   last_signature: Option<String>,
 }
 
 impl UpdateOperationInfo {
   fn identity_generated() -> Self {
     Self {
       ddb_operation: None,
       timestamp: None,
       current_signature: None,
       last_signature: None,
     }
   }
 
   fn primary_device_issued(source: DeviceListUpdate) -> Self {
     Self {
       ddb_operation: None,
       timestamp: Some(source.timestamp),
       current_signature: source.current_primary_signature,
       last_signature: source.last_primary_signature,
     }
   }
 
   fn with_ddb_operation(mut self, operation: TransactWriteItem) -> Self {
     self.ddb_operation = Some(operation);
     self
   }
 }
 
 // Helper module for "migration" code into new device list schema.
 // We can get rid of this when primary device takes over the responsibility
 // of managing the device list.
 mod migration {
   use std::{cmp::Ordering, collections::HashSet};
   use tracing::{debug, error, info};
 
   use super::*;
 
   #[tracing::instrument(skip_all)]
   pub(super) fn reorder_device_list(
     user_id: &str,
     list: &mut [String],
     devices_data: &[DeviceRow],
   ) {
     if !verify_device_list_match(list, devices_data) {
       error!(
         errorType = error_types::DEVICE_LIST_DB_LOG,
         "Device list for user (userID={}) out of sync!", user_id
       );
       return;
     }
 
     let Some(first_device) = list.first() else {
       debug!("Skipping device list rotation. Nothing to reorder.");
       return;
     };
     let Some(primary_device) = determine_primary_device(devices_data) else {
       info!(
         "No valid primary device found for user (userID={}).\
         Skipping device list reorder.",
         user_id
       );
       return;
     };
 
     if first_device == &primary_device.device_id {
       debug!("Skipping device list reorder. Primary device is already first");
       return;
     }
 
     // swap primary device with the first one
     let Some(primary_device_idx) =
       list.iter().position(|id| id == &primary_device.device_id)
     else {
       error!(
         errorType = error_types::DEVICE_LIST_DB_LOG,
         "Primary device not found in device list (userID={})", user_id
       );
       return;
     };
     list.swap(0, primary_device_idx);
     info!("Reordered device list for user (userID={})", user_id);
   }
 
   // checks if device list matches given devices data
   #[tracing::instrument(skip_all)]
   fn verify_device_list_match(
     list: &[String],
     devices_data: &[DeviceRow],
   ) -> bool {
     if list.len() != devices_data.len() {
       debug!(
         list_len = list.len(),
         data_len = devices_data.len(),
         "Device list length mismatch!"
       );
       return false;
     }
 
     let actual_device_ids = devices_data
       .iter()
       .map(|device| &device.device_id)
       .collect::<HashSet<_>>();
 
     let device_list_set = list.iter().collect::<HashSet<_>>();
 
     if let Some(unknown_device_id) = device_list_set
       .symmetric_difference(&actual_device_ids)
       .next()
     {
       debug!(
         "Device list and data out of sync (unknown deviceID={})",
         unknown_device_id
       );
       return false;
     }
 
     true
   }
 
   /// Returns reference to primary device (if any) from given list of devices
   /// or None if there's no valid primary device.
   fn determine_primary_device(devices: &[DeviceRow]) -> Option<&DeviceRow> {
     // 1. Find mobile devices with valid token
     // 2. Prioritize these with latest code version
     // 3. If there's a tie, select the one with latest login time
 
     let mut mobile_devices = devices
       .iter()
       .filter(|device| {
         *device.device_type() == DeviceType::Ios
           || *device.device_type() == DeviceType::Android
       })
       .collect::<Vec<_>>();
 
     mobile_devices.sort_by(|a, b| {
       let code_version_cmp = b
         .platform_details
         .code_version
         .cmp(&a.platform_details.code_version);
       if code_version_cmp == Ordering::Equal {
         b.login_time.cmp(&a.login_time)
       } else {
         code_version_cmp
       }
     });
     mobile_devices.first().cloned()
   }
 
   #[cfg(test)]
   mod tests {
     use super::*;
     use chrono::Duration;
 
     #[test]
     fn reorder_skips_no_devices() {
       let mut list = vec![];
       reorder_device_list("", &mut list, &[]);
       assert_eq!(list, Vec::<String>::new());
     }
 
     #[test]
     fn reorder_skips_single_device() {
       let mut list = vec!["test".into()];
       let devices_data =
         vec![create_test_device("test", DeviceType::Web, 0, Utc::now())];
 
       reorder_device_list("", &mut list, &devices_data);
       assert_eq!(list, vec!["test"]);
     }
 
     #[test]
     fn reorder_skips_for_valid_list() {
       let mut list = vec!["mobile".into(), "web".into()];
       let devices_data = vec![
         create_test_device("mobile", DeviceType::Android, 1, Utc::now()),
         create_test_device("web", DeviceType::Web, 0, Utc::now()),
       ];
 
       reorder_device_list("", &mut list, &devices_data);
       assert_eq!(list, vec!["mobile", "web"]);
     }
 
