feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/sql/users/__init__.py

@@ -0,0 +1,32 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2016 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Provide commands for managing Cloud SQL users."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.ALPHA)
+class Users(base.Group):
+  """Provide commands for managing Cloud SQL users.
+
+  Provide commands for managing Cloud SQL users including creating,
+  listing, and deleting users.
+  """
+  category = base.DATABASES_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/sql/users/assign_roles.py

@@ -0,0 +1,263 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Updates a user's database roles in a given instance."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.sql import api_util
+from googlecloudsdk.api_lib.sql import instances as instances_api_util
+from googlecloudsdk.api_lib.sql import operations
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope import exceptions
+from googlecloudsdk.command_lib.sql import flags
+from googlecloudsdk.command_lib.sql import users
+from googlecloudsdk.core import properties
+
+
+DETAILED_HELP = {
+    'DESCRIPTION':
+        '{description}',
+    'EXAMPLES':
+        """\
+          To grant database roles ``role1'' and ``role2'' for ``my-user'' in instance ``prod-instance'', run:
+
+            $ {command} my-user --instance=prod-instance --database-roles=role1,role2 --type=BUILT_IN
+
+          To revoke existing database roles and grant new database roles ``role3'' and ``role4'' for ``my-user'' in instance
+          ``prod-instance'', run:
+
+            $ {command} my-user --instance=prod-instance --revoke-existing-roles --database-roles=role3,role4 --type=BUILT_IN
+          """,
+}
+
+
+def AddBaseArgs(parser):
+  """Args is called by calliope to gather arguments for this command.
+
+  Args:
+    parser: An argparse parser that you can use it to add arguments that go on
+      the command line after this command. Positional arguments are allowed.
+  """
+  flags.AddInstance(parser)
+  flags.AddUsername(parser)
+  flags.AddHost(parser)
+  flags.AddType(parser, required=True)
+  flags.AddDatabaseRoles(parser)
+  flags.AddRevokeExistingRoles(parser)
+  parser.display_info.AddCacheUpdater(None)
+
+
+def AddBetaArgs(parser):
+  del parser  # Unused.
+  pass
+
+
+def AddAlphaArgs(parser):
+  del parser  # Unused.
+  pass
+
+
+def RunBaseAssignRolesCommand(args):
+  """Updates a user's database roles in a given instance.
+
+  Args:
+    args: argparse.Namespace, The arguments that this command was invoked
+      with.
+
+  Returns:
+    SQL user resource iterator.
+  """
+  client = api_util.SqlClient(api_util.API_VERSION_DEFAULT)
+  sql_client = client.sql_client
+  sql_messages = client.sql_messages
+
+  instance_ref = client.resource_parser.Parse(
+      args.instance,
+      params={'project': properties.VALUES.core.project.GetOrFail},
+      collection='sql.instances',
+  )
+
+  instance = sql_client.instances.Get(
+      sql_messages.SqlInstancesGetRequest(
+          project=instance_ref.project, instance=instance_ref.instance
+      )
+  )
+  is_mysql = instances_api_util.InstancesV1Beta4.IsMysqlDatabaseVersion(
+      instance.databaseVersion
+  )
+  name = args.username
+  host = args.host
+  user_type = users.ParseUserType(sql_messages, args)
+  if (
+      user_type == sql_messages.User.TypeValueValuesEnum.CLOUD_IAM_GROUP
+      and is_mysql
+  ):
+    # MySQL IAM groups are stored with the domain in the host field.
+    if '@' not in name:
+      raise exceptions.InvalidArgumentException(
+          'username',
+          message=(
+              'Cloud SQL IAM groups must be specified with the domain name in'
+              ' the username field.'
+          ),
+      )
+    host = name.split('@')[1]
+    name = name.split('@')[0]
+
+  if is_mysql and user_type in [
+      # TODO: b/437180966 - Add support for 3P user types in MySQL once the
+      # support for 3P users is launched.
