diff --git a/lib/actions/user-actions.js b/lib/actions/user-actions.js
index 29f9fb766..6e3aaf697 100644
--- a/lib/actions/user-actions.js
+++ b/lib/actions/user-actions.js
@@ -1,1208 +1,1208 @@
 // @flow
 
 import invariant from 'invariant';
 import * as React from 'react';
 
 import type {
   CallSingleKeyserverEndpoint,
   CallSingleKeyserverEndpointOptions,
 } from '../keyserver-conn/call-single-keyserver-endpoint.js';
 import {
   extractKeyserverIDFromID,
   sortThreadIDsPerKeyserver,
   sortCalendarQueryPerKeyserver,
 } from '../keyserver-conn/keyserver-call-utils.js';
 import { useKeyserverCall } from '../keyserver-conn/keyserver-call.js';
 import type { CallKeyserverEndpoint } from '../keyserver-conn/keyserver-conn-types.js';
 import { usePreRequestUserState } from '../selectors/account-selectors.js';
 import {
   getOneTimeKeyValuesFromBlob,
   getPrekeyValueFromBlob,
 } from '../shared/crypto-utils.js';
 import { fetchLatestDeviceList } from '../shared/device-list-utils.js';
 import { IdentityClientContext } from '../shared/identity-client-context.js';
 import threadWatcher from '../shared/thread-watcher.js';
 import {
   permissionsAndAuthRelatedRequestTimeout,
   callIdentityServiceTimeout,
 } from '../shared/timeouts.js';
 import { useTunnelbroker } from '../tunnelbroker/tunnelbroker-context.js';
 import type {
   LegacyLogInInfo,
   LegacyLogInResult,
   LegacyRegisterResult,
   LegacyRegisterInfo,
   UpdateUserSettingsRequest,
   PolicyAcknowledgmentRequest,
   ClaimUsernameRequest,
   ClaimUsernameResponse,
   LogInRequest,
   KeyserverAuthResult,
   KeyserverAuthInfo,
   KeyserverAuthRequest,
   ClientLogInResponse,
   KeyserverLogOutResult,
   LogOutResult,
 } from '../types/account-types.js';
 import type {
   UpdateUserAvatarRequest,
   UpdateUserAvatarResponse,
 } from '../types/avatar-types.js';
 import type { RawEntryInfo, CalendarQuery } from '../types/entry-types.js';
 import type {
   Identities,
   IdentityAuthResult,
 } from '../types/identity-service-types';
 import type {
   RawMessageInfo,
   MessageTruncationStatuses,
 } from '../types/message-types.js';
 import type { GetOlmSessionInitializationDataResponse } from '../types/request-types.js';
 import type {
   UserSearchResult,
   ExactUserSearchResult,
 } from '../types/search-types.js';
 import type { PreRequestUserState } from '../types/session-types.js';
 import type {
   SubscriptionUpdateRequest,
   SubscriptionUpdateResult,
 } from '../types/subscription-types.js';
 import type { RawThreadInfos } from '../types/thread-types.js';
 import {
   peerToPeerMessageTypes,
   type EncryptedMessage,
 } from '../types/tunnelbroker/peer-to-peer-message-types.js';
 import {
   userActionsP2PMessageTypes,
   type SecondaryDeviceLogoutP2PMessage,
 } from '../types/tunnelbroker/user-actions-peer-to-peer-message-types.js';
 import type {
   CurrentUserInfo,
   UserInfo,
   PasswordUpdate,
   LoggedOutUserInfo,
 } from '../types/user-types.js';
 import { authoritativeKeyserverID } from '../utils/authoritative-keyserver.js';
 import { getConfig } from '../utils/config.js';
 import { createOlmSessionWithPeer } from '../utils/crypto-utils.js';
 import { getMessageForException } from '../utils/errors.js';
 import { useSelector } from '../utils/redux-utils.js';
 import { usingCommServicesAccessToken } from '../utils/services-utils.js';
 import sleep from '../utils/sleep.js';
 
 const loggedOutUserInfo: LoggedOutUserInfo = {
   anonymous: true,
 };
 
 export type KeyserverLogOutInput = {
   +preRequestUserState: PreRequestUserState,
   +keyserverIDs?: $ReadOnlyArray<string>,
 };
 
 const logOutActionTypes = Object.freeze({
   started: 'LOG_OUT_STARTED',
   success: 'LOG_OUT_SUCCESS',
   failed: 'LOG_OUT_FAILED',
 });
 
 const keyserverLogOut =
   (
     callKeyserverEndpoint: CallKeyserverEndpoint,
     allKeyserverIDs: $ReadOnlyArray<string>,
   ): ((input: KeyserverLogOutInput) => Promise<KeyserverLogOutResult>) =>
   async input => {
     const { preRequestUserState } = input;
     const keyserverIDs = input.keyserverIDs ?? allKeyserverIDs;
     const requests: { [string]: {} } = {};
     for (const keyserverID of keyserverIDs) {
       requests[keyserverID] = {};
     }
 
     let response = null;
     try {
       response = await Promise.race([
         callKeyserverEndpoint('log_out', requests),
         (async () => {
           await sleep(500);
           throw new Error('keyserver log_out took more than 500ms');
         })(),
       ]);
     } catch {}
     const currentUserInfo = response ? loggedOutUserInfo : null;
     return { currentUserInfo, preRequestUserState, keyserverIDs };
   };
 
 type UseLogOutOptions = {
   +logOutType?: 'legacy' | 'secondary_device',
 };
 
 function useLogOut(
   options: UseLogOutOptions = {},
 ): (keyserverIDs?: $ReadOnlyArray<string>) => Promise<LogOutResult> {
   const client = React.useContext(IdentityClientContext);
   const identityClient = client?.identityClient;
 
   const preRequestUserState = usePreRequestUserState();
   const callKeyserverLogOut = useKeyserverCall(keyserverLogOut);
 
   const commServicesAccessToken = useSelector(
     state => state.commServicesAccessToken,
   );
 
   const { logOutType } = options;
   return React.useCallback(
     async (keyserverIDs?: $ReadOnlyArray<string>) => {
       const identityPromise = (async () => {
         if (!usingCommServicesAccessToken || !commServicesAccessToken) {
           return;
         }
         if (!identityClient) {
           throw new Error('Identity service client is not initialized');
         }
         const callIdentityClientLogOut =
           logOutType === 'secondary_device'
             ? identityClient.logOutSecondaryDevice
             : identityClient.logOut;
         try {
           await Promise.race([
             callIdentityClientLogOut(),
             (async () => {
               await sleep(500);
               throw new Error('identity log_out took more than 500ms');
             })(),
           ]);
         } catch {}
       })();
 
       const [{ keyserverIDs: _, ...result }] = await Promise.all([
         callKeyserverLogOut({
           preRequestUserState,
           keyserverIDs,
         }),
         identityPromise,
       ]);
       return {
         ...result,
         preRequestUserState: {
           ...result.preRequestUserState,
           commServicesAccessToken,
         },
       };
     },
     [
       callKeyserverLogOut,
       commServicesAccessToken,
       identityClient,
       logOutType,
       preRequestUserState,
     ],
   );
 }
 
 function useIdentityLogOut(): () => Promise<LogOutResult> {
   const client = React.useContext(IdentityClientContext);
   const identityClient = client?.identityClient;
 
   const preRequestUserState = usePreRequestUserState();
   const commServicesAccessToken = useSelector(
     state => state.commServicesAccessToken,
   );
 
   return React.useCallback(async () => {
     invariant(
       usingCommServicesAccessToken,
       'identityLogOut can only be called when usingCommServicesAccessToken',
     );
     if (!identityClient) {
       throw new Error('Identity service client is not initialized');
     }
     try {
       await Promise.race([
         identityClient.logOut(),
         (async () => {
           await sleep(500);
           throw new Error('identity log_out took more than 500ms');
         })(),
       ]);
     } catch {}
     return {
       currentUserInfo: null,
       preRequestUserState: {
         ...preRequestUserState,
         commServicesAccessToken,
       },
     };
   }, [commServicesAccessToken, identityClient, preRequestUserState]);
 }
 
 const secondaryDeviceLogOutOptions = Object.freeze({
   logOutType: 'secondary_device',
 });
 
 function useSecondaryDeviceLogOut(): () => Promise<LogOutResult> {
   const { sendMessage } = useTunnelbroker();
   const logOut = useLogOut(secondaryDeviceLogOutOptions);
 
   const identityContext = React.useContext(IdentityClientContext);
   if (!identityContext) {
     throw new Error('Identity service client is not initialized');
   }
 
   return React.useCallback(async () => {
     const { identityClient, getAuthMetadata } = identityContext;
     const authMetadata = await getAuthMetadata();
     const { userID, deviceID } = authMetadata;
     if (!deviceID || !userID) {
       throw new Error('No auth metadata');
     }
 
     // get current device list and primary device ID
     const { devices } = await fetchLatestDeviceList(identityClient, userID);
     const primaryDeviceID = devices[0];
     if (deviceID === primaryDeviceID) {
       throw new Error('Used secondary device logout on primary device');
     }
 
     // create and send Olm Tunnelbroker message to primary device
     const { olmAPI } = getConfig();
     await olmAPI.initializeCryptoAccount();
     const messageContents: SecondaryDeviceLogoutP2PMessage = {
       type: userActionsP2PMessageTypes.LOG_OUT_SECONDARY_DEVICE,
     };
     try {
       const encryptedData = await olmAPI.encrypt(
         JSON.stringify(messageContents),
         primaryDeviceID,
       );
       const encryptedMessage: EncryptedMessage = {
         type: peerToPeerMessageTypes.ENCRYPTED_MESSAGE,
         senderInfo: { deviceID, userID },
         encryptedData,
       };
       await sendMessage({
         deviceID: primaryDeviceID,
         payload: JSON.stringify(encryptedMessage),
       });
     } catch {
       try {
         await createOlmSessionWithPeer(
           authMetadata,
           identityClient,
           sendMessage,
           userID,
           primaryDeviceID,
         );
         const encryptedData = await olmAPI.encrypt(
           JSON.stringify(messageContents),
           primaryDeviceID,
         );
         const encryptedMessage: EncryptedMessage = {
           type: peerToPeerMessageTypes.ENCRYPTED_MESSAGE,
           senderInfo: { deviceID, userID },
           encryptedData,
         };
         await sendMessage({
           deviceID: primaryDeviceID,
           payload: JSON.stringify(encryptedMessage),
         });
       } catch (err) {
         console.warn('Error sending secondary device logout message:', err);
       }
     }
 
