s3_migration 0.1.0

data/lib/s3_migration/quarantine.rb

@@ -0,0 +1,154 @@
+# frozen_string_literal: true
+
+module S3Migration
+  # Handles the disk copy of one manifest entry after migration: move it into <storage>/.quarantine
+  # (a rename on the same volume), restore it, and later purge old quarantined files. Every action
+  # is driven by manifest entries, so it is limited to the entries the manifest scope selects.
+  # All actions are dry runs unless apply: true.
+  class Quarantine
+    DIRECTORY = '.quarantine'
+
+    def self.base_path
+      SourceStorage.base_path
+    end
+
+    # Deletes the quarantined copies of the files in the manifest, and nothing else.
+    # @return [Array<Integer>] [files purged (or that would be), files too recent]
+    def self.purge(apply:, min_age:, base: base_path, manifest: Manifest.new)
+      raise ArgumentError, "min_age must be positive, got #{min_age.inspect}" unless min_age.to_f.positive?
+
+      old, recent = quarantined_files(manifest, base).partition { |file| Time.current - File.mtime(file) >= min_age }
+      old.each { |file| delete_with_empty_parents(file, base) } if apply
+      [old.size, recent.size]
+    end
+
+    def self.quarantined_files(manifest, base)
+      manifest.each_entry.filter_map { |entry| quarantine_path(entry, base) }.select { |file| File.file?(file) }
+    end
+
+    def self.disk_path(entry, base)
+      candidate = SourceStorage.path_for(entry[:old_id])
+      candidate if candidate.start_with?("#{base}/")
+    end
+
+    def self.quarantine_path(entry, base)
+      path = disk_path(entry, base)
+      File.join(base, DIRECTORY, path.delete_prefix("#{base}/")) if path
+    end
+
+    def self.delete_with_empty_parents(file, base)
+      root = File.join(base, DIRECTORY)
+      File.delete(file)
+      dir = File.dirname(file)
+      while dir.start_with?("#{root}/") && Dir.empty?(dir)
+        Dir.rmdir(dir)
+        dir = File.dirname(dir)
+      end
+    rescue Errno::ENOENT, Errno::ENOTEMPTY
+      nil # another purge got there first
+    end
+
+    def initialize(entry, apply: false, verify_sha: true, base: nil, s3_storage: nil)
+      @entry = entry
+      @apply = apply
+      @verify_sha = verify_sha
+      @base = base || self.class.base_path
+      @s3_storage = s3_storage || Valkyrie::StorageAdapter.find(:repository_s3)
+    end
+
+    # @return [Symbol] :quarantined, :already_quarantined, :disk_copy_missing, :outside_base,
+    #   :database_changed or :s3_mismatch
+    def quarantine
+      return :outside_base unless path
+      return (File.exist?(destination) ? :already_quarantined : :disk_copy_missing) unless File.exist?(path)
+      return :database_changed unless current_identifier == entry[:new_id]
+      return :s3_mismatch unless s3_matches_manifest?
+
+      quarantine_file if apply
+      :quarantined
+    end
+
+    # Puts the disk copy and the original identifier back, then removes the S3 upload and manifest entry
+    # nothing refers to any more. The disk copy is checked against the manifest first.
+    # @return [Symbol] :rolled_back, :skipped, :disk_copy_gone, :disk_copy_mismatch or :outside_base
+    def rollback
+      return :outside_base unless path
+      return :skipped unless current_identifier == entry[:new_id]
+      return :disk_copy_gone unless File.exist?(path) || File.exist?(destination)
+      return :disk_copy_mismatch unless disk_copy_matches_manifest?
+
+      restore if apply
+      :rolled_back
+    end
+
+    private
+
+    attr_reader :entry, :apply, :verify_sha, :base, :s3_storage
+
+    def manifest
+      @manifest ||= Manifest.new(storage: s3_storage)
+    end
+
+    def path
+      self.class.disk_path(entry, base)
+    end
+
+    def destination
+      self.class.quarantine_path(entry, base)
+    end
+
+    def current
+      @current ||= Hyrax.query_service.find_by(id: entry[:file_metadata_id])
+    end
+
+    def current_identifier
+      current.file_identifier.to_s
+    end
+
+    def s3_matches_manifest?
+      s3_file = s3_storage.find_by(id: entry[:new_id])
+      return false unless s3_file.size.to_i == entry[:size]
+
+      !verify_sha || s3_file.checksum(digests: [Digest::SHA256.new]).first == entry[:sha256]
+    end
+
+    def disk_copy_matches_manifest?
+      file = File.exist?(path) ? path : destination
+      File.size(file) == entry[:size] && (!verify_sha || Digest::SHA256.file(file).hexdigest == entry[:sha256])
+    end
+
+    def quarantine_file
+      FileUtils.touch(path) # a rename keeps the old mtime, which purge reads as the time quarantined
+      move(path, destination)
+    end
+
+    def move(from, to)
+      FileUtils.mkdir_p(File.dirname(to))
+      FileUtils.mv(from, to)
+    end
+
+    def restore
+      move(destination, path) unless File.exist?(path)
+      current.file_identifier = Valkyrie::ID.new(entry[:old_id])
+      Hyrax.persister.save(resource: current)
+      discard_upload
+    end
+
+    # The rollback has already succeeded, so a failure here only leaves an unused upload behind.
+    def discard_upload
+      upload_cleanup.call(entry[:new_id])
+    rescue StandardError => e
+      log_discard_failure(e)
+    end
+
+    def upload_cleanup
+      UploadCleanup.new(file_set_id: entry[:file_set_id], file_metadata_id: entry[:file_metadata_id],
+                        s3_storage:, manifest:)
+    end
+
+    def log_discard_failure(error)
+      Hyrax.logger.warn("S3Migration: rolled back #{entry[:file_set_id]} but could not remove " \
+                        "#{entry[:new_id]}: #{error.class}: #{error.message}")
+    end
+  end
+end

