feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/recaptcha/__init__.py

@@ -0,0 +1,34 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The command group for the reCAPTCHA CLI."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.GA)
+class Recaptcha(base.Group):
+  """Manage reCAPTCHA Enterprise Keys.
+
+  Commands for managing reCAPTCHA Enterprise Keys.
+  """
+
+  category = base.IDENTITY_AND_SECURITY_CATEGORY
+
+  def Filter(self, context, args):
+    del context, args

gcloud auth application-default login/google-cloud-sdk/lib/surface/recaptcha/firewall_policies/__init__.py

@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The command group for reCAPTCHA Firewall Policies CLI."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.GA)
+class RecaptchaFirewallPolicy(base.Group):
+  """Managed reCAPTCHA Firewall Policies."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/recaptcha/firewall_policies/create.yaml

@@ -0,0 +1,57 @@
+- release_tracks: [ALPHA, GA]
+  help_text:
+    brief: Create a Firewall Policy.
+    description: Create a reCAPTCHA Firewall Policy.
+    examples: |
+      To create a new reCAPTCHA firewall policy covering the path "/login/*" for all requests with a
+      reCAPTCHA Lite score of >= 0.5 to allow the requests and set the header 'foo' to the value
+      'bar':
+
+        $ {command} --path='/login/*' --condition='recaptcha.assessment_type == AssessmentType.LITE
+        && recaptcha.score >= 0.5'  --actions=allow,set_header=foo=bar
+
+  request:
+    collection: recaptchaenterprise.projects.firewallpolicies
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.recaptcha.resources:project
+      is_parent_resource: true
+      help_text: |
+        The cloud project in which the reCAPTCHA Firewall Policy is created.
+
+    params:
+    - arg_name: description
+      api_field: googleCloudRecaptchaenterpriseV1FirewallPolicy.description
+      help_text: |
+        A description of what this policy aims to achieve, for convenience purposes. The description
+        can at most include 256 UTF-8 characters.
+    - arg_name: path
+      api_field: googleCloudRecaptchaenterpriseV1FirewallPolicy.path
+      help_text: |
+        The path for which this policy applies, specified as a glob pattern. For more information on
+        glob, see the manual page: https://man7.org/linux/man-pages/man7/glob.7.html.
+    - arg_name: condition
+      api_field: googleCloudRecaptchaenterpriseV1FirewallPolicy.condition
+      help_text: |
+        A CEL (Common Expression Language) conditional expression that specifies if this policy
+        applies to an incoming user request. If this condition evaluates to true and the requested
+        path matched the path pattern, the associated actions should be executed by the caller. The
+        condition string is checked for CEL syntax correctness on creation. For more information,
+        see the CEL spec: https://github.com/google/cel-spec and its language definition:
+        https://github.com/google/cel-spec/blob/master/doc/langdef.md
+    - arg_name: actions
+      api_field: googleCloudRecaptchaenterpriseV1FirewallPolicy.actions
+      processor: googlecloudsdk.command_lib.recaptcha.firewall_policies_util:ParseFirewallActions
+      help_text: |
+        The actions that the caller should take regarding the user. There should be at most 1
+        terminal action. A terminal action is any action that forces a response, such as Allow,
+        Block or Substitute. If it makes sense for it to happen multple times, such as SetHeader,
+        the action is non-terminal.
+
+        Examples:
+        * Block and set the header with key foo to value bar
+          ** --actions=block,set_header=foo=bar
+        * Substitute with path google.com and set two headers, one with key key1 to value value1 and
+        one with key key2 to value value2
+          ** --actions=substitute=google.com,set_header=key1=value1,set_header=key2=value2

gcloud auth application-default login/google-cloud-sdk/lib/surface/recaptcha/firewall_policies/delete.yaml

@@ -0,0 +1,17 @@
+- release_tracks: [ALPHA, GA]
+
+  help_text:
+    description: Delete one or more reCAPTCHA Firewall Policies from a given cloud project.
+    brief: Delete one or more reCAPTCHA Firewall Policies.
+    examples: |
+        To delete a reCAPTCHA firewall policies, run:
+
+          $ {command} policy-id
+
+  request:
+    collection: recaptchaenterprise.projects.firewallpolicies
+
+  arguments:
+    resource:
+      help_text: The reCAPTCHA firewall policy to delete.
+      spec: !REF googlecloudsdk.command_lib.recaptcha.resources:firewall_policies

gcloud auth application-default login/google-cloud-sdk/lib/surface/recaptcha/firewall_policies/describe.yaml

