Make private form submission assets visible for CP users

[RafaelKr]

We have a Statamic page with a form where users can upload images and videos.

I want the page administrator (or every user which is logged in to the CP) to view and download the assets submitted via a form. I've created a PR for this: statamic/cms#4379

Also I want these files to be not accessible by anyone not logged in to the CP. So we need a URL similiar to the downloadLink URL, but just to view the file without downloading it.

I first used a asset container on a custom filesystem which was defined like this:

'form-uploads' => [
    'driver' => 'local',
    'root' => storage_path('app/form-uploads'),
],

The problem is, that the url of the asset file in the CP is null, so there is no way to view it. downloadLink is working.

My current workaround for this is to use a folder in public_path now. I'm not really happy about it because it's now publicly accessible.

'form-uploads' => [
    'driver' => 'local',
    'root' => public_path('assets/form-uploads'),
    'url' => '/assets/form-uploads',
    'visibility' => 'public',
],