diff --git a/src/modules/order/controllers/order.controller.ts b/src/modules/order/controllers/order.controller.ts
index d04bce1..e7e9dcc 100644
--- a/src/modules/order/controllers/order.controller.ts
+++ b/src/modules/order/controllers/order.controller.ts
@@ -12,6 +12,7 @@ import { AdminId } from 'src/common/decorators/admin-id.decorator';
 import { AssignDesignerDto } from '../dto/assign-designer.dto';
 import { UpdateOrderItemDtoAsAdmin, UpdateOrderItemDtoAsUser } from '../dto/update-order-item.dto';
 import { UpdateOrderDtoAsAdmin } from '../dto/update-order.dto';
+import { AdminAuthGuard } from 'src/modules/auth/guards/adminAuth.guard';
 
 @ApiTags('orders')
 @ApiBearerAuth()
@@ -19,21 +20,14 @@ import { UpdateOrderDtoAsAdmin } from '../dto/update-order.dto';
 export class OrderController {
   constructor(private readonly orderService: OrderService) { }
 
-  @Post('public/order')
+  @Post('public/orders')
   @UseGuards(AuthGuard)
   @ApiOperation({ summary: 'create order ' })
   createOrder(@UserId() userId: string, @Body() body: CreateOrderDto) {
     return this.orderService.createOrderAsUser(userId, body);
   }
 
-  @Get('public/order/:id')
-  @UseGuards(AuthGuard)
-  @ApiOperation({ summary: 'order detail' })
-  orderDetail(@Param('id') orderId: string, @UserId() userId: string) {
-    return this.orderService.getOrderAsUser(userId, orderId);
-  }
-
-  @Delete('public/order/:id')
+  @Delete('public/orders/:id')
   @UseGuards(AuthGuard)
   @ApiOperation({ summary: 'Delete order ' })
   deleteOrder(@Param('id') orderId: string, @UserId() userId: string) {
@@ -43,13 +37,18 @@ export class OrderController {
   @Get('public/orders')
   @UseGuards(AuthGuard)
   @ApiOperation({ summary: 'Get all orders with pagination and filters' })
-  async findAll(@Query() dto: FindOrdersDto, @UserId() userId: string) {
-    const orders = await this.orderService.findUserOrders(userId, dto);
-    return orders
+  findAll(@Query() dto: FindOrdersDto, @UserId() userId: string) {
+    return this.orderService.findUserOrders(userId, dto);
   }
 
+  @Get('public/orders/:id')
+  @UseGuards(AuthGuard)
+  @ApiOperation({ summary: 'order detail' })
+  orderDetail(@Param('id') orderId: string, @UserId() userId: string) {
+    return this.orderService.getOrderAsUser(userId, orderId);
+  }
 
-  @Patch('public/order/:id/item')
+  @Post('public/orders/:id/item')
   @UseGuards(AuthGuard)
   @ApiOperation({ summary: 'add item to order ' })
   addOrderItem(@Param('id') orderId: string, @UserId() userId: string, @Body() body: CreateOrderItemAsUserDto) {
@@ -57,15 +56,15 @@ export class OrderController {
   }
 
 
-  @Patch('public/order/:id/item/:itemId')
+  @Patch('public/orders/:id/item/:itemId')
   @UseGuards(AuthGuard)
   @ApiOperation({ summary: 'Update order item ' })
-  updateOrderItem(@Param('id') orderId: string, @UserId() userId: string, @Param(':itemId') itemId: string, @Body() body: UpdateOrderItemDtoAsUser) {
-    return this.orderService.updateOrderItemAsUser(userId, orderId, itemId, body);
+  updateOrderItem(@Param('id') orderId: string, @UserId() userId: string, @Param('itemId') itemId: string, @Body() body: UpdateOrderItemDtoAsUser) {
+    return this.orderService.updateOrderItemAsUser(userId, orderId, +itemId, body);
   }
 
 
-  @Post('public/orders/:orderId/items/:orderItemId/confirm')
+  @Patch('public/orders/:orderId/items/:orderItemId/confirm')
   @UseGuards(AuthGuard)
   @ApiOperation({ summary: 'Confirm Invoice Item ' })
   confirmOrderItem(
@@ -89,22 +88,31 @@ export class OrderController {
 
   /*==========================  Admin Routes =====================*/
 
-  @Post('admin/order')
-  @UseGuards(AuthGuard)
+  @Post('admin/orders')
+  @UseGuards(AdminAuthGuard)
   @ApiOperation({ summary: 'create order ' })
   createOrderAsAdmin(@AdminId() adminId: string, @Body() body: CreateOrderAsAdminDto) {
     return this.orderService.createOrderAsAdmin(adminId, body);
   }
 
+
+  @Get('admin/orders/:id')
+  @UseGuards(AdminAuthGuard)
+  @ApiOperation({ summary: 'order detail' })
+  orderDetailAsAdmin(@Param('id') orderId: string) {
+    return this.orderService.findOrderOrFail(orderId);
+  }
+
+
   @Patch('admin/orders/:orderId')
-  @UseGuards(AuthGuard)
+  @UseGuards(AdminAuthGuard)
   @ApiOperation({ summary: 'Update Order ' })
   updateOrder(@Param('orderId') orderId: string, @Body() dto: UpdateOrderDtoAsAdmin) {
     return this.orderService.updateOrderAsAdmin(orderId, dto);
   }
 
   @Delete('admin/orders/:orderId')
-  @UseGuards(AuthGuard)
+  @UseGuards(AdminAuthGuard)
   @ApiOperation({ summary: 'Hard Delete Order ' })
   hardDelete(@Param('orderId') orderId: string) {
     return this.orderService.hardDeleteOrder(orderId);
@@ -112,43 +120,43 @@ export class OrderController {
 
