From 38513d21853fe75fa2150705d02eeb58426eebda Mon Sep 17 00:00:00 2001
From: bennychen <bennychen@tencent.com>
Date: Wed, 10 Jun 2026 21:39:23 +0800
Subject: [PATCH] =?UTF-8?q?feat:=20=E6=96=B0=E5=A2=9E=20private=20openapi?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../commands/support-files/resources.yaml     | 34 +++++++++++++++++++
 .../services/bpf_service/urls.py              | 10 ++++++
 2 files changed, 44 insertions(+)

diff --git a/bk-plugin-framework/bk_plugin_framework/services/bpf_service/management/commands/support-files/resources.yaml b/bk-plugin-framework/bk_plugin_framework/services/bpf_service/management/commands/support-files/resources.yaml
index b594c0b..6b900cf 100644
--- a/bk-plugin-framework/bk_plugin_framework/services/bpf_service/management/commands/support-files/resources.yaml
+++ b/bk-plugin-framework/bk_plugin_framework/services/bpf_service/management/commands/support-files/resources.yaml
@@ -187,6 +187,40 @@ paths:
         disabledStages: []
         descriptionEn: Plugin open API entry
 
+  /bk_plugin/private/:
+    x-bk-apigateway-method-any:
+      operationId: plugin_private
+      summary: 插件私有API
+      description: 插件私有 API 入口，支持子路径匹配
+      tags:
+        - private
+      responses:
+        default:
+          description: '插件私有API响应'
+      x-bk-apigateway-resource:
+        isPublic: true
+        allowApplyPermission: true
+        matchSubpath: true
+        backend:
+          type: HTTP
+          name: default
+          method: any
+          {% if settings.BK_PLUGIN_APIGW_BACKEND_SUB_PATH %}
+          path: /{env.api_sub_path}/bk_plugin/private/
+          {% else %}
+          path: /bk_plugin/private/
+          {% endif %}
+          matchSubpath: true
+          timeout: 0
+          upstreams: {}
+          transformHeaders: {}
+        authConfig:
+          userVerifiedRequired: true
+          appVerifiedRequired: true
+          resourcePermissionRequired: false
+        disabledStages: []
+        descriptionEn: Plugin private API entry
+
   /plugin_api_dispatch:
     post:
       operationId: plugin_api_dispatch
diff --git a/bk-plugin-framework/bk_plugin_framework/services/bpf_service/urls.py b/bk-plugin-framework/bk_plugin_framework/services/bpf_service/urls.py
index f67660b..387312f 100644
--- a/bk-plugin-framework/bk_plugin_framework/services/bpf_service/urls.py
+++ b/bk-plugin-framework/bk_plugin_framework/services/bpf_service/urls.py
@@ -19,6 +19,7 @@
 
 PLUGIN_API_URLS_MODULE = "bk_plugin.apis.urls"
 PLUGIN_OPENAPI_URLS_MODULE = "bk_plugin.openapi.urls"
+PLUGIN_PRIVATE_URLS_MODULE = "bk_plugin.private.urls"
 
 urlpatterns = [
     # 协议层接口（与平台方对接）
@@ -52,3 +53,12 @@
 else:
     sys.stdout.write("[!]plugin openapi urls module found\n")
     urlpatterns.append(path(r"openapi/", include(PLUGIN_OPENAPI_URLS_MODULE)))
+
+# add plugin private
+try:
+    importlib.import_module(PLUGIN_PRIVATE_URLS_MODULE)
+except ModuleNotFoundError:
+    sys.stdout.write("[!]can not find plugin private urls module, skip it\n")
+else:
+    sys.stdout.write("[!]plugin private urls module found\n")
+    urlpatterns.append(path(r"private/", include(PLUGIN_PRIVATE_URLS_MODULE)))