This feels... unsafe. Generally shouldn't construct queries directly from user input. Granted, achievements aren't particularly sensitive data and it's just a find method, so it's not too problematic, but still generally bad practice. Is there a good reason to keep it generic? Could it limit the keys that it accepts from the query object?