Looking back at this code, it looks like there’s a subtlety I forgot to mention. The first time you run an app after a fresh install, media.hasSource( media.PhotoLibrary ) would always return true. This is by design as iOS permissions have a “not determined” state that they’re initialized to when an app is run the first time.
By returning true that first time, your Lua app could continue to whatever behavior needs permission, and the OS can request that permission when necessary.