data/lib/s3_migration/railtie.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module S3Migration
+  # Registers the s3_migration:* rake tasks with the host application.
+  class Railtie < Rails::Railtie
+    rake_tasks { load File.expand_path('../tasks/s3_migration.rake', __dir__) }
+  end
+end

data/lib/s3_migration/source_storage.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module S3Migration
+  # The Valkyrie storage adapter whose files are moved to S3. Only a plain Valkyrie::Storage::Disk is
+  # supported: versioned disk keeps versions and deletion markers that a copy to S3 would lose.
+  module SourceStorage
+    class Unsupported < StandardError; end
+
+    class << self
+      attr_writer :adapter_name
+
+      # @return [Symbol] the name the source adapter is registered under (default :disk)
+      def adapter_name
+        @adapter_name ||= :disk
+      end
+
+      # @return [Valkyrie::Storage::Disk]
+      # @raise [Unsupported] when no such adapter is registered, or it is not a plain disk adapter
+      def adapter
+        found = Valkyrie::StorageAdapter.find(adapter_name)
+        return found if found.is_a?(Valkyrie::Storage::Disk)
+
+        raise Unsupported, "The :#{adapter_name} storage adapter is a #{found.class}. Only Valkyrie::Storage::Disk " \
+                           '(disk:// ids) can be migrated; see docs/migrating-files-to-s3.md.'
+      rescue Valkyrie::StorageAdapter::AdapterNotFoundError
+        raise Unsupported, "No Valkyrie storage adapter is registered as :#{adapter_name} (registered: " \
+                           "#{Valkyrie::StorageAdapter.storage_adapters.keys.join(', ')}). Set " \
+                           'S3Migration::SourceStorage.adapter_name to the plain disk adapter that holds the files.'
+      end
+
+      # @param identifier [#to_s] a file identifier
+      def handles?(identifier)
+        adapter.handles?(id: Valkyrie::ID.new(identifier.to_s))
+      end
+
+      def path_for(identifier)
+        adapter.file_path(identifier)
+      end
+
+      def base_path
+        adapter.base_path.to_s
+      end
+    end
+  end
+end