     // log out of identity service, keyserver and visually
     return logOut();
   }, [identityContext, sendMessage, logOut]);
 }
 
 const claimUsernameActionTypes = Object.freeze({
   started: 'CLAIM_USERNAME_STARTED',
   success: 'CLAIM_USERNAME_SUCCESS',
   failed: 'CLAIM_USERNAME_FAILED',
 });
 const claimUsername =
   (
     callKeyserverEndpoint: CallKeyserverEndpoint,
   ): ((
     claimUsernameRequest: ClaimUsernameRequest,
   ) => Promise<ClaimUsernameResponse>) =>
   async (claimUsernameRequest: ClaimUsernameRequest) => {
     const requests = { [authoritativeKeyserverID()]: claimUsernameRequest };
     const responses = await callKeyserverEndpoint('claim_username', requests);
     const response = responses[authoritativeKeyserverID()];
     return {
       message: response.message,
       signature: response.signature,
     };
   };
 
 function useClaimUsername(): (
   claimUsernameRequest: ClaimUsernameRequest,
 ) => Promise<ClaimUsernameResponse> {
   return useKeyserverCall(claimUsername);
 }
 
 const deleteKeyserverAccountActionTypes = Object.freeze({
   started: 'DELETE_KEYSERVER_ACCOUNT_STARTED',
   success: 'DELETE_KEYSERVER_ACCOUNT_SUCCESS',
   failed: 'DELETE_KEYSERVER_ACCOUNT_FAILED',
 });
 const deleteKeyserverAccount =
   (
     callKeyserverEndpoint: CallKeyserverEndpoint,
     allKeyserverIDs: $ReadOnlyArray<string>,
   ): ((input: KeyserverLogOutInput) => Promise<KeyserverLogOutResult>) =>
   async input => {
     const { preRequestUserState } = input;
     const keyserverIDs = input.keyserverIDs ?? allKeyserverIDs;
     const requests: { [string]: {} } = {};
     for (const keyserverID of keyserverIDs) {
       requests[keyserverID] = {};
     }
 
     await callKeyserverEndpoint('delete_account', requests);
     return {
       currentUserInfo: loggedOutUserInfo,
       preRequestUserState,
       keyserverIDs,
     };
   };
 
 function useDeleteKeyserverAccount(): (
   keyserverIDs?: $ReadOnlyArray<string>,
 ) => Promise<KeyserverLogOutResult> {
   const preRequestUserState = usePreRequestUserState();
   const callKeyserverDeleteAccount = useKeyserverCall(deleteKeyserverAccount);
 
   return React.useCallback(
     (keyserverIDs?: $ReadOnlyArray<string>) =>
       callKeyserverDeleteAccount({ preRequestUserState, keyserverIDs }),
     [callKeyserverDeleteAccount, preRequestUserState],
   );
 }
 
 const deleteAccountActionTypes = Object.freeze({
   started: 'DELETE_ACCOUNT_STARTED',
   success: 'DELETE_ACCOUNT_SUCCESS',
   failed: 'DELETE_ACCOUNT_FAILED',
 });
 
 function useDeleteAccount(): (password: ?string) => Promise<LogOutResult> {
   const client = React.useContext(IdentityClientContext);
   const identityClient = client?.identityClient;
 
   const preRequestUserState = usePreRequestUserState();
   const callKeyserverDeleteAccount = useKeyserverCall(deleteKeyserverAccount);
 
   const commServicesAccessToken = useSelector(
     state => state.commServicesAccessToken,
   );
 
   return React.useCallback(
     async password => {
       if (usingCommServicesAccessToken) {
         if (!identityClient) {
           throw new Error('Identity service client is not initialized');
         }
         if (
           !identityClient.deleteWalletUser ||
           !identityClient.deletePasswordUser
         ) {
           throw new Error('Delete user method unimplemented');
         }
         if (password) {
           await identityClient.deletePasswordUser(password);
         } else {
           await identityClient.deleteWalletUser();
         }
       }
       try {
         const keyserverResult = await callKeyserverDeleteAccount({
           preRequestUserState,
         });
         const { keyserverIDs: _, ...result } = keyserverResult;
         return {
           ...result,
           preRequestUserState: {
             ...result.preRequestUserState,
             commServicesAccessToken,
           },
         };
       } catch (e) {
         if (!usingCommServicesAccessToken) {
           throw e;
         }
         console.log(
           'Failed to delete account on keyserver:',
           getMessageForException(e),
         );
       }
       return {
         currentUserInfo: null,
         preRequestUserState: {
           ...preRequestUserState,
           commServicesAccessToken,
         },
       };
     },
     [
       callKeyserverDeleteAccount,
       commServicesAccessToken,
       identityClient,
       preRequestUserState,
     ],
   );
 }
 
 // useDeleteDiscardedIdentityAccount is used in a scenario where the user is
 // visibly logged-out, and it's only used to reset state (eg. Redux, SQLite) to
 // a logged-out state.
 function useDeleteDiscardedIdentityAccount(): (
   password: ?string,
 ) => Promise<LogOutResult> {
   const client = React.useContext(IdentityClientContext);
   const identityClient = client?.identityClient;
 
   const preRequestUserState = usePreRequestUserState();
   const commServicesAccessToken = useSelector(
     state => state.commServicesAccessToken,
   );
 
   return React.useCallback(
     async password => {
       invariant(
         usingCommServicesAccessToken,
         'deleteDiscardedIdentityAccount can only be called when ' +
           'usingCommServicesAccessToken',
       );
       if (!identityClient) {
         throw new Error('Identity service client is not initialized');
       }
       if (
         !identityClient.deleteWalletUser ||
         !identityClient.deletePasswordUser
       ) {
         throw new Error('Delete user method unimplemented');
       }
       const deleteUserPromise = password
         ? identityClient.deletePasswordUser(password)
         : identityClient.deleteWalletUser();
 
       await Promise.race([
         deleteUserPromise,
         (async () => {
           await sleep(callIdentityServiceTimeout);
           throw new Error('identity delete user call took more than 500ms');
         })(),
       ]);
 
       return {
         currentUserInfo: null,
         preRequestUserState: {
           ...preRequestUserState,
           commServicesAccessToken,
         },
       };
     },
     [commServicesAccessToken, identityClient, preRequestUserState],
   );
 }
 
 const legacyKeyserverRegisterActionTypes = Object.freeze({
   started: 'LEGACY_KEYSERVER_REGISTER_STARTED',
   success: 'LEGACY_KEYSERVER_REGISTER_SUCCESS',
   failed: 'LEGACY_KEYSERVER_REGISTER_FAILED',
 });
 const legacyKeyserverRegisterCallSingleKeyserverEndpointOptions = {
   timeout: permissionsAndAuthRelatedRequestTimeout,
 };
 const legacyKeyserverRegister =
   (
     callSingleKeyserverEndpoint: CallSingleKeyserverEndpoint,
   ): ((
     registerInfo: LegacyRegisterInfo,
     options?: CallSingleKeyserverEndpointOptions,
   ) => Promise<LegacyRegisterResult>) =>
   async (registerInfo, options) => {
     const deviceTokenUpdateRequest =
       registerInfo.deviceTokenUpdateRequest[authoritativeKeyserverID()];
     const { preRequestUserInfo, ...rest } = registerInfo;
 
     const response = await callSingleKeyserverEndpoint(
       'create_account',
       {
         ...rest,
         deviceTokenUpdateRequest,
         platformDetails: getConfig().platformDetails,
       },
       {
         ...legacyKeyserverRegisterCallSingleKeyserverEndpointOptions,
         ...options,
       },
     );
     return {
       currentUserInfo: response.currentUserInfo,
       rawMessageInfos: response.rawMessageInfos,
       threadInfos: response.cookieChange.threadInfos,
       userInfos: response.cookieChange.userInfos,
       calendarQuery: registerInfo.calendarQuery,
     };
   };
 
 export type KeyserverAuthInput = $ReadOnly<{
   ...KeyserverAuthInfo,
   +preRequestUserInfo: ?CurrentUserInfo,
 }>;
 
 const keyserverAuthActionTypes = Object.freeze({
   started: 'KEYSERVER_AUTH_STARTED',
   success: 'KEYSERVER_AUTH_SUCCESS',
   failed: 'KEYSERVER_AUTH_FAILED',
 });
 const keyserverAuthCallSingleKeyserverEndpointOptions = {
   timeout: permissionsAndAuthRelatedRequestTimeout,
 };
 const keyserverAuth =
   (
     callKeyserverEndpoint: CallKeyserverEndpoint,
   ): ((input: KeyserverAuthInput) => Promise<KeyserverAuthResult>) =>
   async keyserverAuthInfo => {
     const watchedIDs = threadWatcher.getWatchedIDs();
 
     const {
       authActionSource,
       calendarQuery,
       keyserverData,
       deviceTokenUpdateInput,
       preRequestUserInfo,
       ...restLogInInfo
     } = keyserverAuthInfo;
 
     const keyserverIDs = Object.keys(keyserverData);
 
     const watchedIDsPerKeyserver = sortThreadIDsPerKeyserver(watchedIDs);
     const calendarQueryPerKeyserver = sortCalendarQueryPerKeyserver(
       calendarQuery,
       keyserverIDs,
     );
 
     const requests: { [string]: KeyserverAuthRequest } = {};
     for (const keyserverID of keyserverIDs) {
       requests[keyserverID] = {
         ...restLogInInfo,
         deviceTokenUpdateRequest: deviceTokenUpdateInput[keyserverID],
         watchedIDs: watchedIDsPerKeyserver[keyserverID] ?? [],
         calendarQuery: calendarQueryPerKeyserver[keyserverID],
         platformDetails: getConfig().platformDetails,
         initialContentEncryptedMessage:
           keyserverData[keyserverID].initialContentEncryptedMessage,
         initialNotificationsEncryptedMessage:
           keyserverData[keyserverID].initialNotificationsEncryptedMessage,
         source: authActionSource,
       };
     }
 
     const responses: { +[string]: ClientLogInResponse } =
       await callKeyserverEndpoint(
         'keyserver_auth',
         requests,
         keyserverAuthCallSingleKeyserverEndpointOptions,
       );
 
     const userInfosArrays = [];
 
     let threadInfos: RawThreadInfos = {};
     const calendarResult: WritableCalendarResult = {
       calendarQuery: keyserverAuthInfo.calendarQuery,
       rawEntryInfos: [],
     };
     const messagesResult: WritableGenericMessagesResult = {
       messageInfos: [],
       truncationStatus: {},
       watchedIDsAtRequestTime: watchedIDs,
       currentAsOf: {},
     };
     let updatesCurrentAsOf: { +[string]: number } = {};
     for (const keyserverID in responses) {
       threadInfos = {
         ...responses[keyserverID].cookieChange.threadInfos,
         ...threadInfos,
       };
       if (responses[keyserverID].rawEntryInfos) {
         calendarResult.rawEntryInfos = calendarResult.rawEntryInfos.concat(
           responses[keyserverID].rawEntryInfos,
         );
       }
       messagesResult.messageInfos = messagesResult.messageInfos.concat(
         responses[keyserverID].rawMessageInfos,
       );
       messagesResult.truncationStatus = {
         ...messagesResult.truncationStatus,
         ...responses[keyserverID].truncationStatuses,
       };
       messagesResult.currentAsOf = {
         ...messagesResult.currentAsOf,
         [keyserverID]: responses[keyserverID].serverTime,
       };
       updatesCurrentAsOf = {
         ...updatesCurrentAsOf,
         [keyserverID]: responses[keyserverID].serverTime,
       };
       userInfosArrays.push(responses[keyserverID].userInfos);
       userInfosArrays.push(responses[keyserverID].cookieChange.userInfos);
     }
 
     const userInfos = mergeUserInfos(...userInfosArrays);
 
     return {
       threadInfos,
       currentUserInfo: responses[authoritativeKeyserverID()]?.currentUserInfo,
       calendarResult,
       messagesResult,
       userInfos,
       updatesCurrentAsOf,
       authActionSource: keyserverAuthInfo.authActionSource,
       notAcknowledgedPolicies:
         responses[authoritativeKeyserverID()]?.notAcknowledgedPolicies,
       preRequestUserInfo,
     };
   };
 
 const identityRegisterActionTypes = Object.freeze({
   started: 'IDENTITY_REGISTER_STARTED',
   success: 'IDENTITY_REGISTER_SUCCESS',
   failed: 'IDENTITY_REGISTER_FAILED',
 });
 function useIdentityPasswordRegister(): (
   username: string,
   password: string,
   fid: ?string,
 ) => Promise<IdentityAuthResult> {
   const client = React.useContext(IdentityClientContext);
   const identityClient = client?.identityClient;
   invariant(identityClient, 'Identity client should be set');
   if (!identityClient.registerPasswordUser) {
     throw new Error('Register password user method unimplemented');
   }
   return identityClient.registerPasswordUser;
 }
 function useIdentityWalletRegister(): (
   walletAddress: string,
   siweMessage: string,
   siweSignature: string,
   fid: ?string,
 ) => Promise<IdentityAuthResult> {
   const client = React.useContext(IdentityClientContext);
   const identityClient = client?.identityClient;
   invariant(identityClient, 'Identity client should be set');
   if (!identityClient.registerWalletUser) {
     throw new Error('Register wallet user method unimplemented');
   }
   return identityClient.registerWalletUser;
 }
 
