rename path ResourceOwner() to ProtectedResource()

src/internal/kopia/wrapper_test.go

@@ -804,13 +804,13 @@ func (suite *KopiaIntegrationSuite) TestBackupCollections() {
 	reasons := []identity.Reasoner{
 		NewReason(
 			testTenant,
-			suite.storePath1.ResourceOwner(),
+			suite.storePath1.ProtectedResource(),
 			suite.storePath1.Service(),
 			suite.storePath1.Category(),
 		),
 		NewReason(
 			testTenant,
-			suite.storePath2.ResourceOwner(),
+			suite.storePath2.ProtectedResource(),
 			suite.storePath2.Service(),
 			suite.storePath2.Category(),
 		),
@@ -1076,7 +1076,7 @@ func (suite *KopiaIntegrationSuite) TestBackupCollections_NoDetailsForMeta() {
 	reasons := []identity.Reasoner{
 		NewReason(
 			testTenant,
-			storePath.ResourceOwner(),
+			storePath.ProtectedResource(),
 			storePath.Service(),
 			storePath.Category()),
 	}

src/internal/m365/groups/restore.go

@@ -57,7 +57,7 @@ func ConsumeRestoreCollections(
 			ictx     = clues.Add(ctx,
 				"category", category,
 				"restore_location", clues.Hide(rcc.RestoreConfig.Location),
-				"protected_resource", clues.Hide(dc.FullPath().ResourceOwner()),
+				"protected_resource", clues.Hide(dc.FullPath().ProtectedResource()),
 				"full_path", dc.FullPath())
 		)
 

src/internal/m365/helper_test.go

@@ -942,7 +942,7 @@ func checkHasCollections(
 
 		p, err := loc.ToDataLayerPath(
 			fp.Tenant(),
-			fp.ResourceOwner(),
+			fp.ProtectedResource(),
 			fp.Service(),
 			fp.Category(),
 			false)

src/internal/m365/onedrive_test.go

@@ -50,7 +50,7 @@ func mustGetDefaultDriveID(
 	ctx context.Context, //revive:disable-line:context-as-argument
 	ac api.Client,
 	service path.ServiceType,
-	resourceOwner string,
+	protectedResource string,
 ) string {
 	var (
 		err error
@@ -59,9 +59,9 @@ func mustGetDefaultDriveID(
 
 	switch service {
 	case path.OneDriveService:
-		d, err = ac.Users().GetDefaultDrive(ctx, resourceOwner)
+		d, err = ac.Users().GetDefaultDrive(ctx, protectedResource)
 	case path.SharePointService:
-		d, err = ac.Sites().GetDefaultDrive(ctx, resourceOwner)
+		d, err = ac.Sites().GetDefaultDrive(ctx, protectedResource)
 	default:
 		assert.FailNowf(t, "unknown service type %s", service.String())
 	}
@@ -86,10 +86,10 @@ type suiteInfo interface {
 	PrimaryUser() (string, string)
 	SecondaryUser() (string, string)
 	TertiaryUser() (string, string)
-	// ResourceOwner returns the resource owner to run the backup/restore
+	// ProtectedResource returns the resource owner to run the backup/restore
 	// with. This can be different from the values used for permissions and it can
 	// also be a site.
-	ResourceOwner() string
+	ProtectedResource() string
 	Service() path.ServiceType
 	Resource() resource.Category
 }
@@ -100,23 +100,23 @@ type oneDriveSuite interface {
 }
 
 type suiteInfoImpl struct {
-	ac               api.Client
+	ac                api.Client
-	controller       *Controller
+	controller        *Controller
-	resourceOwner    string
+	protectedResource string
-	resourceCategory resource.Category
+	resourceCategory  resource.Category
-	secondaryUser    string
+	secondaryUser     string
-	secondaryUserID  string
+	secondaryUserID   string
-	service          path.ServiceType
+	service           path.ServiceType
-	tertiaryUser     string
+	tertiaryUser      string
-	tertiaryUserID   string
+	tertiaryUserID    string
-	user             string
+	user              string
-	userID           string
+	userID            string
 }
 
 func NewSuiteInfoImpl(
 	t *testing.T,
 	ctx context.Context, //revive:disable-line:context-as-argument
-	resourceOwner string,
+	protectedResource string,
 	service path.ServiceType,
 ) suiteInfoImpl {
 	rsc := resource.Users
@@ -127,14 +127,14 @@ func NewSuiteInfoImpl(
 	ctrl := newController(ctx, t, rsc, path.OneDriveService)
 
