I don't use Cognito, and all authentication / authorization takes place upstream, in API Gateway. Our local tests' leaky abstractions don't care about anything

I don't use Cognito, and all authentication / authorization takes place upstream, in API Gateway. Our local tests' leaky abstractions don't care about anything happening upstream. They only care about testing our core "agnostic" logic.