Is there a way in the API to know who moved a token when receiving a "change:token:left" (or top or rotation) event?
There isn't. Sometimes you can infer the information (no controlled by--was the GM, only one controlled by--probably that player, only one player logged in--likely them), but otherwise there is no information in the event to indicate who it was.
Thanks for the quick answer. I'll manage otherwise, then.
Yeah, it's been a thorn in my side for years. =D
I believe there is or was a script that only allowed players to move during their turns. Do you want that?
No, I want players not to be able to move their 'paralyzed' tokens, but that the GM could still do it. So I think I will prevent paralyzed token from moving, but send a button to the GM to allow such a move when it is attempted. This should work, since changes from the API don't send events, if I'm not mistaken.
You could use MapLock to prevent them from moving (well, it actually moves them back), and then just toggle it on and off for the token if you need to move it.