@@ -0,0 +1,135 @@
+package server
+
+import (
+	"encoding/json"
+	"net/http"
+	"testing"
+
+	"github.com/skyhook-io/radar/internal/auth"
+	"github.com/skyhook-io/radar/internal/k8s"
+	"github.com/skyhook-io/radar/pkg/k8score"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/client-go/kubernetes/fake"
+	k8stesting "k8s.io/client-go/testing"
+)
+
+func TestLimitRangeResourceAccess(t *testing.T) {
+	useTestResourceCache(t, fake.NewClientset(
+		&corev1.LimitRange{ObjectMeta: metav1.ObjectMeta{Name: "rules", Namespace: "default"}},
+	))
+	tests := []struct {
+		name, path, verb string
+		namespaces       []string
+		grants           map[string]bool
+		want             int
+	}{
+		{"list denied", "/api/resources/limitranges?namespace=default", "list", []string{"default"}, map[string]bool{"default": false}, 403},
+		{"list allowed", "/api/resources/limitranges?namespace=default", "list", []string{"default"}, map[string]bool{"default": true}, 200},
+		{"get denied", "/api/resources/limitranges/default/rules", "get", []string{"default"}, map[string]bool{"default": false}, 403},
+		{"get allowed", "/api/resources/limitranges/default/rules", "get", []string{"default"}, map[string]bool{"default": true}, 200},
+		{"namespace denied is not empty", "/api/resources/limitranges?namespace=default", "list", []string{"other"}, map[string]bool{"default": true}, 403},
+		{"cluster pod visibility does not grant rules", "/api/resources/limitranges", "list", nil, map[string]bool{"": false}, 403},
+		{"cluster grant", "/api/resources/limitranges", "list", nil, map[string]bool{"": true}, 200},
+		{"mixed grants cannot claim completeness", "/api/resources/limitranges?namespaces=default,other", "list", []string{"default", "other"}, map[string]bool{"default": true, "other": false}, 403},
+		{"table denial is explicit", "/api/resources/limitranges?namespace=default&table=1", "list", []string{"default"}, map[string]bool{"default": false}, 403},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			env := newAuthTestServer(t)
+			perms := &auth.UserPermissions{AllowedNamespaces: tt.namespaces}
+			for ns, allowed := range tt.grants {
+				perms.SetCanI(tt.verb, "", "limitranges", ns, allowed)
+			}
+			env.srv.permCache.Set("reader", nil, perms)
+			resp := env.authGet(t, tt.path, "reader", "")
+			defer resp.Body.Close()
+			if resp.StatusCode != tt.want {
+				t.Fatalf("status = %d, want %d", resp.StatusCode, tt.want)
+			}
+			if tt.want == http.StatusForbidden {
+				var body map[string]string
+				if err := json.NewDecoder(resp.Body).Decode(&body); err != nil || body["error"] == "" {
+					t.Fatalf("expected explicit error, got %v (%v)", body, err)
+				}
+			} else if tt.verb == "list" {
+				var items []corev1.LimitRange
+				if err := json.NewDecoder(resp.Body).Decode(&items); err != nil || len(items) != 1 || items[0].Name != "rules" {
+					t.Fatalf("expected rules, got %v (%v)", items, err)
+				}
+			}
+		})
+	}
+}
+
+func TestLimitRangeCacheCoverage(t *testing.T) {
+	core, err := k8score.NewResourceCache(k8score.CacheConfig{
+		Client: fake.NewClientset(),
+		ResourceScopes: map[string]k8score.ResourceScope{
+			k8score.LimitRanges: {Enabled: true, Namespace: "default"},
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	cache := k8s.GetResourceCache()
+	original := cache.ResourceCache
+	cache.ResourceCache = core
+	t.Cleanup(func() { cache.ResourceCache = original; core.Stop() })
+
+	for _, tt := range []struct {
+		path string
+		want int
+	}{
+		{"/api/resources/limitranges?namespace=default", 200},
+		{"/api/resources/limitranges?namespace=other", 403},
+		{"/api/resources/limitranges?namespaces=default,other", 403},
+		{"/api/resources/limitranges", 403},
+		{"/api/resources/limitranges/other/unknown", 403},
