diff --git a/src/modules/orders/orders.controller.ts b/src/modules/orders/orders.controller.ts
index 5845a1d..0b00ec6 100644
--- a/src/modules/orders/orders.controller.ts
+++ b/src/modules/orders/orders.controller.ts
@@ -33,8 +33,8 @@ export class OrdersController {
   @ApiOperation({ summary: 'Get an order By id for User' })
   @ApiParam({ name: 'orderId', description: 'Order ID' })
   @Get('public/orders/:orderId')
-  findOne(@Param('orderId') orderId: string) {
-    return this.ordersService.findOne(orderId);
+  findOne(@Param('orderId') orderId: string, @RestId() restId: string) {
+    return this.ordersService.findOne(orderId, restId);
   }
 
   @UseGuards(AuthGuard)
@@ -42,8 +42,8 @@ export class OrdersController {
   @Patch('public/orders/:id/cancel')
   @ApiOperation({ summary: 'Cancel an order By User' })
   @ApiParam({ name: 'id', description: 'Order ID' })
-  cancelOrder(@Param('id') id: string) {
-    return this.ordersService.cancelOrder(id);
+  cancelOrder(@Param('id') id: string, @RestId() restId: string) {
+    return this.ordersService.cancelOrder(id, restId);
   }
 
   @UseGuards(AdminAuthGuard)
@@ -59,8 +59,17 @@ export class OrdersController {
   @Patch('admin/orders/:orderId/confirm')
   @ApiOperation({ summary: 'Accept an order' })
   @ApiParam({ name: 'orderId', description: 'Order ID' })
-  acceptOrder(@Param('orderId') orderId: string) {
-    return this.ordersService.acceptOrder(orderId);
+  acceptOrder(@Param('orderId') orderId: string, @RestId() restId: string) {
+    return this.ordersService.acceptOrder(orderId, restId);
+  }
+
+  @UseGuards(AdminAuthGuard)
+  @ApiBearerAuth()
+  @Patch('admin/orders/:id/prepare')
+  @ApiOperation({ summary: 'Prepare an order By Admin' })
+  @ApiParam({ name: 'id', description: 'Order ID' })
+  prepareOrder(@Param('id') id: string, @RestId() restId: string) {
+    return this.ordersService.prepareOrder(id, restId);
   }
 
   @UseGuards(AdminAuthGuard)
@@ -68,8 +77,8 @@ export class OrdersController {
   @Patch('admin/orders/:orderId/reject')
   @ApiOperation({ summary: 'Reject an order' })
   @ApiParam({ name: 'orderId', description: 'Order ID' })
-  rejectOrder(@Param('orderId') orderId: string) {
-    return this.ordersService.acceptOrder(orderId);
+  rejectOrder(@Param('orderId') orderId: string, @RestId() restId: string) {
+    return this.ordersService.rejectOrder(orderId, restId);
   }
 
   @UseGuards(AdminAuthGuard)
@@ -77,7 +86,7 @@ export class OrdersController {
   @Patch('admin/orders/:orderId/ready')
   @ApiOperation({ summary: 'Ready for pickup or delivery ' })
   @ApiParam({ name: 'orderId', description: 'Order ID' })
-  readyForPickup(@Param('orderId') orderId: string) {
-    return this.ordersService.readyForDelivery(orderId);
+  readyForPickup(@Param('orderId') orderId: string, @RestId() restId: string) {
+    return this.ordersService.readyForDelivery(orderId, restId);
   }
 }
diff --git a/src/modules/orders/orders.service.ts b/src/modules/orders/orders.service.ts
index 8b56aa3..41086a0 100644
--- a/src/modules/orders/orders.service.ts
+++ b/src/modules/orders/orders.service.ts
@@ -252,9 +252,9 @@ export class OrdersService {
     });
   }
 
-  async findOne(id: string): Promise<Order> {
+  async findOne(id: string, restId: string): Promise<Order> {
     const order = await this.orderRepository.findOne(
-      { id },
+      { id, restaurant: { id: restId } },
       { populate: ['user', 'restaurant', 'deliveryMethod', 'address', 'paymentMethod', 'items', 'items.food'] },
     );
     if (!order) {
@@ -263,8 +263,8 @@ export class OrdersService {
     return order;
   }
 
-  async acceptOrder(orderId: string) {
-    const order = await this.em.findOne(Order, { id: orderId });
+  async acceptOrder(orderId: string, restId: string) {
+    const order = await this.em.findOne(Order, { id: orderId, restaurant: { id: restId } });
     if (!order) {
       throw new NotFoundException('Order not found');
     }
@@ -273,8 +273,18 @@ export class OrdersService {
     return order;
   }
 
-  async rejectOrder(orderId: string) {
-    const order = await this.em.findOne(Order, { id: orderId });
+  async prepareOrder(orderId: string, restId: string) {
+    const order = await this.em.findOne(Order, { id: orderId, restaurant: { id: restId } });
+    if (!order) {
+      throw new NotFoundException('Order not found');
+    }
+    order.status = OrderStatus.Confirmed;
+    await this.em.persistAndFlush(order);
+    return order;
+  }
+
+  async rejectOrder(orderId: string, restId: string) {
+    const order = await this.em.findOne(Order, { id: orderId, restaurant: { id: restId } });
     if (!order) {
       throw new NotFoundException('Order not found');
     }
@@ -283,8 +293,8 @@ export class OrdersService {
     return order;
   }
 
-  async readyForDelivery(orderId: string) {
-    const order = await this.em.findOne(Order, { id: orderId });
+  async readyForDelivery(orderId: string, restId: string) {
+    const order = await this.em.findOne(Order, { id: orderId, restaurant: { id: restId } });
     if (!order) {
       throw new NotFoundException('Order not found');
     }
@@ -312,8 +322,8 @@ export class OrdersService {
     return order;
   }
 
-  async cancelOrder(orderId: string) {
-    const order = await this.em.findOne(Order, { id: orderId });
+  async cancelOrder(orderId: string, restId: string) {
+    const order = await this.em.findOne(Order, { id: orderId, restaurant: { id: restId } });
     if (!order) {
       throw new NotFoundException('Order not found');
     }