@@ -2,9 +2,11 @@
 
 from __future__ import annotations
 
+import base64
 import copy
 import logging
 import time
+import types
 from collections import OrderedDict
 from typing import TYPE_CHECKING, Any, cast
 from unittest.mock import patch
@@ -13,7 +15,15 @@
 from freezegun.api import FrozenDateTimeFactory
 from pytest_mock import MockerFixture
 
-from kasa import Device, DeviceType, KasaException, Module
+from kasa import (
+    AuthenticationError,
+    Credentials,
+    Device,
+    DeviceType,
+    KasaException,
+    Module,
+)
+from kasa.device import WifiNetwork
 from kasa.exceptions import DeviceError, SmartErrorCode
 from kasa.smart import SmartDevice
 from kasa.smart.modules.energy import Energy
@@ -1010,3 +1020,347 @@ async def test_unpair(dev: SmartDevice, mocker: MockerFixture):
     await unpair_feat.set_value(None)
 
     unpair_call.assert_called_with(child.device_id)
+
+
+@pytest.mark.requires_dummy
+async def test_wifi_scan_legacy(dummy_protocol):
+    """Verify legacy wifi scan parses base64 ssid values."""
+    dev = SmartDevice("127.0.0.1", protocol=dummy_protocol)
+    ssid = "LegacyWifi"
+    ap_list = [
+        {
+            "ssid": base64.b64encode(ssid.encode()).decode(),
+            "cipher_type": 4,
+            "key_type": 3,
+            "channel": 6,
+            "signal_level": 2,
+            "bssid": "aa:bb:cc:dd:ee:ff",
+        }
+    ]
+
+    async def _query(request, *_, **__):
+        assert request == {"get_wireless_scan_info": {"start_index": 0}}
+        return {"get_wireless_scan_info": {"ap_list": ap_list}}
+
+    dev.protocol.query = _query
+    networks = await dev.wifi_scan()
+
+    assert dev.wpa3_supported is None
+    assert dev.public_key is None
+    assert networks[0].ssid == ssid
+    assert networks[0].bssid == "aa:bb:cc:dd:ee:ff"
+
+
+@pytest.mark.requires_dummy
+async def test_wifi_scan_fallback_scanaplist(dummy_protocol):
+    """Verify scanApList fallback stores wpa3/public_key and parses fields."""
+    dev = SmartDevice("127.0.0.1", protocol=dummy_protocol)
+    ap_list = [
+        {
+            "ssid": "ModernWifi",
+            "bssid": "11:22:33:44:55:66",
+            "auth": 3,
+            "encryption": 2,
+            "rssi": 2,
+        }
+    ]
+
+    async def _query(request, *_, **__):
+        if "get_wireless_scan_info" in request:
+            raise KasaException("scan not supported")
+        assert request == {"scanApList": {"onboarding": {"scan": {}}}}
+        return {
+            "wpa3_supported": "true",
+            "public_key": "  key  ",
+            "scanApList": {"onboarding": {"scan": {"ap_list": ap_list}}},
+        }
+
+    dev.protocol.query = _query
+    networks = await dev.wifi_scan()
+
+    assert dev.wpa3_supported is True
+    assert dev.public_key == "key"
+    assert networks[0].ssid == "ModernWifi"
+    assert networks[0].auth == 3
+    assert networks[0].encryption == 2
+    assert networks[0].rssi == 2
+
+
+@pytest.mark.requires_dummy
+async def test_wifi_scan_fallback_bool_and_missing_key(dummy_protocol):
+    """Verify scanApList fallback handles bool wpa3 and non-string public key."""
+    dev = SmartDevice("127.0.0.1", protocol=dummy_protocol)
+    ap_list = [
+        {
+            "ssid": "ModernWifi2",
+            "bssid": "22:33:44:55:66:77",
+            "auth": 4,
+            "encryption": 1,
+            "rssi": 3,
+        }
+    ]
+
+    async def _query(request, *_, **__):
+        if "get_wireless_scan_info" in request:
+            raise KasaException("scan not supported")
+        assert request == {"scanApList": {"onboarding": {"scan": {}}}}
+        return {
+            "wpa3_supported": True,
+            "public_key": 123,
+            "scanApList": {"onboarding": {"scan": {"ap_list": ap_list}}},
+        }
+
+    dev.protocol.query = _query
+    networks = await dev.wifi_scan()
+
+    assert dev.wpa3_supported is True
+    assert dev.public_key is None
+    assert networks[0].ssid == "ModernWifi2"
+    assert networks[0].auth == 4
+
+
+@pytest.mark.requires_dummy
+async def test_wifi_scan_fallback_false_and_empty_key(dummy_protocol):
+    """Verify scanApList fallback handles false wpa3 and empty public key."""
