feat(rules): add priority field

src/policy_dsl.sql

@@ -12,11 +12,15 @@ CREATE TABLE morbac.policy (
     view TEXT NOT NULL,
     modality morbac.modality NOT NULL,
     context_name TEXT NOT NULL DEFAULT 'always',
+    priority INTEGER,
     created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
-    compiled BOOLEAN NOT NULL DEFAULT FALSE,
-    UNIQUE(org_name, role_name, activity, view, modality, context_name)
+    compiled BOOLEAN NOT NULL DEFAULT FALSE
 );
 
+-- UNIQUE including priority: NULL treated as -1 so two NULL-priority rows for the same tuple conflict
+CREATE UNIQUE INDEX idx_policy_unique
+    ON morbac.policy(org_name, role_name, activity, view, modality, context_name, COALESCE(priority, -1));
+
 CREATE INDEX idx_policy_not_compiled ON morbac.policy(compiled) WHERE NOT compiled;
 
 COMMENT ON TABLE morbac.policy IS 'Policy DSL - simplified policy declaration using names';
@@ -26,6 +30,7 @@ COMMENT ON COLUMN morbac.policy.activity IS 'Activity name';
 COMMENT ON COLUMN morbac.policy.view IS 'View name';
 COMMENT ON COLUMN morbac.policy.modality IS 'Deontic modality';
 COMMENT ON COLUMN morbac.policy.context_name IS 'Context name (default: always)';
+COMMENT ON COLUMN morbac.policy.priority IS 'Optional rule priority (higher wins over lower; NULL = 0)';
 COMMENT ON COLUMN morbac.policy.compiled IS 'Whether this policy entry has been compiled into rules';
 
 -- Helper function to check administration permissions
@@ -138,8 +143,8 @@ BEGIN
             ON CONFLICT (name) DO NOTHING;
 
             -- Insert rule (ignore if already exists)
-            INSERT INTO morbac.rules (org_id, role_id, activity, view, context_id, modality)
-            VALUES (v_org_id, v_role_id, v_policy.activity, v_policy.view, v_context_id, v_policy.modality)
+            INSERT INTO morbac.rules (org_id, role_id, activity, view, context_id, modality, priority)
+            VALUES (v_org_id, v_role_id, v_policy.activity, v_policy.view, v_context_id, v_policy.modality, v_policy.priority)
             ON CONFLICT (org_id, role_id, activity, view, context_id, modality) DO NOTHING;
 
             -- Mark as compiled