fix: add missing sort import, PathLess func, and sortURLSpecsByPathPriority for backport

The cherry-pick from master was missing:
- "sort" import in gateway/api_definition.go
- oasutil.PathLess function used by sortURLSpecsByPathPriority
- sortURLSpecsByPathPriority function referenced by tests
- Exported PathParamRegex in oasutil for cross-package access

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

Author: buger

gateway/api_definition.go

@@ -12,6 +12,7 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
+	"sort"
 	"strings"
 	"sync/atomic"
 	texttemplate "text/template"
@@ -23,6 +24,7 @@ import (
 	"github.com/TykTechnologies/tyk/internal/httpctx"
 	"github.com/TykTechnologies/tyk/internal/httputil"
 	"github.com/TykTechnologies/tyk/internal/mcp"
+	oasutil "github.com/TykTechnologies/tyk/internal/oasutil"
 
 	"github.com/getkin/kin-openapi/routers/gorillamux"
 
@@ -1631,6 +1633,14 @@ func pathParamPatternLength(oasPath, method string, oasPaths *openapi3.Paths) in
 	return total
 }
 
+// sortURLSpecsByPathPriority sorts URLSpec entries using the same path priority
+// rules as oasutil.SortByPathLength, ensuring consistent ordering across the gateway.
+func sortURLSpecsByPathPriority(specs []URLSpec) {
+	sort.Slice(specs, func(i, j int) bool {
+		return oasutil.PathLess(specs[i].OASPath, specs[j].OASPath)
+	})
+}
+
 // compileOASMockResponsePathSpec extracts MockResponse operations from OAS middleware
 // and converts them to URLSpec entries that use the standard regex-based path matching algorithm.
 // This ensures OAS mockResponse middleware respects gateway configurations like

internal/oasutil/paths.go

@@ -17,7 +17,11 @@ type PathItem struct {
 	Path string
 }
 
-var pathParamRegex = regexp.MustCompile(`\{[^}]+\}`)
+// PathParamRegex matches path parameters like {id} or {employeeId} in OAS paths.
+var PathParamRegex = regexp.MustCompile(`\{[^}]+\}`)
+
+// Keep the unexported alias for backward compatibility within this package.
+var pathParamRegex = PathParamRegex
 
 // ExtractPaths will extract paths with the given order.
 func ExtractPaths(in openapi3.Paths, order []string) []PathItem {
@@ -35,6 +39,37 @@ func ExtractPaths(in openapi3.Paths, order []string) []PathItem {
 	return result
 }
 
+// PathLess reports whether pathA should sort before pathB using the
+// standard Tyk path priority rules:
+//   - Strip path parameters {…} before comparing
+//   - If two paths are equal after stripping, the non-parameterised one goes first
+//   - Sort by number of "/" segments (more segments first)
+//   - Sort by string length (longer first)
+//   - Alphabetical for equal length
+func PathLess(pathA, pathB string) bool {
+	a := PathParamRegex.ReplaceAllString(pathA, "")
+	b := PathParamRegex.ReplaceAllString(pathB, "")
+
+	// handle /sub and /sub{id} order with raw path.
+	if a == b {
+		// we're reversing paths here so path with
+		// parameter is sorted after the literal.
+		a, b = pathB, pathA
+	}
+
+	// sort by number of path fragments
+	ka, kb := strings.Count(a, "/"), strings.Count(b, "/")
+	if ka != kb {
+		return ka > kb
+	}
+
+	la, lb := len(a), len(b)
+	if la == lb {
+		return a < b
+	}
+	return la > lb
+}
+
 // SortByPathLength decomposes an openapi3.Paths to a sorted []PathItem.
 // The sorting takes the length of the paths into account, as well as
 // path parameters, sorting them by length descending, and ordering