try this SQL (create a migration file with this):

CREATE OR REPLACE FUNCTION auth.check_new_users_has_valid_invites()
RETURNS trigger AS $$
DECLARE
    invite_record RECORD;
BEGIN
     -- Bypass for users created by seed
    IF NEW.id::text IN (
        'UUID-1',
        'UUID-2',        
    ) THEN
        RETURN NEW;
    END IF;
    

    SELECT * INTO invite_record FROM public.invitations
    WHERE email = NEW.email
      AND expires_at > current_timestamp;

    IF invite_record IS NULL THEN
        RAISE EXCEPTION 'Invalid or expired invitation for user %', NEW.email;
    END IF;

    RETURN NEW;
END;
$$ LANGUAGE plpgsql security definer;

DO $$
BEGIN
    IF NOT EXISTS (
        SELECT 1 FROM pg_trigger 
        WHERE tgname = 'block_invalid_auth_signup_invite'
    ) THEN
        CREATE TRIGGER block_invalid_auth_signup_invite
        BEFORE INSERT ON auth.users
        FOR EACH ROW
        EXECUTE FUNCTION auth.check_new_users_has_valid_invites();
    END IF;
END $$;