Trim the noise glue and drive the source filter from the define

tests/component_tests/ota/test_esphome_ota.py

@@ -372,44 +372,6 @@ def test_auto_load_pulls_noise_only_for_encryption() -> None:
     assert "noise" in AUTO_LOAD({})
 
 
-def test_filter_source_files_excludes_noise_without_encryption() -> None:
-    """The noise transport source compiles only for encrypted builds."""
-    old_config = CORE.config
-    try:
-        CORE.config = {CONF_OTA: [_make_ota_config(port=3232)]}
-        assert FILTER_SOURCE_FILES() == ["ota_esphome_noise.cpp"]
-        CORE.config = {
-            CONF_OTA: [
-                _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: API_KEY}})
-            ]
-        }
-        assert FILTER_SOURCE_FILES() == []
-    finally:
-        CORE.config = old_config
-
-
-def test_filter_source_files_keeps_noise_for_static_api_key() -> None:
-    """A static api key makes the device offer encryption, so the transport
-    compiles even without an ota encryption block."""
-    old_config = CORE.config
-    ota = [_make_ota_config(port=3232)]
-    try:
-        CORE.config = {CONF_API: {CONF_ENCRYPTION: {CONF_KEY: API_KEY}}, CONF_OTA: ota}
-        assert FILTER_SOURCE_FILES() == []
-        # A runtime provisioned or all-zeros api key has nothing to offer
-        CORE.config = {CONF_API: {CONF_ENCRYPTION: {}}, CONF_OTA: ota}
-        assert FILTER_SOURCE_FILES() == ["ota_esphome_noise.cpp"]
-        CORE.config = {
-            CONF_API: {CONF_ENCRYPTION: {CONF_KEY: ZEROS_KEY}},
-            CONF_OTA: ota,
-        }
-        assert FILTER_SOURCE_FILES() == ["ota_esphome_noise.cpp"]
-        CORE.config = {CONF_API: {}, CONF_OTA: ota}
-        assert FILTER_SOURCE_FILES() == ["ota_esphome_noise.cpp"]
-    finally:
-        CORE.config = old_config
-
-
 def test_api_static_key() -> None:
     """Only a real build-time api key can seed the encryption offer."""
     assert _api_static_key({}) is None
@@ -418,52 +380,44 @@ def test_api_static_key() -> None:
     assert _api_static_key({CONF_ENCRYPTION: {CONF_KEY: API_KEY}}) == API_KEY
 
 
-def _defines() -> set[str]:
-    return {define.name for define in CORE.defines}
-
-
-def test_api_key_offers_encryption_without_requiring_it(
+@pytest.mark.parametrize(
+    ("yaml_name", "defines_present", "defines_absent"),
+    [
+        # An api key alone compiles the transport in without requiring it
+        ("api_key_offer", {"USE_OTA_ENCRYPTION"}, {"USE_OTA_ENCRYPTION_REQUIRED"}),
+        # A password still guards plaintext uploads on an offering device
+        (
+            "api_key_offer_password",
+            {"USE_OTA_ENCRYPTION", "USE_OTA_PASSWORD"},
+            {"USE_OTA_ENCRYPTION_REQUIRED"},
+        ),
+        # The ota encryption block is what makes the device refuse plaintext
+        (
+            "encryption_required",
+            {"USE_OTA_ENCRYPTION", "USE_OTA_ENCRYPTION_REQUIRED"},
+            set(),
+        ),
+        # A key provisioned at runtime is unknown at build time, so no offer
+        ("runtime_api_key", set(), {"USE_OTA_ENCRYPTION"}),
+    ],
+)
+def test_encryption_offer_codegen(
     generate_main: Callable[[str], str],
+    yaml_name: str,
+    defines_present: set[str],
+    defines_absent: set[str],
 ) -> None:
-    """An api key alone compiles the transport in and sets the psk, but the
-    device keeps accepting plaintext uploads."""
     main_cpp = generate_main(
-        "tests/component_tests/ota/test_esphome_ota_api_key_offer.yaml"
+        f"tests/component_tests/ota/test_esphome_ota_{yaml_name}.yaml"
     )
-    assert "USE_OTA_ENCRYPTION" in _defines()
-    assert "USE_OTA_ENCRYPTION_REQUIRED" not in _defines()
-    assert "set_noise_psk(" in main_cpp
-
-
-def test_api_key_offer_keeps_password(generate_main: Callable[[str], str]) -> None:
-    """A password still guards plaintext uploads on an offering device."""
-    main_cpp = generate_main(
-        "tests/component_tests/ota/test_esphome_ota_api_key_offer_password.yaml"
-    )
-    assert {"USE_OTA_ENCRYPTION", "USE_OTA_PASSWORD"} <= _defines()
-    assert "USE_OTA_ENCRYPTION_REQUIRED" not in _defines()
-    assert "set_noise_psk(" in main_cpp
-    assert "set_auth_password(" in main_cpp
-
-
-def test_encryption_block_requires_encryption(
-    generate_main: Callable[[str], str],
-) -> None:
-    """The ota encryption block is what makes the device refuse plaintext."""
-    main_cpp = generate_main(
-        "tests/component_tests/ota/test_esphome_ota_encryption_required.yaml"
-    )
-    assert {"USE_OTA_ENCRYPTION", "USE_OTA_ENCRYPTION_REQUIRED"} <= _defines()
-    assert "set_noise_psk(" in main_cpp
-
-
-def test_runtime_api_key_offers_nothing(generate_main: Callable[[str], str]) -> None:
-    """A key provisioned at runtime is unknown at build time, so no offer."""
-    main_cpp = generate_main(
-        "tests/component_tests/ota/test_esphome_ota_runtime_api_key.yaml"
-    )
-    assert "USE_OTA_ENCRYPTION" not in _defines()
-    assert "set_noise_psk(" not in main_cpp
+    defines = {define.name for define in CORE.defines}
+    assert defines_present <= defines
+    assert not (defines_absent & defines)
+    encrypted = "USE_OTA_ENCRYPTION" in defines_present
+    assert ("set_noise_psk(" in main_cpp) is encrypted
+    assert ("set_auth_password(" in main_cpp) is ("USE_OTA_PASSWORD" in defines_present)
+    # The noise transport source compiles only when the define is set
+    assert FILTER_SOURCE_FILES() == ([] if encrypted else ["ota_esphome_noise.cpp"])
 
 
 def test_password_with_encryption_rejected() -> None: