Take the 2-minute tour ×  It is common sense to keep business
logic out of controllers. It is also common sense that database
access logic should be on a repository, using a repository
pattern, as described here: Repository Pattern  However, the
repository pattern specifies only very simple low level database
operations: Insert, Delete, Update, Select. People advise to
keep validation logic out of it too. That is not a problem,
since most of the validation can be put inside the model object
itself. The problem comes when we need to make some kind of
cross-validation, that is, a validation that needs to look on
more than one instance of the same model object (for example,
ensuring that a name is unique accross all instances of same
object) or, even worse, when the validation logic needs to check
two or more objects of different types. In this case, we have a
real big hole: the business logic cannot be in controller,
cannot be in the repository, cannot be in the object model
itself (since the logic is not bound