auth.users is deliberately not reachable from the API. The usual pattern is a profiles table in public that you fill with a trigger on signup, and only copy what the app needs:
create table public.profiles (
id uuid primary key references auth.users on delete cascade,
email text,
display_name text
);Then an RLS policy so people only see profiles of members in their own team (not everyone). For existing users, backfill once with insert into public.profiles (id, email) select id, email from auth.users;.
Keep in mind the copy won't follow email changes unless you also add an update trigger.