The views_authz.js tests should be merged into the auth commands library and the file removed. However, it's currently not possible because jstests/auth/commands_builtin_roles.js runs tests with subsets of the privileges specified in individual testcases, and the views authz special cases require an exact match. We should add an expectAuthzFailExact flag for an individual testcase and update the test runner appropriately.
In addition, once
SERVER-24769 is complete, we can expand our authz test coverage by testing a successful $lookup/$graphLookup (directly and via $facet) on a series of views for which the user is authorized.