Wolfgang Walther <walther(at)technowledgy(dot)de> writes:
> This is because the "must be superuser to alter replication users"
> condition only triggers when the altered role already has isrepliaction,
> so isreplication could very well be >= 0 here.
How do you figure that? This is in an "else" path after
else if (authform->rolreplication || isreplication >= 0)
so AFAICS it's impossible to get there. If it isn't impossible,
we have a much bigger hole with respect to issuper.
regards, tom lane