fix(events): guard extra spread and prevent core field override

- Use (extra ?? {}) to handle undefined extra safely
- Spread extra first to prevent overriding core fields like event, instance, data
- Applied fix to all 7 event controllers

Addresses Sourcery AI review feedback.

src/api/integrations/event/kafka/kafka.controller.ts

@@ -285,6 +285,7 @@ export class KafkaController extends EventController implements EventControllerI
     const logEnabled = configService.get<Log>('LOG').LEVEL.includes('WEBHOOKS');
 
     const message = {
+      ...(extra ?? {}),
       event,
       instance: instanceName,
       data,
@@ -293,7 +294,6 @@ export class KafkaController extends EventController implements EventControllerI
       sender,
       apikey: apiKey,
       timestamp: Date.now(),
-      ...extra,
     };
 
     const messageValue = JSON.stringify(message);

src/api/integrations/event/nats/nats.controller.ts

@@ -66,6 +66,7 @@ export class NatsController extends EventController implements EventControllerIn
     const logEnabled = configService.get<Log>('LOG').LEVEL.includes('WEBHOOKS');
 
     const message = {
+      ...(extra ?? {}),
       event,
       instance: instanceName,
       data,
@@ -73,7 +74,6 @@ export class NatsController extends EventController implements EventControllerIn
       date_time: dateTime,
       sender,
       apikey: apiKey,
-      ...extra,
     };
 
     // Instância específica

src/api/integrations/event/pusher/pusher.controller.ts

@@ -134,6 +134,7 @@ export class PusherController extends EventController implements EventController
     const enabledLog = configService.get<Log>('LOG').LEVEL.includes('WEBHOOKS');
     const eventName = event.replace(/_/g, '.').toLowerCase();
     const pusherData = {
+      ...(extra ?? {}),
       event,
       instance: instanceName,
       data,
@@ -142,7 +143,6 @@ export class PusherController extends EventController implements EventController
       sender,
       server_url: serverUrl,
       apikey: apiKey,
-      ...extra,
     };
     if (event == 'qrcode.updated') {
       delete pusherData.data.qrcode.base64;

src/api/integrations/event/rabbitmq/rabbitmq.controller.ts

@@ -234,6 +234,7 @@ export class RabbitmqController extends EventController implements EventControll
     const logEnabled = configService.get<Log>('LOG').LEVEL.includes('WEBHOOKS');
 
     const message = {
+      ...(extra ?? {}),
       event,
       instance: instanceName,
       data,
@@ -241,7 +242,6 @@ export class RabbitmqController extends EventController implements EventControll
       date_time: dateTime,
       sender,
       apikey: apiKey,
-      ...extra,
     };
 
     if (instanceRabbitmq?.enabled && this.amqpChannel) {

src/api/integrations/event/sqs/sqs.controller.ts

@@ -129,6 +129,7 @@ export class SqsController extends EventController implements EventControllerInt
         const sqsUrl = `https://sqs.${sqsConfig.REGION}.amazonaws.com/${sqsConfig.ACCOUNT_ID}/${queueName}`;
 
         const message = {
+          ...(extra ?? {}),
           event,
           instance: instanceName,
           dataType: 'json',
@@ -138,7 +139,6 @@ export class SqsController extends EventController implements EventControllerInt
           date_time: dateTime,
           sender,
           apikey: apiKey,
-          ...extra,
         };
 
         const jsonStr = JSON.stringify(message);

src/api/integrations/event/webhook/webhook.controller.ts

@@ -91,6 +91,7 @@ export class WebhookController extends EventController implements EventControlle
     const regex = /^(https?:\/\/)/;
 
     const webhookData = {
+      ...(extra ?? {}),
       event,
       instance: instanceName,
       data,
@@ -99,7 +100,6 @@ export class WebhookController extends EventController implements EventControlle
       sender,
       server_url: serverUrl,
       apikey: apiKey,
-      ...extra,
     };
 
     if (local && instance?.enabled) {

src/api/integrations/event/websocket/websocket.controller.ts

@@ -128,6 +128,7 @@ export class WebsocketController extends EventController implements EventControl
     const configEv = event.replace(/[.-]/gm, '_').toUpperCase();
     const logEnabled = configService.get<Log>('LOG').LEVEL.includes('WEBSOCKET');
     const message = {
+      ...(extra ?? {}),
       event,
       instance: instanceName,
       data,
@@ -135,7 +136,6 @@ export class WebsocketController extends EventController implements EventControl
       date_time: dateTime,
       sender,
       apikey: apiKey,
-      ...extra,
     };
 
     if (configService.get<Websocket>('WEBSOCKET')?.GLOBAL_EVENTS) {