Demonstration of using Apex as a conduit for accessing the Salesforce1 Reporting REST API in Lightning

S1Reporting.cls

public class S1Reporting {
	
    /*
     * @see Salesforce1 Reporting REST API Developer Guide
     */
    public class GetAnalyticsReportsResponseBody {
        
        @AuraEnabled
        public String name;
        
        @AuraEnabled
        public String id;
        
        @AuraEnabled
        public String url;
        
        @AuraEnabled
        public String describeUrl;
        
        @AuraEnabled
        public String instancesUrl;
    }
}

S1ReportingClient.cls

public class S1ReportingClient {
    
    public static final String OPERATION_PREFIX = '/services/data/v32.0';
    
    public String accessToken;
    
    public String hostname;
    
    public HttpResponse lastHttpResponse;
    
    public S1ReportingClient(String hostname, String accessToken) {
        this.accessToken = accessToken;
        this.hostname = hostname;
    }
        
    public Boolean getAnalyticsReports() {
        HttpRequest request = new HttpRequest();
        request.setMethod('GET');
        request.setEndpoint(getHttpsEndpoint('/analytics/reports'));
        request.setHeader('Authorization', 'Bearer ' + accessToken);
        
        lastHttpResponse = new Http().send(request);
        System.debug('lastHttpResponse.getBody(): ' + lastHttpResponse.getBody());        
        return lastHttpResponse.getStatusCode() == 200;
    }
    
    public List<S1Reporting.GetAnalyticsReportsResponseBody> getAnalyticsReportsResponse() {
        return (List<S1Reporting.GetAnalyticsReportsResponseBody>)JSON.deserialize(
            lastHttpResponse.getBody(), List<S1Reporting.GetAnalyticsReportsResponseBody>.class);
    }
    
    public String getHttpsEndpoint(String operation) {
        return 'https://' + hostname + OPERATION_PREFIX + operation;
    }
}

S1ReportingClientController.js

({
    handleInit : function(component, event, helper) {
        var self = this;  // safe reference
        
        var getAnalyticsReports =
            component.get("c.getAnalyticsReports");
        
        getAnalyticsReports.setCallback(self, function(a) {
            console.log("returned: %o", a.getReturnValue());
            component.set("v.reports", a.getReturnValue());
        });
        
        $A.enqueueAction(getAnalyticsReports);
    }
})

S1ReportingDemo.app

<aura:application controller="ccmt.S1ReportingDemoController">
    <aura:attribute name="reports" type="Object[]"/>
    <aura:handler name="init" value="{!this}" action="{!c.handleInit}"/>
    
    <h1>Salesforce1 Reporting REST API Demo</h1>
    
    <aura:iteration items="{!v.reports}" var="report">
        <h2>{!report.name}</h2>
        <ul>
            <li>name: {!report.name}</li>
            <li>id: {!report.id}</li>
            <li>url: {!report.url}</li>
            <li>describeUrl: {!report.describeUrl}</li>
            <li>instancesUrl: {!report.instancesUrl}</li>
        </ul>
    </aura:iteration>
</aura:application>

S1ReportingDemoController.cls

public class S1ReportingDemoController {
	
    @AuraEnabled
    public static List<S1Reporting.GetAnalyticsReportsResponseBody> getAnalyticsReports() {
        
        // The server or hostname must be added as a remote site
        // in Setup > Security Controls > Remote Site Settings
        String server = 'ccmt-dev-ed.my.salesforce.com';
        
        // Construct a new REST API client to connect to the
        // specified server, using the current user's Session ID
        // as the OAuth access token
        S1ReportingClient client = new S1ReportingClient(
            server, UserInfo.getSessionId());
        
        // Attempt the desired operation, and return the
        // parsed response if successful, or return null
        // if unsuccessful
        return client.getAnalyticsReports()
            ? client.getAnalyticsReportsResponse() : null;
    }
}

From the docs, you need to use a Named Credential:
https://developer.salesforce.com/docs/atlas.en-us.lightning.meta/lightning/apex_api_calls.htm#apex_api_calls

By security policy, sessions created by Lightning components aren’t enabled for API access. This prevents even your Apex code from making API calls to Salesforce. Using a named credential for specific API calls allows you to carefully and selectively bypass this security restriction.
The restrictions on API-enabled sessions aren’t accidental. Carefully review any code that uses a named credential to ensure you’re not creating a vulnerability.