+		{"/api/resources/limitranges/default/unknown", 404},
+	} {
+		t.Run(tt.path, func(t *testing.T) {
+			resp, err := http.Get(testServer.URL + tt.path)
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer resp.Body.Close()
+			if resp.StatusCode != tt.want {
+				t.Fatalf("status = %d, want %d", resp.StatusCode, tt.want)
+			}
+		})
+	}
+}
+
+func TestLimitRangeCacheWarming(t *testing.T) {
+	client := fake.NewClientset()
+	release := make(chan struct{})
+	client.PrependReactor("list", "limitranges", func(action k8stesting.Action) (bool, runtime.Object, error) {
+		<-release
+		return true, &corev1.LimitRangeList{}, nil
+	})
+	core, err := k8score.NewResourceCache(k8score.CacheConfig{
+		Client:         client,
+		ResourceScopes: map[string]k8score.ResourceScope{k8score.LimitRanges: {Enabled: true}},
+		DeferredTypes:  map[string]bool{k8score.LimitRanges: true},
+	})
+	if err != nil {
+		close(release)
+		t.Fatal(err)
+	}
+	cache := k8s.GetResourceCache()
+	original := cache.ResourceCache
+	cache.ResourceCache = core
+	t.Cleanup(func() { close(release); cache.ResourceCache = original; core.Stop() })
+	for _, path := range []string{"/api/resources/limitranges?namespace=default", "/api/resources/limitranges/default/rules"} {
+		resp, err := http.Get(testServer.URL + path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		resp.Body.Close()
+		if resp.StatusCode != http.StatusServiceUnavailable {
+			t.Fatalf("%s: status = %d, want 503", path, resp.StatusCode)
+		}
+	}
+}
@@ -2033,6 +2033,18 @@ func (s *Server) preflightResourceList(r *http.Request, kind, group string, name
 		}
 	}
 
+	if (kind == "limitranges" || kind == "limitrange") && group == "" {
+		scopes := namespaces
+		if scopes == nil {
+			scopes = []string{""}
+		}
+		for _, ns := range scopes {
+			if !s.canRead(r, "", "limitranges", ns, "list") {
+				return nil, http.StatusForbidden, "insufficient permissions to list limitranges", false
+			}
+		}
+	}
+
 	return namespaces, 0, "", true
 }
 
@@ -2063,11 +2075,15 @@ func (s *Server) handleListResources(w http.ResponseWriter, r *http.Request) {
 	// DiscoverNamespaces if needed). canRead below relies on it.
 	namespaces := s.parseNamespacesForUser(r)
 
-	// Shared RBAC gate. REST converts denies to 200 with `[]` (legacy shape
-	// the frontend tolerates and that doesn't leak kind existence); the AI path
-	// returns the explicit status.
-	finalNamespaces, _, _, ok := s.preflightResourceList(r, kind, group, namespaces)
+	// Most REST lists preserve the empty-list denial response. LimitRange
+	// lookups need an explicit denial so an unreadable namespace is not
+	// presented as having no admission rules.
+	finalNamespaces, status, msg, ok := s.preflightResourceList(r, kind, group, namespaces)
 	if !ok {
+		if kind == "limitranges" && group == "" {
+			s.writeError(w, status, msg)
+			return
+		}
 		// Denied, not empty. writeResourceList resolves columns for an empty
 		// list, and that lookup runs as Radar's own identity — so routing a
 		// denial through it would answer a caller who cannot list the kind with
@@ -2402,10 +2418,20 @@ func (s *Server) handleListResources(w http.ResponseWriter, r *http.Request) {
 		}
 		result, err = cache.IngressClasses().List(labels.Everything())
 	case "limitranges":
-		if cache.LimitRanges() == nil {
+		if cache.IsDeferredPending("limitranges") || cache.LimitRanges() == nil {
 			notReadyOrForbidden("limitranges")
 			return
 		}
+		scopes := namespaces
+		if scopes == nil {
+			scopes = []string{""}
+		}
+		for _, ns := range scopes {
+			if !cache.KindCoversNamespace("limitranges", ns) {
+				s.writeError(w, http.StatusForbidden, "Radar does not have LimitRange visibility for the requested namespace scope")
