From c80899a7537fd33267228680567171d922a65928 Mon Sep 17 00:00:00 2001
From: naiba <hi@nai.ba>
Date: Tue, 26 May 2026 04:07:52 +0000
Subject: [PATCH] fix(fm): switch createFM to POST to match backend CSRF fix

Backend moves /api/v1/file from GET to POST so SameSite=Lax cookies
can no longer expose this state-changing endpoint to cross-site
CSRF. Update createFM() accordingly.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
---
 src/api/fm.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/api/fm.ts b/src/api/fm.ts
index 9dec746..0763b7e 100644
--- a/src/api/fm.ts
+++ b/src/api/fm.ts
@@ -3,5 +3,5 @@ import { ModelCreateFMResponse } from "@/types"
 import { FetcherMethod, fetcher } from "./api"
 
 export const createFM = async (id: string): Promise<ModelCreateFMResponse> => {
-    return fetcher<ModelCreateFMResponse>(FetcherMethod.GET, `/api/v1/file?id=${id}`, null)
+    return fetcher<ModelCreateFMResponse>(FetcherMethod.POST, `/api/v1/file?id=${id}`, null)
 }