+    dev = SmartDevice("127.0.0.1", protocol=dummy_protocol)
+    ap_list = [
+        {
+            "ssid": "ModernWifi3",
+            "bssid": "33:44:55:66:77:88",
+            "auth": 2,
+            "encryption": 1,
+            "rssi": 1,
+        }
+    ]
+
+    async def _query(request, *_, **__):
+        if "get_wireless_scan_info" in request:
+            raise KasaException("scan not supported")
+        assert request == {"scanApList": {"onboarding": {"scan": {}}}}
+        return {
+            "wpa3_supported": "false",
+            "public_key": "   ",
+            "scanApList": {"onboarding": {"scan": {"ap_list": ap_list}}},
+        }
+
+    dev.protocol.query = _query
+    networks = await dev.wifi_scan()
+
+    assert dev.wpa3_supported is False
+    assert dev.public_key is None
+    assert networks[0].ssid == "ModernWifi3"
+
+
+@pytest.mark.requires_dummy
+async def test_wifi_scan_invalid_scan_branches(dummy_protocol):
+    """Cover invalid scan branches inside wifi_scan helper functions."""
+    dev = SmartDevice("127.0.0.1", protocol=dummy_protocol)
+
+    def _get_code(name: str) -> types.CodeType:
+        for const in dev.wifi_scan.__code__.co_consts:
+            if isinstance(const, types.CodeType) and const.co_name == name:
+                return const
+        raise AssertionError(f"Missing {name} code object")
+
+    def _make_cell(value):
+        def _inner():
+            return value
+
+        return _inner.__closure__[0]
+
+    scan_code = _get_code("_scan")
+    scan_fn = types.FunctionType(
+        scan_code,
+        dev.wifi_scan.__globals__,
+        name="_scan",
+        closure=(_make_cell(dev),),
+    )
+    with pytest.raises(KasaException, match="Unknown wifi scan target"):
+        await scan_fn("bogus_target")
+
+    handle_code = _get_code("_handle_scan_response")
+    handle_fn = types.FunctionType(
+        handle_code,
+        dev.wifi_scan.__globals__,
+        name="_handle_scan_response",
+    )
+    with pytest.raises(KasaException, match="Unknown wifi scan response"):
+        handle_fn({}, "bogus_scan")
+
+    net_code = _get_code("_net_for_scan_info")
+    net_fn = types.FunctionType(
+        net_code,
+        dev.wifi_scan.__globals__,
+        name="_net_for_scan_info",
+    )
+    with pytest.raises(KasaException, match="Unknown wifi scan info"):
+        net_fn({}, "bogus_scan")
+
+
+@pytest.mark.requires_dummy
+async def test_wifi_join_connectap_payload_timeout(dummy_protocol):
+    """Verify connectAp payload types and timeout handling."""
+    dev = SmartDevice("127.0.0.1", protocol=dummy_protocol)
+    dev.protocol._transport._credentials = Credentials("user", "pass")
+    dev.networks = [
+        WifiNetwork(
+            ssid="ModernWifi",
+            auth=3,
+            encryption=2,
+            rssi=2,
+            bssid="11:22:33:44:55:66",
+        )
+    ]
+
+    async def _query(request, retry_count=3, *_, **__):
+        assert retry_count == 0
+        payload = request["connectAp"]["onboarding"]["connect"]
+        assert isinstance(payload["ssid"], str)
+        assert isinstance(payload["bssid"], str)
+        assert isinstance(payload["auth"], int)
+        assert isinstance(payload["encryption"], int)
+        assert isinstance(payload["rssi"], int)
+        assert isinstance(payload["password"], str)
+        raise KasaException("timeout")
+
+    dev.protocol.query = _query
+    resp = await dev.wifi_join("ModernWifi", "secret")
+    assert resp == {}
+
+
+@pytest.mark.requires_dummy
+async def test_wifi_join_connectap_device_error(dummy_protocol):
+    """Verify connectAp device errors are re-raised."""
+    dev = SmartDevice("127.0.0.1", protocol=dummy_protocol)
+    dev.protocol._transport._credentials = Credentials("user", "pass")
+    dev.networks = [
+        WifiNetwork(
+            ssid="ModernWifi",
+            auth=3,
+            encryption=2,
+            rssi=2,
+            bssid="11:22:33:44:55:66",
+        )
+    ]
+
+    async def _query(*_, **__):
+        raise DeviceError("bad request", error_code=SmartErrorCode.PARAMS_ERROR)
+
+    dev.protocol.query = _query
+    with pytest.raises(DeviceError):
+        await dev.wifi_join("ModernWifi", "secret")
+
+
+@pytest.mark.requires_dummy
+async def test_wifi_join_connectap_bad_public_key(dummy_protocol, monkeypatch):
+    """Verify connectAp raises on bad public key data."""
+    dev = SmartDevice("127.0.0.1", protocol=dummy_protocol)
+    dev.protocol._transport._credentials = Credentials("user", "pass")
+    dev.public_key = "not-base64"
+    dev.networks = [
+        WifiNetwork(
+            ssid="ModernWifi",
+            auth=3,
+            encryption=2,
+            rssi=2,
+            bssid="11:22:33:44:55:66",
+        )
+    ]
+
+    def _raise_kasa(*_, **__):
+        raise KasaException("bad public key")
+
+    monkeypatch.setattr("base64.b64decode", _raise_kasa)
+
+    with pytest.raises(KasaException, match="bad public key"):
+        await dev.wifi_join("ModernWifi", "secret")
+
+
+@pytest.mark.requires_dummy
+async def test_wifi_join_connectap_non_rsa_key(dummy_protocol, monkeypatch):
+    """Verify connectAp rejects non-RSA public keys."""
+    dev = SmartDevice("127.0.0.1", protocol=dummy_protocol)
+    dev.protocol._transport._credentials = Credentials("user", "pass")
+    dev.public_key = dev.STATIC_PUBLIC_KEY_B64
+    dev.networks = [
+        WifiNetwork(
+            ssid="ModernWifi",
+            auth=3,
+            encryption=2,
+            rssi=2,
+            bssid="11:22:33:44:55:66",
+        )
+    ]
+
+    def _fake_load_der_public_key(_):
+        return object()
+
+    monkeypatch.setattr(
+        "kasa.smart.smartdevice.serialization.load_der_public_key",
+        _fake_load_der_public_key,
+    )
+
+    with pytest.raises(TypeError, match="RSA public key"):
+        await dev.wifi_join("ModernWifi", "secret")
+
+
+@pytest.mark.requires_dummy
+async def test_wifi_join_legacy_set_qs_info(dummy_protocol):
+    """Verify legacy onboarding payload and timeout handling."""
+    dev = SmartDevice("127.0.0.1", protocol=dummy_protocol)
+    dev.protocol._transport._credentials = Credentials("user", "pass")
+    dev._last_update = {"get_device_time": {"year": 2024}}
+    dev.networks = [WifiNetwork(ssid="LegacyWifi", bssid="aa:bb:cc:dd:ee:ff")]
+
+    async def _query(request, retry_count=3, *_, **__):
+        assert retry_count == 0
+        payload = request["set_qs_info"]
+        assert payload["account"]["username"] == base64.b64encode(b"user").decode()
+        assert payload["account"]["password"] == base64.b64encode(b"pass").decode()
+        assert payload["wireless"]["ssid"] == base64.b64encode(b"LegacyWifi").decode()
+        raise KasaException("timeout")
+
+    dev.protocol.query = _query
+    resp = await dev.wifi_join("LegacyWifi", "secret")
+    assert resp == {}
+
+
+@pytest.mark.requires_dummy
+async def test_wifi_join_no_credentials(dummy_protocol):
+    """Verify wifi_join raises without credentials."""
+    dev = SmartDevice("127.0.0.1", protocol=dummy_protocol)
+    with pytest.raises(AuthenticationError):
+        await dev.wifi_join("ssid", "password")
+
+
+@pytest.mark.requires_dummy
+async def test_wifi_join_no_networks(dummy_protocol):
+    """Verify wifi_join raises when scan returns no networks."""
+    dev = SmartDevice("127.0.0.1", protocol=dummy_protocol)
+    dev.protocol._transport._credentials = Credentials("user", "pass")
+
+    async def _wifi_scan():
+        return []
+
+    dev.wifi_scan = _wifi_scan
+    with pytest.raises(KasaException, match="Unable to determine wifi scan type"):
+        await dev.wifi_join("ssid", "password")
+
+
+@pytest.mark.requires_dummy
+async def test_wifi_join_ssid_not_found(dummy_protocol):
+    """Verify wifi_join raises when ssid is not found in scan results."""
+    dev = SmartDevice("127.0.0.1", protocol=dummy_protocol)
+    dev.protocol._transport._credentials = Credentials("user", "pass")
+    dev.networks = [
+        WifiNetwork(
+            ssid="OtherWifi",
+            auth=3,
+            encryption=2,
+            rssi=2,
+            bssid="11:22:33:44:55:66",
+        )
+    ]
+
+    with pytest.raises(KasaException, match="Unable to determine wifi scan type"):
+        await dev.wifi_join("MissingWifi", "secret")