Facade — Find the Bug¶

Source: refactoring.guru/design-patterns/facade

Each section presents a Facade that looks fine but is broken. Find the bug yourself, then check.

Table of Contents¶

1. Bug 1: Missing rollback on partial failure
2. Bug 2: Subsystem exception leaks across the boundary
3. Bug 3: Subsystem types in the API
4. Bug 4: Facade constructs its own dependencies
5. Bug 5: Hidden side effect surprises caller
6. Bug 6: Default that becomes a security incident
7. Bug 7: God-class Facade
8. Bug 8: Sequential when parallel was safe
9. Bug 9: Facade swallows error silently
10. Bug 10: Idempotent Facade isn't actually idempotent
11. Bug 11: Connection pool created per call
12. Bug 12: Saga compensation doesn't compensate
13. Practice Tips

Bug 1: Missing rollback on partial failure¶

public Order placeOrder(PlaceOrderCommand cmd) {
    var reservation = inventory.reserve(cmd.items());
    var receipt = payments.charge(cmd.user(), cmd.total());   // can throw
    var order = orders.save(new Order(cmd.user(), reservation, receipt));
    notifications.send(order);
    return order;
}

A user reports being charged for an order that "doesn't exist."

var reservation = inventory.reserve(cmd.items());
Receipt receipt;
try {
    receipt = payments.charge(cmd.user(), cmd.total());
} catch (Exception e) {
    inventory.cancel(reservation);
    throw e;
}
try {
    return orders.save(new Order(cmd.user(), reservation, receipt));
} catch (Exception e) {
    payments.refund(receipt);
    inventory.cancel(reservation);
    throw e;
}

Bug 2: Subsystem exception leaks across the boundary¶

public Receipt pay(PaymentRequest req) {
    return stripeClient.charges().create(req.toStripeParams());
    // Throws StripeException — propagates up
}

Callers wrote catch (StripeException e) { ... }. Now the team is migrating to Adyen; every catch block needs to change.

public Receipt pay(PaymentRequest req) throws PaymentException {
    try {
        return mapToReceipt(stripeClient.charges().create(req.toStripeParams()));
    } catch (StripeException e) {
        throw new PaymentException(e.getMessage(), e);
    }
}

Bug 3: Subsystem types in the API¶

public Charge processPayment(int amount) {
    return stripeClient.charges().create(...);   // returns Stripe's Charge type
}

Caller code: var charge = service.processPayment(100); chargeId = charge.getId();. When Stripe deprecates Charge.getId() in favor of getChargeId(), every caller breaks.

public class Receipt {
    private final String id;
    private final long amount;
    private final Instant chargedAt;
    // ...
}

public Receipt processPayment(int amount) {
    Charge ch = stripeClient.charges().create(...);
    return new Receipt(ch.getId(), ch.getAmount(), Instant.now());
}

Bug 4: Facade constructs its own dependencies¶

class OrderService:
    def __init__(self):
        self._inv = InventoryService()        # constructed inside
        self._pay = PaymentProcessor(api_key="...")   # constructed inside
        self._orders = OrderRepository(db_url="...")  # constructed inside

Tests fail: "can't reach the real Stripe API" / "no DB available."

class OrderService:
    def __init__(self, inv, pay, orders):
        self._inv = inv
        self._pay = pay
        self._orders = orders

Bug 5: Hidden side effect surprises caller¶

class FileService:
    def save(self, path: str, data: bytes) -> None:
        with open(path, "wb") as f:
            f.write(data)
        # Also: send a "file uploaded" notification to admins
        self._email.send_admin("file uploaded: " + path)

A user uploads 1000 files in a script; admins get spammed with 1000 emails.

def save(self, path: str, data: bytes, notify_admin: bool = False) -> None:
    with open(path, "wb") as f:
        f.write(data)
    if notify_admin:
        self._email.send_admin("file uploaded: " + path)

Bug 6: Default that becomes a security incident¶

class S3Facade:
    def upload(self, key: str, data: bytes) -> None:
        self._client.put_object(
            Bucket=self._bucket,
            Key=key,
            Body=data,
            ACL="public-read",   # ← default
        )

A new developer uses the Facade for a private document. Two weeks later it's indexed by Google.

def upload(self, key: str, data: bytes, public: bool = False) -> None:
    acl = "public-read" if public else "private"
    self._client.put_object(Bucket=self._bucket, Key=key, Body=data, ACL=acl)

