Controller logic vs Service/Business layer logic

I am working on an application and am using a Repository-Service-Controller approach for a REST API.

I find myself debating between controller logic vs service logic. The service logic deals with business logic, such as calculating a book price, and the controller logic should deal with presentation details.

• What if part of the business logic of the application is to check the publisher is subscribed to a PremiumService to determine if the book is editable? Would this go in business logic or controller logic?
• What if in the controller, I want to hide the books being presented if the publisher isn't subscribed in the SubscriptionService? Would SubscriptionService then be a dependency of PublisherController to check the publisher of the book is subscribed in the PremiumService?

I can see how creating too many dependencies on the BookService could turn into spaghetti code though.

Here is an interface with pseudo code to help answer my questions.

class Publisher
{
    public function getId(): int;
    public function getName(): string;
    public function getBooks(): Book[];
}


class Book
{
    public function getId(): int;
    public function getName(): string;
    public function getPublisher(): Publisher;
    public function getAuthors(): Author[];
}

class Author
{
    public function getId(): int;
    public function getName(): string;
    public function getBooks(): Book[];
}

// Simple CRUD repository.
class BookRepository
{
    public function find($id);
    public function findAll($criteria);
    public function edit($book);
    public function remove($book);
}

class BookService
{
    public function __construct(BookRepository $book_repository, AuthorService $author_service, PremiumService $subscription_service);

    public function get($id);

    public function getAll($criteria);

    public function edit(Book $book); // Book is editable if the publisher of the book is subscribed to the PremiumService

    public function remove(Book $book); // Book is removable if the publisher of the book is subscribed to the PremiumService

    public function addAuthor(Author $author, Book $book); // Can only add an author if the publisher of the book is subscribed to the PremiumService.
}

class PublisherController
{
    public function __construct(BookService $book_service);

    public function getBook(Request $request); // Can only view a book if the publisher of the book is subscribed to the PremiumService

    public function getBooks(Request $request); Can only view books if the publisher of the book is subscribed to the PremiumService
}

What is the usual or recommended approach here if a service relies on too many dependencies of other services? Should the service be dumb, like the repository?