 const identityGenerateNonceActionTypes = Object.freeze({
   started: 'IDENTITY_GENERATE_NONCE_STARTED',
   success: 'IDENTITY_GENERATE_NONCE_SUCCESS',
   failed: 'IDENTITY_GENERATE_NONCE_FAILED',
 });
 function useIdentityGenerateNonce(): () => Promise<string> {
   const client = React.useContext(IdentityClientContext);
   const identityClient = client?.identityClient;
   invariant(identityClient, 'Identity client should be set');
   return identityClient.generateNonce;
 }
 
 function mergeUserInfos(
   ...userInfoArrays: Array<$ReadOnlyArray<UserInfo>>
 ): UserInfo[] {
   const merged: { [string]: UserInfo } = {};
   for (const userInfoArray of userInfoArrays) {
     for (const userInfo of userInfoArray) {
       merged[userInfo.id] = userInfo;
     }
   }
   const flattened = [];
   for (const id in merged) {
     flattened.push(merged[id]);
   }
   return flattened;
 }
 
 type WritableGenericMessagesResult = {
   messageInfos: RawMessageInfo[],
   truncationStatus: MessageTruncationStatuses,
   watchedIDsAtRequestTime: string[],
   currentAsOf: { [keyserverID: string]: number },
 };
 type WritableCalendarResult = {
   rawEntryInfos: RawEntryInfo[],
   calendarQuery: CalendarQuery,
 };
 
 const identityLogInActionTypes = Object.freeze({
   started: 'IDENTITY_LOG_IN_STARTED',
   success: 'IDENTITY_LOG_IN_SUCCESS',
   failed: 'IDENTITY_LOG_IN_FAILED',
 });
 function useIdentityPasswordLogIn(): (
   username: string,
   password: string,
 ) => Promise<IdentityAuthResult> {
   const client = React.useContext(IdentityClientContext);
   const identityClient = client?.identityClient;
   const preRequestUserState = useSelector(state => state.currentUserInfo);
   const callClaimUsername = useClaimUsername();
 
   return React.useCallback(
     (username, password) => {
       if (!identityClient) {
         throw new Error('Identity service client is not initialized');
       }
       return (async () => {
         let result;
         try {
           result = await identityClient.logInPasswordUser(username, password);
         } catch (e) {
           const { registerReservedPasswordUser } = identityClient;
           if (
             !registerReservedPasswordUser ||
             getMessageForException(e) !==
-              'need keyserver message to claim username'
+              'need_keyserver_message_to_claim_username'
           ) {
             throw e;
           }
           const { message, signature } = await callClaimUsername({
             username,
             password,
           });
           result = await registerReservedPasswordUser(
             username,
             password,
             message,
             signature,
           );
         }
         return {
           ...result,
           preRequestUserState,
         };
       })();
     },
     [identityClient, preRequestUserState, callClaimUsername],
   );
 }
 function useIdentityWalletLogIn(): (
   walletAddress: string,
   siweMessage: string,
   siweSignature: string,
 ) => Promise<IdentityAuthResult> {
   const client = React.useContext(IdentityClientContext);
   const identityClient = client?.identityClient;
   invariant(identityClient, 'Identity client should be set');
   return identityClient.logInWalletUser;
 }
 function useIdentitySecondaryDeviceLogIn(): (
   userID: string,
 ) => Promise<IdentityAuthResult> {
   const client = React.useContext(IdentityClientContext);
   const identityClient = client?.identityClient;
   invariant(identityClient, 'Identity client should be set');
   const { generateNonce, uploadKeysForRegisteredDeviceAndLogIn } =
     identityClient;
 
   const { signMessage } = getConfig().olmAPI;
 
   return React.useCallback(
     async (userID: string) => {
       const nonce = await generateNonce();
       const nonceSignature = await signMessage(nonce);
       return await uploadKeysForRegisteredDeviceAndLogIn(userID, {
         nonce,
         nonceSignature,
       });
     },
     [generateNonce, signMessage, uploadKeysForRegisteredDeviceAndLogIn],
   );
 }
 
 const legacyLogInActionTypes = Object.freeze({
   started: 'LEGACY_LOG_IN_STARTED',
   success: 'LEGACY_LOG_IN_SUCCESS',
   failed: 'LEGACY_LOG_IN_FAILED',
 });
 const legacyLogInCallSingleKeyserverEndpointOptions = {
   timeout: permissionsAndAuthRelatedRequestTimeout,
 };
 const legacyLogIn =
   (
     callKeyserverEndpoint: CallKeyserverEndpoint,
   ): ((input: LegacyLogInInfo) => Promise<LegacyLogInResult>) =>
   async logInInfo => {
     const watchedIDs = threadWatcher.getWatchedIDs();
     const {
       authActionSource,
       calendarQuery,
       keyserverIDs: inputKeyserverIDs,
       preRequestUserInfo,
       ...restLogInInfo
     } = logInInfo;
 
     // Eventually the list of keyservers will be fetched from the
     // identity service
     const keyserverIDs = inputKeyserverIDs ?? [authoritativeKeyserverID()];
 
     const watchedIDsPerKeyserver = sortThreadIDsPerKeyserver(watchedIDs);
     const calendarQueryPerKeyserver = sortCalendarQueryPerKeyserver(
       calendarQuery,
       keyserverIDs,
     );
 
     const requests: { [string]: LogInRequest } = {};
     for (const keyserverID of keyserverIDs) {
       requests[keyserverID] = {
         ...restLogInInfo,
         deviceTokenUpdateRequest:
           logInInfo.deviceTokenUpdateRequest[keyserverID],
         source: authActionSource,
         watchedIDs: watchedIDsPerKeyserver[keyserverID] ?? [],
         calendarQuery: calendarQueryPerKeyserver[keyserverID],
         platformDetails: getConfig().platformDetails,
       };
     }
 
     const responses: { +[string]: ClientLogInResponse } =
       await callKeyserverEndpoint(
         'log_in',
         requests,
         legacyLogInCallSingleKeyserverEndpointOptions,
       );
 
     const userInfosArrays = [];
 
     let threadInfos: RawThreadInfos = {};
     const calendarResult: WritableCalendarResult = {
       calendarQuery: logInInfo.calendarQuery,
       rawEntryInfos: [],
     };
     const messagesResult: WritableGenericMessagesResult = {
       messageInfos: [],
       truncationStatus: {},
       watchedIDsAtRequestTime: watchedIDs,
       currentAsOf: {},
     };
     let updatesCurrentAsOf: { +[string]: number } = {};
     for (const keyserverID in responses) {
       threadInfos = {
         ...responses[keyserverID].cookieChange.threadInfos,
         ...threadInfos,
       };
       if (responses[keyserverID].rawEntryInfos) {
         calendarResult.rawEntryInfos = calendarResult.rawEntryInfos.concat(
           responses[keyserverID].rawEntryInfos,
         );
       }
       messagesResult.messageInfos = messagesResult.messageInfos.concat(
         responses[keyserverID].rawMessageInfos,
       );
       messagesResult.truncationStatus = {
         ...messagesResult.truncationStatus,
         ...responses[keyserverID].truncationStatuses,
       };
       messagesResult.currentAsOf = {
         ...messagesResult.currentAsOf,
         [keyserverID]: responses[keyserverID].serverTime,
       };
       updatesCurrentAsOf = {
         ...updatesCurrentAsOf,
         [keyserverID]: responses[keyserverID].serverTime,
       };
       userInfosArrays.push(responses[keyserverID].userInfos);
       userInfosArrays.push(responses[keyserverID].cookieChange.userInfos);
     }
 
     const userInfos = mergeUserInfos(...userInfosArrays);
 
     return {
       threadInfos,
       currentUserInfo: responses[authoritativeKeyserverID()].currentUserInfo,
       calendarResult,
       messagesResult,
       userInfos,
       updatesCurrentAsOf,
       authActionSource: logInInfo.authActionSource,
       notAcknowledgedPolicies:
         responses[authoritativeKeyserverID()].notAcknowledgedPolicies,
       preRequestUserInfo,
     };
   };
 
 function useLegacyLogIn(): (
   input: LegacyLogInInfo,
 ) => Promise<LegacyLogInResult> {
   return useKeyserverCall(legacyLogIn);
 }
 
 const changeKeyserverUserPasswordActionTypes = Object.freeze({
   started: 'CHANGE_KEYSERVER_USER_PASSWORD_STARTED',
   success: 'CHANGE_KEYSERVER_USER_PASSWORD_SUCCESS',
   failed: 'CHANGE_KEYSERVER_USER_PASSWORD_FAILED',
 });
 const changeKeyserverUserPassword =
   (
     callSingleKeyserverEndpoint: CallSingleKeyserverEndpoint,
   ): ((passwordUpdate: PasswordUpdate) => Promise<void>) =>
   async passwordUpdate => {
     await callSingleKeyserverEndpoint('update_account', passwordUpdate);
   };
 
 const searchUsersActionTypes = Object.freeze({
   started: 'SEARCH_USERS_STARTED',
   success: 'SEARCH_USERS_SUCCESS',
   failed: 'SEARCH_USERS_FAILED',
 });
 const searchUsers =
   (
     callSingleKeyserverEndpoint: CallSingleKeyserverEndpoint,
   ): ((usernamePrefix: string) => Promise<UserSearchResult>) =>
   async usernamePrefix => {
     const response = await callSingleKeyserverEndpoint('search_users', {
       prefix: usernamePrefix,
     });
     return {
       userInfos: response.userInfos,
     };
   };
 
 const exactSearchUserActionTypes = Object.freeze({
   started: 'EXACT_SEARCH_USER_STARTED',
   success: 'EXACT_SEARCH_USER_SUCCESS',
   failed: 'EXACT_SEARCH_USER_FAILED',
 });
 const exactSearchUser =
   (
     callSingleKeyserverEndpoint: CallSingleKeyserverEndpoint,
   ): ((username: string) => Promise<ExactUserSearchResult>) =>
   async username => {
     const response = await callSingleKeyserverEndpoint('exact_search_user', {
       username,
     });
     return {
       userInfo: response.userInfo,
     };
   };
 
 const updateSubscriptionActionTypes = Object.freeze({
   started: 'UPDATE_SUBSCRIPTION_STARTED',
   success: 'UPDATE_SUBSCRIPTION_SUCCESS',
   failed: 'UPDATE_SUBSCRIPTION_FAILED',
 });
 const updateSubscription =
   (
     callKeyserverEndpoint: CallKeyserverEndpoint,
   ): ((
     input: SubscriptionUpdateRequest,
   ) => Promise<SubscriptionUpdateResult>) =>
   async input => {
     const keyserverID = extractKeyserverIDFromID(input.threadID);
     const requests = { [keyserverID]: input };
 
     const responses = await callKeyserverEndpoint(
       'update_user_subscription',
       requests,
     );
     const response = responses[keyserverID];
     return {
       threadID: input.threadID,
       subscription: response.threadSubscription,
     };
   };
 
 function useUpdateSubscription(): (
   input: SubscriptionUpdateRequest,
 ) => Promise<SubscriptionUpdateResult> {
   return useKeyserverCall(updateSubscription);
 }
 
 const setUserSettingsActionTypes = Object.freeze({
   started: 'SET_USER_SETTINGS_STARTED',
   success: 'SET_USER_SETTINGS_SUCCESS',
   failed: 'SET_USER_SETTINGS_FAILED',
 });
 
 const setUserSettings =
   (
     callKeyserverEndpoint: CallKeyserverEndpoint,
     allKeyserverIDs: $ReadOnlyArray<string>,
   ): ((input: UpdateUserSettingsRequest) => Promise<void>) =>
   async input => {
     const requests: { [string]: UpdateUserSettingsRequest } = {};
     for (const keyserverID of allKeyserverIDs) {
       requests[keyserverID] = input;
     }
     await callKeyserverEndpoint('update_user_settings', requests);
   };
 
 function useSetUserSettings(): (
   input: UpdateUserSettingsRequest,
 ) => Promise<void> {
   return useKeyserverCall(setUserSettings);
 }
 
