This is pretty confusing in a up/downgrade scenario. The returned pwHash will be useless/wrong and hence the next if will not match and the else will not match on SuperUser because res will be != -1.

My suggestion would be to add an else path to the up/downgrade check for normal password checking and only leave the SuperUser failure check outside of it. Imho the empty password check should probably go in front of all of that so it's obvious we don't accept empty passwords.

I'm a bit dubious about the concept of getPasswordHash switching internally in general. It's ok I guess.