tauri_plugin_network_manager/

desktop.rs

use std::collections::HashMap;
use std::sync::mpsc;
use tauri::{plugin::PluginApi, AppHandle, Runtime};
use uuid::Uuid;
use zbus::names::InterfaceName;
use zbus::zvariant::Value;

use crate::error::Result;
use crate::models::*;
use crate::nm_helpers::NetworkManagerHelpers;

impl<R: Runtime> VSKNetworkManager<'static, R> {
    fn vpn_type_from_service_type(service_type: &str) -> VpnType {
        match service_type {
            "org.freedesktop.NetworkManager.openvpn" => VpnType::OpenVpn,
            "org.freedesktop.NetworkManager.wireguard" => VpnType::WireGuard,
            "org.freedesktop.NetworkManager.l2tp" => VpnType::L2tp,
            "org.freedesktop.NetworkManager.pptp" => VpnType::Pptp,
            "org.freedesktop.NetworkManager.sstp" => VpnType::Sstp,
            "org.freedesktop.NetworkManager.strongswan" => VpnType::Ikev2,
            "org.freedesktop.NetworkManager.fortisslvpn" => VpnType::Fortisslvpn,
            "org.freedesktop.NetworkManager.openconnect" => VpnType::OpenConnect,
            _ => VpnType::Generic,
        }
    }

    fn service_type_from_vpn_type(vpn_type: &VpnType) -> &'static str {
        match vpn_type {
            VpnType::OpenVpn => "org.freedesktop.NetworkManager.openvpn",
            VpnType::WireGuard => "org.freedesktop.NetworkManager.wireguard",
            VpnType::L2tp => "org.freedesktop.NetworkManager.l2tp",
            VpnType::Pptp => "org.freedesktop.NetworkManager.pptp",
            VpnType::Sstp => "org.freedesktop.NetworkManager.sstp",
            VpnType::Ikev2 => "org.freedesktop.NetworkManager.strongswan",
            VpnType::Fortisslvpn => "org.freedesktop.NetworkManager.fortisslvpn",
            VpnType::OpenConnect => "org.freedesktop.NetworkManager.openconnect",
            VpnType::Generic => "org.freedesktop.NetworkManager.vpnc",
        }
    }

    fn vpn_state_from_active_state(state: u32) -> VpnConnectionState {
        match state {
            1 => VpnConnectionState::Connecting,
            2 => VpnConnectionState::Connected,
            3 => VpnConnectionState::Disconnecting,
            4 => VpnConnectionState::Disconnected,
            _ => VpnConnectionState::Unknown,
        }
    }

    fn extract_string_from_dict(
        dict: &HashMap<String, zbus::zvariant::OwnedValue>,
        key: &str,
    ) -> Option<String> {
        let value = dict.get(key)?;
        let v: &zbus::zvariant::Value<'_> = value;
        v.downcast_ref::<String>().ok()
    }

    fn extract_bool_from_dict(
        dict: &HashMap<String, zbus::zvariant::OwnedValue>,
        key: &str,
    ) -> Option<bool> {
        let value = dict.get(key)?;
        let v: &zbus::zvariant::Value<'_> = value;
        v.downcast_ref::<bool>().ok()
    }

    fn string_map_from_section(
        settings: &HashMap<String, HashMap<String, zbus::zvariant::OwnedValue>>,
        section_name: &str,
    ) -> HashMap<String, String> {
        let mut out = HashMap::new();
        let section = match settings.get(section_name) {
            Some(v) => v,
            None => return out,
        };

        for (k, v) in section {
            let val: &zbus::zvariant::Value<'_> = v;
            if let Ok(s) = val.downcast_ref::<String>() {
                out.insert(k.clone(), s);
            }
        }
        out
    }

    fn list_connection_paths(&self) -> Result<Vec<zbus::zvariant::OwnedObjectPath>> {
        let settings_proxy = zbus::blocking::Proxy::new(
            &self.connection,
            "org.freedesktop.NetworkManager",
            "/org/freedesktop/NetworkManager/Settings",
            "org.freedesktop.NetworkManager.Settings",
        )?;

        let connections: Vec<zbus::zvariant::OwnedObjectPath> =
            settings_proxy.call("ListConnections", &())?;
        Ok(connections)
    }

    fn get_connection_settings(
        &self,
        conn_path: &zbus::zvariant::OwnedObjectPath,
    ) -> Result<HashMap<String, HashMap<String, zbus::zvariant::OwnedValue>>> {
        let conn_proxy = zbus::blocking::Proxy::new(
            &self.connection,
            "org.freedesktop.NetworkManager",
            conn_path.as_str(),
            "org.freedesktop.NetworkManager.Settings.Connection",
        )?;

        let settings: HashMap<String, HashMap<String, zbus::zvariant::OwnedValue>> =
            conn_proxy.call("GetSettings", &())?;
        Ok(settings)
    }

    fn find_connection_path_by_uuid(&self, uuid: &str) -> Result<zbus::zvariant::OwnedObjectPath> {
        let connections = self.list_connection_paths()?;

        for conn_path in connections {
            let settings = self.get_connection_settings(&conn_path)?;
            let dict = match settings.get("connection") {
                Some(v) => v,
                None => continue,
            };

            if let Some(conn_uuid) = Self::extract_string_from_dict(dict, "uuid") {
                if conn_uuid == uuid {
                    return Ok(conn_path);
                }
            }
        }

        Err(crate::error::NetworkError::VpnProfileNotFound(
            uuid.to_string(),
        ))
    }

    fn vpn_profile_from_settings(
        &self,
        settings: &HashMap<String, HashMap<String, zbus::zvariant::OwnedValue>>,
    ) -> Option<VpnProfile> {
        let connection_dict = settings.get("connection")?;

        let conn_type = Self::extract_string_from_dict(connection_dict, "type")?;
        if conn_type != "vpn" {
            return None;
        }

        let uuid = Self::extract_string_from_dict(connection_dict, "uuid")?;
        let id =
            Self::extract_string_from_dict(connection_dict, "id").unwrap_or_else(|| uuid.clone());
        let interface_name = Self::extract_string_from_dict(connection_dict, "interface-name");
        let autoconnect =
            Self::extract_bool_from_dict(connection_dict, "autoconnect").unwrap_or(false);

        let vpn_settings = Self::string_map_from_section(settings, "vpn");
        let service_type = vpn_settings
            .get("service-type")
            .map(|s| s.as_str())
            .unwrap_or("unknown");

        Some(VpnProfile {
            id,
            uuid,
            vpn_type: Self::vpn_type_from_service_type(service_type),
            interface_name,
            autoconnect,
            editable: true,
            last_error: None,
        })
    }

    /// Get WiFi icon based on signal strength
    fn get_wifi_icon(strength: u8) -> String {
        match strength {
            0..=25 => "network-wireless-signal-weak-symbolic".to_string(),
            26..=50 => "network-wireless-signal-ok-symbolic".to_string(),
            51..=75 => "network-wireless-signal-good-symbolic".to_string(),
            76..=100 => "network-wireless-signal-excellent-symbolic".to_string(),
            _ => "network-wireless-signal-none-symbolic".to_string(),
        }
    }

    /// The icon for anything that is not Wi-Fi.
    ///
    /// Ethernet is one of these, not all of them: a VPN tunnel, a mobile modem
    /// or a bridge are their own thing, and showing a cable for them tells the
    /// person something untrue about how they are connected.
    fn get_icon_for(connection_type: &str, is_connected: bool) -> String {
        if !is_connected {
            return "network-offline-symbolic".to_string();
        }

        match connection_type {
            "Ethernet" => "network-wired-symbolic".to_string(),
            "Modem" => "network-cellular-connected-symbolic".to_string(),
            "VPN" | "WireGuard" => "network-vpn-symbolic".to_string(),
            _ => "network-transmit-receive-symbolic".to_string(),
        }
    }

    /// Create a new VSKNetworkManager instance
    pub fn new(app: AppHandle<R>) -> Result<Self> {
        let connection = zbus::blocking::Connection::system()?;
        let proxy = zbus::blocking::fdo::PropertiesProxy::builder(&connection)
            .destination("org.freedesktop.NetworkManager")?
            .path("/org/freedesktop/NetworkManager")?
            .build()?;

        Ok(Self {
            connection,
            proxy,
            app,
        })
    }

    /// The connection the panel should describe: the one carrying the default
    /// route, which is what NetworkManager calls the primary connection.
    ///
    /// Taking `ActiveConnections[0]` instead is how a laptop on Wi-Fi ended up
    /// showing the wired icon: that list is in no particular order and holds
    /// everything active — the loopback, a VPN tunnel, a bridge — so the panel
    /// was describing whichever one happened to be first. On the machine this
    /// was found on it was a `tun`, whose device type is neither ethernet nor
    /// Wi-Fi, and everything that is not Wi-Fi used to be painted as wired.
    fn primary_connection_path(&self) -> Option<zbus::zvariant::OwnedObjectPath> {
        let primary = self
            .proxy
            .get(
                InterfaceName::from_static_str_unchecked("org.freedesktop.NetworkManager"),
                "PrimaryConnection",
            )
            .ok()?;

        match primary.downcast_ref() {
            // "/" is NetworkManager for "there is no default route right now",
            // and then there is nothing to prefer over the active list.
            Ok(Value::ObjectPath(path)) if path.as_str() != "/" => Some(path.into()),
            _ => None,
        }
    }

    pub fn get_current_network_state(&self) -> Result<NetworkInfo> {
        // Get active connections
        let active_connections_variant = self.proxy.get(
            InterfaceName::from_static_str_unchecked("org.freedesktop.NetworkManager"),
            "ActiveConnections",
        )?;

        let primary = self.primary_connection_path();

