---

        token = secrets.token_hex(24)
        
        # --- ВСТАВИТЬ СЮДА ---
        ip_addr = request.headers.get('X-Forwarded-For', request.remote_addr)
        if ',' in ip_addr:
            ip_addr = ip_addr.split(',')[0].strip()
        # ---------------------

        new_session = UserSession(
            user_id=user.id,
            session_token=token,
            ip_address=ip_addr, # Замени request.remote_addr на ip_addr
            user_agent=request.headers.get('User-Agent')
        )