A lot of validation rules are missing from the create() and update() methods, the updateByPostion() method is not validation at all. Plus, the validation of the update() method doesn't support partial updating, you need to pass all of the fields.