fix ssl_channel

docs/efka_iot_protocol.md

@@ -47,16 +47,17 @@
 }}}
 ```
 
-`iot` 鉴权成功时回复：
+`iot` 回复：
 
 ```erlang
 {response, Ref, {auth_response, ok}}
+{response, Ref, {auth_response, {error, {failed, Reason}}}}
 ```
 
 处理语义：
 
 - `ok`：`efka` 进入 `activated` 状态。
-- 鉴权失败、host 不存在、host 未启动或 attach channel 失败时，`iot` 不返回业务错误响应，直接关闭连接；`efka` 通过 socket close/error 或 auth timeout 进入重连流程。
+- `{error, {failed, Reason}}`：鉴权失败，`iot` 返回失败响应后关闭连接；`efka` 进入重连流程。
 
 ## 授权控制
 

src/transport/tcp/ssl_channel.erl

@@ -181,12 +181,19 @@ handle_request_frame(Ref, {auth_request, #{uuid := UUID, token := Token, timesta
         {ok, HostPid} ?= iot_host:lookup_pid(UUID),
         ok ?= iot_host:attach_channel(HostPid, self()),
         erlang:monitor(process, HostPid),
-        ok ?= send_reply_frame(Transport, Socket, Ref, {auth_response, ok}),
+        ok = send_reply_frame(Transport, Socket, Ref, {auth_response, ok}),
         logger:debug("[ws_channel] auth uuid: ~p", [UUID]),
         {noreply, State#state{uuid = UUID, is_authed = true, host_pid = HostPid}}
-    else {error, Reason} ->
+    else
+        {error, Reason} ->
             logger:warning("[ws_channel] uuid: ~p, auth failed with reason: ~p", [UUID, Reason]),
-        {stop, Reason, State}
+            case send_reply_frame(Transport, Socket, Ref, {auth_response, {error, {failed, Reason}}}) of
+                ok ->
+                    {stop, Reason, State};
+                {error, SendReason} ->
+                    logger:warning("[ws_channel] uuid: ~p, send auth failed response failed: ~p", [UUID, SendReason]),
+                    {stop, {send_failed, SendReason}, State}
+            end
     end;
 handle_request_frame(Ref, {container, ContainerCommand}, State) ->
     logger:warning("[ws_channel] unsupported request message type: container, ref: ~p, command: ~p", [Ref, ContainerCommand]),