Your controller are responsible to just delegating the responsibility to someone. When you've some complex business rules, are recommended you have another abstraction for you business rules and this complexity the in that layer.
But, in general, depending on your app specific, there ok to prototype the rules inside controller to not introduce an unnecessary complexity on the stage 0 of the app, but when it grows are good to create the business layer and do the right responsibility in the right layer.