// Should be allowed again
        assertTrue(rateLimiter.checkAttempt(username, ip), "Should be allowed after lockout expiry");
    }

    @Test
    public void testSuccessResetsCounter() throws Exception {
        String username = "resetuser";
        String ip = "192.168.1.5";

        // Two failures
        assertTrue(rateLimiter.checkAttempt(username, ip));