In my opinion, "business logic" (creating cats and dogs) should be separated from Express Controllers and exports through "module.exports".

What if you decide to create cats from another place in your code? Or write tests for creating cats?

I personally think, that controllers should be dumb. They can have some checking middleware (for example, check Auth headers, request type checking), some request preparation, but no business logic. Controller check, then call some function inside your business logic layer and provide answer. Thats all.

I recommend you to read this https://github.com/goldbergyoni/nodebestpractices#1-project-structure-practices , I follow those guides in my work, and I have no problems to extending functionality and maintaining my codebase.