+				return
+			}
+		}
 		result, err = listPerNs(
 			func() (any, error) { return cache.LimitRanges().List(labels.Everything()) },
 			func(ns string) (any, error) {
@@ -2544,6 +2570,9 @@ func (s *Server) preflightResourceGet(r *http.Request, kind, namespace, name, gr
 		if (kind == "secrets" || kind == "secret") && !s.canRead(r, "", "secrets", namespace, "get") {
 			return http.StatusForbidden, fmt.Sprintf("no access to secrets in namespace %q", namespace), false
 		}
+		if (kind == "limitranges" || kind == "limitrange") && group == "" && !s.canRead(r, "", "limitranges", namespace, "get") {
+			return http.StatusForbidden, fmt.Sprintf("no access to limitranges in namespace %q", namespace), false
+		}
 	default:
 		// Empty namespace and not a recognized cluster-scoped kind: an empty
 		// namespace means the target is cluster-scoped, but ClassifyKindScope
@@ -2786,10 +2815,14 @@ func (s *Server) handleGetResource(w http.ResponseWriter, r *http.Request) {
 		}
 		resource, err = cache.IngressClasses().Get(name)
 	case "limitranges", "limitrange":
-		if cache.LimitRanges() == nil {
+		if cache.IsDeferredPending("limitranges") || cache.LimitRanges() == nil {
 			notReadyOrForbiddenGet("limitranges")
 			return
 		}
+		if !cache.KindCoversNamespace("limitranges", namespace) {
+			s.writeError(w, http.StatusForbidden, "Radar does not have LimitRange visibility for the requested namespace")
+			return
+		}
 		resource, err = cache.LimitRanges().LimitRanges(namespace).Get(name)
 	case "resourcequotas", "resourcequota":
 		if cache.ResourceQuotas() == nil {
 
@@ -0,0 +1,156 @@
+import { describe, expect, it } from 'vitest'
+import { renderToString } from 'react-dom/server'
+import { LimitRangeRenderer, NamespaceLimitRangeLink, NamespaceLimitRangesSection } from './LimitRangeRenderer'
+
+function err(message: string, status?: number): Error {
+  return Object.assign(new Error(message), status === undefined ? {} : { status })
+}
+
+const multiType = {
+  apiVersion: 'v1',
+  kind: 'LimitRange',
+  metadata: { name: 'team-limits', namespace: 'dev' },
+  spec: {
+    limits: [
+      {
+        type: 'Container',
+        min: { cpu: '10m', memory: '16Mi' },
+        max: { cpu: '2', memory: '2Gi' },
+        default: { cpu: '500m', memory: '512Mi' },
+        defaultRequest: { cpu: '100m', memory: '128Mi' },
+        maxLimitRequestRatio: { cpu: '4' },
+      },
+      { type: 'Pod', max: { cpu: '4' } },
+      { type: 'PersistentVolumeClaim', min: { storage: '1Gi' }, max: { storage: '100Gi' } },
+    ],
+  },
+}
+
+describe('LimitRangeRenderer', () => {
+  it('renders every declared entry type with its own rules', () => {
+    const html = renderToString(<LimitRangeRenderer data={multiType} />)
+    expect(html).toContain('Container')
+    expect(html).toContain('Pod')
+    expect(html).toContain('PersistentVolumeClaim')
+    expect(html).toContain('100m')
+    expect(html).toContain('2Gi')
+    expect(html).toContain('storage')
+  })
+
+  // Units and resource names carry the meaning; a reformatted quantity is a
+  // different claim from the one the object makes.
+  it('shows quantities verbatim', () => {
+    const html = renderToString(<LimitRangeRenderer data={multiType} />)
+    expect(html).toContain('16Mi')
+    expect(html).toContain('10m')
+    expect(html).not.toContain('0.01 cores')
+  })
+
+  // An absent facet is not a limit of zero, and a limit of zero is a real rule.
+  it('keeps an unset value distinct from an explicit zero', () => {
+    const html = renderToString(<LimitRangeRenderer data={{
+      spec: { limits: [{ type: 'Container', min: { cpu: '0' }, max: { cpu: '1', memory: '1Gi' } }] },
+    }} />)
+    // memory has a max but no min, so its min cell is the unset marker.
