After using Django's excellent admin interface, I was pondering creating a similar system which wasn't as tied to an ORM.
Now, while considering this, I thought that overcoming webapps limitations (basic widgets, sessions, text/HTTP-based forms, distinct client-side/server-side languages in most cases with a limited communication mechanism, etc.) were a big timewaster, and that maybe traditional GUI development was a better option.
So that brought me to using a desktop app, and then a server part which connects to the database and exposes it via RPC (web services, whatever) to the desktop app, handling security in the traditional webapp fashion.
However, nowadays you can connect to databases remotely securely using SSL, and supposedly databases do provide sufficient role-based authorization (GRANT/REVOKE), so why not connect directly to the database and avoid having to code a server?
Is that a good idea? Are there unassailable problems with this approach? [I think that coupled with good database introspection, one could write a relatively simple framework which would enable very nice RAD of database-based apps)? Which are theoretical problems and which ones are problems with specific implementations?
bonus question: do databases provide enough authorization? While doing my research, I came across the following discussion thread:
which pokes some holes into traditional view-based row access control in the PostgreSQL implementation.