@@ -0,0 +1,17 @@
+- release_tracks: [ALPHA, GA]
+
+  help_text:
+    description: Get the details of a reCAPTCHA Firewall Policy.
+    brief: Describe reCAPTCHA Firewall Policy.
+    examples: |
+        To get details on a reCAPTCHA firewall policy, run:
+
+          $ {command} policy-id
+
+  request:
+    collection: recaptchaenterprise.projects.firewallpolicies
+
+  arguments:
+    resource:
+      help_text: The reCAPTCHA firewall policy to describe.
+      spec: !REF googlecloudsdk.command_lib.recaptcha.resources:firewall_policies

gcloud auth application-default login/google-cloud-sdk/lib/surface/recaptcha/firewall_policies/list.yaml

@@ -0,0 +1,30 @@
+- release_tracks: [ALPHA, GA]
+
+  help_text:
+    brief: List reCAPTCHA Firewall Policies.
+    description: List all of the reCAPTCHA Firewall Policies that exist in a given project.
+    examples: |
+        To list all the reCAPTCHA firewall policies existing for your project, run:
+
+          $ {command}
+
+  request:
+    collection: recaptchaenterprise.projects.firewallpolicies
+
+  response:
+    id_field: name
+
+  arguments:
+    resource:
+      help_text: The project name where to list the indexes.
+      spec: !REF googlecloudsdk.command_lib.recaptcha.resources:project
+
+  output:
+    format: |
+      table(
+          name.basename():label=POLICY_ID,
+          description:label=DESCRIPTION,
+          path:label=PATH,
+          condition:label=CONDITION,
+          actions:label=ACTIONS
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/recaptcha/firewall_policies/reorder.yaml

@@ -0,0 +1,27 @@
+- release_tracks: [ALPHA, GA]
+  help_text:
+    brief: Reorder all Firewall Policies.
+    description: Reorder all reCAPTCHA Firewall Policies.
+    examples: |
+        To reorder the list of reCAPTCHA firewall policies, run:
+
+          $ {command} --names=policy-name,policy-name,policy-name
+
+  request:
+    method: reorder
+    collection: recaptchaenterprise.projects.firewallpolicies
+
+  arguments:
+    resource:
+      help_text: The project name for which to reorder firewall policies.
+      spec: !REF googlecloudsdk.command_lib.recaptcha.resources:project
+      is_parent_resource: true
+    params:
+    - arg_name: names
+      api_field: googleCloudRecaptchaenterpriseV1ReorderFirewallPoliciesRequest.names
+      type: 'googlecloudsdk.calliope.arg_parsers:ArgList:'
+      required: true
+      help_text: |
+        Names of all firewall policies in desired order.
+  output:
+    format: none

gcloud auth application-default login/google-cloud-sdk/lib/surface/recaptcha/firewall_policies/update.yaml

@@ -0,0 +1,55 @@
+- release_tracks: [ALPHA, GA]
+  help_text:
+    brief: Update a Firewall Policy.
+    description: Update a reCAPTCHA Firewall Policy.
+    examples: |
+        To update the information of a reCAPTCHA firewall policy, run:
+
+          $ {command} policy-id --description='updated description' --actions=block
+
+  request:
+    collection: recaptchaenterprise.projects.firewallpolicies
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.recaptcha.resources:firewall_policies
+      help_text: |
+        The reCAPTCHA firewall policy to update.
+    params:
+    - arg_name: description
+      api_field: googleCloudRecaptchaenterpriseV1FirewallPolicy.description
+      help_text: |
+        A description of what this policy aims to achieve, for convenience purposes. The description
+        can at most include 256 UTF-8 characters.
+    - arg_name: path
+      api_field: googleCloudRecaptchaenterpriseV1FirewallPolicy.path
+      help_text: |
+        The path for which this policy applies, specified as a glob pattern. For more information on
+        glob, see the manual page: https://man7.org/linux/man-pages/man7/glob.7.html.
+    - arg_name: condition
+      api_field: googleCloudRecaptchaenterpriseV1FirewallPolicy.condition
+      help_text: |
+        A CEL (Common Expression Language) conditional expression that specifies if this policy
+        applies to an incoming user request. If this condition evaluates to true and the requested
+        path matched the path pattern, the associated actions should be executed by the caller. The
+        condition string is checked for CEL syntax correctness on creation. For more information,
+        see the CEL spec: https://github.com/google/cel-spec and its language definition:
+        https://github.com/google/cel-spec/blob/master/doc/langdef.md
+    - arg_name: actions
+      api_field: googleCloudRecaptchaenterpriseV1FirewallPolicy.actions
+      processor: googlecloudsdk.command_lib.recaptcha.firewall_policies_util:ParseFirewallActions
+      help_text: |
+        The actions that the caller should take regarding the user. There should be at most 1
+        terminal action. A terminal action is any action that forces a response, such as Allow,
+        Block or Substitute. If it makes sense for it to happen multple times, such as SetHeader,
+        the action is non-terminal.
+
+        Examples:
+        * Block and set the header with key foo to value bar
+          ** --actions=block,set_header=foo=bar
+        * Substitute with path google.com and set two headers, one with key key1 to value value1 and
+        one with key key2 to value value2
+          ** --actions=substitute=google.com,set_header=key1=value1,set_header=key2=value2
+
+  output:
+    format: none

gcloud auth application-default login/google-cloud-sdk/lib/surface/recaptcha/keys/__init__.py

