Keep checking the authorization policies while projecting

* The projection only replaces the DTO creation, the filters and the policies still apply

Author: maliming

docs/en/framework/architecture/domain-driven-design/application-services.md

@@ -521,7 +521,14 @@ and the provider has to be able to translate the join. The one row per entity ru
 that's why the example uses a left join. A joined column can not be used for the sorting and the paging,
 since they are already applied to the entity query before this method is called.
 
-> The projection replaces the entity based extension points. `GetAsync` doesn't use `GetEntityByIdAsync` and `MapToGetOutputDtoAsync`, `GetListAsync` doesn't use `MapToGetListOutputDtosAsync` anymore. Projectors are resolved by the `(entity, DTO)` type pair, so registering one enables the projection for every application service using that pair. If an application service needs to keep using the entity based extension points, override the `GetOutputDtoQueryProjector` or `GetListOutputDtoQueryProjector` property and return `null`:
+A projector is resolved by the `(entity, DTO)` type pair, just like an `IObjectMapper<TSource, TDestination>`, so registering one enables the projection for every application service using that pair. The projection only replaces the way the DTOs are created:
+
+* `GetAsync` doesn't use `GetEntityByIdAsync` and `MapToGetOutputDtoAsync` anymore.
+* `GetListAsync` doesn't use `MapToGetListOutputDtosAsync` anymore.
+
+Everything else is untouched. The authorization policies are still checked, `CreateFilteredQueryAsync`, `ApplySorting` and `ApplyPaging` are still used, the data filters (like soft delete and multi-tenancy) are still applied, and the create, update and delete methods still use the [IObjectMapper](../../infrastructure/object-to-object-mapping.md).
+
+> If an application service needs to keep using the entity based extension points, override the `GetOutputDtoQueryProjector` or `GetListOutputDtoQueryProjector` property and return `null`:
 
 ````csharp
 public class BookAppService : CrudAppService<Book, BookDto, Guid>

framework/test/Volo.Abp.Ddd.Application.Tests/Volo/Abp/Application/Services/QueryProjection/BookPolicyCheckedAppService.cs

@@ -0,0 +1,29 @@
+using System;
+using System.Threading.Tasks;
+using Volo.Abp.Domain.Repositories;
+
+namespace Volo.Abp.Application.Services.QueryProjection;
+
+public class BookPolicyCheckedException : Exception
+{
+
+}
+
+public class BookPolicyCheckedAppService : CrudAppService<Book, BookDto, Guid>
+{
+    public BookPolicyCheckedAppService(IRepository<Book, Guid> repository)
+        : base(repository)
+    {
+
+    }
+
+    protected override Task CheckGetPolicyAsync()
+    {
+        throw new BookPolicyCheckedException();
+    }
+
+    protected override Task CheckGetListPolicyAsync()
+    {
+        throw new BookPolicyCheckedException();
+    }
+}

framework/test/Volo.Abp.Ddd.Application.Tests/Volo/Abp/Application/Services/QueryProjection/QueryProjection_Tests.cs

@@ -178,4 +178,14 @@ public async Task Should_Project_A_Single_Entity_From_An_AbstractKey_Application
 
         (await appService.GetAsync(_bookId)).Name.ShouldEndWith(BookProjector.Marker);
     }
+
+    [Fact]
+    public async Task Should_Check_The_Policies_While_Projecting()
+    {
+        var appService = GetRequiredService<BookPolicyCheckedAppService>();
+
+        await Should.ThrowAsync<BookPolicyCheckedException>(async () => await appService.GetAsync(_bookId));
+        await Should.ThrowAsync<BookPolicyCheckedException>(async () =>
+            await appService.GetListAsync(new PagedAndSortedResultRequestDto()));
+    }
 }