WPB-23422 Mark Cookie with label during SSO Login Flow

[battermann]

Checklist

• Add a new entry in an appropriate subdirectory of changelog.d
• Read and follow the PR guidelines

[Copilot]

Pull request overview

This PR adds support for passing an optional cookie label during the SSO (SAML) login flow. This enables clients to mark cookies created during SSO authentication with a specific label (e.g., "shared-device"), which is useful for managing and identifying cookies created on shared or public devices.

Changes:

• Add optional label query parameter to SSO authentication endpoints (/sso/initiate-login routes)
• Store cookie label in VerdictFormat and persist it through the SSO flow to Cassandra
• Pass cookie label to Brig's ssoLogin endpoint to create labeled cookies
• Add Cassandra schema migration V22 to add cookie_label column to verdict table
• Add comprehensive integration test verifying cookie label is properly set during SSO flow

Reviewed changes

Copilot reviewed 22 out of 22 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
libs/wire-api/src/Wire/API/User/Auth.hs	Add HTTP API data conversion instances for CookieLabel (ToParamSchema, FromHttpApiData, ToHttpApiData)
libs/wire-api/src/Wire/API/User/Saml.hs	Add optional cookie label field to VerdictFormat constructors (VerdictFormatWeb, VerdictFormatMobile)
libs/wire-api/src/Wire/API/Routes/Public/Spar.hs	Add optional label query parameter to SSO authentication routes (APIAuthReqPrecheck, APIAuthReq)
services/spar/src/Spar/API.hs	Thread cookie label parameter through authreq, authreqPrecheck, validateAuthreqParams, and authresp handlers
services/spar/src/Spar/App.hs	Pass cookie label from VerdictFormat to verdictHandlerResult and verdictHandlerResultCore
services/spar/src/Spar/Sem/BrigAccess.hs	Add Maybe CookieLabel parameter to SsoLogin constructor
services/spar/src/Spar/Sem/BrigAccess/Http.hs	Thread cookie label parameter to Intra.ssoLogin call
services/spar/src/Spar/Intra/Brig.hs	Pass cookie label to Brig's internal ssoLogin endpoint
services/spar/src/Spar/Data/Instances.hs	Update VerdictFormat serialization to include cookie label field
services/spar/src/Spar/Sem/VerdictFormatStore/Cassandra.hs	Add cookie label column to Cassandra queries for verdict table
services/spar/src/Spar/Schema/V22.hs	Define Cassandra migration to add cookie_label column to verdict table
services/spar/src/Spar/Schema/Run.hs	Register V22 migration in migration list
services/spar/spar.cabal	Add Spar.Schema.V22 module to cabal file
services/spar/test/Test/Spar/Saml/IdPSpec.hs	Update SsoLogin mock to accept label parameter
services/spar/test-integration/Test/Spar/DataSpec.hs	Update VerdictFormat test cases to include Nothing label
cassandra-schema.cql	Add cookie_label column to verdict table schema
integration/test/Test/Auth.hs	Add testSetCookieLabelOnSsoFlow integration test
integration/test/SetupHelpers.hs	Add getCookieWithSaml helper and refactor login flow to support label parameter
integration/test/API/Spar.hs	Add initiateSamlLoginWithZHostAndLabel helper function
integration/test/API/Nginz.hs	Add rotateCookie function (for future cookie management)
integration/test/API/Brig.hs	Add getCookies function to query user cookies by labels
changelog.d/2-features/WPB-23422	Add changelog entry for the feature

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.