@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2019 Google Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The command group for reCAPTCHA Keys CLI."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.GA)
+class RecaptchaKey(base.Group):
+  """Managed reCAPTCHA Keys."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/recaptcha/keys/add_ip_override.yaml

@@ -0,0 +1,27 @@
+- release_tracks: [ALPHA, GA]
+  help_text:
+    brief: Add an IP override to a key.
+    description: Add an IP override to a key.
+    examples: $ {command} test-key --ip=1.2.3.4 --override=allow
+
+  request:
+    collection: recaptchaenterprise.projects.keys
+    method: addIpOverride
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.recaptcha.resources:keys
+      help_text: The reCAPTCHA key to add the IP override to.
+
+    params:
+    - arg_name: ip
+      required: true
+      api_field: googleCloudRecaptchaenterpriseV1AddIpOverrideRequest.ipOverrideData.ip
+      help_text: IP address to override for the key.
+    - arg_name: override
+      required: true
+      api_field: googleCloudRecaptchaenterpriseV1AddIpOverrideRequest.ipOverrideData.overrideType
+      help_text: If set to allow, the IP address/CIDR range will be allowlisted for the key.
+
+  output:
+    format: none

gcloud auth application-default login/google-cloud-sdk/lib/surface/recaptcha/keys/create.yaml