 const getOlmSessionInitializationDataActionTypes = Object.freeze({
   started: 'GET_OLM_SESSION_INITIALIZATION_DATA_STARTED',
   success: 'GET_OLM_SESSION_INITIALIZATION_DATA_SUCCESS',
   failed: 'GET_OLM_SESSION_INITIALIZATION_DATA_FAILED',
 });
 
 const getOlmSessionInitializationData =
   (
     callSingleKeyserverEndpoint: CallSingleKeyserverEndpoint,
   ): ((
     options?: ?CallSingleKeyserverEndpointOptions,
   ) => Promise<GetOlmSessionInitializationDataResponse>) =>
   async options => {
     const olmInitData = await callSingleKeyserverEndpoint(
       'get_olm_session_initialization_data',
       {},
       options,
     );
     return {
       signedIdentityKeysBlob: olmInitData.signedIdentityKeysBlob,
       contentInitializationInfo: {
         ...olmInitData.contentInitializationInfo,
         oneTimeKey: getOneTimeKeyValuesFromBlob(
           olmInitData.contentInitializationInfo.oneTimeKey,
         )[0],
         prekey: getPrekeyValueFromBlob(
           olmInitData.contentInitializationInfo.prekey,
         ),
       },
       notifInitializationInfo: {
         ...olmInitData.notifInitializationInfo,
         oneTimeKey: getOneTimeKeyValuesFromBlob(
           olmInitData.notifInitializationInfo.oneTimeKey,
         )[0],
         prekey: getPrekeyValueFromBlob(
           olmInitData.notifInitializationInfo.prekey,
         ),
       },
     };
   };
 
 const policyAcknowledgmentActionTypes = Object.freeze({
   started: 'POLICY_ACKNOWLEDGMENT_STARTED',
   success: 'POLICY_ACKNOWLEDGMENT_SUCCESS',
   failed: 'POLICY_ACKNOWLEDGMENT_FAILED',
 });
 const policyAcknowledgment =
   (
     callSingleKeyserverEndpoint: CallSingleKeyserverEndpoint,
   ): ((policyRequest: PolicyAcknowledgmentRequest) => Promise<void>) =>
   async policyRequest => {
     await callSingleKeyserverEndpoint('policy_acknowledgment', policyRequest);
   };
 
 const updateUserAvatarActionTypes = Object.freeze({
   started: 'UPDATE_USER_AVATAR_STARTED',
   success: 'UPDATE_USER_AVATAR_SUCCESS',
   failed: 'UPDATE_USER_AVATAR_FAILED',
 });
 const updateUserAvatar =
   (
     callSingleKeyserverEndpoint: CallSingleKeyserverEndpoint,
   ): ((
     avatarDBContent: UpdateUserAvatarRequest,
   ) => Promise<UpdateUserAvatarResponse>) =>
   async avatarDBContent => {
     const { updates }: UpdateUserAvatarResponse =
       await callSingleKeyserverEndpoint('update_user_avatar', avatarDBContent);
     return { updates };
   };
 
 const processNewUserIDsActionType = 'PROCESS_NEW_USER_IDS';
 
 const findUserIdentitiesActionTypes = Object.freeze({
   started: 'FIND_USER_IDENTITIES_STARTED',
   success: 'FIND_USER_IDENTITIES_SUCCESS',
   failed: 'FIND_USER_IDENTITIES_FAILED',
 });
 
 function useFindUserIdentities(): (
   userIDs: $ReadOnlyArray<string>,
 ) => Promise<Identities> {
   const client = React.useContext(IdentityClientContext);
   const identityClient = client?.identityClient;
   invariant(identityClient, 'Identity client should be set');
   return identityClient.findUserIdentities;
 }
 
 const versionSupportedByIdentityActionTypes = Object.freeze({
   started: 'VERSION_SUPPORTED_BY_IDENTITY_STARTED',
   success: 'VERSION_SUPPORTED_BY_IDENTITY_SUCCESS',
   failed: 'VERSION_SUPPORTED_BY_IDENTITY_FAILED',
 });
 
 function useVersionSupportedByIdentity(): () => Promise<{
   +supported: boolean,
 }> {
   const client = React.useContext(IdentityClientContext);
   const identityClient = client?.identityClient;
   invariant(identityClient, 'Identity client should be set');
   return async () => {
     const supported = await identityClient.versionSupported();
     return { supported };
   };
 }
 
 export {
   changeKeyserverUserPasswordActionTypes,
   changeKeyserverUserPassword,
   claimUsernameActionTypes,
   useClaimUsername,
   useDeleteKeyserverAccount,
   deleteKeyserverAccountActionTypes,
   getOlmSessionInitializationDataActionTypes,
   getOlmSessionInitializationData,
   mergeUserInfos,
   legacyLogIn as legacyLogInRawAction,
   identityLogInActionTypes,
   useIdentityPasswordLogIn,
   useIdentityWalletLogIn,
   useIdentitySecondaryDeviceLogIn,
   useLegacyLogIn,
   legacyLogInActionTypes,
   useLogOut,
   useIdentityLogOut,
   useSecondaryDeviceLogOut,
   logOutActionTypes,
   legacyKeyserverRegister,
   legacyKeyserverRegisterActionTypes,
   searchUsers,
   searchUsersActionTypes,
   exactSearchUser,
   exactSearchUserActionTypes,
   useSetUserSettings,
   setUserSettingsActionTypes,
   useUpdateSubscription,
   updateSubscriptionActionTypes,
   policyAcknowledgment,
   policyAcknowledgmentActionTypes,
   updateUserAvatarActionTypes,
   updateUserAvatar,
   deleteAccountActionTypes,
   useDeleteAccount,
   useDeleteDiscardedIdentityAccount,
   keyserverAuthActionTypes,
   keyserverAuth as keyserverAuthRawAction,
   identityRegisterActionTypes,
   useIdentityPasswordRegister,
   useIdentityWalletRegister,
   identityGenerateNonceActionTypes,
   useIdentityGenerateNonce,
   processNewUserIDsActionType,
   findUserIdentitiesActionTypes,
   useFindUserIdentities,
   versionSupportedByIdentityActionTypes,
   useVersionSupportedByIdentity,
 };
diff --git a/services/identity/src/client_service.rs b/services/identity/src/client_service.rs
index 999cdb3b5..693626969 100644
--- a/services/identity/src/client_service.rs
+++ b/services/identity/src/client_service.rs
@@ -1,1227 +1,1235 @@
 // Standard library imports
 use std::str::FromStr;
 
 // External crate imports
 use comm_lib::aws::DynamoDBError;
 use comm_lib::shared::reserved_users::RESERVED_USERNAME_SET;
 use comm_opaque2::grpc::protocol_error_to_grpc_status;
 use rand::rngs::OsRng;
 use serde::{Deserialize, Serialize};
 use siwe::eip55;
 use tonic::Response;
 use tracing::{debug, error, info, warn};
 
 // Workspace crate imports
 use crate::config::CONFIG;
 use crate::constants::{error_types, tonic_status_messages};
 use crate::database::{
   DBDeviceTypeInt, DatabaseClient, DeviceType, KeyPayload
 };
 use crate::device_list::SignedDeviceList;
 use crate::error::{DeviceListError, Error as DBError};
 use crate::grpc_services::authenticated::DeletePasswordUserInfo;
 use crate::grpc_services::protos::unauth::{
   find_user_id_request, AddReservedUsernamesRequest, AuthResponse, Empty,
   ExistingDeviceLoginRequest, FindUserIdRequest, FindUserIdResponse,
   GenerateNonceResponse, OpaqueLoginFinishRequest, OpaqueLoginStartRequest,
   OpaqueLoginStartResponse, RegistrationFinishRequest, RegistrationStartRequest,
   RegistrationStartResponse, RemoveReservedUsernameRequest,
   ReservedRegistrationStartRequest, ReservedWalletRegistrationRequest,
   SecondaryDeviceKeysUploadRequest, VerifyUserAccessTokenRequest,
   VerifyUserAccessTokenResponse, WalletAuthRequest, GetFarcasterUsersRequest,
   GetFarcasterUsersResponse
 };
 use crate::grpc_services::shared::get_platform_metadata;
 use crate::grpc_utils::{
   DeviceKeyUploadActions, RegistrationActions, SignedNonce
 };
 use crate::nonce::generate_nonce_data;
 use crate::reserved_users::{
   validate_account_ownership_message_and_get_user_id,
   validate_add_reserved_usernames_message,
   validate_remove_reserved_username_message,
 };
 use crate::siwe::{
   is_valid_ethereum_address, parse_and_verify_siwe_message, SocialProof,
 };
 use crate::token::{AccessTokenData, AuthType};
 pub use crate::grpc_services::protos::unauth::identity_client_service_server::{
     IdentityClientService, IdentityClientServiceServer,
   };
 use crate::regex::is_valid_username;
 
 #[derive(Clone, Serialize, Deserialize)]
 pub enum WorkflowInProgress {
   Registration(Box<UserRegistrationInfo>),
   Login(Box<UserLoginInfo>),
   Update(UpdateState),
   PasswordUserDeletion(Box<DeletePasswordUserInfo>),
 }
 
 #[derive(Clone, Serialize, Deserialize)]
 pub struct UserRegistrationInfo {
   pub username: String,
   pub flattened_device_key_upload: FlattenedDeviceKeyUpload,
   pub user_id: Option<String>,
   pub farcaster_id: Option<String>,
   pub initial_device_list: Option<SignedDeviceList>,
 }
 
 #[derive(Clone, Serialize, Deserialize)]
 pub struct UserLoginInfo {
   pub user_id: String,
   pub username: String,
   pub flattened_device_key_upload: FlattenedDeviceKeyUpload,
   pub opaque_server_login: comm_opaque2::server::Login,
   pub device_to_remove: Option<String>,
 }
 
 #[derive(Clone, Serialize, Deserialize)]
 pub struct UpdateState {
   pub user_id: String,
 }
 
 #[derive(Clone, Serialize, Deserialize)]
 pub struct FlattenedDeviceKeyUpload {
   pub device_id_key: String,
   pub key_payload: String,
   pub key_payload_signature: String,
   pub content_prekey: String,
   pub content_prekey_signature: String,
   pub content_one_time_keys: Vec<String>,
   pub notif_prekey: String,
   pub notif_prekey_signature: String,
   pub notif_one_time_keys: Vec<String>,
   pub device_type: DeviceType,
 }
 
 #[derive(derive_more::Constructor)]
 pub struct ClientService {
   client: DatabaseClient,
 }
 
 #[tonic::async_trait]
 impl IdentityClientService for ClientService {
   #[tracing::instrument(skip_all)]
   async fn register_password_user_start(
     &self,
     request: tonic::Request<RegistrationStartRequest>,
   ) -> Result<tonic::Response<RegistrationStartResponse>, tonic::Status> {
     let message = request.into_inner();
     debug!("Received registration request for: {}", message.username);
 
     if !is_valid_username(&message.username)
       || is_valid_ethereum_address(&message.username)
     {
-      return Err(tonic::Status::invalid_argument("invalid username"));
+      return Err(tonic::Status::invalid_argument(
+        tonic_status_messages::INVALID_USERNAME,
+      ));
     }
 
     self.check_username_taken(&message.username).await?;
     let username_in_reserved_usernames_table = self
       .client
       .username_in_reserved_usernames_table(&message.username)
       .await
       .map_err(handle_db_error)?;
 
     if username_in_reserved_usernames_table {
       return Err(tonic::Status::already_exists(
         tonic_status_messages::USERNAME_ALREADY_EXISTS,
       ));
     }
 
     if RESERVED_USERNAME_SET.contains(&message.username) {
       return Err(tonic::Status::invalid_argument(
         tonic_status_messages::USERNAME_RESERVED,
       ));
     }
 
     if let Some(fid) = &message.farcaster_id {
       self.check_farcaster_id_taken(fid).await?;
     }
 
     let registration_state = construct_user_registration_info(
       &message,
       None,
       message.username.clone(),
       message.farcaster_id.clone(),
     )?;
     let server_registration = comm_opaque2::server::Registration::new();
     let server_message = server_registration
       .start(
         &CONFIG.server_setup,
         &message.opaque_registration_request,
         message.username.as_bytes(),
       )
       .map_err(protocol_error_to_grpc_status)?;
     let session_id = self
       .client
       .insert_workflow(WorkflowInProgress::Registration(Box::new(
         registration_state,
       )))
       .await
       .map_err(handle_db_error)?;
 
     let response = RegistrationStartResponse {
       session_id,
       opaque_registration_response: server_message,
     };
     Ok(Response::new(response))
   }
 