 	return suiteInfoImpl{
-		ac:               ctrl.AC,
+		ac:                ctrl.AC,
-		controller:       ctrl,
+		controller:        ctrl,
-		resourceOwner:    resourceOwner,
+		protectedResource: protectedResource,
-		resourceCategory: rsc,
+		resourceCategory:  rsc,
-		secondaryUser:    tconfig.SecondaryM365UserID(t),
+		secondaryUser:     tconfig.SecondaryM365UserID(t),
-		service:          service,
+		service:           service,
-		tertiaryUser:     tconfig.TertiaryM365UserID(t),
+		tertiaryUser:      tconfig.TertiaryM365UserID(t),
-		user:             tconfig.M365UserID(t),
+		user:              tconfig.M365UserID(t),
 	}
 }
 
@@ -158,8 +158,8 @@ func (si suiteInfoImpl) TertiaryUser() (string, string) {
 	return si.tertiaryUser, si.tertiaryUserID
 }
 
-func (si suiteInfoImpl) ResourceOwner() string {
+func (si suiteInfoImpl) ProtectedResource() string {
-	return si.resourceOwner
+	return si.protectedResource
 }
 
 func (si suiteInfoImpl) Service() path.ServiceType {
@@ -388,7 +388,7 @@ func testRestoreAndBackupMultipleFilesAndFoldersNoPermissions(
 		ctx,
 		suite.APIClient(),
 		suite.Service(),
-		suite.ResourceOwner())
+		suite.ProtectedResource())
 
 	rootPath := []string{
 		odConsts.DrivesPathDir,
@@ -526,7 +526,7 @@ func testRestoreAndBackupMultipleFilesAndFoldersNoPermissions(
 				t,
 				testData,
 				suite.Tenant(),
-				[]string{suite.ResourceOwner()},
+				[]string{suite.ProtectedResource()},
 				control.DefaultOptions(),
 				restoreCfg)
 		})
@@ -547,7 +547,7 @@ func testPermissionsRestoreAndBackup(suite oneDriveSuite, startVersion int) {
 		ctx,
 		suite.APIClient(),
 		suite.Service(),
-		suite.ResourceOwner())
+		suite.ProtectedResource())
 
 	fileName2 := "test-file2.txt"
 	folderCName := "folder-c"
@@ -775,7 +775,7 @@ func testPermissionsRestoreAndBackup(suite oneDriveSuite, startVersion int) {
 				t,
 				testData,
 				suite.Tenant(),
-				[]string{suite.ResourceOwner()},
+				[]string{suite.ProtectedResource()},
 				control.DefaultOptions(),
 				restoreCfg)
 		})
@@ -796,7 +796,7 @@ func testRestoreNoPermissionsAndBackup(suite oneDriveSuite, startVersion int) {
 		ctx,
 		suite.APIClient(),
 		suite.Service(),
-		suite.ResourceOwner())
+		suite.ProtectedResource())
 
 	inputCols := []stub.ColInfo{
 		{
@@ -867,7 +867,7 @@ func testRestoreNoPermissionsAndBackup(suite oneDriveSuite, startVersion int) {
 				t,
 				testData,
 				suite.Tenant(),
-				[]string{suite.ResourceOwner()},
+				[]string{suite.ProtectedResource()},
 				control.DefaultOptions(),
 				restoreCfg)
 		})
@@ -891,7 +891,7 @@ func testPermissionsInheritanceRestoreAndBackup(suite oneDriveSuite, startVersio
 		ctx,
 		suite.APIClient(),
 		suite.Service(),
-		suite.ResourceOwner())
+		suite.ProtectedResource())
 
 	folderAName := "custom"
 	folderBName := "inherited"
@@ -1072,7 +1072,7 @@ func testPermissionsInheritanceRestoreAndBackup(suite oneDriveSuite, startVersio
 				t,
 				testData,
 				suite.Tenant(),
-				[]string{suite.ResourceOwner()},
+				[]string{suite.ProtectedResource()},
 				control.DefaultOptions(),
 				restoreCfg)
 		})
@@ -1094,7 +1094,7 @@ func testLinkSharesInheritanceRestoreAndBackup(suite oneDriveSuite, startVersion
 		ctx,
 		suite.APIClient(),
 		suite.Service(),
-		suite.ResourceOwner())
+		suite.ProtectedResource())
 