@@ -0,0 +1,280 @@
+- release_tracks: [ALPHA, GA]
+  help_text:
+    brief: Create a Key.
+    description: Create a reCAPTCHA Key.
+    examples: |
+      To create a new reCAPTCHA key for websites showing no CAPTCHA challenge, run:
+
+        $ {command} --display-name=test-key-name --web --allow-all-domains --integration-type=score
+
+  request:
+    collection: recaptchaenterprise.projects.keys
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.recaptcha.hooks:SanitizePlatformSettings
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.recaptcha.resources:project
+      is_parent_resource: true
+      help_text: |
+        The reCAPTCHA Key to create.
+
+    params:
+    - arg_name: display-name
+      required: true
+      api_field: googleCloudRecaptchaenterpriseV1Key.displayName
+      help_text: |
+        A human-readable name for the key. Typically a site or app name.
+    - arg_name: testing-score
+      api_field: googleCloudRecaptchaenterpriseV1Key.testingOptions.testingScore
+      help_text: |
+        If set, all assessments for this key will return this score. Must be between 0
+        (likely not legitimate) and 1 (likely legitimate) inclusive.
+    - group:
+        help_text: |
+          Options for the creation of a WAF-enabled key. For more information, please refer to
+          https://cloud.google.com/recaptcha-enterprise/docs/integration-overview.
+        params:
+        - arg_name: waf-service
+          required: true
+          api_field: googleCloudRecaptchaenterpriseV1Key.wafSettings.wafService
+          help_text: |
+            The WAF service provider to use.
+          choices:
+          - enum_value: CA
+            arg_value: ca
+            help_text: |
+              Cloud Armor
+          - enum_value: FASTLY
+            arg_value: fastly
+            help_text: |
+              Fastly
+          - enum_value: CLOUDFLARE
+            arg_value: cloudflare
+            help_text: |
+              Cloudflare
+          - enum_value: AKAMAI
+            arg_value: akamai
+            help_text: |
+              Akamai
+        - arg_name: waf-feature
+          required: false
+          api_field: googleCloudRecaptchaenterpriseV1Key.wafSettings.wafFeature
+          help_text: |
+            The WAF feature to use. For more information, see
+            https://cloud.google.com/recaptcha-enterprise/docs/usecase#comparison_of_features.
+          choices:
+          - enum_value: CHALLENGE_PAGE
+            arg_value: challenge-page
+            help_text: |
+              Redirects suspicious traffic to reCAPTCHA challenge page.
+          - enum_value: ACTION_TOKEN
+            arg_value: action-token
+            help_text: |
+              Use reCAPTCHA action-tokens to protect user actions.
+          - enum_value: SESSION_TOKEN
+            arg_value: session-token
+            help_text: |
+              Use reCAPTCHA session-tokens to protect the whole user session on the
+              site's domain.
+          - enum_value: EXPRESS
+            arg_value: express
+            help_text: |
+              Assesses requests without tokens or frontend integration. This option is deprecated, use --express instead.
+    - group:
+        mutex: true
+        required: true
+        params:
+        - group:
+            help_text: |
+              Options for the creation of a site key for web.
+            params:
+            - arg_name: web
+              required: true
+              type: bool
+              help_text: |
+                Creates a Key configured for websites.
+            - arg_name: allow-amp-traffic
+              api_field: googleCloudRecaptchaenterpriseV1Key.webSettings.allowAmpTraffic
+              help_text: |
+                Whether this key can be used on AMP (Accelerated Mobile Pages) websites.
+            - group:
+                mutex: true
+                required: true
+                params:
+                - arg_name: allow-all-domains
+                  api_field: googleCloudRecaptchaenterpriseV1Key.webSettings.allowAllDomains
+                  help_text: |
+                    If set, domain name enforcement will NOT be enabled on this key.
+                - arg_name: domains
+                  api_field: googleCloudRecaptchaenterpriseV1Key.webSettings.allowedDomains
+                  help_text: |
+                    Domains or subdomains of websites allowed to use the key. All subdomains of an
+                    allowed domain are automatically allowed. A valid domain requires a host and must
+                    not include any path, port, query or fragment.
+
+                    Examples of valid domains:
+                         'example.com'
+                         'subdomain.example.com'
+            - arg_name: integration-type
+              api_field: googleCloudRecaptchaenterpriseV1Key.webSettings.integrationType
+              help_text: |
+                Configures how reCAPTCHA will operate on your site. This only applies to 'web'
+                platform.
+              choices:
+              - enum_value: SCORE
+                arg_value: score
+                help_text: |
+                  Shows no CAPTCHA challenge on the page
+              - enum_value: CHECKBOX
+                arg_value: checkbox
+                help_text: |
+                  Renders the classic "I'm not a robot" checkbox, and a captcha challenge
+                  for low scoring events
+              - enum_value: INVISIBLE
+                arg_value: invisible
+                help_text: |
+                  Does not display the "I'm not a robot" checkbox, but may show CAPTCHA
+                  challenges after risk analysis
+              - enum_value: POLICY_BASED_CHALLENGE
+                arg_value: policy-based-challenge
+                help_text: |
+                  Conditionally displays a challenge based on the score
+
+            - arg_name: security-preference
+              api_field: googleCloudRecaptchaenterpriseV1Key.webSettings.challengeSecurityPreference
+              help_text: |
+                Represents the possible challenge frequency and difficulty configurations for a web
+                key.
+                            usability: show fewer and easier challenges.
+                            balance: show balanced (in amount and difficulty) challenges.
+                            security: show more and harder challenges.
+            - group:
+                help_text: |
+                  Configure if you want to use the POLICY_BASED_CHALLENGE option.
+                required: false
+                params:
+                - arg_name: default-score-threshold
+                  type: float
+                  required: true
+                  api_field: googleCloudRecaptchaenterpriseV1Key.webSettings.challengeSettings.defaultSettings.scoreThreshold
+                  help_text: |
+                    The global threshold to be used for POLICY_BASED_CHALLENGE if no action specific one exists.
+                - arg_name: action-score-thresholds
+                  api_field: googleCloudRecaptchaenterpriseV1Key.webSettings.challengeSettings.actionSettings
+                  help_text: |
+                    The action to score threshold used for POLICY_BASED_CHALLENGE. For example:
+                    --action-score-thresholds=login='{"scoreThreshold": "0.3"}',signup='{"scoreThreshold": "0.1"}'
+                    or --action-score-thresholds=file_path.(json|yaml)
+                  required: false
+                  repeated: true
+                  type: arg_object
+            - arg_name: testing-challenge
+              api_field: googleCloudRecaptchaenterpriseV1Key.testingOptions.testingChallenge
+              help_text: |
+                For CHECKBOX and INVISIBLE Keys only, this option configures
+                whether challenges will be issued for execute requests.
+              choices:
+              - enum_value: NOCAPTCHA
+                arg_value: nocaptcha
+                help_text: |
+                  Execute requests for this key will always return nocaptcha.
+              - enum_value: UNSOLVABLE_CHALLENGE
+                arg_value: challenge
+                help_text: |
+                  Execute requests for this key will always return an unsolvable
+                  challenge consisting of a message about this testing key.
+
+        - group:
+            help_text: |
+              Options for the creation of a site key for iOS.
+            params:
+            - arg_name: ios
+              required: true
+              type: bool
+              help_text: |
+                Creates a Key configured for iOS devices.
+            - group:
+                mutex: true
+                required: true
+                params:
+                - arg_name: allow-all-bundle-ids
+                  api_field: googleCloudRecaptchaenterpriseV1Key.iosSettings.allowAllBundleIds
+                  help_text: |
+                    If set, bundle id enforcement will NOT be enabled on this key.
+                - arg_name: bundle-ids
+                  api_field: googleCloudRecaptchaenterpriseV1Key.iosSettings.allowedBundleIds
+                  help_text: |
+                    iOS bundle ids of apps allowed to use the key.
+
+                    Example of a valid bundle id:
+                       'com.companyname.productname.appname'
+            - group:
+                required: false
+                help_text: |
+                  Fields that are required to perform Apple-specific integrity checks (recommended
+                  for iOS keys).
+                params:
+                - arg_name: private-key-file
+                  api_field: googleCloudRecaptchaenterpriseV1Key.iosSettings.appleDeveloperId.privateKey
+                  required: true
+                  type: "googlecloudsdk.calliope.arg_parsers:FileContents:"
+                  help_text: |
+                    File path to a private key (downloaded as a text file with a .p8 file extension)
+                    generated for your Apple Developer account. Ensure that DeviceCheck is
+                    enabled for the private key.
+                - arg_name: key-id
+                  api_field: googleCloudRecaptchaenterpriseV1Key.iosSettings.appleDeveloperId.keyId
+                  required: true
+                  help_text: The Apple developer key ID (10-character string).
+                - arg_name: team-id
+                  api_field: googleCloudRecaptchaenterpriseV1Key.iosSettings.appleDeveloperId.teamId
+                  required: true
+                  help_text: |
+                    The Apple team ID (10-character string) owning the provisioning profile
+                    used to build your application.
+
+        - group:
+            help_text: |
+              Options for the creation of a site key for Android.
+            params:
+            - arg_name: android
+              required: true
+              type: bool
+              help_text: |
+                Creates a Key configured for Android devices.
+            - arg_name: support-non-google-app-store-distribution
+              api_field:
+                googleCloudRecaptchaenterpriseV1Key.androidSettings.supportNonGoogleAppStoreDistribution
+              help_text: |
+                If set, this key can be used in an Android application that is
+                available for download in app stores other than the Google Play Store.
+
+                This setting allows your key to accept traffic from devices without Google
+                Mobile Services (GMS) installed.
+            - group:
+                mutex: true
+                required: true
+                params:
+                - arg_name: allow-all-package-names
+                  api_field: googleCloudRecaptchaenterpriseV1Key.androidSettings.allowAllPackageNames
+                  help_text: |
+                    If set, package name enforcement will NOT be enabled on this key.
+                - arg_name: package-names
+                  api_field: googleCloudRecaptchaenterpriseV1Key.androidSettings.allowedPackageNames
+                  help_text: |
+                    Android package names of apps allowed to use the key.
+
+                    Example of a valid package name:
+                       'com.companyname.appname'
+        - group:
+            help_text: |
+              Options for the creation of a site key for Express.
+            params:
+            - arg_name: express
+              required: true
+              type: bool
+              help_text: |
+                Creates a Key configured for Express assessments.
+    labels:
+      api_field: googleCloudRecaptchaenterpriseV1Key.labels

