Default Role Implementation

Hm. I think it'd be simpler if check_alter_user() would also return errors, instead of magic numbers. These errors are not SET PASSWORD specific. See, ER_OPTION_PREVENTS_STATEMENT always applies. ER_PASSWORD_ANONYMOUS_USER — the logic applies, you only need to change the error message (not the label, only the text) to say "not allowed to use this statement". Or, may be, "not allowed to modify user settings". ER_PASSWORD_NO_MATCH is correct, the error message is "Can't find any matching row in the user table". So, basically, check_alter_user() — with these error messages — pretty much works for any ALTER USER variant, either current (password, default role) or anything in the future.