Of course they're allowed to do that, it's far less risky than hiring someone they've never seen before.
Also promoting someone who's been working hard to prove themselves to the company should really be given the position, although I agree they should have looked at that first then advertised for external applications.
My Mum recently had this problem. She's been with her company for 10+ years and she was perfect for the job they were advertising, but they found someone outside that fitted the position too. The fact that they didn't even ask for internal applications made a lot of people very angry.