+      sql_messages.User.TypeValueValuesEnum.CLOUD_IAM_USER,
+      sql_messages.User.TypeValueValuesEnum.CLOUD_IAM_SERVICE_ACCOUNT,
+  ]:
+    # Truncate the domain from the username for MySQL IAM users and service
+    # accounts.
+    name = name.split('@')[0]
+    # For MySQL IAM users, the host is not supported.
+    host = '%'
+
+  user = sql_client.users.Get(
+      sql_messages.SqlUsersGetRequest(
+          project=instance_ref.project,
+          instance=args.instance,
+          name=name,
+          host=host,
+      )
+  )
+
+  user_type = user.type
+  name = user.name
+  if (
+      user_type == sql_messages.User.TypeValueValuesEnum.CLOUD_IAM_USER
+      or user_type
+      == sql_messages.User.TypeValueValuesEnum.CLOUD_IAM_SERVICE_ACCOUNT
+      or user_type
+      == sql_messages.User.TypeValueValuesEnum.CLOUD_IAM_GROUP
+  ):
+    # For MySQL, the iam email needs to be passed in as the name.
+    if user.iamEmail:
+      name = user.iamEmail
+    # For MySQL IAM users, the host is not supported.
+    host = ''
+
+  result_operation = sql_client.users.Update(
+      sql_messages.SqlUsersUpdateRequest(
+          project=instance_ref.project,
+          instance=args.instance,
+          name=name,
+          host=host,
+          user=sql_messages.User(
+              project=instance_ref.project,
+              instance=args.instance,
+              name=name,
+              type=user.type),
+          databaseRoles=args.database_roles,
+          revokeExistingRoles=args.revoke_existing_roles))
+  operation_ref = client.resource_parser.Create(
+      'sql.operations',
+      operation=result_operation.name,
+      project=instance_ref.project)
+  if args.async_:
+    return sql_client.operations.Get(
+        sql_messages.SqlOperationsGetRequest(
+            project=operation_ref.project, operation=operation_ref.operation))
+  operations.OperationsV1Beta4.WaitForOperation(sql_client, operation_ref,
+                                                'Updating Cloud SQL user')
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+@base.UniverseCompatible
+@base.Hidden
+class AssignRoles(base.UpdateCommand):
+  """Updates a user's database roles in a given instance.
+
+  Updates a user's database roles in a given instance with a specified
+  username and host.
+  """
+
+  detailed_help = DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    """Args is called by calliope to gather arguments for this command.
+
+    Args:
+      parser: An argparse parser that you can use it to add arguments that go on
+        the command line after this command. Positional arguments are allowed.
+    """
+    AddBaseArgs(parser)
+    base.ASYNC_FLAG.AddToParser(parser)
+
+  def Run(self, args):
+    return RunBaseAssignRolesCommand(args)
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+@base.UniverseCompatible
+@base.Hidden
+class AssignRolesBeta(base.UpdateCommand):
+  """Updates a user's database roles in a given instance.
+
+  Updates a user's database roles in a given instance with a specified
+  username and host.
+  """
+
+  detailed_help = DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    """Args is called by calliope to gather arguments for this command.
+
+    Args:
+      parser: An argparse parser that you can use it to add arguments that go on
+        the command line after this command. Positional arguments are allowed.
+    """
+    AddBetaArgs(parser)
+    AddBaseArgs(parser)
+    base.ASYNC_FLAG.AddToParser(parser)
+
+  def Run(self, args):
+    return RunBaseAssignRolesCommand(args)
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+@base.UniverseCompatible
+@base.Hidden
+class AssignRolesAlpha(base.UpdateCommand):
+  """Updates a user's database roles in a given instance.
+
+  Updates a user's database roles in a given instance with a specified
+  username and host.
+  """
+
+  detailed_help = DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    """Args is called by calliope to gather arguments for this command.
