The release that turns Casual Sheets from “anonymous rooms only” into a product you can put named users on — without giving up the self-host, no-database posture.
Phase C — personal mode (#49)
- Per-user file storage — the server stores files under
<root>/users/<userID>/. Log in on a different machine and your workbooks are where you left them. - Auth foundation — bcrypt + SQLite at
<root>/.casual/users.db, HMAC-signed session cookies (30-day TTL),__Host--prefixed underSECURE_COOKIES=true. - File CRUD over HTTP —
POST/GET/PUT/PATCH/DELETE /files, plusPOST /auth/signup · /login · /logoutandGET /auth/me. - Profiles + admin — display name, timezone, locale, avatar; an
admin surface behind
RequireAdmin(first signup auto-promotes); areset-password / list-users / promote / demoteCLI.
Phase D — WOPI host (#49)
- A stateless WOPI client + JWT verifier (with JWKS cache).
docID = base64url(wopiSrc)keeps the gateway stateless; embed redirect atGET /wopi/host, per-roomRefreshLockticker so long sessions don’t lose the host lock.
Univer fork (#51)
- The fork now lives at
vendor/univer-revamp/as a submodule; all@univerjs/*packages resolve throughpnpm.overrides. Five perf patches cherry-picked on top (most impactful: stop re-walking the visible span insetStylesCache).
SDK + misc
- New
packages/sdkpublishing@casualoffice/sheets(signing + iframe postMessage protocol). - Soft cell-count cap on print export (was OOMing big workbooks); Format Cells… in the right-click menu; e2e hardening on the co-edit + charts specs.