        // If no active connections, return default
        match active_connections_variant.downcast_ref() {
            Ok(Value::Array(arr)) if !arr.is_empty() => {
                let chosen = match (&primary, &arr[0]) {
                    (Some(path), _) => path.as_ref().to_owned(),
                    (None, Value::ObjectPath(path)) => path.to_owned(),
                    _ => return Ok(NetworkInfo::default()),
                };
                let chosen = Value::ObjectPath(chosen);

                match chosen {
                    zbus::zvariant::Value::ObjectPath(ref path) => {
                        // Get devices for this connection
                        // Crear un proxy de propiedades para obtener las propiedades
                        let properties_proxy =
                            zbus::blocking::fdo::PropertiesProxy::builder(&self.connection)
                                .destination("org.freedesktop.NetworkManager")?
                                .path(path)?
                                .build()?;

                        let devices_variant = properties_proxy.get(
                            InterfaceName::from_static_str_unchecked(
                                "org.freedesktop.NetworkManager.Connection.Active",
                            ),
                            "Devices",
                        )?;

                        // Get the first device (if available)
                        let device_path = match devices_variant.downcast_ref() {
                            Ok(Value::Array(device_arr)) if !device_arr.is_empty() => {
                                match device_arr[0] {
                                    zbus::zvariant::Value::ObjectPath(ref dev_path) => {
                                        dev_path.clone()
                                    }
                                    _ => return Ok(NetworkInfo::default()),
                                }
                            }
                            _ => return Ok(NetworkInfo::default()),
                        };

                        // Retrieve connection details
                        // Crear un proxy de propiedades para el dispositivo
                        let device_properties_proxy =
                            zbus::blocking::fdo::PropertiesProxy::builder(&self.connection)
                                .destination("org.freedesktop.NetworkManager")?
                                .path(&device_path)?
                                .build()?;

                        let connection_type = device_properties_proxy.get(
                            InterfaceName::from_static_str_unchecked(
                                "org.freedesktop.NetworkManager.Device",
                            ),
                            "DeviceType",
                        )?;

                        let state_variant = properties_proxy.get(
                            InterfaceName::from_static_str_unchecked(
                                "org.freedesktop.NetworkManager.Connection.Active",
                            ),
                            "State",
                        )?;

                        let is_connected = match state_variant.downcast_ref() {
                            Ok(zbus::zvariant::Value::U32(state)) => state == 2, // 2 = ACTIVATED
                            _ => false,
                        };

                        // Determine connection type. The numbers are
                        // NMDeviceType; the ones named here are the ones with an
                        // icon of their own, and anything else stays "Unknown"
                        // rather than being drawn as something it is not.
                        let connection_type_str = match connection_type.downcast_ref() {
                            Ok(zbus::zvariant::Value::U32(device_type)) => match device_type {
                                1 => "Ethernet".to_string(),
                                2 => "WiFi".to_string(),
                                8 => "Modem".to_string(),
                                16 => "VPN".to_string(),
                                29 => "WireGuard".to_string(),
                                _ => "Unknown".to_string(),
                            },
                            _ => "Unknown".to_string(),
                        };

                        // Default network info
                        let mut network_info = NetworkInfo {
                            name: "Unknown".to_string(),
                            ssid: "Unknown".to_string(),
                            connection_type: connection_type_str.clone(),
                            icon: "network-offline-symbolic".to_string(),
                            ip_address: "0.0.0.0".to_string(),
                            mac_address: "00:00:00:00:00:00".to_string(),
                            signal_strength: 0,
                            security_type: WiFiSecurityType::None,
                            is_connected: is_connected
                                && NetworkManagerHelpers::has_internet_connectivity(&self.proxy)?,
                        };

                        let hw_address_variant = device_properties_proxy.get(
                            InterfaceName::from_static_str_unchecked(
                                "org.freedesktop.NetworkManager.Device",
                            ),
                            "HwAddress",
                        )?;

                        network_info.mac_address = match hw_address_variant.downcast_ref() {
                            Ok(zbus::zvariant::Value::Str(s)) => s.to_string(),
                            _ => "00:00:00:00:00:00".to_string(),
                        };

                        // For WiFi networks, get additional details
                        if connection_type_str == "WiFi" {
                            // Get active access point
                            // Crear un proxy de propiedades para el dispositivo inalámbrico
                            let wireless_properties_proxy =
                                zbus::blocking::fdo::PropertiesProxy::builder(&self.connection)
                                    .destination("org.freedesktop.NetworkManager")?
                                    .path(&device_path)?
                                    .build()?;

                            let active_ap_path = wireless_properties_proxy.get(
                                InterfaceName::from_static_str_unchecked(
                                    "org.freedesktop.NetworkManager.Device.Wireless",
                                ),
                                "ActiveAccessPoint",
                            )?;

                            if let Ok(zbus::zvariant::Value::ObjectPath(ap_path)) =
                                active_ap_path.downcast_ref()
                            {
                                let _ap_proxy = zbus::blocking::Proxy::new(
                                    &self.connection,
                                    "org.freedesktop.NetworkManager",
                                    &ap_path,
                                    "org.freedesktop.NetworkManager.AccessPoint",
                                )?;

                                // Get SSID
                                // Crear un proxy de propiedades para el punto de acceso
                                let ap_properties_proxy =
                                    zbus::blocking::fdo::PropertiesProxy::builder(&self.connection)
                                        .destination("org.freedesktop.NetworkManager")?
                                        .path(ap_path.as_str())?
                                        .build()?;

                                let ssid_variant = ap_properties_proxy.get(
                                    InterfaceName::from_static_str_unchecked(
                                        "org.freedesktop.NetworkManager.AccessPoint",
                                    ),
                                    "Ssid",
                                )?;

                                network_info.ssid = match ssid_variant.downcast_ref() {
                                    Ok(v) => NetworkManagerHelpers::ssid_from_value(&v),
                                    _ => "Unknown".to_string(),
                                };
                                network_info.name = network_info.ssid.clone();

                                // Get signal strength
                                let strength_variant = ap_properties_proxy.get(
                                    InterfaceName::from_static_str_unchecked(
                                        "org.freedesktop.NetworkManager.AccessPoint",
                                    ),
                                    "Strength",
                                )?;

                                network_info.signal_strength = match strength_variant.downcast_ref()
                                {
                                    Ok(zbus::zvariant::Value::U8(s)) => s,
                                    _ => 0,
                                };

                                // Update icon based on signal strength
                                network_info.icon =
                                    Self::get_wifi_icon(network_info.signal_strength);

                                // Determine security type using helper
                                network_info.security_type =
                                    NetworkManagerHelpers::detect_security_type(
                                        &ap_properties_proxy,
                                    )?;
                            }
                        } else {
                            // Everything that is not Wi-Fi used to be drawn as
                            // an ethernet cable, tunnels and modems included.
                            network_info.icon =
                                Self::get_icon_for(&connection_type_str, network_info.is_connected);
                        }
                        // Get IP configuration
                        let ip4_config_path = device_properties_proxy.get(
                            InterfaceName::from_static_str_unchecked(
                                "org.freedesktop.NetworkManager.Device",
                            ),
                            "Ip4Config",
                        )?;

                        // Retrieve IP address if available
                        if let Ok(zbus::zvariant::Value::ObjectPath(config_path)) =
                            ip4_config_path.downcast_ref()
                        {
                            // Crear un proxy de propiedades para la configuración IP
                            let ip_config_properties_proxy =
                                zbus::blocking::fdo::PropertiesProxy::builder(&self.connection)
                                    .destination("org.freedesktop.NetworkManager")?
                                    .path(config_path)?
                                    .build()?;

                            let addresses_variant = ip_config_properties_proxy.get(
                                InterfaceName::from_static_str_unchecked(
                                    "org.freedesktop.NetworkManager.IP4Config",
                                ),
                                "Addresses",
                            )?;

                            if let Ok(Value::Array(addr_arr)) = addresses_variant.downcast_ref() {
                                if let Some(Value::Array(ip_tuple)) = addr_arr.first() {
                                    if !ip_tuple.is_empty() {
                                        if let Value::U32(ip_int) = &ip_tuple[0] {
                                            use std::net::Ipv4Addr;
                                            network_info.ip_address =
                                                Ipv4Addr::from((*ip_int).to_be()).to_string();
                                        }
                                    }
                                }
                            }
                        }

                        Ok(network_info)
                    }
                    _ => Ok(NetworkInfo::default()),
                }
            }
            _ => Ok(NetworkInfo::default()),
        }
    }

    /// Lightweight: get the SSID of the currently connected access point (if any).
    /// Avoids the ~10 D-Bus calls that `get_current_network_state()` makes.
    fn connected_wifi_ssid(&self) -> Result<Option<String>> {
        let devices = self.wireless_device_paths()?;
        for device_path in &devices {
            let wireless_props = zbus::blocking::fdo::PropertiesProxy::builder(&self.connection)
                .destination("org.freedesktop.NetworkManager")?
                .path(device_path.as_str())?
                .build()?;

            let active_ap = wireless_props.get(
                InterfaceName::from_static_str_unchecked(
                    "org.freedesktop.NetworkManager.Device.Wireless",
                ),
                "ActiveAccessPoint",
            )?;

            if let Ok(zbus::zvariant::Value::ObjectPath(ap_path)) = active_ap.downcast_ref() {
                if ap_path.as_str() == "/" {
                    continue;
                }
                let ap_props = zbus::blocking::fdo::PropertiesProxy::builder(&self.connection)
                    .destination("org.freedesktop.NetworkManager")?
                    .path(ap_path.as_str())?
                    .build()?;

                let ssid_variant = ap_props.get(
                    InterfaceName::from_static_str_unchecked(
                        "org.freedesktop.NetworkManager.AccessPoint",
                    ),
                    "Ssid",
                )?;

                if let Ok(v) = ssid_variant.downcast_ref() {
                    let ssid = NetworkManagerHelpers::ssid_from_value(&v);
                    if !ssid.is_empty() && ssid != "Unknown" {
                        return Ok(Some(ssid));
                    }
                }
            }
        }
        Ok(None)
    }

    /// List available WiFi networks
    pub fn list_wifi_networks(&self) -> Result<Vec<NetworkInfo>> {
        let devices_variant = self.proxy.get(
            InterfaceName::from_static_str_unchecked("org.freedesktop.NetworkManager"),
            "Devices",
        )?;

        let mut networks = Vec::new();
        let connected_ssid = self.connected_wifi_ssid()?;

        if let Ok(zbus::zvariant::Value::Array(devices)) = devices_variant.downcast_ref() {
            for device in devices.iter() {
                if let zbus::zvariant::Value::ObjectPath(ref device_path) = device {
                    let device_props =
                        zbus::blocking::fdo::PropertiesProxy::builder(&self.connection)
                            .destination("org.freedesktop.NetworkManager")?
                            .path(device_path)?
                            .build()?;

                    let device_type_variant = device_props.get(
                        InterfaceName::from_static_str_unchecked(
                            "org.freedesktop.NetworkManager.Device",
                        ),
                        "DeviceType",
                    )?;

                    if let Ok(zbus::zvariant::Value::U32(device_type)) =
                        device_type_variant.downcast_ref()
                    {
                        if device_type == 2u32 {
                            let mac_address = match device_props
                                .get(
                                    InterfaceName::from_static_str_unchecked(
                                        "org.freedesktop.NetworkManager.Device",
                                    ),
                                    "HwAddress",
                                )?
                                .downcast_ref()
                            {
                                Ok(zbus::zvariant::Value::Str(s)) => s.to_string(),
                                _ => "00:00:00:00:00:00".to_string(),
                            };

                            let wireless_props =
                                zbus::blocking::fdo::PropertiesProxy::builder(&self.connection)
                                    .destination("org.freedesktop.NetworkManager")?
                                    .path(device_path)?
                                    .build()?;

                            let access_points_variant = wireless_props.get(
                                InterfaceName::from_static_str_unchecked(
                                    "org.freedesktop.NetworkManager.Device.Wireless",
                                ),
                                "AccessPoints",
                            )?;

                            if let Ok(zbus::zvariant::Value::Array(aps)) =
                                access_points_variant.downcast_ref()
                            {
                                for ap in aps.iter() {
                                    if let zbus::zvariant::Value::ObjectPath(ref ap_path) = ap {
                                        let ap_props =
                                            zbus::blocking::fdo::PropertiesProxy::builder(
                                                &self.connection,
                                            )
                                            .destination("org.freedesktop.NetworkManager")?
                                            .path(ap_path)?
                                            .build()?;

                                        let ssid_variant = ap_props.get(
                                            InterfaceName::from_static_str_unchecked(
                                                "org.freedesktop.NetworkManager.AccessPoint",
                                            ),
                                            "Ssid",
                                        )?;

                                        let ssid = match ssid_variant.downcast_ref() {
                                            Ok(v) => NetworkManagerHelpers::ssid_from_value(&v),
                                            _ => "Unknown".to_string(),
                                        };

                                        let strength_variant = ap_props.get(
                                            InterfaceName::from_static_str_unchecked(
                                                "org.freedesktop.NetworkManager.AccessPoint",
                                            ),
                                            "Strength",
                                        )?;

                                        let strength = match strength_variant.downcast_ref() {
                                            Ok(zbus::zvariant::Value::U8(s)) => s,
                                            _ => 0,
                                        };

                                        let security_type =
                                            NetworkManagerHelpers::detect_security_type(&ap_props)?;

                                        let is_connected =
                                            connected_ssid.as_deref() == Some(ssid.as_str());

                                        let network_info = NetworkInfo {
                                            name: ssid.clone(),
                                            ssid,
                                            connection_type: "wifi".to_string(),
                                            icon: Self::get_wifi_icon(strength),
                                            ip_address: "0.0.0.0".to_string(),
                                            mac_address: mac_address.clone(),
                                            signal_strength: strength,
                                            security_type,
                                            is_connected,
                                        };

                                        if !networks
                                            .iter()
                                            .any(|n: &NetworkInfo| n.ssid == network_info.ssid)
                                        {
                                            networks.push(network_info);
                                        }
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }

        // De mayor a menor señal.
        networks.sort_by_key(|red| std::cmp::Reverse(red.signal_strength));
        Ok(networks)
    }

    /// Collect paths of all wireless (type=2) devices from NetworkManager
    fn wireless_device_paths(&self) -> Result<Vec<zbus::zvariant::OwnedObjectPath>> {
        let devices_variant = self.proxy.get(
            InterfaceName::from_static_str_unchecked("org.freedesktop.NetworkManager"),
            "Devices",
        )?;

        let mut paths = Vec::new();
        if let Ok(zbus::zvariant::Value::Array(devices)) = devices_variant.downcast_ref() {
            for device in devices.iter() {
                if let zbus::zvariant::Value::ObjectPath(device_path) = device {
                    let device_props =
                        zbus::blocking::fdo::PropertiesProxy::builder(&self.connection)
                            .destination("org.freedesktop.NetworkManager")?
                            .path(device_path.as_str())?
                            .build()?;

                    let device_type_variant = device_props.get(
                        InterfaceName::from_static_str_unchecked(
                            "org.freedesktop.NetworkManager.Device",
                        ),
                        "DeviceType",
                    )?;

                    if let Ok(zbus::zvariant::Value::U32(device_type)) =
                        device_type_variant.downcast_ref()
                    {
                        if device_type == 2u32 {
                            let owned =
                                zbus::zvariant::OwnedObjectPath::try_from(device_path.as_str())
                                    .unwrap();
                            paths.push(owned);
                        }
                    }
                }
            }
        }
        Ok(paths)
    }

    /// ¿El barrido ya terminó? NetworkManager marca el fin subiendo `LastScan`
    /// por encima del valor que tenía antes de que lo pidiéramos. `-1` es "nunca
    /// escaneó", así que nunca cuenta como terminado: seguimos esperando.
    fn scan_settled(before: i64, current: i64) -> bool {
        current != -1 && current != before
    }

    /// Lee `LastScan` (milisegundos de CLOCK_BOOTTIME, `-1` si nunca) de un
    /// dispositivo inalámbrico. Cualquier fallo de lectura se devuelve como `-1`
    /// para que el que espera siga esperando en vez de darse por satisfecho con
    /// una lista a medio cocinar.
    fn read_last_scan(props: &zbus::blocking::fdo::PropertiesProxy) -> i64 {
        match props.get(
            InterfaceName::from_static_str_unchecked(
                "org.freedesktop.NetworkManager.Device.Wireless",
            ),
            "LastScan",
        ) {
            Ok(value) => match value.downcast_ref() {
                Ok(zbus::zvariant::Value::I64(last)) => last,
                _ => -1,
            },
            Err(_) => -1,
        }
    }

    /// Request an explicit WiFi scan through NetworkManager and return a fresh list.
    ///
    /// `RequestScan` es "dispará y olvidate": NetworkManager arranca el barrido en
    /// segundo plano y contesta en el acto, mientras el rastreo real tarda varios
    /// segundos. Antes leíamos los `AccessPoints` apenas contestaba —o sea, la
    /// lista del barrido *anterior*, vacía recién encendido el WiFi—, y por eso
    /// "no encontraba nada". Ahora esperamos a que `LastScan` avance antes de leer.
    pub fn rescan_wifi(&self) -> Result<Vec<NetworkInfo>> {
        const SCAN_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(10);
        const SCAN_POLL: std::time::Duration = std::time::Duration::from_millis(300);

        let devices = self.wireless_device_paths()?;

        if devices.is_empty() {
            return Err(crate::error::NetworkError::OperationError(
                "No wireless device available for scanning".to_string(),
            ));
        }

        // ¿Algún dispositivo llegó a completar un barrido? Si ninguno lo hizo,
        // la lista que devolveríamos sería la vieja, y el contrato del comando es
        // entregar una fresca: en ese caso es un error, no un éxito con datos
        // rancios.
        let mut any_settled = false;

        for device_path in &devices {
            let wireless_props = zbus::blocking::fdo::PropertiesProxy::builder(&self.connection)
                .destination("org.freedesktop.NetworkManager")?
                .path(device_path.as_str())?
                .build()?;

            // Desde qué barrido estamos esperando el siguiente.
            let last_scan_before = Self::read_last_scan(&wireless_props);

            let wireless_proxy = zbus::blocking::Proxy::new(
                &self.connection,
                "org.freedesktop.NetworkManager",
                device_path.as_str(),
                "org.freedesktop.NetworkManager.Device.Wireless",
            )?;

            // `RequestScan` puede negarse si ya hay un barrido en curso o si el
            // anterior fue hace muy poco. En los dos casos igual queremos esperar
            // a que `LastScan` avance y leer recién entonces, así que no es un
            // error: lo ignoramos a propósito.
            let options: HashMap<String, zbus::zvariant::OwnedValue> = HashMap::new();
            let _ = wireless_proxy.call::<_, _, ()>("RequestScan", &(options,));