   #[tracing::instrument(skip_all)]
   async fn register_reserved_password_user_start(
     &self,
     request: tonic::Request<ReservedRegistrationStartRequest>,
   ) -> Result<tonic::Response<RegistrationStartResponse>, tonic::Status> {
     let message = request.into_inner();
     self.check_username_taken(&message.username).await?;
 
     if RESERVED_USERNAME_SET.contains(&message.username) {
       return Err(tonic::Status::invalid_argument(
         tonic_status_messages::USERNAME_RESERVED,
       ));
     }
 
     let username_in_reserved_usernames_table = self
       .client
       .username_in_reserved_usernames_table(&message.username)
       .await
       .map_err(handle_db_error)?;
     if !username_in_reserved_usernames_table {
-      return Err(tonic::Status::permission_denied("username not reserved"));
+      return Err(tonic::Status::permission_denied(
+        tonic_status_messages::USERNAME_NOT_RESERVED,
+      ));
     }
 
     let user_id = validate_account_ownership_message_and_get_user_id(
       &message.username,
       &message.keyserver_message,
       &message.keyserver_signature,
     )?;
 
     let registration_state = construct_user_registration_info(
       &message,
       Some(user_id),
       message.username.clone(),
       None,
     )?;
     let server_registration = comm_opaque2::server::Registration::new();
     let server_message = server_registration
       .start(
         &CONFIG.server_setup,
         &message.opaque_registration_request,
         message.username.as_bytes(),
       )
       .map_err(protocol_error_to_grpc_status)?;
 
     let session_id = self
       .client
       .insert_workflow(WorkflowInProgress::Registration(Box::new(
         registration_state,
       )))
       .await
       .map_err(handle_db_error)?;
 
     let response = RegistrationStartResponse {
       session_id,
       opaque_registration_response: server_message,
     };
     Ok(Response::new(response))
   }
 
   #[tracing::instrument(skip_all)]
   async fn register_password_user_finish(
     &self,
     request: tonic::Request<RegistrationFinishRequest>,
   ) -> Result<tonic::Response<AuthResponse>, tonic::Status> {
     let platform_metadata = get_platform_metadata(&request)?;
     let message = request.into_inner();
 
     if let Some(WorkflowInProgress::Registration(state)) = self
       .client
       .get_workflow(message.session_id)
       .await
       .map_err(handle_db_error)?
     {
       let server_registration = comm_opaque2::server::Registration::new();
       let password_file = server_registration
         .finish(&message.opaque_registration_upload)
         .map_err(protocol_error_to_grpc_status)?;
 
       let login_time = chrono::Utc::now();
       let device_id = state.flattened_device_key_upload.device_id_key.clone();
       let username = state.username.clone();
       let user_id = self
         .client
         .add_password_user_to_users_table(
           *state,
           password_file,
           platform_metadata,
           login_time,
         )
         .await
         .map_err(handle_db_error)?;
 
       // Create access token
       let token = AccessTokenData::with_created_time(
         user_id.clone(),
         device_id,
         login_time,
         crate::token::AuthType::Password,
         &mut OsRng,
       );
 
       let access_token = token.access_token.clone();
 
       self
         .client
         .put_access_token_data(token)
         .await
         .map_err(handle_db_error)?;
 
       let response = AuthResponse {
         user_id,
         access_token,
         username,
       };
       Ok(Response::new(response))
     } else {
       Err(tonic::Status::not_found(
         tonic_status_messages::SESSION_NOT_FOUND,
       ))
     }
   }
 
   #[tracing::instrument(skip_all)]
   async fn log_in_password_user_start(
     &self,
     request: tonic::Request<OpaqueLoginStartRequest>,
   ) -> Result<tonic::Response<OpaqueLoginStartResponse>, tonic::Status> {
     let message = request.into_inner();
 
     debug!("Attempting to log in user: {:?}", &message.username);
     let user_id_and_password_file = self
       .client
       .get_user_id_and_password_file_from_username(&message.username)
       .await
       .map_err(handle_db_error)?;
 
     let (user_id, password_file_bytes) =
       if let Some(data) = user_id_and_password_file {
         data
       } else {
         // It's possible that the user attempting login is already registered
         // on Ashoat's keyserver. If they are, we should send back a gRPC status
         // code instructing them to get a signed message from Ashoat's keyserver
         // in order to claim their username and register with the Identity
         // service.
         let username_in_reserved_usernames_table = self
           .client
           .username_in_reserved_usernames_table(&message.username)
           .await
           .map_err(handle_db_error)?;
 
         if username_in_reserved_usernames_table {
           return Err(tonic::Status::permission_denied(
-            "need keyserver message to claim username",
+            tonic_status_messages::NEED_KEYSERVER_MESSAGE_TO_CLAIM_USERNAME,
           ));
         }
 
         return Err(tonic::Status::not_found(
           tonic_status_messages::USER_NOT_FOUND,
         ));
       };
 
     let flattened_device_key_upload =
       construct_flattened_device_key_upload(&message)?;
 
     let maybe_device_to_remove = self
       .get_keyserver_device_to_remove(
         &user_id,
         &flattened_device_key_upload.device_id_key,
         message.force.unwrap_or(false),
         &flattened_device_key_upload.device_type,
       )
       .await?;
 
     let mut server_login = comm_opaque2::server::Login::new();
     let server_response = server_login
       .start(
         &CONFIG.server_setup,
         &password_file_bytes,
         &message.opaque_login_request,
         message.username.as_bytes(),
       )
       .map_err(protocol_error_to_grpc_status)?;
 
     let login_state = construct_user_login_info(
       user_id,
       message.username,
       server_login,
       flattened_device_key_upload,
       maybe_device_to_remove,
     )?;
 
     let session_id = self
       .client
       .insert_workflow(WorkflowInProgress::Login(Box::new(login_state)))
       .await
       .map_err(handle_db_error)?;
 
     let response = Response::new(OpaqueLoginStartResponse {
       session_id,
       opaque_login_response: server_response,
     });
     Ok(response)
   }
 
   #[tracing::instrument(skip_all)]
   async fn log_in_password_user_finish(
     &self,
     request: tonic::Request<OpaqueLoginFinishRequest>,
   ) -> Result<tonic::Response<AuthResponse>, tonic::Status> {
     let platform_metadata = get_platform_metadata(&request)?;
     let message = request.into_inner();
 
     if let Some(WorkflowInProgress::Login(state)) = self
       .client
       .get_workflow(message.session_id)
       .await
       .map_err(handle_db_error)?
     {
       let mut server_login = state.opaque_server_login.clone();
       server_login
         .finish(&message.opaque_login_upload)
         .map_err(protocol_error_to_grpc_status)?;
 
       if let Some(device_to_remove) = state.device_to_remove {
         self
           .client
           .remove_device(state.user_id.clone(), device_to_remove)
           .await
           .map_err(handle_db_error)?;
       }
 
       let login_time = chrono::Utc::now();
       self
         .client
         .add_user_device(
           state.user_id.clone(),
           state.flattened_device_key_upload.clone(),
           platform_metadata,
           login_time,
         )
         .await
         .map_err(handle_db_error)?;
 
       // Create access token
       let token = AccessTokenData::with_created_time(
         state.user_id.clone(),
         state.flattened_device_key_upload.device_id_key,
         login_time,
         crate::token::AuthType::Password,
         &mut OsRng,
       );
 
       let access_token = token.access_token.clone();
 
       self
         .client
         .put_access_token_data(token)
         .await
         .map_err(handle_db_error)?;
 
       let response = AuthResponse {
         user_id: state.user_id,
         access_token,
         username: state.username,
       };
       Ok(Response::new(response))
     } else {
       Err(tonic::Status::not_found(
         tonic_status_messages::SESSION_NOT_FOUND,
       ))
     }
   }
 
   #[tracing::instrument(skip_all)]
   async fn log_in_wallet_user(
     &self,
     request: tonic::Request<WalletAuthRequest>,
   ) -> Result<tonic::Response<AuthResponse>, tonic::Status> {
     let platform_metadata = get_platform_metadata(&request)?;
     let message = request.into_inner();
 
     // WalletAuthRequest is used for both log_in_wallet_user and register_wallet_user
     if !message.initial_device_list.is_empty() {
       return Err(tonic::Status::invalid_argument(
-        "unexpected initial device list",
+        tonic_status_messages::UNEXPECTED_INITIAL_DEVICE_LIST,
       ));
     }
 
     let parsed_message = parse_and_verify_siwe_message(
       &message.siwe_message,
       &message.siwe_signature,
     )?;
 
     self.verify_and_remove_nonce(&parsed_message.nonce).await?;
 
     let wallet_address = eip55(&parsed_message.address);
 
     let flattened_device_key_upload =
       construct_flattened_device_key_upload(&message)?;
 
     let login_time = chrono::Utc::now();
     let Some(user_id) = self
       .client
       .get_user_id_from_user_info(wallet_address.clone(), &AuthType::Wallet)
       .await
       .map_err(handle_db_error)?
     else {
       // It's possible that the user attempting login is already registered
       // on Ashoat's keyserver. If they are, we should send back a gRPC status
       // code instructing them to get a signed message from Ashoat's keyserver
       // in order to claim their wallet address and register with the Identity
       // service.
       let username_in_reserved_usernames_table = self
         .client
         .username_in_reserved_usernames_table(&wallet_address)
         .await
         .map_err(handle_db_error)?;
 
       if username_in_reserved_usernames_table {
         return Err(tonic::Status::permission_denied(
-          "need keyserver message to claim username",
+          tonic_status_messages::NEED_KEYSERVER_MESSAGE_TO_CLAIM_USERNAME,
         ));
       }
 
       return Err(tonic::Status::not_found(
         tonic_status_messages::USER_NOT_FOUND,
       ));
     };
 
     self
       .client
       .add_user_device(
         user_id.clone(),
         flattened_device_key_upload.clone(),
         platform_metadata,
         chrono::Utc::now(),
       )
       .await
       .map_err(handle_db_error)?;
 
     // Create access token
     let token = AccessTokenData::with_created_time(
       user_id.clone(),
       flattened_device_key_upload.device_id_key,
       login_time,
       crate::token::AuthType::Wallet,
       &mut OsRng,
     );
 
     let access_token = token.access_token.clone();
 
     self
       .client
       .put_access_token_data(token)
       .await
       .map_err(handle_db_error)?;
 
     let response = AuthResponse {
       user_id,
       access_token,
       username: wallet_address,
     };
     Ok(Response::new(response))
   }
 