 
   @Post('admin/orders/:orderId/designer')
-  @UseGuards(AuthGuard)
+  @UseGuards(AdminAuthGuard)
   @ApiOperation({ summary: 'Assign Order Designer ' })
   assignDesigner(@Param('orderId') orderId: string, @Body() body: AssignDesignerDto) {
     return this.orderService.assignDesigner(orderId, body.designerId);
   }
 
   @Post('admin/orders/:orderId/invoice')
-  @UseGuards(AuthGuard)
+  @UseGuards(AdminAuthGuard)
   @ApiOperation({ summary: 'Create Order invoice ' })
   createInvoice(@Param('orderId') orderId: string) {
     return this.orderService.createInvoice(orderId);
   }
 
 
-  @Delete('admin/orders/:orderId/items/:orderItemId')
-  @UseGuards(AuthGuard)
+  @Delete('admin/orders/:id/items/:orderItemId')
+  @UseGuards(AdminAuthGuard)
   @ApiOperation({ summary: 'Remove order Item ' })
   removeOrderItemAdAdmin(
-    @Param('orderId') orderId: string,
+    @Param('id') orderId: string,
     @Param('orderItemId') orderItemId: string,
   ) {
     return this.orderService.removeOrderItemAsAdmin(orderId, +orderItemId);
   }
 
-  @Patch('admin/order/:id/item')
-  @UseGuards(AuthGuard)
+  @Post('admin/orders/:id/item')
+  @UseGuards(AdminAuthGuard)
   @ApiOperation({ summary: 'add item to order ' })
   addOrderItemAsAdmin(@Param('id') orderId: string, @Body() body: CreateOrderItemDtoAsAdmin) {
     return this.orderService.addOrderItemAsAdmin(orderId, body);
   }
 
-  @Patch('admin/order/:id/item/:itemId')
-  @UseGuards(AuthGuard)
+  @Patch('admin/orders/:id/item/:itemId')
+  @UseGuards(AdminAuthGuard)
   @ApiOperation({ summary: 'Update order item' })
-  updateOrderAsAdmin(@Param('id') orderId: string, @Param(':itemId') itemId: string,
+  updateOrderItemAsAdmin(@Param('id') orderId: string, @Param('itemId') itemId: string,
     @Body() body: UpdateOrderItemDtoAsAdmin) {
-    return this.orderService.updateOrderItemAsAdmin(orderId, itemId, body);
+    return this.orderService.updateOrderItemAsAdmin(orderId, +itemId, body);
   }
 
 }
diff --git a/src/modules/order/providers/order.service.ts b/src/modules/order/providers/order.service.ts
index 5b916cd..c03bd41 100644
--- a/src/modules/order/providers/order.service.ts
+++ b/src/modules/order/providers/order.service.ts
@@ -116,7 +116,7 @@ export class OrderService {
     return orderItem
   }
 
-  async updateOrderItemAsUser(userId: string, orderId: string, itemId: string, dto: UpdateOrderItemDtoAsUser) {
+  async updateOrderItemAsUser(userId: string, orderId: string, itemId: number, dto: UpdateOrderItemDtoAsUser) {
 
     const order = await this.findOrderOrFail(orderId)
 
@@ -133,9 +133,9 @@ export class OrderService {
     return orderItem
   }
 
-  async updateOrderItemAsAdmin(orderId: string, itemId: string, dto: UpdateOrderItemDtoAsAdmin) {
+  async updateOrderItemAsAdmin(orderId: string, itemId: number, dto: UpdateOrderItemDtoAsAdmin) {
 
-    await this.findOrderOrFail(orderId)
+    await this.findOrderItemOrFail(orderId, itemId)
 
     const orderItem = await this.updateOrderItem(itemId, dto)
 
@@ -333,7 +333,9 @@ export class OrderService {
     const admin = adminId ? await this.adminService.findOrFail(adminId) : undefined
     const designer = designerId ? await this.adminService.findOrFail(designerId) : undefined
     const products = await this.productService.findProductsByIds(items.map(item => item.productId))
-
+    const productMap = new Map(
+      products.map(p => [Number(p.id), p])
+    );
 
     return this.em.transactional(async (em) => {
 
@@ -351,7 +353,7 @@ export class OrderService {
       em.persist(order)
 
       for (const item of items) {
-        const product = products.find(p => Number(p.id) === Number(item.productId))
+        const product = productMap.get(Number(item.productId))
 
         if (!product) {
           throw new BadRequestException("Product not found!")
@@ -421,7 +423,7 @@ export class OrderService {
     return order
   }
 
-  async updateOrderItem(itemId: string, dto: UpdateOrderItem) {
+  async updateOrderItem(itemId: number, dto: UpdateOrderItem) {
     const { attributes, description, productId, quantity, attachments, discount, unitPrice } = dto
 
     const orderItem = await this.orderItemRepository.findOne({
@@ -505,12 +507,20 @@ export class OrderService {
 
   async findOrderOrFail(orderId: string) {
     const order = await this.orderRepository.findOne({ id: orderId },
-      { populate: ['items', 'items.product', 'payments'] })
+      { populate: ['items', 'items.product', 'payments', 'user'] })
     if (!order) {
       throw new BadRequestException('Order not found')
     }
     return order
   }
 
+  async findOrderItemOrFail(orderId: string, itemId: number) {
+    const orderItem = await this.orderItemRepository.findOne({ id: itemId, order: { id: orderId } },
+      { populate: [] })
+    if (!orderItem) {
+      throw new BadRequestException('Order item not found')
+    }
+    return orderItem
+  }
 
 }