Question regarding authentication for calling GraphQL interfaces from web front-end applications

#### What is your question?

I would like to ask how to invoke the GraphQL in this project.
The authorization_code_exchange_lambda created in cms_auth (which abstracts requests to the token endpoint) does not expose any publicly accessible API.
On the other hand, to use the API provided via GraphQL in the cms_api module, it is necessary to obtain an access token.
In the current implementation, it seems that in order to use this API from a web frontend or similar, it is necessary to be able to invoke the authorization_code_exchange_lambda directly via an SDK or similar.
In CMS on AWS, is it assumed that users will prepare their own set of wrapper APIs around authorization_code_exchange_lambda for usage? For example:

- /oauth2/authorize - RFC 6749 (OAuth 2.0)
- /oauth2/token - RFC 6749 (OAuth 2.0)
- /oauth2/revoke - RFC 7009 (Token Revocation)
- /oauth2/userInfo - OpenID Connect Core 1.0
- /.well-known/openid_configuration - OpenID Connect Discovery 1.0
- /.well-known/jwks.json - RFC 7517 (JSON Web Key)

Alternatively, if using Cognito as the IdP, would it be unnecessary to consider implementing the above, by directly using the APIs provided by Cognito?