I ran into this while implementing #11215.

Before #949, it was possible to have access tokens that were not associated with a device. This has now been deprecated for 5 years.

This possibility has now crept across the codebase, as we've marked device_id as Optional in many places, including:

This makes little sense, as you're expected to have a device if you're calling /sync. Much of the /sync handling code assumes you have a device, and would logically fail if the user didn't:

Passing device_id=None to this function always results in zero to-device messages being returned.

Is there anything holding us back (old access tokens?) from marking device IDs as str, not Optional[str]?

Edit: There are currently 64 entries in the access_tokens table on matrix.org that do not have an associated device ID. They are all either abuse, or go neb...