gcloud auth application-default login/google-cloud-sdk/lib/surface/recaptcha/keys/delete.yaml

@@ -0,0 +1,17 @@
+- release_tracks: [ALPHA, GA]
+
+  help_text:
+    description: Delete one or more reCAPTCHA Keys from a given cloud project.
+    brief: Delete one or more reCAPTCHA Keys.
+    examples: |
+        To delete a reCAPTCHA key, run:
+
+          $ {command} test-key
+
+  request:
+    collection: recaptchaenterprise.projects.keys
+
+  arguments:
+    resource:
+      help_text: The reCAPTCHA key to delete.
+      spec: !REF googlecloudsdk.command_lib.recaptcha.resources:keys

gcloud auth application-default login/google-cloud-sdk/lib/surface/recaptcha/keys/describe.yaml

@@ -0,0 +1,17 @@
+- release_tracks: [ALPHA, GA]
+
+  help_text:
+    description: Get the details of a reCAPTCHA Key.
+    brief: Describe reCAPTCHA Key.
+    examples: |
+        To get details on a reCAPTCHA key, run:
+
+          $ {command} test-key
+
+  request:
+    collection: recaptchaenterprise.projects.keys
+
+  arguments:
+    resource:
+      help_text: The reCAPTCHA key to describe.
+      spec: !REF googlecloudsdk.command_lib.recaptcha.resources:keys

gcloud auth application-default login/google-cloud-sdk/lib/surface/recaptcha/keys/list.yaml

