Comments have incorrect `can_flag` values for at least 2 different API routes

Question

I am trying to see and show whether a comment on question/answer is flagged by the authenticated user.

1. But whenever I use /questions/{ids}, can_flag is true irregardless of whether the user (me) can actually flag the comment.
2. When I use /comments/{ids}, I get the correct status.
3. Editors note: additional/updated/different info in the answer below, but this still looks like a set of bugs.

Example:

1. For The API Sandbox question on Meta Stack Exchange:

2. In this answer there (Id 54725), I flagged the (now deleted) comment with ID 764560 (Link now works only for SE devs and MetaSE moderators).

3. But the /questions/{ids} route shows can_flag: true, which is incorrect:

   

   
   

4. However, using /comments/{ids} I get can_flag: false, which is correct:

   

   
   

5. I also tried /comments/{ids} for an unflagged comment (comment ID:396655). It givescan_flag: true, which is correct:

   

Why is there an inconsistency? This looks like a bug.

---

Note: I did (re)check /questions/{ids} 30 minutes after flagging the comment. So this does not seem to be a time-delay/caching issue.

Answer 1

I can't replicate the bug as stated; both /questions/{ids} and /comments/{ids} give the same results which are:

1. can_flag is false for my comments.   (Correct behavior)
2. can_flag is true for comments posted by others.   (See next item)
3. can_flag is true even for comments that I have an active flag on.   (Wrong behavior)

Steps to replicate:

1. Go to this API OAuth page and authorize the application.

2. From the resulting value in your browser's address bar, copy out the access_token value.
   For example, if your browser is redirected to:

   https://stackexchange.com/oauth/login_success#access_token=OGuIJlBxxxMkj2Ola1jG1A))&expires=86400
   

   You want the OGuIJlBxxxMkj2Ola1jG1A))

3. Find a question with a comment you can legitimately flag; perhaps the sandbox question on MetaSE.

4. Add your own comment there.

5. Flag a single comment that legitimately deserves it (if any).

6. Visit this page in your browser (After updating the access_token):

   https://api.stackexchange.com/2.2/questions/3122/?access_token={INSERT VALUE FROM STEP 2 HERE}&site=meta&key=dp55hR5Wr9UhOJReA6F2gg((&filter=!pL7rWh2ni*lt.6(Pbf6bqCepl*I4sG)2VFlDiXzeex7895bjn0p3NcCGHCZb28uVIY
   

   It helps if you use Firefox or a browser/extension that formats the JSON for you.

7. Note that can_flag is false for your comment. (Correct)

8. In the JSON, find the comment you previously flagged (hopefully the comment and flag both still exist). Copy its ID.

9. Visit this page in your browser (After updating the comment ID and the access_token):

   https://api.stackexchange.com/2.2/comments/{INSERT VALUE FROM STEP 8 HERE}?access_token={INSERT VALUE FROM STEP 2 HERE}&site=meta&key=dp55hR5Wr9UhOJReA6F2gg((&filter=!1zSn*g7xPUqB4hiVTpmJB
   

10. Note that the comment's can_flag still shows as true -- which is incorrect.

11. Delete the comment you made in step 4, if appropriate.

12. Your access_token will expire in 24 hours. Or you can deauthorize the app by following these instructions.