disable the storage wrapper if we know there are no rules configured

lib/AppInfo/Application.php

@@ -26,15 +26,20 @@
 use OCA\FilesAccessControl\Listener\FlowRegisterOperationListener;
 use OCA\FilesAccessControl\Operation;
 use OCA\FilesAccessControl\StorageWrapper;
+use OCA\WorkflowEngine\Helper\ScopeContext;
 use OCP\AppFramework\App;
 use OCP\AppFramework\Bootstrap\IBootContext;
 use OCP\AppFramework\Bootstrap\IBootstrap;
 use OCP\AppFramework\Bootstrap\IRegistrationContext;
 use OCP\Files\Storage\IStorage;
+use OCP\IUserSession;
 use OCP\Util;
+use OCP\WorkflowEngine\IManager;
 use OCP\WorkflowEngine\Events\RegisterOperationsEvent;
 
 class Application extends App implements IBootstrap {
+	private bool $hasAccessRules = true;
+
 	public function __construct() {
 		parent::__construct('files_accesscontrol');
 	}
@@ -48,13 +53,13 @@ public function addStorageWrapper() {
 	}
 
 	/**
-	 * @internal
 	 * @param $mountPoint
 	 * @param IStorage $storage
 	 * @return StorageWrapper|IStorage
+	 * @internal
 	 */
 	public function addStorageWrapperCallback($mountPoint, IStorage $storage) {
-		if (!OC::$CLI && $mountPoint !== '/') {
+		if (!OC::$CLI && $mountPoint !== '/' && $this->hasAccessRules) {
 			/** @var Operation $operation */
 			$operation = $this->getContainer()->get(Operation::class);
 			return new StorageWrapper([
@@ -73,5 +78,21 @@ public function register(IRegistrationContext $context): void {
 	}
 
 	public function boot(IBootContext $context): void {
+		$this->hasAccessRules = $context->injectFn([$this, 'checkHasAccessRules']);
+	}
+
+	public function checkHasAccessRules(IManager $manager, IUserSession $userSession) {
+		$scopes[] = new ScopeContext(IManager::SCOPE_ADMIN);
+		$user = $userSession->getUser();
+		if ($user !== null && $manager->isUserScopeEnabled()) {
+			$scopes[] = new ScopeContext(IManager::SCOPE_USER, $user->getUID());
+		}
+		foreach ($scopes as $scope) {
+			$operations = $manager->getOperations(Operation::class, $scope);
+			if (count($operations) > 0) {
+				return true;
+			}
+		}
+		return false;
 	}
 }