data/lib/s3_migration/storage_report.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module S3Migration
+  # Tallies the files by use (original, thumbnail, ...) and storage scheme.
+  class StorageReport
+    # @param progress [S3Migration::Progress, nil] ticked once per file set
+    # @return [Hash{Array<String>=>Array<Integer>}] { [use, scheme] => [file count, bytes] }
+    def self.call(progress: nil)
+      totals = Hash.new { |hash, key| hash[key] = [0, 0] }
+      S3Migration.each_file_set do |file_set|
+        progress&.tick
+        add_files(totals, files_for(file_set))
+      end
+      totals
+    end
+
+    def self.add_files(totals, files)
+      totals[['(file record missing)', '-']][0] += 1 unless files
+      files&.each { |file| add_file(totals, file) }
+    end
+
+    def self.add_file(totals, file)
+      count_and_bytes = totals[[use_for(file), file.file_identifier.to_s[/\A[a-z]+(?=:)/].to_s]]
+      count_and_bytes[0] += 1
+      count_and_bytes[1] += file.recorded_size.first.to_i
+    end
+
+    def self.files_for(file_set)
+      Hyrax.custom_queries.find_files(file_set:)
+    rescue Valkyrie::Persistence::ObjectNotFoundError
+      nil
+    end
+
+    def self.use_for(file)
+      Array(file.pcdm_use).map { |uri| uri.to_s.split('#').last }.join(',')
+    end
+  end
+end

data/lib/s3_migration/stored_checksum.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module S3Migration
+  # The checksum Hyrax recorded for a file at characterization (FileMetadata#checksum). FITS reports
+  # a bare MD5 hex string; an explicit urn:<algorithm>: prefix is also understood. Anything else
+  # (unknown prefix, wrong length) is treated as no checksum rather than as a mismatch.
+  class StoredChecksum
+    ALGORITHMS = { 'md5' => [Digest::MD5, 32], 'sha1' => [Digest::SHA1, 40], 'sha256' => [Digest::SHA256, 64] }.freeze
+
+    attr_reader :algorithm, :digest
+
+    # @return [StoredChecksum, nil] nil when there is no usable checksum
+    def self.for(original)
+      match = /\A(?:urn:(?<algorithm>md5|sha1|sha256):)?(?<digest>\h+)\z/i.match(original.checksum.first.to_s.strip)
+      return unless match
+
+      algorithm = match[:algorithm]&.downcase || 'md5'
+      digest = match[:digest].downcase
+      new(algorithm, digest) if digest.length == ALGORITHMS.fetch(algorithm).last
+    end
+
+    def initialize(algorithm, digest)
+      @algorithm = algorithm
+      @digest = digest
+    end
+
+    def digest_class
+      ALGORITHMS.fetch(algorithm).first
+    end
+
+    def to_s
+      "#{algorithm}:#{digest}"
+    end
+  end
+end

