---

        if otp and pyotp.totp.TOTP(user.totp_secret).verify(otp):
            session.pop('pre_auth_user_id', None)
            token = secrets.token_hex(24)

            # --- ВСТАВИТЬ СЮДА ---
            ip_addr = request.headers.get('X-Forwarded-For', request.remote_addr)
            if ',' in ip_addr:
                ip_addr = ip_addr.split(',')[0].strip()
            # ---------------------

            new_session = UserSession(
                user_id=user.id,
                session_token=token,
                ip_address=ip_addr, # Замени request.remote_addr на ip_addr
                user_agent=request.headers.get('User-Agent')
            )