`references/ubereats.md`

47 lines
# UberEats adapter — PROVEN 2026-08-02 (TK-10140)

Status: every step below was exercised in the live 2026-08-02 session
(`~/uber-address-fix/`, screenshots + step scripts there are the reference
implementation).

## Auth flow (auth.uber.com)

1. Go to `https://www.ubereats.com/` → sign in → lands on `auth.uber.com`.
2. "What's your phone number or email?" → enter login email → Next
   (pattern: `step3.js`).
3. **Email code** (sometimes offered first): read from the user's inbox via
   George (`step4–6.js`). Strip `<style>` blocks from the HTML; Uber's street
   address ("1725 …") appears in the footer — do NOT mistake it for the code.
4. **SMS / phone-call 4-digit code**: 4 separate single-digit inputs, then
   Next (`step6.js` pattern). Gate behaviors, all observed:
   - Codes + whole auth sessions expire in well under 30 min → "Bad request —
     Current session has timed out" even with a correct code.
   - Recovery: `step8-restart-flow.js` — reload auth.uber.com, resubmit the
     email; Uber usually skips straight to a fresh 2FA and auto-fires a code.
   - "Resend code via SMS" can rate-limit → "Error sending code / Bad
     request / Please use another method"; the restart flow then tends to
     fall over to PHONE CALL ("Call me with code") or EMAIL code.
   - Every resend/re-fire INVALIDATES prior codes — newest wins, tell the user.
5. **Card-verification gate** (final, static — does not expire): "confirm
   your payment card's missing digits" — shows brand + last-4 (e.g.
   AMERICAN EXPRESS `____-5001`), one text input + Next. Wants the 4 digits
   immediately BEFORE the last-4 (on a 15-digit Amex: digits 8–11). No
   alternate path exists (verified via full element dump). Never guess,
   never submit blank.

## After login (redirects to ubereats.com)

1. Check for a LIVE order. Wrong address on an active order → order Help →
   change delivery address if offered.
2. Account → Addresses → add the user's verbatim address, set nickname; if
   the pin editor appears, place the pin per the user's instruction.
3. Screenshot each step; email the user the result.

## Quirks

- Select the Uber tab by URL containing `uber.com`, never `pages()[0]`
  (`check-uber-tab.js`).
- Headed real Chrome (channel: 'chrome') required; profile persists in the
  workdir so a dead process can relaunch without full re-login (sometimes).
- CDP port used: 9223.