+
+    Args:
+      parser: An argparse parser that you can use it to add arguments that go on
+        the command line after this command. Positional arguments are allowed.
+    """
+    AddAlphaArgs(parser)
+    AddBetaArgs(parser)
+    AddBaseArgs(parser)
+    base.ASYNC_FLAG.AddToParser(parser)
+
+  def Run(self, args):
+    return RunBaseAssignRolesCommand(args)

gcloud auth application-default login/google-cloud-sdk/lib/surface/sql/users/create.py

@@ -0,0 +1,172 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2016 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Creates a user in a given instance.
+
+Creates a user in a given instance with specified username, host, and password.
+"""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.sql import api_util
+from googlecloudsdk.api_lib.sql import operations
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.sql import flags
+from googlecloudsdk.command_lib.sql import users
+from googlecloudsdk.core import log
+from googlecloudsdk.core import properties
+
+
+def AddBaseArgs(parser):
+  """AddBaseArgs is called to gather arguments for this command.
+
+  Args:
+    parser: An argparse parser that you can use it to add arguments that go on
+      the command line after this command. Positional arguments are allowed.
+  """
+
+  flags.AddInstance(parser)
+  flags.AddUsername(parser)
+  flags.AddHost(parser)
+  flags.AddPassword(parser)
+  flags.AddType(parser)
+  flags.AddPasswordPolicyAllowedFailedAttempts(parser)
+  flags.AddPasswordPolicyPasswordExpirationDuration(parser)
+  flags.AddPasswordPolicyEnableFailedAttemptsCheck(parser)
+  flags.AddPasswordPolicyEnablePasswordVerification(parser)
+  flags.AddDatabaseRoles(parser)
+
+
+def AddBetaArgs(parser):
+  del parser  # Unused.
+  pass
+
+
+def AddAlphaArgs(parser):
+  AddBetaArgs(parser)
+
+
+def RunBaseCreateCommand(args):
+  """Creates a user in a given instance.
+
+  Args:
+    args: argparse.Namespace, The arguments that this command was invoked with.
+
+  Returns:
+    SQL user resource iterator.
+  """
+  client = api_util.SqlClient(api_util.API_VERSION_DEFAULT)
+  sql_client = client.sql_client
+  sql_messages = client.sql_messages
+
+  instance_ref = client.resource_parser.Parse(
+      args.instance,
+      params={'project': properties.VALUES.core.project.GetOrFail},
+      collection='sql.instances')
+  operation_ref = None
+
+  user_type = users.ParseUserType(sql_messages, args)
+  password_policy = users.CreatePasswordPolicyFromArgs(
+      sql_messages, sql_messages.UserPasswordValidationPolicy(), args)
+
+  new_user = sql_messages.User(
+      kind='sql#user',
+      project=instance_ref.project,
+      instance=args.instance,
+      name=args.username,
+      host=args.host,
+      password=args.password,
+      passwordPolicy=password_policy,
+      type=user_type,
+      databaseRoles=args.database_roles)
+
+  result_operation = sql_client.users.Insert(new_user)
+  operation_ref = client.resource_parser.Create(
+      'sql.operations',
+      operation=result_operation.name,
+      project=instance_ref.project)
+  if args.async_:
+    result = sql_client.operations.Get(
+        sql_messages.SqlOperationsGetRequest(
+            project=operation_ref.project, operation=operation_ref.operation))
+  else:
+    operations.OperationsV1Beta4.WaitForOperation(sql_client, operation_ref,
+                                                  'Creating Cloud SQL user')
+    result = new_user
+    result.kind = None
+
+  log.CreatedResource(args.username, kind='user', is_async=args.async_)
+
+  return result
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+@base.UniverseCompatible
+class Create(base.CreateCommand):
+  """Creates a user in a given instance.
+
+  Creates a user in a given instance with specified username, host,
+  type, and password.
