diff --git a/src/modules/orders/controllers/orders.controller.ts b/src/modules/orders/controllers/orders.controller.ts
index 124abba..faf9373 100644
--- a/src/modules/orders/controllers/orders.controller.ts
+++ b/src/modules/orders/controllers/orders.controller.ts
@@ -43,40 +43,33 @@ export class OrdersController {
     return this.ordersService.findOne(orderId, shopId);
   }
 
-  @UseGuards(AuthGuard)
   @Patch('public/orders/:id/:status')
-  @ApiParam({
-    name: 'status',
-    description: 'Order status',
-    enum: OrderStatus,
-  })
+  @UseGuards(AuthGuard)
   @ApiHeader(API_HEADER_SLUG)
-  @ApiBody({ type: UpdateOrderStatusDto })
+  @ApiParam({ name: 'status', description: 'Order status', enum: [OrderStatus.CANCELED, OrderStatus.COMPLETED] })
   @ApiOperation({ summary: 'Update status of an order By User' })
-  @ApiParam({ name: 'id', description: 'Order ID' })
-  cancelOrder(
+  changeOrderStatus(
     @Body() dto: UpdateOrderStatusDto,
     @Param('id') orderId: string,
-    @Param('status') status: OrderStatus,
+    @Param('status') status: OrderStatus.CANCELED | OrderStatus.COMPLETED,
     @ShopId() shopId: string,
   ) {
     return this.ordersService.changeOrderStatus(orderId, shopId, status, 'user', dto?.desc);
   }
 
   /********************  Admin Routes **********************/
+  @Get('admin/orders')
   @UseGuards(AdminAuthGuard)
   @Permissions(Permission.MANAGE_ORDERS)
-  @Get('admin/orders')
   @ApiOperation({ summary: 'Get all orders with pagination and filters' })
   findAllAdmin(@ShopId() shopId: string, @Query() dto: FindOrdersDto) {
     return this.ordersService.findAllForAdmin(shopId, dto);
   }
 
+  @Get('admin/orders/:orderId')
   @UseGuards(AdminAuthGuard)
   @Permissions(Permission.MANAGE_ORDERS)
   @ApiOperation({ summary: 'Get an order By id for User' })
-  @ApiParam({ name: 'orderId', description: 'Order ID' })
-  @Get('admin/orders/:orderId')
   findOneAsAdmin(@Param('orderId') orderId: string, @ShopId() shopId: string) {
     return this.ordersService.findOne(orderId, shopId);
   }
diff --git a/src/modules/orders/providers/orders.service.ts b/src/modules/orders/providers/orders.service.ts
index 2ddd991..dbd6c00 100644
--- a/src/modules/orders/providers/orders.service.ts
+++ b/src/modules/orders/providers/orders.service.ts
@@ -127,7 +127,7 @@ export class OrdersService {
     const { paymentUrl } = await this.paymentsService.payOrder(order.id);
     this.eventEmitter.emit(
       OrderCreatedEvent.name,
-      new OrderCreatedEvent(order.id, shopId, String(order?.orderNumber) || '', order.total),
+      new OrderCreatedEvent(order.id, shopId, String(order.orderNumber), order.total),
     );
 
     return { paymentUrl, order };
@@ -269,6 +269,11 @@ export class OrdersService {
   private canTransition(from: OrderStatus, to: OrderStatus, paymentMethod: PaymentMethodEnum, ref: 'user' | 'admin', deliveryMethod: DeliveryMethodEnum) {
     if (!OrdersService.STATUS_TRANSITIONS[from]?.includes(to)) return false;
 
+    // user only can change sttaus to complete/canceled
+    if (ref == 'user' && ![OrderStatus.CANCELED, OrderStatus.COMPLETED].includes(to)) {
+      return false
+    }
+
     if (to === OrderStatus.CANCELED) {
       // only allow orders with status of PENDING_PAYMENT and PAID are allowed to be canceled by user
       if (ref === 'user' && ![OrderStatus.PENDING_PAYMENT, OrderStatus.PAID].includes(from)) {
diff --git a/todo.mdb b/todo.mdb
new file mode 100644
index 0000000..3467e54
--- /dev/null
+++ b/todo.mdb
@@ -0,0 +1,8 @@
+1. index tables check.
+2. notification check
+2.1 after order created(cash) then sms must be sent to admin
+2.2 after online payment paid successfully then noti must be sent
+2.3 after preapring order noti to user
+2.4 after deliver to recipint notif to user
+2.5 after shiped => notif to user
+2.6 
\ No newline at end of file