Bug: refactor(reports): Change permissions for report APIs



Currently internal users are unable to use report APIs as some of them require Write permission which internal view only users doesn't have.

We need to change the permission required to access report APIs.
diff --git a/crates/api_models/src/user_role.rs b/crates/api_models/src/user_role.rs
index 6dde3eb888a..089e22a62a4 100644
--- a/crates/api_models/src/user_role.rs
+++ b/crates/api_models/src/user_role.rs
@@ -35,6 +35,7 @@ pub enum Permission {
     PayoutWrite,
     PayoutRead,
     WebhookEventWrite,
+    GenerateReport,
 }
 
 #[derive(Debug, serde::Serialize)]
diff --git a/crates/router/src/analytics.rs b/crates/router/src/analytics.rs
index cb34b8f6e93..3cde172d231 100644
--- a/crates/router/src/analytics.rs
+++ b/crates/router/src/analytics.rs
@@ -649,7 +649,7 @@ pub mod routes {
                 .await
                 .map(ApplicationResponse::Json)
             },
-            &auth::JWTAuth(Permission::Analytics),
+            &auth::JWTAuth(Permission::GenerateReport),
             api_locking::LockAction::NotApplicable,
         ))
         .await
@@ -691,7 +691,7 @@ pub mod routes {
                 .await
                 .map(ApplicationResponse::Json)
             },
-            &auth::JWTAuth(Permission::Analytics),
+            &auth::JWTAuth(Permission::GenerateReport),
             api_locking::LockAction::NotApplicable,
         ))
         .await
@@ -733,7 +733,7 @@ pub mod routes {
                 .await
                 .map(ApplicationResponse::Json)
             },
-            &auth::JWTAuth(Permission::PaymentWrite),
+            &auth::JWTAuth(Permission::GenerateReport),
             api_locking::LockAction::NotApplicable,
         ))
         .await
diff --git a/crates/router/src/services/authorization/permission_groups.rs b/crates/router/src/services/authorization/permission_groups.rs
index f3275a78fd0..c31e3d32b1f 100644
--- a/crates/router/src/services/authorization/permission_groups.rs
+++ b/crates/router/src/services/authorization/permission_groups.rs
@@ -19,14 +19,15 @@ pub fn get_permissions_vec(permission_group: &PermissionGroup) -> &[Permission]
     }
 }
 
-pub static OPERATIONS_VIEW: [Permission; 7] = [
+pub static OPERATIONS_VIEW: [Permission; 8] = [
     Permission::PaymentRead,
     Permission::RefundRead,
     Permission::MandateRead,
     Permission::DisputeRead,
     Permission::CustomerRead,
-    Permission::MerchantAccountRead,
+    Permission::GenerateReport,
     Permission::PayoutRead,
+    Permission::MerchantAccountRead,
 ];
 
 pub static OPERATIONS_MANAGE: [Permission; 7] = [
@@ -35,8 +36,8 @@ pub static OPERATIONS_MANAGE: [Permission; 7] = [
     Permission::MandateWrite,
     Permission::DisputeWrite,
     Permission::CustomerWrite,
-    Permission::MerchantAccountRead,
     Permission::PayoutWrite,
+    Permission::MerchantAccountRead,
 ];
 
 pub static CONNECTORS_VIEW: [Permission; 2] = [
@@ -65,8 +66,11 @@ pub static WORKFLOWS_MANAGE: [Permission; 5] = [
     Permission::MerchantAccountRead,
 ];
 
-pub static ANALYTICS_VIEW: [Permission; 2] =
-    [Permission::Analytics, Permission::MerchantAccountRead];
+pub static ANALYTICS_VIEW: [Permission; 3] = [
+    Permission::Analytics,
+    Permission::GenerateReport,
+    Permission::MerchantAccountRead,
+];
 
 pub static USERS_VIEW: [Permission; 2] = [Permission::UsersRead, Permission::MerchantAccountRead];
 
diff --git a/crates/router/src/services/authorization/permissions.rs b/crates/router/src/services/authorization/permissions.rs
index 583b22fe86c..36ed89f4a44 100644
--- a/crates/router/src/services/authorization/permissions.rs
+++ b/crates/router/src/services/authorization/permissions.rs
@@ -34,6 +34,7 @@ pub enum Permission {
     WebhookEventWrite,
     PayoutRead,
     PayoutWrite,
+    GenerateReport,
 }
 
 impl Permission {
@@ -75,6 +76,7 @@ impl Permission {
             Self::WebhookEventWrite => "Trigger retries for webhook events",
             Self::PayoutRead => "View all payouts",
             Self::PayoutWrite => "Create payout, download payout data",
+            Self::GenerateReport => "Generate reports for payments, refunds and disputes",
         }
     }
 }
diff --git a/crates/router/src/utils/user_role.rs b/crates/router/src/utils/user_role.rs
index d0ad08848ca..b1fa4c3a178 100644
--- a/crates/router/src/utils/user_role.rs
+++ b/crates/router/src/utils/user_role.rs
@@ -47,6 +47,7 @@ impl From<Permission> for user_role_api::Permission {
             Permission::WebhookEventWrite => Self::WebhookEventWrite,
             Permission::PayoutRead => Self::PayoutRead,
             Permission::PayoutWrite => Self::PayoutWrite,
+            Permission::GenerateReport => Self::GenerateReport,
         }
     }
 }

## Type of Change
<!-- Put an `x` in the boxes that apply -->

- [ ] Bugfix
- [ ] New feature
- [ ] Enhancement
- [x] Refactoring
- [ ] Dependency updates
- [ ] Documentation
- [ ] CI/CD

## Description
<!-- Describe your changes in detail -->
Currently, internal users are unable to access payment generate report as it requires `PaymentWrite`.

And other reports are having `Analytics` permission, but in the Front-end, the option is in Operations tab and in Analytics tab.

Because Generate reports option is present in both Analytics and Operations, there will be a new permission, which will be available for both Operations and Analytics groups.

### Additional Changes

- [x] This PR modifies the API contract
- [ ] This PR modifies the database schema
- [ ] This PR modifies application configuration/environment variables

<!--
Provide links to the files with corresponding changes.

Following are the paths where you can find config files:
1. `config`
2. `crates/router/src/configs`
3. `loadtest/config`
-->


## Motivation and Context
<!--
Why is this change required? What problem does it solve?
If it fixes an open issue, please link to the issue here.

If you don't have an issue, we'd recommend starting with one first so the PR
can focus on the implementation (unless it is an obvious bug or documentation fix
that will have little conversation).
-->
Closes #5177.

## How did you test it?
<!--
Did you write an integration/unit/API test to verify the code changes?
Or did you test this change manually (provide relevant screenshots)?
-->
```
curl 'http://localhost:8080/analytics/v1/report/payments' \
  -H 'authorization: Bearer Internal user JWT' \
  --data-raw '{"timeRange":{"startTime":"2024-07-01T11:34:38Z","endTime":"2024-07-02T11:34:38.441Z"},"dimensions":[]}'
```

When this API is hit by a internal user, this API should send email with report.

## Checklist
<!-- Put an `x` in the boxes that apply -->

- [x] I formatted the code `cargo +nightly fmt --all`
- [x] I addressed lints thrown by `cargo clippy`
- [x] I reviewed the submitted code
- [ ] I added unit tests for my changes where possible