Bug 7: God-class Facade¶

public class OrderService {
    public Order placeOrder(...) { ... }
    public void cancelOrder(...) { ... }
    public Refund issueRefund(...) { ... }
    public Order reissue(...) { ... }
    public void exportInvoice(...) { ... }
    public void notifyMarketing(...) { ... }
    public void recalculateInventory(...) { ... }
    public List<Order> searchOrders(...) { ... }
    public OrderAnalytics getAnalytics(...) { ... }
    // ... 20 more
}

The team complains: testing is slow, every PR touches this file, merges are painful.

public class CustomerCheckoutService { /* placeOrder, cancelOrder */ }
public class AdminOrderService { /* refund, reissue */ }
public class OrderReportingService { /* analytics, search */ }

Bug 8: Sequential when parallel was safe¶

public OrderQuote quote(QuoteCommand cmd) {
    var inv = inventory.check(cmd.items());      // 50ms
    var price = pricing.quote(cmd.items());      // 80ms
    var risk = fraud.score(cmd.user());          // 100ms
    return new OrderQuote(inv, price, risk);    // total: 230ms
}

P99 latency on this endpoint is 280ms. Subsystems are independent; could run in parallel.

var inv = supplyAsync(() -> inventory.check(cmd.items()), executor);
var price = supplyAsync(() -> pricing.quote(cmd.items()), executor);
var risk = supplyAsync(() -> fraud.score(cmd.user()), executor);
return allOf(inv, price, risk)
    .thenApply(_ -> new OrderQuote(inv.join(), price.join(), risk.join()))
    .join();

Bug 9: Facade swallows error silently¶

class EmailFacade:
    def send(self, to: str, subject: str, body: str) -> None:
        try:
            self._smtp.send(to, subject, body)
        except Exception as e:
            self._log.warning(f"email failed: {e}")
            # Continue silently

A customer complains: "I never got my password reset email." The team logs say "email failed" but the user got a "success" page.

def send(self, to: str, subject: str, body: str) -> None:
    try:
        self._smtp.send(to, subject, body)
    except Exception as e:
        self._log.warning(f"email failed: {e}")
        raise EmailError(f"failed to send to {to}") from e

Bug 10: Idempotent Facade isn't actually idempotent¶

func (c *CheckoutFacade) PlaceOrder(cmd PlaceOrderCommand) (*Order, error) {
    if cmd.IdempotencyKey == "" {
        cmd.IdempotencyKey = uuid.NewString()   // ← always new
    }
    return c.inner.PlaceOrder(cmd)
}

Network retries cause duplicate charges.

func (c *CheckoutFacade) PlaceOrder(cmd PlaceOrderCommand) (*Order, error) {
    if cmd.IdempotencyKey == "" {
        return nil, errors.New("idempotency key required")
    }
    if existing, ok := c.orders.GetByKey(cmd.IdempotencyKey); ok {
        return existing, nil
    }
    return c.inner.PlaceOrder(cmd)
}

Bug 11: Connection pool created per call¶

class HttpFacade:
    def get(self, url: str) -> dict:
        pool = urllib3.PoolManager()   # ← new per call
        r = pool.request("GET", url)
        return json.loads(r.data)

Under load, the application is slow. TLS handshakes dominate the trace.

class HttpFacade:
    def __init__(self):
        self._pool = urllib3.PoolManager()

    def get(self, url: str) -> dict:
        r = self._pool.request("GET", url)
        return json.loads(r.data)

Bug 12: Saga compensation doesn't compensate¶

public Order placeOrder(PlaceOrderCommand cmd) {
    var reservation = inventory.reserve(cmd.items());
    try {
        var receipt = payments.charge(cmd.user(), cmd.total());
        return orders.save(new Order(cmd.user(), reservation, receipt));
    } catch (Exception e) {
        inventory.cancel(reservation);
        throw e;
    }
}

After a payment failure, the inventory cancellation also fails (network issue). The reservation hangs forever.

} catch (Exception e) {
    try {
        inventory.cancel(reservation);
    } catch (Exception cancelEx) {
        log.error("compensation failed: must reconcile manually", cancelEx);
        // Or: enqueue for async retry; or: write to dead-letter queue
    }
    throw e;
}

Practice Tips¶

• Read each snippet, stop, predict the failure mode.
• For each bug, ask: "what's the worst production outcome?" Many Facade bugs are silent (hidden side effects, swallowed errors, defaults that bite).
• After fixing, write a test that would have caught the bug. If it's awkward, the fix is incomplete.
• Repeat in a week. These bugs repeat across codebases.

← Back to Facade folder · ↑ Structural Patterns · ↑↑ Roadmap Home

Next: Facade — Optimize