Is "parse as" the only way to restrict user privileges?

Question

I have an application which is working in a schema blabla_owner.
Users do not need to log into this app, but I don't want them to be able to update data. Although I only have reports and no updateable forms or anything, my client is not very happy that all queries are implicitly done by the schema owner.
I read that "parse as" can be used, so we created a user blabla_read that can only read in the owner's schema and selected this user in the "parse as" attribute of the application, but unfortunately using this mechanism we need to grant the select privileges directly instead of through a role.
I tried changing the dad to use the readonly user but that is no use since the HTMLDB_PUBLIC_USER is only a dummy user and its privileges do not matter.
Is there another way of accomplishing the following:
- not requiring the users to log in
- be sure all queries are done by a user with readonly privileges only
- be able to use a role to grant privileges instead of doing this directly
Thanks

Answer 1

Not to put too fine a point on it, but as I said earlier An Apex application is no different than a "stored procedure" in that object privileges need to be granted directly to the parsing schema and not via a role
The reason for this might be that DBMS_SYS_SQL.PARSE_AS_USER, the underlying mechanism used by Apex to parse all SQLs requires object privileges to be granted directly to the "parse as" schema (for security reasons), but in any case whatever the reason, it is what is.
I have also "wished" many times that stored procedures/views would work with privileges granted through roles and not directly, but hey, what you gonna do?!