+    expect(html).toContain('Not set')
+    expect(html).toContain('>0<')
+  })
+
+  it('drops facets the entry never declares instead of showing empty columns', () => {
+    const html = renderToString(<LimitRangeRenderer data={{
+      spec: { limits: [{ type: 'Pod', max: { cpu: '4' } }] },
+    }} />)
+    expect(html).toContain('Max')
+    expect(html).not.toContain('Default request')
+    expect(html).not.toContain('Max limit/request')
+  })
+
+  it('states that a LimitRange with no entries constrains nothing', () => {
+    const html = renderToString(<LimitRangeRenderer data={{ spec: {} }} />)
+    expect(html).toContain('constrains nothing')
+  })
+})
+
+describe('NamespaceLimitRangesSection', () => {
+  it('summarizes each LimitRange and links to it', () => {
+    const html = renderToString(
+      <NamespaceLimitRangesSection limitRanges={[multiType]} namespace="dev" onNavigate={() => {}} />,
+    )
+    expect(html).toContain('team-limits')
+    expect(html).toContain('Container')
+    expect(html).toContain('default request')
+  })
+
+  it('tells an empty namespace apart from one still loading', () => {
+    const empty = renderToString(<NamespaceLimitRangesSection limitRanges={[]} namespace="dev" />)
+    expect(empty).toContain('Limit Ranges (0)')
+    expect(empty).toContain('No LimitRanges found')
+    expect(empty).toContain('Other admission policies may still apply')
+
+    const loading = renderToString(<NamespaceLimitRangesSection loading namespace="dev" />)
+    expect(loading).toContain('Loading limit ranges')
+    expect(loading).not.toContain('No LimitRanges found')
+  })
+
+  // "You can't see the rules" and "there are no rules" lead to opposite
+  // conclusions about what will happen at admission.
+  it('reports a denied read rather than implying no rules exist', () => {
+    const html = renderToString(
+      <NamespaceLimitRangesSection error={err('forbidden', 403)} namespace="dev" />,
+    )
+    expect(html).toContain('permission')
+    expect(html).not.toContain('No LimitRanges found')
+  })
+
+  it('keeps cached rules visible with a stale warning when a refresh fails', () => {
+    const html = renderToString(
+      <NamespaceLimitRangesSection limitRanges={[multiType]} error={err('unavailable', 500)} namespace="dev" />,
+    )
+    expect(html).toContain('team-limits')
+    expect(html).toContain('Showing previously loaded rules')
+    expect(html).toContain('unavailable')
+    expect(html).not.toContain('This may be incomplete')
+  })
+
+  it('hides cached rules when access is denied', () => {
+    const html = renderToString(
+      <NamespaceLimitRangesSection limitRanges={[multiType]} error={err('forbidden', 403)} namespace="dev" />,
+    )
+    expect(html).toContain('permission')
+    expect(html).not.toContain('team-limits')
+    expect(html).not.toContain('No LimitRanges found')
+  })
+
+  it('keeps a fetch fault loud', () => {
+    const html = renderToString(
+      <NamespaceLimitRangesSection error={err('boom', 500)} namespace="dev" />,
+    )
+    expect(html).toContain('boom')
+    expect(html).toContain('text-red-400')
+  })
+})
+
+describe('NamespaceLimitRangeLink', () => {
+  it('links every LimitRange that governs the namespace', () => {
+    const html = renderToString(
+      <NamespaceLimitRangeLink namespace="dev" names={['team-limits', 'storage-limits']} scope="pod" onNavigate={() => {}} />,
+    )
+    expect(html).toContain('Namespace defaults')
+    expect(html).toContain('team-limits')
+    expect(html).toContain('storage-limits')
+  })
+
+  // Nothing to point at yet is not the same as pointing at nothing.
+  it('renders nothing when the lookup produced no names', () => {
+    expect(renderToString(<NamespaceLimitRangeLink namespace="dev" names={[]} scope="pod" />)).toBe('')
+    expect(renderToString(<NamespaceLimitRangeLink namespace="dev" scope="pod" />)).toBe('')
+  })
+
+  it('offers the scope explanation without adding inline prose', () => {
+    const html = renderToString(
+      <NamespaceLimitRangeLink namespace="dev" names={['team-limits']} scope="workload" onNavigate={() => {}} />,
+    )
+    expect(html).toContain('About namespace defaults and constraints')
+    expect(html).not.toContain('not the workload object itself')
+  })
+})