Controller contains business logic

How to fix

1. Move business decisions into an application service.
2. Keep the controller focused on transport concerns.
3. Add focused service tests for the moved behavior.

What the rule validates

A controller appears to do more than request parsing, authorization handoff, and response shaping.

Why it matters

Keeping controllers thin makes business behavior easier to test, reuse, and govern.

Common causes

• Validation, branching, or persistence logic was added directly to a route handler.
• A small endpoint grew without moving behavior into a service.
• Controller code copied a service workflow inline.

Typical violation example

A controller computes billing eligibility, writes records, and sends email in the route method.

Typical compliant example

The controller validates request shape and calls BillingService.startCheckout(...).

Related rules

Adjacent categories

Related files/config

• apps/api/src
• apps/web
• packages

Related CLI commands

• archpilot validate
• archpilot validate --ci