package route

import (
	"testing"
	"time"
)

func TestVoteSubmitRateLimitKeysSeparateSharedIPUsers(t *testing.T) {
	tokenRL := newRateLimiter(1, time.Minute)
	ipRL := newRateLimiter(2, time.Minute)

	// Two devices behind one public IP use different signed token keys.
	if !tokenRL.allow("token:device-a") || !tokenRL.allow("token:device-b") {
		t.Fatal("different voter tokens should have independent limits")
	}
	if tokenRL.allow("token:device-a") {
		t.Fatal("the same voter token should be limited independently")
	}

	// The shared IP is only a high-threshold fallback, not a one-vote identity.
	if !ipRL.allow("ip:203.0.113.10") || !ipRL.allow("ip:203.0.113.10") {
		t.Fatal("shared IP should allow multiple normal submissions")
	}
	if ipRL.allow("ip:203.0.113.10") {
		t.Fatal("IP fallback should still stop an abnormal burst")
	}
}