            // Esperar a que el barrido termine antes de leer la lista.
            let deadline = std::time::Instant::now() + SCAN_TIMEOUT;
            while std::time::Instant::now() < deadline {
                if Self::scan_settled(last_scan_before, Self::read_last_scan(&wireless_props)) {
                    any_settled = true;
                    break;
                }
                std::thread::sleep(SCAN_POLL);
            }
        }

        if !any_settled {
            return Err(crate::error::NetworkError::OperationError(
                "WiFi scan did not complete on any wireless device".to_string(),
            ));
        }

        self.list_wifi_networks()
    }

    /// Connect to a WiFi network
    pub fn connect_to_wifi(&self, config: WiFiConnectionConfig) -> Result<()> {
        // Log connection attempt. No se loguea el usuario: en WPA-Enterprise es
        // una credencial, y un log de depuración no es lugar para credenciales.
        // Se registra sólo si vino uno, no cuál.
        log::debug!(
            "connect_to_wifi called: ssid='{}' security={:?} has_username={}",
            config.ssid,
            config.security_type,
            config.username.is_some()
        );

        // Create connection settings
        let mut connection_settings = HashMap::new();
        let mut wifi_settings = HashMap::new();
        let mut security_settings = HashMap::new();

        // Set connection name and type
        let mut connection = HashMap::new();
        connection.insert("id".to_string(), Value::from(config.ssid.clone()));
        connection.insert("type".to_string(), Value::from("802-11-wireless"));
        connection_settings.insert("connection".to_string(), connection);

        // Set WiFi settings
        wifi_settings.insert(
            "ssid".to_string(),
            Value::from(config.ssid.as_bytes().to_vec()),
        );
        wifi_settings.insert("mode".to_string(), Value::from("infrastructure"));

        // Set security settings based on security type
        match config.security_type {
            WiFiSecurityType::None => {
                // No security settings needed
            }
            WiFiSecurityType::Wep => {
                security_settings.insert("key-mgmt".to_string(), Value::from("none"));
                if let Some(password) = config.password.clone() {
                    security_settings.insert("wep-key0".to_string(), Value::from(password));
                }
            }
            WiFiSecurityType::WpaPsk => {
                security_settings.insert("key-mgmt".to_string(), Value::from("wpa-psk"));
                if let Some(password) = config.password.clone() {
                    security_settings.insert("psk".to_string(), Value::from(password));
                }
            }
            WiFiSecurityType::WpaEap => {
                security_settings.insert("key-mgmt".to_string(), Value::from("wpa-eap"));
                if let Some(password) = config.password.clone() {
                    security_settings.insert("password".to_string(), Value::from(password));
                }
                if let Some(username) = config.username.clone() {
                    security_settings.insert("identity".to_string(), Value::from(username));
                }
            }
            WiFiSecurityType::Wpa2Psk => {
                security_settings.insert("key-mgmt".to_string(), Value::from("wpa-psk"));
                security_settings.insert("proto".to_string(), Value::from(vec!["rsn"]));
                if let Some(password) = config.password.clone() {
                    security_settings.insert("psk".to_string(), Value::from(password));
                }
            }
            WiFiSecurityType::Wpa3Psk => {
                security_settings.insert("key-mgmt".to_string(), Value::from("sae"));
                if let Some(password) = config.password.clone() {
                    security_settings.insert("psk".to_string(), Value::from(password));
                }
            }
        }

        connection_settings.insert("802-11-wireless".to_string(), wifi_settings);
        if !security_settings.is_empty() {
            connection_settings.insert("802-11-wireless-security".to_string(), security_settings);
        }

        // Log constructed settings for debugging
        log::debug!("connection_settings: {:#?}", connection_settings);

        // Crear un proxy para NetworkManager
        let nm_proxy = zbus::blocking::Proxy::new(
            &self.connection,
            "org.freedesktop.NetworkManager",
            "/org/freedesktop/NetworkManager",
            "org.freedesktop.NetworkManager",
        )?;

        // Llamar al método AddAndActivateConnection con autoselección de NM
        let any_path = zbus::zvariant::OwnedObjectPath::try_from("/").unwrap();
        let call_result: zbus::Result<(
            zbus::zvariant::OwnedObjectPath,
            zbus::zvariant::OwnedObjectPath,
        )> = nm_proxy.call(
            "AddAndActivateConnection",
            &(connection_settings, &any_path, &any_path),
        );

        match call_result {
            Ok((conn_path, active_path)) => {
                log::info!(
                    "AddAndActivateConnection succeeded for ssid='{}' conn='{}' active='{}'",
                    config.ssid,
                    conn_path.as_str(),
                    active_path.as_str()
                );
            }
            Err(e) => {
                log::error!(
                    "AddAndActivateConnection failed for ssid='{}': {:?}",
                    config.ssid,
                    e
                );
                return Err(e.into());
            }
        }

        log::debug!("connect_to_wifi finished for ssid='{}'", config.ssid);

        Ok(())
    }

    /// Toggle network state
    pub fn toggle_network_state(&self, enabled: bool) -> Result<bool> {
        let nm_proxy = zbus::blocking::Proxy::new(
            &self.connection,
            "org.freedesktop.NetworkManager",
            "/org/freedesktop/NetworkManager",
            "org.freedesktop.NetworkManager",
        )?;

        nm_proxy.set_property("NetworkingEnabled", enabled)?;

        let current_state: bool = nm_proxy.get_property("NetworkingEnabled")?;
        Ok(current_state)
    }

    /// Get wireless enabled state
    pub fn get_wireless_enabled(&self) -> Result<bool> {
        let nm_proxy = zbus::blocking::Proxy::new(
            &self.connection,
            "org.freedesktop.NetworkManager",
            "/org/freedesktop/NetworkManager",
            "org.freedesktop.NetworkManager",
        )?;
        Ok(nm_proxy.get_property("WirelessEnabled")?)
    }

    /// Set wireless enabled state
    pub fn set_wireless_enabled(&self, enabled: bool) -> Result<()> {
        let nm_proxy = zbus::blocking::Proxy::new(
            &self.connection,
            "org.freedesktop.NetworkManager",
            "/org/freedesktop/NetworkManager",
            "org.freedesktop.NetworkManager",
        )?;
        nm_proxy.set_property("WirelessEnabled", enabled)?;
        Ok(())
    }

    /// Check if wireless device is available
    pub fn is_wireless_available(&self) -> Result<bool> {
        Ok(!self.wireless_device_paths()?.is_empty())
    }

    /// Listen for network changes
    pub fn listen_network_changes(&self) -> Result<mpsc::Receiver<NetworkInfo>> {
        let (tx, rx) = mpsc::channel();
        let connection_clone = self.connection.clone();
        let app_handle = self.app.clone();

        std::thread::spawn(move || {
            if let Ok(proxy) = zbus::blocking::Proxy::new(
                &connection_clone,
                "org.freedesktop.NetworkManager",
                "/org/freedesktop/NetworkManager",
                "org.freedesktop.NetworkManager",
            ) {
                if let Ok(signal) = proxy.receive_signal("StateChanged") {
                    let proxy_props =
                        zbus::blocking::fdo::PropertiesProxy::builder(&connection_clone)
                            .destination("org.freedesktop.NetworkManager")
                            .unwrap()
                            .path("/org/freedesktop/NetworkManager")
                            .unwrap()
                            .build()
                            .unwrap();

                    for _msg in signal {
                        let network_manager = VSKNetworkManager {
                            connection: connection_clone.clone(),
                            proxy: proxy_props.clone(),
                            app: app_handle.clone(),
                        };

                        if let Ok(network_info) = network_manager.get_current_network_state() {
                            if tx.send(network_info).is_err() {
                                break;
                            }
                        }
                    }
                }
            }
        });

        Ok(rx)
    }

    /// Disconnect from the current WiFi network
    pub fn disconnect_from_wifi(&self) -> Result<()> {
        let nm_proxy = zbus::blocking::Proxy::new(
            &self.connection,
            "org.freedesktop.NetworkManager",
            "/org/freedesktop/NetworkManager",
            "org.freedesktop.NetworkManager",
        )?;

        // Obtener las conexiones activas
        let active_connections_variant: zbus::zvariant::OwnedValue = self.proxy.get(
            InterfaceName::from_static_str_unchecked("org.freedesktop.NetworkManager"),
            "ActiveConnections",
        )?;

        // Convertir el valor a un vector de ObjectPath
        let active_connections = match active_connections_variant.downcast_ref() {
            Ok(zbus::zvariant::Value::Array(arr)) => arr
                .iter()
                .filter_map(|v| match v {
                    zbus::zvariant::Value::ObjectPath(path) => {
                        Some(zbus::zvariant::OwnedObjectPath::from(path.to_owned()))
                    }
                    _ => None,
                })
                .collect::<Vec<zbus::zvariant::OwnedObjectPath>>(),
            _ => Vec::new(),
        };

        if !active_connections.is_empty() {
            nm_proxy.call::<_, _, ()>("DeactivateConnection", &(&active_connections[0],))?;
            Ok(())
        } else {
            Ok(())
        }
    }

    /// Get the list of saved WiFi networks
    pub fn get_saved_wifi_networks(&self) -> Result<Vec<NetworkInfo>> {
        // Crear un proxy para el servicio de configuración de NetworkManager
        let settings_proxy = zbus::blocking::Proxy::new(
            &self.connection,
            "org.freedesktop.NetworkManager",
            "/org/freedesktop/NetworkManager/Settings",
            "org.freedesktop.NetworkManager.Settings",
        )?;

        // Obtener todas las conexiones guardadas
        let connections: Vec<zbus::zvariant::OwnedObjectPath> =
            settings_proxy.call("ListConnections", &())?;
        let mut saved_networks = Vec::new();

