From 1a6820a8b4e68471205adb54b97dcd2c1c52dfe6 Mon Sep 17 00:00:00 2001
From: anlicheng <244108715@qq.com>
Date: Sat, 9 May 2026 15:22:22 +0800
Subject: [PATCH] fix ssl_channel

---
 docs/efka_iot_protocol.md         |  5 +++--
 src/transport/tcp/ssl_channel.erl | 15 +++++++++++----
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/docs/efka_iot_protocol.md b/docs/efka_iot_protocol.md
index d559ef9..88d4d98 100644
--- a/docs/efka_iot_protocol.md
+++ b/docs/efka_iot_protocol.md
@@ -47,16 +47,17 @@
 }}}
 ```
 
-`iot` 鉴权成功时回复：
+`iot` 回复：
 
 ```erlang
 {response, Ref, {auth_response, ok}}
+{response, Ref, {auth_response, {error, {failed, Reason}}}}
 ```
 
 处理语义：
 
 - `ok`：`efka` 进入 `activated` 状态。
-- 鉴权失败、host 不存在、host 未启动或 attach channel 失败时，`iot` 不返回业务错误响应，直接关闭连接；`efka` 通过 socket close/error 或 auth timeout 进入重连流程。
+- `{error, {failed, Reason}}`：鉴权失败，`iot` 返回失败响应后关闭连接；`efka` 进入重连流程。
 
 ## 授权控制
 
diff --git a/src/transport/tcp/ssl_channel.erl b/src/transport/tcp/ssl_channel.erl
index 8447114..c24f528 100644
--- a/src/transport/tcp/ssl_channel.erl
+++ b/src/transport/tcp/ssl_channel.erl
@@ -181,12 +181,19 @@ handle_request_frame(Ref, {auth_request, #{uuid := UUID, token := Token, timesta
         {ok, HostPid} ?= iot_host:lookup_pid(UUID),
         ok ?= iot_host:attach_channel(HostPid, self()),
         erlang:monitor(process, HostPid),
-        ok ?= send_reply_frame(Transport, Socket, Ref, {auth_response, ok}),
+        ok = send_reply_frame(Transport, Socket, Ref, {auth_response, ok}),
         logger:debug("[ws_channel] auth uuid: ~p", [UUID]),
         {noreply, State#state{uuid = UUID, is_authed = true, host_pid = HostPid}}
-    else {error, Reason} ->
-        logger:warning("[ws_channel] uuid: ~p, auth failed with reason: ~p", [UUID, Reason]),
-        {stop, Reason, State}
+    else
+        {error, Reason} ->
+            logger:warning("[ws_channel] uuid: ~p, auth failed with reason: ~p", [UUID, Reason]),
+            case send_reply_frame(Transport, Socket, Ref, {auth_response, {error, {failed, Reason}}}) of
+                ok ->
+                    {stop, Reason, State};
+                {error, SendReason} ->
+                    logger:warning("[ws_channel] uuid: ~p, send auth failed response failed: ~p", [UUID, SendReason]),
+                    {stop, {send_failed, SendReason}, State}
+            end
     end;
 handle_request_frame(Ref, {container, ContainerCommand}, State) ->
     logger:warning("[ws_channel] unsupported request message type: container, ref: ~p, command: ~p", [Ref, ContainerCommand]),