fix(package-discovery): Check for packages in webroot (Bedrock)

[Log1x]

Potential fix for https://discourse.roots.io/t/bedrock-required-composer-packages-not-registered-with-acorns-packagemanifest/23495

Tested and working on my end – not sure if there's a more sane approach.

[QWp6t]

We have a Filesystem::closest() helper that could be used as well. It crawls up the directory tree until it finds the file you're looking for. It returns null if the file is not found.

(new Filesystem)->closest(WP_CONTENT_DIR, 'composer.json');

Directory traversal could get expensive if done too often, though, so we might want to cache the results of that if we do decide to go that route.

If we're venturing outside of webroot, we should test with open_basedir set to webroot to be sure we're not breaking things for more restrictive environments. I believe it will throw an exception that we would have to catch (not sure tho).

PS-
Sorry for not getting back to you right away on Discord when you were asking about this. 💜

[oxyc]

Another way to get the data would be

$composer_paths = ...
    ->merge(
        collect(\Composer\InstalledVersions::getAllRawData())
            ->pluck('root')
            ->pluck('install_path'),
    )
    ->...

But if doing that might as well use getAllRawData() to pick up the ['extra']['acorn'] configs as well... making it all more complex really.

I have nothing against assuming a bedrock like structure :)

[QWp6t]

One of the issues I've run into with using Composer\InstalledVersions is that sometimes plugins come bundled with Composer, which can result in collisions. But I wouldn't be opposed to that as long as there's a way for developers to recover from those potential collisions.