        // Procesar cada conexión guardada
        for conn_path in connections {
            // Crear un proxy para cada conexión
            let conn_proxy = zbus::blocking::Proxy::new(
                &self.connection,
                "org.freedesktop.NetworkManager",
                conn_path.as_str(),
                "org.freedesktop.NetworkManager.Settings.Connection",
            )?;

            // Obtener la configuración de la conexión como un HashMap
            let settings: std::collections::HashMap<String, zbus::zvariant::OwnedValue> =
                conn_proxy.call("GetSettings", &())?;

            // Verificar si es una conexión WiFi
            if let Some(connection) = settings.get("connection") {
                let connection_dict = match connection.downcast_ref::<Value>().and_then(|v| {
                    v.downcast::<std::collections::HashMap<String, zbus::zvariant::OwnedValue>>()
                }) {
                    Ok(dict) => dict,
                    _ => continue,
                };

                // Verificar el tipo de conexión
                if let Some(conn_type) = connection_dict.get("type") {
                    let v_type: &zbus::zvariant::Value<'_> = conn_type;
                    let conn_type_str = match v_type.downcast_ref::<String>() {
                        Ok(s) => s,
                        _ => continue,
                    };

                    // Si es una conexión WiFi, extraer la información
                    if conn_type_str == "802-11-wireless" {
                        let mut network_info = NetworkInfo {
                            connection_type: "wifi".to_string(),
                            ..Default::default()
                        };

                        // Obtener el nombre de la conexión
                        if let Some(id) = connection_dict.get("id") {
                            let v_id: &zbus::zvariant::Value<'_> = id;
                            if let Ok(name) = v_id.downcast_ref::<String>() {
                                network_info.name = name;
                            }
                        }

                        // Obtener el SSID
                        if let Some(wireless) = settings.get("802-11-wireless") {
                            let wireless_dict = match wireless.downcast_ref::<Value>()
                                .and_then(|v| v.downcast::<std::collections::HashMap<String, zbus::zvariant::OwnedValue>>())
                            {
                                Ok(dict) => dict,
                                _ => continue,
                            };

                            if let Some(ssid) = wireless_dict.get("ssid") {
                                let v_ssid: &zbus::zvariant::Value<'_> = ssid;
                                network_info.ssid = NetworkManagerHelpers::ssid_from_value(v_ssid);
                            }
                        }

                        // Determinar el tipo de seguridad
                        if let Some(security) = settings.get("802-11-wireless-security") {
                            let security_dict = match security.downcast_ref::<Value>()
                                .and_then(|v| v.downcast::<std::collections::HashMap<String, zbus::zvariant::OwnedValue>>())
                            {
                                Ok(dict) => dict,
                                _ => {
                                    network_info.security_type = WiFiSecurityType::None;
                                    saved_networks.push(network_info);
                                    continue;
                                },
                            };

                            if let Some(key_mgmt) = security_dict.get("key-mgmt") {
                                let v_km: &zbus::zvariant::Value<'_> = key_mgmt;
                                if let Ok(key_mgmt_str) = v_km.downcast_ref::<String>() {
                                    match key_mgmt_str.as_str() {
                                        "none" => {
                                            network_info.security_type = WiFiSecurityType::None
                                        }
                                        "wpa-psk" => {
                                            network_info.security_type = WiFiSecurityType::WpaPsk
                                        }
                                        "wpa-eap" => {
                                            network_info.security_type = WiFiSecurityType::WpaEap
                                        }
                                        _ => network_info.security_type = WiFiSecurityType::None,
                                    }
                                }
                            }
                        } else {
                            network_info.security_type = WiFiSecurityType::None;
                        }

                        // Agregar a la lista de redes guardadas
                        saved_networks.push(network_info);
                    }
                }
            }
        }

        Ok(saved_networks)
    }

    /// Delete a saved WiFi connection by SSID
    pub fn delete_wifi_connection(&self, ssid: &str) -> Result<bool> {
        // Crear un proxy para el servicio de configuración de NetworkManager
        let settings_proxy = zbus::blocking::Proxy::new(
            &self.connection,
            "org.freedesktop.NetworkManager",
            "/org/freedesktop/NetworkManager/Settings",
            "org.freedesktop.NetworkManager.Settings",
        )?;

        // Obtener todas las conexiones guardadas
        let connections: Vec<zbus::zvariant::OwnedObjectPath> =
            settings_proxy.call("ListConnections", &())?;

        // Procesar cada conexión guardada
        for conn_path in connections {
            // Crear un proxy para cada conexión
            let conn_proxy = zbus::blocking::Proxy::new(
                &self.connection,
                "org.freedesktop.NetworkManager",
                conn_path.as_str(),
                "org.freedesktop.NetworkManager.Settings.Connection",
            )?;

            // Obtener la configuración de la conexión como un HashMap
            let settings: std::collections::HashMap<String, zbus::zvariant::OwnedValue> =
                conn_proxy.call("GetSettings", &())?;

            // Verificar si es una conexión WiFi
            if let Some(connection) = settings.get("connection") {
                let connection_dict = match connection.downcast_ref::<Value>().and_then(|v| {
                    v.downcast::<std::collections::HashMap<String, zbus::zvariant::OwnedValue>>()
                }) {
                    Ok(dict) => dict,
                    _ => continue,
                };

                // Verificar el tipo de conexión
                if let Some(conn_type) = connection_dict.get("type") {
                    let v_type: &zbus::zvariant::Value<'_> = conn_type;
                    let conn_type_str = match v_type.downcast_ref::<String>() {
                        Ok(s) => s,
                        _ => continue,
                    };

                    // Si es una conexión WiFi, verificar el SSID
                    if conn_type_str == "802-11-wireless" {
                        if let Some(wireless) = settings.get("802-11-wireless") {
                            let wireless_dict = match wireless.downcast_ref::<Value>()
                                .and_then(|v| v.downcast::<std::collections::HashMap<String, zbus::zvariant::OwnedValue>>())
                            {
                                Ok(dict) => dict,
                                _ => continue,
                            };

                            if let Some(ssid_value) = wireless_dict.get("ssid") {
                                let v_ssid: &zbus::zvariant::Value<'_> = ssid_value;
                                let conn_ssid_str = NetworkManagerHelpers::ssid_from_value(v_ssid);
                                // Si el SSID coincide, eliminar la conexión
                                if conn_ssid_str == ssid {
                                    conn_proxy.call::<_, _, ()>("Delete", &())?;
                                    return Ok(true);
                                }
                            }
                        }
                    }
                }
            }
        }

        // No se encontró ninguna conexión con el SSID especificado
        Ok(false)
    }

    /// List saved VPN profiles from NetworkManager settings.
    pub fn list_vpn_profiles(&self) -> Result<Vec<VpnProfile>> {
        let connections = self.list_connection_paths()?;
        let mut profiles = Vec::new();

        for conn_path in connections {
            let settings = self.get_connection_settings(&conn_path)?;
            if let Some(profile) = self.vpn_profile_from_settings(&settings) {
                profiles.push(profile);
            }
        }

        profiles.sort_by(|a, b| a.id.cmp(&b.id));
        Ok(profiles)
    }

    /// Get current VPN status from active connections.
    /// Whether an active connection is a tunnel, and how much of a VPN it is.
    ///
    /// NetworkManager only files as "vpn" what one of its own VPN plugins set
    /// up. A client that brings its own daemon — Twingate, Tailscale, ZeroTier,
    /// wg-quick — creates the interface itself, and NetworkManager sees a plain
    /// tun or wireguard device. It is still a VPN to whoever is using the
    /// machine: with Twingate connected, the control centre said there was no
    /// VPN while every packet was going through it.
    ///
    /// The number is how much of a VPN each kind is, for when there is more
    /// than one tunnel up: a profile NetworkManager manages says more than a
    /// tun device somebody else created.
    fn tunnel_priority(conn_type: &str) -> Option<u8> {
        match conn_type {
            "vpn" => Some(3),
            "wireguard" => Some(2),
            "tun" | "tap" | "ip-tunnel" => Some(1),
            _ => None,
        }
    }

    /// The name to show for a tunnel NetworkManager did not create.
    ///
    /// Their connection id is the interface name, which tells nobody anything:
    /// "sdwan0" is Twingate, and there is nothing on the system that says so.
    /// The ones we know get their product name; the rest keep the id, which is
    /// still better than claiming there is no VPN.
    fn tunnel_display_name(id: &str, interface: Option<&str>) -> String {
        const CONOCIDAS: [(&str, &str); 7] = [
            ("sdwan", "Twingate"),
            ("tailscale", "Tailscale"),
            ("nordlynx", "NordVPN"),
            ("proton", "Proton VPN"),
            ("pvpn", "Proton VPN"),
            ("zt", "ZeroTier"),
            ("wg", "WireGuard"),
        ];

        let nombre = interface.unwrap_or(id);
        for (prefijo, producto) in CONOCIDAS {
            if nombre.starts_with(prefijo) {
                return producto.to_string();
            }
        }

        id.to_string()
    }

    pub fn get_vpn_status(&self) -> Result<VpnStatus> {
        let active_connections_variant = self.proxy.get(
            InterfaceName::from_static_str_unchecked("org.freedesktop.NetworkManager"),
            "ActiveConnections",
        )?;

        let mut mejor: Option<(u8, zbus::zvariant::OwnedObjectPath, String)> = None;

        if let Ok(zbus::zvariant::Value::Array(arr)) = active_connections_variant.downcast_ref() {
            for value in arr.iter() {
                let active_path = match value {
                    zbus::zvariant::Value::ObjectPath(path) => path,
                    _ => continue,
                };

                let active_props = zbus::blocking::fdo::PropertiesProxy::builder(&self.connection)
                    .destination("org.freedesktop.NetworkManager")?
                    .path(active_path)?
                    .build()?;

                let conn_type_variant = active_props.get(
                    InterfaceName::from_static_str_unchecked(
                        "org.freedesktop.NetworkManager.Connection.Active",
                    ),
                    "Type",
                )?;

                let conn_type = match conn_type_variant.downcast_ref() {
                    Ok(zbus::zvariant::Value::Str(v)) => v.to_string(),
                    _ => continue,
                };

                let Some(prioridad) = Self::tunnel_priority(&conn_type) else {
                    continue;
                };

