diff --git a/packages/graphql/api/orders.ts b/packages/graphql/api/orders.ts
index 0ff7ea1..f64eded 100644
--- a/packages/graphql/api/orders.ts
+++ b/packages/graphql/api/orders.ts
@@ -1,3 +1,4 @@
+/* eslint-disable sonarjs/cognitive-complexity */
 /* eslint-disable canonical/id-match */
 import { getClientWithToken } from '../apollo/client';
 import * as GQL from '../types';
@@ -141,13 +142,21 @@ export class OrdersService extends BaseService {
 
     if (!order) throw new Error(ERRORS.MISSING_ORDER);
 
-    const isMaster = isCustomerMaster(customer);
+    const isOrderClient = order.client?.documentId === customer.documentId;
+    const isOrderMaster = order.slot?.master?.documentId === customer.documentId;
 
-    const hasPermission =
-      (isMaster && order.slot?.master?.documentId === customer.documentId) ||
-      (!isMaster && order.client?.documentId === customer.documentId);
+    if (!isOrderClient && !isOrderMaster) throw new Error(ERRORS.NO_PERMISSION);
 
-    if (!hasPermission) throw new Error(ERRORS.NO_PERMISSION);
+    if (isOrderClient && Object.keys(variables.data).length > 1)
+      throw new Error(ERRORS.NO_PERMISSION);
+
+    if (
+      isOrderClient &&
+      variables.data.state &&
+      variables.data.state !== GQL.Enum_Order_State.Cancelling
+    ) {
+      throw new Error(ERRORS.NO_PERMISSION);
+    }
 
     const { mutate } = await getClientWithToken();