+  """
+
+  @staticmethod
+  def Args(parser):
+    AddBaseArgs(parser)
+    base.ASYNC_FLAG.AddToParser(parser)
+    parser.display_info.AddCacheUpdater(flags.UserCompleter)
+
+  def Run(self, args):
+    return RunBaseCreateCommand(args)
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+@base.UniverseCompatible
+class CreateBeta(Create):
+  """Creates a user in a given instance.
+
+  Creates a user in a given instance with specified username, host,
+  type, and password.
+  """
+
+  @staticmethod
+  def Args(parser):
+    AddBaseArgs(parser)
+    AddBetaArgs(parser)
+    base.ASYNC_FLAG.AddToParser(parser)
+    parser.display_info.AddCacheUpdater(flags.UserCompleter)
+
+  def Run(self, args):
+    return RunBaseCreateCommand(args)
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+@base.UniverseCompatible
+class CreateAlpha(CreateBeta):
+  """Creates a user in a given instance.
+
+  Creates a user in a given instance with specified username, host,
+  type, and password.
+  """
+
+  @staticmethod
+  def Args(parser):
+    AddBaseArgs(parser)
+    AddAlphaArgs(parser)
+    base.ASYNC_FLAG.AddToParser(parser)
+    parser.display_info.AddCacheUpdater(flags.UserCompleter)
+
+  def Run(self, args):
+    return RunBaseCreateCommand(args)

gcloud auth application-default login/google-cloud-sdk/lib/surface/sql/users/delete.py

@@ -0,0 +1,96 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2016 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Deletes a user in a given instance.
+
+Deletes a user in a given instance specified by username and host.
+"""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+import argparse
+
+from googlecloudsdk.api_lib.sql import api_util
+from googlecloudsdk.api_lib.sql import operations
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.sql import flags
+from googlecloudsdk.core import properties
+from googlecloudsdk.core.console import console_io
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.ALPHA)
+@base.UniverseCompatible
+class Delete(base.DeleteCommand):
+  """Deletes a Cloud SQL user in a given instance.
+
+  Deletes a Cloud SQL user in a given instance specified by username and host.
+  """
+
+  @staticmethod
+  def Args(parser):
+    flags.AddInstance(parser)
+    flags.AddUsername(parser)
+    flags.AddHost(parser)
+    base.ASYNC_FLAG.AddToParser(parser)
+    parser.display_info.AddCacheUpdater(flags.UserCompleter)
+
+  def Run(self, args: argparse.Namespace):
+    """Lists Cloud SQL users in a given instance.
+
+    Args:
+      args: The arguments that this command was invoked
+          with.
+
+    Returns:
+      SQL user resource iterator.
+    """
+    client = api_util.SqlClient(api_util.API_VERSION_DEFAULT)
+    sql_client = client.sql_client
+    sql_messages = client.sql_messages
+
+    instance_ref = client.resource_parser.Parse(
+        args.instance,
+        params={'project': properties.VALUES.core.project.GetOrFail},
+        collection='sql.instances')
+    operation_ref = None
+    user_name = args.username
+    if args.host:
+      user_name = 'f{0}@{1}'.format(args.username, args.host)
+
+    console_io.PromptContinue(
+        message='{0} will be deleted. New connections can no longer be '
+        'made using this user. Existing connections are not affected.'.format(
+            user_name),
+        default=True,
+        cancel_on_no=True)
+
+    result_operation = sql_client.users.Delete(
+        sql_messages.SqlUsersDeleteRequest(
+            project=instance_ref.project,
+            instance=instance_ref.Name(),
+            name=args.username,
+            host=args.host))
+    operation_ref = client.resource_parser.Create(
+        'sql.operations',
+        operation=result_operation.name,
+        project=instance_ref.project)
+    if args.async_:
+      return sql_client.operations.Get(
+          sql_messages.SqlOperationsGetRequest(
+              project=operation_ref.project, operation=operation_ref.operation))
+    operations.OperationsV1Beta4.WaitForOperation(sql_client, operation_ref,
+                                                  'Deleting Cloud SQL user')

gcloud auth application-default login/google-cloud-sdk/lib/surface/sql/users/describe.py

@@ -0,0 +1,73 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Retrieves information about a Cloud SQL user in a given instance."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.sql import api_util
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.sql import flags
+from googlecloudsdk.core import properties
+
+
+def AddBaseArgs(parser):
+  flags.AddInstance(parser)
+  flags.AddUsername(parser)
+  flags.AddHost(parser)
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class Get(base.DescribeCommand):
+  """Retrieves information about a Cloud SQL user in a given instance."""
