fix(my-canister-frontend): expose MAX_FILE_SIZE, add COOP comment, test .gz rejection

- Make MAX_FILE_SIZE a pub const with doc comment
- Explain same-origin-allow-popups is required for Internet Identity popups
- Add test asserting .gz files are rejected with a clear error
- Extend README description to mention static serving

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Web3NL

packages-rs/my-canister-frontend/README.md

@@ -5,7 +5,7 @@
 [![Build Status](https://github.com/Web3NL/my-canister-dapp/workflows/Release/badge.svg)](https://github.com/Web3NL/my-canister-dapp/actions)
 [![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](https://opensource.org/licenses/MIT)
 
-Frontend asset processing library for canisters on the Internet Computer.
+Frontend asset processing and static serving library for canisters on the Internet Computer.
 
 ## Usage
 

packages-rs/my-canister-frontend/src/asset_router.rs

@@ -16,10 +16,12 @@ pub const DEFAULT_ALLOWED_EXTENSIONS: &[&str] = &[
     "woff2", "ttf", "otf", "eot", "json", "xml", "txt", "wasm", "map",
 ];
 
-// ICP query responses are capped at 2 MiB. Each response includes ~3.5 KB of
-// HTTP headers (IC-Certificate, security headers, Content-Type, etc.) on top of
-// the body. Reserve 16 KiB to ensure the total response always fits.
-const MAX_FILE_SIZE: usize = 2 * 1024 * 1024 - 16 * 1024;
+/// Maximum allowed file size in bytes (2 MiB − 16 KiB).
+///
+/// ICP query responses are capped at 2 MiB. Each response includes ~3.5 KB of
+/// HTTP headers (IC-Certificate, security headers, Content-Type, etc.) on top of
+/// the body. 16 KiB is reserved to ensure the total response always fits.
+pub const MAX_FILE_SIZE: usize = 2 * 1024 * 1024 - 16 * 1024;
 
 /// File extensions that benefit from gzip compression.
 /// Binary formats (images, fonts, wasm) are already compressed.
@@ -327,6 +329,8 @@ fn build_headers(config: &FrontendConfig) -> Vec<(String, String)> {
             "Permissions-Policy".into(),
             "accelerometer=(), camera=(), geolocation=(), microphone=(), payment=(), usb=()".into(),
         ),
+        // same-origin-allow-popups is required for Internet Identity authentication,
+        // which opens a popup window to complete the login flow.
         (
             "Cross-Origin-Opener-Policy".into(),
             "same-origin-allow-popups".into(),
@@ -885,6 +889,21 @@ mod tests {
             let config = FrontendConfig::default();
             assert!(validate_asset("/my-app_v2.js", 100, &config).is_ok());
         }
+
+        #[test]
+        fn rejects_gz_extension() {
+            // A manually-included .gz file (e.g. app.js.gz) is not in the allowlist.
+            // The crate generates its own .gz variants internally; user-provided ones
+            // would collide with those generated paths and produce a confusing duplicate error.
+            // Rejecting .gz at validation gives a clear, actionable message instead.
+            let config = FrontendConfig::default();
+            let result = validate_asset("/app.js.gz", 100, &config);
+            assert!(result.is_err());
+            assert!(
+                result.unwrap_err().contains("not in the allowed list"),
+                "expected 'not in the allowed list' error for .gz file"
+            );
+        }
     }
 
     mod gzip_compression {