Key the web_server warning off the OTA platform and tell plaintext uploaders about the offer

tests/component_tests/ota/test_esphome_ota.py

@@ -387,6 +387,47 @@ def test_password_without_static_api_key_no_warning(
         fv.full_config.reset(token)
 
 
+def test_web_server_component_without_ota_platform_does_not_warn(
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    """The web_server component alone has no /update endpoint."""
+    full_conf = {
+        "web_server": {},
+        CONF_OTA: [
+            _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: OTHER_KEY}})
+        ],
+    }
+    token = fv.full_config.set(full_conf)
+    try:
+        with caplog.at_level(logging.WARNING):
+            ota_esphome_final_validate({})
+        assert not any(
+            "OTA encryption does not cover" in r.message for r in caplog.records
+        )
+    finally:
+        fv.full_config.reset(token)
+
+
+def test_web_server_ota_platform_alone_warns(
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    """An explicit web_server ota platform exposes /update permanently, with
+    or without the web_server component."""
+    full_conf = {
+        CONF_OTA: [
+            _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: OTHER_KEY}}),
+            {CONF_PLATFORM: "web_server", CONF_ID: ID("ota_ws", is_manual=False)},
+        ],
+    }
+    token = fv.full_config.set(full_conf)
+    try:
+        with caplog.at_level(logging.WARNING):
+            ota_esphome_final_validate({})
+        assert any("plaintext /update" in r.message for r in caplog.records)
+    finally:
+        fv.full_config.reset(token)
+
+
 def test_web_server_ota_without_encryption_unaffected() -> None:
     """web_server ota stays valid alongside an unencrypted esphome entry."""
     full_conf = {

tests/unit_tests/test_espota2_noise.py

@@ -13,6 +13,7 @@ import base64
 from collections.abc import Callable
 import hashlib
 import io
+import logging
 from pathlib import Path
 import socket
 import sys
@@ -264,6 +265,17 @@ def test_client_fails_closed_when_device_lacks_encryption() -> None:
     device.join_and_check()
 
 
+def test_plaintext_upload_to_offering_device_warns(
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    """A keyless client is told the device could have encrypted the upload."""
+    device = FakeEncryptedDevice(offer_noise=True, require_noise=False)
+    with patch("time.sleep"), caplog.at_level(logging.WARNING):
+        _upload(device, b"firmware", None)
+    device.join_and_check()
+    assert any("offers OTA encryption" in r.message for r in caplog.records)
+
+
 @pytest.mark.parametrize("noise_psk", [None, PSK], ids=["plaintext", "encrypted"])
 def test_offering_device_accepts_either_transport(noise_psk: str | None) -> None:
     """A device that offers but does not require encryption takes a plaintext