+
+  detailed_help = {
+      'EXAMPLES':
+          """\
+          To fetch a user with name 'my-user' and optional host '%' in instance 'my-instance', run:
+
+          $ {command} my-user --host=% --instance=my-instance
+
+        """
+  }
+
+  @staticmethod
+  def Args(parser):
+    AddBaseArgs(parser)
+
+  def Run(self, args):
+    """Retrieves information about a Cloud SQL user in a given instance.
+
+    Args:
+      args: argparse.Namespace, The arguments that this command was invoked
+        with.
+
+    Returns:
+      SQL user resource.
+    """
+    client = api_util.SqlClient(api_util.API_VERSION_DEFAULT)
+    sql_client = client.sql_client
+    sql_messages = client.sql_messages
+
+    project_id = properties.VALUES.core.project.Get(required=True)
+
+    return sql_client.users.Get(
+        sql_messages.SqlUsersGetRequest(
+            project=project_id,
+            instance=args.instance,
+            name=args.username,
+            host=args.host))

gcloud auth application-default login/google-cloud-sdk/lib/surface/sql/users/list.py

@@ -0,0 +1,151 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2016 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Lists users in a given project.
+
+Lists users in a given project in the alphabetical order of the user name.
+"""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.sql import api_util
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.sql import flags
+from googlecloudsdk.core import properties
+
+
+def AddBaseArgs(parser):
+  flags.AddInstance(parser)
+  parser.display_info.AddCacheUpdater(flags.UserCompleter)
+
+
+def RunBaseListCommand(args, release_track):
+  """Lists Cloud SQL users in a given instance.
+
+  Args:
+    args: argparse.Namespace, The arguments that this command was invoked with.
+    release_track: base.ReleaseTrack, the release track that this was run under.
+
+  Returns:
+    SQL user resource iterator.
+  """
+  client = api_util.SqlClient(api_util.API_VERSION_DEFAULT)
+  sql_client = client.sql_client
+  sql_messages = client.sql_messages
+
+  project_id = properties.VALUES.core.project.Get(required=True)
+
+  users = sql_client.users.List(
+      sql_messages.SqlUsersListRequest(
+          project=project_id, instance=args.instance)).items
+
+  # We will not display dual passwords if no user in the instance
+  # has information about this field. This an implicit way of saying that we
+  # will only show dual password type on MySQL 8.0, as no other instance type
+  # will have dual password information. Likewise, we will not display
+  # IAM status if no user in the instance has information about this field.
+  dual_password_type = ""
+  iam_status = ""
+  for user in users:
+    if user.dualPasswordType:
+      dual_password_type = "dualPasswordType,"
+    policy = user.passwordPolicy
+    if (
+        user.iamStatus
+        == sql_messages.User.IamStatusValueValuesEnum.IAM_STATUS_UNSPECIFIED
+    ):
+      user.iamStatus = None
+    if user.iamStatus:
+      iam_status = "iamStatus,"
+    if not policy:
+      continue
+    # Don't display
+    policy.enableFailedAttemptsCheck = None
+
+  # Dual Password types is exposed in all release tracks, but we will not
+  # expose the column early to customers, because returning the Dual Password
+  # status is gated by a flag upstream.
