🔒 CRITICAL SECURITY: Admin API Exposed in Client Cod

[Karelaking]

Description

The CreateConversationModal component uses supabase.auth.admin.listUsers() directly in client-side code. This is critically dangerous because:

1. Admin API requires service role key (secret) — not anon key
2. Exposes all user data without authorization
3. Violates principle of least privilege
4. Creates massive security vulnerability

Affected Code

File: src/components/CreateConversationModal.tsx
Line: 43

useEffect(() => {
  const fetchUsers = async () => {
    try {
      const { data, error } = await supabase.auth.admin.listUsers();  // ⚠️ DANGEROUS
      if (error) throw error;
      
      // Filter out current user
      const filteredUsers = data.users.filter(u => u.id !== currentUser?.id);
      setUsers(filteredUsers as User[]);
    } catch (error) {
      console.error('Failed to fetch users:', error);
    }
  };

  fetchUsers();
}, [currentUser]);

[Karelaking]

assign it to me under ewocs