 	folderAName := "custom"
 	folderBName := "inherited"
@@ -1267,7 +1267,7 @@ func testLinkSharesInheritanceRestoreAndBackup(suite oneDriveSuite, startVersion
 				t,
 				testData,
 				suite.Tenant(),
-				[]string{suite.ResourceOwner()},
+				[]string{suite.ProtectedResource()},
 				control.DefaultOptions(),
 				restoreCfg)
 		})
@@ -1289,7 +1289,7 @@ func testRestoreFolderNamedFolderRegression(
 		ctx,
 		suite.APIClient(),
 		suite.Service(),
-		suite.ResourceOwner())
+		suite.ProtectedResource())
 
 	rootPath := []string{
 		odConsts.DrivesPathDir,
@@ -1383,7 +1383,7 @@ func testRestoreFolderNamedFolderRegression(
 				t,
 				testData,
 				suite.Tenant(),
-				[]string{suite.ResourceOwner()},
+				[]string{suite.ProtectedResource()},
 				control.DefaultOptions(),
 				restoreCfg)
 		})

src/internal/m365/sharepoint/collection.go

@@ -219,7 +219,7 @@ func (sc *Collection) retrieveLists(
 	lists, err := loadSiteLists(
 		ctx,
 		sc.client.Stable,
-		sc.fullPath.ResourceOwner(),
+		sc.fullPath.ProtectedResource(),
 		sc.jobs,
 		errs)
 	if err != nil {
@@ -282,14 +282,14 @@ func (sc *Collection) retrievePages(
 		return metrics, clues.New("beta service required").WithClues(ctx)
 	}
 
-	parent, err := as.GetByID(ctx, sc.fullPath.ResourceOwner())
+	parent, err := as.GetByID(ctx, sc.fullPath.ProtectedResource())
 	if err != nil {
 		return metrics, err
 	}
 
 	root := ptr.Val(parent.GetWebUrl())
 
-	pages, err := betaAPI.GetSitePages(ctx, betaService, sc.fullPath.ResourceOwner(), sc.jobs, errs)
+	pages, err := betaAPI.GetSitePages(ctx, betaService, sc.fullPath.ProtectedResource(), sc.jobs, errs)
 	if err != nil {
 		return metrics, err
 	}

src/internal/m365/sharepoint/restore.go

@@ -69,7 +69,7 @@ func ConsumeRestoreCollections(
 			ictx     = clues.Add(ctx,
 				"category", category,
 				"restore_location", clues.Hide(rcc.RestoreConfig.Location),
-				"resource_owner", clues.Hide(dc.FullPath().ResourceOwner()),
+				"resource_owner", clues.Hide(dc.FullPath().ProtectedResource()),
 				"full_path", dc.FullPath())
 		)
 
@@ -219,7 +219,7 @@ func RestoreListCollection(
 	var (
 		metrics   = support.CollectionMetrics{}
 		directory = dc.FullPath()
-		siteID    = directory.ResourceOwner()
+		siteID    = directory.ProtectedResource()
 		items     = dc.Items(ctx, errs)
 		el        = errs.Local()
 	)
@@ -292,7 +292,7 @@ func RestorePageCollection(
 	var (
 		metrics   = support.CollectionMetrics{}
 		directory = dc.FullPath()
-		siteID    = directory.ResourceOwner()
+		siteID    = directory.ProtectedResource()
 	)
 
 	trace.Log(ctx, "m365:sharepoint:restorePageCollection", directory.String())

src/internal/m365/stub/stub.go

@@ -183,7 +183,7 @@ func backupOutputPathFromRestore(
 
 	return path.Build(
 		inputPath.Tenant(),
-		inputPath.ResourceOwner(),
+		inputPath.ProtectedResource(),
 		inputPath.Service(),
 		inputPath.Category(),
 		false,

src/internal/operations/backup.go

@@ -482,7 +482,7 @@ func consumeBackupCollections(
 
 func matchesReason(reasons []identity.Reasoner, p path.Path) bool {
 	for _, reason := range reasons {
-		if p.ResourceOwner() == reason.ProtectedResource() &&
+		if p.ProtectedResource() == reason.ProtectedResource() &&
 			p.Service() == reason.Service() &&
 			p.Category() == reason.Category() {
 			return true

src/internal/operations/backup_test.go

@@ -538,12 +538,12 @@ func (suite *BackupOpUnitSuite) TestBackupOperation_MergeBackupDetails_AddsItems
 
