From 17823891a22cdbe1ac88699f2b00aeb309c48b61 Mon Sep 17 00:00:00 2001
From: xboard <xboard>
Date: Fri, 17 Apr 2026 01:59:42 +0800
Subject: [PATCH] fix: use POST for machine/nodes endpoint to prevent token URL
 leakage

---
 internal/panel/client.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/internal/panel/client.go b/internal/panel/client.go
index 1957e37..402d6cb 100644
--- a/internal/panel/client.go
+++ b/internal/panel/client.go
@@ -316,7 +316,7 @@ func (c *Client) ResetETags() {
 
 // GetMachineNodes fetches the list of active nodes bound to this machine.
 func (c *Client) GetMachineNodes() (*MachineNodesResponse, error) {
-	resp, err := c.doRequest("GET", "/api/v2/server/machine/nodes", nil, "")
+	resp, err := c.doRequest("POST", "/api/v2/server/machine/nodes", nil, "")
 	if err != nil {
 		return nil, fmt.Errorf("get machine nodes: %w", err)
 	}