enhancement: preview file attachment without download

app/components/avo/fields/common/files/view_type/grid_item_component.html.erb

@@ -7,11 +7,11 @@
     <% elsif is_video? %>
       <%= video_tag(helpers.main_app.url_for(file), controls: true, preload: false, class: 'w-full') %>
     <% else %>
-      <div class="relative flex flex-col justify-evenly items-center px-2 rounded-lg border bg-white border-gray-500 min-h-24">
+      <%= content_tag file.representable? ? :a : :div, **document_arguments do %>
         <div class="flex flex-col justify-center items-center w-full">
           <%= helpers.svg "heroicons/outline/document-text", class: 'h-10 text-gray-600 mb-2' %>
         </div>
-      </div>
+      <% end %>
     <% end %>
     <% if @field.display_filename %>
       <span class="text-gray-500 mt-1 text-sm truncate" title="<%= file.filename %>"><%= file.filename %></span>

app/components/avo/fields/common/files/view_type/grid_item_component.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class Avo::Fields::Common::Files::ViewType::GridItemComponent < Avo::BaseComponent
+  include Avo::Fields::Concerns::FileAuthorization
+
   prop :field
   prop :resource
   prop :file
@@ -45,4 +47,27 @@ def record_persisted?
     ActiveStorage::Blob.destroy(file.blob_id) if file.blob_id.present?
     false
   end
+
+  def document_arguments
+    args = {
+      class: class_names(
+        "relative flex flex-col justify-evenly items-center px-2 rounded-lg border bg-white border-gray-500 min-h-24",
+        {
+          "hover:bg-gray-100 transition": file.representable?
+        }
+      )
+    }
+
+    if file.representable? && can_download_file?
+      args.merge!(
+        {
+          href: helpers.main_app.url_for(file),
+          target: "_blank",
+          rel: "noopener noreferrer"
+        }
+      )
+    end
+
+    args
+  end
 end

spec/system/avo/open_field_attachment_spec.rb

@@ -0,0 +1,60 @@
+require "rails_helper"
+
+RSpec.describe "OpenFieldAttachment", type: :system do
+  include ActionView::RecordIdentifier
+  let!(:user) { create :user }
+
+  context "with PDF attachment" do
+    it "opens attachment in new window without download" do
+      allow_any_instance_of(ActiveStorage::Blob).to receive(:representable?).and_wrap_original do |original_method, *args|
+        blob = original_method.receiver
+        if blob.filename.to_s == "dummy-file.pdf"
+          true
+        else
+          original_method.call(*args)
+        end
+      end
+
+      user.cv.attach(
+        io: Rails.root.join("db", "seed_files", "dummy-file.pdf").open,
+        filename: "dummy-file.pdf",
+        content_type: "application/pdf"
+      )
+
+      visit avo.resources_field_discovery_user_path(user)
+
+      file_path = Rails.application.routes.url_helpers.rails_blob_path(user.cv, only_path: true)
+
+      within("##{dom_id(user.cv)}") do
+        link = find(:css, "a[href*='#{file_path}']:not([download])")
+        expect(link[:target]).to eq("_blank")
+        expect(link[:rel]).to eq("noopener noreferrer")
+
+        new_window = window_opened_by { link.click }
+        expect(new_window).not_to be_nil
+
+        within_window new_window do
+          # Check that final URL ends with filename, since path changes after redirect
+          expect(page.current_url).to match(/dummy-file\.pdf\z/)
+        end
+      end
+    end
+  end
+
+  context "with CSV attachment" do
+    it "can not open or download attachment in new window" do
+      csv_file_path = Rails.root.join("db", "seed_files", "sample.csv")
+
+      user.cv.attach(io: csv_file_path.open, filename: "sample.csv", content_type: "application/csv")
+
+      visit avo.resources_field_discovery_user_path(user)
+
+      file_path = Rails.application.routes.url_helpers.rails_blob_path(user.cv, only_path: true)
+
+      within("##{dom_id(user.cv)}") do
+        expect(page).not_to have_selector(:css, "a[href*='#{file_path}']:not([download])")
+        expect(page).to have_selector(:css, "a[href*='#{file_path}'][download]")
+      end
+    end
+  end
+end