don't allow courses in the site admin tree at all

Change-Id: I1b8a51dc2191a5f376897eb77f96ac120b75eed0
Reviewed-on: https://gerrit.instructure.com/61259
Reviewed-by: Rob Orton <rob@instructure.com>
Tested-by: Jenkins
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>

app/models/account.rb

@@ -924,7 +924,7 @@ class Account < ActiveRecord::Base
     given { |user|
       result = false
 
-      if !site_admin? && user
+      if !root_account.site_admin? && user
         scope = root_account.enrollments.active.where(user_id: user)
         result = root_account.teachers_can_create_courses? &&
             scope.where(:type => ['TeacherEnrollment', 'DesignerEnrollment']).exists?

spec/models/account_spec.rb

@@ -525,6 +525,16 @@ describe Account do
     expect(a.grants_right?(@user, :create_courses)).to be_truthy
   end
 
+  it "does not allow create_courses even to admins on site admin and children" do
+    a = Account.site_admin
+    a.settings = { :no_enrollments_can_create_courses => true }
+    manual = a.manually_created_courses_account
+    user
+
+    expect(a.grants_right?(@user, :create_courses)).to eq false
+    expect(manual.grants_right?(@user, :create_courses)).to eq false
+  end
+
   it "should correctly return sub-accounts as options" do
     a = Account.default
     sub = Account.create!(:name => 'sub', :parent_account => a)