                // `map_or` y no `is_none_or`: esta última es estable desde 1.82 y el
                // crate declara `rust-version = "1.77.2"`, así que con ella no
                // compilaba en el mínimo que promete.
                if mejor
                    .as_ref()
                    .map_or(true, |(previa, _, _)| prioridad > *previa)
                {
                    mejor = Some((
                        prioridad,
                        zbus::zvariant::OwnedObjectPath::from(active_path.to_owned()),
                        conn_type,
                    ));
                }
            }
        }

        let Some((_, active_path, conn_type)) = mejor else {
            return Ok(VpnStatus::default());
        };

        self.vpn_status_from_active(&active_path, &conn_type)
    }

    /// Reads the status of one active tunnel.
    fn vpn_status_from_active(
        &self,
        active_path: &zbus::zvariant::OwnedObjectPath,
        conn_type: &str,
    ) -> Result<VpnStatus> {
        let mut status = VpnStatus::default();

        let active_props = zbus::blocking::fdo::PropertiesProxy::builder(&self.connection)
            .destination("org.freedesktop.NetworkManager")?
            .path(active_path.as_ref())?
            .build()?;

        let leer = |propiedad: &'static str| {
            active_props.get(
                InterfaceName::from_static_str_unchecked(
                    "org.freedesktop.NetworkManager.Connection.Active",
                ),
                propiedad,
            )
        };

        let state = match leer("State")?.downcast_ref() {
            Ok(zbus::zvariant::Value::U32(v)) => v,
            _ => 0,
        };
        status.state = Self::vpn_state_from_active_state(state);

        let id = match leer("Id")?.downcast_ref() {
            Ok(zbus::zvariant::Value::Str(v)) => v.to_string(),
            _ => String::new(),
        };
        status.active_profile_uuid = match leer("Uuid")?.downcast_ref() {
            Ok(zbus::zvariant::Value::Str(v)) => Some(v.to_string()),
            _ => None,
        };

        // Una VPN de NetworkManager tiene nombre puesto por quien la creó; las
        // otras traen el nombre de la interfaz, que no le dice nada a nadie.
        status.managed_externally = conn_type != "vpn";
        status.interface = self.active_connection_interface(&active_props);
        status.active_profile_name = Some(if status.managed_externally {
            Self::tunnel_display_name(&id, status.interface.as_deref())
        } else {
            id.clone()
        });
        status.active_profile_id = Some(id);

        if let Ok(zbus::zvariant::Value::ObjectPath(ip4_path)) = leer("Ip4Config")?.downcast_ref() {
            if ip4_path.as_str() != "/" {
                let ip4_props = zbus::blocking::fdo::PropertiesProxy::builder(&self.connection)
                    .destination("org.freedesktop.NetworkManager")?
                    .path(ip4_path)?
                    .build()?;

                let leer_ip = |propiedad: &'static str| {
                    ip4_props.get(
                        InterfaceName::from_static_str_unchecked(
                            "org.freedesktop.NetworkManager.IP4Config",
                        ),
                        propiedad,
                    )
                };

                if let Ok(gateway) = leer_ip("Gateway") {
                    status.gateway = match gateway.downcast_ref() {
                        Ok(zbus::zvariant::Value::Str(v)) if !v.is_empty() => Some(v.to_string()),
                        _ => None,
                    };
                }

                // La dirección dentro del túnel: es lo que alguien mira para
                // saber con qué IP lo ve la red del otro lado.
                if let Ok(addresses) = leer_ip("Addresses") {
                    if let Ok(zbus::zvariant::Value::Array(arr)) = addresses.downcast_ref() {
                        if let Some(zbus::zvariant::Value::Array(tupla)) = arr.first() {
                            if let Some(zbus::zvariant::Value::U32(entero)) = tupla.first() {
                                use std::net::Ipv4Addr;
                                status.ip_address =
                                    Some(Ipv4Addr::from(entero.to_be()).to_string());
                            }
                        }
                    }
                }
            }
        }

        Ok(status)
    }

    /// The interface a tunnel came up on, asked to the device itself.
    fn active_connection_interface(
        &self,
        active_props: &zbus::blocking::fdo::PropertiesProxy,
    ) -> Option<String> {
        let devices = active_props
            .get(
                InterfaceName::from_static_str_unchecked(
                    "org.freedesktop.NetworkManager.Connection.Active",
                ),
                "Devices",
            )
            .ok()?;

        let zbus::zvariant::Value::Array(arr) = devices.downcast_ref().ok()? else {
            return None;
        };
        let zbus::zvariant::Value::ObjectPath(device_path) = arr.first()? else {
            return None;
        };

        let device_props = zbus::blocking::fdo::PropertiesProxy::builder(&self.connection)
            .destination("org.freedesktop.NetworkManager")
            .ok()?
            .path(device_path)
            .ok()?
            .build()
            .ok()?;

        let interface = device_props
            .get(
                InterfaceName::from_static_str_unchecked("org.freedesktop.NetworkManager.Device"),
                "Interface",
            )
            .ok()?;

        match interface.downcast_ref() {
            Ok(zbus::zvariant::Value::Str(v)) => Some(v.to_string()),
            _ => None,
        }
    }

    /// Connect a VPN profile by UUID.
    pub fn connect_vpn(&self, uuid: String) -> Result<()> {
        let current_status = self.get_vpn_status()?;
        if current_status.state == VpnConnectionState::Connected
            && current_status.active_profile_uuid.as_deref() == Some(uuid.as_str())
        {
            return Err(crate::error::NetworkError::VpnAlreadyConnected(uuid));
        }

        let conn_path = self.find_connection_path_by_uuid(&uuid)?;

        let nm_proxy = zbus::blocking::Proxy::new(
            &self.connection,
            "org.freedesktop.NetworkManager",
            "/org/freedesktop/NetworkManager",
            "org.freedesktop.NetworkManager",
        )?;

        let any_path = zbus::zvariant::OwnedObjectPath::try_from("/").unwrap();
        let activate_result: zbus::Result<zbus::zvariant::OwnedObjectPath> =
            nm_proxy.call("ActivateConnection", &(&conn_path, &any_path, &any_path));

        match activate_result {
            Ok(_) => Ok(()),
            Err(e) => {
                let msg = e.to_string().to_lowercase();
                if msg.contains("secret") || msg.contains("authentication") {
                    Err(crate::error::NetworkError::VpnAuthFailed(e.to_string()))
                } else {
                    Err(crate::error::NetworkError::VpnActivationFailed(
                        e.to_string(),
                    ))
                }
            }
        }
    }

    /// Disconnect VPN by UUID or disconnect active VPN if UUID is not provided.
    pub fn disconnect_vpn(&self, uuid: Option<String>) -> Result<()> {
        let active_connections_variant = self.proxy.get(
            InterfaceName::from_static_str_unchecked("org.freedesktop.NetworkManager"),
            "ActiveConnections",
        )?;

        let mut target_active_connection: Option<zbus::zvariant::OwnedObjectPath> = None;

        if let Ok(zbus::zvariant::Value::Array(arr)) = active_connections_variant.downcast_ref() {
            for value in arr.iter() {
                let active_path = match value {
                    zbus::zvariant::Value::ObjectPath(path) => {
                        zbus::zvariant::OwnedObjectPath::from(path.to_owned())
                    }
                    _ => continue,
                };

                let active_props = zbus::blocking::fdo::PropertiesProxy::builder(&self.connection)
                    .destination("org.freedesktop.NetworkManager")?
                    .path(active_path.as_str())?
                    .build()?;

                let conn_type_variant = active_props.get(
                    InterfaceName::from_static_str_unchecked(
                        "org.freedesktop.NetworkManager.Connection.Active",
                    ),
                    "Type",
                )?;
                let conn_type = match conn_type_variant.downcast_ref() {
                    Ok(zbus::zvariant::Value::Str(v)) => v.to_string(),
                    _ => continue,
                };

                if conn_type != "vpn" {
                    continue;
                }

                if let Some(target_uuid) = uuid.as_deref() {
                    let uuid_variant = active_props.get(
                        InterfaceName::from_static_str_unchecked(
                            "org.freedesktop.NetworkManager.Connection.Active",
                        ),
                        "Uuid",
                    )?;
                    let active_uuid = match uuid_variant.downcast_ref() {
                        Ok(zbus::zvariant::Value::Str(v)) => v.to_string(),
                        _ => continue,
                    };

                    if active_uuid == target_uuid {
                        target_active_connection = Some(active_path.clone());
                        break;
                    }
                } else {
                    target_active_connection = Some(active_path.clone());
                    break;
                }
            }
        }

        let target_active_connection = match target_active_connection {
            Some(path) => path,
            None => {
                if let Some(target_uuid) = uuid {
                    return Err(crate::error::NetworkError::VpnProfileNotFound(target_uuid));
                }
                return Err(crate::error::NetworkError::VpnNotActive);
            }
        };

        let nm_proxy = zbus::blocking::Proxy::new(
            &self.connection,
            "org.freedesktop.NetworkManager",
            "/org/freedesktop/NetworkManager",
            "org.freedesktop.NetworkManager",
        )?;

        nm_proxy.call::<_, _, ()>(
            "DeactivateConnection",
            &(target_active_connection.as_str(),),
        )?;
        Ok(())
    }