data/lib/s3_migration/tasks.rb

@@ -0,0 +1,186 @@
+# frozen_string_literal: true
+
+module S3Migration
+  # The behaviour behind the s3_migration:* rake tasks. The environment and output are injected so it can be tested.
+  class Tasks
+    # Raised where a task should stop with a message instead of running.
+    class Abort < StandardError; end
+
+    ACTED_ON = %i[quarantined rolled_back].freeze
+
+    # Runs one task for its rake wrapper, turning an Abort into a rake abort.
+    def self.run(name)
+      new.public_send(name)
+    rescue Abort => e
+      abort e.message
+    end
+
+    def initialize(env: ENV, out: $stdout)
+      @env = env
+      @out = out
+    end
+
+    def migrate
+      require_storage!
+      dry_run = flag('DRY_RUN')
+      return enqueue unless dry_run || flag('INLINE')
+
+      out.puts "[DRY RUN] No changes will be made.\n\n" if dry_run
+      migrate_inline(dry_run:)
+    end
+
+    def verify
+      counts = Hash.new(0)
+      each_original(counts) do |file_set, original|
+        guarded(counts, file_set, :problem) { audit_counted?(counts, file_set, original) }
+      end
+      out.puts "\nOK: #{counts[:ok]}  Problems: #{counts[:problem]}  " \
+               "Not yet in S3: #{counts[:not_in_s3]}  No original: #{counts[:no_original]}"
+    end
+
+    def report
+      out.puts 'use | scheme | files | GB'
+      StorageReport.call(progress: Progress.new).sort.each do |(use, scheme), (count, bytes)|
+        out.puts "#{use} | #{scheme} | #{count} | #{(bytes / 1e9).round(2)}"
+      end
+    end
+
+    def quarantine
+      require_storage!
+      out.puts "[DRY RUN] Nothing will be moved. Set APPLY=true to move.\n\n" unless flag('APPLY')
+      each_entry('Quarantine', :quarantine)
+    end
+
+    def rollback
+      require_storage!
+      out.puts "[DRY RUN] Nothing will change. Set APPLY=true to roll back.\n\n" unless flag('APPLY')
+      each_entry('Rolling back', :rollback)
+    end
+
+    def purge
+      require_storage!
+      apply = flag('APPLY')
+      out.puts "[DRY RUN] Nothing will be deleted. Set APPLY=true to delete.\n\n" unless apply
+      purged, kept = Quarantine.purge(apply:, min_age: min_age_days.days)
+      out.puts "#{apply ? 'Deleted' : 'Would delete'}: #{purged}  Too recent: #{kept}"
+    end
+
+    private
+
+    attr_reader :env, :out
+
+    def flag(name, default: 'false')
+      ActiveModel::Type::Boolean.new.cast(env.fetch(name, default))
+    end
+
+    def limit
+      env['LIMIT']&.to_i
+    end
+
+    def min_age_days
+      days = Float(env.fetch('MIN_AGE_DAYS', '14'), exception: false)
+      unless days&.positive? && days.finite?
+        raise Abort,
+              "MIN_AGE_DAYS must be a positive number, got #{env['MIN_AGE_DAYS'].inspect}."
+      end
+
+      days
+    end
+
+    def require_storage!
+      unless Valkyrie::StorageAdapter.storage_adapters.key?(:repository_s3)
+        raise Abort,
+              'Set up the :repository_s3 Valkyrie storage adapter first (see docs/migrating-files-to-s3.md).'
+      end
+
+      SourceStorage.adapter
+    rescue SourceStorage::Unsupported => e
+      raise Abort, e.message
+    end
+
+    def enqueue
+      MigrateFilesJob.perform_later(limit:)
+      out.puts 'Enqueued S3Migration::MigrateFilesJob'
+    end
+
+    def tally(counts)
+      counts.map { |status, count| "#{status}: #{count}" }.join('  ')
+    end
+
+    def each_original(counts, &)
+      progress = Progress.new(detail: -> { tally(counts) })
+      on_error = lambda do |file_set, error|
+        counts[:no_original] += 1
+        out.puts "  NO_ORIGINAL #{file_set.id} - #{missing_original_detail(file_set, error)}"
+      end
+      S3Migration.each_original(limit:, progress:, on_error:, &)
+    end
+
+    def missing_original_detail(file_set, error)
+      if file_set.try(:file_ids).blank?
+        'file set has no files'
+      elsif error.is_a?(Valkyrie::Persistence::ObjectNotFoundError)
+        'original file record not found'
+      else
+        "#{error.class}: #{error.message}"
+      end
+    end
+
+    def migrate_inline(dry_run:)
+      counts = Hash.new(0)
+      each_original(counts) do |file_set, original|
+        guarded(counts, file_set, :error) { migrate_counted?(counts, file_set, original, dry_run:) }
+      end
+      out.puts "\nExamined #{counts.values.sum} file sets. #{tally(counts)}".strip
+      out.puts 'No file sets were found; check the model names and query services.' if counts.empty?
+    end
+
+    # Runs the block for one file set; a StandardError is counted under key and printed, and the run goes on.
+    def guarded(counts, file_set, key)
+      yield
+    rescue StandardError => e
+      counts[key] += 1
+      out.puts "  #{key.to_s.upcase} #{file_set.id} - #{e.class}: #{e.message}"
+      true
+    end
+
+    def audit_counted?(counts, file_set, original)
+      result = Auditor.new(original:).call
+      counts[result.status] += 1
+      return false if result.status == :not_in_s3
+
+      out.puts "  PROBLEM #{file_set.id} - #{result.problems.join('; ')}" if result.status == :problem
+      true
+    end
+
+    def migrate_counted?(counts, file_set, original, dry_run:)
+      result = FileMigrator.new(file_set:, original:, dry_run:).call
+      counts[result.status] += 1
+      return false if result.status == :already_migrated
+
+      out.puts "  #{result.status.to_s.upcase} #{file_set.id} #{result.message}".rstrip
+      true
+    end
+
+    def each_entry(label, action)
+      counts = Hash.new(0)
+      progress = Progress.new(detail: -> { tally(counts) })
+      Manifest.new.each_entry do |entry|
+        progress.tick
+        process_entry(entry, counts, label, action)
+      end
+      out.puts "\n#{tally(counts)}".strip
+      out.puts 'No manifest entries found.' if counts.empty?
+    end
+
+    def process_entry(entry, counts, label, action)
+      status = Quarantine.new(entry, apply: flag('APPLY'),
+                                     verify_sha: flag('VERIFY_SHA', default: 'true')).public_send(action)
+      counts[status] += 1
+      out.puts "  #{label} #{entry[:file_set_id]}" if ACTED_ON.include?(status)
+    rescue StandardError => e
+      counts[:error] += 1
+      out.puts "  ERROR #{entry[:file_set_id]} - #{e.class}: #{e.message}"
+    end
+  end
+end