   #[tracing::instrument(skip_all)]
   async fn register_wallet_user(
     &self,
     request: tonic::Request<WalletAuthRequest>,
   ) -> Result<tonic::Response<AuthResponse>, tonic::Status> {
     let platform_metadata = get_platform_metadata(&request)?;
     let message = request.into_inner();
 
     let parsed_message = parse_and_verify_siwe_message(
       &message.siwe_message,
       &message.siwe_signature,
     )?;
 
     match self
       .client
       .get_nonce_from_nonces_table(&parsed_message.nonce)
       .await
       .map_err(handle_db_error)?
     {
       None => {
         return Err(tonic::Status::invalid_argument(
           tonic_status_messages::INVALID_NONCE,
         ))
       }
       Some(nonce) if nonce.is_expired() => {
         // we don't need to remove the nonce from the table here
         // because the DynamoDB TTL will take care of it
         return Err(tonic::Status::aborted(
           tonic_status_messages::NONCE_EXPIRED,
         ));
       }
       Some(_) => self
         .client
         .remove_nonce_from_nonces_table(&parsed_message.nonce)
         .await
         .map_err(handle_db_error)?,
     };
 
     let wallet_address = eip55(&parsed_message.address);
 
     self.check_wallet_address_taken(&wallet_address).await?;
     let username_in_reserved_usernames_table = self
       .client
       .username_in_reserved_usernames_table(&wallet_address)
       .await
       .map_err(handle_db_error)?;
 
     if username_in_reserved_usernames_table {
       return Err(tonic::Status::already_exists(
         tonic_status_messages::WALLET_ADDRESS_TAKEN,
       ));
     }
 
     if let Some(fid) = &message.farcaster_id {
       self.check_farcaster_id_taken(fid).await?;
     }
 
     let flattened_device_key_upload =
       construct_flattened_device_key_upload(&message)?;
 
     let login_time = chrono::Utc::now();
 
     let initial_device_list = message.get_and_verify_initial_device_list()?;
     let social_proof =
       SocialProof::new(message.siwe_message, message.siwe_signature);
 
     let user_id = self
       .client
       .add_wallet_user_to_users_table(
         flattened_device_key_upload.clone(),
         wallet_address.clone(),
         social_proof,
         None,
         platform_metadata,
         login_time,
         message.farcaster_id,
         initial_device_list,
       )
       .await
       .map_err(handle_db_error)?;
 
     // Create access token
     let token = AccessTokenData::with_created_time(
       user_id.clone(),
       flattened_device_key_upload.device_id_key,
       login_time,
       crate::token::AuthType::Wallet,
       &mut OsRng,
     );
 
     let access_token = token.access_token.clone();
 
     self
       .client
       .put_access_token_data(token)
       .await
       .map_err(handle_db_error)?;
 
     let response = AuthResponse {
       user_id,
       access_token,
       username: wallet_address,
     };
     Ok(Response::new(response))
   }
 
   #[tracing::instrument(skip_all)]
   async fn register_reserved_wallet_user(
     &self,
     request: tonic::Request<ReservedWalletRegistrationRequest>,
   ) -> Result<tonic::Response<AuthResponse>, tonic::Status> {
     let platform_metadata = get_platform_metadata(&request)?;
     let message = request.into_inner();
 
     let parsed_message = parse_and_verify_siwe_message(
       &message.siwe_message,
       &message.siwe_signature,
     )?;
 
     self.verify_and_remove_nonce(&parsed_message.nonce).await?;
 
     let wallet_address = eip55(&parsed_message.address);
 
     self.check_wallet_address_taken(&wallet_address).await?;
 
     let wallet_address_in_reserved_usernames_table = self
       .client
       .username_in_reserved_usernames_table(&wallet_address)
       .await
       .map_err(handle_db_error)?;
     if !wallet_address_in_reserved_usernames_table {
       return Err(tonic::Status::permission_denied(
         tonic_status_messages::WALLET_ADDRESS_NOT_RESERVED,
       ));
     }
 
     let user_id = validate_account_ownership_message_and_get_user_id(
       &wallet_address,
       &message.keyserver_message,
       &message.keyserver_signature,
     )?;
 
     let flattened_device_key_upload =
       construct_flattened_device_key_upload(&message)?;
 
     let initial_device_list = message.get_and_verify_initial_device_list()?;
     let social_proof =
       SocialProof::new(message.siwe_message, message.siwe_signature);
 
     let login_time = chrono::Utc::now();
     self
       .client
       .add_wallet_user_to_users_table(
         flattened_device_key_upload.clone(),
         wallet_address.clone(),
         social_proof,
         Some(user_id.clone()),
         platform_metadata,
         login_time,
         None,
         initial_device_list,
       )
       .await
       .map_err(handle_db_error)?;
 
     let token = AccessTokenData::with_created_time(
       user_id.clone(),
       flattened_device_key_upload.device_id_key,
       login_time,
       crate::token::AuthType::Wallet,
       &mut OsRng,
     );
 
     let access_token = token.access_token.clone();
 
     self
       .client
       .put_access_token_data(token)
       .await
       .map_err(handle_db_error)?;
 
     let response = AuthResponse {
       user_id,
       access_token,
       username: wallet_address,
     };
 
     Ok(Response::new(response))
   }
 
   #[tracing::instrument(skip_all)]
   async fn upload_keys_for_registered_device_and_log_in(
     &self,
     request: tonic::Request<SecondaryDeviceKeysUploadRequest>,
   ) -> Result<tonic::Response<AuthResponse>, tonic::Status> {
     let platform_metadata = get_platform_metadata(&request)?;
     let message = request.into_inner();
 
     let challenge_response = SignedNonce::try_from(&message)?;
     let flattened_device_key_upload =
       construct_flattened_device_key_upload(&message)?;
 
     let user_id = message.user_id;
     let device_id = flattened_device_key_upload.device_id_key.clone();
 
     let nonce = challenge_response.verify_and_get_nonce(&device_id)?;
     self.verify_and_remove_nonce(&nonce).await?;
 
     let user_identity = self
       .client
       .get_user_identity(&user_id)
       .await
       .map_err(handle_db_error)?
       .ok_or_else(|| {
         tonic::Status::not_found(tonic_status_messages::USER_NOT_FOUND)
       })?;
 
     let Some(device_list) = self
       .client
       .get_current_device_list(&user_id)
       .await
       .map_err(handle_db_error)?
     else {
       warn!("User {} does not have valid device list. Secondary device auth impossible.", user_id);
-      return Err(tonic::Status::aborted("device list error"));
+      return Err(tonic::Status::aborted(
+        tonic_status_messages::DEVICE_LIST_ERROR,
+      ));
     };
 
     if !device_list.device_ids.contains(&device_id) {
       return Err(tonic::Status::permission_denied(
-        "device not in device list",
+        tonic_status_messages::DEVICE_NOT_IN_DEVICE_LIST,
       ));
     }
 
     let login_time = chrono::Utc::now();
     let identifier = user_identity.identifier;
     let username = identifier.username().to_string();
     let token = AccessTokenData::with_created_time(
       user_id.clone(),
       device_id,
       login_time,
       identifier.into(),
       &mut OsRng,
     );
     let access_token = token.access_token.clone();
     self
       .client
       .put_access_token_data(token)
       .await
       .map_err(handle_db_error)?;
 
     self
       .client
       .put_device_data(
         &user_id,
         flattened_device_key_upload,
         platform_metadata,
         login_time,
       )
       .await
       .map_err(handle_db_error)?;
 
     let response = AuthResponse {
       user_id,
       access_token,
       username,
     };
     Ok(Response::new(response))
   }
 
   #[tracing::instrument(skip_all)]
   async fn log_in_existing_device(
     &self,
     request: tonic::Request<ExistingDeviceLoginRequest>,
   ) -> std::result::Result<tonic::Response<AuthResponse>, tonic::Status> {
     let message = request.into_inner();
     let challenge_response = SignedNonce::try_from(&message)?;
     let ExistingDeviceLoginRequest {
       user_id, device_id, ..
     } = message;
 
     let nonce = challenge_response.verify_and_get_nonce(&device_id)?;
     self.verify_and_remove_nonce(&nonce).await?;
 
     let (identity_response, device_list_response) = tokio::join!(
       self.client.get_user_identity(&user_id),
       self.client.get_current_device_list(&user_id)
     );
     let user_identity =
       identity_response.map_err(handle_db_error)?.ok_or_else(|| {
         tonic::Status::not_found(tonic_status_messages::USER_NOT_FOUND)
       })?;
 
     let device_list = device_list_response
       .map_err(handle_db_error)?
       .ok_or_else(|| {
         warn!("User {} does not have a valid device list.", user_id);
-        tonic::Status::aborted("device list error")
+        tonic::Status::aborted(tonic_status_messages::DEVICE_LIST_ERROR)
       })?;
 
     if !device_list.device_ids.contains(&device_id) {
       return Err(tonic::Status::permission_denied(
-        "device not in device list",
+        tonic_status_messages::DEVICE_NOT_IN_DEVICE_LIST,
       ));
     }
 
     let login_time = chrono::Utc::now();
     let identifier = user_identity.identifier;
     let username = identifier.username().to_string();
     let token = AccessTokenData::with_created_time(
       user_id.clone(),
       device_id,
       login_time,
       identifier.into(),
       &mut OsRng,
     );
     let access_token = token.access_token.clone();
     self
       .client
       .put_access_token_data(token)
       .await
       .map_err(handle_db_error)?;
 
     let response = AuthResponse {
       user_id,
       access_token,
       username,
     };
     Ok(Response::new(response))
   }
 
   #[tracing::instrument(skip_all)]
   async fn generate_nonce(
     &self,
     _request: tonic::Request<Empty>,
   ) -> Result<tonic::Response<GenerateNonceResponse>, tonic::Status> {
     let nonce_data = generate_nonce_data(&mut OsRng);
     match self
       .client
       .add_nonce_to_nonces_table(nonce_data.clone())
       .await
     {
       Ok(_) => Ok(Response::new(GenerateNonceResponse {
         nonce: nonce_data.nonce,
       })),
       Err(e) => Err(handle_db_error(e)),
     }
   }
 
   #[tracing::instrument(skip_all)]
   async fn verify_user_access_token(
     &self,
     request: tonic::Request<VerifyUserAccessTokenRequest>,
   ) -> Result<tonic::Response<VerifyUserAccessTokenResponse>, tonic::Status> {
     let message = request.into_inner();
     debug!("Verifying device: {}", &message.device_id);
 
     let token_valid = self
       .client
       .verify_access_token(
         message.user_id,
         message.device_id.clone(),
         message.access_token,
       )
       .await
       .map_err(handle_db_error)?;
 
     let response = Response::new(VerifyUserAccessTokenResponse { token_valid });
     debug!(
       "device {} was verified: {}",
       &message.device_id, token_valid
     );
     Ok(response)
   }
 
   #[tracing::instrument(skip_all)]
   async fn add_reserved_usernames(
     &self,
     request: tonic::Request<AddReservedUsernamesRequest>,
   ) -> Result<tonic::Response<Empty>, tonic::Status> {
     let message = request.into_inner();
 
     let user_details = validate_add_reserved_usernames_message(
       &message.message,
       &message.signature,
     )?;
 
     let filtered_user_details = self
       .client
       .filter_out_taken_usernames(user_details)
       .await
       .map_err(handle_db_error)?;
 
     self
       .client
       .add_usernames_to_reserved_usernames_table(filtered_user_details)
       .await
       .map_err(handle_db_error)?;
 
     let response = Response::new(Empty {});
     Ok(response)
   }
 
   #[tracing::instrument(skip_all)]
   async fn remove_reserved_username(
     &self,
     request: tonic::Request<RemoveReservedUsernameRequest>,
   ) -> Result<tonic::Response<Empty>, tonic::Status> {
     let message = request.into_inner();
 
     let username = validate_remove_reserved_username_message(
       &message.message,
       &message.signature,
     )?;
 
     self
       .client
       .delete_username_from_reserved_usernames_table(username)
       .await
       .map_err(handle_db_error)?;
 
     let response = Response::new(Empty {});
     Ok(response)
   }
 
   #[tracing::instrument(skip_all)]
   async fn ping(
     &self,
     _request: tonic::Request<Empty>,
   ) -> Result<Response<Empty>, tonic::Status> {
     let response = Response::new(Empty {});
     Ok(response)
   }
 
   #[tracing::instrument(skip_all)]
   async fn find_user_id(
     &self,
     request: tonic::Request<FindUserIdRequest>,
   ) -> Result<tonic::Response<FindUserIdResponse>, tonic::Status> {
     let message = request.into_inner();
 
     use find_user_id_request::Identifier;
     let (user_ident, auth_type) = match message.identifier {
       None => {
-        return Err(tonic::Status::invalid_argument("no identifier provided"))
+        return Err(tonic::Status::invalid_argument(
+          tonic_status_messages::NO_IDENTIFIER_PROVIDED,
+        ))
       }
       Some(Identifier::Username(username)) => (username, AuthType::Password),
       Some(Identifier::WalletAddress(address)) => (address, AuthType::Wallet),
     };
 
     let (is_reserved_result, user_id_result) = tokio::join!(
       self
         .client
         .username_in_reserved_usernames_table(&user_ident),
       self
         .client
         .get_user_id_from_user_info(user_ident.clone(), &auth_type),
     );
     let is_reserved = is_reserved_result.map_err(handle_db_error)?;
     let user_id = user_id_result.map_err(handle_db_error)?;
 