 		pathReason1 = kopia.NewReason(
 			"",
-			itemPath1.ResourceOwner(),
+			itemPath1.ProtectedResource(),
 			itemPath1.Service(),
 			itemPath1.Category())
 		pathReason3 = kopia.NewReason(
 			"",
-			itemPath3.ResourceOwner(),
+			itemPath3.ProtectedResource(),
 			itemPath3.Service(),
 			itemPath3.Category())
 	)
@@ -685,7 +685,7 @@ func (suite *BackupOpUnitSuite) TestBackupOperation_MergeBackupDetails_AddsItems
 										[]string{
 											itemPath1.Tenant(),
 											itemPath1.Service().String(),
-											itemPath1.ResourceOwner(),
+											itemPath1.ProtectedResource(),
 											path.UnknownCategory.String(),
 										},
 										itemPath1.Folders()...,
@@ -714,7 +714,7 @@ func (suite *BackupOpUnitSuite) TestBackupOperation_MergeBackupDetails_AddsItems
 					[]string{
 						itemPath1.Tenant(),
 						path.OneDriveService.String(),
-						itemPath1.ResourceOwner(),
+						itemPath1.ProtectedResource(),
 						path.FilesCategory.String(),
 						"personal",
 						"item1",
@@ -973,7 +973,7 @@ func (suite *BackupOpUnitSuite) TestBackupOperation_MergeBackupDetails_AddsFolde
 
 		pathReason1 = kopia.NewReason(
 			"",
-			itemPath1.ResourceOwner(),
+			itemPath1.ProtectedResource(),
 			itemPath1.Service(),
 			itemPath1.Category())
 

src/internal/operations/pathtransformer/restore_path_transformer.go

@@ -44,7 +44,7 @@ func basicLocationPath(repoRef path.Path, locRef *path.Builder) (path.Path, erro
 	if len(locRef.Elements()) == 0 {
 		res, err := path.BuildPrefix(
 			repoRef.Tenant(),
-			repoRef.ResourceOwner(),
+			repoRef.ProtectedResource(),
 			repoRef.Service(),
 			repoRef.Category())
 		if err != nil {
@@ -56,7 +56,7 @@ func basicLocationPath(repoRef path.Path, locRef *path.Builder) (path.Path, erro
 
 	return locRef.ToDataLayerPath(
 		repoRef.Tenant(),
-		repoRef.ResourceOwner(),
+		repoRef.ProtectedResource(),
 		repoRef.Service(),
 		repoRef.Category(),
 		false)

src/internal/operations/pathtransformer/restore_path_transformer_test.go

@@ -40,7 +40,7 @@ func (suite *RestorePathTransformerUnitSuite) TestGetPaths() {
 			Append(
 				repoRef.Tenant(),
 				repoRef.Service().String(),
-				repoRef.ResourceOwner(),
+				repoRef.ProtectedResource(),
 				repoRef.Category().String()).
 			Append(unescapedFolders...).
 			String()

src/pkg/backup/details/testdata/testdata.go

@@ -104,7 +104,7 @@ func (p repoRefAndLocRef) locationAsRepoRef() path.Path {
 
 	res, err := tmp.ToDataLayerPath(
 		p.RR.Tenant(),
-		p.RR.ResourceOwner(),
+		p.RR.ProtectedResource(),
 		p.RR.Service(),
 		p.RR.Category(),
 		len(p.ItemLocation()) > 0)
@@ -133,7 +133,7 @@ func mustPathRep(ref string, isItem bool) repoRefAndLocRef {
 
 	rr, err := rrPB.ToDataLayerPath(
 		tmp.Tenant(),
-		tmp.ResourceOwner(),
+		tmp.ProtectedResource(),
 		tmp.Service(),
 		tmp.Category(),
 		isItem)

src/pkg/path/builder.go

@@ -201,10 +201,10 @@ func (pb Builder) withPrefix(elements ...string) *Builder {
 	return res
 }
 