data/lib/s3_migration/upload_cleanup.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module S3Migration
+  # Removes an upload the database does not point at, along with the manifest entry that names it.
+  class UploadCleanup
+    def initialize(file_set_id:, file_metadata_id:, s3_storage:, manifest:)
+      @file_set_id = file_set_id.to_s
+      @file_metadata_id = file_metadata_id
+      @s3_storage = s3_storage
+      @manifest = manifest
+    end
+
+    # The save can raise after committing (a timeout, say), so the database decides, not the exception.
+    # @param upload_id [Valkyrie::ID, String] the S3 identifier to discard
+    def call(upload_id)
+      upload_id = Valkyrie::ID.new(upload_id.to_s)
+      return if referenced?(upload_id)
+
+      s3_storage.delete(id: upload_id)
+      forget_entry(upload_id)
+    end
+
+    private
+
+    attr_reader :file_set_id, :file_metadata_id, :s3_storage, :manifest
+
+    # When the database cannot be read, keep the upload: the manifest entry still points at it.
+    def referenced?(upload_id)
+      Hyrax.query_service.find_by(id: file_metadata_id).file_identifier == upload_id
+    rescue StandardError
+      true
+    end
+
+    # Only an entry naming this upload goes; another process's entry for the file set stays. Failing here
+    # must not hide the error that sent the migration to cleanup.
+    def forget_entry(upload_id)
+      manifest.delete(file_set_id) if manifest.read(file_set_id)&.dig(:new_id) == upload_id.to_s
+    rescue StandardError => e
+      Hyrax.logger.warn("S3Migration: could not remove the manifest entry for #{file_set_id}: #{e.class}: #{e.message}")
+    end
+  end
+end

data/lib/s3_migration/upload_watch.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module S3Migration
+  # Remembers which objects exist under a file set's prefix before an upload. valkyrie-shrine checks the copy
+  # inside upload, so an upload that fails verification has already written its object, under a key the caller
+  # never receives; this finds and removes it. Only safe while FileLock keeps other jobs from uploading for the
+  # same file set.
+  class UploadWatch
+    def initialize(s3_storage:, file_set_id:)
+      shrine = s3_storage.shrine
+      @bucket = shrine.bucket
+      @prefix = "#{[shrine.prefix, file_set_id].compact.join('/')}/"
+      @before = keys
+    end
+
+    # Removes the objects created since the snapshot. It never raises: it runs while another error is propagating.
+    def discard_new
+      @bucket.objects(prefix: @prefix).each { |object| object.delete unless @before.include?(object.key) }
+    rescue StandardError => e
+      Hyrax.logger.warn("S3Migration: could not remove objects left under #{@prefix}: #{e.class}: #{e.message}")
+    end
+
+    private
+
+    def keys
+      @bucket.objects(prefix: @prefix).map(&:key)
+    end
+  end
+end

data/lib/s3_migration/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module S3Migration
+  VERSION = '0.1.0'
+end