@@ -0,0 +1,27 @@
+- release_tracks: [ALPHA, GA]
+
+  help_text:
+    brief: List reCAPTCHA Keys.
+    description: List all of the reCAPTCHA Keys that exist in a given project.
+    examples: |
+        To list all the reCAPTCHA keys existing for your project, run:
+
+          $ {command}
+
+  request:
+    collection: recaptchaenterprise.projects.keys
+
+  response:
+    id_field: name
+
+  arguments:
+    resource:
+      help_text: The project name where to list the indexes.
+      spec: !REF googlecloudsdk.command_lib.recaptcha.resources:project
+
+  output:
+    format: |
+      table(
+      name.basename():label=SITE_KEY,
+        display_name
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/recaptcha/keys/list_ip_overrides.yaml

@@ -0,0 +1,21 @@
+- release_tracks: [ALPHA, GA]
+  help_text:
+    brief: List IP overrides for a key.
+    description: List IP overrides for a key.
+    examples: $ {command} test-key
+
+  request:
+    collection: recaptchaenterprise.projects.keys
+    method: listIpOverrides
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.recaptcha.resources:keys
+      help_text: The reCAPTCHA key for which to list the IP overrides.
+
+  output:
+    format: |
+      table(
+        name.basename():label=SITE_KEY,
+        ip_overrides:label=IP_OVERRIDE_DATA
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/recaptcha/keys/migrate.yaml

@@ -0,0 +1,31 @@
+- release_tracks: [ALPHA, GA]
+  help_text:
+    brief: Migrate a key to reCAPTCHA Enterprise.
+    description: Migrate a key from reCAPTCHA to reCAPTCHA Enterprise.
+    examples: |
+        To migrate a key from reCAPTCHA to reCAPTCHA Enterprise, run:
+
+          $ {command} test-key
+
+  request:
+    collection: recaptchaenterprise.projects.keys
+    method: migrate
+
+  arguments:
+    resource:
+      help_text: The reCAPTCHA key to migrate.
+      spec: !REF googlecloudsdk.command_lib.recaptcha.resources:keys
+
+    params:
+    - arg_name: skip-billing-check
+      api_field: googleCloudRecaptchaenterpriseV1MigrateKeyRequest.skipBillingCheck
+      help_text: |
+        If true, skips the billing check. If your usage of reCAPTCHA is under
+        the free quota, you can safely skip the billing check.
+
+  response:
+    modify_response_hooks:
+    - googlecloudsdk.command_lib.recaptcha.migrate_util:LogMigrateSuccess
+
+  output:
+    format: none

gcloud auth application-default login/google-cloud-sdk/lib/surface/recaptcha/keys/remove_ip_override.yaml

@@ -0,0 +1,27 @@
+- release_tracks: [ALPHA, GA]
+  help_text:
+    brief: Remove an IP override from a key.
+    description: Remove an IP override from a key.
+    examples: $ {command} test-key --ip=1.2.3.4 --override=allow
+
+  request:
+    collection: recaptchaenterprise.projects.keys
+    method: removeIpOverride
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.recaptcha.resources:keys
+      help_text: The reCAPTCHA key from which to remove the IP override.
+
+    params:
+    - arg_name: ip
+      required: true
+      api_field: googleCloudRecaptchaenterpriseV1RemoveIpOverrideRequest.ipOverrideData.ip
+      help_text: IP address to override for the key.
+    - arg_name: override
+      required: true
+      api_field: googleCloudRecaptchaenterpriseV1RemoveIpOverrideRequest.ipOverrideData.overrideType
+      help_text: If set to allow, the IP address/CIDR range will be removed from the allowlisted IPs.
+
+  output:
+    format: none

gcloud auth application-default login/google-cloud-sdk/lib/surface/recaptcha/keys/update.yaml