     #[test]
     fn reorder_swaps_primary_device_when_possible() {
       let mut list = vec!["web".into(), "mobile".into()];
       let devices_data = vec![
         create_test_device("web", DeviceType::Web, 0, Utc::now()),
         create_test_device("mobile", DeviceType::Android, 1, Utc::now()),
       ];
 
       reorder_device_list("", &mut list, &devices_data);
       assert_eq!(list, vec!["mobile", "web"]);
     }
 
     #[test]
     fn determine_primary_device_returns_none_for_empty_list() {
       let devices = vec![];
       assert!(determine_primary_device(&devices).is_none());
     }
 
     #[test]
     fn determine_primary_device_returns_none_for_web_only() {
       let devices =
         vec![create_test_device("web", DeviceType::Web, 0, Utc::now())];
 
       assert!(
         determine_primary_device(&devices).is_none(),
         "Primary device should be None for web-only devices"
       );
     }
 
     #[test]
     fn determine_primary_device_prioritizes_mobile() {
       let devices = vec![
         create_test_device("mobile", DeviceType::Android, 0, Utc::now()),
         create_test_device("web", DeviceType::Web, 0, Utc::now()),
       ];
 
       let primary_device = determine_primary_device(&devices)
         .expect("Primary device should be present");
       assert_eq!(
         primary_device.device_id, "mobile",
         "Primary device should be mobile"
       );
     }
 
     #[test]
     fn determine_primary_device_prioritizes_latest_code_version() {
       let devices_with_latest_code_version = vec![
         create_test_device("mobile1", DeviceType::Android, 1, Utc::now()),
         create_test_device("mobile2", DeviceType::Android, 2, Utc::now()),
         create_test_device("web", DeviceType::Web, 0, Utc::now()),
       ];
 
       let primary_device =
         determine_primary_device(&devices_with_latest_code_version)
           .expect("Primary device should be present");
 
       assert_eq!(
         primary_device.device_id, "mobile2",
         "Primary device should be mobile with latest code version"
       );
     }
 
     #[test]
     fn determine_primary_device_prioritizes_latest_login_time() {
       let devices = vec![
         create_test_device("mobile1_today", DeviceType::Ios, 1, Utc::now()),
         create_test_device(
           "mobile2_yesterday",
           DeviceType::Android,
           1,
           Utc::now() - Duration::days(1),
         ),
         create_test_device("web", DeviceType::Web, 0, Utc::now()),
       ];
 
       let primary_device = determine_primary_device(&devices)
         .expect("Primary device should be present");
 
       assert_eq!(
         primary_device.device_id, "mobile1_today",
         "Primary device should be mobile with latest login time"
       );
     }
 
     #[test]
     fn determine_primary_device_keeps_deterministic_order() {
       // Given two identical devices, the first one should be selected as primary
       let today = Utc::now();
       let devices_with_latest_code_version = vec![
         create_test_device("mobile1", DeviceType::Android, 1, today),
         create_test_device("mobile2", DeviceType::Android, 1, today),
       ];
 
       let primary_device =
         determine_primary_device(&devices_with_latest_code_version)
           .expect("Primary device should be present");
 
       assert_eq!(
         primary_device.device_id, "mobile1",
         "Primary device selection should be deterministic"
       );
     }
 
     #[test]
     fn determine_primary_device_all_rules_together() {
       use DeviceType::{Android, Ios, Web};
       let today = Utc::now();
       let yesterday = today - Duration::days(1);
 
       let devices = vec![
         create_test_device("mobile1_today", Android, 1, today),
         create_test_device("mobile2_today", Android, 2, today),
         create_test_device("mobile3_yesterday", Ios, 1, yesterday),
         create_test_device("mobile4_yesterday", Ios, 2, yesterday),
         create_test_device("web", Web, 5, today),
       ];
 
       let primary_device = determine_primary_device(&devices)
         .expect("Primary device should be present");
 
       assert_eq!(
         primary_device.device_id, "mobile2_today",
         "Primary device should be mobile with latest code version and login time"
     );
     }
 
     fn create_test_device(
       id: &str,
       platform: DeviceType,
       code_version: u64,
       login_time: DateTime<Utc>,
     ) -> DeviceRow {
       DeviceRow {
         user_id: "test".into(),
         device_id: id.into(),
         device_key_info: IdentityKeyInfo {
           key_payload: "".into(),
           key_payload_signature: "".into(),
         },
         content_prekey: Prekey {
           prekey: "".into(),
           prekey_signature: "".into(),
         },
         notif_prekey: Prekey {
           prekey: "".into(),
           prekey_signature: "".into(),
         },
         platform_details: PlatformDetails {
           device_type: platform,
           code_version,
           state_version: None,
           major_desktop_version: None,
         },
         login_time,
       }
     }
   }
 }