data/lib/s3_migration.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require 'valkyrie/shrine' # Shrine and the S3 adapter's errors are used here; do not rely on the app requiring them
+require 'zeitwerk'
+
+loader = Zeitwerk::Loader.for_gem
+loader.ignore("#{__dir__}/tasks")
+loader.setup
+
+# Moves original files from the disk storage adapter to the S3 repository adapter
+# (see docs/migrating-files-to-s3.md).
+module S3Migration
+  class << self
+    # Hosts that partition one repository into several (e.g. multitenant apps) can set a callable
+    # returning a label for the current partition; manifest entries are then kept per label, so
+    # the quarantine and rollback tasks only see the current partition's files.
+    attr_writer :scope_provider
+
+    def scope_provider
+      @scope_provider ||= -> {}
+    end
+
+    def scope
+      scope_provider.call.presence
+    end
+
+    # Yields every file set stored in the repository, once. Lists each non-Wings query service directly,
+    # once per name Hyrax registers for file sets (Hyrax::ModelRegistry.file_set_classes, which includes
+    # Hyrax.config.file_set_model). The composite query service converts the model it is given, so apps
+    # that store file sets under the legacy "FileSet" name get nothing back when asked through it.
+    def each_file_set
+      return enum_for(:each_file_set) unless block_given?
+
+      seen = Set.new
+      query_services.each do |service|
+        Hyrax::ModelRegistry.file_set_classes.each do |model|
+          service.find_all_of_model(model:).each { |file_set| yield file_set if seen.add?(file_set.id.to_s) }
+        end
+      end
+    end
+
+    # Yields [file_set, original file] for each file set that has an original. A file set whose original
+    # cannot be loaded (for example a dangling file record) goes to on_error and is skipped, so one bad
+    # record does not stop the run.
+    def each_original(limit: nil, progress: nil, on_error: nil)
+      return enum_for(:each_original, limit:, progress:, on_error:) unless block_given?
+
+      done = 0
+      each_file_set do |file_set|
+        break if limit && done >= limit
+
+        progress&.tick
+        original = original_for(file_set, on_error:)
+        next unless original
+
+        done += 1 if yield(file_set, original)
+      end
+    end
+
+    def original_for(file_set, on_error: nil)
+      Hyrax.custom_queries.find_original_file(file_set:)
+    rescue StandardError => e
+      on_error&.call(file_set, e)
+      nil
+    end
+
+    def query_services
+      service = Hyrax.query_service
+      services = service.respond_to?(:services) ? service.services : [service]
+      services.reject { |inner| defined?(Wings::Valkyrie::QueryService) && inner.is_a?(Wings::Valkyrie::QueryService) }
+    end
+  end
+end
+
+require 's3_migration/railtie' if defined?(Rails::Railtie)

data/lib/tasks/s3_migration.rake

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+# Thin wrappers: the work lives in S3Migration::Tasks. See docs/migrating-files-to-s3.md.
+namespace :s3_migration do
+  desc <<~DESC
+    Move original files from the plain disk storage adapter (disk:// ids) to the :repository_s3 adapter. By default this
+    enqueues jobs (one per file set; set S3_MIGRATION_QUEUE to use a dedicated queue). Each upload is
+    verified by SHA-256 read-back, and against the stored characterization checksum, before the identifier
+    is switched; the disk copy is never touched.
+    Env: DRY_RUN=true runs inline and only reports; INLINE=true runs inline for real; LIMIT=<n> files.
+  DESC
+  task migrate: :environment do
+    S3Migration::Tasks.run(:migrate)
+  end
+
+  desc <<~DESC
+    Read-only audit of originals already in S3: object readable, recorded size and stored checksum match.
+    Get zero problems before deleting anything from disk. Env: LIMIT=<n> files.
+  DESC
+  task verify: :environment do
+    S3Migration::Tasks.run(:verify)
+  end
+
+  desc 'Read-only report of file storage by file use and scheme (disk, shrine, ...).'
+  task report: :environment do
+    S3Migration::Tasks.run(:report)
+  end
+
+  desc <<~DESC
+    Move the disk copies of manifested files to <storage>/.quarantine after re-checking the database
+    and the S3 object against the manifest. Dry run unless APPLY=true. VERIFY_SHA=false skips the hash.
+  DESC
+  task quarantine: :environment do
+    S3Migration::Tasks.run(:quarantine)
+  end
+
+  desc 'Undo a migration from the manifest (restores the disk copy and id, removes the unused upload). ' \
+       'Dry run unless APPLY=true.'
+  task rollback: :environment do
+    S3Migration::Tasks.run(:rollback)
+  end
+
+  desc 'Permanently delete the quarantined copies of manifested files older than MIN_AGE_DAYS (default 14). ' \
+       'Dry run unless APPLY=true.'
+  task purge: :environment do
+    S3Migration::Tasks.run(:purge)
+  end
+end