+  if release_track == base.ReleaseTrack.GA:
+    # Because there are tests running against Python 3.5, I can't use f-Strings.
+    args.GetDisplayInfo().AddFormat("""
+      table(
+        name.yesno(no='(anonymous)'),
+        host,
+        type.yesno(no='BUILT_IN'),
+        {dualPasswordType}
+        {iamStatus}
+        passwordPolicy
+      )
+    """.format(dualPasswordType=dual_password_type, iamStatus=iam_status))
+  else:
+    args.GetDisplayInfo().AddFormat("""
+      table(
+        name.yesno(no='(anonymous)'),
+        host,
+        type.yesno(no='BUILT_IN'),
+        {dualPasswordType}
+        {iamStatus}
+        iamEmail,
+        passwordPolicy
+      )
+    """.format(dualPasswordType=dual_password_type, iamStatus=iam_status))
+
+  return users
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+@base.UniverseCompatible
+class List(base.ListCommand):
+  """Lists Cloud SQL users in a given instance.
+
+  Lists Cloud SQL users in a given instance in the alphabetical
+  order of the user name.
+  """
+
+  @staticmethod
+  def Args(parser):
+    AddBaseArgs(parser)
+
+  def Run(self, args):
+    return RunBaseListCommand(args, self.ReleaseTrack())
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+@base.UniverseCompatible
+class ListBeta(List):
+  """Lists Cloud SQL users in a given instance.
+
+  Lists Cloud SQL users in a given instance in the alphabetical
+  order of the user name.
+  """
+
+  @staticmethod
+  def Args(parser):
+    AddBaseArgs(parser)
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+@base.UniverseCompatible
+class ListAlpha(ListBeta):
+  """Lists Cloud SQL users in a given instance.
+
+  Lists Cloud SQL users in a given instance in the alphabetical
+  order of the user name.
+  """
+
+  @staticmethod
+  def Args(parser):
+    AddBaseArgs(parser)

gcloud auth application-default login/google-cloud-sdk/lib/surface/sql/users/set_password.py

@@ -0,0 +1,150 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2016 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Changes a user's password in a given instance.
+
+Changes a user's password in a given instance with specified username and host.
+"""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.sql import api_util
+from googlecloudsdk.api_lib.sql import operations
+from googlecloudsdk.api_lib.sql import users_util
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.sql import flags
+from googlecloudsdk.command_lib.sql import users
+from googlecloudsdk.core import properties
+from googlecloudsdk.core.console import console_io
+
+
+def AddBaseArgs(parser):
+  flags.AddInstance(parser)
+  flags.AddUsername(parser)
+  flags.AddHost(parser)
+  password_group = parser.add_mutually_exclusive_group()
+  flags.AddPassword(password_group)
+  flags.AddPromptForPassword(password_group)
+  dual_password_group = parser.add_mutually_exclusive_group()
+  flags.AddUserDiscardDualPassword(dual_password_group)
+  flags.AddUserRetainPassword(dual_password_group)
+
+
+def AddBetaArgs(parser):
+  del parser  # unused
+  pass
+
+
+def AddAlphaArgs(parser):
+  AddBetaArgs(parser)
+  pass
+
+
+def RunBaseSetPasswordCommand(args):
+  """Changes a user's password in a given instance.
+
+  Args:
+    args: argparse.Namespace, The arguments that this command was invoked with.
+
+  Returns:
+    SQL user resource iterator.
