public function getUserEntityByUserCredentials(
    string $username,
    #[SensitiveParameter]
    string $password,
    string $grantType,
    ClientEntityInterface $clientEntity
  ): ?UserEntityInterface {
    if ($this->loginConfigService->getConfig()?->useDefault === false) {
      // never allow login via password if the default login is disabled (e.g. using SSO only)
      return null;
    }

    $builder = $this->connection->createQueryBuilder();
    $user = $builder->select('user.id', 'user.password')
      ->from('user')
      ->where('username = :username')
      ->setParameter('username', $username)
      ->fetchAssociative();

    // PATH 1: EARLY RETURN WHEN USERNAME IS NOT FOUND
    if (!$user) {
      return null;
    }

    // PATH 2: VERIFY PASSWORD IF USER IS FOUND
    if (!password verify($password, (string) $user['password'])) {
      return null;
    }

    return new User(Uuid::fromBytesToHex($user['id']));
  }