ToDo controller (cross-site)

TodoController.java

package hello;

import static java.util.Collections.synchronizedList;
import static org.apache.http.HttpStatus.SC_BAD_REQUEST;
import static org.apache.http.HttpStatus.SC_NOT_FOUND;
import static org.apache.http.HttpStatus.SC_OK;
import static org.apache.http.HttpStatus.SC_UNPROCESSABLE_ENTITY;
import static org.springframework.web.bind.annotation.RequestMethod.DELETE;
import static org.springframework.web.bind.annotation.RequestMethod.GET;
import static org.springframework.web.bind.annotation.RequestMethod.OPTIONS;
import static org.springframework.web.bind.annotation.RequestMethod.POST;
import static org.springframework.web.bind.annotation.RequestMethod.PUT;

import java.util.ArrayList;
import java.util.List;
import java.util.Map;

import javax.servlet.http.HttpServletResponse;

import org.apache.commons.lang3.BooleanUtils;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class TodoController {
    
    private final List<Todo> todos = synchronizedList(new ArrayList<>());
    
    @RequestMapping(path = "/todo", method = { OPTIONS }, produces = "application/json")
    public String getOption(HttpServletResponse response, Model model) {
        response.setHeader("Access-Control-Allow-Origin", "*");
        response.setHeader("Access-Control-Allow-Methods", "GET,PUT,POST,DELETE,OPTIONS");
        return "";
    }
    
    @RequestMapping(path = "/todo/{id}", method = { OPTIONS }, produces = "application/json")
    public String getOptionForId(@PathVariable("id") int id, HttpServletResponse response, Model model) {
        response.setHeader("Access-Control-Allow-Origin", "*");
        response.setHeader("Access-Control-Allow-Methods", "GET,PUT,POST,DELETE,OPTIONS");
        return "";
    }
    
    @RequestMapping(path = "/todos/{user}", method = { GET }, produces = "application/json")
    public List<Todo> readAllForUser(@PathVariable("user") String user, HttpServletResponse response) {
        response.setHeader("Access-Control-Allow-Origin", "*");
        
        if ("ben".equalsIgnoreCase(user)) {
            response.setStatus(SC_OK);
            return todos;
        } else {
            response.setStatus(SC_NOT_FOUND);
            return new ArrayList<>();
        }
    }
    
    @RequestMapping(path = "/todo/{id}", method = { GET }, produces = "application/json")
    public Todo read(@PathVariable("id") int id, HttpServletResponse response) {
        response.setHeader("Access-Control-Allow-Origin", "*");
        
        try {
            response.setStatus(SC_OK);
            return todos.stream().filter(it -> it.getId() == id).findFirst().orElseThrow(IndexOutOfBoundsException::new);
            
        } catch (IndexOutOfBoundsException e) {
            response.setStatus(SC_NOT_FOUND);
            return null;
            
        } catch (Exception e) {
            throw new InternalServerErrorException();
        }
    }
    
    @RequestMapping(path = "/todo", method = { POST }, produces = "application/json")
    public List<Todo> create(@RequestBody Map<String, String> body, HttpServletResponse response) {
        response.setHeader("Access-Control-Allow-Origin", "*");
        
        try {
            if (body.get("text") != null) {
                boolean done = BooleanUtils.toBoolean(body.get("done"));
                todos.add(new Todo(body.get("text"), done));
                response.setStatus(SC_OK);
                
            } else {
                response.setStatus(SC_UNPROCESSABLE_ENTITY);
            }
            
        } catch (Exception e) {
            throw new InternalServerErrorException();
        }
        return todos;
    }
    
    @RequestMapping(path = "/todo", method = { DELETE }, produces = "application/json")
    public synchronized List<Todo> deleteByObject(@RequestBody Todo body, HttpServletResponse response) {
        response.setHeader("Access-Control-Allow-Origin", "*");
        
        try {
            if (todos.remove(body)) {
                response.setStatus(SC_OK);
            } else {
                response.setStatus(SC_NOT_FOUND);
            }
            
        } catch (Exception e) {
            throw new InternalServerErrorException();
        }
        
        return todos;
    }
    
    @RequestMapping(path = "/todo/{id}", method = { DELETE }, produces = "application/json")
    public List<Todo> deleteById(@PathVariable("id") int id, HttpServletResponse response) {
        response.setHeader("Access-Control-Allow-Origin", "*");
        
        try {
            if (todos.removeIf(it -> it.getId() == id)) {
                response.setStatus(SC_OK);
            } else {
                response.setStatus(SC_NOT_FOUND);
            }
            
        } catch (Exception e) {
            throw new InternalServerErrorException();
        }
        return todos;
    }
    
    @RequestMapping(path = "/todo/{id}", method = { PUT }, produces = "application/json")
    public List<Todo> update(@PathVariable("id") int id, @RequestBody Todo body, HttpServletResponse response) {
        response.setHeader("Access-Control-Allow-Origin", "*");
        
        try {
            todos.stream()
                    .filter(it -> it.getId() == id)
                    .findFirst()
                    .orElseThrow(IndexOutOfBoundsException::new)
                    .put(body);
                    
            response.setStatus(SC_OK);
            
        } catch (IndexOutOfBoundsException e) {
            response.setStatus(SC_NOT_FOUND);
            
        } catch (Exception e) {
            throw new InternalServerErrorException();
        }
        return todos;
    }
    
    @RequestMapping(path = "/todo", method = { PUT }, produces = "application/json")
    public List<Todo> updateByObject(@RequestBody List<Todo> body, HttpServletResponse response) {
        response.setHeader("Access-Control-Allow-Origin", "*");
        
        try {
            if (body.size() != 2) {
                response.setStatus(SC_BAD_REQUEST);
                
            } else {
                response.setStatus(SC_NOT_FOUND);
                todos.stream()
                        .filter(it -> it.equals(body.get(0)))
                        .findFirst()
                        .ifPresent(it -> {
                            it.put(body.get(1));
                            response.setStatus(SC_OK);
                        });
            }
            
        } catch (Exception e) {
            throw new InternalServerErrorException();
        }
        
        return todos;
    }
    
}