Passkey* events never reach the webhook: missing cases in subscription filter + ALL is expanded on connect

[dionatanfmsilva]

Welcome!

• Yes, I have searched for similar issues on GitHub and found none.

What did you do?

1. Called POST /instance/connect with a granular subscription list:
   subscribe: ["MESSAGE","READ_RECEIPT","CONNECTION","QRCODE","CALL"]
2. Paired an account that requires a passkey (WebAuthn), so the instance emitted
   PasskeyRequest / PasskeyConfirmation / PasskeyError events.
3. Also tried subscribe: ["ALL"] and even manually setting the events column
   to ALL in the database.

What did you expect?

The Passkey* events should be delivered to the configured webhook — either under
some subscription type (they are part of the pairing flow, like QRCode), or at
least when subscribing with ["ALL"].

What did you observe instead of what you expected?

Two combined bugs make the Passkey* events unreachable through the API:

1. No case in the subscription filter. The CallWebhook switch has no case for PasskeyRequest/PasskeyConfirmation/
PasskeyError, so they hit default: return and are silently dropped. The log
is misleading because ===== DISPATCHING WEBHOOK ===== Event: PasskeyRequest is
printed in myEventHandler before the filter runs.

2. The ALL fast-path is unreachable via the API. In Connect
(pkg/instance/service/instance_service.go), when ALL is the first element
it is expanded into AllEventTypes — which does not include "ALL" itself — so
instance.Events never stores the literal ALL and the
contains(subscriptions, "ALL") fast-path in CallWebhook never triggers.
Manually editing the events column to ALL works, but is overwritten on the
next /instance/connect (it always rewrites instance.Events).

Workaround found: pass ALL in any position other than the first
(e.g. subscribe: ["MESSAGE","ALL"]). The granular validation branch accepts it
(validEventTypes includes ALL) and persists it literally, enabling the fast-path.

Suggested fix:

• Add the Passkey* events to the QRCODE (or CONNECTION) bucket:

  case "QRCode", "QRTimeout", "QRSuccess", "PasskeyRequest", "PasskeyConfirmation", "PasskeyError":
      if contains(subscriptions, "QRCODE") { ... }

Screenshots/Videos

No response

Which version are you using?

0.7.2

What is your environment?

Linux

If applicable, paste the log output

No response

Additional Notes

Root cause analysis and the suggested fix were done with the help of Claude