Nope nope nope nope.  :)

This is too much logic for a controller.  We will definitely need an endpoint to handle this kind of thing, but it might not even live in the Shops controller.  Here are a couple of possibilities:

1.  We make a Transactions controller - we can do this without creating a Transactions model if we want to.  Transaction#create takes a Seller, a Buyer, and a Good, and delegates the underlying logic to a single selected model (i.e., all transactions are handled as a `.buy` method on the buyer or as a `.sell` method on the seller, but it's only one and it's the same every time)

2.  We make a "transact" action in the Shops controller.  It looks up a Shop and a Customer, then passes relevant params (good, quantity, buy/sell instructions) and delegates the logic to the Shop model specifically.

3.  We make a "transfer" action in a Goods controller.  It looks up a Good, then passes relevant params (buyer, seller, quantity) and delegates the logic to a single underlying model as above.

The important pattern is the "delegates the logic" bit.  A controller should only support the channel over which a conversation is happening.

Have you ever had a relay call?  It's where a person using a TDD is calling a person using a regular telephone.  A TDD is text-based, of course, so there needs to be an adapter of some kind in the middle.  That adapter is a Relay Operator, whose job is to read the text coming from the TDD out loud to the person on the phone, then transcribe the audio from the phone as text to the person using the TDD.

The Relay Operator is kind of like a controller.  They can't actually participate in the conversation - they can only facilitate it.  They are limited to helping with the actual channel of the conversation - you can ask them to re-read the last sentence, and you can ask them to spell a word as it was typed, but nothing else.  I remember asking once whether a relay service as billable per minute, per call, or free, because it made a difference as to how I was going to handle the call; the operator duly typed the question to the customer to let them explain (it's a free, nationally-provided service).  

So, in this buy/sell situation, our Controller should pass along the message between the right parties, but only that - incoming parameters, outgoing data.  When asked questions like "What does buying a thing actually mean" or "how many parties are involved," the controller shouldn't know.  It should know "Shop#buy: I send a good, a buyer, and a quantity to the correct shop.  If successful, I send this message back; if not successful I send this other message back."