design – "State" pattern and encapsulation

Yes, it's a code smell that an "internal" function like setState is exposed on the public interface of Order.

What you can do about it depends to a large extent on the design of your classes and the features provided by your implementation language.

In a language like Java, if Order and concrete OrderState the implementations belong to the same package, so you could give setState the "private package" access specifier, specifying that only members of the same package are allowed to use this method.

In C ++, you can exchange the code smell of a public API too great against the code smell specifying the actual implementations of "OrderState" as a friend of "Order ". That would make it possible setState private but Order must know all the states in which it can be, and its implementations have very broad access to Order. You would have to choose which solution feels the least.

In other languages, there may be no way to remove the odor and you will have to live with it.