I think what you're looking for is a ServiceService class. Controllers should be very thin and do literally nothing but forward the data from the request to a service and respond with the appropriate output.
The service class should take care of validation delegation and dealing with the database abstraction.