My suggestion is to take away the authorization check outside of the exampleService, so the function getAllByProject() by examService will only take one argument, which is the project object (like the name).

This is only my personal opinion, and there might be a better approach for this.