@@ -0,0 +1,179 @@
+- release_tracks: [ALPHA, GA]
+  help_text:
+    brief: Update a Key.
+    description: Update a reCAPTCHA Key.
+    examples: |
+        To update the information of a reCAPTCHA key, run:
+
+          $ {command} test-key --labels="foo=bar" --web --domains=test.com.mx
+
+  request:
+    collection: recaptchaenterprise.projects.keys
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.recaptcha.hooks:SanitizePlatformSettings
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.recaptcha.resources:keys
+      help_text: |
+        The reCAPTCHA Key to update.
+    params:
+    - arg_name: display-name
+      required: false
+      api_field: googleCloudRecaptchaenterpriseV1Key.displayName
+      help_text: |
+        A human-readable name for the key. Typically a site or app name.
+    - api_field: googleCloudRecaptchaenterpriseV1Key.labels.additionalProperties
+      arg_name: labels
+      metavar: KEY=VALUE
+      required: false
+      help_text: |
+        List of label KEY=VALUE pairs to add.
+      type:
+        arg_dict:
+          flatten: true
+          spec:
+          - api_field: key
+          - api_field: value
+    - group:
+        mutex: true
+        params:
+        - group:
+            help_text: |
+              Options for the creation of a site key for web.
+            params:
+            - arg_name: web
+              required: true
+              type: bool
+              help_text: |
+                Creates a Key configured for websites.
+            - arg_name: allow-amp-traffic
+              api_field: googleCloudRecaptchaenterpriseV1Key.webSettings.allowAmpTraffic
+              help_text: |
+                Whether this key can be used on AMP (Accelerated Mobile Pages) websites.
+            - group:
+                mutex: true
+                required: false
+                params:
+                - arg_name: allow-all-domains
+                  api_field: googleCloudRecaptchaenterpriseV1Key.webSettings.allowAllDomains
+                  help_text: |
+                    If set, domain name enforcement will NOT be enabled on this key.
+                - arg_name: domains
+                  api_field: googleCloudRecaptchaenterpriseV1Key.webSettings.allowedDomains
+                  help_text: |
+                    Domains or subdomains of websites allowed to use the key. All subdomains of an
+                    allowed domain are automatically allowed. A valid domain requires a host and must
+                    not include any path, port, query or fragment.
+
+                    Examples of valid domains:
+                         'example.com'
+                         'subdomain.example.com'
+            - arg_name: security-preference
+              api_field: googleCloudRecaptchaenterpriseV1Key.webSettings.challengeSecurityPreference
+              help_text: |
+                Represents the possible challenge frequency and difficulty configurations for a web key.
+                            usability: show fewer and easier challenges.
+                            balance: show balanced (in amount and difficulty) challenges.
+                            security: show more and harder challenges.
+            - group:
+                help_text: |
+                  Configure if you want to use the POLICY_BASED_CHALLENGE option.
+                required: false
+                params:
+                - arg_name: default-score-threshold
+                  type: float
+                  api_field: googleCloudRecaptchaenterpriseV1Key.webSettings.challengeSettings.defaultSettings.scoreThreshold
+                  help_text: |
+                    The global threshold to be used for POLICY_BASED_CHALLENGE if no action specific one exists.
+                - arg_name: action-score-thresholds
+                  api_field: googleCloudRecaptchaenterpriseV1Key.webSettings.challengeSettings.actionSettings
+                  help_text: |
+                    The action to score threshold used for POLICY_BASED_CHALLENGE. For example:
+                    --action-score-thresholds=login='{"scoreThreshold": "0.3"}',signup='{"scoreThreshold": "0.1"}'
+                    or --action-score-thresholds=file_path.(json|yaml)
+                  repeated: true
+                  type: arg_object
+        - group:
+            help_text: |
+              Options for the creation of a site key for iOS.
+            params:
+            - arg_name: ios
+              required: true
+              type: bool
+              help_text: |
+                Creates a Key configured for iOS devices.
+            - group:
+                mutex: true
+                required: false
+                params:
+                - arg_name: allow-all-bundle-ids
+                  api_field: googleCloudRecaptchaenterpriseV1Key.iosSettings.allowAllBundleIds
+                  help_text: |
+                    If set, bundle id enforcement will NOT be enabled on this key.
+                - arg_name: bundle-ids
+                  api_field: googleCloudRecaptchaenterpriseV1Key.iosSettings.allowedBundleIds
+                  help_text: |
+                    iOS bundle ids of apps allowed to use the key.
+
+                    Example of a valid bundle id:
+                       'com.companyname.productname.appname'
+            - group:
+                required: false
+                help_text: |
+                  Fields that are required to perform Apple-specific integrity checks (recommended
+                  for iOS keys).
+                params:
+                - arg_name: private-key-file
+                  api_field: googleCloudRecaptchaenterpriseV1Key.iosSettings.appleDeveloperId.privateKey
+                  required: true
+                  type: "googlecloudsdk.calliope.arg_parsers:FileContents:"
+                  help_text: |
+                    File path to a private key (downloaded as a text file with a .p8 file extension)
+                    generated for your Apple Developer account. Ensure that DeviceCheck is
+                    enabled for the private key.
+                - arg_name: key-id
+                  api_field: googleCloudRecaptchaenterpriseV1Key.iosSettings.appleDeveloperId.keyId
+                  required: true
+                  help_text: The Apple developer key ID (10-character string).
+                - arg_name: team-id
+                  api_field: googleCloudRecaptchaenterpriseV1Key.iosSettings.appleDeveloperId.teamId
+                  required: true
+                  help_text: |
+                    The Apple team ID (10-character string) owning the provisioning profile
+                    used to build your application.
+        - group:
+            help_text: |
+              Options for the creation of a site key for Android.
+            params:
+            - arg_name: android
+              required: true
+              type: bool
+              help_text: |
+                Creates a Key configured for Android devices.
+            - group:
+                mutex: true
+                required: true
+                params:
+                - arg_name: allow-all-package-names
+                  api_field: googleCloudRecaptchaenterpriseV1Key.androidSettings.allowAllPackageNames
+                  help_text: |
+                    If set, package name enforcement will NOT be enabled on this key.
+                - arg_name: package-names
+                  api_field: googleCloudRecaptchaenterpriseV1Key.androidSettings.allowedPackageNames
+                  help_text: |
+                    Android package names of apps allowed to use the key.
+
+                    Example of a valid package name:
+                         'com.companyname.appname'
+        - group:
+            help_text: |
+              Options for the creation of a site key for Express.
+            params:
+            - arg_name: express
+              required: true
+              type: bool
+              help_text: |
+                Creates a Key configured for Express assessments.
+  output:
+    format: none