    /// Create a new VPN profile in NetworkManager settings.
    pub fn create_vpn_profile(&self, config: VpnCreateConfig) -> Result<VpnProfile> {
        if config.id.trim().is_empty() {
            return Err(crate::error::NetworkError::VpnInvalidConfig(
                "id is required".to_string(),
            ));
        }

        let uuid = Uuid::new_v4().to_string();
        let mut connection_section = HashMap::new();
        connection_section.insert("id".to_string(), Value::from(config.id.clone()));
        connection_section.insert("uuid".to_string(), Value::from(uuid.clone()));
        connection_section.insert("type".to_string(), Value::from("vpn"));
        connection_section.insert(
            "autoconnect".to_string(),
            Value::from(config.autoconnect.unwrap_or(false)),
        );

        let mut vpn_section = HashMap::new();
        vpn_section.insert(
            "service-type".to_string(),
            Value::from(Self::service_type_from_vpn_type(&config.vpn_type)),
        );

        if let Some(username) = config.username {
            vpn_section.insert("user-name".to_string(), Value::from(username));
        }
        if let Some(gateway) = config.gateway {
            vpn_section.insert("remote".to_string(), Value::from(gateway));
        }
        if let Some(ca_cert_path) = config.ca_cert_path {
            vpn_section.insert("ca".to_string(), Value::from(ca_cert_path));
        }
        if let Some(user_cert_path) = config.user_cert_path {
            vpn_section.insert("cert".to_string(), Value::from(user_cert_path));
        }
        if let Some(private_key_path) = config.private_key_path {
            vpn_section.insert("key".to_string(), Value::from(private_key_path));
        }
        if let Some(private_key_password) = config.private_key_password {
            vpn_section.insert(
                "key-password".to_string(),
                Value::from(private_key_password),
            );
        }
        if let Some(custom_settings) = config.settings {
            for (k, v) in custom_settings {
                vpn_section.insert(k, Value::from(v));
            }
        }

        let mut vpn_secrets_section = HashMap::new();
        if let Some(password) = config.password {
            vpn_secrets_section.insert("password".to_string(), Value::from(password));
        }
        if let Some(custom_secrets) = config.secrets {
            for (k, v) in custom_secrets {
                vpn_secrets_section.insert(k, Value::from(v));
            }
        }

        let mut settings: HashMap<String, HashMap<String, Value>> = HashMap::new();
        settings.insert("connection".to_string(), connection_section);
        settings.insert("vpn".to_string(), vpn_section);
        if !vpn_secrets_section.is_empty() {
            settings.insert("vpn-secrets".to_string(), vpn_secrets_section);
        }

        let settings_proxy = zbus::blocking::Proxy::new(
            &self.connection,
            "org.freedesktop.NetworkManager",
            "/org/freedesktop/NetworkManager/Settings",
            "org.freedesktop.NetworkManager.Settings",
        )?;

        let _created_path: zbus::zvariant::OwnedObjectPath =
            settings_proxy.call("AddConnection", &(settings,))?;

        Ok(VpnProfile {
            id: config.id,
            uuid,
            vpn_type: config.vpn_type,
            interface_name: None,
            autoconnect: config.autoconnect.unwrap_or(false),
            editable: true,
            last_error: None,
        })
    }

    /// Update an existing VPN profile by UUID.
    pub fn update_vpn_profile(&self, config: VpnUpdateConfig) -> Result<VpnProfile> {
        let conn_path = self.find_connection_path_by_uuid(&config.uuid)?;
        let existing_settings = self.get_connection_settings(&conn_path)?;

        let existing_profile = self
            .vpn_profile_from_settings(&existing_settings)
            .ok_or_else(|| crate::error::NetworkError::VpnProfileNotFound(config.uuid.clone()))?;

        let existing_vpn_settings = Self::string_map_from_section(&existing_settings, "vpn");
        let existing_vpn_secrets = Self::string_map_from_section(&existing_settings, "vpn-secrets");

        // Start from the full current settings map to preserve unrelated sections
        // (IPv4/IPv6, routes, DNS, permissions, proxy, etc.).
        let mut settings: HashMap<String, HashMap<String, Value>> = HashMap::new();
        for (section_name, dict) in &existing_settings {
            let mut section_map: HashMap<String, Value> = HashMap::new();
            for (k, v) in dict {
                if let Ok(val) = v.downcast_ref::<Value>() {
                    section_map.insert(k.clone(), val);
                }
            }
            settings.insert(section_name.clone(), section_map);
        }

        let connection_section = settings.entry("connection".to_string()).or_default();
        connection_section.insert(
            "id".to_string(),
            Value::from(config.id.clone().unwrap_or(existing_profile.id.clone())),
        );
        connection_section.insert("uuid".to_string(), Value::from(config.uuid.clone()));
        connection_section.insert("type".to_string(), Value::from("vpn"));
        connection_section.insert(
            "autoconnect".to_string(),
            Value::from(config.autoconnect.unwrap_or(existing_profile.autoconnect)),
        );

        let service_type = existing_vpn_settings
            .get("service-type")
            .cloned()
            .unwrap_or_else(|| {
                Self::service_type_from_vpn_type(&existing_profile.vpn_type).to_string()
            });

        let vpn_section = settings.entry("vpn".to_string()).or_default();
        vpn_section.insert("service-type".to_string(), Value::from(service_type));

        let mut merged_settings = existing_vpn_settings;
        if let Some(username) = config.username {
            merged_settings.insert("user-name".to_string(), username);
        }
        if let Some(gateway) = config.gateway {
            merged_settings.insert("remote".to_string(), gateway);
        }
        if let Some(ca_cert_path) = config.ca_cert_path {
            merged_settings.insert("ca".to_string(), ca_cert_path);
        }
        if let Some(user_cert_path) = config.user_cert_path {
            merged_settings.insert("cert".to_string(), user_cert_path);
        }
        if let Some(private_key_path) = config.private_key_path {
            merged_settings.insert("key".to_string(), private_key_path);
        }
        if let Some(private_key_password) = config.private_key_password {
            merged_settings.insert("key-password".to_string(), private_key_password);
        }
        if let Some(custom_settings) = config.settings {
            for (k, v) in custom_settings {
                merged_settings.insert(k, v);
            }
        }

        for (k, v) in merged_settings {
            vpn_section.insert(k, Value::from(v));
        }

        let mut merged_secrets = existing_vpn_secrets;
        if let Some(password) = config.password {
            merged_secrets.insert("password".to_string(), password);
        }
        if let Some(custom_secrets) = config.secrets {
            for (k, v) in custom_secrets {
                merged_secrets.insert(k, v);
            }
        }

        if merged_secrets.is_empty() {
            settings.remove("vpn-secrets");
        } else {
            let vpn_secrets_section = settings.entry("vpn-secrets".to_string()).or_default();
            vpn_secrets_section.clear();
            for (k, v) in merged_secrets {
                vpn_secrets_section.insert(k, Value::from(v));
            }
        }

        let conn_proxy = zbus::blocking::Proxy::new(
            &self.connection,
            "org.freedesktop.NetworkManager",
            conn_path.as_str(),
            "org.freedesktop.NetworkManager.Settings.Connection",
        )?;
        conn_proxy.call::<_, _, ()>("Update", &(settings,))?;

        let updated_settings = self.get_connection_settings(&conn_path)?;
        self.vpn_profile_from_settings(&updated_settings)
            .ok_or(crate::error::NetworkError::VpnProfileNotFound(config.uuid))
    }

    /// Delete a VPN profile by UUID.
    pub fn delete_vpn_profile(&self, uuid: String) -> Result<()> {
        let conn_path = self.find_connection_path_by_uuid(&uuid)?;

        let conn_proxy = zbus::blocking::Proxy::new(
            &self.connection,
            "org.freedesktop.NetworkManager",
            conn_path.as_str(),
            "org.freedesktop.NetworkManager.Settings.Connection",
        )?;

        conn_proxy.call::<_, _, ()>("Delete", &())?;
        Ok(())
    }
}

/// Initialize the network manager plugin
pub fn init(
    app: &AppHandle<tauri::Wry>,
    _api: PluginApi<tauri::Wry, ()>,
) -> Result<VSKNetworkManager<'static, tauri::Wry>> {
    VSKNetworkManager::new(app.clone())
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn vpn_state_deactivated_maps_to_disconnected() {
        assert_eq!(
            VSKNetworkManager::<tauri::Wry>::vpn_state_from_active_state(4),
            VpnConnectionState::Disconnected
        );
    }

    /// El caso que motivó todo esto: con Twingate conectado, el centro de
    /// control decía que no había VPN. Twingate levanta su propio túnel, así
    /// que NetworkManager lo archiva como un `tun` cualquiera y no como una
    /// "vpn" suya.
    #[test]
    fn un_tun_ajeno_tambien_es_una_vpn() {
        type NM = VSKNetworkManager<'static, tauri::Wry>;

        assert!(
            NM::tunnel_priority("tun").is_some(),
            "Twingate quedaba afuera"
        );
        assert!(NM::tunnel_priority("wireguard").is_some());
        assert!(NM::tunnel_priority("vpn").is_some());

        // Y lo que no es un túnel sigue sin serlo: si el wifi contara como VPN,
        // el indicador estaría siempre encendido.
        assert!(NM::tunnel_priority("802-11-wireless").is_none());
        assert!(NM::tunnel_priority("ethernet").is_none());
        assert!(NM::tunnel_priority("loopback").is_none());
        assert!(NM::tunnel_priority("bridge").is_none());
    }

