Allow existing NAS photo read group and reject unreadable catalogs

tests/test_external_photo_sources.py

@@ -204,3 +204,21 @@ def test_scheduled_random_photo_runs_once_with_restore(app, service, photos):
     op = service.operation(rows[0]["id"])
     assert op["status"] in ("SYNCING", "COMPLETED")
     assert service.state("living-room")["previous_image_id"] == original
+
+
+def test_unreadable_source_is_forbidden_not_empty(
+    client, photos, settings, monkeypatch
+):
+    import os
+
+    original = os.scandir
+
+    def restricted(path):
+        if str(path) == str(settings.photo_root / "family"):
+            raise PermissionError("permission denied")
+        return original(path)
+
+    monkeypatch.setattr(os, "scandir", restricted)
+    response = client.get("/api/v1/photo-sources/family/images")
+    assert response.status_code == 403
+    assert response.json()["error"]["code"] == "FORBIDDEN"