// Should still be allowed
        assertTrue(rateLimiter.checkAttempt("user1", "192.168.1.1"), "After success should be allowed");
    }

    @Test
    public void testAccountLockout() throws Exception {
        String username = "testuser";
        String ip = "192.168.1.2";

        // First attempts should be allowed
        assertTrue(rateLimiter.checkAttempt(username, ip));