[ota] Skip the web_server plaintext warning when web_server ota is disabled (#19348)

esphome/components/esphome/ota/__init__.py

@@ -166,9 +166,17 @@ def ota_esphome_final_validate(config: ConfigType) -> None:
                 CONF_PASSWORD,
             )
     # web_server and prometheus keep the shared listener up; the captive
-    # portal's copy only exists on the fallback AP and is the recovery path
+    # portal's copy only exists on the fallback AP and is the recovery path.
+    # web_server `ota: false` gates /update behind the captive portal on
+    # every listener
+    web_server_conf = full_conf.get(CONF_WEB_SERVER)
+    plaintext_update_reachable = (
+        web_server_conf.get(CONF_OTA) is not False
+        if web_server_conf is not None
+        else "prometheus" in full_conf
+    )
     if (
-        (CONF_WEB_SERVER in full_conf or "prometheus" in full_conf)
+        plaintext_update_reachable
         and any(conf.get(CONF_PLATFORM) == CONF_WEB_SERVER for conf in full_ota_conf)
         and any(
             CONF_ENCRYPTION in conf

tests/component_tests/ota/test_esphome_ota.py

@@ -319,6 +319,32 @@ def test_encryption_with_captive_portal_does_not_warn(
         fv.full_config.reset(token)
 
 
+@pytest.mark.parametrize("extra", [{}, {"prometheus": {}}])
+def test_encryption_with_web_server_ota_disabled_does_not_warn(
+    caplog: pytest.LogCaptureFixture, extra: dict[str, Any]
+) -> None:
+    """web_server `ota: false` only serves /update while the captive portal is
+    active, on every listener, so there is no plaintext endpoint to warn about."""
+    full_conf = {
+        "web_server": {CONF_OTA: False},
+        **extra,
+        CONF_OTA: [
+            _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: OTHER_KEY}}),
+            {CONF_PLATFORM: "web_server", CONF_ID: ID("ota_ws", is_manual=False)},
+        ],
+    }
+    token = fv.full_config.set(full_conf)
+    try:
+        with caplog.at_level(logging.WARNING):
+            ota_esphome_final_validate({})
+        assert not any(
+            "OTA encryption does not cover" in record.message
+            for record in caplog.records
+        )
+    finally:
+        fv.full_config.reset(token)
+
+
 def test_password_with_api_key_warns(caplog: pytest.LogCaptureFixture) -> None:
     """A static api key makes the device offer encryption and the CLI take
     it, so the password is dead weight; the config validates with a warning."""