Fix subject priority sorting for programmatically added policies

[Copilot]

Subject priority effect (subjectPriority(p.eft) || deny) worked correctly for CSV-loaded policies but failed when policies were added via addPolicy() or addGroupingPolicy(). The issue occurs because policies need to be sorted by subject hierarchy (most specific subjects first) to evaluate correctly.

Root Cause

loadPolicy() calls sortPoliciesBySubjectHierarchy() after loading from CSV, but programmatic policy modifications (addPolicy, addGroupingPolicy, etc.) never triggered this sorting.

Changes

Modified src/internalEnforcer.ts to call sortPoliciesBySubjectHierarchy() after policy modifications:

• addPolicyInternal() and addPoliciesInternal() - after adding policies/grouping policies
• updatePolicyInternal() - after updating policies/grouping policies
• removePolicyInternal() and removePoliciesInternal() - after removing policies/grouping policies
• removeFilteredPolicyInternal() - after filtered removal

The sorting method checks for SUBJECT_PRIORITY effect internally, so no performance impact on other models.

Example

// Previously failed - policies evaluated in insertion order
const e = await newEnforcer('examples/subject_priority_model.conf');
await e.addPolicy('group', 'data1', 'read', 'deny');      // Less specific
await e.addPolicy('user', 'data1', 'read', 'allow');      // More specific
await e.addGroupingPolicy('user', 'group');
await e.enforce('user', 'data1', 'read');  // Now returns true (allow)

Added test cases covering simple and complex hierarchy scenarios with programmatic policy addition.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>(bug?) Adding policies programatically don't work as expected with subjectPriority</issue_title>
<issue_description>There appears to be an inconsistency in how subject priority is handled when policies are loaded from CSV files versus when they are added programmatically using addPolicy() and addGroupingPolicy() methods.

I have created a sample demonstration PR here: #500

Test Cases Demonstrating the Issue

I've added three test cases to demonstrate the problem:

1. TestSubjectPriority with CSV converted to addPolicy/addGroupingPolicy - "TestSubjectPriority" case but converts CSV policies to programmatic calls
2. TestSubjectPriority simpler with CSV - "TestSubjectPriority" with simpler policies from CSV file
3. TestSubjectPriority simpler with addPolicy - "TestSubjectPriority" with simpler policies added programmatically

Expected Behavior

The programatically cases should have the same behavior as the ones from the policies loaded via CSV

Current Behavior

The tests show that:

• CSV loading works correctly: Users get the expected permissions based on subject priority
• Programmatic addition may not work correctly: The same policies added via addPolicy() and addGroupingPolicy() may not produce the same results

Configuration Details

Model Configuration (examples/subject_priority_model.conf):

[policy_effect]
e = subjectPriority(p.eft) || deny

Simple Test Case (examples/subject_priority_policy_simple.csv):

p, group, data1, read, deny
p, user, data1, read, allow
g, user, group

Expected Result: user should be allowed to read data1 because the direct allow policy takes priority over the inherited deny policy from the group role.

Environment

• Node.js Casbin version: 5
• Node.js version: 22

Could this be related to casbin/casbin#1058?</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes [question] Adding policies programatically don't work as expected with subjectPriority #501

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}