def METHOD_NAME(
    config: dict, username: str, password: str, mail: Mail
) -> tuple[dict | db.User, HTTPStatus]:
    """
    Returns user a message in case of failed login attempt.
    config: dict
        Dictionary with configuration settings
    username: str
        Username of user to be logged in
    password: str
        Password of user to be logged in
    mail: flask_mail.Mail
        An instance of the Flask mail class. Used to send email to user in case
        of too many failed login attempts.
    Returns
    -------
    User or Dict:
        User SQLAlchemy model if user is logged in, otherwise dictionary with
        error message
    HTTPStatus:
        Status code that the current request should return
    """
    log.info(f"Trying to login '{username}'")
    failed_login_msg = "Failed to login"
    if db.User.username_exists(username):
        user = db.User.get_by_username(username)
        password_policy = config.get("password_policy", {})
        max_failed_attempts = password_policy.get('max_failed_attempts', 5)
        inactivation_time = password_policy.get('inactivation_minutes', 15)
        is_blocked, min_rem = user.is_blocked(max_failed_attempts,
                                              inactivation_time)
        if is_blocked:
            notify_user_blocked(user, max_failed_attempts, min_rem, mail,
                                config)
            return {"msg": failed_login_msg}, HTTPStatus.UNAUTHORIZED
        elif user.check_password(password):
            user.failed_login_attempts = 0
            user.save()
            return user, HTTPStatus.OK
        else:
            # update the number of failed login attempts
            user.failed_login_attempts = 1 \
                if (
                    not user.failed_login_attempts or
                    user.failed_login_attempts >= max_failed_attempts
                ) else user.failed_login_attempts + 1
            user.last_login_attempt = dt.datetime.now()
            user.save()
    return {"msg": failed_login_msg}, HTTPStatus.UNAUTHORIZED