// First attempts should be allowed
        assertTrue(rateLimiter.checkAttempt(username, ip));
        rateLimiter.recordFailure(username, ip);

        assertTrue(rateLimiter.checkAttempt(username, ip));
        rateLimiter.recordFailure(username, ip);

        assertTrue(rateLimiter.checkAttempt(username, ip));
        rateLimiter.recordFailure(username, ip);

     * @param sourceIp the source IP address
     * @return true if attempt is allowed, false if rate limited
     * @throws SmbException if account is locked out
     */
    public boolean checkAttempt(String username, String sourceIp) throws SmbException {
        if (closed.get()) {
            throw new IllegalStateException("Rate limiter is closed");
        }

        // Check global rate limit