feat(security): implement SOC 2 & ISO 27001 audit logging, password policy, and session timeout

profile.php

@@ -175,8 +175,8 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
         if (!password_verify($currentPassword, $storedHash)) {
             $message = "Uw huidige wachtwoord is niet correct ingevoerd.";
             $messageType = 'error';
-        } elseif (strlen($newPassword) < 8) {
-            $message = "Het nieuwe wachtwoord moet minimaal 8 tekens lang zijn.";
+        } elseif (($pwErr = fociz_validate_password($newPassword)) !== null) {
+            $message = $pwErr;
             $messageType = 'error';
         } elseif ($newPassword !== $confirmPassword) {
             $message = "Het nieuwe wachtwoord en de bevestiging komen niet overeen.";
@@ -185,6 +185,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
             $newHash = password_hash($newPassword, PASSWORD_DEFAULT);
             $stmtUp = $db->prepare("UPDATE users SET password_hash = ? WHERE id = ?");
             $stmtUp->execute([$newHash, $userId]);
+            fociz_log_audit($userId, 'PASSWORD_CHANGED', 'user', $userId, ['method' => 'profile'], 'SUCCESS', $user['email']);
             $message = "Uw wachtwoord is succesvol gewijzigd.";
             $messageType = 'success';
         }