-// verifyPrefix ensures that the tenant and resourceOwner are valid
+// verifyPrefix ensures that the tenant and protectedResource are valid
 // values, and that the builder has some directory structure.
-func (pb Builder) verifyPrefix(tenant, resourceOwner string) error {
+func (pb Builder) verifyPrefix(tenant, protectedResource string) error {
-	if err := verifyInputValues(tenant, resourceOwner); err != nil {
+	if err := verifyInputValues(tenant, protectedResource); err != nil {
 		return err
 	}
 

src/pkg/path/path.go

@@ -82,7 +82,7 @@ type Path interface {
 	Service() ServiceType
 	Category() CategoryType
 	Tenant() string
-	ResourceOwner() string
+	ProtectedResource() string
 	Folder(escaped bool) string
 	Folders() Elements
 	Item() string
@@ -132,7 +132,7 @@ type RestorePaths struct {
 // ---------------------------------------------------------------------------
 
 func Build(
-	tenant, resourceOwner string,
+	tenant, protectedResource string,
 	service ServiceType,
 	category CategoryType,
 	hasItem bool,
@@ -141,13 +141,13 @@ func Build(
 	b := Builder{}.Append(elements...)
 
 	return b.ToDataLayerPath(
-		tenant, resourceOwner,
+		tenant, protectedResource,
 		service, category,
 		hasItem)
 }
 
 func BuildPrefix(
-	tenant, resourceOwner string,
+	tenant, protectedResource string,
 	s ServiceType,
 	c CategoryType,
 ) (Path, error) {
@@ -157,12 +157,12 @@ func BuildPrefix(
 		return nil, err
 	}
 
-	if err := verifyInputValues(tenant, resourceOwner); err != nil {
+	if err := verifyInputValues(tenant, protectedResource); err != nil {
 		return nil, err
 	}
 
 	return &dataLayerResourcePath{
-		Builder:  *pb.withPrefix(tenant, s.String(), resourceOwner, c.String()),
+		Builder:  *pb.withPrefix(tenant, s.String(), protectedResource, c.String()),
 		service:  s,
 		category: c,
 		hasItem:  false,
@@ -290,13 +290,13 @@ func Split(segment string) []string {
 // Unexported Helpers
 // ---------------------------------------------------------------------------
 
-func verifyInputValues(tenant, resourceOwner string) error {
+func verifyInputValues(tenant, protectedResource string) error {
 	if len(tenant) == 0 {
 		return clues.Stack(errMissingSegment, clues.New("tenant"))
 	}
 
-	if len(resourceOwner) == 0 {
+	if len(protectedResource) == 0 {
-		return clues.Stack(errMissingSegment, clues.New("resourceOwner"))
+		return clues.Stack(errMissingSegment, clues.New("protected resource"))
 	}
 
 	return nil

src/pkg/path/path_test.go

@@ -407,7 +407,7 @@ func (suite *PathUnitSuite) TestFromDataLayerPath() {
 							assert.Equal(t, service, p.Service(), "service")
 							assert.Equal(t, cat, p.Category(), "category")
 							assert.Equal(t, testTenant, p.Tenant(), "tenant")
-							assert.Equal(t, testUser, p.ResourceOwner(), "resource owner")
+							assert.Equal(t, testUser, p.ProtectedResource(), "protected resource")
 
 							fld := p.Folder(false)
 							escfld := p.Folder(true)
@@ -438,7 +438,7 @@ func (suite *PathUnitSuite) TestBuildPrefix() {
 		service   ServiceType
 		category  CategoryType
 		tenant    string
-		owner     string
+		resource  string
 		expect    string
 		expectErr require.ErrorAssertionFunc
 	}{
@@ -447,7 +447,7 @@ func (suite *PathUnitSuite) TestBuildPrefix() {
 			service:   ExchangeService,
 			category:  ContactsCategory,
 			tenant:    "t",
-			owner:     "ro",
+			resource:  "ro",
 			expect:    join([]string{"t", ExchangeService.String(), "ro", ContactsCategory.String()}),
 			expectErr: require.NoError,
 		},
@@ -456,7 +456,7 @@ func (suite *PathUnitSuite) TestBuildPrefix() {
 			service:   ExchangeService,
 			category:  FilesCategory,
 			tenant:    "t",
-			owner:     "ro",
+			resource:  "ro",
 			expectErr: require.Error,
 		},
 		{
@@ -464,15 +464,15 @@ func (suite *PathUnitSuite) TestBuildPrefix() {
 			service:   ExchangeService,
 			category:  ContactsCategory,
 			tenant:    "",
-			owner:     "ro",
+			resource:  "ro",
 			expectErr: require.Error,
 		},
 		{
-			name:      "bad owner",
+			name:      "bad resource",
 			service:   ExchangeService,
 			category:  ContactsCategory,
 			tenant:    "t",
-			owner:     "",
+			resource:  "",
 			expectErr: require.Error,
 		},
 	}
@@ -480,7 +480,7 @@ func (suite *PathUnitSuite) TestBuildPrefix() {
 		suite.Run(test.name, func() {
 			t := suite.T()
 