+  """
+  client = api_util.SqlClient(api_util.API_VERSION_DEFAULT)
+  sql_client = client.sql_client
+
+  if args.prompt_for_password:
+    args.password = console_io.PromptPassword('New Password: ')
+
+  users.ValidateSetPasswordRequest(args)
+
+  sql_messages = client.sql_messages
+  instance_ref = client.resource_parser.Parse(
+      args.instance,
+      params={'project': properties.VALUES.core.project.GetOrFail},
+      collection='sql.instances')
+
+  dual_password_type = users.ParseDualPasswordType(sql_messages, args)
+  request = users_util.CreateSetPasswordRequest(sql_messages,
+                                                args,
+                                                dual_password_type,
+                                                instance_ref.project)
+  result_operation = sql_client.users.Update(request)
+  operation_ref = client.resource_parser.Create(
+      'sql.operations',
+      operation=result_operation.name,
+      project=instance_ref.project)
+  if args.async_:
+    return sql_client.operations.Get(
+        sql_messages.SqlOperationsGetRequest(
+            project=operation_ref.project, operation=operation_ref.operation))
+  operations.OperationsV1Beta4.WaitForOperation(sql_client, operation_ref,
+                                                'Updating Cloud SQL user')
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class Create(base.CreateCommand):
+  """Changes a user's password in a given instance.
+
+  Changes a user's password in a given instance with specified username and
+  host.
+  """
+
+  @staticmethod
+  def Args(parser):
+    AddBaseArgs(parser)
+    base.ASYNC_FLAG.AddToParser(parser)
+    parser.display_info.AddCacheUpdater(None)
+
+  def Run(self, args):
+    return RunBaseSetPasswordCommand(args)
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+class CreateBeta(Create):
+  """Changes a user's password in a given instance.
+
+  Changes a user's password in a given instance with specified username and
+  host.
+  """
+
+  @staticmethod
+  def Args(parser):
+    AddBaseArgs(parser)
+    AddBetaArgs(parser)
+    base.ASYNC_FLAG.AddToParser(parser)
+    parser.display_info.AddCacheUpdater(None)
+
+  def Run(self, args):
+    return RunBaseSetPasswordCommand(args)
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class CreateAlpha(CreateBeta):
+  """Changes a user's password in a given instance.
+
+  Changes a user's password in a given instance with specified username and
+  host.
+  """
+
+  @staticmethod
+  def Args(parser):
+    AddBaseArgs(parser)
+    AddAlphaArgs(parser)
+    base.ASYNC_FLAG.AddToParser(parser)
+    parser.display_info.AddCacheUpdater(None)
+
+  def Run(self, args):
+    return RunBaseSetPasswordCommand(args)

gcloud auth application-default login/google-cloud-sdk/lib/surface/sql/users/set_password_policy.py

@@ -0,0 +1,205 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Replaces a user's password policy in a given instance.
+
+Replaces a user's password policy in a given instance with specified policy.
+"""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.sql import api_util
+from googlecloudsdk.api_lib.sql import operations
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.sql import flags
+from googlecloudsdk.command_lib.sql import users
+from googlecloudsdk.core import properties
+
+
+DETAILED_HELP = {
+    'DESCRIPTION':
+        '{description}',
+    'EXAMPLES':
+        """\
+          To replace the password policy with 2 minutes password
+          expiration time for ``my-user'' in instance ``prod-instance'', run:
+
+            $ {command} my-user --instance=prod-instance --password-policy-password-expiration-duration=2m
+
+          To clear the existing password policy of ``my-user'' in instance
+          ``prod-instance'', run:
+
+            $ {command} my-user --instance=prod-instance --clear-password-policy
+          """,
+}
+
+
+def AddBaseArgs(parser):
+  """Args is called by calliope to gather arguments for this command.
+
+  Args:
+    parser: An argparse parser that you can use it to add arguments that go on
+      the command line after this command. Positional arguments are allowed.
+  """
+  flags.AddInstance(parser)
+  flags.AddUsername(parser)
+  flags.AddHost(parser)
+  flags.AddPasswordPolicyAllowedFailedAttempts(parser)
+  flags.AddPasswordPolicyPasswordExpirationDuration(parser)
+  flags.AddPasswordPolicyEnableFailedAttemptsCheck(parser)
+  flags.AddPasswordPolicyEnablePasswordVerification(parser)
+  flags.AddPasswordPolicyClearPasswordPolicy(parser)
+  base.ASYNC_FLAG.AddToParser(parser)
+  parser.display_info.AddCacheUpdater(None)
+
+
+def AddBetaArgs(parser):
+  del parser  # Unused.