gcloud auth application-default login/google-cloud-sdk/lib/surface/recaptcha/policies/__init__.py

@@ -0,0 +1,28 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The command group for reCAPTCHA Policies CLI."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+@base.Hidden
+@base.DefaultUniverseOnly
+class RecaptchaPolicy(base.Group):
+  """Manage reCAPTCHA Policies."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/recaptcha/policies/describe.py

@@ -0,0 +1,50 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command to describe a reCAPTCHA key policy."""
+
+from googlecloudsdk.api_lib.util import apis
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.recaptcha import policies_util
+from googlecloudsdk.generated_clients.apis.recaptchaenterprise.v1 import recaptchaenterprise_v1_messages as messages
+
+
+@base.Hidden
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class Describe(base.DescribeCommand):
+  """Describe a reCAPTCHA key's policy.
+
+  ## EXAMPLES
+
+  To describe a policy for a reCAPTCHA key:
+
+      $ {command} --key=test-key
+
+  See [https://cloud.google.com/sdk/gcloud/reference/recaptcha/keys] for more
+  details for recaptcha keys.
+  """
+
+  @staticmethod
+  def Args(parser):
+    policies_util.AddKeyResourceArg(parser, 'to describe')
+
+  def Run(self, args):
+    client = apis.GetClientInstance('recaptchaenterprise', 'v1')
+    key_ref = args.CONCEPTS.key.Parse()
+    policy_name = key_ref.RelativeName() + '/policy'
+    request = messages.RecaptchaenterpriseProjectsKeysGetPolicyRequest(
+        name=policy_name
+    )
+    return client.projects_keys.GetPolicy(request)

gcloud auth application-default login/google-cloud-sdk/lib/surface/recaptcha/policies/update.py

@@ -0,0 +1,69 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command to update a reCAPTCHA key policy."""
+
+from apitools.base.py import encoding
+from googlecloudsdk.api_lib.util import apis
+from googlecloudsdk.calliope import arg_parsers
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.recaptcha import policies_util
+from googlecloudsdk.generated_clients.apis.recaptchaenterprise.v1 import recaptchaenterprise_v1_messages as messages
+
+
+@base.Hidden
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class Update(base.UpdateCommand):
+  """Update a reCAPTCHA key's policy.
+
+  ## EXAMPLES
+
+  To update a policy for a reCAPTCHA key:
+
+      $ {command} --key=test-key  --policy=policy.yaml
+
+  See [https://cloud.google.com/sdk/gcloud/reference/recaptcha/keys] for more
+  details for recaptcha keys.
+  """
+
+  @staticmethod
+  def Args(parser):
+    policies_util.AddKeyResourceArg(parser, 'to update')
+    parser.add_argument(
+        '--policy',
+        help=(
+            'Path to a YAML file or a JSON file containing the policy'
+            ' definition.'
+        ),
+        required=True,
+        type=arg_parsers.YAMLFileContents(),
+    )
+
+  def Run(self, args):
+    client = apis.GetClientInstance('recaptchaenterprise', 'v1')
+    key_ref = args.CONCEPTS.key.Parse()
+    policy_name = key_ref.RelativeName() + '/policy'
+
+    policy_dict = args.policy if args.policy is not None else {}
+    policy_message = encoding.DictToMessage(
+        policy_dict, messages.GoogleCloudRecaptchaenterpriseV1Policy
+    )
+
+    # Create the UpdatePolicyRequest message
+    request = messages.RecaptchaenterpriseProjectsKeysUpdatePolicyRequest(
+        name=policy_name,
+        googleCloudRecaptchaenterpriseV1Policy=policy_message,
+    )
+    return client.projects_keys.UpdatePolicy(request)