Question: I wanted to check commits to a branch, and I saw that there were commits that appear in 2 branches.

Why?
What does it mean? 

[![enter image description here](https://i.stack.imgur.com/x3Azq.png)](https://i.stack.imgur.com/x3Azq.png)

Answer: 
A requirement to allow admins to impersonate users shouldn't require any more API endpoints than already exist in the system. This should be handled with additional form fields on your create/edit POST/PUTs rather than entirely different endpoints. You would need to add some validation that these fields are only populated when the request comes from an admin, or to ignore them for non admins. You should already have the authorization mechanism in place to recognize an admin request from a non admin, this functionality can be viewed as a slight extension to that. While not required for fulfilling the business need, it would also be a good idea to modify your database/persistence layer to track both who made an update and who should be displayed as an update. This will prove useful should an admin abuse their power.
I think a key thing will be your exact requirements around what it means to "post on behalf of another user"

But, assuming its just the author byline I would simply have a property on the Post object

```
class Post
{
    public string AuthoredByUserId {get;set;}
    ....
}

```

Now in your controller you can check whether AuthoredByUserId is the same as the user submitting the post and either allow it for super users or disallow it from normal users.

Having said that, personally I would *still* add a seperate endpoint simply so I can use built in authentication per endpoint methods, rather than having to code an authentication check eg.

```
[Authorise(Roles="ContentWriter")]
public Action AddPost(Post)
{
    ...error if AuthoredByUserId != the users Id
}

[Authorise(Roles="SUPER_ADMIN")]
public Action AddPostForAnotherUser(Post)
{
    ..ignore the userid validation
}

```