     Ok(Response::new(FindUserIdResponse {
       user_id,
       is_reserved,
     }))
   }
 
   #[tracing::instrument(skip_all)]
   async fn get_farcaster_users(
     &self,
     request: tonic::Request<GetFarcasterUsersRequest>,
   ) -> Result<tonic::Response<GetFarcasterUsersResponse>, tonic::Status> {
     let message = request.into_inner();
 
     let farcaster_users = self
       .client
       .get_farcaster_users(message.farcaster_ids)
       .await
       .map_err(handle_db_error)?
       .into_iter()
       .map(|d| d.0)
       .collect();
 
     Ok(Response::new(GetFarcasterUsersResponse { farcaster_users }))
   }
 }
 
 impl ClientService {
   async fn check_username_taken(
     &self,
     username: &str,
   ) -> Result<(), tonic::Status> {
     let username_taken = self
       .client
       .username_taken(username.to_string())
       .await
       .map_err(handle_db_error)?;
     if username_taken {
       return Err(tonic::Status::already_exists(
         tonic_status_messages::USERNAME_ALREADY_EXISTS,
       ));
     }
     Ok(())
   }
 
   async fn check_wallet_address_taken(
     &self,
     wallet_address: &str,
   ) -> Result<(), tonic::Status> {
     let wallet_address_taken = self
       .client
       .wallet_address_taken(wallet_address.to_string())
       .await
       .map_err(handle_db_error)?;
     if wallet_address_taken {
       return Err(tonic::Status::already_exists(
         tonic_status_messages::WALLET_ADDRESS_TAKEN,
       ));
     }
     Ok(())
   }
 
   async fn check_farcaster_id_taken(
     &self,
     farcaster_id: &str,
   ) -> Result<(), tonic::Status> {
     let fid_already_registered = !self
       .client
       .get_farcaster_users(vec![farcaster_id.to_string()])
       .await
       .map_err(handle_db_error)?
       .is_empty();
     if fid_already_registered {
       return Err(tonic::Status::already_exists(
         tonic_status_messages::FID_TAKEN,
       ));
     }
     Ok(())
   }
 
   async fn verify_and_remove_nonce(
     &self,
     nonce: &str,
   ) -> Result<(), tonic::Status> {
     match self
       .client
       .get_nonce_from_nonces_table(nonce)
       .await
       .map_err(handle_db_error)?
     {
       None => {
         return Err(tonic::Status::invalid_argument(
           tonic_status_messages::INVALID_NONCE,
         ))
       }
       Some(nonce) if nonce.is_expired() => {
         // we don't need to remove the nonce from the table here
         // because the DynamoDB TTL will take care of it
         return Err(tonic::Status::aborted(
           tonic_status_messages::NONCE_EXPIRED,
         ));
       }
       Some(nonce_data) => self
         .client
         .remove_nonce_from_nonces_table(&nonce_data.nonce)
         .await
         .map_err(handle_db_error)?,
     };
     Ok(())
   }
 
   async fn get_keyserver_device_to_remove(
     &self,
     user_id: &str,
     new_keyserver_device_id: &str,
     force: bool,
     device_type: &DeviceType,
   ) -> Result<Option<String>, tonic::Status> {
     if device_type != &DeviceType::Keyserver {
       return Ok(None);
     }
 
     let maybe_keyserver_device_id = self
       .client
       .get_keyserver_device_id_for_user(user_id)
       .await
       .map_err(handle_db_error)?;
 
     let Some(existing_keyserver_device_id) = maybe_keyserver_device_id else {
       return Ok(None);
     };
 
     if new_keyserver_device_id == existing_keyserver_device_id {
       return Ok(None);
     }
 
     if force {
       info!(
         "keyserver {} will be removed from the device list",
         existing_keyserver_device_id
       );
       Ok(Some(existing_keyserver_device_id))
     } else {
       Err(tonic::Status::already_exists(
         "user already has a keyserver",
       ))
     }
   }
 }
 
 #[tracing::instrument(skip_all)]
 pub fn handle_db_error(db_error: DBError) -> tonic::Status {
   match db_error {
     DBError::AwsSdk(DynamoDBError::InternalServerError(_))
     | DBError::AwsSdk(DynamoDBError::ProvisionedThroughputExceededException(
       _,
     ))
     | DBError::AwsSdk(DynamoDBError::RequestLimitExceeded(_)) => {
       tonic::Status::unavailable("please retry")
     }
     DBError::DeviceList(DeviceListError::InvalidDeviceListUpdate) => {
       tonic::Status::invalid_argument("invalid device list update")
     }
     DBError::DeviceList(DeviceListError::InvalidSignature) => {
       tonic::Status::invalid_argument("invalid device list signature")
     }
     e => {
       error!(
         errorType = error_types::GENERIC_DB_LOG,
         "Encountered an unexpected error: {}", e
       );
       tonic::Status::failed_precondition("unexpected error")
     }
   }
 }
 
 fn construct_user_registration_info(
   message: &(impl DeviceKeyUploadActions + RegistrationActions),
   user_id: Option<String>,
   username: String,
   farcaster_id: Option<String>,
 ) -> Result<UserRegistrationInfo, tonic::Status> {
   Ok(UserRegistrationInfo {
     username,
     flattened_device_key_upload: construct_flattened_device_key_upload(
       message,
     )?,
     user_id,
     farcaster_id,
     initial_device_list: message.get_and_verify_initial_device_list()?,
   })
 }
 
 fn construct_user_login_info(
   user_id: String,
   username: String,
   opaque_server_login: comm_opaque2::server::Login,
   flattened_device_key_upload: FlattenedDeviceKeyUpload,
   device_to_remove: Option<String>,
 ) -> Result<UserLoginInfo, tonic::Status> {
   Ok(UserLoginInfo {
     user_id,
     username,
     flattened_device_key_upload,
     opaque_server_login,
     device_to_remove,
   })
 }
 
 fn construct_flattened_device_key_upload(
   message: &impl DeviceKeyUploadActions,
 ) -> Result<FlattenedDeviceKeyUpload, tonic::Status> {
   let key_info = KeyPayload::from_str(&message.payload()?).map_err(|_| {
     tonic::Status::invalid_argument(tonic_status_messages::MALFORMED_PAYLOAD)
   })?;
 
   let flattened_device_key_upload = FlattenedDeviceKeyUpload {
     device_id_key: key_info.primary_identity_public_keys.ed25519,
     key_payload: message.payload()?,
     key_payload_signature: message.payload_signature()?,
     content_prekey: message.content_prekey()?,
     content_prekey_signature: message.content_prekey_signature()?,
     content_one_time_keys: message.one_time_content_prekeys()?,
     notif_prekey: message.notif_prekey()?,
     notif_prekey_signature: message.notif_prekey_signature()?,
     notif_one_time_keys: message.one_time_notif_prekeys()?,
     device_type: DeviceType::try_from(DBDeviceTypeInt(message.device_type()?))
       .map_err(handle_db_error)?,
   };
 
   Ok(flattened_device_key_upload)
 }
diff --git a/services/identity/src/constants.rs b/services/identity/src/constants.rs
index 6d0df9e13..22901b54d 100644
--- a/services/identity/src/constants.rs
+++ b/services/identity/src/constants.rs
@@ -1,319 +1,328 @@
 use tokio::time::Duration;
 
 // Secrets
 
 pub const SECRETS_DIRECTORY: &str = "secrets";
 pub const SECRETS_SETUP_FILE: &str = "server_setup.txt";
 
 // DynamoDB
 
 // User table information, supporting opaque_ke 2.0 and X3DH information
 
 // Users can sign in either through username+password or Eth wallet.
 //
 // This structure should be aligned with the messages defined in
 // shared/protos/identity_unauthenticated.proto
 //
 // Structure for a user should be:
 // {
 //   userID: String,
 //   opaqueRegistrationData: Option<String>,
 //   username: Option<String>,
 //   walletAddress: Option<String>,
 //   devices: HashMap<String, Device>
 // }
 //
 // A device is defined as:
 // {
 //     deviceType: String, # client or keyserver
 //     keyPayload: String,
 //     keyPayloadSignature: String,
 //     identityPreKey: String,
 //     identityPreKeySignature: String,
 //     identityOneTimeKeys: Vec<String>,
 //     notifPreKey: String,
 //     notifPreKeySignature: String,
 //     notifOneTimeKeys: Vec<String>,
 //     socialProof: Option<String>
 //   }
 // }
 //
 // Additional context:
 // "devices" uses the signing public identity key of the device as a key for the devices map
 // "keyPayload" is a JSON encoded string containing identity and notif keys (both signature and verification)
 // if "deviceType" == "keyserver", then the device will not have any notif key information
 
 pub const USERS_TABLE: &str = "identity-users";
 pub const USERS_TABLE_PARTITION_KEY: &str = "userID";
 pub const USERS_TABLE_REGISTRATION_ATTRIBUTE: &str = "opaqueRegistrationData";
 pub const USERS_TABLE_USERNAME_ATTRIBUTE: &str = "username";
 pub const USERS_TABLE_DEVICES_MAP_DEVICE_TYPE_ATTRIBUTE_NAME: &str =
   "deviceType";
 pub const USERS_TABLE_WALLET_ADDRESS_ATTRIBUTE: &str = "walletAddress";
 pub const USERS_TABLE_SOCIAL_PROOF_ATTRIBUTE_NAME: &str = "socialProof";
 pub const USERS_TABLE_DEVICELIST_TIMESTAMP_ATTRIBUTE_NAME: &str =
   "deviceListTimestamp";
 pub const USERS_TABLE_FARCASTER_ID_ATTRIBUTE_NAME: &str = "farcasterID";
 pub const USERS_TABLE_USERNAME_INDEX: &str = "username-index";
 pub const USERS_TABLE_WALLET_ADDRESS_INDEX: &str = "walletAddress-index";
 pub const USERS_TABLE_FARCASTER_ID_INDEX: &str = "farcasterID-index";
 
 pub mod token_table {
   pub const NAME: &str = "identity-tokens";
   pub const PARTITION_KEY: &str = "userID";
   pub const SORT_KEY: &str = "signingPublicKey";
   pub const ATTR_CREATED: &str = "created";
   pub const ATTR_AUTH_TYPE: &str = "authType";
   pub const ATTR_VALID: &str = "valid";
   pub const ATTR_TOKEN: &str = "token";
 }
 
 pub const NONCE_TABLE: &str = "identity-nonces";
 pub const NONCE_TABLE_PARTITION_KEY: &str = "nonce";
 pub const NONCE_TABLE_CREATED_ATTRIBUTE: &str = "created";
 pub const NONCE_TABLE_EXPIRATION_TIME_ATTRIBUTE: &str = "expirationTime";
 pub const NONCE_TABLE_EXPIRATION_TIME_UNIX_ATTRIBUTE: &str =
   "expirationTimeUnix";
 
 pub const WORKFLOWS_IN_PROGRESS_TABLE: &str = "identity-workflows-in-progress";
 pub const WORKFLOWS_IN_PROGRESS_PARTITION_KEY: &str = "id";
 pub const WORKFLOWS_IN_PROGRESS_WORKFLOW_ATTRIBUTE: &str = "workflow";
 pub const WORKFLOWS_IN_PROGRESS_TABLE_EXPIRATION_TIME_UNIX_ATTRIBUTE: &str =
   "expirationTimeUnix";
 
 // Usernames reserved because they exist in Ashoat's keyserver already
 pub const RESERVED_USERNAMES_TABLE: &str = "identity-reserved-usernames";
 pub const RESERVED_USERNAMES_TABLE_PARTITION_KEY: &str = "username";
 pub const RESERVED_USERNAMES_TABLE_USER_ID_ATTRIBUTE: &str = "userID";
 
