fix: detect crypto with typeof, not optional chaining

[firatoezcan]

Disclaimer: AI wrote this, but I vetted it

Summary

constantTimeEqual is initialized at module load with:

typeof crypto?.timingSafeEqual === 'function'

typeof does not protect that. Optional chaining still evaluates the identifier, so a missing crypto global throws ReferenceError instead of taking the string-compare fallback.

randomId in the same file already does this correctly:

typeof crypto === 'undefined' || isCloudflareWorker()

This change uses that same typeof crypto check:

typeof crypto !== 'undefined' && typeof crypto.timingSafeEqual === 'function'

What is not a problem

• crypto.subtle in signCookie only runs when signing a cookie.
• crypto.randomUUID() only runs in the randomId branch after typeof crypto === 'undefined' has already passed.

Importing Elysia (and thus utils.ts) no longer requires a crypto global.

Summary by CodeRabbit

• Bug Fixes
  • Improved cookie comparison compatibility in environments where cryptographic browser features are unavailable.
  • Prevented errors caused by missing global cryptography support.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8409753b-4dd7-4512-99d8-4414848f0c7a

📥 Commits

Reviewing files that changed from the base of the PR and between 89088df and 8d4af2c.

📒 Files selected for processing (1)

• src/utils.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

Walkthrough

The constant-time cookie comparison fallback now checks whether the global crypto identifier exists before accessing timingSafeEqual.

Changes

Constant-time cookie comparison

Layer / File(s)	Summary
Guard crypto availability src/utils.ts	The fallback checks for an available global crypto object before accessing timingSafeEqual.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 8d4af

This localized change prevents module import failures when crypto is unavailable while preserving the existing fallback behavior; no actionable merge-blocking risk remains beyond normal checks and review.

Possibly related PRs

• elysiajs/elysia#1646: Introduced the constant-time comparison logic that this change now guards. Obviously, the tiny fix still needed its own moment in the spotlight~ ♡

Poem

crypto may hide away~
The guard checks first, without delay ♡
Cookies compare, no crash in sight
One small line makes runtime right
Such a tiny fix, acting so smug~ (￣▽￣)ノ

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The description clearly explains the bug, fix, fallback behavior, and unchanged behavior, but it omits the template checklist and required AI policy disclosure.
Title check	✅ Passed	The title clearly and concisely describes the crypto detection fix.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}