-			r, err := BuildPrefix(test.tenant, test.owner, test.service, test.category)
+			r, err := BuildPrefix(test.tenant, test.resource, test.service, test.category)
 			test.expectErr(t, err, clues.ToCore(err))
 
 			if r == nil {

src/pkg/path/resource_path.go

@@ -10,7 +10,7 @@ import (
 // dataLayerResourcePath with invalid service/category combinations.
 //
 // All dataLayerResourcePaths start with the same prefix:
-// <tenant ID>/<service>/<resource owner ID>/<category>
+// <tenant ID>/<service>/<protected resource ID>[/<subService>/<protected resource ID>]/<category>
 // which allows extracting high-level information from the path. The path
 // elements after this prefix represent zero or more folders and, if the path
 // refers to a file or item, an item ID. A valid dataLayerResourcePath must have
@@ -38,9 +38,9 @@ func (rp dataLayerResourcePath) Category() CategoryType {
 	return rp.category
 }
 
-// ResourceOwner returns the user ID or group ID embedded in the
+// ProtectedResource returns the resource ID embedded in the
 // dataLayerResourcePath.
-func (rp dataLayerResourcePath) ResourceOwner() string {
+func (rp dataLayerResourcePath) ProtectedResource() string {
 	return rp.Builder.elements[2]
 }
 

src/pkg/path/resource_path_test.go

@@ -37,7 +37,7 @@ var (
 			rest:   rest,
 		},
 		{
-			name:   "NoResourceOwner",
+			name:   "NoProtectedResource",
 			tenant: testTenant,
 			user:   "",
 			rest:   rest,
@@ -404,7 +404,7 @@ func (suite *DataLayerResourcePath) TestToExchangePathForCategory() {
 					assert.Equal(t, testTenant, p.Tenant())
 					assert.Equal(t, path.ExchangeService, p.Service())
 					assert.Equal(t, test.category, p.Category())
-					assert.Equal(t, testUser, p.ResourceOwner())
+					assert.Equal(t, testUser, p.ProtectedResource())
 					assert.Equal(t, strings.Join(m.expectedFolders, "/"), p.Folder(false))
 					assert.Equal(t, path.Elements(m.expectedFolders), p.Folders())
 					assert.Equal(t, m.expectedItem, p.Item())
@@ -471,12 +471,12 @@ func (suite *PopulatedDataLayerResourcePath) TestCategory() {
 	}
 }
 
-func (suite *PopulatedDataLayerResourcePath) TestResourceOwner() {
+func (suite *PopulatedDataLayerResourcePath) TestProtectedResource() {
 	for _, m := range modes {
 		suite.Run(m.name, func() {
 			t := suite.T()
 
-			assert.Equal(t, testUser, suite.paths[m.isItem].ResourceOwner())
+			assert.Equal(t, testUser, suite.paths[m.isItem].ProtectedResource())
 		})
 	}
 }

src/pkg/repository/loadtest/repository_load_test.go

@@ -348,7 +348,7 @@ func ensureAllUsersInDetails(
 				continue
 			}
 
-			ro := p.ResourceOwner()
+			ro := p.ProtectedResource()
 			if !assert.NotEmpty(t, ro, "resource owner in path: "+rr) {
 				continue
 			}

src/pkg/selectors/exchange_test.go

@@ -816,7 +816,7 @@ func (suite *ExchangeSelectorSuite) TestExchangeRestore_Reduce() {
 
 		joinedFldrs := strings.Join(newElems, "/")
 
-		return stubRepoRef(p.Service(), p.Category(), p.ResourceOwner(), joinedFldrs, p.Item())
+		return stubRepoRef(p.Service(), p.Category(), p.ProtectedResource(), joinedFldrs, p.Item())
 	}
 
 	makeDeets := func(refs ...path.Path) *details.Details {

src/pkg/selectors/scopes.go

@@ -545,7 +545,7 @@ func reduce[T scopeT, C categoryT](
 		}
 
 		// first check, every entry needs to match the selector's resource owners.
-		if !matchesResourceOwner.Compare(repoPath.ResourceOwner()) {
+		if !matchesResourceOwner.Compare(repoPath.ProtectedResource()) {
 			continue
 		}