#vulnerable code 
                                @Override
    public OAuthGrant getByIdAndUser(User user, Long grantId) {
        OAuthGrant grant = getById(grantId);
        if (grant.getUser().equals(user)) {
            return grant;
        } else {
            return null;
        }
    } 
                            #location 4 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                @Override
    public OAuthGrant getByIdAndUser(User user, Long grantId) {
        OAuthGrant grant = getById(grantId);
        if (grant != null && user != null && grant.getUserId() == user.getId()) {
            return restoreRefs(grant, user, null);
        } else {
            return null;
        }
    }