feat(admin): rc admin account and user two-factor commands

crates/cli/src/commands/admin/config.rs

@@ -17,6 +17,7 @@ use zeroize::Zeroizing;
 use super::get_admin_client;
 use crate::exit_code::ExitCode;
 use crate::output::Formatter;
+use crate::private_file::write_private_file;
 
 #[derive(Subcommand, Debug)]
 #[command(disable_help_subcommand = true)]
@@ -839,20 +840,6 @@ fn read_protected_value_file(path: &Path) -> rc_core::Result<Zeroizing<String>>
     Ok(Zeroizing::new(value.to_string()))
 }
 
-fn write_private_file(path: &Path, contents: &[u8]) -> rc_core::Result<()> {
-    let mut options = std::fs::OpenOptions::new();
-    options.write(true).create_new(true);
-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::OpenOptionsExt;
-        options.mode(0o600);
-    }
-    let mut file = options.open(path)?;
-    use std::io::Write;
-    file.write_all(contents)?;
-    Ok(())
-}
-
 fn emit_error(error: &Error, formatter: &Formatter) -> ExitCode {
     let code = ExitCode::from_i32(error.exit_code()).unwrap_or(ExitCode::GeneralError);
     if formatter.is_json() {

crates/cli/src/commands/admin/idp.rs

@@ -9,11 +9,12 @@ use rc_core::{Error, Result};
 use serde::Serialize;
 use serde_json::Value;
 use std::fs::File;
-use std::io::{BufRead, IsTerminal, Read, Write};
+use std::io::Read;
 use std::path::{Path, PathBuf};
 use zeroize::Zeroizing;
 
 use super::{emit_observability_error, get_admin_client};
+use crate::confirm::{Confirmation, confirm};
 use crate::exit_code::ExitCode;
 use crate::output::Formatter;
 
@@ -554,35 +555,19 @@ async fn prepare_and_delete(
 }
 
 fn confirm_delete(provider: &OidcProvider, yes: bool, formatter: &Formatter) -> Result<()> {
-    if yes {
-        return Ok(());
-    }
-    if formatter.is_json() || !std::io::stdin().is_terminal() {
-        return Err(Error::InvalidPath(
-            "OIDC provider deletion requires --yes in non-interactive or JSON mode".to_string(),
-        ));
-    }
-
-    let mut stderr = std::io::stderr().lock();
-    write!(
-        stderr,
-        "Delete OIDC provider '{}'? [y/N] ",
+    let prompt = format!(
+        "Delete OIDC provider '{}'? [y/N]",
         safe(&provider.provider_id, formatter)
+    );
+    confirm(
+        &Confirmation {
+            prompt: &prompt,
+            requires_yes: "OIDC provider deletion requires --yes in non-interactive or JSON mode",
+            declined: "OIDC provider deletion was declined",
+        },
+        yes,
+        formatter,
     )
-    .map_err(Error::Io)?;
-    stderr.flush().map_err(Error::Io)?;
-    let mut answer = String::new();
-    std::io::stdin()
-        .lock()
-        .read_line(&mut answer)
-        .map_err(Error::Io)?;
-    if matches!(answer.trim().to_ascii_lowercase().as_str(), "y" | "yes") {
-        Ok(())
-    } else {
-        Err(Error::Interrupted(
-            "OIDC provider deletion was declined".to_string(),
-        ))
-    }
 }
 
 async fn prepare_and_apply_mutation(

crates/cli/src/commands/admin/mod.rs

@@ -4,6 +4,7 @@
 //! service accounts, and cluster operations through the RustFS Admin API.
 
 mod access_key;
+mod account;
 mod bucket_metadata;
 mod capabilities;
 mod config;
@@ -39,6 +40,10 @@ use rc_s3::AdminClient;
 /// Admin subcommands for IAM and cluster management
 #[derive(Subcommand, Debug)]
 pub enum AdminCommands {
+    /// Manage the identity this alias authenticates as
+    #[command(subcommand)]
+    Account(account::AccountCommands),
+
     /// Discover effective RustFS runtime capabilities
     Capabilities(capabilities::CapabilitiesArgs),
 
@@ -135,6 +140,7 @@ pub async fn execute(cmd: AdminCommands, output_config: OutputConfig) -> ExitCod
     let formatter = Formatter::new(output_config);
 
     match cmd {
+        AdminCommands::Account(account_cmd) => account::execute(account_cmd, &formatter).await,
         AdminCommands::Capabilities(args) => capabilities::execute(args, &formatter).await,
         AdminCommands::Diagnostics(command) => diagnostics::execute(command, &formatter).await,
         AdminCommands::Config(config_cmd) => config::execute(config_cmd, &formatter).await,