+  pass
+
+
+def AddAlphaArgs(parser):
+  del parser  # Unused.
+  pass
+
+
+def RunBaseSetPasswordCommand(args):
+  """Changes a user's password in a given instance.
+
+  Args:
+    args: argparse.Namespace, The arguments that this command was invoked
+      with.
+
+  Returns:
+    SQL user resource iterator.
+  """
+  client = api_util.SqlClient(api_util.API_VERSION_DEFAULT)
+  sql_client = client.sql_client
+  sql_messages = client.sql_messages
+
+  instance_ref = client.resource_parser.Parse(
+      args.instance,
+      params={'project': properties.VALUES.core.project.GetOrFail},
+      collection='sql.instances')
+  operation_ref = None
+
+  user = sql_client.users.Get(
+      sql_messages.SqlUsersGetRequest(
+          project=instance_ref.project,
+          instance=args.instance,
+          name=args.username,
+          host=args.host))
+
+  password_policy = users.CreatePasswordPolicyFromArgs(
+      sql_messages, user.passwordPolicy, args)
+
+  result_operation = sql_client.users.Update(
+      sql_messages.SqlUsersUpdateRequest(
+          project=instance_ref.project,
+          instance=args.instance,
+          name=args.username,
+          host=args.host,
+          user=sql_messages.User(
+              project=instance_ref.project,
+              instance=args.instance,
+              name=args.username,
+              host=args.host,
+              passwordPolicy=password_policy)))
+  operation_ref = client.resource_parser.Create(
+      'sql.operations',
+      operation=result_operation.name,
+      project=instance_ref.project)
+  if args.async_:
+    return sql_client.operations.Get(
+        sql_messages.SqlOperationsGetRequest(
+            project=operation_ref.project, operation=operation_ref.operation))
+  operations.OperationsV1Beta4.WaitForOperation(sql_client, operation_ref,
+                                                'Updating Cloud SQL user')
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class SetPasswordPolicy(base.UpdateCommand):
+  """Replaces a user's password policy in a given instance.
+
+  Replaces a user's password policy in a given instance with a specified
+  username and host.
+  """
+
+  detailed_help = DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    """Args is called by calliope to gather arguments for this command.
+
+    Args:
+      parser: An argparse parser that you can use it to add arguments that go on
+        the command line after this command. Positional arguments are allowed.
+    """
+    AddBaseArgs(parser)
+
+  def Run(self, args):
+    RunBaseSetPasswordCommand(args)
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+class SetPasswordPolicyBeta(base.UpdateCommand):
+  """Replaces a user's password policy in a given instance.
+
+  Replaces a user's password policy in a given instance with a specified
+  username and host.
+  """
+
+  detailed_help = DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    """Args is called by calliope to gather arguments for this command.
+
+    Args:
+      parser: An argparse parser that you can use it to add arguments that go on
+        the command line after this command. Positional arguments are allowed.
+    """
+    AddBetaArgs(parser)
+    AddBaseArgs(parser)
+
+  def Run(self, args):
+    RunBaseSetPasswordCommand(args)
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class SetPasswordPolicyAlpha(base.UpdateCommand):
+  """Replaces a user's password policy in a given instance.
+
+  Replaces a user's password policy in a given instance with a specified
+  username and host.
+  """
+
+  detailed_help = DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    """Args is called by calliope to gather arguments for this command.
+
+    Args:
+      parser: An argparse parser that you can use it to add arguments that go on
+        the command line after this command. Positional arguments are allowed.
+    """
+    AddAlphaArgs(parser)
+    AddBetaArgs(parser)
+    AddBaseArgs(parser)
+
+  def Run(self, args):
+    RunBaseSetPasswordCommand(args)