Are db-user restrictions bypassed in proxy db --tunnel mode (clickhouse) ?

[pe-hem]

Using Teleport v15.4.19
I have a clickhouse server (named "clickhouse00") on my production network. This server has several users defined in its configuration, like :

<clickhouse>
    <users>
      <prod-rw>
        <password>xxxxxxxxxxxx</password>
        <networks incl="networks" replace="replace">
          <ip>10.0.0.0/16</ip>
        </networks>
        <profile>default</profile>
        <quota>default</quota>
      </prod-rw>
      <!-- read-only user for teleport access -->
      <teleport-ro>
        <password>yyyyyyyyyyyy</password>
        <networks incl="networks" replace="replace">
          <ip>10.0.0.0/16</ip>
        </networks>
        <profile>read_only</profile>
        <quota>default</quota>
      </teleport-ro>
    </users>
    <profiles>
      <read_only>
        <readonly>1</readonly>
      </read_only>
    </profiles>
</clickhouse>

My production network is on a private network and clickhouse server is not reachable from the outside, except through teleport services.

Extract of teleport.yaml from clickhouse server :

db_service:
  enabled: "yes"
  resources:
  - labels:
      "*": "*"

  databases:
  - name: "clickhouse"
    description: "Production database"
    protocol: "clickhouse"
    uri: "10.0.0.16:9440"
    static_labels:
      env: "prod"

With my team, we need to be able to connect in read-only to our production database, while production applications are running, using the prod-rw user.
So on my laptop, I first authenticate to Teleport :

$ tsh login --proxy=teleport.mycompany.com --user me
> Profile URL:        https://teleport.mycompany.com:443
  Logged in as:       me
  Cluster:            teleport.mycompany.com
  Roles:              db-ro
  Logins:             me
  Kubernetes:         enabled
  Valid until:        2024-10-15 22:46:33 +0200 CEST [valid for 10h48m0s]
  Extensions:         login-ip, permit-port-forwarding, permit-pty, private-key-policy

$ tctl get roles/db-ro
kind: role
metadata:
  id: 570690
  name: db-ro
  revision: "570690"
spec:
  allow:
    db_labels:
      '*': '*'
    db_names:
    - '*'
    db_users:
    - teleport-ro
  deny: {}
  options:
    cert_format: standard
    create_db_user: false
    create_desktop_user: false
    desktop_clipboard: true
    desktop_directory_sharing: true
    enhanced_recording:
    - command
    - network
    forward_agent: false
    idp:
      saml:
        enabled: true
    max_session_ttl: 30h0m0s
    pin_source_ip: false
    port_forwarding: true
    record_session:
      default: best_effort
      desktop: true
    ssh_file_copy: true
version: v7

Starting from here, if I :

• tsh db connect clickhouse00 --db-user teleport-ro => success, I am connected with read-only privileges
• tsh db connect clickhouse00 --db-user prod-rw => fail, access denied (as intended ; so far, so good)
• tsh proxy db --tunnel clickhouse00 --port 9440 then, in another window: clickhouse-client --host localhost --port 9440 --user prod-rw => success, I am connected with FULL privileges (which I'm not supposed to be able to do)

Am I doing something wrong ?
Is there any other way to achieve the desired result : restricting distant people through Teleport from using unallowed users with tunnel mode (which is needed since we use GUI tools like dbeaver) ?

Please let me know if I could post any additional useful information