 // Users table social proof attribute
 pub const SOCIAL_PROOF_MESSAGE_ATTRIBUTE: &str = "siweMessage";
 pub const SOCIAL_PROOF_SIGNATURE_ATTRIBUTE: &str = "siweSignature";
 
 pub mod devices_table {
   /// table name
   pub const NAME: &str = "identity-devices";
   pub const TIMESTAMP_INDEX_NAME: &str = "deviceList-timestamp-index";
   pub const DEVICE_ID_INDEX_NAME: &str = "deviceID-index";
 
   /// partition key
   pub const ATTR_USER_ID: &str = "userID";
   /// sort key
   pub const ATTR_ITEM_ID: &str = "itemID";
 
   // itemID prefixes (one shouldn't be a prefix of the other)
   pub const DEVICE_ITEM_KEY_PREFIX: &str = "device-";
   pub const DEVICE_LIST_KEY_PREFIX: &str = "devicelist-";
 
   // device-specific attrs
   pub const ATTR_DEVICE_KEY_INFO: &str = "deviceKeyInfo";
   pub const ATTR_CONTENT_PREKEY: &str = "contentPreKey";
   pub const ATTR_NOTIF_PREKEY: &str = "notifPreKey";
   pub const ATTR_PLATFORM_DETAILS: &str = "platformDetails";
   pub const ATTR_LOGIN_TIME: &str = "loginTime";
 
   // IdentityKeyInfo constants
   pub const ATTR_KEY_PAYLOAD: &str = "keyPayload";
   pub const ATTR_KEY_PAYLOAD_SIGNATURE: &str = "keyPayloadSignature";
 
   // PreKey constants
   pub const ATTR_PREKEY: &str = "preKey";
   pub const ATTR_PREKEY_SIGNATURE: &str = "preKeySignature";
 
   // PlatformDetails constants
   pub const ATTR_DEVICE_TYPE: &str = "deviceType";
   pub const ATTR_CODE_VERSION: &str = "codeVersion";
   pub const ATTR_STATE_VERSION: &str = "stateVersion";
   pub const ATTR_MAJOR_DESKTOP_VERSION: &str = "majorDesktopVersion";
 
   // device-list-specific attrs
   pub const ATTR_TIMESTAMP: &str = "timestamp";
   pub const ATTR_DEVICE_IDS: &str = "deviceIDs";
   pub const ATTR_CURRENT_SIGNATURE: &str = "curPrimarySignature";
   pub const ATTR_LAST_SIGNATURE: &str = "lastPrimarySignature";
 
   // one-time key constants
   pub const ATTR_CONTENT_OTK_COUNT: &str = "contentOTKCount";
   pub const ATTR_NOTIF_OTK_COUNT: &str = "notifOTKCount";
 
   // deprecated attributes
   pub const OLD_ATTR_DEVICE_TYPE: &str = "deviceType";
   pub const OLD_ATTR_CODE_VERSION: &str = "codeVersion";
 }
 
 // One time keys table, which need to exist in their own table to ensure
 // atomicity of additions and removals
 pub mod one_time_keys_table {
   pub const NAME: &str = "identity-one-time-keys";
   pub const PARTITION_KEY: &str = "userID#deviceID#olmAccount";
   pub const SORT_KEY: &str = "timestamp#keyNumber";
   pub const ATTR_ONE_TIME_KEY: &str = "oneTimeKey";
 }
 
 // Tokio
 
 pub const MPSC_CHANNEL_BUFFER_CAPACITY: usize = 1;
 pub const IDENTITY_SERVICE_SOCKET_ADDR: &str = "[::]:50054";
 pub const IDENTITY_SERVICE_WEBSOCKET_ADDR: &str = "[::]:51004";
 
 pub const SOCKET_HEARTBEAT_TIMEOUT: Duration = Duration::from_secs(3);
 
 // Token
 
 pub const ACCESS_TOKEN_LENGTH: usize = 512;
 
 // Temporary config
 
 pub const AUTH_TOKEN: &str = "COMM_IDENTITY_SERVICE_AUTH_TOKEN";
 pub const KEYSERVER_PUBLIC_KEY: &str = "KEYSERVER_PUBLIC_KEY";
 
 // Nonce
 
 pub const NONCE_LENGTH: usize = 17;
 pub const NONCE_TTL_DURATION: Duration = Duration::from_secs(120); // seconds
 
 // Device list
 
 pub const DEVICE_LIST_TIMESTAMP_VALID_FOR: Duration = Duration::from_secs(300);
 
 // Workflows in progress
 
 pub const WORKFLOWS_IN_PROGRESS_TTL_DURATION: Duration =
   Duration::from_secs(120);
 
 // Identity
 
 pub const DEFAULT_IDENTITY_ENDPOINT: &str = "http://localhost:50054";
 
 // LocalStack
 
 pub const LOCALSTACK_ENDPOINT: &str = "LOCALSTACK_ENDPOINT";
 
 // OPAQUE Server Setup
 
 pub const OPAQUE_SERVER_SETUP: &str = "OPAQUE_SERVER_SETUP";
 
 // Identity Search
 
 pub const OPENSEARCH_ENDPOINT: &str = "OPENSEARCH_ENDPOINT";
 pub const DEFAULT_OPENSEARCH_ENDPOINT: &str =
   "identity-search-domain.us-east-2.opensearch.localhost.localstack.cloud:4566";
 pub const IDENTITY_SEARCH_INDEX: &str = "users";
 pub const IDENTITY_SEARCH_RESULT_SIZE: u32 = 20;
 
 // Log Error Types
 
 pub mod error_types {
   pub const GENERIC_DB_LOG: &str = "DB Error";
   pub const OTK_DB_LOG: &str = "One-time Key DB Error";
   pub const DEVICE_LIST_DB_LOG: &str = "Device List DB Error";
   pub const TOKEN_DB_LOG: &str = "Token DB Error";
   pub const FARCASTER_DB_LOG: &str = "Farcaster DB Error";
 
   pub const SYNC_LOG: &str = "Sync Error";
   pub const SEARCH_LOG: &str = "Search Error";
   pub const SIWE_LOG: &str = "SIWE Error";
   pub const GRPC_SERVICES_LOG: &str = "gRPC Services Error";
   pub const TUNNELBROKER_LOG: &str = "Tunnelbroker Error";
   pub const HTTP_LOG: &str = "HTTP Error";
 }
 
 // Tonic Status Messages
 pub mod tonic_status_messages {
   pub const UNEXPECTED_MESSAGE_DATA: &str = "unexpected_message_data";
   pub const SIGNATURE_INVALID: &str = "signature_invalid";
   pub const MALFORMED_KEY: &str = "malformed_key";
   pub const VERIFICATION_FAILED: &str = "verification_failed";
   pub const MALFORMED_PAYLOAD: &str = "malformed_payload";
   pub const INVALID_DEVICE_LIST_PAYLOAD: &str = "invalid_device_list_payload";
   pub const USERNAME_ALREADY_EXISTS: &str = "username_already_exists";
   pub const USERNAME_RESERVED: &str = "username_reserved";
   pub const WALLET_ADDRESS_TAKEN: &str = "wallet_address_taken";
   pub const WALLET_ADDRESS_NOT_RESERVED: &str = "wallet_address_not_reserved";
   pub const USER_NOT_FOUND: &str = "user_not_found";
   pub const INVALID_NONCE: &str = "invalid_nonce";
   pub const NONCE_EXPIRED: &str = "nonce_expired";
   pub const FID_TAKEN: &str = "fid_taken";
   pub const CANNOT_LINK_FID: &str = "cannot_link_fid";
   pub const INVALID_PLATFORM_METADATA: &str = "invalid_platform_metadata";
   pub const MISSING_CREDENTIALS: &str = "missing_credentials";
   pub const BAD_CREDENTIALS: &str = "bad_credentials";
   pub const SESSION_NOT_FOUND: &str = "session_not_found";
   pub const INVALID_TIMESTAMP: &str = "invalid_timestamp";
+  pub const INVALID_USERNAME: &str = "invalid_username";
+  pub const USERNAME_NOT_RESERVED: &str = "username_not_reserved";
+  pub const NEED_KEYSERVER_MESSAGE_TO_CLAIM_USERNAME: &str =
+    "need_keyserver_message_to_claim_username";
+  pub const UNEXPECTED_INITIAL_DEVICE_LIST: &str =
+    "unexpected_initial_device_list";
+  pub const DEVICE_LIST_ERROR: &str = "device_list_error";
+  pub const DEVICE_NOT_IN_DEVICE_LIST: &str = "device_not_in_device_list";
+  pub const NO_IDENTIFIER_PROVIDED: &str = "no_identifier_provided";
 }
 
 // Tunnelbroker
 pub const TUNNELBROKER_GRPC_ENDPOINT: &str = "TUNNELBROKER_GRPC_ENDPOINT";
 pub const DEFAULT_TUNNELBROKER_ENDPOINT: &str = "http://localhost:50051";
 
 // X3DH key management
 
 // Threshold for requesting more one_time keys
 pub const ONE_TIME_KEY_MINIMUM_THRESHOLD: usize = 5;
 // Number of keys to be refreshed when below the threshold
 pub const ONE_TIME_KEY_REFRESH_NUMBER: u32 = 5;
 
 // Minimum supported code versions
 
 pub const MIN_SUPPORTED_NATIVE_VERSION: u64 = 270;
 
 // Request metadata
 
 pub mod request_metadata {
   pub const CODE_VERSION: &str = "code_version";
   pub const STATE_VERSION: &str = "state_version";
   pub const MAJOR_DESKTOP_VERSION: &str = "major_desktop_version";
   pub const DEVICE_TYPE: &str = "device_type";
   pub const USER_ID: &str = "user_id";
   pub const DEVICE_ID: &str = "device_id";
   pub const ACCESS_TOKEN: &str = "access_token";
 }
 
 // CORS
 
 pub mod cors {
   use std::time::Duration;
 
   pub const DEFAULT_MAX_AGE: Duration = Duration::from_secs(24 * 60 * 60);
   pub const DEFAULT_EXPOSED_HEADERS: [&str; 3] =
     ["grpc-status", "grpc-message", "grpc-status-details-bin"];
   pub const DEFAULT_ALLOW_HEADERS: [&str; 11] = [
     "x-grpc-web",
     "content-type",
     "x-user-agent",
     "grpc-timeout",
     super::request_metadata::CODE_VERSION,
     super::request_metadata::STATE_VERSION,
     super::request_metadata::MAJOR_DESKTOP_VERSION,
     super::request_metadata::DEVICE_TYPE,
     super::request_metadata::USER_ID,
     super::request_metadata::DEVICE_ID,
     super::request_metadata::ACCESS_TOKEN,
   ];
   pub const ALLOW_ORIGIN_LIST: &str = "ALLOW_ORIGIN_LIST";
   pub const PROD_ORIGIN_HOST_STR: &str = "web.comm.app";
 }
 
 // Tracing
 
 pub const COMM_SERVICES_USE_JSON_LOGS: &str = "COMM_SERVICES_USE_JSON_LOGS";
 
 // Regex
 
 pub const VALID_USERNAME_REGEX_STRING: &str =
   r"^[a-zA-Z0-9][a-zA-Z0-9-_]{0,190}$";
 
 // Retry
 
 // TODO: Replace this with `ExponentialBackoffConfig` from `comm-lib`
 pub mod retry {
   pub const MAX_ATTEMPTS: usize = 8;
 
   pub const CONDITIONAL_CHECK_FAILED: &str = "ConditionalCheckFailed";
   pub const TRANSACTION_CONFLICT: &str = "TransactionConflict";
 }
 
 // One-time keys
 pub const ONE_TIME_KEY_UPLOAD_LIMIT_PER_ACCOUNT: usize = 24;
 pub const ONE_TIME_KEY_SIZE: usize = 43; // as defined in olm
 pub const MAX_ONE_TIME_KEYS: usize = 100; // as defined in olm