rateLimiter.recordFailure(username, ip);

        // After 3 failures, account should be locked
        try {
            rateLimiter.checkAttempt(username, ip);
            fail("Should throw SmbException for locked account");
        } catch (SmbException e) {
            assertTrue(e.getMessage().contains("locked out"), "Should indicate account lockout");
        }
    }

    @Test

     *
     * @param username the username attempting authentication
     * @param sourceIp the source IP address
     * @return true if attempt is allowed, false if rate limited
     * @throws SmbException if account is locked out
     */
    public boolean checkAttempt(String username, String sourceIp) throws SmbException {
        if (closed.get()) {
            throw new IllegalStateException("Rate limiter is closed");
        }

  private static class LockingThread extends Thread {
    final CountDownLatch locked = new CountDownLatch(1);
    final CountDownLatch finishLatch = new CountDownLatch(1);
    final Lock lock;

    LockingThread(Lock lock) {
      this.lock = lock;
    }

    @Override
    public void run() {
      lock.lock();
      try {
        locked.countDown();
        finishLatch.await(1, MINUTES);

    int NT_STATUS_PASSWORD_MUST_CHANGE = 0xC0000224;
    /** The object was not found */
    int NT_STATUS_NOT_FOUND = 0xC0000225;
    /** The referenced account is currently locked out */
    int NT_STATUS_ACCOUNT_LOCKED_OUT = 0xC0000234;
    /** The remote system refused the network connection */
    int NT_STATUS_CONNECTION_REFUSED = 0xC0000236;
    /** The pathname does not traverse a DFS junction */

    int NT_STATUS_PASSWORD_MUST_CHANGE = 0xC0000224;
    /** The object was not found */
    int NT_STATUS_NOT_FOUND = 0xC0000225;
    /** The referenced account is currently locked out */
    int NT_STATUS_ACCOUNT_LOCKED_OUT = 0xC0000234;
    /** The pathname does not traverse a DFS junction */
    int NT_STATUS_PATH_NOT_COVERED = 0xC0000257;
    /** The IO operation on the reparse point failed */

             * return which would render the timeout effectively useless.
             */
            doConnect();
        } catch (final Exception ex) {
            ex0 = ex; // Defer to below where we're locked
            return;
        } finally {
            synchronized (run_thread) {
                if (run_thread != thread) {
                    /* Thread no longer the one setup for this transport --

                .map(Plugin::getArtifactId) // managed by us, groupId is always o.a.m.plugins
                .toList();

        if (!unversionedPlugins.isEmpty()) {
            logger.warn("Version not locked for default bindings plugins " + unversionedPlugins
                    + ", you should define versions in pluginManagement section of your " + "pom.xml or parent");
        }

        return executionPlan;
    }

        // Resource errors
        OUT_OF_MEMORY("Out of memory", ErrorCategory.RESOURCE, true), TOO_MANY_SESSIONS("Too many sessions", ErrorCategory.RESOURCE,
                true), RESOURCE_LOCKED("Resource is locked", ErrorCategory.RESOURCE, true),

        // Transient errors
        BUSY("Server busy", ErrorCategory.TRANSIENT, true), TRY_AGAIN("Try again later", ErrorCategory.TRANSIENT,

    public static final int ACB_SVRTRUST = 256;
    /** Account control bit flag: Password does not expire */
    public static final int ACB_PWNOEXP = 512;
    /** Account control bit flag: Account is auto-locked */
    public static final int ACB_AUTOLOCK = 1024;
    /** Account control bit flag: Encrypted text password is allowed */
    public static final int ACB_ENC_TXT_PWD_ALLOWED = 2048;

    public static final int ACB_SVRTRUST = 256;
    /** Account control bit flag: Password does not expire */
    public static final int ACB_PWNOEXP = 512;
    /** Account control bit flag: Account is auto-locked */
    public static final int ACB_AUTOLOCK = 1024;
    /** Account control bit flag: Encrypted text password is allowed */
    public static final int ACB_ENC_TXT_PWD_ALLOWED = 2048;