    /// Con varios túneles arriba manda el que NetworkManager administra: es el
    /// único que además se puede conectar y desconectar desde el escritorio.
    #[test]
    fn una_vpn_de_networkmanager_le_gana_a_un_tun() {
        type NM = VSKNetworkManager<'static, tauri::Wry>;
        assert!(NM::tunnel_priority("vpn") > NM::tunnel_priority("wireguard"));
        assert!(NM::tunnel_priority("wireguard") > NM::tunnel_priority("tun"));
    }

    /// Contra el NetworkManager de verdad: que las propiedades que leemos
    /// existan y digan lo que creemos. Es donde se esconden los errores de una
    /// interfaz D-Bus, y ningún test puro los encuentra.
    ///
    /// Ignorado por defecto porque necesita un sistema con NetworkManager y una
    /// VPN levantada: `cargo test -- --ignored --nocapture`.
    #[test]
    #[ignore]
    fn el_tunel_de_esta_maquina_se_ve_como_vpn() {
        type NM = VSKNetworkManager<'static, tauri::Wry>;
        use zbus::names::InterfaceName;
        use zbus::zvariant::Value;

        let conexion = zbus::blocking::Connection::system().expect("sin bus del sistema");
        let nm = zbus::blocking::fdo::PropertiesProxy::builder(&conexion)
            .destination("org.freedesktop.NetworkManager")
            .unwrap()
            .path("/org/freedesktop/NetworkManager")
            .unwrap()
            .build()
            .expect("NetworkManager no está");

        let activas = nm
            .get(
                InterfaceName::from_static_str_unchecked("org.freedesktop.NetworkManager"),
                "ActiveConnections",
            )
            .unwrap();

        let mut encontrados = Vec::new();
        if let Ok(Value::Array(arr)) = activas.downcast_ref() {
            for valor in arr.iter() {
                let Value::ObjectPath(ruta) = valor else {
                    continue;
                };
                let props = zbus::blocking::fdo::PropertiesProxy::builder(&conexion)
                    .destination("org.freedesktop.NetworkManager")
                    .unwrap()
                    .path(ruta)
                    .unwrap()
                    .build()
                    .unwrap();
                let leer = |p: &'static str| {
                    props.get(
                        InterfaceName::from_static_str_unchecked(
                            "org.freedesktop.NetworkManager.Connection.Active",
                        ),
                        p,
                    )
                };
                let tipo = match leer("Type").unwrap().downcast_ref() {
                    Ok(Value::Str(v)) => v.to_string(),
                    _ => continue,
                };
                let id = match leer("Id").unwrap().downcast_ref() {
                    Ok(Value::Str(v)) => v.to_string(),
                    _ => String::new(),
                };
                match NM::tunnel_priority(&tipo) {
                    Some(prioridad) => {
                        let nombre = NM::tunnel_display_name(&id, Some(&id));
                        println!("túnel: id={id} tipo={tipo} prioridad={prioridad} se muestra como «{nombre}»");
                        encontrados.push(nombre);
                    }
                    None => println!("no es túnel: id={id} tipo={tipo}"),
                }
            }
        }

        assert!(
            !encontrados.is_empty(),
            "ningún túnel detectado; levantá la VPN antes de correr esto"
        );
    }

    /// «sdwan0» no le dice nada a nadie; «Twingate» sí.
    #[test]
    fn los_tuneles_conocidos_se_muestran_con_su_nombre() {
        type NM = VSKNetworkManager<'static, tauri::Wry>;

        assert_eq!(
            NM::tunnel_display_name("sdwan0", Some("sdwan0")),
            "Twingate"
        );
        assert_eq!(
            NM::tunnel_display_name("tailscale0", Some("tailscale0")),
            "Tailscale"
        );
        assert_eq!(NM::tunnel_display_name("wg0", Some("wg0")), "WireGuard");

        // Uno desconocido conserva el nombre que le puso NetworkManager: es
        // menos de lo que querríamos, pero muchísimo más que decir que no hay
        // ninguna VPN.
        assert_eq!(NM::tunnel_display_name("Oficina", Some("tun0")), "Oficina");
    }

    /// Guardia de la regresión que motivó `fix/wifi-scan-wait`: antes `rescan_wifi`
    /// leía los `AccessPoints` apenas `RequestScan` contestaba, o sea la lista del
    /// barrido *anterior* —vacía recién encendido el WiFi—, y "no encontraba nada".
    /// El arreglo espera a que `LastScan` avance; `scan_settled` es quien decide si
    /// el barrido terminó, y estos casos clavan su contrato:
    ///
    /// - mismo valor ⇒ sigue el barrido viejo, hay que esperar (false);
    /// - valor mayor ⇒ terminó uno nuevo, se puede leer (true);
    /// - `-1` ("nunca escaneó") NUNCA cuenta como terminado, aunque haya cambiado:
    ///   ese es exactamente el estado que devolvía la lista vacía, así que si
    ///   alguien vuelve a tratar al `-1` como "listo" este test se pone en rojo.
    #[test]
    fn scan_settled_solo_es_cierto_cuando_termino_un_barrido_nuevo() {
        type NM = VSKNetworkManager<'static, tauri::Wry>;

        // El mismo barrido de antes: todavía no terminó nada, hay que esperar.
        assert!(
            !NM::scan_settled(1000, 1000),
            "con el mismo LastScan no hay barrido nuevo: no se puede leer todavía"
        );

        // `LastScan` avanzó: terminó un barrido nuevo y recién ahí se lee la lista.
        assert!(
            NM::scan_settled(1000, 1500),
            "LastScan avanzó: el barrido terminó y la lista ya es la fresca"
        );

        // `-1` es "nunca escaneó": no importa desde dónde se espere, nunca está
        // listo. Es el caso que devolvía la lista vacía recién encendido el WiFi.
        assert!(
            !NM::scan_settled(-1, -1),
            "«nunca escaneó» no es un barrido terminado"
        );
        assert!(
            !NM::scan_settled(1000, -1),
            "volver a -1 (reset del contador) no es un barrido terminado: la regresión"
        );
    }

    /// Contra el NetworkManager de verdad: pedir un barrido y comprobar que
    /// `LastScan` avanza dentro del tope, que es justo lo que `rescan_wifi` espera
    /// antes de leer la lista. Reproduce el ciclo a bajo nivel —leer `LastScan`,
    /// `RequestScan`, volver a leer— porque construir un `VSKNetworkManager`
    /// necesita un `AppHandle` de Tauri que en un test no existe.
    ///
    /// Ignorado por defecto: necesita un sistema con NetworkManager y una placa
    /// inalámbrica. `cargo test -- --ignored --nocapture`.
    #[test]
    #[ignore]
    fn el_barrido_real_hace_avanzar_last_scan() {
        type NM = VSKNetworkManager<'static, tauri::Wry>;
        use zbus::names::InterfaceName;
        use zbus::zvariant::Value;

        let conexion = zbus::blocking::Connection::system().expect("sin bus del sistema");
        let nm = zbus::blocking::fdo::PropertiesProxy::builder(&conexion)
            .destination("org.freedesktop.NetworkManager")
            .unwrap()
            .path("/org/freedesktop/NetworkManager")
            .unwrap()
            .build()
            .expect("NetworkManager no está");

        let devices = nm
            .get(
                InterfaceName::from_static_str_unchecked("org.freedesktop.NetworkManager"),
                "Devices",
            )
            .unwrap();

        // Primer dispositivo inalámbrico (DeviceType == 2).
        let mut wireless_path = None;
        if let Ok(Value::Array(arr)) = devices.downcast_ref() {
            for valor in arr.iter() {
                let Value::ObjectPath(ruta) = valor else {
                    continue;
                };
                let props = zbus::blocking::fdo::PropertiesProxy::builder(&conexion)
                    .destination("org.freedesktop.NetworkManager")
                    .unwrap()
                    .path(ruta)
                    .unwrap()
                    .build()
                    .unwrap();
                let tipo = props.get(
                    InterfaceName::from_static_str_unchecked(
                        "org.freedesktop.NetworkManager.Device",
                    ),
                    "DeviceType",
                );
                if let Ok(valor) = tipo {
                    if let Ok(Value::U32(2)) = valor.downcast_ref() {
                        wireless_path = Some(ruta.to_string());
                        break;
                    }
                }
            }
        }

        let ruta = wireless_path.expect("no hay placa inalámbrica; este test la necesita");

        let props = zbus::blocking::fdo::PropertiesProxy::builder(&conexion)
            .destination("org.freedesktop.NetworkManager")
            .unwrap()
            .path(ruta.as_str())
            .unwrap()
            .build()
            .unwrap();

        let antes = NM::read_last_scan(&props);
        println!("LastScan antes del barrido: {antes}");

        let wireless_proxy = zbus::blocking::Proxy::new(
            &conexion,
            "org.freedesktop.NetworkManager",
            ruta.as_str(),
            "org.freedesktop.NetworkManager.Device.Wireless",
        )
        .unwrap();
        let options: std::collections::HashMap<String, zbus::zvariant::OwnedValue> =
            std::collections::HashMap::new();
        // Puede negarse si hay un barrido en curso: no es error, igual esperamos.
        let _ = wireless_proxy.call::<_, _, ()>("RequestScan", &(options,));

        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
        let mut settled = false;
        while std::time::Instant::now() < deadline {
            let ahora = NM::read_last_scan(&props);
            if NM::scan_settled(antes, ahora) {
                println!("LastScan avanzó a {ahora}: el barrido terminó");
                settled = true;
                break;
            }
            std::thread::sleep(std::time::Duration::from_millis(300));
        }

        assert!(
            settled,
            "LastScan no avanzó en 10 s: o la lógica de espera está rota o NM no barrió"
        );
    }
}