Question: I wanted to check commits to a branch, and I saw that there were commits that appear in 2 branches.

Why?
What does it mean? 

[![enter image description here](https://i.stack.imgur.com/x3Azq.png)](https://i.stack.imgur.com/x3Azq.png)

Answer: 
But as far as I can tell, what you are really trying to do is analogous to having Alice invoke

```
sudo -u bob ls /home/bob

```

I think you can reasonably argue one of two ways

First, that this is a *different resource*; it shares a common set of representations with `ls /home/bob`, but the authorization rules are different. On the web, that would mean two different identifiers

```
/home/bob
/su/bob/home/bob

```

In effect, we have a new protocol, so we create new resources to support that protocol.

The other argument is that these are the *same* resource, and the difference between the two cases is the [Authorization](https://www.rfc-editor.org/rfc/rfc7235#section-4.2) header. That feels right? but I can't find any examples that do this.

You can find some examples where people have implemented a similar idea using custom http headers. For example <https://www.linkedin.com/pulse/jira-rest-api-user-impersonation-marjan-sterjev/>

Because of the lack of clear precedent, I would recommend continuing with the first approach.
I think a key thing will be your exact requirements around what it means to "post on behalf of another user"

But, assuming its just the author byline I would simply have a property on the Post object

```
class Post
{
    public string AuthoredByUserId {get;set;}
    ....
}

```

Now in your controller you can check whether AuthoredByUserId is the same as the user submitting the post and either allow it for super users or disallow it from normal users.

Having said that, personally I would *still* add a seperate endpoint simply so I can use built in authentication per endpoint methods, rather than having to code an authentication check eg.

```
[Authorise(Roles="ContentWriter")]
public Action AddPost(Post)
{
    ...error if AuthoredByUserId != the users Id
}

[Authorise(Roles="SUPER_ADMIN")]
public Action AddPostForAnotherUser(Post)
{
    ..ignore the userid validation
}

```