Permission errors in send message extension

[rmkerr]

I've set up the extension in the default config. I am able to write to the messages collection fine, and it correctly triggers the ext-send-message-processQueue function. However, the processQueue then throws this error.

Error: 7 PERMISSION_DENIED: Missing or insufficient permissions.
    at Object.callErrorFromStatus (/workspace/node_modules/@grpc/grpc-js/build/src/call.js:31:19)
    at Object.onReceiveStatus (/workspace/node_modules/@grpc/grpc-js/build/src/client.js:190:52)
    at Object.onReceiveStatus (/workspace/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:365:141)
    at Object.onReceiveStatus (/workspace/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:328:181)
    at /workspace/node_modules/@grpc/grpc-js/build/src/call-stream.js:188:78
    at processTicksAndRejections (internal/process/task_queues.js:77:11)
for call at
    at ServiceClientImpl.makeUnaryRequest (/workspace/node_modules/@grpc/grpc-js/build/src/client.js:160:30)
    at ServiceClientImpl.<anonymous> (/workspace/node_modules/@grpc/grpc-js/build/src/make-client.js:105:19)
    at /workspace/node_modules/@google-cloud/firestore/build/src/v1/firestore_client.js:205:29
    at /workspace/node_modules/google-gax/build/src/normalCalls/timeout.js:44:16
    at repeat (/workspace/node_modules/google-gax/build/src/normalCalls/retries.js:80:25)
    at /workspace/node_modules/google-gax/build/src/normalCalls/retries.js:118:13
    at OngoingCallPromise.call (/workspace/node_modules/google-gax/build/src/call.js:67:27)
    at NormalApiCaller.call (/workspace/node_modules/google-gax/build/src/normalCalls/normalApiCaller.js:34:19)
    at /workspace/node_modules/google-gax/build/src/createApiCall.js:81:30 {
  code: 7,
  details: 'Missing or insufficient permissions.',
  metadata: Metadata { internalRepr: Map(0) {}, options: {} },
  note: 'Exception occurred in retry method that was not classified as transient'
}

As far as I can tell this isn't a permission error with the /messages/ store -- I tried allowing public read and write without any change in the behavior.

Other random potentially useful info:

• the phone number I'm trying to send to is verified.
• there appears to be no activity in the onsend function
• I don't have any non-default permissions set up in google cloud or firebase functions
• there are no status updates written to /messages/{id}

Thanks so much for taking a look!